helm: trim hardening to essentials (#45)

Keep the Helm hardening outcome while removing the unnecessary helper layer, test template, duplicate checks, verbose documentation, and historical index churn.

.github/workflows/helm.yml

@@ -1,85 +1,45 @@
-name: Helm Chart
+name: Helm
 
 on:
-  workflow_dispatch:
   pull_request:
     paths:
       - ".github/workflows/helm.yml"
       - "helm/**"
       - "helm-releases/minio-*.tgz"
-      - "helm-reindex.sh"
-      - "index.yaml"
   push:
-    branches:
-      - master
+    branches: [master]
     paths:
       - ".github/workflows/helm.yml"
       - "helm/**"
       - "helm-releases/minio-*.tgz"
-      - "helm-reindex.sh"
-      - "index.yaml"
 
 permissions:
   contents: read
 
 jobs:
-  install-smoke:
+  smoke:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Helm
-        uses: azure/setup-helm@v4
+      - uses: actions/checkout@v4
+      - uses: azure/setup-helm@v4
         with:
           version: v3.19.0
 
-      - name: Verify packaged chart
+      - name: Lint packaged chart
         run: |
-          set -euo pipefail
-          chart_version="$(awk '$1 == "version:" { print $2; exit }' helm/minio/Chart.yaml)"
-          chart_package="helm-releases/minio-${chart_version}.tgz"
-          test -f "${chart_package}"
-          echo "CHART_PACKAGE=${chart_package}" >> "${GITHUB_ENV}"
-          helm lint --strict "${chart_package}"
-
-          unpacked="$(mktemp -d)"
-          tar -xzf "${chart_package}" -C "${unpacked}"
-          diff -ru --exclude Chart.yaml helm/minio "${unpacked}/minio"
-
-          package_digest="$(sha256sum "${chart_package}" | awk '{ print $1 }')"
-          grep -F "digest: ${package_digest}" index.yaml
-          grep -F "https://raw.githubusercontent.com/pgsty/minio/master/${chart_package}" index.yaml
-
-      - name: Render and verify immutable images
-        run: |
-          set -euo pipefail
-          expected_image='pgsty/minio@sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b'
-          rendered="$(mktemp)"
-          helm template silo "${CHART_PACKAGE}" \
-            --namespace silo \
-            --set mode=standalone \
-            --set persistence.enabled=false > "${rendered}"
-          grep -F "image: \"${expected_image}\"" "${rendered}"
-          if grep -Eq 'image:.*(quay\.io/minio|minio/minio|minio/mc)' "${rendered}"; then
-            echo "Rendered chart still references an upstream MinIO image."
-            exit 1
-          fi
+          version="$(awk '$1 == "version:" { print $2; exit }' helm/minio/Chart.yaml)"
+          chart="helm-releases/minio-${version}.tgz"
+          test -f "${chart}"
+          helm lint --strict "${chart}"
+          echo "CHART=${chart}" >> "${GITHUB_ENV}"
 
       - name: Create Kind cluster
         uses: helm/kind-action@v1
-        with:
-          version: v0.31.0
-          kubectl_version: v1.35.0
-          node_image: kindest/node:v1.35.0@sha256:452d707d4862f52530247495d180205e029056831160e22870e37e3f6c1ac31f
-          cluster_name: silo-chart
-          wait: 120s
 
-      - name: Install chart
+      - name: Install and test
         run: |
-          set -euo pipefail
-          helm install silo "${CHART_PACKAGE}" \
+          helm install silo "${CHART}" \
             --namespace silo \
             --create-namespace \
             --wait \
@@ -94,17 +54,12 @@ jobs:
             --set 'buckets[0].name=bootstrap' \
             --set 'buckets[0].policy=none' \
             --set 'buckets[0].purge=false'
-          kubectl rollout status deployment/silo-minio --namespace silo --timeout=2m
 
