From 8a48d5b6e438a3e81d6ae91d3c0d46be0ae4bb90 Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Tue, 6 Oct 2026 07:05:23 +0000 Subject: [PATCH 1/5] helm: use standard Helm labels in all generated templates The generated service accounts, role bindings, and workload templates were missing standard Helm labels (helm.sh/chart, managed-by, instance, version). This caused conflicts when installing the chart into a cluster with pre-existing kustomize-managed resources. Assisted-by: AI Signed-off-by: Alice Frosi --- hack/sync-helm.sh | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/hack/sync-helm.sh b/hack/sync-helm.sh index 54f6daf..fd67a75 100755 --- a/hack/sync-helm.sh +++ b/hack/sync-helm.sh @@ -56,7 +56,8 @@ gen_workload() { .metadata.namespace = \"HELM_NAMESPACE\" | .spec.template.spec.serviceAccountName = \"HELM_FULLNAME-${name}\" | .spec.template.spec.containers[0].image = \"HELM_IMAGE\" | - del(.metadata.labels.\"app.kubernetes.io/managed-by\") | + del(.metadata.labels) | + .metadata.labels.HELM_LABELS_PLACEHOLDER = true | del(.spec.template.spec.containers[0].volumeMounts | select(length == 0)) | del(.spec.template.spec.volumes | select(length == 0)) | ... comments=\"\" @@ -64,6 +65,7 @@ gen_workload() { -e 's/HELM_FULLNAME/{{ include "bootc-operator.fullname" . }}/g' \ -e 's/HELM_NAMESPACE/{{ .Release.Namespace }}/g' \ -e 's/HELM_IMAGE/{{ include "bootc-operator.image" . }}/g' \ + -e '/HELM_LABELS_PLACEHOLDER/c\ {{- include "bootc-operator.labels" . | nindent 4 }}' \ > "$output" sed -i '/image: {{ include "bootc-operator\.image" \. }}/a\ @@ -105,11 +107,14 @@ gen_binding() { "$YQ" -I2 " .metadata.name = \"HELM_FULLNAME-${name}\" | - del(.metadata.labels.\"app.kubernetes.io/managed-by\") | + del(.metadata.labels) | + .metadata.labels.HELM_LABELS_PLACEHOLDER = true | .roleRef.name = \"HELM_FULLNAME-${role_suffix}\" | .subjects[0].name = \"HELM_FULLNAME-${sa_suffix}\" | .subjects[0].namespace = \"HELM_NAMESPACE\" - " "$source" | helm_sed > "$output" + " "$source" | helm_sed | sed \ + -e '/HELM_LABELS_PLACEHOLDER/c\ {{- include "bootc-operator.labels" . | nindent 4 }}' \ + > "$output" } gen_binding "$CONFIG_DIR/rbac/role_binding.yaml" \ @@ -129,8 +134,11 @@ gen_sa() { "$YQ" -I2 " .metadata.name = \"HELM_FULLNAME-${name}\" | .metadata.namespace = \"HELM_NAMESPACE\" | - del(.metadata.labels.\"app.kubernetes.io/managed-by\") - " "$source" | helm_sed > "$output" + del(.metadata.labels) | + .metadata.labels.HELM_LABELS_PLACEHOLDER = true + " "$source" | helm_sed | sed \ + -e '/HELM_LABELS_PLACEHOLDER/c\ {{- include "bootc-operator.labels" . | nindent 4 }}' \ + > "$output" } gen_sa "$CONFIG_DIR/rbac/controller_service_account.yaml" \ From 3625328238db3eb41f15466b8771c58a4decfce1 Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Tue, 6 Oct 2026 06:04:31 +0000 Subject: [PATCH 2/5] ci: publish Helm chart as OCI artifact on release Run make helm to generate the helm chart, replace the version and tag from the release and push the charts as oci artifact. Assisted-by: AI Signed-off-by: Alice Frosi --- .github/workflows/release.yaml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index db3b2ef..72367f3 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -113,6 +113,20 @@ jobs: TAG: ${{ steps.version.outputs.tag }} run: make release-manifest IMG="${IMAGE}:${TAG}" + - name: Package and push Helm chart + env: + VERSION: ${{ steps.version.outputs.version }} + TAG: ${{ steps.version.outputs.tag }} + ACTOR: ${{ github.actor }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + make helm + ./bin/yq -i ".version = \"${VERSION}\"" chart/bootc-operator/Chart.yaml + ./bin/yq -i ".appVersion = \"${TAG}\"" chart/bootc-operator/Chart.yaml + helm package chart/bootc-operator + helm registry login -u "${ACTOR}" -p "${GH_TOKEN}" ghcr.io + helm push "bootc-operator-${VERSION}.tgz" oci://ghcr.io/${{ github.repository }}/charts + - name: Create release env: GH_TOKEN: ${{ steps.app-token.outputs.token }} @@ -120,9 +134,16 @@ jobs: run: | { printf '## Installation\n\n' + printf '### kubectl\n\n' printf '```bash\n' printf 'kubectl apply -f https://github.com/%s/releases/download/%s/install.yaml\n' \ "${GITHUB_REPOSITORY}" "${TAG}" + printf '```\n\n' + printf '### Helm\n\n' + printf '```bash\n' + printf 'helm install bootc-operator oci://ghcr.io/%s/charts/bootc-operator --version %s \\\n' \ + "${GITHUB_REPOSITORY}" "${TAG#v}" + printf ' --create-namespace --namespace bootc-operator\n' printf '```\n' } > notes.md gh release create "${TAG}" \ From db355844a6671edeee141a80506dda860663146e Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Tue, 6 Oct 2026 06:04:34 +0000 Subject: [PATCH 3/5] docs: add OCI registry install instructions for Helm chart Assisted-by: AI Signed-off-by: Alice Frosi --- docs/src/helm.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/src/helm.md b/docs/src/helm.md index 22ed264..ebb67c0 100644 --- a/docs/src/helm.md +++ b/docs/src/helm.md @@ -7,6 +7,23 @@ ## Install +Install from the OCI registry: + +```bash +helm install bootc-operator oci://ghcr.io/bootc-dev/bootc-operator/charts/bootc-operator \ + --create-namespace --namespace bootc-operator +``` + +To install a specific version: + +```bash +helm install bootc-operator oci://ghcr.io/bootc-dev/bootc-operator/charts/bootc-operator \ + --version 0.1.0 \ + --create-namespace --namespace bootc-operator +``` + +Alternatively, install from a local checkout: + ```bash helm install bootc-operator ./chart/bootc-operator \ --create-namespace --namespace bootc-operator From 74831d24f7ad39fa401364f00b7f76bcc92d62be Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Tue, 6 Oct 2026 08:50:54 +0200 Subject: [PATCH 4/5] Bump version from 0.1.0 to 0.2.0 Signed-off-by: Alice Frosi --- VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION b/VERSION index 6e8bf73..0ea3a94 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.0 +0.2.0 From 9c67bce71f800c69043ed10e2c69b481b8f27e17 Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Tue, 6 Oct 2026 07:55:52 +0000 Subject: [PATCH 5/5] ci: create release branch on first minor release Assisted-by: AI Signed-off-by: Alice Frosi --- .github/workflows/release.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 72367f3..502aa26 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -92,6 +92,21 @@ jobs: git tag -s -m "Release ${TAG}" "${TAG}" git push origin "${TAG}" + - name: Create release branch + env: + VERSION: ${{ steps.version.outputs.version }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} + run: | + BRANCH="release-${VERSION%.*}" + if gh api "repos/${GITHUB_REPOSITORY}/branches/${BRANCH}" >/dev/null 2>&1; then + echo "Branch ${BRANCH} already exists, skipping" + else + SHA=$(git rev-parse HEAD) + gh api "repos/${GITHUB_REPOSITORY}/git/refs" \ + -f "ref=refs/heads/${BRANCH}" \ + -f "sha=${SHA}" + fi + - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: