Merge branch 'renovate/ironbank' into 'main'

Update Ironbank

See merge request !12

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
+## [34.120.0-bb.0] - 2023-03-24
+### Changed
+- Added standard Network Policies
+- Update renovate.json to include `helmv3` manager
+- Update redis dependency to reference OCI artifact
+- Update to application and chart version to `34.120.0`
+
 ## [32.38.0-bb.1] - 2023-03-22
 ### Added
 - Added `renovate.json` configuration to project root for renovate updates

README.md

 # renovate
 
-![Version: 32.38.0-bb.1](https://img.shields.io/badge/Version-32.38.0--bb.1-informational?style=flat-square) ![AppVersion: 32.38.0](https://img.shields.io/badge/AppVersion-32.38.0-informational?style=flat-square)
+![Version: 34.120.0-bb.0](https://img.shields.io/badge/Version-34.120.0--bb.0-informational?style=flat-square) ![AppVersion: 34.120.0](https://img.shields.io/badge/AppVersion-34.120.0-informational?style=flat-square)
 
 Universal dependency update tool that fits into your workflows.
 
@@ -36,46 +36,72 @@ helm install renovate chart/
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| cronjob.schedule | string | `"0 1 * * *"` |  |
+| global.commonLabels | object | `{}` | Additional labels to be set on all renovate resources |
+| nameOverride | string | `""` | Override the name of the chart |
+| fullnameOverride | string | `""` | Override the fully qualified app name |
+| cronjob.schedule | string | `"0 1 * * *"` | Schedules the job to run using cron notation |
 | cronjob.suspend | bool | `false` | If it is set to true, all subsequent executions are suspended. This setting does not apply to already started executions. |
-| cronjob.annotations | object | `{}` |  |
-| cronjob.labels | object | `{}` |  |
-| cronjob.concurrencyPolicy | string | `""` |  |
-| cronjob.failedJobsHistoryLimit | string | `""` |  |
-| cronjob.successfulJobsHistoryLimit | string | `""` |  |
-| cronjob.jobRestartPolicy | string | `"Never"` |  |
-| cronjob.jobBackoffLimit | string | `""` |  |
-| cronjob.startingDeadlineSeconds | string | `""` |  |
-| pod.annotations | object | `{}` |  |
-| pod.labels | object | `{}` |  |
+| cronjob.annotations | object | `{}` | Annotations to set on the cronjob |
+| cronjob.labels | object | `{}` | Labels to set on the cronjob |
+| cronjob.concurrencyPolicy | string | `""` | "Allow" to allow concurrent runs, "Forbid" to skip new runs if a previous run is still running or "Replace" to replace the previous run |
+| cronjob.failedJobsHistoryLimit | string | `""` | Amount of failed jobs to keep in history |
+| cronjob.successfulJobsHistoryLimit | string | `""` | Amount of completed jobs to keep in history |
+| cronjob.jobRestartPolicy | string | `"Never"` | Set to Never to restart the job when the pod fails or to OnFailure to restart when a container fails |
+| cronjob.ttlSecondsAfterFinished | string | `""` | Time to keep the job after it finished before automatically deleting it |
+| cronjob.activeDeadlineSeconds | string | `""` | Deadline for the job to finish |
+| cronjob.jobBackoffLimit | string | `""` | Number of times to retry running the pod before considering the job as being failed |
+| cronjob.startingDeadlineSeconds | string | `""` | Deadline to start the job, skips execution if job misses it's configured deadline |
+| cronjob.initContainers | list | `[]` | Additional initContainers that can be executed before renovate |
+| cronjob.preCommand | string | `""` | Prepend shell commands before renovate runs |
+| pod.annotations | object | `{}` | Annotations to set on the pod |
+| pod.labels | object | `{}` | Labels to set on the pod |
 | image.repository | string | `"registry1.dso.mil/ironbank/container-hardening-tools/renovate/renovate"` |  |
-| image.tag | string | `"32.38.0"` |  |
+| image.tag | string | `"34.120.0"` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | imagePullSecrets[0].name | string | `"private-registry"` |  |
 | renovate.existingConfigFile | string | `""` | Custom exiting global renovate config |
 | renovate.config | string | `"{}"` | Inline global renovate config.json |
-| ssh_config.enabled | bool | `false` |  |
-| ssh_config.id_rsa | string | `""` |  |
-| ssh_config.id_rsa_pub | string | `""` |  |
-| ssh_config.config | string | `""` |  |
-| ssh_config.existingSecret | string | `""` |  |
-| secrets | object | `{}` |  |
-| existingSecret | string | `""` |  |
+| renovate.configEnableHelmTpl | bool | `false` | Use the Helm tpl function on your configuration. See README for how to use this value |
+| renovate.configIsSecret | bool | `false` | Use this to create the renovate-config as a secret instead of a configmap |
