Edition gate

.github/workflows/ci.yml

@@ -14,6 +14,10 @@ on:
           - varnish-enterprise
           - varnish-controller
           - varnish-controller-router
+      varnish_cache_version:
+        description: "Varnish Cache OSS version to publish (required when publishing varnish-cache, e.g. 9.0.3)"
+        type: string
+        required: false
 
 jobs:
   build_and_push:
@@ -34,14 +38,26 @@ jobs:
           tar xavf /tmp/helm.tar.gz
           mv linux-amd64/helm /usr/local/bin/helm
 
-          pip install yq
-
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends bats parallel
+      - name: "Generate community chart"
+        if: matrix.chart == 'varnish-cache'
+        run: |
+          if [ "${{ github.event.inputs.publish }}" = "varnish-cache" ]; then
+            if [ -z "${{ github.event.inputs.varnish_cache_version }}" ]; then
+              echo "Error: varnish_cache_version input is required when publishing varnish-cache"
+              exit 1
+            fi
+            VERSION="${{ github.event.inputs.varnish_cache_version }}"
+          else
+            VERSION="latest"
+          fi
+          bash ci/publish-community.sh "$VERSION" dist/varnish-cache
       - name: "Add Helm dependencies"
         # See also: https://circleci.com/docs/env-vars/#alpine-linux
         run: |
-            cd ${{ matrix.chart }}
+            CHART_DIR=${{ matrix.chart == 'varnish-cache' && 'dist/varnish-cache' || matrix.chart }}
+            cd "$CHART_DIR"
             # Helm is painful https://github.com/helm/helm/issues/8036
             i=0
             yq -r '.dependencies[]?.repository' < Chart.yaml | while read -r p; do
@@ -51,21 +67,23 @@ jobs:
             helm dependency build
       - name: "Unit tests"
         run: |
-          if [ -x ${{ matrix.chart }}/test/unit/run.sh ]; then 
+          if [ -x ${{ matrix.chart }}/test/unit/run.sh ]; then
             ${{ matrix.chart }}/test/unit/run.sh -j 50
           fi
-          if [ -x ${{ matrix.chart }}/test/unit_common/run.sh ]; then 
+          if [ -x ${{ matrix.chart }}/test/unit_common/run.sh ]; then
             ${{ matrix.chart }}/test/unit_common/run.sh -j 50
           fi
       - name: Create package
         run: |
-          helm package "${{ matrix.chart }}"
+          CHART_DIR=${{ matrix.chart == 'varnish-cache' && 'dist/varnish-cache' || matrix.chart }}
+          helm package "$CHART_DIR"
           mkdir -p /tmp/artifacts
           cp "${{ matrix.chart }}"-*.tgz /tmp/artifacts
       - name: "Check version does not already exist"
         if: ${{ github.event.inputs.publish == matrix.chart }}
         run: |
-          VERSION=$(yq -r '.version' "${{ matrix.chart }}/Chart.yaml")
+          CHART_DIR=${{ matrix.chart == 'varnish-cache' && 'dist/varnish-cache' || matrix.chart }}
+          VERSION=$(yq -r '.version' "$CHART_DIR/Chart.yaml")
           echo ${{ secrets.DOCKERHUB_TOKEN }} | helm registry login -u "varnish" --password-stdin registry-1.docker.io
           if helm pull "oci://registry-1.docker.io/varnish/${{ matrix.chart }}" --version "$VERSION" --destination /tmp 2>/dev/null; then
             echo "Error: ${{ matrix.chart }} version $VERSION already exists in the registry"

README.md

@@ -2,11 +2,38 @@
 
 This repository hosts Helm charts for Varnish Cache and related projects.
 
-## Documentation
+## Charts
 
-For documentation, please see README.md in each chart's directory.
+### Varnish Enterprise
+
+The `varnish-enterprise/` chart is the **single source of truth** for both the enterprise and community charts. It targets the Varnish Enterprise image from `quay.io/varnish-software/varnish-plus` by default.
+
+For full documentation see the [Varnish Enterprise Helm Chart docs](https://docs.varnish-software.com/varnish-helm/varnish-enterprise/).
+
+### Varnish Cache (Community)
+
+The community chart is **generated** from the enterprise chart at publish time. It is not maintained separately. Do not edit the `varnish-cache/` directory by hand.
+
+To build the community chart:
+
+```sh
+./ci/publish-community.sh <oss-version> [output-dir]
+```
+
+- `oss-version`: the Varnish Cache OSS release to target, e.g. `9.0.3`. This sets the `appVersion` in `Chart.yaml` and the default image tag (`docker.io/varnish:<oss-version>`).
+- `output-dir`: where to write the generated chart. Defaults to `./dist/varnish-cache`.
+
+Example:
+
+```sh
+./ci/publish-community.sh 9.0.3
+helm package dist/varnish-cache --destination dist/packages
+```
+
+The script requires [`yq`](https://github.com/mikefarah/yq) (go-yq) and `helm`.
+
+### Other Charts
 
