Skip to content

Commit bbf6fc5

Browse files
mhmtsvrmhmtsvr
committed
Initial boundary-helm release - 0.1.0
0 parents  commit bbf6fc5

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+3044
-0
lines changed

‎.circleci/config.yml‎

Lines changed: 235 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
version: 2.1
2+
3+
orbs:
4+
helm: circleci/helm@3.2.0
5+
6+
executors:
7+
helm-executor:
8+
docker:
9+
- image: cimg/base:stable
10+
resource_class: medium
11+
12+
jobs:
13+
lint-and-validate:
14+
executor: helm-executor
15+
steps:
16+
- checkout
17+
- helm/install_helm_client:
18+
version: v4.0.4
19+
- run:
20+
name: Lint Helm Chart
21+
command: |
22+
helm lint boundary-helm
23+
- run:
24+
name: Template Chart
25+
command: |
26+
helm template boundary-helm boundary-helm
27+
- run:
28+
name: Validate Chart Version
29+
command: |
30+
VERSION=$(grep '^version:' boundary-helm/Chart.yaml | awk '{print $2}')
31+
echo "Chart version: $VERSION"
32+
if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
33+
echo "Error: Chart version must follow semantic versioning (x.y.z)"
34+
exit 1
35+
fi
36+
editorconfig-check:
37+
docker:
38+
- image: cimg/go:1.25
39+
resource_class: medium
40+
steps:
41+
- checkout
42+
- run: go install github.com/editorconfig-checker/editorconfig-checker/v3/cmd/editorconfig-checker@v3.4.0
43+
- run:
44+
name: Check EditorConfig
45+
command: |
46+
if editorconfig-checker; then
47+
echo -e "\nAll files conform to the EditorConfig rules"
48+
else
49+
echo -e "\nYou can set up EditorConfig (https://editorconfig.org/) in your IDE to enforce these formatting rules automatically"
50+
exit 1
51+
fi
52+
53+
validate-docs:
54+
docker:
55+
- image: cimg/go:1.25
56+
resource_class: medium
57+
steps:
58+
- checkout
59+
- run: go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.14.2
60+
- run:
61+
name: Generate Helm Documentation
62+
command: helm-docs --chart-search-root=boundary-helm
63+
- run:
64+
name: Check for Documentation Changes
65+
command: |
66+
if ! git ls-files --error-unmatch boundary-helm/README.md > /dev/null 2>&1; then
67+
echo "ERROR: README.md does not exist"
68+
echo "Please run 'helm-docs --chart-search-root=boundary-helm' locally and commit the generated README.md"
69+
exit 1
70+
fi
71+
if git diff --exit-code boundary-helm/README.md; then
72+
echo "Documentation is up to date"
73+
else
74+
echo "ERROR: README.md is out of sync with values.yaml"
75+
echo "Please run 'helm-docs --chart-search-root=boundary-helm' locally and commit the changes"
76+
git diff boundary-helm/README.md
77+
exit 1
78+
fi
79+
80+
release:
81+
executor: helm-executor
82+
environment:
83+
GITHUB_USER: mhmtsvr
84+
steps:
85+
- checkout
86+
- helm/install_helm_client:
87+
version: v4.0.4
88+
- run:
89+
name: Install chart-releaser
90+
command: |
91+
VERSION="v1.8.1"
92+
ARCH="linux_amd64"
93+
curl -sSL "https://github.com/helm/chart-releaser/releases/download/${VERSION}/chart-releaser_${VERSION#v}_${ARCH}.tar.gz" | tar xz
94+
sudo mv cr /usr/local/bin/cr
95+
cr version
96+
- run:
97+
name: Package Helm Chart
98+
command: |
99+
mkdir -p .cr-release-packages
100+
helm package boundary-helm --destination .cr-release-packages
101+
- run:
102+
name: Create GitHub Release and Upload Chart
103+
command: |
104+
echo "Running cr upload..."
105+
cr upload \
106+
--owner ${GITHUB_USER} \
107+
--git-repo boundary-helm \
108+
--token "${GITHUB_TOKEN}" \
109+
--package-path .cr-release-packages \
110+
--commit "${CIRCLE_SHA1}" \
111+
--release-name-template "v{{ .Version }}" \
112+
--generate-release-notes \
113+
--skip-existing
114+
- run:
115+
name: Push Chart to GHCR as OCI Artifact
116+
command: |
117+
# Extract version from Chart.yaml
118+
VERSION=$(grep '^version:' boundary-helm/Chart.yaml | awk '{print $2}')
119+
CHART_PACKAGE=".cr-release-packages/boundary-${VERSION}.tgz"
120+
121+