+| renovate.securityContext | object | `{}` | Renovate Container-level security-context |
+| renovate.persistence | object | `{"cache":{"enabled":false,"storageClass":"","storageSize":"512Mi"}}` | Options related to persistence |
+| renovate.persistence.cache.enabled | bool | `false` | Allow the cache to persist between runs |
+| renovate.persistence.cache.storageClass | string | `""` | Storage class of the cache PVC |
+| renovate.persistence.cache.storageSize | string | `"512Mi"` | Storage size of the cache PVC |
+| ssh_config.enabled | bool | `false` | Whether to enable the use and creation of a secret containing .ssh files |
+| ssh_config.id_rsa | string | `""` | Contents of the id_rsa file |
+| ssh_config.id_rsa_pub | string | `""` | Contents of the id_rsa_pub file |
+| ssh_config.config | string | `""` | Contents of the config file |
+| ssh_config.existingSecret | string | `""` | Name of the existing secret containing a valid .ssh configuration |
+| secrets | object | `{}` | Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set |
+| existingSecret | string | `""` | k8s secret to reference environment variables from. Overrides secrets if set |
 | dind.enabled | bool | `false` | dind is non-functional in BB as it requires a privileged non-hardened container, changing this value does nothing |
+| dind.slim.enabled | bool | `true` | Do not add `-slim` suffix to image tag when using dind |
+| dind.image.repository | string | `"docker"` | Repository to pull dind image from |
+| dind.image.tag | string | `"20.10.23-dind"` | dind image tag to pull |
+| dind.image.pullPolicy | string | `"IfNotPresent"` | "IfNotPresent" to pull the image if no image with the specified tag exists on the node, "Always" to always pull the image or "Never" to try and use pre-pulled images |
+| dind.securityContext | object | `{"privileged":true}` | DinD Container-level security-context. Privileged is needed for DinD, it will not work without! |
 | extraConfigmaps | list | `[]` | Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config |
 | extraVolumes | list | `[]` | Additional volumes to the pod |
 | extraVolumeMounts | list | `[]` | Additional volumeMounts to the container |
-| serviceAccount.create | bool | `false` |  |
-| serviceAccount.annotations | object | `{}` |  |
-| serviceAccount.name | string | `""` |  |
-| resources | object | `{}` |  |
-| envFrom | list | `[]` |  |
-| env | object | `{}` |  |
+| serviceAccount.create | bool | `false` | Specifies whether a service account should be created |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.name | string | `""` | The name of the service account to use If not set and create is true, a name is generated using the fullname template |
+| resources | object | `{}` | Specify resource limits and requests for the renovate container |
+| envFrom | list | `[]` | Environment variables to add from existing secrets/configmaps. Uses the keys as variable name |
+| env | object | `{}` | Environment variables to set on the renovate container |
+| envList | list | `[]` | Additional env. Helpful too if you want to use anything other than a `value` source. |
 | redis.enabled | bool | `false` | Enable the Redis subchart? |
+| redis.nameOverride | string | `""` | Override the prefix of the redisHost |
 | redis.architecture | string | `"standalone"` | Disable replication by default |
 | redis.auth.enabled | bool | `false` | Don't require a password by default |
 | redis.kubeVersion | string | `""` | Override Kubernetes version for redis chart |
 | apiVersionOverrides.cronjob | string | `"batch/v1"` | String to override apiVersion of cronjob rendered by this helm chart |
+| hostAliases | list | `[]` | Override hostname resolution |
+| securityContext | object | `{}` | Pod-level security-context |
+| nodeSelector | object | `{}` | Select the node using labels to specify where the cronjob pod should run on |
+| affinity | object | `{}` | Configure the pod(Anti)Affinity and/or node(Anti)Affinity |
+| tolerations | list | `[]` | Configure which node taints the pod should tolerate |
 | domain | string | `"bigbang.dev"` | Big Bang Values |
 | istio.enabled | bool | `false` |  |
 | istio.mtls.mode | string | `"PERMISSIVE"` | STRICT = Allow only mutual TLS traffic, PERMISSIVE = Allow both plain text and mutual TLS traffic PERMISSIVE is required for any action which redeploys pods because STRICT interferes with initContainers Can be changed to STRICT after all initContainers have finished but will interfere with upgrades/pod deployments that have initContainers |

