diff --git a/README.md b/README.md index c0b8bda9c..67f566a87 100644 --- a/README.md +++ b/README.md @@ -59,6 +59,7 @@ $ helm search bitnami - [nginx](https://github.com/bitnami/charts/tree/master/bitnami/nginx) - [nginx-ingress-controller](https://github.com/bitnami/charts/tree/master/bitnami/nginx-ingress-controller) - [NodeJS](https://github.com/bitnami/charts/tree/master/bitnami/node) +- [PyTorch](https://github.com/bitnami/charts/tree/master/bitnami/pytorch) - [TensorFlow ResNet](https://github.com/bitnami/charts/tree/master/bitnami/tensorflow-resnet) - [Tomcat](https://github.com/bitnami/charts/tree/master/bitnami/tomcat) - [WildFly](https://github.com/bitnami/charts/tree/master/bitnami/wildfly) diff --git a/bitnami/airflow/Chart.yaml b/bitnami/airflow/Chart.yaml index 5b179a92a..07739a9df 100644 --- a/bitnami/airflow/Chart.yaml +++ b/bitnami/airflow/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: airflow -version: 0.0.4 +version: 0.1.2 appVersion: 1.10.3 description: Apache Airflow is a platform to programmatically author, schedule and monitor workflows. keywords: diff --git a/bitnami/airflow/README.md b/bitnami/airflow/README.md index 1f6b443f4..eecd66d5b 100644 --- a/bitnami/airflow/README.md +++ b/bitnami/airflow/README.md @@ -51,25 +51,25 @@ The following tables lists the configurable parameters of the Kafka chart and th | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Airflow image registry | `docker.io` | | `image.repository` | Airflow image name | `bitnami/airflow` | -| `image.tag` | Airflow image tag | `{VERSION}` | +| `image.tag` | Airflow image tag | `{TAG_NAME}` | | `image.pullPolicy` | Airflow image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug values should be set | `false` | | `schedulerImage.registry` | Airflow Scheduler image registry | `docker.io` | | `schedulerImage.repository` | Airflow Scheduler image name | `bitnami/airflow-shceduler` | -| `schedulerImage.tag` | Airflow Scheduler image tag | `{VERSION}` | +| `schedulerImage.tag` | Airflow Scheduler image tag | `{TAG_NAME}` | | `schedulerImage.pullPolicy` | Airflow Scheduler image pull policy | `Always` | | `schedulerImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `schedulerImage.debug` | Specify if debug values should be set | `false` | | `workerImage.registry` | Airflow Worker image registry | `docker.io` | | `workerImage.repository` | Airflow Worker image name | `bitnami/airflow-worker` | -| `workerImage.tag` | Airflow Worker image tag | `{VERSION}` | +| `workerImage.tag` | Airflow Worker image tag | `{TAG_NAME}` | | `workerImage.pullPolicy` | Airflow Worker image pull policy | `Always` | | `workerImage.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `workerImage.debug` | Specify if debug values should be set | `false` | | `git.registry` | Git image registry | `docker.io` | | `git.repository` | Git image name | `bitnami/git` | -| `git.tag` | Git image tag | `{VERSION}` | +| `git.tag` | Git image tag | `{TAG_NAME}` | | `git.pullPolicy` | Git image pull policy | `Always` | | `git.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | @@ -79,7 +79,8 @@ The following tables lists the configurable parameters of the Kafka chart and th | `airflow.loadExamples` | Switch to load some Airflow examples | `true` | | `airflow.cloneDagFilesFromGit.enabled` | Enable in order to download DAG files from git repository. | `false` | | `airflow.cloneDagFilesFromGit.repository` | Repository where download DAG files from | `nil` | -| `airflow.cloneDagFilesFromGit.revision` | Revision from repository to checkout | `nil` | +| `airflow.cloneDagFilesFromGit.branch` | Branch from repository to checkout | `nil` | +| `airflow.cloneDagFilesFromGit.interval` | Interval to pull the repository on sidecar container | `nil` | | `airflow.baseUrl` | URL used to access to airflow web ui | `nil` | | `airflow.worker.port` | Airflow Worker port | `8793` | | `airflow.worker.replicas` | Number of Airflow Worker replicas | `2` | @@ -164,6 +165,12 @@ $ helm install --name my-release -f values.yaml bitnami/airflow > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The Bitnami Airflow chart relies on the PostgreSQL chart persistence. This means that Airflow does not persist anything. @@ -188,12 +195,12 @@ You can manually create a config map containing all your DAG files and then pass ### Option 3: Get your DAG files from a git repository -You can store all your DAG files on a GitHub repository and then clone to the Airflow pods with an initContainer. In order to do that, you can deploy airflow with the following options: +You can store all your DAG files on a GitHub repository and then clone to the Airflow pods with an initContainer. The repository will be periodically updated using a sidecar container. In order to do that, you can deploy airflow with the following options: ```console helm install --name my-release bitnami/airflow \ --set airflow.cloneDagFilesFromGit.enabled=true \ --set airflow.cloneDagFilesFromGit.repository=https://github.com/USERNAME/REPOSITORY \ - --set airflow.cloneDagFilesFromGit.revision=master - -``` \ No newline at end of file + --set airflow.cloneDagFilesFromGit.branch=master + --set airflow.cloneDagFilesFromGit.interval=60 +``` diff --git a/bitnami/airflow/templates/NOTES.txt b/bitnami/airflow/templates/NOTES.txt index 67023e306..ddc6e3e31 100644 --- a/bitnami/airflow/templates/NOTES.txt +++ b/bitnami/airflow/templates/NOTES.txt @@ -75,4 +75,7 @@ host. To configure Airflow with the URL of your service: echo User: {{ .Values.airflow.auth.username }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "airflow.fullname" . }} -o jsonpath="{.data.airflow-password}" | base64 --decode) - {{- end }} \ No newline at end of file +{{- end }} + +{{ include "airflow.validateValues" . }} +{{ include "airflow.checkRollingTags" . }} diff --git a/bitnami/airflow/templates/_helpers.tpl b/bitnami/airflow/templates/_helpers.tpl index a7aeff416..87b67bb48 100644 --- a/bitnami/airflow/templates/_helpers.tpl +++ b/bitnami/airflow/templates/_helpers.tpl @@ -146,7 +146,6 @@ Also, we can't use a single if because lazy evaluation is not an option {{- end -}} {{- end -}} - {{/* Return the proper Docker Image Registry Secret Names */}} @@ -233,4 +232,56 @@ Get the secret name {{- else -}} {{- printf "%s" (include "airflow.fullname" .) -}} {{- end -}} -{{- end -}} \ No newline at end of file +{{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "airflow.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "airflow.validateValues.cloneDagFilesFromGit.repository" .) -}} +{{- $messages := append $messages (include "airflow.validateValues.cloneDagFilesFromGit.branch" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* Validate values of Airflow - "airflow.cloneDagFilesFromGit.repository" must be provided when "airflow.cloneDagFilesFromGit.enabled" is "true" */}} +{{- define "airflow.validateValues.cloneDagFilesFromGit.repository" -}} +{{- if and .Values.airflow.cloneDagFilesFromGit.enabled (empty .Values.airflow.cloneDagFilesFromGit.repository) -}} +airflow: airflow.cloneDagFilesFromGit.repository + The repository must be provided when enabling downloading DAG files + from git repository (--set airflow.cloneDagFilesFromGit.repository="xxx") +{{- end -}} +{{- end -}} +{{/* Validate values of Airflow - "airflow.cloneDagFilesFromGit.branch" must be provided when "airflow.cloneDagFilesFromGit.enabled" is "true" */}} +{{- define "airflow.validateValues.cloneDagFilesFromGit.branch" -}} +{{- if and .Values.airflow.cloneDagFilesFromGit.enabled (empty .Values.airflow.cloneDagFilesFromGit.branch) -}} +airflow: airflow.cloneDagFilesFromGit.branch + The branch must be provided when enabling downloading DAG files + from git repository (--set airflow.cloneDagFilesFromGit.branch="xxx") +{{- end -}} +{{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "airflow.checkRollingTags" -}} +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.schedulerImage.repository) (not (.Values.schedulerImage.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.schedulerImage.repository }}:{{ .Values.schedulerImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.workerImage.repository) (not (.Values.workerImage.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.workerImage.repository }}:{{ .Values.workerImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.git.repository) (not (.Values.git.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.git.repository }}:{{ .Values.git.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- end -}} diff --git a/bitnami/airflow/templates/deployment-scheduler.yaml b/bitnami/airflow/templates/deployment-scheduler.yaml index 41d5cdd84..bd07634e4 100644 --- a/bitnami/airflow/templates/deployment-scheduler.yaml +++ b/bitnami/airflow/templates/deployment-scheduler.yaml @@ -50,12 +50,32 @@ spec: - name: git-clone-repository image: "{{ template "git.image" . }}" imagePullPolicy: {{ .Values.git.pullPolicy | quote }} - command: [ '/bin/sh', '-c' , 'git clone {{ .Values.airflow.cloneDagFilesFromGit.repository }} /dags && cd /dags && git checkout {{ .Values.airflow.cloneDagFilesFromGit.revision }}'] + command: + - /bin/bash + - -ec + - | + git clone {{ .Values.airflow.cloneDagFilesFromGit.repository }} --branch {{ .Values.airflow.cloneDagFilesFromGit.branch }} /dags volumeMounts: - name: git-cloned-dag-files mountPath: /dags - {{- end }} containers: + - name: git-repo-syncer + image: "{{ template "git.image" . }}" + imagePullPolicy: {{ .Values.git.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + while true; do + cd /dags && git pull origin {{ .Values.airflow.cloneDagFilesFromGit.branch }} + sleep {{ default "60" .Values.airflow.cloneDagFilesFromGit.interval }} + done + volumeMounts: + - name: git-cloned-dag-files + mountPath: /dags + {{- else }} + containers: + {{- end }} - name: airflow-scheduler image: {{ template "airflow.schedulerImage" . }} imagePullPolicy: {{ .Values.schedulerImage.pullPolicy | quote }} @@ -187,4 +207,4 @@ spec: - name: custom-configuration-file configMap: name: {{ .Values.airflow.configurationConfigMap }} - {{- end }} \ No newline at end of file + {{- end }} diff --git a/bitnami/airflow/templates/deployment-web.yaml b/bitnami/airflow/templates/deployment-web.yaml index d8659bf42..536016e6d 100644 --- a/bitnami/airflow/templates/deployment-web.yaml +++ b/bitnami/airflow/templates/deployment-web.yaml @@ -50,12 +50,32 @@ spec: - name: git-clone-repository image: "{{ template "git.image" . }}" imagePullPolicy: {{ .Values.git.pullPolicy | quote }} - command: [ '/bin/sh', '-c' , 'git clone {{ .Values.airflow.cloneDagFilesFromGit.repository }} /dags && cd /dags && git checkout {{ .Values.airflow.cloneDagFilesFromGit.revision }}'] + command: + - /bin/bash + - -ec + - | + git clone {{ .Values.airflow.cloneDagFilesFromGit.repository }} --branch {{ .Values.airflow.cloneDagFilesFromGit.branch }} /dags volumeMounts: - name: git-cloned-dag-files mountPath: /dags - {{- end }} containers: + - name: git-repo-syncer + image: "{{ template "git.image" . }}" + imagePullPolicy: {{ .Values.git.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + while true; do + cd /dags && git pull origin {{ .Values.airflow.cloneDagFilesFromGit.branch }} + sleep {{ default "60" .Values.airflow.cloneDagFilesFromGit.interval }} + done + volumeMounts: + - name: git-cloned-dag-files + mountPath: /dags + {{- else }} + containers: + {{- end }} - name: airflow-web image: {{ template "airflow.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy | quote }} @@ -217,4 +237,4 @@ spec: - name: custom-configuration-file configMap: name: {{ .Values.airflow.configurationConfigMap }} - {{- end }} \ No newline at end of file + {{- end }} diff --git a/bitnami/airflow/templates/statefulset-worker.yaml b/bitnami/airflow/templates/statefulset-worker.yaml index 223644791..0960b8035 100644 --- a/bitnami/airflow/templates/statefulset-worker.yaml +++ b/bitnami/airflow/templates/statefulset-worker.yaml @@ -54,12 +54,32 @@ spec: - name: git-clone-repository image: "{{ template "git.image" . }}" imagePullPolicy: {{ .Values.git.pullPolicy | quote }} - command: [ '/bin/sh', '-c' , 'git clone {{ .Values.airflow.cloneDagFilesFromGit.repository }} /dags && cd /dags && git checkout {{ .Values.airflow.cloneDagFilesFromGit.revision }}'] + command: + - /bin/bash + - -ec + - | + git clone {{ .Values.airflow.cloneDagFilesFromGit.repository }} --branch {{ .Values.airflow.cloneDagFilesFromGit.branch }} /dags volumeMounts: - name: git-cloned-dag-files mountPath: /dags - {{- end }} containers: + - name: git-repo-syncer + image: "{{ template "git.image" . }}" + imagePullPolicy: {{ .Values.git.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + while true; do + cd /dags && git pull origin {{ .Values.airflow.cloneDagFilesFromGit.branch }} + sleep {{ default "60" .Values.airflow.cloneDagFilesFromGit.interval }} + done + volumeMounts: + - name: git-cloned-dag-files + mountPath: /dags + {{- else }} + containers: + {{- end }} - name: airflow-worker image: "{{ template "airflow.workerImage" . }}" imagePullPolicy: "{{ .Values.workerImage.pullPolicy }}" @@ -202,4 +222,4 @@ spec: - name: custom-configuration-file configMap: name: {{ .Values.airflow.configurationConfigMap }} - {{- end }} \ No newline at end of file + {{- end }} diff --git a/bitnami/airflow/values-production.yaml b/bitnami/airflow/values-production.yaml index d3ca6d1b0..dc4ed1777 100644 --- a/bitnami/airflow/values-production.yaml +++ b/bitnami/airflow/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/airflow - tag: 1.10.3 + tag: 1.10.3-debian-9-r16 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -37,7 +37,7 @@ image: schedulerImage: registry: docker.io repository: bitnami/airflow-scheduler - tag: 1.10.3 + tag: 1.10.3-debian-9-r26 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -61,7 +61,7 @@ schedulerImage: workerImage: registry: docker.io repository: bitnami/airflow-worker - tag: 1.10.3 + tag: 1.10.3-debian-9-r25 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -85,7 +85,7 @@ workerImage: git: registry: docker.io repository: bitnami/git - tag: latest + tag: 2.21.0-debian-9-r72 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -120,8 +120,9 @@ airflow: ## cloneDagFilesFromGit: enabled: false - repository: - revision: + # repository: + # branch: + # interval: ## URL used to access to airflow web ui ## baseUrl: http://airflow.local @@ -354,4 +355,4 @@ metrics: ## Metrics exporter pod Annotation and Labels # podAnnotations: {} - # podLabels: {} \ No newline at end of file + # podLabels: {} diff --git a/bitnami/airflow/values.yaml b/bitnami/airflow/values.yaml index 286a55906..8806776a2 100644 --- a/bitnami/airflow/values.yaml +++ b/bitnami/airflow/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/airflow - tag: 1.10.3 + tag: 1.10.3-debian-9-r16 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -37,7 +37,7 @@ image: schedulerImage: registry: docker.io repository: bitnami/airflow-scheduler - tag: 1.10.3 + tag: 1.10.3-debian-9-r26 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -61,7 +61,7 @@ schedulerImage: workerImage: registry: docker.io repository: bitnami/airflow-worker - tag: 1.10.3 + tag: 1.10.3-debian-9-r25 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -85,7 +85,7 @@ workerImage: git: registry: docker.io repository: bitnami/git - tag: latest + tag: 2.21.0-debian-9-r72 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -119,9 +119,10 @@ airflow: ## Enable in order to download DAG files from git repository. ## cloneDagFilesFromGit: - enabled: true - repository: https://github.com/tompizmor/sample-airflow-dag - revision: master + enabled: false + # repository: + # branch: + # interval: ## URL used to access to airflow web ui ## # baseUrl: diff --git a/bitnami/apache/Chart.yaml b/bitnami/apache/Chart.yaml index 858c51a32..8b700e2e7 100644 --- a/bitnami/apache/Chart.yaml +++ b/bitnami/apache/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: apache -version: 4.2.0 +version: 4.2.4 appVersion: 2.4.39 description: Chart for Apache HTTP Server keywords: diff --git a/bitnami/apache/README.md b/bitnami/apache/README.md index 651772aa2..056a2e93e 100644 --- a/bitnami/apache/README.md +++ b/bitnami/apache/README.md @@ -50,7 +50,7 @@ The following tables lists the configurable parameters of the Apache chart and t | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Apache Docker image registry | `docker.io` | | `image.repository` | Apache Docker image name | `bitnami/apache` | -| `image.tag` | Apache Docker image tag | `{VERSION}` | +| `image.tag` | Apache Docker image tag | `{TAG_NAME}` | | `image.pullPolicy` | Apache Docker image pull policy | `Always` | | `image.pullSecrets` | Specify Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `podAnnotations` | Pod annotations | `{}` | @@ -98,6 +98,12 @@ $ helm install --name my-release -f values.yaml bitnami/apache > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Upgrading ### To 2.0.0 diff --git a/bitnami/apache/templates/NOTES.txt b/bitnami/apache/templates/NOTES.txt new file mode 100644 index 000000000..d24052057 --- /dev/null +++ b/bitnami/apache/templates/NOTES.txt @@ -0,0 +1,6 @@ +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/apache/values.yaml b/bitnami/apache/values.yaml index 73f4a77dd..c2da84bb7 100644 --- a/bitnami/apache/values.yaml +++ b/bitnami/apache/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/apache - tag: 2.4.39 + tag: 2.4.39-debian-9-r31 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## diff --git a/bitnami/cassandra/Chart.yaml b/bitnami/cassandra/Chart.yaml index 37ca3b924..578b12f80 100644 --- a/bitnami/cassandra/Chart.yaml +++ b/bitnami/cassandra/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: cassandra -version: 2.3.3 +version: 2.3.5 appVersion: 3.11.4 description: Apache Cassandra is a free and open-source distributed database management system designed to handle large amounts of data across many commodity servers, providing high availability with no single point of failure. Cassandra offers robust support for clusters spanning multiple datacenters, with asynchronous masterless replication allowing low latency operations for all clients. icon: https://bitnami.com/assets/stacks/cassandra/img/cassandra-stack-220x234.png diff --git a/bitnami/cassandra/README.md b/bitnami/cassandra/README.md index 7c9716f8f..f44e9379d 100644 --- a/bitnami/cassandra/README.md +++ b/bitnami/cassandra/README.md @@ -52,7 +52,7 @@ The following tables lists the configurable parameters of the cassandra chart an | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Cassandra Image registry | `docker.io` | | `image.repository` | Cassandra Image name | `bitnami/cassandra` | -| `image.tag` | Cassandra Image tag | `{VERSION}` | +| `image.tag` | Cassandra Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `service.type` | Kubernetes Service type | `ClusterIP` | @@ -137,6 +137,12 @@ $ helm install --name my-release -f values.yaml bitnami/cassandra > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami cassandra](https://github.com/bitnami/bitnami-docker-cassandra) image stores the cassandra data at the `/bitnami/cassandra` path of the container. diff --git a/bitnami/cassandra/templates/NOTES.txt b/bitnami/cassandra/templates/NOTES.txt index 514a5f051..d83c8ac4d 100644 --- a/bitnami/cassandra/templates/NOTES.txt +++ b/bitnami/cassandra/templates/NOTES.txt @@ -38,7 +38,7 @@ To connect to your database from outside the cluster execute the following comma export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "cassandra.fullname" . }}) - + cqlsh -u {{ .Values.dbUser.user }} -p $CASSANDRA_PASSWORD $NODE_IP $NODE_PORT {{- else if contains "LoadBalancer" .Values.service.type }} @@ -57,3 +57,9 @@ To connect to your database from outside the cluster execute the following comma {{- end }} {{- end }} +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/cassandra/values-production.yaml b/bitnami/cassandra/values-production.yaml index e1b786094..cf38ce82e 100644 --- a/bitnami/cassandra/values-production.yaml +++ b/bitnami/cassandra/values-production.yaml @@ -16,7 +16,7 @@ image: ## Bitnami Cassandra image tag ## ref: https://github.com/bitnami/bitnami-docker-cassandra#supported-tags-and-respective-dockerfile-links ## - tag: 3.11.4 + tag: 3.11.4-debian-9-r84 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/cassandra/values.yaml b/bitnami/cassandra/values.yaml index 7d806f609..209041a0e 100644 --- a/bitnami/cassandra/values.yaml +++ b/bitnami/cassandra/values.yaml @@ -16,7 +16,7 @@ image: ## Bitnami Cassandra image tag ## ref: https://github.com/bitnami/bitnami-docker-cassandra#supported-tags-and-respective-dockerfile-links ## - tag: 3.11.4 + tag: 3.11.4-debian-9-r84 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/consul/Chart.yaml b/bitnami/consul/Chart.yaml index 6cc702a51..de3b22072 100644 --- a/bitnami/consul/Chart.yaml +++ b/bitnami/consul/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: consul -version: 4.2.5 -appVersion: 1.5.0 +version: 4.2.8 +appVersion: 1.5.1 description: Highly available and distributed service discovery and key-value store designed with support for the modern data center to make distributed systems and configuration easy. home: https://www.consul.io/ sources: diff --git a/bitnami/consul/README.md b/bitnami/consul/README.md index 5a259f5ea..cca6df7d1 100644 --- a/bitnami/consul/README.md +++ b/bitnami/consul/README.md @@ -55,7 +55,7 @@ The following tables lists the configurable parameters of the HashiCorp Consul c | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | HashiCorp Consul image registry | `docker.io` | | `image.repository` | HashiCorp Consul image name | `bitnami/consul` | -| `image.tag` | HashiCorp Consul image tag | `{VERSION}` | +| `image.tag` | HashiCorp Consul image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `replicas` | Number of replicas | `3` | @@ -133,6 +133,12 @@ $ helm install --name my-release -f values.yaml bitnami/consul > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami HashiCorp Consul](https://github.com/bitnami/bitnami-docker-consul) image stores the HashiCorp Consul data at the `/bitnami` path of the container. diff --git a/bitnami/consul/templates/NOTES.txt b/bitnami/consul/templates/NOTES.txt index 4de830897..cf17af2b9 100644 --- a/bitnami/consul/templates/NOTES.txt +++ b/bitnami/consul/templates/NOTES.txt @@ -45,3 +45,10 @@ Furthermore, to know which Consul node is the cluster leader run this other comm kubectl exec -it {{ template "consul.fullname" . }}-0 -- consul operator raft list-peers {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/consul/values-production.yaml b/bitnami/consul/values-production.yaml index 35bbfc5ad..4951bc757 100644 --- a/bitnami/consul/values-production.yaml +++ b/bitnami/consul/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/consul - tag: 1.5.0 + tag: 1.5.1-debian-9-r5 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/consul/values.yaml b/bitnami/consul/values.yaml index 84ba95b72..fe71cf4a6 100644 --- a/bitnami/consul/values.yaml +++ b/bitnami/consul/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/consul - tag: 1.5.0 + tag: 1.5.1-debian-9-r5 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/elasticsearch/Chart.yaml b/bitnami/elasticsearch/Chart.yaml index 8ba34d813..d54b243c9 100644 --- a/bitnami/elasticsearch/Chart.yaml +++ b/bitnami/elasticsearch/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: elasticsearch -version: 5.0.1 -appVersion: 7.0.1 +version: 5.1.5 +appVersion: 7.1.1 description: A highly scalable open-source full-text search and analytics engine keywords: - elasticsearch diff --git a/bitnami/elasticsearch/README.md b/bitnami/elasticsearch/README.md index 9f23fc66e..625aae3a5 100644 --- a/bitnami/elasticsearch/README.md +++ b/bitnami/elasticsearch/README.md @@ -55,7 +55,7 @@ The following table lists the configurable parameters of the Elasticsearch chart | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Elasticsearch image registry | `docker.io` | | `image.repository` | Elasticsearch image repository | `bitnami/elasticsearch` | -| `image.tag` | Elasticsearch image tag | `{VERSION}` | +| `image.tag` | Elasticsearch image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `name` | Elasticsearch cluster name | `elastic` | @@ -78,6 +78,7 @@ The following table lists the configurable parameters of the Elasticsearch chart | `master.livenessProbe.timeoutSeconds` | When the probe times out (master-eligible nodes pod) | `5` | | `master.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (master-eligible nodes pod) | `1` | | `master.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `master.podAnnotations` | Annotations for master pods. | `{}` | | `master.readinessProbe.enabled` | Enable/disable the readiness probe (master-eligible nodes pod) | `true` | | `master.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (master-eligible nodes pod) | `90` | | `master.readinessProbe.periodSeconds` | How often to perform the probe (master-eligible nodes pod) | `10` | @@ -93,6 +94,7 @@ The following table lists the configurable parameters of the Elasticsearch chart | `coordinating.heapSize` | Coordinating-only node heap size | `128m` | | `coordinating.antiAffinity` | Coordinating-only node pod anti-affinity policy | `soft` | | `coordinating.nodeAffinity` | Coordinating-only node affinity policy | `nil` | +| `coordinating.podAnnotations` | Annotations for coordniating pods. | `{}` | | `coordinating.service.type` | Kubernetes Service type (coordinating-only nodes) | `ClusterIP` | | `coordinating.service.port` | Kubernetes Service port for REST API (coordinating-only nodes) | `9200` | | `coordinating.service.nodePort` | Kubernetes Service nodePort (coordinating-only nodes) | `nil` | @@ -130,6 +132,7 @@ The following table lists the configurable parameters of the Elasticsearch chart | `data.livenessProbe.timeoutSeconds` | When the probe times out (data nodes pod) | `5` | | `data.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (data nodes pod) | `1` | | `data.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `data.podAnnotations` | Annotations for data pods. | `{}` | | `data.readinessProbe.enabled` | Enable/disable the readiness probe (data nodes pod) | `true` | | `data.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (data nodes pod) | `90` | | `data.readinessProbe.periodSeconds` | How often to perform the probe (data nodes pod) | `10` | @@ -154,6 +157,7 @@ The following table lists the configurable parameters of the Elasticsearch chart | `ingest.livenessProbe.timeoutSeconds` | When the probe times out (ingest nodes pod) | `5` | | `ingest.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (ingest nodes pod) | `1` | | `ingest.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `ingest.podAnnotations` | Annotations for ingest pods. | `{}` | | `ingest.readinessProbe.enabled` | Enable/disable the readiness probe (ingest nodes pod) | `true` | | `ingest.