feat: expose UDS Core config as native Zarf values by briantwatson · Pull Request #2762 · defenseunicorns/uds-core

briantwatson · 2026-06-23T14:42:21Z

Description

This PR adds native Zarf values support to UDS Core packages, allowing users to deploy and customize packages with zarf package deploy --values without requiring a UDS bundle.

Existing Variable Compatibility

Existing Zarf variable workflows remain supported and unchanged.
Variables such as DOMAIN and ADMIN_DOMAIN continue to use tokens such as ###ZARF_VAR_DOMAIN###.
Values are resolved before Helm rendering and take precedence over variables when explicitly provided.
When values are not supplied, existing variable defaults and fallback behavior continue to apply.

Zarf Values

Adds package-level zarf-values.yaml files for values-enabled package layers.
Adds source package values files and chart mappings.
Uses broad chart pass-through mappings so users can override supported chart configuration without needing package-specific wiring for every value.
Keeps package-facing values separate from underlying chart paths.
Supports top-level domain and adminDomain configuration across applicable charts.
Admin-domain precedence is:
1. Explicit adminDomain value
2. ADMIN_DOMAIN variable
3. admin.<domain>
Portal uses its existing chart and does not require a Portal chart update.

Protected Configuration

Adds excludePaths to prevent user overrides of deployment-controlled settings.
Protected settings include image references, registries, security contexts, selected service configuration, and other package-managed values.

Schema Generation

Adds generated package-facing schemas at packages/*/zarf-values.schema.json.
Adds a task to regenerate schemas from the package definitions:
```
uds run -f tasks/lint.yaml values-generate
```

Linting and Verification

Adds values linting to detect mapping and schema regressions.
Adds values verification to render packages and assert that:
- Overrides reach their intended charts.
- Excluded values are not rendered.
- Domain and admin-domain precedence works as expected.
Adds values-deployment equivalency testing to the CI matrix.

Relevant checks include:

uds run -f tasks/lint.yaml values-lint
uds run -f tasks/lint.yaml values-verify
uds run test:uds-core-values-e2e --set FLAVOR=upstream

Compatibility Note

Deployments using native Zarf values require Zarf v0.79.0 or newer because of the package pull behavior fix for values files and schemas.

Related Issue

Fixes CORE-57

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Other (security config, docs update, etc)

Steps to Validate

Ran uds run lint:values-lint — all 5 packages lint clean
Verified --features values=true flag behavior against Zarf source code and live testing
Confirmed deep-merge semantics and {} no-op on a live k3d cluster with a podinfo probe package
Confirmed must-exist rule hard-fails at deploy (not create)
Confirmed list replace behavior (backends key in podinfo)
Confirmed excludePaths are source-rooted (validated against Zarf test source)

Checklist before merging

Test, docs, adr added or updated as needed
Contributor Guide followed

greptile-apps · 2026-06-23T14:56:18Z

Greptile Summary

This PR adds native Zarf values support across all UDS Core source packages, enabling zarf package deploy --values without requiring a UDS bundle. It introduces zarf-values.yaml defaults, values: chart mappings with excludePaths for protected settings, schema generation and validation, and a complete vitest-based verification harness.

Domain/adminDomain precedence is implemented consistently via Zarf Go templates across all affected charts (pepr, keycloak, istio gateways, grafana, portal), replacing the previous ###ZARF_VAR_*### two-step pattern.
Protected chart settings (images, registries, security contexts) are blocked via excludePaths, with vitest specs asserting SHOULD_NOT_APPEAR strings are absent from rendered manifests.
CI integration adds a values-type matrix entry running a full cluster equivalency test and a schema-drift autogenerated-check.

Confidence Score: 5/5

Safe to merge — three-tier domain/adminDomain precedence is consistently implemented and verified; backward compatibility with existing variable-based deployments is preserved.

Domain-precedence logic is uniformly applied and verified by five domain scenarios in vitest specs. Protected settings are blocked via excludePaths and tested with SHOULD_NOT_APPEAR probes. Full equivalency CI job closes the loop with a live cluster deploy. The two flagged items are style and robustness suggestions with no impact on correctness.

src/grafana/values/values.yaml — the four grafana.ini fields use a bespoke four-branch conditional that diverges from the canonical pattern used everywhere else.

