helm: trim hardening to essentials (#45 )

Keep the Helm hardening outcome while removing the unnecessary helper layer, test template, duplicate checks, verbose documentation, and historical index churn.
helm: harden Silo chart delivery (#44 )
2026-07-31 07:45:19 +03:00 · 2026-07-28 11:52:21 +08:00 · 2026-07-28 11:30:56 +08:00
7 changed files with 115 additions and 27 deletions
@@ -0,0 +1,65 @@
+name: Helm
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/helm.yml"
+      - "helm/**"
+      - "helm-releases/minio-*.tgz"
+  push:
+    branches: [master]
+    paths:
+      - ".github/workflows/helm.yml"
+      - "helm/**"
+      - "helm-releases/minio-*.tgz"
+
+permissions:
+  contents: read
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: azure/setup-helm@v4
+        with:
+          version: v3.19.0
+
+      - name: Lint packaged chart
+        run: |
+          version="$(awk '$1 == "version:" { print $2; exit }' helm/minio/Chart.yaml)"
+          chart="helm-releases/minio-${version}.tgz"
+          test -f "${chart}"
+          helm lint --strict "${chart}"
+          echo "CHART=${chart}" >> "${GITHUB_ENV}"
+
+      - name: Create Kind cluster
+        uses: helm/kind-action@v1
+
+      - name: Install and test
+        run: |
+          helm install silo "${CHART}" \
+            --namespace silo \
+            --create-namespace \
+            --wait \
+            --wait-for-jobs \
+            --timeout 10m \
+            --set mode=standalone \
+            --set replicas=1 \
+            --set persistence.enabled=false \
+            --set resources.requests.memory=512Mi \
+            --set rootUser=siloadmin \
+            --set rootPassword=silo-smoke-password \
+            --set 'buckets[0].name=bootstrap' \
+            --set 'buckets[0].policy=none' \
+            --set 'buckets[0].purge=false'
+
+          kubectl get deployment/silo-minio --namespace silo -o jsonpath='{.spec.template.spec.containers[0].image}' | grep -q '^pgsty/minio:'
+          kubectl exec --namespace silo deployment/silo-minio -- /bin/sh -ec '
+            mc alias set local http://127.0.0.1:9000 siloadmin silo-smoke-password
+            trap "mc rm --recursive --force local/silo-smoke >/dev/null 2>&1 || true; mc rb local/silo-smoke >/dev/null 2>&1 || true" EXIT
+            mc mb local/silo-smoke
+            printf smoke | mc pipe local/silo-smoke/probe
+            test "$(mc cat local/silo-smoke/probe)" = smoke
+          '
@@ -2,4 +2,4 @@

 helm package helm/minio -d helm-releases/

-helm repo index --merge index.yaml --url https://charts.min.io .
+helm repo index --merge index.yaml --url https://raw.githubusercontent.com/pgsty/minio/master .
@@ -1,18 +1,18 @@
 apiVersion: v1
 description: High Performance Object Storage
 name: minio
-version: 5.4.0
-appVersion: RELEASE.2024-12-18T13-15-44Z
+version: 5.5.0
+appVersion: RELEASE.2026-06-18T00-00-00Z
 keywords:
  - minio
  - storage
  - object-storage
  - s3
  - cluster
-home: https://min.io
+home: https://silo.pigsty.io
 icon: https://min.io/resources/img/logo/MINIO_wordmark.png
 sources:
- https://github.com/minio/minio
+- https://github.com/pgsty/minio
 maintainers:
- name: MinIO, Inc
-  email: dev@minio.io
+- name: Pigsty
+  url: https://pigsty.io
@@ -6,7 +6,7 @@ MinIO is a High Performance Object Storage released under GNU Affero General Pub

 | IMPORTANT |
 | -------------------------- |
-| This Helm chart is community built, maintained, and supported. MinIO does not guarantee support for any given bug, feature request, or update referencing this chart. <br/><br/> MinIO publishes a separate [MinIO Kubernetes Operator and Tenant Helm Chart](https://github.com/minio/operator/tree/master/helm) that is officially maintained and supported. MinIO strongly recommends using the MinIO Kubernetes Operator for production deployments. See [Deploy Operator With Helm](https://silo.pigsty.io/operations/deployments/k8s-deploy-operator-helm-on-kubernetes.html?ref=github) for additional documentation. |
+| This direct-deployment chart is maintained in [`pgsty/minio`](https://github.com/pgsty/minio) and defaults to a fixed `pgsty/minio` release. The MinIO Operator, Tenant CRDs, and operator lifecycle are not maintained by this repository. |

