chore(release): appwrite 1.0.0

CHANGELOG.md

@@ -8,68 +8,42 @@ annotation in `charts/appwrite/Chart.yaml`.
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-10-13
+
 First release of the chart, for Appwrite 2.3.0.
 
 ### Added
 
-- API, console, realtime, workers, scheduler, maintenance and interval tasks,
-  and the geo service, all passing the `restricted` Pod Security Standard.
-- Built-in single-replica PostgreSQL, Redis and ClickHouse, or external ones
-  (PostgreSQL, MariaDB, MySQL, MongoDB; Redis; ClickHouse over HTTP or TLS).
-  Each backing service is one block (`database`, `redis`, `clickhouse`,
-  `storage`, `smtp`, `documentsDb`, `vectorsDb`) with a `mode` switch,
-  `builtin` and `external` settings, and every credential takes the same
-  `{value, secretName, secretKey}` shape.
-- Combined, separate and grouped worker topologies; split schedulers.
-- Opt-in metrics for the built-in datastores: postgres_exporter and
-  redis_exporter sidecars, ClickHouse's own Prometheus endpoint, a
-  ServiceMonitor per datastore, a PrometheusRule from your rule groups, and
-  `networkPolicy.metrics.from` for the scraper.
-- `extraObjects`: extra manifests as a list or a map, rendered with `tpl`.
-- The same extension keys on every component, the built-in datastores
-  included: `extraEnv`, `extraVolumes`, `extraVolumeMounts`,
-  `extraInitContainers`, `extraContainers`, `terminationGracePeriodSeconds`.
-- `defaults.revisionHistoryLimit`, `defaults.hostAliases`, `defaults.dnsPolicy`
-  and `defaults.dnsConfig` for every pod.
-- `autoscaling.metrics` for the API, console and realtime, replacing the CPU
-  and memory targets.
-- `ingress.pathType`, `ingress.extraTls` and `httpRoute.timeouts` (every rule
-  but realtime).
-- A memory-backed `/dev/shm` for the built-in PostgreSQL (`postgresql.shm`).
-- Redis, ClickHouse, geo and the assistant restart when the value they read
-  from the chart's Secret changes.
-- A guard against an `image.tag` of another Appwrite major version
-  (`image.allowUnsupportedVersion`), and a pattern for failing clearly on
-  renamed values.
-- The chart README groups the values table by area.
-- Ingress and Gateway API HTTPRoutes for the API, console, realtime, function
-  and site previews, and custom domains.
-- S3 storage, and Functions and Sites: builds run in the cluster as
-  Kubernetes Jobs through the open-runtimes orchestrator, in their own
-  `baseline` namespace behind a NetworkPolicy that only allows public
-  addresses (plus `deniedCIDRs`). Executions run on the open-runtimes
-  executor on Docker-in-Docker: a privileged pod you accept with
-  `compute.executor.privileged` (or Sysbox through `runtimeClassName`), in a
-  namespace of its own with its own copy of its credentials, no TCP listener
-  on the Docker daemon, and a NetworkPolicy that only lets Appwrite in and
-  the executor out to DNS, S3 and public addresses.
+- The API, console, realtime, workers (combined, separate or grouped),
+  schedulers, maintenance and interval tasks, and geo, all passing the
+  `restricted` Pod Security Standard.
+- Built-in single-replica PostgreSQL, Redis and ClickHouse, or external
+  services (PostgreSQL, MariaDB, MySQL, MongoDB; Redis; ClickHouse over HTTP
+  or TLS). Each backing service (`database`, `redis`, `clickhouse`,
+  `storage`, `smtp`, `documentsDb`, `vectorsDb`) has a `mode` switch, and
+  every credential takes the same `{value, secretName, secretKey}` shape.
+- Storage on a volume or in S3-compatible object storage.
+- Opt-in Functions and Sites in the cluster: builds run as Kubernetes Jobs
+  through the open-runtimes orchestrator, in their own `baseline` namespace;
+  executions run on the open-runtimes executor on Docker-in-Docker, a
+  privileged pod you accept with `compute.executor.privileged` (or Sysbox
+  through `runtimeClassName`), in its own namespace behind NetworkPolicies.
+- Ingress and Gateway API HTTPRoutes for the API, console, realtime,
+  function and site previews, and custom domains.
 - Optional browser, assistant, autogravity, embedding and MQTT components.
 - PodDisruptionBudgets and topology spread by default; opt-in
-  NetworkPolicies and HorizontalPodAutoscalers.
-- `appwrite.extraVolumes` and `appwrite.extraVolumeMounts` for every Appwrite
-  pod, including tasks and the migration Job, for example to mount the CA that
-  verifies the database's TLS certificate.
-- Credentials generated once, kept across upgrades and uninstalls, with guards
-  against changing the encryption key or regenerating datastore passwords.
-- Data migrations as a post-upgrade hook (retried after a failure) or a Job
-  named after the version and its spec, and a downgrade guard.
-- `values.schema.json` that also accepts a parent chart's `global` values,
-  validation of worker topologies and connection limits, `helm test` pods,
-  and documentation: getting started, architecture, executor, production,
-  networking, security, storage, external databases with provider notes,
-  integrations (SMTP, Git deployments, console sign-in, SMS, Sentry),
-  optional components, migrating from Docker, upgrades, backups, GitOps and
-  troubleshooting.
-- `examples/`: values files for a local try-out, a first install,
-  production, external services, AWS, and Functions and Sites, rendered and
-  validated in CI.
+  NetworkPolicies, HorizontalPodAutoscalers, and metrics for the built-in
+  datastores (exporters, ServiceMonitors and a PrometheusRule).
+- Credentials generated once and kept across upgrades and uninstalls, with
+  guards against changing the encryption key or regenerating datastore
+  passwords. Pods restart when a Secret value they read changes.
+- Data migrations on upgrade, a downgrade guard, and a guard against an
+  `image.tag` of another Appwrite major version.
+- The same extension keys on every component, the built-in datastores
+  included (`extraEnv`, `extraVolumes`, `extraVolumeMounts`,
+  `extraInitContainers`, `extraContainers`), pod-wide `defaults`, and
+  `extraObjects` for your own manifests.
+- `values.schema.json`, `helm test` pods, documentation from getting started
+  to backups, GitOps and troubleshooting, and example values files for local,
+  production, external services, AWS, GCP, Azure, and Functions and Sites
+  installs.