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (ingest nodes pod) | `90` | | `ingest.readinessProbe.periodSeconds` | How often to perform the probe (ingest nodes pod) | `10` | @@ -168,6 +172,7 @@ The following table lists the configurable parameters of the Elasticsearch chart | `metrics.image.pullPolicy` | Metrics exporter image pull policy | `Always` | | `metrics.service.type` | Metrics exporter endpoint service type | `ClusterIP` | | `metrics.resources` | Metrics exporter resource requests/limit | `requests: { cpu: "25m" }` | +| `metrics.podAnnotations` | Annotations for metrics pods. | `{}` | | `sysctlImage.enabled` | Enable kernel settings modifier image | `false` | | `sysctlImage.registry` | Kernel settings modifier image registry | `docker.io` | | `sysctlImage.repository` | Kernel settings modifier image repository | `bitnami/minideb` | @@ -192,6 +197,12 @@ $ helm install --name my-release -f values.yaml bitnami/elasticsearch > **Tip**: You can use the default [values.yaml](values.yaml). [values-production.yaml](values-production.yaml) has defaults optimized for use in production environments. +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Elasticsearch](https://github.com/bitnami/bitnami-docker-elasticsearch) image stores the Elasticsearch data at the `/bitnami/elasticsearch/data` path of the container. diff --git a/bitnami/elasticsearch/templates/NOTES.txt b/bitnami/elasticsearch/templates/NOTES.txt index 00441ae0b..e4873e5a0 100644 --- a/bitnami/elasticsearch/templates/NOTES.txt +++ b/bitnami/elasticsearch/templates/NOTES.txt @@ -63,3 +63,10 @@ kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "elasticsearch.coordinating.fullname" . }} {{ .Values.coordinating.service.port }}:9200 & curl http://127.0.0.1:9200/ {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/elasticsearch/templates/coordinating-deploy.yaml b/bitnami/elasticsearch/templates/coordinating-deploy.yaml index 7d2fd48ee..120cde216 100644 --- a/bitnami/elasticsearch/templates/coordinating-deploy.yaml +++ b/bitnami/elasticsearch/templates/coordinating-deploy.yaml @@ -21,6 +21,10 @@ spec: app: {{ template "elasticsearch.name" . }} release: {{ .Release.Name | quote }} role: "coordinating-only" +{{- with .Values.coordinating.podAnnotations }} + annotations: +{{ toYaml . | indent 8 }} +{{- end }} spec: {{- if .Values.securityContext.enabled }} securityContext: diff --git a/bitnami/elasticsearch/templates/data-statefulset.yaml b/bitnami/elasticsearch/templates/data-statefulset.yaml index b045b82f7..0ff44529e 100644 --- a/bitnami/elasticsearch/templates/data-statefulset.yaml +++ b/bitnami/elasticsearch/templates/data-statefulset.yaml @@ -31,6 +31,10 @@ spec: chart: {{ template "elasticsearch.chart" . }} release: {{ .Release.Name | quote }} role: "data" +{{- with .Values.data.podAnnotations }} + annotations: +{{ toYaml . | indent 8 }} +{{- end }} spec: {{- include "elasticsearch.imagePullSecrets" . | nindent 6 }} {{- if .Values.securityContext.enabled }} diff --git a/bitnami/elasticsearch/templates/ingest-deploy.yaml b/bitnami/elasticsearch/templates/ingest-deploy.yaml index a2665e433..bc1472c34 100644 --- a/bitnami/elasticsearch/templates/ingest-deploy.yaml +++ b/bitnami/elasticsearch/templates/ingest-deploy.yaml @@ -22,6 +22,10 @@ spec: app: {{ template "elasticsearch.name" . }} release: {{ .Release.Name | quote }} role: "ingest" +{{- with .Values.ingest.podAnnotations }} + annotations: +{{ toYaml . | indent 8 }} +{{- end }} spec: {{- include "elasticsearch.imagePullSecrets" . | nindent 6 }} {{- if .Values.securityContext.enabled }} diff --git a/bitnami/elasticsearch/templates/master-statefulset.yaml b/bitnami/elasticsearch/templates/master-statefulset.yaml index 89d0bc580..630d05ee4 100644 --- a/bitnami/elasticsearch/templates/master-statefulset.yaml +++ b/bitnami/elasticsearch/templates/master-statefulset.yaml @@ -23,6 +23,10 @@ spec: chart: {{ template "elasticsearch.chart" . }} release: {{ .Release.Name | quote }} role: "master" +{{- with .Values.master.podAnnotations }} + annotations: +{{ toYaml . | indent 8 }} +{{- end }} spec: {{- include "elasticsearch.imagePullSecrets" . | nindent 6 }} {{- if .Values.securityContext.enabled }} @@ -133,4 +137,4 @@ spec: name: {{ template "elasticsearch.fullname" . }} {{- end }} - name: "data" - emptyDir: {} \ No newline at end of file + emptyDir: {} diff --git a/bitnami/elasticsearch/templates/metrics-deploy.yaml b/bitnami/elasticsearch/templates/metrics-deploy.yaml index 5fa14087d..bc9cf0ca7 100644 --- a/bitnami/elasticsearch/templates/metrics-deploy.yaml +++ b/bitnami/elasticsearch/templates/metrics-deploy.yaml @@ -23,6 +23,10 @@ spec: release: {{ .Release.Name | quote }} chart: {{ template "elasticsearch.chart" . }} role: "metrics" +{{- with .Values.metrics.podAnnotations }} + annotations: +{{ toYaml . | indent 8 }} +{{- end }} spec: {{- include "elasticsearch.imagePullSecrets" . | indent 6 }} containers: diff --git a/bitnami/elasticsearch/values-production.yaml b/bitnami/elasticsearch/values-production.yaml index 318c7916a..52ff6fe56 100644 --- a/bitnami/elasticsearch/values-production.yaml +++ b/bitnami/elasticsearch/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/elasticsearch - tag: 7.0.1 + tag: 7.1.1-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/elasticsearch/values.yaml b/bitnami/elasticsearch/values.yaml index 107774ba0..1b2ff50f9 100644 --- a/bitnami/elasticsearch/values.yaml +++ b/bitnami/elasticsearch/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/elasticsearch - tag: 7.0.1 + tag: 7.1.1-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -85,6 +85,9 @@ master: annotations: {} # loadBalancerIP: + ## Provide annotations for the master pods. + podAnnotations: {} + ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## @@ -151,6 +154,9 @@ coordinating: annotations: {} # loadBalancerIP: + ## Provide annotations for the coordinating pods. + podAnnotations: {} + ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## @@ -189,6 +195,8 @@ data: antiAffinity: "soft" ## node affinity # nodeAffinity: + ## Provide annotations for the data pods. + podAnnotations: {} ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## @@ -268,6 +276,9 @@ ingest: annotations: {} # loadBalancerIP: + ## Provide annotations for the ingest pods. + podAnnotations: {} + ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## @@ -306,6 +317,8 @@ metrics: ## # pullSecrets: # - myRegistryKeySecretName + ## Provide annotations for the metrics pods. + podAnnotations: {} annotations: prometheus.io/scrape: "true" prometheus.io/port: "9108" diff --git a/bitnami/etcd/Chart.yaml b/bitnami/etcd/Chart.yaml index 58ce0f302..bc3df4926 100644 --- a/bitnami/etcd/Chart.yaml +++ b/bitnami/etcd/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: etcd -version: 2.2.3 +version: 2.2.5 appVersion: 3.3.13 description: etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines keywords: diff --git a/bitnami/etcd/README.md b/bitnami/etcd/README.md index 7488f187b..677f6850e 100644 --- a/bitnami/etcd/README.md +++ b/bitnami/etcd/README.md @@ -51,7 +51,7 @@ The following tables lists the configurable parameters of the etcd chart and the | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | etcd image registry | `docker.io` | | `image.repository` | etcd Image name | `bitnami/etcd` | -| `image.tag` | etcd Image tag | `{VERSION}` | +| `image.tag` | etcd Image tag | `{TAG_NAME}` | | `image.pullPolicy` | etcd image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug values should be set | `false` | @@ -127,6 +127,12 @@ $ helm install --name my-release -f values.yaml bitnami/etcd > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ### Using custom configuration In order to use custom configuration parameters, two options are available: diff --git a/bitnami/etcd/templates/NOTES.txt b/bitnami/etcd/templates/NOTES.txt index 4636e8489..512277242 100644 --- a/bitnami/etcd/templates/NOTES.txt +++ b/bitnami/etcd/templates/NOTES.txt @@ -75,3 +75,10 @@ To connect to your etcd server from outside the cluster execute the following co {{ if .Values.auth.client.enableAuthentication }} * As TLS host authentication is enabled you should add the flag `--ca-file /opt/bitnami/etcd/certs/client/ca.crt` to the etcdctl commands. {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/etcd/values-production.yaml b/bitnami/etcd/values-production.yaml index 72d275277..0538358d4 100644 --- a/bitnami/etcd/values-production.yaml +++ b/bitnami/etcd/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/etcd - tag: 3.3.13 + tag: 3.3.13-debian-9-r16 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/etcd/values.yaml b/bitnami/etcd/values.yaml index 581edcde0..6cea6c9ca 100644 --- a/bitnami/etcd/values.yaml +++ b/bitnami/etcd/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/etcd - tag: 3.3.13 + tag: 3.3.13-debian-9-r16 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/external-dns/Chart.yaml b/bitnami/external-dns/Chart.yaml index 0b0e89664..560eeaa6a 100644 --- a/bitnami/external-dns/Chart.yaml +++ b/bitnami/external-dns/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: external-dns -version: 1.5.3 -appVersion: 0.5.13 +version: 1.5.6 +appVersion: 0.5.14 description: ExternalDNS is a Kubernetes addon that configures public DNS servers with information about exposed Kubernetes services to make them discoverable. keywords: - external-dns diff --git a/bitnami/external-dns/README.md b/bitnami/external-dns/README.md index d26d97bdd..aab648b1a 100644 --- a/bitnami/external-dns/README.md +++ b/bitnami/external-dns/README.md @@ -52,7 +52,7 @@ The following table lists the configurable parameters of the external-dns chart | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | ExternalDNS image registry | `docker.io` | | `image.repository` | ExternalDNS Image name | `bitnami/external-dns` | -| `image.tag` | ExternalDNS Image tag | `{VERSION}` | +| `image.tag` | ExternalDNS Image tag | `{TAG_NAME}` | | `image.pullPolicy` | ExternalDNS image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug values should be set | `false` | @@ -124,6 +124,12 @@ $ helm install --name my-release -f values.yaml bitnami/external-dns > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Tutorials Find information about the requirements for each DNS provider on the link below: diff --git a/bitnami/external-dns/templates/NOTES.txt b/bitnami/external-dns/templates/NOTES.txt index 0a206c037..909f7c455 100644 --- a/bitnami/external-dns/templates/NOTES.txt +++ b/bitnami/external-dns/templates/NOTES.txt @@ -43,3 +43,10 @@ Replace the placeholder YOUR_DNS_PROVIDER with a valid DNS provider (aws, azure, {{- end }} ** Please be patient while the chart is being deployed ** + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/external-dns/values-production.yaml b/bitnami/external-dns/values-production.yaml index e00b0dea4..2328c1a9a 100644 --- a/bitnami/external-dns/values-production.yaml +++ b/bitnami/external-dns/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/external-dns - tag: 0.5.13 + tag: 0.5.14-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/external-dns/values.yaml b/bitnami/external-dns/values.yaml index 6791b7143..7a167db9a 100644 --- a/bitnami/external-dns/values.yaml +++ b/bitnami/external-dns/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/external-dns - tag: 0.5.13 + tag: 0.5.14-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/jenkins/Chart.yaml b/bitnami/jenkins/Chart.yaml index ec4398890..bce642e14 100644 --- a/bitnami/jenkins/Chart.yaml +++ b/bitnami/jenkins/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: jenkins -version: 2.3.2 +version: 2.3.4 appVersion: 2.164.3 description: The leading open source automation server keywords: diff --git a/bitnami/jenkins/README.md b/bitnami/jenkins/README.md index 7ee70b810..e914d36c2 100644 --- a/bitnami/jenkins/README.md +++ b/bitnami/jenkins/README.md @@ -51,7 +51,7 @@ The following tables lists the configurable parameters of the Jenkins chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Jenkins image registry | `docker.io` | | `image.repository` | Jenkins Image name | `bitnami/jenkins` | -| `image.tag` | Jenkins Image tag | `{VERSION}` | +| `image.tag` | Jenkins Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Jenkins image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `jenkinsUser` | User of the application | `user` | @@ -113,6 +113,12 @@ $ helm install --name my-release -f values.yaml bitnami/jenkins > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Jenkins](https://github.com/bitnami/bitnami-docker-jenkins) image stores the Jenkins data and configurations at the `/bitnami/jenkins` path of the container. diff --git a/bitnami/jenkins/templates/NOTES.txt b/bitnami/jenkins/templates/NOTES.txt index b9e6d5f51..5182fe8dc 100644 --- a/bitnami/jenkins/templates/NOTES.txt +++ b/bitnami/jenkins/templates/NOTES.txt @@ -29,3 +29,10 @@ echo Username: {{ .Values.jenkinsUser }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.jenkins-password}" | base64 --decode) + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/jenkins/values.yaml b/bitnami/jenkins/values.yaml index f16ee2aec..bd281b241 100644 --- a/bitnami/jenkins/values.yaml +++ b/bitnami/jenkins/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/jenkins - tag: 2.164.3 + tag: 2.164.3-debian-9-r16 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/kafka/Chart.yaml b/bitnami/kafka/Chart.yaml index fcd1a2a0f..9eb8c4980 100644 --- a/bitnami/kafka/Chart.yaml +++ b/bitnami/kafka/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: kafka -version: 2.2.4 +version: 2.2.5 appVersion: 2.2.0 description: Apache Kafka is a distributed streaming platform. keywords: diff --git a/bitnami/kafka/README.md b/bitnami/kafka/README.md index 672beb7d6..6c96f0b93 100644 --- a/bitnami/kafka/README.md +++ b/bitnami/kafka/README.md @@ -51,12 +51,15 @@ The following tables lists the configurable parameters of the Kafka chart and th | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Kafka image registry | `docker.io` | | `image.repository` | Kafka Image name | `bitnami/kafka` | -| `image.tag` | Kafka Image tag | `{VERSION}` | +| `image.tag` | Kafka Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Kafka image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug values should be set | `false` | +| `nameOverride` | String to partially override kafka.fullname template with a string (will append the release name) | `nil` | +| `fullnameOverride` | String to fully override kafka.fullname template with a string | `nil` | | `updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | | `rollingUpdatePartition` | Partition update strategy | `nil` | +| `podDisruptionBudget.maxUnavailable` | Max number of pods down simultaneously | `1` | | `replicaCount` | Number of Kafka nodes | `1` | | `config` | Configuration file for Kafka | `nil` | | `allowPlaintextListener` | Allow to use the PLAINTEXT listener | `true` | @@ -170,6 +173,12 @@ $ helm install --name my-release -f values.yaml bitnami/kafka > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Production and horizontal scaling The following repo contains the recommended production settings for Kafka server in an alternative [values file](values-production.yaml). Please read carefully the comments in the values-production.yaml file to set up your environment diff --git a/bitnami/kafka/templates/NOTES.txt b/bitnami/kafka/templates/NOTES.txt index e621560ae..0c93e7701 100644 --- a/bitnami/kafka/templates/NOTES.txt +++ b/bitnami/kafka/templates/NOTES.txt @@ -91,3 +91,10 @@ To connect to your Kafka server from outside the cluster execute the following c CONSUMER: kafka-console-consumer.sh --bootstrap-server 127.0.0.1:9092 --topic test --from-beginning {{ end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/kafka/templates/poddisruptionbudget.yaml b/bitnami/kafka/templates/poddisruptionbudget.yaml new file mode 100644 index 000000000..3d3433c0e --- /dev/null +++ b/bitnami/kafka/templates/poddisruptionbudget.yaml @@ -0,0 +1,20 @@ +{{- $replicaCount := int .Values.replicaCount }} +{{- if gt $replicaCount 1 }} +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: {{ template "kafka.fullname" . }} + labels: + app.kubernetes.io/name: {{ template "kafka.name" . }} + helm.sh/chart: {{ template "kafka.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: kafka +spec: + selector: + matchLabels: + app.kubernetes.io/name: {{ template "kafka.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: kafka +{{ toYaml .Values.podDisruptionBudget | indent 2 }} +{{- end }} diff --git a/bitnami/kafka/values-production.yaml b/bitnami/kafka/values-production.yaml index e4ef25271..3c6d94b4f 100644 --- a/bitnami/kafka/values-production.yaml +++ b/bitnami/kafka/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/kafka - tag: 2.2.0 + tag: 2.2.0-debian-9-r40 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -31,6 +31,12 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override kafka.fullname template (will maintain the release name) +# nameOverride: + + ## String to fully override kafka.fullname template +# fullnameOverride: + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## @@ -41,6 +47,14 @@ updateStrategy: RollingUpdate ## # rollingUpdatePartition: +## Limits the number of pods of the replicated application that are down simultaneously from voluntary disruptions +## The PDB will only be created if replicaCount is greater than 1 +## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions +## +podDisruptionBudget: + maxUnavailable: 1 + + replicaCount: 3 config: |- @@ -153,7 +167,7 @@ socketSendBufferBytes: 102400 zookeeperConnectionTimeoutMs: 6000 ## The endpoint identification algorithm to validate server hostname using server certificate. -sslEndpointIdentificationAlgorithm : https +sslEndpointIdentificationAlgorithm: https ## Authentication parameteres ## https://github.com/bitnami/bitnami-docker-kafka#security diff --git a/bitnami/kafka/values.yaml b/bitnami/kafka/values.yaml index f43f1dc14..00c79c1c5 100644 --- a/bitnami/kafka/values.yaml +++ b/bitnami/kafka/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/kafka - tag: 2.2.0 + tag: 2.2.0-debian-9-r40 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -31,6 +31,12 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override kafka.fullname template (will maintain the release name) +# nameOverride: + + ## String to fully override kafka.fullname template +# fullnameOverride: + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## @@ -41,6 +47,14 @@ updateStrategy: RollingUpdate ## # rollingUpdatePartition: +## Limits the number of pods of the replicated application that are down simultaneously from voluntary disruptions +## The PDB will only be created if replicaCount is greater than 1 +## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions +## +podDisruptionBudget: + maxUnavailable: 1 + + replicaCount: 1 config: |- @@ -153,7 +167,7 @@ socketSendBufferBytes: 102400 zookeeperConnectionTimeoutMs: 6000 ## The endpoint identification algorithm to validate server hostname using server certificate. -sslEndpointIdentificationAlgorithm : https +sslEndpointIdentificationAlgorithm: https ## Authentication parameteres ## https://github.com/bitnami/bitnami-docker-kafka#security diff --git a/bitnami/kubeapps/Chart.yaml b/bitnami/kubeapps/Chart.yaml index 8702e0f80..b363ead07 100644 --- a/bitnami/kubeapps/Chart.yaml +++ b/bitnami/kubeapps/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: kubeapps -version: 1.6.2 -appVersion: v1.3.2 +version: 1.7.0 +appVersion: v1.4.0 description: Kubeapps is a dashboard for your Kubernetes cluster that makes it easy to deploy and manage applications in your cluster using Helm icon: https://raw.githubusercontent.com/kubeapps/kubeapps/master/docs/img/logo.png keywords: diff --git a/bitnami/kubeapps/templates/apprepositories.yaml b/bitnami/kubeapps/templates/apprepositories.yaml index b681bb2a2..a0d17e51a 100644 --- a/bitnami/kubeapps/templates/apprepositories.yaml +++ b/bitnami/kubeapps/templates/apprepositories.yaml @@ -4,11 +4,19 @@ kind: AppRepository metadata: name: {{ .name }} annotations: +{{- if semverCompare ">=2.14.0" $.Capabilities.TillerVersion.SemVer }} + # Using the hook pre-install because since Helm v2.14 the crd-install + # hook should be used only for CRDs and the issues related to install + # Custom Resources have been already fixed + # https://github.com/helm/helm/issues/5756#issuecomment-493653454 + "helm.sh/hook": pre-install +{{- else }} # Using the hook crd-install to avoid issue w/Helm v1.11 # https://github.com/kubeapps/kubeapps/pull/955#pullrequestreview-200764260 "helm.sh/hook": crd-install # Make sure this runs after the AppRepository CRD install "helm.sh/hook-weight": "10" +{{- end }} labels: app: {{ template "kubeapps.apprepository.fullname" $ }} chart: {{ template "kubeapps.chart" $ }} diff --git a/bitnami/kubeapps/templates/apprepository-crd.yaml b/bitnami/kubeapps/templates/apprepository-crd.yaml index 8f4132481..ba1f07a2c 100644 --- a/bitnami/kubeapps/templates/apprepository-crd.yaml +++ b/bitnami/kubeapps/templates/apprepository-crd.yaml @@ -14,6 +14,7 @@ metadata: heritage: {{ .Release.Service }} spec: group: kubeapps.com + scope: Namespaced names: kind: AppRepository plural: apprepositories diff --git a/bitnami/kubeapps/values.yaml b/bitnami/kubeapps/values.yaml index 0a62f20ad..91510b601 100644 --- a/bitnami/kubeapps/values.yaml +++ b/bitnami/kubeapps/values.yaml @@ -99,7 +99,7 @@ apprepository: image: registry: docker.io repository: bitnami/kubeapps-apprepository-controller - tag: 1.3.2 + tag: 1.4.0 # Image used to perform chart repository syncs syncImage: registry: docker.io @@ -154,7 +154,7 @@ tillerProxy: image: registry: docker.io repository: bitnami/kubeapps-tiller-proxy - tag: 1.3.2 + tag: 1.4.0 service: port: 8080 host: tiller-deploy.kube-system:44134 @@ -216,7 +216,7 @@ dashboard: image: registry: docker.io repository: bitnami/kubeapps-dashboard - tag: 1.3.2 + tag: 1.4.0 service: port: 8080 livenessProbe: diff --git a/bitnami/memcached/Chart.yaml b/bitnami/memcached/Chart.yaml index 6f416830d..6e6146f6f 100644 --- a/bitnami/memcached/Chart.yaml +++ b/bitnami/memcached/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: memcached -version: 1.5.3 -appVersion: 1.5.14 +version: 1.5.7 +appVersion: 1.5.16 description: Chart for Memcached keywords: - memcached diff --git a/bitnami/memcached/README.md b/bitnami/memcached/README.md index 3608f6eaf..02c0a6031 100644 --- a/bitnami/memcached/README.md +++ b/bitnami/memcached/README.md @@ -51,7 +51,7 @@ The following tables lists the configurable parameters of the Memcached chart an | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Memcached image registry | `docker.io` | | `image.repository` | Memcached Image name | `bitnami/memcached` | -| `image.tag` | Memcached Image tag | `{VERSION}` | +| `image.tag` | Memcached Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Memcached image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `securityContext.enabled` | Enable security context | `true` | @@ -89,6 +89,12 @@ $ helm install --name my-release -f values.yaml bitnami/memcached > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Upgrading ### To 1.0.0 diff --git a/bitnami/memcached/templates/NOTES.txt b/bitnami/memcached/templates/NOTES.txt index 143bd52fb..665da7848 100644 --- a/bitnami/memcached/templates/NOTES.txt +++ b/bitnami/memcached/templates/NOTES.txt @@ -3,3 +3,9 @@ Memcached can be accessed on port 11211 on the following DNS name from within your cluster: {{ template "fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/memcached/values-production.yaml b/bitnami/memcached/values-production.yaml index 5ac952f7e..bc16e1fd8 100644 --- a/bitnami/memcached/values-production.yaml +++ b/bitnami/memcached/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/memcached - tag: 1.5.14 + tag: 1.5.16-debian-9-r3 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/memcached/values.yaml b/bitnami/memcached/values.yaml index a17d84092..d48b47d7e 100644 --- a/bitnami/memcached/values.yaml +++ b/bitnami/memcached/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/memcached - tag: 1.5.14 + tag: 1.5.16-debian-9-r3 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/metrics-server/Chart.yaml b/bitnami/metrics-server/Chart.yaml index fdef11bf5..0771bf129 100644 --- a/bitnami/metrics-server/Chart.yaml +++ b/bitnami/metrics-server/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: metrics-server -version: 2.3.4 +version: 2.3.6 appVersion: 0.3.3 description: Metrics Server is a cluster-wide aggregator of resource usage data. Metrics Server collects metrics from the Summary API, exposed by Kubelet on each node. keywords: diff --git a/bitnami/metrics-server/README.md b/bitnami/metrics-server/README.md index cb5ec1a02..478397e6f 100644 --- a/bitnami/metrics-server/README.md +++ b/bitnami/metrics-server/README.md @@ -51,7 +51,7 @@ The following tables lists the configurable parameters of the Metrics Server cha | `global.imagePullSecrets`| Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Metrics Server image registry | `docker.io` | | `image.repository` | Metrics Server image name | `bitnami/metrics-server` | -| `image.tag` | Metrics Server image tag | `{VERSION}` | +| `image.tag` | Metrics Server image tag | `{TAG_NAME}` | | `image.pullPolicy` | Metrics Server image pull policy | `Always` | | `securePort` | Port where metrics-server will be running | `8443` | | `service.type` | Kubernetes Service type | `ClusterIP` | @@ -81,6 +81,12 @@ $ helm install --name my-release -f values.yaml bitnami/metrics-server > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Enable security for Metrics Server ### Configure RBAC diff --git a/bitnami/metrics-server/templates/NOTES.txt b/bitnami/metrics-server/templates/NOTES.txt index fde59febc..184107147 100644 --- a/bitnami/metrics-server/templates/NOTES.txt +++ b/bitnami/metrics-server/templates/NOTES.txt @@ -24,3 +24,10 @@ Option B: You configure the metrics API service outside of this Helm chart {{- end -}} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/metrics-server/values.yaml b/bitnami/metrics-server/values.yaml index b641f42d6..85fad2f37 100644 --- a/bitnami/metrics-server/values.yaml +++ b/bitnami/metrics-server/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/metrics-server - tag: 0.3.3 + tag: 0.3.3-debian-9-r16 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/minio/Chart.yaml b/bitnami/minio/Chart.yaml index ba6b54bb2..73bcccdb2 100644 --- a/bitnami/minio/Chart.yaml +++ b/bitnami/minio/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 -version: 0.1.1 -appVersion: 2019.5.2 +version: 0.1.6 +appVersion: 2019.5.23 description: MinIO is an object storage server, compatible with Amazon S3 cloud storage service, mainly used for storing unstructured data (such as photos, videos, log files, etc.) keywords: - minio diff --git a/bitnami/minio/README.md b/bitnami/minio/README.md index cb47c41de..fdeeef6d2 100644 --- a/bitnami/minio/README.md +++ b/bitnami/minio/README.md @@ -54,13 +54,13 @@ The following table lists the configurable parameters of the MinIO chart and the | `global.minio.secretKey` | MinIO Secret Key (overrides `secretKey.password`) | `nil` | | `image.registry` | MinIO image registry | `docker.io` | | `image.repository` | MinIO image name | `bitnami/minio` | -| `image.tag` | MinIO image tag | `{VERSION}` | +| `image.tag` | MinIO image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug logs should be enabled | `false` | | `clientImage.registry` | MinIO Client image registry | `docker.io` | | `clientImage.repository` | MinIO Client image name | `bitnami/minio-client` | -| `clientImage.tag` | MinIO Client image tag | `{VERSION}` | +| `clientImage.tag` | MinIO Client image tag | `{TAG_NAME}` | | `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | | `statefulset.replicaCount` | Number of pods (only for Minio distributed mode). Should be 4 <= x <= 32 | `4` | | `statefulset.updateStrategy` | Statefulset update strategy policy | `RollingUpdate` | @@ -136,6 +136,12 @@ $ helm install --name my-release -f values.yaml bitnami/minio > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Distributed mode You can start the MinIO chart in distributed mode with the following command: diff --git a/bitnami/minio/templates/NOTES.txt b/bitnami/minio/templates/NOTES.txt index e0216bb7d..d303c4abb 100644 --- a/bitnami/minio/templates/NOTES.txt +++ b/bitnami/minio/templates/NOTES.txt @@ -68,3 +68,4 @@ To access the MinIO web UI: {{- end }} {{ include "minio.validateValues" . }} +{{ include "minio.checkRollingTags" . }} diff --git a/bitnami/minio/templates/_helpers.tpl b/bitnami/minio/templates/_helpers.tpl index b3da21151..4d2572950 100644 --- a/bitnami/minio/templates/_helpers.tpl +++ b/bitnami/minio/templates/_helpers.tpl @@ -140,3 +140,15 @@ minio: replicaCount Please set a valid number of replicas (--set statefulset.replicaCount=X) {{- end -}} {{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "minio.checkRollingTags" -}} +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.clientImage.repository) (not (.Values.clientImage.