The decision from issue #128: app major -> chart major, app minor ->
chart MINOR, patch/digest -> chart patch, as a maximum against the
chart's own classification rather than a replacement. The level comes
from Renovate's update type, since an appVersion comparison is blind to
the update that prompted it - freesailarr's appVersion never moves.
Versioning carries the rule, Renovate the hook and its measurements,
Workflow the wiki exception where "plain" is now mechanically defined,
CI-CD the new bump-level job, and Lessons-Learned the decision together
with its limit: the reading duty was rejected, so the incident that
lesson is about stays repeatable and the honest number is the whole of
the remedy.
Chart-Style-Guide, ytdlp-web-player, bulwark and stalwart each carried
a sentence calling the hook's result a chart patch, which it no longer
always is.
freesailarr, Renovate, Lessons learned: the grouped stack PR and the security default a patch bump switched off
The chart's trustedNetworks value for prowlarr, radarr and sonarr, with the
consequence written as it is: the default is empty, so the chart does not
restore the forwarded-header trust that prowlarr 2.6.3 and radarr 6.4.3
removed, and sonarr has been without it since before 4.0.19.
Renovate: the first grouped chart, the two rules it takes because
matchUpdateTypes and separateMinorPatch are rejected in one rule, and the
measured branch split without the second rule.
Lessons learned: a plain app-version bump switched off a security default,
and that is the one update class the wiki obligation exempts.
Gateway API as the second routing mode (pilot on cyberchef)
Documents Gitea #114's pilot, which is in helm-charts PR #115.
Chart-Style-Guide §4 becomes "Ingress and Gateway API" and carries the
binding form: HTTPRoute with parentRefs only - no Gateway, no
gatewayClassName, no certificate, no implementation-specific policy object,
because that subset is identical on nginx-gateway-fabric, Cilium, Envoy
Gateway and Istio. Plus the four guards (a value instead of auto-detection,
mutual exclusion with ingress.enabled, mandatory parentRefs, one source of
truth for the hostname) and what has no counterpart at all: proxy-body-size
and auth annotations. The §4 anchor changed, so the reference on the
homeassistant page moved with it.
CI-CD gains the httproute-match job as #5 (install-test renumbered to #7)
and a section on the Gateway-API CRD fixture - why it is real rather than a
stub, why --server-side (the CRD is 244792 bytes as JSON against a 262144
byte annotation limit), and why it is not in ci/common/.
cyberchef gains the httpRoute values, a "Routing modes" section, the
attachment check, and the honest version of its CI section: its install-test
now runs in Gateway mode, which gives up installing the Ingress and buys a
route validated against a real schema. What stays unprovable is named -
nothing routes in k3d.
template-chart carries the reference implementation; New-Chart gains the
overlay obligation; Renovate replaces the blanket "ci/** is not managed"
with the distinction that was always meant - a fixture image stays
unmanaged, a pinned tool is tracked wherever it lives.
Lessons-Learned: the stub CRD that would have proved nothing.
keycloak: new chart page, index, sidebar, and three rules it bought
The chart page carries the values table, the vault fields, the first-install
checklist with the permanent administrator as a mandatory step, the
minor-upgrade procedure, and the traps - of which two are the point of the
page: hostname-admin is not an access control, and a shared database merges two
clusters.
Chart index counter: 30 directories / 29 installable. That follows the index
TABLE, which already lists convertx - its page landed before its PR, and
convertx/ does not exist on origin/main yet. So the number is one ahead of the
repository on purpose, as it was before this change.
Renovate: the counter-case to garage, measured rather than assumed - four tag
shapes on quay.io/keycloak/keycloak and plain docker versioning already excludes
the three unwanted ones, so that block carries no versioningTemplate. Written
down because an unnecessary constraint is not free: it reads as load-bearing to
the next person and has to stay correct as upstream's tagging changes. Plus a
section on the automerge decision: switching it off for minor and major was
proposed and declined, so the upgrade procedure is documented instead of
prevented, with the obligation that puts on whoever reviews an app-version PR.
Chart style guide section 11: a chart defaulting to more than one replica ships
a PodDisruptionBudget, and it is rendered only while the computed replica count
is >= 2 - minAvailable 1 with a single replica blocks every drain forever with a
message that names the PDB rather than the replica count.
CI/CD: the trusted-registry list for AVD-KSV-0125 is a separate file from the
ignore file on purpose, so a new registry is an entry there rather than a
suppression. quay.io joined it with this chart.
Lessons learned, two entries and three lines in the recurring shape:
- "The application that rewrites its own installation at start" - three correct
requirements that cannot start a pod together, and why the obvious repair
(an empty volume over the directory) breaks the command meant to fill it.
- "The upgrade procedure the automerge did not know about" - the general form,
which applies to any clustered application whose versions must not be mixed:
a constraint living in documentation is invisible to the machinery that
performs upgrades, and the better the pipeline, the less likely anybody is
standing in the path to notice.
Renovate: a registry with a tag per commit needs a version constraint
The garage block's reason, as the general rule: an anchor keeps floating names
out, but a constraint is what keeps 40-character commit-SHA tags out - and on
dxflrs/garage those are the 22 newest tags in the registry (measured
2026-10-03) while the current release is three weeks old. Prereleases and
internal builds come with it, and ordering does not exclude them:
v1.99.3-internal sorts above the whole v1.3.x line.
Renovate: the PR policy after the alignment with cluster-config
The config now matches cluster-config's: global automerge with
platformAutomerge, no PR caps, separateMinorPatch, config:best-practices.
Two statements on these pages had become false and are rewritten rather
than left standing: that Renovate merges its own PRs because main has no
required status checks, and that majors are merged by hand. Both are
active on main now - a review requirement and validate-charts as the
single status context the matrix reports under - which is precisely why
platformAutomerge could be turned on and why automerging majors is not
unattended: the review is the gate.
Touches Renovate (PR policy), Forge-and-Tooling (auto-merge, required
check), Versioning (the order of a stepwise major jump is kept at the
review now), CI-CD (required check, why the install-test blocks), and the
two pages quoting the searxng downgrade as something that happened
"unattended".
One page per chart - prerequisites, installation walkthrough, the required
1Password fields, the complete values reference and the chart's operating
traps - plus the long form of the workflow, the forge and its measured
differences, the pipelines, versioning, Renovate, the chart style guide, the
procedure for a new chart, local development, and the incidents each rule was
bought with.
Chart pages quote versions as snapshots; Chart.yaml stays authoritative,
because Renovate moves app versions continuously and never edits the wiki.
jklein