mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 22:13:18 +09:00
Aleksei Sviridkin
d542f66368
Bump the chart and controller image to 0.8.1, which renders the controller Deployment's rollout strategy in every controller.mode instead of only in external-dns mode. Up to 0.8.0 the chart rendered a strategy only in external-dns mode, as type: Recreate, and nothing in the other modes. The apiserver defaults a rollingUpdate block onto a Deployment created without one, so switching a live release into external-dns laid Recreate on top of that defaulted block and the apiserver rejected the object: spec.strategy.rollingUpdate: Forbidden: may not be specified when strategy `type` is 'Recreate' The strategy is now identical across all modes, so no mode switch changes a strategy field at all. This is a latent break rather than an active one: the host pins coredns and tenants pin coredns-import, neither of which rendered a strategy in 0.8.0, and no shipped configuration selects external-dns. But controller.mode is user-settable and the chart supports the mode, so the transition is reachable by configuration. It surfaces only under server-side apply, which helm-controller uses by default, so no local helm upgrade reproduces it: a client-side strategic merge carries retainKeys on strategy and clears rollingUpdate on the way through. The rendered strategy is pinned on all three modes, external-dns included — it is the only mode that ever rendered Recreate, so a bump that re-gated the block would otherwise slip past a coredns-only suite. 0.8.1 also carries an upstream bump of the cleanup-hook kubectl image to 1.36.1. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
57 lines
2.8 KiB
Makefile
57 lines
2.8 KiB
Makefile
export NAME=ouroboros
|
|
export NAMESPACE=cozy-$(NAME)
|
|
|
|
include ../../../hack/common-envs.mk
|
|
include ../../../hack/package.mk
|
|
|
|
# Pin the upstream ouroboros chart by version AND OCI manifest digest.
|
|
#
|
|
# OUROBOROS_CHART_DIGEST below is the digest of the OCI **chart**
|
|
# manifest at ghcr.io/lexfrei/charts/ouroboros — it pins the contents
|
|
# of the helm chart artefact (templates, values.yaml, Chart.yaml).
|
|
# It is NOT the digest of the controller container image. The image
|
|
# digest lives in values.yaml under image.tag (`image.tag: "<version>@sha256:..."`)
|
|
# and pins ghcr.io/lexfrei/ouroboros (the runtime binary). Both
|
|
# digests have to land together at every chart bump — the chart
|
|
# version, the chart-manifest digest, and the controller-image
|
|
# digest all advance in lockstep with the upstream release.
|
|
#
|
|
# Bump together with the image tag+digest in values.yaml. The digest
|
|
# pin closes the supply-chain hole that a tag-only pull would leave —
|
|
# OCI registries can republish under the same tag, but the manifest
|
|
# digest is immutable. To bump: resolve the new chart-manifest digest
|
|
# with
|
|
# crane manifest ghcr.io/lexfrei/charts/ouroboros:<new-tag> | sha256sum
|
|
# (or `oras manifest fetch ghcr.io/lexfrei/charts/ouroboros:<new-tag> | sha256sum`)
|
|
# and update both lines below; resolve the new image digest with
|
|
# crane digest ghcr.io/lexfrei/ouroboros:<new-tag>
|
|
# and update values.yaml.
|
|
OUROBOROS_CHART_VERSION ?= 0.8.1
|
|
OUROBOROS_CHART_DIGEST ?= sha256:40fd5b639ff73594989856076eab5dfbd0dfab8ee16d1cab915756e24b54458b
|
|
|
|
test:
|
|
helm unittest .
|
|
|
|
update:
|
|
rm -rf charts
|
|
# Pull by digest, then verify Chart.yaml records the expected
|
|
# version. A digest mismatch (someone bumped DIGEST without
|
|
# bumping VERSION, or vice versa) trips the assert and aborts.
|
|
helm pull oci://ghcr.io/lexfrei/charts/ouroboros@$(OUROBOROS_CHART_DIGEST) --untar --untardir charts
|
|
# Pulling by digest also leaves an empty directory named after the
|
|
# digest ref next to the untarred chart. Git ignores empty directories
|
|
# so it never shows as drift, which is exactly why it lingers
|
|
# unnoticed; drop it so `make update` leaves the tree clean.
|
|
rm -rf "charts/ouroboros@$(OUROBOROS_CHART_DIGEST)"
|
|
@actual_version=$$(awk '/^version:/ {print $$2}' charts/ouroboros/Chart.yaml | tr -d '"'); \
|
|
if [ "$$actual_version" != "$(OUROBOROS_CHART_VERSION)" ]; then \
|
|
echo "ERROR: pulled chart Chart.yaml version=$$actual_version but Makefile OUROBOROS_CHART_VERSION=$(OUROBOROS_CHART_VERSION). Bump both in lockstep."; \
|
|
exit 1; \
|
|
fi
|
|
# Drop vendored upstream helm-unittest fixtures: the upstream
|
|
# fixtures hard-code upstream defaults that conflict with the
|
|
# cozystack values.yaml overrides (target Service FQDN, mode,
|
|
# Gateway-API gating). The cozystack-side fixtures in tests/
|
|
# are the only ones CI should run.
|
|
rm -rf charts/ouroboros/tests
|