chart/Chart.lock

 dependencies:
 - name: redis
-  repository: file://deps/redis
-  version: 16.9.2-bb.0
-digest: sha256:5bc0be4aa74148551cec5556e12a42f81ccf5ab9d3aea0ff2d616c4c511539f8
-generated: "2022-06-09T15:54:24.194470134-05:00"
+  repository: oci://registry1.dso.mil/bigbang
+  version: 17.7.2-bb.0
+- name: gluon
+  repository: oci://registry1.dso.mil/bigbang
+  version: 0.3.2
+digest: sha256:ecee3e2d238711ccd73332f9dd5baa4ed4d9f7715772f2c286646d803c3a9acf
+generated: "2023-03-24T10:39:09.91868-07:00"

chart/Chart.yaml

 apiVersion: v2
-appVersion: '32.38.0'
+appVersion: '34.120.0'
 description: Universal dependency update tool that fits into your workflows.
 name: renovate
-version: '32.38.0-bb.1'
+version: '34.120.0-bb.0'
 icon: https://docs.renovatebot.com/assets/images/logo.png
 home: https://github.com/renovatebot/renovate
 keywords:
@@ -22,15 +22,29 @@ maintainers:
   - name: rarkins
     email: rhys@arkins.net
 annotations:
+  bigbang.dev/applicationVersions: |
+    - Renovate: 34.120.0
+  helm.sh/images: |
+    - name: renovate
+      image: registry1.dso.mil/ironbank/container-hardening-tools/renovate/renovate:34.120.0
+    - name: redis
+      image: registry1.dso.mil/ironbank/bitnami/redis:7.0.8
+      condition: redis.enabled
+    - name: exporter
+      image: registry1.dso.mil/ironbank/bitnami/analytics/redis-exporter:v1.46.0
+      condition: redis.enabled
   artifacthub.io/license: AGPL-3.0-only
   artifacthub.io/images: |
     - name: renovate
-      image: renovate/renovate:32.38.0
+      image: renovate/renovate:34.120.0
   artifacthub.io/links: |
     - name: docs
       url: https://docs.renovatebot.com
 dependencies:
-  - name: redis
-    repository: file://deps/redis
-    version: 16.9.2-bb.0
-    condition: redis.enabled
+- name: redis
+  version: 17.7.2-bb.0
+  repository: "oci://registry1.dso.mil/bigbang"
+  condition: redis.enabled
+- name: gluon
+  version: "0.3.2"
+  repository: "oci://registry1.dso.mil/bigbang"

chart/Kptfile

@@ -5,7 +5,7 @@ metadata:
 upstream:
   type: git
   git:
-    commit: 25e5fc95267f20ada51d0a8f458221e2d43f9405
+    commit: 77c1901f381aa346e1e7805d278fce17ab16887e
     repo: https://github.com/renovatebot/helm-charts
     directory: charts/renovate
-    ref: renovate-32.38.0
+    ref: renovate-34.120.0

chart/README.md

 # renovate
 
-![Version: 32.38.0](https://img.shields.io/badge/Version-32.38.0-informational?style=flat-square) ![AppVersion: 32.38.0](https://img.shields.io/badge/AppVersion-32.38.0-informational?style=flat-square)
+![Version: 34.120.0](https://img.shields.io/badge/Version-34.120.0-informational?style=flat-square) ![AppVersion: 34.120.0](https://img.shields.io/badge/AppVersion-34.120.0-informational?style=flat-square)
 
 Universal dependency update tool that fits into your workflows.
 
