Release gohoarder 0.1.272

Add markers around the table and list gohoarder. The release
workflow rewrites the table after each chart release.

README.md

@@ -25,9 +25,13 @@ helm install <chart-name> raczylo/<chart-name>
 
 ## Currently available charts
 
+<!-- CHARTS_START -->
+
 | Chart | Description |
 | ----- | ----------- |
-| [jobs-manager](https://github.com/lukaszraczylo/jobs-manager-operator) | Kubernetes Operator for managing and scheduling Jobs |
+| [gohoarder](https://github.com/lukaszraczylo/gohoarder) | A universal package cache proxy supporting npm, PyPI, and Go modules with security scanning |
-| [kube-images-sync](https://github.com/lukaszraczylo/kubernetes-images-sync-operator) | Kubernetes Operator for storing images pre-impex |
+| [jobs-manager](https://github.com/lukaszraczylo/jobs-manager-operator) | Kubernetes jobs manager operator for orchestrating workflow-based job execution with dependency management |
-| [kubemirror](https://github.com/lukaszraczylo/kubemirror) | Kubernetes Operator for mirroring Kubernetes resources across namespaces |
+| [kube-images-sync](https://github.com/lukaszraczylo/kubernetes-images-sync-operator) | A Helm chart for Kubernetes Images Sync Operator |
-| ----- | ----------- |
+| [kubemirror](https://github.com/lukaszraczylo/kubemirror) | Kubernetes controller for mirroring resources across namespaces |
+
+<!-- CHARTS_END -->

charts/gohoarder/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: gohoarder
 description: A universal package cache proxy supporting npm, PyPI, and Go modules with security scanning
 type: application
-version: 0.1.126
+version: 0.1.272
-appVersion: "0.1.126"
+appVersion: "0.1.272"
 keywords:
   - package-manager
   - cache

