build(helm): replace the minio chart with a silo chart that preserves identity

helm/minio becomes helm/silo: chart name silo, version 6.0.0 -> 7.0.0, the
MinIO wordmark icon replaced with the project's own, image.repository and
mcImage.repository pointing at pgsty/silo, and the container command changed to
silo. User-visible titles, comments and documentation links are rebranded. The
MINIO_* environment variables and every existing values key are kept - the
first Silo chart is a rename, not a values-schema migration.

The hard problem is that a chart rename normally rewrites Kubernetes resource
identity, and a StatefulSet's selector and volumeClaimTemplate are immutable.
An existing release upgraded carelessly would either fail or orphan its PVCs.
Two things address that:

- Templates no longer derive the container name from .Chart.Name. It comes from
  a helper, so nameOverride can pin it, which means an existing release can be
  upgraded with nameOverride=minio, fullnameOverride=<existing-fullname> and
  serviceAccount.name=minio-sa and render byte-stable identity while switching
  chart and image.

- helm-migration-guard and verify-helm-migration.sh make that a gate rather
  than a documented hope. The script lints the chart, renders it in distributed
  and standalone modes plus the optional templates, then renders the legacy
  chart from a pinned commit and the new chart with those three overrides and
  compares resource identity. The guard additionally rejects any rendered
  container still pulling pgsty/minio or invoking /usr/bin/minio. It runs
  through a pinned alpine/helm image when helm is not installed locally, so the
  gate does not depend on the developer's machine. Currently green over 7
  compared resources.

Rollback is asymmetric and the README says so: the old chart with the new image
survives via the entrypoint argv shim, but the new chart with an old MinIO
image does not, because `silo server` is not a command that binary knows. Only
`helm rollback` is supported, never an image-only downgrade.

Not addressed here: the default image tag is pgsty/silo:RELEASE.2026-08-04T00-00-00Z,
which does not exist yet. The chart must not be published until the first Silo
image is pushed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

helm/silo/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+# OWNERS file for Kubernetes
+OWNERS

helm/silo/Chart.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+description: S3-Interface Libre Object Storage
+name: silo
+version: 7.0.0
+appVersion: RELEASE.2026-08-04T00-00-00Z
+keywords:
+  - silo
+  - storage
+  - object-storage
+  - s3
+  - cluster
+home: https://silo.pgsty.com/
+icon: https://silo.pgsty.com/img/silo.svg
+sources:
+- https://github.com/pgsty/minio
+maintainers:
+- name: Pigsty
+  url: https://pigsty.io

helm/silo/README.md

@@ -0,0 +1,141 @@
+# Silo Helm Chart
+
+This chart installs Silo, an independently maintained, S3-compatible object
+storage server, on Kubernetes. It supports standalone and distributed modes.
+The chart and server are licensed under AGPL-3.0-or-later.
+
+## Prerequisites
+
+- Kubernetes 1.19 or later
+- Helm 3
+- A PersistentVolume provisioner unless `persistence.enabled=false`
+
+## Install
+
+From this repository:
+
+```bash
+helm install silo ./helm/silo \
+  --namespace silo --create-namespace \
+  --set rootUser=silo-admin \
+  --set rootPassword='replace-with-a-long-random-secret'
+```
+
+For a disposable standalone installation:
+
+```bash
+helm install silo ./helm/silo \
+  --namespace silo --create-namespace \
+  --set mode=standalone \
+  --set replicas=1 \
+  --set persistence.enabled=false \
+  --set resources.requests.memory=512Mi \
+  --set rootUser=silo-admin \
+  --set rootPassword='replace-with-a-long-random-secret'
+```
+
+The default server and post-install image is `docker.io/pgsty/silo`. The image
+contains the `silo` server, `mcli`, and an `mc` compatibility symlink. It does
+not contain a `minio` server binary.
+
+## Compatibility contract
+
+The product and delivery names are Silo, while established interfaces remain
+compatible:
+
+- `MINIO_*` environment variables and existing values keys are unchanged.
+- `/minio/*` API and metrics routes are unchanged.
+- `minio_*` Prometheus metrics and `x-minio-*` protocol headers are unchanged.
+- Existing storage, including `.minio.sys`, is used without conversion.
+- `nameOverride`, `fullnameOverride`, and `serviceAccount.name` can pin existing
+  Kubernetes resource identities during an upgrade.
+
+New installations default to Silo resource names and the `silo-sa` service
+account.
+
+## Upgrade an existing release
+
+Do not upgrade an existing release without first pinning its current resource
+names. Export the complete values and render the candidate chart offline:
+
+```bash
+helm get values my-release -n my-namespace -a > values.before-silo.yaml
+SILO_TAG='<published-silo-release-tag>'
+
+helm template my-release ./helm/silo \
+  -n my-namespace \
+  -f values.before-silo.yaml \
+  --set nameOverride=minio \
+  --set fullnameOverride=my-existing-fullname \
+  --set serviceAccount.name=minio-sa \
+  --set image.repository=pgsty/silo \
+  --set mcImage.repository=pgsty/silo \
+  --set-string image.tag="${SILO_TAG}" \
+  --set-string mcImage.tag="${SILO_TAG}" \
+  > rendered.silo.yaml
+```
+
+Compare the old and new manifests. Stop if the candidate changes immutable
+selectors, StatefulSet or Service identity, PVC names, Secrets, or storage
+mounts. After review, upgrade the chart and image together:
+
+```bash
+SILO_TAG='<published-silo-release-tag>'
+helm upgrade my-release ./helm/silo \
+  -n my-namespace \
+  -f values.before-silo.yaml \
+  --set nameOverride=minio \
+  --set fullnameOverride=my-existing-fullname \
+  --set serviceAccount.name=minio-sa \
+  --set image.repository=pgsty/silo \
+  --set mcImage.repository=pgsty/silo \
+  --set-string image.tag="${SILO_TAG}" \
+  --set-string mcImage.tag="${SILO_TAG}"
+```
+
+Rollback is chart-level: use `helm rollback`, not an image-only downgrade. The
+new chart invokes `silo server`; an old image does not provide that executable.
+The new image accepts a legacy first argv token of `minio` only to support old
+chart commands during the forward migration.
+
+## Persistence and TLS
+
+The default PersistentVolumeClaim mounts at `/export`. Use an existing claim
+with:
+
+```bash
+helm install silo ./helm/silo --set persistence.existingClaim=PVC_NAME
+```
+
+Create a TLS Secret containing `private.key` and `public.crt`, then set:
+
+```bash
+helm upgrade --install silo ./helm/silo \
+  --set tls.enabled=true \
+  --set tls.certSecret=silo-tls
+```
+
+Additional trusted CAs can be supplied through `trustedCertsSecret`.
+
+## Existing Secrets and post-install resources
+
+Set `existingSecret` to a Secret containing `rootUser` and `rootPassword`.
+Buckets, users, policies, service accounts, and custom commands can be created
+with the existing `buckets`, `users`, `policies`, `svcaccts`, and
+`customCommands` values. The post-install job uses `mcli` through its `mc`
+compatibility command. New custom commands should target `mysilo`; the legacy
+`myminio` target remains registered so existing values continue to work.
+
+## Configuration
+
+See [values.yaml](./values.yaml) for the complete values surface and the
+[Silo documentation](https://silo.pgsty.com/) for server operations.
+
+To uninstall the chart:
+
+```bash
+helm uninstall silo -n silo
+```
+
+PersistentVolumeClaims may remain after uninstall; inspect them before any
+manual deletion.

helm/silo/templates/NOTES.txt

@@ -0,0 +1,43 @@
+{{- if eq .Values.service.type "ClusterIP" "NodePort" }}
+Silo can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster:
+{{ template "silo.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.clusterDomain }}
+
+To access Silo from localhost, run the below commands:
+
+  1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+
+  2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }}
+
+Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/
+
+You can now access Silo server on http://localhost:9000. Follow the below steps to connect to Silo server with mc client:
+
+  1. Download the Silo mc client - https://silo.pgsty.com/reference/minio-mc/#quickstart
+
+  2. export MC_HOST_{{ template "silo.fullname" . }}_local=http://$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "silo.secretName" . }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "silo.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@localhost:{{ .Values.service.port }}
+
+  3. mc ls {{ template "silo.fullname" . }}_local
+
+{{- end }}
+{{- if eq .Values.service.type "LoadBalancer" }}
+Silo can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by:
+kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "silo.fullname" . }}
+
+Note that the public IP may take a couple of minutes to be available.
+
+You can now access Silo server on http://<External-IP>:9000. Follow the below steps to connect to Silo server with mc client:
+
+  1. Download the Silo mc client - https://silo.pgsty.com/reference/minio-mc/#quickstart
+
+  2. export MC_HOST_{{ template "silo.fullname" . }}_local=http://$(kubectl get secret {{ template "silo.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret {{ template "silo.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@<External-IP>:{{ .Values.service.port }}
+
+  3. mc ls {{ template "silo.fullname" . }}
+
+Alternately, use a browser, an S3 SDK, or a MinIO-compatible SDK to access Silo - https://silo.pgsty.com/reference/minio-server/minio-server/
+{{- end }}
+
+{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}
+Note: Since NetworkPolicy is enabled, only pods with label
+{{ template "silo.fullname" . }}-client=true"
+will be able to connect to this Silo cluster.
+{{- end }}

helm/silo/templates/_helper_create_bucket.txt

@@ -0,0 +1,123 @@
+#!/bin/sh
+set -e # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# connectToSilo
+# Use a check-sleep-check loop to wait for Silo service to be available
+connectToSilo() {
+	SCHEME=$1
+	ATTEMPTS=0
+	LIMIT=29 # Allow 30 attempts
+	set -e   # fail if we can't read the keys.
+	ACCESS=$(cat /config/rootUser)
+	SECRET=$(cat /config/rootPassword)
+	set +e # The connections to Silo are allowed to fail.
+	echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT"
+	MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET"
+	$MC_COMMAND
+	STATUS=$?
+	until [ $STATUS = 0 ]; do
+		ATTEMPTS=$(expr $ATTEMPTS + 1)
+		echo \"Failed attempts: $ATTEMPTS\"
+		if [ $ATTEMPTS -gt $LIMIT ]; then
+			exit 1
+		fi
+		sleep 2 # 1 second intervals between attempts
+		$MC_COMMAND
+		STATUS=$?
+	done
+	set -e # reset `e` as active
+	return 0
+}
+
+# checkBucketExists ($bucket)
+# Check if the bucket exists, by using the exit code of `mc ls`
+checkBucketExists() {
+	BUCKET=$1
+	CMD=$(${MC} stat mysilo/$BUCKET >/dev/null 2>&1)
+	return $?
+}
+
+# createBucket ($bucket, $policy, $purge)
+# Ensure bucket exists, purging if asked to
+createBucket() {
+	BUCKET=$1
+	POLICY=$2
+	PURGE=$3
+	VERSIONING=$4
+	OBJECTLOCKING=$5
+
+	# Purge the bucket, if set & exists
+	# Since PURGE is user input, check explicitly for `true`
+	if [ $PURGE = true ]; then
+		if checkBucketExists $BUCKET; then
+			echo "Purging bucket '$BUCKET'."
+			set +e # don't exit if this fails
+			${MC} rm -r --force mysilo/$BUCKET
+			set -e # reset `e` as active
+		else
+			echo "Bucket '$BUCKET' does not exist, skipping purge."
+		fi
+	fi
+
+	# Create the bucket if it does not exist and set objectlocking if enabled (NOTE: versioning will be not changed if OBJECTLOCKING is set because it enables versioning to the Buckets created)
+	if ! checkBucketExists $BUCKET; then
+		if [ ! -z $OBJECTLOCKING ]; then
+			if [ $OBJECTLOCKING = true ]; then
+				echo "Creating bucket with OBJECTLOCKING '$BUCKET'"
+				${MC} mb --with-lock mysilo/$BUCKET
+			elif [ $OBJECTLOCKING = false ]; then
+				echo "Creating bucket '$BUCKET'"
+				${MC} mb mysilo/$BUCKET
+			fi
+		elif [ -z $OBJECTLOCKING ]; then
+			echo "Creating bucket '$BUCKET'"
+			${MC} mb mysilo/$BUCKET
+		else
+			echo "Bucket '$BUCKET' already exists."
+		fi
+	fi
+
+	# set versioning for bucket if objectlocking is disabled or not set
+	if [ $OBJECTLOCKING = false ]; then
+		if [ ! -z $VERSIONING ]; then
+			if [ $VERSIONING = true ]; then
+				echo "Enabling versioning for '$BUCKET'"
+				${MC} version enable mysilo/$BUCKET
+			elif [ $VERSIONING = false ]; then
+				echo "Suspending versioning for '$BUCKET'"
+				${MC} version suspend mysilo/$BUCKET
+			fi
+		else
+		    echo "No versioning action for '$BUCKET'" 
+		fi
+	else
+		echo "Bucket '$BUCKET' versioning unchanged."
+	fi
+
+	# At this point, the bucket should exist, skip checking for existence
+	# Set policy on the bucket
+	echo "Setting policy of bucket '$BUCKET' to '$POLICY'."
+	${MC} anonymous set $POLICY mysilo/$BUCKET
+}
+
+# Try connecting to Silo instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToSilo $scheme
+
+{{ if .Values.buckets }}
+{{ $global := . }}
+# Create the buckets
+{{- range .Values.buckets }}
+createBucket {{ tpl .name $global }} {{ .policy | default "none" | quote }} {{ .purge | default false }} {{ .versioning | default "" }} {{ .objectlocking | default false }}{{- end }}
+{{- end }}

helm/silo/templates/_helper_create_policy.txt

@@ -0,0 +1,75 @@
+#!/bin/sh
+set -e ; # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# connectToSilo
+# Use a check-sleep-check loop to wait for Silo service to be available
+connectToSilo() {
+  SCHEME=$1
+  ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
+  set -e ; # fail if we can't read the keys.
+  ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
+  set +e ; # The connections to Silo are allowed to fail.
+  echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
+  MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
+  $MC_COMMAND ;
+  STATUS=$? ;
+  until [ $STATUS = 0 ]
+  do
+    ATTEMPTS=`expr $ATTEMPTS + 1` ;
+    echo \"Failed attempts: $ATTEMPTS\" ;
+    if [ $ATTEMPTS -gt $LIMIT ]; then
+      exit 1 ;
+    fi ;
+    sleep 2 ; # 1 second intervals between attempts
+    $MC_COMMAND ;
+    STATUS=$? ;
+  done ;
+  set -e ; # reset `e` as active
+  return 0
+}
+
+# checkPolicyExists ($policy)
+# Check if the policy exists, by using the exit code of `mc admin policy info`
+checkPolicyExists() {
+  POLICY=$1
+  CMD=$(${MC} admin policy info mysilo $POLICY > /dev/null 2>&1)
+  return $?
+}
+
+# createPolicy($name, $filename)
+createPolicy () {
+  NAME=$1
+  FILENAME=$2
+
+  # Create the name if it does not exist
+  echo "Checking policy: $NAME (in /config/$FILENAME.json)"
+  if ! checkPolicyExists $NAME ; then
+    echo "Creating policy '$NAME'"
+  else
+    echo "Policy '$NAME' already exists."
+  fi
+  ${MC} admin policy create mysilo $NAME /config/$FILENAME.json
+
+}
+
+# Try connecting to Silo instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToSilo $scheme
+
+{{ if .Values.policies }}
+# Create the policies
+{{- range $idx, $policy := .Values.policies }}
+createPolicy {{ $policy.name }} policy_{{ $idx }}
+{{- end }}
+{{- end }}

helm/silo/templates/_helper_create_svcacct.txt

@@ -0,0 +1,106 @@
+#!/bin/sh
+set -e ; # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters.
+# Special characters for example : ',",<,>,{,}
+MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_svcacct_tmp"
+
+# connectToSilo
+# Use a check-sleep-check loop to wait for Silo service to be available
+connectToSilo() {
+  SCHEME=$1
+  ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
+  set -e ; # fail if we can't read the keys.
+  ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
+  set +e ; # The connections to Silo are allowed to fail.
+  echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
+  MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
+  $MC_COMMAND ;
+  STATUS=$? ;
+  until [ $STATUS = 0 ]
+  do
+    ATTEMPTS=`expr $ATTEMPTS + 1` ;
+    echo \"Failed attempts: $ATTEMPTS\" ;
+    if [ $ATTEMPTS -gt $LIMIT ]; then
+      exit 1 ;
+    fi ;
+    sleep 2 ; # 2 second intervals between attempts
+    $MC_COMMAND ;
+    STATUS=$? ;
+  done ;
+  set -e ; # reset `e` as active
+  return 0
+}
+
+# checkSvcacctExists ()
+# Check if the svcacct exists, by using the exit code of `mc admin user svcacct info`
+checkSvcacctExists() {
+  CMD=$(${MC} admin user svcacct info mysilo $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
+  return $?
+}
+
+# createSvcacct ($user)
+createSvcacct () {
+  USER=$1
+  FILENAME=$2
+  #check accessKey_and_secretKey_tmp file
+  if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then
+    echo "credentials file does not exist"
+    return 1
+  fi
+  if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then
+    echo "credentials file is invalid"
+    rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
+    return 1
+  fi
+  SVCACCT=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP)
+  # Create the svcacct if it does not exist
+  if ! checkSvcacctExists ; then
+    echo "Creating svcacct '$SVCACCT'"
+    # Check if policy file is define
+    if [ -z $FILENAME ]; then
+      ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) mysilo $USER
+    else
+      ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --policy /config/$FILENAME.json mysilo $USER
+    fi
+  else
+    echo "Svcacct '$SVCACCT' already exists."
+  fi
+  #clean up credentials files.
+  rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
+}
+
+# Try connecting to Silo instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToSilo $scheme
+
+{{ if .Values.svcaccts }}
+{{ $global := . }}
+# Create the svcaccts
+{{- range $idx, $svc := .Values.svcaccts }}
+echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP
+{{- if .existingSecret }}
+cat /config/secrets-svc/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+# Add a new line if it doesn't exist
+echo >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+{{ else }}
+echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+{{- end }}
+{{- if $svc.policy}}
+createSvcacct {{ .user }} svc_policy_{{ $idx }}
+{{ else }}
+createSvcacct {{ .user }}
+{{- end }}
+{{- end }}
+{{- end }}

helm/silo/templates/_helper_create_user.txt

@@ -0,0 +1,107 @@
+#!/bin/sh
+set -e ; # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters.
+# Special characters for example : ',",<,>,{,}
+MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_tmp"
+
+# connectToSilo
+# Use a check-sleep-check loop to wait for Silo service to be available
+connectToSilo() {
+  SCHEME=$1
+  ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
+  set -e ; # fail if we can't read the keys.
+  ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
+  set +e ; # The connections to Silo are allowed to fail.
+  echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
+  MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
+  $MC_COMMAND ;
+  STATUS=$? ;
+  until [ $STATUS = 0 ]
+  do
+    ATTEMPTS=`expr $ATTEMPTS + 1` ;
+    echo \"Failed attempts: $ATTEMPTS\" ;
+    if [ $ATTEMPTS -gt $LIMIT ]; then
+      exit 1 ;
+    fi ;
+    sleep 2 ; # 1 second intervals between attempts
+    $MC_COMMAND ;
+    STATUS=$? ;
+  done ;
+  set -e ; # reset `e` as active
+  return 0
+}
+
+# checkUserExists ()
+# Check if the user exists, by using the exit code of `mc admin user info`
+checkUserExists() {
+  CMD=$(${MC} admin user info mysilo $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
+  return $?
+}
+
+# createUser ($policy)
+createUser() {
+  POLICY=$1
+  #check accessKey_and_secretKey_tmp file
+  if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then
+    echo "credentials file does not exist"
+    return 1
+  fi
+  if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then
+    echo "credentials file is invalid"
+    rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
+    return 1
+  fi
+  USER=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP)
+  # Create the user if it does not exist
+  if ! checkUserExists ; then
+    echo "Creating user '$USER'"
+    cat $MINIO_ACCESSKEY_SECRETKEY_TMP | ${MC} admin user add mysilo
+  else
+    echo "User '$USER' already exists."
+  fi
+  #clean up credentials files.
+  rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
+
+  # set policy for user
+  if [ ! -z $POLICY -a $POLICY != " " ] ; then
+      echo "Adding policy '$POLICY' for '$USER'"
+      set +e ; # policy already attach errors out, allow it.
+      ${MC} admin policy attach mysilo $POLICY --user=$USER
+      set -e
+  else
+      echo "User '$USER' has no policy attached."
+  fi
+}
+
+# Try connecting to Silo instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToSilo $scheme
+
+{{ if .Values.users }}
+{{ $global := . }}
+# Create the users
+{{- range .Values.users }}
+echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP
+{{- if .existingSecret }}
+cat /config/secrets/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+# Add a new line if it doesn't exist
+echo >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+createUser {{ .policy }}
+{{ else }}
+echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+createUser {{ .policy }}
+{{- end }}
+{{- end }}
+{{- end }}

helm/silo/templates/_helper_custom_command.txt

@@ -0,0 +1,61 @@
+#!/bin/sh
+set -e ; # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# connectToSilo
+# Use a check-sleep-check loop to wait for Silo service to be available
+connectToSilo() {
+  SCHEME=$1
+  ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
+  set -e ; # fail if we can't read the keys.
+  ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
+  set +e ; # The connections to Silo are allowed to fail.
+  echo "Connecting to Silo server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
+  MC_COMMAND="${MC} alias set mysilo $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
+  $MC_COMMAND ;
+  STATUS=$? ;
+  until [ $STATUS = 0 ]
+  do
+    ATTEMPTS=`expr $ATTEMPTS + 1` ;
+    echo \"Failed attempts: $ATTEMPTS\" ;
+    if [ $ATTEMPTS -gt $LIMIT ]; then
+      exit 1 ;
+    fi ;
+    sleep 2 ; # 1 second intervals between attempts
+    $MC_COMMAND ;
+    STATUS=$? ;
+  done ;
+  set -e ; # reset `e` as active
+  # Keep the legacy target for existing customCommands values while making
+  # mysilo the preferred target for new installations.
+  ${MC} alias set myminio "$SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" "$ACCESS" "$SECRET" ;
+  return 0
+}
+
+# runCommand ($@)
+# Run custom mc command
+runCommand() {
+  ${MC} "$@"
+  return $?
+}
+
+# Try connecting to Silo instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToSilo $scheme
+
+{{ if .Values.customCommands }}
+# Run custom commands
+{{- range .Values.customCommands }}
+runCommand {{ .command }}
+{{- end }}
+{{- end }}

