chore(jellyfin): Bump chart version to 1.5.0 and set appVersion to 10.10.1

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/app_release.yaml

@@ -17,12 +17,12 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
          persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
       with:
         python-version: 3.x
 

.github/workflows/docs_update.yaml

@@ -14,12 +14,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       with:
         fetch-depth: 0
 
     - name: Helm Docs GitHub Action
-      uses: losisin/helm-docs-github-action@v1.3.1
+      uses: losisin/helm-docs-github-action@57d2dc9379d9f0d5d22d2845a62c935d32cddfe2 # v1.3.3
       with:
         git-push: true
         git-commit-message: "docs(charts): :memo: write updated reademe"

.github/workflows/release.yaml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
 
@@ -28,12 +28,12 @@ jobs:
           git config --global user.email "team@jellyfin.org"
 
       - name: Install Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.6.0
+        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
         env:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
         with:

charts/jellyfin/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-appVersion: 10.9.11
+appVersion: 10.10.1
 description: Jellyfin Media Server
 name: jellyfin
-version: 1.2.0
+version: 1.5.0
 type: application
 home: https://jellyfin.org/
 icon: https://jellyfin.org/images/logo.svg

charts/jellyfin/README.md

@@ -1,6 +1,6 @@
 # jellyfin
 
-![Version: 1.1.0](https://img.shields.io/badge/Version-1.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 10.9.11](https://img.shields.io/badge/AppVersion-10.9.11-informational?style=flat-square)
+![Version: 1.4.0](https://img.shields.io/badge/Version-1.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.4.0](https://img.shields.io/badge/AppVersion-1.4.0-informational?style=flat-square)
 
 Jellyfin Media Server
 
@@ -54,8 +54,9 @@ helm install <release-name> <chart-name> -f values.yaml
 |-----|------|---------|-------------|
 | affinity | object | `{}` |  |
 | enableDLNA | bool | `false` | Setting this to true enables DLNA which requires the pod to be attached to the host network in order to be useful - this can break things like ingress to the service https://jellyfin.org/docs/general/networking/dlna.html |
-| extraContainers | object | `{}` | additional sidecar containers to run inside the pod. |
+| extraContainers | list | `[]` | additional sidecar containers to run inside the pod. |
 | extraEnvVars | list | `[]` | aditional environment variables passed to the pod |
+| extraInitContainers | list | `[]` | additional init containers to run inside the pod. |
 | extraPodAnnotations | object | `{}` | additional annotations applied to the pod |
 | extraPodLabels | object | `{}` | additional pod labels. Not used as a selector label. |
 | extraVolumeMounts | list | `[]` | Define mount points for additional volumes. |
@@ -64,26 +65,35 @@ helm install <release-name> <chart-name> -f values.yaml
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.repository | string | `"docker.io/jellyfin/jellyfin"` | Set cutom repository for jellyfin image |
 | image.tag | string | `""` | Set jellyfin version which should be required since chart is updated with new versions automatically |
+| imagePullSecrets | list | `[]` |  |
 | ingress.annotations | object | `{}` |  |
 | ingress.enabled | bool | `false` |  |
 | ingress.hosts[0] | string | `"chart-example.local"` |  |
+| ingress.labels | object | `{}` |  |
 | ingress.path | string | `"/"` |  |
 | ingress.tls | list | `[]` |  |
 | livenessProbe | object | `{"enabled":true,"initialDelaySeconds":10}` | Larger libraries may need to increase the readinessProbe and livenessProbe timeouts. Start by increasing the initialDelaySeconds. |
 | nameOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
 | persistence.config.accessMode | string | `"ReadWriteOnce"` |  |
+| persistence.config.annotations | object | `{}` | Custom annotations to be added to the PVC |
 | persistence.config.enabled | bool | `false` |  |
+| persistence.config.labels | object | `{}` | Custom labels to be added to the PVC |
 | persistence.config.size | string | `"1Gi"` |  |
 | persistence.config.storageClass | string | `"-"` | If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner. |
 | persistence.extraExistingClaimMounts | list | `[]` | Add aditional PVs/PVCs to our container. Check values.yaml to see an example. |
 | persistence.media.accessMode | string | `"ReadWriteOnce"` |  |
+| persistence.media.annotations | object | `{}` | Custom annotations to be added to the PVC |
 | persistence.media.enabled | bool | `false` |  |
+| persistence.media.labels | object | `{}` | Custom labels to be added to the PVC |
 | persistence.media.size | string | `"10Gi"` |  |
 | persistence.media.storageClass | string | `"-"` | If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner. |
+| podSecurityContext | object | `{}` | SecurityContext configuration for the Jellyfin pod |
 | readinessProbe | object | `{"enabled":true,"initialDelaySeconds":10}` | Larger libraries may need to increase the readinessProbe and livenessProbe timeouts. Start by increasing the initialDelaySeconds. |
 | replicaCount | int | `1` | Number of jellyfin replicas to start. Should be left at 1 |
 | resources | object | `{}` |  |
+| runtimeClassName | string | `nil` |  |
+| securityContext | object | `{}` | SecurityContext configuration for the Jellyfin container |
 | service.annotations | object | `{}` |  |
 | service.labels | object | `{}` |  |
 | service.loadBalancerIP | string | `nil` |  |
@@ -93,3 +103,30 @@ helm install <release-name> <chart-name> -f values.yaml
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)
+
+## Hardware acceleration
+
+Out of the box the pod does not have the necessary permissions to enable hardware acceleration (HWA) in Jellyfin.
+Adding the following Helm values should make it enable you to use hardware acceleration features.
+Some settings may need to be tweaked depending on the type of device (Intel/AMD/NVIDIA/...) and your container runtime.
+
+Please refer to the Jellyfin upstream documentation for more information about hardware acceleration: <https://jellyfin.org/docs/general/administration/hardware-acceleration/>
+
+```yaml
+securityContext:
+  capabilities:
+    add:
+      - "SYS_ADMIN"
+    drop:
+      - "ALL"
+  privileged: false
+
+extraVolumes:
+  - name: hwa
+    hostPath:
+      path: /dev/dri
+
+extraVolumeMounts:
+  - name: hwa
+    mountPath: /dev/dri
+```

