[DND-1418] Upgrade Default S3Proxy to 3.x (appVersion 2.7.0 -> 3.3.0)

.github/workflows/functional-test.yaml

@@ -71,6 +71,11 @@ jobs:
         with:
           version: v3.19.2
 
+      - name: Build chart dependencies
+        # comet-common is not vendored in-repo; resolve it from Chart.lock
+        # (anonymous OCI pull, no auth needed).
+        run: helm dependency build charts/s3proxy
+
       - name: Create kind cluster
         uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
 

.github/workflows/helm-diff.yaml

@@ -48,6 +48,18 @@ jobs:
         with:
           version: v3.19.2
 
+      - name: Build chart dependencies
+        # comet-common is not vendored in-repo; resolve it from Chart.lock on each
+        # side that has one (base may predate the dependency), before rendering.
+        run: |
+          for dir in base-repo pr-repo
+          do
+            if [ -f "${dir}/${CHART_PATH}/Chart.lock" ]
+            then
+              helm dependency build "${dir}/${CHART_PATH}"
+            fi
+          done
+
       - name: Render and diff
         run: |
           set -uo pipefail

.github/workflows/lint-render.yaml

@@ -45,6 +45,11 @@ jobs:
         with:
           version: v3.19.2
 
+      - name: Build chart dependencies
+        # comet-common is not vendored in-repo; resolve it from Chart.lock
+        # (anonymous OCI pull, no auth needed).
+        run: helm dependency build charts/s3proxy
+
       - name: Helm lint
         run: helm lint charts/s3proxy --values "${{ matrix.values }}"
 

.github/workflows/release.yaml

@@ -81,6 +81,16 @@ jobs:
         run: |
           cp README.md charts/s3proxy/
 
+      - name: Set up Helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        with:
+          version: v3.19.2
+
+      - name: Build chart dependencies
+        # comet-common is not vendored in-repo; resolve it from Chart.lock
+        # (anonymous OCI pull) so chart-releaser can package the chart.
+        run: helm dependency build charts/s3proxy
+
       - name: Run chart-releaser
         uses: bitdeps/helm-oci-charts-releaser@v0.1.3
         with:

.gitignore

@@ -0,0 +1,3 @@
+# Vendored Helm chart dependencies. Not checked in; resolved from Chart.lock via
+# `helm dependency build` (CI does this before lint/template/install/package).
+charts/s3proxy/charts/

charts/s3proxy/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: comet-common
+  repository: oci://ghcr.io/comet-ml
+  version: 0.3.0
+digest: sha256:8dfb72314d8825e0fecef7d194fef49be3946cb04537924c56a6921222fc9593
+generated: "2026-07-21T15:17:18.631137876+02:00"

charts/s3proxy/Chart.yaml

@@ -15,10 +15,20 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.1.0
+version: 0.2.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "2.7.0"
+appVersion: "3.3.0"
+
+# comet-common is a library chart of shared helpers (names, labels, images, ...)
+# used across Comet charts. The resolved dependency (charts/*.tgz) is git-ignored,
+# not checked in; Chart.lock pins the version/digest and CI runs
+# `helm dependency build` (anonymous OCI pull, no auth) before lint/template/
+# install/package.
+dependencies:
+  - name: comet-common
+    version: "0.3.0"
+    repository: "oci://ghcr.io/comet-ml"

charts/s3proxy/README.md.gotmpl

@@ -19,6 +19,23 @@
 - Helm 3.2.0+
 - PV provisioner support in the underlying infrastructure (if using filesystem backend with persistence)
 
