gitadmin/devops-infra-helm-charts-gcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added repo

Browse Source
This commit is contained in:
Your Name
2026-08-26 03:39:42 +05:30
parent 45c25a95af
commit b8575bb8b9
6889 changed files with 1217125 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
claude/03-chart-inventory.md
+82
View File
@@ -0,0 +1,82 @@
> Per AI Blitz Plan §claude. Layer: 1. Repo: devops-infra-helm-charts.
# 03 — Chart inventory
`helm-templates/` carries about 74 chart directories. They fall into three categories by structure and one cross-cutting category by lifecycle.
## By structure
### 1. Vanilla upstream cache
Most charts are pulled verbatim via `helm pull <repo>/<chart>` and committed. The `templates/` are *not* edited. Editing them silently forks the chart and the edits get clobbered the next time someone refreshes the cache. The pre-commit hooks do not catch this — only PR review does.
If a fork is intentional, it must be documented in the chart's `README.md` and called out in the PR. See [`../docs/platform/procedures/fork-upstream-chart.md`](../docs/platform/procedures/fork-upstream-chart.md).
Background: [`../wiki/analyses/ADR-A1-cache-vs-upstream-charts.md`](../wiki/analyses/ADR-A1-cache-vs-upstream-charts.md).
### 2. Thin wrapper
`Chart.yaml` declares `dependencies:` pointing at one or more upstream charts. The local `templates/` is empty or carries only a thin glue manifest. Used so a single Argo Application can install a stack (e.g., kube-prometheus-stack carries Prometheus + Alertmanager + Grafana + node-exporter + kube-state-metrics together).
When bumping a wrapper, refresh `Chart.lock` with `helm dependency update helm-templates/<chart>`. See [`../docs/platform/procedures/update-chart-version.md`](../docs/platform/procedures/update-chart-version.md).
### 3. Intentional fork
A small number of charts have deliberate `templates/` edits — local CRD patches, label injection, removed sub-resources we don't want, etc. Each fork should be self-documenting in its `README.md`. If the rationale is missing, treat the fork as suspect and escalate per [`../docs/global/escalation-matrix.md`](../docs/global/escalation-matrix.md).
## By lifecycle — versioned siblings
A chart family often has two siblings live simultaneously to support blue-green migrations:
| Stable | Migration target | Used for |
|--------|------------------|----------|
| `argo-cd` | `argo-cd-green` | Green-deploy of the Argo CD control plane itself |
| `contour` | `contour-v1.33.3` | Pinned-version migration of the ingress data plane |
| `keda` | `keda-2.17.1` | Autoscaler version cutover |
| `opentelemetry-collector` | `opentelemetry-collector-latest` | OTel collector cutover |
| `victoria-metrics-cluster` | `victoria-metrics-cluster-latest` | VM cluster cutover |
| `victoria-metrics-agent` | `victoria-metrics-agent-latest` | VM agent cutover |
| `sonarqube` | (was forward; `sonarqube-old` retained) | SonarQube major cutover |
The `-green` / `-vX.Y.Z` / `-latest` / `-old` suffix names the **migration target** (or in `-old`'s case, the kept-around predecessor). Both can be live at once on different clusters or even on the same cluster (different Argo Applications). Deletion of a sibling requires confirming zero references in the sister repo. See [`../wiki/analyses/ADR-A2-blue-green-sibling-pattern.md`](../wiki/analyses/ADR-A2-blue-green-sibling-pattern.md) and [`../docs/platform/procedures/blue-green-chart-migration.md`](../docs/platform/procedures/blue-green-chart-migration.md).
## Multi-Contour pattern
Contour is unique in that a single cluster runs **multiple separate Contour Helm releases**, each pinned to its own node pool / compute class. The standard set:
- `contour-external` — public-facing ingress, primary
- `contour-external-1` — public-facing ingress, secondary (capacity / blue-green)
- `contour-internal-0`, `contour-internal-1` — internal mesh ingress, redundant pair
- `contour-internal-intra-0`, `contour-internal-intra-1` — intra-VPC ingress, redundant pair
Per-cluster matrix of which release goes on which node pool: repo-root `contour-nodeselector-tolerations-summary.md`. Each release has its own `helm-overrides/<cluster>/<contour-release>/custom-values.yaml`.
## Notable individual charts
| Chart | Notes |
|-------|-------|
| `argo-cd` / `argo-cd-green` | Self-managing — Argo CD installs itself. Sync policy must be careful. |
| `vault` | Stateful HA on Raft. Edits to seal config or HA storage require platform-team review. |
| `external-secrets` | Source of truth for secret materialization on each cluster. See [`./06-secrets-and-identity.md`](./06-secrets-and-identity.md). |
| `kyverno` | Cluster-policy enforcement. Edits change admission behaviour for all workloads. |
| `kube-prometheus-stack` | Bundles Prometheus + Alertmanager. Alert rules pages on-call — validate PromQL. See [`../docs/global/coding-guidelines/observability.md`](../docs/global/coding-guidelines/observability.md). |
| `external-dns` | Publishes DNS records to Cloud DNS. Often paired with sidecar `external-dns-services/*.yaml` raw manifests. |
| `cert-manager` | Issues TLS certs (Let's Encrypt + Vault). |
## Image registry convention
Production overrides pin images to Meesho's Artifact Registry mirror:
```
asia-southeast1-docker.pkg.dev/meesho-devops-admin-0622/admin/sre/<image>
```
…rather than Docker Hub directly. Mirroring decouples deploys from upstream registry availability and rate limits.
## See also
- [`./01-repo-structure.md`](./01-repo-structure.md)
- [`./02-cluster-fleet.md`](./02-cluster-fleet.md)
- [`./04-override-hierarchy.md`](./04-override-hierarchy.md)
- [`../docs/platform/procedures/update-chart-version.md`](../docs/platform/procedures/update-chart-version.md)
- [`../docs/platform/procedures/fork-upstream-chart.md`](../docs/platform/procedures/fork-upstream-chart.md)