[maestrod] initial chart

Author: lazyoldbear

.github/workflows/helm-docs.yaml

@@ -27,3 +27,10 @@ jobs:
           chart-search-root: charts/ai-assistant
           # git-push: true
           fail-on-diff: true
+
+      - name: Run helm-docs for Maestrod
+        uses: losisin/helm-docs-github-action@v1
+        with:
+          chart-search-root: charts/maestrod
+          # git-push: true
+          fail-on-diff: true

CLAUDE.md

@@ -15,14 +15,15 @@ Nutrient Helm Charts repository. Contains Kubernetes Helm charts for Nutrient pr
 |-------|-------------|
 | `document-engine` | Backend for document processing and automation workflows. Most complex chart. |
 | `ai-assistant` | AI Assistant application. Depends on `document-engine` chart. |
+| `maestrod` | Orchestration backend for Nutrient managed cloud workloads. Single stateless Deployment. |
 | `signing-service-example` | Example chart for demonstration. Excluded from CI. |
 | `simple-resource-wrapper` | Generic Kubernetes resource wrapper (Terraform workaround). |
 
 ## Code Generation — Do Not Edit Generated Files Directly
 
 ### README.md (helm-docs)
 
-README.md files for `document-engine` and `ai-assistant` are **auto-generated** by
+README.md files for `document-engine`, `ai-assistant`, and `maestrod` are **auto-generated** by
 [helm-docs](https://github.com/norwoodj/helm-docs). CI fails if they are out of sync.
 
 - **Template**: `charts/<chart>/README.md.gotmpl`
@@ -34,6 +35,7 @@ To regenerate locally:
 ```bash
 helm-docs --chart-search-root charts/document-engine
 helm-docs --chart-search-root charts/ai-assistant
+helm-docs --chart-search-root charts/maestrod
 ```
 
 ### values.schema.json (helm-values-schema-json)
@@ -49,6 +51,7 @@ To regenerate locally:
 ```bash
 cd charts/document-engine && helm schema -input values.yaml -draft 2020 -indent 2 -output values.schema.json
 cd charts/ai-assistant && helm schema -input values.yaml -draft 2020 -indent 2 -output values.schema.json
+cd charts/maestrod && helm schema
 ```
 
 ## values.yaml Comment Conventions
@@ -135,6 +138,7 @@ After modifying any chart, regenerate derived files before committing:
    ```bash
    helm-docs --chart-search-root charts/document-engine
    helm-docs --chart-search-root charts/ai-assistant
+   helm-docs --chart-search-root charts/maestrod
    ```
 2. **values.schema.json** — run `helm schema` whenever `values.yaml` schema annotations change:
    ```bash