@@ -38,51 +38,90 @@ The following table lists the configurable parameters of the chart and the defau
 ## Values
 
 | Key | Type | Default | Description |
-|-----|------|---------|-------------|
+|-----|------|-------|-------------|
+| affinity | object | `{}` | Configure the pod(Anti)Affinity and/or node(Anti)Affinity |
 | apiVersionOverrides.cronjob | string | `""` | String to override apiVersion of cronjob rendered by this helm chart |
-| cronjob.annotations | object | `{}` |  |
-| cronjob.concurrencyPolicy | string | `""` |  |
-| cronjob.failedJobsHistoryLimit | string | `""` |  |
-| cronjob.jobBackoffLimit | string | `""` |  |
-| cronjob.jobRestartPolicy | string | `"Never"` |  |
-| cronjob.labels | object | `{}` |  |
-| cronjob.schedule | string | `"0 1 * * *"` |  |
-| cronjob.startingDeadlineSeconds | string | `""` |  |
-| cronjob.successfulJobsHistoryLimit | string | `""` |  |
+| cronjob.activeDeadlineSeconds | string | `""` | Deadline for the job to finish |
+| cronjob.annotations | object | `{}` | Annotations to set on the cronjob |
+| cronjob.concurrencyPolicy | string | `""` | "Allow" to allow concurrent runs, "Forbid" to skip new runs if a previous run is still running or "Replace" to replace the previous run |
+| cronjob.failedJobsHistoryLimit | string | `""` | Amount of failed jobs to keep in history |
+| cronjob.initContainers | list | `[]` | Additional initContainers that can be executed before renovate |
+| cronjob.jobBackoffLimit | string | `""` | Number of times to retry an errored job before considering it as being failed |
+| cronjob.jobRestartPolicy | string | `"Never"` | Set to Never to restart the job when the pod fails or to OnFailure to restart when a container fails |
+| cronjob.labels | object | `{}` | Labels to set on the cronjob |
+| cronjob.preCommand | string | `""` | Prepend shell commands before renovate runs |
+| cronjob.schedule | string | `"0 1 * * *"` | Schedules the job to run using cron notation |
+| cronjob.startingDeadlineSeconds | string | `""` | Deadline to start the job, skips execution if job misses it's configured deadline |
+| cronjob.successfulJobsHistoryLimit | string | `""` | Amount of completed jobs to keep in history |
 | cronjob.suspend | bool | `false` | If it is set to true, all subsequent executions are suspended. This setting does not apply to already started executions. |
+| cronjob.ttlSecondsAfterFinished | string | `"""` | Time to keep the job after it finished before automatically deleting it |
 | dind.enabled | bool | `false` | Enable dind sidecar usage? |
-| dind.image.pullPolicy | string | `"IfNotPresent"` |  |
-| dind.image.repository | string | `"docker"` |  |
-| dind.image.tag | string | `"20.10.14-dind"` |  |
+| dind.image.pullPolicy | string | `"IfNotPresent"` | "IfNotPresent" to pull the image if no image with the specified tag exists on the node, "Always" to always pull the image or "Never" to try and use pre-pulled images |
+| dind.image.repository | string | `"docker"` | Repository to pull dind image from |
+| dind.image.tag | string | `"20.10.23-dind"` | dind image tag to pull |
+| dind.securityContext | object | `{"privileged":true}` | DinD Container-level security-context. Privileged is needed for DinD, it will not work without! |
 | dind.slim.enabled | bool | `true` | Do not add `-slim` suffix to image tag when using dind |
-| env | object | `{}` |  |
-| envFrom | list | `[]` |  |
-| existingSecret | string | `""` |  |
+| env | object | `{}` | Environment variables to set on the renovate container |
+| envFrom | list | `[]` | Environment variables to add from existing secrets/configmaps. Uses the keys as variable name |
+| envList | list | `[]` | Additional env. Helpful too if you want to use anything other than a `value` source. |
+| existingSecret | string | `""` | k8s secret to reference environment variables from. Overrides secrets if set |
 | extraConfigmaps | list | `[]` | Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config |
 | extraVolumeMounts | list | `[]` | Additional volumeMounts to the container |
 | extraVolumes | list | `[]` | Additional volumes to the pod |
-| image.pullPolicy | string | `"IfNotPresent"` |  |
-| image.repository | string | `"renovate/renovate"` |  |
-| image.tag | string | `"32.38.0"` |  |
-| imagePullSecrets | object | `{}` |  |
-| pod.annotations | object | `{}` |  |
-| pod.labels | object | `{}` |  |
+| fullnameOverride | string | `""` | Override the fully qualified app name |
+| global.commonLabels | object | `{}` | Additional labels to be set on all renovate resources |
+| hostAliases | list | `[]` | Override hostname resolution |
+| image.pullPolicy | string | `"IfNotPresent"` | "IfNotPresent" to pull the image if no image with the specified tag exists on the node, "Always" to always pull the image or "Never" to try and use pre-pulled images |
+| image.repository | string | `"renovate/renovate"` | Repository to pull renovate image from |
+| image.tag | string | `"34.108.3"` | Renovate image tag to pull |
+| imagePullSecrets | object | `{}` | Secret to use to pull the image from the repository |
+| nameOverride | string | `""` | Override the name of the chart |
+| nodeSelector | object | `{}` | Select the node using labels to specify where the cronjob pod should run on |
+| pod.annotations | object | `{}` | Annotations to set on the pod |
+| pod.labels | object | `{}` | Labels to set on the pod |
 | redis.architecture | string | `"standalone"` | Disable replication by default |
 | redis.auth.enabled | bool | `false` | Don't require a password by default |
 | redis.enabled | bool | `false` | Enable the Redis subchart? |
 | redis.kubeVersion | string | `""` | Override Kubernetes version for redis chart |
+| redis.nameOverride | string | `""` | Override the prefix of the redisHost |
 | renovate.config | string | `""` | Inline global renovate config.json |
+| renovate.configEnableHelmTpl | bool | `false` | Use the Helm tpl function on your configuration. See README for how to use this value |
+| renovate.configIsSecret | bool | `false` | Use this to create the renovate-config as a secret instead of a configmap |
 | renovate.existingConfigFile | string | `""` | Custom exiting global renovate config |
-| resources | object | `{}` |  |
-| secrets | object | `{}` |  |
-| serviceAccount.annotations | object | `{}` |  |
-| serviceAccount.create | bool | `false` |  |
-| serviceAccount.name | string | `""` |  |
-| ssh_config.config | string | `""` |  |
-| ssh_config.enabled | bool | `false` |  |
-| ssh_config.existingSecret | string | `""` |  |
-| ssh_config.id_rsa | string | `""` |  |
-| ssh_config.id_rsa_pub | string | `""` |  |
+| renovate.persistence.cache.enabled | bool | `false` | Allow the cache to persist between runs |
+| renovate.persistence.cache.storageClass | string | `""` | Storage class of the cache PVC |
+| renovate.persistence.cache.storageSize | string | `"512Mi"` | Storage size of the cache PVC |
+| renovate.securityContext | object | `{}` | Renovate Container-level security-context |
+| resources | object | `{}` | Specify resource limits and requests for the renovate container |
+| secrets | object | `{}` | Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set |
+| securityContext | object | `{}` | Pod-level security-context |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `false` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use |
+| ssh_config.config | string | `""` | Contents of the config file |
+| ssh_config.enabled | bool | `false` | Whether to enable the use and creation of a secret containing .ssh files |
+| ssh_config.existingSecret | string | `""` | Name of the existing secret containing a valid .ssh configuration |
+| ssh_config.id_rsa | string | `""` | Contents of the id_rsa file |
+| ssh_config.id_rsa_pub | string | `""` | Contents of the id_rsa_pub file |
+| tolerations | list | `[]` | Configure which node taints the pod should tolerate |
+
+## Renovate persistent cache
+
+To speed up execution time of jobs it could be useful to enable persistent caching. This means that Renovate
+can make use of the cache that have been build up in previous runs. Set `renovate.persistence.cache.enabled` to true
+to enable this. If necessary, the storageClass can be configured and the storageSize can be set to the preferred value.
+
+**NOTE**: `securityContext.fsGroup` must be set to the correct group ID to use the persistent cache. Without it, renovate
+can't write to the mounted PVC. For the current default user (`ubuntu`), the correct fsGroup is `1000`.
+
+## Renovate config templating
+
+Enable `renovate.configEnableHelmTpl` to use helm templates for generated renovate `config.json`.
+Allows you to reference values using `"{{ .Values.someValue }}"` in your config
+
+**NOTE**: setting `renovate.configEnableHelmTpl` to true means that you have to
+escape your config entries containing `{{` (i.e. `"key": "{{depName}}"`) in the
+value by wrapping it like: `"key": "{{ "{{depName}}" }}"`.
 
 ## Docker in Docker configuration
 
@@ -92,4 +131,5 @@ The slim suffix will be added to the tag if not present. To disable this behavio
 
 ## Redis
 
-Please checkout [bitnami redis](https://artifacthub.io/packages/helm/bitnami/redis) chart for additional redis configuration.
+Please check out [bitnami redis](https://artifacthub.io/packages/helm/bitnami/redis) chart for additional redis configuration.
+

chart/README.md.gotmpl

@@ -38,6 +38,24 @@ The following table lists the configurable parameters of the chart and the defau
 
 {{ template "chart.valuesSection" . }}
 
+## Renovate persistent cache
+
+To speed up execution time of jobs it could be useful to enable persistent caching. This means that Renovate
+can make use of the cache that have been build up in previous runs. Set `renovate.persistence.cache.enabled` to true
+to enable this. If necessary, the storageClass can be configured and the storageSize can be set to the preferred value.
+
+**NOTE**: `securityContext.fsGroup` must be set to the correct group ID to use the persistent cache. Without it, renovate
+can't write to the mounted PVC. For the current default user (`ubuntu`), the correct fsGroup is `1000`.
+
+## Renovate config templating
+
+Enable `renovate.configEnableHelmTpl` to use helm templates for generated renovate `config.json`.
+Allows you to reference values using `"{{ .Values.someValue }}"` in your config
+
+**NOTE**: setting `renovate.configEnableHelmTpl` to true means that you have to
+escape your config entries containing `{{` (i.e. `"key": "{{depName}}"`) in the
+value by wrapping it like: `"key": "{{ "{{depName}}" }}"`.
+
 ## Docker in Docker configuration
 
 When `dind.enabled` is set to `true`, a Docker in Docker container will run as a sidecar to supply a Docker daemon to the RenovateBot container. This allows the configuration `binarySource` to be set to `docker`, which is the default configuration in the slim Docker images.

chart/ci/ci-values.yaml

@@ -25,3 +25,7 @@ renovate:
       "logLevel": "debug",
       "repositories": ["username/repo", "orgname/repo"]
     }
+hostAliases:
+  - ip: "1.2.3.4"
+    hostnames:
+      - "example.com"

chart/deps/redis/.helmignore

-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj

chart/deps/redis/Chart.lock

-dependencies:
-- name: common
-  repository: https://charts.bitnami.com/bitnami
-  version: 1.13.1
-digest: sha256:1056dac8da880ed967a191e8d9eaf04766f77bda66a5715456d5dd4494a4a942
-generated: "2022-04-27T18:53:53.946986327Z"

chart/deps/redis/Chart.yaml

-annotations:
-  category: Database
-apiVersion: v2
-appVersion: 6.2.6
-dependencies:
-  - name: common
-    repository: https://charts.bitnami.com/bitnami
-    tags:
-      - bitnami-common
-    version: 1.x.x
-description: Redis(TM) is an open source, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.
-engine: gotpl
-home: https://github.com/bitnami/charts/tree/master/bitnami/redis
-icon: https://bitnami.com/assets/stacks/redis/img/redis-stack-220x234.png
-keywords:
-  - redis
-  - keyvalue
-  - database
-maintainers:
-  - email: containers@bitnami.com
-    name: Bitnami
-  - email: cedric@desaintmartin.fr
-    name: desaintmartin
-name: redis
-sources:
-  - https://github.com/bitnami/bitnami-docker-redis
-version: 16.9.2-bb.0

chart/deps/redis/Kptfile

-apiVersion: kpt.dev/v1alpha1
-kind: Kptfile
-metadata:
-  name: chart
-upstream:
-  type: git
-  git:
-    commit: 9817539972fefe994a8809fcb7ca5e05133fafee
-    repo: https://repo1.dso.mil/platform-one/big-bang/apps/application-utilities/redis
-    directory: /chart
-    ref: 16.9.2-bb.0

chart/deps/redis/ci/default-values.yaml

-# Leave this file empty to ensure that CI runs builds against the default configuration in values.yaml.

chart/deps/redis/ci/extra-flags-values.yaml

-master:
-  extraFlags:
-    - --maxmemory-policy allkeys-lru
-  persistence:
-    enabled: false
-replica:
-  extraFlags:
-    - --maxmemory-policy allkeys-lru
-  persistence:
-    enabled: false
-auth:
-  enabled: false