charts/jellyfin/README.md.gotmpl

@@ -58,3 +58,30 @@ helm install <release-name> <chart-name> -f values.yaml
 {{ template "chart.valuesSection" . }}
 
 {{ template "helm-docs.versionFooter" . }}
+
+## Hardware acceleration
+
+Out of the box the pod does not have the necessary permissions to enable hardware acceleration (HWA) in Jellyfin.
+Adding the following Helm values should make it enable you to use hardware acceleration features.
+Some settings may need to be tweaked depending on the type of device (Intel/AMD/NVIDIA/...) and your container runtime.
+
+Please refer to the Jellyfin upstream documentation for more information about hardware acceleration: <https://jellyfin.org/docs/general/administration/hardware-acceleration/>
+
+```yaml
+securityContext:
+  capabilities:
+    add:
+      - "SYS_ADMIN"
+    drop:
+      - "ALL"
+  privileged: false
+
+extraVolumes:
+  - name: hwa
+    hostPath:
+      path: /dev/dri
+
+extraVolumeMounts:
+  - name: hwa
+    mountPath: /dev/dri
+```

charts/jellyfin/templates/config-pvc.yaml

@@ -9,6 +9,13 @@ metadata:
     helm.sh/chart: {{ include "jellyfin.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- with .Values.persistence.config.labels }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.persistence.config.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   accessModes:
     - {{ .Values.persistence.config.accessMode | quote }}

charts/jellyfin/templates/deployment.yaml

@@ -28,6 +28,10 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
     spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
     {{- if .Values.enableDLNA }}
       hostNetwork: true
     {{- end }}
@@ -35,9 +39,21 @@ spec:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+        {{ if .Values.image.command }}
+          command:
+            {{- toYaml .Values.image.command | nindent 12 }}
+        {{- end }}
+        {{ if .Values.image.args }}
+          args:
+            {{- toYaml .Values.image.args | nindent 12 }}
+        {{- end }}
         {{ if .Values.extraEnvVars }}
           env:
             {{- toYaml .Values.extraEnvVars | nindent 12 }}
+        {{- end }}
+        {{ if .Values.securityContext }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
         {{- end }}
           ports:
             - name: http
@@ -109,10 +125,16 @@ spec:
             {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
             {{- end }}
           {{- if .Values.extraContainers }}
-          {{- toYaml .Values.extraContainers | nindent 10 }}
+          {{- toYaml .Values.extraContainers | nindent 8 }}
           {{- end }}
           resources:
 {{ toYaml .Values.resources | indent 12 }}
+          terminationMessagePolicy: FallbackToLogsOnError
+          securityContext: {{- toYaml .Values.securityContext | nindent 12 }}
+  {{- if .Values.extraInitContainers }}
+      initContainers:
+      {{- toYaml .Values.extraInitContainers | nindent 10 }}
+  {{- end }}
       volumes:
       - name: config
       {{- if .Values.persistence.config.enabled }}
@@ -148,3 +170,7 @@ spec:
       tolerations:
 {{ toYaml . | indent 8 }}
     {{- end }}
+      securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
+    {{- if .Values.runtimeClassName }}
+      runtimeClassName: {{.Values.runtimeClassName}}
+    {{- end }}

