Add session.components for init container delivery

Change the default session image from rstudio/r-session-complete
to rstudio/workbench-session and enable session component delivery
via init containers by default. The launcher configures a
workbench-session-init container that injects Workbench session
components into session pods at startup.

- Add session.components.enabled (default true) and
  session.components.sessionInit values for init container config
- Configure rserver.conf with launcher-sessions-auto-update and
  launcher-sessions-init-container-image-{name,tag} when both
  launcher and components are enabled
- When launcher is disabled, components are silently ignored
- Set session.components.enabled=false and session.image.repository
  to rstudio/r-session-complete to restore classic behavior
- Bump chart version to 0.11.0 (breaking change)

Author: bschwedler

CLAUDE.md

@@ -48,7 +48,7 @@ charts/<chart-name>/
 ### Documentation Generation
 - READMEs are auto-generated using helm-docs from `README.md.gotmpl` templates
 - Never edit `README.md` directly - edit the `.gotmpl` template
-- CI auto-generates and commits docs back to PRs
+- Run `just docs` locally before committing — CI will reject uncommitted changes
 
 ## Critical Workflow Requirements
 

charts/rstudio-workbench/Chart.yaml

@@ -1,6 +1,6 @@
 name: rstudio-workbench
 description: Official Helm chart for Posit Workbench
-version: 0.10.12
+version: 0.11.0
 apiVersion: v2
 appVersion: 2026.01.1
 icon:

charts/rstudio-workbench/NEWS.md

@@ -1,6 +1,12 @@
 # Changelog
 
 
+## 0.11.0
+
+- **BREAKING**: Change default session image from `rstudio/r-session-complete` to `rstudio/workbench-session` and enable session component delivery via init containers by default
+- Add `session.components` values for configuring session component init containers.
+  Set `session.components.enabled: false` and `session.image.repository: rstudio/r-session-complete` to restore the previous behavior
+
 ## 0.10.12
 
 - Fix invalid JSON in default `positron-user-settings.json`

charts/rstudio-workbench/README.md

@@ -1,6 +1,6 @@
 # Posit Workbench
 
-![Version: 0.10.12](https://img.shields.io/badge/Version-0.10.12-informational?style=flat-square) ![AppVersion: 2026.01.1](https://img.shields.io/badge/AppVersion-2026.01.1-informational?style=flat-square)
+![Version: 0.11.0](https://img.shields.io/badge/Version-0.11.0-informational?style=flat-square) ![AppVersion: 2026.01.1](https://img.shields.io/badge/AppVersion-2026.01.1-informational?style=flat-square)
 
 #### _Official Helm chart for Posit Workbench_
 
@@ -24,11 +24,11 @@ To ensure a stable production deployment:
 
 ## Installing the chart
 
-To install the chart with the release name `my-release` at version 0.10.12:
+To install the chart with the release name `my-release` at version 0.11.0:
 
 ```{.bash}
 helm repo add rstudio https://helm.rstudio.com
-helm upgrade --install my-release rstudio/rstudio-workbench --version=0.10.12
+helm upgrade --install my-release rstudio/rstudio-workbench --version=0.11.0
 ```
 
 To explore other chart versions, look at:
@@ -172,6 +172,22 @@ Alternatively, database passwords may be set during `helm install` with the foll
 
 `--set config.secret.'database\.conf'.password="<YOUR_PASSWORD_HERE>"`
 
+## Session images
+
+By default, session pods use the `rstudio/workbench-session` image with an init container
+(`rstudio/workbench-session-init`) that delivers Workbench session components at pod startup.
+
+To use the classic all-in-one `r-session-complete` image instead (which bundles all components
+into a single image), disable session components and change the session image:
+
+```yaml
+session:
+  image:
+    repository: "rstudio/r-session-complete"
+  components:
+    enabled: false
+```
+
 ## General principles
 