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.clientImage.repository }}:{{ .Values.clientImage.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- end -}} diff --git a/bitnami/minio/templates/deployment-standalone.yaml b/bitnami/minio/templates/deployment-standalone.yaml index a0ab565c0..3a612ec69 100644 --- a/bitnami/minio/templates/deployment-standalone.yaml +++ b/bitnami/minio/templates/deployment-standalone.yaml @@ -89,7 +89,7 @@ spec: value: {{ .Values.defaultBuckets }} {{- end }} - name: MINIO_BROWSER - value: {{ ternary "off" "on" .Values.disableWebUI }} + value: {{ ternary "off" "on" .Values.disableWebUI | quote }} {{- if .Values.extraEnv }} {{ toYaml .Values.extraEnv | indent 8 }} {{- end }} diff --git a/bitnami/minio/templates/statefulset.yaml b/bitnami/minio/templates/statefulset.yaml index 2c462edd8..17cd36534 100644 --- a/bitnami/minio/templates/statefulset.yaml +++ b/bitnami/minio/templates/statefulset.yaml @@ -104,7 +104,7 @@ spec: key: secret-key {{- end }} - name: MINIO_BROWSER - value: {{ ternary "off" "on" .Values.disableWebUI }} + value: {{ ternary "off" "on" .Values.disableWebUI | quote }} {{- if .Values.extraEnv }} {{ toYaml .Values.extraEnv | indent 8 }} {{- end }} diff --git a/bitnami/minio/values-production.yaml b/bitnami/minio/values-production.yaml index 7ec6ae73a..4cad0218e 100644 --- a/bitnami/minio/values-production.yaml +++ b/bitnami/minio/values-production.yaml @@ -18,7 +18,7 @@ global: image: registry: docker.io repository: bitnami/minio - tag: 2019.5.2 + tag: 2019.5.23-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -42,7 +42,7 @@ image: clientImage: registry: docker.io repository: bitnami/minio-client - tag: latest + tag: 2019.5.23-debian-9-r5 ## MinIO server mode. Allowed values: standalone or distributed. ## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide diff --git a/bitnami/minio/values.yaml b/bitnami/minio/values.yaml index f99571cd6..15da5cd8d 100644 --- a/bitnami/minio/values.yaml +++ b/bitnami/minio/values.yaml @@ -18,7 +18,7 @@ global: image: registry: docker.io repository: bitnami/minio - tag: 2019.5.2 + tag: 2019.5.23-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -42,7 +42,7 @@ image: clientImage: registry: docker.io repository: bitnami/minio-client - tag: latest + tag: 2019.5.23-debian-9-r5 ## MinIO server mode. Allowed values: standalone or distributed. ## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide diff --git a/bitnami/mysql/Chart.yaml b/bitnami/mysql/Chart.yaml index 8af85a634..be84f8490 100644 --- a/bitnami/mysql/Chart.yaml +++ b/bitnami/mysql/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: mysql -version: 4.5.2 -appVersion: 5.7.26 +version: 5.0.3 +appVersion: 8.0.16 description: Chart to create a Highly available MySQL cluster keywords: - mysql diff --git a/bitnami/mysql/README.md b/bitnami/mysql/README.md index 3e7550e83..e986d9fc7 100644 --- a/bitnami/mysql/README.md +++ b/bitnami/mysql/README.md @@ -51,7 +51,7 @@ The following tables lists the configurable parameters of the MySQL chart and th | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | MySQL image registry | `docker.io` | | `image.repository` | MySQL Image name | `bitnami/mysql` | -| `image.tag` | MySQL Image tag | `{VERSION}` | +| `image.tag` | MySQL Image tag | `{TAG_NAME}` | | `image.pullPolicy` | MySQL image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `service.type` | Kubernetes service type | `ClusterIP` | @@ -138,6 +138,12 @@ $ helm install --name my-release -f values.yaml bitnami/mysql > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Initialize a fresh instance The [Bitnami MySQL](https://github.com/bitnami/bitnami-docker-mysql) image allows you to use your custom scripts to initialize a fresh instance. In order to execute the scripts, they must be located inside the chart folder `files/docker-entrypoint-initdb.d` so they can be consumed as a ConfigMap. diff --git a/bitnami/mysql/templates/NOTES.txt b/bitnami/mysql/templates/NOTES.txt index 82849cfc9..c8a3595c0 100644 --- a/bitnami/mysql/templates/NOTES.txt +++ b/bitnami/mysql/templates/NOTES.txt @@ -40,3 +40,10 @@ To upgrade this helm chart: ROOT_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.mysql-root-password}" | base64 --decode) helm upgrade {{ .Release.Name }} bitnami/mysql --set root.password=$ROOT_PASSWORD + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/mysql/values-production.yaml b/bitnami/mysql/values-production.yaml index c1c0d9236..ac4b7c6cf 100644 --- a/bitnami/mysql/values-production.yaml +++ b/bitnami/mysql/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/mysql - tag: 5.7.26 + tag: 8.0.16-debian-9-r16 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/mysql/values.yaml b/bitnami/mysql/values.yaml index 5301a5f9d..7666cd9bc 100644 --- a/bitnami/mysql/values.yaml +++ b/bitnami/mysql/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/mysql - tag: 5.7.26 + tag: 8.0.16-debian-9-r16 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/nginx-ingress-controller/Chart.yaml b/bitnami/nginx-ingress-controller/Chart.yaml index 3b531004e..bec038f05 100644 --- a/bitnami/nginx-ingress-controller/Chart.yaml +++ b/bitnami/nginx-ingress-controller/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: nginx-ingress-controller -version: 3.4.5 +version: 3.4.7 appVersion: 0.24.1 description: Chart for the nginx Ingress controller keywords: diff --git a/bitnami/nginx-ingress-controller/README.md b/bitnami/nginx-ingress-controller/README.md index 0ef0eb82a..8199fe108 100644 --- a/bitnami/nginx-ingress-controller/README.md +++ b/bitnami/nginx-ingress-controller/README.md @@ -53,7 +53,7 @@ Parameter | Description | Default `name` | name of the controller component | `controller` `image.registry` | name of the container image registry | `docker.io` `image.repository` | controller container image repository | `bitnami/nginx-ingress-controller` -`image.tag` | controller container image tag | `{VERSION}` +`image.tag` | controller container image tag | `{TAG_NAME}` `image.pullPolicy` | controller container image pull policy | `IfNotPresent` `config` | nginx ConfigMap entries | `use-geoip: "false", use-geoip2: "true"` `hostNetwork` | If the nginx deployment / daemonset should run on the host's network namespace. Do not set this when `controller.service.externalIPs` is set and `kube-proxy` is used as there will be a port-conflict for port `80` | false @@ -182,6 +182,12 @@ $ helm install --name my-release -f values.yaml bitnami/nginx-ingress-controller > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Upgrading ### To 1.0.0 diff --git a/bitnami/nginx-ingress-controller/templates/NOTES.txt b/bitnami/nginx-ingress-controller/templates/NOTES.txt index 80e3bf7ec..7efaa5e2e 100644 --- a/bitnami/nginx-ingress-controller/templates/NOTES.txt +++ b/bitnami/nginx-ingress-controller/templates/NOTES.txt @@ -64,3 +64,10 @@ If TLS is enabled for the Ingress, a Secret containing the certificate and key m tls.crt: tls.key: type: kubernetes.io/tls + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/nginx-ingress-controller/values-production.yaml b/bitnami/nginx-ingress-controller/values-production.yaml index 86ee7a838..2a38d4661 100644 --- a/bitnami/nginx-ingress-controller/values-production.yaml +++ b/bitnami/nginx-ingress-controller/values-production.yaml @@ -13,7 +13,7 @@ name: controller image: registry: docker.io repository: bitnami/nginx-ingress-controller - tag: 0.24.1 + tag: 0.24.1-debian-9-r25 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -309,8 +309,9 @@ defaultBackend: name: default-backend image: - repository: k8s.gcr.io/defaultbackend - tag: "1.4" + registry: docker.io + repository: bitnami/nginx + tag: 1.16.0-debian-9-r26 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/nginx-ingress-controller/values.yaml b/bitnami/nginx-ingress-controller/values.yaml index 256ff7fb2..25a813f66 100644 --- a/bitnami/nginx-ingress-controller/values.yaml +++ b/bitnami/nginx-ingress-controller/values.yaml @@ -13,7 +13,7 @@ name: controller image: registry: docker.io repository: bitnami/nginx-ingress-controller - tag: 0.24.1 + tag: 0.24.1-debian-9-r25 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -310,7 +310,7 @@ defaultBackend: image: registry: docker.io repository: bitnami/nginx - tag: latest + tag: 1.16.0-debian-9-r26 pullPolicy: Always ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/nginx/Chart.yaml b/bitnami/nginx/Chart.yaml index fddda8718..284962118 100644 --- a/bitnami/nginx/Chart.yaml +++ b/bitnami/nginx/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: nginx -version: 3.2.0 +version: 3.2.2 appVersion: 1.16.0 description: Chart for the nginx server keywords: diff --git a/bitnami/nginx/README.md b/bitnami/nginx/README.md index eba18fa4f..7f9ad8f4c 100644 --- a/bitnami/nginx/README.md +++ b/bitnami/nginx/README.md @@ -48,7 +48,7 @@ The following tables lists the configurable parameters of the NGINX Open Source | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | NGINX image registry | `docker.io` | | `image.repository` | NGINX Image name | `bitnami/nginx` | -| `image.tag` | NGINX Image tag | `{VERSION}` | +| `image.tag` | NGINX Image tag | `{TAG_NAME}` | | `image.pullPolicy` | NGINX image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `serverBlock` | Custom NGINX server block | `nil` | @@ -96,6 +96,12 @@ $ helm install --name my-release -f values.yaml bitnami/nginx > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ### Providing a custom server block You can use the `serverBlock` value to provide a custom server block for NGINX to use. diff --git a/bitnami/nginx/templates/NOTES.txt b/bitnami/nginx/templates/NOTES.txt new file mode 100644 index 000000000..d24052057 --- /dev/null +++ b/bitnami/nginx/templates/NOTES.txt @@ -0,0 +1,6 @@ +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/nginx/values.yaml b/bitnami/nginx/values.yaml index 0c2bd5bdd..e30b2a5db 100644 --- a/bitnami/nginx/values.yaml +++ b/bitnami/nginx/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/nginx - tag: 1.16.0 + tag: 1.16.0-debian-9-r26 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -32,7 +32,7 @@ image: service: type: LoadBalancer ## Provide optional annotations to the service i.e. for external-dns - # annotations: + # annotations: # external-dns.alpha.kubernetes.io/hostname: yourservicename.k8s.yourcompany.com ## ## HTTP Port diff --git a/bitnami/node/Chart.yaml b/bitnami/node/Chart.yaml index 7bbde10e2..3b9a49b69 100644 --- a/bitnami/node/Chart.yaml +++ b/bitnami/node/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: node -version: 8.1.5 -appVersion: 10.15.3 +version: 8.1.8 +appVersion: 10.16.0 description: Event-driven I/O server-side JavaScript environment based on V8 keywords: - node diff --git a/bitnami/node/README.md b/bitnami/node/README.md index 07ca214ba..66b2d5ab1 100644 --- a/bitnami/node/README.md +++ b/bitnami/node/README.md @@ -56,7 +56,7 @@ The following table lists the configurable parameters of the Node chart and thei | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | NodeJS image registry | `docker.io` | | `image.repository` | NodeJS image name | `bitnami/node` | -| `image.tag` | NodeJS image tag | `{VERSION}` | +| `image.tag` | NodeJS image tag | `{TAG_NAME}` | | `image.pullPolicy` | NodeJS image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `git.registry` | Git image registry | `docker.io` | @@ -115,6 +115,12 @@ $ helm install --name my-release -f values.yaml bitnami/node > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Node](https://github.com/bitnami/bitnami-docker-node) image stores the Node application and configurations at the `/app` path of the container. diff --git a/bitnami/node/templates/NOTES.txt b/bitnami/node/templates/NOTES.txt index a245510fe..2a6c7f2c4 100644 --- a/bitnami/node/templates/NOTES.txt +++ b/bitnami/node/templates/NOTES.txt @@ -21,3 +21,5 @@ echo "Node app URL: http://127.0.0.1:{{ .Values.service.port }}/" {{- end }} + +{{ include "node.checkRollingTags" . }} diff --git a/bitnami/node/templates/_helpers.tpl b/bitnami/node/templates/_helpers.tpl index c5e3b6110..35d68681b 100644 --- a/bitnami/node/templates/_helpers.tpl +++ b/bitnami/node/templates/_helpers.tpl @@ -121,3 +121,15 @@ imagePullSecrets: {{- end }} {{- end -}} {{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "node.checkRollingTags" -}} +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.git.repository) (not (.Values.git.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.git.repository }}:{{ .Values.git.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- end -}} diff --git a/bitnami/node/values.yaml b/bitnami/node/values.yaml index 58b1fef6c..83f0f69f6 100644 --- a/bitnami/node/values.yaml +++ b/bitnami/node/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/node - tag: 10.15.3 + tag: 10.16.0-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -32,7 +32,7 @@ image: git: registry: docker.io repository: bitnami/git - tag: latest + tag: 2.21.0-debian-9-r72 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/pytorch/.helmignore b/bitnami/pytorch/.helmignore new file mode 100644 index 000000000..50af03172 --- /dev/null +++ b/bitnami/pytorch/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/bitnami/pytorch/Chart.yaml b/bitnami/pytorch/Chart.yaml new file mode 100644 index 000000000..c4010ac91 --- /dev/null +++ b/bitnami/pytorch/Chart.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +name: pytorch +version: 0.0.4 +appVersion: 1.1.0 +description: Deep learning platform that accelerates the transition from research prototyping to production deployment +keywords: +- pytorch +- python +- machine +- learning +home: http://pytorch.org/ +sources: +- https://github.com/bitnami/bitnami-docker-pytorch +maintainers: +- name: Bitnami + email: containers@bitnami.com +engine: gotpl +icon: https://bitnami.com/assets/stacks/pytorch/img/pytorch-stack-110x117.png \ No newline at end of file diff --git a/bitnami/pytorch/README.md b/bitnami/pytorch/README.md new file mode 100644 index 000000000..04dd37d07 --- /dev/null +++ b/bitnami/pytorch/README.md @@ -0,0 +1,164 @@ +# PyTorch + +[PyTorch](http://pytorch.org/) is a deep learning platform that accelerates the transition from research prototyping to production deployment. It is built for full integration into Python that enables you to use it with its libraries and main packages. + +## TL;DR; + +```console +$ helm install bitnami/pytorch +``` + +## Introduction + +This chart bootstraps a [PyTorch](https://github.com/bitnami/bitnami-docker-pytorch) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment and management of Helm Charts in clusters. This Helm chart has been tested on top of [Bitnami Kubernetes Production Runtime](https://kubeprod.io/) (BKPR). Deploy BKPR to get automated TLS certificates, logging and monitoring for your applications. + +## Prerequisites + +- Kubernetes 1.8+ with Beta APIs enabled +- PV provisioner support in the underlying infrastructure + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +$ helm install --name my-release bitnami/pytorch +``` + +The command deploys PyTorch on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured. + +> **Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +$ helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following table lists the configurable parameters of the MinIO chart and their default values. + +| Parameter | Description | Default | +| ------------------------------------ | -------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | PyTorch image registry | `docker.io` | +| `image.repository` | PyTorch image name | `bitnami/pytorch` | +| `image.tag` | PyTorch image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug logs should be enabled | `false` | +| `git.registry` | Git image registry | `docker.io` | +| `git.repository` | Git image name | `bitnami/git` | +| `git.tag` | Git image tag | `latest` | +| `git.pullPolicy` | Git image pull policy | `Always` | +| `git.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| service.type | Kubernetes service type | `ClusterIP` | +| `entrypoint.file` | Main entrypoint to your application | `''` | +| `entrypoint.args` | Args required by your entrypoint | `nil` | +| `mode` | Run PyTorch in standalone or distributed mode (possible values: `standalone`, `distributed`) | `standalone` | +| `worldSize` | Number of nodes that will execute your code | `nil` | +| `port` | PyTorch master port | `49875` | +| `configMap` | Config map that contains the files you want to load in PyTorch | `nil` | +| `cloneFilesFromGit.enabled` | Enable in order to download files from git repository | `false` | +| `cloneFilesFromGit.repository` | Repository that holds the files | `nil` | +| `cloneFilesFromGit.revision` | Revision from the repository to checkout | `master` | +| `extraEnvVars` | Extra environment variables to add to master and workers pods | `nil` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `[]` | +| `affinity` | Map of node/pod affinities | `{}` | +| `resources` | Pod resources | `{}` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `5` | +| `livenessProbe.periodSeconds` | How often to perform the probe | `5` | +| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `readinessProbe.enabled` | Enable/disable the Readiness probe | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | +| `readinessProbe.periodSeconds` | How often to perform the probe | `5` | +| `readinessProbe.timeoutSeconds` | When the probe times out | `1` | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `persistence.enabled` | Use a PVC to persist data | `true` | +| `persistence.mountPath` | Path to mount the volume at | `/bitnami/pytorch` | +| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | +| `persistence.size` | Size of data volume | `8Gi` | +| `persistence.annotations` | Persistent Volume annotations | `{}` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install --name my-release \ + --set mode=distributed \ + --set worldSize=4 \ + bitnami/pytorch +``` + +The above command create 4 pods for PyTorch: one master and three workers. + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```console +$ helm install --name my-release -f values.yaml bitnami/pytorch +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +## Loading your files + +The PyTorch chart supports three different ways to load your files. In order of priority, they are: + + 1. Existing config map + 2. Files under the `files` directory + 3. Cloning a git repository + +This means that if you specify a config map with your files, it won't look for the `files/` directory nor the git repository. + +In order to use use an existing config map: + +```console +$ helm install --name my-release \ + --set configMap=my-config-map \ + bitnami/pytorch +``` + +To load your files from the `files/` directory you don't have to set any option. Just copy your files inside and don't specify a `ConfigMap`: + +```console +$ helm install --name my-release \ + bitnami/pytorch +``` + +Finally, if you want to clone a git repository: + +```console +$ helm install --name my-release \ + --set cloneFilesFromGit.enabled=true \ + --set cloneFilesFromGit.repository=https://github.com/my-user/my-repo \ + --set cloneFilesFromGit.revision=master \ + bitnami/pytorch +``` + +## Persistence + +The [Bitnami PyTorch](https://github.com/bitnami/bitnami-docker-pytorch) image can persist data. If enabled, the persisted path is `/bitnami/pytorch` by default. + +The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning. diff --git a/bitnami/pytorch/templates/NOTES.txt b/bitnami/pytorch/templates/NOTES.txt new file mode 100644 index 000000000..6af81e2bd --- /dev/null +++ b/bitnami/pytorch/templates/NOTES.txt @@ -0,0 +1,38 @@ +{{- if or (.Values.configMap) (.Files.Glob "files/*") (.Values.cloneFilesFromGit.enabled) }} +{{- if .Values.entrypoint.file }} +The provided file {{ .Values.entrypoint.file }} is being executed. You can see the logs of each running node with: + kubectl logs [POD_NAME] + +and the list of pods: + kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "pytorch.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" +{{- else }} +You didn't specify any entrypoint to your code. +To run it, you can either deploy again using the `pytorch.entrypoint.file` option to specify your entrypoint, or execute it manually by jumping into the pods: + +1. Get the running pods + kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "pytorch.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" + +2. Get into a pod + kubectl exec -ti [POD_NAME] bash + +3. Execute your script as you would normally do. +{{- end }} +{{- else }} +WARNING: You haven't loaded any file. You can access the Python REPL by jumping into the pods: + +1. Get the running pods + kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "pytorch.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" + +2. Run the Python REPL + kubectl exec -ti [POD_NAME] python + +This chart allows three different methods to load your files: + +1. Load the files from an existing ConfigMap, using the `configMap` option. +2. Putting your files in a `files` folder in the root of the Chart. +3. Cloning a Git repository with the `cloneFilesFromGit` option. + +Examples for the different methods can be found in the README. +{{- end }} +{{ include "pytorch.validateValues" . }} +{{ include "pytorch.checkRollingTags" . }} diff --git a/bitnami/pytorch/templates/_helpers.tpl b/bitnami/pytorch/templates/_helpers.tpl new file mode 100644 index 000000000..5792a4ce5 --- /dev/null +++ b/bitnami/pytorch/templates/_helpers.tpl @@ -0,0 +1,159 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "pytorch.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "pytorch.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "pytorch.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Return the proper PyTorch image name +*/}} +{{- define "pytorch.image" -}} +{{- $registryName := .Values.image.registry -}} +{{- $repositoryName := .Values.image.repository -}} +{{- $tag := .Values.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper git image name +*/}} +{{- define "git.image" -}} +{{- $registryName := .Values.git.registry -}} +{{- $repositoryName := .Values.git.repository -}} +{{- $tag := .Values.git.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "pytorch.imagePullSecrets" -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. +Also, we can not use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} +{{- if .Values.global.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.global.imagePullSecrets }} + - name: {{ . }} +{{- end }} +{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets }} +imagePullSecrets: +{{- range .Values.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.git.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets }} +imagePullSecrets: +{{- range .Values.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.git.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "pytorch.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "pytorch.validateValues.mode" .) -}} +{{- $messages := append $messages (include "pytorch.validateValues.worldSize" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* Validate values of PyTorch - must provide a valid mode ("distributed" or "standalone") */}} +{{- define "pytorch.validateValues.mode" -}} +{{- if and (ne .Values.mode "distributed") (ne .Values.mode "standalone") -}} +pytorch: mode + Invalid mode selected. Valid values are "distributed" and + "standalone". Please set a valid mode (--set mode="xxxx") +{{- end -}} +{{- end -}} + +{{/* Validate values of PyTorch - number of replicas must be even, greater than 4 and lower than 32 */}} +{{- define "pytorch.validateValues.worldSize" -}} +{{- $replicaCount := int .Values.worldSize }} +{{- if and (eq .Values.mode "distributed") (lt $replicaCount 24) -}} +pytorch: worldSize + World size must be greater than 1 in distributed mode!! + Please set a valid world size (--set worldSize=X) +{{- end -}} +{{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "pytorch.checkRollingTags" -}} +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.git.repository) (not (.Values.git.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.git.repository }}:{{ .Values.git.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- end -}} diff --git a/bitnami/pytorch/templates/configmap.yaml b/bitnami/pytorch/templates/configmap.yaml new file mode 100644 index 000000000..e99a4ba31 --- /dev/null +++ b/bitnami/pytorch/templates/configmap.yaml @@ -0,0 +1,13 @@ +{{- if .Files.Glob "files/*" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "pytorch.fullname" . }}-files + labels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + helm.sh/chart: {{ include "pytorch.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +data: +{{ (.Files.Glob "files/*").AsConfig | indent 2 }} +{{ end }} \ No newline at end of file diff --git a/bitnami/pytorch/templates/deployment.yaml b/bitnami/pytorch/templates/deployment.yaml new file mode 100644 index 000000000..fab7d3a42 --- /dev/null +++ b/bitnami/pytorch/templates/deployment.yaml @@ -0,0 +1,146 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "pytorch.fullname" . }}{{ if eq .Values.mode "distributed" }}-master{{ end }} + labels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + helm.sh/chart: {{ include "pytorch.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "master" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: "master" + template: + metadata: + labels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + helm.sh/chart: {{ include "pytorch.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "master" + spec: + {{- include "pytorch.imagePullSecrets" . | nindent 6 }} + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.cloneFilesFromGit.enabled }} + initContainers: + - name: git-clone-repository + image: {{ include "git.image" . }} + imagePullPolicy: {{ .Values.git.pullPolicy | quote }} + command: + - /bin/sh + - -c + - | + git clone {{ .Values.cloneFilesFromGit.repository }} /app + cd /app + git checkout {{ .Values.cloneFilesFromGit.revision }} + volumeMounts: + - name: git-cloned-files + mountPath: /app + {{- end }} + containers: + - name: master + image: {{ include "pytorch.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - bash + - -c + - | + {{- if .Values.entrypoint.file }} + python {{ .Values.entrypoint.file }} {{ if .Values.entrypoint.args }}{{ .Values.entrypoint.args }}{{ end }} + {{- end }} + sleep infinity + env: + {{- if eq .Values.mode "distributed" }} + - name: MASTER_ADDR + value: "127.0.0.1" + - name: MASTER_PORT + value: {{ .Values.port | quote }} + - name: WORLD_SIZE + value: {{ .Values.worldSize | quote }} + - name: RANK + value: "0" + {{- end }} +{{- if .Values.extraEnvVars }} +{{ toYaml .Values.extraEnvVars | indent 8 }} +{{- end }} + ports: + - name: pytorch + containerPort: {{ .Values.port }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: + exec: + command: + - python + - -c + - import torch; torch.