From 4dc78362fb7c4d742ea9d68158cd1d6f4bf7ddaf Mon Sep 17 00:00:00 2001 From: Christian Hopf Date: Tue, 17 Mar 2026 19:08:08 +0100 Subject: [PATCH] fix: adjust secret Signed-off-by: Christian Hopf --- .github/workflows/bump-chart.yaml | 6 ++--- .github/workflows/release.yaml | 2 +- CLAUDE.md | 44 +++++++++++++++++++++++++------ 3 files changed, 40 insertions(+), 12 deletions(-) diff --git a/.github/workflows/bump-chart.yaml b/.github/workflows/bump-chart.yaml index 3d94df0..5ed8981 100644 --- a/.github/workflows/bump-chart.yaml +++ b/.github/workflows/bump-chart.yaml @@ -28,7 +28,7 @@ jobs: uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 with: repository: ckotzbauer/helm-charts - token: ${{ secrets.CR_TOKEN }} + token: ${{ secrets.REPO_ACCESS }} - name: Calculate new chart version id: version @@ -104,7 +104,7 @@ jobs: id: create-pr uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7 with: - token: ${{ secrets.CR_TOKEN }} + token: ${{ secrets.REPO_ACCESS }} commit-message: "feat: update ${{ inputs.chart }} to ${{ inputs.app-version }}" branch: "bump/${{ inputs.chart }}-${{ inputs.app-version }}" title: "feat: update ${{ inputs.chart }} to ${{ inputs.app-version }}" @@ -121,4 +121,4 @@ jobs: if: steps.create-pr.outputs.pull-request-number run: gh pr merge "${{ steps.create-pr.outputs.pull-request-number }}" --auto --merge env: - GH_TOKEN: ${{ secrets.CR_TOKEN }} + GH_TOKEN: ${{ secrets.REPO_ACCESS }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 943905c..5b30af7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -35,7 +35,7 @@ jobs: - name: Run chart-releaser uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0 env: - CR_TOKEN: "${{ secrets.CR_TOKEN }}" + CR_TOKEN: "${{ secrets.REPO_ACCESS }}" release-oci: runs-on: ubuntu-latest diff --git a/CLAUDE.md b/CLAUDE.md index 9b766d4..a876f73 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -40,6 +40,7 @@ helm-charts/ ``` Each chart follows a standard structure: + ``` charts// ├── Chart.yaml @@ -61,6 +62,7 @@ charts// ## Charts Overview ### 1. access-manager + - **Chart version:** 0.14.1 | **App version:** 0.13.0 | **API version:** v1 - **Purpose:** Kubernetes operator to simplify RBAC configurations. Manages `RbacDefinition` and `SyncSecretDefinition` custom resources (CRDs defined inline in `templates/crd.yaml`). - **Image:** `ghcr.io/ckotzbauer/access-manager` (pinned by SHA256 digest) @@ -70,6 +72,7 @@ charts// - **Key values:** `replicas`, `image`, `resources` (defaults: 10m/128Mi request, 50m/128Mi limit), `securityContext` (non-root UID 1001, read-only root filesystem, all capabilities dropped) ### 2. cadvisor + - **Chart version:** 2.4.1 | **App version:** 0.52.1 | **API version:** v1 - **Purpose:** Deploys Google cAdvisor as a DaemonSet for container resource monitoring and metrics export. - **Image:** `gcr.io/cadvisor/cadvisor:v0.52.1` (pinned by SHA256 digest) @@ -81,6 +84,7 @@ charts// - **Key values:** `container.additionalArgs` (housekeeping intervals, disabled metrics), `container.hostPaths`, `metrics.enabled/interval/scrapeTimeout`, `podSecurityPolicy.create`, `commonLabels`, `podLabels` ### 3. chekr + - **Chart version:** 0.5.1 | **App version:** 0.5.1 | **API version:** v2, type: application - **Purpose:** Inspection utility for Kubernetes cluster maintenance. Runs scheduled checks (deprecation analysis, resource usage) as CronJobs and serves HTML/JSON reports via an nginx webserver Deployment. - **Images:** `ghcr.io/ckotzbauer/chekr` (job, pinned by digest) + `nginxinc/nginx-unprivileged:mainline-alpine` (webserver, pinned by digest) @@ -93,6 +97,7 @@ charts// - **CI values:** `charts/chekr/ci/ci-values.yaml` overrides persistence to `storageClass: "standard"`, `accessMode: ReadWriteOnce` ### 4. postgres-operator + - **Chart version:** 1.12.0 | **App version:** 1.12.0 | **API version:** v2 - **Purpose:** Deploys