Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform.
cute.haus
ansible
terraform
nix
k8s
just: render global values from generated configmap
Aly Raffauf
(Jul 1, 2026, 6:04 PM EDT)
7c2efdfb
7c3be6ed
+36
-5
+13
-3
.github/workflows/check-config.yml
+13
-3
.github/workflows/check-config.yml
···
32
32
- uses: actions/checkout@v7
33
33
with: { fetch-depth: 1 }
34
34
- uses: azure/setup-helm@v5
35
-
- name: helm template each local chart
35
+
- uses: azure/setup-kubectl@v4
36
+
- name: helm template each local chart with the generated global values
36
37
run: |
37
-
set -e
38
+
set -euo pipefail
39
+
# Source the same cute-haus-global values Flux feeds charts via
40
+
# valuesFrom, straight from the generated ConfigMap — no plain values
41
+
# file to drift. Full valuesFrom-resolving render lives in local
42
+
# `just flux-test`; it can't run in public CI because decrypting the
43
+
# SOPS secrets layer risks leaking plaintext into public logs.
44
+
values="$(mktemp)"
45
+
kubectl kustomize k8s/flux/sources \
46
+
| yq e 'select(.kind == "ConfigMap" and .metadata.name == "cute-haus-global") | .data["values.yaml"]' - \
47
+
> "$values"
38
48
for chart in k8s/charts/*/; do
39
49
name="$(basename "$chart")"
40
50
[[ "$name" == "common" ]] && continue
41
51
echo "::group::$name"
42
52
helm dependency update "$chart" >/dev/null
43
-
helm template "$chart" -f k8s/values/global.yaml >/dev/null
53
+
helm template "$chart" -f "$values" >/dev/null
44
54
echo "::endgroup::"
45
55
done
46
56
+21
-2
.justfile
+21
-2
.justfile
···
181
181
for dir in k8s/flux/system k8s/flux/sources k8s/flux/secrets k8s/flux/infra-crds k8s/flux/infra-core k8s/flux/platform k8s/flux/apps k8s/flux/external-routes; do kubectl kustomize "$dir" >/dev/null; done
182
182
nix flake check --impure
183
183
184
+
# Render every HelmRelease the way Flux does (resolving valuesFrom), like CI.
185
+
# flux-local isn't packaged in nixpkgs; run it via uv (uses the devShell's
186
+
# kustomize/helm/flux binaries).
187
+
[group('kubes')]
188
+
flux-test:
189
+
uvx flux-local@8.3.0 test --enable-helm --path k8s/flux
190
+
184
191
# Bump a digest-pinned chart image to its current upstream digest.
185
192
# Usage: just bump <chart> | just bump --all | just bump --check
186
193
[group('kubes')]
···
203
210
fi
204
211
}
205
212
213
+
# Render the cute-haus-global values to a temp file — the same ConfigMap
214
+
# Flux feeds every chart via valuesFrom, so local apply/diff match runtime.
215
+
global_values() {
216
+
local out; out="$(mktemp)"
217
+
kubectl kustomize k8s/flux/sources \
218
+
| yq e 'select(.kind == "ConfigMap" and .metadata.name == "cute-haus-global") | .data["values.yaml"]' - \
219
+
> "$out"
220
+
echo "$out"
221
+
}
222
+
206
223
case "{{action}}" in
207
224
apply)
208
225
if [[ ! -f "$chart/Chart.yaml" ]]; then
209
226
echo "just k8s apply supports local charts only: $chart/Chart.yaml not found" >&2
210
227
exit 2
211
228
fi
229
+
values="$(global_values)"; trap 'rm -f "$values"' EXIT
212
230
flux_cmd suspend helmrelease "{{release}}" -n "{{hr_namespace}}" || true
213
231
helm upgrade --install "{{release}}" "$chart" \
214
-
-n "{{namespace}}" -f k8s/values/global.yaml
232
+
-n "{{namespace}}" -f "$values"
215
233
;;
216
234
diff)
217
235
if [[ ! -f "$chart/Chart.yaml" ]]; then
218
236
echo "just k8s diff supports local charts only: $chart/Chart.yaml not found" >&2
219
237
exit 2
220
238
fi
239
+
values="$(global_values)"; trap 'rm -f "$values"' EXIT
221
240
helm diff upgrade --allow-unreleased "{{release}}" "$chart" \
222
-
-n "{{namespace}}" -f k8s/values/global.yaml
241
+
-n "{{namespace}}" -f "$values"
223
242
;;
224
243
suspend)
225
244
flux_cmd suspend helmrelease "{{release}}" -n "{{hr_namespace}}"