dfe-infra deploys culvert as the edge VPN opt-in on the scale and scale-mesh profiles. v2.1.14 ships only the GHCR container (release has zero assets, no OCI chart repo), so dfe-infra carries its own chart against the pinned image. If the reference chart under deploy/helm/culvert were published as an OCI artifact on every release (same shape as the container), dfe-infra could pin the chart by digest instead of maintaining a second one.
Two things noticed in the reference chart while writing ours:
- it mounts culvert.yaml at /etc/vpn/profiles but never sets CULVERT_PROFILE, and scripts/lib/config.py only loads a profile when that variable names one, so the mount is never read
- its Service mixes TCP 9090 and UDP 1194 in one Service, which several cloud LB controllers refuse; splitting by family renders everywhere
Done when a release carries an OCI chart whose digest a consumer can pin, and the reference chart reads the profile it mounts.
dfe-infra deploys culvert as the edge VPN opt-in on the scale and scale-mesh profiles. v2.1.14 ships only the GHCR container (release has zero assets, no OCI chart repo), so dfe-infra carries its own chart against the pinned image. If the reference chart under deploy/helm/culvert were published as an OCI artifact on every release (same shape as the container), dfe-infra could pin the chart by digest instead of maintaining a second one.
Two things noticed in the reference chart while writing ours:
Done when a release carries an OCI chart whose digest a consumer can pin, and the reference chart reads the profile it mounts.