instantlinux · instantlinux · Sep 20, 2026 · Sep 18, 2026 · Sep 18, 2026 · Sep 18, 2026
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -1,28 +1,69 @@
-name: Release Helm Charts
+name: Publish Helm Charts
+
+env:
+  DOCKER_REGISTRY: registry-1.docker.io
+  DOCKER_USER: instantlinux
+  GITHUB_REGISTRY: ghcr.io
+  CHART_DIR: k8s/helm
 
 on:
   push:
-    # branches: [gh-pages, master]
-    branches: [gh-pages, master, SYS-570_charts]
+    branches: [main]
+    paths:
+    - k8s/helm/**/Chart.yaml
+    - images/**/helm/Chart.yaml
 
 jobs:
-  release:
+  find-charts:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: List Chart.yaml Updates
+        id: set-matrix
+        run: |
+          CHANGED=$(git diff --name-only HEAD^ HEAD | \
+            grep -E "^(${CHART_DIR}/.*|images/.*/helm)/Chart.yaml" | \
+            awk '{sub(/\/[^/]+$/, ""); print}' | \
+            jq -R . | jq -s -c .)
+          echo "matrix={\"chart\":$CHANGED}" >> $GITHUB_OUTPUT
+
+  publish:
+    needs: find-charts
+    if: ${{ needs.find-charts.outputs.matrix != '{"chart":[]}' &&
+            needs.find-charts.outputs.matrix != '' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.find-charts.outputs.matrix) }}
     steps:
     - name: Checkout
-      uses: actions/checkout@v2.3.4
+      uses: actions/checkout@v4
       with:
         fetch-depth: 0
 
-    - name: Configure Git
+    - name: Install Helm
+      uses: azure/setup-helm@v4
+
+    - name: Log in to github OCI Registry
       run: |
-        git config user.name "$GITHUB_ACTOR"
-        git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+        echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ${{ env.GITHUB_REGISTRY }} --username ${{ github.actor }} --password-stdin
 
-    - name: Run chart-releaser
-      uses: helm/chart-releaser-action@v1.2.1
-      env:
-        CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-      with:
-        charts_dir: k8s/helm
-        config: .github/cr.yaml
+    - name: Log in to docker hub OCI Registry
+      run: |
+        echo "${{ secrets.DOCKER_TOKEN }}" | helm registry login ${{ env.DOCKER_REGISTRY }} --username ${{ env.DOCKER_USER }} --password-stdin
+
+    - name: Package and Push
+      run: |
+        helm dependency update "${{ matrix.chart }}"
+        helm package "${{ matrix.chart }}"
+        helm push "$(echo *.tgz)" oci://${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_USER }}
+        helm push "$(echo *.tgz)" oci://${{ env.GITHUB_REGISTRY }}/${{ github.repository_owner }}/charts
diff --git a/README.md b/README.md
@@ -34,7 +34,7 @@ The cluster-deployment tools here include helm charts and ansible playbooks to s
 * Encryption for internal etcd
 * MFA using [Authelia](https://github.com/clems4ever/authelia) and Google Authenticator
 * Calico or flannel networking
-* ingress-nginx
+* Envoy API gateway
 * Local-volume sync
 * Garage object storage
 * Pod security policies

diff --git a/ansible/roles/network/defaults/main.yml b/ansible/roles/network/defaults/main.yml
@@ -1,4 +1,9 @@
 ---
+ca_trust_defaults:
+  path: /usr/local/share/ca-certificates
+  certificates: []
+ca_trust: "{{ ca_trust_defaults | combine(ca_trust_override) }}"
+
 kernel_modules:
   - ip_vs
 

diff --git a/ansible/roles/network/files/certs b/ansible/roles/network/files/certs
@@ -0,0 +1 @@
+../../../../admin/tls/
diff --git a/ansible/roles/network/handlers/main.yml b/ansible/roles/network/handlers/main.yml
@@ -13,6 +13,9 @@
     name: ssh
     state: restarted
 
