Community Helm Chart - new home wanted

[Otterian]

If this is not a suitable place to ask for this, I apologize.

Hi, I'm one of the maintainers on the Dependency-Track community Helm chart.

Unfortunately, we (the chart maintainers) do not have time to follow up on upgrades and PRs for this chart anymore - and we believe that the chart deserves a better place to live, with people that are invested in the Dependency-Track stack.

We're wondering if the Dependency-Track project would consider adopting this chart as part of the mainstream project, or if there's anyone else that want to maintain and develop the chart going forward.

Thanks in advance for any feedback/thoughts.

[syalioune]

Seems legit to me (not saying this so that i can have my PR merged 😜)

[nscuro]

Hi @Otterian, thank you for reaching out, and thanks for all all the work you've done so far with maintaining the chart!

I think it makes sense for us to adopt the chart.

At the very least, it will have a higher visibility under the DependencyTrack org, making it easier to discover
and (hopefully) more appealing for contributors.

What is your proposed / preferred way of executing this ownership transfer?

[Otterian]

Hi @nscuro, thank you for your reply and sorry for the very late response om my part.

Since the evryfs/helm-charts repo contains other charts as well, I think it would be easiest to take the contents of the dependency-track chart folder (https://github.com/evryfs/helm-charts/tree/master/charts/dependency-track) and commit it to a repository under the DependencyTrack organization. I can add a note to the evryfs/helm-charts repository as well as an issue pointing to the new location of the chart, and keep it around for some time to minimize risk before removing the chart and the releases from the repository altogether.

For the CI/CD part (GitHub Actions), those can be carried over as far as I can see, but should probably be reworked, depending on project needs, coverage, etc. (https://github.com/evryfs/helm-charts/blob/master/.github/workflows/test.yaml)

The chart releases can be published on GitHub, as is the case for the current repo: https://github.com/evryfs/helm-charts/blob/master/.github/workflows/publish.yaml.

There's probably some things that need to be fixed after the fact, as the chart hasn't been updated for several months, so it doesn't follow the current release. Other details like maintainers, sources etc must be updated (e.g https://github.com/evryfs/helm-charts/blob/master/charts/dependency-track/Chart.yaml)

Please let me know if you have any questions or feedback on the above approach.

[iamrahul127]

Hi @nscuro,
Do you know when community helm chart will be moved and updated? We need the latest version of DT and kind of stuck on v4.6.2 as helm chart is not updated yet.

[iamrahul127]

Hi @nscuro,
Do you know if this will be prioritized or not?

[nscuro]

@iamrahul127 We have decided to build our own instead. The new chart is hosted here: https://github.com/DependencyTrack/helm-charts

We don't consider it production ready yet since we're still awaiting and receiving enhancements from the community.

[black-snow]

We just copypasted and adjusted the original one. I'd be thrilled being able to move "back" to an official one.