echo "Logging into GHCR..."
122+
echo "${GITHUB_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_USER}" --password-stdin
123+
124+
echo "Pushing chart version ${VERSION} to GHCR..."
125+
PUSH_OUTPUT=$(helm push "${CHART_PACKAGE}" oci://ghcr.io/mhmtsvr 2>&1)
126+
echo "$PUSH_OUTPUT"
127+
128+
# Extract digest from helm push output and save for signing step
129+
CHART_DIGEST=$(echo "$PUSH_OUTPUT" | grep -oP 'Digest: \Ksha256:[a-f0-9]+' || echo "")
130+
if [ -n "$CHART_DIGEST" ]; then
131+
echo "$CHART_DIGEST" > /tmp/chart_digest.txt
132+
echo "Chart digest: $CHART_DIGEST"
133+
fi
134+
135+
echo "Chart successfully pushed to oci://ghcr.io/mhmtsvr/boundary:${VERSION}"
136+
echo ""
137+
echo "NOTE: The GHCR package will be private by default."
138+
echo "After the first release, manually change the package visibility to public at:"
139+
echo "https://github.com/users/mhmtsvr/packages/container/boundary/settings"
140+
- run:
141+
name: Install Cosign
142+
command: |
143+
COSIGN_VERSION="v2.4.1"
144+
curl -sSLO "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64"
145+
sudo mv cosign-linux-amd64 /usr/local/bin/cosign
146+
sudo chmod +x /usr/local/bin/cosign
147+
cosign version
148+
- run:
149+
name: Sign Chart with Cosign (Keyless)
150+
command: |
151+
# Extract version from Chart.yaml
152+
VERSION=$(grep '^version:' boundary-helm/Chart.yaml | awk '{print $2}')
153+
154+
# Read the digest saved from the push step
155+
CHART_DIGEST=$(cat /tmp/chart_digest.txt 2>/dev/null || echo "")
156+
157+
if [ -z "$CHART_DIGEST" ]; then
158+
echo "ERROR: Chart digest not found. Cannot sign without digest."
159+
exit 1
160+
fi
161+
162+
CHART_REF="ghcr.io/mhmtsvr/boundary@${CHART_DIGEST}"
163+
echo "Chart reference: ${CHART_REF}"
164+
165+
echo "Authenticating Cosign to GHCR..."
166+
# Cosign needs to authenticate to push the signature artifact to GHCR
167+
echo "${GITHUB_TOKEN}" | cosign login ghcr.io --username "${GITHUB_USER}" --password-stdin
168+
169+
echo "Generating custom OIDC token with Sigstore audience..."
170+
# Generate a custom OIDC token with audience set to "sigstore" for Fulcio
171+
SIGSTORE_OIDC_TOKEN=$(circleci run oidc get --claims '{"aud": "sigstore"}')
172+
173+
echo "Signing chart with Cosign using CircleCI OIDC..."
174+
175+
# Sign using CircleCI's OIDC token (keyless signing)
176+
# This will automatically push the signature to GHCR
177+
cosign sign --yes \
178+
--oidc-issuer=https://oidc.circleci.com/org/${CIRCLE_ORGANIZATION_ID} \
179+
--identity-token="${SIGSTORE_OIDC_TOKEN}" \
180+
--annotations=version="${VERSION}" \
181+
"${CHART_REF}"
182+
183+
echo "Chart successfully signed!"
184+
echo "Signature stored in GHCR alongside the chart artifact"
185+
echo ""
186+
echo "To verify the signature, run:"
187+
echo " cosign verify ${CHART_REF} \\"
188+
echo " --certificate-identity-regexp='https://circleci\.com/api/v2/projects/.+/pipeline-definitions/.+' \\"
189+
echo " --certificate-oidc-issuer-regexp='https://oidc\.circleci\.com/org/.+' \\"
190+
echo " --annotations=version=${VERSION}"
191+
192+
workflows:
193+
version: 2
194+
validate:
195+
jobs:
196+
- lint-and-validate:
197+
filters:
198+
branches:
199+
only: /.*/
200+
- editorconfig-check:
201+
filters:
202+
branches:
203+
only: /.*/
204+
205+
release:
206+
jobs:
207+
- lint-and-validate:
208+
filters:
209+
branches:
210+
ignore: /.*/
211+
tags:
212+
only: /^v[0-9]+\.[0-9]+\.[0-9]+$/
213+
- editorconfig-check:
214+
filters:
215+
branches:
216+
ignore: /.*/
217+
tags:
218+
only: /^v[0-9]+\.[0-9]+\.[0-9]+$/
219+
- validate-docs:
220+
filters:
221+
branches:
222+
ignore: /.*/
223+
tags:
224+
only: /^v[0-9]+\.[0-9]+\.[0-9]+$/
225+
- release:
226+
requires:
227+
- lint-and-validate
228+
- editorconfig-check
229+
- validate-docs
230+
context: gh-release
231+
filters:
232+
branches:
233+
only: main
234+
tags:
235+
only: /^v[0-9]+\.[0-9]+\.[0-9]+$/

