Add support for chronicle local configuration - #920
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a new chronicle.localConfig values key to the Posit Workbench and Posit Connect Helm charts to let operators supply Chronicle .gcfg overrides that are applied after the product-generated Chronicle configuration. This follows each chart’s existing config rendering approach, with Connect additionally staging the override into a writable config directory via an init container.
Changes:
- Workbench: merge
chronicle.localConfiginto the existing config override map so it renders aschronicle-local.gcfgin the general ConfigMap. - Connect: render
chronicle-local.gcfginto the main ConfigMap and add an init container +emptyDirmount to stage it into Chronicle’s writable config directory. - Add helm-unittest coverage, docs/NEWS updates, and chart version bumps for both charts.
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| charts/rstudio-workbench/values.yaml | Adds the new chronicle.localConfig values entry and inline examples. |
| charts/rstudio-workbench/tests/chronicle_test.yaml | Adds unit tests covering default behavior, rendering format, and Workbench lookup behavior via XDG_CONFIG_DIRS. |
| charts/rstudio-workbench/templates/configmap-general.yaml | Merges chronicle.localConfig into rendered config outputs as chronicle-local.gcfg. |
| charts/rstudio-workbench/README.md.gotmpl | Documents how/why to use chronicle.localConfig for bundled Chronicle overrides. |
| charts/rstudio-workbench/README.md | Generated README update reflecting the new documentation and values table row. |
| charts/rstudio-workbench/NEWS.md | Notes the new value in the changelog. |
| charts/rstudio-workbench/Chart.yaml | Bumps chart version to 0.22.0. |
| charts/rstudio-connect/values.yaml | Adds the new chronicle.localConfig values entry and inline examples. |
| charts/rstudio-connect/tests/chronicle_test.yaml | Adds unit tests for ConfigMap emission and init container / volume wiring. |
| charts/rstudio-connect/templates/deployment.yaml | Adds init container + emptyDir mount to stage the override into Chronicle’s writable config directory. |
| charts/rstudio-connect/templates/configmap.yaml | Renders chronicle-local.gcfg into the ConfigMap when chronicle.localConfig is set. |
| charts/rstudio-connect/README.md.gotmpl | Documents chronicle.localConfig behavior and the init container requirement. |
| charts/rstudio-connect/README.md | Generated README update reflecting the new documentation and values table row. |
| charts/rstudio-connect/NEWS.md | Notes the new value in the changelog. |
| charts/rstudio-connect/Chart.yaml | Bumps chart version to 0.21.0. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| {{- $podRunAsNonRoot := dig "runAsNonRoot" false .Values.pod.securityContext }} | ||
| {{- $podRunAsUser := dig "runAsUser" nil .Values.pod.securityContext }} | ||
| {{- if or $podRunAsNonRoot (and $podRunAsUser (ne (int $podRunAsUser) 0)) }} | ||
| {{- fail "chronicle.localConfig requires the Connect pod to run as root: the chronicle-config init container chowns /etc/rstudio-connect/chronicle for posit-chronicle. Remove pod.securityContext.runAsNonRoot / a non-zero pod.securityContext.runAsUser, or unset chronicle.localConfig." }} |
There was a problem hiding this comment.
What does this failure mean / how would it present to users? Will it put the pod in a failed state? Or just the initContainer?
There was a problem hiding this comment.
This would fail during the template rendering(helm install) instead of failing during runtime, an example failure:
Error: INSTALLATION FAILED: execution error at (rstudio-connect/templates/deployment.yaml:105:10):
chronicle.localConfig requires the Connect pod to run as root: the chronicle-config init
container chowns /etc/rstudio-connect/chronicle for posit-chronicle. Remove
pod.securityContext.runAsNonRoot / a non-zero pod.securityContext.runAsUser, or unset
chronicle.localConfig.
There was a problem hiding this comment.
OK. That seems good to me.
I'm vaguely concerned about the requirement for the pod to runAsRoot in order to override config. I know that allowing the products to run without being root has been a point of emphasis recently, but I'm not sure whether that would apply here. I'm sure the product team reviewers would be able to help us understand impact if there is any.
There was a problem hiding this comment.
I did some testing on this and it seems Connect already requires this, I got an error "Connect must run as a privileged user (root) in most installations".
But I agree, if the products do not recommend it, then I wouldn't want to introduce it. We can see what they say.
Testing:
Verified end-to-end on OrbStack + Minio — override reaches Chronicle and data reaches S3