charts/gohoarder/templates/ingressroute-traefik.yaml

@@ -0,0 +1,129 @@
+{{- if and .Values.ingress.enabled (eq .Values.ingress.className "traefik") -}}
+---
+# Traefik IngressRoute for package registry paths
+# This handles package downloads including scoped packages with encoded slashes
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ include "gohoarder.fullname" . }}-packages
+  labels:
+    {{- include "gohoarder.labels" . | nindent 4 }}
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    # Package registry routes with high priority
+    # PathPrefix matching to avoid Go's encoded slash rejection in regex
+    - match: Host(`{{ .Values.ingress.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) }}`) && PathPrefix(`/npm/`)
+      kind: Rule
+      priority: 100
+      services:
+        - name: {{ include "gohoarder.fullname" . }}-frontend
+          port: {{ .Values.frontend.service.port }}
+      middlewares:
+        - name: {{ include "gohoarder.fullname" . }}-strip-encoded-slash
+          namespace: {{ .Release.Namespace }}
+        {{- if .Values.ingress.traefik }}
+        {{- if .Values.ingress.traefik.middlewares }}
+        {{- range .Values.ingress.traefik.middlewares }}
+        - name: {{ . }}
+          namespace: traefik
+        {{- end }}
+        {{- end }}
+        {{- end }}
+
+    - match: Host(`{{ .Values.ingress.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) }}`) && PathPrefix(`/pypi/`)
+      kind: Rule
+      priority: 100
+      services:
+        - name: {{ include "gohoarder.fullname" . }}-frontend
+          port: {{ .Values.frontend.service.port }}
+      middlewares:
+        - name: {{ include "gohoarder.fullname" . }}-strip-encoded-slash
+          namespace: {{ .Release.Namespace }}
+        {{- if .Values.ingress.traefik }}
+        {{- if .Values.ingress.traefik.middlewares }}
+        {{- range .Values.ingress.traefik.middlewares }}
+        - name: {{ . }}
+          namespace: traefik
+        {{- end }}
+        {{- end }}
+        {{- end }}
+
+    - match: Host(`{{ .Values.ingress.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) }}`) && PathPrefix(`/go/`)
+      kind: Rule
+      priority: 100
+      services:
+        - name: {{ include "gohoarder.fullname" . }}-frontend
+          port: {{ .Values.frontend.service.port }}
+      middlewares:
+        - name: {{ include "gohoarder.fullname" . }}-strip-encoded-slash
+          namespace: {{ .Release.Namespace }}
+        {{- if .Values.ingress.traefik }}
+        {{- if .Values.ingress.traefik.middlewares }}
+        {{- range .Values.ingress.traefik.middlewares }}
+        - name: {{ . }}
+          namespace: traefik
+        {{- end }}
+        {{- end }}
+        {{- end }}
+
+    # All other routes (frontend, API, etc.) with lower priority
+    - match: Host(`{{ .Values.ingress.host | default (printf "%s.%s" "gohoarder" .Values.global.domain) }}`)
+      kind: Rule
+      priority: 50
+      services:
+        - name: {{ include "gohoarder.fullname" . }}-frontend
+          port: {{ .Values.frontend.service.port }}
+      {{- if .Values.ingress.traefik }}
+      {{- if .Values.ingress.traefik.middlewares }}
+      middlewares:
+        {{- range .Values.ingress.traefik.middlewares }}
+        - name: {{ . }}
+          namespace: traefik
+        {{- end }}
+      {{- end }}
+      {{- end }}
+
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    secretName: {{ .Values.ingress.tls.secretName }}
+  {{- end }}
+
+---
+# Middleware to handle encoded slashes in package paths
+# Note: This middleware attempts to work around Traefik's encoded slash limitation
+# but may not fully resolve the issue due to Go stdlib constraints
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ include "gohoarder.fullname" . }}-strip-encoded-slash
+  labels:
+    {{- include "gohoarder.labels" . | nindent 4 }}
+spec:
+  # Use headers to pass original path information
+  # The backend can reconstruct the original URL from these headers
+  headers:
+    customRequestHeaders:
+      X-Original-URI: "{{ .Request.URL.Path }}"
+      X-Forwarded-Path: "{{ .Request.URL.Path }}"
+
+---
+# ServersTransport configuration for backend communication
+# This ensures the backend connection doesn't have additional restrictions
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: {{ include "gohoarder.fullname" . }}-transport
+  labels:
+    {{- include "gohoarder.labels" . | nindent 4 }}
+spec:
+  insecureSkipVerify: false
+  {{- if .Values.ingress.traefik }}
+  {{- if .Values.ingress.traefik.transport }}
+  {{- with .Values.ingress.traefik.transport }}
+  serverName: {{ .serverName | default "" }}
+  {{- end }}
+  {{- end }}
+  {{- end }}
+{{- end }}

charts/gohoarder/values.yaml

@@ -51,17 +51,17 @@ image:
   server:
     repository: ghcr.io/lukaszraczylo/gohoarder-server
     pullPolicy: IfNotPresent
-    tag: "0.1.126"
+    tag: "0.1.272"
 
   frontend:
     repository: ghcr.io/lukaszraczylo/gohoarder-frontend
     pullPolicy: IfNotPresent
-    tag: "0.1.126"
+    tag: "0.1.272"
 
   scanner:
     repository: ghcr.io/lukaszraczylo/gohoarder-scanner
     pullPolicy: IfNotPresent
-    tag: "0.1.126"
+    tag: "0.1.272"
 
 # Service Account
 serviceAccount:
@@ -358,7 +358,7 @@ migration:
   image:
     repository: ghcr.io/lukaszraczylo/gohoarder-migrate
     pullPolicy: IfNotPresent
-    tag: "0.1.126"
+    tag: "0.1.272"
 
   # Migration settings
   logLevel: "info"    # debug, info, warn, error
@@ -514,6 +514,16 @@ ingress:
     enabled: false
     secretName: "gohoarder-tls"
 
