docs(ec): cover repo/OCI-sourced Helm extension charts in v2→v3 migration#4276
docs(ec): cover repo/OCI-sourced Helm extension charts in v2→v3 migration#4276sgalsaleh wants to merge 2 commits into
Conversation
…tion Embedded Cluster v3 resolves extension charts from .tgz archives bundled in the release; it does not pull them from an HTTP Helm repository or an OCI registry at install time. Migrating a v2 extension whose chart was sourced from a repo/registry therefore requires packaging the chart as a .tgz and including it in the release, not just reshaping the Config YAML. - embedded-v3-migrate.mdx: add a comparison subsection explaining the bundled-.tgz model, and expand the extensions migration step with the helm pull (HTTP repo + OCI) and bundle-then-reference procedure. - embedded-using.mdx (#add-extensions): state the bundled-.tgz requirement and expand the steps to package/pull and reference the chart. - embedded-config.mdx: add a requirements note to the extensions reference. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for replicated-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for replicated-docs-upgrade ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
github-actions
Bot
added
type::docs
|
The One thing I think is missing: should the migration steps also mention creating a HelmChart v2 CR for each extension chart? The existing step 6 in the migration doc says "Ensure that your release has a corresponding HelmChart v2 custom resource for each of your Helm charts," but it's not clear whether that includes extension charts. The new extension-specific steps (helm pull → add .tgz → reference in EC Config) don't mention the CR at all. This matters for Security Center — without a HelmChart CR, the extension chart's images don't get scanned. The validation currently exempts extension charts from the CR requirement, so vendors won't get a lint error, but they'll silently lose image scanning coverage. If extension charts should have HelmChart CRs (and I think they should based on the docs stating every chart needs one), it would be worth adding that as a sub-step here. |
|
Update on the HelmChart CR concern above: Salah clarified that extension charts don't need a separate HelmChart CR — the schema lives inside the EC Config, and Security Center scans extensions without one. So the migration steps in this PR are correct as-is. That said, this is worth making explicit in a few spots since the existing docs are ambiguous:
These are small clarifications — happy to push commits to this PR if you'd prefer. |
|
I'll go ahead and contribute to this pr since they are small edits |
…art CR The HelmChart v2 CR requirement applies to application charts only. Extension charts are defined in the Embedded Cluster Config, which serves the same purpose. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2 participants
Problem
Embedded Cluster v3 resolves Helm extension charts from
.tgzarchives bundled in the release. It does not pull extension charts at install time from an HTTP Helm repository or an OCI registry — the v3extensions.helmChartsschema has no repository/registry field.A vendor migrating a v2 extension whose chart was sourced from a repo or registry (e.g.
chartname: ingress-nginx/ingress-nginxorchartname: oci://quay.io/jetstack/charts/cert-manager) hits a wall: the v2→v3 migration docs only showed the Config YAML shape change and never explained where the.tgzcomes from. In one case a v2-shaped extensions config was promoted under a v3 apiVersion, the extension's images never made it into the air gap bundle, and the install failed.What this changes
Docs-only. Closes the migration-path gap by documenting the fetch-and-bundle procedure.
embedded-v3-migrate.mdx— new comparison subsection "Helm extension charts must be bundled in the release" explaining the v2 (repo/OCI pull) → v3 (bundled.tgz) model; and expands the extensions migration step from a pure YAML swap into:helm pull(HTTP repo and OCI examples) → add the.tgzto the release → reference it inextensions.helmCharts.embedded-using.mdx(#add-extensions) — states the bundled-.tgzrequirement and expands the steps to package/pull and reference the chart.embedded-config.mdx— adds a requirements bullet to theextensions.helmChartsreference.Example chart sources were verified against upstream:
https://kubernetes.github.io/ingress-nginx(valid repo, versions have novprefix) andoci://quay.io/jetstack/charts/cert-manager(canonical OCI location; the1.19.2tag exists on quay.io).Out of scope
The related asks to add a promote-time lint for a missing chart archive / HelmChart CR and to fetch-and-bundle at the platform level during promote are code/product changes in other repos, tracked separately.
🤖 Generated with Claude Code