-      - name: Run S3 smoke test
-        run: |
-          set -euo pipefail
-          helm test silo --namespace silo --logs --timeout 5m
-
-      - name: Diagnostics
-        if: failure()
-        run: |
-          helm status silo --namespace silo || true
-          kubectl get all --namespace silo -o wide || true
-          kubectl describe pods --namespace silo || true
-          kubectl logs --namespace silo --all-containers=true --prefix=true --selector release=silo || true
+          kubectl get deployment/silo-minio --namespace silo -o jsonpath='{.spec.template.spec.containers[0].image}' | grep -q '^pgsty/minio:'
+          kubectl exec --namespace silo deployment/silo-minio -- /bin/sh -ec '
+            mc alias set local http://127.0.0.1:9000 siloadmin silo-smoke-password
+            trap "mc rm --recursive --force local/silo-smoke >/dev/null 2>&1 || true; mc rb local/silo-smoke >/dev/null 2>&1 || true" EXIT
+            mc mb local/silo-smoke
+            printf smoke | mc pipe local/silo-smoke/probe
+            test "$(mc cat local/silo-smoke/probe)" = smoke
+          '

README.md

@@ -29,15 +29,3 @@ Console: [`georgmangold/console`](https://github.com/georgmangold/console/), a c
 Ansible Deployment: [https://pigsty.io/docs/minio](https://pigsty.io/docs/minio)
 
 APT/YUM repo for `minio` and `mcli` binary: [https://pigsty.io/docs/infra](https://pigsty.io/docs/repo/infra/list/#object-storage)
-
-## Kubernetes delivery and scope
-
-This repository maintains the direct-deployment Helm chart in [`helm/minio`](helm/minio/README.md) for standalone and distributed Silo server deployments. Chart defaults use the version- and digest-pinned multi-architecture [`pgsty/minio`](https://hub.docker.com/r/pgsty/minio) image, and every chart change is checked by a real Kind install plus an S3 write/read/delete smoke test.
-
-```bash
-helm repo add silo https://raw.githubusercontent.com/pgsty/minio/master
-helm repo update silo
-helm install my-release silo/minio --namespace minio --create-namespace
-```
-
-The MinIO Operator, Tenant CRDs, and operator lifecycle are **not maintained by this repository**. There is no Pigsty/Silo operator fork here. Users who require an operator must select and validate a separate operator implementation; issues and pull requests for operator code should be filed with that implementation.

helm-reindex.sh

@@ -1,5 +1,4 @@
-#!/usr/bin/env bash
-set -euo pipefail
+#!/bin/bash
 
 helm package helm/minio -d helm-releases/
 

helm/minio/Chart.yaml

@@ -1,17 +1,16 @@
 apiVersion: v1
-description: Silo, a community-maintained MinIO-compatible object store
+description: High Performance Object Storage
 name: minio
 version: 5.5.0
 appVersion: RELEASE.2026-06-18T00-00-00Z
 keywords:
   - minio
-  - silo
   - storage
   - object-storage
   - s3
   - cluster
 home: https://silo.pigsty.io
-icon: https://raw.githubusercontent.com/pgsty/minio/master/.github/logo.svg
+icon: https://min.io/resources/img/logo/MINIO_wordmark.png
 sources:
 - https://github.com/pgsty/minio
 maintainers:

helm/minio/README.md

@@ -1,38 +1,24 @@
-# Silo Community Helm Chart
+# MinIO Community Helm Chart
 
-[![license](https://img.shields.io/badge/license-AGPL%20V3-blue)](https://github.com/pgsty/minio/blob/master/LICENSE)
-[![source](https://img.shields.io/badge/source-pgsty%2Fminio-blue?logo=github)](https://github.com/pgsty/minio)
-[![image](https://img.shields.io/badge/image-pgsty%2Fminio-blue?logo=docker)](https://hub.docker.com/r/pgsty/minio)
+[![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io) [![license](https://img.shields.io/badge/license-AGPL%20V3-blue)](https://github.com/minio/minio/blob/master/LICENSE)
 
-Silo is a community-maintained, S3-compatible object store derived from MinIO. This chart deploys the Silo server directly on Kubernetes in standalone or distributed mode.
+MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads.
 
-> [!IMPORTANT]
-> This chart is maintained in [`pgsty/minio`](https://github.com/pgsty/minio). Chart changes are linted, installed into Kind, and verified with an S3 write/read/delete test.
->
-> The MinIO Operator, Tenant CRDs, and operator lifecycle are **not maintained here**. This repository does not provide or plan to provide a Pigsty/Silo operator fork.
-
-## Pinned images
-
-The defaults are immutable multi-architecture references for `linux/amd64` and `linux/arm64`:
-
-| Workload | Repository | Release | Manifest digest |
-|:---------|:-----------|:--------|:----------------|
-| Server | `pgsty/minio` | `RELEASE.2026-06-18T00-00-00Z` | `sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b` |
-| Post-install jobs and tests | `pgsty/minio` | `RELEASE.2026-06-18T00-00-00Z` | `sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b` |
-
-The Silo image bundles `mcli` and an `mc` compatibility alias. When an image `digest` is set it takes precedence over `tag`. To select another release, update both fields; alternatively set `digest: ""` to use the tag alone.
+| IMPORTANT |
+| -------------------------- |
+| This direct-deployment chart is maintained in [`pgsty/minio`](https://github.com/pgsty/minio) and defaults to a fixed `pgsty/minio` release. The MinIO Operator, Tenant CRDs, and operator lifecycle are not maintained by this repository. |
 
 ## Introduction
 
-This chart bootstraps a Silo cluster on [Kubernetes](https://kubernetes.io) using the [Helm](https://helm.sh) package manager.
+This chart bootstraps MinIO Cluster on [Kubernetes](http://kubernetes.io) using the [Helm](https://helm.sh) package manager.
 
 ## Prerequisites
 
-- Helm 3 with a Kubernetes cluster configured.
+- Helm cli with Kubernetes cluster configured.
 - PV provisioner support in the underlying infrastructure. (We recommend using <https://github.com/minio/direct-csi>)
-- Kubernetes v1.25 or later is recommended. The current CI test version is recorded in [the Helm workflow](../../.github/workflows/helm.yml).
+- Use Kubernetes version v1.19 and later for best experience.
 
-## Configure the Silo Helm repository
+## Configure MinIO Helm repo
 
 ```bash
 helm repo add silo https://raw.githubusercontent.com/pgsty/minio/master
@@ -44,10 +30,7 @@ helm repo update silo
 Install this chart using:
 
 ```bash
-helm install my-release silo/minio \
-  --namespace minio \
-  --create-namespace \
-  --set rootUser=rootuser,rootPassword=rootpass123
+helm install --namespace minio --set rootUser=rootuser,rootPassword=rootpass123 --generate-name silo/minio
 ```
 
 The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
@@ -57,17 +40,7 @@ The command deploys MinIO on the Kubernetes cluster in the default configuration
 Minimal toy setup for testing purposes can be deployed using:
 
 ```bash
-helm install my-release silo/minio \
-  --namespace minio \
-  --create-namespace \
-  --set mode=standalone \
-  --set replicas=1 \
-  --set persistence.enabled=false \
-  --set resources.requests.memory=512Mi \
-  --set rootUser=rootuser \
-  --set rootPassword=rootpass123
-
-helm test my-release --namespace minio --logs
+helm install --set resources.requests.memory=512Mi --set replicas=1 --set persistence.enabled=false --set mode=standalone --set rootUser=rootuser,rootPassword=rootpass123 --generate-name silo/minio
 ```
 
 ### Upgrading the Chart
@@ -78,7 +51,7 @@ You can use Helm to update MinIO version in a live release. Assuming your releas
 helm get values my-release > old_values.yaml
 ```
 
-Update `image.tag` and `image.digest` together for the server release. If post-install jobs are enabled, update `mcImage.tag` and `mcImage.digest` to the same tested artifact. Then upgrade the release:
+Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using
 
 ```bash
 helm upgrade -f old_values.yaml my-release silo/minio

helm/minio/templates/_helpers.tpl

@@ -31,28 +31,6 @@ Create chart name and version as used by the chart label.
   {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
-{{/*
-Build the immutable server image reference. Digest takes precedence over tag.
-*/}}
-{{- define "minio.image" -}}
-  {{- if .Values.image.digest -}}
-    {{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
-  {{- else -}}
-    {{- printf "%s:%s" .Values.image.repository .Values.image.tag -}}
-  {{- end -}}
-{{- end -}}
-
-{{/*
-Build the immutable client/job image reference. Digest takes precedence over tag.
-*/}}
-{{- define "minio.mcImage" -}}
-  {{- if .Values.mcImage.digest -}}
-    {{- printf "%s@%s" .Values.mcImage.repository .Values.mcImage.digest -}}
-  {{- else -}}
-    {{- printf "%s:%s" .Values.mcImage.repository .Values.mcImage.tag -}}
-  {{- end -}}
-{{- end -}}
-
 {{/*
 Return the appropriate apiVersion for networkpolicy.
 */}}

helm/minio/templates/deployment.yaml

@@ -62,7 +62,7 @@ spec:
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}
-          image: {{ include "minio.image" . | quote }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command:
             - "/bin/sh"

helm/minio/templates/post-job.yaml

@@ -88,7 +88,7 @@ spec:
       {{- if .Values.policies }}
       initContainers:
         - name: minio-make-policy
-          image: {{ include "minio.mcImage" . | quote }}
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
           {{- if .Values.makePolicyJob.securityContext.enabled }}
           {{- with .Values.makePolicyJob.containerSecurityContext }}
           securityContext: {{ toYaml . | nindent 12 }}
@@ -122,7 +122,7 @@ spec:
       containers:
         {{- if .Values.buckets }}
         - name: minio-make-bucket
-          image: {{ include "minio.mcImage" . | quote }}
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
           {{- if .Values.makeBucketJob.securityContext.enabled }}
           {{- with .Values.makeBucketJob.containerSecurityContext }}
           securityContext: {{ toYaml . | nindent 12 }}
@@ -155,7 +155,7 @@ spec:
         {{- end }}
         {{- if .Values.users }}
         - name: minio-make-user
-          image: {{ include "minio.mcImage" . | quote }}
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
           {{- if .Values.makeUserJob.securityContext.enabled }}
           {{- with .Values.makeUserJob.containerSecurityContext }}
           securityContext: {{ toYaml . | nindent 12 }}
@@ -188,7 +188,7 @@ spec:
         {{- end }}
         {{- if .Values.customCommands }}
         - name: minio-custom-command
-          image: {{ include "minio.mcImage" . | quote }}
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
           {{- if .Values.customCommandJob.securityContext.enabled }}
           {{- with .Values.customCommandJob.containerSecurityContext }}
           securityContext: {{ toYaml . | nindent 12 }}
@@ -224,7 +224,7 @@ spec:
         {{- end }}
         {{- if .Values.svcaccts }}
         - name: minio-make-svcacct
-          image: {{ include "minio.mcImage" . | quote }}
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
           {{- if .Values.makeServiceAccountJob.securityContext.enabled }}
           {{- with .Values.makeServiceAccountJob.containerSecurityContext }}
           securityContext: {{ toYaml . | nindent 12 }}

helm/minio/templates/statefulset.yaml

@@ -90,7 +90,7 @@ spec:
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}
-          image: {{ include "minio.image" . | quote }}
+          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command: [
             "/bin/sh",

helm/minio/templates/tests/test-connection.yaml

@@ -1,52 +0,0 @@
-{{- if .Values.tests.enabled }}
-{{- $scheme := .Values.tls.enabled | ternary "https" "http" }}
-apiVersion: v1
-kind: Pod
-metadata:
-  name: {{ include "minio.fullname" . }}-test-connection