+- name: Update CA certificates
+  command: update-ca-certificates
+
 - name: Restart tailscaled
   ansible.builtin.service:
     enabled: yes

diff --git a/ansible/roles/network/tasks/certificates.yml b/ansible/roles/network/tasks/certificates.yml
@@ -0,0 +1,8 @@
+---
+- name: Add trusted root certificate(s)
+  ansible.builtin.copy:
+    dest: "{{ ca_trust.path }}/{{ item }}"
+    mode: 0400
+    src: certs/{{ item }}
+  with_items: "{{ ca_trust.certificates }}"
+  notify: Update CA certificates
diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml
@@ -12,6 +12,7 @@
 - import_tasks: tailscale.yml
   when: network.tailscale.enabled
 
+- import_tasks: certificates.yml
 - import_tasks: kernel.yml
 - import_tasks: sshd.yml
 

diff --git a/images/mythtv-backend/helm/Chart.yaml b/images/mythtv-backend/helm/Chart.yaml
@@ -6,12 +6,12 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/mythtv/mythtv
 type: application
-version: 0.1.23
+version: 0.1.24
 appVersion: "36.0-fixes.202608221819.b6ed364d3f"
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
 - name: data-sync
   version: 0.1.3
   repository: https://instantlinux.github.io/docker-tools

diff --git a/images/mythtv-backend/helm/templates/app.yaml b/images/mythtv-backend/helm/templates/app.yaml
@@ -1,3 +1,5 @@
+{{- include "chartlib.configmap" . }}
+---
 {{- include "chartlib.deployment" . }}
 ---
 {{- include "chartlib.hpa" . }}
@@ -6,6 +8,8 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}

diff --git a/images/mythtv-backend/helm/values.yaml b/images/mythtv-backend/helm/values.yaml
@@ -89,6 +89,8 @@ authelia:
   fqdn: authtotp.example.com
   ip: 10.101.1.5
   path: /Myth/LoginUser
+gateway:
+  enabled: true
 ingress:
   # This ingress exposes your MythTV schedule and operational controls to
   #  the public Internet. Set up the admin user before enabling. See

diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml
@@ -5,9 +5,9 @@ home: https://github.com/instantlinux/docker-tools
 sources:
 - https://github.com/instantlinux/docker-tools
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "latest"
 dependencies:
 - name: chartlib
-  version: 0.1.8
-  repository: https://instantlinux.github.io/docker-tools
+  version: 0.1.10
+  repository: oci://registry-1.docker.io/instantlinux
diff --git a/images/squirrelmail/helm/templates/app.yaml b/images/squirrelmail/helm/templates/app.yaml
@@ -1,3 +1,5 @@
+{{- include "chartlib.configmap" . }}
+---
 {{- include "chartlib.deployment" . }}
 ---
 {{- include "chartlib.hpa" . }}
@@ -6,6 +8,10 @@
 ---
 {{- include "chartlib.ingresstotp" . }}
 ---
+{{- include "chartlib.listener" . }}
+---
 {{- include "chartlib.service" . }}
 ---
 {{- include "chartlib.serviceaccount" . }}
+---
+{{- include "chartlib.statefulset" . }}
diff --git a/images/squirrelmail/helm/values.yaml b/images/squirrelmail/helm/values.yaml
@@ -51,11 +51,5 @@ service:
 autoscaling:
   enabled: false
 
-authelia:
-  fqdn: authtotp.example.com
-  ip: 10.101.1.5
-  path: /src/login.php
-ingress:
-  enabled: true
-ingressTOTP:
+gateway:
   enabled: true
diff --git a/k8s/Makefile b/k8s/Makefile
@@ -91,15 +91,12 @@ INSTALL_YAML = $(basename $(wildcard install/*.yaml)) \
           $(addprefix imports/, $(IMPORTS))
 VOLUMES_YAML = $(basename $(wildcard volumes/*.yaml))
 
