fix: adjust secret

Signed-off-by: Christian Hopf <git@ckotzbauer.de>
2026-10-21 11:47:32 +02:00 · 2026-03-17 19:08:08 +01:00
parent d7e7853a2f
commit 4dc78362fb
3 changed files with 40 additions and 12 deletions
@@ -28,7 +28,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          repository: ckotzbauer/helm-charts
-          token: ${{ secrets.CR_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS }}

      - name: Calculate new chart version
        id: version
@@ -104,7 +104,7 @@ jobs:
        id: create-pr
        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7
        with:
-          token: ${{ secrets.CR_TOKEN }}
+          token: ${{ secrets.REPO_ACCESS }}
          commit-message: "feat: update ${{ inputs.chart }} to ${{ inputs.app-version }}"
          branch: "bump/${{ inputs.chart }}-${{ inputs.app-version }}"
          title: "feat: update ${{ inputs.chart }} to ${{ inputs.app-version }}"
@@ -121,4 +121,4 @@ jobs:
        if: steps.create-pr.outputs.pull-request-number
        run: gh pr merge "${{ steps.create-pr.outputs.pull-request-number }}" --auto --merge
        env:
-          GH_TOKEN: ${{ secrets.CR_TOKEN }}
+          GH_TOKEN: ${{ secrets.REPO_ACCESS }}
@@ -35,7 +35,7 @@ jobs:
      - name: Run chart-releaser
        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
        env:
-          CR_TOKEN: "${{ secrets.CR_TOKEN }}"
+          CR_TOKEN: "${{ secrets.REPO_ACCESS }}"

  release-oci:
    runs-on: ubuntu-latest
@@ -40,6 +40,7 @@ helm-charts/
 ```

 Each chart follows a standard structure:
+
 ```
 charts/<name>/
 ├── Chart.yaml
@@ -61,6 +62,7 @@ charts/<name>/
 ## Charts Overview

 ### 1. access-manager
+
 - **Chart version:** 0.14.1 | **App version:** 0.13.0 | **API version:** v1
 - **Purpose:** Kubernetes operator to simplify RBAC configurations. Manages `RbacDefinition` and `SyncSecretDefinition` custom resources (CRDs defined inline in `templates/crd.yaml`).
 - **Image:** `ghcr.io/ckotzbauer/access-manager` (pinned by SHA256 digest)
@@ -70,6 +72,7 @@ charts/<name>/
 - **Key values:** `replicas`, `image`, `resources` (defaults: 10m/128Mi request, 50m/128Mi limit), `securityContext` (non-root UID 1001, read-only root filesystem, all capabilities dropped)

 ### 2. cadvisor
+
 - **Chart version:** 2.4.1 | **App version:** 0.52.1 | **API version:** v1
 - **Purpose:** Deploys Google cAdvisor as a DaemonSet for container resource monitoring and metrics export.
 - **Image:** `gcr.io/cadvisor/cadvisor:v0.52.1` (pinned by SHA256 digest)
@@ -81,6 +84,7 @@ charts/<name>/
 - **Key values:** `container.additionalArgs` (housekeeping intervals, disabled metrics), `container.hostPaths`, `metrics.enabled/interval/scrapeTimeout`, `podSecurityPolicy.create`, `commonLabels`, `podLabels`

 ### 3. chekr
+
 - **Chart version:** 0.5.1 | **App version:** 0.5.1 | **API version:** v2, type: application
 - **Purpose:** Inspection utility for Kubernetes cluster maintenance. Runs scheduled checks (deprecation analysis, resource usage) as CronJobs and serves HTML/JSON reports via an nginx webserver Deployment.
 - **Images:** `ghcr.io/ckotzbauer/chekr` (job, pinned by digest) + `nginxinc/nginx-unprivileged:mainline-alpine` (webserver, pinned by digest)
@@ -93,6 +97,7 @@ charts/<name>/
 - **CI values:** `charts/chekr/ci/ci-values.yaml` overrides persistence to `storageClass: "standard"`, `accessMode: ReadWriteOnce`