Important Files Changed

Filename	Overview
src/pepr/uds-operator-config/values.yaml	Migrated from ###ZARF_VAR_*### tokens to Zarf Go template expressions; domain/adminDomain implement the full precedence chain.
src/pepr/uds-operator-config/templates/clusterconfig.yaml	Adds legacy token guard for adminDomain and boolean-safe pipeline for allowAllNsExemptions.
src/istio/charts/uds-istio-config/templates/gateway.yaml	Admin gateway domain logic reads adminDomain first and falls back to admin. correctly.
src/istio/values/config-admin.yaml	Replaced Helm-evaluated token expression with Zarf-resolved domain + adminDomain pair.
src/grafana/values/values.yaml	Now a templatedValuesFile; top-level values use canonical pattern but grafana.ini entries use a divergent four-branch conditional with dead ###ZARF_VAR_*### guard.
test/values/helpers.ts	New test harness with manifest rendering and caching; YAML override files generated via JSON.stringify which is fragile for strings containing newlines.
src/keycloak/chart/templates/statefulset.yaml	UDS_ADMIN_DOMAIN now uses the same adminDomain fallback logic as gateway and pepr changes.
tasks/lint.yaml	Adds values-lint, values-generate, and build-pepr tasks integrated into the main lint flow.
tasks/test.yaml	Adds uds-core-values-e2e task for full cluster equivalency testing.
.github/workflows/pull-request-conditionals.yaml	Adds values test_type matrix entry to trigger the new values E2E test in CI.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["zarf package deploy --values"] --> B["Zarf values merge"]
    B --> C{".Values.domain set?"}
    C -- yes --> D["domain = .Values.domain"]
    C -- no --> E["domain = .Variables.DOMAIN"]
    D & E --> F{".Values.adminDomain set?"}
    F -- yes --> G["adminDomain = .Values.adminDomain"]
    F -- no --> H{".Variables.ADMIN_DOMAIN set?"}
    H -- yes --> I["adminDomain = .Variables.ADMIN_DOMAIN"]
    H -- no --> J["adminDomain = admin.<domain>"]
    G & I & J --> K["Zarf resolves templatedValuesFiles"]
    K --> L["Helm renders charts"]
    L --> M{"excludePaths filter"}
    M --> N["Final Kubernetes manifests"]

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["zarf package deploy --values"] --> B["Zarf values merge"]
    B --> C{".Values.domain set?"}
    C -- yes --> D["domain = .Values.domain"]
    C -- no --> E["domain = .Variables.DOMAIN"]
    D & E --> F{".Values.adminDomain set?"}
    F -- yes --> G["adminDomain = .Values.adminDomain"]
    F -- no --> H{".Variables.ADMIN_DOMAIN set?"}
    H -- yes --> I["adminDomain = .Variables.ADMIN_DOMAIN"]
    H -- no --> J["adminDomain = admin.<domain>"]
    G & I & J --> K["Zarf resolves templatedValuesFiles"]
    K --> L["Helm renders charts"]
    L --> M{"excludePaths filter"}
    M --> N["Final Kubernetes manifests"]

_{Reviews (6): Last reviewed commit: "chore: helm unit test fix" | Re-trigger Greptile}

briantwatson · 2026-06-23T16:09:51Z

@greptile review

slaskawi · 2026-06-23T18:33:07Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 673eb8452a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Racer159 · 2026-07-02T15:50:38Z

The other thing I will call out for the release is that there are some borked versions of Zarf that might cause issues with this if people have not updated UDS CLI / Zarf - the pull: always pull values.yaml and values.schema.json is what fixes this in v0.79.0 but this may lock UDS Core to that version+ for some use cases...

(v0.63.0 - pre-values works fine)

(v0.64.0 - post-values introduction does not work on pull/deploy)

(v0.78.0 - before the fix also does not work)

(v0.79.0 - now works and is fixed)

so basically Zarf versions between 0.64.0 and 0.78.0 will be 💀 with this change...

github-actions

Lula Compliance Overview

Please review the changes to ensure they meet compliance standards.

Reviewed Changes

Lula reviewed 30 files changed that affect compliance.

File	Lines Changed
`.github/workflows/pull-request-conditionals.yaml`	`154–189`

UUID: 11948466-9230-4498-be44-dbac784d86d1
sha256: 7e9888ac82452d1c09bb3511aa1785c1622a476191a2fcb1148068c4110c71af

_{Tip: Customize your compliance reviews with Lula.}

briantwatson · 2026-07-09T13:32:17Z

Summary since first review

Major refactor: reworked the chart value mappings from enumerating a handful of keys to a broad pass-through per chart (sourcePath: .<chart>, targetPath: .) with excludePaths negative logic to block what should not be set (image refs, security contexts, Service wiring, Loki deployment mode, Grafana sidecar, SSO wiring, etc.). Upstream charts are now fully overridable except the guarded paths.
Converted the standalone values-verify diff check into a real values-deploy equivalency e2e wired into CI (values test type); excluded velero (storage not values-exposed, see below).
Following feedback: added egressCidr for external Postgres (Keycloak, Grafana); fixed authservice.replicaCount schema (minimum: 0 to 1); exposed Falco / runtime-security values that were missing; doc accuracy fixes (exposed vs excluded paths, top-level domain, no em-dashes).
Added a single top-level domain value that fans out to Keycloak, the Istio tenant and passthrough gateways, the Pepr operator, and the portal. Scoped adminDomain value out (deferred, see below).
Keycloak chart: moved the admin.<domain> fallback from the value into its consumers so it stays overridable (helm unittest added).