-install: install/admin-user cluster_network \
-	install/local-storage storage_localdefault imports \
-	install_imports namespace_config install/prometheus-rbac \
-	install/k8s-backup fluent-bit remote_volumes \
+install: install/admin-user cluster_network imports \
+	install_imports namespace_config fluent-bit remote_volumes \
 	sops data-sync-ssh persistent secrets install/ingress-nginx \
-	install/rsyslog-ext install/cert-manager
+	infra storage_localdefault
 
-namespace_config: install/namespace install/limits install/namespace-user \
-	secrets/regcred
+namespace_config: install/namespace install/namespace-user secrets/regcred
 
 untaint_master:
 	@echo -e '** Allowing workload on master risks admin-cert security compromise **\n'
@@ -176,15 +173,33 @@ include Makefile.sops
 # cert-manager
 ##########
 
-# Note - need both, to define the CRD and the ClusterIssuer resources
+# Note - need both, to define the CRD and the ClusterIssuer resources; define
+#     an override file for infra helm chart first and then:
 #   make imports/cert-manager
-#   make install/cert-manager
+#   make infra
 
 imports/cert-manager.yaml: imports/cert-manager-$(VERSION_CERT_MANAGER).yaml
 	ln -s $(notdir $<) $@
 imports/cert-manager-$(VERSION_CERT_MANAGER).yaml:
 	curl -sLo $@ https://github.com/cert-manager/cert-manager/releases/download/v$(VERSION_CERT_MANAGER)/cert-manager.yaml
 
+# Run this once after imports/cert-manager
+cert-manager-gateway: 
+	kubectl patch deployment cert-manager --context=sudo -n cert-manager --type='json' -p='[ { "op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--enable-gateway-api" }, { "op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--enable-gateway-api-listenerset" }, { "op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--feature-gates=ListenerSets=true" } ]'
+
+##########
+# envoy-gateway
+##########
+imports/envoy-gateway.yaml: imports/envoy-gateway-$(VERSION_ENVOY_GATEWAY).yaml
+	ln -s $(notdir $<) $@
+imports/envoy-gateway-$(VERSION_ENVOY_GATEWAY).yaml:
+	curl -sLo $@ https://github.com/envoyproxy/gateway/releases/download/v$(VERSION_ENVOY_GATEWAY)/install.yaml
+imports/envoy-gateway:: imports/envoy-gateway.yaml
+	@echo --$(NOTICE) $@ from server-side--
+	@SERVICE_NAME=$(@F) \
+	  envsubst < $@.yaml | kubectl $(ADMIN_CTX) $(ACTION) \
+	  --server-side --force-conflicts -f -
+
 ##########
 # node-local-dns
 ##########

diff --git a/k8s/Makefile.helm b/k8s/Makefile.helm
@@ -49,3 +49,5 @@ CHARTLOCK = $(addsuffix /Chart.lock, $(addprefix helm/, $(CHARTS))) \
 	  $(addsuffix /Chart.lock, $(addprefix helm/instances/, $(INSTANCES)))
 $(CHARTLOCK):
 	helm dependency update $(dir $@)
+
+infra: XARGS=--kube-context=sudo
diff --git a/k8s/Makefile.sops b/k8s/Makefile.sops
@@ -5,6 +5,7 @@
 #    make gen_sops_gpg    - Set up local PGP private key
 #    make secrets/foo.yml - Create a new secret
 #    make secrets/foo     - (without .yml) Upload secret to k8s
+#    K8S_NAMESPACE=other CONTEXT_FLAG=--context=sudo make secrets/foo  - Upload to alt namespace
 #    sops secrets/foo.yml - Edit secret
 #
 # Note:
@@ -13,6 +14,7 @@
 .PHONY: sops gen_sops_gpg
 
