Skip to content

Commit aedac23

Browse files
migmartrimigmartri
authored
chore: upgrade Go to 1.25.3 and Atlas to 0.38.0 (#2511)
Signed-off-by: Miguel Martinez <miguel@chainloop.dev>
1 parent 186888f commit aedac23

File tree

22 files changed

+635
-485
lines changed

22 files changed

+635
-485
lines changed

‎.claude/skills/upgrading-chart/SKILL.md‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
name: upgrading-chart
3+
description: Upgrades Helm chart dependencies (PostgreSQL, Vault) in the Chainloop project, including vendorized charts, container images, and CI/CD workflows. Use when the user mentions upgrading Helm charts, Bitnami dependencies, PostgreSQL chart, or Vault chart. CRITICAL - Major version upgrades are FORBIDDEN and must be escalated.
4+
---
5+
6+
# Upgrading Helm Chart Dependencies
7+
8+
This skill automates the upgrade process for Helm chart dependencies in the Chainloop project. Supports PostgreSQL and Vault (both Bitnami charts).
9+
10+
## CRITICAL RESTRICTIONS
11+
12+
**Version Upgrade Rules**:
13+
- Patch upgrades (1.2.3 → 1.2.4): ALLOWED
14+
- Minor upgrades (1.2.x → 1.3.x): ALLOWED
15+
- Major upgrades (1.x.x → 2.x.x): **FORBIDDEN - STOP IMMEDIATELY**
16+
17+
**MANDATORY**: If major version upgrade is detected, STOP the process and inform the user that manual review is required.
18+
19+
## Upgrade Types
20+
21+
The skill supports two upgrade types:
22+
23+
1. **Specific Image Upgrade**: Update container image to specific version (chart unchanged)
24+
2. **Chart Minor Version Upgrade**: Update chart to latest minor version (may include image updates)
25+
26+
**IMPORTANT**: Container images are ONLY updated as part of chart upgrades, never independently (unless Type 1).
27+
28+
## Process
29+
30+
### 1. Identify Upgrade Type
31+
32+
Ask the user which type of upgrade they want:
33+
- Type 1: Specific image version upgrade
34+
- Type 2: Latest minor chart version upgrade
35+
36+
Also ask which chart: `postgresql` or `vault`
37+
38+
### 2. Pre-Upgrade Validation
39+
40+
Check current state:
41+
```bash
42+
cat deployment/chainloop/charts/<chart-name>/Chart.yaml | grep "^version:"
43+
cat deployment/chainloop/charts/<chart-name>/Chart.yaml | grep "^appVersion:"
44+
```
45+
46+
### 3. Version Compatibility Check
47+
48+
For any version change, validate that major version remains the same:
49+
```bash
50+
CURRENT_MAJOR=$(echo "$CURRENT_VERSION" | cut -d. -f1)
51+
TARGET_MAJOR=$(echo "$TARGET_VERSION" | cut -d. -f1)
52+
53+
if [ "$CURRENT_MAJOR" != "$TARGET_MAJOR" ]; then
54+
echo "FORBIDDEN: Major version upgrade detected"
55+
exit 1
56+
fi
57+
```
58+
59+
If major version upgrade detected, STOP and escalate.
60+
61+
## Type 1: Specific Image Upgrade
62+
63+
See [image-upgrade-process.md](image-upgrade-process.md) for detailed steps.
64+
65+
**Summary**:
66+
1. Locate target container image in [Bitnami Containers](https://github.com/bitnami/containers)
67+
2. Find commit with release message pattern
68+
3. Extract APP_VERSION from Dockerfile
69+
4. Update `deployment/charts/<chart-name>/Chart.yaml` appVersion
70+
5. Update `.github/workflows/build_external_container_images.yaml` commit hash
71+
72+
## Type 2: Chart Minor Version Upgrade
73+
74+
See [chart-upgrade-process.md](chart-upgrade-process.md) for detailed steps.
75+
76+
**Summary**:
77+
1. Locate target chart version in [Bitnami Charts](https://github.com/bitnami/charts) CHANGELOG.md
78+
2. Validate minor version upgrade only
79+
3. Download and extract target chart
80+
4. Check for image changes (compare Chart.yaml)
81+
5. If images changed, update container image references
82+
6. Vendorize chart update (copy files)
83+
7. Update dependencies in correct order
84+
8. Update main chart dependency version
85+
9. Clean up temporary files
86+
87+
## Verification
88+
89+
After any upgrade type, run:
90+
```bash
91+
# Lint charts
92+
helm lint deployment/charts/<chart-name>
93+
helm lint deployment/chainloop
94+
95+
# Template validation
96+
helm template deployment/charts/<chart-name>
97+
helm template deployment/chainloop
98+
99+
# Local testing
100+
cd devel && docker compose up
101+
102+
# Verify image consistency
103+
grep -r "appVersion\|image.*tag" deployment/charts/<chart-name>/
104+
```
105+
106+
## Files Modified
107+
108+
See [files-modified.md](files-modified.md) for complete list.
109+
110+
## Troubleshooting
111+
112+
Common issues:
113+
- **Image Version Mismatch**: Verify APP_VERSION matches Chart.yaml appVersion
114+
- **Build Failures**: Check commit reference in build workflow
115+
- **Dependency Conflicts**: Verify dependencies updated in correct order (vendorized first, then main chart)
116+
117+
## Rollback
118+
119+
If issues occur:
120+
```bash
121+
git checkout HEAD -- deployment/
122+
find deployment/ -name "Chart.lock" -delete
123+
cd deployment/chainloop && helm dependency build
124+
cd ../../devel && docker compose down && docker compose up
125+
```
126+
127+
## Important Notes
128+
129+
- Dex is self-managed and follows a separate process (not covered by this skill)
130+
- Always use commit hashes for reproducibility
131+
- Dependencies must be updated in correct order: vendorized chart first, then main chart
132+
- Container images are found in Bitnami Containers repo, charts in Bitnami Charts repo

