From 5adef74a7e13610399c6d526c1595c44141aff17 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Fri, 25 Sep 2026 22:47:34 -0400 Subject: [PATCH 01/12] read endpoint from secret --- templates/_helpers.tpl | 5 ++++- templates/secret.yaml | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index af3d3dc6..30e277cd 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -85,7 +85,10 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- if .Values.s3.regionEndpoint }} - name: REGISTRY_STORAGE_S3_REGIONENDPOINT - value: {{ .Values.s3.regionEndpoint }} + valueFrom: + secretKeyRef: + name: {{ template "docker-registry.fullname" . }}-secret + key: s3Endpoint {{- end -}} {{- if .Values.s3.rootdirectory }} diff --git a/templates/secret.yaml b/templates/secret.yaml index 56bf7f84..9b717c1c 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -33,6 +33,9 @@ data: s3AccessKey: {{ .Values.secrets.s3.accessKey | b64enc | quote }} s3SecretKey: {{ .Values.secrets.s3.secretKey | b64enc | quote }} {{- end }} + {{- if .Values.s3.regionEndpoint }} + s3Endpoint: {{ .Values.s3.regionEndpoint | b64enc | quote }} + {{- end }} {{- else if eq .Values.storage "swift" }} {{- if and .Values.secrets.swift.username .Values.secrets.swift.password }} swiftUsername: {{ .Values.secrets.swift.username | b64enc | quote }} From 99f1c0d15e8efb1593f10eb673934fcc640edec4 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Fri, 25 Sep 2026 22:49:07 -0400 Subject: [PATCH 02/12] remove unused field --- templates/secret.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/templates/secret.yaml b/templates/secret.yaml index 9b717c1c..3871af7a 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -26,9 +26,6 @@ data: azureContainer: {{ .Values.secrets.azure.container | b64enc | quote }} {{- end }} {{- else if eq .Values.storage "s3" }} - {{- if and .Values.secrets.s3.secretRef }} - secretRef: {{ .Values.secrets.s3.secretRef | b64enc | quote }} - {{- end }} {{- if and .Values.secrets.s3.secretKey .Values.secrets.s3.accessKey }} s3AccessKey: {{ .Values.secrets.s3.accessKey | b64enc | quote }} s3SecretKey: {{ .Values.secrets.s3.secretKey | b64enc | quote }} From 1c50015f98a4a45c9c5f2d8c2edf2edd49f03276 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Mon, 28 Sep 2026 19:04:12 -0400 Subject: [PATCH 03/12] external secret for endpoint --- templates/_helpers.tpl | 6 +++--- templates/secret.yaml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 30e277cd..17ff15c0 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -83,12 +83,12 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this key: {{ if .Values.secrets.s3.secretKeyName}}{{ .Values.secrets.s3.secretKeyName}}{{ else }} s3SecretKey {{ end }} {{- end -}} -{{- if .Values.s3.regionEndpoint }} +{{- if or .Values.s3.regionEndpoint .Values.secrets.s3RegionEndpoint.secretRef }} - name: REGISTRY_STORAGE_S3_REGIONENDPOINT valueFrom: secretKeyRef: - name: {{ template "docker-registry.fullname" . }}-secret - key: s3Endpoint + name: {{ if .Values.secrets.s3RegionEndpoint.secretRef }}{{ .Values.secrets.s3RegionEndpoint.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} + key: {{ if .Values.secrets.s3RegionEndpoint.secretKeyName }}{{ .Values.secrets.s3RegionEndpoint.secretKeyName }}{{ else }} s3RegionEndpoint {{ end }} {{- end -}} {{- if .Values.s3.rootdirectory }} diff --git a/templates/secret.yaml b/templates/secret.yaml index 3871af7a..cb6c19d1 100644 --- a/templates/secret.yaml +++ b/templates/secret.yaml @@ -31,7 +31,7 @@ data: s3SecretKey: {{ .Values.secrets.s3.secretKey | b64enc | quote }} {{- end }} {{- if .Values.s3.regionEndpoint }} - s3Endpoint: {{ .Values.s3.regionEndpoint | b64enc | quote }} + s3RegionEndpoint: {{ .Values.s3.regionEndpoint | b64enc | quote }} {{- end }} {{- else if eq .Values.storage "swift" }} {{- if and .Values.secrets.swift.username .Values.secrets.swift.password }} From c7b7efb41abaaf35424dbe98d058c58351e34ce7 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Mon, 28 Sep 2026 19:49:18 -0400 Subject: [PATCH 04/12] tweak key name --- templates/_helpers.