jklein
bd1fdc09a0
Validate Helm Charts / Detect changed charts (pull_request) Successful in 4s
Validate Helm Charts / Resource quantities (pull_request) Successful in 14s
Validate Helm Charts / Selector match (pull_request) Successful in 14s
Validate Helm Charts / HTTPRoute match (pull_request) Successful in 14s
Validate Helm Charts / Build freesailarr (pull_request) Successful in 7s
Validate Helm Charts / Build outline (pull_request) Successful in 7s
Validate Helm Charts / Build paperless-ngx (pull_request) Successful in 8s
Validate Helm Charts / Build zipline (pull_request) Successful in 8s
Validate Helm Charts / Build calibre-web-automated (pull_request) Successful in 7s
Validate Helm Charts / Trivy config calibre-web-automated (pull_request) Successful in 19s
Validate Helm Charts / Trivy config freesailarr (pull_request) Successful in 24s
Validate Helm Charts / Trivy config outline (pull_request) Successful in 17s
Validate Helm Charts / Trivy config paperless-ngx (pull_request) Successful in 19s
Validate Helm Charts / Trivy config zipline (pull_request) Successful in 19s
Install-test / Install-test calibre-web-automated (pull_request) Successful in 2m11s
Install-test / Install-test freesailarr (pull_request) Successful in 3m55s
Install-test / Install-test outline (pull_request) Successful in 2m44s
Install-test / Install-test paperless-ngx (pull_request) Successful in 3m52s
Install-test / Install-test zipline (pull_request) Successful in 2m6s
Validate Helm Charts / Install-test (pull_request) Successful in 14m50s
Group 2 of the #114 sweep: the charts whose behaviour hangs off an nginx annotation - calibre-web-automated, outline, paperless-ngx, zipline (proxy-body-size) and freesailarr (rewrite-target). Each gets the form the pilot (cyberchef, PR #115) fixed and group 1 (PR #116) repeated: an httpRoute block off by default, a template rendering ONLY an HTTPRoute with parentRefs - no Gateway, no gatewayClassName, no Certificate, no implementation-specific policy object - render aborts on both modes at once (naming both value paths), on an empty parentRefs and on a missing hostname, empty hostnames meaning [ingress.domain], a schema entry closed against unknown keys with an open parentRef definition, and a NOTES.txt that names the active mode and what the mode costs. Minor, additive, defaults unchanged: `helm template` with each chart's CI values is byte-identical to origin/main for all five. The upload limit is DOCUMENTED, not rebuilt (decision 2 of the issue). The Gateway API knows no body size; a policy object would bind the chart to one implementation. So the Gateway branch of NOTES.txt says, per chart and in the chart's own terms, that the value is NOT ENFORCED and names where to set it: an e-book library (calibre), an upload service (zipline), the web-UI half of the document intake while the consume directory keeps no limit at all (paperless), and the open #12 pair (outline). Four findings that were not in the plan, each argued in the file it changes: freesailarr gated freesailarr.sharedIngressApps on ingress.enabled, and that list is read by the <APP>__SERVER__URLBASE variables as well as by the routing objects. In Gateway mode it would have come out EMPTY while the route served radarr, sonarr and prowlarr under their prefixes: UrlBase unset, assets and API calls linked at the host root, broken UI behind a Ready pod. The helper's two guards (seerr/mediathekarr only at "/", no duplicate paths) would have gone unenforced there too. Fixed with freesailarr.published (ingress.enabled OR httpRoute.enabled) - the same shape as sure.publishedOverTls in group 1, and identical to ingress.enabled while