diun/README.md

Diun Helm chart

This repository maintains a small adapter chart for the upstream Diun image. It owns the Deployment, service account and read-only Kubernetes Pod RBAC, configuration, notification wiring, and optional persistent data claim. The cluster chooses the chart release and supplies only its Secret references, registry/Matrix endpoints, and storage settings in homelab-gitops.

The chart uses upstream crazymax/diun release tags. Its Chart appVersion is the Diun release; the chart package version is derived from Git tags with git describe. The chart repository's baseline tag is the same release, v4.33.0, so the next chart-only commit packages as 4.33.0-1-g<commit> rather than an unrelated 1.0.0 version. On a Diun upgrade, update Chart.yaml.appVersion, verify the default image follows it, test the chart, and tag the new upstream version. The Matrix integration downloads Shoutrrr 0.14.0 at startup because later 0.14.1 sent duplicate Matrix authentication data rejected by the configured Synapse. The init image uses a readable curl image tag. No image digests or hard-coded download checksums are used.

Install

Add the public chart repository and install the published chart (or use the same-release convenience script in this checkout):

helm repo add brunner.ninja https://brunner.ninja/charts
helm repo update brunner.ninja
./install.sh

For a new cluster, create a values file that references existing Kubernetes Secrets for registry.credentialsSecretName and matrix.tokenSecretName; do not put their values in Helm values or Git. See values.example.yaml for the chart interface. The default chart supports a portable PVC; the homelab GitOps values preserve the existing diun claim.

Add this annotation to a Pod template to exclude it from Diun's Kubernetes provider:

spec:
  template:
    metadata:
      annotations:
        diun.enable: "false"

Diun has no web UI. It notices newly seen image references and changed image digests on scheduled scans; a first sighting is not proof that an image is outdated.

Development and publication

Run ./test.sh to lint and render the chart and check resource relationships. Gitea Actions publishes immutable chart versions to the public brunner.ninja Helm repository and promotes the published version to this Argo Application. The repository Actions secrets are PACKAGE_USERNAME, PACKAGE_TOKEN, and GITOPS_TOKEN; chart CI has no Kubernetes credentials.