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 17ff15c0..d50c2211 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -88,7 +88,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this valueFrom: secretKeyRef: name: {{ if .Values.secrets.s3RegionEndpoint.secretRef }}{{ .Values.secrets.s3RegionEndpoint.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: {{ if .Values.secrets.s3RegionEndpoint.secretKeyName }}{{ .Values.secrets.s3RegionEndpoint.secretKeyName }}{{ else }} s3RegionEndpoint {{ end }} + key: {{ if .Values.secrets.s3RegionEndpoint.keyName }}{{ .Values.secrets.s3RegionEndpoint.keyName }}{{ else }} s3RegionEndpoint {{ end }} {{- end -}} {{- if .Values.s3.rootdirectory }} From 6f8326b634e641dfed7c9ca6b4589ce5ddab8a15 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Mon, 2 Nov 2026 14:28:15 -0500 Subject: [PATCH 05/12] example values for the s3 endpoint secret --- values.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/values.yaml b/values.yaml index 09314874..cf11fc00 100644 --- a/values.yaml +++ b/values.yaml @@ -93,6 +93,12 @@ secrets: # accessKeyName: "" # defaults to s3AccessKey if not specified # accessKey: "" # secretKey: "" +# Secrets for S3 region endpoint +# Use a secret ref with the endpoint +# s3RegionEndpoint: +# secretRef: "" +# keyName: "" # defaults to s3RegionEndpoint if not specified +# # Secrets for Swift username and password # swift: # username: "" From 5c11af3393e55170477a9076941f068e93e3f6c8 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Mon, 2 Nov 2026 14:43:11 -0500 Subject: [PATCH 06/12] Add info about s3 endpoint plus missing info about access and secret key --- README.md | 6 +++++- values.yaml | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 45e25b52..96fa5669 100644 --- a/README.md +++ b/README.md @@ -89,7 +89,11 @@ their default values. | `secrets.htpasswd` | Htpasswd authentication | `nil` | | `secrets.s3.accessKey` | Access Key for S3 configuration | `nil` | | `secrets.s3.secretKey` | Secret Key for S3 configuration | `nil` | -| `secrets.s3.secretRef` | The ref for an external secret containing the s3AccessKey and s3SecretKey keys | `""` | +| `secrets.s3.secretRef` | The ref for an external secret containing the s3AccessKey and s3SecretKey keys | `""` | +| `secrets.s3.accessKeyName` | The name of the field in the secret containing the s3 access key | `"s3AccessKey"` | +| `secrets.s3.secretKeyName` | The name of the field in the secret containing the s3 secret key | `"s3SecretKey"` | +| `secrets.s3RegionEndpoint.secretRef` | The ref for an external secret containing the s3 region endpoint | `""` | +| `secrets.s3RegionEndpoint.keyName` | The name of the field in the secret containing the s3 region endpoint | `"s3RegionEndpoint"` | | `secrets.swift.username` | Username for Swift configuration | `nil` | | `secrets.swift.password` | Password for Swift configuration | `nil` | | `secrets.haSharedSecret` | Shared secret for Registry | `nil` | diff --git a/values.yaml b/values.yaml index cf11fc00..97163b5d 100644 --- a/values.yaml +++ b/values.yaml @@ -94,7 +94,7 @@ secrets: # accessKey: "" # secretKey: "" # Secrets for S3 region endpoint -# Use a secret ref with the endpoint +# Use a secret ref with the endpoint for an endpoint stored outside the chart # s3RegionEndpoint: # secretRef: "" # keyName: "" # defaults to s3RegionEndpoint if not specified From bf4c555dd672b2ff3a4843e1ee20899ab70218b9 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Mon, 2 Nov 2026 14:52:01 -0500 Subject: [PATCH 07/12] use name instead of keyName --- README.md | 2 +- values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 96fa5669..b4268a0d 100644 --- a/README.md +++ b/README.md @@ -93,7 +93,7 @@ their default values. | `secrets.s3.accessKeyName` | The name of the field in the secret containing the s3 access key | `"s3AccessKey"` | | `secrets.s3.secretKeyName` | The name of the field in the secret containing the s3 secret key | `"s3SecretKey"` | | `secrets.s3RegionEndpoint.secretRef` | The ref for an external secret containing the s3 region endpoint | `""` | -| `secrets.s3RegionEndpoint.keyName` | The name of the field in the secret containing the s3 region endpoint | `"s3RegionEndpoint"` | +| `secrets.s3RegionEndpoint.name` | The name of the field in the secret containing the s3 region endpoint | `"s3RegionEndpoint"` | | `secrets.swift.username` | Username for Swift configuration | `nil` | | `secrets.swift.password` | Password for Swift configuration | `nil` | | `secrets.haSharedSecret` | Shared secret for Registry | `nil` | diff --git a/values.yaml b/values.yaml index 97163b5d..ab328be3 100644 --- a/values.yaml +++ b/values.yaml @@ -97,7 +97,7 @@ secrets: # Use a secret ref with the endpoint for an endpoint stored outside the chart # s3RegionEndpoint: # secretRef: "" -# keyName: "" # defaults to s3RegionEndpoint if not specified +# name: "" # defaults to s3RegionEndpoint if not specified # # Secrets for Swift username and password # swift: From 2c55856596ced766237005ce060514816699c9a7 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Tue, 3 Nov 2026 14:13:34 -0500 Subject: [PATCH 08/12] add missing change --- templates/_helpers.tpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index d50c2211..76a32fcc 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -88,7 +88,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this valueFrom: secretKeyRef: name: {{ if .Values.secrets.s3RegionEndpoint.secretRef }}{{ .Values.secrets.s3RegionEndpoint.secretRef }}{{ else }}{{ template "docker-registry.fullname" . }}-secret{{ end }} - key: {{ if .Values.secrets.s3RegionEndpoint.keyName }}{{ .Values.secrets.s3RegionEndpoint.keyName }}{{ else }} s3RegionEndpoint {{ end }} + key: {{ if .Values.secrets.s3RegionEndpoint.name }}{{ .Values.secrets.s3RegionEndpoint.name }}{{ else }} s3RegionEndpoint {{ end }} {{- end -}} {{- if .Values.s3.rootdirectory }} From 32433ad626ee4e6752f639a94c8f3400837e0dfc Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Tue, 3 Nov 2026 14:14:10 -0500 Subject: [PATCH 09/12] fix helm lint workflow --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d24c0251..cbf12b51 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -21,7 +21,7 @@ jobs: steps: - uses: actions/checkout@v4.1.4 - run: | - helm lint --strict + helm lint --strict . integration-test: name: Integration Test runs-on: ubuntu-latest From e11d59acf5223fa7f240bd4047c7574d4f114681 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Tue, 3 Nov 2026 14:27:45 -0500 Subject: [PATCH 10/12] force to use a newer version of k3d --- .github/workflows/ci.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index cbf12b51..9f930e7c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -32,6 +32,7 @@ jobs: name: Create K3D Cluster with Container Registry with: cluster-name: local-ci-k3d-cluster + k3d-version: v5.9.0 args: >- --agents 1 --registry-create local-ci-k3d-registry From becd97734243ec2d21750b38a25a85c2cae90602 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Tue, 3 Nov 2026 14:30:22 -0500 Subject: [PATCH 11/12] use a newer version of k3d action instead --- .github/workflows/ci.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 9f930e7c..36ef5bd0 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -28,11 +28,10 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v4.1.4 - - uses: AbsaOSS/k3d-action@v2.4.0 + - uses: AbsaOSS/k3d-action@v2.11.0 name: Create K3D Cluster with Container Registry with: cluster-name: local-ci-k3d-cluster - k3d-version: v5.9.0 args: >- --agents 1 --registry-create local-ci-k3d-registry From 600c32011824cae0ae297267f13bf5e989301152 Mon Sep 17 00:00:00 2001 From: Geoffrey Lefebvre Date: Tue, 3 Nov 2026 14:37:36 -0500 Subject: [PATCH 12/12] Revert "use a newer version of k3d action instead" This reverts commit becd97734243ec2d21750b38a25a85c2cae90602. --- .github/workflows/ci.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 36ef5bd0..9f930e7c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -28,10 +28,11 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@v4.1.4 - - uses: AbsaOSS/k3d-action@v2.11.0 + - uses: AbsaOSS/k3d-action@v2.4.0 name: Create K3D Cluster with Container Registry with: cluster-name: local-ci-k3d-cluster + k3d-version: v5.9.0 args: >- --agents 1 --registry-create local-ci-k3d-registry