+  # Traefik-specific configuration (when className: "traefik")
+  # Used by IngressRoute template for advanced routing
+  traefik:
+    # Middleware references (from traefik namespace)
+    # Example: ["default-chain", "rate-limit"]
+    middlewares: []
+    # ServersTransport configuration
+    transport:
+      serverName: ""
+
 # Autoscaling configuration
 autoscaling:
   enabled: false

charts/jobs-manager-operator/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: jobs-manager
 description: Kubernetes jobs manager operator for orchestrating workflow-based job execution with dependency management
 type: application
-version: 0.1.15
+version: 0.1.47
-appVersion: "0.1.15"
+appVersion: "0.1.47"
 keywords:
   - operator
   - jobs

charts/jobs-manager-operator/values.yaml

@@ -21,7 +21,7 @@ controllerManager:
         - ALL
     image:
       repository: ghcr.io/lukaszraczylo/jobs-manager-operator
-      tag: "0.1.15"
+      tag: "0.1.47"
     resources:
       limits:
         cpu: 500m

charts/kube-images-sync-operator/Chart.yaml

@@ -10,9 +10,9 @@ description: |
 
 type: application
 
-version: 0.5.57
+version: 0.5.90
 
-appVersion: "0.5.57"
+appVersion: "0.5.90"
 
 home: https://github.com/lukaszraczylo/kubernetes-images-sync-operator
 

charts/kube-images-sync-operator/values.yaml

@@ -17,7 +17,7 @@ controllerManager:
       workerImage: ghcr.io/lukaszraczylo/kubernetes-images-sync-worker:0.5.54
     image:
       repository: ghcr.io/lukaszraczylo/kubernetes-images-sync-operator
-      tag: "0.5.57"
+      tag: "0.5.90"
     resources:
       limits:
         cpu: 500m

charts/kubemirror/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: kubemirror
 description: Kubernetes controller for mirroring resources across namespaces
 type: application
-version: 0.9.10
+version: 0.10.49
-appVersion: "0.9.10"
+appVersion: "0.10.49"
 keywords:
   - kubernetes
   - controller