__version__ + initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: + exec: + command: + - python + - -c + - import torch; torch.__version__ + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + {{- end }} + resources: {{ toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- if .Values.configMap }} + - name: ext-files + mountPath: /app + {{- else if .Files.Glob "files/*" }} + - name: local-files + mountPath: /app + {{- else if .Values.cloneFilesFromGit.enabled }} + - name: git-cloned-files + mountPath: /app + {{- end }} + - name: data + mountPath: {{ .Values.persistence.mountPath }} + volumes: + {{- if .Values.configMap }} + - name: ext-files + configMap: + name: {{ .Values.configMap }} + {{- else if .Files.Glob "files/*" }} + - name: local-files + configMap: + name: {{ include "pytorch.fullname" . }}-files + {{- else if .Values.cloneFilesFromGit.enabled }} + - name: git-cloned-files + emptyDir: {} + {{- end }} + - name: data + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ include "pytorch.fullname" . }}{{ if eq .Values.mode "distributed" }}-master{{ end }} + {{- else }} + emptyDir: {} + {{- end }} diff --git a/bitnami/pytorch/templates/pvc.yaml b/bitnami/pytorch/templates/pvc.yaml new file mode 100644 index 000000000..894a5236d --- /dev/null +++ b/bitnami/pytorch/templates/pvc.yaml @@ -0,0 +1,26 @@ +{{- if .Values.persistence.enabled }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ include "pytorch.fullname" . }}{{ if eq .Values.mode "distributed" }}-master{{ end }} + labels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + helm.sh/chart: {{ include "pytorch.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +spec: + accessModes: + {{- range .Values.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + {{- if .Values.persistence.storageClass }} + {{- if (eq "-" .Values.persistence.storageClass) }} + storageClassName: "" + {{- else }} + storageClassName: "{{ .Values.persistence.storageClass }}" + {{- end }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/bitnami/pytorch/templates/service.yaml b/bitnami/pytorch/templates/service.yaml new file mode 100644 index 000000000..abd15111f --- /dev/null +++ b/bitnami/pytorch/templates/service.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "pytorch.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + helm.sh/chart: {{ include "pytorch.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "master" +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.port }} + targetPort: pytorch + name: pytorch + selector: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: "master" diff --git a/bitnami/pytorch/templates/statefulset.yml b/bitnami/pytorch/templates/statefulset.yml new file mode 100644 index 000000000..c6ad52746 --- /dev/null +++ b/bitnami/pytorch/templates/statefulset.yml @@ -0,0 +1,166 @@ +{{- if eq .Values.mode "distributed" }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "pytorch.fullname" . }}-worker + labels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + helm.sh/chart: {{ include "pytorch.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "worker" +spec: + selector: + matchLabels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: "worker" + replicas: {{ sub .Values.worldSize 1 }} + template: + metadata: + labels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + helm.sh/chart: {{ include "pytorch.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: "worker" + spec: + {{- include "pytorch.imagePullSecrets" . | nindent 6 }} + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.cloneFilesFromGit.enabled }} + initContainers: + - name: git-clone-repository + image: {{ include "git.image" . }} + imagePullPolicy: {{ .Values.git.pullPolicy | quote }} + command: + - /bin/sh + - -c + - | + git clone {{ .Values.cloneFilesFromGit.repository }} /app + cd /app + git checkout {{ .Values.cloneFilesFromGit.revision }} + volumeMounts: + - name: git-cloned-files + mountPath: /app + {{- end }} + containers: + - name: worker + image: {{ include "pytorch.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - bash + - -c + - | + RANK=${POD_NAME##*-} + ((RANK++)) + export RANK + {{- if .Values.entrypoint.file }} + python {{ .Values.entrypoint.file }} {{ if .Values.entrypoint.args }}{{ .Values.entrypoint.args }}{{ end }} + {{- end }} + sleep infinity + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: MASTER_ADDR + value: {{ include "pytorch.fullname" . }} + - name: MASTER_PORT + value: {{ .Values.port | quote }} + - name: WORLD_SIZE + value: {{ .Values.worldSize | quote }} +{{- if .Values.extraEnvVars }} +{{ toYaml .Values.extraEnvVars | indent 8 }} +{{- end }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: + exec: + command: + - python + - -c + - import torch; torch.__version__ + initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: + exec: + command: + - python + - -c + - import torch; torch.__version__ + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + {{- end }} + resources: {{ toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- if .Values.configMap }} + - name: ext-files + mountPath: /app + {{- else if .Files.Glob "files/*" }} + - name: local-files + mountPath: /app + {{- else if .Values.cloneFilesFromGit.enabled }} + - name: git-cloned-files + mountPath: /app + {{- end }} + - name: data + mountPath: {{ .Values.persistence.mountPath }} + volumes: + {{- if .Values.configMap }} + - name: ext-files + configMap: + name: {{ .Values.configMap }} + {{- else if .Files.Glob "files/*" }} + - name: local-files + configMap: + name: {{ include "pytorch.fullname" . }}-files + {{- else if .Values.cloneFilesFromGit.enabled }} + - name: git-cloned-files + emptyDir: {} + {{- end }} + {{- if .Values.persistence.enabled }} + volumeClaimTemplates: + - metadata: + name: data + labels: + app.kubernetes.io/name: {{ include "pytorch.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + {{- if .Values.persistence.annotations }} + annotations: {{ toYaml .Values.persistence.annotations | nindent 8 }} + {{- end }} + spec: + accessModes: {{ toYaml .Values.persistence.accessModes | nindent 8 }} + {{- if .Values.persistence.storageClass }} + {{- if (eq "-" .Values.persistence.storageClass) }} + storageClassName: "" + {{- else }} + storageClassName: {{ .Values.persistence.storageClass | quote }} + {{- end }} + {{- end }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} + {{- else }} + - name: data + emptyDir: {} + {{- end }} +{{- end }} diff --git a/bitnami/pytorch/values-production.yaml b/bitnami/pytorch/values-production.yaml new file mode 100644 index 000000000..43671f67f --- /dev/null +++ b/bitnami/pytorch/values-production.yaml @@ -0,0 +1,173 @@ +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## +# global: +# imageRegistry: myRegistryName +# imagePullSecrets: +# - myRegistryKeySecretName + +## Bitnami PyTorch image version +## ref: https://hub.docker.com/r/bitnami/pytorch/tags/ +## +image: + registry: docker.io + repository: bitnami/pytorch + tag: 1.1.0-debian-9-r15 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + ## + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami git image version +## ref: https://hub.docker.com/r/bitnami/git/tags/ +## +git: + registry: docker.io + repository: bitnami/git + tag: 2.21.0-debian-9-r72 + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + +service: + ## Kubernetes service type, ClusterIP and NodePort are supported at present + type: ClusterIP + +## PyTorch configuration +## +## The main entrypoint of your app, this will be executed as: +## python [file] [args] +entrypoint: + file: + #args: + +## Set to `distributed` in order to enable distributed mode +## mode: distributed +## +mode: distributed + +## Number of nodes that will run the code +## WORLD_SIZE will be set to this value +## +worldSize: 4 + +## The port used to comunicate with the master +## MASTER_PORT will be set to this value +## +port: 49875 + +## Name of an existing config map containing all the files you want to load in PyTorch +## +#configMap: + +## Enable in order to download files from git repository. +## +cloneFilesFromGit: + enabled: false +# repository: +# revision: master + +## Additional environment variables +## +# extraEnvVars: +# - name: NCCL_DEBUG +# value: "INFO" +# - name: NCCL_DEBUG_SUBSYS +# value: "ALL" + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} + +## Tolerations for pod assignment +## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +## +tolerations: [] + +## Affinity for pod assignment +## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +## +affinity: {} + +## Configure resource requests and limits +## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## +resources: {} + +## Pod Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + +## Configure liveness and readiness probes +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) +## +livenessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 +readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + +## Enable persistence using Persistent Volume Claims +## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ +## +persistence: + ## If true, use a Persistent Volume Claim + ## + enabled: true + + ## Data volume mount path + ## + mountPath: /bitnami/pytorch + + ## Persistent Volume Access Mode + ## + accessModes: + - ReadWriteOnce + + ## Persistent Volume size + ## + size: 8Gi + + ## Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + + ## Persistent Volume Claim annotations + ## + annotations: {} diff --git a/bitnami/pytorch/values.yaml b/bitnami/pytorch/values.yaml new file mode 100644 index 000000000..0addf50a2 --- /dev/null +++ b/bitnami/pytorch/values.yaml @@ -0,0 +1,173 @@ +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## +# global: +# imageRegistry: myRegistryName +# imagePullSecrets: +# - myRegistryKeySecretName + +## Bitnami PyTorch image version +## ref: https://hub.docker.com/r/bitnami/pytorch/tags/ +## +image: + registry: docker.io + repository: bitnami/pytorch + tag: 1.1.0-debian-9-r15 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + ## + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + debug: false + +## Bitnami git image version +## ref: https://hub.docker.com/r/bitnami/git/tags/ +## +git: + registry: docker.io + repository: bitnami/git + tag: 2.21.0-debian-9-r72 + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + +service: + ## Kubernetes service type, ClusterIP and NodePort are supported at present + type: ClusterIP + +## PyTorch configuration +## +## The main entrypoint of your app, this will be executed as: +## python [file] [args] +entrypoint: + file: + #args: + +## Set to `distributed` in order to enable distributed mode +## mode: distributed +## +mode: standalone + +## Number of nodes that will run the code +## WORLD_SIZE will be set to this value +## +#worldSize: + +## The port used to comunicate with the master +## MASTER_PORT will be set to this value +## +port: 49875 + +## Name of an existing config map containing all the files you want to load in PyTorch +## +#configMap: + +## Enable in order to download files from git repository. +## +cloneFilesFromGit: + enabled: false +# repository: +# revision: master + +## Additional environment variables +## +# extraEnvVars: +# - name: NCCL_DEBUG +# value: "INFO" +# - name: NCCL_DEBUG_SUBSYS +# value: "ALL" + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} + +## Tolerations for pod assignment +## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +## +tolerations: [] + +## Affinity for pod assignment +## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +## +affinity: {} + +## Configure resource requests and limits +## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## +resources: {} + +## Pod Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + enabled: true + fsGroup: 1001 + runAsUser: 1001 + +## Configure liveness and readiness probes +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) +## +livenessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 +readinessProbe: + enabled: true + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + +## Enable persistence using Persistent Volume Claims +## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ +## +persistence: + ## If true, use a Persistent Volume Claim + ## + enabled: true + + ## Data volume mount path + ## + mountPath: /bitnami/pytorch + + ## Persistent Volume Access Mode + ## + accessModes: + - ReadWriteOnce + + ## Persistent Volume size + ## + size: 8Gi + + ## Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + + ## Persistent Volume Claim annotations + ## + annotations: {} diff --git a/bitnami/tensorflow-resnet/Chart.yaml b/bitnami/tensorflow-resnet/Chart.yaml index 63003a76c..e73655de6 100755 --- a/bitnami/tensorflow-resnet/Chart.yaml +++ b/bitnami/tensorflow-resnet/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: tensorflow-resnet -version: 0.1.2 +version: 0.1.4 appVersion: 1.13.0 description: Open-source software library serving the ResNet machine learning model. keywords: diff --git a/bitnami/tensorflow-resnet/README.md b/bitnami/tensorflow-resnet/README.md index 295bd1286..30a719fae 100755 --- a/bitnami/tensorflow-resnet/README.md +++ b/bitnami/tensorflow-resnet/README.md @@ -66,14 +66,14 @@ The following tables lists the configurable parameters of the TensorFlow ResNet | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `server.image.registry` | TensorFlow Serving image registry | `docker.io` | | `server.image.repository` | TensorFlow Serving Image name | `bitnami/tensorflow-serving` | -| `server.image.tag` | TensorFlow Serving Image tag | `{VERSION}` | +| `server.image.tag` | TensorFlow Serving Image tag | `{TAG_NAME}` | | `server.image.pullPolicy` | TensorFlow Serving image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `server.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `replicaCount` | Desired number of pods | `1` | | `server.port` | Tensorflow server port | `8500` | | `client.image.registry` | TensorFlow ResNet image registry | `docker.io` | | `client.image.repository` | TensorFlow ResNet Image name | `bitnami/tensorflow-resnet` | -| `client.image.tag` | TensorFlow ResNet Image tag | `{VERSION}` | +| `client.image.tag` | TensorFlow ResNet Image tag | `{TAG_NAME}` | | `client.image.pullPolicy` | TensorFlow ResNet image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `client.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `imagePullPolicy` | Image pull policy | `Always` if `image` tag is `latest`, else `IfNotPresent` | @@ -125,3 +125,9 @@ $ helm install --name my-release -f values.yaml bitnami/tensorflow-resnet ``` > **Tip**: You can use the default [values.yaml](values.yaml) + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. diff --git a/bitnami/tensorflow-resnet/templates/NOTES.txt b/bitnami/tensorflow-resnet/templates/NOTES.txt index 083106f27..be4367846 100755 --- a/bitnami/tensorflow-resnet/templates/NOTES.txt +++ b/bitnami/tensorflow-resnet/templates/NOTES.txt @@ -27,4 +27,6 @@ 2. Test the server with a sample image. - docker run --rm -it bitnami/tensorflow-resnet bash -c "curl -Lo /tmp/cat.jpg https://tensorflow.org/images/blogs/serving/cat.jpg && resnet_client_cc --server_port=$APP_HOST:$APP_PORT --image_file=/tmp/cat.jpg" \ No newline at end of file + docker run --rm -it bitnami/tensorflow-resnet bash -c "curl -Lo /tmp/cat.jpg https://tensorflow.org/images/blogs/serving/cat.jpg && resnet_client_cc --server_port=$APP_HOST:$APP_PORT --image_file=/tmp/cat.jpg" + +{{ include "tensorflow-resnet.checkRollingTags" . }} diff --git a/bitnami/tensorflow-resnet/templates/_helpers.tpl b/bitnami/tensorflow-resnet/templates/_helpers.tpl index 3acf143b4..116ecfe30 100644 --- a/bitnami/tensorflow-resnet/templates/_helpers.tpl +++ b/bitnami/tensorflow-resnet/templates/_helpers.tpl @@ -124,3 +124,15 @@ imagePullSecrets: {{- end }} {{- end -}} {{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "tensorflow-resnet.checkRollingTags" -}} +{{- if and (contains "bitnami/" .Values.server.image.repository) (not (.Values.server.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.server.image.repository }}:{{ .Values.server.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.client.image.repository) (not (.Values.client.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .Values.client.image.repository }}:{{ .Values.client.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- end -}} diff --git a/bitnami/tensorflow-resnet/values.yaml b/bitnami/tensorflow-resnet/values.yaml index b27f7e74c..1a8601529 100755 --- a/bitnami/tensorflow-resnet/values.yaml +++ b/bitnami/tensorflow-resnet/values.yaml @@ -16,7 +16,7 @@ server: image: registry: docker.io repository: bitnami/tensorflow-serving - tag: 1.13.0 + tag: 1.13.0-debian-9-r62 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -37,7 +37,7 @@ client: image: registry: docker.io repository: bitnami/tensorflow-resnet - tag: 1.13.0 + tag: 1.13.0-debian-9-r63 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/tomcat/Chart.yaml b/bitnami/tomcat/Chart.yaml index f6e3f1ac7..ac748c8b4 100644 --- a/bitnami/tomcat/Chart.yaml +++ b/bitnami/tomcat/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: tomcat -version: 2.2.2 -appVersion: 8.5.40 +version: 3.0.3 +appVersion: 9.0.20 description: Chart for Apache Tomcat keywords: - tomcat diff --git a/bitnami/tomcat/README.md b/bitnami/tomcat/README.md index 6314fba22..017006612 100644 --- a/bitnami/tomcat/README.md +++ b/bitnami/tomcat/README.md @@ -51,7 +51,7 @@ The following tables lists the configurable parameters of the Tomcat chart and t | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods)| | `image.registry` | Tomcat image registry | `docker.io` | | `image.repository` | Tomcat Image name | `bitnami/tomcat` | -| `image.tag` | Tomcat Image tag | `{VERSION}` | +| `image.tag` | Tomcat Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Tomcat image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `tomcatUsername` | Tomcat admin user | `user` | @@ -90,6 +90,12 @@ $ helm install --name my-release -f values.yaml bitnami/tomcat > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Tomcat](https://github.com/bitnami/bitnami-docker-tomcat) image stores the Tomcat data and configurations at the `/bitnami/tomcat` path of the container. diff --git a/bitnami/tomcat/templates/NOTES.txt b/bitnami/tomcat/templates/NOTES.txt index e8bfa5831..9cb46f661 100644 --- a/bitnami/tomcat/templates/NOTES.txt +++ b/bitnami/tomcat/templates/NOTES.txt @@ -28,3 +28,10 @@ echo Username: {{ .Values.tomcatUsername }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.tomcat-password}" | base64 --decode) + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/tomcat/values.yaml b/bitnami/tomcat/values.yaml index ee0659ceb..6ec11ddd5 100644 --- a/bitnami/tomcat/values.yaml +++ b/bitnami/tomcat/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/tomcat - tag: 8.5.40 + tag: 9.0.20-debian-9-r15 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -24,7 +24,7 @@ image: ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ## # pullSecrets: - # - myRegistryKeySecretName + # - myRegistryKeySecretName ## Pod Security Context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ diff --git a/bitnami/wildfly/Chart.yaml b/bitnami/wildfly/Chart.yaml index 7c3490b9f..4345ee6e4 100644 --- a/bitnami/wildfly/Chart.yaml +++ b/bitnami/wildfly/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: wildfly -version: 2.2.1 +version: 2.2.3 appVersion: 16.0.0 description: Chart for Wildfly keywords: diff --git a/bitnami/wildfly/README.md b/bitnami/wildfly/README.md index 80c477750..478b29269 100644 --- a/bitnami/wildfly/README.md +++ b/bitnami/wildfly/README.md @@ -51,7 +51,7 @@ The following tables lists the configurable parameters of the WildFly chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | WildFly image registry | `docker.io` | | `image.repository` | WildFly Image name | `bitnami/wildfly` | -| `image.tag` | WildFly Image tag | `{VERSION}` | +| `image.tag` | WildFly Image tag | `{TAG_NAME}` | | `image.pullPolicy` | WildFly image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `wildflyUsername` | WildFly admin user | `user` | @@ -92,6 +92,12 @@ $ helm install --name my-release -f values.yaml bitnami/wildfly > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami WildFly](https://github.com/bitnami/bitnami-docker-wildfly) image stores the WildFly data and configurations at the `/bitnami/wildfly` path of the container. diff --git a/bitnami/wildfly/templates/NOTES.txt b/bitnami/wildfly/templates/NOTES.txt index 14ff56213..d9293cbad 100644 --- a/bitnami/wildfly/templates/NOTES.txt +++ b/bitnami/wildfly/templates/NOTES.txt @@ -28,3 +28,10 @@ echo Username: {{ .Values.wildflyUsername }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.wildfly-password}" | base64 --decode) + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/wildfly/values.yaml b/bitnami/wildfly/values.yaml index 26037c34d..330514b57 100644 --- a/bitnami/wildfly/values.yaml +++ b/bitnami/wildfly/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/wildfly - tag: 16.0.0 + tag: 16.0.0-debian-9-r57 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -24,7 +24,7 @@ image: ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ## # pullSecrets: - # - myRegistryKeySecretName + # - myRegistryKeySecretName ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/bitnami/zookeeper/Chart.yaml b/bitnami/zookeeper/Chart.yaml index 09be7d67a..dc4a54bbb 100644 --- a/bitnami/zookeeper/Chart.yaml +++ b/bitnami/zookeeper/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: zookeeper -version: 2.1.0 +version: 2.2.4 appVersion: 3.4.14 description: A centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services for distributed applications. keywords: diff --git a/bitnami/zookeeper/README.md b/bitnami/zookeeper/README.md index 31e9b1d15..c5fb33ad0 100644 --- a/bitnami/zookeeper/README.md +++ b/bitnami/zookeeper/README.md @@ -41,6 +41,10 @@ $ helm delete my-release The command removes all the Kubernetes components associated with the chart and deletes the release. +## Log level + +You can configure the Zookeeper log level using the `ZOO_LOG_LEVEL` environment variable. By default, it is set to `ERROR` because of each readiness probe produce an `INFO` message on connection and a `WARN` message on disconnection. + ## Configuration The following tables lists the configurable parameters of the Zookeeper chart and their default values. @@ -51,10 +55,12 @@ The following tables lists the configurable parameters of the Zookeeper chart an | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Zookeeper image registry | `docker.io` | | `image.repository` | Zookeeper Image name | `bitnami/zookeeper` | -| `image.tag` | Zookeeper Image tag | `{VERSION}` | +| `image.tag` | Zookeeper Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Zookeeper image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug values should be set | `false` | +| `nameOverride` | String to partially override zookeeper.fullname template with a string (will append the release name) | `nil` | +| `fullnameOverride` | String to fully override zookeeper.fullname template with a string | `nil` | | `updateStrategy` | Update strategies | `RollingUpdate` | | `podDisruptionBudget.maxUnavailable` | Max number of pods down simultaneously | `1` | | `rollingUpdatePartition` | Partition update strategy | `nil` | @@ -69,9 +75,10 @@ The following tables lists the configurable parameters of the Zookeeper chart an | `auth.enabled` | Enable Zookeeper auth | `false` | | `auth.clientUser` | User that will use Zookeeper clients to auth | `nil` | | `auth.clientPassword` | Password that will use Zookeeper clients to auth | `nil` | -| `auth.serverUsers` | List of user to be created | `[]` | -| `auth.serverPasswords` | List of passwords to assign to users when created | `[]` | +| `auth.serverUsers` | List of user to be created | `nil` | +| `auth.serverPasswords` | List of passwords to assign to users when created | `nil` | | `heapSize` | Size in MB for the Java Heap options (Xmx and XMs) | `[]` | +| `logLevel` | Log level of Zookeeper server | `ERROR` | | `jvmFlags` | Default JVMFLAGS for the ZooKeeper process | `nil` | | `config` | Configure ZooKeeper with a custom zoo.conf file | `nil` | | `service.type` | Kubernetes Service type | `ClusterIP` | @@ -113,6 +120,7 @@ The following tables lists the configurable parameters of the Zookeeper chart an | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9141"}` | | `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | | `metrics.tolerations` | Exporter toleration labels for pod assignment | `[]` | +| `metrics.timeoutSeconds` | Timeout in seconds the exporter uses to scrape its targets | 3 | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -132,6 +140,12 @@ $ helm install --name my-release -f values.yaml bitnami/zookeeper > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Zookeeper](https://github.com/bitnami/bitnami-docker-zookeeper) image stores the Zookeeper data and configurations at the `/bitnami/zookeeper` path of the container. diff --git a/bitnami/zookeeper/templates/NOTES.txt b/bitnami/zookeeper/templates/NOTES.txt index efee5f277..83686c7d0 100644 --- a/bitnami/zookeeper/templates/NOTES.txt +++ b/bitnami/zookeeper/templates/NOTES.txt @@ -48,3 +48,10 @@ To connect to your ZooKeeper server from outside the cluster execute the followi zkCli.sh 127.0.0.1:2181 {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/bitnami/zookeeper/templates/_helpers.tpl b/bitnami/zookeeper/templates/_helpers.tpl index 2a8946e1a..fac78d68c 100644 --- a/bitnami/zookeeper/templates/_helpers.tpl +++ b/bitnami/zookeeper/templates/_helpers.tpl @@ -9,10 +9,19 @@ Expand the name of the chart. {{/* Create a default fully qualified app name. We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. */}} {{- define "zookeeper.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 24 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 24 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 24 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} {{- end -}} {{/* diff --git a/bitnami/zookeeper/templates/metrics-deployment.yaml b/bitnami/zookeeper/templates/metrics-deployment.yaml index 3f34bfce3..46d65c229 100644 --- a/bitnami/zookeeper/templates/metrics-deployment.yaml +++ b/bitnami/zookeeper/templates/metrics-deployment.yaml @@ -39,6 +39,8 @@ spec: name: zookeeper-exporter command: - /usr/local/bin/zookeeper-exporter + - -timeout + - {{ .Values.metrics.timeoutSeconds | quote }} - -zk-list {{- $replicaCount := int .Values.replicaCount }} {{- $followerPort := int .Values.service.followerPort }} @@ -52,4 +54,14 @@ spec: - name: metrics containerPort: 8080 resources: {{ toYaml .Values.metrics.resources | nindent 10 }} + livenessProbe: + httpGet: + path: /metrics + port: metrics + initialDelaySeconds: 180 + readinessProbe: + httpGet: + path: /metrics + port: metrics + initialDelaySeconds: 15 {{- end }} diff --git a/bitnami/zookeeper/templates/statefulset.yaml b/bitnami/zookeeper/templates/statefulset.yaml index c56e17575..9d8a768c2 100644 --- a/bitnami/zookeeper/templates/statefulset.yaml +++ b/bitnami/zookeeper/templates/statefulset.yaml @@ -115,6 +115,8 @@ spec: {{- end }} - name: ZOO_HEAP_SIZE value: {{ .Values.heapSize | quote }} + - name: ZOO_LOG_LEVEL + value: {{ .Values.logLevel | quote }} - name: ALLOW_ANONYMOUS_LOGIN value: {{ ternary "yes" "no" .Values.allowAnonymousLogin | quote }} {{- if .Values.jvmFlags }} diff --git a/bitnami/zookeeper/values-production.yaml b/bitnami/zookeeper/values-production.yaml index 58bb4d51e..53d2e611b 100644 --- a/bitnami/zookeeper/values-production.yaml +++ b/bitnami/zookeeper/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/zookeeper - tag: 3.4.14 + tag: 3.4.14-debian-9-r25 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -31,6 +31,12 @@ image: ## debug: false +## String to partially override zookeeper.fullname template (will maintain the release name) +# nameOverride: + +## String to fully override zookeeper.fullname template +# fullnameOverride: + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## @@ -90,12 +96,12 @@ auth: ## Password that will use Zookeeper clients to auth ## # clientPassword: - ## Comma, semicolon or whitespace separated list of user to be created. Example: user1,user2,admin + ## Comma, semicolon or whitespace separated list of user to be created. Specify them as a string, for example: "user1,user2,admin" ## - # serverUsers: [] - ## Comma, semicolon or whitespace separated list of passwords to assign to users when created. Example: pass4user1, pass4user2, pass4admin + # serverUsers: "" + ## Comma, semicolon or whitespace separated list of passwords to assign to users when created. Specify them as a string, for example: "pass4user1, pass4user2, pass4admin" ## - # serverPasswords: [] + # serverPasswords: "" ## Size in MB for the Java Heap options (Xmx and XMs). This env var is ignored if Xmx an Xms are configured via JVMFLAGS ## @@ -189,8 +195,8 @@ metrics: image: registry: docker.io - repository: javsalgar/zookeeper-exporter - tag: latest + repository: dabealu/zookeeper-exporter + tag: v0.1.0 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -205,6 +211,8 @@ metrics: prometheus.io/port: "9141" podLabels: {} + timeoutSeconds: 3 + ## Metrics exporter resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## diff --git a/bitnami/zookeeper/values.yaml b/bitnami/zookeeper/values.yaml index 2502e51fb..893b90332 100644 --- a/bitnami/zookeeper/values.yaml +++ b/bitnami/zookeeper/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/zookeeper - tag: 3.4.14 + tag: 3.4.14-debian-9-r25 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -31,6 +31,12 @@ image: ## debug: false +## String to partially override zookeeper.fullname template (will maintain the release name) +# nameOverride: + +## String to fully override zookeeper.fullname template +# fullnameOverride: + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## @@ -90,17 +96,21 @@ auth: ## Password that will use Zookeeper clients to auth ## # clientPassword: - ## Comma, semicolon or whitespace separated list of user to be created. Example: user1,user2,admin + ## Comma, semicolon or whitespace separated list of user to be created. Specify them as a string, for example: "user1,user2,admin" ## - # serverUsers: [] - ## Comma, semicolon or whitespace separated list of passwords to assign to users when created. Example: pass4user1, pass4user2, pass4admin + # serverUsers: "" + ## Comma, semicolon or whitespace separated list of passwords to assign to users when created. Specify them as a string, for example: "pass4user1, pass4user2, pass4admin" ## - # serverPasswords: [] + # serverPasswords: "" ## Size in MB for the Java Heap options (Xmx and XMs). This env var is ignored if Xmx an Xms are configured via JVMFLAGS ## heapSize: 1024 +## Log level for the Zookeeper server. ERROR by default. Have in mind if you set it to INFO or WARN the ReadinessProve will produce a lot of logs. +## +logLevel: ERROR + ## Default JVMFLAGS for the ZooKeeper process ## # jvmFlags: @@ -189,8 +199,8 @@ metrics: image: registry: docker.io - repository: javsalgar/zookeeper-exporter - tag: latest + repository: dabealu/zookeeper-exporter + tag: v0.1.0 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -205,6 +215,8 @@ metrics: prometheus.io/port: "9141" podLabels: {} + timeoutSeconds: 3 + ## Metrics exporter resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## diff --git a/library/bitnami-common/Chart.yaml b/library/bitnami-common/Chart.yaml index 8072f2ef5..7f976d1e6 100644 --- a/library/bitnami-common/Chart.yaml +++ b/library/bitnami-common/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 name: bitnami-common -version: 0.0.7 -appVersion: 0.0.7 -description: Chart with custom tempaltes used in Bitnami charts. +version: 0.0.8 +appVersion: 0.0.8 +description: Chart with custom templates used in Bitnami charts. icon: https://bitnami.com/downloads/logos/bitnami-mark.png keywords: - helper diff --git a/upstreamed/dokuwiki/Chart.yaml b/upstreamed/dokuwiki/Chart.yaml index a2805edba..a0152edab 100644 --- a/upstreamed/dokuwiki/Chart.yaml +++ b/upstreamed/dokuwiki/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: dokuwiki -version: 4.2.0 +version: 4.2.2 appVersion: 0.20180422.201901061035 description: DokuWiki is a standards-compliant, simple to use wiki optimized for creating documentation. It is targeted at developer teams, workgroups, and small companies. diff --git a/upstreamed/dokuwiki/README.md b/upstreamed/dokuwiki/README.md index e4c90eec4..26a73f268 100644 --- a/upstreamed/dokuwiki/README.md +++ b/upstreamed/dokuwiki/README.md @@ -51,7 +51,7 @@ The following table lists the configurable parameters of the DokuWiki chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | DokuWiki image registry | `docker.io` | | `image.repository` | DokuWiki image name | `bitnami/dokuwiki` | -| `image.tag` | DokuWiki image tag | `{VERSION}` | +| `image.tag` | DokuWiki image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `dokuwikiUsername` | User of the application | `user` | @@ -109,7 +109,6 @@ The following table lists the configurable parameters of the DokuWiki chart and | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | | `metrics.resources` | Exporter resource requests/limit | {} | - The above parameters map to the env variables defined in [bitnami/dokuwiki](http://github.com/bitnami/bitnami-docker-dokuwiki). For more information please refer to the [bitnami/dokuwiki](http://github.com/bitnami/bitnami-docker-dokuwiki) image documentation. Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -130,6 +129,12 @@ $ helm install --name my-release -f values.yaml stable/dokuwiki > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami DokuWiki](https://github.com/bitnami/bitnami-docker-dokuwiki) image stores the DokuWiki data and configurations at the `/bitnami/dokuwiki` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/dokuwiki/templates/NOTES.txt b/upstreamed/dokuwiki/templates/NOTES.txt index 24b8e605b..79f207579 100644 --- a/upstreamed/dokuwiki/templates/NOTES.txt +++ b/upstreamed/dokuwiki/templates/NOTES.txt @@ -42,3 +42,10 @@ echo Username: {{ .Values.dokuwikiUsername }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "dokuwiki.fullname" . }} -o jsonpath="{.data.dokuwiki-password}" | base64 --decode) + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/dokuwiki/values.yaml b/upstreamed/dokuwiki/values.yaml index eba4c762b..f21ddb879 100644 --- a/upstreamed/dokuwiki/values.yaml +++ b/upstreamed/dokuwiki/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/dokuwiki - tag: 0.20180422.201901061035 + tag: 0.20180422.201901061035-debian-9-r105 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/drupal/Chart.yaml b/upstreamed/drupal/Chart.yaml index 3515f5956..8216e0ab0 100644 --- a/upstreamed/drupal/Chart.yaml +++ b/upstreamed/drupal/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: drupal -version: 3.2.5 -appVersion: 8.7.1 +version: 3.2.7 +appVersion: 8.7.2 description: One of the most versatile open source content management systems. keywords: - drupal diff --git a/upstreamed/drupal/README.md b/upstreamed/drupal/README.md index 3af33135b..68f053443 100644 --- a/upstreamed/drupal/README.md +++ b/upstreamed/drupal/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the Drupal chart and th | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Drupal image registry | `docker.io` | | `image.repository` | Drupal Image name | `bitnami/drupal` | -| `image.tag` | Drupal Image tag | `{VERSION}` | +| `image.tag` | Drupal Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Drupal image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `drupalProfile` | Drupal installation profile | `standard` | diff --git a/upstreamed/drupal/templates/NOTES.txt b/upstreamed/drupal/templates/NOTES.txt index c9bb8da49..8772c9bf9 100644 --- a/upstreamed/drupal/templates/NOTES.txt +++ b/upstreamed/drupal/templates/NOTES.txt @@ -42,3 +42,10 @@ echo Username: {{ .Values.drupalUsername }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "drupal.fullname" . }} -o jsonpath="{.data.drupal-password}" | base64 --decode) + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/drupal/values.yaml b/upstreamed/drupal/values.yaml index e9291efd1..76da2e67b 100644 --- a/upstreamed/drupal/values.yaml +++ b/upstreamed/drupal/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/drupal - tag: 8.7.1 + tag: 8.7.2-debian-9-r5 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/ghost/Chart.yaml b/upstreamed/ghost/Chart.yaml index 04b0a820f..03015adfc 100644 --- a/upstreamed/ghost/Chart.yaml +++ b/upstreamed/ghost/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: ghost -version: 6.7.10 -appVersion: 2.21.0 +version: 6.7.16 +appVersion: 2.23.1 description: A simple, powerful publishing platform that allows you to share your stories with the world keywords: - ghost diff --git a/upstreamed/ghost/README.md b/upstreamed/ghost/README.md index bfc597f7f..40fc62465 100644 --- a/upstreamed/ghost/README.md +++ b/upstreamed/ghost/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the Ghost chart and the | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Ghost image registry | `docker.io` | | `image.repository` | Ghost Image name | `bitnami/ghost` | -| `image.tag` | Ghost Image tag | `{VERSION}` | +| `image.tag` | Ghost Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | @@ -146,6 +146,12 @@ $ helm install --name my-release -f values.yaml stable/ghost > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Using an existing database Sometimes you may want to have Ghost connect to an external database rather than installing one inside your cluster, e.g. to use a managed database service, or use run a single database server for all your applications. To do this, the chart allows you to specify credentials for an external database under the [`externalDatabase` parameter](#configuration). You should also disable the MariaDB installation with the `mariadb.enabled` option. For example: diff --git a/upstreamed/ghost/templates/NOTES.txt b/upstreamed/ghost/templates/NOTES.txt index ffcff11dc..a692651e3 100644 --- a/upstreamed/ghost/templates/NOTES.txt +++ b/upstreamed/ghost/templates/NOTES.txt @@ -56,3 +56,10 @@ host. To configure Ghost with the URL of your service: echo Email: {{ .Values.ghostEmail }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "ghost.fullname" . }} -o jsonpath="{.data.ghost-password}" | base64 --decode) {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/ghost/values.yaml b/upstreamed/ghost/values.yaml index abafae316..e6787ef8c 100644 --- a/upstreamed/ghost/values.yaml +++ b/upstreamed/ghost/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/ghost - tag: 2.21.0 + tag: 2.23.1-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/jasperreports/Chart.yaml b/upstreamed/jasperreports/Chart.yaml index e6ed1a3cd..714ae2941 100644 --- a/upstreamed/jasperreports/Chart.yaml +++ b/upstreamed/jasperreports/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: jasperreports -version: 4.2.0 -appVersion: 7.1.1 +version: 4.2.2 +appVersion: 7.2.0 description: The JasperReports server can be used as a stand-alone or embedded reporting and BI server that offers web-based reporting, analytic tools and visualization, and a dashboard feature for compiling multiple custom views diff --git a/upstreamed/jasperreports/README.md b/upstreamed/jasperreports/README.md index 090e16143..4f850e57d 100644 --- a/upstreamed/jasperreports/README.md +++ b/upstreamed/jasperreports/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the JasperReports chart | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | JasperReports image registry | `docker.io` | | `image.repository` | JasperReports Image name | `bitnami/jasperreports` | -| `image.tag` | JasperReports Image tag | `{VERSION}` | +| `image.tag` | JasperReports Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `jasperreportsUsername` | User of the application | `user` | @@ -117,6 +117,12 @@ $ helm install --name my-release -f values.yaml stable/jasperreports > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami JasperReports](https://github.com/bitnami/bitnami-docker-jasperreports) image stores the JasperReports data and configurations at the `/bitnami/jasperreports` path of the container. diff --git a/upstreamed/jasperreports/templates/NOTES.txt b/upstreamed/jasperreports/templates/NOTES.txt index c7c9717b7..6f5dccb17 100644 --- a/upstreamed/jasperreports/templates/NOTES.txt +++ b/upstreamed/jasperreports/templates/NOTES.txt @@ -46,3 +46,10 @@ host. To configure JasperReports to use and external database host: helm upgrade {{ .Release.Name }} --set service.type={{ .Values.service.type }},mariadb.enabled=false,externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST stable/jasperreports {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/jasperreports/values.yaml b/upstreamed/jasperreports/values.yaml index 51b554441..9e5c3907a 100644 --- a/upstreamed/jasperreports/values.yaml +++ b/upstreamed/jasperreports/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/jasperreports - tag: 7.1.1 + tag: 7.2.0-debian-9-r5 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/joomla/Chart.yaml b/upstreamed/joomla/Chart.yaml index 6f3b1d522..bd9acfe87 100644 --- a/upstreamed/joomla/Chart.yaml +++ b/upstreamed/joomla/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: joomla -version: 4.2.2 +version: 4.2.3 appVersion: 3.9.6 description: PHP content management system (CMS) for publishing web content keywords: diff --git a/upstreamed/joomla/README.md b/upstreamed/joomla/README.md index 397a81148..32ea08179 100644 --- a/upstreamed/joomla/README.md +++ b/upstreamed/joomla/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the Joomla! chart and t | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Joomla! image registry | `docker.io` | | `image.repository` | Joomla! Image name | `bitnami/joomla` | -| `image.tag` | Joomla! Image tag | `{VERSION}` | +| `image.tag` | Joomla! Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `joomlaUsername` | User of the application | `user` | @@ -147,6 +147,12 @@ $ helm install --name my-release -f values.yaml stable/joomla > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Joomla!](https://github.com/bitnami/bitnami-docker-joomla) image stores the Joomla! data and configurations at the `/bitnami/joomla` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/joomla/templates/NOTES.txt b/upstreamed/joomla/templates/NOTES.txt index fe3caeba4..b5937e1d3 100644 --- a/upstreamed/joomla/templates/NOTES.txt +++ b/upstreamed/joomla/templates/NOTES.txt @@ -59,3 +59,10 @@ host. To configure Joomla! to use and external database host: helm upgrade {{ .Release.Name }} --set service.type={{ .Values.service.type }},mariadb.enabled=false,externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST stable/joomla {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/joomla/values.yaml b/upstreamed/joomla/values.yaml index df8a226f9..cd0846021 100644 --- a/upstreamed/joomla/values.yaml +++ b/upstreamed/joomla/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/joomla - tag: 3.9.6 + tag: 3.9.6-debian-9-r9 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/magento/Chart.yaml b/upstreamed/magento/Chart.yaml index 74e4384e5..43f9226b3 100644 --- a/upstreamed/magento/Chart.yaml +++ b/upstreamed/magento/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: magento -version: 4.5.1 +version: 5.0.3 appVersion: 2.3.1 description: A feature-rich flexible e-commerce solution. It includes transaction options, multi-store functionality, loyalty programs, product categorization and shopper filtering, promotion rules, and more. keywords: diff --git a/upstreamed/magento/README.md b/upstreamed/magento/README.md index b4ee26c33..6daa8c955 100644 --- a/upstreamed/magento/README.md +++ b/upstreamed/magento/README.md @@ -47,87 +47,94 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the Magento chart and their default values. -| Parameter | Description | Default | -|--------------------------------------|--------------------------------------------|----------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Magento image registry | `docker.io` | -| `image.repository` | Magento Image name | `bitnami/magento` | -| `image.tag` | Magento Image tag | `{VERSION}` | -| `image.debug` | Specify if debug values should be set | `false` | -| `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `magentoHost` | Magento host to create application URLs | `nil` | -| `magentoLoadBalancerIP` | `loadBalancerIP` for the magento Service | `nil` | -| `magentoUsername` | User of the application | `user` | -| `magentoPassword` | Application password | _random 10 character long alphanumeric string_ | -| `magentoEmail` | Admin email | `user@example.com` | -| `magentoFirstName` | Magento Admin First Name | `FirstName` | -| `magentoLastName` | Magento Admin Last Name | `LastName` | -| `magentoMode` | Magento mode | `developer` | -| `magentoAdminUri` | Magento prefix to access Magento Admin | `admin` | -| `allowEmptyPassword` | Allow DB blank passwords | `yes` | -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.annotations` | Ingress annotations | `[]` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.hosts[0].name` | Hostname to your Magento installation | `magento.local` | -| `ingress.hosts[0].path` | Path within the url structure | `/` | -| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | -| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `magento.local-tls-secret` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | -| `externalDatabase.host` | Host of the external database | `nil` | -| `externalDatabase.port` | Port of the external database | `3306` | -| `externalDatabase.user` | Existing username in the external db | `bn_magento` | -| `externalDatabase.password` | Password for the above username | `nil` | -| `externalDatabase.database` | Name of the existing database | `bitnami_magento` | -| `mariadb.enabled` | Whether to use the MariaDB chart | `true` | -| `mariadb.rootUser.password` | MariaDB admin password | `nil` | -| `mariadb.db.name` | Database name to create | `bitnami_magento` | -| `mariadb.db.user` | Database user to create | `bn_magento` | -| `mariadb.db.password` | Password for the database | _random 10 character long alphanumeric string_ | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port | `80` | -| `service.httpsPort` | Service HTTPS port | `443` | -| `nodePorts.https` | Kubernetes https node port | `""` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `service.nodePorts.https` | Kubernetes https node port | `""` | -| `service.loadBalancerIP` | `loadBalancerIP` for the Magento Service | `nil` | -| `livenessProbe.enabled` | Turn on and off liveness probe | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `1000` | -| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | -| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe| `1` | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe | `6` | -| `readinessProbe.enabled` | Turn on and off readiness probe | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `30` | -| `readinessProbe.periodSeconds` | How often to perform the probe | `5` | -| `readinessProbe.timeoutSeconds` | When the probe times out | `3` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe| `1` | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe | `3` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.apache.storageClass` | PVC Storage Class for Apache volume | `nil` (uses alpha storage annotation) | -| `persistence.apache.accessMode` | PVC Access Mode for Apache volume | `ReadWriteOnce` | -| `persistence.apache.size` | PVC Storage Request for Apache volume | `1Gi` | -| `persistence.magento.storageClass` | PVC Storage Class for Magento volume | `nil` (uses alpha storage annotation) | -| `persistence.magento.accessMode` | PVC Access Mode for Magento volume | `ReadWriteOnce` | -| `persistence.magento.size` | PVC Storage Request for Magento volume | `8Gi` | -| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | -| `podAnnotations` | Pod annotations | `{}` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | -| `metrics.resources` | Exporter resource requests/limit | {} | +| Parameter | Description | Default | +| ------------------------------------ | ------------------------------------------------------------------------------------ | ------------------------------------------------------------ | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Magento image registry | `docker.io` | +| `image.repository` | Magento Image name | `bitnami/magento` | +| `image.tag` | Magento Image tag | `{TAG_NAME}` | +| `image.debug` | Specify if debug values should be set | `false` | +| `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `magentoHost` | Magento host to create application URLs | `nil` | +| `magentoLoadBalancerIP` | `loadBalancerIP` for the magento Service | `nil` | +| `magentoUsername` | User of the application | `user` | +| `magentoPassword` | Application password | _random 10 character long alphanumeric string_ | +| `magentoEmail` | Admin email | `user@example.com` | +| `magentoFirstName` | Magento Admin First Name | `FirstName` | +| `magentoLastName` | Magento Admin Last Name | `LastName` | +| `magentoMode` | Magento mode | `developer` | +| `magentoAdminUri` | Magento prefix to access Magento Admin | `admin` | +| `allowEmptyPassword` | Allow DB blank passwords | `yes` | +| `ingress.enabled` | Enable ingress controller resource | `false` | +| `ingress.annotations` | Ingress annotations | `[]` | +| `ingress.certManager` | Add annotations for cert-manager | `false` | +| `ingress.hosts[0].name` | Hostname to your Magento installation | `magento.local` | +| `ingress.hosts[0].path` | Path within the url structure | `/` | +| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | +| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `magento.local-tls-secret` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | +| `externalDatabase.host` | Host of the external database | `nil` | +| `externalDatabase.port` | Port of the external database | `3306` | +| `externalDatabase.user` | Existing username in the external db | `bn_magento` | +| `externalDatabase.password` | Password for the above username | `nil` | +| `externalDatabase.database` | Name of the existing database | `bitnami_magento` | +| `externalElasticsearch.host` | Host of the external elasticsearch server | `nil` | +| `externalElasticsearch.port` | Port of the external elasticsearch server | `nil` | +| `mariadb.enabled` | Whether to use the MariaDB chart | `true` | +| `mariadb.rootUser.password` | MariaDB admin password | `nil` | +| `mariadb.db.name` | Database name to create | `bitnami_magento` | +| `mariadb.db.user` | Database user to create | `bn_magento` | +| `mariadb.db.password` | Password for the database | _random 10 character long alphanumeric string_ | +| `elasticsearch.enabled` | Use the Elasticsearch chart as search engine | `false` | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.port` | Service HTTP port | `80` | +| `service.httpsPort` | Service HTTPS port | `443` | +| `nodePorts.https` | Kubernetes https node port | `""` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `service.nodePorts.https` | Kubernetes https node port | `""` | +| `service.loadBalancerIP` | `loadBalancerIP` for the Magento Service | `nil` | +| `livenessProbe.enabled` | Turn on and off liveness probe | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `1000` | +| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | +| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe | `1` | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe | `6` | +| `readinessProbe.enabled` | Turn on and off readiness probe | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `30` | +| `readinessProbe.periodSeconds` | How often to perform the probe | `5` | +| `readinessProbe.timeoutSeconds` | When the probe times out | `3` | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe | `1` | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe | `3` | +| `persistence.enabled` | Enable persistence using PVC | `true` | +| `persistence.apache.storageClass` | PVC Storage Class for Apache volume | `nil` (uses alpha storage annotation) | +| `persistence.apache.accessMode` | PVC Access Mode for Apache volume | `ReadWriteOnce` | +| `persistence.apache.size` | PVC Storage Request for Apache volume | `1Gi` | +| `persistence.magento.storageClass` | PVC Storage Class for Magento volume | `nil` (uses alpha storage annotation) | +| `persistence.magento.accessMode` | PVC Access Mode for Magento volume | `ReadWriteOnce` | +| `persistence.magento.size` | PVC Storage Request for Magento volume | `8Gi` | +| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| `podAnnotations` | Pod annotations | `{}` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | Apache exporter image registry | `docker.io` | +| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | +| `metrics.resources` | Exporter resource requests/limit | {} | The above parameters map to the env variables defined in [bitnami/magento](http://github.com/bitnami/bitnami-docker-magento). For more information please refer to the [bitnami/magento](http://github.com/bitnami/bitnami-docker-magento) image documentation. +> **Note**: +> +> Setting `elasticsearch.enabled` to true will launch seven more pods by default. Use it with caution. + > **Note**: > > For Magento to function correctly, you should specify the `magentoHost` parameter to specify the FQDN (recommended) or the public IP address of the Magento service. @@ -160,6 +167,12 @@ $ helm install --name my-release -f values.yaml stable/magento > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Magento](https://github.com/bitnami/bitnami-docker-magento) image stores the Magento data and configurations at the `/bitnami/magento` and `/bitnami/apache` paths of the container. @@ -168,6 +181,19 @@ The [Bitnami Magento](https://github.com/bitnami/bitnami-docker-magento) image s ## Upgrading +### To 5.0.0 + +Manual intervention is needed if configuring Elasticsearch 6 as Magento search engine is desired. + +[Follow the Magento documentation](https://devdocs.magento.com/guides/v2.3/config-guide/elasticsearch/configure-magento.html) in order to configure Elasticsearch, setting **Search Engine** to **Elasticsearch 6.0+**. If using the Elasticsearch server included in this chart, `hostname` and `port` can be obtained with the following commands: + +``` +$ kubectl get svc -l app=elasticsearch,component=client,release=RELEASE_NAME -o jsonpath="{.items[0].metadata.name}" +$ kubectl get svc -l app=elasticsearch,component=client,release=RELEASE_NAME -o jsonpath="{.items[0].spec.ports[0].port}" +``` + +Where `RELEASE_NAME` is the name of the release. Use `helm