5e76f55077
* fix(helm): namespace app-specific values under global.seaweedfs Move all app-specific values from the global namespace to global.seaweedfs.* to avoid polluting the shared .Values.global namespace when the chart is used as a subchart. Standard Helm conventions (global.imageRegistry, global.imagePullSecrets) remain at the global level as they are designed to be shared across subcharts. Fixes seaweedfs/seaweedfs#8699 BREAKING CHANGE: global values have been restructured. Users must update their values files to use the new paths: - global.registry → global.imageRegistry - global.repository → global.seaweedfs.image.repository - global.imageName → global.seaweedfs.image.name - global.<key> → global.seaweedfs.<key> (for all other app-specific values) * fix(ci): update helm CI tests to use new global.seaweedfs.* value paths Update all --set flags in helm_ci.yml to use the new namespaced global.seaweedfs.* paths matching the values.yaml restructuring. * fix(ci): install Claude Code via npm to avoid install.sh 403 The claude-code-action's built-in installer uses `curl https://claude.ai/install.sh | bash` which can fail with 403. Due to the pipe, bash exits 0 on empty input, masking the curl failure and leaving the `claude` binary missing. Work around this by installing Claude Code via npm before invoking the action, and passing the executable path via path_to_claude_code_executable. * revert: remove claude-code-review.yml changes from this PR The claude-code-action OIDC token exchange validates that the workflow file matches the version on the default branch. Modifying it in a PR causes the review job to fail with "Workflow validation failed". The Claude Code install fix will need to be applied directly to master or in a separate PR. * fix: update stale references to old global.* value paths - admin-statefulset.yaml: fix fail message to reference global.seaweedfs.masterServer - values.yaml: fix comment to reference image.name instead of imageName - helm_ci.yml: fix diagnostic message to reference global.seaweedfs.enableSecurity * feat(helm): add backward-compat shim for old global.* value paths Add _compat.tpl with a seaweedfs.compat helper that detects old-style global.* keys (e.g. global.enableSecurity, global.registry) and merges them into the new global.seaweedfs.* namespace. Since the old keys no longer have defaults in values.yaml, their presence means the user explicitly provided them. The helper uses in-place mutation via `set` so all templates see the merged values. This ensures existing deployments using old value paths continue to work without changes after upgrading. * fix: update stale comment references in values.yaml Update comments referencing global.enableSecurity and global.masterServer to the new global.seaweedfs.* paths. --------- Co-authored-by: Copilot <copilot@github.com>
71 lines
1.8 KiB
YAML
71 lines
1.8 KiB
YAML
{{- include "seaweedfs.compat" . -}}
|
|
{{- if .Values.cosi.enabled }}
|
|
---
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
|
|
labels:
|
|
app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
|
|
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
rules:
|
|
- apiGroups: ["objectstorage.k8s.io"]
|
|
resources:
|
|
- "buckets"
|
|
- "bucketaccesses"
|
|
- "bucketclaims"
|
|
- "bucketaccessclasses"
|
|
- "buckets/status"
|
|
- "bucketaccesses/status"
|
|
- "bucketclaims/status"
|
|
- "bucketaccessclasses/status"
|
|
verbs:
|
|
- "get"
|
|
- "list"
|
|
- "watch"
|
|
- "update"
|
|
- "create"
|
|
- "delete"
|
|
- apiGroups: ["coordination.k8s.io"]
|
|
resources: ["leases"]
|
|
verbs:
|
|
- "get"
|
|
- "watch"
|
|
- "list"
|
|
- "delete"
|
|
- "update"
|
|
- "create"
|
|
- apiGroups: [""]
|
|
resources:
|
|
- "secrets"
|
|
- "events"
|
|
verbs:
|
|
- "get"
|
|
- "list"
|
|
- "watch"
|
|
- "update"
|
|
- "create"
|
|
- "delete"
|
|
- "patch"
|
|
---
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
|
|
labels:
|
|
app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
|
|
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner
|
|
namespace: {{ .Release.Namespace }}
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: {{ include "seaweedfs.fullname" . }}-objectstorage-provisioner
|
|
apiGroup: rbac.authorization.k8s.io
|
|
{{- end }}
|