charts/kubemirror/README.md

@@ -0,0 +1,83 @@
+# kubemirror Helm chart
+
+Deploys the [kubemirror](https://github.com/lukaszraczylo/kubemirror) controller,
+which mirrors Kubernetes resources (Secrets, ConfigMaps, and other types) across
+namespaces.
+
+- Chart version: `0.1.0`
+- App version: `0.1.0`
+- Image: `ghcr.io/lukaszraczylo/kubemirror`
+
+## Install
+
+```bash
+helm install kubemirror ./charts/kubemirror -n kubemirror --create-namespace
+```
+
+With a values override:
+
+```bash
+helm install kubemirror ./charts/kubemirror -n kubemirror --create-namespace \
+  -f my-values.yaml
+```
+
+## Uninstall
+
+```bash
+helm uninstall kubemirror -n kubemirror
+```
+
+## What it creates
+
+A single-replica `Deployment`, a `ServiceAccount`, a cluster-scoped `ClusterRole`
++ `ClusterRoleBinding` (the controller watches resources across all namespaces),
+and a `Service` exposing the metrics (`8080`) and health (`8081`) ports. The
+container runs as non-root (uid `65532`) with a read-only root filesystem and all
+Linux capabilities dropped.
+
+## Values
+
+Defaults are taken from [`values.yaml`](values.yaml).
+
+| Key | Default | Description |
+| --- | --- | --- |
+| `replicaCount` | `1` | Number of controller replicas. |
+| `image.repository` | `ghcr.io/lukaszraczylo/kubemirror` | Controller image. |
+| `image.tag` | `"0.1.0"` | Image tag (falls back to chart `appVersion` if empty). |
+| `image.pullPolicy` | `IfNotPresent` | Image pull policy. |
+| `serviceAccount.create` | `true` | Create a ServiceAccount. |
+| `serviceAccount.name` | `""` | Override the generated ServiceAccount name. |
+| `controller.metricsBindAddress` | `":8080"` | `--metrics-bind-address`. |
+| `controller.healthProbeBindAddress` | `":8081"` | `--health-probe-bind-address`. |
+| `controller.leaderElect` | `true` | Enable leader election (`--leader-elect`). |
+| `controller.leaderElectionID` | `"kubemirror-controller-leader"` | Lease name (`--leader-election-id`). |
+| `controller.resourceTypes` | `[]` | Resource types to mirror (`--resource-types`). Empty enables auto-discovery. |
+| `controller.discoveryInterval` | `"5m"` | Auto-discovery interval (`--discovery-interval`). |
+| `controller.resyncPeriod` | `"1h"` | Cache resync period, safety net only (`--resync-period`). |
+| `controller.maxTargets` | `100` | Max target namespaces per resource (`--max-targets`). |
+| `controller.workerThreads` | `5` | Concurrent reconcile workers (`--worker-threads`). |
+| `controller.rateLimitQPS` | `50.0` | API QPS limit (`--rate-limit-qps`). |
+| `controller.rateLimitBurst` | `100` | API burst limit (`--rate-limit-burst`). |
+| `controller.verifySourceFreshness` | `false` | Verify cache against a direct API read (`--verify-source-freshness`). |
+| `controller.lazyWatcherInit` | `false` | Only watch resource types actually in use (`--lazy-watcher-init`). Lowers memory; recommended for production. |
+| `controller.watcherScanInterval` | `"5m"` | Scan interval for new types in lazy mode (`--watcher-scan-interval`). |
+| `controller.excludedNamespaces` | `""` | Comma-separated namespaces never mirrored to (`--excluded-namespaces`). |
+| `controller.includedNamespaces` | `""` | Comma-separated namespace patterns to include (`--included-namespaces`). |
+| `service.type` | `ClusterIP` | Service type. |
+| `service.metricsPort` | `8080` | Metrics port. |
+| `service.healthPort` | `8081` | Health-probe port. |
+| `resources.requests` | `100m` CPU / `128Mi` | Container requests. |
+| `resources.limits` | `500m` CPU / `512Mi` | Container limits. |
+| `nodeSelector` / `tolerations` / `affinity` | `{}` / `[]` / `{}` | Standard scheduling controls. |
+| `priorityClassName` | `""` | Pod priority class. |
+
+> **Memory tip:** setting `controller.resourceTypes` to the exact types you mirror
+> (e.g. `["Secret.v1", "ConfigMap.v1"]`), or enabling `controller.lazyWatcherInit`,
+> avoids creating watchers for unused resource types and cuts memory use
+> substantially versus full auto-discovery.
+
+## Usage
+
+After install, mark a source resource for mirroring and opt a target namespace
+in. See the [project README](../../README.md) and [examples](../../examples/) for
+the full annotation/label reference and worked scenarios.

charts/kubemirror/templates/deployment.yaml

@@ -43,9 +43,7 @@ spec:
             - --worker-threads={{ .Values.controller.workerThreads }}
             - --rate-limit-qps={{ .Values.controller.rateLimitQPS }}
             - --rate-limit-burst={{ .Values.controller.rateLimitBurst }}
-            {{- if .Values.controller.verifySourceFreshness }}
+            - --verify-source-freshness={{ .Values.controller.verifySourceFreshness }}
-            - --verify-source-freshness=true
-            {{- end }}
             {{- if .Values.controller.lazyWatcherInit }}
             - --lazy-watcher-init=true
             {{- end }}

charts/kubemirror/values.yaml

@@ -3,7 +3,7 @@ replicaCount: 1
 image:
   repository: ghcr.io/lukaszraczylo/kubemirror
   pullPolicy: IfNotPresent
-  tag: "0.9.10"
+  tag: "0.10.49"
 
 imagePullSecrets: []
 nameOverride: ""
@@ -54,10 +54,11 @@ controller:
   # How often to rediscover available resources in the cluster
   discoveryInterval: "5m"
 
-  # Cache resync period - how often to refresh all cached resources
+  # Cache resync period - safety net for missed watch events; mirror drift
+  # is repaired event-driven, so this can stay long
   # Higher values reduce memory churn and API load
   # Default: 10m (was 30s in earlier versions)
-  resyncPeriod: "10m"
+  resyncPeriod: "1h"
 
   # Resource limits
   maxTargets: 100