charts/jellyfin/templates/ingress.yaml

@@ -1,5 +1,6 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "jellyfin.fullname" . -}}
+{{- $servicePort := .Values.service.port -}}
 {{- $ingressPath := .Values.ingress.path -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -10,6 +11,9 @@ metadata:
     helm.sh/chart: {{ include "jellyfin.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- with .Values.ingress.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 {{- with .Values.ingress.annotations }}
   annotations:
 {{ toYaml . | indent 4 }}

charts/jellyfin/templates/media-pvc.yaml

@@ -9,6 +9,13 @@ metadata:
     helm.sh/chart: {{ include "jellyfin.chart" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/managed-by: {{ .Release.Service }}
+  {{- with .Values.persistence.media.labels }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.persistence.media.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   accessModes:
     - {{ .Values.persistence.media.accessMode | quote }}

charts/jellyfin/values.yaml

@@ -1,6 +1,7 @@
 # -- Number of jellyfin replicas to start. Should be left at 1
 replicaCount: 1
 
+imagePullSecrets: []
 image:
   # -- Set cutom repository for jellyfin image
   repository: docker.io/jellyfin/jellyfin
@@ -39,6 +40,7 @@ service:
 
 ingress:
   enabled: false
+  labels: {}
   annotations: {}
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
@@ -61,6 +63,10 @@ persistence:
     # subPath: some-subpath
     accessMode: ReadWriteOnce
     size: 1Gi
+    # -- Custom labels to be added to the PVC
+    labels: {}
+    # -- Custom annotations to be added to the PVC
+    annotations: {}
   media:
     enabled: false
     # -- If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner.
@@ -71,6 +77,11 @@ persistence:
     # subPath: some-subpath
     accessMode: ReadWriteOnce
     size: 10Gi
+    # -- Custom labels to be added to the PVC
+    labels: {}
+    # -- Custom annotations to be added to the PVC
+    annotations: {}
+
   # -- Add aditional PVs/PVCs to our container. Check values.yaml to see an example.
   extraExistingClaimMounts: []
     # - name: external-mount
@@ -92,6 +103,9 @@ resources: {}
   #  cpu: 100m
   #  memory: 128Mi
 
+# Define a custom runtimeClassName for the pod, e.g. "nvidia" if you have the NVIDIA GPU Operator installed
+runtimeClassName:
+
 nodeSelector: {}
 
 tolerations: []
@@ -120,8 +134,26 @@ extraEnvVars: []
 # -- additional annotations applied to the pod
 extraPodAnnotations: {}
 
+# -- additional init containers to run inside the pod.
+extraInitContainers: []
+  
 # -- additional sidecar containers to run inside the pod.
-extraContainers: {}
+extraContainers: []
+
+# -- SecurityContext configuration for the Jellyfin pod
+podSecurityContext: {}
+# Jellyfin can be run as an unprivileged user with the following settings:
+  # runAsUser: 65534
+  # runAsGroup: 65534
+
+# -- SecurityContext configuration for the Jellyfin container
+securityContext: {}
+# For example, you might need to grant the following capabilities to enable hardware acceleration when mounting a /dev/dri device:
+  # capabilities:
+  #   add:
+  #     - "SYS_ADMIN"
+  #   drop:
+  #     - "ALL"
 
 # -- Larger libraries may need to increase the readinessProbe and livenessProbe timeouts. Start by increasing the initialDelaySeconds.
 livenessProbe: