OCI Helm Chart Registry
17 custom Helm charts authored to a single consistent contract and published to an OCI registry, with a CI pipeline that validates every chart without a live cluster and signs each release with cosign.
View Code on GitHubChart publish pipeline
The registry is as much about consistency as distribution. Seventeen charts — covering stateful services, gateways, and utilities — share one authoring contract so any of them reads the same way, and eleven of them are what the GitOps platform actually deploys.
A contract, not a pile of charts
Values files carry structured @section/@param documentation, external
credentials always arrive via an existingSecret reference instead of inline
values, and template helpers fail fast on contradictory configuration.
Charts ship the operational patterns real workloads need — probes, resource
defaults, HPA, PodDisruptionBudget, ServiceMonitor — behind the same value
names every time, so operating one chart teaches you all of them.
Validation without a cluster
The pipeline detects which charts a commit touched, renders each with
helm template, and parses the output with Python to catch template errors,
schema violations, and malformed manifests. The CI scripts themselves are
pytest-covered — the pipeline is code with tests, not glue. None of it needs a
Kubernetes cluster, so validation is fast and runs on every merge request.
Publishing that can’t clobber
Stable releases publish once: the pipeline checks whether a version already exists in the OCI registry and refuses to overwrite it, while work-in-progress builds get timestamped CI versions. Every published chart is cosign-signed by digest — and if signing fails, the publish rolls back rather than leaving an unsigned artifact in the registry. The verification key is committed in the repo, so consumers can verify what they pull.
Key Technical Highlights
- One chart contract: Every chart follows the same conventions — @section/@param value docs, an existingSecret pattern for external secrets, and {{- fail }} validation helpers for mutually-exclusive options.
- Cluster-free validation: CI renders each changed chart with helm template and parses the output with Python — catching template and schema errors without needing a Kubernetes cluster in the pipeline.
- Idempotent, signed publishing: Charts publish to the OCI registry with smart version detection to prevent overwrite conflicts; each release is cosign-signed by digest, with an automatic rollback if signing fails.
- Renovate-tracked images: Chart image tags are Renovate-managed and auto-bump the chart version, so upstream updates flow through as reviewable, soaked merge requests.
From chart source to running workload