‎.editorconfig‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# EditorConfig: https://EditorConfig.org
2+
3+
root = true
4+
5+
# Default settings for all files
6+
[*]
7+
charset = utf-8
8+
end_of_line = lf
9+
insert_final_newline = true
10+
trim_trailing_whitespace = true
11+
indent_style = space
12+
13+
# YAML files (Helm charts, Kubernetes manifests)
14+
[*.{yaml,yml}]
15+
indent_size = 2
16+
17+
# Helm template files
18+
[*.tpl]
19+
indent_size = 2
20+
21+
# Markdown files
22+
[*.md]
23+
indent_size = 2
24+
trim_trailing_whitespace = false
25+
26+
# JSON files
27+
[*.json]
28+
indent_size = 2

‎.gitattributes‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*.tpl linguist-language=Go-Template linguist-detectable
2+
*.yaml linguist-language=YAML linguist-detectable
3+
*.yml linguist-language=YAML linguist-detectable

‎.github/CODEOWNERS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# See syntax guidelines for owners file
2+
# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
3+
4+
# These owners will be the default owners for everything in the repo.
5+
* @mhmtsvr

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve the Boundary Helm chart
4+
title: '[BUG] '
5+
labels: bug
6+
assignees: ''
7+
---
8+
9+
## Bug Description
10+
11+
A clear and concise description of what the bug is.
12+
13+
## Environment
14+
15+
**Chart Version:**
16+
<!-- e.g., x.y.z -->
17+
18+
**Kubernetes Version:**
19+
<!-- Output of: kubectl version -->
20+
21+
**Boundary Version:**
22+
<!-- e.g., x.y.z -->
23+
24+
**PostgreSQL Version:**
25+
<!-- e.g., 18.1 -->
26+
27+
**Helm Version:**
28+
<!-- Output of: helm version -->
29+
30+
## Steps to Reproduce
31+
32+
1. Install the chart with '...'
33+
2. Configure values '...'
34+
3. Execute command '...'
35+
4. See error
36+
37+
## Expected Behavior
38+
39+
A clear and concise description of what you expected to happen.
40+
41+
## Actual Behavior
42+
43+
A clear and concise description of what actually happened.
44+
45+
## Relevant Logs
46+
47+
```
48+
Paste relevant logs here from:
49+
kubectl logs -n boundary <pod-name>
50+
```
51+
52+
## Configuration
53+
54+
Please provide your `values.yaml` configuration (sanitized of sensitive data):
55+
56+
```yaml
57+
# Your values.yaml content here
58+
```
59+
60+
## Additional Context
61+
62+
Add any other context about the problem here (screenshots, error messages, etc.).
63+
64+
## Checklist
65+
66+
- [ ] I have checked the [existing issues](https://github.com/mhmtsvr/boundary-helm/issues) to avoid duplicates
67+
- [ ] I have reviewed the [README](https://github.com/mhmtsvr/boundary-helm/blob/main/README.md) and [PREREQUISITES](https://github.com/mhmtsvr/boundary-helm/blob/main/PREREQUISITES.md)
68+
- [ ] I have tested with the latest version of the chart
69+
- [ ] I have sanitized any sensitive information from logs and configurations

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
### Description
2+
3+
<!-- Provide a brief description of the changes in this PR. -->
4+
5+
### Type of Change
6+
7+
- [ ] Bug fix (non-breaking change which fixes an issue)
8+
- [ ] New feature (non-breaking change which adds functionality)
9+
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
10+
- [ ] Documentation update
11+
- [ ] Refactoring (no functional changes)
12+
13+
14+
### Testing
15+
16+
<!-- Describe the tests you ran to verify your changes: -->
17+
18+
- [ ] Tested installation in a Kubernetes cluster
19+
- [ ] Verified all pods are running
20+
- [ ] Checked logs for errors
21+
22+
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

‎.gitignore‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
tmp/
2+
.DS_Store
3+
4+
# Helm
5+
*.tgz
6+
7+
# Terraform
8+
.terraform/
9+
*.tfstate
10+
*.tfstate.*
11+
*.tfvars

0 commit comments

Comments
 (0)