From ad42ddb52da3f896b008515a440d7eea1583285e Mon Sep 17 00:00:00 2001 From: MergeCheck Date: Fri, 3 Jul 2026 20:24:06 -0300 Subject: [PATCH 1/3] fix(immich): align template standards --- charts/immich/README.md | 18 ++++++++- charts/immich/templates/NOTES.txt | 38 +++++++++---------- charts/immich/templates/networkpolicy.yaml | 4 +- .../networkpolicy-extra-egress-values.yaml | 10 +++++ charts/immich/tests/networkpolicy_test.yaml | 36 ++++++++++++++++++ .../tests/test-connection.yaml | 0 charts/immich/values.schema.json | 11 +++++- charts/immich/values.yaml | 2 + 8 files changed, 93 insertions(+), 26 deletions(-) create mode 100644 charts/immich/tests/networkpolicy-extra-egress-values.yaml create mode 100644 charts/immich/tests/networkpolicy_test.yaml rename charts/immich/{templates => }/tests/test-connection.yaml (100%) diff --git a/charts/immich/README.md b/charts/immich/README.md index eaaa795f4..f00fd95f5 100644 --- a/charts/immich/README.md +++ b/charts/immich/README.md @@ -91,6 +91,20 @@ ingress: pathType: Prefix ``` +## NetworkPolicy + +```yaml +networkPolicy: + enabled: true + extraEgress: + - to: + - ipBlock: + cidr: 10.0.0.0/8 + ports: + - protocol: TCP + port: 443 +``` + ## Documentation - [Design](DESIGN.md) @@ -108,10 +122,10 @@ helm unittest --with-subchart=false charts/immich helm template immich charts/immich -f charts/immich/ci/ci-values.yaml ``` -### 🟢 Security Scan: `immich` +### Security Scan: `immich` | Framework | Score | |---|---| | MITRE + NSA + SOC2 | **88.61111%** | -> ✅ Security posture acceptable. +Security posture acceptable. diff --git a/charts/immich/templates/NOTES.txt b/charts/immich/templates/NOTES.txt index effc3c60f..aeeb8177c 100644 --- a/charts/immich/templates/NOTES.txt +++ b/charts/immich/templates/NOTES.txt @@ -1,28 +1,24 @@ {{/* SPDX-License-Identifier: Apache-2.0 */}} -============================================================================= -Immich deployed successfully! -============================================================================= +1. Summary + Immich has been deployed successfully. + Image: {{ .Values.image.repository }}:{{ .Values.image.tag }} + Service: {{ include "immich.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }} -ACCESS: +2. Access {{- if .Values.ingress.enabled }} {{- range .Values.ingress.hosts }} - http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }} + URL: http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }} {{- end }} {{- else if and .Values.gateway.enabled .Values.gateway.hostnames }} {{- range .Values.gateway.hostnames }} - https://{{ . }} + URL: https://{{ . }} {{- end }} {{- else }} kubectl port-forward svc/{{ include "immich.fullname" . }} -n {{ .Release.Namespace }} 2283:{{ .Values.service.port }} Open: http://localhost:2283 {{- end }} -SERVICE: - Internal: {{ include "immich.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }} - Health: {{ .Values.probes.path }} - Image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - -DATABASE: +3. Data Services {{- if .Values.postgresql.enabled }} PostgreSQL: bundled HelmForge subchart with Immich VectorChord image Service: {{ .Release.Name }}-postgresql.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.postgresql.service.port | default 5432 }} @@ -30,8 +26,6 @@ DATABASE: PostgreSQL: external Host: {{ .Values.database.external.host }}:{{ .Values.database.external.port }} {{- end }} - -CACHE: {{- if .Values.valkey.internal.enabled }} Redis-compatible cache: bundled HelmForge Redis subchart aliased as valkey Service: {{ include "immich.valkeyHost" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.valkey.service.ports.redis | default 6379 }} @@ -41,24 +35,26 @@ CACHE: {{- end }} {{- if .Values.machineLearning.enabled }} -MACHINE LEARNING: +4. Machine Learning Service: {{ include "immich.fullname" . }}-machine-learning.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.machineLearning.service.port }} {{- end }} -OPERATIONS: +5. Validation + Health path: {{ .Values.probes.path }} Run Helm tests: - helm test {{ .Release.Name }} -n {{ .Release.Namespace }} + helm test {{ .Release.Name }} -n {{ .Release.Namespace }} +6. Troubleshooting Inspect pods: - kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} - kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "immich.fullname" . }} + kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} + kubectl logs -n {{ .Release.Namespace }} deploy/{{ include "immich.fullname" . }} -PRODUCTION REMINDERS: +7. Production Reminders 1. Use explicit Secrets or External Secrets for PostgreSQL and cache credentials. 2. Keep upload persistence on durable storage and use ReadWriteMany before scaling server replicas. 3. Configure HTTPS through Ingress or Gateway API before exposing Immich publicly. -DOCUMENTATION: +8. Resources Chart: https://helmforge.dev/docs/charts/immich Source: https://github.com/helmforgedev/charts/tree/main/charts/immich Immich: https://immich.app diff --git a/charts/immich/templates/networkpolicy.yaml b/charts/immich/templates/networkpolicy.yaml index 7b641010e..463813fc3 100644 --- a/charts/immich/templates/networkpolicy.yaml +++ b/charts/immich/templates/networkpolicy.yaml @@ -21,8 +21,8 @@ spec: - namespaceSelector: {} {{- end }} egress: - {{- if .Values.networkPolicy.egress }} - {{- toYaml .Values.networkPolicy.egress | nindent 4 }} + {{- with concat (.Values.networkPolicy.egress | default list) (.Values.networkPolicy.extraEgress | default list) }} + {{- toYaml . | nindent 4 }} {{- else }} - {} {{- end }} diff --git a/charts/immich/tests/networkpolicy-extra-egress-values.yaml b/charts/immich/tests/networkpolicy-extra-egress-values.yaml new file mode 100644 index 000000000..1c14847cc --- /dev/null +++ b/charts/immich/tests/networkpolicy-extra-egress-values.yaml @@ -0,0 +1,10 @@ +# SPDX-License-Identifier: Apache-2.0 +networkPolicy: + enabled: true + extraEgress: + - to: + - ipBlock: + cidr: 10.0.0.0/8 + ports: + - protocol: TCP + port: 443 diff --git a/charts/immich/tests/networkpolicy_test.yaml b/charts/immich/tests/networkpolicy_test.yaml new file mode 100644 index 000000000..a975cd9be --- /dev/null +++ b/charts/immich/tests/networkpolicy_test.yaml @@ -0,0 +1,36 @@ +# SPDX-License-Identifier: Apache-2.0 +suite: NetworkPolicy +templates: + - templates/networkpolicy.yaml +release: + name: test +tests: + - it: should render default ingress and egress when enabled + set: + networkPolicy.enabled: true + asserts: + - isKind: + of: NetworkPolicy + - equal: + path: spec.policyTypes[0] + value: Ingress + - equal: + path: spec.policyTypes[1] + value: Egress + - equal: + path: spec.ingress[0].from[0].namespaceSelector + value: {} + - equal: + path: spec.egress[0] + value: {} + + - it: should append extra egress rules + values: + - networkpolicy-extra-egress-values.yaml + asserts: + - equal: + path: spec.egress[0].to[0].ipBlock.cidr + value: 10.0.0.0/8 + - equal: + path: spec.egress[0].ports[0].port + value: 443 diff --git a/charts/immich/templates/tests/test-connection.yaml b/charts/immich/tests/test-connection.yaml similarity index 100% rename from charts/immich/templates/tests/test-connection.yaml rename to charts/immich/tests/test-connection.yaml diff --git a/charts/immich/values.schema.json b/charts/immich/values.schema.json index 54968cce9..a5338bb87 100644 --- a/charts/immich/values.schema.json +++ b/charts/immich/values.schema.json @@ -140,7 +140,16 @@ "pathType": { "type": "string", "enum": ["Exact", "PathPrefix", "RegularExpression"] } } }, - "networkPolicy": { "type": "object" }, + "networkPolicy": { + "type": "object", + "additionalProperties": true, + "properties": { + "enabled": { "type": "boolean" }, + "ingress": { "type": "array" }, + "egress": { "type": "array" }, + "extraEgress": { "type": "array" } + } + }, "autoscaling": { "type": "object" }, "pdb": { "type": "object" }, "probes": { "type": "object" }, diff --git a/charts/immich/values.yaml b/charts/immich/values.yaml index 83ba16f2b..04a9e1cb1 100644 --- a/charts/immich/values.yaml +++ b/charts/immich/values.yaml @@ -346,6 +346,8 @@ networkPolicy: ingress: [] # -- Additional egress rules. Defaults allow all egress for database, cache, machine-learning, and external API compatibility. egress: [] + # -- Additional egress rules appended after networkPolicy.egress. + extraEgress: [] autoscaling: # -- Enable HorizontalPodAutoscaler for the Immich server. From e99beff04d66c2a1f8fbd3ed81c8ffcaf98fcabc Mon Sep 17 00:00:00 2001 From: MergeCheck Date: Fri, 3 Jul 2026 20:52:32 -0300 Subject: [PATCH 2/3] fix(immich): preserve default network egress --- charts/immich/templates/networkpolicy.yaml | 3 ++- .../{ => templates}/tests/test-connection.yaml | 0 charts/immich/tests/networkpolicy_test.yaml | 7 +++++-- charts/immich/tests/test_connection_test.yaml | 18 ++++++++++++++++++ 4 files changed, 25 insertions(+), 3 deletions(-) rename charts/immich/{ => templates}/tests/test-connection.yaml (100%) create mode 100644 charts/immich/tests/test_connection_test.yaml diff --git a/charts/immich/templates/networkpolicy.yaml b/charts/immich/templates/networkpolicy.yaml index 463813fc3..8384ba041 100644 --- a/charts/immich/templates/networkpolicy.yaml +++ b/charts/immich/templates/networkpolicy.yaml @@ -21,7 +21,8 @@ spec: - namespaceSelector: {} {{- end }} egress: - {{- with concat (.Values.networkPolicy.egress | default list) (.Values.networkPolicy.extraEgress | default list) }} + {{- $egress := .Values.networkPolicy.egress | default (list (dict)) }} + {{- with concat $egress (.Values.networkPolicy.extraEgress | default list) }} {{- toYaml . | nindent 4 }} {{- else }} - {} diff --git a/charts/immich/tests/test-connection.yaml b/charts/immich/templates/tests/test-connection.yaml similarity index 100% rename from charts/immich/tests/test-connection.yaml rename to charts/immich/templates/tests/test-connection.yaml diff --git a/charts/immich/tests/networkpolicy_test.yaml b/charts/immich/tests/networkpolicy_test.yaml index a975cd9be..811e364c3 100644 --- a/charts/immich/tests/networkpolicy_test.yaml +++ b/charts/immich/tests/networkpolicy_test.yaml @@ -29,8 +29,11 @@ tests: - networkpolicy-extra-egress-values.yaml asserts: - equal: - path: spec.egress[0].to[0].ipBlock.cidr + path: spec.egress[0] + value: {} + - equal: + path: spec.egress[1].to[0].ipBlock.cidr value: 10.0.0.0/8 - equal: - path: spec.egress[0].ports[0].port + path: spec.egress[1].ports[0].port value: 443 diff --git a/charts/immich/tests/test_connection_test.yaml b/charts/immich/tests/test_connection_test.yaml new file mode 100644 index 000000000..118d2acb3 --- /dev/null +++ b/charts/immich/tests/test_connection_test.yaml @@ -0,0 +1,18 @@ +# SPDX-License-Identifier: Apache-2.0 +suite: Helm Test +templates: + - templates/tests/test-connection.yaml +release: + name: test + namespace: default +tests: + - it: should render the Helm test hook pod + asserts: + - isKind: + of: Pod + - equal: + path: metadata.name + value: test-immich-test + - equal: + path: metadata.annotations["helm.sh/hook"] + value: test From 495cdaeaba1ebd19e744aa9f6f2349598038ebc4 Mon Sep 17 00:00:00 2001 From: MergeCheck Date: Sun, 5 Jul 2026 11:49:12 -0300 Subject: [PATCH 3/3] test(immich): cover combined egress ordering --- charts/immich/tests/networkpolicy_test.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/charts/immich/tests/networkpolicy_test.yaml b/charts/immich/tests/networkpolicy_test.yaml index 811e364c3..0e16eb579 100644 --- a/charts/immich/tests/networkpolicy_test.yaml +++ b/charts/immich/tests/networkpolicy_test.yaml @@ -37,3 +37,16 @@ tests: - equal: path: spec.egress[1].ports[0].port value: 443 + + - it: should append extraEgress after base egress rules + set: + networkPolicy.enabled: true + networkPolicy.egress[0].to[0].ipBlock.cidr: 172.16.0.0/12 + networkPolicy.extraEgress[0].to[0].ipBlock.cidr: 10.0.0.0/8 + asserts: + - equal: + path: spec.egress[0].to[0].ipBlock.cidr + value: 172.16.0.0/12 + - equal: + path: spec.egress[1].to[0].ipBlock.cidr + value: 10.0.0.0/8