Follow-ups (deferred)

Top-level adminDomain value: not included. Admin domains (admin gateway, Grafana, Keycloak admin console) stay driven by the DOMAIN/ADMIN_DOMAIN Zarf variables. Reason: admin charts derive admin.<domain> in-template, but a value-fed adminDomain arrives as the literal ###ZARF_VAR_ADMIN_DOMAIN### placeholder at Helm-render time (Zarf substitutes it only afterward), so the in-template fallback never fires. A future fix (operator-fed or pre-render derivation) should be verified on a real non-default-domain deploy, which the current k3d CI cannot do since it only has certs/DNS for *.uds.dev.
Velero storage: its BackupStorageLocation (bucket/prefix) is not in the values surface; it stays on Zarf variables + bundle overrides. Excluded from the values e2e validation only (bundle e2e still fully validates it). Resolve in follow-up by exposing velero storage via values.

Superseded by a new Lula compliance review.

github-actions

Lula Compliance Overview

Please review the changes to ensure they meet compliance standards.

Reviewed Changes

Lula reviewed 30 files changed that affect compliance.

File	Lines Changed
`.github/workflows/pull-request-conditionals.yaml`	`154–189`

UUID: 11948466-9230-4498-be44-dbac784d86d1
sha256: 7e9888ac82452d1c09bb3511aa1785c1622a476191a2fcb1148068c4110c71af

_{Tip: Customize your compliance reviews with Lula.}

joelmccoy · 2026-07-17T15:25:01Z

@greptileai review

joelmccoy

LGTM. I know you are refactoring a bit more, so will hold off on official approval

chance-coleman

🚀 This is awesome, great work!

Superseded by a new Lula compliance review.

github-actions

Lula Compliance Overview

Please review the changes to ensure they meet compliance standards.

Reviewed Changes

Lula reviewed 30 files changed that affect compliance.

File	Lines Changed
`.github/workflows/pull-request-conditionals.yaml`	`154–189`

UUID: 11948466-9230-4498-be44-dbac784d86d1
sha256: 7e9888ac82452d1c09bb3511aa1785c1622a476191a2fcb1148068c4110c71af

_{Tip: Customize your compliance reviews with Lula.}

Superseded by a new Lula compliance review.

github-actions

Lula Compliance Overview

Please review the changes to ensure they meet compliance standards.

Reviewed Changes

Lula reviewed 30 files changed that affect compliance.

File	Lines Changed
`.github/workflows/pull-request-conditionals.yaml`	`154–189`

UUID: 11948466-9230-4498-be44-dbac784d86d1
sha256: 7e9888ac82452d1c09bb3511aa1785c1622a476191a2fcb1148068c4110c71af

_{Tip: Customize your compliance reviews with Lula.}

Superseded by a new Lula compliance review.

github-actions

Lula Compliance Overview

Please review the changes to ensure they meet compliance standards.

Reviewed Changes

Lula reviewed 30 files changed that affect compliance.

File	Lines Changed
`.github/workflows/pull-request-conditionals.yaml`	`154–189`

UUID: 11948466-9230-4498-be44-dbac784d86d1
sha256: 7e9888ac82452d1c09bb3511aa1785c1622a476191a2fcb1148068c4110c71af

_{Tip: Customize your compliance reviews with Lula.}

briantwatson · 2026-07-17T16:22:56Z

@greptile review

Superseded by a new Lula compliance review.

github-actions

Lula Compliance Overview

Please review the changes to ensure they meet compliance standards.

Reviewed Changes

Lula reviewed 30 files changed that affect compliance.

File	Lines Changed
`.github/workflows/pull-request-conditionals.yaml`	`154–189`

UUID: 11948466-9230-4498-be44-dbac784d86d1
sha256: 7e9888ac82452d1c09bb3511aa1785c1622a476191a2fcb1148068c4110c71af

_{Tip: Customize your compliance reviews with Lula.}

n/a

feat: zarf values

d5d8c29

briantwatson requested a review from a team as a code owner June 23, 2026 14:42

greptile-apps Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread docs/reference/configuration/zarf-values.mdx Outdated