 - In most places, we opt to pass Helm values directly into ConfigMaps. We automatically translate these into the
@@ -696,12 +712,16 @@ Use of [Sealed secrets](https://github.com/bitnami-labs/sealed-secrets) disables
 | serviceMonitor.additionalLabels | object | `{}` | additionalLabels normally includes the release name of the Prometheus Operator |
 | serviceMonitor.enabled | bool | `false` | Whether to create a ServiceMonitor CRD for use with a Prometheus Operator |
 | serviceMonitor.namespace | string | `""` | Namespace to create the ServiceMonitor in (usually the same as the one in which the Prometheus Operator is running). Defaults to the release namespace |
+| session.components | object | `{"enabled":true,"sessionInit":{"repository":"rstudio/workbench-session-init","tag":""}}` | Session component delivery via init containers. When enabled (default), the chart configures rserver.conf so the launcher injects init containers into session pods at startup. Set `enabled: false` and change `session.image.repository` to `rstudio/r-session-complete` to use the classic all-in-one session image instead. |
+| session.components.enabled | bool | `true` | Enable session component delivery via init containers. When false, no init containers are configured and session.image must be a self-contained image like r-session-complete. |
+| session.components.sessionInit.repository | string | `"rstudio/workbench-session-init"` | The repository for the session init container image |
+| session.components.sessionInit.tag | string | `""` | A tag override for the session init container. Default tag is the chart appVersion (or versionOverride) |
 | session.defaultConfigMount | bool | `true` | Whether to automatically mount the config.session configuration into session pods. If launcher.namespace is different from Release Namespace, then the chart will duplicate the session configmap in both namespaces to facilitate this |
 | session.defaultHomeMount | bool | `true` | Whether to automatically add the homeStorage PVC to the session (i.e. via the `launcher-mounts` file) |
 | session.defaultSecretMountPath | string | `"/mnt/session-secret/"` | The path to mount the sessionSecret (from `config.sessionSecret`) onto the server and session pods |
-| session.image.repository | string | `"rstudio/r-session-complete"` | The repository to use for the session image |
+| session.image.repository | string | `"rstudio/workbench-session"` | The repository to use for the session image |
 | session.image.tag | string | `""` | A tag override for the session image. Overrides the "tagPrefix" above, if set. Default tag is `{{ tagPrefix }}{{ version }}` |
-| session.image.tagPrefix | string | `"ubuntu2204-"` | A tag prefix for session images (common selections: ubuntu2204-, centos7-). Only used if tag is not defined |
+| session.image.tagPrefix | string | `"ubuntu2204-"` | A tag prefix for session images (common selections: ubuntu2204-). Only used if tag is not defined |
 | shareProcessNamespace | bool | `false` | whether to provide `shareProcessNamespace` to the pod. |
 | sharedStorage.accessModes | list | `["ReadWriteMany"]` | accessModes defined for the storage PVC (represented as YAML) |
 | sharedStorage.annotations | object | `{"helm.sh/resource-policy":"keep"}` | Define the annotations for the Persistent Volume Claim resource |

charts/rstudio-workbench/README.md.gotmpl

@@ -118,6 +118,22 @@ Alternatively, database passwords may be set during `helm install` with the foll
 
 `--set config.secret.'database\.conf'.password="<YOUR_PASSWORD_HERE>"`
 
+## Session images
+
+By default, session pods use the `rstudio/workbench-session` image with an init container
+(`rstudio/workbench-session-init`) that delivers Workbench session components at pod startup.
+
+To use the classic all-in-one `r-session-complete` image instead (which bundles all components
+into a single image), disable session components and change the session image:
+
+```yaml
+session:
+  image:
+    repository: "rstudio/r-session-complete"
+  components:
+    enabled: false
+```
+
 ## General principles
 
 - In most places, we opt to pass Helm values directly into ConfigMaps. We automatically translate these into the

charts/rstudio-workbench/templates/configmap-general.yaml

@@ -49,6 +49,12 @@
 {{- $defaultIDEServiceName := include "rstudio-workbench.fullname" . }}
 {{- $defaultIDEServiceURL := printf "http://%s.%s.svc.cluster.local:80" $defaultIDEServiceName $.Release.Namespace }}
 {{- $defaultRServerConfigValues := dict "launcher-sessions-callback-address" ($defaultIDEServiceURL) }}
+{{- if and .Values.launcher.enabled .Values.session.components.enabled }}
+  {{- $initTag := .Values.session.components.sessionInit.tag | default $defaultVersion }}
+  {{- $_ := set $defaultRServerConfigValues "launcher-sessions-auto-update" 1 }}
+  {{- $_ := set $defaultRServerConfigValues "launcher-sessions-init-container-image-name" .Values.session.components.sessionInit.repository }}
+  {{- $_ := set $defaultRServerConfigValues "launcher-sessions-init-container-image-tag" $initTag }}
+{{- end }}
 {{- $defaultRServerConfig := dict "rserver.conf" ($defaultRServerConfigValues) }}
 {{- $defaultLauncherK8sConfigValues := dict "kubernetes-namespace" (default $.Release.Namespace .Values.launcher.namespace) }}
 {{- if .Values.launcher.useTemplates }}

