bump everything to common 14.0.1 (will need to fix inherently failing CI)

**Description**
With the removal of manifest manager tc-system is removed for new users.
Traefik should use it's own namespace for middlewares instead and common
is already adapted to allow this.

This change also allows us to throw errors if traefik isn't installed on
a system when ingress is enabled.

Downside is that this currently breaks ingressclass, which is a
non-supported setup currently, untill we do more R&D for cleanly
handling ingressClasses, namespaces and middlewares correctly.

Also adds helm and SCALE support for the modsecurity plugin.

Also fixes CI bug with metallb.

**⚙️ Type of change**

- [x] ⚙️ Feature/App addition
- [x] 🪛 Bugfix
- [x] ⚠️ Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [x] 🔃 Refactor of current code

**🧪 How Has This Been Tested?**
<!--
Please describe the tests that you ran to verify your changes. Provide
instructions so we can reproduce. Please also list any relevant details
for your test configuration
-->

**📃 Notes:**
<!-- Please enter any other relevant information here -->

**✔️ Checklist:**

- [ ] ⚖️ My code follows the style guidelines of this project
- [ ] 👀 I have performed a self-review of my own code
- [ ] #️⃣ I have commented my code, particularly in hard-to-understand
areas
- [ ] 📄 I have made corresponding changes to the documentation
- [ ] ⚠️ My changes generate no new warnings
- [ ] 🧪 I have added tests to this description that prove my fix is
effective or that my feature works
- [ ] ⬆️ I increased versions for any altered app according to semantic
versioning

**➕ App addition**

If this PR is an app addition please make sure you have done the
following.

- [ ] 🪞 I have opened a PR on
[truecharts/containers](https://github.com/truecharts/containers) adding
the container to TrueCharts mirror repo.
- [ ] 🖼️ I have added an icon in the Chart's root directory called
`icon.png`

---

_Please don't blindly check all the boxes. Read them and only check
those that apply.
Those checkboxes are there for the reviewer to see what is this all
about and
the status of this PR with a quick glance._

.all-contributorsrc

@@ -504,7 +504,8 @@
       "avatar_url": "https://avatars.githubusercontent.com/u/18377483?v=4",
       "profile": "https://github.com/j0hnby",
       "contributions": [
-        "bug"
+        "bug",
+        "doc"
       ]
     },
     {
@@ -1688,7 +1689,8 @@
       "avatar_url": "https://avatars.githubusercontent.com/u/1540233?v=4",
       "profile": "https://github.com/nautilus7",
       "contributions": [
-        "bug"
+        "bug",
+        "code"
       ]
     },
     {
@@ -1790,9 +1792,128 @@
       "contributions": [
         "code"
       ]
+    },
+    {
+      "login": "Emalton",
+      "name": "John P",
+      "avatar_url": "https://avatars.githubusercontent.com/u/9328458?v=4",
+      "profile": "https://github.com/Emalton",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "kryojenik",
+      "name": "kryojenik",
+      "avatar_url": "https://avatars.githubusercontent.com/u/845427?v=4",
+      "profile": "https://github.com/kryojenik",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "malcolmcdixon",
+      "name": "Malcolm",
+      "avatar_url": "https://avatars.githubusercontent.com/u/56974882?v=4",
+      "profile": "https://github.com/malcolmcdixon",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "depasseg",
+      "name": "depasseg",
+      "avatar_url": "https://avatars.githubusercontent.com/u/3201827?v=4",
+      "profile": "https://github.com/depasseg",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "j1mbl3s",
+      "name": "j1mbl3s",
+      "avatar_url": "https://avatars.githubusercontent.com/u/44634577?v=4",
+      "profile": "https://github.com/j1mbl3s",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "VictorienXP",
+      "name": "VictorienXP",
+      "avatar_url": "https://avatars.githubusercontent.com/u/1633366?v=4",
+      "profile": "https://github.com/VictorienXP",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "yelhouti",
+      "name": "yelhouti",
+      "avatar_url": "https://avatars.githubusercontent.com/u/5471639?v=4",
+      "profile": "https://github.com/yelhouti",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "svetlemodry",
+      "name": "Jaroslav Lichtblau",
+      "avatar_url": "https://avatars.githubusercontent.com/u/8712544?v=4",
+      "profile": "https://github.com/svetlemodry",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "Maximilian-Staab",
+      "name": "MaximilianS",
+      "avatar_url": "https://avatars.githubusercontent.com/u/20892091?v=4",
+      "profile": "https://github.com/Maximilian-Staab",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "dionlarson",
+      "name": "Dion Larson",
+      "avatar_url": "https://avatars.githubusercontent.com/u/1843883?v=4",
+      "profile": "http://dionlarson.com",
+      "contributions": [
+        "code",
+        "doc"
+      ]
+    },
+    {
+      "login": "Physics-Dude",
+      "name": "Physics-Dude",
+      "avatar_url": "https://avatars.githubusercontent.com/u/22563517?v=4",
+      "profile": "https://github.com/Physics-Dude",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "waflint",
+      "name": "waflint",
+      "avatar_url": "https://avatars.githubusercontent.com/u/94139453?v=4",
+      "profile": "https://github.com/waflint",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "Shrinks99",
+      "name": "Henry Wilkinson",
+      "avatar_url": "https://avatars.githubusercontent.com/u/5672810?v=4",
+      "profile": "https://github.com/Shrinks99",
+      "contributions": [
+        "code"
+      ]
     }
   ],
   "contributorsPerLine": 7,
   "skipCi": true,
-  "commitConvention": "angular"
+  "commitConvention": "angular",
+  "commitType": "docs"
 }

.github/README.md

@@ -124,7 +124,7 @@ A lot of our work is based on the great effort of others. We would love to exten
 ## Contributors ✨
 
 <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
-[![All Contributors](https://img.shields.io/badge/all_contributors-191-orange.svg?style=for-the-badge)](#contributors)
+[![All Contributors](https://img.shields.io/badge/all_contributors-204-orange.svg?style=for-the-badge)](#contributors)
 <!-- ALL-CONTRIBUTORS-BADGE:END -->
 
 Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
@@ -201,7 +201,7 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
     </tr>
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/eingemaischt"><img src="https://avatars.githubusercontent.com/u/151498?v=4?s=100" width="100px;" alt="Philipp"/><br /><sub><b>Philipp</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Aeingemaischt" title="Bug reports">🐛</a></td>
-      <td align="center" valign="top" width="14.28%"><a href="https://github.com/j0hnby"><img src="https://avatars.githubusercontent.com/u/18377483?v=4?s=100" width="100px;" alt="John"/><br /><sub><b>John</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Aj0hnby" title="Bug reports">🐛</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/j0hnby"><img src="https://avatars.githubusercontent.com/u/18377483?v=4?s=100" width="100px;" alt="John"/><br /><sub><b>John</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Aj0hnby" title="Bug reports">🐛</a> <a href="https://github.com/truecharts/charts/commits?author=j0hnby" title="Documentation">📖</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/john-parton"><img src="https://avatars.githubusercontent.com/u/2071543?v=4?s=100" width="100px;" alt="John Parton"/><br /><sub><b>John Parton</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Ajohn-parton" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/Amasis"><img src="https://avatars.githubusercontent.com/u/7325217?v=4?s=100" width="100px;" alt="Marc"/><br /><sub><b>Marc</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3AAmasis" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/fdzaebel"><img src="https://avatars.githubusercontent.com/u/46503230?v=4?s=100" width="100px;" alt="fdzaebel"/><br /><sub><b>fdzaebel</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Afdzaebel" title="Bug reports">🐛</a></td>
@@ -366,7 +366,7 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/CommanderStarhump"><img src="https://avatars.githubusercontent.com/u/91758053?v=4?s=100" width="100px;" alt="CommanderStarhump"/><br /><sub><b>CommanderStarhump</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3ACommanderStarhump" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/vianchiel"><img src="https://avatars.githubusercontent.com/u/123665622?v=4?s=100" width="100px;" alt="Vianchiel"/><br /><sub><b>Vianchiel</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Avianchiel" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/b-m-f"><img src="https://avatars.githubusercontent.com/u/2843450?v=4?s=100" width="100px;" alt="Maximilian Ehlers"/><br /><sub><b>Maximilian Ehlers</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Ab-m-f" title="Bug reports">🐛</a></td>
-      <td align="center" valign="top" width="14.28%"><a href="https://github.com/nautilus7"><img src="https://avatars.githubusercontent.com/u/1540233?v=4?s=100" width="100px;" alt="nautilus7"/><br /><sub><b>nautilus7</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Anautilus7" title="Bug reports">🐛</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/nautilus7"><img src="https://avatars.githubusercontent.com/u/1540233?v=4?s=100" width="100px;" alt="nautilus7"/><br /><sub><b>nautilus7</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Anautilus7" title="Bug reports">🐛</a> <a href="https://github.com/truecharts/charts/commits?author=nautilus7" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/kqmaverick"><img src="https://avatars.githubusercontent.com/u/121722567?v=4?s=100" width="100px;" alt="kqmaverick"/><br /><sub><b>kqmaverick</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Akqmaverick" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/ccalby"><img src="https://avatars.githubusercontent.com/u/680553?v=4?s=100" width="100px;" alt="ccalby"/><br /><sub><b>ccalby</b></sub></a><br /><a href="https://github.com/truecharts/charts/issues?q=author%3Accalby" title="Bug reports">🐛</a></td>
     </tr>
@@ -382,6 +382,23 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
     <tr>
       <td align="center" valign="top" width="14.28%"><a href="https://fnichol.com"><img src="https://avatars.githubusercontent.com/u/261548?v=4?s=100" width="100px;" alt="Fletcher Nichol"/><br /><sub><b>Fletcher Nichol</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=fnichol" title="Code">💻</a> <a href="https://github.com/truecharts/charts/issues?q=author%3Afnichol" title="Bug reports">🐛</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://marcofaggian.com"><img src="https://avatars.githubusercontent.com/u/19221001?v=4?s=100" width="100px;" alt="Marco Faggian"/><br /><sub><b>Marco Faggian</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=marcofaggian" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/Emalton"><img src="https://avatars.githubusercontent.com/u/9328458?v=4?s=100" width="100px;" alt="John P"/><br /><sub><b>John P</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=Emalton" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/kryojenik"><img src="https://avatars.githubusercontent.com/u/845427?v=4?s=100" width="100px;" alt="kryojenik"/><br /><sub><b>kryojenik</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=kryojenik" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/malcolmcdixon"><img src="https://avatars.githubusercontent.com/u/56974882?v=4?s=100" width="100px;" alt="Malcolm"/><br /><sub><b>Malcolm</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=malcolmcdixon" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/depasseg"><img src="https://avatars.githubusercontent.com/u/3201827?v=4?s=100" width="100px;" alt="depasseg"/><br /><sub><b>depasseg</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=depasseg" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/j1mbl3s"><img src="https://avatars.githubusercontent.com/u/44634577?v=4?s=100" width="100px;" alt="j1mbl3s"/><br /><sub><b>j1mbl3s</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=j1mbl3s" title="Documentation">📖</a></td>
+    </tr>
+    <tr>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/VictorienXP"><img src="https://avatars.githubusercontent.com/u/1633366?v=4?s=100" width="100px;" alt="VictorienXP"/><br /><sub><b>VictorienXP</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=VictorienXP" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/yelhouti"><img src="https://avatars.githubusercontent.com/u/5471639?v=4?s=100" width="100px;" alt="yelhouti"/><br /><sub><b>yelhouti</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=yelhouti" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/svetlemodry"><img src="https://avatars.githubusercontent.com/u/8712544?v=4?s=100" width="100px;" alt="Jaroslav Lichtblau"/><br /><sub><b>Jaroslav Lichtblau</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=svetlemodry" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/Maximilian-Staab"><img src="https://avatars.githubusercontent.com/u/20892091?v=4?s=100" width="100px;" alt="MaximilianS"/><br /><sub><b>MaximilianS</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=Maximilian-Staab" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="http://dionlarson.com"><img src="https://avatars.githubusercontent.com/u/1843883?v=4?s=100" width="100px;" alt="Dion Larson"/><br /><sub><b>Dion Larson</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=dionlarson" title="Code">💻</a> <a href="https://github.com/truecharts/charts/commits?author=dionlarson" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/Physics-Dude"><img src="https://avatars.githubusercontent.com/u/22563517?v=4?s=100" width="100px;" alt="Physics-Dude"/><br /><sub><b>Physics-Dude</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=Physics-Dude" title="Documentation">📖</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/waflint"><img src="https://avatars.githubusercontent.com/u/94139453?v=4?s=100" width="100px;" alt="waflint"/><br /><sub><b>waflint</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=waflint" title="Code">💻</a></td>
+    </tr>
+    <tr>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/Shrinks99"><img src="https://avatars.githubusercontent.com/u/5672810?v=4?s=100" width="100px;" alt="Henry Wilkinson"/><br /><sub><b>Henry Wilkinson</b></sub></a><br /><a href="https://github.com/truecharts/charts/commits?author=Shrinks99" title="Code">💻</a></td>
     </tr>
   </tbody>
 </table>

.github/actions/collect-changes/action.yaml

@@ -42,13 +42,15 @@ runs:
         for CHARTPATH in "${PATHS[@]}"
         do
           IFS='/' read -r -a path_parts <<< "${CHARTPATH}"
-          CHARTS+=("${path_parts[1]}/${path_parts[2]}")
+          CHARTS+=("${path_parts[0]}/${path_parts[1]}/${path_parts[2]}")
         done
 
         # Remove duplicates
         CHARTS=( `printf "%s\n" "${CHARTS[@]}" | sort -u` )
         # Set output to changed charts
+        echo "Changed charts: ${CHARTS[*]}"
         printf "::set-output name=addedOrModified::%s\n" "${CHARTS[*]}"
+        
 
     - name: Collect bumped charts after last tag
       id: filter-bumped-charts
@@ -106,11 +108,9 @@ runs:
 
         # Remove duplicates
         CHARTS=( `printf "%s\n" "${CHARTS[@]}" | sort -u` )
-        # Set output to changed charts
-        printf "::set-output name=addedOrModified::%s\n" "${CHARTS[*]}"
 
         echo "Number of detected changed charts: ${#CHARTS[@]}"
-        if [ ${#CHARTS[@]} -eq 0 ] || [ "${CHARTS[0]}" = " " ] || [ "${CHARTS[0]}" = "/" ]; then
+        if [ ${#CHARTS[@]} -eq 0 ] || [ "${CHARTS[0]}" == ' ' ] || [ "${CHARTS[0]}" == '/' ]; then
           echo "No Changed Charts detected since latest tag..."
           printf "::set-output name=changesDetectedAfterTag::%s\n" "false"
         else
@@ -120,7 +120,7 @@ runs:
           # Get only the chart paths
 
           # Set output to changed charts
-          echo "Changed charts: ${CHARTS[*]}"
+          echo "Changed charts since latest tag: ${CHARTS[*]}"
           printf "::set-output name=modifiedChartsAfterTag::%s\n" "${CHARTS[*]}"
         fi
         popd > /dev/null

.github/actions/label-from-status/action.yaml

@@ -1,48 +0,0 @@
-name: "Set issue labels based on status"
-description: "Sets / removes issue labels based on CI job status"
-inputs:
-  token:
-    required: true
-    description: "The Github API token to use"
-  issue-number:
-    required: true
-    description: "The issue to label"
-  prefix:
-    required: true
-    description: "The label prefix (e.g. lint, install)"
-  job-status:
-    required: true
-    description: "The status of the CI job"
-  remove-on-skipped:
-    required: false
-    default: false
-    description: "Remove the label if the job was skipped"
-
-runs:
-  using: "composite"
-  steps:
-    - name: Label success
-      uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90 # tag=1.0.4
-      if: ${{ inputs.job-status == 'success' }}
-      with:
-        repo-token: ${{ inputs.token }}
-        issue-number: ${{ inputs.issue-number }}
-        add-labels: "${{ inputs.prefix }}:ok"
-        remove-labels: "${{ inputs.prefix }}:failed"
-
-    - name: Label failure
-      uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90 # tag=1.0.4
-      if: ${{ inputs.job-status == 'failure' }}
-      with:
-        repo-token: ${{ inputs.token }}
-        issue-number: ${{ inputs.issue-number }}
-        add-labels: "${{ inputs.prefix }}:failed"
-        remove-labels: "${{ inputs.prefix }}:ok"
-
-    - name: Remove label
-      uses: andymckay/labeler@e6c4322d0397f3240f0e7e30a33b5c5df2d39e90 # tag=1.0.4
-      if: ${{ (inputs.job-status == 'skipped') && (inputs.remove-on-skipped == 'true') }}
-      with:
-        repo-token: ${{ inputs.token }}
-        issue-number: ${{ inputs.issue-number }}
-        remove-labels: "${{ inputs.prefix }}:ok, ${{ inputs.prefix }}:failed"

.github/ct-install.yaml

@@ -1,6 +1,6 @@
 remote: origin
 target-branch: master
-helm-extra-args: --timeout 180s
+helm-extra-args: --timeout 250s
 chart-yaml-schema: .github/chart_schema.yaml
 chart-dirs:
   - charts/incubator
@@ -8,11 +8,14 @@ chart-dirs:
   - charts/dependency
   - charts/dev
   - charts/enterprise
+  - charts/operators
 excluded-charts:
   - charts/dependency/subchart
-  - charts/incubator/frigate
+  - charts/incubator/twingate-connector
+  - charts/incubator/midarr
   - charts/incubator/orbital-sync
   - charts/incubator/plex-meta-manager
+  - charts/incubator/tauticord
   - charts/library/common
   - charts/stable/alertmanager-bot
   - charts/stable/alertmanager-bot
@@ -21,18 +24,16 @@ excluded-charts:
   - charts/stable/discordgsm
   - charts/stable/facebox
   - charts/stable/foundryvtt
-  - charts/stable/foundryvtt
-  - charts/stable/frigate
   - charts/stable/heimdall
+  - charts/stable/mc-router
   - charts/stable/multus
   - charts/stable/orbital-sync
   - charts/stable/plex-meta-manager
   - charts/stable/pod-gateway
   - charts/stable/promcord
-  - charts/stable/promcord
   - charts/stable/rdesktop
   - charts/stable/reg
-  - charts/incubator/romm
+  - charts/stable/romm
   - charts/stable/ser2sock
   - charts/stable/storj-node
   - charts/stable/tailscale
@@ -43,3 +44,4 @@ chart-repos:
   - truecharts=https://charts.truecharts.org
   - truecharts-library=https://library-charts.truecharts.org
   - truecharts-deps=https://deps.truecharts.org
+  - jetstack=https://charts.jetstack.io

.github/ct-lint.yaml

@@ -8,8 +8,10 @@ chart-dirs:
   - charts/dependency
   - charts/dev
   - charts/enterprise
+  - charts/operators
 excluded-charts: []
 chart-repos:
   - truecharts=https://charts.truecharts.org
   - truecharts-library=https://library-charts.truecharts.org
   - truecharts-deps=https://deps.truecharts.org
+  - jetstack=https://charts.jetstack.io

.github/renovate.json5

@@ -62,7 +62,7 @@
       "bumpVersion": "major",
       "labels": ["update/helm/dependency/major"],
       "groupName": ["helm dependency major"],
-      "matchPaths": ["charts/dependency/**"],
+      "matchPaths": ["charts/dependency/**", "templates/**"],
     },
     {
       "matchDatasources": ["helm"],
@@ -73,11 +73,11 @@
       ],
       "bumpVersion": "patch",
       "labels": ["update/helm/dependency/non-major", "automerge"],
-      "matchPaths": ["charts/dependency/**"],
+      "matchPaths": ["charts/dependency/**", "templates/**"],
       "groupName": "helm dependency non-major",
     },
     //
-    // helm ent
+    // helm ent and operators
     //
     {
       "matchDatasources": ["helm"],
@@ -86,7 +86,7 @@
       "enabled": true,
       "labels": ["update/helm/general/major"],
       "groupName": ["helm general major"],
-      "matchPaths": ["charts/enterprise/**"],
+      "matchPaths": ["charts/enterprise/**", "charts/operators/**"],
       "schedule": [
         "before 10pm on tuesday"
       ],
@@ -102,7 +102,7 @@
       "bumpVersion": "patch",
       "labels": ["update/helm/general/non-major", "automerge"],
       "groupName": "helm general non-major",
-      "matchPaths": ["charts/enterprise/**"],
+      "matchPaths": ["charts/enterprise/**", "charts/operators/**"],
       "schedule": [
         "before 10pm on tuesday"
       ],
@@ -139,7 +139,7 @@
       ],
     },
     //
-    // Tag updates for semantic tags on enterprise Apps
+    // Tag updates for semantic tags on enterprise and operatorApps
     //
     {
       "matchDatasources": ["docker"],
@@ -147,7 +147,7 @@
       "enabled": true,
       "bumpVersion": "major",
       "labels": ["update/docker/enterprise/major"],
-      "matchPaths": ["charts/enterprise/**"],
+      "matchPaths": ["charts/enterprise/**", "charts/operators/**"],
     },
     {
       "matchDatasources": ["docker"],
@@ -158,7 +158,7 @@
       "enabled": true,
       "bumpVersion": "patch",
       "labels": ["update/docker/enterprise/minor"],
-      "matchPaths": ["charts/enterprise/**"],
+      "matchPaths": ["charts/enterprise/**", "charts/operators/**"],
     },
     {
       "matchDatasources": ["docker"],
@@ -173,6 +173,19 @@
       "labels": ["update/docker/enterprise/patch", "automerge"],
       "matchPaths": ["charts/enterprise/**"],
     },
+    {
+      "matchDatasources": ["docker"],
+      "automerge": false,
+      "matchUpdateTypes": [
+        "patch",
+        "digest",
+        "pin",
+      ],
+      "bumpVersion": "patch",
+      "enabled": true,
+      "labels": ["update/docker/operator/patch"],
+      "matchPaths": ["charts/operator/**"],
+    },
     //
     // Tag updates for semantic tags on incubator and dev charts
     //
@@ -191,15 +204,25 @@
         "minor",
         "patch",
         "digest",
-        "pin",
       ],
       "bumpVersion": "patch",
       "enabled": false,
       "labels": ["update/docker/incubator/non-major", "automerge"],
       "matchPaths": ["charts/incubator/**", "charts/dev/**"],
     },
+    {
+      "matchDatasources": ["docker"],
+      "automerge": false,
+      "matchUpdateTypes": [
+        "pin",
+      ],
+      "bumpVersion": "patch",
+      "enabled": true,
+      "labels": ["update/docker/incubator/non-major", "automerge"],
+      "matchPaths": ["charts/incubator/**", "charts/dev/**"],
+    },
     //
-    // Tag updates for semantic tags on all but enterprise and incubator Apps
+    // Tag updates for semantic tags on all but enterprise, operator and incubator Apps
     //
     {
       "matchDatasources": ["docker"],
@@ -258,6 +281,11 @@
       "matchPackagePrefixes": ["tccr.io/truecharts/immich"],
       "groupName": "immich",
     },
+    {
+      "matchDatasources": ["docker"],
+      "matchPackagePrefixes": ["tccr.io/truecharts/portainer"],
+      "groupName": "portainer",
+    },
     {
       "matchDatasources": ["docker"],
       "matchPackagePrefixes": ["tccr.io/truecharts/neko"],
@@ -268,6 +296,11 @@
       "matchPackagePrefixes": ["tccr.io/truecharts/webtop"],
       "groupName": "webtop",
     },
+    {
+      "matchDatasources": ["docker"],
+      "matchPackagePrefixes": ["tccr.io/truecharts/metallb"],
+      "groupName": "metallb",
+    },
     {
       "matchDatasources": ["docker"],
       "matchPackagePrefixes": ["tccr.io/truecharts/zabbix"],

.github/scripts/build-catalog.sh

@@ -75,6 +75,21 @@ patch_apps() {
     sed -i "s|^icon:|icon_url:|g" catalog/${train}/${chartname}/item.yaml
     echo "categories:" >> catalog/${train}/${chartname}/item.yaml
     cat ${target}/Chart.yaml | yq '.annotations."truecharts.org/catagories"' -r >> catalog/${train}/${chartname}/item.yaml
+
+    # Generate screenshots
+    screenshots=""
+    if [[ -d "${target}/screenshots" ]]; then
+        screenshots=$(ls ${target}/screenshots)
+    fi
+    if [[ -n $screenshots ]]; then
+        echo "screenshots:" >> catalog/${train}/${chartname}/item.yaml
+        for screenshot in $screenshots; do
+            echo "  - https://truecharts.org/img/hotlink-ok/chart-screenshots/${chartname}/${screenshot}" >> catalog/${train}/${chartname}/item.yaml
+        done
+    else
+        echo "screenshots: []" >> catalog/${train}/${chartname}/item.yaml
+    fi
+    rm -rf ${target}/screenshots
     # Copy changelog from website
     if [[ ! -f "website/docs/charts/${train}/${chartname}/CHANGELOG.md" ]]; then
         touch "website/docs/charts/${train}/${chartname}/CHANGELOG.md"

.github/scripts/fetch_helm_deps.sh

@@ -28,6 +28,7 @@ echo "⏬ Downloading and Loading TrueCharts pgp Public Key"
 gpg_dir=.cr-gpg
 mkdir -p "$gpg_dir"
 curl --silent https://keybase.io/truecharts/pgp_keys.asc | gpg --dearmor > $gpg_dir/pubring.gpg || echo "❌ Couldn't load  Public Key."
+curl --silent https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg > $gpg_dir/certman.gpg || echo "❌ Couldn't load certman Public Key."
 echo "✅ Public Key loaded successfully..."
 echo ""
 }
@@ -93,28 +94,56 @@ for idx in $(eval echo "{0..$length}"); do
             # Extract url from repo_url. It's under .entries.DEP_NAME.urls. We filter the specific version first (.version)
             dep_url=$(v="$version" n="$name" go-yq '.entries.[env(n)].[] | select (.version == env(v)) | .urls.[0]' "$index_cache/$repo_dir/index.yaml")
 
+            # tmp hotpatch for cert-manager
+            if [[ !  "$dep_url" == "https"* ]]; then
+              dep_url="https://charts.jetstack.io/${dep_url}"
+            fi
+
             echo ""
             echo "⏬ Downloading dependency $name-$version from $dep_url..."
             mkdir -p "$cache_path/$repo_dir"
             wget --quiet "$dep_url" -P "$cache_path/$repo_dir"
-            wget --quiet "$dep_url.prov" -P "$cache_path/$repo_dir"
+            wget --quiet "$dep_url.prov" -P "$cache_path/$repo_dir" || echo "failed downloading .prov"
 
             if [ ! $? ]; then
                 echo "❌ wget encountered an error..."
-                helm dependency build "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/pubring.gpg || \
-                helm dependency update "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/pubring.gpg || exit 1
+              if [[ "$train_chart" =~ incubator\/.* ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "cert-manager" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/certman.gpg || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/certman.gpg || exit 1
+              else
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/pubring.gpg || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/pubring.gpg || exit 1
+              fi
             fi
 
             if [ -f "$cache_path/$repo_dir/$name-$version.tgz" ]; then
                 echo "✅ Dependency Downloaded!"
-                echo "Validating dependency signature..."
-                helm verify $cache_path/$repo_dir/$name-$version.tgz --keyring $gpg_dir/pubring.gpg || \
-                helm verify $cache_path/$repo_dir/$name-$version.tgz --keyring $gpg_dir/pubring.gpg || exit 1
+                if [[ "$name" =~ "cert-manager" ]]; then
+                  helm verify $cache_path/$repo_dir/$name-$version.tgz --keyring $gpg_dir/certman.gpg || \
+                  helm verify $cache_path/$repo_dir/$name-$version.tgz --keyring $gpg_dir/certman.gpg || exit 1
+                elif [[ ! "$train_chart" =~ incubator\/.* ]]; then
+                  echo "Validating dependency signature..."
+                  helm verify $cache_path/$repo_dir/$name-$version.tgz --keyring $gpg_dir/pubring.gpg || \
+                  helm verify $cache_path/$repo_dir/$name-$version.tgz --keyring $gpg_dir/pubring.gpg || exit 1
+                else
+                  echo "Skipping dependency signature verification for $train_chart..."
+                fi
             else
                 echo "❌ Failed to download dependency"
                 # Try helm dependency build/update or otherwise fail fast if a dep fails to download...
-                helm dependency build "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/pubring.gpg || \
-                helm dependency update "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/pubring.gpg || exit 1
+              if [[ "$train_chart" =~ incubator\/.* ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml"|| exit 1
+              elif [[ "$name" =~ "cert-manager" ]]; then
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/certman.gpg || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/certman.gpg || exit 1
+              else
+                  helm dependency build "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/pubring.gpg || \
+                  helm dependency update "$charts_path/$train_chart/Chart.yaml" --verify --keyring $gpg_dir/pubring.gpg || exit 1
+              fi
             fi
         fi
         echo ""

.github/scripts/tc-lint.sh

@@ -4,6 +4,19 @@ function check_version() {
     chart_path=${1:?"No chart path provided to [Version Check]"}
     target_branch=${2:?"No target branch provided to [Version Check]"}
 
+    # If only docs changed, skip version check
+    # git diff target_branch, filter only on $chart_path and invert match for $chart_path/docs
+    # note that it requires branches to be up to date for this to work.
+    chart_changes=$(git diff --name-status "$target_branch" -- "$chart_path" | grep -v "$chart_path/docs")
+    echo -e "\tChange files: \n\n$chart_changes"
+
+    if [[ -z "$chart_changes" ]]; then
+        echo -e "\tLooks like only docs changed. Skipping chart version check"
+        echo -e "\t✅ Chart version: No bump required"
+        echo ''
+        return
+    fi
+
     new=$(git diff "$target_branch" -- "$chart_path" | sed -nr 's/^\+version: (.*)$/\1/p')
     old=$(git diff "$target_branch" -- "$chart_path" | sed -nr 's/^\-version: (.*)$/\1/p')
 
@@ -12,15 +25,18 @@ function check_version() {
         curr_result=1
     fi
 
-    echo -e "\t🔙 Old Chart Version: $old"
-    echo -e "\t🆕 New Chart Version: $new"
+    if [[ -n "$new" ]]; then
+        echo -e "\t🔙 Old Chart Version: $old"
+        echo -e "\t🆕 New Chart Version: $new"
 
-    if [[ $(echo "$new\n$old" | sort -V -r | head -n1) != "$old" ]]; then
-        echo -e "\t✅ Chart version: Bumped"
-    else
-        echo -e "\t❌ Chart version: Not bumped or downgraded"
-        curr_result=1
+        if [[ $(echo "$new\n$old" | sort -V -r | head -n1) != "$old" ]]; then
+            echo -e "\t✅ Chart version: Bumped"
+        else
+            echo -e "\t❌ Chart version: Not bumped or downgraded"
+            curr_result=1
+        fi
     fi
+    echo ''
 }
 export -f check_version
 
@@ -30,7 +46,9 @@ function check_chart_schema(){
     yamale_output=$(yamale --schema .github/chart_schema.yaml "$chart_path/Chart.yaml")
     yamale_exit_code=$?
     while IFS= read -r line; do
-        echo -e "\t$line"
+        if [[ -n $line ]]; then
+            echo -e "\t$line"
+        fi
     done <<< "$yamale_output"
 
     if [ $yamale_exit_code -ne 0 ]; then
@@ -39,6 +57,7 @@ function check_chart_schema(){
     else
         echo -e "\t✅ Chart Schema: Passed"
     fi
+    echo ''
 }
 export -f check_chart_schema
 
@@ -49,7 +68,9 @@ function helm_lint(){
     helm_lint_output=$(helm lint --quiet "$chart_path")
     helm_lint_exit_code=$?
     while IFS= read -r line; do
-        echo -e "\t$line"
+        if [[ -n $line ]]; then
+            echo -e "\t$line"
+        fi
     done <<< "$helm_lint_output"
 
     if [ $helm_lint_exit_code -ne 0 ]; then
@@ -58,16 +79,46 @@ function helm_lint(){
     else
         echo -e "\t✅ Helm Lint: Passed"
     fi
+    echo ''
 }
 export -f helm_lint
 
