fix(docs): Common 2025 news and docs (#36670)

**Description**  ⚒️ Fixes #  **⚙️ Type of change** - [ ] ⚙️ Feature/App addition - [x] 🪛 Bugfix - [ ] ⚠️ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] 🔃 Refactor of current code - [x] 📜 Documentation Changes **🧪 How Has This Been Tested?**  **📃 Notes:**  **✔️ Checklist:** - [x] ⚖️ My code follows the style guidelines of this project - [x] 👀 I have performed a self-review of my own code - [ ] #️⃣ I have commented my code, particularly in hard-to-understand areas - [x] 📄 I have made changes to the documentation - [ ] 🧪 I have added tests to this description that prove my fix is effective or that my feature works - [x] ⬆️ I increased versions for any altered app according to semantic versioning - [x] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):`, `chore(chart-name):`, `docs(chart-name):` or `fix(docs):` **➕ App addition** If this PR is an app addition please make sure you have done the following. - [ ] 🖼️ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._ --------- Signed-off-by: Alfred Göppel <43101280+alfi0812@users.noreply.github.com> Co-authored-by: Kjeld Schouten <info@kjeldschouten.nl>
2025-07-06 02:00:57 +02:00
parent f259090de2
commit c6c000d57b
6 changed files with 229 additions and 107 deletions
@@ -0,0 +1,46 @@
+---
+title: Advanced Addon Configuration
+---
+
+Common offers an addon system to easily integrate some predefined addons into your charts without the need to configure additional workloads etc.
+While it usually isnt needed people have similar options to the main workload sections of our charts.
+Therefore you can configure the workload of each addon with the following section: (for the example codesever is used)
+
+```yaml
+
+addons:
+  codeserver:
+    enabled: true
+    container:
+      enabled: true
+      probes:
+        liveness:
+          enabled: true
+          port: 12321
+          path: "/"
+        readiness:
+          enabled: true
+          port: 12321
+          path: "/"
+        startup:
+          enabled: true
+          port: 12321
+          path: "/"
+      imageSelector: "codeserverImage"
+      resources:
+        excludeExtra: true
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+        runAsNonRoot: false
+        readOnlyRootFilesystem: false
+      args:
+        - "--port"
+        - "12321"
+        - "/"
+        - --auth
+        - none
+
+```
+
+As you can see most options of the workload can be edited (even the image beeing used). Feel free to change certain settings if needed.
@@ -12,12 +12,12 @@ addons:

        service:
        # -- Enable a service for the code-server add-on.
-            type: "LoadBalancer"
-            loadBalancerIP: "192.168.178.11"
-            # Specify the default port information
-            ports:
-                codeserver:
-                  port: 12321
+          type: "LoadBalancer"
+          loadBalancerIP: "192.168.178.11"
+          # Specify the default port information
+          ports:
+            codeserver:
+              port: 12321

        ingress:
          # -- Enable an ingress for the code-server add-on.
@@ -36,12 +36,12 @@ Install the chart as per usual and add the the section for Gluetun like shown be

 ```yaml
 addons:
-  vpn:
-    type: gluetun
-    killSwitch: true
-    excludedNetworks_IPv4:
-      - "192.168.178.0/24"
-    excludedNetworks_IPv6: []
+  gluetun:
+    enabled: true
+    container:
+      env:
+        FIREWALL: "on"
+        FIREWALL_OUTBOUND_SUBNETS: "192.168.178.0/24"
 ```

 `Gluetun` works with Environment Variables so we need to configure them below. Enter your `VPN Provider` specific ones as below.
@@ -50,19 +50,18 @@ addons:

 ```yaml
 addons:
-  vpn:
-    type: gluetun
-    killSwitch: true
-    excludedNetworks_IPv4:
-      - "192.168.178.0/24"
-    excludedNetworks_IPv6: []
-    env:
-      VPN_SERVICE_PROVIDER: "windscribe"
-      VPN_TYPE: "openvpn"
-      OPENVPN_USER: "username"
-      OPENVPN_PASSWORD: "password"
-      SERVER_REGIONS: "Canada East"
-      SERVER_CITIES: "Montreal"
+  gluetun:
+    enabled: true
+    container:
+      env:
+        FIREWALL: "on"
+        FIREWALL_OUTBOUND_SUBNETS: "192.168.178.0/24"
+        VPN_SERVICE_PROVIDER: "windscribe"
+        VPN_TYPE: "openvpn"
+        OPENVPN_USER: "username"
+        OPENVPN_PASSWORD: "password"
+        SERVER_REGIONS: "Canada East"
+        SERVER_CITIES: "Montreal"
 ```

 All providers will generally need `VPN_SERVICE_PROVIDER` and `VPN_TYPE`. For me, it's `Windscribe` and `openvpn` but I could easily choose `Wireguard`.
@@ -81,22 +80,21 @@ Now we can enter the Env Vars. Install the chart as per usual and add the specif

 ```yaml
 addons:
-  vpn:
-    type: gluetun
-    killSwitch: true
-    excludedNetworks_IPv4:
-      - "192.168.178.0/24"
-    excludedNetworks_IPv6: []
-    env:
-      VPN_TYPE: "wireguard"
-      VPN_SERVICE_PROVIDER: "mullvad"
-      WIREGUARD_PRIVATE_KEY: "xxxxxxx"
-      FIREWALL_VPN_INPUT_PORTS: "59241"
-      WIREGUARD_ADDRESSES: "xxx.xxx.xxx.xxx/32"
-      SERVER_CITIES: "Torronto"
-      VPN_ENDPOINT_PORT: "51820"
-      WIREGUARD_PUBLIC_KEY: "xxxxxxxx"
-      VPN_ENDPOINT_IP: "xx.xx.xxx.xxx"
+  gluetun:
+    enabled: true
+    container:
+      env:
+        FIREWALL: "on"
+        FIREWALL_OUTBOUND_SUBNETS: "192.168.178.0/24"
+        VPN_TYPE: "wireguard"
+        VPN_SERVICE_PROVIDER: "mullvad"
+        WIREGUARD_PRIVATE_KEY: "xxxxxxx"
+        FIREWALL_VPN_INPUT_PORTS: "59241"
+        WIREGUARD_ADDRESSES: "xxx.xxx.xxx.xxx/32"
+        SERVER_CITIES: "Torronto"
+        VPN_ENDPOINT_PORT: "51820"
+        WIREGUARD_PUBLIC_KEY: "xxxxxxxx"
+        VPN_ENDPOINT_IP: "xx.xx.xxx.xxx"
 ```

 :::caution[Killswitch Entry]
@@ -142,18 +140,17 @@ Those env have to be set additionally to your VPN setup from above.

 ```yaml
 addons:
-  vpn:
-    type: gluetun
-    killSwitch: true
-    excludedNetworks_IPv4:
-      - "192.168.178.0/24"
-    excludedNetworks_IPv6: []
-    env:
-      HTTPPROXY: "on"
-      FIREWALL_INPUT_PORTS: 10095,8888
-      #optional
-      HTTPPROXY_LOG: "on"
-      HTTPPROXY_LISTENING_ADDRESS: :8888
+  gluetun:
+    enabled: true
+    container:
+      env:
+        FIREWALL: "on"
+        FIREWALL_OUTBOUND_SUBNETS: "192.168.178.0/24"
+        HTTPPROXY: "on"
+        FIREWALL_INPUT_PORTS: 10095,8888
+        #optional
+        HTTPPROXY_LOG: "on"
+        HTTPPROXY_LISTENING_ADDRESS: :8888
 ```

 Only the additional ENV needed for the Proxy are shown here to keep it shorter. You still need your VPN setup from above.
@@ -215,28 +212,16 @@ In talos in order to use the tun interface for Gluetun a workaround is needed ot

 Install the generic-device-plugin from our helm chart repository. Make sure to make the namespace privileged.

-### Step 2: Add this into your helm-release.yaml for your app
+### Step 2: Add this into your hvalues for your app

 Here is an example snippet on how to add it:

 ```yaml
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-    name: chart
-    namespace: namespace
-spec:
-    postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              version: v1
-              kind: Deployment
-              name: qbittorrent
-            patch: |
-              - op: add
-                path: /spec/template/spec/containers/1/resources/limits/truecharts.org~1tun
-                value: 1
-    interval: 5m
-    chart:
+addons:
+  gluetun:
+    enabled: true
+    container:
+      resources:
+        limits:
+          truecharts.org/tun: 1
 ```
@@ -122,30 +122,37 @@ You can set charts to use either of them by specifying either:
 or
 `ingressClassName: external`

-## Annotations Examples
+## Nginx Integration examples

-Here we will showcase some annotations you can use to customize your NGINX ingress behavior
-
-### Redirect to Https
+Our Common-Chart offers some Nginx Integrations which save some time compared to manually setting the annotations.
+These can be configured in the following section of the ingress which is `disabled` by default:

 ```yaml
-annotations:
-  nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+
+ingress:
+    main:
+      integrations:
+        nginx:
+          #disabled by default
+          enabled: true
 ```

-### Auth
+In the following sections only the nginx part is shown for simplicity.

-#### Authelia
+### Authelia

 ```yaml
-annotations:
-  nginx.ingress.kubernetes.io/auth-method: 'GET'
-  nginx.ingress.kubernetes.io/auth-url: 'http://authelia.authelia.svc.cluster.local:9091/api/verify'
-  nginx.ingress.kubernetes.io/auth-signin: 'https://auth.${DOMAIN_1}?rm=$request_method'
-  nginx.ingress.kubernetes.io/auth-response-headers: 'Remote-User,Remote-Name,Remote-Groups,Remote-Email'
+nginx:
+  enabled: true
+  auth:
+    type: "authelia"
+    internalHost: "http://authelia.authelia.svc.cluster.local:9091/api/verify"
+    externalHost: "https://auth.${DOMAIN_1}?rm=$request_method"
+    # Can be left default in most cases
+    responseHeaders: []
 ```

-#### Authentik
+### Authentik

 When using Authentik, take care to configure the service as follows.

@@ -163,31 +170,43 @@ to create a provider and application, then enable the embedded outpost for your
 Once that has been done, configure each service you wish to place behind Authentik as follows:

 ```yaml
-annotations:
-  nginx.ingress.kubernetes.io/auth-url: http://authentik-http.authentik.svc.cluster.local:10230/outpost.goauthentik.io/auth/nginx
-  nginx.ingress.kubernetes.io/auth-signin: https://auth.${DOMAIN_1}/outpost.goauthentik.io/start?rd=$scheme://$http_host$escaped_request_uri
-  nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid
-  nginx.ingress.kubernetes.io/auth-snippet: proxy_set_header X-Forwarded-Host $http_host;
+nginx:
+  enabled: true
+  auth:
+    type: "authentik"
+    internalHost: "http://authentik-http.authentik.svc.cluster.local:10230/outpost.goauthentik.io/auth/nginx"
+    externalHost: "https://auth.${DOMAIN_1}/outpost.goauthentik.io/start?rd=$scheme://$http_host$escaped_request_uri"
+    # Can be left default in most cases
+    responseHeaders: []
 ```

 ### IP Whitelist

 ```yaml
-annotations:
-  nginx.ingress.kubernetes.io/whitelist-source-range: 49.36.X.X/32
+nginx:
+  enabled: true
+  ipWhitelist: 49.36.X.X/32
 ```

 ### Themepark

+```yaml
+nginx:
+  enabled: true
+  themepark:
+    enabled: true
+    css: "https://gilbn.github.io/theme.park/CSS/themes/APP_NAME/THEME.css"
+```
+
+## Annotations Examples
+
+Here we will showcase some annotations you can use to customize your NGINX ingress behavior
+
+### Redirect to Https
+
 ```yaml
 annotations:
-  nginx.ingress.kubernetes.io/configuration-snippet: |
-      proxy_set_header Accept-Encoding "";
-      sub_filter
-      '</head>'
-      '<link rel="stylesheet" type="text/css" href="https://gilbn.github.io/theme.park/CSS/themes/APP_NAME/THEME.css">
-      </head>';
-      sub_filter_once on;
+  nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
 ```

 ### Redirect-Regex
@@ -0,0 +1,72 @@
+---
+slug: "news/common-2025"
+title: "Common-2025 finally released"
+authors: [alfi0812]
+date: 2025-06-26
+tags:
+  - "2025"
+---
+
+## TrueCharts Releases `common-2025` Helm Library with Major Improvements
+
+The TrueCharts team is proud to announce the release of **`common-2025`**, the latest version of the shared Helm chart library powering all TrueCharts charts. This major update delivers powerful new features, improved integrations, and essential structural upgrades that enhance usability, maintainability, and compatibility across the board.
+
+## 🚀 Key Highlights of `common-2025`
+
+- **🔐 Nginx Ingress Integration**
+  - **Disabled by default** for a cleaner baseline
+  - Built-in support for:
+    - Authentication
+    - IP whitelisting
+    - ThemePark styling
+
+- **🛠 GitOps CNPG Recovery Enhancements**
+  - No more need to bump revision numbers during CNPG cluster recovery
+  - Using the revision number is now optional.
+
+- **🌐 Traefik Updates**
+  - **Disabled by default** for a cleaner baseline
+  - Complete rework of **Traefik middlewares**, now defined per chart
+
+- **📦 Resource Management**
+  - Updated defaults for **required pod resources**
+
+- **🔑 Existing Pull Secret Support**
+  - Added support for using **existing Kubernetes secrets** for container registry authentication
+  - Simplifies integration in environments with pre-configured imagePullSecrets
+
+- **🧩 Addon System Rework**
+  - Safe upgrade: prevents updates when some legacy addon layouts are present
+  - **More configuration options for addons**, including:
+    - Full access to the **workload definition**
+
+- **📁 Structural Cleanups**
+  - Removal of deprecated **Portal** (legacy from SCALE)
+  - Major improvements to `notes.txt`
+  - Moved **MetalLB** and **Traefik** service annotations to centralized integration logic
+
+- **📊 Autoscaling Enhancements**
+  - Refactored **Horizontal Pod Autoscaler (HPA)**: To comply to our coding standards and testing regime
+  - Added support for **Vertical Pod Autoscaler (VPA)**: Allows for automatically adjusts CPU and memory limits over time
+
+- **👤 Service Account Overrides**
+  - Added support to **optionally override the service account name** in the workload `podSpec`
+
+- **🌐 Topology Key Configuration**
+  - Users can now configure a **default `topologyKey`** for scheduling behavior
+
+- **📌 Pod Affinity Support**
+  - Added full support for **pod affinity**, enabling more advanced workload placement strategies
+  - Default **pod affinity** to ensure pods sharing RWO PVCs are started on the same node
+
+---
+
+## 🙏 Thank You
+
+This release marks another milestone in the growth of the TrueCharts ecosystem. A huge **thank you** to all contributors who help build, improve, and maintain all of our charts. Your work makes TrueCharts possible.
+
+And of course, **thank you to all users**—your feedback, deployments, and support are what drive this project forward every day.
+
+---
+
+For more information or to get involved, visit: [https://truecharts.org](https://truecharts.org)