helm/silo/templates/_helper_policy.tpl

@@ -0,0 +1,28 @@
+{{- $statements_length := len .statements -}}
+{{- $statements_length := sub $statements_length 1 -}}
+{
+  "Version": "2012-10-17",
+  "Statement": [
+{{- range $i, $statement := .statements }}
+    {
+      "Effect": "{{ $statement.effect | default "Allow" }}",
+      "Action": [
+"{{ $statement.actions | join "\",\n\"" }}"
+      ]{{ if $statement.resources }},
+      "Resource": [
+"{{ $statement.resources | join "\",\n\"" }}"
+      ]{{ end }}
+{{- if $statement.conditions }}
+{{- $condition_len := len $statement.conditions }}
+{{- $condition_len := sub $condition_len 1 }}
+      ,
+      "Condition": {
+ {{- range $k,$v := $statement.conditions }}
+ {{- range $operator,$object := $v }}
+        "{{ $operator }}": { {{ $object }} }{{- if lt $k $condition_len }},{{- end }}
+ {{- end }}{{- end }}
+      }{{- end }}
+    }{{ if lt $i $statements_length }},{{end }}
+{{- end }}
+  ]
+}

helm/silo/templates/_helpers.tpl

@@ -0,0 +1,216 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "silo.name" -}}
+  {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "silo.fullname" -}}
+  {{- if .Values.fullnameOverride -}}
+    {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+  {{- else -}}
+    {{- $name := default .Chart.Name .Values.nameOverride -}}
+    {{- if contains $name .Release.Name -}}
+      {{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+    {{- else -}}
+      {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "silo.chart" -}}
+  {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Return the appropriate apiVersion for networkpolicy.
+*/}}
+{{- define "silo.networkPolicy.apiVersion" -}}
+  {{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}}
+    {{- print "extensions/v1beta1" -}}
+  {{- else if semverCompare ">=1.7-0, <1.16-0" .Capabilities.KubeVersion.Version -}}
+    {{- print "networking.k8s.io/v1beta1" -}}
+  {{- else if semverCompare "^1.16-0" .Capabilities.KubeVersion.Version -}}
+    {{- print "networking.k8s.io/v1" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Return the appropriate apiVersion for deployment.
+*/}}
+{{- define "silo.deployment.apiVersion" -}}
+  {{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}}
+    {{- print "apps/v1beta2" -}}
+  {{- else -}}
+    {{- print "apps/v1" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Return the appropriate apiVersion for statefulset.
+*/}}
+{{- define "silo.statefulset.apiVersion" -}}
+  {{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}}
+    {{- print "apps/v1beta2" -}}
+  {{- else -}}
+    {{- print "apps/v1" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Return the appropriate apiVersion for ingress.
+*/}}
+{{- define "silo.ingress.apiVersion" -}}
+  {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+    {{- print "extensions/v1beta1" -}}
+  {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+    {{- print "networking.k8s.io/v1beta1" -}}
+  {{- else -}}
+    {{- print "networking.k8s.io/v1" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Return the appropriate apiVersion for console ingress.
+*/}}
+{{- define "silo.consoleIngress.apiVersion" -}}
+  {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+    {{- print "extensions/v1beta1" -}}
+  {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+    {{- print "networking.k8s.io/v1beta1" -}}
+  {{- else -}}
+    {{- print "networking.k8s.io/v1" -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Determine secret name.
+*/}}
+{{- define "silo.secretName" -}}
+  {{- if .Values.existingSecret -}}
+    {{- .Values.existingSecret }}
+  {{- else -}}
+    {{- include "silo.fullname" . -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Determine name for scc role and rolebinding
+*/}}
+{{- define "silo.sccRoleName" -}}
+  {{- printf "%s-%s" "scc" (include "silo.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Properly format optional additional arguments to Silo binary
+*/}}
+{{- define "silo.extraArgs" -}}
+{{- range .Values.extraArgs -}}
+{{ " " }}{{ . }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the proper Docker Image Registry Secret Names
+*/}}
+{{- define "silo.imagePullSecrets" -}}
+{{/*
+Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
+but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic.
+Also, we can not use a single if because lazy evaluation is not an option
+*/}}
+{{- if .Values.global }}
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+    {{ toYaml .Values.global.imagePullSecrets }}
+{{- else if .Values.imagePullSecrets }}
+imagePullSecrets:
+    {{ toYaml .Values.imagePullSecrets }}
+{{- end -}}
+{{- else if .Values.imagePullSecrets }}
+imagePullSecrets:
+    {{ toYaml .Values.imagePullSecrets }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Formats volumeMount for Silo TLS keys and trusted certs
+*/}}
+{{- define "silo.tlsKeysVolumeMount" -}}
+{{- if .Values.tls.enabled }}
+- name: cert-secret-volume
+  mountPath: {{ .Values.certsPath }}
+{{- end }}
+{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }}
+{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }}
+- name: trusted-cert-secret-volume
+  mountPath: {{ $casPath }}
+{{- end }}
+{{- end -}}
+
+{{/*
+Formats volume for Silo TLS keys and trusted certs
+*/}}
+{{- define "silo.tlsKeysVolume" -}}
+{{- if .Values.tls.enabled }}
+- name: cert-secret-volume
+  secret:
+    secretName: {{ tpl .Values.tls.certSecret $ }}
+    items:
+    - key: {{ .Values.tls.publicCrt }}
+      path: public.crt
+    - key: {{ .Values.tls.privateKey }}
+      path: private.key
+{{- end }}
+{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }}
+{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }}
+{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }}
+- name: trusted-cert-secret-volume
+  secret:
+    secretName: {{ $certSecret }}
+    {{- if ne $publicCrt "" }}
+    items:
+    - key: {{ $publicCrt }}
+      path: public.crt
+    {{- end }}
+{{- end }}
+{{- end -}}
+
+{{/*
+Returns the available value for certain key in an existing secret (if it exists),
+otherwise it generates a random value.
+*/}}
+{{- define "silo.getValueFromSecret" }}
+  {{- $len := (default 16 .Length) | int -}}
+  {{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}}
+  {{- if $obj }}
+    {{- index $obj .Key | b64dec -}}
+  {{- else -}}
+    {{- randAlphaNum $len -}}
+  {{- end -}}
+{{- end }}
+
+{{- define "silo.root.username" -}}
+  {{- if .Values.rootUser }}
+    {{- .Values.rootUser | toString }}
+  {{- else }}
+    {{- include "silo.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "silo.fullname" .) "Length" 20 "Key" "rootUser") }}
+  {{- end }}
+{{- end -}}
+
+{{- define "silo.root.password" -}}
+  {{- if .Values.rootPassword }}
+    {{- .Values.rootPassword | toString }}
+  {{- else }}
+    {{- include "silo.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "silo.fullname" .) "Length" 40 "Key" "rootPassword") }}
+  {{- end }}
+{{- end -}}

helm/silo/templates/ciliumnetworkpolicy.yaml

@@ -0,0 +1,33 @@
+{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "cilium") }}
+kind: CiliumNetworkPolicy
+apiVersion: cilium.io/v2
+metadata:
+  name: {{ template "silo.fullname" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  endpointSelector:
+    matchLabels:
+      app: {{ template "silo.name" . }}
+      release: {{ .Release.Name }}
+  ingress:
+  - toPorts:
+    - ports:
+      - port: "{{ .Values.minioAPIPort }}"
+        protocol: TCP
+      - port: "{{ .Values.minioConsolePort }}"
+        protocol: TCP
+    {{- if not .Values.networkPolicy.allowExternal }}
+    fromEndpoints:
+    - matchLabels:
+        {{ template "silo.name" . }}-client: "true"
+    {{- end }}
+  egress:
+  {{- range $entity := .Values.networkPolicy.egressEntities }}
+  - toEntities:
+    - {{ $entity }}
+  {{- end }}
+{{- end }}

helm/silo/templates/configmap.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "silo.fullname" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  initialize: |-
+    {{- include (print $.Template.BasePath "/_helper_create_bucket.txt") . | nindent 4 }}
+  add-user: |-
+    {{- include (print $.Template.BasePath "/_helper_create_user.txt") . | nindent 4 }}
+  add-policy: |-
+    {{- include (print $.Template.BasePath "/_helper_create_policy.txt") . | nindent 4 }}
+  {{- range $idx, $policy := .Values.policies }}
+  # Policy: {{ $policy.name }}
+  policy_{{ $idx }}.json: |-
+    {{- include (print $.Template.BasePath "/_helper_policy.tpl") . | nindent 4 }}
+  {{ end }}
+  {{- range $idx, $svc := .Values.svcaccts }}
+  {{- if $svc.policy }}
+  # SVC: {{ $svc.accessKey }}
+  svc_policy_{{ $idx }}.json: |-
+    {{- include (print $.Template.BasePath "/_helper_policy.tpl") .policy | nindent 4 }}
+  {{- end }}
+  {{- end }}
+  add-svcacct: |-
+    {{- include (print $.Template.BasePath "/_helper_create_svcacct.txt") . | nindent 4 }}
+  custom-command: |-
+    {{- include (print $.Template.BasePath "/_helper_custom_command.txt") . | nindent 4 }}

helm/silo/templates/console-ingress.yaml

@@ -0,0 +1,55 @@
+{{- if .Values.consoleIngress.enabled -}}
+{{- $fullName := printf "%s-console" (include "silo.fullname" .) -}}
+{{- $servicePort := .Values.consoleService.port -}}
+{{- $ingressPath := .Values.consoleIngress.path -}}
+apiVersion: {{ template "silo.consoleIngress.apiVersion" . }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- with .Values.consoleIngress.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.consoleIngress.annotations }}
+  annotations: {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.consoleIngress.ingressClassName }}
+  ingressClassName: {{ .Values.consoleIngress.ingressClassName }}
+  {{- end }}
+  {{- if .Values.consoleIngress.tls }}
+  tls:
+    {{- range .Values.consoleIngress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.consoleIngress.hosts }}
+    - http:
+        paths:
+          - path: {{ $ingressPath }}
+            {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $fullName }}
+                port: 
+                  number: {{ $servicePort }}
+            {{- else }}
+            backend:
+              serviceName: {{ $fullName }}
+              servicePort: {{ $servicePort }}
+            {{- end }}
+      {{- if . }}
+      host: {{ tpl . $ | quote }}
+      {{- end }}
+    {{- end }}
+{{- end }}

