Chore/banjo helm 0.5.0 dev1

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   _:
-    uses: toggle-corp/banjo-action/.github/workflows/pipeline.yml@v0.2.0
+    uses: toggle-corp/banjo-action/.github/workflows/pipeline.yml@v0.4.0
     with:
       # Job: Pre-commit
       pre_commit__apt_packages: "gdal-bin libgdal-dev"
@@ -28,3 +28,6 @@ jobs:
         }
       # Job: Helm
       helm__chart_directory: "./helm"
+      # Pinned: helm renders whitespace differently across releases and the pipeline
+      # diffs the committed chart snapshots byte-for-byte.
+      helm__version: "v4.2.2"

.github/workflows/helm-publish.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   _:
-    uses: toggle-corp/banjo-action/.github/workflows/pipeline.yml@v0.2.0
+    uses: toggle-corp/banjo-action/.github/workflows/pipeline.yml@v0.4.0
     with:
       # -- Same as validate
       # Job: Pre-commit
@@ -32,6 +32,9 @@ jobs:
         }
       # Job: Helm
       helm__chart_directory: "./helm"
+      # Pinned: helm renders whitespace differently across releases and the pipeline
+      # diffs the committed chart snapshots byte-for-byte.
+      helm__version: "v4.2.2"
       # -- Publish
       docker__push: true
       helm__push: true

helm/Chart.lock

@@ -1,6 +1,6 @@
 dependencies:
 - name: banjo-helm
   repository: oci://ghcr.io/toggle-corp
-  version: 0.4.0
-digest: sha256:962f25aab2f21bc6c7d642be104a0590bc323b5d6b4daa1a8cd94b6fa4ca2ebd
-generated: "2026-07-08T21:15:58.231349627+05:45"
+  version: 0.5.0
+digest: sha256:08b8147edabbe2ccba7982b18b3ff233330ede52fa5bdeda04ebf46a3d6f9aaf
+generated: "2026-09-10T18:47:05.642300394+05:45"

helm/Chart.yaml

@@ -9,5 +9,5 @@ sources:
 dependencies:
   - name: banjo-helm
     alias: app
-    version: 0.4.0
+    version: 0.5.0
     repository: oci://ghcr.io/toggle-corp

helm/snapshots/alpha-1.yaml

@@ -54,10 +54,9 @@ kind: ConfigMap
 metadata:
   name: risk-1-create-users-files
   annotations:
-    argocd.argoproj.io/hook: "Sync"
-    argocd.argoproj.io/sync-wave: "25"
-    # Refresh content on every sync and clean up before the next run.
+    argocd.argoproj.io/hook: Sync
     argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "25"
   labels:
     app: risk-1
     component: hook
@@ -572,7 +571,9 @@ metadata:
     release: release-name
   annotations:
     argocd.argoproj.io/sync-wave: "30"
+    traefik.ingress.kubernetes.io/router.middlewares: default-risk-module-body-size@kubernetescrd
 spec:
+  ingressClassName: "traefik"
   rules:
     - host: "risk-1.ifrcgo.local.example.com"
       http:
@@ -614,3 +615,13 @@ spec:
         requests:
           storage: 1Gi
       storageClassName: local-path
+---
+# Source: ifrcgo-risk-module-helm/charts/app/templates/extraManifests.yaml
+# Manifest: traefik-body-size-middleware
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: risk-module-body-size
+spec:
+  buffering:
+    maxRequestBodyBytes: 524288000

helm/snapshots/staging.yaml

@@ -5,10 +5,8 @@ kind: ServiceAccount
 metadata:
   name: service-token-reader
   annotations:
-
-    azure.workload.identity/client-id: null
+    azure.workload.identity/client-id: test-client-id
   labels:
-
     azure.workload.identity/use: "true"
 automountServiceAccountToken: true
 
@@ -561,8 +559,9 @@ metadata:
     release: release-name
   annotations:
     argocd.argoproj.io/sync-wave: "30"
+    traefik.ingress.kubernetes.io/router.middlewares: default-risk-module-body-size@kubernetescrd
 spec:
-  ingressClassName: "nginx"
+  ingressClassName: "traefik"
   rules:
     - host: "go-risk-api-stage.ifrc.org"
       http:
@@ -607,6 +606,16 @@ spec:
       resources:
         requests:
           storage: 1Gi
+---
+# Source: ifrcgo-risk-module-helm/charts/app/templates/extraManifests.yaml
+# Manifest: traefik-body-size-middleware
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: risk-module-body-size
+spec:
+  buffering:
+    maxRequestBodyBytes: 524288000
 
 ---
 # Source: ifrcgo-risk-module-helm/charts/app/templates/api/secrets-provider-class.yaml

helm/tests.yaml

@@ -2,7 +2,9 @@ tests:
   alpha-1.yaml:
     - values/operators.yaml
     - values/alpha.yaml
+    - values/traefik.yaml
   staging.yaml:
     - values/operators.yaml
     - values/go-deploy.yaml
     - values/staging.yaml
+    - values/traefik.yaml

helm/tests/staging.yaml

@@ -16,7 +16,7 @@ app:
     AZURE_STORAGE_MANAGED_IDENTITY: "true"
   serviceAccount:
     annotations:
-      azure.workload.identity/client-id:
+      azure.workload.identity/client-id: test-client-id
   secretsStoreCsiDriver:
     parameters:
       clientID: AZURE_CLIENT_ID-XYZ

helm/values/alpha.yaml

@@ -18,7 +18,7 @@ app:
         command: ["./manage.py", "wait_for_resources", "--db", "--cache", "--minio"]
       create-users:
         enabled: true
-        annotations:
+        jobAnnotations:
           argocd.argoproj.io/hook: "Sync"
           argocd.argoproj.io/sync-wave: "25"
           argocd.argoproj.io/hook-delete-policy: BeforeHookCreation

helm/values/go-deploy.yaml

@@ -7,7 +7,6 @@ app:
   api:
     ingress:
       enabled: true
-      className: nginx
       tls:
         enabled: true
 

helm/values/traefik.yaml

@@ -0,0 +1,21 @@
+# Serve the api ingress through Traefik. Layer this after an environment overlay
+# so the class here wins.
+app:
+  api:
+    ingress:
+      className: traefik
+      # Attach the risk-module-body-size Middleware to the api router. Traefik
+      # references CRD middlewares as `<namespace>-<name>@kubernetescrd`; the
+      # namespace is resolved via tpl so this stays namespace-agnostic.
+      annotations:
+        traefik.ingress.kubernetes.io/router.middlewares: "{{ $.Release.Namespace }}-risk-module-body-size@kubernetescrd"
+
+  extraManifests:
+    traefik-body-size-middleware:
+      apiVersion: traefik.io/v1alpha1
+      kind: Middleware
+      metadata:
+        name: risk-module-body-size
+      spec:
+        buffering:
+          maxRequestBodyBytes: 524288000   # 500 MiB