Skip to content

Commit ae7949e

Browse files
Martin Jacksoncursoragent
Martin Jackson
and
cursoragent
committed
Add Stakater Reloader wrapper for OpenShift and CSI.
Ship stakater/reloader 2.2.11 as a vendored dependency with defaults for cluster-wide watch, OpenShift, HA, and Secrets Store CSI integration so CI can lint without pulling charts at runtime. Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent bd9b8a6 commit ae7949e

8 files changed

Lines changed: 200 additions & 14 deletions

File tree

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,9 @@
22
# Edit at https://www.toptal.com/developers/gitignore?templates=helm,vim,linux
33

44
### Helm ###
5-
# Chart dependencies
5+
# Chart dependencies (vendored subcharts are tracked for CI without registry pulls)
66
**/charts/*.tgz
7+
!charts/reloader-*.tgz
78

89
### Linux ###
910
*~

‎Chart.lock‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dependencies:
2+
- name: reloader
3+
repository: https://stakater.github.io/stakater-charts
4+
version: 2.2.11
5+
digest: sha256:09bd15e46f5b5c09da317bda9dfe5dd4b74e5e2aecd8271e8e66eaabfd0df521
6+
generated: "2026-05-15T14:05:20.156502347-05:00"

‎Chart.yaml‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,23 @@
11
apiVersion: v2
2-
description: A Helm chart to serve as the Validated Patterns Template
2+
name: vp-stakater-reloader
3+
description: >-
4+
Wrapper Helm chart for Stakater Reloader with defaults for cluster-wide
5+
OpenShift, ConfigMap/Secret watching, and Secrets Store CSI integration.
6+
type: application
7+
version: 0.1.0
38
keywords:
4-
- pattern
5-
name: vp-template
6-
version: 0.0.1
9+
- reloader
10+
- openshift
11+
- validated-patterns
12+
- secrets-store-csi
13+
home: https://github.com/stakater/Reloader
14+
sources:
15+
- https://github.com/stakater/Reloader
16+
icon: https://raw.githubusercontent.com/stakater/Reloader/master/assets/web/reloader-round-100px.png
17+
maintainers:
18+
- name: Validated Patterns
19+
# Bump the dependency version below to pick up new stakater/reloader chart releases.
20+
dependencies:
21+
- name: reloader
22+
version: 2.2.11
23+
repository: https://stakater.github.io/stakater-charts

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ help: ## This help message
1414
@echo "Pattern: $(NAME)"
1515
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^(\s|[a-zA-Z_0-9-])+:.*?##/ { printf " \033[36m%-35s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
1616

17+
.PHONY: helm-deps
18+
helm-deps: ## Downloads subchart dependencies (updates Chart.lock and charts/*.tgz)
19+
helm dependency update
20+
1721
.PHONY: helm-lint
1822
helm-lint: ## Runs helm lint against the chart
1923
helm lint .

‎README.md‎

Lines changed: 86 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,93 @@
1-
# vp-template
1+
# vp-stakater-reloader
22

3-
![Version: 0.0.1](https://img.shields.io/badge/Version-0.0.1-informational?style=flat-square)
3+
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
44

5-
A Helm chart to serve as the Validated Patterns Template
5+
Wrapper Helm chart for Stakater Reloader with defaults for cluster-wide OpenShift, ConfigMap/Secret watching, and Secrets Store CSI integration.
66

7-
This chart is used to serve as the template for Validated Patterns Charts
7+
## Prerequisites
88

9-
## Notable changes
9+
- Helm 3 or later
10+
- OpenShift (or Kubernetes) cluster
11+
- Optional: [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/) and its CRDs if you rely on CSI-backed secret rotation (Reloader watches those APIs when `reloader.reloader.enableCSIIntegration` is true)
1012

