61 lines
2.5 KiB
Markdown
61 lines
2.5 KiB
Markdown
# Diun Helm chart
|
|
|
|
This repository maintains a small adapter chart for the upstream Diun image.
|
|
It owns the Deployment, service account and read-only Kubernetes Pod RBAC,
|
|
configuration, notification wiring, and optional persistent data claim. The
|
|
cluster chooses the chart release and supplies only its Secret references,
|
|
registry/Matrix endpoints, and storage settings in
|
|
[`homelab-gitops`](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/diun).
|
|
|
|
The chart uses upstream `crazymax/diun` release tags. Its Chart `appVersion`
|
|
is the Diun release; the chart package version is derived from Git tags with
|
|
`git describe`. The chart repository's baseline tag is the same release,
|
|
`v4.33.0`, so the next chart-only commit packages as
|
|
`4.33.0-1-g<commit>` rather than an unrelated `1.0.0` version. On a Diun
|
|
upgrade, update `Chart.yaml.appVersion`, verify the default image follows it,
|
|
test the chart, and tag the new upstream version. The Matrix integration
|
|
downloads Shoutrrr 0.14.0 at startup because later 0.14.1 sent duplicate
|
|
Matrix authentication data rejected by the
|
|
configured Synapse. The init image uses a readable curl image tag. No image
|
|
digests or hard-coded download checksums are used.
|
|
|
|
## Install
|
|
|
|
Add the public chart repository and install the published chart (or use the
|
|
same-release convenience script in this checkout):
|
|
|
|
```sh
|
|
helm repo add brunner.ninja https://brunner.ninja/charts
|
|
helm repo update brunner.ninja
|
|
./install.sh
|
|
```
|
|
|
|
For a new cluster, create a values file that references existing Kubernetes
|
|
Secrets for `registry.credentialsSecretName` and
|
|
`matrix.tokenSecretName`; do not put their values in Helm values or Git.
|
|
See `values.example.yaml` for the chart interface. The default chart supports a
|
|
portable PVC; the homelab GitOps values preserve the existing `diun` claim.
|
|
|
|
Add this annotation to a Pod template to exclude it from Diun's Kubernetes
|
|
provider:
|
|
|
|
```yaml
|
|
spec:
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
diun.enable: "false"
|
|
```
|
|
|
|
Diun has no web UI. It notices newly seen image references and changed image
|
|
digests on scheduled scans; a first sighting is not proof that an image is
|
|
outdated.
|
|
|
|
## Development and publication
|
|
|
|
Run `./test.sh` to lint and render the chart and check resource relationships.
|
|
Gitea Actions publishes immutable chart versions to the public `brunner.ninja`
|
|
Helm repository and promotes the published version to this Argo Application.
|
|
The repository Actions secrets are `PACKAGE_USERNAME`, `PACKAGE_TOKEN`, and
|
|
`GITOPS_TOKEN`; chart CI has no Kubernetes credentials.
|