Add one-off Loki log export + PII scan tooling - #337
Open
jimleitch01 wants to merge 59 commits into
Open
Conversation
bas-info-nl
force-pushed
the
feature/podiumd-4.8.0
branch
from
June 25, 2026 13:14
c5e9cb3 to
c68bfc1
Compare
Chart openinwoner 2.1.3 -> 2.2.0 (appVersion 2.3.0); image tag 2.1.2 -> 2.3.0. Spans upstream 2.2.0 (Django CMS v3->v4) and 2.3.0 (ClamAV virus scan, ZGW cache-warmup + low-latency worker). - values.yaml: pin image tag 2.3.0; add settings.cms4MigrationInitContainer (runs one-time cms4_migration init container), cacheZgwZakenTimeout, cacheSeedingQueue; add lowLatencyWorker block with pinned resources. - docs/images/images-4.8.0.yaml: new image + amd64 manifest digest for the ACR mirror (verified against registry-1.docker.io). - docs/upgrade-from-4.7.3-to-4.8.0.md: operator upgrade guide (CMS migration, opt-in ClamAV scanning, low-latency worker, BRP/ES no-op notes). - README.md: 4.8.0 component-version section. ClamAV scanning is opt-in; defaults (clamav_host=clamav, port 3310) already match the in-cluster clamav service. ES rename and BRP_VERSION change are no-ops for podiumd.
…de guide Match upstream wording (runs once, flip false after rollout) instead of asserting the init container is a no-op on re-run, which is unverified.
Adds upgrade-from-4.7.5-to-4.8.0.md for environments on the current stable 4.7.5 baseline. Documents the 4.8.0 component delta (OIP 2.1.2 -> 2.3.0, KISS, ITA) identical to the 4.7.3 -> 4.8.0 guide. Adds a prominent prerequisite: 4.8.0 branched before 4.7.4/4.7.5, so main (=4.7.5) must be merged into the 4.8.0 branch before release or the keycloak 26.6.3 / openzaak 1.27.2 / OF logging / datamigratie work regresses. Lists the carry-over items a 4.7.5 env already has (no re-action).
…> 4.8.0) The 4.8.0 line branched before UPGRADING.md existed. Add the index with the official path extended through 4.7.5 -> 4.8.0, note 4.7.6 is a parallel 4.7-line patch, and flag that the 4.7.4/4.7.5 per-hop guides come from main (links resolve once main is merged into 4.8.0 - the documented release prerequisite).
Squash-merge of main into the 4.8.0 line so 4.8.0 carries the 4.7.4/4.7.5 security work (squash used because the branch protection hook rejects merge commits / requires linear history). Brings in: Keycloak server+operator 26.6.3 (+ operator chart 1.12.0), Open Zaak 1.27.2, ZGW Office Add-in v0.9.313 (chart 0.0.88, add-in->addin rename), OF outgoing-request logging default off, Datamigratie client, OAB external_registers docs. Keeps 4.8.0's own changes (OIP 2.3.0, ITA, openbeheer). Chart stays version/appVersion 4.8.0; UPGRADING.md kept the 4.8.0 path variant (4.7.5 -> 4.8.0).
…tegrated) main (4.7.5) is forward-integrated into 4.8.0, so the prerequisite/regression warning in upgrade-from-4.7.5-to-4.8.0.md and the matching 'inherited from main / links resolve once merge lands' caveat in UPGRADING.md are obsolete. Replaced the guide warning with a plain carry-over note; removed the UPGRADING caveat.
…note (IN-2345) Add the OpenBeheer<->Objecttypen API token section to both 4.7.x->4.8.0 upgrade guides: same OBJECTTYPEN_OPENBEHEER_TOKEN secret on both sides, mandatory 'Token ' prefix on the openbeheer header, the two IN-2345 mistakes (missing prefix, mismatched secret name), and the strict objecttypen-config validation pitfall.
Integrate PRs #292, #294, #324, #334 (Renovate, targeted main) directly into feature/podiumd-4.8.0: - alpine/k8s 1.34.7 -> 1.36.2 (#292) - azure/k8s-bake action v3 -> v4 (#294) - keycloak-config-cli 6.5.0-26 -> 6.5.1-26 (#324) - nginx-unprivileged 1.30.2 digest 77fb538 -> 1d13071 (#334), applied to all 8 occurrences for chart-wide digest consistency
Reflect the Renovate updates integrated into 4.8.0 (commit 17333e9) in images-4.8.0.yaml, with digests verified live against the source registry: - nginx-unprivileged 1.30.2 digest 77fb538 -> 1d13071 (#334) - alpine/k8s 1.34.7 -> 1.36.2 (#292) - keycloak-config-cli 6.5.0-26 -> 6.5.1-26 (#324) Also corrects the stale "nginx sidecar unchanged" note: the 1.30.2 tag is unchanged but the pinned digest was refreshed. PR #294 (azure/k8s-bake action) is not a container image and is omitted.
…7,348,274,278) - keycloak server 26.6.3 digest refresh (9b03307) - clamav_exporter v2.1.2 -> v2.1.3 - referentielijsten-api 0.7.2 -> 0.7.3 - python 3.12-slim -> 3.14-slim (keycloak init) - postgres 16 -> 18 (keycloak DB migration job) - azure/setup-helm v5.0.0 -> v5.0.1 (GHA) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Keep postgres at 16; the upgrade requires operator validation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
needed for testing 'binnengemeentelijk zoeken': BRP-API/Haal-Centraal-BRP-bevragen#2028
…nd upgrade guides Rolling patch of the 2.7.0 series; adds 'binnengemeentelijk zoeken' test data (BRP-API/Haal-Centraal-BRP-bevragen#2028). Chart bumped to 1.2.9. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… 1.26.14 First explicit image tag pin in values.yaml (previously floated on appVersion). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
- Bumps ZAC from 4.7.2 → 5.0.1 (helm chart `1.0.228` → `1.0.251`)
- Aligns all `nginx-unprivileged` pins to `1.31.1` across all components
- Restructures `zac.brpApi.protocollering` to the new ZAC 5.x explicit
field-per-dimension format
- Adds `zac.brpApi.logLevel`
- Removes `zac.featureFlags.pabcIntegration` (dropped in ZAC 5.x)
## Changes
**`charts/podiumd/Chart.yaml`**
- ZAC helm chart `1.0.228` → `1.0.251`
**`charts/podiumd/values.yaml`**
- ZAC image `4.7.2` → `5.0.1`
- All `nginx-unprivileged` pins `1.30.2` → `1.31.1` (9 occurrences)
- ZAC sub-images: nginx `1.31.1`, gotenberg `8.33.0`, OPA
`1.17.1-static`, busybox `1.38.0-glibc`
- `zac.brpApi.protocollering` restructured (aanbieder removed, explicit
header/value fields added)
- `zac.brpApi.logLevel: "OFF"` added
- `zac.featureFlags.pabcIntegration` removed
- `zac.brpApi.apiKey` changed from string to `{header, value}` object
- `zgw-office-addin` placeholder URLs changed from `""` to
`*.example.nl` (fixes schema lint)
**Docs**
- `docs/images/images-4.8.0.yaml`: ZAC 5.0.1 and sub-image entries added
- `docs/upgrade-from-4.7.5-to-4.8.0.md` /
`upgrade-from-4.7.3-to-4.8.0.md`: ZAC 5.0.1 section with all breaking
changes
- `docs/values-changes-4.8.0.md`: ZAC breaking-change entries
- `docs/zac-brp-protocollering.md`: new vendor reference doc (iConnect,
eServices, 2Secure/EnableU) with api-proxy interaction notes
- `docs/UPGRADING.md`: reference entries for new docs
## Test plan
- [x] `helm lint charts/podiumd` — only pre-existing KISS schema
failures remain (zgw-office-addin errors resolved)
- [x] No duplicate YAML keys in `values.yaml` (helm-dupecheck clean)
- [x] Verify gemeente `podiumd.yml` overrides for `zac.brpApi.apiKey`
use the new `{header, value}` object form
- [x] Verify gemeente files with iConnect protocollering are updated to
the new explicit field structure and
`apiproxy.locations.brp.toepassingHeaderName` is set to `""`
- [x] Verify gemeente files with `zac.featureFlags.pabcIntegration` have
that key removed
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Cyril Roos <cyril@info.nl>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: John Bol <john@info.nl>
) ## Purpose Introduce the **strip-registry ACR mirror naming convention** and migration tooling, on top of the current 4.8.0 line. ## Changes (3 commits on top of feature/podiumd-4.8.0) - **Convention**: ACR mirror repo = upstream image ref minus the registry host (full `namespace/repo` kept). Replaces the hand-maintained drop-namespace/drop-hyphen/Dutch-rename table with a mechanical rule. - **Script** `charts/podiumd/scripts/mirror-strip-registry.py`: `--gen-manifest` (aggregates all images-*.yaml into stripped names + version + digest) and a gemeente `podiumd.yml` migrator (inline / split `registry:`+`repository:` / `imageName:` shapes; dry-run diff by default, `--in-place` to apply). - **Manifest** `docs/images/images-mirror-stripped.yaml`: complete pinned set (41 images, name/url/version/digest). - **Docs**: `acr-mirror-naming.md` documents the new convention + links the script (old table kept frozen as migration reference); `upgrade-from-4.7.5-to-4.8.0.md` gets an ACR-migration section (alongside the existing IN-2345 Open Beheer token note). ## Notes - Tested (dry-run) against `dim1/ontw` and `mayk/ontw` gemeente values. - Best-guess upstreams in the legacy migration map are flagged in the script — verify before ACR re-import. - Rebased onto the latest 4.8.0 (incl. Renovate bumps, postgres 18->16 revert, brp-personen-mock, zaakbrug, zgw-addin mirror-name fix); linear history.
…3 digest (#358) ## What Override `keycloak-operator.operator.config.keycloakImage` in `charts/podiumd/values.yaml` to pin the operator's default Keycloak **server** image to the refreshed `26.6.3` digest `sha256:9b03307…`. ## Why The adfinis `keycloak-operator` subchart (1.12.0) ships a built-in default `operator.config.keycloakImage.sha` of `sha256:5fdbf2d…` — the **pre-PR#344** `26.6.3` digest. PR #344 refreshed podiumd's own `keycloak.image` (the StatefulSet image) to `sha256:9b03307…`, but the operator's default image — stamped onto Keycloak CRs it provisions via the `RELATED_IMAGE_KEYCLOAK` env on the operator Deployment — was left on the stale digest. Result: same tag `26.6.3`, two different digests in one release. Pods run `9b03307`, but operator-provisioned Keycloak CRs would have hinted `5fdbf2d`. ## Fix ```yaml keycloak-operator: operator: config: keycloakImage: repository: quay.io/keycloak/keycloak tag: "26.6.3" sha: "9b0330756022422149aa6502eb2def8cd47c6e1b000c7c65cdb13e7c0133e992" ``` (`sha` is a separate field the subchart appends as `@sha256:{{ .sha }}` — not embedded in `tag`, to avoid a double digest.) ## Validation `helm template podiumd -f ci/lint-values.yaml` (with office-addin dummy uris for the pre-existing schema gate): - All `keycloak:26.6.3` **server** refs → `sha256:9b03307…` (3/3, was 2× 9b03307 + 1× 5fdbf2d). - `RELATED_IMAGE_KEYCLOAK` env → `sha256:9b03307…`. - Operator image unchanged: `keycloak-operator:26.6.3@sha256:bd128cd6…`. - **No double-`@sha256`** anywhere in the render.