-- [varnish-cache](varnish-cache/README.md)
 - [orca-chart](orca-chart/README.md)
 
 ## Enterprise Customers

ci/publish-community.sh

@@ -0,0 +1,79 @@
+#!/bin/sh
+# Builds the varnish-cache community chart from the varnish-enterprise source.
+#
+# The enterprise chart is the single source of truth. This script transforms it
+# into the community chart by switching the edition, changing the default image,
+# and stripping enterprise-only values so they never appear in the published chart.
+#
+# Usage:
+#   ./ci/publish-community.sh <oss-version> [output-dir]
+#
+# oss-version: the Varnish Cache release to target, e.g. "9.0.3"
+#              This sets Chart.yaml appVersion and the default image tag.
+# output-dir:  defaults to ./dist/varnish-cache
+#
+# Requires yq (https://github.com/mikefarah/yq) and helm.
+
+set -e
+
+if [ -z "$1" ]; then
+    echo "Usage: $0 <oss-version> [output-dir]" >&2
+    echo "  e.g. $0 9.0.3" >&2
+    exit 1
+fi
+
+OSS_VERSION="$1"
+REPO_ROOT="$(realpath "$(dirname "$0")/..")"
+SRC="$REPO_ROOT/varnish-enterprise"
+OUT="${2:-$REPO_ROOT/dist/varnish-cache}"
+
+# Allow the caller to override which yq binary to use via YQ=/path/to/yq.
+# This is needed in CI where python-yq and go-yq may both be present.
+YQ="${YQ:-yq}"
+
+if ! command -v "$YQ" > /dev/null 2>&1; then
+    echo "Error: yq is required (https://github.com/mikefarah/yq)" >&2
+    exit 1
+fi
+
+if ! command -v helm > /dev/null 2>&1; then
+    echo "Error: helm is required" >&2
+    exit 1
+fi
+
+echo "Building community chart from $SRC -> $OUT (Varnish Cache $OSS_VERSION)"
+
+rm -rf "$OUT"
+mkdir -p "$(dirname "$OUT")"
+cp -r "$SRC" "$OUT"
+
+# Patch Chart.yaml: rename, update description, and set the OSS appVersion.
+# OSS_VERSION is passed via the environment so yq can reference it with strenv().
+OSS_VERSION="$OSS_VERSION" "$YQ" -i '
+    .name = "varnish-cache" |
+    .description = "Varnish Cache Helm Chart" |
+    .appVersion = strenv(OSS_VERSION)
+' "$OUT/Chart.yaml"
+
+# Switch edition and image defaults, enable malloc, strip enterprise-only sections.
+# go-yq preserves comments on sections that are not deleted.
+"$YQ" -i '
+    .global.edition = "community" |
+    .server.image.repository = "docker.io/varnish" |
+    .server.malloc.enabled = true |
+    del(.server.mse) |
+    del(.server.mse4) |
+    del(.server.agent) |
+    del(.server.initAgent) |
+    del(.server.otel) |
+    del(.server.baseUrl) |
+    del(.server.licenseSecret) |
+    del(.cluster) |
+    del(.natsServer)
+' "$OUT/values.yaml"
+
+helm lint "$OUT"
+
+echo "Community chart written to $OUT"
+echo "  appVersion: $OSS_VERSION (default image: docker.io/varnish:$OSS_VERSION)"
+echo "To package: helm package $OUT --destination ./dist/packages"

varnish-cache/test/unit/daemonset.bats

@@ -49,7 +49,7 @@ load _helpers
         --namespace default \
         --show-only templates/daemonset.yaml \
         . || echo "---") | tee -a /dev/stderr |
-        yq -r -c '.spec.updateStrategy' | tee -a /dev/stderr)
+        yq -r -o=json -I=0 '.spec.updateStrategy' | tee -a /dev/stderr)
 
