From 4d12fed6cd9a2c36c28261c8ec8e5a4c027c920d Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Sun, 3 May 2026 16:31:09 +0200 Subject: [PATCH] chore: update repository structure --- .gitea/workflows/artifacthub-metadata.yaml | 41 ++++++ .gitea/workflows/helm.yaml | 4 +- .gitea/workflows/release.yaml | 140 +++++++++++++++++---- .markdownlint.yaml | 1 - .vscode/settings.json | 5 +- Chart.yaml | 7 ++ README.md | 64 +++------- renovate.json | 7 -- 8 files changed, 187 insertions(+), 82 deletions(-) create mode 100644 .gitea/workflows/artifacthub-metadata.yaml diff --git a/.gitea/workflows/artifacthub-metadata.yaml b/.gitea/workflows/artifacthub-metadata.yaml new file mode 100644 index 0000000..b7e0960 --- /dev/null +++ b/.gitea/workflows/artifacthub-metadata.yaml @@ -0,0 +1,41 @@ +name: Upload ArtifactHub Metadata + +on: + schedule: + - cron: '0 3 1 * *' + workflow_dispatch: + +jobs: + upload-metadata: + name: "Upload artifacthub-repo.yml to OCI registry" + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v6.0.2 + - uses: docker/login-action@v4.1.0 + with: + registry: ${{ github.server_url }} + username: ${{ github.repository_owner }} + password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} + - uses: oras-project/setup-oras@v2.0.0 + with: + version: 1.3.2 # renovate: datasource=github-tags depName=oras-project/oras extractVersion='^v?(?.*)$' + - name: Extract meta information + run: | + echo "GITEA_SERVER_HOSTNAME=$(echo "${GITHUB_SERVER_URL}" | cut -d '/' -f 3)" >> $GITHUB_ENV + echo "PACKAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV + echo "REPOSITORY_NAME=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 2 | sed --regexp-extended 's/-charts?//g')" >> $GITHUB_ENV + echo "REPOSITORY_OWNER=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 1)" >> $GITHUB_ENV + - name: Push artifacthub-repo.yml + run: | + oras push ${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}:artifacthub.io \ + --config /dev/null:application/vnd.cncf.artifacthub.config.v1+yaml \ + artifacthub-repo.yml:application/vnd.cncf.artifacthub.repository-metadata.layer.v1.yaml + - name: Push public cosign key + env: + COSIGN_PUBLIC_KEY: ${{ vars.COSIGN_PUBLIC_KEY }} + run: | + echo "${COSIGN_PUBLIC_KEY}" > cosign.pub + oras push ${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}:cosign.pub \ + --artifact-type application/vnd.dev.cosign.public-key.v1 \ + --annotation org.opencontainers.image.title=cosign.pub \ + cosign.pub:application/vnd.dev.cosign.public-key.v1 diff --git a/.gitea/workflows/helm.yaml b/.gitea/workflows/helm.yaml index 7c486dc..d19bc38 100644 --- a/.gitea/workflows/helm.yaml +++ b/.gitea/workflows/helm.yaml @@ -17,7 +17,7 @@ jobs: - uses: actions/checkout@v6.0.2 - uses: azure/setup-helm@v5.0.0 with: - version: v4.0.1 # renovate: datasource=github-releases depName=helm/helm + version: "v4.1.4" # renovate: datasource=github-tags depName=helm/helm - name: Lint helm files run: | helm lint --values values.yaml . @@ -28,7 +28,7 @@ jobs: - uses: actions/checkout@v6.0.2 - uses: azure/setup-helm@v5.0.0 with: - version: v4.0.1 # renovate: datasource=github-releases depName=helm/helm + version: "v4.1.4" # renovate: datasource=github-tags depName=helm/helm - env: HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest name: Install helm-unittest diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml index b3b9c08..4767ea7 100644 --- a/.gitea/workflows/release.yaml +++ b/.gitea/workflows/release.yaml @@ -1,5 +1,10 @@ name: Release +env: + GPG_PRIVATE_KEY_FILE: ${{ runner.temp }}/private.key + GPG_PRIVATE_KEY_FINGERPRINT: ${{ vars.GPG_PRIVATE_KEY_FINGERPRINT }} + GPG_PRIVATE_KEY_PASSPHRASE_FILE: ${{ runner.temp }}/passphrase.txt + on: push: tags: @@ -7,14 +12,58 @@ on: jobs: publish-chart: - container: - image: docker.io/volkerraschek/helm:3.19.2 runs-on: ubuntu-latest steps: - - name: Install packages via apk + - uses: sigstore/cosign-installer@v4.1.1 + with: + cosign-release: "v3.0.6" # renovate: datasource=github-tags depName=sigstore/cosign + + - uses: azure/setup-helm@v5.0.0 + with: + version: "v4.1.4" # renovate: datasource=github-tags depName=helm/helm + + - name: Install helm plugins + env: + HELM_SIGSTORE_VERSION: "0.3.0" # renovate: datasource=github-tags depName=sigstore/helm-sigstore extractVersion='^v(?\d+\.\d+\.\d+)$' + HELM_SCHEMA_VALUES_VERSION: "2.3.1" # renovate: datasource=github-tags depName=losisin/helm-values-schema-json extractVersion='^v(?\d+\.\d+\.\d+)$' + HELM_UNITTEST_VERSION: "1.0.3" # renovate: datasource=github-tags depName=helm-unittest/helm-unittest extractVersion='^v(?\d+\.\d+\.\d+)$' run: | - apk update - apk add git npm jq yq + helm plugin install --verify=false https://github.com/sigstore/helm-sigstore.git --version "${HELM_SIGSTORE_VERSION}" 1> /dev/null + helm plugin install --verify=false https://github.com/losisin/helm-values-schema-json.git --version "${HELM_SCHEMA_VALUES_VERSION}" 1> /dev/null + helm plugin install --verify=false https://github.com/helm-unittest/helm-unittest.git --version "${HELM_UNITTEST_VERSION}" 1> /dev/null + helm plugin list + + - name: GPG configuration + env: + GPG_PRIVATE_KEY_PASSPHRASE: ${{ secrets.GPG_PRIVATE_KEY_PASSPHRASE }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} + run: | + # Configure GPG and GPG Agent + mkdir --parents "${HOME}/.gnupg" + chmod 0700 "${HOME}/.gnupg" + + cat > "${HOME}/.gnupg/gpg.conf" < "${HOME}/.gnupg/gpg-agent.conf" < "${GPG_PRIVATE_KEY_PASSPHRASE_FILE}" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}" + cat 1> "${GPG_PRIVATE_KEY_FILE}" <<< "${GPG_PRIVATE_KEY}" + gpg --batch --yes --passphrase-fd 0 --import "${GPG_PRIVATE_KEY_FILE}" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}" + + # Export GPG keyring + gpg --batch --yes --export "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/pubring.gpg" + gpg --batch --yes --passphrase-fd 0 --export-secret-keys "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/secring.gpg" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}" - uses: actions/checkout@v6.0.2 with: @@ -28,9 +77,10 @@ jobs: - name: Extract meta information run: | + echo "GITEA_SERVER_HOSTNAME=$(echo "${GITHUB_SERVER_URL}" | cut --delimiter '/' --fields 3)" >> $GITHUB_ENV echo "PACKAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV - echo "REPOSITORY_NAME=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 2 | sed --regexp-extended 's/-charts?//g')" >> $GITHUB_ENV - echo "REPOSITORY_OWNER=$(echo ${GITHUB_REPOSITORY} | cut -d '/' -f 1)" >> $GITHUB_ENV + echo "REPOSITORY_NAME=$(echo ${GITHUB_REPOSITORY} | cut --delimiter '/' --fields 2 | sed --regexp-extended 's/-charts?//g')" >> $GITHUB_ENV + echo "REPOSITORY_OWNER=$(echo ${GITHUB_REPOSITORY} | cut --delimiter '/' --fields 1)" >> $GITHUB_ENV - name: Update Helm Chart version in README.md run: sed -i -E "s/^CHART_VERSION=.*/CHART_VERSION=${PACKAGE_VERSION}/g" README.md @@ -38,24 +88,70 @@ jobs: - name: Package chart run: | helm dependency build - helm package --version "${PACKAGE_VERSION}" ./ + helm package \ + --sign \ + --key "$(gpg --with-colons --list-keys "${GPG_PRIVATE_KEY_FINGERPRINT}" | grep uid | cut --delimiter ':' --fields 10)" \ + --keyring "${HOME}/.gnupg/secring.gpg" \ + --passphrase-file "${GPG_PRIVATE_KEY_PASSPHRASE_FILE}" \ + --version "${PACKAGE_VERSION}" ./ - - name: Upload Chart to ChartMuseum + - uses: docker/login-action@v4.1.0 + with: + registry: ${{ github.server_url }} + username: ${{ github.repository_owner }} + password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} + + - name: Upload Chart to Gitea (OCI) env: + COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} + COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} + run: | + helm push ${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz oci://${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER} + cosign sign --yes --upload=true --key=env://COSIGN_PRIVATE_KEY ${GITEA_SERVER_HOSTNAME}/${REPOSITORY_OWNER}/${REPOSITORY_NAME}:${PACKAGE_VERSION} + + - name: Upload Chart to Gitea (Helm) + env: + GITEA_REGISTRY_TOKEN: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} + run: | + curl \ + --fail \ + --show-error \ + --request POST \ + --user "${REPOSITORY_OWNER}:${GITEA_REGISTRY_TOKEN}" \ + --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz" \ + https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/charts + + if [ -f "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" ]; then + curl \ + --fail \ + --show-error \ + --request POST \ + --user "${CHARTMUSEUM_USERNAME}:${CHARTMUSEUM_PASSWORD}" \ + --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" \ + https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/prov + fi + + - name: Upload Chart to Chartmuseum (Helm) + env: + CHARTMUSEUM_HOSTNAME: ${{ vars.CHARTMUSEUM_HOSTNAME }} + CHARTMUSEUM_USERNAME: ${{ secrets.CHARTMUSEUM_USERNAME }} CHARTMUSEUM_PASSWORD: ${{ secrets.CHARTMUSEUM_PASSWORD }} CHARTMUSEUM_REPOSITORY: ${{ vars.CHARTMUSEUM_REPOSITORY }} - CHARTMUSEUM_USERNAME: ${{ secrets.CHARTMUSEUM_USERNAME }} - CHARTMUSEUM_HOSTNAME: ${{ vars.CHARTMUSEUM_HOSTNAME }} run: | - helm repo add --username ${CHARTMUSEUM_USERNAME} --password ${CHARTMUSEUM_PASSWORD} chartmuseum https://${CHARTMUSEUM_HOSTNAME}/${CHARTMUSEUM_REPOSITORY} - helm cm-push ${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz chartmuseum - helm repo remove chartmuseum + curl \ + --fail \ + --show-error \ + --request POST \ + --user "${CHARTMUSEUM_USERNAME}:${CHARTMUSEUM_PASSWORD}" \ + --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz" \ + https://${CHARTMUSEUM_HOSTNAME}/api/${CHARTMUSEUM_REPOSITORY}/charts - - name: Upload Chart to Gitea - env: - GITEA_PACKAGE_REGISTRY_TOKEN: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }} - GITEA_SERVER_URL: ${{ github.server_url }} - run: | - helm repo add --username ${REPOSITORY_OWNER} --password ${GITEA_PACKAGE_REGISTRY_TOKEN} gitea ${GITEA_SERVER_URL}/api/packages/${REPOSITORY_OWNER}/helm - helm cm-push ${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz gitea - helm repo remove gitea + if [ -f "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" ]; then + curl \ + --fail \ + --show-error \ + --request POST \ + --user "${CHARTMUSEUM_USERNAME}:${CHARTMUSEUM_PASSWORD}" \ + --upload-file ${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov \ + https://${CHARTMUSEUM_HOSTNAME}/api/${CHARTMUSEUM_REPOSITORY}/prov + fi diff --git a/.markdownlint.yaml b/.markdownlint.yaml index 5156987..247f790 100644 --- a/.markdownlint.yaml +++ b/.markdownlint.yaml @@ -136,7 +136,6 @@ MD044: - kube-prometheus-stack - Memcached - Oracle - - ORBIS U - PostgreSQL - Prometheus - prometheus-exporter diff --git a/.vscode/settings.json b/.vscode/settings.json index f65313f..bf3294f 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -1,8 +1,11 @@ { + "files.associations": { + ".gitea/workflows/*.yaml": "github-actions-workflow" + }, "yaml.schemas": { "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.0.3/schema/helm-testsuite.json": [ "/unittests/**/*.yaml" ] }, "yaml.schemaStore.enable": true -} \ No newline at end of file +} diff --git a/Chart.yaml b/Chart.yaml index dccd205..75e8f03 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -1,12 +1,19 @@ annotations: + artifacthub.io/license: MIT artifacthub.io/links: | - name: Prometheus Fail2Ban exporter (binary) url: https://git.cryptic.systems/volker.raschek/prometheus-fail2ban-exporter - name: support url: https://git.cryptic.systems/volker.raschek/prometheus-fail2ban-exporter-charts/issues + artifacthub.io/operator: "false" + artifacthub.io/prerelease: "false" + artifacthub.io/signKey: | + fingerprint: 3B0CE9853CAD76076260025383D342258456906E + url: https://keys.openpgp.org/vks/v1/by-fingerprint/3B0CE9853CAD76076260025383D342258456906E apiVersion: v2 appVersion: "0.1.1" description: Prometheus metric exporter for Fail2Ban +home: https://git.cryptic.systems/volker.raschek/prometheus-fail2ban-exporter-charts # icon: https://annotations.example.com/icon.png keywords: - prometheus diff --git a/README.md b/README.md index 7b7380b..0704016 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,8 @@ separate [chapter](#argocd). ## Helm: configuration and installation -1. A helm chart repository must be configured, to pull the helm charts from. +1. A helm chart repository must be configured, to pull the helm charts from. The helm charts can either be pulled from + the classic helm chart repository or OCI registry. 2. All available [parameters](#parameters) are documented in detail below. The parameters can be defined via the helm `--set` flag or directly as part of a `values.yaml` file. The following example defines the `prometheus-exporter` repository and use the `--set` flag for a basic deployment. @@ -32,7 +33,7 @@ separate [chapter](#argocd). > time is not possible. ```bash -helm repo add prometheus-exporters https://charts.cryptic.systems/prometheus-exporters +helm repo add prometheus-exporters https://git.cryptic.systems/api/packages/volker.raschek/helm helm repo update CHART_VERSION=0.4.21 helm install --version "${CHART_VERSION}" prometheus-fail2ban-exporter prometheus-exporters/prometheus-fail2ban-exporter \ @@ -40,6 +41,18 @@ helm install --version "${CHART_VERSION}" prometheus-fail2ban-exporter prometheu --set 'prometheus.metrics.serviceMonitor.enabled=true' ``` +Alternatively, the deployment of the helm charts can also be done via an OCI registry: + +```bash +CHART_VERSION=0.5.9 +helm install "oci://git.cryptic.systems/volker.raschek/prometheus-fail2ban-exporter:${CHART_VERSION}" \ + --set 'config.database.secret.databaseUsername=postgres' \ + --set 'config.database.secret.databasePassword=postgres' \ + --set 'config.database.secret.databaseConnectionUrl="postgres.example.local:5432/postgres?ssl=disable"' \ + --set 'prometheus.metrics.enabled=true' \ + --set 'prometheus.metrics.serviceMonitor.enabled=true' +``` + Instead of passing all parameters via the *set* flag, it is also possible to define them as part of the `values.yaml`. The following command downloads the `values.yaml` for a specific version of this chart. Please keep in mind, that the version of the chart must be in sync with the `values.yaml`. Newer *minor* versions can have new features. New *major* @@ -93,53 +106,6 @@ helm install --version "${CHART_VERSION}" prometheus-fail2ban-exporter prometheu --set 'daemonSet.fail2banExporter.resources.limits.cpu=1000m' ``` - - #### Grafana dashboard The helm chart includes Grafana dashboards. These can be deployed as a configMap by activating Grafana integration. It diff --git a/renovate.json b/renovate.json index 28e575e..57045c6 100644 --- a/renovate.json +++ b/renovate.json @@ -44,13 +44,6 @@ } ], "packageRules": [ - { - "groupName": "Update docker.io/volkerraschek/helm", - "matchDepNames": [ - "docker.io/volkerraschek/helm", - "volkerraschek/helm" - ] - }, { "automerge": true, "groupName": "Update helm plugin 'unittest'",