 ## Introduction

@@ -21,7 +21,8 @@ This chart bootstraps MinIO Cluster on [Kubernetes](http://kubernetes.io) using
 ## Configure MinIO Helm repo

 ```bash
-helm repo add minio https://charts.min.io/
+helm repo add silo https://raw.githubusercontent.com/pgsty/minio/master
+helm repo update silo
 ```

 ### Installing the Chart
@@ -29,7 +30,7 @@ helm repo add minio https://charts.min.io/
 Install this chart using:

 ```bash
-helm install --namespace minio --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio
+helm install --namespace minio --set rootUser=rootuser,rootPassword=rootpass123 --generate-name silo/minio
 ```

 The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
@@ -39,7 +40,7 @@ The command deploys MinIO on the Kubernetes cluster in the default configuration
 Minimal toy setup for testing purposes can be deployed using:

 ```bash
-helm install --set resources.requests.memory=512Mi --set replicas=1 --set persistence.enabled=false --set mode=standalone --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio
+helm install --set resources.requests.memory=512Mi --set replicas=1 --set persistence.enabled=false --set mode=standalone --set rootUser=rootuser,rootPassword=rootpass123 --generate-name silo/minio
 ```

 ### Upgrading the Chart
@@ -53,7 +54,7 @@ helm get values my-release > old_values.yaml
 Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using

 ```bash
-helm upgrade -f old_values.yaml my-release minio/minio
+helm upgrade -f old_values.yaml my-release silo/minio
 ```

 Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy.
@@ -65,7 +66,7 @@ Refer the [Values file](./values.yaml) for all the possible config fields.
 You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,

 ```bash
-helm install --name my-release --set persistence.size=1Ti minio/minio
+helm install my-release --set persistence.size=1Ti silo/minio
 ```

 The above command deploys MinIO server with a 1Ti backing persistent volume.
@@ -73,7 +74,7 @@ The above command deploys MinIO server with a 1Ti backing persistent volume.
 Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example,

 ```bash
-helm install --name my-release -f values.yaml minio/minio
+helm install my-release -f values.yaml silo/minio
 ```

 ### Persistence
@@ -81,7 +82,7 @@ helm install --name my-release -f values.yaml minio/minio
 This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by:

 ```bash
-helm install --set persistence.enabled=false minio/minio
+helm install my-release --set persistence.enabled=false silo/minio
 ```

 > *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."*
@@ -95,7 +96,7 @@ If a Persistent Volume Claim already exists, specify it during installation.
 3. Install the chart

 ```bash
-helm install --set persistence.existingClaim=PVC_NAME minio/minio
+helm install my-release --set persistence.existingClaim=PVC_NAME silo/minio
 ```

 ### NetworkPolicy
@@ -134,7 +135,7 @@ kubectl create secret generic my-minio-secret --from-literal=rootUser=foobarbaz
 Then install the chart, specifying that you want to use an existing secret:

 ```bash
-helm install --set existingSecret=my-minio-secret minio/minio
+helm install my-release --set existingSecret=my-minio-secret silo/minio
 ```

 The following fields are expected in the secret:
@@ -157,7 +158,7 @@ kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --fr
 Then install the chart, specifying that you want to use the TLS secret:

 ```bash
-helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio
+helm install my-release --set tls.enabled=true,tls.certSecret=tls-ssl-minio silo/minio
 ```

 ### Installing certificates from third party CAs
@@ -191,7 +192,7 @@ or
 Install the chart, specifying the buckets you want to create after install:

 ```bash
-helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio
+helm install my-release --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false silo/minio
 ```