+function helm_template(){
+    chart_path=${1:?"No chart path provided to [Helm template]"}
+    values=${2:-}
+
+    if [[ -n "$values" ]]; then
+        values="-f $values"
+    fi
+
+    # Print only errors and warnings
+    helm_template_output=$(helm template $values "$chart_path" 2>&1 >/dev/null)
+    helm_template_exit_code=$?
+    while IFS= read -r line; do
+        if [[ -n $line ]]; then
+            echo -e "\t$line"
+        fi
+    done <<< "$helm_template_output"
+
+    if [ $helm_template_exit_code -ne 0 ]; then
+        echo -e "\t❌ Helm template: Failed"
+        curr_result=1
+    else
+        echo -e "\t✅ Helm template: Passed"
+    fi
+    echo ''
+}
+export -f helm_template
+
 function yaml_lint(){
     file_path=${1:?"No file path provided to [YAML lint]"}
 
     yaml_lint_output=$(yamllint --config-file .github/yaml-lint-conf.yaml "$file_path")
     yaml_lint_exit_code=$?
     while IFS= read -r line; do
-        echo -e "\t$line"
+        if [[ -n $line ]]; then
+            echo -e "\t$line"
+        fi
     done <<< "$yaml_lint_output"
 
     if [ $yaml_lint_exit_code -ne 0 ]; then
@@ -76,6 +127,7 @@ function yaml_lint(){
     else
         echo -e "\t✅ YAML Lint: Passed [$file_path]"
     fi
+    echo ''
 }
 export -f yaml_lint
 
@@ -95,6 +147,18 @@ function lint_chart(){
         echo "👣 Helm Lint - [$chart_path]"
         helm_lint "$chart_path"
 
+        if [[ ! $(ls $chart_path/ci/*values.yaml) ]]; then
+            echo "👣 Helm Template - [$chart_path]"
+            helm_template "$chart_path"
+        fi
+
+        for values in $chart_path/ci/*values.yaml; do
+            if [ -f "${values}" ]; then
+                echo "👣 Helm Template - [$values]"
+                helm_template "$chart_path" "$values"
+            fi
+        done
+
         echo "👣 Chart Version - [$chart_path] against [$target_branch]"
         check_version "$chart_path" "$target_branch"
 
@@ -127,6 +191,7 @@ function lint_chart(){
         echo ''
     } > "$curr_result_file"
     cat "$curr_result_file"
+    # $curr_result starts with 0, and it gets set to 1 only when a linting step fails
     echo $curr_result >> "$status_file"
 }
 export -f lint_chart
@@ -140,6 +205,33 @@ exit_code=0
 
 result_file=${result_file:?"No result file provided"}
 
+rm -f "$status_file"
+rm -f "$status_file"
+
+command -v yamale >/dev/null 2>&1 || {
+    printf >&2 "%s\n" "yamale (https://github.com/23andMe/Yamale#pip) is not installed. Aborting."
+    printf >&2 "%s\n" "Install it with 'pip install yamale'"
+    exit 1
+}
+
+command -v yamllint >/dev/null 2>&1 || {
+    printf >&2 "%s\n" "yamllint (https://yamllint.readthedocs.io/en/stable/quickstart.html#installing-yamllint) is not installed. Aborting."
+    printf >&2 "%s\n" "Install it with 'pip install yamllint'"
+    exit 1
+}
+
+command -v helm >/dev/null 2>&1 || {
+    printf >&2 "%s\n" "helm (https://helm.sh/docs/intro/install) is not installed. Aborting."
+    printf >&2 "%s\n" "Install it with 'curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash'"
+    exit 1
+}
+
+command -v parallel >/dev/null 2>&1 || {
+    printf >&2 "%s\n" "parallel (https://www.gnu.org/software/parallel) is not installed. Aborting."
+    printf >&2 "%s\n" "Install it with 'sudo apt install parallel'"
+    exit 1
+}
+
 changed=$(echo $charts | jq --raw-output '.[]')
 
 echo "📂 Charts to lint:"
@@ -175,6 +267,8 @@ echo '' | tee -a "$result_file"
 
 if [ $exit_code -ne 0 ]; then
     echo "❌ Linting: **Failed** - Took $diff_time seconds" | tee -a "$result_file"
+    echo "🖱️ Open [Lint Charts and Verify Dependencies] job" | tee -a "$result_file"
+    echo "👀 Expand [Run Chart Linting] step to view the results" | tee -a "$result_file"
 else
     echo "✅ Linting: **Passed** - Took $diff_time seconds" | tee -a "$result_file"
 fi

.github/workflows/catalog-test.yaml

@@ -17,7 +17,7 @@ jobs:
     container:
       image: ghcr.io/truecharts/devcontainer:3.1.10@sha256:c239addf725eb5cedf79517f8089fdafdc32b5270d1893ee87ae6e511b9bcae3
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         name: Checkout
         with:
           fetch-depth: 100
@@ -26,19 +26,13 @@ jobs:
       - name: Setting repo parent dir as safe safe.directory
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
-      - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
-        with:
-          repository: truecharts/catalog
-          path: catalog
+      ## TODO: Only run on the existing catalog when CI or template changes are actually detected
+      # - name: Checkout
+      #   uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+      #   with:
+      #     repository: truecharts/catalog
+      #     path: catalog
 
       - name: build-and-run
         run: |
           tools/build-release.sh
-
-      - uses: vishnudxb/cancel-workflow@c3c77eb4383ba7d023e6614a07d94fe990501ac6 # tag=v1.2
-        if: failure()
-        with:
-          repo: truecharts/charts
-          workflow_id: ${{ github.run_id }}
-          access_token: ${{ github.token }}

.github/workflows/charts-changelog.yaml

@@ -1,89 +0,0 @@
-name: "Charts: Update README"
-
-on:
-  workflow_dispatch:
-    inputs:
-      modifiedCharts:
-        required: true
-        type: string
-      isRenovatePR:
-        required: true
-        type: string
-    outputs:
-      commitHash:
-        description: "The most recent commit hash at the end of this workflow"
-        value: ${{ jobs.generate-changelog.outputs.commitHash }}
-
-jobs:
-  validate-changelog:
-    name: Validate changelog
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
-        with:
-          fetch-depth: 0
-
-      - name: Check changelog annotations
-        if: inputs.isRenovatePR != 'true'
-        run: |
-          CHARTS=(${{ inputs.modifiedCharts }})
-          for i in "${CHARTS[@]}"
-          do
-              IFS='/' read -r -a chart_parts <<< "$i"
-              ./.github/scripts/check-releasenotes.sh "charts/${chart_parts[0]}/${chart_parts[1]}"
-              echo ""
-          done
-
-  generate-changelog:
-    name: Generate changelog annotations
-    runs-on: ubuntu-latest
-    needs:
-      - validate-changelog
-    outputs:
-      commitHash: ${{ steps.save-commit-hash.outputs.commit_hash }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
-        with:
-          fetch-depth: 0
-
-      - name: Install Kubernetes tools
-        if: inputs.isRenovatePR == 'true'
-        uses: yokawasa/action-setup-kube-tools@af4ebb1af1efd30c5bd84a2e9773355ad6362a33 # v0.9.3
-        with:
-          setup-tools: |
-            yq
-          yq: "4.20.1"
-
-      - name: Annotate Charts.yaml for Renovate PR's
-        if: inputs.isRenovatePR == 'true'
-        env:
-          DEFAULT_BRANCH: "${{ github.event.repository.default_branch }}"
-        run: |
-          CHARTS=(${{ inputs.modifiedCharts }})
-          for i in "${CHARTS[@]}"
-          do
-              IFS='/' read -r -a chart_parts <<< "$i"
-                ./.github/scripts/renovate-releasenotes.sh "charts/${chart_parts[0]}/${chart_parts[1]}"
-              echo ""
-          done
-
-      - name: Create commit
-        id: create-commit
-        if: inputs.isRenovatePR == 'true'
-        uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a # v4
-        with:
-          file_pattern: charts/**/
-          commit_message: "chore: Auto-update chart metadata [skip ci]"
-          commit_user_name: ${{ github.actor }}
-          commit_user_email: ${{ github.actor }}@users.noreply.github.com
-
-      - name: Save commit hash
-        id: save-commit-hash
-        run: |
-          if [ "${{ steps.create-commit.outputs.changes_detected || 'unknown' }}" == "true" ]; then
-            echo '::set-output name=commit_hash::${{ steps.create-commit.outputs.commit_hash }}'
-          else
-            echo "::set-output name=commit_hash::${GITHUB_SHA}"
-          fi

.github/workflows/charts-lint.yaml

@@ -9,29 +9,50 @@ on:
       chartChangesDetected:
         required: true
         type: string
+      modifiedFiles:
+        required: true
+        type: string
+      modifiedCharts:
+        required: true
+        type: string
 
 jobs:
   lint-and-verify:
     name: Lint Charts and Verify Dependencies
     runs-on: ubuntu-latest
-    container:
-      image: tccr.io/truecharts/devcontainer:v3.1.38@sha256:2fd9355bc6791461430db87a04f5fe7b49c46bc5957bc348f1efbff4c6c7913d
     steps:
-      - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+      - name: Checkout [master]
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
-          fetch-depth: 0
+          fetch-depth: 1
+          ref: master
+
+      - name: Checkout [commit]
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
+        with:
+          fetch-depth: 1
           ref: ${{ inputs.checkoutCommit }}
 
       - name: Setting repo parent dir as safe safe.directory
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
+      - name: Install go-yq
+        run: |
+          mkdir -p $HOME/.local/bin
+          wget https://github.com/mikefarah/yq/releases/download/v4.26.1/yq_linux_amd64 -O $HOME/.local/bin/go-yq && \
+          chmod +x $HOME/.local/bin/go-yq
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Install pre-commit, yamale and yamllint
+        run: |
+          pip3 install --no-cache-dir pre-commit yamale yamllint
+
       - name: Prep Helm
         run: |
           helm repo add truecharts https://charts.truecharts.org
           helm repo add truecharts-deps https://deps.truecharts.org
           helm repo add truecharts-library https://library-charts.truecharts.org
-          helm repo add truecharts-deps https://deps.truecharts.org
+          helm repo add jetstack https://charts.jetstack.io
           helm repo update
 
       - name: Collect changes (branch-based)
@@ -39,7 +60,9 @@ jobs:
         if: inputs.chartChangesDetected == 'true'
         shell: bash
         run: |
-          CHARTS=$(ct list-changed --config .github/ct-lint.yaml)
+          CHARTS="${{ inputs.modifiedCharts }}"
+          echo "Modified Charts: ${CHARTS}"
+
           EXCLUDED_JSON=$(go-yq eval -o=json '.excluded-charts // []' .github/ct-lint.yaml)
           CHARTS_JSON=$(echo "${CHARTS}" | jq --raw-input '.' | jq --compact-output --slurp '.')
           OUTPUT_JSON=$(echo "{\"excluded\": ${EXCLUDED_JSON}, \"all\": ${CHARTS_JSON}}" | jq --compact-output '.all-.excluded')
@@ -49,6 +72,17 @@ jobs:
             echo "detected=true" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Test and Fix Pre-Commit Issues
+        shell: bash
+        # TODO: Only run pre-commit on changed files
+        # TODO: Commit fixes
+        if: inputs.chartChangesDetected == 'true'
+        run: |
+          echo "Running pre-commit test-and-cleanup..."
+          # Fix sh files to always be executable
+          find . -name '*.sh' | xargs chmod +x
+          pre-commit run --all || pre-commit run --all
+
       - name: Fetch and Verify dependencies
         shell: bash
         if: steps.list-changed.outputs.detected == 'true'
@@ -73,18 +107,23 @@ jobs:
 
       - name: Create/Update comment
         if: steps.list-changed.outputs.detected == 'true'
-        uses: thollander/actions-comment-pull-request@632cf9ce90574d125be56b5f3405cda41a84e2fd # v2
+        continue-on-error: true
+        uses: thollander/actions-comment-pull-request@dadb7667129e23f12ca3925c90dc5cd7121ab57e # v2
         with:
           filePath: /tmp/lint_result.txt
           comment_tag: lint_results
           mode: recreate
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: Lint Result
         if: steps.list-changed.outputs.detected == 'true'
         shell: bash
         run: |
           if [ "${{ steps.lint.outcome }}" != "success" ]; then
-            echo "Linting failed"
+            echo "❌ Linting failed ❌"
+            echo '###############################################################'
+            echo '## 👀 Expand [Run Chart Linting] step to view the results 👀 ##'
+            echo '###############################################################'
             exit 1
           fi
 

.github/workflows/charts-release.yaml

@@ -17,13 +17,13 @@ jobs:
       image: ghcr.io/truecharts/devcontainer:3.1.10@sha256:c239addf725eb5cedf79517f8089fdafdc32b5270d1893ee87ae6e511b9bcae3
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           token: ${{ secrets.BOT_TOKEN }}
           fetch-depth: 1
 
       - name: Checkout Helm-Staging
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           fetch-depth: 1
           repository: truecharts/helm-staging
@@ -73,6 +73,7 @@ jobs:
           helm repo add truecharts https://charts.truecharts.org
           helm repo add truecharts-library https://library-charts.truecharts.org
           helm repo add truecharts-deps https://deps.truecharts.org
+          helm repo add jetstack https://charts.jetstack.io
           helm repo update
 
       # Optional step if GPG signing is used
@@ -92,7 +93,7 @@ jobs:
           GPG_PASSPHRASE: "${{ secrets.GPG_PASSPHRASE }}"
 
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           token: ${{ secrets.BOT_TOKEN }}
           fetch-depth: 0
@@ -124,7 +125,7 @@ jobs:
           find . -name '*.sh' | xargs chmod +x
 
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         if: |
           steps.collect-changes.outputs.changesDetectedAfterTag == 'true'
         with:
@@ -184,6 +185,7 @@ jobs:
                 mkdir -p website/docs/charts/${train}/${chart} || echo "chart path already exists, continuing..."
                 yes | cp -rf charts/${train}/${chart}/docs/* website/docs/charts/${train}/${chart}/ 2>/dev/null || :
                 yes | cp -rf charts/${train}/${chart}/icon.png website/static/img/hotlink-ok/chart-icons/${chart}.png 2>/dev/null || :
+                yes | cp -rf charts/${train}/${chart}/screenshots/* website/static/img/hotlink-ok/chart-screenshots/${chart}/ 2>/dev/null || :
 
                 # Copy over kept documents
                 mv -f tmp/website/docs/charts/${train}/${chart}/CHANGELOG.md website/docs/charts/${train}/${chart}/CHANGELOG.md 2>/dev/null || :
@@ -238,7 +240,7 @@ jobs:
           git push
 
       - name: Checkout Catalog
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         if: |
           steps.collect-changes.outputs.changesDetectedAfterTag == 'true'
         with:

.github/workflows/charts-test.yaml

@@ -9,42 +9,11 @@ on:
       chartChangesDetected:
         required: true
         type: string
+      modifiedCharts:
+        required: true
+        type: string
 
 jobs:
-  unit-test:
-    name: Run unit tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
-        with:
-          fetch-depth: 0
-          ref: ${{ inputs.checkoutCommit }}
-
-      - name: Install Kubernetes tools
-        uses: yokawasa/action-setup-kube-tools@af4ebb1af1efd30c5bd84a2e9773355ad6362a33 # v0.9.3
-        with:
-          setup-tools: |
-            helmv3
-          helm: "3.8.0"
-
-      - name: Install Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: 2.7
-
-      - name: Install dependencies
-        env:
-          RUBYJQ_USE_SYSTEM_LIBRARIES: 1
-        run: |
-          sudo apt-get update
-          sudo apt-get install libjq-dev
-          bundle install
-
-      - name: Run tests
-        run: |
-          bundle exec m -r ./test/
-
   generate-install-matrix:
     name: Generate matrix for install
     runs-on: ubuntu-latest
@@ -81,51 +50,57 @@ jobs:
       detected6: ${{ steps.list-changed.outputs.detected6 }}
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           ref: ${{ inputs.checkoutCommit }}
 
