Fix chart image pulls for kloud-csi installs.

Use a valid livenessprobe tag, default the driver image to appVersion, add imagePullSecrets support, and publish GHCR packages as public after CI builds.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/build.yaml

@@ -21,6 +21,7 @@ jobs:
       - name: Container image name (GHCR is lowercase)
         run: |
           echo "IMAGE_NAME=${REGISTRY_HOST}/$(echo "${GITHUB_REPOSITORY}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
+          echo "APP_VERSION=$(grep '^appVersion:' charts/kloud-csi/Chart.yaml | awk '{print $2}' | tr -d '\"')" >> "$GITHUB_ENV"
 
       - uses: docker/setup-buildx-action@v3
 
@@ -38,6 +39,7 @@ jobs:
         with:
           images: ${{ env.IMAGE_NAME }}
           tags: |
+            type=raw,value=${{ env.APP_VERSION }},enable=${{ github.ref == 'refs/heads/main' }}
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
             type=sha,prefix=sha-
             type=semver,pattern={{version}}
@@ -51,3 +53,11 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      - name: Make container image public
+        if: github.event_name != 'pull_request'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          owner=$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')
+          gh api --method PATCH "/orgs/${owner}/packages/container/kks-csi-plugin/visibility" -f visibility=public

.github/workflows/release-chart.yaml

@@ -58,3 +58,10 @@ jobs:
           for chart in "${charts[@]}"; do
             helm push "$chart" "oci://ghcr.io/${owner}/charts"
           done
+
+      - name: Make OCI chart public
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          owner=$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')
+          gh api --method PATCH "/orgs/${owner}/packages/container/charts%2Fkloud-csi/visibility" -f visibility=public || true

README.md

@@ -139,7 +139,8 @@ Helm fails at render time if `serverURL` or credentials are missing.
 | Value | Default | Description |
 |-------|---------|-------------|
 | `image.repository` | `ghcr.io/KubelanCloud/kks-csi-plugin` | Driver container image |
-| `image.tag` | `latest` | Image tag (defaults to chart `appVersion` if empty) |
+| `image.tag` | *(chart appVersion)* | Image tag (defaults to chart `appVersion` when empty) |
+| `imagePullSecrets` | `[]` | Pull secrets for private registries such as GHCR |
 | `existingSecret` | `""` | Use an existing secret instead of creating one |
 | `existingSecretAccessTokenKey` | `access-token` | Key in the secret holding the token |
 | `driver.name` | `storage.csi.kloud.team` | CSI driver name |

charts/kloud-csi/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: kloud-csi
 description: Kloud CSI driver for kks persistent volumes
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "0.1.0"
 kubeVersion: ">=1.28.0-0"
 home: https://github.com/KubelanCloud/kks-csi-plugin

charts/kloud-csi/templates/controller-deployment.yaml

@@ -27,6 +27,10 @@ spec:
       {{- end }}
     spec:
       serviceAccountName: {{ include "kloud-csi.controllerServiceAccountName" . }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/kloud-csi/templates/node-daemonset.yaml

@@ -26,6 +26,10 @@ spec:
       {{- end }}
     spec:
       serviceAccountName: {{ include "kloud-csi.nodeServiceAccountName" . }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       priorityClassName: {{ .Values.node.priorityClassName }}
       hostNetwork: true
       hostPID: true

charts/kloud-csi/values.yaml

@@ -14,10 +14,12 @@ nameOverride: ""
 fullnameOverride: ""
 
 image:
-  repository: ghcr.io/KubelanCloud/kks-csi-plugin
-  tag: "latest"
+  repository: ghcr.io/kubelancloud/kks-csi-plugin
+  tag: ""
   pullPolicy: IfNotPresent
 
+imagePullSecrets: []
+
 serverURL: ""
 accessToken: ""
 existingSecret: ""
@@ -38,7 +40,7 @@ sidecars:
     tag: v2.12.0
   livenessProbe:
     repository: registry.k8s.io/sig-storage/livenessprobe
-    tag: v2.13.0
+    tag: v2.13.1
 
 storageClass:
   enabled: true