blittermib-chart

Helm chart for blittermib — the self-hostable, browser-based SNMP MIB reference tool.

Extracted from the application repository so chart releases are decoupled from application releases.

Install

helm install blittermib oci://ghcr.io/no42-org/charts/blittermib --version <chart-version>
kubectl port-forward svc/blittermib 8080:8080   # then open http://localhost:8080

blittermib is single-instance (replicaCount: 1) — the SQLite cache is per-pod, so it doesn't scale horizontally.

To try unreleased chart changes, --version 0.0.0-main installs the preview built from the tip of main. It is signed but mutable, overwritten by every merge, and carries no SBOM or provenance — don't run it in production.

Versioning

field	meaning	source
chart version	this chart's own semver — the OCI tag	stamped from this repo's vX.Y.Z git tag
appVersion	the blittermib application release the chart is pinned to and CI-tested against	Chart.yaml, bumped deliberately by PR

image.tag defaults to appVersion. The kind smoke in CI installs the chart against the pinned image and asserts the full path: standards served on first boot, then an import-drop round trip.

Common values

Value	Default	Purpose
persistence.enabled	false	Persist the data volume — curated corpus, import/ intake, and SQLite cache as one unit. Strongly recommended when importing MIBs (else an emptyDir: imports vanish on pod replacement; standards re-mirror from the image either way). Switches the deploy strategy to Recreate.
uploads.enabled	false	Enable the in-browser MIB upload (BLITTERMIB_UPLOAD_ENABLED); uploads run through the import pipeline.
ingress.enabled	false	Expose via a classic Ingress.
httpRoute.enabled	false	Expose via a Gateway API HTTPRoute (set httpRoute.parentRefs). Mutually exclusive with ingress.

To seed MIBs declaratively, use an initContainer that copies files into /var/lib/blittermib/data/mibs/import/ — the import pipeline routes them on boot.

The chart pins the official image (it bundles libsmi, which the binary needs at runtime) — don't override image.repository with a stripped rebuild.

Verifying releases

Charts are signed with cosign keyless signing; the identity is this repository's publish workflow, at a version tag:

cosign verify ghcr.io/no42-org/charts/blittermib:<chart-version> \
  --certificate-identity-regexp='^https://github.com/no42-org/blittermib-chart/\.github/workflows/(publish|release)\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$' \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com

The identity names publish.yml, not release.yml: signing moved into a reusable workflow that release.yml calls, and Fulcio issues the certificate to the called workflow. release.yml stays in the pattern so charts through 0.5.9 still verify with one command.

The @refs/tags/ anchor is what separates a release from a preview — 0.0.0-main is signed by the same workflow at @refs/heads/main, so it can never satisfy this command.

Charts published before the extraction (≤ 0.10.0) were signed by the application repository's release.yml instead — see the blittermib README.

Development

make lint         # helm lint + render guards
make template     # default + persistent renders
make package      # TAG=vX.Y.Z stamps the chart version into dist/
make lint-actions # actionlint + zizmor over .github/workflows

Releases: tag vX.Y.Z → CI runs the gates, packages, pushes to oci://ghcr.io/no42-org/charts, signs the digest, and opens a draft GitHub release with the SBOM and signed checksums. See RELEASING.md.

How to contribute — issue first, DCO sign-off, AI-assistance policy — is in CONTRIBUTING.md. Security reports go through SECURITY.md, never a public issue. Where to ask questions: SUPPORT.md.

License

MIT — see LICENSE.