list` to find it. + ### To 3.0.0 Backwards compatibility is not guaranteed unless you modify the labels used on the chart's deployments. @@ -176,3 +202,4 @@ Use the workaround below to upgrade from versions previous to 3.0.0. The followi ```console $ kubectl patch deployment magento-magento --type=json -p='[{"op": "remove", "path": "/spec/selector/matchLabels/chart"}]' $ kubectl delete statefulset magento-mariadb --cascade=false +``` diff --git a/upstreamed/magento/requirements.lock b/upstreamed/magento/requirements.lock index d32553d7b..46320626a 100644 --- a/upstreamed/magento/requirements.lock +++ b/upstreamed/magento/requirements.lock @@ -1,6 +1,9 @@ dependencies: - name: mariadb repository: https://kubernetes-charts.storage.googleapis.com/ - version: 5.2.3 -digest: sha256:0593b73b2163fbbbae061de1aa2b8280d43f8a423a91e1c7375c0b6c86784b1c -generated: 2018-12-11T12:41:27.526645039Z + version: 5.11.3 +- name: elasticsearch + repository: https://kubernetes-charts.storage.googleapis.com/ + version: 1.26.2 +digest: sha256:b8276d2d458462fb87b222b5a45fa01461f11140acce57ccd1878b80c9eb7991 +generated: 2019-05-20T16:42:21.321514+02:00 diff --git a/upstreamed/magento/requirements.yaml b/upstreamed/magento/requirements.yaml index a828b3769..e5ffa232d 100644 --- a/upstreamed/magento/requirements.yaml +++ b/upstreamed/magento/requirements.yaml @@ -3,3 +3,7 @@ dependencies: version: 5.x.x repository: https://kubernetes-charts.storage.googleapis.com/ condition: mariadb.enabled +- name: elasticsearch + version: 1.x.x + repository: https://kubernetes-charts.storage.googleapis.com/ + condition: elasticsearch.enabled diff --git a/upstreamed/magento/templates/NOTES.txt b/upstreamed/magento/templates/NOTES.txt index 143f2d8e7..d737a936b 100644 --- a/upstreamed/magento/templates/NOTES.txt +++ b/upstreamed/magento/templates/NOTES.txt @@ -96,3 +96,10 @@ host. To configure Magento to use and external database host: helm upgrade {{ .Release.Name }} stable/{{ .Chart.Name }} \ --set magentoPassword=$APP_PASSWORD,magentoHost=$APP_HOST,service.type={{ .Values.service.type }},mariadb.enabled=false{{- if not (empty .Values.externalDatabase.user) }},externalDatabase.user={{ .Values.externalDatabase.user }}{{- end }}{{- if not (empty .Values.externalDatabase.password) }},externalDatabase.password={{ .Values.externalDatabase.password }}{{- end }}{{- if not (empty .Values.externalDatabase.database) }},externalDatabase.database={{ .Values.externalDatabase.database }}{{- end }},externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST{{- if .Values.global }}{{- if .Values.global.imagePullSecrets }},global.imagePullSecrets={{ .Values.global.imagePullSecrets }}{{- end }}{{- end }} {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/magento/templates/_helpers.tpl b/upstreamed/magento/templates/_helpers.tpl index a13e7d806..68f09ed03 100644 --- a/upstreamed/magento/templates/_helpers.tpl +++ b/upstreamed/magento/templates/_helpers.tpl @@ -39,6 +39,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- printf "%s-%s" .Release.Name "mariadb" | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "magento.elasticsearch.fullname" -}} +{{- printf "%s-%s-client" .Release.Name "elasticsearch" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + {{/* Get the user defined LoadBalancerIP for this release. Note, returns 127.0.0.1 if using ClusterIP. diff --git a/upstreamed/magento/templates/deployment.yaml b/upstreamed/magento/templates/deployment.yaml index a53d1a079..5f657f07c 100644 --- a/upstreamed/magento/templates/deployment.yaml +++ b/upstreamed/magento/templates/deployment.yaml @@ -57,6 +57,22 @@ spec: {{- else }} value: {{ .Values.externalDatabase.port | quote }} {{- end }} + - name: ELASTICSEARCH_HOST + {{- if .Values.elasticsearch.enabled }} + value: {{ template "magento.elasticsearch.fullname" . }} + {{- else if .Values.externalElasticsearch.host }} + value: {{ .Values.externalElasticsearch.host | quote }} + {{- else }} + value: "" + {{- end }} + - name: ELASTICSEARCH_PORT_NUMBER + {{- if .Values.elasticsearch.enabled }} + value: "9200" + {{- else if .Values.externalElasticsearch.port }} + value: {{ .Values.externalElasticsearch.port | quote }} + {{- else }} + value: "" + {{- end }} - name: MAGENTO_DATABASE_NAME {{- if .Values.mariadb.enabled }} value: {{ .Values.mariadb.db.name | quote }} diff --git a/upstreamed/magento/values-production.yaml b/upstreamed/magento/values-production.yaml new file mode 100644 index 000000000..dd7cac313 --- /dev/null +++ b/upstreamed/magento/values-production.yaml @@ -0,0 +1,325 @@ +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## +# global: +# imageRegistry: myRegistryName +# imagePullSecrets: +# - myRegistryKeySecretName + +## Bitnami Magento image version +## ref: https://hub.docker.com/r/bitnami/magento/tags/ +## +image: + registry: docker.io + repository: bitnami/magento + tag: 2.3.1-debian-9-r41 + ## Set to true if you would like to see extra information on logs + ## It turns BASH and NAMI debugging in minideb + ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging + ## + debug: false + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + +## Magento host to create application URLs +## ref: https://github.com/bitnami/bitnami-docker-magento#configuration +## +# magentoHost: + +## loadBalancerIP for the Magento Service (optional, cloud specific) +## ref: http://kubernetes.io/docs/user-guide/services/#type-loadbalancer +## +# magentoLoadBalancerIP: + +## User of the application +## ref: https://github.com/bitnami/bitnami-docker-magento#configuration +## +magentoUsername: user + +## Application password +## Defaults to a random 10-character alphanumeric string if not set +## ref: https://github.com/bitnami/bitnami-docker-magento#configuration +## +# magentoPassword: + +## Admin email +## ref: https://github.com/bitnami/bitnami-docker-magento#configuration +## +magentoEmail: user@example.com + +## Prefix for Magento Admin +## ref: https://github.com/bitnami/bitnami-docker-magento#configuration +## +magentoAdminUri: admin + +## First Name +## ref: https://github.com/bitnami/bitnami-docker-magento#configuration +## +magentoFirstName: FirstName + +## Last Name +## ref: https://github.com/bitnami/bitnami-docker-magento#configuration +## +magentoLastName: LastName + +## Mode +## ref: https://github.com/bitnami/bitnami-docker-magento#configuration +## +magentoMode: developer + +## Set to `yes` to allow the container to be started with blank passwords +## ref: https://github.com/bitnami/bitnami-docker-magento#environment-variables +allowEmptyPassword: "yes" + +## +## External database configuration +## +externalDatabase: + ## Database host + host: + + ## Database port + port: 3306 + + ## Database user + user: bn_magento + + ## Database password + password: + + ## Database name + database: bitnami_magento + +## +## External elasticsearch configuration +## +externalElasticsearch: + ## Elasticsearch host + host: + + ## Elasticsearch port + port: + +## +## MariaDB chart configuration +## +## https://github.com/helm/charts/blob/master/stable/mariadb/values.yaml +## +mariadb: + ## Whether to deploy a mariadb server to satisfy the applications database requirements. To use an external database set this to false and configure the externalDatabase parameters + enabled: true + ## Disable MariaDB replication + replication: + enabled: false + + ## Create a database and a database user + ## ref: https://github.com/bitnami/bitnami-docker-mariadb/blob/master/README.md#creating-a-database-user-on-first-run + ## + db: + name: bitnami_magento + user: bn_magento + ## If the password is not specified, mariadb will generates a random password + ## + # password: + + ## MariaDB admin password + ## ref: https://github.com/bitnami/bitnami-docker-mariadb/blob/master/README.md#setting-the-root-password-on-first-run + ## + # rootUser: + # password: + + ## Enable persistence using Persistent Volume Claims + ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + ## + master: + persistence: + enabled: true + ## mariadb data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + accessMode: ReadWriteOnce + size: 8Gi + +## +## Elasticsearch chart configuration +## +## https://github.com/helm/charts/blob/master/stable/elasticsearch/values.yaml +## +elasticsearch: + ## Whether to deploy a elasticsearch server to use as magento's search engine + ## To use an external server set this to false and configure the externalElasticsearch parameters + enabled: true + +## Kubernetes configuration +## For minikube, set this to NodePort, elsewhere use LoadBalancer +## +service: + type: LoadBalancer + # HTTP Port + port: 80 + # HTTPS Port + httpsPort: 443 + ## + ## loadBalancerIP: + ## nodePorts: + ## http: + ## https: + nodePorts: + http: "" + https: "" + ## Enable client source IP preservation + ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + +## Configure liveness and readiness probes +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) +## +livenessProbe: + enabled: true + initialDelaySeconds: 1000 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 6 +readinessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 5 + timeoutSeconds: 3 + successThreshold: 1 + failureThreshold: 3 + +## Enable persistence using Persistent Volume Claims +## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ +## +persistence: + enabled: true + apache: + ## apache data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + accessMode: ReadWriteOnce + size: 1Gi + magento: + ## magento data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + accessMode: ReadWriteOnce + size: 8Gi + +## Configure resource requests and limits +## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## +resources: + requests: + memory: 512Mi + cpu: 300m + +## Pod annotations +## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ +## +podAnnotations: {} + +## Configure the ingress resource that allows you to access the +## Magento installation. Set up the URL +## ref: http://kubernetes.io/docs/user-guide/ingress/ +## +ingress: + ## Set to true to enable ingress record generation + enabled: false + + ## Set this to true in order to add the corresponding annotations for cert-manager + certManager: false + + ## Ingress annotations done as key:value pairs + ## For a full list of possible ingress annotations, please see + ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md + ## + ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set + ## If certManager is set to true, annotation kubernetes.io/tls-acme: "true" will automatically be set + annotations: + # kubernetes.io/ingress.class: nginx + + ## The list of hostnames to be covered with this ingress record. + ## Most likely this will be just one host, but in the event more hosts are needed, this is an array + hosts: + - name: magento.local + path: / + + ## Set this to true in order to enable TLS on the ingress record + tls: false + + ## Optionally specify the TLS hosts for the ingress record + ## Useful when the Ingress controller supports www-redirection + ## If not specified, the above host name will be used + # tlsHosts: + # - www.magento.local + # - magento.local + + ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS + tlsSecret: magento.local-tls + + secrets: + ## If you're providing your own certificates, please use this to add the certificates as secrets + ## key and certificate should start with -----BEGIN CERTIFICATE----- or + ## -----BEGIN RSA PRIVATE KEY----- + ## + ## name should line up with a tlsSecret set further up + ## If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set + ## + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + # - name: magento.local-tls + # key: + # certificate: + + +## Prometheus Exporter / Metrics +## +metrics: + enabled: true + image: + registry: docker.io + repository: lusotycoon/apache-exporter + tag: v0.5.0 + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + ## Metrics exporter pod Annotation and Labels + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9117" + ## Metrics exporter resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + # resources: {} diff --git a/upstreamed/magento/values.yaml b/upstreamed/magento/values.yaml index 8040dc4c2..48df44d1a 100644 --- a/upstreamed/magento/values.yaml +++ b/upstreamed/magento/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/magento - tag: 2.3.1 + tag: 2.3.1-debian-9-r41 ## Set to true if you would like to see extra information on logs ## It turns BASH and NAMI debugging in minideb ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging @@ -88,7 +88,7 @@ externalDatabase: ## Database host host: - ## Database host + ## Database port port: 3306 ## Database user @@ -100,6 +100,16 @@ externalDatabase: ## Database name database: bitnami_magento +## +## External elasticsearch configuration +## +externalElasticsearch: + ## Elasticsearch host + host: + + ## Elasticsearch port + port: + ## ## MariaDB chart configuration ## @@ -145,6 +155,16 @@ mariadb: accessMode: ReadWriteOnce size: 8Gi +## +## Elasticsearch chart configuration +## +## https://github.com/helm/charts/blob/master/stable/elasticsearch/values.yaml +## +elasticsearch: + ## Whether to deploy a elasticsearch server to use as magento's search engine + ## To use an external server set this to false and configure the externalElasticsearch parameters + enabled: false + ## Kubernetes configuration ## For minikube, set this to NodePort, elsewhere use LoadBalancer ## diff --git a/upstreamed/mariadb/Chart.yaml b/upstreamed/mariadb/Chart.yaml index af007289f..9e107cbbf 100644 --- a/upstreamed/mariadb/Chart.yaml +++ b/upstreamed/mariadb/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: mariadb -version: 6.0.0 -appVersion: 10.3.14 +version: 6.2.1 +appVersion: 10.3.15 description: Fast, reliable, scalable, and easy to use open-source relational database system. MariaDB Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. Highly available MariaDB cluster. keywords: - mariadb diff --git a/upstreamed/mariadb/README.md b/upstreamed/mariadb/README.md index ca86fefcf..0e59e2b38 100644 --- a/upstreamed/mariadb/README.md +++ b/upstreamed/mariadb/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the MariaDB chart and t | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | MariaDB image registry | `docker.io` | | `image.repository` | MariaDB Image name | `bitnami/mariadb` | -| `image.tag` | MariaDB Image tag | `{VERSION}` | +| `image.tag` | MariaDB Image tag | `{TAG_NAME}` | | `image.pullPolicy` | MariaDB image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug logs should be enabled | `false` | @@ -81,10 +81,12 @@ The following table lists the configurable parameters of the MariaDB chart and t | `master.annotations[].value` | value for the the annotation list item | `nil` | | `master.affinity` | Master affinity (in addition to master.antiAffinity when set) | `{}` | | `master.antiAffinity` | Master pod anti-affinity policy | `soft` | +| `master.nodeSelector` | Master node labels for pod assignment | `{}` | | `master.tolerations` | List of node taints to tolerate (master) | `[]` | | `master.updateStrategy` | Master statefulset update strategy policy | `RollingUpdate` | | `master.persistence.enabled` | Enable persistence using PVC | `true` | | `master.persistence.existingClaim` | Provide an existing `PersistentVolumeClaim` | `nil` | +| `master.persistence.subPath` | Subdirectory of the volume to mount | `nil` | | `master.persistence.mountPath` | Path to mount the volume at | `/bitnami/mariadb` | | `master.persistence.annotations` | Persistent Volume Claim annotations | `{}` | | `master.persistence.storageClass` | Persistent Volume Storage Class | `` | @@ -113,6 +115,7 @@ The following table lists the configurable parameters of the MariaDB chart and t | `slave.annotations[].value` | value for the the annotation list item | `nil` | | `slave.affinity` | Slave affinity (in addition to slave.antiAffinity when set) | `{}` | | `slave.antiAffinity` | Slave pod anti-affinity policy | `soft` | +| `slave.nodeSelector` | Slave node labels for pod assignment | `{}` | | `slave.tolerations` | List of node taints to tolerate for (slave) | `[]` | | `slave.updateStrategy` | Slave statefulset update strategy policy | `RollingUpdate` | | `slave.persistence.enabled` | Enable persistence using a `PersistentVolumeClaim` | `true` | @@ -165,6 +168,12 @@ $ helm install --name my-release -f values.yaml stable/mariadb > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Initialize a fresh instance The [Bitnami MariaDB](https://github.com/bitnami/bitnami-docker-mariadb) image allows you to use your custom scripts to initialize a fresh instance. In order to execute the scripts, they must be located inside the chart folder `files/docker-entrypoint-initdb.d` so they can be consumed as a ConfigMap. diff --git a/upstreamed/mariadb/templates/NOTES.txt b/upstreamed/mariadb/templates/NOTES.txt index 768f77fe4..f3641d060 100644 --- a/upstreamed/mariadb/templates/NOTES.txt +++ b/upstreamed/mariadb/templates/NOTES.txt @@ -40,3 +40,10 @@ To upgrade this helm chart: ROOT_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "mariadb.fullname" . }} -o jsonpath="{.data.mariadb-root-password}" | base64 --decode) helm upgrade {{ .Release.Name }} stable/mariadb --set rootUser.password=$ROOT_PASSWORD + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/mariadb/templates/master-statefulset.yaml b/upstreamed/mariadb/templates/master-statefulset.yaml index c9f8e11c1..5895ec8a2 100644 --- a/upstreamed/mariadb/templates/master-statefulset.yaml +++ b/upstreamed/mariadb/templates/master-statefulset.yaml @@ -73,6 +73,10 @@ spec: {{ toYaml . | indent 8 }} {{- end }} {{- end }} + {{- if .Values.master.nodeSelector }} + nodeSelector: + {{ toYaml .Values.master.nodeSelector | nindent 8 }} + {{- end -}} {{- with .Values.master.tolerations }} tolerations: {{ toYaml . | indent 8 }} @@ -158,6 +162,9 @@ spec: volumeMounts: - name: data mountPath: {{ .Values.master.persistence.mountPath }} + {{- if .Values.master.persistence.subPath }} + subPath: {{ .Values.master.persistence.subPath }} + {{- end }} {{- if or (.Files.Glob "files/docker-entrypoint-initdb.d/*.{sh,sql,sql.gz}") .Values.initdbScriptsConfigMap .Values.initdbScripts }} - name: custom-init-scripts mountPath: /docker-entrypoint-initdb.d diff --git a/upstreamed/mariadb/templates/slave-statefulset.yaml b/upstreamed/mariadb/templates/slave-statefulset.yaml index 8372b226f..dfc8c7f95 100644 --- a/upstreamed/mariadb/templates/slave-statefulset.yaml +++ b/upstreamed/mariadb/templates/slave-statefulset.yaml @@ -74,6 +74,10 @@ spec: {{ toYaml . | indent 8 }} {{- end }} {{- end }} + {{- if .Values.slave.nodeSelector }} + nodeSelector: + {{ toYaml .Values.slave.nodeSelector | nindent 8 }} + {{- end -}} {{- with .Values.slave.tolerations }} tolerations: {{ toYaml . | indent 8 }} diff --git a/upstreamed/mariadb/values-production.yaml b/upstreamed/mariadb/values-production.yaml index acdd38e61..2fd85d0e8 100644 --- a/upstreamed/mariadb/values-production.yaml +++ b/upstreamed/mariadb/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/mariadb - tag: 10.3.14 + tag: 10.3.15-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -145,6 +145,11 @@ master: ## antiAffinity: soft + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## Tolerations for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## @@ -164,6 +169,8 @@ master: enabled: true # Enable persistence using an existing PVC # existingClaim: + # Subdirectory of the volume to mount + # subPath: mountPath: /bitnami/mariadb ## Persistent Volume Storage Class ## If defined, storageClassName: @@ -267,6 +274,11 @@ slave: ## antiAffinity: soft + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## Tolerations for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## diff --git a/upstreamed/mariadb/values.yaml b/upstreamed/mariadb/values.yaml index f47d3252c..babcdd8d0 100644 --- a/upstreamed/mariadb/values.yaml +++ b/upstreamed/mariadb/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/mariadb - tag: 10.3.14 + tag: 10.3.15-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -145,6 +145,11 @@ master: ## antiAffinity: soft + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## Tolerations for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## @@ -164,6 +169,8 @@ master: enabled: true # Enable persistence using an existing PVC # existingClaim: + # Subdirectory of the volume to mount + # subPath: mountPath: /bitnami/mariadb ## Persistent Volume Storage Class ## If defined, storageClassName: @@ -266,6 +273,11 @@ slave: ## antiAffinity: soft + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## Tolerations for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## diff --git a/upstreamed/mediawiki/Chart.yaml b/upstreamed/mediawiki/Chart.yaml index 327b67fbd..e127d5f06 100644 --- a/upstreamed/mediawiki/Chart.yaml +++ b/upstreamed/mediawiki/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: mediawiki -version: 6.2.1 +version: 6.2.2 appVersion: 1.32.1 description: Extremely powerful, scalable software and a feature-rich wiki implementation that uses PHP to process and display data stored in a database. home: http://www.mediawiki.org/ diff --git a/upstreamed/mediawiki/README.md b/upstreamed/mediawiki/README.md index 1bcc2cc40..590a8e429 100644 --- a/upstreamed/mediawiki/README.md +++ b/upstreamed/mediawiki/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the MediaWiki chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | MediaWiki image registry | `docker.io` | | `image.repository` | MediaWiki Image name | `bitnami/mediawiki` | -| `image.tag` | MediaWiki Image tag | `{VERSION}` | +| `image.tag` | MediaWiki Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `mediawikiUser` | User of the application | `user` | @@ -140,6 +140,12 @@ $ helm install --name my-release -f values.yaml stable/mediawiki > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami MediaWiki](https://github.com/bitnami/bitnami-docker-mediawiki) image stores the MediaWiki data and configurations at the `/bitnami/mediawiki` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/mediawiki/templates/NOTES.txt b/upstreamed/mediawiki/templates/NOTES.txt index 306ec8587..d5ae3bb11 100644 --- a/upstreamed/mediawiki/templates/NOTES.txt +++ b/upstreamed/mediawiki/templates/NOTES.txt @@ -59,3 +59,10 @@ host. To configure MediaWiki to use and external database host: helm upgrade {{ .Release.Name }} --set service.type={{ .Values.service.type }},mariadb.enabled=false,externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST stable/mediawiki {{- end}} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/mediawiki/values.yaml b/upstreamed/mediawiki/values.yaml index 07635cafa..01dfd587d 100644 --- a/upstreamed/mediawiki/values.yaml +++ b/upstreamed/mediawiki/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/mediawiki - tag: 1.32.1 + tag: 1.32.1-debian-9-r17 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/mongodb/Chart.yaml b/upstreamed/mongodb/Chart.yaml index f24a2dd53..76663cfd1 100644 --- a/upstreamed/mongodb/Chart.yaml +++ b/upstreamed/mongodb/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: mongodb -version: 5.17.0 -appVersion: 4.0.9 +version: 5.17.3 +appVersion: 4.0.10 description: NoSQL document-oriented database that stores JSON-like documents with dynamic schemas, simplifying the integration of data in content-driven applications. keywords: - mongodb diff --git a/upstreamed/mongodb/README.md b/upstreamed/mongodb/README.md index 2bea24777..fa2a8cd71 100644 --- a/upstreamed/mongodb/README.md +++ b/upstreamed/mongodb/README.md @@ -51,7 +51,7 @@ The following table lists the configurable parameters of the MongoDB chart and t | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | MongoDB image registry | `docker.io` | | `image.repository` | MongoDB Image name | `bitnami/mongodb` | -| `image.tag` | MongoDB Image tag | `{VERSION}` | +| `image.tag` | MongoDB Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug logs should be enabled | `false` | @@ -66,39 +66,39 @@ The following table lists the configurable parameters of the MongoDB chart and t | `mongodbDirectoryPerDB` | Switch to enable/disable DirectoryPerDB on MongoDB | `false` | | `mongodbSystemLogVerbosity` | MongoDB systen log verbosity level | `0` | | `mongodbDisableSystemLog` | Whether to disable MongoDB system log or not | `false` | -| `mongodbExtraFlags` | MongoDB additional command line flags | [] | +| `mongodbExtraFlags` | MongoDB additional command line flags | `[]` | | `service.annotations` | Kubernetes service annotations | `{}` | | `service.type` | Kubernetes Service type | `ClusterIP` | | `service.clusterIP` | Static clusterIP or None for headless services | `nil` | | `service.nodePort` | Port to bind to for NodePort service type | `nil` | | `service.loadBalancerIP` | Static IP Address to use for LoadBalancer service type | `nil` | -| `service.externalIPs` | External IP list to use with ClusterIP service type | [] | +| `service.externalIPs` | External IP list to use with ClusterIP service type | `[]` | | `port` | MongoDB service port | `27017` | | `replicaSet.enabled` | Switch to enable/disable replica set configuration | `false` | | `replicaSet.name` | Name of the replica set | `rs0` | | `replicaSet.useHostnames` | Enable DNS hostnames in the replica set config | `true` | -| `replicaSet.key` | Key used for authentication in the replica set | `nil` | +| `replicaSet.key` | Key used for authentication in the replica set | `random alphanumeric string (10)` | | `replicaSet.replicas.secondary` | Number of secondary nodes in the replica set | `1` | | `replicaSet.replicas.arbiter` | Number of arbiter nodes in the replica set | `1` | | `replicaSet.pdb.minAvailable.primary` | PDB for the MongoDB Primary nodes | `1` | | `replicaSet.pdb.minAvailable.secondary` | PDB for the MongoDB Secondary nodes | `1` | | `replicaSet.pdb.minAvailable.arbiter` | PDB for the MongoDB Arbiter nodes | `1` | -| `podAnnotations` | Annotations to be added to pods | {} | -| `podLabels` | Additional labels for the pod(s). | {} | -| `resources` | Pod resources | {} | +| `podAnnotations` | Annotations to be added to pods | `{}` | +| `podLabels` | Additional labels for the pod(s). | `{}` | +| `resources` | Pod resources | `{}` | | `priorityClassName` | Pod priority class name | `` | -| `nodeSelector` | Node labels for pod assignment | {} | -| `affinity` | Affinity for pod assignment | {} | -| `tolerations` | Toleration labels for pod assignment | {} | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `affinity` | Affinity for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `{}` | | `updateStrategy` | Statefulsets update strategy policy | `RollingUpdate` | | `securityContext.enabled` | Enable security context | `true` | | `securityContext.fsGroup` | Group ID for the container | `1001` | | `securityContext.runAsUser` | User ID for the container | `1001` | | `persistence.enabled` | Use a PVC to persist data | `true` | | `persistence.mountPath` | Path to mount the volume at | `/bitnami/mongodb` | -| `persistence.subPath` | Subdirectory of the volume to mount at | `""` | +| `persistence.subPath` | Subdirectory of the volume to mount at | `""` | | `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | +| `persistence.accessModes` | Use volume as ReadOnly or ReadWrite | `[ReadWriteOnce]` | | `persistence.size` | Size of data volume | `8Gi` | | `persistence.annotations` | Persistent Volume annotations | `{}` | | `persistence.existingClaim` | Name of an existing PVC to use (avoids creating one if this is given) | `nil` | @@ -120,31 +120,33 @@ The following table lists the configurable parameters of the MongoDB chart and t | `ingress.enabled` | Enables Ingress. Tested with nginx-ingress version `1.3.1` | `false` | | `ingress.annotations` | Ingress annotations | `{}` | | `ingress.labels` | Custom labels | `{}` | +| `ingress.paths` | Ingress paths | `[/]` | | `ingress.hosts` | Ingress accepted hostnames | `[]` | -| `ingress.tls` | Ingress TLS configuration | `[]` | +| `ingress.tls` | Ingress TLS configuration | `[ { secretName: secret-tls, hosts: [] } ]` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | MongoDB exporter image registry | `docker.io` | | `metrics.image.repository` | MongoDB exporter image name | `forekshub/percona-mongodb-exporter` | | `metrics.image.tag` | MongoDB exporter image tag | `latest` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | {} | +| `metrics.podAnnotations.prometheus.io/scrape` | Additional annotations for Metrics exporter pod | `true` | +| `metrics.podAnnotations.prometheus.io/port` | Additional annotations for Metrics exporter pod | `"9216"` | | `metrics.extraArgs` | String with extra arguments for the MongoDB Exporter | `` | -| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | +| `metrics.resources` | Exporter resource requests/limit | `{}` | | `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using PrometheusOperator | `false` | -| `metrics.serviceMonitor.additionalLabels` | Used to pass Labels that are required by the Installed Prometheus Operator | {} | +| `metrics.serviceMonitor.additionalLabels` | Used to pass Labels that are required by the Installed Prometheus Operator | `{}` | | `metrics.serviceMonitor.relabellings` | Specify Metric Relabellings to add to the scrape endpoint | `nil` | -| `metrics.serviceMonitor.alerting.rules` | Define individual alerting rules as required | {} | -| `metrics.serviceMonitor.alerting.additionalLabels` | Used to pass Labels that are required by the Installed Prometheus Operator | {} | +| `metrics.serviceMonitor.alerting.rules` | Define individual alerting rules as required | `{}` | +| `metrics.serviceMonitor.alerting.additionalLabels` | Used to pass Labels that are required by the Installed Prometheus Operator | `{}` | | `metrics.livenessProbe.enabled` | Enable/disable the Liveness Check of Prometheus metrics exporter | `false` | | `metrics.livenessProbe.initialDelaySeconds` | Initial Delay for Liveness Check of Prometheus metrics exporter | `15` | -| `metrics.livenessProbe.periodSeconds` | How often to perform Liveness Check of Prometheus metrics exporter | `10` | +| `metrics.livenessProbe.periodSeconds` | How often to perform Liveness Check of Prometheus metrics exporter | `5` | | `metrics.livenessProbe.timeoutSeconds` | Timeout for Liveness Check of Prometheus metrics exporter | `5` | | `metrics.livenessProbe.failureThreshold` | Failure Threshold for Liveness Check of Prometheus metrics exporter | `3` | | `metrics.livenessProbe.successThreshold` | Success Threshold for Liveness Check of Prometheus metrics exporter | `1` | | `metrics.readinessProbe.enabled` | Enable/disable the Readiness Check of Prometheus metrics exporter | `false` | | `metrics.readinessProbe.initialDelaySeconds` | Initial Delay for Readiness Check of Prometheus metrics exporter | `5` | -| `metrics.readinessProbe.periodSeconds` | How often to perform Readiness Check of Prometheus metrics exporter | `10` | +| `metrics.readinessProbe.periodSeconds` | How often to perform Readiness Check of Prometheus metrics exporter | `5` | | `metrics.readinessProbe.timeoutSeconds` | Timeout for Readiness Check of Prometheus metrics exporter | `1` | | `metrics.readinessProbe.failureThreshold` | Failure Threshold for Readiness Check of Prometheus metrics exporter | `3` | | `metrics.readinessProbe.successThreshold` | Success Threshold for Readiness Check of Prometheus metrics exporter | `1` | @@ -168,6 +170,12 @@ $ helm install --name my-release -f values.yaml stable/mongodb > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Replication You can start the MongoDB chart in replica set mode with the following command: diff --git a/upstreamed/mongodb/templates/NOTES.txt b/upstreamed/mongodb/templates/NOTES.txt index d2c3dc656..54026b8bf 100644 --- a/upstreamed/mongodb/templates/NOTES.txt +++ b/upstreamed/mongodb/templates/NOTES.txt @@ -64,3 +64,10 @@ To connect to your database from outside the cluster execute the following comma mongo --host 127.0.0.1 {{- if .Values.usePassword }} --authenticationDatabase admin -p $MONGODB_ROOT_PASSWORD{{- end }} {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/mongodb/values-production.yaml b/upstreamed/mongodb/values-production.yaml index d6db78956..0c08ef00d 100644 --- a/upstreamed/mongodb/values-production.yaml +++ b/upstreamed/mongodb/values-production.yaml @@ -17,7 +17,7 @@ image: ## Bitnami MongoDB image tag ## ref: https://hub.docker.com/r/bitnami/mongodb/tags/ ## - tag: 4.0.9 + tag: 4.0.10-debian-9-r0 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/mongodb/values.yaml b/upstreamed/mongodb/values.yaml index a2dfac1e3..fa7775f1b 100644 --- a/upstreamed/mongodb/values.yaml +++ b/upstreamed/mongodb/values.yaml @@ -17,7 +17,7 @@ image: ## Bitnami MongoDB image tag ## ref: https://hub.docker.com/r/bitnami/mongodb/tags/ ## - tag: 4.0.9 + tag: 4.0.10-debian-9-r0 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/moodle/Chart.yaml b/upstreamed/moodle/Chart.yaml index fe31e530a..828ed2169 100644 --- a/upstreamed/moodle/Chart.yaml +++ b/upstreamed/moodle/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: moodle -version: 4.2.1 -appVersion: 3.6.4 +version: 4.2.3 +appVersion: 3.7.0 description: Moodle is a learning platform designed to provide educators, administrators and learners with a single robust, secure and integrated system to create personalised learning environments keywords: - moodle diff --git a/upstreamed/moodle/README.md b/upstreamed/moodle/README.md index 91629bce5..2e04f2b8d 100644 --- a/upstreamed/moodle/README.md +++ b/upstreamed/moodle/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the Moodle chart and th | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Moodle image registry | `docker.io` | | `image.repository` | Moodle Image name | `bitnami/moodle` | -| `image.tag` | Moodle Image tag | `{VERSION}` | +| `image.tag` | Moodle Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent`| | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `moodleUsername` | User of the application | `user` | @@ -145,6 +145,12 @@ $ helm install --name my-release -f values.yaml stable/moodle > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ### Ingress without TLS For using ingress (example without TLS): diff --git a/upstreamed/moodle/templates/NOTES.txt b/upstreamed/moodle/templates/NOTES.txt index 7f6f63cc2..9963efa93 100644 --- a/upstreamed/moodle/templates/NOTES.txt +++ b/upstreamed/moodle/templates/NOTES.txt @@ -59,3 +59,10 @@ host. To configure Moodle to use and external database host: helm upgrade {{ .Release.Name }} --set service.type={{ .Values.service.type }},mariadb.enabled=false,externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST stable/moodle {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/moodle/values.yaml b/upstreamed/moodle/values.yaml index e65cac9ab..14c24228d 100644 --- a/upstreamed/moodle/values.yaml +++ b/upstreamed/moodle/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/moodle - tag: 3.6.4 + tag: 3.7.0-debian-9-r9 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/nats/Chart.yaml b/upstreamed/nats/Chart.yaml index 17a1cf70e..83b6bee2a 100644 --- a/upstreamed/nats/Chart.yaml +++ b/upstreamed/nats/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: nats -version: 2.4.2 +version: 2.5.2 appVersion: 1.4.1 description: An open-source, cloud-native messaging system keywords: diff --git a/upstreamed/nats/README.md b/upstreamed/nats/README.md index d61765ab9..04c863d0a 100644 --- a/upstreamed/nats/README.md +++ b/upstreamed/nats/README.md @@ -51,7 +51,7 @@ The following table lists the configurable parameters of the NATS chart and thei | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | NATS image registry | `docker.io` | | `image.repository` | NATS Image name | `bitnami/nats` | -| `image.tag` | NATS Image tag | `{VERSION}` | +| `image.tag` | NATS Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `auth.enabled` | Switch to enable/disable client authentication | `true` | @@ -70,6 +70,7 @@ The following table lists the configurable parameters of the NATS chart and thei | `maxPayload` | Max. payload | `nil` | | `writeDeadline` | Duration the server can block on a socket write to a client | `nil` | | `replicaCount` | Number of NATS nodes | `1` | +| `resourceType` | NATS cluster resource type under Kubernetes (Supported: StatefulSets, or Deployment) | `statefulset` | | `securityContext.enabled` | Enable security context | `true` | | `securityContext.fsGroup` | Group ID for the container | `1001` | | `securityContext.runAsUser` | User ID for the container | `1001` | @@ -131,10 +132,8 @@ The following table lists the configurable parameters of the NATS chart and thei | `metrics.resources` | Prometheus metrics exporter resource requests/limit | {} | | `sidecars` | Attach additional containers to the pod | `nil` | - Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - ```bash $ helm install --name my-release \ --set auth.enabled=true,auth.user=my-user,auth.password=T0pS3cr3t \ @@ -151,6 +150,12 @@ $ helm install --name my-release -f values.yaml stable/nats > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Sidecars If you have a need for additional containers to run within the same pod as NATS (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. diff --git a/upstreamed/nats/templates/NOTES.txt b/upstreamed/nats/templates/NOTES.txt index 224df8fc7..af444340c 100644 --- a/upstreamed/nats/templates/NOTES.txt +++ b/upstreamed/nats/templates/NOTES.txt @@ -85,4 +85,14 @@ To access the Monitoring svc from outside the cluster, follow the steps below: kubectl port-forward --namespace {{ .Release.Namespace }} {{ template "nats.fullname" . }}-0 {{ .Values.metrics.port }}:{{ .Values.metrics.port }} 4. Access NATS Prometheus metrics by opening the URL obtained in a browser. + +{{- end }} + +{{- include "nats.validateValues" . -}} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + {{- end }} diff --git a/upstreamed/nats/templates/_helpers.tpl b/upstreamed/nats/templates/_helpers.tpl index fd2f84067..6159ca095 100644 --- a/upstreamed/nats/templates/_helpers.tpl +++ b/upstreamed/nats/templates/_helpers.tpl @@ -119,3 +119,26 @@ imagePullSecrets: {{- end }} {{- end -}} {{- end -}} + +{{/* +Compile all warnings into a single message, and call fail. +*/}} +{{- define "nats.validateValues" -}} +{{- $messages := list -}} +{{- $messages := append $messages (include "nats.validateValues.resourceType" .) -}} +{{- $messages := without $messages "" -}} +{{- $message := join "\n" $messages -}} + +{{- if $message -}} +{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}} +{{- end -}} +{{- end -}} + +{{/* Validate values of NATS - must provide a valid resourceType ("deployment" or "statefulset") */}} +{{- define "nats.validateValues.resourceType" -}} +{{- if and (ne .Values.resourceType "deployment") (ne .Values.resourceType "statefulset") -}} +nats: resourceType + Invalid resourceType selected. Valid values are "deployment" and + "statefulset". Please set a valid mode (--set resourceType="xxxx") +{{- end -}} +{{- end -}} diff --git a/upstreamed/nats/templates/deployment.yaml b/upstreamed/nats/templates/deployment.yaml new file mode 100644 index 000000000..2964cd728 --- /dev/null +++ b/upstreamed/nats/templates/deployment.yaml @@ -0,0 +1,166 @@ +{{- if eq .Values.resourceType "deployment" }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "nats.fullname" . }} + labels: + app: "{{ template "nats.name" . }}" + chart: "{{ template "nats.chart" . }}" + release: {{ .Release.Name | quote }} + heritage: {{ .Release.Service | quote }} +spec: + serviceName: {{ template "nats.fullname" . }}-headless + replicas: {{ .Values.replicaCount }} + strategy: + rollingUpdate: + maxSurge: {{ .Values.deployment.maxSurge }} + maxUnavailable: {{ .Values.deployment.maxUnavailable }} + type: {{ .Values.deployment.updateType }} + selector: + matchLabels: + app: "{{ template "nats.name" . }}" + release: {{ .Release.Name | quote }} + template: + metadata: + labels: + app: "{{ template "nats.name" . }}" + chart: "{{ template "nats.chart" . }}" + release: {{ .Release.Name | quote }} + {{- if .Values.podLabels }} +{{ toYaml .Values.podLabels | indent 8 }} + {{- end }} +{{- if or .Values.podAnnotations .Values.metrics.enabled }} + annotations: +{{- if .Values.podAnnotations }} +{{ toYaml .Values.podAnnotations | indent 8 }} +{{- end }} +{{- if .Values.metrics.podAnnotations }} +{{ toYaml .Values.metrics.podAnnotations | indent 8 }} +{{- end }} +{{- end }} + spec: +{{- include "nats.imagePullSecrets" . | indent 6 }} + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName | quote }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} + {{- end }} + {{- if .Values.schedulerName }} + schedulerName: {{ .Values.schedulerName | quote }} + {{- end }} + {{- if eq .Values.antiAffinity "hard" }} + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - topologyKey: "kubernetes.io/hostname" + labelSelector: + matchLabels: + app: "{{ template "nats.name" . }}" + release: {{ .Release.Name | quote }} + {{- else if eq .Values.antiAffinity "soft" }} + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 1 + podAffinityTerm: + topologyKey: kubernetes.io/hostname + labelSelector: + matchLabels: + app: "{{ template "nats.name" . }}" + release: {{ .Release.Name | quote }} + {{- end }} + containers: + - name: {{ template "nats.name" . }} + image: {{ template "nats.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - gnatsd + args: + - -c + - /opt/bitnami/nats/gnatsd.conf + # to ensure nats could run with non-root user, we put the configuration + # file under `/opt/bitnami/nats/gnatsd.conf`, please check the link below + # for the implementation inside Dockerfile: + # - https://github.com/bitnami/bitnami-docker-nats/blob/master/1/debian-9/Dockerfile#L12 + {{- if .Values.extraArgs }} +{{ toYaml .Values.extraArgs | indent 8 }} + {{- end }} + ports: + - name: client + containerPort: {{ .Values.client.service.port }} + - name: cluster + containerPort: {{ .Values.cluster.service.port }} + - name: monitoring + containerPort: {{ .Values.monitoring.service.port }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: / + port: monitoring + initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: / + port: monitoring + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + {{- end }} + resources: +{{ toYaml .Values.resources | indent 10 }} + volumeMounts: + - name: config + mountPath: /opt/bitnami/nats/gnatsd.conf + subPath: gnatsd.conf + {{- if .Values.sidecars }} +{{ toYaml .Values.sidecars | indent 6 }} + {{- end }} +{{- if .Values.metrics.enabled }} + - name: metrics + image: {{ template "nats.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + args: +{{ toYaml .Values.metrics.args | indent 10 -}} + - "http://localhost:{{ .Values.monitoring.service.port }}" + ports: + - name: metrics + containerPort: {{ .Values.metrics.port }} + livenessProbe: + httpGet: + path: /metrics + port: metrics + initialDelaySeconds: 15 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /metrics + port: metrics + initialDelaySeconds: 5 + timeoutSeconds: 1 + resources: +{{ toYaml .Values.metrics.resources | indent 10 }} +{{- end }} + volumes: + - name: config + configMap: + name: {{ template "nats.fullname" . }} +{{- end }} diff --git a/upstreamed/nats/templates/statefulset.yaml b/upstreamed/nats/templates/statefulset.yaml index 00cc37340..662db563d 100644 --- a/upstreamed/nats/templates/statefulset.yaml +++ b/upstreamed/nats/templates/statefulset.yaml @@ -1,3 +1,4 @@ +{{- if or (eq .Values.resourceType "statefulset") (not (contains .Values.resourceType "deployment")) }} apiVersion: apps/v1beta2 kind: StatefulSet metadata: @@ -92,7 +93,11 @@ spec: - gnatsd args: - -c - - /opt/nats/gnatsd.conf + - /opt/bitnami/nats/gnatsd.conf + # to ensure nats could run with non-root user, we put the configuration + # file under `/opt/bitnami/nats/gnatsd.conf`, please check the link below + # for the implementation inside Dockerfile: + # - https://github.com/bitnami/bitnami-docker-nats/blob/master/1/debian-9/Dockerfile#L12 {{- if .Values.extraArgs }} {{ toYaml .Values.extraArgs | indent 8 }} {{- end }} @@ -129,7 +134,7 @@ spec: {{ toYaml .Values.resources | indent 10 }} volumeMounts: - name: config - mountPath: /opt/nats/gnatsd.conf + mountPath: /opt/bitnami/nats/gnatsd.conf subPath: gnatsd.conf {{- if .Values.sidecars }} {{ toYaml .Values.sidecars | indent 6 }} @@ -163,3 +168,4 @@ spec: - name: config configMap: name: {{ template "nats.fullname" . }} +{{- end }} diff --git a/upstreamed/nats/values-production.yaml b/upstreamed/nats/values-production.yaml index 2689e8a57..5330b27be 100644 --- a/upstreamed/nats/values-production.yaml +++ b/upstreamed/nats/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/nats - tag: 1.4.1 + tag: 1.4.1-debian-9-r85 pullPolicy: Always ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -65,7 +65,13 @@ podLabels: {} ## # priorityClassName: "" -## Update strategy, can be set to RollingUpdate or OnDelete by default. +## NATS cluster resource type under Kubernetes. Allowed values: statefulset (default) or deployment +## ref: +## - https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ +## - https://kubernetes.io/docs/concepts/workloads/controllers/deployment/ +resourceType: "statefulset" + +## Update strategy for statefulset, can be set to RollingUpdate or OnDelete by default. ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets statefulset: updateStrategy: OnDelete @@ -73,6 +79,12 @@ statefulset: ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions # rollingUpdatePartition: +## Update strategy for deployment, can be set to RollingUpdate or OnDelete by default. +## https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy +deployment: + updateType: RollingUpdate + # maxSurge: 25% + # maxUnavailable: 25% ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ diff --git a/upstreamed/nats/values.yaml b/upstreamed/nats/values.yaml index 46c32896f..8ca905f5c 100644 --- a/upstreamed/nats/values.yaml +++ b/upstreamed/nats/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/nats - tag: 1.4.1 + tag: 1.4.1-debian-9-r85 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -69,7 +69,13 @@ podLabels: {} ## # priorityClassName: "" -## Update strategy, can be set to RollingUpdate or OnDelete by default. +## NATS cluster resource type under Kubernetes. Allowed values: statefulset (default) or deployment +## ref: +## - https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ +## - https://kubernetes.io/docs/concepts/workloads/controllers/deployment/ +resourceType: "statefulset" + +## Update strategy for statefulset, can be set to RollingUpdate or OnDelete by default. ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets statefulset: updateStrategy: OnDelete @@ -77,6 +83,12 @@ statefulset: ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions # rollingUpdatePartition: +## Update strategy for deployment, can be set to RollingUpdate or OnDelete by default. +## https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy +deployment: + updateType: RollingUpdate + # maxSurge: 25% + # maxUnavailable: 25% ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ diff --git a/upstreamed/odoo/Chart.yaml b/upstreamed/odoo/Chart.yaml index a67e13b48..018dfd3c4 100644 --- a/upstreamed/odoo/Chart.yaml +++ b/upstreamed/odoo/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: odoo -version: 8.0.0 -appVersion: 12.0.20190415 +version: 8.0.2 +appVersion: 12.0.20190515 description: A suite of web based open source business apps. home: https://www.odoo.com/ icon: https://bitnami.com/assets/stacks/odoo/img/odoo-stack-110x117.png diff --git a/upstreamed/odoo/README.md b/upstreamed/odoo/README.md index 33da0126a..0212bace1 100644 --- a/upstreamed/odoo/README.md +++ b/upstreamed/odoo/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the Odoo chart and thei | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Odoo image registry | `docker.io` | | `image.repository` | Odoo Image name | `bitnami/odoo` | -| `image.tag` | Odoo Image tag | `{VERSION}` | +| `image.tag` | Odoo Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `odooUsername` | User of the application | `user@example.com` | @@ -123,6 +123,12 @@ $ helm install --name my-release -f values.yaml stable/odoo > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Odoo](https://github.com/bitnami/bitnami-docker-odoo) image stores the Odoo data and configurations at the `/bitnami/odoo` path of the container. diff --git a/upstreamed/odoo/templates/NOTES.txt b/upstreamed/odoo/templates/NOTES.txt index c9a711cb1..ea961082f 100644 --- a/upstreamed/odoo/templates/NOTES.txt +++ b/upstreamed/odoo/templates/NOTES.txt @@ -41,3 +41,10 @@ echo Email : {{ .Values.odooEmail }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "odoo.fullname" . }} -o jsonpath="{.data.odoo-password}" | base64 --decode) + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/odoo/values.yaml b/upstreamed/odoo/values.yaml index e2d73d5dc..11f6934e5 100644 --- a/upstreamed/odoo/values.yaml +++ b/upstreamed/odoo/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/odoo - tag: 12.0.20190415 + tag: 12.0.20190515-debian-9-r7 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/opencart/Chart.yaml b/upstreamed/opencart/Chart.yaml index b622dd25a..7ba22b8af 100644 --- a/upstreamed/opencart/Chart.yaml +++ b/upstreamed/opencart/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: opencart -version: 4.4.1 +version: 4.4.2 appVersion: 3.0.3-2 description: A free and open source e-commerce platform for online merchants. It provides a professional and reliable foundation for a successful online store. keywords: diff --git a/upstreamed/opencart/README.md b/upstreamed/opencart/README.md index 4d89154e6..981c5c6ad 100644 --- a/upstreamed/opencart/README.md +++ b/upstreamed/opencart/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the OpenCart chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | OpenCart image registry | `docker.io` | | `image.repository` | OpenCart Image name | `bitnami/opencart` | -| `image.tag` | OpenCart Image tag | `{VERSION}` | +| `image.tag` | OpenCart Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `opencartHost` | OpenCart host to create application URLs | `nil` | @@ -147,6 +147,12 @@ $ helm install --name my-release -f values.yaml stable/opencart > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami OpenCart](https://github.com/bitnami/bitnami-docker-opencart) image stores the OpenCart data and configurations at the `/bitnami/opencart` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/opencart/templates/NOTES.txt b/upstreamed/opencart/templates/NOTES.txt index 6df42bd3a..1b340dfbb 100644 --- a/upstreamed/opencart/templates/NOTES.txt +++ b/upstreamed/opencart/templates/NOTES.txt @@ -94,3 +94,10 @@ host. To configure OpenCart to use and external database host: helm upgrade {{ .Release.Name }} stable/{{ .Chart.Name }} \ --set opencartPassword=$APP_PASSWORD,opencartHost=$APP_HOST,service.type={{ .Values.service.type }},mariadb.enabled=false{{- if not (empty .Values.externalDatabase.user) }},externalDatabase.user={{ .Values.externalDatabase.user }}{{- end }}{{- if not (empty .Values.externalDatabase.password) }},externalDatabase.password={{ .Values.externalDatabase.password }}{{- end }}{{- if not (empty .Values.externalDatabase.database) }},externalDatabase.database={{ .Values.externalDatabase.database }}{{- end }},externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST{{- if .Values.global }}{{- if .Values.global.imagePullSecrets }},global.imagePullSecrets={{ .Values.global.imagePullSecrets }}{{- end }}{{- end }} {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/opencart/values.yaml b/upstreamed/opencart/values.yaml index ea8be69cc..87dbfca83 100644 --- a/upstreamed/opencart/values.yaml +++ b/upstreamed/opencart/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/opencart - tag: 3.0.3-2 + tag: 3.0.3-2-debian-9-r30 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/orangehrm/Chart.yaml b/upstreamed/orangehrm/Chart.yaml index a8c11291d..4da87c83d 100644 --- a/upstreamed/orangehrm/Chart.yaml +++ b/upstreamed/orangehrm/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: orangehrm -version: 4.3.2 +version: 4.3.3 appVersion: 4.3.1-0 description: OrangeHRM is a free HR management system that offers a wealth of modules to suit the needs of your business. diff --git a/upstreamed/orangehrm/README.md b/upstreamed/orangehrm/README.md index 9c04a2773..49c86ddb0 100644 --- a/upstreamed/orangehrm/README.md +++ b/upstreamed/orangehrm/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the OrangeHRM chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | OrangeHRM image registry | `docker.io` | | `image.repository` | OrangeHRM Image name | `bitnami/orangehrm` | -| `image.tag` | OrangeHRM Image tag | `{VERSION}` | +| `image.tag` | OrangeHRM Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `orangehrmUsername` | User of the application | `user` | @@ -133,6 +133,12 @@ $ helm install --name my-release -f values.yaml stable/orangehrm > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami OrangeHRM](https://github.com/bitnami/bitnami-docker-orangehrm) image stores the OrangeHRM data and configurations at the `/bitnami/orangehrm` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/orangehrm/templates/NOTES.txt b/upstreamed/orangehrm/templates/NOTES.txt index 5ffc4029a..ee726dbca 100644 --- a/upstreamed/orangehrm/templates/NOTES.txt +++ b/upstreamed/orangehrm/templates/NOTES.txt @@ -47,3 +47,10 @@ host. To configure OrangeHRM to use and external database host: helm upgrade {{ .Release.Name }} --set service.type={{ .Values.service.type }},mariadb.enabled=false,externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST stable/orangehrm {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/orangehrm/values.yaml b/upstreamed/orangehrm/values.yaml index 075b3bed7..763e8fdb2 100644 --- a/upstreamed/orangehrm/values.yaml +++ b/upstreamed/orangehrm/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/orangehrm - tag: 4.3.1-0 + tag: 4.3.1-0-debian-9-r5 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/osclass/Chart.yaml b/upstreamed/osclass/Chart.yaml index fd5653279..218e23265 100644 --- a/upstreamed/osclass/Chart.yaml +++ b/upstreamed/osclass/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: osclass -version: 4.3.0 +version: 4.3.1 appVersion: 3.7.4 description: Osclass is a php script that allows you to quickly create and manage your own free classifieds site. diff --git a/upstreamed/osclass/README.md b/upstreamed/osclass/README.md index 7da101a49..3f1f85839 100644 --- a/upstreamed/osclass/README.md +++ b/upstreamed/osclass/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the Osclass chart and t | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Osclass image registry | `docker.io` | | `image.repository` | Osclass Image name | `bitnami/osclass` | -| `image.tag` | Osclass Image tag | `{VERSION}` | +| `image.tag` | Osclass Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `osclassHost` | Osclass host to create application URLs | `nil` | @@ -148,6 +148,12 @@ $ helm install --name my-release -f