feat(Chart)!: 📦 add separated chart for CRDs

.github/workflows/changelog.json

@@ -0,0 +1,53 @@
+{
+  "template": "## [#{{TO_TAG}}](#{{RELEASE_DIFF}}) (${DATE})\n#{{CHANGELOG}}",
+  "categories": [
+    {
+      "title": "## :boom: BREAKING CHANGES",
+      "rules": [
+        {
+          "pattern": ".*\\((${REGEXP}).*\\)!:.*",
+          "on_property": "title",
+          "flags": "gu"
+        }
+      ]
+    },
+    {
+      "title": "## :rocket: Features",
+      "rules": [
+        {
+          "pattern": "feat\\((${REGEXP}).*\\):.*",
+          "on_property": "title",
+          "flags": "gu"
+        }
+      ]
+    },
+    {
+      "title": "## :bug: Bug fixes",
+      "rules": [
+        {
+          "pattern": "fix\\((${REGEXP}).*\\):.*",
+          "on_property": "title",
+          "flags": "gu"
+        }
+      ]
+    },
+    {
+      "title": "## :package: Others",
+      "rules": [
+        {
+          "pattern": "(chore|release)\\((${REGEXP}).*\\):.*",
+          "on_property": "title",
+          "flags": "gu"
+        }
+      ]
+    }
+  ],
+  "pr_template": "- ${{TITLE}} ##{{NUMBER}} by @#{{AUTHOR}}",
+  "empty_template": "- no changes",
+  "transformers": [
+    {
+      "pattern": "[\\-\\*] (\\[(...|TEST|CI|SKIP)\\])( )?(.+?)\n(.+?[\\-\\*] )(.+)",
+      "target": "- $4\n  - $6"
+    }
+  ]
+}

.github/workflows/release.yml

@@ -7,11 +7,13 @@ on:
 
 env:
   tag_prefix: v
+  crds_tag_prefix: crds_v
 
 jobs:
   test:
     uses: "traefik/traefik-helm-chart/.github/workflows/test.yml@master"
-  release:
+
+  traefik:
     needs: test
     runs-on: ubuntu-latest
     steps:
@@ -27,31 +29,38 @@ jobs:
           git config user.email "[email protected]"
           git config --global --add safe.directory /charts
 
-      - name: Copy LICENSE and README.md for packaging
+      - name: Copy LICENSE, EXAMPLES.md and README.md for packaging
         run: |
           cp ./README.md ./traefik/README.md
           cp ./EXAMPLES.md ./traefik/EXAMPLES.md
           cp ./LICENSE ./traefik/LICENSE
 
       - name: Generate default static install
         run: |
-          kustomize build traefik/crds > traefik.yaml
+          kustomize build traefik-crds > traefik.yaml
           helm template traefik ./traefik -n traefik >> traefik.yaml
 
-      - name: Get chart verison
+      - name: Get chart version
         id: chart_version
         run: |
-          echo "CHART_VERSION=$(cat traefik/Chart.yaml | awk -F"[ ',]+" '/version:/{print $2}')" >> $GITHUB_OUTPUT
+          echo "CHART_VERSION=$(cat traefik/Chart.yaml | awk -F"[ ',]+" '/version:/{print $2}' | head -n 1)" >> $GITHUB_OUTPUT
 
       - name: Check if tag exists
         id: tag_exists
         run: |
-          TAG_EXISTS=true
-          if ! [ $(git tag -l "${{ env.tag_prefix }}${{ steps.chart_version.outputs.CHART_VERSION }}") ]; then
-              TAG_EXISTS=false
+          TAG_EXISTS=false
+          if git tag -l | grep "${{ env.tag_prefix }}${{ steps.chart_version.outputs.CHART_VERSION }}" > /dev/null ; then
+              TAG_EXISTS=true
           fi
           echo TAG_EXISTS=$TAG_EXISTS >> $GITHUB_OUTPUT
 
