v1.12.0

cairn installs with Helm from this release. Nothing on the page changes: this one is for the people running it on Kubernetes.

⎈ A Helm chart

helm install cairn oci://ghcr.io/morgankryze/charts/cairn --version 1.12.0 -f values.yaml

The chart ships as an OCI artifact next to the image, pushed and signed by the same workflow, so there is no repository to add and nothing new to trust.

The Kubernetes page has been enough for anyone templating their own cluster, right up to the Ingress it leaves as an exercise: host, class, TLS secret, annotations, the four things that differ per cluster and that a document cannot know. That is what the chart is for. Everything else it installs is the same ConfigMap, Deployment and Service that page already prints.

Your config goes into the values as block scalars, one entry per file, so it reaches cairn exactly as written instead of being folded into the values tree:

config:
  site.yaml: |
    title: Our tools
    locales: [fr, en]
  services.yaml: |
    - id: pad
      url: https://pad.example.org
      icon: hedgedoc
      name: { fr: Bloc-notes, en: Notepad }

existingConfigMap opts out of that entirely, for anyone already managing the ConfigMap with kustomize or sops.

Two things the chart does deliberately:

• The chart version and the cairn version are the same number. Chart 1.12.0 installs cairn 1.12.0, so there is never a second version to reason about, and image.tag is there if you want to break the pair apart.
• No checksum/config annotation. The standard trick rolls the pods whenever the ConfigMap changes. cairn polls its config directory and reloads by itself, so an edited value updates the ConfigMap and nothing restarts.

The security contexts are values rather than hardcoded, carrying the defaults from the hardened compose: non-root as 65534, read-only root filesystem, every capability dropped, RuntimeDefault seccomp. They are exposed for one reason only, which the file states: OpenShift assigns its own UID range and rejects a fixed runAsUser.

ingress.host is required once the Ingress is enabled, so a forgotten hostname is a sentence at install time rather than an Ingress object with an empty host.

Everything else, including every value in one table: Helm.

🧹 Internal

Every pull request now lints the chart and renders it twice, bare and with an Ingress under TLS, so a broken template cannot reach main. just chart runs the same three commands locally. The Kubernetes page says what it is for and links across, SECURITY.md gains the chart's cosign verify, and CONTRIBUTING gains the layout entry and what a release does with the chart version.

📦 Image

docker pull ghcr.io/morgankryze/cairn:1.12.0

This release also moves 1.12, 1, stable and latest.