helm/silo/templates/console-service.yaml

@@ -0,0 +1,45 @@
+{{ $scheme := .Values.tls.enabled | ternary "https" "http" }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "silo.fullname" . }}-console
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  {{- if .Values.consoleService.annotations }}
+  annotations: {{- toYaml .Values.consoleService.annotations | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.consoleService.type }}
+  {{- if and (eq .Values.consoleService.type "ClusterIP") .Values.consoleService.clusterIP }}
+  clusterIP: {{ .Values.consoleService.clusterIP }}
+  {{- end }}
+  {{- if or (eq .Values.consoleService.type "LoadBalancer") (eq .Values.consoleService.type "NodePort") }}
+  externalTrafficPolicy: {{ .Values.consoleService.externalTrafficPolicy | quote }}
+  {{- end }}
+  {{- if and (eq .Values.consoleService.type "LoadBalancer") .Values.consoleService.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges: {{ .Values.consoleService.loadBalancerSourceRanges }}
+  {{ end }}
+  {{- if and (eq .Values.consoleService.type "LoadBalancer") (not (empty .Values.consoleService.loadBalancerIP)) }}
+  loadBalancerIP: {{ .Values.consoleService.loadBalancerIP }}
+  {{- end }}
+  ports:
+    - name: {{ $scheme }}
+      port: {{ .Values.consoleService.port }}
+      protocol: TCP
+      {{- if (and (eq .Values.consoleService.type "NodePort") ( .Values.consoleService.nodePort)) }}
+      nodePort: {{ .Values.consoleService.nodePort }}
+      {{- else }}
+      targetPort: {{ .Values.minioConsolePort }}
+      {{- end }}
+  {{- if .Values.consoleService.externalIPs }}
+  externalIPs:
+    {{- range $i , $ip := .Values.consoleService.externalIPs }}
+    - {{ $ip }}
+    {{- end }}
+  {{- end }}
+  selector:
+    app: {{ template "silo.name" . }}
+    release: {{ .Release.Name }}

helm/silo/templates/deployment.yaml

@@ -0,0 +1,213 @@
+{{- if eq .Values.mode "standalone" }}
+{{ $scheme := .Values.tls.enabled | ternary "https" "http" }}
+{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }}
+apiVersion: {{ template "silo.deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+  name: {{ template "silo.fullname" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- if .Values.additionalLabels }}
+      {{- toYaml .Values.additionalLabels | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }}
+  {{- end }}
+spec:
+  strategy:
+    type: {{ .Values.deploymentUpdate.type }}
+    {{- if eq .Values.deploymentUpdate.type "RollingUpdate" }}
+    rollingUpdate:
+      maxSurge: {{ .Values.deploymentUpdate.maxSurge }}
+      maxUnavailable: {{ .Values.deploymentUpdate.maxUnavailable }}
+    {{- end }}
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ template "silo.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      name: {{ template "silo.fullname" . }}
+      labels:
+        app: {{ template "silo.name" . }}
+        release: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+          {{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+        {{- if not .Values.ignoreChartChecksums }}
+        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if .Values.podAnnotations }}
+          {{- toYaml .Values.podAnnotations | trimSuffix "\n" | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- if .Values.priorityClassName }}
+      priorityClassName: "{{ .Values.priorityClassName }}"
+      {{- end }}
+      {{- if .Values.runtimeClassName }}
+      runtimeClassName: "{{ .Values.runtimeClassName }}"
+      {{- end }}
+      {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
+      securityContext:
+        {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      {{ if .Values.serviceAccount.create }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+      {{- end }}
+      containers:
+        - name: {{ include "silo.name" . }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            - "/bin/sh"
+            - "-ce"
+            - "/usr/bin/docker-entrypoint.sh silo server {{ $bucketRoot }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template "silo.extraArgs" . }}"
+          volumeMounts:
+            - name: silo-user
+              mountPath: "/tmp/credentials"
+              readOnly: true
+            - name: export
+              mountPath: {{ .Values.mountPath }}
+              {{- if and .Values.persistence.enabled .Values.persistence.subPath }}
+              subPath: "{{ .Values.persistence.subPath }}"
+              {{- end }}
+            {{- if .Values.extraSecret }}
+            - name: extra-secret
+              mountPath: "/tmp/silo-config-env"
+            {{- end }}
+            {{- include "silo.tlsKeysVolumeMount" . | indent 12 }}
+            {{- if .Values.extraVolumeMounts }}
+              {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+            {{- end }}
+          ports:
+            - name: {{ $scheme }}
+              containerPort: {{ .Values.minioAPIPort }}
+            - name: {{ $scheme }}-console
+              containerPort: {{ .Values.minioConsolePort }}
+          env:
+            - name: MINIO_ROOT_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "silo.secretName" . }}
+                  key: rootUser
+            - name: MINIO_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "silo.secretName" . }}
+                  key: rootPassword
+            {{- if .Values.extraSecret }}
+            - name: MINIO_CONFIG_ENV_FILE
+              value: "/tmp/silo-config-env/config.env"
+            {{- end }}
+            {{- if .Values.metrics.serviceMonitor.public }}
+            - name: MINIO_PROMETHEUS_AUTH_TYPE
+              value: "public"
+            {{- end }}
+            {{- if .Values.oidc.enabled }}
+            - name: MINIO_IDENTITY_OPENID_CONFIG_URL
+              value: {{ .Values.oidc.configUrl }}
+            - name: MINIO_IDENTITY_OPENID_CLIENT_ID
+            {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientIdKey }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.oidc.existingClientSecretName }}
+                  key: {{ .Values.oidc.existingClientIdKey }}
+            {{- else }}
+              value: {{ .Values.oidc.clientId }}
+            {{- end }}
+            - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+            {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientSecretKey }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.oidc.existingClientSecretName }}
+                  key: {{ .Values.oidc.existingClientSecretKey }}
+            {{- else }}
+              value: {{ .Values.oidc.clientSecret }}
+            {{- end }}
+            - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
+              value: {{ .Values.oidc.claimName }}
+            - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX
+              value: {{ .Values.oidc.claimPrefix }}
+            - name: MINIO_IDENTITY_OPENID_SCOPES
+              value: {{ .Values.oidc.scopes }}
+            - name: MINIO_IDENTITY_OPENID_COMMENT
+              value: {{ .Values.oidc.comment }}
+            - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
+              value: {{ .Values.oidc.redirectUri }}
+            - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
+              value: {{ .Values.oidc.displayName }}
+            {{- end }}
+            {{- if .Values.etcd.endpoints }}
+            - name: MINIO_ETCD_ENDPOINTS
+              value: {{ join "," .Values.etcd.endpoints | quote }}
+            {{- if .Values.etcd.clientCert }}
+            - name: MINIO_ETCD_CLIENT_CERT
+              value: "/tmp/credentials/etcd_client_cert.pem"
+            {{- end }}
+            {{- if .Values.etcd.clientCertKey }}
+            - name: MINIO_ETCD_CLIENT_CERT_KEY
+              value: "/tmp/credentials/etcd_client_cert_key.pem"
+            {{- end }}
+            {{- if .Values.etcd.pathPrefix }}
+            - name: MINIO_ETCD_PATH_PREFIX
+              value: {{ .Values.etcd.pathPrefix }}
+            {{- end }}
+            {{- if .Values.etcd.corednsPathPrefix }}
+            - name: MINIO_ETCD_COREDNS_PATH
+              value: {{ .Values.etcd.corednsPathPrefix }}
+            {{- end }}
+            {{- end }}
+            {{- range $key, $val := .Values.environment }}
+            - name: {{ $key }}
+              value: {{ tpl $val $ | quote }}
+            {{- end }}
+          resources: {{- toYaml .Values.resources | nindent 12 }}
+          {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
+          {{- with .Values.containerSecurityContext }}
+          securityContext: {{ toYaml . | nindent 12}}
+          {{- end }}
+          {{- end }}
+        {{- with .Values.extraContainers }}
+          {{- if eq (typeOf .) "string" }}
+            {{- tpl . $ | nindent 8 }}
+          {{- else }}
+            {{- toYaml . | nindent 8 }}
+          {{- end }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- include "silo.imagePullSecrets" . | indent 6 }}
+      {{- with .Values.affinity }}
+      affinity: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: export
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.existingClaim | default (include "silo.fullname" .) }}
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+        {{- if .Values.extraSecret }}
+        - name: extra-secret
+          secret:
+            secretName: {{ .Values.extraSecret }}
+        {{- end }}
+        - name: silo-user
+          secret:
+            secretName: {{ template "silo.secretName" . }}
+        {{- include "silo.tlsKeysVolume" . | indent 8 }}
+        {{- if .Values.extraVolumes }}
+          {{ toYaml .Values.extraVolumes | nindent 8 }}
+        {{- end }}
+{{- end }}

helm/silo/templates/ingress.yaml

@@ -0,0 +1,55 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "silo.fullname" . -}}
+{{- $servicePort := .Values.service.port -}}
+{{- $ingressPath := .Values.ingress.path -}}
+apiVersion: {{ template "silo.ingress.apiVersion" . }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- with .Values.ingress.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.ingress.annotations }}
+  annotations: {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.ingressClassName }}
+  ingressClassName: {{ .Values.ingress.ingressClassName }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+      {{- range .hosts }}
+        - {{ . | quote }}
+      {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - http:
+        paths:
+          - path: {{ $ingressPath }}
+            {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $fullName }}
+                port: 
+                  number: {{ $servicePort }}
+            {{- else }}
+            backend:
+              serviceName: {{ $fullName }}
+              servicePort: {{ $servicePort }}
+            {{- end }}
+      {{- if . }}
+      host: {{ tpl . $ | quote }}
+      {{- end }}
+    {{- end }}
+{{- end }}

helm/silo/templates/networkpolicy.yaml

@@ -0,0 +1,66 @@
+{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "kubernetes") }}
+kind: NetworkPolicy
+apiVersion: {{ template "silo.networkPolicy.apiVersion" . }}
+metadata:
+  name: {{ template "silo.fullname" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  podSelector:
+    matchLabels:
+      app: {{ template "silo.name" . }}
+      release: {{ .Release.Name }}
+  ingress:
+    - ports:
+        - port: {{ .Values.minioAPIPort }}
+          protocol: TCP
+        - port: {{ .Values.minioConsolePort }}
+          protocol: TCP
+      {{- if not .Values.networkPolicy.allowExternal }}
+      from:
+        - podSelector:
+            matchLabels:
+              {{ template "silo.name" . }}-client: "true"
+      {{- end }}
+  {{- if .Values.networkPolicy.egress.enabled }}
+  egress:
+    - ports:
+        {{ .Values.networkPolicy.egress.ports | toJson }}
+      {{- with .Values.networkPolicy.egress.to }}
+      to:
+        {{- toYaml . | nindent 12 }}
+      {{- end }}
+  {{- end }}
+---
+kind: NetworkPolicy
+apiVersion: {{ template "silo.networkPolicy.apiVersion" . }}
+metadata:
+  name: {{ template "silo.fullname" . }}-post-job
+  labels:
+    app: {{ template "silo.name" . }}-post-job
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  podSelector:
+    matchLabels:
+      app: {{ template "silo.name" . }}-job
+      release: {{ .Release.Name }}
+  egress:
+    - ports:
+        - port: {{ .Values.minioAPIPort }}
+          protocol: TCP
+        - port: {{ .Values.minioConsolePort }}
+          protocol: TCP
+    {{- if .Values.networkPolicy.egress.enabled }}
+    - ports:
+        {{ .Values.networkPolicy.egress.ports | toJson }}
+      {{- with .Values.networkPolicy.egress.to }}
+      to:
+        {{- toYaml . | nindent 12 }}
+      {{- end }}
+    {{- end }}
+{{- end }}