+      - name: Get Previous tag
+        id: previous_tag
+        uses: "WyriHaximus/github-action-get-previous-tag@v1"
+        with:
+          prefix: v
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
       - name: Tag release
         id: tag_version
         uses: mathieudutour/[email protected]
@@ -61,16 +70,40 @@ jobs:
           tag_prefix: ${{ env.tag_prefix }}
         if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
 
+      - name: Render changelog configuration
+        env:
+          REGEXP: "?!crds"
+        run: |
+          export DATE=$(date +%F); cat .github/workflows/changelog.json | envsubst > /tmp/changelog.json; cat /tmp/changelog.json
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
+      - name: Build Changelog
+        id: changelog
+        uses: mikepenz/release-changelog-builder-action@v5
+        with:
+          fromTag: ${{ steps.previous_tag.outputs.tag }}
+          toTag: ${{ steps.tag_version.outputs.new_tag }}
+          configuration: "/tmp/changelog.json"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
       - name: Create release
         uses: ncipollo/release-action@v1
         with:
           tag: ${{ steps.tag_version.outputs.new_tag }}
           name: ${{ steps.tag_version.outputs.new_tag }}
-          body: ${{ steps.tag_version.outputs.changelog }}
+          body: ${{ steps.changelog.outputs.changelog }}
           prerelease: ${{ contains(steps.chart_version.outputs.CHART_VERSION, '-') }}
           artifacts: "traefik.yaml"
         if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
 
+      # avoid to push both charts
+      - name: Delete traefik-crds chart
+        run: |
+          rm -rf traefik-crds
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
       - name: Publish Helm chart
         uses: stefanprodan/helm-gh-pages@master
         with:
@@ -97,3 +130,113 @@ jobs:
           registry_username: traefiker
           registry_password: ${{ secrets.GHCR_TOKEN }}
         if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
+  traefik-crds:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "[email protected]"
+          git config --global --add safe.directory /charts
+
+      - name: Copy LICENSE for packaging
+        run: |
+          cp ./LICENSE ./traefik/LICENSE
+
+      - name: Get chart version
+        id: chart_version
+        run: |
+          echo "CHART_VERSION=$(cat traefik-crds/Chart.yaml | awk -F"[ ',]+" '/version:/{print $2}' | head -n 1)" >> $GITHUB_OUTPUT
+
+      - name: Check if tag exists
+        id: tag_exists
+        run: |
+          TAG_EXISTS=false
+          if git tag -l | grep "${{ env.crds_tag_prefix }}${{ steps.chart_version.outputs.CHART_VERSION }}" > /dev/null ; then
+              TAG_EXISTS=true
+          fi
+          echo TAG_EXISTS=$TAG_EXISTS >> $GITHUB_OUTPUT
+
+      - name: Get Previous tag
+        id: previous_tag
+        uses: "WyriHaximus/github-action-get-previous-tag@v1"
+        with:
+          prefix: crds_v
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
+      - name: Tag release
+        id: tag_version
+        uses: mathieudutour/[email protected]
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          custom_tag: ${{ steps.chart_version.outputs.CHART_VERSION }}
+          tag_prefix: ${{ env.crds_tag_prefix }}
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
+      - name: Render changelog configuration
+        env:
+          REGEXP: "?!crds"
+        run: |
+          export DATE=$(date +%F); cat .github/workflows/changelog.json | envsubst > /tmp/changelog.json; cat /tmp/changelog.json
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
+      - name: Build Changelog
+        id: changelog
+        uses: mikepenz/release-changelog-builder-action@v5
+        with:
+          fromTag: ${{ steps.previous_tag.outputs.tag }}
+          toTag: ${{ steps.tag_version.outputs.new_tag }}
+          configuration: "/tmp/changelog.json"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
+      - name: Create release
+        uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ steps.tag_version.outputs.new_tag }}
+          name: ${{ steps.tag_version.outputs.new_tag }}
+          body: ${{ steps.changelog.outputs.changelog }}
+          prerelease: ${{ contains(steps.chart_version.outputs.CHART_VERSION, '-') }}
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
+      # avoid to push both charts
+      - name: Delete traefik chart
+        run: |
+          rm -rf traefik
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
+      - name: Publish Helm chart
+        uses: stefanprodan/helm-gh-pages@master
+        with:
+          token: ${{ secrets.CHARTS_TOKEN }}
+          charts_dir: .
+          charts_url: https://traefik.github.io/charts
+          owner: traefik
+          repository: charts
+          branch: master
+          target_dir: traefik-crds
+          index_dir: .
+          commit_username: traefiker
+          commit_email: [email protected]
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'
+
+      - name: Publish Helm chart to the ghcr.io registry
+        uses: appany/[email protected]
+        with:
+          name: traefik-crds
+          repository: traefik/helm
+          tag: ${{ steps.chart_version.outputs.CHART_VERSION }}
+          path: ./traefik-crds
+          registry: ghcr.io
+          registry_username: traefiker
+          registry_password: ${{ secrets.GHCR_TOKEN }}
+        if: steps.tag_exists.outputs.TAG_EXISTS == 'false'