-      - name: Set up chart-testing
-        uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0
+      - name: Install go-yq
+        run: |
+          mkdir -p $HOME/.local/bin
+          wget https://github.com/mikefarah/yq/releases/download/v4.26.1/yq_linux_amd64 -O $HOME/.local/bin/go-yq && \
+          chmod +x $HOME/.local/bin/go-yq
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
 
       - name: Run chart-testing (list-changed)
         id: list-changed
         if: inputs.chartChangesDetected == 'true'
+        shell: bash
         run: |
-          EXCLUDED=$(yq eval -o=json '.excluded-charts // []' .github/ct-install.yaml)
-          CHARTS=$(ct list-changed --config .github/ct-install.yaml)
-          CHARTS_JSON=$(echo "${CHARTS}" | jq -R -s -c 'split("\n")[:-1]')
-          OUTPUT_JSON=$(echo "{\"excluded\": ${EXCLUDED}, \"all\": ${CHARTS_JSON}}" | jq -c '.all-.excluded')
+          CHARTS="${{ inputs.modifiedCharts }}"
+          echo "Modified Charts: ${CHARTS}"
+          EXCLUDED_JSON=$(go-yq eval -o=json '.excluded-charts // []' .github/ct-install.yaml)
+          CHARTS_JSON=$(echo ${CHARTS} | jq --raw-input '.' | jq --compact-output --slurp '.' | jq 'map(. |= split(" "))[]' )
+          OUTPUT_JSON=$(echo "{\"excluded\": ${EXCLUDED_JSON}, \"all\": ${CHARTS_JSON}}" | jq --compact-output '.all-.excluded')
           OUTPUT_JSON1=$((echo $OUTPUT_JSON | jq -r -c '.[:50]'; echo $OUTPUT_JSON | jq -r -c '.[301:350]'; echo $OUTPUT_JSON | jq -r -c '.[601:650]'; echo $OUTPUT_JSON | jq -r -c '.[901:950]'; echo $OUTPUT_JSON | jq -r -c '.[1201:1250]') | jq -s add)
           OUTPUT_JSON2=$((echo $OUTPUT_JSON | jq -r -c '.[51:100]'; echo $OUTPUT_JSON | jq -r -c '.[351:400]'; echo $OUTPUT_JSON | jq -r -c '.[651:700]'; echo $OUTPUT_JSON | jq -r -c '.[951:1000]'; echo $OUTPUT_JSON | jq -r -c '.[1251:1300]') | jq -s add)
           OUTPUT_JSON3=$((echo $OUTPUT_JSON | jq -r -c '.[101:150]'; echo $OUTPUT_JSON | jq -r -c '.[401:450]'; echo $OUTPUT_JSON | jq -r -c '.[701:750]'; echo $OUTPUT_JSON | jq -r -c '.[1001:1050]'; echo $OUTPUT_JSON | jq -r -c '.[1301:1350]') | jq -s add)
           OUTPUT_JSON4=$((echo $OUTPUT_JSON | jq -r -c '.[151:200]'; echo $OUTPUT_JSON | jq -r -c '.[451:500]'; echo $OUTPUT_JSON | jq -r -c '.[751:800]'; echo $OUTPUT_JSON | jq -r -c '.[1051:1100]'; echo $OUTPUT_JSON | jq -r -c '.[1351:1400]') | jq -s add)
           OUTPUT_JSON5=$((echo $OUTPUT_JSON | jq -r -c '.[201:250]'; echo $OUTPUT_JSON | jq -r -c '.[501:550]'; echo $OUTPUT_JSON | jq -r -c '.[801:850]'; echo $OUTPUT_JSON | jq -r -c '.[1101:1150]'; echo $OUTPUT_JSON | jq -r -c '.[1401:1450]') | jq -s add)
           OUTPUT_JSON6=$((echo $OUTPUT_JSON | jq -r -c '.[251:300]'; echo $OUTPUT_JSON | jq -r -c '.[551:600]'; echo $OUTPUT_JSON | jq -r -c '.[851:900]'; echo $OUTPUT_JSON | jq -r -c '.[1151:1200]'; echo $OUTPUT_JSON | jq -r -c '.[1451:1500]') | jq -s add)
-          echo ::set-output name=charts1::${OUTPUT_JSON1}
-          echo ::set-output name=charts2::${OUTPUT_JSON2}
-          echo ::set-output name=charts3::${OUTPUT_JSON3}
-          echo ::set-output name=charts4::${OUTPUT_JSON4}
-          echo ::set-output name=charts5::${OUTPUT_JSON5}
-          echo ::set-output name=charts6::${OUTPUT_JSON6}
+          echo charts1=${OUTPUT_JSON1} >> $GITHUB_OUTPUT
+          echo charts2=${OUTPUT_JSON2} >> $GITHUB_OUTPUT
+          echo charts3=${OUTPUT_JSON3} >> $GITHUB_OUTPUT
+          echo charts4=${OUTPUT_JSON4} >> $GITHUB_OUTPUT
+          echo charts5=${OUTPUT_JSON5} >> $GITHUB_OUTPUT
+          echo charts6=${OUTPUT_JSON6} >> $GITHUB_OUTPUT
           if [[ $(echo ${OUTPUT_JSON1} | jq -c '. | length') -gt 0 ]]; then
-            echo "::set-output name=detected1::true"
+            echo "detected1=true" >> $GITHUB_OUTPUT
           fi
           if [[ $(echo ${OUTPUT_JSON2} | jq -c '. | length') -gt 0 ]]; then
-            echo "::set-output name=detected2::true"
+            echo "detected2=true" >> $GITHUB_OUTPUT
           fi
           if [[ $(echo ${OUTPUT_JSON3} | jq -c '. | length') -gt 0 ]]; then
-            echo "::set-output name=detected3::true"
+            echo "detected3=true" >> $GITHUB_OUTPUT
           fi
           if [[ $(echo ${OUTPUT_JSON4} | jq -c '. | length') -gt 0 ]]; then
-            echo "::set-output name=detected4::true"
+            echo "detected4=true" >> $GITHUB_OUTPUT
           fi
           if [[ $(echo ${OUTPUT_JSON5} | jq -c '. | length') -gt 0 ]]; then
-            echo "::set-output name=detected5::true"
+            echo "detected5=true" >> $GITHUB_OUTPUT
           fi
           if [[ $(echo ${OUTPUT_JSON6} | jq -c '. | length') -gt 0 ]]; then
-            echo "::set-output name=detected6::true"
+            echo "detected6=true" >> $GITHUB_OUTPUT
           fi
 
   install-charts1:
@@ -140,9 +115,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           ref: ${{ inputs.checkoutCommit }}
 
       - name: Install Kubernetes tools
@@ -150,11 +125,11 @@ jobs:
         with:
           setup-tools: |
             helmv3
-          helm: "3.8.0"
+          helm: "3.9.4"
 
-      - uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4
+      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0
@@ -166,12 +141,27 @@ jobs:
           # Flags found here https://github.com/k3d-io/k3d
           k3d-args: --k3s-arg --disable=metrics-server@server:*
           github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Remove node taints
         run: |
           kubectl taint --all=true nodes node.cloudprovider.kubernetes.io/uninitialized- || true
 
+      - name: Add Dependencies
+        run: |
+          ## TODO: Move to our Helm Charts
+          ## TODO: Only add when required
+          if [[ "${{ matrix.chart }}" == "charts/operators/metallb-config" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.10/config/manifests/metallb-native.yaml --server-side --force-conflicts || echo "error fetching metallb manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/cloudnative-pg" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.20/releases/cnpg-1.20.0.yaml  --server-side --force-conflicts || echo "error fetching cnpg manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/prometheus-operator" ]]; then
+            kubectl apply -f  https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.66.0/bundle.yaml --server-side --force-conflicts || echo "error fetching prometheus operator manifest"
+          fi
+
       - name: Run chart-testing (install)
-        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" #--upgrade
+        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" # --upgrade
 
   install-charts2:
     needs:
@@ -185,9 +175,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           ref: ${{ inputs.checkoutCommit }}
 
       - name: Install Kubernetes tools
@@ -195,11 +185,11 @@ jobs:
         with:
           setup-tools: |
             helmv3
-          helm: "3.8.0"
+          helm: "3.9.4"
 
-      - uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4
+      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0
@@ -216,8 +206,20 @@ jobs:
         run: |
           kubectl taint --all=true nodes node.cloudprovider.kubernetes.io/uninitialized- || true
 
+      - name: Add Dependencies
+        run: |
+          if [[ "${{ matrix.chart }}" == "charts/operators/metallb-config" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.10/config/manifests/metallb-native.yaml --server-side --force-conflicts || echo "error fetching metallb manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/cloudnative-pg" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.17/releases/cnpg-1.17.5.yaml  --server-side --force-conflicts || echo "error fetching cnpg manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/prometheus-operator" ]]; then
+            kubectl apply -f  https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.66.0/bundle.yaml --server-side --force-conflicts || echo "error fetching prometheus operator manifest"
+          fi
+
       - name: Run chart-testing (install)
-        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" #--upgrade
+        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" # --upgrade
 
   install-charts3:
     needs:
@@ -231,9 +233,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           ref: ${{ inputs.checkoutCommit }}
 
       - name: Install Kubernetes tools
@@ -241,11 +243,11 @@ jobs:
         with:
           setup-tools: |
             helmv3
-          helm: "3.8.0"
+          helm: "3.9.4"
 
-      - uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4
+      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0
@@ -257,12 +259,25 @@ jobs:
           # Flags found here https://github.com/k3d-io/k3d
           k3d-args: --k3s-arg --disable=metrics-server@server:*
           github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Remove node taints
         run: |
           kubectl taint --all=true nodes node.cloudprovider.kubernetes.io/uninitialized- || true
 
+      - name: Add Dependencies
+        run: |
+          if [[ "${{ matrix.chart }}" == "charts/operators/metallb-config" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.10/config/manifests/metallb-native.yaml --server-side --force-conflicts || echo "error fetching metallb manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/cloudnative-pg" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.17/releases/cnpg-1.17.5.yaml  --server-side --force-conflicts || echo "error fetching cnpg manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/prometheus-operator" ]]; then
+            kubectl apply -f  https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.66.0/bundle.yaml --server-side --force-conflicts || echo "error fetching prometheus operator manifest"
+          fi
+
       - name: Run chart-testing (install)
-        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" #--upgrade
+        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" # --upgrade
 
   install-charts4:
     needs:
@@ -276,9 +291,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           ref: ${{ inputs.checkoutCommit }}
 
       - name: Install Kubernetes tools
@@ -286,11 +301,11 @@ jobs:
         with:
           setup-tools: |
             helmv3
-          helm: "3.8.0"
+          helm: "3.9.4"
 
-      - uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4
+      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0
@@ -302,12 +317,25 @@ jobs:
           # Flags found here https://github.com/k3d-io/k3d
           k3d-args: --k3s-arg --disable=metrics-server@server:*
           github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Remove node taints
         run: |
           kubectl taint --all=true nodes node.cloudprovider.kubernetes.io/uninitialized- || true
 
+      - name: Add Dependencies
+        run: |
+          if [[ "${{ matrix.chart }}" == "charts/operators/metallb-config" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.10/config/manifests/metallb-native.yaml --server-side --force-conflicts || echo "error fetching metallb manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/cloudnative-pg" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.17/releases/cnpg-1.17.5.yaml  --server-side --force-conflicts || echo "error fetching cnpg manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/prometheus-operator" ]]; then
+            kubectl apply -f  https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.66.0/bundle.yaml --server-side --force-conflicts || echo "error fetching prometheus operator manifest"
+          fi
+
       - name: Run chart-testing (install)
-        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" #--upgrade
+        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" # --upgrade
 
   install-charts5:
     needs:
@@ -321,9 +349,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           ref: ${{ inputs.checkoutCommit }}
 
       - name: Install Kubernetes tools
@@ -331,11 +359,11 @@ jobs:
         with:
           setup-tools: |
             helmv3
-          helm: "3.8.0"
+          helm: "3.9.4"
 
-      - uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4
+      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0
@@ -347,12 +375,25 @@ jobs:
           # Flags found here https://github.com/k3d-io/k3d
           k3d-args: --k3s-arg --disable=metrics-server@server:*
           github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Remove node taints
         run: |
           kubectl taint --all=true nodes node.cloudprovider.kubernetes.io/uninitialized- || true
 
+      - name: Add Dependencies
+        run: |
+          if [[ "${{ matrix.chart }}" == "charts/operators/metallb-config" ]]; then
+            kubectl apply -f --server-side --force-conflicts https://raw.githubusercontent.com/metallb/metallb/v0.13.10/config/manifests/metallb-native.yaml
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/cloudnative-pg" ]]; then
+            kubectl apply -f --server-side --force-conflicts https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.17/releases/cnpg-1.17.5.yaml
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/prometheus-operator" ]]; then
+            kubectl apply -f --server-side --force-conflicts --server-side --force-conflicts https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.66.0/bundle.yaml
+          fi
+
       - name: Run chart-testing (install)
-        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" #--upgrade
+        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" # --upgrade
 
   install-charts6:
     needs:
@@ -366,9 +407,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
-          fetch-depth: 0
+          fetch-depth: 1
           ref: ${{ inputs.checkoutCommit }}
 
       - name: Install Kubernetes tools
@@ -376,11 +417,11 @@ jobs:
         with:
           setup-tools: |
             helmv3
-          helm: "3.8.0"
+          helm: "3.9.4"
 
-      - uses: actions/setup-python@bd6b4b6205c4dbad673328db7b31b7fab9e241c0 # v4
+      - uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4
         with:
-          python-version: "3.10"
+          python-version: "3.11"
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0
@@ -392,12 +433,25 @@ jobs:
           # Flags found here https://github.com/k3d-io/k3d
           k3d-args: --k3s-arg --disable=metrics-server@server:*
           github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Remove node taints
         run: |
           kubectl taint --all=true nodes node.cloudprovider.kubernetes.io/uninitialized- || true
 
+      - name: Add Dependencies
+        run: |
+          if [[ "${{ matrix.chart }}" == "charts/operators/metallb-config" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/metallb/metallb/v0.13.10/config/manifests/metallb-native.yaml --server-side --force-conflicts || echo "error fetching metallb manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/cloudnative-pg" ]]; then
+            kubectl apply -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.17/releases/cnpg-1.17.5.yaml  --server-side --force-conflicts || echo "error fetching cnpg manifest"
+          fi
+          if [[ "${{ matrix.chart }}" != "charts/operators/prometheus-operator" ]]; then
+            kubectl apply -f  https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.66.0/bundle.yaml --server-side --force-conflicts || echo "error fetching prometheus operator manifest"
+          fi
+
       - name: Run chart-testing (install)
-        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" #--upgrade
+        run: ct install --config ".github/ct-install.yaml" --charts "${{ matrix.chart }}" # --upgrade
 