helm/silo/templates/poddisruptionbudget.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodDisruptionBudget" }}
+apiVersion: policy/v1beta1
+{{- else }}
+apiVersion: policy/v1
+{{- end }}
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "silo.fullname" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+spec:
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+  selector:
+    matchLabels:
+      app: {{ template "silo.name" . }}
+{{- end }}

helm/silo/templates/post-job.yaml

@@ -0,0 +1,258 @@
+{{- if or .Values.buckets .Values.users .Values.policies .Values.customCommands .Values.svcaccts }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ template "silo.fullname" . }}-post-job
+  labels:
+    app: {{ template "silo.name" . }}-post-job
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": post-install,post-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
+    {{- with .Values.postJob.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  template:
+    metadata:
+      labels:
+        app: {{ template "silo.name" . }}-job
+        release: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+          {{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+      {{- if .Values.postJob.podAnnotations }}
+      annotations: {{- toYaml .Values.postJob.podAnnotations | nindent 8 }}
+      {{- end }}
+    spec:
+      restartPolicy: OnFailure
+      {{- include "silo.imagePullSecrets" . | indent 6 }}
+      {{- if .Values.nodeSelector }}
+      nodeSelector: {{- toYaml .Values.postJob.nodeSelector | nindent 8 }}
+      {{- end }}
+      {{- with .Values.postJob.affinity }}
+      affinity: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.postJob.tolerations }}
+      tolerations: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if .Values.postJob.securityContext.enabled }}
+      securityContext: {{ omit .Values.postJob.securityContext "enabled" | toYaml | nindent 12 }}
+      {{- end }}
+      volumes:
+        - name: etc-path
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+        - name: silo-configuration
+          projected:
+            sources:
+              - configMap:
+                  name: {{ template "silo.fullname" . }}
+              - secret:
+                  name: {{ template "silo.secretName" . }}
+              {{- range (concat .Values.users (default (list) .Values.svcaccts)) }}
+              {{- if .existingSecret }}
+              - secret:
+                  name: {{ tpl .existingSecret $ }}
+                  items:
+                    - key: {{ .existingSecretKey }}
+                      path: secrets/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }}
+              {{- end }}
+              {{- end }}
+              {{- range ( default list .Values.svcaccts ) }}
+              {{- if .existingSecret }}
+              - secret:
+                  name: {{ tpl .existingSecret $ }}
+                  items:
+                    - key: {{ .existingSecretKey }}
+                      path: secrets-svc/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }}
+              {{- end }}
+              {{- end }}
+        {{- if .Values.tls.enabled }}
+        - name: cert-secret-volume-mc
+          secret:
+            secretName: {{ .Values.tls.certSecret }}
+            items:
+              - key: {{ .Values.tls.publicCrt }}
+                path: CAs/public.crt
+        {{- end }}
+        {{- if .Values.customCommandJob.extraVolumes }}
+          {{- toYaml .Values.customCommandJob.extraVolumes | nindent 8 }}
+        {{- end }}
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+      {{- end }}
+      {{- if .Values.policies }}
+      initContainers:
+        - name: silo-make-policy
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+          {{- if .Values.makePolicyJob.securityContext.enabled }}
+          {{- with .Values.makePolicyJob.containerSecurityContext }}
+          securityContext: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+          {{- if .Values.makePolicyJob.exitCommand }}
+          command: [ "/bin/sh", "-c" ]
+          args: [ "/bin/sh /config/add-policy; EV=$?; {{ .Values.makePolicyJob.exitCommand }} && exit $EV" ]
+          {{- else }}
+          command: [ "/bin/sh", "/config/add-policy" ]
+          {{- end }}
+          env:
+            - name: MINIO_ENDPOINT
+              value: {{ template "silo.fullname" . }}
+            - name: MINIO_PORT
+              value: {{ .Values.service.port | quote }}
+          volumeMounts:
+            - name: etc-path
+              mountPath: /etc/silo/mc
+            - name: tmp
+              mountPath: /tmp
+            - name: silo-configuration
+              mountPath: /config
+            {{- if .Values.tls.enabled }}
+            - name: cert-secret-volume-mc
+              mountPath: {{ .Values.configPathmc }}certs
+            {{- end }}
+          resources: {{- toYaml .Values.makePolicyJob.resources | nindent 12 }}
+      {{- end }}
+      containers:
+        {{- if .Values.buckets }}
+        - name: silo-make-bucket
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+          {{- if .Values.makeBucketJob.securityContext.enabled }}
+          {{- with .Values.makeBucketJob.containerSecurityContext }}
+          securityContext: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+          {{- if .Values.makeBucketJob.exitCommand }}
+          command: [ "/bin/sh", "-c" ]
+          args: [ "/bin/sh /config/initialize; EV=$?; {{ .Values.makeBucketJob.exitCommand }} && exit $EV" ]
+          {{- else }}
+          command: [ "/bin/sh", "/config/initialize" ]
+          {{- end }}
+          env:
+            - name: MINIO_ENDPOINT
+              value: {{ template "silo.fullname" . }}
+            - name: MINIO_PORT
+              value: {{ .Values.service.port | quote }}
+          volumeMounts:
+            - name: etc-path
+              mountPath: /etc/silo/mc
+            - name: tmp
+              mountPath: /tmp
+            - name: silo-configuration
+              mountPath: /config
+            {{- if .Values.tls.enabled }}
+            - name: cert-secret-volume-mc
+              mountPath: {{ .Values.configPathmc }}certs
+            {{- end }}
+          resources: {{- toYaml .Values.makeBucketJob.resources | nindent 12 }}
+        {{- end }}
+        {{- if .Values.users }}
+        - name: silo-make-user
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+          {{- if .Values.makeUserJob.securityContext.enabled }}
+          {{- with .Values.makeUserJob.containerSecurityContext }}
+          securityContext: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+          {{- if .Values.makeUserJob.exitCommand }}
+          command: [ "/bin/sh", "-c" ]
+          args: [ "/bin/sh /config/add-user; EV=$?; {{ .Values.makeUserJob.exitCommand }} && exit $EV" ]
+          {{- else }}
+          command: [ "/bin/sh", "/config/add-user" ]
+          {{- end }}
+          env:
+            - name: MINIO_ENDPOINT
+              value: {{ template "silo.fullname" . }}
+            - name: MINIO_PORT
+              value: {{ .Values.service.port | quote }}
+          volumeMounts:
+            - name: etc-path
+              mountPath: /etc/silo/mc
+            - name: tmp
+              mountPath: /tmp
+            - name: silo-configuration
+              mountPath: /config
+            {{- if .Values.tls.enabled }}
+            - name: cert-secret-volume-mc
+              mountPath: {{ .Values.configPathmc }}certs
+            {{- end }}
+          resources: {{- toYaml .Values.makeUserJob.resources | nindent 12 }}
+        {{- end }}
+        {{- if .Values.customCommands }}
+        - name: silo-custom-command
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+          {{- if .Values.customCommandJob.securityContext.enabled }}
+          {{- with .Values.customCommandJob.containerSecurityContext }}
+          securityContext: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+          {{- if .Values.customCommandJob.exitCommand }}
+          command: [ "/bin/sh", "-c" ]
+          args: [ "/bin/sh /config/custom-command; EV=$?; {{ .Values.customCommandJob.exitCommand }} && exit $EV" ]
+          {{- else }}
+          command: [ "/bin/sh", "/config/custom-command" ]
+          {{- end }}
+          env:
+            - name: MINIO_ENDPOINT
+              value: {{ template "silo.fullname" . }}
+            - name: MINIO_PORT
+              value: {{ .Values.service.port | quote }}
+          volumeMounts:
+            - name: etc-path
+              mountPath: /etc/silo/mc
+            - name: tmp
+              mountPath: /tmp
+            - name: silo-configuration
+              mountPath: /config
+            {{- if .Values.tls.enabled }}
+            - name: cert-secret-volume-mc
+              mountPath: {{ .Values.configPathmc }}certs
+            {{- end }}
+            {{- if .Values.customCommandJob.extraVolumeMounts }}
+              {{- toYaml .Values.customCommandJob.extraVolumeMounts | nindent 12 }}
+            {{- end }}
+          resources: {{- toYaml .Values.customCommandJob.resources | nindent 12 }}
+        {{- end }}
+        {{- if .Values.svcaccts }}
+        - name: silo-make-svcacct
+          image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+          {{- if .Values.makeServiceAccountJob.securityContext.enabled }}
+          {{- with .Values.makeServiceAccountJob.containerSecurityContext }}
+          securityContext: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+          {{- if .Values.makeServiceAccountJob.exitCommand }}
+          command: [ "/bin/sh", "-c" ]
+          args: ["/bin/sh /config/add-svcacct; EV=$?; {{ .Values.makeServiceAccountJob.exitCommand }} && exit $EV" ]
+          {{- else }}
+          command: ["/bin/sh", "/config/add-svcacct"]
+          {{- end }}
+          env:
+            - name: MINIO_ENDPOINT
+              value: {{ template "silo.fullname" . }}
+            - name: MINIO_PORT
+              value: {{ .Values.service.port | quote }}
+          volumeMounts:
+            - name: etc-path
+              mountPath: /etc/silo/mc
+            - name: tmp
+              mountPath: /tmp
+            - name: silo-configuration
+              mountPath: /config
+            {{- if .Values.tls.enabled }}
+            - name: cert-secret-volume-mc
+              mountPath: {{ .Values.configPathmc }}certs
+            {{- end }}
+          resources: {{- toYaml .Values.makeServiceAccountJob.resources | nindent 12 }}
+        {{- end }}
+{{- end }}

helm/silo/templates/pvc.yaml

@@ -0,0 +1,32 @@
+{{- if eq .Values.mode "standalone" }}
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ template "silo.fullname" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  {{- if .Values.persistence.annotations }}
+  annotations: {{- toYaml .Values.persistence.annotations | nindent 4 }}
+  {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+  {{- if .Values.persistence.storageClass }}
+  {{- if (eq "-" .Values.persistence.storageClass) }}
+  storageClassName: ""
+  {{- else }}
+  storageClassName: "{{ .Values.persistence.storageClass }}"
+  {{- end }}
+  {{- end }}
+  {{- if .Values.persistence.volumeName }}
+  volumeName: "{{ .Values.persistence.volumeName }}"
+  {{- end }}
+{{- end }}
+{{- end }}

helm/silo/templates/secrets.yaml

@@ -0,0 +1,21 @@
+{{- if not .Values.existingSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "silo.secretName" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+type: Opaque
+data:
+  rootUser: {{ include "silo.root.username" . | b64enc | quote }}
+  rootPassword: {{ include "silo.root.password" . | b64enc | quote }}
+  {{- if .Values.etcd.clientCert }}
+  etcd_client.crt: {{ .Values.etcd.clientCert | toString | b64enc | quote }}
+  {{- end }}
+  {{- if .Values.etcd.clientCertKey }}
+  etcd_client.key: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }}
+  {{- end }}
+{{- end }}

