charts/koment/README.md.gotmpl
1
{{ template "chart.header" . }}
3
{{ template "chart.typeBadge" . }}
5
This chart runs the unified authenticated koment service. It reads immutable
6
GitHub commits directly through the Git data API; it needs no checkout, volume,
7
database, migration, or application outbox.
9
```sh
10
helm install koment oci://ghcr.io/koment-dev/charts/koment \
11
--namespace koment --create-namespace \
12
--set repositories[0].remote=example/project
13
```
15
The default repository is public `koment-dev/koment`. Private reads and reviewed
16
writes use an existing Secret rather than a token in Helm values:
18
```sh
19
kubectl -n koment create secret generic koment-provider \
20
--from-file=github-token=./github-token
22
helm upgrade --install koment oci://ghcr.io/koment-dev/charts/koment \
23
--namespace koment --create-namespace \
24
--set github.existingSecret=koment-provider
25
```
27
Agent credentials are another existing Secret. The file stores SHA-256 hashes,
28
never bearer plaintext:
30
```yaml
31
version: 1
32
tokens:
33
- name: coding-agent
34
sha256: 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
35
repositories: [koment]
36
permissions: [read, write]
37
```
39
Mount it with `auth.existingSecret`. Human identity comes from an OIDC proxy;
40
set `auth.trustedProxies` to only that proxy's network. The default trusts only
41
loopback and therefore fails closed for direct cluster traffic.
43
The application port serves `/`, `/mcp`, `/livez`, and `/readyz`. Metrics use a
44
separate listener and are enabled with `metrics.enabled=true`. The chart never
45
places either secret in Pod environment variables or rendered manifests.
47
`helm test <release>` verifies liveness, readiness, and the authenticated UI
48
boundary with a digest-pinned client image. CI installs the chart into Kind
49
against the image built from the pull request before running that test.
51
{{ template "chart.valuesSection" . }}
53
{{ template "helm-docs.versionFooter" . }}