the [Zalando Postgres Operator](https://github.com/zalando/postgres-operator) which creates and manages PostgreSQL clusters (Spilo/Patroni-based) in Kubernetes. - **Image:** `registry.opensource.zalan.do/acid/postgres-operator:v1.11.0` (pinned by SHA256 digest) @@ -106,6 +111,7 @@ charts// - **Helpers:** Unique among charts -- defines `postgres-pod.serviceAccountName`, `postgres-pod.priorityClassName`, `postgres-operator.controllerID` in addition to standard name/fullname/chart helpers ### 5. sbom-operator + - **Chart version:** 0.41.0 | **App version:** 0.40.0 | **API version:** v2 - **Purpose:** Catalogues container images running in a Kubernetes cluster and generates SBOMs (Software Bill of Materials) using Syft. Can push SBOMs to multiple targets (git, configmap, etc.). - **Image:** `ghcr.io/ckotzbauer/sbom-operator` (pinned by SHA256 digest) @@ -119,6 +125,7 @@ charts// - `all-env-values.yaml` -- same config via `envVars` environment variables (SBOM_FORMAT, SBOM_VERBOSITY, etc.) ### 6. vulnerability-operator + - **Chart version:** 0.29.0 | **App version:** 0.27.0 | **API version:** v2 - **Purpose:** Scans SBOMs for known vulnerabilities using Grype. Provides metrics, reports, and filtering capabilities. - **Image:** `ghcr.io/ckotzbauer/vulnerability-operator` (pinned by SHA256 digest) @@ -133,22 +140,28 @@ charts// ## Architecture and Patterns ### Helper Template Naming + Two naming conventions exist across charts: + - **Older charts** (access-manager, sbom-operator, vulnerability-operator): Use `app.name`, `app.fullname`, `app.chart`, `app.labels`, `app.selectorLabels`, `app.serviceAccountName` as template names - **Newer/external charts** (cadvisor, chekr, postgres-operator): Use chart-specific prefixes like `cadvisor.name`, `chekr.fullname`, `postgres-operator.name` All helpers follow the standard pattern: name truncated to 63 characters, fullname combining release name and chart name, chart label combining name and version. ### Label Patterns + - **Older charts** (access-manager): Use `app`, `chart`, `release`, `heritage` labels - **Newer charts** (cadvisor, chekr, sbom-operator, vulnerability-operator): Use Kubernetes recommended labels (`app.kubernetes.io/name`, `app.kubernetes.io/instance`, `app.kubernetes.io/version`, `app.kubernetes.io/managed-by`, `helm.sh/chart`) - **postgres-operator**: Uses `app.kubernetes.io/*` labels directly in templates (not via helper includes) ### Image Pinning + All charts pin container images using SHA256 digests (e.g., `@sha256:...`) for reproducibility and supply-chain security. Some use the format `tag@sha256:...`, others use `@sha256:...` as the tag value itself. ### Security Posture + Most charts enforce security best practices by default: + - `runAsNonRoot: true` - `readOnlyRootFilesystem: true` - `allowPrivilegeEscalation: false` @@ -157,20 +170,25 @@ Most charts enforce security best practices by default: - Non-root user IDs (1001, 1000, 101 depending on chart) ### ServiceAccount Pattern + All charts support conditional ServiceAccount creation (`serviceAccount.create: true`) with an optional custom name. If create is true and no name is set, the fullname template generates the name. ### RBAC Pattern + - Most operator charts use ClusterRole + ClusterRoleBinding (cluster-wide scope) - access-manager binds to `cluster-admin` directly - sbom-operator and vulnerability-operator define least-privilege ClusterRoles with only the permissions needed - postgres-operator has the most complex RBAC with conditional rules based on configuration flags ### Kubernetes Version Compatibility + Charts use `semverCompare` for API version selection: + - Ingress: `networking.k8s.io/v1` (>= 1.19), `networking.k8s.io/v1beta1` (>= 1.14), `extensions/v1beta1` (older) - CronJob: `batch/v1` (>= 1.21), `batch/v1beta1` (older) ### Configuration Patterns + - **Args map pattern** (sbom-operator, vulnerability-operator): `args` is a key-value map rendered as `--key=value` CLI flags. Empty values render as bare `--key` flags. - **Config sections pattern** (postgres-operator): Extensive configuration organized into typed sections (`configGeneral`, `configKubernetes`, etc.) rendered into an `OperatorConfiguration` CR using `tpl` for template processing within values. - **Dual config pattern** (sbom-operator): Supports both `args` map and `envVars` list, giving users flexibility in how they configure the application. @@ -178,12 +196,14 @@ Charts use `semverCompare` for API version selection: ## Build and Development ### Prerequisites + - Helm v3 - Python (for chart-testing) - chart-testing (`ct`) CLI - kind (for local integration testing) ### Local Development + ```bash # Add the repo helm repo add ckotzbauer https://ckotzbauer.github.io/helm-charts @@ -202,7 +222,9 @@ helm install --dry-run --debug my-release charts/ ``` ### Chart-Testing Configuration + Defined in `/ct.yaml`: + - Remote: `origin` - Target branch: `main` - Chart directories: `charts/` @@ -211,12 +233,16 @@ Defined in `/ct.yaml`: ## Testing ### CI Integration Tests + Chart-testing (`ct`) runs two phases: + 1. **Lint** (`ct lint --target-branch main`): Validates chart structure, templates, and values 2. **Install** (`ct install --target-branch main`): Installs changed charts into a kind cluster (v0.22.0) and verifies they deploy successfully ### CI Values Files + Charts provide `ci/` directories with alternative values for integration testing: + - `charts/chekr/ci/ci-values.yaml` -- overrides persistence settings for CI (standard StorageClass, ReadWriteOnce) - `charts/sbom-operator/ci/all-args-values.yaml` -- tests args-based configuration - `charts/sbom-operator/ci/all-env-values.yaml` -- tests envVars-based configuration @@ -228,21 +254,23 @@ These files are automatically picked up by `ct install` to run multiple test sce ### Workflows -| Workflow | Trigger | Purpose | -|---|---|---| -| `lint-test.yaml` | Pull request | Lints all charts, installs changed charts in kind cluster | -| `release.yaml` | Push to `main` | Packages and releases charts using chart-releaser to GitHub Pages | -| `stale.yml` | Daily cron (`0 0 * * *`) | Marks stale issues/PRs via reusable workflow | -| `label-issues.yml` | Issue/PR events | Automates labeling via reusable workflow | -| `size-label.yml` | PR opened/synced | Adds size labels to PRs | +| Workflow | Trigger | Purpose | +| ------------------ | ------------------------ | ----------------------------------------------------------------- | +| `lint-test.yaml` | Pull request | Lints all charts, installs changed charts in kind cluster | +| `release.yaml` | Push to `main` | Packages and releases charts using chart-releaser to GitHub Pages | +| `stale.yml` | Daily cron (`0 0 * * *`) | Marks stale issues/PRs via reusable workflow | +| `label-issues.yml` | Issue/PR events | Automates labeling via reusable workflow | +| `size-label.yml` | PR opened/synced | Adds size labels to PRs | ### Release Process + 1. Make changes to chart(s) and bump `version` in `Chart.yaml` 2. Open a PR -- lint-test workflow runs automatically 3. Merge to `main` -- chart-releaser detects version changes, packages the chart, and publishes to the `gh-pages` branch -4. The release uses `CR_TOKEN` secret for GitHub API authentication +4. The release uses `REPO_ACCESS` secret for GitHub API authentication ### Dependency Management + - **Renovate**: Extends `ckotzbauer/renovate-config:default` and `ckotzbauer/renovate-config:weekly`. Handles image tag/digest updates in `values.yaml`. - **Dependabot**: Configured for `github-actions` ecosystem only (daily interval, reviewer: ckotzbauer, label: `kind/dependencies`). - All GitHub Actions are pinned by commit SHA with version comments.