feat(traefik-control): add traefik-control chart #1

Merged

ryan.mcgee merged 2 commits from feat/traefik-control-chart into main

2026-10-21 14:29:31 +00:00

ryan.mcgee commented

2026-10-21 13:46:33 +00:00

Owner

Summary

Traefik Control had no Kubernetes deployment. This adds the traefik-control chart, plus the repository scaffolding (chart-testing config, Makefile, lint and publish workflows) modelled on the Enclave helm repository.
The application side (probes, clustering, read-only root filesystem) is in White_Ghost_Cyber_Systems/traefik-control#34. The chart needs that release: it pins image 1.1.0, the version the weekly job proposes for that feat.

Changes

charts/traefik-control: Deployment, Service plus a headless Service for pod discovery, Ingress, ServiceAccount, PodDisruptionBudget, generated Secret (SECRET_KEY_BASE, RELEASE_COOKIE, kept across upgrades), and database.mode of cnpg (CloudNativePG Cluster, default), external or sqlite (PVC, one pod, Recreate); the image variant follows the mode.
Probes on /healthz (startup, liveness) and /readyz (readiness), preStop sleep, uid 65534, read-only root filesystem with a /tmp emptyDir, all capabilities dropped, RuntimeDefault seccomp.
Pod clustering through DNS_CLUSTER_QUERY, POD_IP and the cookie when clustering.enabled (not for sqlite). Validation fails early for a missing host, a bad database.mode, a missing external Secret, and sqlite with more than one replica.
Makefile, ct.yaml, lintconf.yaml, .gitea/workflows/lint.yaml and publish.yaml (OCI push to git.enclaveis.com/white_ghost_cyber_systems, then link the package to this repository). README.

Verification

helm lint --strict and helm template for ci/cnpg-values.yaml, ci/external-values.yaml and ci/sqlite-values.yaml (helm 4.3.0); kubeconform -strict against Kubernetes 1.33.0 with the CRD catalog: 8, 5 and 5 resources valid, none invalid.
ct lint (chart-testing 3.14.0 with lintconf.yaml) passes; the five invalid-input cases fail with the intended messages.
Rendered env checked by eye for the cnpg and sqlite topologies (cookie, pod IP, DNS name, TRAEFIK_CONTROL_TRUST_PROXY, image variant).
Not run: an install on a real cluster (k3s does not start in rootless podman on this host), the CloudNativePG operator, and the publish workflow.

Notes

make validate checks that the image tag exists with crane, so the lint job fails until traefik-control 1.1.0 is released. Merge this after that release; publishing runs on the push to main and needs a REGISTRY_TOKEN secret with write:package on this repository.
Not added: a license file (the application repository has none either) and Renovate.

## Summary - Traefik Control had no Kubernetes deployment. This adds the `traefik-control` chart, plus the repository scaffolding (chart-testing config, Makefile, lint and publish workflows) modelled on the Enclave helm repository. - The application side (probes, clustering, read-only root filesystem) is in White_Ghost_Cyber_Systems/traefik-control#34. The chart needs that release: it pins image `1.1.0`, the version the weekly job proposes for that `feat`. ## Changes - `charts/traefik-control`: Deployment, Service plus a headless Service for pod discovery, Ingress, ServiceAccount, PodDisruptionBudget, generated Secret (`SECRET_KEY_BASE`, `RELEASE_COOKIE`, kept across upgrades), and `database.mode` of `cnpg` (CloudNativePG Cluster, default), `external` or `sqlite` (PVC, one pod, `Recreate`); the image variant follows the mode. - Probes on `/healthz` (startup, liveness) and `/readyz` (readiness), `preStop` sleep, uid 65534, read-only root filesystem with a `/tmp` emptyDir, all capabilities dropped, `RuntimeDefault` seccomp. - Pod clustering through `DNS_CLUSTER_QUERY`, `POD_IP` and the cookie when `clustering.enabled` (not for sqlite). Validation fails early for a missing `host`, a bad `database.mode`, a missing external Secret, and `sqlite` with more than one replica. - `Makefile`, `ct.yaml`, `lintconf.yaml`, `.gitea/workflows/lint.yaml` and `publish.yaml` (OCI push to `git.enclaveis.com/white_ghost_cyber_systems`, then link the package to this repository). README. ## Verification - `helm lint --strict` and `helm template` for `ci/cnpg-values.yaml`, `ci/external-values.yaml` and `ci/sqlite-values.yaml` (helm 4.3.0); `kubeconform -strict` against Kubernetes 1.33.0 with the CRD catalog: 8, 5 and 5 resources valid, none invalid. - `ct lint` (chart-testing 3.14.0 with `lintconf.yaml`) passes; the five invalid-input cases fail with the intended messages. - Rendered env checked by eye for the cnpg and sqlite topologies (cookie, pod IP, DNS name, `TRAEFIK_CONTROL_TRUST_PROXY`, image variant). - Not run: an install on a real cluster (k3s does not start in rootless podman on this host), the CloudNativePG operator, and the publish workflow. ## Notes - `make validate` checks that the image tag exists with `crane`, so the lint job fails until traefik-control 1.1.0 is released. Merge this after that release; publishing runs on the push to `main` and needs a `REGISTRY_TOKEN` secret with `write:package` on this repository. - Not added: a license file (the application repository has none either) and Renovate.

ryan.mcgee added 1 commit

2026-10-21 13:46:33 +00:00

feat(traefik-control): add traefik-control chart

Lint charts / lint (pull_request) Failing after 28s

Details

0749e81439

- deploy the postgres or sqlite3 image by database.mode: cnpg,
  external or sqlite
- probes on /healthz and /readyz, read-only root filesystem,
  generated secrets kept across upgrades, optional Ingress
- cluster the pods through a headless Service and a cookie, with
  a PodDisruptionBudget above one replica
- add chart-testing config, Makefile, lint and publish workflows

ryan.mcgee added 1 commit

2026-10-21 14:28:47 +00:00

ci: re-run lint now that traefik-control 1.1.0 exists

Lint charts / lint (pull_request) Successful in 35s

Details

e03c81e248

ryan.mcgee merged commit 132e18970d into main

2026-10-21 14:29:31 +00:00

ryan.mcgee deleted branch feat/traefik-control-chart

2026-10-21 14:29:31 +00:00

ryan.mcgee referenced this pull request from a commit

2026-10-21 14:29:32 +00:00