ChartMuseum Resource for Concourse CI

Fetches, verifies and publishes Helm Charts from a running ChartMuseum instance. Harbor works as well, since it uses ChartMuseum under the hood.

This resource works probably best in conjunction with the Helm resource which can be used to perform Helm deployments into Kubernetes clusters.

Requirements

• A running ChartMuseum instance (this resource has been tested with v0.9.0)

Installation

Add a new resource type to your Concourse CI pipeline:

resource_types:
name: chartmuseum
  type: docker-image
  source:
    repository: cathive/concourse-chartmuseum-resource
    tag: latest # For reproducible builds use a specific tag and don't rely on "latest".

Source Configuration

server_url: Required. The address of the Chartmuseum/Harbor API. For chartmuseum, this'll be something like https://chartmuseum.yourdomain.com/api/charts. For harbor (which uses chartmuseum but changes the API and path), this'll be something like https://harbor.yourdomain.com/api/chartrepo/charts (for the default "library" project*) or https://harbor.yourdomain.com/api/chartrepo/<project name>/charts for other projects.

chart_name: Required* The name of the chart to operate upon.

• version_range: Optional parameter that can be used to specify a (SemVer) version range

that must match when checking for new charts, e.g. =1.2.0, ^2.0.0, ~0.2.3 or *.

• basicauthusername: Optional username to be used if your ChartMuseum is username/password protected.

If provided, the paramter basicauthpassword must also be specified.

• basicauthpassword: Optional password to be used if your ChartMuseum is username/password protected.

If provided, the paramter basicauthusername must also be specified.

harbor_api: Optional, set to true use the Harbor API (which is different enough to the standard ChartMuseum API not to work*)

Behavior

The resource implements all three actions (check, in and out).

check: Check for new versions of the Helm chart

Checks for new versions of the specified Helm chart. If a semver version range has been specified in the sourceconfiguration it will be honored when checking new versions.

in: Fetches the chart and (optionally) verifies it's provenance

Places the JSON object that describes the Helm chart into the destination directory along with the package and it's provenance file.

The basename of these three files will be in the format ${chartname}-${chartversion} unless overwritten by the parameter target_basename.

"in" Parameters

• target_basename: Optional parameter that can be used to change the name of the

input files that will be written.

out: Push an updated version of the Helm chart

"out" Parameters

chart: Required* Path to the tgz-archive or a folder that contains the chart to be uploaded. If a folder has been specified instead of a ".tgz" file, this folder will be packaged up prior to uploading it's contents to the ChartMuseum instance.

• force: Optional parameter that can be used to force the upload of the chart,

even if the version to be uploaded does already exist on the server. Enforcement only works, if the ChartMuseum server has not been started with the --disable-force-overwrite flag, though.

• version: Optional parameter that can be used to override the "version" field in the

chart's Chart.yaml file. If the override version is stored in a file, you can use the parameter version_file instead.

• version_file: Optional parameter that points to a file that contains a version string

that should be used to override the version specified in the chart's Chart.yaml file.

• sign: Optional parameter that indicates if the chart package should be signed using a

GPG key. If set to true either keydata or keyfile must be specified as well.

• key_data: If sign has been set to true, this parameter can be used to pass the

key to be used to sign the chart package.

• key_file: If sign has been set to true, this parameter can be used to pass the

location of a file that contains the GPG key that shall be used to sign the chart package.

• key_passphrase: If sign has been set to true this parameter can be used to

specifcy the passphrase that protects the GPG signing key to be used to sign the chart package.

• dependency_update: must be set to true if there are any dependencies in the

helm chart to be uploaded. This will cause the dependencies to be fetched before the chart is packaged.