From d804c72c070ecca9b5b5893dfa0797a84926dff3 Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Mon, 25 May 2026 15:01:35 -0700 Subject: [PATCH] Migrate to custom oci registry Signed-off-by: Bryan Frimin --- .github/workflows/make.yaml | 10 +- .github/workflows/release-helm.yaml | 98 +++++++++++++++++++ .github/workflows/release-probod.yaml | 43 ++++---- CHANGELOG.md | 4 +- Dockerfile | 3 +- GNUmakefile | 7 +- compose.prod.yaml | 2 +- contrib/claude/make.md | 2 +- contrib/claude/release/README.md | 7 +- contrib/claude/release/helm.md | 34 +++++++ contrib/claude/release/probod.md | 2 +- contrib/helm/README.md | 17 +++- contrib/helm/charts/probo/CHANGELOG.md | 5 + contrib/helm/charts/probo/Chart.yaml | 2 +- contrib/helm/charts/probo/README.md | 24 ++++- .../charts/probo/templates/deployment.yaml | 2 +- .../probo/values-production.yaml.example | 2 +- contrib/helm/charts/probo/values.yaml | 4 +- 18 files changed, 224 insertions(+), 44 deletions(-) create mode 100644 .github/workflows/release-helm.yaml create mode 100644 contrib/claude/release/helm.md create mode 100644 contrib/helm/charts/probo/CHANGELOG.md diff --git a/.github/workflows/make.yaml b/.github/workflows/make.yaml index 0cc5196a9..ad8569195 100644 --- a/.github/workflows/make.yaml +++ b/.github/workflows/make.yaml @@ -131,8 +131,9 @@ jobs: - uses: "docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd" # v4.0.0 - uses: "docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121" # v4.1.0 with: - username: "gearnode" - password: ${{ secrets.DOCKER_HUB_TOKEN }} + registry: artifact.probo.inc + username: ${{ secrets.HARBOR_USERNAME }} + password: ${{ secrets.HARBOR_PASSWORD }} - uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8 with: name: "binary-linux-${{ matrix.arch }}" @@ -143,7 +144,8 @@ jobs: run: | docker buildx build \ --platform "${{ matrix.platform }}" \ - --tag "ghcr.io/getprobo/probo:snapshot-${{ matrix.arch }}" \ + --build-arg "BASE_IMAGE=artifact.probo.inc/docker/library/ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b" \ + --tag "artifact.probo.inc/probo/probo:snapshot-${{ matrix.arch }}" \ --load \ . - name: "Cache Trivy database" @@ -155,7 +157,7 @@ jobs: - name: "Scan Docker image with Trivy" uses: "aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25" # 0.36.0 with: - image-ref: "ghcr.io/getprobo/probo:snapshot-${{ matrix.arch }}" + image-ref: "artifact.probo.inc/probo/probo:snapshot-${{ matrix.arch }}" format: "table" exit-code: 1 ignore-unfixed: true diff --git a/.github/workflows/release-helm.yaml b/.github/workflows/release-helm.yaml new file mode 100644 index 000000000..b29fea752 --- /dev/null +++ b/.github/workflows/release-helm.yaml @@ -0,0 +1,98 @@ +name: "Release helm" + +on: + push: + tags: + - "helm/v*" + +permissions: + contents: "read" + +jobs: + publish-helm: + name: "publish-helm" + runs-on: "runs-on=${{ github.run_id }}/runner=2cpu-linux-x64/extras=s3-cache" + permissions: + contents: "read" + steps: + - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6 + - uses: "runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0" # v2 + - uses: "azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112" # v4.3.0 + with: + version: "3.17.3" + - name: "Validate chart version" + run: | + VERSION="${GITHUB_REF_NAME##*/v}" + CHART_VERSION="$(awk '/^version:/ { print $2 }' contrib/helm/charts/probo/Chart.yaml)" + if [ "${CHART_VERSION}" != "${VERSION}" ]; then + echo "Chart.yaml version (${CHART_VERSION}) does not match tag (${VERSION})" + exit 1 + fi + - name: "Log in to Harbor" + run: | + helm registry login artifact.probo.inc \ + --username "${{ secrets.HARBOR_USERNAME }}" \ + --password "${{ secrets.HARBOR_PASSWORD }}" + - name: "Package and push Helm chart" + run: | + VERSION="${GITHUB_REF_NAME##*/v}" + CHART_DIR="contrib/helm/charts/probo" + + helm dependency update "${CHART_DIR}" + helm package "${CHART_DIR}" + helm push "probo-${VERSION}.tgz" oci://artifact.probo.inc/probo + - uses: "actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f" # v7 + with: + name: "helm-chart" + path: "probo-*.tgz" + retention-days: 1 + + github-release: + name: "github-release" + needs: [publish-helm] + runs-on: "runs-on=${{ github.run_id }}/runner=2cpu-linux-x64/extras=s3-cache" + permissions: + contents: "write" + steps: + - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6 + with: + fetch-depth: 0 + - uses: "runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0" # v2 + - uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8 + with: + name: "helm-chart" + path: "." + - name: "Extract release notes" + run: | + VERSION="${GITHUB_REF_NAME##*/v}" + APP_VERSION="$(awk '/^appVersion:/ { gsub(/"/, "", $2); print $2 }' contrib/helm/charts/probo/Chart.yaml)" + awk -v ver="$VERSION" ' + /^## \[/ { if (found) exit; if ($0 ~ "\\[" ver "\\]") found=1 } + found + ' contrib/helm/charts/probo/CHANGELOG.md > release-notes.md + cat >> release-notes.md << EOF + + ## Install + + \`\`\`bash + helm install my-probo oci://artifact.probo.inc/probo/probo --version ${VERSION} + \`\`\` + + Defaults to probod image tag \`v${APP_VERSION}\`. + EOF + - name: "Create GitHub release" + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + PRERELEASE_FLAG="" + if echo "${GITHUB_REF_NAME}" | grep -qE '(alpha|beta|rc)'; then + PRERELEASE_FLAG="--prerelease" + fi + + gh release delete "${GITHUB_REF_NAME}" --yes 2>/dev/null || true + + gh release create "${GITHUB_REF_NAME}" \ + --title "${GITHUB_REF_NAME}" \ + --notes-file release-notes.md \ + $PRERELEASE_FLAG \ + probo-*.tgz diff --git a/.github/workflows/release-probod.yaml b/.github/workflows/release-probod.yaml index 9e4546e9a..16fbd3466 100644 --- a/.github/workflows/release-probod.yaml +++ b/.github/workflows/release-probod.yaml @@ -156,13 +156,9 @@ jobs: - uses: "docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd" # v4.0.0 - uses: "docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2" # v4.0.0 with: - username: "gearnode" - password: ${{ secrets.DOCKER_HUB_TOKEN }} - - uses: "docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2" # v4.0.0 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + registry: artifact.probo.inc + username: ${{ secrets.HARBOR_USERNAME }} + password: ${{ secrets.HARBOR_PASSWORD }} - uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8 with: name: "binary-linux-${{ matrix.arch }}" @@ -173,7 +169,7 @@ jobs: id: tag run: | VERSION="${GITHUB_REF_NAME##*/v}" - echo "image_tag=probod-v${VERSION}" >> "$GITHUB_OUTPUT" + echo "image_tag=v${VERSION}" >> "$GITHUB_OUTPUT" - name: "Build and push Docker image" env: PLATFORM: ${{ matrix.platform }} @@ -182,6 +178,7 @@ jobs: run: | docker buildx build \ --platform "${PLATFORM}" \ + --build-arg "BASE_IMAGE=artifact.probo.inc/docker/library/ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b" \ --label "org.opencontainers.image.title=probod" \ --label "org.opencontainers.image.description=Probo compliance management platform" \ --label "org.opencontainers.image.url=https://github.com/getprobo/probo" \ @@ -189,7 +186,7 @@ jobs: --label "org.opencontainers.image.version=${GITHUB_REF_NAME}" \ --label "org.opencontainers.image.revision=${GITHUB_SHA}" \ --label "org.opencontainers.image.licenses=MIT" \ - --tag "ghcr.io/getprobo/probo:${IMAGE_TAG}-${ARCH}" \ + --tag "artifact.probo.inc/probo/probo:${IMAGE_TAG}-${ARCH}" \ --push \ . @@ -208,35 +205,35 @@ jobs: - uses: "docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd" # v4.0.0 - uses: "docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2" # v4.0.0 with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + registry: artifact.probo.inc + username: ${{ secrets.HARBOR_USERNAME }} + password: ${{ secrets.HARBOR_PASSWORD }} - uses: "sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad" # v4.0.0 - name: "Compute image tag" id: tag run: | VERSION="${GITHUB_REF_NAME##*/v}" - echo "image_tag=probod-v${VERSION}" >> "$GITHUB_OUTPUT" + echo "image_tag=v${VERSION}" >> "$GITHUB_OUTPUT" - name: "Create and push manifest" env: IMAGE_TAG: ${{ steps.tag.outputs.image_tag }} run: | docker buildx imagetools create \ - --tag "ghcr.io/getprobo/probo:${IMAGE_TAG}" \ - --tag "ghcr.io/getprobo/probo:latest" \ - "ghcr.io/getprobo/probo:${IMAGE_TAG}-amd64" \ - "ghcr.io/getprobo/probo:${IMAGE_TAG}-arm64" + --tag "artifact.probo.inc/probo/probo:${IMAGE_TAG}" \ + --tag "artifact.probo.inc/probo/probo:latest" \ + "artifact.probo.inc/probo/probo:${IMAGE_TAG}-amd64" \ + "artifact.probo.inc/probo/probo:${IMAGE_TAG}-arm64" - name: "Get manifest digest" id: digest env: IMAGE_TAG: ${{ steps.tag.outputs.image_tag }} run: | - DIGEST=$(docker buildx imagetools inspect "ghcr.io/getprobo/probo:${IMAGE_TAG}" --format '{{json .Manifest.Digest}}' | jq -r) + DIGEST=$(docker buildx imagetools inspect "artifact.probo.inc/probo/probo:${IMAGE_TAG}" --format '{{json .Manifest.Digest}}' | jq -r) echo "digest=$DIGEST" >> "$GITHUB_OUTPUT" - name: "Sign Docker manifest" env: DIGEST: ${{ steps.digest.outputs.digest }} - run: cosign sign "ghcr.io/getprobo/probo@${DIGEST}" --yes + run: cosign sign "artifact.probo.inc/probo/probo@${DIGEST}" --yes github-release: name: "github-release" @@ -288,13 +285,13 @@ jobs: - name: "Attest Docker image SBOM" uses: "actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26" # v4.1.0 with: - subject-name: "ghcr.io/getprobo/probo" + subject-name: "artifact.probo.inc/probo/probo" subject-digest: ${{ needs.docker-manifest.outputs.digest }} sbom-path: "sbom.json" - name: "Trivy scan Docker image" uses: "aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25" # 0.36.0 with: - image-ref: "ghcr.io/getprobo/probo:${{ needs.docker-manifest.outputs.image_tag }}" + image-ref: "artifact.probo.inc/probo/probo:${{ needs.docker-manifest.outputs.image_tag }}" format: "sarif" output: "trivy-results.sarif" exit-code: 1 @@ -318,8 +315,8 @@ jobs: cat >> release-notes.md << EOF ## Docker Images - - \`ghcr.io/getprobo/probo:${IMAGE_TAG}\` (multi-arch: linux/amd64, linux/arm64) - - \`ghcr.io/getprobo/probo:latest\` (multi-arch: linux/amd64, linux/arm64) + - \`artifact.probo.inc/probo/probo:${IMAGE_TAG}\` (multi-arch: linux/amd64, linux/arm64) + - \`artifact.probo.inc/probo/probo:latest\` (multi-arch: linux/amd64, linux/arm64) EOF - name: "Create GitHub release" env: diff --git a/CHANGELOG.md b/CHANGELOG.md index d6d55c3d0..4c9cd987b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,14 +9,16 @@ Each release track now keeps its own changelog. The history below 0.173.0 of the - `probod-bootstrap` — [cmd/probod-bootstrap/CHANGELOG.md](cmd/probod-bootstrap/CHANGELOG.md) - `@probo/n8n-nodes-probo` — [packages/n8n-node/CHANGELOG.md](packages/n8n-node/CHANGELOG.md) - `@probo/cookie-banner` — [packages/cookie-banner/CHANGELOG.md](packages/cookie-banner/CHANGELOG.md) +- Helm chart (`probo`) — [contrib/helm/charts/probo/CHANGELOG.md](contrib/helm/charts/probo/CHANGELOG.md) ## Tag scheme Each track is published under its own annotated tag of the form `/v`: - `prb/vX.Y.Z` -- `probod/vX.Y.Z` (also tags the `ghcr.io/getprobo/probo` Docker image) +- `probod/vX.Y.Z` (also tags the `artifact.probo.inc/probo/probo` Docker image) - `probod-bootstrap/vX.Y.Z` +- `helm/vX.Y.Z` (also publishes the chart to `oci://artifact.probo.inc/probo/probo`) - `@probo/n8n-nodes-probo/vX.Y.Z` - `@probo/cookie-banner/vX.Y.Z` diff --git a/Dockerfile b/Dockerfile index 6ec4c026d..7d0e2f1a1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,6 @@ # ubuntu:24.04 - pinned to digest for reproducibility (2026-02-05) -FROM ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b +ARG BASE_IMAGE=ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b +FROM ${BASE_IMAGE} LABEL org.opencontainers.image.source="https://github.com/getprobo/probo" LABEL org.opencontainers.image.licenses="MIT" diff --git a/GNUmakefile b/GNUmakefile index a0aedfe63..921bb9294 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -49,7 +49,12 @@ TEST_FLAGS?= -race -cover -coverprofile=coverage.out E2E_CONFIG ?= $(CURDIR)/e2e/console/testdata/config.yaml E2E_COVER_DIR ?= $(CURDIR)/coverage/e2e -DOCKER_IMAGE_NAME= ghcr.io/getprobo/probo +DOCKER_REGISTRY= artifact.probo.inc +DOCKER_PROXY= $(DOCKER_REGISTRY)/docker +DOCKER_BASE_IMAGE= ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b +DOCKER_PROXY_BASE_IMAGE= $(DOCKER_PROXY)/library/$(DOCKER_BASE_IMAGE) +DOCKER_IMAGE_NAME= $(DOCKER_REGISTRY)/probo/probo +HELM_CHART_OCI= oci://$(DOCKER_REGISTRY)/probo DOCKER_TAG_NAME?= latest GENERATED= pkg/server/api/connect/v1/schema/schema.go \ diff --git a/compose.prod.yaml b/compose.prod.yaml index c9d1c5ac1..bcb03dfa7 100644 --- a/compose.prod.yaml +++ b/compose.prod.yaml @@ -1,6 +1,6 @@ services: probo: - image: "ghcr.io/getprobo/probo:latest" + image: "artifact.probo.inc/probo/probo:latest" environment: # Required secrets (use secure values in production) PROBOD_ENCRYPTION_KEY: ${PROBOD_ENCRYPTION_KEY} diff --git a/contrib/claude/make.md b/contrib/claude/make.md index 56c535160..2840fedc5 100644 --- a/contrib/claude/make.md +++ b/contrib/claude/make.md @@ -55,7 +55,7 @@ Individual codegen is driven by `go generate`: | Target | Purpose | | ------------------- | ------------------------------------------------- | -| `make docker-build` | Build the Docker image (`ghcr.io/getprobo/probo`) | +| `make docker-build` | Build the Docker image (`artifact.probo.inc/probo/probo`) | | `make sbom` | Source SBOM (CycloneDX) | | `make sbom-docker` | Docker image SBOM | | `make scan` | Vulnerability scan (Grype) on source + Docker | diff --git a/contrib/claude/release/README.md b/contrib/claude/release/README.md index c6558419c..8bc00b901 100644 --- a/contrib/claude/release/README.md +++ b/contrib/claude/release/README.md @@ -1,6 +1,6 @@ # Release -The repository ships six independently-versioned tracks. Each has its own +The repository ships seven independently-versioned tracks. Each has its own version source, its own `CHANGELOG.md`, its own tag pattern, and its own release workflow. Cutting a release means: bump the version, write a changelog entry, commit, tag, push. @@ -13,6 +13,7 @@ changelog entry, commit, tag, push. | `proboctl` | `proboctl/v*` | [proboctl.md](./proboctl.md) | | `@probo/n8n-nodes-probo` | `@probo/n8n-nodes-probo/v*` | [n8n-nodes-probo.md](./n8n-nodes-probo.md) | | `@probo/cookie-banner` | `@probo/cookie-banner/v*` | [cookie-banner.md](./cookie-banner.md) | +| Helm chart (`probo`) | `helm/v*` | [helm.md](./helm.md) | When the user asks for a release **without specifying a track**, follow [Step 1](#1-decide-which-tracks-to-release) below to detect which tracks @@ -69,6 +70,10 @@ git log $(git describe --tags --abbrev=0 --match='@probo/n8n-nodes-probo/v*')..H # @probo/cookie-banner git log $(git describe --tags --abbrev=0 --match='@probo/cookie-banner/v*')..HEAD --oneline \ -- packages/cookie-banner + +# helm chart +git log $(git describe --tags --abbrev=0 --match='helm/v*')..HEAD --oneline \ + -- contrib/helm ``` If a track returns no commits, skip it. If all commits for a track are diff --git a/contrib/claude/release/helm.md b/contrib/claude/release/helm.md new file mode 100644 index 000000000..dcafe24d3 --- /dev/null +++ b/contrib/claude/release/helm.md @@ -0,0 +1,34 @@ +# Release Helm chart (`probo`) + +After confirming commits below, follow the +[common steps](./README.md#3-common-steps-every-track). + +## Track facts + +- **Tag pattern**: `helm/v*` +- **Version source**: `contrib/helm/charts/probo/Chart.yaml` (`version` field) +- **Version bump**: Edit `version` in `contrib/helm/charts/probo/Chart.yaml` +- **Changelog**: `contrib/helm/charts/probo/CHANGELOG.md` +- **Files to stage**: `contrib/helm/charts/probo/Chart.yaml`, + `contrib/helm/charts/probo/CHANGELOG.md` +- **Workflow**: `.github/workflows/release-helm.yaml` +- **Path filter**: `contrib/helm` + +## Detect commits + +```shell +git log $(git describe --tags --abbrev=0 --match='helm/v*')..HEAD --oneline \ + -- contrib/helm +``` + +If empty or non-user-facing only, do not release this track. + +## Notes + +The chart has its own SemVer (`version`). `appVersion` in `Chart.yaml` is +the default probod application version the chart deploys (image tag +`v`). Bump `appVersion` when the chart should default +to a newer probod release. + +CI packages the chart and pushes it to +`oci://artifact.probo.inc/probo/probo`, then publishes a GitHub Release. diff --git a/contrib/claude/release/probod.md b/contrib/claude/release/probod.md index 438567fdd..720886b67 100644 --- a/contrib/claude/release/probod.md +++ b/contrib/claude/release/probod.md @@ -32,6 +32,6 @@ The changelog covers changes across all four components (`probod`, `@probo/console`, `@probo/trust`, `@probo/ui`). CI builds the frontends and Go binaries, builds and pushes the -multi-arch image to `ghcr.io/getprobo/probo:probod-v` (and +multi-arch image to `artifact.probo.inc/probo/probo:v` (and `:latest`), runs Trivy + cosign + attestations, and publishes the GitHub Release. diff --git a/contrib/helm/README.md b/contrib/helm/README.md index 5416b5f98..f2659fd01 100644 --- a/contrib/helm/README.md +++ b/contrib/helm/README.md @@ -18,7 +18,20 @@ Before deploying Probo, ensure you have: ## Install -#### Using Local Chart +### From OCI Registry + +```bash +helm install my-probo oci://artifact.probo.inc/probo/probo --version +``` + +Replace `` with a released chart version (e.g. `0.1.0`). The +chart defaults to the probod image tag `v` from +`Chart.yaml`. + +Configure secrets and external services with `--set` flags or a values file +(see [Helm Chart Documentation](charts/probo/README.md)). + +### From Local Chart ##### Generate Secrets @@ -302,7 +315,7 @@ spec: | Key | Type | Default | Description | |---------------------------------------------------------| ------- |----------------------------------------------------|-----------------------------------------------------------------------------------------------------| | replicaCount | int | `1` | Number of Probo application replicas | -| image.repository | string | `"ghcr.io/getprobo/probo"` | Container image repository | +| image.repository | string | `"artifact.probo.inc/probo/probo"` | Container image repository | | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy | | image.tag | string | `"latest"` | Overrides the image tag whose default is the chart appVersion | | imagePullSecrets | list | `[]` | Image pull secrets for private registries | diff --git a/contrib/helm/charts/probo/CHANGELOG.md b/contrib/helm/charts/probo/CHANGELOG.md new file mode 100644 index 000000000..9dd7ca856 --- /dev/null +++ b/contrib/helm/charts/probo/CHANGELOG.md @@ -0,0 +1,5 @@ +# Changelog + +All notable changes to the Probo Helm chart will be documented in this file. + +## Unreleased diff --git a/contrib/helm/charts/probo/Chart.yaml b/contrib/helm/charts/probo/Chart.yaml index b2c75dae4..cdabef574 100644 --- a/contrib/helm/charts/probo/Chart.yaml +++ b/contrib/helm/charts/probo/Chart.yaml @@ -3,7 +3,7 @@ name: probo description: A Helm chart for deploying Probo - Open Source Compliance Platform type: application version: 0.1.0 -appVersion: "0.74.7" +appVersion: "0.191.0" keywords: - compliance - soc2 diff --git a/contrib/helm/charts/probo/README.md b/contrib/helm/charts/probo/README.md index 826b5cc89..f96981a7c 100644 --- a/contrib/helm/charts/probo/README.md +++ b/contrib/helm/charts/probo/README.md @@ -12,7 +12,25 @@ This Helm chart deploys Probo - an open-source SOC-2 compliance platform - on Ku ## Installing the Chart -### Generate Required Secrets +### From OCI Registry + +```bash +helm install probo oci://artifact.probo.inc/probo/probo --version \ + --set probo.baseUrl="probo.example.com" \ + --set probo.encryptionKey="$ENCRYPTION_KEY" \ + --set probo.auth.cookieSecret="$COOKIE_SECRET" \ + --set probo.auth.passwordPepper="$PASSWORD_PEPPER" \ + --set probo.trustAuth.tokenSecret="$TRUST_TOKEN_SECRET" \ + --set postgresql.host="postgres.example.com" \ + --set postgresql.password="" \ + --set s3.bucket="probo-production" \ + --set s3.accessKeyId="" \ + --set s3.secretAccessKey="" +``` + +### From Local Chart + +#### Generate Required Secrets ```bash # Generate required secrets @@ -63,7 +81,7 @@ For production, create a `values-production.yaml` file: ```yaml # values-production.yaml image: - repository: ghcr.io/getprobo/probo + repository: artifact.probo.inc/probo/probo tag: "0.74.7" replicaCount: 3 @@ -147,7 +165,7 @@ The following parameters **must** be configured: | Parameter | Description | Default | |------------------------|---------------------------------|---------| -| `image.repository` | Probo image repository | `ghcr.io/getprobo/probo` | +| `image.repository` | Probo image repository | `artifact.probo.inc/probo/probo` | | `image.tag` | Probo image tag | Chart appVersion | | `replicaCount` | Number of Probo replicas | `1` | | `probo.baseUrl` | Public baseUrl | `probo.example.com` | diff --git a/contrib/helm/charts/probo/templates/deployment.yaml b/contrib/helm/charts/probo/templates/deployment.yaml index bf60e54ab..a8fc049b3 100644 --- a/contrib/helm/charts/probo/templates/deployment.yaml +++ b/contrib/helm/charts/probo/templates/deployment.yaml @@ -35,7 +35,7 @@ spec: - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}" imagePullPolicy: {{ .Values.image.pullPolicy }} env: - name: CONFIG_FILE diff --git a/contrib/helm/charts/probo/values-production.yaml.example b/contrib/helm/charts/probo/values-production.yaml.example index 0c595f7fb..e566d88a9 100644 --- a/contrib/helm/charts/probo/values-production.yaml.example +++ b/contrib/helm/charts/probo/values-production.yaml.example @@ -4,7 +4,7 @@ # Use specific version tag image: - repository: ghcr.io/getprobo/probo + repository: artifact.probo.inc/probo/probo tag: "0.74.7" pullPolicy: IfNotPresent diff --git a/contrib/helm/charts/probo/values.yaml b/contrib/helm/charts/probo/values.yaml index eff51540f..890ae9470 100644 --- a/contrib/helm/charts/probo/values.yaml +++ b/contrib/helm/charts/probo/values.yaml @@ -5,10 +5,10 @@ replicaCount: 1 image: - repository: ghcr.io/getprobo/probo + repository: artifact.probo.inc/probo/probo pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "latest" + tag: "" imagePullSecrets: [] nameOverride: ""