+## S3Proxy version compatibility
+
+The chart tracks S3Proxy (`andrewgaul/s3proxy`) through `appVersion` (currently `{{ template "chart.appVersion" . }}`); override it with `image.tag`. Minimum supported version is `2.7.0`.
+
+S3Proxy `3.0.0` deprecated the Apache jclouds storage backends (`s3`, `aws-s3`, `azureblob`, `filesystem`, `transient`) in favor of SDK / NIO2 providers. Upstream has announced that `3.3.0` is the last release to bundle jclouds and that future releases "will lack its Atmos and B2 storage backends" (no jclouds-free release has shipped yet; `3.3.0` remains the latest). The jclouds providers still work on 3.x, but are deprecated:
+
+- `filesystem` / `transient`: already default to the non-deprecated `*-nio2` variants (`nio2: true`).
+- `azureblob`: **defaults to `provider: azureblob-sdk`** (the Azure SDK provider, which signs correctly against custom endpoints such as Azurite). The legacy jclouds `azureblob` provider is deprecated and mis-signs against custom endpoints; set `provider: azureblob` only if you specifically need it. On real Azure, `azureblob-sdk` may require `config.backends.azureblob.regions` for bucket creation.
+- `s3`, `googleCloudStorage`, `openstackSwift`: SDK providers exist upstream (`aws-s3-sdk`, `google-cloud-storage-sdk`, `openstack-swift-sdk`). `rackspaceCloudfiles` is OpenStack-Swift-compatible and may be served by `openstack-swift-sdk`. Migrating the chart defaults to the SDK providers is tracked separately.
+- `b2` (and Atmos, if ever added) are jclouds-only with **no SDK successor**. These are the backends upstream has said future releases will drop.
+
+### Our compatibility plan
+
+- **Through S3Proxy `3.3.0` (chart `0.x`):** all current backends, including the jclouds-only `b2`, are supported. This is where the chart sits today.
+- **Guardrail:** the chart **hard-fails at render time** if `b2` (or `atmos`) is enabled while the effective S3Proxy version (`image.tag`, else `appVersion`) is greater than `3.3.0`, so an upgrade past the jclouds sunset cannot silently ship a broken backend. Pin `image.tag` to `3.3.0` or earlier, or disable the backend.
+- **When S3Proxy ships its first jclouds-free release:** the chart moves to `1.x.x` (major bump), migrates the remaining backends to their SDK providers, and drops `b2`/`atmos`. Tracked in the SDK-migration follow-up.
+
 ## Installation
 
 ### Install the chart

charts/s3proxy/templates/NOTES.txt

@@ -6,16 +6,16 @@
     {{- end }}
   {{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "s3proxy.fullname" . }})
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "comet-common.names.fullname" . }})
   export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
   echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
      NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "s3proxy.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "s3proxy.fullname" . }} --template "{{ "{{" }} range (index .status.loadBalancer.ingress 0) {{ "}}" }}{{ "{{" }}.{{ "}}" }}{{ "{{" }} end {{ "}}" }}")
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "comet-common.names.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "comet-common.names.fullname" . }} --template "{{ "{{" }} range (index .status.loadBalancer.ingress 0) {{ "}}" }}{{ "{{" }}.{{ "}}" }}{{ "{{" }} end {{ "}}" }}")
   echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "s3proxy.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "comet-common.names.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
   export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
   echo "Visit http://127.0.0.1:8080 to use your application"
   kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
@@ -100,7 +100,7 @@
 
 4. Monitoring:
    To check the logs:
-   kubectl logs -n {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "s3proxy.name" . }},app.kubernetes.io/instance={{ .Release.Name }}"
+   kubectl logs -n {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "comet-common.names.name" . }},app.kubernetes.io/instance={{ .Release.Name }}"
 
 5. Important Notes:
 {{- if .Values.config.backends.filesystem.enabled }}

charts/s3proxy/templates/_helpers.tpl

@@ -1,62 +1,20 @@
 {{- /*
-Expand the name of the chart.
-*/}}
-{{- define "s3proxy.name" -}}
-  {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{- /*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "s3proxy.fullname" -}}
-  {{- if .Values.fullnameOverride }}
-    {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-  {{- else }}
-    {{- $name := default .Chart.Name .Values.nameOverride }}
-    {{- if contains $name .Release.Name }}
-      {{- .Release.Name | trunc 63 | trimSuffix "-" }}
-    {{- else }}
-      {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-    {{- end }}
-  {{- end }}
-{{- end }}
-
-{{- /*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "s3proxy.chart" -}}
-  {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
+This chart uses the comet-common library chart
+(https://github.com/comet-ml/common-helm-chart) directly for naming, labels, and
+image rendering: call sites use comet-common.names.*, comet-common.labels.base,
+and comet-common.images.image. Only s3proxy-specific helpers live in this file.
 
