bonddim · Aug 12, 2026 · Aug 7, 2026 · Aug 12, 2026 · Aug 12, 2026
diff --git a/charts/base/Chart.yaml b/charts/base/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: base
 description: Base Helm chart for Kubernetes - fully values-driven.
 type: application
-version: 0.2.1
+version: 0.3.0
 maintainers:
   - name: bonddim
 sources:

diff --git a/charts/base/README.md b/charts/base/README.md
@@ -1,6 +1,6 @@
 # base
 
-![Version: 0.2.1](https://img.shields.io/badge/Version-0.2.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 0.3.0](https://img.shields.io/badge/Version-0.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Base Helm chart for Kubernetes - fully values-driven.
 
@@ -36,12 +36,11 @@ Base Helm chart for Kubernetes - fully values-driven.
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| workload | string | `"deployment"` | Workload type to deploy. One of: deployment, daemonset, statefulset, pod or null |
+| workload | string | `"deployment"` | Workload type to deploy. One of: deployment, daemonset, statefulset, rollout, pod or null |
 | annotations | object | `{}` | Additional annotations on the Workload resource itself. |
 | labels | object | `{}` | Additional labels on the Deployment resource itself. |
 | replicas | int | `nil` | Number of pod replicas. Ignored when autoscaling.enabled=true. Must be >= 0 if specified. null by default, which defaults to 1 and not controlled by Helm. |
-| strategy | object | `{}` | Deployment update strategy. e.g. { type: RollingUpdate, rollingUpdate: { maxSurge: 1, maxUnavailable: 0 } } |
-| updateStrategy | object | `{}` | DaemonSet/StatefulSet update strategy. e.g. { type: RollingUpdate } or { type: OnDelete } |
+| strategy | object | `{}` | Update strategy for the selected workload. e.g. { type: RollingUpdate, rollingUpdate: { maxSurge: 1, maxUnavailable: 0 } }. For workload=rollout, the chart merges Service references into this strategy: `stableService`/`activeService`. |
 | serviceName | string | `""` | StatefulSet service name. Defaults to the fullname when empty. |
 | podManagementPolicy | string | `""` | StatefulSet pod management policy: OrderedReady or Parallel. |
 | volumeClaimTemplates | list | `[]` | StatefulSet volumeClaimTemplates for persistent storage. |
@@ -113,6 +112,13 @@ Base Helm chart for Kubernetes - fully values-driven.
 | httpRoute.parentRefs | list | `[]` | Gateway parentRefs this route attaches to. |
 | httpRoute.hostnames | list | `[]` | Hostnames matched by this route. |
 | httpRoute.rules | list | `[]` | Routing rules. backendRefs are auto-populated from the Service. |
+| networkPolicy.enabled | bool | `false` | Whether to create a NetworkPolicy resource. |
+| networkPolicy.annotations | object | `{}` | Annotations for the NetworkPolicy. |
+| networkPolicy.labels | object | `{}` | Labels for the NetworkPolicy. |
+| networkPolicy.podSelector | object | `{}` | Pods this policy applies to. Defaults to this release's selector labels when empty. |
+| networkPolicy.policyTypes | list | `[]` | Policy types to enforce, e.g. [Ingress, Egress]. Listing a type without matching rules below denies all traffic of that type. |
+| networkPolicy.ingress | list | `[]` | Ingress rules, passed through to the NetworkPolicy spec (tpl-rendered). |
+| networkPolicy.egress | list | `[]` | Egress rules, passed through to the NetworkPolicy spec (tpl-rendered). |
 
 ### Autoscaling parameters
 
@@ -127,6 +133,17 @@ Base Helm chart for Kubernetes - fully values-driven.
 | autoscaling.behavior | object | `{}` | Advanced scaling behavior. |
 | autoscaling.metrics | list | `[]` | Additional custom metrics (appended to the generated metrics list). |
 
+### Pod Disruption Budget parameters
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| podDisruptionBudget.enabled | bool | `false` | Whether to create a PodDisruptionBudget resource. |
+| podDisruptionBudget.annotations | object | `{}` | Annotations for the PodDisruptionBudget. |
+| podDisruptionBudget.labels | object | `{}` | Labels for the PodDisruptionBudget. |
+| podDisruptionBudget.minAvailable | int/string | `1` | Minimum number or percentage of pods that must stay available. Mutually exclusive with maxUnavailable - set this to null to use maxUnavailable. |
+| podDisruptionBudget.maxUnavailable | int/string | `nil` | Maximum number or percentage of pods that may be unavailable. Mutually exclusive with minAvailable. |
+| podDisruptionBudget.unhealthyPodEvictionPolicy | string | `nil` | How unhealthy pods are counted during eviction: IfHealthyBudget or AlwaysAllow. |
+
 ### ConfigMap parameters
 
 | Key | Type | Default | Description |
@@ -142,5 +159,11 @@ Base Helm chart for Kubernetes - fully values-driven.
 |-----|------|---------|-------------|
 | extraObjects | object/list | `[]` | Render additional Kubernetes manifests. Each entry may be a string (with Go template expressions) or a YAML object. |
 
+### Other Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| rollout | object | `{"analysis":{},"minReadySeconds":0,"paused":null,"progressDeadlineAbort":null,"progressDeadlineSeconds":600,"rollbackWindow":{}}` | Rollout parameters. Only applicable when workload=rollout. https://argo-rollouts.readthedocs.io/en/stable/features/specification/ |
+
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)
diff --git a/charts/base/templates/_helpers.tpl b/charts/base/templates/_helpers.tpl
@@ -101,3 +101,11 @@ Tag defaults to Chart.AppVersion when empty.
 {{- printf "%s:%s" $repository $tag }}
 {{- end }}
 {{- end }}
+
+{{/*
+Defines service name used with the Argo Rollouts workload.
+Usage: {{ include "base.rolloutServiceName" . }}
+*/}}
+{{- define "base.rolloutServiceName" -}}
+{{- printf "%s-rollout" (include "base.fullname" .) | trunc 63 | trimSuffix "-" }}
+{{- end -}}
diff --git a/charts/base/templates/_service.tpl b/charts/base/templates/_service.tpl
@@ -0,0 +1,64 @@
+{{/*
+Render a Service from the shared service.* spec.
+Usage:
+  {{ include "base.service" (dict "context" . "name" (include "base.fullname" .)) }}
+*/}}
+{{- define "base.service" -}}
+apiVersion: v1
+kind: Service
+metadata:
+  {{- with include "base.annotations" (dict "annotations" .context.Values.service.annotations "context" .context) }}
+  annotations: {{- . | nindent 4 }}
+  {{- end }}
+  labels: {{- include "base.labels" (dict "labels" .context.Values.service.labels "context" .context) | nindent 4 }}
+  name: {{ .name }}
+spec:
+  {{- with .context.Values.service.clusterIP }}
+  clusterIP: {{ . }}
+  {{- end }}
+  {{- with .context.Values.service.externalIPs }}
+  externalIPs: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .context.Values.service.externalName }}
+  externalName: {{ . }}
+  {{- end }}
+  {{- with .context.Values.service.externalTrafficPolicy }}
+  externalTrafficPolicy: {{ . }}
+  {{- end }}
+  {{- with .context.Values.service.healthCheckNodePort }}
+  healthCheckNodePort: {{ . }}
+  {{- end }}
+  {{- with .context.Values.service.loadBalancerIP }}
+  loadBalancerIP: {{ . }}
+  {{- end }}
+  {{- with .context.Values.service.loadBalancerSourceRanges }}
+  loadBalancerSourceRanges: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  ports:
+    - name: http
+      port: {{ .context.Values.service.port }}
+      targetPort: {{ .context.Values.service.targetPort }}
+      protocol: {{ .context.Values.service.protocol }}
+      {{- with .context.Values.service.nodePort }}
+      nodePort: {{ . }}
+      {{- end }}
+    {{- with .context.Values.service.extraPorts }}
+    {{- include "base.render.list" (dict "value" . "context" .context) | nindent 4 }}
+    {{- end }}
+  {{- with .context.Values.service.publishNotReadyAddresses }}
+  publishNotReadyAddresses: {{ . }}
+  {{- end }}
+  selector: {{- include "base.selectorLabels" .context | nindent 4 }}
+  {{- with .context.Values.service.sessionAffinity }}
+  sessionAffinity: {{ . }}
+  {{- end }}
+  {{- with .context.Values.service.sessionAffinityConfig }}
+  sessionAffinityConfig: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .context.Values.service.topologyKeys }}
+  topologyKeys: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .context.Values.service.type}}
+  type: {{ . }}
+  {{- end }}
+{{- end }}
diff --git a/charts/base/templates/daemonset.yaml b/charts/base/templates/daemonset.yaml
@@ -13,7 +13,7 @@ spec:
   {{- end }}
   selector:
     matchLabels: {{- include "base.selectorLabels" . | nindent 6 }}
-  {{- with .Values.updateStrategy }}
+  {{- with .Values.strategy }}
   updateStrategy: {{- toYaml . | nindent 4 }}
   {{- end }}
   template: {{- include "base.podTemplate" . | nindent 4 }}

diff --git a/charts/base/templates/hpa.yaml b/charts/base/templates/hpa.yaml
@@ -9,27 +9,35 @@ metadata:
   name: {{ include "base.fullname" . }}
 spec:
   scaleTargetRef:
+    {{- if eq .Values.workload "rollout" }}
+    apiVersion: argoproj.io/v1alpha1
+    kind: Rollout
+    {{- else if eq .Values.workload "statefulset" }}
+    apiVersion: apps/v1
+    kind: StatefulSet
+    {{- else }}
     apiVersion: apps/v1
     kind: Deployment
+    {{- end }}
     name: {{ include "base.fullname" . }}
   minReplicas: {{ .Values.autoscaling.minReplicas }}
   maxReplicas: {{ .Values.autoscaling.maxReplicas }}
   metrics:
-    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- with .Values.autoscaling.targetCPUUtilizationPercentage }}
     - type: Resource
       resource:
         name: cpu
         target:
           type: Utilization
-          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+          averageUtilization: {{ . }}
     {{- end }}
-    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- with .Values.autoscaling.targetMemoryUtilizationPercentage }}
     - type: Resource
       resource:
         name: memory
         target:
           type: Utilization
-          averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+          averageUtilization: {{ . }}
     {{- end }}
     {{- with .Values.autoscaling.metrics }}
     {{- toYaml . | nindent 4 }}

diff --git a/charts/base/templates/httproute.yaml b/charts/base/templates/httproute.yaml
@@ -12,14 +12,22 @@ spec:
   {{- with .Values.httpRoute.hostnames }}
   hostnames: {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- $isCanary := and (eq .Values.workload "rollout") (hasKey .Values.strategy "canary") }}
   rules:
     {{- range .Values.httpRoute.rules }}
     - backendRefs:
         - group: ""
           kind: Service
           name: {{ include "base.fullname" $ }}
           port: {{ $.Values.service.port }}
-          weight: 1
+          weight: {{ $isCanary | ternary 100 1 }}
+        {{- if $isCanary }}
+        - group: ""
+          kind: Service
+          name: {{ include "base.rolloutServiceName" $ }}
+          port: {{ $.Values.service.port }}
+          weight: 0
+        {{- end }}
       {{- with .filters }}
       filters: {{- toYaml . | nindent 8 }}
       {{- end }}

diff --git a/charts/base/templates/networkpolicy.yaml b/charts/base/templates/networkpolicy.yaml
@@ -0,0 +1,26 @@
+{{- if .Values.networkPolicy.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  {{- with include "base.annotations" (dict "annotations" .Values.networkPolicy.annotations "context" .) }}
+  annotations: {{- . | nindent 4 }}
+  {{- end }}
+  labels: {{- include "base.labels" (dict "labels" .Values.networkPolicy.labels "context" .) | nindent 4 }}
+  name: {{ include "base.fullname" . }}
+spec:
+  podSelector:
+    {{- if .Values.networkPolicy.podSelector }}
+    {{- include "base.render.value" (dict "value" .Values.networkPolicy.podSelector "context" $) | nindent 4 }}
+    {{- else }}
+    matchLabels: {{- include "base.selectorLabels" . | nindent 6 }}
+    {{- end }}
+  {{- with .Values.networkPolicy.policyTypes }}
+  policyTypes: {{- include "base.render.value" (dict "value" . "context" $) | nindent 4 }}
+  {{- end }}
+  {{- with .Values.networkPolicy.ingress }}
+  ingress: {{- include "base.render.value" (dict "value" . "context" $) | nindent 4 }}
+  {{- end }}
+  {{- with .Values.networkPolicy.egress }}
+  egress: {{- include "base.render.value" (dict "value" . "context" $) | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/base/templates/pdb.yaml b/charts/base/templates/pdb.yaml
@@ -0,0 +1,28 @@
+{{- if .Values.podDisruptionBudget.enabled -}}
+{{- $pdb := .Values.podDisruptionBudget }}
+{{- $hasMin := and (not (kindIs "invalid" $pdb.minAvailable)) (ne (toString $pdb.minAvailable) "") }}
+{{- $hasMax := and (not (kindIs "invalid" $pdb.maxUnavailable)) (ne (toString $pdb.maxUnavailable) "") }}
+{{- if and $hasMin $hasMax }}
+{{- fail "podDisruptionBudget: set only one of minAvailable or maxUnavailable (set podDisruptionBudget.minAvailable=null to use maxUnavailable)" }}
+{{- end }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  {{- with include "base.annotations" (dict "annotations" $pdb.annotations "context" .) }}
+  annotations: {{- . | nindent 4 }}
+  {{- end }}
+  labels: {{- include "base.labels" (dict "labels" $pdb.labels "context" .) | nindent 4 }}
+  name: {{ include "base.fullname" . }}
+spec:
+  {{- if $hasMin }}
+  minAvailable: {{ $pdb.minAvailable }}
+  {{- end }}
+  {{- if $hasMax }}
+  maxUnavailable: {{ $pdb.maxUnavailable }}
+  {{- end }}
+  {{- with $pdb.unhealthyPodEvictionPolicy }}
+  unhealthyPodEvictionPolicy: {{ . }}
+  {{- end }}
+  selector:
+    matchLabels: {{- include "base.selectorLabels" . | nindent 6 }}
+{{- end }}
diff --git a/charts/base/templates/rollout.yaml b/charts/base/templates/rollout.yaml
@@ -0,0 +1,51 @@
+{{- if eq .Values.workload "rollout" -}}
+{{- $fullname := include "base.fullname" . }}
+{{- $rolloutServiceName := include "base.rolloutServiceName" . }}
+{{- $strategy := deepCopy (default dict .Values.strategy) }}
+{{- if hasKey $strategy "canary" }}
+  {{- $services := dict "stableService" $fullname "canaryService" $rolloutServiceName }}
+  {{- $_ := set $strategy "canary" (merge (deepCopy (default dict $strategy.canary)) $services) }}
+{{- else }}
+  {{- $services := dict "activeService" $fullname "previewService" $rolloutServiceName }}
+  {{- $_ := set $strategy "blueGreen" (merge (deepCopy (default dict $strategy.blueGreen)) $services) }}
+{{- end }}
+apiVersion: argoproj.io/v1alpha1
+kind: Rollout
+metadata:
+  {{- with include "base.annotations" (dict "annotations" .Values.annotations "context" .) }}
+  annotations: {{- . | nindent 4 }}
+  {{- end }}
