Announcement: Helm chart will be moved

[sagikazarmark]

It's been due for quite some time now, but as of the next Dex release the following changes will be made to the Helm chart:

The Helm chart will be moved to the main Dex repository. This will make it easier to test Dex with the Helm chart as well as unify our release process.

We will also move the chart to an OCI registry (on ghcr.io). The old chart repository will remain available, but won't receive new updates.

We will do our best to merge pending pull requests before making the move.

Should you have any questions or concerns, feel free to comment below.

[Vad1mo]

Bump the major chart version to mark the clear cut, even if there are no structural changes.

[sagikazarmark]

The chart version is going to follow the Dex version from now on.

[Vad1mo]

The chart version is going to follow the Dex version from now on.

I think I know why you want to do that. Your intention is to simplify the workflow..

Is it reasonable to have one version for both things?

• Is the project going to bump the app version if the chart gets new capabilities?
• What if the Chart version undergoes a significant change and would require a bump of the major version?

[sagikazarmark]

Well, there are a couple of reasons:

• Simplify release workflow, yes
• Make the workflow less error prone (bumping the chart version often requires and extra round of reviews)
• Test the Helm chart with the latest Dex version, so we can catch incompatibilities early
• ~~There was something else, I don't remember :) ~~ (Update: I remember now: having to manually update new Dex versions in the chart)

But you raise fair points.

How about this?

• Bump a major version after the move
• When releasing Dex, update the app version and bump a minor chart version
• When something is changed in the chart, we may opt for automatic release or manual tags

This way we get the simplification, but also keep the ability to version the chart separately.

[Vad1mo]

Without knowing the details, your proposal looks good that way. Keep the chart patch in sync with the app, and if new features are added to chart manually bump minor or major if it is breaking.

From experience and also my own failed attempts. It only works most of the time. Having some flexibility here will save some headeach down the road...

As the chart is fairly stable, manual releases would not be needed that often..

[sagikazarmark]

Cool, thanks a lot for jumping in and the suggestions!

[matheuscscp]

I'd just sync app and chart versions, no issues with that. You're moving to the same repo already, make it a single bundle. Anything changes, the only version gets a bump.

We will also move the chart to an OCI registry (on ghcr.io). The old chart repository will remain available, but won't receive new updates.

Should also sign the chart (and image) with cosign keyless: https://docs.sigstore.dev/cosign/signing/overview/

[Vad1mo]

cosign keyless

Good point!

You can take a look into that PR to have a starting point: https://github.com/goharbor/harbor/pull/22578/changes

[gaffneyd4]

This work is happening here: dexidp/dex#4331