RELEASING.md

@@ -84,24 +84,19 @@ people may have pulled it already.
 
 ## Pre-releases
 
-Every 0.x version is a pre-release: the workflow marks its GitHub release as
-one (as it does for versions with a `-suffix`), and `Chart.yaml` carries
-`artifacthub.io/prerelease: "true"`. At 1.0.0, set that annotation to
-`"false"` in the same PR that bumps the version. For a later pre-release such
-as `1.1.0-rc.1`, set it back to `"true"` for that version only.
-
-## Before the first release (0.1.0)
-
-`Chart.yaml` already says `0.1.0`, so the first release only needs the
-changelog and the repository settings:
-
-- [ ] Rename `## [Unreleased]` in `CHANGELOG.md` to `## [0.1.0] - <date>`
-      (add a new empty `## [Unreleased]` above it), and run `make changes`.
-      Do this before running the workflow below: it refuses to publish a
-      version without changelog entries.
-- [ ] Make the repository public, then run the release workflow manually
-      (Actions → Release → Run workflow, on `main`); it skips itself while
-      the repository is private. Build provenance attestations on private
+The workflow marks a version with a `-suffix`, such as `1.1.0-rc.1`, as a
+pre-release on GitHub. Set `artifacthub.io/prerelease: "true"` in `Chart.yaml`
+for that version only, and back to `"false"` in the next release.
+
+## Before the first release (1.0.0)
+
+The release pull request sets `Chart.yaml` to `1.0.0` and has the changelog
+section, so the first release only needs the repository settings:
+
+- [ ] Make the repository public before merging the release pull request:
+      the release workflow skips itself while the repository is private. If
+      the pull request was merged first, run it manually (Actions → Release
+      → Run workflow, on `main`). Build provenance attestations on private
       repositories need GitHub Enterprise Cloud, and keyless signatures record
       the repository in the public Rekor transparency log anyway.
 - [ ] After the first push, make the `charts/appwrite` package public in the