11-
---
13+
## Install
1214

15+
Add this chart (or your chart repo) and install into a dedicated namespace, for example `reloader`:
16+
17+
```bash
18+
helm install reloader /path/to/vp-stakater-reloader-chart \
19+
--namespace reloader \
20+
--create-namespace
21+
```
22+
23+
### OpenShift UID / SCC (recommended)
24+
25+
Upstream Reloader defaults `runAsUser: 65534`. On OpenShift 4.13+, Stakater recommends letting the namespace SCC assign the UID. Helm value merging keeps that default unless you clear the key explicitly:
26+
27+
```bash
28+
helm install reloader /path/to/vp-stakater-reloader-chart \
29+
--namespace reloader \
30+
--create-namespace \
31+
--set reloader.reloader.deployment.securityContext.runAsUser=null
32+
```
33+
34+
### Maximum automation (`autoReloadAll`)
35+
36+
This chart sets `reloader.reloader.autoReloadAll` to `false` so workloads opt in via Reloader annotations. To reload on ConfigMap/Secret changes by default (opt out with `reloader.stakater.com/auto: "false"` on a workload), set:
37+
38+
```bash
39+
--set reloader.reloader.autoReloadAll=true
40+
```
41+
42+
## Upstream documentation
43+
44+
- [Reloader OSS documentation](https://docs.stakater.com/reloader/)
45+
- [Annotations reference](https://docs.stakater.com/reloader/1.4/reference/annotations.html)
46+
47+
## Maintainer tasks
48+
49+
Refresh the vendored subchart after editing `Chart.yaml` dependencies:
50+
51+
```bash
52+
make helm-deps
53+
```
54+
55+
**Homepage:** <https://github.com/stakater/Reloader>
56+
57+
## Maintainers
58+
59+
| Name | Email | Url |
60+
| ---- | ------ | --- |
61+
| Validated Patterns | | |
62+
63+
## Source Code
64+
65+
* <https://github.com/stakater/Reloader>
66+
67+
## Requirements
68+
69+
| Repository | Name | Version |
70+
|------------|------|---------|
71+
| https://stakater.github.io/stakater-charts | reloader | 2.2.11 |
72+
73+
## Values
74+
75+
| Key | Type | Default | Description |
76+
|-----|------|---------|-------------|
77+
| reloader.reloader.autoReloadAll | bool | `false` | Reload on ConfigMap or Secret changes by default; opt out per workload via Reloader annotations |
78+
| reloader.reloader.deployment.replicas | int | `2` | Number of controller replicas (requires enableHA when greater than 1) |
79+
| reloader.reloader.deployment.securityContext.runAsNonRoot | bool | `true` | Run as non-root |
80+
| reloader.reloader.deployment.securityContext.seccompProfile.type | string | `"RuntimeDefault"` | Seccomp profile for the pod |
81+
| reloader.reloader.enableCSIIntegration | bool | `true` | Watch Secrets Store CSI SecretProviderClass and SecretProviderClassPodStatus resources |
82+
| reloader.reloader.enableHA | bool | `true` | Enable leader election for multiple replicas |
83+
| reloader.reloader.ignoreConfigMaps | bool | `false` | Ignore ConfigMaps when true (cannot be true together with ignoreSecrets) |
84+
| reloader.reloader.ignoreCronJobs | bool | `false` | Exclude CronJobs from reload monitoring |
85+
| reloader.reloader.ignoreJobs | bool | `false` | Exclude Jobs from reload monitoring |
86+
| reloader.reloader.ignoreSecrets | bool | `false` | Ignore Secrets when true (cannot be true together with ignoreConfigMaps) |
87+
| reloader.reloader.isOpenshift | bool | `true` | Enable OpenShift DeploymentConfig RBAC when the API exists |
88+
| reloader.reloader.reloadOnCreate | bool | `true` | Trigger rollouts when new ConfigMaps or Secrets appear |
89+
| reloader.reloader.syncAfterRestart | bool | `true` | With HA, reconcile after leader restart (pairs with reloadOnCreate) |
90+
| reloader.reloader.watchGlobally | bool | `true` | Cluster-wide watch of all namespaces |
91+
92+
----------------------------------------------
1393
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎README.md.gotmpl‎

Lines changed: 46 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,53 @@
55

66
{{ template "chart.description" . }}
77

8-
This chart is used to serve as the template for Validated Patterns Charts
8+
## Prerequisites
99