-  labels:
-    app: {{ include "minio.name" . }}-test
-    release: {{ .Release.Name }}
-    {{ include "minio.name" . }}-client: "true"
-  annotations:
-    "helm.sh/hook": test
-    "helm.sh/hook-delete-policy": before-hook-creation
-spec:
-  restartPolicy: Never
-  {{- include "minio.imagePullSecrets" . | nindent 2 }}
-  containers:
-    - name: s3-smoke
-      image: {{ include "minio.mcImage" . | quote }}
-      imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
-      command: ["/bin/sh", "-ec"]
-      args:
-        - |
-          alias_name=silo-helm-test
-          bucket_name="silo-helm-test-$(date +%s)"
-          object_name=probe.txt
-          payload="silo helm smoke test"
-          mc alias set "${alias_name}" "{{ $scheme }}://{{ include "minio.fullname" . }}:{{ .Values.service.port }}" "${MINIO_ROOT_USER}" "${MINIO_ROOT_PASSWORD}" {{ if .Values.tls.enabled }}--insecure{{ end }}
-          cleanup() {
-            mc rm --recursive --force "${alias_name}/${bucket_name}" >/dev/null 2>&1 || true
-            mc rb "${alias_name}/${bucket_name}" >/dev/null 2>&1 || true
-          }
-          trap cleanup EXIT
-          mc mb --ignore-existing "${alias_name}/${bucket_name}"
-          printf '%s' "${payload}" | mc pipe "${alias_name}/${bucket_name}/${object_name}"
-          actual="$(mc cat "${alias_name}/${bucket_name}/${object_name}")"
-          test "${actual}" = "${payload}"
-          mc rm "${alias_name}/${bucket_name}/${object_name}"
-          mc rb "${alias_name}/${bucket_name}"
-          trap - EXIT
-      env:
-        - name: MINIO_ROOT_USER
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "minio.secretName" . }}
-              key: rootUser
-        - name: MINIO_ROOT_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: {{ include "minio.secretName" . }}
-              key: rootPassword
-{{- end }}

helm/minio/values.yaml

@@ -10,26 +10,22 @@ fullnameOverride: ""
 ##
 clusterDomain: cluster.local
 
-## Silo server image. The default is pinned by both release tag and multi-arch
-## manifest digest. When digest is non-empty it takes precedence over tag.
+## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
 ##
 image:
   repository: pgsty/minio
   tag: RELEASE.2026-06-18T00-00-00Z
-  digest: sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b
   pullPolicy: IfNotPresent
 
 imagePullSecrets: []
 # - name: "image-pull-secret"
 
-## Image used by post-install jobs and Helm tests. pgsty/minio bundles the
-## maintained mcli binary and an mc compatibility alias, so these jobs use the
-## exact same pinned, multi-arch artifact as the server.
+## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio
+## client used to create a default bucket).
 ##
 mcImage:
   repository: pgsty/minio
   tag: RELEASE.2026-06-18T00-00-00Z
-  digest: sha256:dacff8306a6e0a734518533992dbdcca26bc1ca47f77cf47cb9945725f92b29b
   pullPolicy: IfNotPresent
 
 ## minio mode, i.e. standalone or distributed
@@ -131,13 +127,13 @@ pools: 1
 ## TLS Settings for MinIO
 tls:
   enabled: false
-  ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/pgsty/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
+  ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
   certSecret: ""
   publicCrt: public.crt
   privateKey: private.key
 
 ## Trusted Certificates Settings for MinIO. Ref: https://silo.pigsty.io/operations/network-encryption.html#third-party-certificate-authorities
-## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/pgsty/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
+## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
 ## When using self-signed certificates, remember to include MinIO's own certificate in the bundle with key public.crt.
 ## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret.
 trustedCertsSecret: ""
@@ -621,11 +617,7 @@ metrics:
     # Scrape timeout, for example `scrapeTimeout: 10s`
     scrapeTimeout: ~
 
-## Enable the `helm test` S3 write/read/delete smoke test.
-tests:
-  enabled: true
-
-## ETCD settings: https://github.com/pgsty/minio/blob/master/docs/sts/etcd.md
+## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md
 ## Define endpoints to enable this section.
 etcd:
   endpoints: []