+  labels: {{- include "base.labels" (dict "labels" .Values.labels "context" .) | nindent 4 }}
+  name: {{ $fullname }}
+spec:
+  {{- if and (not .Values.autoscaling.enabled) (ge (int .Values.replicas) 0) }}
+  replicas: {{ .Values.replicas }}
+  {{- end }}
+  {{- with .Values.revisionHistoryLimit }}
+  revisionHistoryLimit: {{ . }}
+  {{- end }}
+  selector:
+    matchLabels: {{- include "base.selectorLabels" . | nindent 6 }}
+  {{- with $strategy }}
+  strategy: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template: {{- include "base.podTemplate" . | nindent 4 }}
+  {{- with .Values.rollout.analysis }}
+  analysis: {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.rollout.minReadySeconds }}
+  minReadySeconds: {{ . }}
+  {{- end }}
+  {{- with .Values.rollout.paused }}
+  paused: {{ . }}
+  {{- end }}
+  {{- with .Values.rollout.progressDeadlineSeconds }}
+  progressDeadlineSeconds: {{ . }}
+  {{- end }}
+  {{- with .Values.rollout.progressDeadlineAbort }}
+  progressDeadlineAbort: {{ . }}
+  {{- end }}
+  {{- with .Values.rollout.rollbackWindow }}
+  rollbackWindow: {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/base/templates/service-rollout.yaml b/charts/base/templates/service-rollout.yaml
@@ -0,0 +1,3 @@
+{{- if eq .Values.workload "rollout" -}}
+{{- include "base.service" (dict "context" . "name" (include "base.rolloutServiceName" .)) }}
+{{- end }}
diff --git a/charts/base/templates/service.yaml b/charts/base/templates/service.yaml
@@ -1,59 +1,3 @@
 {{- if .Values.service.enabled -}}
-apiVersion: v1
-kind: Service
-metadata:
-  {{- with include "base.annotations" (dict "annotations" .Values.service.annotations "context" $) }}
-  annotations: {{- . | nindent 4 }}
-  {{- end }}
-  labels: {{- include "base.labels" (dict "labels" .Values.service.labels "context" .) | nindent 4 }}
-  name: {{ include "base.fullname" . }}
-spec:
-  {{- with .Values.service.clusterIP }}
-  clusterIP: {{ . }}
-  {{- end }}
-  {{- with .Values.service.externalIPs }}
-  externalIPs: {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.service.externalName }}
-  externalName: {{ . }}
-  {{- end }}
-  {{- with .Values.service.externalTrafficPolicy }}
-  externalTrafficPolicy: {{ . }}
-  {{- end }}
-  {{- with .Values.service.healthCheckNodePort }}
-  healthCheckNodePort: {{ . }}
-  {{- end }}
-  {{- with .Values.service.loadBalancerIP }}
-  loadBalancerIP: {{ . }}
-  {{- end }}
-  {{- with .Values.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges: {{- toYaml . | nindent 4 }}
-  {{- end }}
-  ports:
-    - name: http
-      port: {{ .Values.service.port }}
-      targetPort: {{ .Values.service.targetPort }}
-      protocol: {{ .Values.service.protocol }}
-      {{- with .Values.service.nodePort }}
-      nodePort: {{ . }}
-      {{- end }}
-    {{- with .Values.service.extraPorts }}
-    {{- include "base.render.list" (dict "value" . "context" $) | nindent 4 }}
-    {{- end }}
-  {{- with .Values.service.publishNotReadyAddresses }}
-  publishNotReadyAddresses: {{ . }}
-  {{- end }}
-  selector: {{- include "base.selectorLabels" . | nindent 4 }}
-  {{- with .Values.service.sessionAffinity }}
-  sessionAffinity: {{ . }}
-  {{- end }}
-  {{- with .Values.service.sessionAffinityConfig }}
-  sessionAffinityConfig: {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.service.topologyKeys }}
-  topologyKeys: {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with .Values.service.type}}
-  type: {{ . }}
-  {{- end }}
+{{- include "base.service" (dict "context" . "name" (include "base.fullname" .)) }}
 {{- end }}