.github/workflows/test.yml

@@ -23,11 +23,26 @@ jobs:
           git config user.name "$GITHUB_ACTOR"
           git config user.email "[email protected]"
 
-      - name: Check if values schema is up-to-date
+      - name: Check traefik if values schema is up-to-date
         uses: losisin/helm-values-schema-json-action@v1
         with:
           input: traefik/values.yaml
           output: traefik/values.schema.json
+          id: "https://traefik.io/traefik-helm-chart.schema.json"
+          title: "Traefik Proxy Helm Chart"
+          description: "The Cloud Native Application Proxy"
+          additional-properties: true
+          fail-on-diff: true
+
+      - name: Check traefik-crds if values schema is up-to-date
+        uses: losisin/helm-values-schema-json-action@v1
+        with:
+          input: traefik-crds/values.yaml
+          output: traefik-crds/values.schema.json
+          id: "https://traefik.io/traefik-crds-helm-chart.schema.json"
+          title: "Traefik CRDs Helm Chart"
+          description: "The Cloud Native Application Proxy"
+          additional-properties: false
           fail-on-diff: true
 
       - name: Lint

Makefile

@@ -7,10 +7,14 @@ IMAGE_HELM_UNITTEST=docker.io/helmunittest/helm-unittest:3.16.1-0.6.1
 
 traefik/tests/__snapshot__:
 	@mkdir traefik/tests/__snapshot__
+	@mkdir traefik-crds/tests/__snapshot__
 
 test: traefik/tests/__snapshot__
 	docker run ${DOCKER_ARGS} --entrypoint /bin/sh --rm -v $(CURDIR):/charts -w /charts $(IMAGE_HELM_UNITTEST) /charts/hack/test.sh
 
+deps:
+	helm dependency update traefik
+
 lint:
 	docker run ${DOCKER_ARGS} --env GIT_SAFE_DIR="true" --entrypoint /bin/sh --rm -v $(CURDIR):/charts -w /charts $(IMAGE_CHART_TESTING) /charts/hack/ct.sh lint
 
@@ -24,7 +28,8 @@ test-install:
 # Requires to install schema generation plugin beforehand
 # $ helm plugin install https://github.com/losisin/helm-values-schema-json.git
 schema:
-	helm schema
+	cd traefik && helm schema
+	cd traefik-crds && helm schema
 
 changelog:
 	@echo "== Updating Changelogs..."

README.md

@@ -81,23 +81,50 @@ helm install -f myvalues.yaml traefik traefik/traefik
 
 One can check what has changed in the [Changelog](./traefik/Changelog.md).
 
-:information_source: With Helm v3, CRDs created by this chart can not be updated, cf. the [Helm Documentation on CRDs](https://helm.sh/docs/chart_best_practices/custom_resource_definitions).
-
 :warning: Please read carefully release notes of this chart before upgrading CRDs.
 
 ```bash
 # Update repository
 helm repo update
 # See current Chart & Traefik version
 helm search repo traefik/traefik
-# Update CRDs (Traefik Proxy v3 CRDs)
-kubectl apply --server-side --force-conflicts -k https://github.com/traefik/traefik-helm-chart/traefik/crds/
 # Upgrade Traefik
 helm upgrade traefik traefik/traefik
 ```
 
+If you opt-out CRDs management system, you can still apply it manually:
+
+```bash
+# Update CRDs (Traefik Proxy v3 CRDs)
+kubectl apply --server-side --force-conflicts -k https://github.com/traefik/traefik-helm-chart/traefik-crds/
+```
+
 New major version indicates that there is an incompatible breaking change.
 
