Dimpact/helm-charts
1
0
Fork 0
mirror of https://github.com/Dimpact-Samenwerking/helm-charts.git synced 2026-10-13 18:17:18 +00:00
Code Issues Projects Releases Packages Wiki Activity
Dimpact Helm charts
434 commits 62 branches 224 tags 23 MiB
  • Python 94.9%
  • Shell 3.2%
  • Go Template 1.4%
  • Lua 0.5%
Find a file
Exact
Sytske van Hasselt 88dc47279d
 Feature PodiumD 4.9.4 (#523) 
# PodiumD 4.9.4

`feature/podiumd-4.9.4` into `main`. Details: [upgrade
guide](charts/podiumd/docs/_UPGRADE_PATHS/4.9.3-to-4.9.4-upgrade.md),
[values
deltas](charts/podiumd/docs/_UPGRADE_PATHS/4.9.3-to-4.9.4-values-deltas.md),
[gemeente-specific](charts/podiumd/docs/_UPGRADE_PATHS/4.9.3-to-4.9.4-gemeente-specific.md),
[`images-4.9.4.yaml`](charts/podiumd/docs/images/images-4.9.4.yaml).

## Updated components

| Component | App version | Helm chart |
| --- | --- | --- |
| openinwoner (Portaal) | 2.4.3 → 2.4.6 | 2.4.0 (unchanged) |
| ita | 3.3.2 → 3.3.4 | 3.3.2 → 3.3.4 |

- **openinwoner 2.4.6 — security fix.** The editor's image endpoints let
any logged-in user (also DigiD/eHerkenning) upload HTML/SVG with
JavaScript (stored XSS) and read or change any image's metadata; all
versions from 2.0.0 are affected. 2.4.6 also brings 2.4.4/2.4.5:
django-cms 4.1.10 → 5.0.11, per-role `OTEL_SERVICE_NAME`, and bug fixes.
- **ita 3.3.4** — bug fixes only (#582, #574, #578); the chart changes
nothing but its version.

## Configuration change

- `openinwoner.settings.cms4MigrationInitContainer` now defaults to
`false`: on django-cms 5 the init container crashes and Open Inwoner
does not start. Per-environment values must not set it to `true`.

## Upgrade notes

- **Before:** back up the `openinwoner` database (the django-cms 5
migrations drop `cms_treenode`; a restore is the only reliable
rollback), mirror the new images, and give editor groups
`filer.add_image` / `filer.change_image`.
- **After:** run `check_filer_images` to find abuse of the closed hole,
and check the CMS page tree and editing.
- Scripts calling `Page.set_as_homepage()` / `move_page()` need
`transaction.atomic()`; Grafana filters on `service.name="openinwoner"`
need the per-role names.

## Other fixes

- `install-keycloak-operator-crds.sh` installs the Keycloak 26.7 client
CRDs, fails on fetch errors instead of skipping them, and defaults to
the chart's Keycloak version.
- `fix-doc-consistency` no longer leaves a trailing blank line when it
moves a manifest group to the end (with test).

## Verification

- Tested with Portaal 2.4.5 on johnb00 and on ontw-dim2 (4.6.6 → 4.9.3 →
4.9.4): migrations, health, DigiD/eHerkenning login, Mijn zaken, Open
Klant flows and observability. The 2.4.6 and ITA 3.3.4 bumps are
image-only on top of that.
- `verify-podiumd` passes for the 2.4.6/3.3.4 commit (CVE and upgrade
scans not re-run).
- ontw-dim1 deploy (branch mode) rolled out the new images but failed on
a pre-existing Redis volume problem on that cluster, unrelated to this
chart.

---------

Co-authored-by: Kees van Vloten <kees@info.nl>
Co-authored-by: John Bol <john@info.nl>
Co-authored-by: Bas de Wit <bas@info.nl>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-08 16:23:13 +02:00
.claude refactor(podiumd): upgrade-doc writer and checker share one implementation (#520) 2026-10-07 13:47:38 +02:00
.github ci(release): don't run the chart release for podiumd tooling changes (#528) 2026-10-06 15:10:42 +02:00
charts Feature PodiumD 4.9.4 (#523) 2026-10-08 16:23:13 +02:00
.gitattributes PodiumD 4.6 🚀 (#205) 2026-03-31 17:48:20 +02:00
.gitignore Feature PodiumD 4.9.4 (#523) 2026-10-08 16:23:13 +02:00
CLAUDE.md PodiumD 4.9.2 (#461) 2026-09-24 20:04:52 +02:00
README.md feature: PodiumD 4.9.0 (#350) 2026-08-28 16:41:46 +02:00
renovate.json feature: PodiumD patch 4.9.3 (#497) 2026-09-30 17:58:45 +02:00

README.md

Dimpact Helm charts

This repository contains Helm charts for:

Usage

helm repo add dimpact https://Dimpact-Samenwerking.github.io/helm-charts/
helm search repo dimpact
helm install my-release dimpact/<chart>

Branching strategy

The repository uses a forward-cascade model centred on PodiumD releases.

main  (current release, e.g. 4.7.5)
 └── feature/podiumd-4.8.0          ← next release
      ├── feature/podiumd-4.8.0-*   ← feature branches to be merged into 4.8.0
      ├── feature/info-podiumd-4.8.0   ┐
      ├── feature/icatt-podiumd-4.8.0  ├ environment-specific branches (o-info / o-icatt / o-maykin)
      ├── feature/maykin-podiumd-4.8.0 ┘
      └── feature/podiumd-4.9.0     ← future release (changes that won't be part of 4.8.0)
           ├── feature/info-podiumd-4.9.0   ┐
           ├── feature/icatt-podiumd-4.9.0  ├ environment-specific branches
           └── feature/maykin-podiumd-4.9.0 ┘
Branch pattern Purpose
main Current production release. Merging here triggers a production release.
feature/podiumd-<X.Y.0> Upcoming release branch. Branched from main (or the previous release branch for future releases). All release work lands here before merging to main.
feature/podiumd-<X.Y.0>-* Short-lived feature branches for changes destined for <X.Y.0>. Merged into the release branch when ready.
feature/<env>-podiumd-<X.Y.0> Environment-specific branches (e.g. o-info, o-icatt, o-maykin) branched from the matching release branch. Changes here may or may not be promoted back into the release branch.

Rules

  • Each release branch is branched from the tip of the previous release branch (or main for the immediate next release), so every release automatically contains all prior changes.
  • Environment-specific branches (feature/<env>-podiumd-*) are branched from the corresponding release branch and kept in sync with it by rebasing or merging.
  • Short-lived feature branches (feature/podiumd-<X.Y.0>-*) target the release branch they are named after and are deleted after merging.
  • main always reflects the latest production release; only completed release branches are merged into it.

Releases

Production Releases

Production releases are automatically created when changes are pushed to the main or release/* branches. These releases follow semantic versioning and are production-ready.

Snapshot Releases (Podiumd Only)

For testing purposes, you can manually create snapshot releases of the podiumd chart from any branch. Snapshot releases:

  • Include the branch name in the version (e.g., podiumd-1.0.0-feature-new-config-snapshot)
  • Are marked as pre-release (not production ready)
  • Are overwritten each time you run the workflow on the same branch
  • Are automatically cleaned up after 3 weeks
  • Only apply to the podiumd chart - all other charts are excluded from snapshot releases

To create a snapshot release, go to the Actions tab and manually trigger the Release Snapshot Charts workflow.

See Snapshot Release Documentation for more details.