README.md

@@ -21,6 +21,14 @@ helm upgrade --install -n document-engine \
      -f ./document-engine-values.yaml
 ```
 
+### Maestrod
+
+```
+helm upgrade --install -n maestrod \
+     maestrod nutrient/maestrod \
+     -f ./maestrod-values.yaml
+```
+
 ## Support, Issues and License Questions
 
 Nutrient offers support via https://support.nutrient.io/hc/en-us/requests/new

charts/maestrod/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/maestrod/.schema.yaml

@@ -0,0 +1,6 @@
+input:
+  - values.yaml
+
+draft: 2020
+indent: 2
+output: values.schema.json

charts/maestrod/CHANGELOG.md

@@ -0,0 +1,89 @@
+# Changelog
+
+- [Changelog](#changelog)
+  - [0.4.0 (2026-05-26)](#040-2026-05-26)
+    - [Added](#added)
+    - [Changed](#changed)
+
+## 0.4.0 (2026-05-26)
+
+First public release of the Maestrod Helm chart on
+[`https://pspdfkit.github.io/helm-charts`](https://pspdfkit.github.io/helm-charts).
+Continues the version line from the internal `0.3.4` chart with full
+backwards-compatibility for existing value paths.
+
+### Added
+
+* `licenseSecret.name: ""` now skips wiring the `NUTRIENT_LICENSE_KEY` env var
+  entirely (vs. the internal `0.3.4` chart which always rendered the
+  `secretKeyRef`, leaving pods in `CreateContainerConfigError` whenever the
+  Secret was missing). The default `licenseSecret.name: maestrod-secret`
+  preserves the previous behaviour for existing consumers.
+* `podDisruptionBudget.{minAvailable,maxUnavailable}` accept integer or
+  percentage string (e.g. `"50%"`); the schema reflects that.
+* Sectioned `values.yaml` with `# @section`, `# --`, `# @schema`, and `# @notationType`
+  annotations for [helm-docs](https://github.com/norwoodj/helm-docs) and
+  [helm-values-schema-json](https://github.com/losisin/helm-values-schema-json).
+* Generated `README.md` (helm-docs) and `values.schema.json`
+  (helm-values-schema-json).
+* Optional `ServiceAccount` via `serviceAccount.{create,name,annotations,automount}`
+  (defaults to `create: false` so existing pod specs are unchanged).
+* Optional [HorizontalPodAutoscaler](https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/)
+  via `autoscaling.*` (defaults to disabled).
+* Optional [PodDisruptionBudget](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)
+  via `podDisruptionBudget.*` (defaults to disabled).
+* Optional `startupProbe`, `livenessProbe`, and `lifecycle` hooks alongside the
+  existing `readinessProbe`.
+* `extraEnvs`, `extraEnvFrom`, `extraEnvFromSecrets`, `extraVolumes`,
+  `extraVolumeMounts`, `sidecars`, `initContainers` for extending the
+  pod spec without modifying templates.
+* `deploymentAnnotations`, `topologySpreadConstraints`, `schedulerName` knobs.
+* `helm test` connection probe under `templates/tests/test-connection.yaml`.
+* `ci/` test value files for `helm-chart-testing`.
+
+### Changed
+
+* **Migration from internal `0.3.4`:** the following defaults changed; users who
+  previously relied on them must set them explicitly in their values file:
+
+  ```yaml
+  image:
+    repository: 111300957880.dkr.ecr.eu-west-1.amazonaws.com/maestrod  # was the default
+    tag: stable                                                          # was the default
+    pullPolicy: Always                                                   # was the default
+
+  imagePullSecrets:
+    - name: image-registry-mcleod-ecr  # was the default
+
+  podLabels:
+    component_name: maestrod           # was the default
+    otel/logging-enabled: "true"       # was the default
+
+  # only if restartJob.enabled: true
+  restartJob:
+    registryAuthSecretName: image-registry-mcleod-ecr  # was the default
+  ```
+
+  All other values keys (`licenseSecret`, `maestro.*`, `service`, `ingress`,
+  `subdomainHostName`, `subdomainRootName`, `environmentShortName`, scheduling,
+  resources, `updateStrategy`, `restartJob.*`) keep identical defaults and
+  semantics.
+
+* `image.repository` no longer has a default; the JSON schema rejects an empty
+  string at install time. Set it to the registry/repository hosting your
+  Maestrod image.
+* `image.tag` defaults to the chart's `appVersion` when unset (matches the
+  convention used by the other charts in this repo).
+* `image.pullPolicy` defaults to `IfNotPresent` (consistent with a pinned tag).
+* `imagePullSecrets` defaults to `[]`.
+* `podLabels` defaults to `{}`.
+* Restart Job templates moved to `templates/restart-job/`. The CronJob remains
+  opt-in (`restartJob.enabled: false` by default) and now requires
+  `restartJob.registryAuthSecretName` to be set explicitly when enabled.
+
+### Fixed
+
+* `PodDisruptionBudget` template no longer renders both `minAvailable` and
+  `maxUnavailable` simultaneously (which Kubernetes rejects). When
+  `maxUnavailable` is non-empty it takes precedence; otherwise `minAvailable`
+  is rendered.

charts/maestrod/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: maestrod
+type: application
+description: Maestrod, the orchestration backend for Nutrient managed cloud workloads.
+home: https://www.nutrient.io
+icon: https://cdn.prod.website-files.com/65fdb7696055f07a05048833/66e58e33c3880ff24aa34027_nutrient-logo.png
+version: 0.4.0
+appVersion: "1.0.0"
+
+keywords:
+  - nutrient
+  - maestrod
+
+maintainers:
+  - name: Nutrient
+    email: support@nutrient.io
+    url: https://www.nutrient.io

charts/maestrod/LICENSE

@@ -0,0 +1,42 @@
+The Nutrient Sample applications are licensed with a modified BSD
+license. In plain language: you're allowed to do whatever you wish
+with the code, modify, redistribute, embed in your products (free or
+commercial), but you must include copyright, terms of usage and
+disclaimer as stated in the license.
+
+You will require a commercial Nutrient License to run these examples
+in non-demo mode. Please refer to sales@nutrient.io for details.
+
+Copyright © 2018-present PSPDFKit GmbH.
+All rights reserved.
+
+Redistribution and use in source or binary forms,
+with or without modification, are permitted provided
+that the following conditions are met:
+
+- Redistributions of source code must retain the above copyright
+  notice, this list of conditions and the following disclaimer.
+
+- Redistributions in binary form must reproduce the above copyright
+  notice, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the
+  distribution.
+
+- Redistributions of Nutrient Samples must include attribution to
+  Nutrient, either in documentation or other appropriate media.
+
+- Neither the name of the Nutrient, PSPDFKit GmbH, nor its developers
+  may be used to endorse or promote products derived from
+  this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.