+### Upgrade to 34.X
+
+Starting from this release, the new traefik helm CRD management which works around [Helm caveats](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#some-caveats-and-explanations) system is enabled by default:
+
+```bash
+# Update repository
+helm repo update
+# See current Chart & Traefik version
+helm search repo traefik/traefik
+# Change CRDs ownership
+kubectl get customresourcedefinitions.apiextensions.k8s.io -o name | grep traefik.io | xargs kubectl patch --type='json' -p='[{"op": "add", "path": "/metadata/labels", "value": {"app.kubernetes.io/managed-by":"Helm"}},{"op": "add", "path": "/metadata/annotations/meta.helm.sh~1release-name", "value":"traefik"},{"op": "add", "path": "/metadata/annotations/meta.helm.sh~1release-namespace", "value":"traefik"}]'
+# If you use gateway API, you might also want to change Gateway API ownership
+kubectl get customresourcedefinitions.apiextensions.k8s.io -o name | grep gateway.networking.k8s.io | xargs kubectl patch --type='json' -p='[{"op": "add", "path": "/metadata/labels", "value": {"app.kubernetes.io/managed-by":"Helm"}},{"op": "add", "path": "/metadata/annotations/meta.helm.sh~1release-name", "value":"traefik"},{"op": "add", "path": "/metadata/annotations/meta.helm.sh~1release-namespace", "value":"traefik"}]'
+# Upgrade Traefik
+helm upgrade traefik traefik/traefik
+```
+
+If you still want to manage CRDs your self, it can be opt-out:
+
+```bash
+# Upgrade Traefik and skip all CRDs installation
+helm upgrade traefik traefik/traefik --set traefik-crds.traefik=false --set traefik-crds.hub=false --set traefik-crds.gateway_api=false 
+```
+
 ### Upgrade up to 27.X
 
 When upgrading on Traefik Proxy v2 version, one need to stay at Traefik Helm Chart v27.x. The command to upgrade to the latest Traefik Proxy v2 CRD is:

hack/changelog.sh

@@ -1,9 +1,14 @@
 #!/bin/bash
 
-chart="./traefik"
+for chart in "./traefik" "./traefik-crds"; do
+  version=$(yq -r '.version' <"${chart}/Chart.yaml")
+  changelog="$(sed -e "1,/^## ${version}/d" -e "/^##/,\$d" -e '/^$/d' -e 's/^* /- /' -e 's/^/    /' ${chart}/Changelog.md | grep '^    - ' | sed -e 's/\ *$//g' | sed 's/    - \(.*\)/    - "\1"/g')"
 
-version="$(awk '/^version:/ { print $2} ' ${chart}/Chart.yaml)"
-changelog="$(sed -e "1,/^## ${version}/d" -e "/^###/,\$d" -e '/^$/d' -e 's/^* /- /' -e 's/^/    /' ${chart}/Changelog.md | grep '^    - ' | sed -e 's/\ *$//g' | sed 's/    - \(.*\)/    - "\1"/g')"
-sed -i -e '/^  artifacthub.io\/changes: |/,$d' ${chart}/Chart.yaml
-echo "  artifacthub.io/changes: |" >> ${chart}/Chart.yaml
-echo "${changelog}" >> ${chart}/Chart.yaml
+  echo "${version}"
+  echo "${changelog}"
+
+  sed -i -r 's/^annotations: \{\}/annotations:/g' ${chart}/Chart.yaml
+  sed -i -e '/^  artifacthub.io\/changes: |/,$d' ${chart}/Chart.yaml
+  echo "  artifacthub.io/changes: |" >>${chart}/Chart.yaml
+  echo "${changelog}" >>${chart}/Chart.yaml
+done