   # Summarize matrix https://github.community/t/status-check-for-a-matrix-jobs/127354/7
   install_success:
@@ -423,43 +477,43 @@ jobs:
           res6="${{needs.install-charts6.result}}"
 
           if [[ $res1 == "success" || $res1 == "skipped" ]]; then
-            echo "install tests 1 successfull..."
+            echo "Install test suite [1] was successful..."
           else
-            echo "install tests 1 error, stopping due to failure..."
+            echo "Install test suite [1] failed, stopping..."
             exit 1
           fi
 
           if [[ $res2 == "success" || $res2 == "skipped" ]]; then
-            echo "install tests 2 successfull..."
+            echo "Install test suite [2] was successful..."
           else
-            echo "install tests 2 error, stopping due to failure..."
+            echo "Install test suite [2] failed, stopping..."
             exit 1
           fi
 
           if [[ $res3 == "success" || $res3 == "skipped" ]]; then
-            echo "install tests 3 successfull..."
+            echo "Install test suite [3] was successful..."
           else
-            echo "install tests 3 error, stopping due to failure..."
+            echo "Install test suite [3] failed, stopping..."
             exit 1
           fi
 
           if [[ $res4 == "success" || $res4 == "skipped" ]]; then
-            echo "install tests 4 successfull..."
+            echo "Install test suite [4] was successful..."
           else
-            echo "install tests 4 error, stopping due to failure..."
+            echo "Install test suite [4] failed, stopping..."
             exit 1
           fi
 
           if [[ $res5 == "success" || $res5 == "skipped" ]]; then
-            echo "install tests 5 successfull..."
+            echo "Install test suite [5] was successful..."
           else
-            echo "install tests 5 error, stopping due to failure..."
+            echo "Install test suite [5] failed, stopping..."
             exit 1
           fi
 
           if [[ $res6 == "success" || $res6 == "skipped" ]]; then
-            echo "install tests 6 successfull..."
+            echo "Install test suite [6] was successful..."
           else
-            echo "install tests 6 error, stopping due to failure..."
+            echo "Install test suite [6] failed, stopping..."
             exit 1
           fi

.github/workflows/daily.yaml

@@ -20,7 +20,7 @@ jobs:
       image: ghcr.io/truecharts/devcontainer:3.1.10@sha256:c239addf725eb5cedf79517f8089fdafdc32b5270d1893ee87ae6e511b9bcae3
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           token: ${{ secrets.BOT_TOKEN }}
           fetch-depth: 1
@@ -55,7 +55,7 @@ jobs:
           done
 
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           repository: truecharts/website
           path: website
@@ -204,6 +204,15 @@ jobs:
             done
           done
 
+      - name: Fix Fixable Pre-Commit issues
+        shell: bash
+        if: inputs.chartChangesDetected == 'true'
+        run: |
+          echo "Running pre-commit test-and-cleanup..."
+          pre-commit run --all ||:
+          # Fix sh files to always be executable
+          find . -name '*.sh' | xargs chmod +x
+
       - name: Cleanup
         run: |
           rm -rf changes.json
@@ -239,7 +248,7 @@ jobs:
           helm repo update
 
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           token: ${{ secrets.BOT_TOKEN }}
           fetch-depth: 1
@@ -248,7 +257,7 @@ jobs:
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - name: Checkout website
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           fetch-depth: 1
           repository: truecharts/website
@@ -351,7 +360,7 @@ jobs:
   lock-threads:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@c1b35aecc5cdb1a34539d14196df55838bb2f836 # v4
+      - uses: dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21 # v4
         with:
           github-token: ${{ secrets.BOT_TOKEN }}
           issue-inactive-days: "7"
@@ -368,12 +377,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           token: ${{ secrets.BOT_TOKEN }}
           fetch-depth: 1
 
-      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
+      - uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3
         with:
           node-version: 18
 

.github/workflows/pr-metadata.yaml

@@ -1,60 +0,0 @@
-name: "Pull Request: Get metadata"
-
-on:
-  workflow_call:
-    outputs:
-      isRenovatePR:
-        description: "Is the PR coming from Renovate?"
-        value: ${{ jobs.pr-metadata.outputs.isRenovatePR }}
-      isFork:
-        description: "Is the PR coming from a forked repo?"
-        value: ${{ jobs.pr-metadata.outputs.isFork }}
-      addedOrModified:
-        description: "Does the PR contain any changes?"
-        value: ${{ jobs.pr-changes.outputs.addedOrModified }}
-      addedOrModifiedFiles:
-        description: "A list of the files changed in this PR"
-        value: ${{ jobs.pr-changes.outputs.addedOrModifiedFiles }}
-      addedOrModifiedCharts:
-        description: "A list of the charts changed in this PR"
-        value: ${{ jobs.pr-changes.outputs.addedOrModifiedCharts }}
-
-jobs:
-  pr-metadata:
-    name: Collect PR metadata
-    runs-on: ubuntu-latest
-    outputs:
-      isRenovatePR: ${{ startsWith(steps.branch-name.outputs.current_branch, 'renovate/') }}
-      isFork: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-    steps:
-      - name: Get branch name
-        id: branch-name
-        uses: tj-actions/branch-names@2e5354c6733793113f416314375826df030ada23 # v6.5
-
-      - name: Save PR data to file
-        env:
-          PR_NUMBER: ${{ github.event.number }}
-        run: |
-          echo $PR_NUMBER > pr_number.txt
-
-      - name: Store pr data in artifact
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3
-        with:
-          name: pr_metadata
-          path: ./pr_number.txt
-          retention-days: 5
-
-  pr-changes:
-    name: Collect PR changes
-    runs-on: ubuntu-latest
-    outputs:
-      addedOrModified: ${{ steps.collect-changes.outputs.changesDetected }}
-      addedOrModifiedFiles: ${{ steps.collect-changes.outputs.addedOrModifiedFiles }}
-      addedOrModifiedCharts: ${{ steps.collect-changes.outputs.addedOrModifiedCharts }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
-
-      - name: Collect changes
-        id: collect-changes
-        uses: ./.github/actions/collect-changes

.github/workflows/pr-validate.yaml

@@ -8,52 +8,47 @@ concurrency:
   # cancel-in-progress: true
 
 jobs:
-  pr-metadata:
-    uses: ./.github/workflows/pr-metadata.yaml
+  pr-changes:
+    name: Collect PR changes
+    runs-on: ubuntu-latest
+    outputs:
+      addedOrModified: ${{ steps.collect-changes.outputs.changesDetected }}
+      addedOrModifiedFiles: ${{ steps.collect-changes.outputs.addedOrModifiedFiles }}
+      addedOrModifiedCharts: ${{ steps.collect-changes.outputs.addedOrModifiedCharts }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
 
-  pre-commit-check:
-    uses: truecharts/.github/.github/workflows/pre-commit-check.yaml@main
-    needs:
-      - pr-metadata
-    with:
-      modifiedFiles: ${{ needs.pr-metadata.outputs.addedOrModifiedFiles }}
-
-  #charts-changelog:
-  #  uses: ./.github/workflows/charts-changelog.yaml
-  #  needs:
-  #    - pr-metadata
-  #    - pre-commit-check
-  #  with:
-  #    isRenovatePR: ${{ needs.pr-metadata.outputs.isRenovatePR }}
-  #    modifiedCharts: ${{ needs.pr-metadata.outputs.addedOrModifiedCharts }}
+      - name: Collect changes
+        id: collect-changes
+        uses: ./.github/actions/collect-changes
 
   charts-lint:
     uses: ./.github/workflows/charts-lint.yaml
     needs:
-      - pr-metadata
-    #  - charts-changelog
+      - pr-changes
     with:
       checkoutCommit: ${{ needs.charts-changelog.outputs.commitHash }}
-      chartChangesDetected: ${{ needs.pr-metadata.outputs.addedOrModified }}
-
+      chartChangesDetected: ${{ needs.pr-changes.outputs.addedOrModified }}
+      modifiedFiles: ${{ needs.pr-changes.outputs.addedOrModifiedFiles }}
+      modifiedCharts: ${{ needs.pr-changes.outputs.addedOrModifiedCharts }}
   charts-test:
     uses: ./.github/workflows/charts-test.yaml
     needs:
-      - pr-metadata
-      #  - charts-changelog
+      - pr-changes
       - charts-lint
     with:
       checkoutCommit: ${{ needs.charts-changelog.outputs.commitHash }}
-      chartChangesDetected: ${{ needs.pr-metadata.outputs.addedOrModified }}
+      chartChangesDetected: ${{ needs.pr-changes.outputs.addedOrModified }}
+      modifiedCharts: ${{ needs.pr-changes.outputs.addedOrModifiedCharts }}
 
   catalog-test:
     uses: ./.github/workflows/catalog-test.yaml
     needs:
-      - pr-metadata
-    #  - charts-changelog
+      - pr-changes
     with:
       checkoutCommit: ${{ needs.charts-changelog.outputs.commitHash }}
-      chartChangesDetected: ${{ needs.pr-metadata.outputs.addedOrModified }}
+      chartChangesDetected: ${{ needs.pr-changes.outputs.addedOrModified }}
 
   print_head_msg:
     name: print commit message
@@ -62,7 +57,7 @@ jobs:
       head-commit-message: ${{ steps.get_head_commit_message.outputs.headCommitMsg }}
     steps:
       - name: Get repo
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: verbose head git commit message
@@ -73,7 +68,7 @@ jobs:
 
   automerge-and-approve:
     needs:
-      - pr-metadata
+      - pr-changes
       - catalog-test
       - charts-test
       - charts-lint

.github/workflows/prune.yaml

@@ -9,7 +9,7 @@ jobs:
     name: "prune old releases"
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           fetch-depth: 0
       - uses: actions/delete-package-versions@0d39a63126868f5eefaa47169615edd3c0f61e20 # v4

.github/workflows/renovate-bump.yaml

@@ -14,12 +14,12 @@ jobs:
     container:
       image: ghcr.io/truecharts/devcontainer:3.1.10@sha256:c239addf725eb5cedf79517f8089fdafdc32b5270d1893ee87ae6e511b9bcae3
     steps:
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         name: Checkout
         with:
           fetch-depth: 0
           token: ${{ secrets.BOT_TOKEN }}
-      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         name: Checkout
         with:
           fetch-depth: 0
@@ -117,6 +117,8 @@ jobs:
               train="games"
             elif test -f "./charts/enterprise/${chart}/Chart.yaml"; then
               train="enterprise"
+            elif test -f "./charts/operators/${chart}/Chart.yaml"; then
+              train="operators"
             else
               train="incubator"
             fi

.github/workflows/renovate.yml

@@ -8,11 +8,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
         with:
           token: ${{ secrets.BOT_TOKEN }}
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@4cc203c40dc0eb6b356306893cabda6ff9d42f33 # v37.0.0
+        uses: renovatebot/github-action@23a02fe7be9e93f857a953cc8162e57d2c8401ef # v39.0.1
         with:
           configurationFile: .github/renovate-config.js
           token: ${{ secrets.BOT_TOKEN }}

.github/workflows/schedule-sync-labels.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
         with:
           token: ${{ secrets.BOT_TOKEN }}
 

.pre-commit-config.yaml

@@ -22,7 +22,7 @@ repos:
       - id: fix-byte-order-marker # removes utf-8 byte order marker.
       - id: requirements-txt-fixer # sorts entries in requirements.txt.
       - id: check-added-large-files # prevents giant files from being committed.
-        exclude: \.(png|jpg|jpeg|svg)$
+        exclude: \.(png|jpg|jpeg|svg|yaml|yml|tpl)$
       - id: check-yaml # checks yaml files for parseable syntax.
         exclude: (templates\/.*|crds\/.*|questions.yaml|chart_schema.yaml)
       - id: detect-private-key # detects the presence of private keys.

charts/dependency/clickhouse/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "23.4.2.11"
+appVersion: "23.7.1.247"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.10.0
+    version: 14.0.1
 deprecated: false
 description: ClickHouse is a column-oriented database management system (DBMS) for online analytical processing of queries (OLAP).
 home: https://truecharts.org/charts/dependency/clickhouse
@@ -22,7 +22,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/clickhouse
   - https://clickhouse.com/
 type: application
-version: 5.0.28
+version: 7.0.0
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/clickhouse/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/clickhouse/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/clickhouse
   pullPolicy: IfNotPresent
-  tag: v23.4.2.11@sha256:c12f70ed3f189415fac14cb4e1cb861575817fe6d1e385dc88024341eca10cca
+  tag: v23.7.1.2470@sha256:fbec51f0c6b09733fe4601bba2584dc750f0a8a5077702b86163744bd6f4573f
 
 workload:
   main:

charts/dependency/kube-state-metrics/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "2.8.2"
+appVersion: "2.9.2"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.10.0
+    version: 14.0.1
 deprecated: false
 description: kube-state-metrics is a simple service that listens to the Kubernetes API server and generates metrics about the state of the objects.
 home: https://truecharts.org/charts/dependency/kube-state-metrics
@@ -21,7 +21,7 @@ name: kube-state-metrics
 sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/kube-state-metrics
 type: application
-version: 1.0.5
+version: 3.0.0
 annotations:
   truecharts.org/catagories: |
     - metrics

charts/dependency/kube-state-metrics/README.md

@@ -5,14 +5,14 @@
 TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
 However only installations using the TrueNAS SCALE Apps system are supported.
 
-For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/)
+For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/dependency/)
 
 **This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
 
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/kube-state-metrics/questions.yaml

@@ -72,6 +72,7 @@ questions:
 # Include{ingressDefault}
 # Include{ingressTLS}
 # Include{ingressTraefik}
+# Include{ingressAdvanced}
 # Include{ingressList}
 # Include{securityContextRoot}
 

charts/dependency/kube-state-metrics/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/kube-state-metrics
   pullPolicy: IfNotPresent
-  tag: v2.8.2@sha256:e7b9fbc67f29bb72043238ebaa397d5161f9e3d5cdb16ac888e2ffe152015700
+  tag: v2.9.2@sha256:f97c4f80c68ea1fb7852ac7f0dd5a06e680d61c4c0b43b6f9feca282bd5958f4
 
 service:
   main:
@@ -48,7 +48,7 @@ workload:
             - --resources=services
             - --resources=statefulsets
             - --resources=storageclasses
-            - --resources=verticalpodautoscalers
+            # - --resources=verticalpodautoscalers
             - --resources=validatingwebhookconfigurations
             - --resources=volumeattachments
 
@@ -285,7 +285,7 @@ metrics:
     # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
     # @default -- See values.yaml
     enabled: true
-    type: serviceMonitor
+    type: "servicemonitor"
     endpoints:
       - port: main
       - port: selfmonitor

charts/dependency/mariadb/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "10.11.3"
+appVersion: "11.0.2"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.10.0
+    version: 14.0.1
 deprecated: false
 description: Fast, reliable, scalable, and easy to use open-source relational database system.
 home: https://truecharts.org/charts/dependency/mariadb
@@ -25,7 +25,7 @@ sources:
   - https://github.com/prometheus/mysqld_exporter
   - https://mariadb.org
 type: application
-version: 7.0.32
+version: 9.0.0
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/mariadb/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/mariadb/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/mariadb
   pullPolicy: IfNotPresent
-  tag: v10.11.3@sha256:6644ba3144bf9956439b2c40ec6b645c16c9b83fdf1943a9b60a750f98ac7e3c
+  tag: v11.0.2@sha256:01c12c8ab605cf1a613f87ea781d34a1311cfa18aa61babcc76d0be61c5cb1f1
 
 workload:
   main:

charts/dependency/memcached/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.6.20"
+appVersion: "1.6.21"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.10.0
+    version: 14.0.1
 deprecated: false
 description: Memcached is a memory-backed database caching solution
 home: https://truecharts.org/charts/dependency/memcached
@@ -23,7 +23,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-memcached
   - http://memcached.org/
 type: application
-version: 6.0.42
+version: 8.0.0
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/memcached/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/memcached/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/memcached
   pullPolicy: IfNotPresent
-  tag: v1.6.20@sha256:6e11823db1555e766c5eda1b7725f4cc5cc5513da404644541d38a8432820117
+  tag: v1.6.21@sha256:a4405d38745d617d73119228f0043b72f80007af25735743e1c3ac86da75d4ac
 
 service:
   main:

charts/dependency/mongodb/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "6.0.6"
+appVersion: "6.0.8"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.10.0
+    version: 14.0.1
 deprecated: false
 description: Fast, reliable, scalable, and easy to use open-source no-sql database system.
 home: https://truecharts.org/charts/dependency/mongodb
@@ -23,7 +23,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-mongodb
   - https://www.mongodb.com
 type: application
-version: 6.0.31
+version: 8.0.0
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/mongodb/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/mongodb/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/mongodb
   pullPolicy: IfNotPresent
-  tag: v6.0.6@sha256:9d10c8a26a1b98d7212bbc2fef5dd7bf35275390dad10e6b4680c8f01c8177e4
+  tag: v6.0.8@sha256:7435fdeb21aa12486de9efdce9d72e1ed1c4ed1d5f4af9b3e37b3e8eb31576be
 
 workload:
   main:

charts/dependency/node-exporter/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "1.5.0"
+appVersion: "1.6.1"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.10.0
+    version: 14.0.1
 deprecated: false
 description: Prometheus exporter for hardware and OS metrics exposed by UNIX kernels, with pluggable metric collectors.
 home: https://truecharts.org/charts/dependency/node-exporter
@@ -21,7 +21,7 @@ name: node-exporter
 sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/node-exporter
 type: application
-version: 1.0.4
+version: 3.0.0
 annotations:
   truecharts.org/catagories: |
     - metrics

charts/dependency/node-exporter/README.md

@@ -5,14 +5,14 @@
 TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
 However only installations using the TrueNAS SCALE Apps system are supported.
 
-For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/enterprise/)
+For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/dependency/)
 
 **This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
 
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/node-exporter/questions.yaml

@@ -50,6 +50,7 @@ questions:
 # Include{ingressDefault}
 # Include{ingressTLS}
 # Include{ingressTraefik}
+# Include{ingressAdvanced}
 # Include{ingressList}
 # Include{securityContextRoot}
 

charts/dependency/node-exporter/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/node-exporter
   pullPolicy: IfNotPresent
-  tag: v1.5.0@sha256:674e04af703ffb85daf5cbddc64c5fc92e75ba49a5e2b0c0d14a2a8ccace3590
+  tag: v1.6.1@sha256:6c481c3c3ddf83b604f207f7a27b3dbd469035c4e4783fc100e478bf05f9a9c5
 
 service:
   main:
@@ -17,11 +17,12 @@ workload:
       containers:
         main:
           args:
-            - --path.procfs=/host/proc
-            - --path.sysfs=/host/sys
+            - --path.rootfs=/host
+            - --path.procfs=/hostproc
+            - --path.sysfs=/hostsys
             - --web.listen-address=0.0.0.0:{{ .Values.service.main.ports.main.port }}
-            - --collector.filesystem.ignored-mount-points="^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+|var/db/system/.+|mnt/[a-zA-Z0-9-_\\.]+/ix-applications/.+)($|/)"
-            - --collector.filesystem.ignored-fs-types="^(autofs|binfmt_misc|cgroup|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|mqueue|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|sysfs|tracefs)$"
+            - --collector.filesystem.mount-points-exclude="^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+|var/db/system/.+|mnt/[a-zA-Z0-9-_\\.]+/ix-applications/.+)($|/)"
+            - --collector.filesystem.fs-types-exclude="^(autofs|binfmt_misc|cgroup|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|mqueue|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|sysfs|tracefs)$"
             - --collector.netdev.device-exclude="^veth.*$"
             - --collector.netclass.ignored-devices="^veth.*$"
           probes:
@@ -44,18 +45,21 @@ podOptions:
 persistence:
   host:
     enabled: true
+    type: hostPath
     hostPath: /
     mountPath: /host
     readOnly: true
   proc:
     enabled: true
+    type: hostPath
     hostPath: /proc
-    mountPath: /host/proc
+    mountPath: /hostproc
     readOnly: true
   sys:
     enabled: true
+    type: hostPath
     hostPath: /sys
-    mountPath: /host/sys
+    mountPath: /hostsys
     readOnly: true
 
 metrics:
@@ -63,7 +67,7 @@ metrics:
     # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
     # @default -- See values.yaml
     enabled: true
-    type: serviceMonitor
+    type: "servicemonitor"
     endpoints:
       - port: main
         path: /metrics

charts/dependency/redis/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "7.0.11"
+appVersion: "7.0.12"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.10.0
+    version: 14.0.1
 deprecated: false
 description: Open source, advanced key-value store.
 home: https://truecharts.org/charts/dependency/redis
@@ -23,7 +23,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-redis
   - http://redis.io/
 type: application
-version: 6.0.45
+version: 8.0.0
 annotations:
   truecharts.org/catagories: |
     - database

charts/dependency/redis/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/redis/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/redis
   pullPolicy: IfNotPresent
-  tag: 7.0.11@sha256:4653f0bff0f593ae2fd5782fbca41c15e0fbc631ab339ee74fb0e82ef37ed90a
+  tag: v7.0.12@sha256:4a7b38a055a1183d226d8e2eb8bb1a55d2ef4ba217a74fd9c1562513c51e5064
 
 workload:
   main:

charts/dependency/solr/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
-appVersion: "9.2.1"
+appVersion: "9.3.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.10.0
+    version: 14.0.1
 deprecated: false
 description: Apache Solr
 home: https://truecharts.org/charts/dependency/solr
@@ -22,7 +22,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/dependency/solr
   - https://github.com/apache/solr
 type: application
-version: 4.0.31
+version: 6.0.0
 annotations:
   truecharts.org/catagories: |
     - search

charts/dependency/solr/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/dependency/solr/values.yaml

@@ -1,7 +1,7 @@
 image:
   repository: tccr.io/truecharts/solr
   pullPolicy: IfNotPresent
-  tag: v9.2.1@sha256:93e8741f09c07cbdce822aad7f74882f43a6b2e388f071b5e667a8cb93724849
+  tag: v9.3.0@sha256:e4780b9d70fe771d1a6aa477fba5b3be92ddd8d858a685f334616f027f58772a
 
 workload:
   main:

charts/enterprise/authelia/Chart.yaml

@@ -3,11 +3,11 @@ appVersion: "4.37.5"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.9.5
+    version: 14.0.1
   - condition: redis.enabled
     name: redis
     repository: https://deps.truecharts.org
-    version: 6.0.44
+    version: 7.0.6
 deprecated: false
 description: Authelia is a Single Sign-On Multi-Factor portal for web apps
 home: https://truecharts.org/charts/enterprise/authelia
@@ -35,7 +35,7 @@ sources:
   - https://github.com/authelia/chartrepo
   - https://github.com/authelia/authelia
 type: application
-version: 15.1.20
+version: 18.0.0
 annotations:
   truecharts.org/catagories: |
     - security

charts/enterprise/authelia/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/authelia/docs/Setup-Guide.md

@@ -0,0 +1,112 @@
+# Authelia + LLDAP + Traefik ForwardAuth Setup guide
+
+This quick guide should take you through the steps necessary to setup `Authelia` as your `forwardAuth` for `Traefik`. We'll be using `LLDAP` as the backend for `Authelia` since it's lightweight and simple enough for most users. A more complete video is available on our YouTube Channel
+
+## Prerequisites
+
+- Traefik installed (enable the `enterprise train`)
+- Clusterissuer for certificates
+- CloudnativePG operator (enable the `operators train`)
+
+## Setup LLDAP
+
+:::warning
+
+LLDAP is a `Stable` train chart and therefore isn't supported at the same level as the charts in the `Enterprise` train (Authelia and Traefik).
+
+:::
+
+- Follow the steps included in the [Installation Notes](https://truecharts.org/charts/stable/lldap/installation-notes) for [LLDAP](https://truecharts.org/charts/stable/lldap/). Pretty straightforward. Change `dc=example,dc=com` to your domain, i.e. `dc=MYDOMAIN,dc=net` and then change your password. Also make sure you have the `Operators` train enabled and `CloudnativePG` operator installed, since you'll need it for `LLDAP` and `Authelia`
+
+![LLDAP Config](img/LLDAPCatalogConfig.png)
+
+- I've set the services to `ClusterIP` since I'll be using ingress
+
+- Once in `LLDAP`, create a user inside the `lldap_password_manager` group and change your default `admin` password. That `lldap_password_manager` user will be used to bind to `Authelia`. I've created a user called `Steven`
+
+## Setup Authelia
+
+- The setup for Authelia is very specific, and the logs won't tell you where you've messed up, but there's precise steps used to integrate `LLDAP` into `Authelia`. The info comes from the [LLDAP Authelia Docs](https://truecharts.org/charts/stable/lldap/authelia) and the upstream repo.
+
+### App Configuration
+
+- Domain: `mydomain.com` <- Your domain without https://
+- Default Redirection URL: `https://auth.mydomain.com` <- Can be anything, but we'll stick to auth.mydomain.com. As well, this will be the ingress URL for `Authelia`
+
+### LDAP Backend Configuration
+
+`Click Enable` then ensure everything is as below or you won't be able to connect to the LLDAP backend
+
+- Implementation: `Custom` (that's the default)
+- URL: `ldap://lldap-ldap.ix-lldap.svc.cluster.local:3890`
+- Connection Timeout: 5s
+- Start TLS: (Not necessary)
+- TLS Settings: (Not necessary)
+- Server Name: Leave blank
+- Skip Certificate Verification: Leave unchecked
+- Minimum TLS version: `TLS1.2`
+- Base DN: `DC=mydomain,DC=com`
+- Username Attribute: `uid`
+- Additional Users DN: `ou=people`
+- Users Filter: `(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))`
+- Additional Groups DN: `ou=groups`
+- Groups Filter: `(member={dn})`
+- Group name Attribute:`cn`
+- Mail Attribute:`mail`
+- Display Name Attribute:`displayName`
+- Admin User: `uid=Steven,ou=people,dc=mydomain,dc=com` <- Notice the uid=Steven, most of the time people use admin and a generated password
+- Password: `RANDOMPASSWORD`
+
+#### SMTP Configuration
+
+Check your mail provider for this, generally Gmail gives you an app specific password for your email account and uses `smtp.gmail.com` and port `587`
+
+### Access Control Configuration
+
+- This section is to set rules to connect to `Authelia` and which users can go where. This is a basic general rule below where the main user (Steven) can access all the site using a wildcard
+
+Leave the default `one_factor` unless you've setup TOTP above. Then click `Add` next to `Rules` to get the screen below
+
+![AutheliaAccessControl](img/AutheliaAccessControl.png)
+
+- Add your `Domain` and a `Wildcard` for your subdomains.
+- Leave policy `one_factor`
+- Click `Add Subject` and add a subject of `group:lldap_password_manager` since `Steven` is part of that group
+
+#### Setup Authelia Ingress
+
+- Make sure you're using the same domain as the `Default Redirection URL` above, so for me that's `auth.mydomain.com`
+
+![AutheliaIngress](img/AutheliaIngress.png)
+
+## Traefik ForwardAuth Setup
+
+- This part is straight forward as long as you have a working `Traefik` install, please see our [How-To](https://truecharts.org/charts/enterprise/traefik/how-to) if you need more info on getting that running.
+
+- Scroll down to `forwardAuth` and click `Add`
+
+![TraefikForwardAuth](img/TraefikForwardAuth.png)
+
+- Name your `forwardauth` something you'll remember, since that's the middleware you'll add to your ingress going forward. Most people use `auth`
+- Address: `http://authelia.ix-authelia.svc.cluster.local:9091/api/verify?rd=https://auth.mydomain.com/` and replace the last part based on `mydomain.com`, and if you've changed ports/names you can get that from `Heavyscript`
+- Check `trustForwardHeader`
+- Add the following `authResponseHeaders` (press `Add` 4 times)
+  - `Remote-User`
+  - `Remote-Group`
+  - `Remote-Name`
+  - `Remote-Email`
+
+### Adding the forwardauth to your Apps
+
+The last step is adding the `forwardauth` along with the standard `ingress` settings for your app, for more info on setting ingress see the [ClusterIssuer Guide](https://truecharts.org/charts/enterprise/clusterissuer/how-to). What changes versus a standard setup is the `Traefik Middlewares` section, where you must add your `forwardauth` to the section.
+
+- In this example we use the same name as above, or `auth`. Click `Add` to the `Traefik Middlewares` section, and enter your `forwardauth` name.
+
+![TraefikForwardAuthMiddleware](img/TraefikForwardAuthMiddleware.png)
+### References
+
+The origin material for this guide is available on the [LLDAP Github](https://github.com/lldap/lldap). While further information on Authelia can be found on their [Github](https://github.com/authelia/authelia) and [website](https://www.authelia.com/).
+
+### Support
+
+If you have any issues with following this guide, we can be reached using [Discord](https://discord.gg/tVsPTHWTtr) for real-time feedback and support.

charts/enterprise/authelia/docs/validation.md

@@ -0,0 +1,23 @@
+# Input Validation
+
+**`Default Redirection URL`**
+
+Accepts:
+
+- `https://`
+- DNS host
+- Characters (`0-9`, `a-z`, `A-Z`, `-`, `.`)
+
+Accepted formats are:
+
+- `https://dnshost`
+- `https://DNSHOST`
+- `https://DNS-HOST`
+- `https://dns-host`
+
+Regex used to match this: `^https?:\/\/(.*)`
+You can try live [here](https://regex101.com/r/zFt9zy/1)
+
+---
+
+_If you find a field that you think it needs validation, please open an issue on github_

charts/enterprise/authelia/questions.yaml

@@ -28,6 +28,7 @@ questions:
     schema:
       type: string
       default: ""
+      valid_chars: '^https?:\/\/(.*)'
   - variable: theme
     group: "App Configuration"
     label: "Theme"
@@ -765,6 +766,7 @@ questions:
 # Include{ingressDefault}
 # Include{ingressTLS}
 # Include{ingressTraefik}
+# Include{ingressAdvanced}
 # Include{ingressList}
 # Include{securityContextRoot}
               - variable: runAsUser