‎.claude/skills/upgrading-chart/chart-upgrade-process.md‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
# Chart Minor Version Upgrade Process (Type 2)
2+
3+
This process upgrades a Helm chart to the latest minor version, potentially including image updates.
4+
5+
## Step 1: Locate Target Chart Version
6+
7+
1. Navigate to [Bitnami Charts](https://github.com/bitnami/charts)
8+
2. Open `bitnami/<chart-name>/CHANGELOG.md`
9+
3. Find latest minor version (ensure no major version change)
10+
4. Note target chart version
11+
12+
## Step 2: Version Validation
13+
14+
**MANDATORY**: Verify minor upgrade only:
15+
```bash
16+
CURRENT_CHART_VERSION="<current>"
17+
TARGET_CHART_VERSION="<target>"
18+
19+
CURRENT_MAJOR=$(echo "$CURRENT_CHART_VERSION" | cut -d. -f1)
20+
TARGET_MAJOR=$(echo "$TARGET_CHART_VERSION" | cut -d. -f1)
21+
22+
if [ "$CURRENT_MAJOR" != "$TARGET_MAJOR" ]; then
23+
echo "FORBIDDEN: Major version upgrade detected"
24+
exit 1
25+
fi
26+
```
27+
28+
## Step 3: Download and Extract Target Chart
29+
30+
```bash
31+
# Pull chart to temporary location
32+
helm pull bitnami/<chart-name> --version <target-version> --untar --untardir /tmp
33+
34+
# Examine structure
35+
ls -la /tmp/<chart-name>/
36+
```
37+
38+
## Step 4: Check for Image Changes
39+
40+
```bash
41+
# Compare current vs target chart
42+
diff deployment/charts/<chart-name>/Chart.yaml /tmp/<chart-name>/Chart.yaml
43+
44+
# Look for changes in:
45+
# - appVersion field
46+
# - images section (if present)
47+
# - dependencies
48+
```
49+
50+
## Step 5: Update Container Images (if changed)
51+
52+
**Execute only if images changed in target chart**:
53+
54+
1. **Locate new image versions**:
55+
- Pattern format: `<app-version>-<distro>-<distro-version>-r<revision>`
56+
- Example: `15.3.0-debian-12-r1`
57+
58+
2. **Get APP_VERSION from Dockerfile**:
59+
- Navigate to `bitnami/containers/<image>/<major-version>/<distro>-<version>/Dockerfile`
60+
- Extract `APP_VERSION` environment variable
61+
62+
3. **Update build configuration**:
63+
```bash
64+
# Update commit hash in build workflow
65+
vi .github/workflows/build_external_container_images.yaml
66+
```
67+
68+
## Step 6: Vendorize Chart Update
69+
70+
```bash
71+
# Replace vendorized chart with new version
72+
cp -r /tmp/<chart-name>/* deployment/charts/<chart-name>/
73+
74+
# Update Chart.yaml if images changed
75+
vi deployment/charts/<chart-name>/Chart.yaml
76+
# Set appVersion to APP_VERSION from Bitnami Containers
77+
78+
# Update values.yaml if needed
79+
# Replace docker.io/bitnami/* with Chainloop registry paths
80+
vi deployment/charts/<chart-name>/values.yaml
81+
```
82+
83+
## Step 7: Update Dependencies (CRITICAL ORDER)
84+
85+
**Dependencies must be updated in this specific order**:
86+
87+
```bash
88+
# 1. Update vendorized chart dependencies FIRST
89+
cd deployment/charts/<chart-name>
90+
helm dependency update
91+
helm dependency build
92+
93+
# 2. Update main chart dependency version
94+
cd ../../chainloop
95+
vi Chart.yaml # Update dependency version to match vendorized chart
96+
97+
# 3. Update main chart dependencies
98+
helm dependency update
99+
helm dependency build
100+
101+
cd ../..
102+
```
103+
104+
## Step 8: Clean Up
105+
106+
```bash
107+
# Remove temporary files
108+
rm -rf /tmp/<chart-name>
109+
110+
# Verify working directory
111+
git status
112+
```
113+
114+
## Step 9: Verification
115+
116+
```bash
117+
# Lint charts
118+
helm lint deployment/charts/<chart-name>
119+
helm lint deployment/chainloop
120+
121+
# Template validation
122+
helm template deployment/charts/<chart-name>
123+
helm template deployment/chainloop
124+
125+
# Local testing
126+
cd devel && docker compose up
127+
128+
# Verify image consistency
129+
grep -r "appVersion\|image.*tag" deployment/charts/<chart-name>/
130+
grep -r "<chart-name>" .github/workflows/build_external_container_images.yaml
131+
```
132+
133+
## Files Modified
134+
135+
- `deployment/charts/<chart-name>/Chart.yaml` - Chart version and appVersion
136+
- `deployment/charts/<chart-name>/values.yaml` - Image references
137+
- `deployment/charts/<chart-name>/Chart.lock` - Dependency lock (regenerated)
138+
- `deployment/charts/<chart-name>/templates/*` - All chart templates (vendorized)
139+
- `deployment/chainloop/Chart.yaml` - Main chart dependency version
140+
- `deployment/chainloop/Chart.lock` - Main dependency lock (regenerated)
141+
- `.github/workflows/build_external_container_images.yaml` - Image build references (if images changed)
142+
143+
## Important Notes
144+
145+
- Always vendorize first, then update main chart dependencies
146+
- Chart.lock files are regenerated by `helm dependency build`
147+
- Image registry paths must use Chainloop registry (not docker.io/bitnami)
148+
- Commit hashes ensure reproducible builds

