diff --git a/CHANGELOG.md b/CHANGELOG.md index d6fc83a..bf66ba3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,68 +8,42 @@ annotation in `charts/appwrite/Chart.yaml`. ## [Unreleased] +## [1.0.0] - 2026-10-13 + First release of the chart, for Appwrite 2.3.0. ### Added -- API, console, realtime, workers, scheduler, maintenance and interval tasks, - and the geo service, all passing the `restricted` Pod Security Standard. -- Built-in single-replica PostgreSQL, Redis and ClickHouse, or external ones - (PostgreSQL, MariaDB, MySQL, MongoDB; Redis; ClickHouse over HTTP or TLS). - Each backing service is one block (`database`, `redis`, `clickhouse`, - `storage`, `smtp`, `documentsDb`, `vectorsDb`) with a `mode` switch, - `builtin` and `external` settings, and every credential takes the same - `{value, secretName, secretKey}` shape. -- Combined, separate and grouped worker topologies; split schedulers. -- Opt-in metrics for the built-in datastores: postgres_exporter and - redis_exporter sidecars, ClickHouse's own Prometheus endpoint, a - ServiceMonitor per datastore, a PrometheusRule from your rule groups, and - `networkPolicy.metrics.from` for the scraper. -- `extraObjects`: extra manifests as a list or a map, rendered with `tpl`. -- The same extension keys on every component, the built-in datastores - included: `extraEnv`, `extraVolumes`, `extraVolumeMounts`, - `extraInitContainers`, `extraContainers`, `terminationGracePeriodSeconds`. -- `defaults.revisionHistoryLimit`, `defaults.hostAliases`, `defaults.dnsPolicy` - and `defaults.dnsConfig` for every pod. -- `autoscaling.metrics` for the API, console and realtime, replacing the CPU - and memory targets. -- `ingress.pathType`, `ingress.extraTls` and `httpRoute.timeouts` (every rule - but realtime). -- A memory-backed `/dev/shm` for the built-in PostgreSQL (`postgresql.shm`). -- Redis, ClickHouse, geo and the assistant restart when the value they read - from the chart's Secret changes. -- A guard against an `image.tag` of another Appwrite major version - (`image.allowUnsupportedVersion`), and a pattern for failing clearly on - renamed values. -- The chart README groups the values table by area. -- Ingress and Gateway API HTTPRoutes for the API, console, realtime, function - and site previews, and custom domains. -- S3 storage, and Functions and Sites: builds run in the cluster as - Kubernetes Jobs through the open-runtimes orchestrator, in their own - `baseline` namespace behind a NetworkPolicy that only allows public - addresses (plus `deniedCIDRs`). Executions run on the open-runtimes - executor on Docker-in-Docker: a privileged pod you accept with - `compute.executor.privileged` (or Sysbox through `runtimeClassName`), in a - namespace of its own with its own copy of its credentials, no TCP listener - on the Docker daemon, and a NetworkPolicy that only lets Appwrite in and - the executor out to DNS, S3 and public addresses. +- The API, console, realtime, workers (combined, separate or grouped), + schedulers, maintenance and interval tasks, and geo, all passing the + `restricted` Pod Security Standard. +- Built-in single-replica PostgreSQL, Redis and ClickHouse, or external + services (PostgreSQL, MariaDB, MySQL, MongoDB; Redis; ClickHouse over HTTP + or TLS). Each backing service (`database`, `redis`, `clickhouse`, + `storage`, `smtp`, `documentsDb`, `vectorsDb`) has a `mode` switch, and + every credential takes the same `{value, secretName, secretKey}` shape. +- Storage on a volume or in S3-compatible object storage. +- Opt-in Functions and Sites in the cluster: builds run as Kubernetes Jobs + through the open-runtimes orchestrator, in their own `baseline` namespace; + executions run on the open-runtimes executor on Docker-in-Docker, a + privileged pod you accept with `compute.executor.privileged` (or Sysbox + through `runtimeClassName`), in its own namespace behind NetworkPolicies. +- Ingress and Gateway API HTTPRoutes for the API, console, realtime, + function and site previews, and custom domains. - Optional browser, assistant, autogravity, embedding and MQTT components. - PodDisruptionBudgets and topology spread by default; opt-in - NetworkPolicies and HorizontalPodAutoscalers. -- `appwrite.extraVolumes` and `appwrite.extraVolumeMounts` for every Appwrite - pod, including tasks and the migration Job, for example to mount the CA that - verifies the database's TLS certificate. -- Credentials generated once, kept across upgrades and uninstalls, with guards - against changing the encryption key or regenerating datastore passwords. -- Data migrations as a post-upgrade hook (retried after a failure) or a Job - named after the version and its spec, and a downgrade guard. -- `values.schema.json` that also accepts a parent chart's `global` values, - validation of worker topologies and connection limits, `helm test` pods, - and documentation: getting started, architecture, executor, production, - networking, security, storage, external databases with provider notes, - integrations (SMTP, Git deployments, console sign-in, SMS, Sentry), - optional components, migrating from Docker, upgrades, backups, GitOps and - troubleshooting. -- `examples/`: values files for a local try-out, a first install, - production, external services, AWS, and Functions and Sites, rendered and - validated in CI. + NetworkPolicies, HorizontalPodAutoscalers, and metrics for the built-in + datastores (exporters, ServiceMonitors and a PrometheusRule). +- Credentials generated once and kept across upgrades and uninstalls, with + guards against changing the encryption key or regenerating datastore + passwords. Pods restart when a Secret value they read changes. +- Data migrations on upgrade, a downgrade guard, and a guard against an + `image.tag` of another Appwrite major version. +- The same extension keys on every component, the built-in datastores + included (`extraEnv`, `extraVolumes`, `extraVolumeMounts`, + `extraInitContainers`, `extraContainers`), pod-wide `defaults`, and + `extraObjects` for your own manifests. +- `values.schema.json`, `helm test` pods, documentation from getting started + to backups, GitOps and troubleshooting, and example values files for local, + production, external services, AWS, GCP, Azure, and Functions and Sites + installs. diff --git a/RELEASING.md b/RELEASING.md index 89140f6..c7c2cc5 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -84,24 +84,19 @@ people may have pulled it already. ## Pre-releases -Every 0.x version is a pre-release: the workflow marks its GitHub release as -one (as it does for versions with a `-suffix`), and `Chart.yaml` carries -`artifacthub.io/prerelease: "true"`. At 1.0.0, set that annotation to -`"false"` in the same PR that bumps the version. For a later pre-release such -as `1.1.0-rc.1`, set it back to `"true"` for that version only. - -## Before the first release (0.1.0) - -`Chart.yaml` already says `0.1.0`, so the first release only needs the -changelog and the repository settings: - -- [ ] Rename `## [Unreleased]` in `CHANGELOG.md` to `## [0.1.0] - ` - (add a new empty `## [Unreleased]` above it), and run `make changes`. - Do this before running the workflow below: it refuses to publish a - version without changelog entries. -- [ ] Make the repository public, then run the release workflow manually - (Actions → Release → Run workflow, on `main`); it skips itself while - the repository is private. Build provenance attestations on private +The workflow marks a version with a `-suffix`, such as `1.1.0-rc.1`, as a +pre-release on GitHub. Set `artifacthub.io/prerelease: "true"` in `Chart.yaml` +for that version only, and back to `"false"` in the next release. + +## Before the first release (1.0.0) + +The release pull request sets `Chart.yaml` to `1.0.0` and has the changelog +section, so the first release only needs the repository settings: + +- [ ] Make the repository public before merging the release pull request: + the release workflow skips itself while the repository is private. If + the pull request was merged first, run it manually (Actions → Release + → Run workflow, on `main`). Build provenance attestations on private repositories need GitHub Enterprise Cloud, and keyless signatures record the repository in the public Rekor transparency log anyway. - [ ] After the first push, make the `charts/appwrite` package public in the diff --git a/charts/appwrite/Chart.yaml b/charts/appwrite/Chart.yaml index e1d2e04..3a66a34 100644 --- a/charts/appwrite/Chart.yaml +++ b/charts/appwrite/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: appwrite description: Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse. type: application -version: 0.1.0 +version: 1.0.0 appVersion: "2.3.0" kubeVersion: ">=1.29.0-0" home: https://github.com/appwrite/helm-chart @@ -23,7 +23,7 @@ maintainers: url: https://github.com/levivannoort annotations: artifacthub.io/license: BSD-3-Clause - artifacthub.io/prerelease: "true" + artifacthub.io/prerelease: "false" artifacthub.io/category: database artifacthub.io/links: | - name: Chart source @@ -38,25 +38,27 @@ annotations: url: https://github.com/appwrite/helm-chart/issues artifacthub.io/changes: | - kind: added - description: Appwrite 2.3.0 with the API, console, realtime, workers and tasks, passing the restricted Pod Security Standard + description: The API, console, realtime, workers (combined, separate or grouped), schedulers, maintenance and interval tasks, and geo, all passing the `restricted` Pod Security Standard. - kind: added - description: Built-in PostgreSQL, Redis and ClickHouse, or external services + description: Built-in single-replica PostgreSQL, Redis and ClickHouse, or external services (PostgreSQL, MariaDB, MySQL, MongoDB; Redis; ClickHouse over HTTP or TLS). Each backing service (`database`, `redis`, `clickhouse`, `storage`, `smtp`, `documentsDb`, `vectorsDb`) has a `mode` switch, and every credential takes the same `{value, secretName, secretKey}` shape. - kind: added - description: Combined, separate and grouped worker topologies + description: Storage on a volume or in S3-compatible object storage. - kind: added - description: Ingress and Gateway API routes, including function and site previews and custom domains + description: 'Opt-in Functions and Sites in the cluster: builds run as Kubernetes Jobs through the open-runtimes orchestrator, in their own `baseline` namespace; executions run on the open-runtimes executor on Docker-in-Docker, a privileged pod you accept with `compute.executor.privileged` (or Sysbox through `runtimeClassName`), in its own namespace behind NetworkPolicies.' - kind: added - description: S3 storage, and Functions and Sites in the cluster, with builds as Kubernetes Jobs and the executor on Docker-in-Docker in its own namespace (opt-in privileged pod) + description: Ingress and Gateway API HTTPRoutes for the API, console, realtime, function and site previews, and custom domains. - kind: added - description: Optional browser, assistant, autogravity, embedding and MQTT components + description: Optional browser, assistant, autogravity, embedding and MQTT components. - kind: added - description: PodDisruptionBudgets and topology spread by default; NetworkPolicies and autoscaling + description: PodDisruptionBudgets and topology spread by default; opt-in NetworkPolicies, HorizontalPodAutoscalers, and metrics for the built-in datastores (exporters, ServiceMonitors and a PrometheusRule). - kind: added - description: Credentials generated once and kept across upgrades, with guards against losing the encryption key or datastore passwords + description: Credentials generated once and kept across upgrades and uninstalls, with guards against changing the encryption key or regenerating datastore passwords. Pods restart when a Secret value they read changes. - kind: added - description: Data migrations on upgrade and a downgrade guard + description: Data migrations on upgrade, a downgrade guard, and a guard against an `image.tag` of another Appwrite major version. - kind: added - description: Guides for external databases, S3 and integrations, and example values files for local, production, AWS and Functions and Sites installs + description: The same extension keys on every component, the built-in datastores included (`extraEnv`, `extraVolumes`, `extraVolumeMounts`, `extraInitContainers`, `extraContainers`), pod-wide `defaults`, and `extraObjects` for your own manifests. + - kind: added + description: '`values.schema.json`, `helm test` pods, documentation from getting started to backups, GitOps and troubleshooting, and example values files for local, production, external services, AWS, GCP, Azure, and Functions and Sites installs.' artifacthub.io/images: | - name: appwrite image: docker.io/appwrite/appwrite:2.3.0 diff --git a/charts/appwrite/README.md b/charts/appwrite/README.md index 3da97a0..cc308f0 100644 --- a/charts/appwrite/README.md +++ b/charts/appwrite/README.md @@ -1,6 +1,6 @@ # Appwrite Helm chart -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.3.0](https://img.shields.io/badge/AppVersion-2.3.0-informational?style=flat-square) +![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.3.0](https://img.shields.io/badge/AppVersion-2.3.0-informational?style=flat-square) Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse. diff --git a/charts/appwrite/tests/scheduling_test.yaml b/charts/appwrite/tests/scheduling_test.yaml index c63c0fa..98eb346 100644 --- a/charts/appwrite/tests/scheduling_test.yaml +++ b/charts/appwrite/tests/scheduling_test.yaml @@ -37,6 +37,8 @@ tests: - it: leaves chart and version labels off pod templates template: templates/api/deployment.yaml + chart: + version: 9.9.9 asserts: - notExists: path: spec.template.metadata.labels["helm.sh/chart"] @@ -44,7 +46,7 @@ tests: path: spec.template.metadata.labels["app.kubernetes.io/version"] - equal: path: metadata.labels["helm.sh/chart"] - value: appwrite-0.1.0 + value: appwrite-9.9.9 - it: skips the API PodDisruptionBudget while a ReadWriteOnce volume pins it to one node template: templates/api/pdb.yaml diff --git a/docs/gitops.md b/docs/gitops.md index 36d1206..b91ba78 100644 --- a/docs/gitops.md +++ b/docs/gitops.md @@ -281,7 +281,7 @@ spec: source: repoURL: ghcr.io/appwrite/charts chart: appwrite - targetRevision: 0.1.0 + targetRevision: 1.0.0 helm: valuesObject: appwrite: @@ -351,7 +351,7 @@ Things that differ from the Helm CLI: dry run, which doesn't touch the cluster: ```console - helm install appwrite oci://ghcr.io/appwrite/charts/appwrite --version 0.1.0 \ + helm install appwrite oci://ghcr.io/appwrite/charts/appwrite --version 1.0.0 \ -n appwrite -f values.yaml --dry-run=client | sed -n '/^NOTES:/,$p' ``` - **No `ignoreDifferences` needed.** With the values above, two renders are diff --git a/docs/upgrading.md b/docs/upgrading.md index d640605..4d4bac3 100644 --- a/docs/upgrading.md +++ b/docs/upgrading.md @@ -8,7 +8,7 @@ the chart upgrades Appwrite. You can pin a different Appwrite version with | Chart | Appwrite | | --- | --- | -| 0.1.0 | 2.3.0 | +| 1.0.0 | 2.3.0 | The [changelog](../CHANGELOG.md) lists what changed in each chart version, and [version notes](#version-notes) what you have to do about it. @@ -182,6 +182,6 @@ and after. A release without an entry needs nothing beyond `helm upgrade`. When you skip versions, apply the entries of every version in between, oldest first. -### To 0.1.0 +### To 1.0.0 The first release. Nothing to do.