 sops: /usr/local/bin/sops
+CONTEXT_FLAG ?=
 
 /usr/local/bin/sops:
 ifeq ($(shell uname -s),Darwin)
@@ -55,10 +57,7 @@ SECRETS = $(basename $(wildcard secrets/*.yml secrets/*/*.yml))
 secrets: $(SECRETS)
 $(SECRETS):
 	-sops -d $@.yml | envsubst | \
-	 kubectl create -n $(K8S_NAMESPACE) -f -
-
-# TODO does this need sudo?
-# kubectl create -n $(K8S_NAMESPACE) --context=sudo -f -
+	 kubectl create -n $(K8S_NAMESPACE) $(CONTEXT_FLAG) -f -
 
 secrets/%.yml secrets/*/%yml:
 	@echo Creating secret $(@F)

diff --git a/k8s/Makefile.vars b/k8s/Makefile.vars
@@ -6,18 +6,13 @@
 
 export DOMAIN               ?= domain.com
 
-export CERT_MGR_EMAIL       ?= admin@$(DOMAIN)
 export CLUSTER_NETWORK      ?= flannel
 export DB_HOST              ?= db00.$(DOMAIN)
 export EDITOR               ?= vi
 export K8S_NAMESPACE        ?= worker
 export K8S_NODES            ?= kube1.$(DOMAIN) kube2.$(DOMAIN) kube3.$(DOMAIN)
 export K8S_WORKER_COUNT     ?= 3
 export K8S_VOLUMES_PATH     ?= /var/lib/docker/k8s-volumes
-export LIMIT_CPU_DEFAULT    ?= 500m
-export LIMIT_CPU_REQUEST    ?= 50m
-export LIMIT_MEM_DEFAULT    ?= 256Mi
-export LIMIT_MEM_REQUEST    ?= 64Mi
 export LOG_NAMESPACE        ?= logging
 export LOG_TO_SPLUNK        ?=
 export MYTHTV_VOL_SIZE      ?= 400Gi
@@ -31,17 +26,16 @@ export POOL_SIZE_SMALL       = 500Mi
 export TZ                   ?= UTC
 
 # IP addresses - TODO replace static IPs with names, if practical
-export K8S_INGRESS_NGINX_IP ?= 10.101.1.2
 export AUTHELIA_IP          ?= 10.101.1.5
-export MONITOR_EXT_IP       ?= 192.168.1.20
-export RSYSLOGD_IP          ?= 10.101.1.40
 export COREDNS_IP           ?= 10.96.0.10
+export K8S_INGRESS_NGINX_IP ?= 10.101.1.2
+export MONITOR_EXT_IP       ?= 192.168.1.20
 export NODE_LOCAL_DNS_IP    ?= 169.254.0.10
+export RSYSLOGD_IP          ?= 10.101.1.40
 
-# Exposed nodePorts - install/ingress-nginx.yaml, install/rsyslog-ext.yaml
+# Exposed nodePorts - install/ingress-nginx.yaml
 export NODEPORT_HTTP         ?= 30080
 export NODEPORT_HTTPS        ?= 30443
-export NODEPORT_SYSLOG       ?= 30514
 
 # Ports configured in ingress-nginx.yaml
 export PORT_DOVECOT_IMAPD    ?= 843

diff --git a/k8s/Makefile.versions b/k8s/Makefile.versions
@@ -1,8 +1,9 @@
 # Third-party versions
-export VERSION_CERT_MANAGER   ?= 1.21.1
+export VERSION_CERT_MANAGER   ?= 1.21.2
 export VERSION_DEFAULTBACKEND ?= 1.5
+export VERSION_ENVOY_GATEWAY  ?= 1.9.1
 export VERSION_FLANNEL        ?= 0.28.9
-export VERSION_HELM           ?= 4.1.0
+export VERSION_HELM           ?= 4.3.0
 export VERSION_INGRESS_NGINX  ?= 1.15.1
 export VERSION_METRICS        ?= 2.18.0
 export VERSION_NODE_LOCAL_DNS ?= 1.36.4