… [IN-2348] (#357) ## Wat Bump opennotificaties helm-chart **1.13.1 -> 2.0.0** (app/Notificaties **1.16.0**) voor podiumd 4.8.0. ## Breaking value-changes (chart 2.0.0) - RabbitMQ is uit de chart verwijderd -> `rabbitmq`-blok uit `values.yaml` gehaald. - Celery gebruikt nu Redis (broker + result-backend) -> `opennotificaties.tags.redis: false` -> **true** (redis-subchart levert de broker). ## Getest Uitgerold + gevalideerd op **podiumd-test**: Celery connected to `redis://opennotificaties-redis-master`, notification-taken received + succeeded, geen rabbitmq meer. Ticket: IN-2348
The office add-in repo was renamed zgw-office-add-in-* -> zgw-office-addin-* (hyphen dropped). Older per-release manifests still list the dashed url, so the aggregated mirror manifest carried both variants. Skip the deprecated dashed urls in --gen-manifest so only the new no-dash variant is mirrored. Old per-release manifests are left untouched.
…om mirror The per-release images-*.yaml only list images new/changed in each release, so images stable since before 4.5.16 were absent from the aggregated mirror manifest. Add images-baseline.yaml (picked up by --gen-manifest) covering: objects-api, open-klant, openzaak/open-notificaties, clamav, postgres, eck-operator, opstree/redis-operator (with live digests), plus elasticsearch and podiumd-adapter (version-only; digests TODO on docker.elastic.co/ghcr). Notes upstream-name corrections: objects-api (not objecten-api) and openzaak/open-notificaties (not maykinmedia/*). rabbitmq/os-shell and a kiss alpine util are documented as out, pending the Bitnami relocation + tag pin.
…p upstreams
opennotificaties.tags.redis was true while the redis dependency is gated on the
top-level tags.redis (false), so .Subcharts.redis is never loaded and
secret.yaml crashed rendering ("invalid value; expected string" on
.Release.Name). Celery result-backend + cache already point at the shared
redis-ha cluster (db6/db3), so set tags.redis: false — render now succeeds.
Also correct mirror-strip-registry.py LEGACY_UPSTREAM urls that pointed at
pre-4.8.0 upstreams: objects-api, openzaak/open-notificaties,
platform-autorisatie-beheer-component/pabc-*, brp-api/personen-mock,
sergeymakinen/clamav_exporter, adorsys/keycloak-config-cli,
opstree/redis-operator, and the kiss contact-* repos.
The kiss alpine.image block (library/alpine) had no template consumer and was removed from the gemeente values. The real alpine image is alpine/k8s (redis-ha jobs), already pinned + mirrored. Update the baseline note.
….yaml Merge the generated images-mirror-stripped.yaml aggregate into images-baseline.yaml and remove the former. images-baseline.yaml is now the single complete strip-registry mirror manifest (per-release delta images + long-stable gap-fillers), keeping the curated TODO-digest and NOT-INCLUDED notes. - scripts/mirror-strip-registry.py: --gen-manifest now excludes images-baseline.yaml (instead of images-mirror-stripped.yaml) from its input glob so it is not re-aggregated into itself. The gap-filler entries unique to images-baseline.yaml are not reproduced by --gen-manifest and remain hand-maintained (noted in the file header and script comment). - docs/images/acr-mirror-naming.md, docs/upgrade-from-4.7.5-to-4.8.0.md: repoint references to images-baseline.yaml.
Track team-shared Claude Code knowledge in git: - CLAUDE.md (repo root): project overview (PodiumD Helm umbrella; corrects the unrelated CrawlDock CLAUDE.md that loads from a parent dir), branch model, and @imports of the memory files so they auto-load. - .claude/memory/branch-workflow.md: no-merge-commit policy -> rebase/squash + force-with-lease; push base before rebasing children. - .claude/memory/render-verify.md: helm dep update + template, plus the zgw-office-addin dummy-uri override needed to pass the schema gate. - .gitignore: track .claude/memory/ (mirrors the existing .claude/commands/ exception).
Chart values.yaml deploys kiss-frontend 2.2.2, kiss-elastic-sync 0.3.2 and ita web/poller 3.1.0 (lag the 4.8.0 manifest tags 2.2.3/0.3.3/3.2.0). Add the older tags alongside the new ones in images-baseline so the import mirrors both and ontw-mayk stops ImagePullBackOff. Digests: kiss resolved via ghcr token (Docker-Content-Digest); ita from images-4.7.1.yaml.
Solution design for TLS termination at Azure Application Gateway with cert-manager as the single certificate authority, shared with in-cluster APISIX and covering the FSC-NLX front-channel scenarios. Recovered from WIP stash (originally drafted on feature/podiumd-4.7.4); never committed.
Flip pabc.enabled false -> true in charts/podiumd/values.yaml so the PABC (PodiumD Autorisatie Beheer Component) subchart deploys by default.
…n guard The zac.featureFlags.pabcIntegration key was removed in ZAC 5.0.1, so the deployment-time guard that failed when it was true while pabc.enabled was false can never fire. Remove it.
The test workflow baked charts/podiumd with no values, so schema and required/fail guards failed. Pass ci/lint-values.yaml via k8s-bake overrideFiles (-> helm template -f); k8s-bake already runs 'helm dependency update' first. Add the missing @zac and @Worth-NL chart repos so dependency resolution succeeds, and add dummy zgw-office-addin values (its schema/required guards otherwise block a bare render).
- opennotificaties 2.0.0: add settings.messageBroker.celeryResultBackend (redis db6) — subchart secret.yaml nil-pointered without it, base render was broken (C2/N1). - ita: bump 3.1.0->3.2.0 (Chart.yaml + web/poller image tags), add required ita.medewerker block + fail-fast guard in validations.yaml (W2). - zgw-office-addin: revert frontendUrl/zgwApis.url to "" for fail-fast; placeholders live only in ci/lint-values.yaml (W3). - keycloak-operator initImage: digest-pin python 3.14-slim (N3). - redis-ha.yaml: quote app/service_name label values (W5).
- images-4.8.0.yaml: add open-notificaties 1.16.0 entry (C3) — was missing from the hop manifest, mirror pipeline would skip it. - upgrade guides (4.7.3 + 4.7.5): add Open Notificaties 2.0.0 section with RabbitMQ drain + orphaned PVC/secret cleanup (C2); PABC-enabled-by-default + external DB (C1); redis rolling-restart note (W5); fix ITA 3.2.1->3.2.0; add ON/PABC/redis component rows. - values-changes-4.8.0.md: PABC section + TL;DR row (C1); fill empty New-optional-fields + Pre-deploy-checklist sections (N2).
Fail the test workflow if keycloak.image.tag embedded digest drifts from keycloak-operator.config.keycloakImage.sha (two hand-synced copies of the same 26.6.3 digest).
ci/lint-values.yaml now carries zgw-office-addin placeholders, so a bare render with only -f ci/lint-values.yaml passes; drop the /tmp/ovr.yaml step.
- Remove upgrade-from-4.7.3-to-4.8.0.md (official path enters 4.8.0 via 4.7.5); clean references in UPGRADING.md, the 4.7.5 guide, images-4.8.0.yaml and README. - Restore zgw-office-addin common.frontendUrl + backend.zgwApis.url example hosts in values.yaml; remove those URL keys from ci/lint-values.yaml (chart supplies URLs, lint file only the MSAL/secret placeholders). - Add ZGW Office Add-in appEnv=production (DisplayName indicator) note to the 4.7.5 upgrade guide + pre-deploy checklist.
- New consolidated upgrade-from-4.6.8-to-4.7.6.md folding the whole 4.7.x line (4.7.0-4.7.6): Keycloak 26.6.1->26.6.3, OpenZaak 1.27.2, OAB 2.0.0, Datamigratie, ZGW Office Add-in v0.9.313, OF logging revert, Open Beheer token. - Rename upgrade-from-4.7.5-to-4.8.0.md -> upgrade-from-4.7.6-to-4.8.0.md; baseline now 4.7.6, carry-over note extended with 4.7.6 items. - 4.8.0 guide + values-changes: note to remove the now-redundant pabc.enabled from gemeente values (default true); zac.featureFlags.pabcIntegration removal already documented. - UPGRADING.md path 4.6.8->4.7.6->4.8.0; drop the stale '4.7.6 is a parallel patch' note; index updates. Fix references in images-4.8.0.yaml + README.
* Removes the default value for `apiproxy.locations.brp.toepassingDefaultValue`
Updates to KISS and ITA for PodiumD 4.8 - KISS: 2.2.2 > 2.2.4 - ITA: 3.1.0 > 3.2.0 Removed sha from image tag of OMC: omc uses the tag in pod labels, so including the sha will cause deploy to fail OMC chart at this point does not support a separate sha tag. --------- Co-authored-by: infojohn <john@info.nl>
### Open Inwoner 2.3.0 → 2.3.1 - `Chart.yaml`: `openinwoner` dependency `2.2.0` → `2.2.1` (appVersion `2.3.1`). The 2.2.1 chart is *only* the appVersion bump — no template changes. - `values.yaml`: `openinwoner.image.tag` `2.3.0` → `2.3.1`. - 2.3.1 is a **pure bug-fix patch** over 2.3.0: no new settings, no migrations, no breaking changes, no security fixes. Notable fixes: logout-confirm page for users with incomplete required fields, ZGW per-zaaktype related-type import guard, phone-number constraint handling on Klanten-API sync, SSD fixes, `Site` existence before uWSGI on fresh deploys, missing-`PartijIdentificator` handling, HTMX/CSP fix. ### ClamAV 1.4.4 → 1.5.2 (daemon) - `values.yaml`: `clamav.image.tag` `1.4.4` → `1.5.2` (image-tag override). The wiremind `clamav` chart **stays `3.7.1`** — already the latest published version (default appVersion `1.4.3`, overridden via the tag), so no chart bump is available/needed. - 1.5.x is a feature release; 1.5.2 fixes **CVE-2026-20031** (HTML-parser DoS) plus crash fixes (`RUSTSEC-2026-0007`, JPEG loop, alignment). - **No breaking `clamd.conf` changes** — 1.5 only adds options; existing config keeps working. CVD signature DBs stay compatible (freshclam re-syncs on start). ### Docs - `docs/images/images-4.8.0.yaml`: OIP → 2.3.1 + digest; new `clamav` 1.5.2 entry (multi-arch OCI index digest). - `docs/upgrade-from-4.7.3-to-4.8.0.md`: component table updated, OIP 2.3.0→2.3.1 bug-fix note, and a new ClamAV 1.4.4→1.5.2 section. ## Action required **None** for either bump — pods roll on `helm upgrade`; ClamAV re-syncs its signature DB on startup. ## Digests | Image | Version | Digest | |---|---|---| | `docker.io/maykinmedia/open-inwoner` | 2.3.1 | `sha256:3a2ff5c8eefa69252b15a7385c82811c3681e6ecc29bb2aa35eccb331dddbc56` | | `docker.io/clamav/clamav` (index) | 1.5.2 | `sha256:c17762a00ba24dce4cf822fdc6f5bdfaa6e3ba152efc734d545b9a68be5641da` |
- Bump Open Inwoner references 2.3.0/chart 2.2.0 -> 2.3.1/chart 2.2.1 in upgrade guide, values-changes doc, and images-4.8.0.yaml header - Remove callout saying 2.3.1 is not part of base 4.8.0 release (it now is) - Fix values-changes-4.8.0.md companion link (was 4.6.5->4.7.0, now 4.7.6->4.8.0) - Add missing images-baseline.yaml entries: open-inwoner 2.3.1, ClamAV 1.5.2, redis-operator v0.25.0, kiss-frontend 2.2.4 - Remove stale "lags" comments for ITA 3.1.0 and kiss-elastic-sync 0.3.2 - Bump redis-ha initContainerImage busybox 1.37.0-glibc -> 1.38.0-glibc Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
bas-info-nl
force-pushed
the
feature/podiumd-4.8.0
branch
from
July 6, 2026 22:57
c56fc33 to
4f4dd12
Compare
- README.md, UPGRADING.md, upgrade-from-4.7.6-to-4.8.0.md: fix Open Inwoner version (2.3.1/chart 2.2.1), add Open Zaak 1.27.3 (4.7.7 patch folded in), add three missing reference guides to the path table, fix cumulative hop reference (4.6.8→4.7.6 not 4.7.3) - images-4.8.0.yaml: rename all 25 entries from legacy ACR short names to strip-registry convention (name = strip_registry(url)); add Open Zaak 1.27.3 entry; fix header (vs 4.7.6, not 4.7.3); drop stale "keeps openzaak/ prefix" comment; remove duplicate open-notificaties entry - images-baseline.yaml: add Open Zaak 1.27.3 entry - mirror-strip-registry.py: add zaakbrug, zgw-office-addin-backend/ frontend; fix zgw-office-add-in-* to target current addin (no hyphen) upstream; correct k8s-wait-for registry (ghcr.io not docker.io) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Upstream re-published these tags with updated base/security layers; pinned digests refreshed to match current upstream manifest index: clamav/clamav:1.5.2 library/python:3.14-slim (values.yaml line 77 + manifests) library/solr:9.10.1-slim (values.yaml lines 2836/2839 + baseline) nginxinc/nginx-unprivileged:1.31.1 (9 pins in values.yaml + manifests) sergeymakinen/clamav_exporter:v2.1.3 wearefrank/zaakbrug:1.26.14 brp-api/personen-mock:2.7.0-202606230850 keycloak/keycloak-operator:26.6.3 (baseline only) Verified by scripts/verify_digests.py against upstream registries. Helm render confirmed OK after update. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Update chart version OpenZaak 1.14.1>1.14.2
…+ account clients) All accounts in the podiumd realm are admin-provisioned; the built-in Account Console has no legitimate use case for beheer staff. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
## What Adds an operator guide for the **Open Beheer** component shipped in PodiumD 4.8.0. - **New** `charts/podiumd/docs/openbeheer.md` — overview, quick-reference table, component dependencies (Keycloak OIDC, Open Zaak Catalogi, Objecttypen, public Selectielijst, Postgres, Redis HA db 17), `django-setup-configuration` wiring, secrets handling, RWX Azure-file storage, the uWSGI `--master` requirement, opt-in enable steps with a full `configuration.data` example, and validation checks. - **Edit** `charts/podiumd/README.md` — new `### Open Beheer` component section linking the doc (same pattern as APISIX / PABC). Detail level mirrors the MI-exports operator doc. ## Scope Docs only — no `values.yaml` / template changes. Component remains disabled by default (`openbeheer.enabled: false`). ## Refs JIRA IN-2157. 🤖 Generated by Claude Code with help from Jimbo
## What Adds `charts/podiumd/docs/zaakbrug-deploy.md` — a generic, end-to-end guide for enabling the zaakbrug Frank!Framework sub-chart (disabled by default). ## Why Zaakbrug enablement is a multi-layer integration, and two pieces are easy to miss — they are not templated by the chart and must be supplied by the environment: 1. The `zaakbrug.frank.environmentVariables` **OAuth2 console block**. Without it the Frank console starts with no auth provider and serves its system information openly instead of redirecting to Keycloak. 2. The **post-deploy `kubectl patch`** that mounts the `zaakbrug-oauth-role-mapping` ConfigMap at `/opt/frank/resources/` (the upstream chart has no `extraVolumeMounts` support; the pod crash-loops without it). Both surfaced in a recent test-environment rollout where only a minimal values block was applied. The guide documents both, plus the `ssl: true` (boolean, not string) pitfall and the recommended deploy method. ## Contents - Quick reference table - 1. Database · 2. Key Vault secrets · 3. Values (keycloak client + OAuth2 console block + jdbc/ssl) · 4. Open Zaak trust · 5. Pipeline (wearefrank repo, secret bindings, mount patch) · 6. Keycloak realm config (automatic) · 7. DNS · 8. Deploy & verify - Troubleshooting: open-console-no-Keycloak (with reproduce table), `expected bool; got string`, CrashLoopBackOff, false-failed deploy ## Notes - Targets 4.8.0 — zaakbrug `2.3.27` / image `1.26.14`. - The post-deploy mount patch is flagged as a **temporary workaround**, to be removed once the upstream `wearefrank/zaakbrug` chart supports `extraVolumes`/`extraVolumeMounts`. - Docs-only change; no chart templates or values touched. 🤖 Generated by Claude Code with help from Jimbo
Verdergebouwd op #331 @felixcicatt - gerebased op de 4.8, plus OIP en runbook. --------- Co-authored-by: JIMMELAPTOP\Jimme <jimme_vd_meer@hotmail.com>
Two one-off, in-cluster tools for the monitoring-logging Loki stack:
loki-dump/ Export all Loki logs (last 30d) to a single gzip file on a
self-sized PVC, then snapshot the disk (VolumeSnapshot, Retain).
Measures ingested volume first to size /dump, paginates
query_range forward (ns cursors compared as strings).
loki-pii-scan/ One-off Dutch-PII (AVG) sweep. Per-category server-side LogQL
filters, then local validation (BSN 11-proef, IBAN mod-97,
Luhn) and masking. Writes a MASKED report (no raw PII) to a PVC
and snapshots it.
Both run as Jobs in ns monitoring using the internal-ACR base image
acrprodmgmt.azurecr.io/k8s:1.34.7 (no public egress). Scripts are
bash3-compatible and pass shellcheck.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
🤖 Generated by Claude Code with help from Jimbo
Umbrella doc for loki-dump/ and loki-pii-scan/. States explicitly that both are temporary, one-off operator tools, not GitOps/CI-managed, and are expected to be torn down (in-cluster resources, snapshots, and the scripts themselves) once their task is complete. Includes prerequisites, run commands, expected lifetime, decommissioning commands, and a removal checklist. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> 🤖 Generated by Claude Code with help from Jimbo
jimleitch01
force-pushed
the
feature/podiumd-4.8.0-loki-log-tooling
branch
from
July 8, 2026 09:28
d0312e5 to
f55967e
Compare
jimleitch01
force-pushed
the
feature/podiumd-4.8.0
branch
from
July 10, 2026 12:12
69e6fb5 to
42df048
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two temporary, one-off operator tools under
charts/podiumd/scripts/, for themonitoring-loggingLoki stack. Not GitOps/CI-wired; expected to be removed once their task is done (seeloki-tooling-USAGE.md).loki-dump/loki-pii-scan/How
monitoringvia internal-ACR base imageacrprodmgmt.azurecr.io/k8s:1.34.7(bash+curl+jq+awk; no public egress).query_rangepagination; ns cursors compared as strings (avoids jq 2^53 float corruption).VolumeSnapshot(deletionPolicy: Retain).Notes
shellcheck. PII validators tested locally (valid/invalid BSN, IBAN, Luhn; epoch rejection; masking).loki-tooling-USAGE.mddocuments one-off intent, decommissioning commands, and a removal checklist.Test plan
loki-pii-scan.shagainstaks-blue-ontw-dim1loki-tooling-USAGE.md🤖 Generated by Claude Code with help from Jimbo