{"id":31769145,"url":"https://github.com/guacsec/trustify-helm-charts","last_synced_at":"2026-01-20T17:19:41.697Z","repository":{"id":263026335,"uuid":"887777364","full_name":"guacsec/trustify-helm-charts","owner":"guacsec","description":"Helm charts for Trustify","archived":false,"fork":false,"pushed_at":"2025-11-18T12:29:00.000Z","size":160,"stargazers_count":0,"open_issues_count":4,"forks_count":8,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-11-30T22:51:53.388Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://guacsec.github.io/trustify-helm-charts/","language":"Smarty","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/guacsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-11-13T09:13:32.000Z","updated_at":"2025-11-18T12:29:04.000Z","dependencies_parsed_at":"2025-03-20T16:22:17.875Z","dependency_job_id":"16ec6e43-4c0b-452f-82af-35f7f0d4642d","html_url":"https://github.com/guacsec/trustify-helm-charts","commit_stats":null,"previous_names":["trustification/trustify-helm-charts","guacsec/trustify-helm-charts"],"tags_count":39,"template":false,"template_full_name":null,"purl":"pkg:github/guacsec/trustify-helm-charts","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-helm-charts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-helm-charts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-helm-charts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-helm-charts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/guacsec","download_url":"https://codeload.github.com/guacsec/trustify-helm-charts/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-helm-charts/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28607625,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-20T16:10:39.856Z","status":"ssl_error","status_checked_at":"2026-01-20T16:10:39.493Z","response_time":117,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-10T02:29:07.250Z","updated_at":"2026-01-20T17:19:41.679Z","avatar_url":"https://github.com/guacsec.png","language":"Smarty","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Deploying Trustify using Helm\n\n## From a local checkout\n\nFrom a local copy of the repository, execute one of the following deployments.\n\n### Minikube\n\nCreate a new cluster:\n\n```bash\nminikube start --cpus 8 --memory 24576 --disk-size 20gb --addons ingress,dashboard\n```\n\nCreate a new namespace:\n\n```bash\nkubectl create ns trustify\n```\n\nUse it as default:\n\n```bash\nkubectl config set-context --current --namespace=trustify\n```\n\nEvaluate the application domain and namespace:\n\n```bash\nNAMESPACE=trustify\nAPP_DOMAIN=.$(minikube ip).nip.io\n```\n\nInstall the infrastructure services:\n\n```bash\nhelm upgrade --install --dependency-update -n $NAMESPACE infrastructure charts/trustify-infrastructure --values values-minikube.yaml --set-string keycloak.ingress.hostname=sso$APP_DOMAIN --set-string appDomain=$APP_DOMAIN\n```\n\nThen deploy the application:\n\n```bash\nhelm upgrade --install -n $NAMESPACE trustify charts/trustify --values values-minikube.yaml --set-string appDomain=$APP_DOMAIN\n```\n\n#### Enable tracing and metrics\n\n```bash\nhelm upgrade --install --dependency-update -n $NAMESPACE infrastructure charts/trustify-infrastructure --values values-minikube.yaml --set-string keycloak.ingress.hostname=sso$APP_DOMAIN --set-string appDomain=$APP_DOMAIN --set jaeger.enabled=true --set-string jaeger.allInOne.ingress.host=jaeger$APP_DOMAIN --set tracing.enabled=true --set prometheus.enabled=true --set-string prometheus.server.ingress.host=prometheus$APP_DOMAIN --set metrics.enabled=true\n```\n\nUsing the default http://infrastructure-otelcol:4317 OpenTelemetry collector endpoint. This works with the previous\ncommand of the default infrastructure deployment:\n\n```bash\nhelm upgrade --install -n $NAMESPACE trustify charts/trustify --values values-minikube.yaml --set-string appDomain=$APP_DOMAIN --set tracing.enabled=true --set metrics.enabled=true\n```\n\nSetting an explicit OpenTelemetry collector endpoint:\n\n```bash\nhelm upgrade --install -n $NAMESPACE trustify charts/trustify --values values-minikube.yaml --set-string appDomain=$APP_DOMAIN --set tracing.enabled=true --set metrics.enabled=true --set-string collector.endpoint=\"http://infrastructure-otelcol:4317\"\n```\n\n### Kind\n\nCreate a new cluster:\n\n```bash\nkind create cluster --config kind/config.yaml\nkubectl apply -f https://kind.sigs.k8s.io/examples/ingress/deploy-ingress-nginx.yaml\n```\n\nThe rest works like the `minikube` approach. The `APP_DOMAIN` is different though:\n\n```bash\nAPP_DOMAIN=.$(kubectl get node kind-control-plane -o jsonpath='{.status.addresses[?(@.type == \"InternalIP\")].address}' | awk '// { print $1 }').nip.io\n```\n\n#### Important Note for Kind + Podman Users (macOS/Windows)\n\nWhen using Kind with Podman (instead of Docker Desktop), the Kind cluster runs inside a VM managed by Podman. This creates a networking scenario where:\n\n- **Pod's localhost** = the pod itself (not the VM, not the host)\n- **VM localhost** = the VM (not the host)\n- **Host localhost** = your actual machine\n\nFor proper networking, you need to use `APP_DOMAIN=.127.0.0.1.nip.io` and patch the CoreDNS configuration:\n\n1. **Get the ingress controller ClusterIP:**\n   ```bash\n   kubectl -n ingress-nginx get svc ingress-nginx-controller -o jsonpath='{.spec.clusterIP}'\n   ```\n\n2. **Patch the CoreDNS configuration:**\n   ```bash\n   kubectl -n kube-system get configmap coredns -o yaml \u003e coredns-config.yaml\n   ```\n   \n   Edit the `coredns-config.yaml` file and add the following to the `Corefile` section:\n   ```yaml\n   hosts {\n       10.96.75.197 sso.127.0.0.1.nip.io  # Replace 10.96.75.197 with your actual ClusterIP\n       fallthrough\n   }\n   ```\n   \n   Apply the updated configuration:\n   ```bash\n   kubectl -n kube-system apply -f coredns-config.yaml\n   ```\n\n3. **Restart CoreDNS:**\n   ```bash\n   kubectl -n kube-system rollout restart deployment coredns\n   ```\n\nThis ensures that DNS resolution works correctly within the Kind cluster when using Podman.\n\n### CRC\n\nCreate a new cluster:\n\n```bash\ncrc start --cpus 8 --memory 32768 --disk-size 80\n```\n\nCreate a new namespace:\n\n```bash\noc new-project trustify\n```\n\nEvaluate the application domain and namespace:\n\n```bash\nNAMESPACE=trustify\nAPP_DOMAIN=-$NAMESPACE.$(oc -n openshift-ingress-operator get ingresscontrollers.operator.openshift.io default -o jsonpath='{.status.domain}')\n```\n\nProvide the trust anchor:\n\n```bash\noc get secret -n openshift-ingress router-certs-default -o go-template='{{index .data \"tls.crt\"}}' | base64 -d \u003e tls.crt\noc create configmap crc-trust-anchor --from-file=tls.crt -n trustify\nrm tls.crt\n```\n\nDeploy the infrastructure:\n\n```bash\nhelm upgrade --install --dependency-update -n $NAMESPACE infrastructure charts/trustify-infrastructure --values values-ocp-no-aws.yaml --set-string keycloak.ingress.hostname=sso$APP_DOMAIN --set-string appDomain=$APP_DOMAIN\n```\n\nDeploy the application:\n\n```bash\nhelm upgrade --install -n $NAMESPACE trustify charts/trustify --values values-ocp-no-aws.yaml --set-string appDomain=$APP_DOMAIN --values values-crc.yaml\n```\n\n## OpenShift with AWS resources\n\nInstead of using Keycloak and the filesystem storage, it is also possible to use AWS Cognito and S3.\n\nDeploy only the application:\n\n```bash\nhelm upgrade --install -n $NAMESPACE trustify charts/trustify --values values-ocp-aws.yaml --set-string appDomain=$APP_DOMAIN\n```\n\n## From a released chart\n\nInstead of using a local checkout, you can also use a released chart.\n\n\u003e [!NOTE]\n\u003e You will still need a \"values\" files, providing the necessary information. If you don't clone the repository, you'll\n\u003e need to create a value yourself.\n\nFor this, you will need to add the following repository:\n\n```bash\nhelm repo add trustify https://guacsec.github.io/trustify-helm-charts/\n```\n\nAnd then, modify any of the previous `helm` commands to use:\n\n```bash\nhelm […] --devel trustify/\u003cchart\u003e […]\n```\n\n## Ingress Configuration\n\nThe Trustify Helm chart supports flexible ingress configuration with multiple hostnames and automatic TLS setup.\n\n### Default Behavior\n\nBy default, the chart creates an ingress with a single hostname using the pattern `{service-name}{appDomain}`:\n\n```yaml\n# Default configuration\nappDomain: .example.com\n# Results in hostname: server.example.com\n```\n\n### Multiple Hostnames\n\nYou can configure multiple hostnames for the same service:\n\n```yaml\ningress:\n  hosts:\n    - \"api.trustify.com\"\n    - \"api-staging.trustify.com\"\n    - \"api-dev.trustify.com\"\n```\n\n### Custom TLS Configuration\n\nFor advanced scenarios, you can provide explicit TLS configuration:\n\n```yaml\ningress:\n  hosts:\n    - \"api.trustify.com\"\n    - \"api-staging.trustify.com\"\n  tls:\n    - hosts:\n        - \"api.trustify.com\"\n        - \"api-staging.trustify.com\"\n      secretName: \"custom-tls\"\n```\n\n### Multiple TLS Blocks\n\nYou can configure different TLS secrets for different host groups:\n\n```yaml\ningress:\n  hosts:\n    - \"api.trustify.com\"\n    - \"api-staging.trustify.com\"\n    - \"api-dev.trustify.com\"\n  tls:\n    - hosts:\n        - \"api.trustify.com\"\n        - \"api-staging.trustify.com\"\n      secretName: \"prod-tls\"\n    - hosts:\n        - \"api-dev.trustify.com\"\n      secretName: \"dev-tls\"\n```\n\n### Module-level Overrides\n\nYou can override global ingress settings at the module level:\n\n```yaml\ningress:\n  hosts:\n    - \"default.example.com\"\nmodules:\n  server:\n    ingress:\n      hosts:\n        - \"api.trustify.com\"\n        - \"api-staging.trustify.com\"\n```\n\n### Ingress Class and Annotations\n\nConfigure ingress class and additional annotations:\n\n```yaml\ningress:\n  className: \"nginx\"\n  additionalAnnotations:\n    nginx.ingress.kubernetes.io/rate-limit: \"100\"\n    nginx.ingress.kubernetes.io/ssl-redirect: \"true\"\n```\n\n### Disable Ingress\n\nYou can disable ingress creation globally or per module:\n\n```yaml\n# Disable globally\ningress:\n  enabled: false\n\n# Disable per module\nmodules:\n  server:\n    enabled: false\n```\n\n## Initial set of importers\n\nYou can create an initial set of importers by adding the values file `values-importers.yaml`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fguacsec%2Ftrustify-helm-charts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fguacsec%2Ftrustify-helm-charts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fguacsec%2Ftrustify-helm-charts/lists"}