From ee3235e0cdcbc62c8de8618b077170442262db7e Mon Sep 17 00:00:00 2001
From: Renku Bot <renku@datascience.ch>
Date: Mon, 13 Jul 2026 15:03:37 +0000
Subject: [PATCH 1/2] chore: create release 2.20.0


From cb145e8bc9958bc51991f28b04d55f31b49d200f Mon Sep 17 00:00:00 2001
From: Tasko Olevski <16360283+olevski@users.noreply.github.com>
Date: Wed, 29 Jul 2026 09:04:06 +0200
Subject: [PATCH 2/2] feat: data export from Renku to Envidat (#4556)

* feat: helm chart changes

* feat: upgrade data service to 0.81.0

Adds support for exporting data from Renku to Envidat. The feature has
to be explicitly enabled in the values file and additional credentials
have to be specified in a Kubernetes secret.

* feat: bump renku-ui version to 4.28.0

---------

Co-authored-by: Mohammad Alisafaee <mohammad.alisafaee@epfl.ch>
Co-authored-by: Lorenzo <lorenzo.cavazzi.tech@gmail.com>
---
 .../templates/data-service/deployment.yaml    | 28 +++++++++++++++++++
 helm-chart/renku/values.yaml                  | 20 +++++++++----
 2 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/helm-chart/renku/templates/data-service/deployment.yaml b/helm-chart/renku/templates/data-service/deployment.yaml
index b29f191451..43f7b1cc24 100644
--- a/helm-chart/renku/templates/data-service/deployment.yaml
+++ b/helm-chart/renku/templates/data-service/deployment.yaml
@@ -214,6 +214,34 @@ spec:
             {{- end }}
             - name: DATA_DEPOSITS_JOB_IMAGE
               value: {{ .Values.dataService.dataDeposits.image | quote }}
+            - name: ENVIDAT_URL
+              value: {{ .Values.dataService.dataDeposits.envidat.url | quote }}
+            - name: ENVIDAT_RCLONE_IMAGE
+              value: {{ .Values.dataService.dataDeposits.envidat.rcloneImage | quote }}
+            - name: ENVIDAT_EXPORTS_ENABLED
+              value: {{ .Values.dataService.dataDeposits.envidat.exportsEnabled | quote }}
+            {{- if .Values.dataService.dataDeposits.envidat.exportsEnabled }}
+            - name: ENVIDAT_S3_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.dataService.dataDeposits.envidat.s3.credentialsSecretName | quote }}
+                  key: ENDPOINT
+            - name: ENVIDAT_S3_BUCKET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.dataService.dataDeposits.envidat.s3.credentialsSecretName | quote }}
+                  key: BUCKET
+            - name: ENVIDAT_S3_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.dataService.dataDeposits.envidat.s3.credentialsSecretName | quote }}
+                  key: ACCESS_KEY_ID
+            - name: ENVIDAT_S3_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.dataService.dataDeposits.envidat.s3.credentialsSecretName | quote }}
+                  key: SECRET_ACCESS_KEY
+            {{- end }}
             - name: RENKU_URL
               value: {{ (include "renku.baseUrl" .) | quote }}
           volumeMounts:
diff --git a/helm-chart/renku/values.yaml b/helm-chart/renku/values.yaml
index 28868d3526..255c7412c3 100644
--- a/helm-chart/renku/values.yaml
+++ b/helm-chart/renku/values.yaml
@@ -570,7 +570,7 @@ ui:
     replicaCount: 1
     image:
       repository: renku/renku-ui
-      tag: "4.27.2"
+      tag: "4.28.0"
       pullPolicy: IfNotPresent
       ## Optionally specify an array of imagePullSecrets.
       ## Secrets must be manually created in the namespace.
@@ -762,7 +762,7 @@ ui:
     keepCookies: []
     image:
       repository: renku/renku-ui-server
-      tag: "4.27.2"
+      tag: "4.28.0"
       pullPolicy: IfNotPresent
     imagePullSecrets: []
     nameOverride: ""
@@ -1215,12 +1215,12 @@ dataService:
     existingPriorityClass: ""
   image:
     repository: renku/renku-data-service
-    tag: "0.78.2"
+    tag: "0.81.0"
     pullPolicy: IfNotPresent
   k8sWatcher:
     image:
       repository: renku/data-service-k8s-watcher
-      tag: "0.78.2"
+      tag: "0.81.0"
       pullPolicy: IfNotPresent
     resources: {}
     sentry:
@@ -1231,7 +1231,7 @@ dataService:
   dataTasks:
     image:
       repository: renku/data-service-data-tasks
-      tag: "0.78.2"
+      tag: "0.81.0"
       pullPolicy: IfNotPresent
     resources: {}
     enableResourceRequestTracking: false
@@ -1332,6 +1332,14 @@ dataService:
         key: renku.io/dedicated
         operator: Equal
         value: user
+    envidat:
+      exportsEnabled: false
+      url: https://envidat.ch
+      rcloneImage: rclone/rclone:1
+      s3:
+        ## The secret name that stores the S3 ACCESS_KEY_ID, SECRET_ACCESS_KEY, ENDPOINT, BUCKET for uploading data to Envidat
+        ## The keys in the Kubernetes secret should have the same names as the terms mentioned above.
+        credentialsSecretName: renku-envidat-s3-credentials
   ## The service account used in the Amalthea session pods for the resource pool(s) that use the local cluster.
   ## The only use for this is if you want to use a different SCC than the default in OpenShift.
   ## The service account is not mounted in the session. Leaving the default value of "" means that
@@ -1372,7 +1380,7 @@ authz:
 secretsStorage:
   image:
     repository: renku/secrets-storage
-    tag: "0.78.2"
+    tag: "0.81.0"
     pullPolicy: IfNotPresent
   service:
     type: ClusterIP