[mannie-exe]

Summary

Chart 1.5.0 installs published cfgate 0.2.0-alpha.6 and fixes issue #85 for chart users. Synchronize all four CRDs and manager RBAC, disable Service environment injection, and expose controller limits and installation identity while preserving existing values.

The README gives a concise chart 1.4.0 → 1.5.0 / controller alpha.5 → alpha.6 upgrade checklist, including explicit image-tag overrides and externally managed CRDs/RBAC. Detailed ownership migration remains in the versioned controller guide. Release notes remain generated by git-cliff.

The default operator image is pinned to the verified multi-architecture digest in chart metadata. Explicit repository/tag overrides remain supported; optional image.digest takes precedence. The release guard checks the source and packaged default Deployment against the verified digest before publication. Pins are committed in source, not injected during release. CI asserts image selection, controller/namespace/service-account overrides, reused values, packaging, and schema rejection. The existing chart release workflow also checks immutable source, published operator/connector dependencies, and exact operator provenance before pushing and signing the chart. cfgate alpha.6 is published; its release workflow passed all 119 E2E tests, scans, provenance, and signing.

Validation

At 84a902a:

• Helm 4.3.0 lint, default/CI/reused-1.4-values/custom/external-CRD-RBAC rendering, six invalid-setting rejections, packaging, and archive inspection pass
• Four rendered CRD specs match published alpha.6 assets and source b8cb740; RBAC preserves required operations while narrowing ConfigMap access to the installation namespace
• Seventeen chart-rendering and release-guard tests plus actionlint 1.7.12 pass; new image-selection tests fail against the old chart
• Published operator index sha256:3d3eaeae0ae0a76f8b3bc5271f642cf06f42e6525c85cb16e1b778fb4d864d6a resolves and its OCI-hosted GitHub provenance verifies against the release workflow, tag, and full source SHA
• Connector v2026.9.3-h2c.1 release and image are available
• Disposable ARM64 kind / Kubernetes 1.37.0 with Gateway API 1.6.2: installed chart 1.4.0 reproduced the service-link startup failure; helm upgrade --reuse-values to 1.5.0 ran the published alpha.6 image successfully, retained ports 9090/9091, and passed rollout restart
• A second packaged-chart 1.4.0 → 1.5.0 upgrade with --reuse-values passed after digest pinning: values unchanged, custom ports preserved, pinned operator Ready
• Installed CRD versions match published schemas; Kubernetes rejects conflicting h2c/http2 settings; manager token remains mounted

The chart check created no Cloudflare resources. Its disposable cluster was deleted, the temporary Colima inotify limit restored, and all three pre-existing clusters and the original kubeconfig context preserved. This verifies the stated configuration, not a broad Kubernetes support range. The chart release tag/source check will run against the real chart tag at publication; no chart tag or publication was created during review.

Includes the versions proposed by dependency PRs #14–20; checkout v7 supersedes the v6 proposal.

Greptile scope: verified-image, CI-coverage, and ConfigMap-scope findings are addressed. ConfigMap get/create/delete now lives in a namespaced claim Role/Binding, honoring installation namespace, manager namespace, custom service accounts, and rbac.create=false. The cluster-wide ConfigMap rule is removed. On a disposable Kubernetes 1.37.0 cluster, alpha.6 became Ready with a separate claim namespace; its service account could create/read/delete claims there, but received Forbidden attempting deletion in an unrelated namespace. The unrelated object remained intact. RBAC generation and Kustomize changes are tracked in cfgate/cfgate#91; neither this chart nor that source change requires an alpha.7 release.

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates Helm chart release automation and CI/CD workflows.

The PR appears safe to merge based on the reviewed changes.

Summary

Chart 1.5.0 targets cfgate alpha.6, updates the CRDs and manager configuration, pins the default operator image, and moves claim ConfigMap permissions into a namespaced Role. The latest revision adds rendering tests and checks the source and packaged image pin before publication.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  V[Chart values] --> D[Manager Deployment]
  C[Chart digest annotation] --> D
  D --> SA[Manager ServiceAccount]
  SA --> CB[ClusterRoleBinding]
  CB --> CR[ClusterRole]
  SA --> RB[Claim RoleBinding]
  RB --> R[ConfigMap claim Role in installation namespace]

Loading

_{Reviews (2) · Last reviewed commit: "feat: scope chart claim permissions by n..."}