 ### 4. postgres-operator
+
 - **Chart version:** 1.12.0 | **App version:** 1.12.0 | **API version:** v2
 - **Purpose:** Deploys the [Zalando Postgres Operator](https://github.com/zalando/postgres-operator) which creates and manages PostgreSQL clusters (Spilo/Patroni-based) in Kubernetes.
 - **Image:** `registry.opensource.zalan.do/acid/postgres-operator:v1.11.0` (pinned by SHA256 digest)
@@ -106,6 +111,7 @@ charts/<name>/
 - **Helpers:** Unique among charts -- defines `postgres-pod.serviceAccountName`, `postgres-pod.priorityClassName`, `postgres-operator.controllerID` in addition to standard name/fullname/chart helpers

 ### 5. sbom-operator
+
 - **Chart version:** 0.41.0 | **App version:** 0.40.0 | **API version:** v2
 - **Purpose:** Catalogues container images running in a Kubernetes cluster and generates SBOMs (Software Bill of Materials) using Syft. Can push SBOMs to multiple targets (git, configmap, etc.).
 - **Image:** `ghcr.io/ckotzbauer/sbom-operator` (pinned by SHA256 digest)
@@ -119,6 +125,7 @@ charts/<name>/
  - `all-env-values.yaml` -- same config via `envVars` environment variables (SBOM_FORMAT, SBOM_VERBOSITY, etc.)

 ### 6. vulnerability-operator
+
 - **Chart version:** 0.29.0 | **App version:** 0.27.0 | **API version:** v2
 - **Purpose:** Scans SBOMs for known vulnerabilities using Grype. Provides metrics, reports, and filtering capabilities.
 - **Image:** `ghcr.io/ckotzbauer/vulnerability-operator` (pinned by SHA256 digest)
@@ -133,22 +140,28 @@ charts/<name>/
 ## Architecture and Patterns

 ### Helper Template Naming
+
 Two naming conventions exist across charts:
+
 - **Older charts** (access-manager, sbom-operator, vulnerability-operator): Use `app.name`, `app.fullname`, `app.chart`, `app.labels`, `app.selectorLabels`, `app.serviceAccountName` as template names
 - **Newer/external charts** (cadvisor, chekr, postgres-operator): Use chart-specific prefixes like `cadvisor.name`, `chekr.fullname`, `postgres-operator.name`

 All helpers follow the standard pattern: name truncated to 63 characters, fullname combining release name and chart name, chart label combining name and version.

 ### Label Patterns
+
 - **Older charts** (access-manager): Use `app`, `chart`, `release`, `heritage` labels
 - **Newer charts** (cadvisor, chekr, sbom-operator, vulnerability-operator): Use Kubernetes recommended labels (`app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`, `helm.sh/chart`)
 - **postgres-operator**: Uses `app.kubernetes.io/*` labels directly in templates (not via helper includes)

 ### Image Pinning
+
 All charts pin container images using SHA256 digests (e.g., `@sha256:...`) for reproducibility and supply-chain security. Some use the format `tag@sha256:...`, others use `@sha256:...` as the tag value itself.

 ### Security Posture
+
 Most charts enforce security best practices by default:
+
 - `runAsNonRoot: true`
 - `readOnlyRootFilesystem: true`
 - `allowPrivilegeEscalation: false`
@@ -157,20 +170,25 @@ Most charts enforce security best practices by default:
 - Non-root user IDs (1001, 1000, 101 depending on chart)

 ### ServiceAccount Pattern
+
 All charts support conditional ServiceAccount creation (`serviceAccount.create: true`) with an optional custom name. If create is true and no name is set, the fullname template generates the name.

 ### RBAC Pattern
+
 - Most operator charts use ClusterRole + ClusterRoleBinding (cluster-wide scope)
 - access-manager binds to `cluster-admin` directly
 - sbom-operator and vulnerability-operator define least-privilege ClusterRoles with only the permissions needed
 - postgres-operator has the most complex RBAC with conditional rules based on configuration flags

 ### Kubernetes Version Compatibility
+
 Charts use `semverCompare` for API version selection:
+
 - Ingress: `networking.k8s.io/v1` (>= 1.19), `networking.k8s.io/v1beta1` (>= 1.14), `extensions/v1beta1` (older)
 - CronJob: `batch/v1` (>= 1.21), `batch/v1beta1` (older)

