upgrading-chart

chainloop-dev's avatarfrom chainloop-dev

Upgrades Helm chart dependencies (PostgreSQL, Vault) in the Chainloop project, including vendorized charts, container images, and CI/CD workflows. Use when the user mentions upgrading Helm charts, Bitnami dependencies, PostgreSQL chart, or Vault chart. CRITICAL - Major version upgrades are FORBIDDEN and must be escalated.

⭐517stars🔀41forks📁View on GitHub🕐Updated Dec 26, 2025
[CI and CD]

When & Why to Use This Skill

This Claude skill automates the end-to-end process of upgrading Helm chart dependencies, specifically for PostgreSQL and Vault within the Chainloop project. It streamlines DevOps workflows by managing vendorized charts, container image versions, and CI/CD configurations while enforcing strict safety guardrails against breaking major version changes to ensure infrastructure stability.

Use Cases

  • 1. Automated Dependency Maintenance: Efficiently upgrading Bitnami-based charts to the latest minor or patch versions to maintain security, performance, and stability without manual file manipulation.
  • 2. Container Image Synchronization: Updating specific container image tags and automatically reflecting these changes across Helm manifests and associated GitHub Actions workflows for consistent builds.
  • 3. Infrastructure Compliance and Safety: Ensuring all Helm upgrades adhere to strict versioning policies by automatically detecting and blocking forbidden major version jumps, reducing the risk of breaking production environments.
nameupgrading-chart
descriptionUpgrades Helm chart dependencies (PostgreSQL, Vault) in the Chainloop project, including vendorized charts, container images, and CI/CD workflows. Use when the user mentions upgrading Helm charts, Bitnami dependencies, PostgreSQL chart, or Vault chart. CRITICAL - Major version upgrades are FORBIDDEN and must be escalated.

Upgrading Helm Chart Dependencies

This skill automates the upgrade process for Helm chart dependencies in the Chainloop project. Supports PostgreSQL and Vault (both Bitnami charts).

CRITICAL RESTRICTIONS

Version Upgrade Rules:

  • Patch upgrades (1.2.3 → 1.2.4): ALLOWED
  • Minor upgrades (1.2.x → 1.3.x): ALLOWED
  • Major upgrades (1.x.x → 2.x.x): FORBIDDEN - STOP IMMEDIATELY

MANDATORY: If major version upgrade is detected, STOP the process and inform the user that manual review is required.

Upgrade Types

The skill supports two upgrade types:

  1. Specific Image Upgrade: Update container image to specific version (chart unchanged)
  2. Chart Minor Version Upgrade: Update chart to latest minor version (may include image updates)

IMPORTANT: Container images are ONLY updated as part of chart upgrades, never independently (unless Type 1).

Process

1. Identify Upgrade Type

Ask the user which type of upgrade they want:

  • Type 1: Specific image version upgrade
  • Type 2: Latest minor chart version upgrade

Also ask which chart: postgresql or vault

2. Pre-Upgrade Validation

Check current state:

cat deployment/chainloop/charts/<chart-name>/Chart.yaml | grep "^version:"
cat deployment/chainloop/charts/<chart-name>/Chart.yaml | grep "^appVersion:"

3. Version Compatibility Check

For any version change, validate that major version remains the same:

CURRENT_MAJOR=$(echo "$CURRENT_VERSION" | cut -d. -f1)
TARGET_MAJOR=$(echo "$TARGET_VERSION" | cut -d. -f1)

if [ "$CURRENT_MAJOR" != "$TARGET_MAJOR" ]; then
    echo "FORBIDDEN: Major version upgrade detected"
    exit 1
fi

If major version upgrade detected, STOP and escalate.

Type 1: Specific Image Upgrade

See image-upgrade-process.md for detailed steps.

Summary:

  1. Locate target container image in Bitnami Containers
  2. Find commit with release message pattern
  3. Extract APP_VERSION from Dockerfile
  4. Update deployment/charts/<chart-name>/Chart.yaml appVersion
  5. Update .github/workflows/build_external_container_images.yaml commit hash

Type 2: Chart Minor Version Upgrade

See chart-upgrade-process.md for detailed steps.

Summary:

  1. Locate target chart version in Bitnami Charts CHANGELOG.md
  2. Validate minor version upgrade only
  3. Download and extract target chart
  4. Check for image changes (compare Chart.yaml)
  5. If images changed, update container image references
  6. Vendorize chart update (copy files)
  7. Update dependencies in correct order
  8. Update main chart dependency version
  9. Clean up temporary files

Verification

After any upgrade type, run:

# Lint charts
helm lint deployment/charts/<chart-name>
helm lint deployment/chainloop

# Template validation
helm template deployment/charts/<chart-name>
helm template deployment/chainloop

# Local testing
cd devel && docker compose up

# Verify image consistency
grep -r "appVersion\|image.*tag" deployment/charts/<chart-name>/

Files Modified

See files-modified.md for complete list.

Troubleshooting

Common issues:

  • Image Version Mismatch: Verify APP_VERSION matches Chart.yaml appVersion
  • Build Failures: Check commit reference in build workflow
  • Dependency Conflicts: Verify dependencies updated in correct order (vendorized first, then main chart)

Rollback

If issues occur:

git checkout HEAD -- deployment/
find deployment/ -name "Chart.lock" -delete
cd deployment/chainloop && helm dependency build
cd ../../devel && docker compose down && docker compose up

Important Notes

  • Dex is self-managed and follows a separate process (not covered by this skill)
  • Always use commit hashes for reproducibility
  • Dependencies must be updated in correct order: vendorized chart first, then main chart
  • Container images are found in Bitnami Containers repo, charts in Bitnami Charts repo