     [ "${actual}" == "null" ]
 }
@@ -64,7 +64,7 @@ load _helpers
         --namespace default \
         --show-only templates/daemonset.yaml \
         . || echo "---") | tee -a /dev/stderr |
-        yq -r -c '.spec.updateStrategy' | tee -a /dev/stderr)
+        yq -r -o=json -I=0 '.spec.updateStrategy' | tee -a /dev/stderr)
 
     [ "${actual}" == '{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}' ]
 }
@@ -84,7 +84,7 @@ rollingUpdate:
         --namespace default \
         --show-only templates/daemonset.yaml \
         . || echo "---") | tee -a /dev/stderr |
-        yq -r -c '.spec.updateStrategy' | tee -a /dev/stderr)
+        yq -r -o=json -I=0 '.spec.updateStrategy' | tee -a /dev/stderr)
 
     [ "${actual}" == '{"type":"RollingUpdate","rollingUpdate":{"maxUnavailable":1}}' ]
 }

varnish-cache/test/unit/deployment.bats

@@ -32,7 +32,7 @@ load _helpers
         --namespace default \
         --show-only templates/deployment.yaml \
         . || echo "---") | tee -a /dev/stderr |
-        yq -r -c '.spec.strategy' | tee -a /dev/stderr)
+        yq -r -o=json -I=0 '.spec.strategy' | tee -a /dev/stderr)
 
     [ "${actual}" == "null" ]
 }
@@ -47,7 +47,7 @@ load _helpers
         --namespace default \
         --show-only templates/deployment.yaml \
         . || echo "---") | tee -a /dev/stderr |
-        yq -r -c '.spec.strategy' | tee -a /dev/stderr)
+        yq -r -o=json -I=0 '.spec.strategy' | tee -a /dev/stderr)
 
     [ "${actual}" == '{"rollingUpdate":{"maxUnavailable":1},"type":"RollingUpdate"}' ]
 }
@@ -67,7 +67,7 @@ rollingUpdate:
         --namespace default \
         --show-only templates/deployment.yaml \
         . || echo "---") | tee -a /dev/stderr |
-        yq -r -c '.spec.strategy' | tee -a /dev/stderr)
+        yq -r -o=json -I=0 '.spec.strategy' | tee -a /dev/stderr)
 
     [ "${actual}" == '{"type":"RollingUpdate","rollingUpdate":{"maxUnavailable":1}}' ]
 }

varnish-cache/test/unit/extra.bats

@@ -51,13 +51,13 @@ EOF
         . || echo "---") |
         tee -a /dev/stderr)
 
-    local actual=$(echo "$object" | yq -c | wc -l | tee -a /dev/stderr)
+    local actual=$(echo "$object" | yq -o=json -I=0 | wc -l | tee -a /dev/stderr)
     [ "${actual}" == "2" ]
 
-    local actual=$(echo "$object" | yq -r -c 'select(.metadata.name == "release-name-clusterrole")' | tee -a /dev/stderr)
+    local actual=$(echo "$object" | yq -r -o=json -I=0 'select(.metadata.name == "release-name-clusterrole")' | tee -a /dev/stderr)
     [ "${actual}" == '{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"name":"release-name-clusterrole"},"rules":[{"apiGroups":[""],"resources":["endpoints"],"verbs":["get","list","watch"]}]}' ]
 
-    local actual=$(echo "$object" | yq -r -c 'select(.metadata.name == "release-name-clusterrolebinding")' | tee -a /dev/stderr)
+    local actual=$(echo "$object" | yq -r -o=json -I=0 'select(.metadata.name == "release-name-clusterrolebinding")' | tee -a /dev/stderr)
     [ "${actual}" == '{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"name":"release-name-clusterrolebinding"},"roleRef":{"kind":"ClusterRole","name":"release-name-clusterrole","apiGroup":"rbac.authorization.k8s.io"},"subjects":[{"kind":"ServiceAccount","name":"release-name","namespace":"default"}]}' ]
 }
 
@@ -100,12 +100,12 @@ EOF
         . || echo "---") |
         tee -a /dev/stderr)
 
-    local actual=$(echo "$object" | yq -c | wc -l | tee -a /dev/stderr)
+    local actual=$(echo "$object" | yq -o=json -I=0 | wc -l | tee -a /dev/stderr)
     [ "${actual}" == "2" ]
 