charts/rstudio-workbench/tests/configmap_test.yaml

@@ -0,0 +1,109 @@
+suite: Workbench ConfigMap
+templates:
+  - configmap-general.yaml
+  - configmap-prestart.yaml
+  - configmap-secret.yaml
+  - configmap-session.yaml
+tests:
+  # -- Default behavior: components enabled
+  - it: should include session-init settings by default
+    template: configmap-general.yaml
+    documentIndex: 0
+    asserts:
+      - matchRegex:
+          path: data["rserver.conf"]
+          pattern: "launcher-sessions-auto-update=1"
+      - matchRegex:
+          path: data["rserver.conf"]
+          pattern: "launcher-sessions-init-container-image-name=rstudio/workbench-session-init"
+      - matchRegex:
+          path: data["rserver.conf"]
+          pattern: "launcher-sessions-init-container-image-tag=\\d+\\.\\d+\\.\\d+"
+
+  - it: should use workbench-session as default session image
+    template: configmap-general.yaml
+    documentIndex: 0
+    asserts:
+      - matchRegex:
+          path: data["launcher.kubernetes.profiles.conf"]
+          pattern: "default-container-image=rstudio/workbench-session:"
+
+  # -- Components disabled (classic mode)
+  - it: should not include session-init settings when components are disabled
+    template: configmap-general.yaml
+    documentIndex: 0
+    set:
+      session:
+        components:
+          enabled: false
+    asserts:
+      - notMatchRegex:
+          path: data["rserver.conf"]
+          pattern: "launcher-sessions-auto-update"
+      - notMatchRegex:
+          path: data["rserver.conf"]
+          pattern: "launcher-sessions-init-container"
+
+  - it: should use r-session-complete when configured for classic mode
+    template: configmap-general.yaml
+    documentIndex: 0
+    set:
+      session:
+        image:
+          repository: "rstudio/r-session-complete"
+        components:
+          enabled: false
+    asserts:
+      - matchRegex:
+          path: data["launcher.kubernetes.profiles.conf"]
+          pattern: "default-container-image=rstudio/r-session-complete:"
+
+  # -- Custom session init container
+  - it: should use custom session init repository when overridden
+    template: configmap-general.yaml
+    documentIndex: 0
+    set:
+      session:
+        components:
+          sessionInit:
+            repository: "custom-registry/session-init"
+    asserts:
+      - matchRegex:
+          path: data["rserver.conf"]
+          pattern: "launcher-sessions-init-container-image-name=custom-registry/session-init"
+
+  - it: should use custom session init tag when overridden
+    template: configmap-general.yaml
+    documentIndex: 0
+    set:
+      session:
+        components:
+          sessionInit:
+            tag: "jammy-2025.01.0"
+    asserts:
+      - matchRegex:
+          path: data["rserver.conf"]
+          pattern: "launcher-sessions-init-container-image-tag=jammy-2025.01.0"
+
+  # -- versionOverride propagates to init container tag
+  - it: should use versionOverride for init container tag
+    template: configmap-general.yaml
+    documentIndex: 0
+    set:
+      versionOverride: "2025.06.0"
+    asserts:
+      - matchRegex:
+          path: data["rserver.conf"]
+          pattern: "launcher-sessions-init-container-image-tag=2025.06.0"
+
+  # -- Launcher disabled: components silently ignored
+  - it: should not include session-init settings when launcher is disabled
+    template: configmap-general.yaml
+    documentIndex: 0
+    set:
+      launcher:
+        enabled: false
+    asserts:
+      - notMatchRegex:
+          path: data["rserver.conf"]
+          pattern: "launcher-sessions-init-container"

charts/rstudio-workbench/values.yaml

@@ -21,12 +21,25 @@ session:
   # -- The path to mount the sessionSecret (from `config.sessionSecret`) onto the server and session pods
   defaultSecretMountPath: /mnt/session-secret/
   image:
-    # -- A tag prefix for session images (common selections: ubuntu2204-, centos7-). Only used if tag is not defined
+    # -- A tag prefix for session images (common selections: ubuntu2204-). Only used if tag is not defined
     tagPrefix: ubuntu2204-
     # -- The repository to use for the session image
-    repository: "rstudio/r-session-complete"
+    repository: "rstudio/workbench-session"
     # -- A tag override for the session image. Overrides the "tagPrefix" above, if set. Default tag is `{{ tagPrefix }}{{ version }}`
     tag: ""
+  # -- Session component delivery via init containers. When enabled (default), the chart configures
+  # rserver.conf so the launcher injects init containers into session pods at startup.
+  # Set `enabled: false` and change `session.image.repository` to `rstudio/r-session-complete`
+  # to use the classic all-in-one session image instead.
+  components:
+    # -- Enable session component delivery via init containers. When false, no init containers
+    # are configured and session.image must be a self-contained image like r-session-complete.
+    enabled: true
+    sessionInit:
+      # -- The repository for the session init container image
+      repository: "rstudio/workbench-session-init"
+      # -- A tag override for the session init container. Default tag is the chart appVersion (or versionOverride)
+      tag: ""
 
 sharedStorage:
   # -- whether to create the persistentVolumeClaim for shared storage