diff --git a/charts/osdfir-infrastructure/Chart.lock b/charts/osdfir-infrastructure/Chart.lock index 8ba882f8..e4f640b4 100644 --- a/charts/osdfir-infrastructure/Chart.lock +++ b/charts/osdfir-infrastructure/Chart.lock @@ -4,7 +4,7 @@ dependencies: version: 2.5.6 - name: yeti repository: file://charts/yeti - version: 2.6.0 + version: 2.7.0 - name: openrelik repository: file://charts/openrelik version: 2.4.2 @@ -14,5 +14,5 @@ dependencies: - name: hashr repository: file://charts/hashr version: 2.0.1 -digest: sha256:8fecf0dc21ff91e7e31bb3aeb8dc674dfe1626910cec03718e4cafec56889e7b -generated: "2026-08-31T14:24:01.276081487Z" +digest: sha256:d2cef67f8b863c638a70ecca2c2944b2823aefa1dba8d8cb1d47ce4d3e5972b1 +generated: "2026-08-31T20:18:14.07591851Z" diff --git a/charts/osdfir-infrastructure/Chart.yaml b/charts/osdfir-infrastructure/Chart.yaml index c816eb8e..8b5e7962 100644 --- a/charts/osdfir-infrastructure/Chart.yaml +++ b/charts/osdfir-infrastructure/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: osdfir-infrastructure -version: 2.12.0 +version: 2.13.0 description: A Helm chart for Open Source Digital Forensics Kubernetes deployments. keywords: - timesketch @@ -18,7 +18,7 @@ dependencies: - condition: global.yeti.enabled name: yeti repository: file://charts/yeti - version: 2.6.0 + version: 2.7.0 - condition: global.openrelik.enabled name: openrelik repository: file://charts/openrelik diff --git a/charts/osdfir-infrastructure/charts/yeti/Chart.yaml b/charts/osdfir-infrastructure/charts/yeti/Chart.yaml index 63047b5d..2b02f1da 100644 --- a/charts/osdfir-infrastructure/charts/yeti/Chart.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: yeti -version: 2.6.0 +version: 2.7.0 description: A Helm chart for Yeti Kubernetes deployments. keywords: - yeti diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl b/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl index 48406abb..0d3a5f91 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl +++ b/charts/osdfir-infrastructure/charts/yeti/templates/_helpers.tpl @@ -34,8 +34,8 @@ Emits a non-empty string when true, so callers test it with `if`. {{- if and (not .Values.agents.googleApiKeySecret) (ne .Values.agents.llmProvider "ollama") -}} {{- fail (printf "\n\nagents.enabled is true but agents.googleApiKeySecret is not set.\nThe Yeti Agents service reads GOOGLE_API_KEY at startup and cannot run without it.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-google-api-secret \\\n --namespace %s --from-literal=google-api-key=$GOOGLE_API_KEY\n helm upgrade ... --set agents.googleApiKeySecret=yeti-google-api-secret\n\nAlternatively set agents.llmProvider=ollama to use a local model, or\nagents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} {{- end -}} -{{- if not .Values.global.yeti.apiKeySecret -}} -{{- fail (printf "\n\nagents.enabled is true but global.yeti.apiKeySecret is not set.\nThe agents reach Yeti over its API; without these credentials they start but\nevery tool call fails.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-api-secret \\\n --namespace %s --from-literal=yeti-api=$YETI_API_KEY\n helm upgrade ... --set global.yeti.apiKeySecret=yeti-api-secret\n\nAlternatively set agents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} +{{- if not .Values.agents.yetiApiKeySecret -}} +{{- fail (printf "\n\nagents.enabled is true but agents.yetiApiKeySecret is not set.\nThe agents reach Yeti over its API; without these credentials they start but\nevery tool call fails.\n\nCreate the secret and pass its name:\n kubectl create secret generic yeti-api-secret \\\n --namespace %s --from-literal=yeti-api=$YETI_API_KEY\n helm upgrade ... --set agents.yetiApiKeySecret=yeti-api-secret\n\nAlternatively set agents.enabled=false to deploy Yeti without the agents service.