helm/silo/templates/securitycontextconstraints.yaml

@@ -0,0 +1,45 @@
+{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }}
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: {{ template "silo.fullname" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities: []
+readOnlyRootFilesystem: false
+defaultAddCapabilities: []
+requiredDropCapabilities:
+- KILL
+- MKNOD
+- SETUID
+- SETGID
+fsGroup:
+  type: MustRunAs
+  ranges:
+  - max: {{ .Values.securityContext.fsGroup }}
+    min: {{ .Values.securityContext.fsGroup }}
+runAsUser:
+  type: MustRunAs
+  uid: {{ .Values.securityContext.runAsUser }}
+seLinuxContext:
+  type: MustRunAs
+supplementalGroups:
+  type: RunAsAny
+volumes:
+- configMap
+- downwardAPI
+- emptyDir
+- persistentVolumeClaim
+- projected
+- secret
+{{- end }}

helm/silo/templates/service.yaml

@@ -0,0 +1,46 @@
+{{ $scheme := .Values.tls.enabled | ternary "https" "http" }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "silo.fullname" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    monitoring: "true"
+  {{- if .Values.service.annotations }}
+  annotations: {{- toYaml .Values.service.annotations | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if and (eq .Values.service.type "ClusterIP") .Values.service.clusterIP }}
+  clusterIP: {{ .Values.service.clusterIP }}
+  {{- end }}
+  {{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "NodePort") }}
+  externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy | quote }}
+  {{- end }}
+  {{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }}
+  {{ end }}
+  {{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }}
+  loadBalancerIP: {{ default "" .Values.service.loadBalancerIP | quote }}
+  {{- end }}
+  ports:
+    - name: {{ $scheme }}
+      port: {{ .Values.service.port }}
+      protocol: TCP
+      {{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }}
+      nodePort: {{ .Values.service.nodePort }}
+      {{- else }}
+      targetPort: {{ .Values.minioAPIPort }}
+      {{- end }}
+  {{- if .Values.service.externalIPs }}
+  externalIPs:
+    {{- range $i , $ip := .Values.service.externalIPs }}
+    - {{ $ip }}
+    {{- end }}
+  {{- end }}
+  selector:
+    app: {{ template "silo.name" . }}
+    release: {{ .Release.Name }}

helm/silo/templates/serviceaccount.yaml

@@ -0,0 +1,6 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name | quote }}
+{{- end }}

helm/silo/templates/servicemonitor.yaml

@@ -0,0 +1,112 @@
+{{- if and .Values.metrics.serviceMonitor.enabled .Values.metrics.serviceMonitor.includeNode }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "silo.fullname" . }}
+  {{- if .Values.metrics.serviceMonitor.namespace }}
+  namespace: {{ .Values.metrics.serviceMonitor.namespace }}
+  {{- end }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- if .Values.metrics.serviceMonitor.additionalLabels }}
+      {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }}
+    {{- end }}
+  {{- if .Values.metrics.serviceMonitor.annotations }}
+  annotations: {{- toYaml .Values.metrics.serviceMonitor.annotations | nindent 4 }}
+  {{- end }}
+spec:
+  endpoints:
+    {{- if .Values.tls.enabled }}
+    - port: https
+      scheme: https
+      tlsConfig:
+        ca:
+          secret:
+            name: {{ .Values.tls.certSecret }}
+            key: {{ .Values.tls.publicCrt }}
+        serverName: {{ template "silo.fullname" . }}
+    {{- else }}
+    - port: http
+      scheme: http
+    {{- end }}
+      path: /minio/v2/metrics/node
+      {{- if .Values.metrics.serviceMonitor.interval }}
+      interval: {{ .Values.metrics.serviceMonitor.interval }}
+      {{- end }}
+      {{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
+      scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
+      {{- end }}
+      {{- if .Values.metrics.serviceMonitor.relabelConfigs }}
+        {{- toYaml .Values.metrics.serviceMonitor.relabelConfigs | nindent 6 }}
+      {{- end }}
+      {{- if not .Values.metrics.serviceMonitor.public }}
+      bearerTokenSecret:
+        name: {{ template "silo.fullname" . }}-prometheus
+        key: token
+      {{- end }}
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace | quote }}
+  selector:
+    matchLabels:
+      app: {{ include "silo.name" . }}
+      release: {{ .Release.Name }}
+      monitoring: "true"
+{{- end }}
+{{- if .Values.metrics.serviceMonitor.enabled }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: Probe
+metadata:
+  name: {{ template "silo.fullname" . }}-cluster
+  {{- if .Values.metrics.serviceMonitor.namespace }}
+  namespace: {{ .Values.metrics.serviceMonitor.namespace }}
+  {{- end }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- if .Values.metrics.serviceMonitor.additionalLabels }}
+      {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }}
+    {{- end }}
+spec:
+  jobName: {{ template "silo.fullname" . }}
+  {{- if .Values.tls.enabled }}
+  tlsConfig:
+    ca:
+      secret:
+        name: {{ .Values.tls.certSecret }}
+        key: {{ .Values.tls.publicCrt }}
+    serverName: {{ template "silo.fullname" . }}
+  {{- end }}
+  prober:
+    url: {{ template "silo.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}
+    path: /minio/v2/metrics/cluster
+    {{- if .Values.tls.enabled }}
+    scheme: https
+    {{- else }}
+    scheme: http
+    {{- end }}
+  {{- if .Values.metrics.serviceMonitor.relabelConfigsCluster }}
+    {{- toYaml .Values.metrics.serviceMonitor.relabelConfigsCluster | nindent 2 }}
+  {{- end }}
+  targets:
+    staticConfig:
+      static:
+      - {{ template "silo.fullname" . }}.{{ .Release.Namespace }}
+      {{- if not .Values.metrics.serviceMonitor.public }}
+      {{- if .Values.metrics.serviceMonitor.interval }}
+      interval: {{ .Values.metrics.serviceMonitor.interval }}
+      {{- end }}
+      {{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
+      scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
+      {{- end }}
+      bearerTokenSecret:
+        name: {{ template "silo.fullname" . }}-prometheus
+        key: token
+      {{- end }}
+{{- end }}

helm/silo/templates/statefulset.yaml

@@ -0,0 +1,267 @@
+{{- if eq .Values.mode "distributed" }}
+{{ $poolCount := .Values.pools | int }}
+{{ $nodeCount := .Values.replicas | int }}
+{{ $replicas := mul $poolCount $nodeCount }}
+{{ $drivesPerNode := .Values.drivesPerNode | int }}
+{{ $scheme := .Values.tls.enabled | ternary "https" "http" }}
+{{ $mountPath := .Values.mountPath }}
+{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }}
+{{ $subPath := .Values.persistence.subPath }}
+{{ $penabled := .Values.persistence.enabled }}
+{{ $accessMode := .Values.persistence.accessMode }}
+{{ $storageClass := .Values.persistence.storageClass }}
+{{ $psize := .Values.persistence.size }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "silo.fullname" . }}-svc
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  publishNotReadyAddresses: true
+  clusterIP: None
+  ports:
+    - name: {{ $scheme }}
+      port: {{ .Values.service.port }}
+      protocol: TCP
+      targetPort: {{ .Values.minioAPIPort }}
+  selector:
+    app: {{ template "silo.name" . }}
+    release: {{ .Release.Name }}
+---
+apiVersion: {{ template "silo.statefulset.apiVersion" . }}
+kind: StatefulSet
+metadata:
+  name: {{ template "silo.fullname" . }}
+  labels:
+    app: {{ template "silo.name" . }}
+    chart: {{ template "silo.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    {{- if .Values.additionalLabels }}
+      {{- toYaml .Values.additionalLabels | nindent 4 }}
+    {{- end }}
+  {{- if .Values.additionalAnnotations }}
+  annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }}
+  {{- end }}
+spec:
+  updateStrategy:
+    type: {{ .Values.statefulSetUpdate.updateStrategy }}
+  podManagementPolicy: "Parallel"
+  serviceName: {{ template "silo.fullname" . }}-svc
+  replicas: {{ $replicas }}
+  selector:
+    matchLabels:
+      app: {{ template "silo.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      name: {{ template "silo.fullname" . }}
+      labels:
+        app: {{ template "silo.name" . }}
+        release: {{ .Release.Name }}
+        {{- if .Values.podLabels }}
+          {{- toYaml .Values.podLabels | nindent 8 }}
+        {{- end }}
+      annotations:
+        {{- if not .Values.ignoreChartChecksums }}
+        checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if .Values.podAnnotations }}
+          {{- toYaml .Values.podAnnotations | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- if .Values.priorityClassName }}
+      priorityClassName: "{{ .Values.priorityClassName }}"
+      {{- end }}
+      {{- if .Values.runtimeClassName }}
+      runtimeClassName: "{{ .Values.runtimeClassName }}"
+      {{- end }}
+      {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
+      securityContext:
+        {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+      {{- end }}
+      containers:
+        - name: {{ include "silo.name" . }}
+          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: [
+            "/bin/sh",
+            "-ce",
+            "/usr/bin/docker-entrypoint.sh silo server {{- range $i := until $poolCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `silo.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `silo.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{ else }}{{ $bucketRoot }}{{end }}{{- end }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template `silo.extraArgs` . }}"
+          ]
+          volumeMounts:
+            {{- if $penabled }}
+            {{- if (gt $drivesPerNode 1) }}
+            {{- range $i := until $drivesPerNode }}
+            - name: export-{{ $i }}
+              mountPath: {{ $mountPath }}-{{ $i }}
+              {{- if and $penabled $subPath }}
+              subPath: {{ $subPath }}
+              {{- end }}
+            {{- end }}
+            {{- else }}
+            - name: export
+              mountPath: {{ $mountPath }}
+              {{- if and $penabled $subPath }}
+              subPath: {{ $subPath }}
+              {{- end }}
+            {{- end }}
+            {{- end }}
+            {{- if .Values.extraSecret }}
+            - name: extra-secret
+              mountPath: "/tmp/silo-config-env"
+            {{- end }}
+            {{- include "silo.tlsKeysVolumeMount" . | indent 12 }}
+            {{- if .Values.extraVolumeMounts }}
+              {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+            {{- end }}
+          ports:
+            - name: {{ $scheme }}
+              containerPort: {{ .Values.minioAPIPort }}
+            - name: {{ $scheme }}-console
+              containerPort: {{ .Values.minioConsolePort }}
+          env:
+            - name: MINIO_ROOT_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "silo.secretName" . }}
+                  key: rootUser
+            - name: MINIO_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "silo.secretName" . }}
+                  key: rootPassword
+            {{- if .Values.extraSecret }}
+            - name: MINIO_CONFIG_ENV_FILE
+              value: "/tmp/silo-config-env/config.env"
+            {{- end }}
+            {{- if .Values.metrics.serviceMonitor.public }}
+            - name: MINIO_PROMETHEUS_AUTH_TYPE
+              value: "public"
+            {{- end }}
+            {{- if .Values.oidc.enabled }}
+            - name: MINIO_IDENTITY_OPENID_CONFIG_URL
+              value: {{ .Values.oidc.configUrl }}
+            - name: MINIO_IDENTITY_OPENID_CLIENT_ID
+            {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientIdKey }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.oidc.existingClientSecretName }}
+                  key: {{ .Values.oidc.existingClientIdKey }}
+            {{- else }}
+              value: {{ .Values.oidc.clientId }}
+            {{- end }}
+            - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+            {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientSecretKey }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.oidc.existingClientSecretName }}
+                  key: {{ .Values.oidc.existingClientSecretKey }}
+            {{- else }}
+              value: {{ .Values.oidc.clientSecret }}
+            {{- end }}
+            - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
+              value: {{ .Values.oidc.claimName }}
+            - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX
+              value: {{ .Values.oidc.claimPrefix }}
+            - name: MINIO_IDENTITY_OPENID_SCOPES
+              value: {{ .Values.oidc.scopes }}
+            - name: MINIO_IDENTITY_OPENID_COMMENT
+              value: {{ .Values.oidc.comment }}
+            - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
+              value: {{ .Values.oidc.redirectUri }}
+            - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
+              value: {{ .Values.oidc.displayName }}
+            {{- end }}
+            {{- range $key, $val := .Values.environment }}
+            - name: {{ $key }}
+              value: {{ tpl $val $ | quote }}
+            {{- end }}
+          resources: {{- toYaml .Values.resources | nindent 12 }}
+          {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
+          {{- with .Values.containerSecurityContext }}
+          securityContext: {{ toYaml . | nindent 12}}
+          {{- end }}
+          {{- end }}
+        {{- with .Values.extraContainers }}
+          {{- if eq (typeOf .) "string" }}
+            {{- tpl . $ | nindent 8 }}
+          {{- else }}
+            {{- toYaml . | nindent 8 }}
+          {{- end }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- include "silo.imagePullSecrets" . | indent 6 }}
+      {{- with .Values.affinity }}
+      affinity: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and (gt $replicas 1) (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "19") }}
+      {{- with .Values.topologySpreadConstraints }}
+      topologySpreadConstraints: {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      volumes:
+        - name: silo-user
+          secret:
+            secretName: {{ template "silo.secretName" . }}
+        {{- if .Values.extraSecret }}
+        - name: extra-secret
+          secret:
+            secretName: {{ .Values.extraSecret }}
+        {{- end }}
+        {{- include "silo.tlsKeysVolume" . | indent 8 }}
+        {{- if .Values.extraVolumes }}
+          {{- toYaml .Values.extraVolumes | nindent 8 }}
+        {{- end }}
+  {{- if .Values.persistence.enabled }}
+  volumeClaimTemplates:
+    {{- if gt $drivesPerNode 1 }}
+    {{- range $diskId := until $drivesPerNode}}
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: export-{{ $diskId }}
+        {{- if $.Values.persistence.annotations }}
+        annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }}
+        {{- end }}
+      spec:
+        accessModes: [ {{ $accessMode | quote }} ]
+        {{- if $storageClass }}
+        storageClassName: {{ $storageClass }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ $psize }}
+    {{- end }}
+    {{- else }}
+    - apiVersion: v1
+      kind: PersistentVolumeClaim
+      metadata:
+        name: export
+        {{- if $.Values.persistence.annotations }}
+        annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }}
+        {{- end }}
+      spec:
+        accessModes: [ {{ $accessMode | quote }} ]
+        {{- if $storageClass }}
+        storageClassName: {{ $storageClass }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ $psize }}
+    {{- end }}
+  {{- end }}
+{{- end }}

