From 97cc321d7644598a7ddfa351e6db0b2a100439d8 Mon Sep 17 00:00:00 2001 From: lgs <11679637+louisgls@users.noreply.github.com> Date: Wed, 29 Jul 2026 14:29:36 +0200 Subject: [PATCH 1/2] feat(chart): add deploymentAnnotations for Deployment metadata MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The chart only exposed `podAnnotations`, which renders onto the pod template. Controllers that watch the workload object itself had no way to be configured through values. The concrete failure: the TLS cert secret is mounted with `subPath`, and kubelet never refreshes a subPath volume in place. When cert-manager rotates the certificate, the running pods keep serving the old one until they are restarted. Stakater Reloader does exactly that, but it reads `reloader.stakater.com/auto` from `Deployment.metadata.annotations` — which the chart could not render. The proxy therefore served an expired certificate and every TLS client failed with `x509: certificate has expired`. Add `deploymentAnnotations` (default `{}`, declared in values.schema.json) and render it onto the Deployment metadata. No behavior change when unset. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 10 +++++++++- charts/s3proxy/Chart.yaml | 2 +- charts/s3proxy/templates/deployment.yaml | 4 ++++ charts/s3proxy/values.schema.json | 1 + charts/s3proxy/values.yaml | 9 +++++++++ 5 files changed, 24 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e779d8f..c127190 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,7 +16,15 @@ Two version streams move independently: ### Chart -- **`chart/1.9.3`** — Dashboard usability + Go runtime panels. +- **`chart/1.10.0`** — New `deploymentAnnotations` value, rendered onto the + `Deployment` object's own `metadata.annotations`. Until now the chart only + exposed `podAnnotations`, which lands on the pod template — so controllers + that watch the workload metadata had no way in. The motivating case is + Stakater Reloader (`reloader.stakater.com/auto: "true"`): the TLS secret is + mounted with `subPath`, which kubelet never refreshes in place, so a renewed + certificate is only picked up when the pods restart. Without the annotation + the proxy keeps serving the expired certificate after cert-manager rotates + it, and every TLS client fails with `x509: certificate has expired`. - `Job` picker now defaults to **All** (`allValue: ".*s3proxy.*"`) and restricts its dropdown to jobs whose name contains `s3proxy` via the template `regex: /s3proxy/`. Multi-release clusters land on a diff --git a/charts/s3proxy/Chart.yaml b/charts/s3proxy/Chart.yaml index 7884401..8a8d384 100644 --- a/charts/s3proxy/Chart.yaml +++ b/charts/s3proxy/Chart.yaml @@ -18,5 +18,5 @@ maintainers: annotations: org.opencontainers.image.source: "https://github.com/intrinsec/s3proxy/" type: application -version: 1.9.3 +version: 1.10.0 appVersion: "1.8.1" diff --git a/charts/s3proxy/templates/deployment.yaml b/charts/s3proxy/templates/deployment.yaml index f7e2471..2520d6c 100644 --- a/charts/s3proxy/templates/deployment.yaml +++ b/charts/s3proxy/templates/deployment.yaml @@ -4,6 +4,10 @@ metadata: name: {{ include "s3proxy.fullname" . }} labels: {{- include "s3proxy.labels" . | nindent 4 }} + {{- with .Values.deploymentAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} spec: {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.replicaCount }} diff --git a/charts/s3proxy/values.schema.json b/charts/s3proxy/values.schema.json index 38ee718..ef1ef02 100644 --- a/charts/s3proxy/values.schema.json +++ b/charts/s3proxy/values.schema.json @@ -99,6 +99,7 @@ "type": "object", "additionalProperties": true }, + "deploymentAnnotations": { "type": "object" }, "podAnnotations": { "type": "object" }, "podLabels": { "type": "object" }, "podSecurityContext": { "type": "object" }, diff --git a/charts/s3proxy/values.yaml b/charts/s3proxy/values.yaml index 4cc25b1..df55c2b 100644 --- a/charts/s3proxy/values.yaml +++ b/charts/s3proxy/values.yaml @@ -80,6 +80,15 @@ valsSecret: {} # secretKey: ref+vault://s3proxy/secrets/secret-key # encryptKey: ref+vault://s3proxy/secrets/encrypt-key +# Annotations set on the Deployment object itself (not the pod template). +# Required by controllers that watch the workload metadata, e.g. Stakater +# Reloader, which restarts the pods when the TLS secret is renewed: +# deploymentAnnotations: +# reloader.stakater.com/auto: "true" +# The cert secret is mounted with subPath, so kubelet never refreshes it +# in-place — a pod restart is the only way to pick up a renewed certificate. +deploymentAnnotations: {} + podAnnotations: {} podLabels: {} From 96372dc78b2eba6887a8d0ad437ebb89567aa700 Mon Sep 17 00:00:00 2001 From: lgs <11679637+louisgls@users.noreply.github.com> Date: Wed, 29 Jul 2026 14:46:35 +0200 Subject: [PATCH 2/2] docs(changelog): restore the chart/1.9.3 heading The 1.10.0 entry was inserted in place of the 1.9.3 heading line, leaving 1.9.3's dashboard sub-bullets attached to 1.10.0. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c127190..6a56e20 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,6 +25,7 @@ Two version streams move independently: certificate is only picked up when the pods restart. Without the annotation the proxy keeps serving the expired certificate after cert-manager rotates it, and every TLS client fails with `x509: certificate has expired`. +- **`chart/1.9.3`** — Dashboard usability + Go runtime panels. - `Job` picker now defaults to **All** (`allValue: ".*s3proxy.*"`) and restricts its dropdown to jobs whose name contains `s3proxy` via the template `regex: /s3proxy/`. Multi-release clusters land on a