10-
## Notable changes
10+
- Helm 3 or later
11+
- OpenShift (or Kubernetes) cluster
12+
- Optional: [Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/) and its CRDs if you rely on CSI-backed secret rotation (Reloader watches those APIs when `reloader.reloader.enableCSIIntegration` is true)
13+
14+
## Install
15+
16+
Add this chart (or your chart repo) and install into a dedicated namespace, for example `reloader`:
17+
18+
```bash
19+
helm install reloader /path/to/vp-stakater-reloader-chart \
20+
--namespace reloader \
21+
--create-namespace
22+
```
23+
24+
### OpenShift UID / SCC (recommended)
25+
26+
Upstream Reloader defaults `runAsUser: 65534`. On OpenShift 4.13+, Stakater recommends letting the namespace SCC assign the UID. Helm value merging keeps that default unless you clear the key explicitly:
27+
28+
```bash
29+
helm install reloader /path/to/vp-stakater-reloader-chart \
30+
--namespace reloader \
31+
--create-namespace \
32+
--set reloader.reloader.deployment.securityContext.runAsUser=null
33+
```
34+
35+
### Maximum automation (`autoReloadAll`)
36+
37+
This chart sets `reloader.reloader.autoReloadAll` to `false` so workloads opt in via Reloader annotations. To reload on ConfigMap/Secret changes by default (opt out with `reloader.stakater.com/auto: "false"` on a workload), set:
38+
39+
```bash
40+
--set reloader.reloader.autoReloadAll=true
41+
```
42+
43+
## Upstream documentation
44+
45+
- [Reloader OSS documentation](https://docs.stakater.com/reloader/)
46+
- [Annotations reference](https://docs.stakater.com/reloader/1.4/reference/annotations.html)
47+
48+
## Maintainer tasks
49+
50+
Refresh the vendored subchart after editing `Chart.yaml` dependencies:
51+
52+
```bash
53+
make helm-deps
54+
```
1155

1256
{{ template "chart.homepageLine" . }}
1357

‎charts/reloader-2.2.11.tgz‎

13.7 KB
Binary file not shown.

‎values.yaml‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,35 @@
1-
---
1+
# All keys under reloader are passed to the stakater reloader subchart dependency.
2+
reloader:
3+
reloader:
4+
# -- Cluster-wide watch of all namespaces
5+
watchGlobally: true
6+
# -- Enable OpenShift DeploymentConfig RBAC when the API exists
7+
isOpenshift: true
8+
# -- Watch Secrets Store CSI SecretProviderClass and SecretProviderClassPodStatus resources
9+
enableCSIIntegration: true
10+
# -- Ignore ConfigMaps when true (cannot be true together with ignoreSecrets)
11+
ignoreConfigMaps: false
12+
# -- Ignore Secrets when true (cannot be true together with ignoreConfigMaps)
13+
ignoreSecrets: false
14+
# -- Exclude Jobs from reload monitoring
15+
ignoreJobs: false
16+
# -- Exclude CronJobs from reload monitoring
17+
ignoreCronJobs: false
18+
# -- Reload on ConfigMap or Secret changes by default; opt out per workload via Reloader annotations
19+
autoReloadAll: false
20+
# -- Enable leader election for multiple replicas
21+
enableHA: true
22+
# -- Trigger rollouts when new ConfigMaps or Secrets appear
23+
reloadOnCreate: true
24+
# -- With HA, reconcile after leader restart (pairs with reloadOnCreate)
25+
syncAfterRestart: true
26+
deployment:
27+
# -- Number of controller replicas (requires enableHA when greater than 1)
28+
replicas: 2
29+
# -- Pod securityContext; on OpenShift 4.13+ also pass --set reloader.reloader.deployment.securityContext.runAsUser=null
30+
securityContext:
31+
# -- Run as non-root
32+
runAsNonRoot: true
33+
seccompProfile:
34+
# -- Seccomp profile for the pod
35+
type: RuntimeDefault

0 commit comments

Comments
 (0)