‎.claude/skills/upgrading-chart/files-modified.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Files Modified During Chart Upgrades
2+
3+
This reference lists all files that may be modified during Helm chart dependency upgrades.
4+
5+
## Type 1: Specific Image Upgrade
6+
7+
### Chart Files
8+
- `deployment/charts/<chart-name>/Chart.yaml` - appVersion only
9+
10+
### CI/CD Configuration
11+
- `.github/workflows/build_external_container_images.yaml` - commit hash reference
12+
13+
**Total files**: 2 files
14+
15+
## Type 2: Chart Minor Version Upgrade
16+
17+
### Vendorized Chart Files
18+
- `deployment/charts/<chart-name>/Chart.yaml` - Chart version and appVersion
19+
- `deployment/charts/<chart-name>/values.yaml` - Default configuration and image references
20+
- `deployment/charts/<chart-name>/Chart.lock` - Dependency lock file (regenerated)
21+
- `deployment/charts/<chart-name>/templates/*` - All Helm template files
22+
- `deployment/charts/<chart-name>/README.md` - Chart documentation
23+
- Other chart files as needed
24+
25+
### Main Chart Files
26+
- `deployment/chainloop/Chart.yaml` - Dependency version reference
27+
- `deployment/chainloop/Chart.lock` - Main chart dependency lock (regenerated)
28+
29+
### CI/CD Configuration (if images changed)
30+
- `.github/workflows/build_external_container_images.yaml` - Image build commit references
31+
32+
**Total files**: Variable (all vendorized chart files + 2-3 main files)
33+
34+
## Common Chart Names
35+
36+
- `postgresql` - PostgreSQL database
37+
- `vault` - HashiCorp Vault for secrets
38+
39+
## File Locations Summary
40+
41+
```
42+
deployment/
43+
├── charts/
44+
│ ├── postgresql/ # Vendorized PostgreSQL chart
45+
│ │ ├── Chart.yaml # Chart metadata
46+
│ │ ├── Chart.lock # Dependencies (regenerated)
47+
│ │ ├── values.yaml # Configuration
48+
│ │ └── templates/ # Helm templates
49+
│ └── vault/ # Vendorized Vault chart
50+
│ ├── Chart.yaml
51+
│ ├── Chart.lock
52+
│ ├── values.yaml
53+
│ └── templates/
54+
└── chainloop/ # Main Chainloop chart
55+
├── Chart.yaml # Main chart with dependencies
56+
└── Chart.lock # Main dependencies (regenerated)
57+
58+
.github/
59+
└── workflows/
60+
└── build_external_container_images.yaml # Image build config
61+
```
62+
63+
## Key Points
64+
65+
- `.lock` files are always regenerated by `helm dependency build`
66+
- Template files are completely replaced during vendorization
67+
- Image registry paths should reference Chainloop registry, not `docker.io/bitnami`
68+
- Build workflow only modified if container images change

0 commit comments

Comments
 (0)