proxysql

ProxySQL

Chainguard's redistribution of the ProxySQL Helm chart, pre-configured with hardened Chainguard Images.

Prerequisites

Authentication is required. First, authenticate with Chainguard:

chainctl auth login
chainctl auth configure-docker --pull-token --save
helm registry login cgr.dev

Create the namespace and an image pull secret in it:

kubectl create namespace proxysql --dry-run=client -o yaml | kubectl apply -f -

kubectl create secret docker-registry cgr-pull-secret \
  --docker-server=cgr.dev \
  --docker-username="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Username')" \
  --docker-password="$(echo cgr.dev | docker-credential-cgr get | jq -r '.Secret')" \
  --namespace proxysql

Installation

helm install proxysql oci://cgr.dev/ORGANIZATION/charts/proxysql \
  --namespace proxysql \
  --create-namespace \
  --set imagePullSecrets[0].name=cgr-pull-secret

About This Chart

This is a redistribution of the upstream Dysnix ProxySQL Helm chart. All upstream configuration options apply.

The chart is pre-configured to run ProxySQL as the nonroot user (UID/GID 65532) used by the Chainguard image, which owns the /var/lib/proxysql data directory. The upstream default of 999 cannot write to that directory, so keep the provided podSecurityContext unless you also adjust the data directory ownership.

For full documentation, see: https://github.com/dysnix/charts/tree/main/dysnix/proxysql