-{{- /*
-Common labels
+s3proxy.selectorLabels is kept local rather than using comet-common.selectorLabels:
+the latter adds app.kubernetes.io/component, and a Deployment's
+spec.selector.matchLabels is immutable, so adopting it would break `helm upgrade`
+on existing releases.
 */}}
-{{- define "s3proxy.labels" -}}
-helm.sh/chart: {{ include "s3proxy.chart" . }}
-{{ include "s3proxy.selectorLabels" . }}
-  {{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-  {{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
 
 {{- /*
-Selector labels
+Selector labels. The immutable Deployment selector stays {name, instance}; the
+name value is sourced from comet-common for consistency.
 */}}
 {{- define "s3proxy.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "s3proxy.name" . }}
+app.kubernetes.io/name: {{ include "comet-common.names.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
-
-{{- /*
-Create the name of the service account to use
-*/}}
-{{- define "s3proxy.serviceAccountName" -}}
-  {{- if .Values.serviceAccount.create }}
-    {{- default (include "s3proxy.fullname" .) .Values.serviceAccount.name }}
-  {{- else }}
-    {{- default "default" .Values.serviceAccount.name }}
-  {{- end }}
-{{- end }}

charts/s3proxy/templates/configmap.yaml

@@ -60,12 +60,31 @@ s3proxy.sharded-blobstore.levels=2
 s3proxy.large-object-mocking=true
   {{- end }}
 {{- end }}
+{{- /*
+  Guardrail (DND-1418): the jclouds-only backends below have no SDK successor, and
+  upstream has announced they are dropped after S3Proxy 3.3.0. Fail the render if
+  one is enabled while the effective S3Proxy version (image.tag, else appVersion)
+  parses as semver and is greater than 3.3.0, so upgrading past the jclouds sunset
+  cannot silently ship a broken backend. Non-semver tags (master, sha-*) are not
+  version-checked. When S3Proxy ships a jclouds-free release the chart moves to
+  1.x.x and migrates/removes these backends.
+*/}}
+{{- $s3pVersion := .Values.image.tag | default .Chart.AppVersion -}}
+{{- if regexMatch "^v?[0-9]+\\.[0-9]+\\.[0-9]+" $s3pVersion }}
+  {{- if semverCompare "> 3.3.0" (trimPrefix "v" $s3pVersion) }}
+    {{- range $backend := list "b2" "atmos" }}
+      {{- if dig $backend "enabled" false $.Values.config.backends }}
+        {{- fail (printf "config.backends.%s is enabled, but the %q S3Proxy backend relies on Apache jclouds, which is dropped after 3.3.0 (resolved image version %s). Pin image.tag to 3.3.0 or earlier, or disable config.backends.%s. See the chart README 'S3Proxy version compatibility' notes." $backend $backend $s3pVersion $backend) }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{- end }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "s3proxy.fullname" . }}
+  name: {{ include "comet-common.names.fullname" . }}
   labels:
-    {{- include "s3proxy.labels" . | nindent 4 }}
+    {{- include "comet-common.labels.base" . | nindent 4 }}
 data:
 {{- if .Values.config.backends.filesystem.enabled }}
   backend-filesystem.properties: |-