charts/appwrite/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: appwrite
 description: Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse.
 type: application
-version: 0.1.0
+version: 1.0.0
 appVersion: "2.3.0"
 kubeVersion: ">=1.29.0-0"
 home: https://github.com/appwrite/helm-chart
@@ -23,7 +23,7 @@ maintainers:
     url: https://github.com/levivannoort
 annotations:
   artifacthub.io/license: BSD-3-Clause
-  artifacthub.io/prerelease: "true"
+  artifacthub.io/prerelease: "false"
   artifacthub.io/category: database
   artifacthub.io/links: |
     - name: Chart source
@@ -38,25 +38,27 @@ annotations:
       url: https://github.com/appwrite/helm-chart/issues
   artifacthub.io/changes: |
     - kind: added
-      description: Appwrite 2.3.0 with the API, console, realtime, workers and tasks, passing the restricted Pod Security Standard
+      description: The API, console, realtime, workers (combined, separate or grouped), schedulers, maintenance and interval tasks, and geo, all passing the `restricted` Pod Security Standard.
     - kind: added
-      description: Built-in PostgreSQL, Redis and ClickHouse, or external services
+      description: Built-in single-replica PostgreSQL, Redis and ClickHouse, or external services (PostgreSQL, MariaDB, MySQL, MongoDB; Redis; ClickHouse over HTTP or TLS). Each backing service (`database`, `redis`, `clickhouse`, `storage`, `smtp`, `documentsDb`, `vectorsDb`) has a `mode` switch, and every credential takes the same `{value, secretName, secretKey}` shape.
     - kind: added
-      description: Combined, separate and grouped worker topologies
+      description: Storage on a volume or in S3-compatible object storage.
     - kind: added
-      description: Ingress and Gateway API routes, including function and site previews and custom domains
+      description: 'Opt-in Functions and Sites in the cluster: builds run as Kubernetes Jobs through the open-runtimes orchestrator, in their own `baseline` namespace; executions run on the open-runtimes executor on Docker-in-Docker, a privileged pod you accept with `compute.executor.privileged` (or Sysbox through `runtimeClassName`), in its own namespace behind NetworkPolicies.'
     - kind: added
-      description: S3 storage, and Functions and Sites in the cluster, with builds as Kubernetes Jobs and the executor on Docker-in-Docker in its own namespace (opt-in privileged pod)
+      description: Ingress and Gateway API HTTPRoutes for the API, console, realtime, function and site previews, and custom domains.
     - kind: added
-      description: Optional browser, assistant, autogravity, embedding and MQTT components
+      description: Optional browser, assistant, autogravity, embedding and MQTT components.
     - kind: added
-      description: PodDisruptionBudgets and topology spread by default; NetworkPolicies and autoscaling
+      description: PodDisruptionBudgets and topology spread by default; opt-in NetworkPolicies, HorizontalPodAutoscalers, and metrics for the built-in datastores (exporters, ServiceMonitors and a PrometheusRule).
     - kind: added
-      description: Credentials generated once and kept across upgrades, with guards against losing the encryption key or datastore passwords
+      description: Credentials generated once and kept across upgrades and uninstalls, with guards against changing the encryption key or regenerating datastore passwords. Pods restart when a Secret value they read changes.
     - kind: added
-      description: Data migrations on upgrade and a downgrade guard
+      description: Data migrations on upgrade, a downgrade guard, and a guard against an `image.tag` of another Appwrite major version.
     - kind: added
-      description: Guides for external databases, S3 and integrations, and example values files for local, production, AWS and Functions and Sites installs
+      description: The same extension keys on every component, the built-in datastores included (`extraEnv`, `extraVolumes`, `extraVolumeMounts`, `extraInitContainers`, `extraContainers`), pod-wide `defaults`, and `extraObjects` for your own manifests.
+    - kind: added
+      description: '`values.schema.json`, `helm test` pods, documentation from getting started to backups, GitOps and troubleshooting, and example values files for local, production, external services, AWS, GCP, Azure, and Functions and Sites installs.'
   artifacthub.io/images: |
     - name: appwrite
       image: docker.io/appwrite/appwrite:2.3.0

charts/appwrite/README.md

@@ -1,6 +1,6 @@
 # Appwrite Helm chart
 
-![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.3.0](https://img.shields.io/badge/AppVersion-2.3.0-informational?style=flat-square)
+![Version: 1.0.0](https://img.shields.io/badge/Version-1.0.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2.3.0](https://img.shields.io/badge/AppVersion-2.3.0-informational?style=flat-square)
 
 Appwrite, the open-source backend platform, on Kubernetes. Deploys the API, console, realtime, workers and schedulers with optional built-in PostgreSQL, Redis and ClickHouse.
 

charts/appwrite/tests/scheduling_test.yaml

@@ -37,14 +37,16 @@ tests:
 
   - it: leaves chart and version labels off pod templates
     template: templates/api/deployment.yaml
+    chart:
+      version: 9.9.9
     asserts:
       - notExists:
           path: spec.template.metadata.labels["helm.sh/chart"]
       - notExists:
           path: spec.template.metadata.labels["app.kubernetes.io/version"]
       - equal:
           path: metadata.labels["helm.sh/chart"]
-          value: appwrite-0.1.0
+          value: appwrite-9.9.9
 
   - it: skips the API PodDisruptionBudget while a ReadWriteOnce volume pins it to one node
     template: templates/api/pdb.yaml

docs/gitops.md

@@ -281,7 +281,7 @@ spec:
   source:
     repoURL: ghcr.io/appwrite/charts
     chart: appwrite
-    targetRevision: 0.1.0
+    targetRevision: 1.0.0
     helm:
       valuesObject:
         appwrite:
@@ -351,7 +351,7 @@ Things that differ from the Helm CLI:
   dry run, which doesn't touch the cluster:
 
   ```console
-  helm install appwrite oci://ghcr.io/appwrite/charts/appwrite --version 0.1.0 \
+  helm install appwrite oci://ghcr.io/appwrite/charts/appwrite --version 1.0.0 \
     -n appwrite -f values.yaml --dry-run=client | sed -n '/^NOTES:/,$p'
   ```
 - **No `ignoreDifferences` needed.** With the values above, two renders are

docs/upgrading.md

@@ -8,7 +8,7 @@ the chart upgrades Appwrite. You can pin a different Appwrite version with
 
 | Chart | Appwrite |
 | --- | --- |
-| 0.1.0 | 2.3.0 |
+| 1.0.0 | 2.3.0 |
 
 The [changelog](../CHANGELOG.md) lists what changed in each chart version,
 and [version notes](#version-notes) what you have to do about it.
@@ -182,6 +182,6 @@ and after. A release without an entry needs nothing beyond `helm upgrade`.
 When you skip versions, apply the entries of every version in between,
 oldest first.
 
-### To 0.1.0
+### To 1.0.0
 
 The first release. Nothing to do.