helm/silo/values.yaml

@@ -0,0 +1,629 @@
+## Override the Silo name used for resource names and `app:` labels. Existing
+## releases can set this to `minio` to retain their current resource identity.
+##
+nameOverride: ""
+
+## Provide a name to substitute for the full names of resources
+##
+fullnameOverride: ""
+
+## Set the Kubernetes cluster domain where Silo is running.
+##
+clusterDomain: cluster.local
+
+## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
+##
+image:
+  repository: pgsty/silo
+  tag: RELEASE.2026-08-04T00-00-00Z
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+# - name: "image-pull-secret"
+
+## Image used by post-install jobs. The pgsty/silo image bundles mcli and
+## provides /usr/bin/mc as a compatibility link.
+##
+mcImage:
+  repository: pgsty/silo
+  tag: RELEASE.2026-08-04T00-00-00Z
+  pullPolicy: IfNotPresent
+
+## Silo mode, i.e. standalone or distributed.
+mode: distributed ## other supported values are "standalone"
+
+## Additional labels to include with deployment or statefulset
+additionalLabels: {}
+
+## Additional annotations to include with deployment or statefulset
+additionalAnnotations: {}
+
+## Typically the deployment/statefulset includes checksums of secrets/config,
+## So that when these change on a subsequent helm install, the deployment/statefulset
+## is restarted. This can result in unnecessary restarts under GitOps tooling such as
+## flux, so set to "true" to disable this behaviour.
+ignoreChartChecksums: false
+
+## Additional arguments to pass to the Silo binary.
+extraArgs: []
+# example for enabling FTP:
+#   - --ftp=\"address=:8021\"
+#   - --ftp=\"passive-port-range=10000-10010\"
+
+## Additional volumes for the Silo container.
+extraVolumes: []
+
+## Additional volume mounts for the Silo container.
+extraVolumeMounts: []
+
+## Additional sidecar containers
+extraContainers: []
+
+## Internal port number for the Silo S3 API container.
+## Change service.port to change external port number
+minioAPIPort: "9000"
+
+## Internal port number for the Silo Console container.
+## Change consoleService.port to change external port number
+minioConsolePort: "9001"
+
+## Update strategy for Deployments
+deploymentUpdate:
+  type: RollingUpdate
+  maxUnavailable: 0
+  maxSurge: 100%
+
+## Update strategy for StatefulSets
+statefulSetUpdate:
+  updateStrategy: RollingUpdate
+
+## Pod priority settings
+## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
+##
+priorityClassName: ""
+
+## Pod runtime class name
+## ref https://kubernetes.io/docs/concepts/containers/runtime-class/
+##
+runtimeClassName: ""
+
+## Set default rootUser, rootPassword
+## rootUser and rootPassword is generated when not set
+## Distributed Silo reference: https://silo.pgsty.com/operations/deployments/baremetal/
+##
+rootUser: ""
+rootPassword: ""
+
+## Use existing Secret that store following variables:
+##
+## | Chart var             | .data.<key> in Secret    |
+## |:----------------------|:-------------------------|
+## | rootUser              | rootUser                 |
+## | rootPassword          | rootPassword             |
+##
+## All mentioned variables will be ignored in values file.
+## .data.rootUser and .data.rootPassword are mandatory,
+## others depend on enabled status of corresponding sections.
+existingSecret: ""
+
+## Certificate and mcli configuration paths inside the Silo pod.
+certsPath: "/etc/silo/certs/"
+configPathmc: "/etc/silo/mc/"
+
+## Path where the PV is mounted on the Silo pod.
+mountPath: "/export"
+## Override the root directory which the Silo server should serve from.
+## If left empty, it defaults to the value of {{ .Values.mountPath }}
+## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }}
+##
+bucketRoot: ""
+
+# Number of drives attached to a node
+drivesPerNode: 1
+# Number of Silo containers running
+replicas: 16
+# Number of expanded Silo clusters
+pools: 1
+
+## TLS settings for Silo.
+tls:
+  enabled: false
+  ## Create a Secret with private.key and public.crt and pass its name here.
+  certSecret: ""
+  publicCrt: public.crt
+  privateKey: private.key
+
+## Trusted certificate settings for Silo. Ref: https://silo.pgsty.com/operations/network-encryption/#third-party-certificate-authorities
+## Bundle multiple trusted certificates into one Secret and pass that here.
+## With self-signed certificates, include Silo's own certificate under public.crt.
+## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret.
+trustedCertsSecret: ""
+
+## Enable persistence using Persistent Volume Claims
+## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
+##
+persistence:
+  enabled: true
+  annotations: {}
+
+  ## A manually managed Persistent Volume and Claim
+  ## Requires persistence.enabled: true
+  ## If defined, PVC must be created manually before volume will be bound
+  existingClaim: ""
+
+  ## Silo data PersistentVolume storage class.
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+  ##   GKE, AWS & OpenStack)
+  ##
+  ## Storage class of PV to bind. By default it looks for standard storage class.
+  ## If the PV uses a different storage class, specify that here.
+  storageClass: ""
+  volumeName: ""
+  accessMode: ReadWriteOnce
+  size: 500Gi
+
+  ## If subPath is set mount a sub folder of a volume instead of the root of the volume.
+  ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs).
+  ##
+  subPath: ""
+
+## Expose Silo outside the cluster with a LoadBalancer Service.
+## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
+## ref: http://kubernetes.io/docs/user-guide/services/
+##
+service:
+  type: ClusterIP
+  clusterIP: ~
+  port: "9000"
+  nodePort: 32000
+  loadBalancerIP: ~
+  externalIPs: []
+  annotations: {}
+
+  ## service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer
+  ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
+  ##
+  #loadBalancerSourceRanges:
+  #   - 10.10.10.0/24
+  loadBalancerSourceRanges: []
+
+  ## service.externalTrafficPolicy controls Silo Service traffic handling.
+  ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
+  ##
+  externalTrafficPolicy: Cluster
+
+## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/
+##
+
+ingress:
+  enabled: false
+  ingressClassName: ~
+  labels:
+    {}
+    # node-role.kubernetes.io/ingress: platform
+  annotations:
+    {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+    # kubernetes.io/ingress.allow-http: "false"
+    # kubernetes.io/ingress.global-static-ip-name: ""
+    # nginx.ingress.kubernetes.io/secure-backends: "true"
+    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
+  path: /
+  hosts:
+    - silo-example.local
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - chart-example.local
+
+consoleService:
+  type: ClusterIP
+  clusterIP: ~
+  port: "9001"
+  nodePort: 32001
+  loadBalancerIP: ~
+  externalIPs: []
+  annotations: {}
+  ## consoleService.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer
+  ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
+  ##
+  #loadBalancerSourceRanges:
+  #   - 10.10.10.0/24
+  loadBalancerSourceRanges: []
+
+  ## consoleService.externalTrafficPolicy controls Console traffic handling.
+  ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
+  ##
+  externalTrafficPolicy: Cluster
+
+consoleIngress:
+  enabled: false
+  ingressClassName: ~
+  labels:
+    {}
+    # node-role.kubernetes.io/ingress: platform
+  annotations:
+    {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+    # kubernetes.io/ingress.allow-http: "false"
+    # kubernetes.io/ingress.global-static-ip-name: ""
+    # nginx.ingress.kubernetes.io/secure-backends: "true"
+    # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
+  path: /
+  hosts:
+    - console.silo-example.local
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - chart-example.local
+
+## Node labels for pod assignment
+## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+##
+nodeSelector: {}
+tolerations: []
+affinity: {}
+topologySpreadConstraints: []
+
+## Configure the security context used by stateful Silo containers.
+## user and group NOTE: securityContext is only enabled if persistence.enabled=true
+securityContext:
+  enabled: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+  fsGroupChangePolicy: "OnRootMismatch"
+
+containerSecurityContext:
+  readOnlyRootFilesystem: false
+
+# Additational pod annotations
+podAnnotations: {}
+
+# Additional pod labels
+podLabels: {}
+
+## Configure resource requests and limits
+## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+##
+resources:
+  requests:
+    memory: 16Gi
+
+## Policies to create after installing Silo.
+##
+## In addition to default policies [readonly|readwrite|writeonly|consoleAdmin|diagnostics]
+## you can define additional policies with custom supported actions and resources
+policies: []
+## writeexamplepolicy policy grants creation or deletion of buckets with name
+## starting with example. In addition, grants objects write permissions on buckets starting with
+## example.
+# - name: writeexamplepolicy
+#   statements:
+#     - effect: Allow  # this is the default
+#       resources:
+#         - 'arn:aws:s3:::example*/*'
+#       actions:
+#         - "s3:AbortMultipartUpload"
+#         - "s3:GetObject"
+#         - "s3:DeleteObject"
+#         - "s3:PutObject"
+#         - "s3:ListMultipartUploadParts"
+#     - resources:
+#         - 'arn:aws:s3:::example*'
+#       actions:
+#         - "s3:CreateBucket"
+#         - "s3:DeleteBucket"
+#         - "s3:GetBucketLocation"
+#         - "s3:ListBucket"
+#         - "s3:ListBucketMultipartUploads"
+## readonlyexamplepolicy policy grants access to buckets with name starting with example.
+## In addition, grants objects read permissions on buckets starting with example.
+# - name: readonlyexamplepolicy
+#   statements:
+#     - resources:
+#         - 'arn:aws:s3:::example*/*'
+#       actions:
+#         - "s3:GetObject"
+#     - resources:
+#         - 'arn:aws:s3:::example*'
+#       actions:
+#         - "s3:GetBucketLocation"
+#         - "s3:ListBucket"
+#         - "s3:ListBucketMultipartUploads"
+## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only
+# - name: conditionsexample
+#   statements:
+#     - resources:
+#       - 'arn:aws:s3:::example/*'
+#       actions:
+#       - 's3:*'
+#       conditions:
+#         - StringEquals: '"aws:username": "johndoe"'
+#         - IpAddress: |
+#             "aws:SourceIp": [
+#               "10.0.0.0/8",
+#               "192.168.0.0/24"
+#             ]
+#
+## Additional Annotations for the Kubernetes Job makePolicyJob
+makePolicyJob:
+  securityContext:
+    enabled: false
+    runAsUser: 1000
+    runAsGroup: 1000
+  resources:
+    requests:
+      memory: 128Mi
+  # Command to run after the main command on exit
+  exitCommand: ""
+
+## Users to create after installing Silo.
+## Username, password and policy to be assigned to the user.
+## Default policies are [readonly|readwrite|writeonly|consoleAdmin|diagnostics].
+## Add new policies as explained here https://silo.pgsty.com/administration/identity-access-management/#access-management
+## NOTE: this will fail if LDAP is enabled in the Silo deployment.
+##
+## Example:
+## users:
+##   - accessKey: console
+##     secretKey: change-me
+##     policy: consoleAdmin
+## Or refer to a specific secret:
+##   - accessKey: externalSecret
+##     existingSecret: my-secret
+##     existingSecretKey: password
+##     policy: readonly
+users: []
+
+## Additional Annotations for the Kubernetes Job makeUserJob
+makeUserJob:
+  securityContext:
+    enabled: false
+    runAsUser: 1000
+    runAsGroup: 1000
+  resources:
+    requests:
+      memory: 128Mi
+  # Command to run after the main command on exit
+  exitCommand: ""
+
+## Service accounts to create after installing Silo.
+##
+svcaccts:
+  []
+  ## accessKey, secretKey and parent user to be assigned to the service accounts
+  ## Add new service accounts as explained here https://silo.pgsty.com/administration/identity-access-management/minio-user-management/#access-keys
+  # - accessKey: console-svcacct
+  #   secretKey: console123
+  #   user: console
+  ## Or you can refer to specific secret
+  # - accessKey: externalSecret
+  #   existingSecret: my-secret
+  #   existingSecretKey: password
+  #   user: console
+  ## You also can pass custom policy
+  # - accessKey: console-svcacct
+  #   secretKey: console123
+  #   user: console
+  #   policy:
+  #     statements:
+  #       - resources:
+  #           - 'arn:aws:s3:::example*/*'
+  #         actions:
+  #           - "s3:AbortMultipartUpload"
+  #           - "s3:GetObject"
+  #           - "s3:DeleteObject"
+  #           - "s3:PutObject"
+  #           - "s3:ListMultipartUploadParts"
+
+makeServiceAccountJob:
+  securityContext:
+    enabled: false
+    runAsUser: 1000
+    runAsGroup: 1000
+  resources:
+    requests:
+      memory: 128Mi
+  # Command to run after the main command on exit
+  exitCommand: ""
+
+## Buckets to create after installing Silo.
+##
+buckets:
+  []
+  #   # Name of the bucket
+  # - name: bucket1
+  #   # Policy to be set on the
+  #   # bucket [none|download|upload|public]
+  #   policy: none
+  #   # Purge if bucket exists already
+  #   purge: false
+  #   # set versioning for
+  #   # bucket [true|false]
+  #   versioning: false # remove this key if you do not want versioning feature
+  #   # set objectlocking for
+  #   # bucket [true|false] NOTE: versioning is enabled by default if you use locking
+  #   objectlocking: false
+  # - name: bucket2
+  #   policy: none
+  #   purge: false
+  #   versioning: true
+  #   # set objectlocking for
+  #   # bucket [true|false] NOTE: versioning is enabled by default if you use locking
+  #   objectlocking: false
+
+## Additional Annotations for the Kubernetes Job makeBucketJob
+makeBucketJob:
+  securityContext:
+    enabled: false
+    runAsUser: 1000
+    runAsGroup: 1000
+  resources:
+    requests:
+      memory: 128Mi
+  # Command to run after the main command on exit
+  exitCommand: ""
+
+## Commands to run after installing Silo.
+## The preferred mc command TARGET is "mysilo". The legacy "myminio" target
+## remains registered so existing customCommands values continue to work.
+customCommands:
+  # - command: "admin policy attach mysilo consoleAdmin --group='cn=ops,cn=groups,dc=example,dc=com'"
+
+## Additional Annotations for the Kubernetes Job customCommandJob
+customCommandJob:
+  securityContext:
+    enabled: false
+    runAsUser: 1000
+    runAsGroup: 1000
+  resources:
+    requests:
+      memory: 128Mi
+  ## Additional volumes to add to the post-job.
+  extraVolumes:
+    []
+    # - name: extra-policies
+    #   configMap:
+    #     name: my-extra-policies-cm
+  ## Additional volumeMounts to add to the custom commands container when
+  ## running the post-job.
+  extraVolumeMounts:
+    []
+    # - name: extra-policies
+    #   mountPath: /mnt/extras/
+  # Command to run after the main command on exit
+  exitCommand: ""
+
+## Merge jobs
+postJob:
+  podAnnotations: {}
+  annotations: {}
+  securityContext:
+    enabled: false
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
+## Add environment variables for Silo. The MINIO_* names remain the stable
+## configuration interface and are passed to the Silo container(s).
+environment:
+  ## Please refer for comprehensive list https://silo.pgsty.com/reference/minio-server/minio-server/
+  ## MINIO_BROWSER: "off"
+
+## The name of a secret in the same kubernetes namespace which contain secret values
+## This can be useful for LDAP password, etc
+## The key in the secret must be 'config.env'
+##
+extraSecret: ~
+
+## OpenID Identity Management
+## The following section documents environment variables for enabling external identity management using an OpenID Connect (OIDC)-compatible provider.
+## See https://silo.pgsty.com/operations/external-iam/configure-openid-external-identity-management/ for a tutorial on using these variables.
+oidc:
+  enabled: false
+  configUrl: "https://identity-provider-url/.well-known/openid-configuration"
+  clientId: "silo"
+  clientSecret: ""
+  # Provide existing client secret from the Kubernetes Secret resource, existing secret will have priority over `clientId` and/or `clientSecret``
+  existingClientSecretName: ""
+  existingClientIdKey: ""
+  existingClientSecretKey: ""
+  claimName: "policy"
+  scopes: "openid,profile,email"
+  redirectUri: "https://console-endpoint-url/oauth_callback"
+  # Can leave empty
+  claimPrefix: ""
+  comment: ""
+  displayName: ""
+
+networkPolicy:
+  enabled: false
+  # Specifies whether the policies created will be standard Network Policies (flavor: kubernetes)
+  # or Cilium Network Policies (flavor: cilium)
+  flavor: kubernetes
+  # Allow external access to the Silo API.
+  allowExternal: true
+  ## @params networkPolicy.egress configuration of the egress traffic
+  egress:
+    ## @param networkPolicy.egress.enabled When enabled, an egress network policy will be
+    ## created allowing Silo to connect to external data sources from the cluster.
+    ##
+    enabled: false
+    ## @param networkPolicy.egress.ports Add individual ports to be allowed by the egress
+    ## Add ports to the egress by specifying - port: <port number>
+    ## E.X.
+    ## - port: 80
+    ## - port: 443
+    ## - port: 53
+    ##   protocol: UDP
+    ##
+    ports: []
+    ## @param networkPolicy.egress.to Allow egress traffic to specific destinations
+    ## Add destinations to the egress by specifying - ipBlock: <CIDR>
+    ## E.X.
+    ## to:
+    ##  - namespaceSelector:
+    ##    matchExpressions:
+    ##    - {key: role, operator: In, values: [silo]}
+    ##
+    to: []
+  # only when using flavor: cilium
+  egressEntities:
+    - kube-apiserver
+
+## PodDisruptionBudget settings
+## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
+##
+podDisruptionBudget:
+  enabled: false
+  maxUnavailable: 1
+
+## Specify the service account to use for Silo pods. If 'create' is set to 'false'
+## and 'name' is left unspecified, the account 'default' will be used.
+serviceAccount:
+  create: true
+  ## The name of the service account to use. If 'create' is 'true', a service account with that name
+  ## will be created.
+  name: "silo-sa"
+
+metrics:
+  serviceMonitor:
+    enabled: false
+    # scrape each node/pod individually for additional metrics
+    includeNode: false
+    public: true
+    additionalLabels: {}
+    annotations: {}
+    # for node metrics
+    relabelConfigs: {}
+    # for cluster metrics
+    relabelConfigsCluster:
+      {}
+      # metricRelabelings:
+      #   - regex: (server|pod)
+      #     action: labeldrop
+    namespace: ~
+    # Scrape interval, for example `interval: 30s`
+    interval: ~
+    # Scrape timeout, for example `scrapeTimeout: 10s`
+    scrapeTimeout: ~
+
+## ETCD settings. The existing MINIO_ETCD_* configuration interface is retained.
+## Define endpoints to enable this section.
+etcd:
+  endpoints: []
+  pathPrefix: ""
+  corednsPathPrefix: ""
+  clientCert: ""
+  clientCertKey: ""