cncf · tegioz · Oct 28, 2025 · Oct 28, 2025
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: clomonitor
 description: CLOMonitor is a tool that periodically checks open source projects repositories to verify they meet certain project health best practices
 type: application
-version: 1.0.0
+version: 1.0.1-1
 appVersion: 1.0.0
 kubeVersion: ">= 1.19.0-0"
 keywords:
@@ -15,6 +15,6 @@ maintainers:
     email: [email protected]
 dependencies:
   - name: postgresql
-    version: 8.2.1
-    repository: https://charts.helm.sh/stable
+    version: 18.0.15
+    repository: https://charts.bitnami.com/bitnami
     condition: postgresql.enabled
diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl
@@ -79,8 +79,13 @@ longest resource name ("dbmigrator-install" = 18 chars).
 Provide an init container to verify the database is accessible
 */}}
 {{- define "chart.checkDbIsReadyInitContainer" -}}
+{{- $securityContext := default (dict) .Values.checkDbIsReadyInitContainer.securityContext }}
 name: check-db-ready
+{{ if .Values.postgresql.image.registry -}}
+image: {{ .Values.postgresql.image.registry }}/{{ .Values.postgresql.image.repository }}:{{ .Values.postgresql.image.tag }}
+{{- else }}
 image: {{ .Values.postgresql.image.repository }}:{{ .Values.postgresql.image.tag }}
+{{- end }}
 imagePullPolicy: {{ .Values.pullPolicy }}
 env:
   - name: PGHOST
@@ -89,5 +94,10 @@ env:
     value: "{{ .Values.db.port }}"
   - name: PGUSER
     value: "{{ .Values.db.user }}"
+{{- if $securityContext }}
+securityContext:{{- toYaml $securityContext | nindent 2 }}
+{{- else }}
+securityContext: {}
+{{- end }}
 command: ['sh', '-c', 'until pg_isready; do echo waiting for database; sleep 2; done;']
 {{- end -}}
diff --git a/chart/templates/apiserver_deployment.yaml b/chart/templates/apiserver_deployment.yaml
@@ -21,6 +21,10 @@ spec:
         app.kubernetes.io/component: apiserver
         {{- include "chart.selectorLabels" . | nindent 8 }}
     spec:
+    {{- with .Values.apiserver.deploy.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
     {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -36,12 +40,20 @@ spec:
           {{ $kubectlImageVersion := ternary "1.33" $kubeVersion (semverCompare ">=1.34.0-0" (printf "%s.0" $kubeVersion)) }}
           image: "docker.io/bitnamilegacy/kubectl:{{ $kubectlImageVersion }}"
           imagePullPolicy: IfNotPresent
+          {{- with .Values.checkDbIsReadyInitContainer.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           command: ['kubectl', 'wait', '--namespace={{ .Release.Namespace }}', '--for=condition=complete', 'job/{{ include "chart.resourceNamePrefix" . }}dbmigrator-install', '--timeout=60s']
         {{- end }}
       containers:
         - name: apiserver
           image: {{ .Values.apiserver.deploy.image.repository }}:{{ .Values.imageTag | default (printf "v%s" .Chart.AppVersion) }}
           imagePullPolicy: {{ .Values.pullPolicy }}
+          {{- with .Values.apiserver.deploy.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           volumeMounts:
             - name: apiserver-config
               mountPath: {{ .Values.configDir | quote }}

diff --git a/chart/templates/apiserver_ingress.yaml b/chart/templates/apiserver_ingress.yaml
@@ -15,7 +15,7 @@ spec:
     service:
       name: {{ include "chart.resourceNamePrefix" . }}apiserver
       port:
-        number: {{ .Values.apiserver.service.port }}
+        number: {{ .Values.apiserver.ingress.backendServicePort }}
   {{- with .Values.apiserver.ingress.rules }}
   rules:
     {{- toYaml . | nindent 4 }}

diff --git a/chart/templates/apiserver_service.yaml b/chart/templates/apiserver_service.yaml
@@ -5,13 +5,15 @@ metadata:
   labels:
     app.kubernetes.io/component: apiserver
     {{- include "chart.labels" . | nindent 4 }}
+  {{- with .Values.apiserver.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
+  allocateLoadBalancerNodePorts: {{ .Values.apiserver.service.allocateLoadBalancerNodePorts }}
   type: {{ .Values.apiserver.service.type }}
   ports:
-    - port: {{ .Values.apiserver.service.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
+    {{- toYaml .Values.apiserver.service.ports | nindent 4 }}
   selector:
     app.kubernetes.io/component: apiserver
     {{- include "chart.selectorLabels" . | nindent 4 }}
diff --git a/chart/templates/archiver_cronjob.yaml b/chart/templates/archiver_cronjob.yaml
@@ -15,6 +15,10 @@ spec:
     spec:
       template:
         spec:
+        {{- with .Values.archiver.cronjob.podSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+        {{- end }}
         {{- with .Values.imagePullSecrets }}
           imagePullSecrets:
             {{- toYaml . | nindent 12 }}
@@ -26,6 +30,10 @@ spec:
             - name: archiver
               image: {{ .Values.archiver.cronjob.image.repository }}:{{ .Values.imageTag | default (printf "v%s" .Chart.AppVersion) }}
               imagePullPolicy: {{ .Values.pullPolicy }}
+              {{- with .Values.archiver.cronjob.containerSecurityContext }}
+              securityContext:
+                {{- toYaml . | nindent 16 }}
+              {{- end }}
               resources:
                 {{- toYaml .Values.archiver.cronjob.resources | nindent 16 }}
               volumeMounts:

diff --git a/chart/templates/dbmigrator_job.yaml b/chart/templates/dbmigrator_job.yaml
@@ -13,6 +13,10 @@ metadata:
 spec:
   template:
     spec:
+    {{- with .Values.dbmigrator.job.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
     {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -24,6 +28,10 @@ spec:
         - name: dbmigrator
           image: {{ .Values.dbmigrator.job.image.repository }}:{{ .Values.imageTag | default (printf "v%s" .Chart.AppVersion) }}
           imagePullPolicy: {{ .Values.pullPolicy }}
+          {{- with .Values.dbmigrator.job.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           env:
             - name: TERN_CONF
               value: {{ .Values.configDir }}/tern.conf

diff --git a/chart/templates/dbmigrator_secret.yaml b/chart/templates/dbmigrator_secret.yaml
@@ -11,3 +11,4 @@ stringData:
     database = {{ .Values.db.dbname }}
     user = {{ .Values.db.user }}
     password = {{ .Values.db.password }}
+    sslmode = prefer
diff --git a/chart/templates/notifier_cronjob.yaml b/chart/templates/notifier_cronjob.yaml
@@ -16,6 +16,10 @@ spec:
     spec:
       template:
         spec:
+        {{- with .Values.notifier.cronjob.podSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+        {{- end }}
         {{- with .Values.imagePullSecrets }}
           imagePullSecrets:
             {{- toYaml . | nindent 12 }}
@@ -27,6 +31,10 @@ spec:
             - name: notifier
               image: {{ .Values.notifier.cronjob.image.repository }}:{{ .Values.imageTag | default (printf "v%s" .Chart.AppVersion) }}
               imagePullPolicy: {{ .Values.pullPolicy }}
+              {{- with .Values.notifier.cronjob.containerSecurityContext }}
+              securityContext:
+                {{- toYaml . | nindent 16 }}
+              {{- end }}
               resources:
                 {{- toYaml .Values.notifier.cronjob.resources | nindent 16 }}
               volumeMounts:

diff --git a/chart/templates/registrar_cronjob.yaml b/chart/templates/registrar_cronjob.yaml
@@ -15,6 +15,10 @@ spec:
     spec:
       template:
         spec:
+        {{- with .Values.registrar.cronjob.podSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+        {{- end }}
         {{- with .Values.imagePullSecrets }}
           imagePullSecrets:
             {{- toYaml . | nindent 12 }}
@@ -26,6 +30,10 @@ spec:
             - name: registrar
               image: {{ .Values.registrar.cronjob.image.repository }}:{{ .Values.imageTag | default (printf "v%s" .Chart.AppVersion) }}
               imagePullPolicy: {{ .Values.pullPolicy }}
+              {{- with .Values.registrar.cronjob.containerSecurityContext }}
+              securityContext:
+                {{- toYaml . | nindent 16 }}
+              {{- end }}
               resources:
                 {{- toYaml .Values.registrar.cronjob.resources | nindent 16 }}
               volumeMounts:

diff --git a/chart/templates/tracker_cronjob.yaml b/chart/templates/tracker_cronjob.yaml
@@ -15,6 +15,10 @@ spec:
     spec:
       template:
         spec:
+        {{- with .Values.tracker.cronjob.podSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+        {{- end }}
         {{- with .Values.imagePullSecrets }}
           imagePullSecrets:
             {{- toYaml . | nindent 12 }}
@@ -26,6 +30,10 @@ spec:
             - name: tracker
               image: {{ .Values.tracker.cronjob.image.repository }}:{{ .Values.imageTag | default (printf "v%s" .Chart.AppVersion) }}
               imagePullPolicy: {{ .Values.pullPolicy }}
+              {{- with .Values.tracker.cronjob.containerSecurityContext }}
+              securityContext:
+                {{- toYaml . | nindent 16 }}
+              {{- end }}
               resources:
                 {{- toYaml .Values.tracker.cronjob.resources | nindent 16 }}
               volumeMounts:

diff --git a/chart/values-staging.yaml b/chart/values-staging.yaml