charts/enterprise/authelia/templates/_configmap.tpl

@@ -32,41 +32,41 @@ enabled: true
 data:
   configuration.yaml: |
     ---
-    theme: {{ default "light" .Values.theme }}
+    theme: {{ .Values.theme | default "light" }}
     default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
     ntp:
-      address:  {{ default "time.cloudflare.com:123" .Values.ntp.address }}
-      version: {{ default 4 .Values.ntp.version }}
-      max_desync: {{ default "3s" .Values.ntp.max_desync }}
-      disable_startup_check: {{ default false .Values.ntp.disable_startup_check }}
-      disable_failure: {{ default true .Values.ntp.disable_failure }}
+      address:  {{ .Values.ntp.address | default "time.cloudflare.com:123" }}
+      version: {{ .Values.ntp.version | default 4 }}
+      max_desync: {{ .Values.ntp.max_desync | default "3s" }}
+      disable_startup_check: {{ .Values.ntp.disable_startup_check | default false }}
+      disable_failure: {{ .Values.ntp.disable_failure |  default true }}
     server:
       host: 0.0.0.0
-      port: {{ default 9091 .Values.server.port }}
-      {{- if not (eq "" (default "" .Values.server.path)) }}
+      port: {{ .Values.server.port | default 9091 }}
+      {{- if ne "" (.Values.server.path | default "") }}
       path: {{ .Values.server.path }}
       {{- end }}
       buffers:
-        write: {{ default 4096 .Values.server.write_buffer_size }}
-        read: {{ default 4096 .Values.server.read_buffer_size }}
-      enable_pprof: {{ default false .Values.server.enable_pprof }}
-      enable_expvars: {{ default false .Values.server.enable_expvars }}
+        write: {{ .Values.server.write_buffer_size | default 4096 }}
+        read: {{ .Values.server.read_buffer_size | default 4096 }}
+      enable_pprof: {{ .Values.server.enable_pprof | default false }}
+      enable_expvars: {{ .Values.server.enable_expvars | default false }}
     log:
-      level: {{ default "info" .Values.log.level }}
-      format: {{ default "text" .Values.log.format }}
-      {{- if not (eq "" (default "" .Values.log.file_path)) }}
+      level: {{ .Values.log.level | default "info" }}
+      format: {{ .Values.log.format | default "text" }}
+      {{- if ne "" (.Values.log.file_path | default "") }}
       file_path: {{ .Values.log.file_path }}
       keep_stdout: true
       {{- end }}
     totp:
-      issuer: {{ default .Values.domain .Values.totp.issuer }}
-      period: {{ default 30 .Values.totp.period }}
-      skew: {{ default 1 .Values.totp.skew }}
+      issuer: {{ .Values.totp.issuer | default .Values.domain }}
+      period: {{ .Values.totp.period | default 30 }}
+      skew: {{ .Values.totp.skew | default 1 }}
     {{- if .Values.duo_api.enabled }}
     duo_api:
       hostname: {{ .Values.duo_api.hostname }}
       integration_key: {{ .Values.duo_api.integration_key }}
-    {{- end }}
+    {{- end -}}
     {{- with $auth := .Values.authentication_backend }}
     authentication_backend:
       password_reset:
@@ -74,95 +74,121 @@ data:
     {{- if $auth.file.enabled }}
       file:
         path: {{ $auth.file.path }}
-        password: {{ toYaml $auth.file.password | nindent 10 }}
-    {{- end }}
+        password:
+          {{- $p := $auth.file.password -}}
+          {{- if $p.algorithm }}
+          algorithm: {{ $p.algorithm }}
+          {{- end -}}
+          {{- if $p.iterations }}
+          iterations: {{ $p.iterations }}
+          {{- end -}}
+          {{- if $p.key_length }}
+          key_length: {{ $p.key_length }}
+          {{- end -}}
+          {{- if $p.salt_length }}
+          salt_length: {{ $p.salt_length }}
+          {{- end -}}
+          {{- if $p.memory }}
+          memory: {{ $p.memory }}
+          {{- end -}}
+          {{- if $p.parallelism }}
+          parallelism: {{ $p.parallelism }}
+          {{- end -}}
+    {{- end -}}
     {{- if $auth.ldap.enabled }}
       ldap:
-        implementation: {{ default "custom" $auth.ldap.implementation }}
+        implementation: {{ $auth.ldap.implementation | default "custom" }}
         url: {{ $auth.ldap.url }}
-        timeout: {{ default "5s" $auth.ldap.timeout }}
+        timeout: {{ $auth.ldap.timeout | default "5s" }}
         start_tls: {{ $auth.ldap.start_tls }}
         tls:
           {{- if hasKey $auth.ldap.tls "server_name" }}
-          server_name: {{ default $auth.ldap.host $auth.ldap.tls.server_name }}
+          server_name: {{ $auth.ldap.tls.server_name | default $auth.ldap.host }}
           {{- end }}
-          minimum_version: {{ default "TLS1.2" $auth.ldap.tls.minimum_version }}
-          skip_verify: {{ default false $auth.ldap.tls.skip_verify }}
+          minimum_version: {{ $auth.ldap.tls.minimum_version | default "TLS1.2" }}
+          skip_verify: {{ $auth.ldap.tls.skip_verify | default false }}
     {{- if $auth.ldap.base_dn }}
         base_dn: {{ $auth.ldap.base_dn }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.username_attribute }}
         username_attribute: {{ $auth.ldap.username_attribute }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.additional_users_dn }}
         additional_users_dn: {{ $auth.ldap.additional_users_dn }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.users_filter }}
         users_filter: {{ $auth.ldap.users_filter }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.additional_groups_dn }}
         additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.groups_filter }}
         groups_filter: {{ $auth.ldap.groups_filter }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.group_name_attribute }}
         group_name_attribute: {{ $auth.ldap.group_name_attribute }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.mail_attribute }}
         mail_attribute: {{ $auth.ldap.mail_attribute }}
-    {{- end }}
+    {{- end -}}
     {{- if $auth.ldap.display_name_attribute }}
         display_name_attribute: {{ $auth.ldap.display_name_attribute }}
     {{- end }}
         user: {{ $auth.ldap.user }}
-    {{- end }}
-    {{- end }}
+    {{- end -}}
+    {{- end -}}
     {{- with $session := .Values.session }}
     session:
-      name: {{ default "authelia_session" $session.name }}
+      name: {{ $session.name | default "authelia_session" }}
       domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
-      same_site: {{ default "lax" $session.same_site }}
-      expiration: {{ default "1M" $session.expiration }}
-      inactivity: {{ default "5m" $session.inactivity }}
-      remember_me_duration: {{ default "1M" $session.remember_me_duration }}
+      same_site: {{ $session.same_site | default "lax" }}
+      expiration: {{ $session.expiration | default "1M" }}
+      inactivity: {{ $session.inactivity | default "5m" }}
+      remember_me_duration: {{ $session.remember_me_duration | default "1M" }}
     {{- end }}
       redis:
         host: {{ .Values.redis.creds.plain }}
       {{- with $redis := .Values.redisProvider }}
-        port: {{ default 6379 $redis.port }}
+        port: {{ $redis.port | default 6379 }}
         {{- if not (eq $redis.username "") }}
         username: {{ $redis.username }}
         {{- end }}
-        maximum_active_connections: {{ default 8 $redis.maximum_active_connections }}
-        minimum_idle_connections: {{ default 0 $redis.minimum_idle_connections }}
+        maximum_active_connections: {{ $redis.maximum_active_connections | default 8 }}
+        minimum_idle_connections: {{ $redis.minimum_idle_connections | default 0 }}
     {{- if $redis.tls.enabled }}
         tls:
           server_name: {{ $redis.tls.server_name }}
-          minimum_version: {{ default "TLS1.2" $redis.tls.minimum_version }}
+          minimum_version: {{ $redis.tls.minimum_version | default "TLS1.2" }}
           skip_verify: {{ $redis.tls.skip_verify }}
     {{- end }}
     {{- if $redis.high_availability.enabled }}
         high_availability:
           sentinel_name: {{ $redis.high_availability.sentinel_name }}
     {{- if $redis.high_availability.nodes }}
-          nodes: {{ toYaml $redis.high_availability.nodes | nindent 10 }}
+          nodes:
+          {{- range $node := $redis.high_availability.nodes }}
+          - host: {{ $node.host }}
+            port: {{ $node.port | default 26379 }}
+          {{- end -}}
     {{- end }}
           route_by_latency: {{ $redis.high_availability.route_by_latency }}
           route_randomly: {{ $redis.high_availability.route_randomly }}
       {{- end }}
     {{- end }}
-    regulation: {{ toYaml .Values.regulation | nindent 6 }}
+    regulation:
+      max_retries: {{ .Values.regulation.max_retries | default 3 }}
+      find_time: {{ .Values.regulation.find_time | default "1m" }}
+      ban_time: {{ .Values.regulation.ban_time | default "5m" }}
     storage:
       postgres:
         host: {{ $.Values.cnpg.main.creds.host }}
     {{- with $storage := .Values.storage }}
-        port: {{ default 5432 $storage.postgres.port }}
-        database: {{ default "authelia" $storage.postgres.database }}
-        username: {{ default "authelia" $storage.postgres.username }}
-        timeout: {{ default "5s" $storage.postgres.timeout }}
+        port: {{ $storage.postgres.port | default 5432 }}
+        database: {{ $storage.postgres.database | default "authelia" }}
+        username: {{ $storage.postgres.username | default "authelia" }}
+        timeout: {{ $storage.postgres.timeout | default "5s" }}
         ssl:
-          mode: {{ default "disable" $storage.postgres.sslmode }}
+          mode: {{ $storage.postgres.sslmode | default "disable" }}
     {{- end }}
     {{- with $notifier := .Values.notifier }}
     notifier:
@@ -174,8 +200,8 @@ data:
     {{- if $notifier.smtp.enabled }}
       smtp:
         host: {{ $notifier.smtp.host }}
-        port: {{ default 25 $notifier.smtp.port }}
-        timeout: {{ default "5s" $notifier.smtp.timeout }}
+        port: {{ $notifier.smtp.port | default 25 }}
+        timeout: {{ $notifier.smtp.timeout | default "5s" }}
         {{- with $notifier.smtp.username }}
         username: {{ . }}
         {{- end }}
@@ -186,50 +212,65 @@ data:
         disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
         disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
         tls:
-          server_name: {{ default $notifier.smtp.host $notifier.smtp.tls.server_name }}
-          minimum_version: {{ default "TLS1.2" $notifier.smtp.tls.minimum_version }}
-          skip_verify: {{ default false $notifier.smtp.tls.skip_verify }}
+          server_name: {{ $notifier.smtp.tls.server_name | default $notifier.smtp.host }}
+          minimum_version: {{ $notifier.smtp.tls.minimum_version | default "TLS1.2" }}
+          skip_verify: {{ $notifier.smtp.tls.skip_verify | default false }}
     {{- end }}
     {{- end }}
     {{- if .Values.identity_providers.oidc.enabled }}
     identity_providers:
       oidc:
-        access_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.access_token_lifespan }}
-        authorize_code_lifespan: {{ default "1m" .Values.identity_providers.oidc.authorize_code_lifespan }}
-        id_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.id_token_lifespan }}
-        refresh_token_lifespan: {{ default "90m" .Values.identity_providers.oidc.refresh_token_lifespan }}
-        enable_client_debug_messages: {{ default false .Values.identity_providers.oidc.enable_client_debug_messages }}
-        minimum_parameter_entropy: {{ default 8 .Values.identity_providers.oidc.minimum_parameter_entropy }}
-        {{- if gt (len .Values.identity_providers.oidc.clients) 0 }}
+        access_token_lifespan: {{ .Values.identity_providers.oidc.access_token_lifespan | default "1h" }}
+        authorize_code_lifespan: {{ .Values.identity_providers.oidc.authorize_code_lifespan | default "1m" }}
+        id_token_lifespan: {{ .Values.identity_providers.oidc.id_token_lifespan | default "1h" }}
+        refresh_token_lifespan: {{ .Values.identity_providers.oidc.refresh_token_lifespan | default "90m" }}
+        enable_client_debug_messages: {{ .Values.identity_providers.oidc.enable_client_debug_messages | default false }}
+        minimum_parameter_entropy: {{ .Values.identity_providers.oidc.minimum_parameter_entropy | default 8 }}
+        {{- if .Values.identity_providers.oidc.clients  }}
         clients:
     {{- range $client := .Values.identity_providers.oidc.clients }}
         - id: {{ $client.id }}
-          description: {{ default $client.id $client.description }}
-          secret: {{ default (randAlphaNum 128) $client.secret }}
+          description: {{ $client.description | default $client.id }}
+          secret: {{ $client.secret | default (randAlphaNum 128) }}
           {{- if $client.public }}
           public: {{ $client.public }}
           {{- end }}
-          authorization_policy: {{ default "two_factor" $client.authorization_policy }}
-          consent_mode: {{ default "auto" $client.consent_mode}}
+          authorization_policy: {{ $client.authorization_policy | default "two_factor" }}
+          consent_mode: {{ $client.consent_mode | default "auto" }}
           redirect_uris:
           {{- range $client.redirect_uris }}
           - {{ . }}
           {{- end }}
           {{- if $client.audience }}
-          audience: {{ toYaml $client.audience | nindent 10 }}
+          audience:
+            {{- range $client.audience }}
+            - {{ . }}
+            {{- end }}
+          {{- end }}
+          scopes:
+          {{- range ($client.scopes | default (list "openid" "profile" "email" "groups")) }}
+            - {{ . }}
+          {{- end }}
+          grant_types:
+          {{- range ($client.grant_types | default (list "refresh_token" "authorization_code")) }}
+            - {{ . }}
+          {{- end }}
+          response_types:
+          {{- range ($client.response_types | default (list "code")) }}
+            - {{ . }}
           {{- end }}
-          scopes: {{ toYaml (default (list "openid" "profile" "email" "groups") $client.scopes) | nindent 10 }}
-          grant_types: {{ toYaml (default (list "refresh_token" "authorization_code") $client.grant_types) | nindent 10 }}
-          response_types: {{ toYaml (default (list "code") $client.response_types) | nindent 10 }}
           {{- if $client.response_modes }}
-          response_modes: {{ toYaml $client.response_modes | nindent 10 }}
+          response_modes:
+          {{- range $client.response_modes }}
+            - {{ . }}
           {{- end }}
-          userinfo_signing_algorithm: {{ default "none" $client.userinfo_signing_algorithm }}
+          {{- end }}
+          userinfo_signing_algorithm: {{ $client.userinfo_signing_algorithm | default "none" }}
     {{- end }}
     {{- end }}
     {{- end }}
     access_control:
-    {{- if (eq (len .Values.access_control.rules) 0) }}
+    {{- if not .Values.access_control.rules }}
       {{- if (eq .Values.access_control.default_policy "bypass") }}
       default_policy: one_factor
       {{- else if (eq .Values.access_control.default_policy "deny") }}
@@ -240,15 +281,69 @@ data:
     {{- else }}
       default_policy: {{ .Values.access_control.default_policy }}
     {{- end }}
-    {{- if (eq (len .Values.access_control.networks) 0) }}
+
+    {{- if not .Values.access_control.networks }}
       networks: []
     {{- else }}
-      networks: {{ toYaml .Values.access_control.networks | nindent 6 }}
+      networks:
+    {{- range $net := .Values.access_control.networks }}
+      - name: {{ $net.name }}
+        networks:
+          {{- range $net.networks }}
+          - {{ . | squote }}
+          {{- end }}
     {{- end }}
-    {{- if (eq (len .Values.access_control.rules) 0) }}
+    {{- end }}
+
+    {{- if not .Values.access_control.rules }}
       rules: []
     {{- else }}
-      rules: {{ toYaml .Values.access_control.rules | nindent 6 }}
+      rules:
+    {{- range $rule := .Values.access_control.rules }}
+      {{- if $rule.domain }}
+      - domain:
+        {{- if kindIs "string" $rule.domain }}
+          - {{ $rule.domain | squote }}
+        {{- else -}}
+          {{- range $rule.domain }}
+          - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end -}}
+      {{- with $rule.policy }}
+        policy: {{ . }}
+      {{- end -}}
+      {{- if $rule.networks }}
+        networks:
+        {{- if kindIs "string" $rule.networks }}
+          - {{ $rule.networks | squote }}
+        {{- else -}}
+          {{- range $rule.networks }}
+            - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if $rule.subject }}
+        subject:
+        {{- if kindIs "string" $rule.subject }}
+          - {{ $rule.subject | squote }}
+        {{- else -}}
+          {{- range $rule.subject }}
+            - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if $rule.resources }}
+        resources:
+        {{- if kindIs "string" $rule.resources }}
+          - {{ $rule.resources | squote }}
+        {{- else -}}
+          {{- range $rule.resources }}
+            - {{ . | squote }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+    {{- end }}
     {{- end }}
     ...
 {{- end -}}

charts/enterprise/blocky/Chart.yaml

@@ -3,11 +3,11 @@ appVersion: "0.21.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.9.5
+    version: 14.0.1
   - condition: redis.enabled
     name: redis
     repository: https://deps.truecharts.org
-    version: 6.0.44
+    version: 7.0.6
 description: Blocky is a DNS proxy, DNS enhancer and ad-blocker for the local network written in Go
 home: https://truecharts.org/charts/enterprise/blocky
 icon: https://truecharts.org/img/hotlink-ok/chart-icons/blocky.png
@@ -25,7 +25,7 @@ sources:
   - https://0xerr0r.github.io/blocky/
   - https://github.com/0xERR0R/blocky
   - https://github.com/Mozart409/blocky-frontend
-version: 5.0.32
+version: 8.0.0
 annotations:
   truecharts.org/catagories: |
     - network

charts/enterprise/blocky/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/blocky/docs/installation-notes.md

@@ -55,10 +55,11 @@ However: this negatively affects rollback and high availability, so we _highly_
 
 ## k8s-gateway
 
-Our blocky Chart/App, includes build-in compatibility for [k8s_gateway](https://github.com/ori-edge/k8s_gateway), this tool can be used to ensure devices on your local network, connect directly to the LAN IP of any Charts/Apps using Ingress, instead of via the outside world or, in a lot of cases, having a bunch of connectivity issues.
+Our blocky Chart/App includes build-in compatibility for [k8s_gateway](https://github.com/ori-edge/k8s_gateway).
+This tool can be used to achieve [Split DNS](https://en.wikipedia.org/wiki/Split-horizon_DNS) to ensure devices on your local network connect directly to the LAN IP of any Charts/Apps using Ingress, instead of via the outside world or, in a lot of cases, having a bunch of connectivity issues.
 
-The setup of k8s_gateway is simple:
-Just add the domain(s), which will include and subdomains(!), to the k8s_gateway domains list.
+To setup k8s_gateway add **your** root domain(s) to the `k8s_gateway` section domains list, e.g. `mydomain.com`.
 From that point onwards we will take care to automatically apply the required `conditional` settings in `blocky` as well.
+This will automatically include all your app subdomains exposed via Ingress, e.g. `jellyfin.mydomain.com`.
 
-Please be mindfull that using `Blocky Style` configuration using the `blockyConfig` object in `values.yaml`, might override this automatic setup.
+Please be mindfull that using `Blocky Style` configuration, using the `blockyConfig` object in `values.yaml`, might override this automatic setup.

charts/enterprise/blocky/docs/setup-guide.md

@@ -0,0 +1,78 @@
+# Blocky Setup Guide
+
+This will guide you through the basic setup of Blocky which is the preferred DNS solution for TrueCharts. This guide will cover basic setup options which will get you up and running and is not all inclusive.
+
+## Upstream DNS
+
+Blocky has multiple DNS entries configured by default these can be overridden to your personal preferences or left as default.
+
+Blocky supports 3 methods for upstream DNS.
+
+- UDP - Basic DNS
+- DoT - DNS over TLS
+- DoH - DNS over HTTPS
+
+While UDP provides no security for DNS both DoT and DoH will encrypt DNS request. DoH has the added benefit of privacy since DNS traffic will appear as HTTPS traffic.
+
+### UDP DNS Setup
+
+- Google DNS: `8.8.8.8` `8.8.4.4`
+- Cloudflare DNS: `1.1.1.1` `1.0.0.1`
+
+![blocky-udp-upstream-google](./img/blocky-udp-upstream-google.png)
+
+### DoT DNS Setup
+
+- Google DNS ([Bootstrap DNS Required](#bootstrap-dns)): `tcp-tls:dns.google:853`
+- Cloudflare DNS: `tcp-tls:1.1.1.1:853` `tcp-tls:1.0.0.1:853`
+
+![blocky-dot-upstream-google](./img/blocky-dot-upstream-google.png)
+
+### DoH Upstream
+
+- Google DNS ([Bootstrap DNS Required](#bootstrap-dns)): `https://dns.google/dns-query`
+- Cloudflare DNS: `https://1.1.1.1/dns-query` `https://1.0.0.1/dns-query`
+
+![blocky-doh-upstream-google](./img/blocky-doh-upstream-google.png)
+
+## Bootstrap DNS
+
+For DNS providers that do not use an IP address for DoT or DoH a bootstrap DNS provider
+ is needed to resolve the DoT or DoH address. This provider can be any UDP upstream DNS.
+ In the below example I am using Google DNS.
+
+![blocky-bootstrap-google](./img/blocky-bootstrap-google.png)
+
+## DNS Blacklists
+
+DNS Blacklists are used to prevent DNS resolution of advertisement, malware, trackers
+and adult sites domains. This is completed with public maintained blocklists.
+A good source for these is [firebog.net](https://firebog.net).
+
+:::warning Warning
+
+While publicly maintained blocklists usually do a good job of allowing legitimate traffic they
+can sometimes be too broad and catch traffic that you wish to allow. You may need to disable
+certain blocklists if you find legitimate traffic being blocked.
+
+:::
+
+1. Pick a Group Name for your blocklists.
+2. Add List entries for each blocklist by URL.
+  ![blocky-blacklist](./img/blocky-blacklist.png)
+3. Add a Clients Group Block and set Client Group Name to `default`
+4. Under Groups Entry enter the Group name you used above.
+  ![blocky-blacklist-group](./img/blocky-blacklist-group.png)
+
+## k8s-Gateway Configuration
+
+k8s-Gateway will automatically provide split DNS for your local domain. This will allow
+you to resolve all ingress configured subdomains locally. All that is required for setup
+is to add your root domain in the Domain name block.
+
+![blocky-k8s-gateway](./img/blocky-k8s-gateway.png)
+
+## Prometheus/Grafana
+
+TBD
+

charts/enterprise/blocky/questions.yaml

@@ -689,7 +689,7 @@ questions:
           schema:
             type: boolean
             default: false
-            show_if: [["enabled", "=", "true"]]
+            show_if: [["enabled", "=", true]]
             show_subquestions_if: true
             subquestions:
               - variable: ttl
@@ -827,6 +827,7 @@ questions:
 # Include{ingressDefault}
 # Include{ingressTLS}
 # Include{ingressTraefik}
+# Include{ingressAdvanced}
 # Include{ingressList}
 # Include{securityContextRoot}
               - variable: runAsUser

charts/enterprise/blocky/templates/_k8sgateway.tpl

@@ -38,7 +38,7 @@ Create the matchable regex from domain
 {{- $fqdn := ( include "tc.v1.common.lib.chart.names.fqdn" . ) }}
 enabled: true
 data:
-  Corefile: |-
+  Corefile: |
     .:{{ .Values.service.k8sgateway.ports.k8sgateway.targetPort }} {
         errors
         log
@@ -48,9 +48,15 @@ data:
         ready
         {{- range .Values.k8sgateway.domains }}
         {{- if .dnsChallenge.enabled }}
+          {{- if not .dnsChallenge.domain -}}
+            {{- fail "DNS01 challenge domain is mandatory" -}}
+          {{- end }}
+
         template IN ANY {{ required "Delegated domain ('domain') is mandatory" .domain }} {
            match "_acme-challenge[.](.*)[.]{{ include "k8sgateway.configmap.regex" . }}"
-           answer "{{ "{{" }} .Name {{ "}}" }} 5 IN CNAME {{ "{{" }}  index .Match 1 {{ "}}" }}.{{ required "DNS01 challenge domain is mandatory" .dnsChallenge.domain }}"
+           {{- $name := "{{ \"{{ .Name }}\" }}" }}
+           {{- $index := "{{ \"{{ index .Match 1 }}\" }}" }}
+           answer "{{ $name }} 5 IN CNAME {{ $index }}.{{ .dnsChallenge.domain }}"
            fallthrough
         }
         {{- end }}

charts/enterprise/blocky/templates/common.yaml

@@ -4,7 +4,6 @@
 {{- end }}
 {{- include "tc.v1.common.loader.init" . }}
 
-
 {{/* Render configmap for blocky */}}
 {{- $configmapFile := include "blocky.configmap" . | fromYaml -}}
 {{- if $configmapFile -}}

charts/enterprise/blocky/values.yaml

@@ -325,7 +325,7 @@ metrics:
   main:
     # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
     # @default -- See values.yaml
-    enabled: true
+    enabled: false
     type: "servicemonitor"
     endpoints:
       - port: main

charts/enterprise/cert-manager/docs/how-to.md

@@ -1,54 +0,0 @@
-# Cert-Manager Setup Guide
-
-This guide will walk you through setting up `cert-manager`, certificate management for Kubernetes.
-
-## Prerequisites
-
-Ensure you have the `enterprise` train enabled for `TrueCharts` as discussed [here](https://truecharts.org/manual/SCALE/guides/getting-started/#adding-truecharts).
-
-Ensure you have traefik installed, required for Ingress.
-
-Search for cert-manager in the `Apps` menu | `Available Applications` tab and click **Install**.
-
-## Cloudflare DNS-Provider
-
-You can setup multiple domains with a single cert-manager app, all you have to do is either add the global API key (**not recommended**) or `Add` multiple `ACME Issuer` entries for each domain and create an API token for each at [Cloudflare API Tokens](https://dash.cloudflare.com/profile/api-tokens).
-
-- Give the certificate a name (eg domain or "maincert", etc).
-- Select the correct provider, for example `Cloudflare`.
-- Set **Server** to **Letsencrypt-Production**.
-- Set Email to the account email.
-- Optionally set Cloudflare API key (**not recommended**)
-- Set the Cloudflare API Token to the one created earlier.
-
-![cert-manager1](img/cert-manager1.png)
-
-## cert-manager App
-
-> **Note**
->
-> It is normal that the app does not run, there are no events, no logs and no shell. This is by design.
-
-![cert-manager3](img/cert-manager3.png)
-
-## How to Add Ingress to Apps with cert-manager
-
-Here's an example on how to add ingress to an app with cert-manager for a single domain only.
-
-Add the name of the `ACME Issuer` into `Cert-Manager clusterIssuer`
-
-> **Warning**
-> Do **NOT** use this combined with the `TLS-Settings`.
-
-![cert-manager2](img/cert-manager2.png)
-
-If you want to support multiple domains, use the `TLS-Settings` option to create each one, basically an extra step each time.
-
-## Verifying cert-manager is working
-
-Once install using the Ingress settings above, you can see the `Application Events` for the app in question to pull the certificate and issue the challenge directly. See the example below:
-
-![cert-manager4](img/cert-manager4.png)
-![cert-manager5](img/cert-manager5.png)
-
-All is automated by `cert-manager`

charts/enterprise/cert-manager/templates/_metrics.tpl

@@ -1,26 +0,0 @@
-{{- define "certmanager.metrics" -}}
-{{- if .Values.customMetrics.enabled }}
----
-apiVersion: monitoring.coreos.com/v1
-kind: PodMonitor
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-  labels:
-    app: cert-manager
-    app.kubernetes.io/name: cert-manager
-    app.kubernetes.io/instance: cert-manager
-    app.kubernetes.io/component: "controller"
-spec:
-  jobLabel: app.kubernetes.io/name
-  selector:
-    matchLabels:
-      app: cert-manager
-      app.kubernetes.io/name: cert-manager
-      app.kubernetes.io/instance: cert-manager
-      app.kubernetes.io/component: "controller"
-  podMetricsEndpoints:
-    - port: http
-      honorLabels: true
-{{- end }}
-{{- end -}}

charts/enterprise/clusterissuer/Chart.yaml

@@ -2,26 +2,26 @@ apiVersion: v2
 appVersion: "latest"
 deprecated: false
 description: Certificate management for Kubernetes
-home: https://truecharts.org/charts/enterprise/cert-manager
-icon: https://truecharts.org/img/hotlink-ok/chart-icons/cert-manager.png
+home: https://truecharts.org/charts/enterprise/clusterissuer
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/clusterissuer.png
 keywords:
-  - metallb
-  - loadbalancer
+  - cert-manager
+  - certificates
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 12.9.5
+    version: 14.0.1
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
     name: TrueCharts
     url: https://truecharts.org
-name: cert-manager
+name: clusterissuer
 sources:
-  - https://github.com/truecharts/charts/tree/master/charts/enterprise/cert-manager
+  - https://github.com/truecharts/charts/tree/master/charts/enterprise/clusterissuer
   - https://cert-manager.io/
 type: application
-version: 1.0.35
+version: 4.0.0
 annotations:
   truecharts.org/catagories: |
     - core

charts/enterprise/clusterissuer/README.md

@@ -12,7 +12,7 @@ For more information about this App, please check the docs on the TrueCharts [we
 
 ## Support
 
-- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE/guides/scale-intro).
 - See the [Website](https://truecharts.org)
 - Check our [Discord](https://discord.gg/tVsPTHWTtr)
 - Open a [issue](https://github.com/truecharts/charts/issues/new/choose)

charts/enterprise/clusterissuer/docs/how-to.md

@@ -0,0 +1,91 @@
+# clusterissuer Setup Guide
+
+This guide will walk you through setting up `clusterissuer`, certificate management for Kubernetes.
+
+## Prerequisites
+
+- Ensure you have the `enterprise` and `operators` trains enabled for `TrueCharts` as discussed [here](https://truecharts.org/manual/SCALE/guides/getting-started#adding-truecharts).
+- [Traefik](https://truecharts.org/charts/enterprise/traefik/) is installed from enterprise train
+- [Cert-Mananger](https://truecharts.org/charts/operators/cert-manager/) and [Prometheus-Operator](https://truecharts.org/charts/operators/prometheus-operator/) are installed from the operators train
+
+## Set Scale Nameservers
+
+It is important to configure Scale with reliable nameserver to avoid issues handling DNS-01 challenges. Under Network -> Global Configuration-> Nameservers, we recommend setting 1.1.1.1, 9.9.9.9 or 8.8.8.8.
+
+![clusterissuer scale nameservers](img/scale-network-nameserver.png)
+
+
+## Install clusterissuer App
+
+:::note
+
+It is by design that the app does not run, there are no events, no logs and no shell.
+
+:::
+
+![clusterissuer app card](img/clusterissuer2.png)
+
+## Configure ACME Issuer
+
+You can setup multiple domains and/or DNS providers with a single `clusterissuer` app.
+
+### Cloudflare DNS Provider
+
+#### Create a Cloudflare API token
+
+Login to Cloudflare dashboard and go to the [Cloudflare API Tokens](https://dash.cloudflare.com/profile/api-tokens) page. Select Edit Zone DNS template.
+
+![clusterissuer app card](img/cf-apitokens-template.png)
+
+The recommended  `API Token` permissions are below:
+![clusterissuer app card](img/cf-apitokens-perms.png)
+
+#### Cloudflare ACME Issuer Settings
+
+- **Name**: Name of the issuer entry; such as "cert" or "cloudflareprod". This name will be used later in the app ingress configuration
+- **Type of DNS Provider**: `Cloudflare`
+- **Server**: `Letsencrypt-Production`
+- **Email**: The email address you register with Let's Encrypt for renewal/expiration notices
+- **Cloudflare API key**: Leave blank since API token will be used
+- **Cloudflare API Token**: Populate with token created from above.
+
+![clusterissuer edit dialog](img/clusterissuer-appconfig.png)
+
+More detail can be found on the upstream [Cert-Manager](https://cert-manager.io/) documentaition for [Cloudflare](https://cert-manager.io/docs/configuration/acme/dns01/cloudflare/).
+
+### Route 53 DNS Provider
+
+To be completed
+
+### Akamai DNS Provider
+
+To be completed
+
+### Digital Ocean DNS Provider
+
+To be completed
+
+## Configure Ingress using clusterissuer
+
+Here's an example on how to add ingress to an app with clusterissuer for a single domain only.
+
+Add the name of the `ACME Issuer` into `Cert-Manager clusterIssuer`
+
+:::warning
+
+Do **NOT** use this combined with the `TLS-Settings`.
+
+:::
+
+![configure ingress using clusterissuer ](img/clusterissuer-ingressconfig.png)
+
+If you want to support multiple domains on a single app, under `Show Advanced Settings` checkbox, use the `TLS-Settings` option to create each one with the Add button.
+
+## Verifying clusterissuer is working
+
+Once installed using the Ingress settings above, you can see the `Application Events` for the app in question to pull the certificate and issue the challenge directly. See the example below:
+
+![clusterissuer4](img/clusterissuer4.png)
+![clusterissuer5](img/clusterissuer5.png)
+
+Renewals are handled automatically by `clusterissuer`.

charts/enterprise/clusterissuer/questions.yaml

@@ -52,7 +52,6 @@ questions:
                       description: "Server for ACME, for example: letsencrypt"
                       schema:
                         type: string
-                        show_if: [["type", "!=", "HTTP01"]]
                         default: 'Letsencrypt-Production'
                         enum:
                           - value: 'https://acme-v02.api.letsencrypt.org/directory'
@@ -78,7 +77,6 @@ questions:
                       schema:
                         type: string
                         required: true
-                        show_if: [["type", "!=", "HTTP01"]]
                         default: "something@example.com"
                     - variable: cfapikey
                       label: CloudFlare API key
@@ -230,7 +228,7 @@ questions:
                       schema:
                         type: string
                         required: true
-                        show_if: [["selfSigned", "=", "true"]]
+                        show_if: [["selfSigned", "=", true]]
                         default: "my-selfsigned-ca"
                     - variable: crt
                       label: "Custom CA cert (experimental)"
@@ -238,7 +236,8 @@ questions:
                       schema:
                         type: string
                         required: true
-                        show_if: [["selfSigned", "=", "false"]]
+                        max_length: 10240
+                        show_if: [["selfSigned", "=", false]]
                         default: ""
                     - variable: key
                       label: "Custom CA key (experimental)"
@@ -246,7 +245,8 @@ questions:
                       schema:
                         type: string
                         required: true
-                        show_if: [["selfSigned", "=", "false"]]
+                        max_length: 10240
+                        show_if: [["selfSigned", "=", false]]
                         default: ""
 
         - variable: selfSigned