 ### Configuration Patterns
+
 - **Args map pattern** (sbom-operator, vulnerability-operator): `args` is a key-value map rendered as `--key=value` CLI flags. Empty values render as bare `--key` flags.
 - **Config sections pattern** (postgres-operator): Extensive configuration organized into typed sections (`configGeneral`, `configKubernetes`, etc.) rendered into an `OperatorConfiguration` CR using `tpl` for template processing within values.
 - **Dual config pattern** (sbom-operator): Supports both `args` map and `envVars` list, giving users flexibility in how they configure the application.
@@ -178,12 +196,14 @@ Charts use `semverCompare` for API version selection:
 ## Build and Development

 ### Prerequisites
+
 - Helm v3
 - Python (for chart-testing)
 - chart-testing (`ct`) CLI
 - kind (for local integration testing)

 ### Local Development
+
 ```bash
 # Add the repo
 helm repo add ckotzbauer https://ckotzbauer.github.io/helm-charts
@@ -202,7 +222,9 @@ helm install --dry-run --debug my-release charts/<chart-name>
 ```

 ### Chart-Testing Configuration
+
 Defined in `/ct.yaml`:
+
 - Remote: `origin`
 - Target branch: `main`
 - Chart directories: `charts/`
@@ -211,12 +233,16 @@ Defined in `/ct.yaml`:
 ## Testing

 ### CI Integration Tests
+
 Chart-testing (`ct`) runs two phases:
+
 1. **Lint** (`ct lint --target-branch main`): Validates chart structure, templates, and values
 2. **Install** (`ct install --target-branch main`): Installs changed charts into a kind cluster (v0.22.0) and verifies they deploy successfully

 ### CI Values Files
+
 Charts provide `ci/` directories with alternative values for integration testing:
+
 - `charts/chekr/ci/ci-values.yaml` -- overrides persistence settings for CI (standard StorageClass, ReadWriteOnce)
 - `charts/sbom-operator/ci/all-args-values.yaml` -- tests args-based configuration
 - `charts/sbom-operator/ci/all-env-values.yaml` -- tests envVars-based configuration
@@ -228,21 +254,23 @@ These files are automatically picked up by `ct install` to run multiple test sce

 ### Workflows

-| Workflow | Trigger | Purpose |
-|---|---|---|
-| `lint-test.yaml` | Pull request | Lints all charts, installs changed charts in kind cluster |
-| `release.yaml` | Push to `main` | Packages and releases charts using chart-releaser to GitHub Pages |
-| `stale.yml` | Daily cron (`0 0 * * *`) | Marks stale issues/PRs via reusable workflow |
-| `label-issues.yml` | Issue/PR events | Automates labeling via reusable workflow |
-| `size-label.yml` | PR opened/synced | Adds size labels to PRs |
+| Workflow           | Trigger                  | Purpose                                                           |
+| ------------------ | ------------------------ | ----------------------------------------------------------------- |
+| `lint-test.yaml`   | Pull request             | Lints all charts, installs changed charts in kind cluster         |
+| `release.yaml`     | Push to `main`           | Packages and releases charts using chart-releaser to GitHub Pages |
+| `stale.yml`        | Daily cron (`0 0 * * *`) | Marks stale issues/PRs via reusable workflow                      |
+| `label-issues.yml` | Issue/PR events          | Automates labeling via reusable workflow                          |
+| `size-label.yml`   | PR opened/synced         | Adds size labels to PRs                                           |

 ### Release Process
+
 1. Make changes to chart(s) and bump `version` in `Chart.yaml`
 2. Open a PR -- lint-test workflow runs automatically
 3. Merge to `main` -- chart-releaser detects version changes, packages the chart, and publishes to the `gh-pages` branch
-4. The release uses `CR_TOKEN` secret for GitHub API authentication
+4. The release uses `REPO_ACCESS` secret for GitHub API authentication

 ### Dependency Management
+
 - **Renovate**: Extends `ckotzbauer/renovate-config:default` and `ckotzbauer/renovate-config:weekly`. Handles image tag/digest updates in `values.yaml`.
 - **Dependabot**: Configured for `github-actions` ecosystem only (daily interval, reviewer: ckotzbauer, label: `kind/dependencies`).
 - All GitHub Actions are pinned by commit SHA with version comments.