 Description of the configuration parameters used above -
@@ -205,7 +206,7 @@ Description of the configuration parameters used above -
 Install the chart, specifying the policies you want to create after install:

 ```bash
-helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio
+helm install my-release --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' silo/minio
 ```

 Description of the configuration parameters used above -
@@ -220,7 +221,7 @@ Description of the configuration parameters used above -
 Install the chart, specifying the users you want to create after install:

 ```bash
-helm install --set users[0].accessKey=accessKey,users[0].secretKey=secretKey,users[0].policy=none,users[1].accessKey=accessKey2,users[1].secretRef=existingSecret,users[1].secretKey=password,users[1].policy=none minio/minio
+helm install my-release --set users[0].accessKey=accessKey,users[0].secretKey=secretKey,users[0].policy=none,users[1].accessKey=accessKey2,users[1].secretRef=existingSecret,users[1].secretKey=password,users[1].policy=none silo/minio
 ```

 Description of the configuration parameters used above -
@@ -236,7 +237,7 @@ Description of the configuration parameters used above -
 Install the chart, specifying the service accounts you want to create after install:

 ```bash
-helm install --set svcaccts[0].accessKey=accessKey,svcaccts[0].secretKey=secretKey,svcaccts[0].user=parentUser,svcaccts[1].accessKey=accessKey2,svcaccts[1].secretRef=existingSecret,svcaccts[1].secretKey=password,svcaccts[1].user=parentUser2 minio/minio
+helm install my-release --set svcaccts[0].accessKey=accessKey,svcaccts[0].secretKey=secretKey,svcaccts[0].user=parentUser,svcaccts[1].accessKey=accessKey2,svcaccts[1].secretRef=existingSecret,svcaccts[1].secretKey=password,svcaccts[1].user=parentUser2 silo/minio
 ```

 Description of the configuration parameters used above -
@@ -13,8 +13,8 @@ clusterDomain: cluster.local
 ## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
 ##
 image:
-  repository: quay.io/minio/minio
-  tag: RELEASE.2024-12-18T13-15-44Z
+  repository: pgsty/minio
+  tag: RELEASE.2026-06-18T00-00-00Z
  pullPolicy: IfNotPresent

 imagePullSecrets: []
@@ -24,8 +24,8 @@ imagePullSecrets: []
 ## client used to create a default bucket).
 ##
 mcImage:
-  repository: quay.io/minio/mc
-  tag: RELEASE.2024-11-21T17-21-54Z
+  repository: pgsty/minio
+  tag: RELEASE.2026-06-18T00-00-00Z
  pullPolicy: IfNotPresent

 ## minio mode, i.e. standalone or distributed
@@ -1,6 +1,28 @@
 apiVersion: v1
 entries:
  minio:
+  - apiVersion: v1
+    appVersion: RELEASE.2026-06-18T00-00-00Z
+    created: "2026-07-28T11:45:51.951744+08:00"
+    description: High Performance Object Storage
+    digest: 8ae62718f54150656df2606ae74561f86acb2af120e26f6954ee041781e47ce4
+    home: https://silo.pigsty.io
+    icon: https://min.io/resources/img/logo/MINIO_wordmark.png
+    keywords:
+    - minio
+    - storage
+    - object-storage
+    - s3
+    - cluster
+    maintainers:
+    - name: Pigsty
+      url: https://pigsty.io
+    name: minio
+    sources:
+    - https://github.com/pgsty/minio
+    urls:
+    - https://raw.githubusercontent.com/pgsty/minio/master/helm-releases/minio-5.5.0.tgz
+    version: 5.5.0
  - apiVersion: v1
    appVersion: RELEASE.2024-12-18T13-15-44Z
    created: "2025-01-02T21:34:25.234658257-08:00"
@@ -1965,4 +1987,4 @@ entries:
    urls:
    - https://charts.min.io/helm-releases/minio-1.0.0.tgz
    version: 1.0.0
-generated: "2025-01-02T21:34:24.920106038-08:00"
+generated: "2026-07-28T11:45:51.948559+08:00"