\n" .Release.Namespace) -}} {{- end -}} true {{- end -}} diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml b/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml index a21bd5c8..95fc33b9 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/templates/agents-statefulset.yaml @@ -41,11 +41,11 @@ spec: {{- include "yeti.envs" . | nindent 12 }} - name: YETI_API_ROOT value: "http://{{ .Release.Name }}-yeti-api:8000" - {{- if .Values.global.yeti.apiKeySecret }} + {{- if .Values.agents.yetiApiKeySecret }} - name: YETI_API_KEY valueFrom: secretKeyRef: - name: {{ .Values.global.yeti.apiKeySecret | quote }} + name: {{ .Values.agents.yetiApiKeySecret | quote }} key: "yeti-api" {{- end }} {{- if .Values.agents.googleApiKeySecret }} diff --git a/charts/osdfir-infrastructure/charts/yeti/templates/bloomcheck-statefulset.yaml b/charts/osdfir-infrastructure/charts/yeti/templates/bloomcheck-statefulset.yaml index 32c0a720..df20a223 100644 --- a/charts/osdfir-infrastructure/charts/yeti/templates/bloomcheck-statefulset.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/templates/bloomcheck-statefulset.yaml @@ -24,7 +24,7 @@ spec: containers: - name: bloomcheck image: "{{ .Values.bloomcheck.image.repository }}:{{ .Values.bloomcheck.image.tag }}" - imagePullPolicy: {{ .Values.config.imagePullPolicy }} + imagePullPolicy: {{ .Values.bloomcheck.image.pullPolicy | default .Values.config.imagePullPolicy }} command: ["/bin/sh", "-c"] args: - | diff --git a/charts/osdfir-infrastructure/charts/yeti/values.yaml b/charts/osdfir-infrastructure/charts/yeti/values.yaml index 6093afbc..d94a6abf 100644 --- a/charts/osdfir-infrastructure/charts/yeti/values.yaml +++ b/charts/osdfir-infrastructure/charts/yeti/values.yaml @@ -163,6 +163,9 @@ bloomcheck: ## @param bloomcheck.image.tag Overrides the image tag whose default is the chart appVersion ## tag: dev + ## @param bloomcheck.image.pullPolicy + ## + pullPolicy: Always ## Yeti bloomcheck resource requests and limits ## ref: https://kubernetes.io/docs/user-guide/compute-resources/ ## @param bloomcheck.resources.limits Resource limits for the bloomcheck container @@ -185,9 +188,9 @@ bloomcheck: ## agents: ## @param agents.enabled Whether to enable Yeti Agents microservice - ## Enabling this requires agents.googleApiKeySecret (or llmProvider "ollama") - ## and global.yeti.apiKeySecret. The install fails with instructions if either - ## is missing, rather than deploying a service that cannot answer. + ## Enabling this requires a Google API key for Gemini (agents.googleApiKeySecret) + ## and Yeti API credentials (agents.yetiApiKeySecret or global.yeti.apiKeySecret). + ## The install fails with instructions if either is missing. ## enabled: false image: @@ -199,15 +202,16 @@ agents: tag: dev ## @param agents.image.pullPolicy ## - pullPolicy: IfNotPresent + pullPolicy: Always + ## @param agents.yetiApiKeySecret Existing secret containing the Yeti API key (key: "yeti-api"). + ## Defaults to global.yeti.apiKeySecret if set. + ## (e.g. kubectl create secret generic yeti-api-secret --from-literal=yeti-api=${YETI_API_KEY}) + ## + yetiApiKeySecret: "" ## @param agents.googleApiKeySecret Existing secret containing the Google API key for Gemini. ## Required when agents.llmProvider is "gemini". ## (e.g. kubectl create secret generic yeti-google-api-secret --from-literal=google-api-key=${GOOGLE_API_KEY}) ## - ## The agents workload is only deployed once it can actually run, which also - ## requires global.yeti.apiKeySecret: the agents reach Yeti over its API, and - ## without those credentials they start but every tool call fails. - ## googleApiKeySecret: "" ## @param agents.llmProvider LLM backend for the agents service ("gemini" or "ollama") ##