charts/s3proxy/templates/deployment.yaml

@@ -1,9 +1,9 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "s3proxy.fullname" . }}
+  name: {{ include "comet-common.names.fullname" . }}
   labels:
-    {{- include "s3proxy.labels" . | nindent 4 }}
+    {{- include "comet-common.labels.base" . | nindent 4 }}
 spec:
 {{- if not .Values.autoscaling.enabled }}
   replicas: {{ .Values.replicaCount }}
@@ -29,14 +29,14 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
 {{- end }}
-      serviceAccountName: {{ include "s3proxy.serviceAccountName" . }}
+      serviceAccountName: {{ include "comet-common.names.serviceAccount" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       initContainers:
         - name: merge-configs
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.configMergeImage.repository }}:{{ .Values.configMergeImage.tag }}"
+          image: {{ include "comet-common.images.image" (dict "imageRoot" .Values.configMergeImage "chart" .Chart) | quote }}
           imagePullPolicy: {{ .Values.configMergeImage.pullPolicy }}
           command: ["sh", "-c"]
           args:
@@ -98,7 +98,7 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          image: {{ include "comet-common.images.image" (dict "imageRoot" .Values.image "chart" .Chart) | quote }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           command:
             - java
@@ -186,17 +186,17 @@ spec:
       volumes:
         - name: config
           configMap:
-            name: {{ include "s3proxy.fullname" . }}
+            name: {{ include "comet-common.names.fullname" . }}
         - name: secret-config
           secret:
-            secretName: {{ include "s3proxy.fullname" . }}
+            secretName: {{ include "comet-common.names.fullname" . }}
         - name: merged-config
           emptyDir: {}
 {{- if .Values.config.backends.filesystem.enabled }}
   {{- if .Values.persistence.enabled }}
         - name: data
           persistentVolumeClaim:
-            claimName: {{ .Values.persistence.existingClaim | default (include "s3proxy.fullname" .) }}
+            claimName: {{ .Values.persistence.existingClaim | default (include "comet-common.names.fullname" .) }}
   {{- end }}
 {{- end }}
 {{- if and .Values.config.backends.googleCloudStorage.enabled .Values.config.backends.googleCloudStorage.privateKey.existingSecret }}

charts/s3proxy/templates/hpa.yaml

@@ -2,14 +2,14 @@
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
-  name: {{ include "s3proxy.fullname" . }}
+  name: {{ include "comet-common.names.fullname" . }}
   labels:
-    {{- include "s3proxy.labels" . | nindent 4 }}
+    {{- include "comet-common.labels.base" . | nindent 4 }}
 spec:
   scaleTargetRef:
     apiVersion: apps/v1
     kind: Deployment
-    name: {{ include "s3proxy.fullname" . }}
+    name: {{ include "comet-common.names.fullname" . }}
   minReplicas: {{ .Values.autoscaling.minReplicas }}
   maxReplicas: {{ .Values.autoscaling.maxReplicas }}
   metrics:

charts/s3proxy/templates/ingress.yaml

@@ -1,5 +1,5 @@
 {{- if .Values.ingress.enabled -}}
-  {{- $fullName := include "s3proxy.fullname" . -}}
+  {{- $fullName := include "comet-common.names.fullname" . -}}
   {{- $svcPort := .Values.service.port -}}
   {{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
     {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
@@ -17,7 +17,7 @@ kind: Ingress
 metadata:
   name: {{ $fullName }}
   labels:
-    {{- include "s3proxy.labels" . | nindent 4 }}
+    {{- include "comet-common.labels.base" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/s3proxy/templates/pvc.yaml

@@ -2,9 +2,9 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ include "s3proxy.fullname" . }}
+  name: {{ include "comet-common.names.fullname" . }}
   labels:
-    {{- include "s3proxy.labels" . | nindent 4 }}
+    {{- include "comet-common.labels.base" . | nindent 4 }}
   {{- with .Values.persistence.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/s3proxy/templates/secret.yaml

@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "s3proxy.fullname" . }}
+  name: {{ include "comet-common.names.fullname" . }}
   labels:
-    {{- include "s3proxy.labels" . | nindent 4 }}
+    {{- include "comet-common.labels.base" . | nindent 4 }}
 type: Opaque
 stringData:
   # Sensitive properties merged into the backend properties files by the

charts/s3proxy/templates/service.yaml

@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "s3proxy.fullname" . }}
+  name: {{ include "comet-common.names.fullname" . }}
   labels:
-    {{- include "s3proxy.labels" . | nindent 4 }}
+    {{- include "comet-common.labels.base" . | nindent 4 }}
 {{- with .Values.service.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/s3proxy/templates/serviceaccount.yaml

@@ -2,9 +2,9 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "s3proxy.serviceAccountName" . }}
+  name: {{ include "comet-common.names.serviceAccount" . }}
   labels:
-    {{- include "s3proxy.labels" . | nindent 4 }}
+    {{- include "comet-common.labels.base" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}