Comment thread docs/reference/configuration/zarf-values.mdx Outdated

Comment thread packages/identity-authorization/zarf-values.yaml Outdated

Comment thread packages/standard/zarf-values.yaml Outdated

chore: pr feedback

673eb84

chatgpt-codex-connector Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread packages/base/zarf.yaml

chance-coleman reviewed Jun 24, 2026

View reviewed changes

Comment thread packages/identity-authorization/zarf-values.schema.json Outdated

joelmccoy reviewed Jun 24, 2026

View reviewed changes

Comment thread src/loki/common/zarf.yaml

joelmccoy reviewed Jun 24, 2026

View reviewed changes

Comment thread tasks/values-verify.yaml Outdated

joelmccoy reviewed Jun 24, 2026

View reviewed changes

Comment thread packages/standard/zarf-values.yaml Outdated

briantwatson added 2 commits July 2, 2026 14:11

chore: pr feedback - pass-through value mappings and dev deploy fixes

63aedcd

chore: move standalone values-verify into CI

aced364

chance-coleman reviewed Jul 8, 2026

View reviewed changes

Comment thread packages/identity-authorization/zarf-values.schema.json

briantwatson added 9 commits July 8, 2026 15:18

Merge branch 'main' into feat/core-57-zarf-values

83a4227

chore: finalize zarf values feature (falco, egressCidr, domain, docs)

cf2a566

chore: fixing bad merge

e4c6fd0

feat: top-level domain via zarf values

7f0a044

fix: scope top-level domain value to tenant tier; exclude velero

0ac059e

chore: final review

f7945bf

chore: remove fanout check from final solution

7074bcb

chore: simplifying comments

3d06ed5

chore: collapsing zarf-values

4c3ce50

github-actions Bot previously requested changes Jul 9, 2026

View reviewed changes

briantwatson commented Jul 9, 2026

View reviewed changes

Comment thread src/keycloak/chart/values.yaml

briantwatson commented Jul 9, 2026

View reviewed changes

Comment thread src/keycloak/chart/templates/statefulset.yaml Outdated

briantwatson commented Jul 9, 2026

View reviewed changes

Comment thread src/keycloak/common/zarf.yaml Outdated

briantwatson added 2 commits July 17, 2026 09:33

chore: update schema

a9f5a58

chore: improved messaging on autogenerated-check step

b1136ee

github-actions Bot previously requested changes Jul 17, 2026

View reviewed changes

joelmccoy reviewed Jul 17, 2026

View reviewed changes

Comment thread tasks/test.yaml Outdated

joelmccoy reviewed Jul 17, 2026

View reviewed changes

chance-coleman previously approved these changes Jul 17, 2026

View reviewed changes

chore: refactor to empty values defaults and lean on go templating

cd73c6a

briantwatson dismissed chance-coleman’s stale review via cd73c6a July 17, 2026 15:54

briantwatson requested a review from a team as a code owner July 17, 2026 15:54

github-actions Bot previously requested changes Jul 17, 2026

View reviewed changes

chore: helm unit test fix

cbaf182

github-actions Bot previously requested changes Jul 17, 2026

View reviewed changes

briantwatson requested a review from joelmccoy July 17, 2026 16:22

joelmccoy reviewed Jul 17, 2026

View reviewed changes

Comment thread bundles/base-shim/README.md Outdated

joelmccoy reviewed Jul 17, 2026

View reviewed changes

Comment thread docs/concepts/configuration-and-packaging/package-requirements.mdx Outdated

joelmccoy reviewed Jul 17, 2026

View reviewed changes

Comment thread docs/concepts/configuration-and-packaging/package-requirements.mdx Outdated

joelmccoy previously approved these changes Jul 17, 2026

View reviewed changes

chore: pr feedback

1f17a2f

briantwatson dismissed joelmccoy’s stale review via 1f17a2f July 17, 2026 19:25

github-actions Bot previously requested changes Jul 17, 2026

View reviewed changes

chance-coleman approved these changes Jul 17, 2026

View reviewed changes

Uh oh!

Conversation

briantwatson commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Existing Variable Compatibility

Zarf Values

Protected Configuration

Schema Generation

Linting and Verification

Compatibility Note

Related Issue

Type of change

Steps to Validate

Checklist before merging

Uh oh!

greptile-apps Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

briantwatson commented Jun 23, 2026

Uh oh!

slaskawi commented Jun 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Racer159 commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Lula Compliance Overview

Reviewed Changes

Uh oh!

briantwatson commented Jul 9, 2026

Summary since first review

Follow-ups (deferred)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Lula Compliance Overview

Reviewed Changes

Uh oh!

joelmccoy commented Jul 17, 2026

Uh oh!

Uh oh!

joelmccoy left a comment

Choose a reason for hiding this comment

Uh oh!

chance-coleman left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Lula Compliance Overview

Reviewed Changes

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Lula Compliance Overview

Reviewed Changes

Uh oh!

briantwatson commented Jun 23, 2026 •

edited

Loading

greptile-apps Bot commented Jun 23, 2026 •

edited

Loading

Racer159 commented Jul 2, 2026 •

edited

Loading