httpRoute.enabled is false. Measured: on origin/main with ingress.enabled: false the render emits ZERO URLBASE variables; with this change in Gateway mode it emits three. paperless-ngx was the last chart in the repository rendering its Ingress UNCONDITIONALLY. Without an ingress.enabled switch there is no second value path for the mutual-exclusion abort to name, and the Ingress plus its unconditional required() on clusterIssuer would have kept rendering in Gateway mode - a value demanded for nothing, which is issue #114's "Folge 1" and README guideline 12. The switch was added, defaulting to true, so the render is unchanged. paperless-ngx PAPERLESS_URL had no required() of its own: it relied on the Ingress template's, which stops firing the moment the Ingress is switchable. With httpRoute.hostnames set and ingress.domain empty it would have rendered "https://" and refused every login POST as a CSRF failure. It now carries its own required(), naming what the value is for. calibre-web-automated claimed, in values.yaml and in its schema, that ingress.domain is read nowhere but in the Ingress template. The HTTPRoute reads it, so the claim now holds only while both modes are off. Corrected rather than left standing - the same correction garage needed in group 1. freesailarr is where the Gateway API is LESS machinery than what it replaces, not a translation of it. rewrite-target applies per Ingress OBJECT, so qBittorrent (no base path, prefix must be stripped) needed a second Ingress on the shared host, which then had to repeat the first object's TLS secret name, omit the cert-manager annotation conditionally so only one Certificate is requested, and match an ImplementationSpecific regex path for the rewrite's capture group. A URLRewrite filter applies per RULE: one route, one rule per app, the filter on qBittorrent's rule, a plain PathPrefix. All four crutches gone. It is also the only chart without httpRoute.hostnames - it has no ingress.domain either, and a chart-global hostname list could not say which of the ten apps it belonged to, so the hostnames stay in ingress.host and <app>.ingress.host. CI: one render overlay per chart under ci/httproute/, so the assertion is not vacuum-green - ci/run-httproute-match-test.sh goes from 20 held assertions over 10 charts to 36 over 15. freesailarr's overlay moves bazarr onto a host of its own, so the shared-host route AND the per-app route are both rendered; without that the per-app branch would be exercised by nothing. The install-test fixtures stay in Ingress mode: the install runs one configuration per chart, cyberchef already pays that price against the real Gateway-API CRDs, and for paperless-ngx that fixture is the only install of the valkey-subchart path anywhere. README also carries a stale figure fixed here: the HTTPRoute test was still documented at the pilot's 4 assertions over 2 charts, although group 1 had taken it to 20 over 10. Not proven, by construction: that traffic flows. No Gateway controller runs in CI. Not run locally either: k3d, Docker, Trivy. The Gateway branch of NOTES.txt is EXECUTED by the render test (a template error in it fails the job, verified) but its text is printed by no pipeline stage - helm template does not emit notes, and the install-test installs in Ingress mode. Part of #114
90 lines
4.8 KiB
YAML
90 lines
4.8 KiB
YAML
apiVersion: v2
|
|
name: paperless-ngx
|
|
description: A Helm chart to deploy Paperless-NGX on Kubernetes
|
|
icon: https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/dev/src-ui/src/apple-touch-icon.png
|
|
|
|
type: application
|
|
|
|
version: 12.3.0+up3.2.1
|
|
|
|
appVersion: 3.2.1
|
|
|
|
maintainers:
|
|
- name: jklein
|
|
|
|
# The third chart in this repo with a dependency (after ytdlp-web-player and
|
|
# stalwart). README, "Chart dependencies", holds the bar a dependency has to
|
|
# clear and the full price list; what is repeated here is only what is specific
|
|
# to THIS chart, because the generic half is already written down twice.
|
|
#
|
|
# WHY ONE HERE. paperless-ngx cannot run without a Redis: PAPERLESS_REDIS is
|
|
# the Celery broker, and without it the web UI comes up looking healthy while
|
|
# consumption, OCR, the scheduled tasks and the index updates never run. So
|
|
# every installation needs one, and before this block the only way to have one
|
|
# was a second Helm release whose address lived in a 1Password item and in
|
|
# neither chart.
|
|
#
|
|
# WHY IT IS OFF BY DEFAULT: an installation that already has a Redis (or wants
|
|
# a shared one, which is what secrets.redisSecretRef' key-prefix field exists
|
|
# for) points redis-connection-url at it, and this dependency renders nothing.
|
|
# The subchart is the path for an installation that has none.
|
|
#
|
|
# THE SUBCHART IS OUR OWN valkey CHART, resolved from the published index - not
|
|
# upstream's. So README guideline 14.2 ("we consume their chart as it comes")
|
|
# does not apply and there are no third-party defaults to leave unpatched: the
|
|
# subchart follows this repo's conventions because it IS this repo's chart.
|
|
# What does apply in full is the subchart being invisible to everything
|
|
# downstream that watches Helm release versions, and the PR-ordering hazard
|
|
# below.
|
|
dependencies:
|
|
- name: valkey
|
|
# KEEP THIS VERSION MOVING - it is the only path a Valkey update has into a
|
|
# cluster through this chart. The version declared here is baked into our
|
|
# packaged .tgz, so anything watching Helm release versions (Fleet
|
|
# included) sees only "paperless-ngx": a new valkey chart, a security fix
|
|
# included, arrives ONLY when this line is raised and a new paperless-ngx
|
|
# version is published. Nothing reports the gap.
|
|
#
|
|
# Renovate's BUILT-IN helmv3 manager reads this block and opens the PR, and
|
|
# ci/renovate-bump-chart.sh bumps this chart's patch version, which is what
|
|
# actually ships it. No customManagers entry exists or would help - that
|
|
# manager is for exactly this case, where repository and version sit
|
|
# together in one file. Measured for Gitea #65 against our self-hosted
|
|
# index (Renovate 44.132.2, dry run with the dependency pinned low:
|
|
# newVersion "1.0.0+up9.1.2.alpine", versioning "helm"), so the chain is
|
|
# proven for this registry and this build-metadata suffix and was not
|
|
# re-measured here.
|
|
#
|
|
# Independent of appVersion: raising it is a patch or minor bump of this
|
|
# chart and is never tied to the paperless-ngx image.
|
|
version: "1.0.0+up9.1.2.alpine"
|
|
# Our own published index, and the READ path only - anonymously readable
|
|
# (measured), so ci/helm-dependencies.sh needs no credential and was not
|
|
# touched. The publish target and its credentials still live in 1Password
|
|
# and appear nowhere in this repository; see README, "CI/CD".
|
|
repository: "https://git.jk-dev.de/api/packages/jlab-cluster/helm"
|
|
# Off by default, so a plain install renders none of its objects.
|
|
#
|
|
# NOT "valkey.enabled", AND THAT IS NOT A STYLE CHOICE. Everything under
|
|
# the "valkey:" key is handed to the subchart as ITS values and validated
|
|
# against ITS schema, and our valkey chart ships additionalProperties:
|
|
# false with no "enabled" property:
|
|
# Error: values don't meet the specifications of the schema(s) in the
|
|
# following chart(s): valkey: - at '': additional properties 'enabled'
|
|
# not allowed
|
|
# Worse, Helm skips a DISABLED subchart's schema validation, so with the
|
|
# default of false that error would stay invisible through lint, render and
|
|
# install-test and surface only for whoever first switched it on - the one
|
|
# case the value exists for. The condition is therefore a key of OUR OWN,
|
|
# outside the subchart's value subtree.
|
|
condition: valkeySubchart.enabled
|
|
#
|
|
# !!! NEVER CHANGE valkey/ AND THIS CHART IN THE SAME PULL REQUEST !!!
|
|
#
|
|
# The dependency resolves out of the PUBLISHED index, not out of the working
|
|
# tree, and valkey/ is published only by a push to main that touches it. A
|
|
# single PR carrying both therefore runs lint, package, render AND the
|
|
# install-test against the OLD valkey .tgz and goes green about an artifact
|
|
# that is not the one in the diff. Two consecutive pull requests: change
|
|
# valkey/, merge, let it publish, then raise the version here. README, "Chart
|
|
# dependencies", and the wiki's valkey page carry the long form. |