-    local actual=$(echo "$object" | yq -r -c 'select(.metadata.name == "varnish-cache-clusterrole")' | tee -a /dev/stderr)
+    local actual=$(echo "$object" | yq -r -o=json -I=0 'select(.metadata.name == "varnish-cache-clusterrole")' | tee -a /dev/stderr)
     [ "${actual}" == '{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"name":"varnish-cache-clusterrole"},"rules":[{"apiGroups":[""],"resources":["endpoints"],"verbs":["get","list","watch"]}]}' ]
 
-    local actual=$(echo "$object" | yq -r -c 'select(.metadata.name == "varnish-cache-clusterrolebinding")' | tee -a /dev/stderr)
+    local actual=$(echo "$object" | yq -r -o=json -I=0 'select(.metadata.name == "varnish-cache-clusterrolebinding")' | tee -a /dev/stderr)
     [ "${actual}" == '{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"name":"varnish-cache-clusterrolebinding"},"roleRef":{"apiGroup":"rbac.authorization.k8s.io","kind":"ClusterRole","name":"varnish-cache-clusterrole"},"subjects":[{"kind":"ServiceAccount","name":"varnish-cache","namespace":"default"}]}' ]
 }

varnish-cache/test/unit/hpa.bats

@@ -24,24 +24,24 @@ load _helpers
         . || echo "---") | tee -a /dev/stderr)
 
     local actual=$(echo "$object" |
-        yq -r -c 'length > 0' |
+        yq -r -o=json -I=0 'length > 0' |
         tee -a /dev/stderr)
     [ "${actual}" == "true" ]
 
     local actual=$(echo "$object" |
-        yq -r -c '.spec.minReplicas' |
+        yq -r -o=json -I=0 '.spec.minReplicas' |
         tee -a /dev/stderr)
     [ "${actual}" == "2" ]
 
     local actual=$(echo "$object" |
-        yq -r -c '.spec.maxReplicas' |
+        yq -r -o=json -I=0 '.spec.maxReplicas' |
         tee -a /dev/stderr)
     [ "${actual}" == "10" ]
 
     local actual=$(echo "$object" |
-        yq -r -c '.spec.maxReplicas | type' |
+        yq -r -o=json -I=0 '.spec.maxReplicas | type' |
         tee -a /dev/stderr)
-    [ "${actual}" == "number" ]
+    [ "${actual}" == "!!int" ]
 }
 
 @test "HorizontalPodAutoscaler/behavior: can be set" {
@@ -57,7 +57,7 @@ load _helpers
         . || echo "---") | tee -a /dev/stderr)
 
     local actual=$(echo "$object" |
-        yq -r -c '.spec.behavior' |
+        yq -r -o=json -I=0 '.spec.behavior' |
         tee -a /dev/stderr)
     [ "${actual}" == '{"scaleDown":{"policies":[{"periodSeconds":60,"type":"Pods","value":4}]}}' ]
 }
@@ -80,7 +80,7 @@ scaleDown:
         . || echo "---") | tee -a /dev/stderr)
 
     local actual=$(echo "$object" |
-        yq -r -c '.spec.behavior' |
+        yq -r -o=json -I=0 '.spec.behavior' |
         tee -a /dev/stderr)
     [ "${actual}" == '{"scaleDown":{"policies":[{"type":"Pods","value":4,"periodSeconds":60}]}}' ]
 }
@@ -99,7 +99,7 @@ scaleDown:
         . || echo "---") | tee -a /dev/stderr)
 
     local actual=$(echo "$object" |
-        yq -r -c '.spec.metrics' |
+        yq -r -o=json -I=0 '.spec.metrics' |
         tee -a /dev/stderr)
     [ "${actual}" == '[{"resource":{"name":"cpu","target":{"averageUtilization":50,"type":"Utilization"}},"type":"Resource"}]' ]
 }
@@ -123,7 +123,7 @@ scaleDown:
         . || echo "---") | tee -a /dev/stderr)
 
     local actual=$(echo "$object" |
-        yq -r -c '.spec.metrics' |
+        yq -r -o=json -I=0 '.spec.metrics' |
         tee -a /dev/stderr)
     [ "${actual}" == '[{"type":"Resources","resource":{"name":"cpu","target":{"type":"Utilization","averageUtilization":50}}}]' ]
 }