values.yaml stable/osclass > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Osclass](https://github.com/bitnami/bitnami-docker-osclass) image stores the Osclass data and configurations at the `/bitnami/osclass` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/osclass/templates/NOTES.txt b/upstreamed/osclass/templates/NOTES.txt index c239fdda9..875e755fe 100644 --- a/upstreamed/osclass/templates/NOTES.txt +++ b/upstreamed/osclass/templates/NOTES.txt @@ -27,7 +27,7 @@ host. To configure Osclass with the URL of your service: {{- end }} {{- end }} export APP_DATABASE_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "osclass.mariadb.fullname" . }} -o jsonpath="{.data.mariadb-password}" | base64 --decode) - + 2. Complete your Osclass deployment by running: {{- if .Values.mariadb.enabled }} @@ -97,3 +97,10 @@ host. To configure Osclass to use and external database host: helm upgrade {{ .Release.Name }} stable/{{ .Chart.Name }} \ --set osclassPassword=$APP_PASSWORD,osclassHost=$APP_HOST,service.type={{ .Values.service.type }},mariadb.enabled=false{{- if not (empty .Values.externalDatabase.user) }},externalDatabase.user={{ .Values.externalDatabase.user }}{{- end }}{{- if not (empty .Values.externalDatabase.password) }},externalDatabase.password={{ .Values.externalDatabase.password }}{{- end }}{{- if not (empty .Values.externalDatabase.database) }},externalDatabase.database={{ .Values.externalDatabase.database }}{{- end }},externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST{{- if .Values.global }}{{- if .Values.global.imagePullSecrets }},global.imagePullSecrets={{ .Values.global.imagePullSecrets }}{{- end }}{{- end }} {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/osclass/values.yaml b/upstreamed/osclass/values.yaml index b83a37312..4001b6da6 100644 --- a/upstreamed/osclass/values.yaml +++ b/upstreamed/osclass/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/osclass - tag: 3.7.4 + tag: 3.7.4-debian-9-r251 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/owncloud/Chart.yaml b/upstreamed/owncloud/Chart.yaml index a867abec7..c01bb6333 100644 --- a/upstreamed/owncloud/Chart.yaml +++ b/upstreamed/owncloud/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: owncloud -version: 4.2.2 -appVersion: 10.1.1 +version: 4.2.4 +appVersion: 10.2.0 description: A file sharing server that puts the control and security of your own data back into your hands. keywords: - owncloud diff --git a/upstreamed/owncloud/README.md b/upstreamed/owncloud/README.md index ea52e00b3..20e6aa3ce 100644 --- a/upstreamed/owncloud/README.md +++ b/upstreamed/owncloud/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the ownCloud chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | ownCloud image registry | `docker.io` | | `image.repository` | ownCloud Image name | `bitnami/owncloud` | -| `image.tag` | ownCloud Image tag | `{VERSION}` | +| `image.tag` | ownCloud Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `ingress.enabled` | Enable ingress controller resource | `false` | @@ -139,6 +139,12 @@ $ helm install --name my-release -f values.yaml stable/owncloud > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami ownCloud](https://github.com/bitnami/bitnami-docker-owncloud) image stores the ownCloud data and configurations at the `/bitnami/owncloud` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/owncloud/templates/NOTES.txt b/upstreamed/owncloud/templates/NOTES.txt index 89250d4b2..a83646012 100644 --- a/upstreamed/owncloud/templates/NOTES.txt +++ b/upstreamed/owncloud/templates/NOTES.txt @@ -94,3 +94,10 @@ host. To configure ownCloud to use and external database host: helm upgrade {{ .Release.Name }} stable/{{ .Chart.Name }} \ --set owncloudPassword=$APP_PASSWORD,owncloudHost=$APP_HOST,service.type={{ .Values.service.type }},mariadb.enabled=false{{- if not (empty .Values.externalDatabase.user) }},externalDatabase.user={{ .Values.externalDatabase.user }}{{- end }}{{- if not (empty .Values.externalDatabase.password) }},externalDatabase.password={{ .Values.externalDatabase.password }}{{- end }}{{- if not (empty .Values.externalDatabase.database) }},externalDatabase.database={{ .Values.externalDatabase.database }}{{- end }},externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST{{- if .Values.global }}{{- if .Values.global.imagePullSecrets }},global.imagePullSecrets={{ .Values.global.imagePullSecrets }}{{- end }}{{- end }} {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/owncloud/values.yaml b/upstreamed/owncloud/values.yaml index 537966366..634ccf3d0 100644 --- a/upstreamed/owncloud/values.yaml +++ b/upstreamed/owncloud/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/owncloud - tag: 10.1.1 + tag: 10.2.0-debian-9-r5 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/parse/Chart.yaml b/upstreamed/parse/Chart.yaml index ef5e551dc..b561ef653 100644 --- a/upstreamed/parse/Chart.yaml +++ b/upstreamed/parse/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: parse -version: 6.2.4 -appVersion: 3.3.0 +version: 6.2.6 +appVersion: 3.4.0 description: Parse is a platform that enables users to add a scalable and powerful backend to launch a full-featured app for iOS, Android, JavaScript, Windows, Unity, and more. keywords: - parse diff --git a/upstreamed/parse/README.md b/upstreamed/parse/README.md index 1a4b3377f..feeb5cb40 100644 --- a/upstreamed/parse/README.md +++ b/upstreamed/parse/README.md @@ -56,7 +56,7 @@ The following table lists the configurable parameters of the Parse chart and the | `service.nodePorts.http` | Kubernetes http node port | `""` | | `server.image.registry` | Parse image registry | `docker.io` | | `server.image.repository` | Parse image name | `bitnami/parse` | -| `server.image.tag` | Parse image tag | `{VERSION}` | +| `server.image.tag` | Parse image tag | `{TAG_NAME}` | | `server.image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `server.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `server.securityContext.enabled` | Enable security context for Parse Server | `true` | @@ -70,7 +70,7 @@ The following table lists the configurable parameters of the Parse chart and the | `dashboard.enabled` | Enable parse dashboard | `true` | | `dashboard.image.registry` | Dashboard image registry | `docker.io` | | `dashboard.image.repository` | Dashboard image name | `bitnami/parse-dashboard` | -| `dashboard.image.tag` | Dashboard image tag | `{VERSION}` | +| `dashboard.image.tag` | Dashboard image tag | `{TAG_NAME}` | | `dashboard.image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `dashboard.securityContext.enabled` | Enable security context for Dashboard | `true` | | `dashboard.securityContext.fsGroup` | Group ID for Dashboard container | `1001` | @@ -141,6 +141,12 @@ $ helm install --name my-release -f values.yaml stable/parse > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Parse](https://github.com/bitnami/bitnami-docker-parse) image stores the Parse data and configurations at the `/bitnami/parse` path of the container. diff --git a/upstreamed/parse/templates/NOTES.txt b/upstreamed/parse/templates/NOTES.txt index d448136ec..bce5a6152 100644 --- a/upstreamed/parse/templates/NOTES.txt +++ b/upstreamed/parse/templates/NOTES.txt @@ -83,3 +83,5 @@ service: echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "parse.fullname" . }} -o jsonpath="{.data.parse-dashboard-password}" | base64 --decode) {{- end }} {{- end }} + +{{ include "parse.checkRollingTags" . }} diff --git a/upstreamed/parse/templates/_helpers.tpl b/upstreamed/parse/templates/_helpers.tpl index ef3f175a9..8e2d8e2a6 100644 --- a/upstreamed/parse/templates/_helpers.tpl +++ b/upstreamed/parse/templates/_helpers.tpl @@ -131,3 +131,15 @@ imagePullSecrets: {{- end }} {{- end -}} {{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "parse.checkRollingTags" -}} +{{- if and (contains "bitnami/" .Values.server.image.repository) (not (.Values.server.image.tag | regexFind "-r\\d+$")) }} +WARNING: Rolling tag detected ({{ .Values.server.image.repository }}:{{ .Values.server.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.dashboard.image.repository) (not (.Values.dashboard.image.tag | regexFind "-r\\d+$")) }} +WARNING: Rolling tag detected ({{ .Values.dashboard.image.repository }}:{{ .Values.dashboard.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- end -}} diff --git a/upstreamed/parse/values.yaml b/upstreamed/parse/values.yaml index 324833baf..d74215783 100644 --- a/upstreamed/parse/values.yaml +++ b/upstreamed/parse/values.yaml @@ -36,7 +36,7 @@ server: image: registry: docker.io repository: bitnami/parse - tag: 3.3.0 + tag: 3.4.0-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -96,7 +96,7 @@ dashboard: image: registry: docker.io repository: bitnami/parse-dashboard - tag: 1.2.0 + tag: 1.3.0-debian-9-r28 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/phabricator/Chart.yaml b/upstreamed/phabricator/Chart.yaml index 8ea25844b..7dd9e230a 100644 --- a/upstreamed/phabricator/Chart.yaml +++ b/upstreamed/phabricator/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: phabricator -version: 4.2.7 -appVersion: 2019.17.0 +version: 4.2.10 +appVersion: 2019.21.0 description: Collection of open source web applications that help software companies build better software. keywords: - phabricator diff --git a/upstreamed/phabricator/README.md b/upstreamed/phabricator/README.md index 3e536849b..e49366716 100644 --- a/upstreamed/phabricator/README.md +++ b/upstreamed/phabricator/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the Phabricator chart a | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Phabricator image registry | `docker.io` | | `image.repository` | Phabricator image name | `bitnami/phabricator` | -| `image.tag` | Phabricator image tag | `{VERSION}` | +| `image.tag` | Phabricator image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `phabricatorHost` | Phabricator host to create application URLs | `nil` | @@ -141,6 +141,12 @@ $ helm install --name my-release -f values.yaml stable/phabricator > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami Phabricator](https://github.com/bitnami/bitnami-docker-phabricator) image stores the Phabricator data and configurations at the `/bitnami/phabricator` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/phabricator/templates/NOTES.txt b/upstreamed/phabricator/templates/NOTES.txt index ef2e0283f..46cf05d16 100644 --- a/upstreamed/phabricator/templates/NOTES.txt +++ b/upstreamed/phabricator/templates/NOTES.txt @@ -48,3 +48,10 @@ host. To configure Phabricator with the URL of your service: echo Username: {{ .Values.phabricatorUsername }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "phabricator.fullname" . }} -o jsonpath="{.data.phabricator-password}" | base64 --decode) {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/phabricator/values.yaml b/upstreamed/phabricator/values.yaml index 4f8db4d1b..c2d289d7d 100644 --- a/upstreamed/phabricator/values.yaml +++ b/upstreamed/phabricator/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/phabricator - tag: 2019.17.0 + tag: 2019.21.0-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/phpbb/Chart.yaml b/upstreamed/phpbb/Chart.yaml index d18658cec..bdc6a9c96 100644 --- a/upstreamed/phpbb/Chart.yaml +++ b/upstreamed/phpbb/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: phpbb -version: 4.3.2 +version: 4.3.3 appVersion: 3.2.7 description: Community forum that supports the notion of users and groups, file attachments, full-text search, notifications and more. keywords: diff --git a/upstreamed/phpbb/README.md b/upstreamed/phpbb/README.md index ff68625f8..ade462709 100644 --- a/upstreamed/phpbb/README.md +++ b/upstreamed/phpbb/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the phpBB chart and the | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | phpBB image registry | `docker.io` | | `image.repository` | phpBB image name | `bitnami/phpbb` | -| `image.tag` | phpBB image tag | `{VERSION}` | +| `image.tag` | phpBB image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `phpbbUser` | User of the application | `user` | @@ -130,6 +130,12 @@ $ helm install --name my-release -f values.yaml stable/phpbb > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami phpBB](https://github.com/bitnami/bitnami-docker-phpbb) image stores the phpBB data and configurations at the `/bitnami/phpbb` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/phpbb/templates/NOTES.txt b/upstreamed/phpbb/templates/NOTES.txt index 81381d08b..7d402ce5f 100644 --- a/upstreamed/phpbb/templates/NOTES.txt +++ b/upstreamed/phpbb/templates/NOTES.txt @@ -45,3 +45,10 @@ host. To configure phpBB to use and external database host: helm upgrade {{ .Release.Name }} --set service.type={{ .Values.service.type }},mariadb.enabled=false,externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST stable/phpbb {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/phpbb/values.yaml b/upstreamed/phpbb/values.yaml index 1910b90a0..10a3a228c 100644 --- a/upstreamed/phpbb/values.yaml +++ b/upstreamed/phpbb/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/phpbb - tag: 3.2.7 + tag: 3.2.7-debian-9-r16 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/phpmyadmin/Chart.yaml b/upstreamed/phpmyadmin/Chart.yaml index 765b48ed1..edbcc80f3 100644 --- a/upstreamed/phpmyadmin/Chart.yaml +++ b/upstreamed/phpmyadmin/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: phpmyadmin -version: 2.2.0 +version: 2.2.1 appVersion: 4.8.5 description: phpMyAdmin is an mysql administration frontend keywords: diff --git a/upstreamed/phpmyadmin/README.md b/upstreamed/phpmyadmin/README.md index 91f8bd655..d391a70e2 100644 --- a/upstreamed/phpmyadmin/README.md +++ b/upstreamed/phpmyadmin/README.md @@ -50,7 +50,7 @@ The following table lists the configurable parameters of the phpMyAdmin chart an | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | phpMyAdmin image registry | `docker.io` | | `image.repository` | phpMyAdmin image name | `bitnami/phpmyadmin` | -| `image.tag` | phpMyAdmin image tag | `{VERSION}` | +| `image.tag` | phpMyAdmin image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `service.type` | Type of service for phpMyAdmin frontend | `ClusterIP` | @@ -97,6 +97,12 @@ $ helm install --name my-release -f values.yaml stable/phpmyadmin > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Upgrading ### To 1.0.0 diff --git a/upstreamed/phpmyadmin/templates/NOTES.txt b/upstreamed/phpmyadmin/templates/NOTES.txt index c7af942f6..4277729fb 100644 --- a/upstreamed/phpmyadmin/templates/NOTES.txt +++ b/upstreamed/phpmyadmin/templates/NOTES.txt @@ -4,7 +4,7 @@ You should be able to access your new phpMyAdmin installation through http{{ if $.Values.ingress.tls }}s{{ end }}://{{ if $.Values.ingress.host }}{{.Values.ingress.host}}{{else}}your-cluster-ip{{end}}{{ $.Values.ingress.path }} {{if not $.Values.ingress.host}} - + Find out your cluster ip address by running: $ kubectl cluster-info @@ -15,10 +15,10 @@ echo "phpMyAdmin URL: http://$NODE_IP:$NODE_PORT" {{- else if contains "LoadBalancer" .Values.service.type }} - + NOTE: It may take a few minutes for the LoadBalancer IP to be available. You can watch the status of by running 'kubectl get svc -w {{ template "phpmyadmin.fullname" . }}' - + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "phpmyadmin.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") echo "phpMyAdmin URL: http://$SERVICE_IP:{{ .Values.service.port }}" @@ -34,7 +34,7 @@ phpMyAdmin has been configured to connect to a database in {{ if .Values.db.chartName}}{{template "phpmyadmin.dbfullname" .}}{{ else }}{{.Values.db.host}}{{end}} {{if .Values.db.port}}with port {{.Values.db.port}} {{end }} -Please login using a database username and password. +Please login using a database username and password. {{ else if .Values.db.bundleTestDB }} For testing purposes, phpMyAdmin has been configured to point to a test MariaDB instance. Please login using the following credentials: @@ -46,9 +46,15 @@ instance. Please login using the following credentials: phpMyAdmin has not been configure to point to a specific database. Please provide the db host, username and password at log in or upgrade the release with a specific database: -$ helm upgrade {{.Release.Name}} stable/phpmyadmin --set db.host=mydb +$ helm upgrade {{.Release.Name}} stable/phpmyadmin --set db.host=mydb {{end}} -** Please be patient while the chart is being deployed ** +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} + +** Please be patient while the chart is being deployed ** diff --git a/upstreamed/phpmyadmin/values.yaml b/upstreamed/phpmyadmin/values.yaml index f0fd422ff..7f0a59dbd 100644 --- a/upstreamed/phpmyadmin/values.yaml +++ b/upstreamed/phpmyadmin/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/phpmyadmin - tag: 4.8.5 + tag: 4.8.5-debian-9-r93 ## Specify a imagePullPolicy pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. diff --git a/upstreamed/postgresql/Chart.yaml b/upstreamed/postgresql/Chart.yaml index 6259c3607..fa112c8f9 100644 --- a/upstreamed/postgresql/Chart.yaml +++ b/upstreamed/postgresql/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: postgresql -version: 4.0.2 -appVersion: 10.7.0 +version: 5.1.1 +appVersion: 11.3.0 description: Chart for PostgreSQL, an object-relational database management system (ORDBMS) with an emphasis on extensibility and on standards-compliance. keywords: - postgresql diff --git a/upstreamed/postgresql/README.md b/upstreamed/postgresql/README.md index 71fed6f19..6782fbdb9 100644 --- a/upstreamed/postgresql/README.md +++ b/upstreamed/postgresql/README.md @@ -56,7 +56,7 @@ The following tables lists the configurable parameters of the PostgreSQL chart a | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | PostgreSQL Image registry | `docker.io` | | `image.repository` | PostgreSQL Image name | `bitnami/postgresql` | -| `image.tag` | PostgreSQL Image tag | `{VERSION}` | +| `image.tag` | PostgreSQL Image tag | `{TAG_NAME}` | | `image.pullPolicy` | PostgreSQL Image pull policy | `Always` | | `image.pullSecrets` | Specify Image pull secrets | `nil` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug values should be set | `false` | @@ -83,11 +83,11 @@ The following tables lists the configurable parameters of the PostgreSQL chart a | `postgresqlConfiguration` | Runtime Config Parameters | `nil` | | `postgresqlExtendedConf` | Extended Runtime Config Parameters (appended to main or default configuration) | `nil` | | `pgHbaConfiguration` | Content of pg\_hba.conf | `nil (do not create pg_hba.conf)` | -| `configurationConfigMap` | ConfigMap with the PostgreSQL configuration files (Note: Overrides `postgresqlConfiguration` and `pgHbaConfiguration`) | `nil` | -| `extendedConfConfigMap` | ConfigMap with the extended PostgreSQL configuration files | `nil` | -| `initdbScripts` | Dictionary of initdb scripts | `nil` | -| `initdbScriptsConfigMap` | ConfigMap with the initdb scripts (Note: Overrides `initdbScripts`) | `nil` | -| `initdbScriptsSecret` | Secret with initdb scripts that contain sensitive information (Note: can be used with `initdbScriptsConfigMap` or `initdbScripts`) | `nil` | +| `configurationConfigMap` | ConfigMap with the PostgreSQL configuration files (Note: Overrides `postgresqlConfiguration` and `pgHbaConfiguration`). The value is evaluated as a template. | `nil` | +| `extendedConfConfigMap` | ConfigMap with the extended PostgreSQL configuration files. The value is evaluated as a template. | `nil` | +| `initdbScripts` | Dictionary of initdb scripts | `nil` | +| `initdbScriptsConfigMap` | ConfigMap with the initdb scripts (Note: Overrides `initdbScripts`). The value is evaluated as a template. | `nil` | +| `initdbScriptsSecret` | Secret with initdb scripts that contain sensitive information (Note: can be used with `initdbScriptsConfigMap` or `initdbScripts`). The value is evaluated as a template. | `nil` | | `service.type` | Kubernetes Service type | `ClusterIP` | | `service.port` | PostgreSQL port | `5432` | | `service.nodePort` | Kubernetes Service nodePort | `nil` | @@ -117,6 +117,8 @@ The following tables lists the configurable parameters of the PostgreSQL chart a | `securityContext.enabled` | Enable security context | `true` | | `securityContext.fsGroup` | Group ID for the container | `1001` | | `securityContext.runAsUser` | User ID for the container | `1001` | +| `serviceAccount.enabled` | Enable service account (Note: Service Account will only be automatically created if `serviceAccount.name` is not set) | `false` | +| `serviceAcccount.name` | Name of existing service account | `nil` | | `livenessProbe.enabled` | Would you like a livessProbed to be enabled | `true` | | `networkPolicy.enabled` | Enable NetworkPolicy | `false` | | `networkPolicy.allowExternal` | Don't require client label for connections | `true` | @@ -175,6 +177,12 @@ $ helm install --name my-release -f values.yaml stable/postgresql > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ### postgresql.conf / pg_hba.conf files as configMap This helm chart also supports to customize the whole configuration file. @@ -298,6 +306,36 @@ This way, the credentials will be available in all of the subcharts. ## Upgrade +## 5.0.0 + +In this version, the **chart is using PostgreSQL 11 instead of PostgreSQL 10**. You can find the main difference and notable changes in the following links: [https://www.postgresql.org/about/news/1894/](https://www.postgresql.org/about/news/1894/) and [https://www.postgresql.org/about/featurematrix/](https://www.postgresql.org/about/featurematrix/). + +For major releases of PostgreSQL, the internal data storage format is subject to change, thus complicating upgrades, you can see some errors like the following one in the logs: + +```bash +Welcome to the Bitnami postgresql container +Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-postgresql +Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-postgresql/issues +Send us your feedback at containers@bitnami.com + +INFO ==> ** Starting PostgreSQL setup ** +NFO ==> Validating settings in POSTGRESQL_* env vars.. +INFO ==> Initializing PostgreSQL database... +INFO ==> postgresql.conf file not detected. Generating it... +INFO ==> pg_hba.conf file not detected. Generating it... +INFO ==> Deploying PostgreSQL with persisted data... +INFO ==> Configuring replication parameters +INFO ==> Loading custom scripts... +INFO ==> Enabling remote connections +INFO ==> Stopping PostgreSQL... +INFO ==> ** PostgreSQL setup finished! ** + +INFO ==> ** Starting PostgreSQL ** + [1] FATAL: database files are incompatible with server + [1] DETAIL: The data directory was initialized by PostgreSQL version 10, which is not compatible with this version 11.3. +``` +In this case, you should migrate the data from the old chart to the new one following an approach similar to that described in [this section](https://www.postgresql.org/docs/current/upgrading.html#UPGRADING-VIA-PGDUMPALL) from the official documentation. Basically, create a database dump in the old chart, move and restore it in the new one. + ### 4.0.0 This chart will use by default the Bitnami PostgreSQL container starting from version `10.7.0-r68`. This version moves the initialization logic from node.js to bash. This new version of the chart requires setting the `POSTGRES_PASSWORD` in the slaves as well, in order to properly configure the `pg_hba.conf` file. Users from previous versions of the chart are advised to upgrade immediately. diff --git a/upstreamed/postgresql/templates/NOTES.txt b/upstreamed/postgresql/templates/NOTES.txt index 177334017..0848828de 100644 --- a/upstreamed/postgresql/templates/NOTES.txt +++ b/upstreamed/postgresql/templates/NOTES.txt @@ -1,6 +1,6 @@ ** Please be patient while the chart is being deployed ** -PostgreSQL can be accessed via port 5432 on the following DNS name from within your cluster: +PostgreSQL can be accessed via port {{ template "postgresql.port" . }} on the following DNS name from within your cluster: {{ template "postgresql.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local - Read/Write connection {{- if .Values.replication.enabled }} @@ -13,7 +13,7 @@ To get the password for "{{ template "postgresql.username" . }}" run: To connect to your database run the following command: kubectl run {{ template "postgresql.fullname" . }}-client --rm --tty -i --restart='Never' --namespace {{ .Release.Namespace }} --image {{ template "postgresql.image" . }} --env="PGPASSWORD=$POSTGRES_PASSWORD" {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} - --labels="{{ template "postgresql.fullname" . }}-client=true" {{- end }} --command -- psql --host {{ template "postgresql.fullname" . }} -U {{ .Values.postgresqlUsername }}{{- if .Values.postgresqlDatabase }} -d {{ .Values.postgresqlDatabase }}{{- end }} + --labels="{{ template "postgresql.fullname" . }}-client=true" {{- end }} --command -- psql --host {{ template "postgresql.fullname" . }} -U {{ .Values.postgresqlUsername }}{{- if .Values.postgresqlDatabase }} -d {{ .Values.postgresqlDatabase }}{{- end }} -p {{ template "postgresql.port" . }} {{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} Note: Since NetworkPolicy is enabled, only pods with label {{ template "postgresql.fullname" . }}-client=true" will be able to connect to this PostgreSQL cluster. @@ -33,11 +33,18 @@ To connect to your database from outside the cluster execute the following comma Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "postgresql.fullname" . }}' export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "postgresql.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") - {{ if (include "postgresql.password" . ) }}PGPASSWORD="$POSTGRES_PASSWORD" {{ end }}psql --host $SERVICE_IP --port {{ .Values.service.port }} -U {{ .Values.postgresqlUsername }}{{- if .Values.postgresqlDatabase }} -d {{ .Values.postgresqlDatabase }}{{- end }} + {{ if (include "postgresql.password" . ) }}PGPASSWORD="$POSTGRES_PASSWORD" {{ end }}psql --host $SERVICE_IP --port {{ template "postgresql.port" . }} -U {{ .Values.postgresqlUsername }}{{- if .Values.postgresqlDatabase }} -d {{ .Values.postgresqlDatabase }}{{- end }} {{- else if contains "ClusterIP" .Values.service.type }} - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "postgresql.fullname" . }} 5432:5432 & - {{ if (include "postgresql.password" . ) }}PGPASSWORD="$POSTGRES_PASSWORD" {{ end }}psql --host 127.0.0.1 -U {{ .Values.postgresqlUsername }}{{- if .Values.postgresqlDatabase }} -d {{ .Values.postgresqlDatabase }}{{- end }} + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "postgresql.fullname" . }} {{ template "postgresql.port" . }}:{{ template "postgresql.port" . }} & + {{ if (include "postgresql.password" . ) }}PGPASSWORD="$POSTGRES_PASSWORD" {{ end }}psql --host 127.0.0.1 -U {{ .Values.postgresqlUsername }}{{- if .Values.postgresqlDatabase }} -d {{ .Values.postgresqlDatabase }}{{- end }} -p {{ template "postgresql.port" . }} + +{{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ {{- end }} diff --git a/upstreamed/postgresql/templates/_helpers.tpl b/upstreamed/postgresql/templates/_helpers.tpl index 38dd8f6f0..40621db83 100644 --- a/upstreamed/postgresql/templates/_helpers.tpl +++ b/upstreamed/postgresql/templates/_helpers.tpl @@ -220,7 +220,7 @@ Get the configuration ConfigMap name. */}} {{- define "postgresql.configurationCM" -}} {{- if .Values.configurationConfigMap -}} -{{- printf "%s" .Values.configurationConfigMap -}} +{{- printf "%s" (tpl .Values.configurationConfigMap $) -}} {{- else -}} {{- printf "%s-configuration" (include "postgresql.fullname" .) -}} {{- end -}} @@ -231,7 +231,7 @@ Get the extended configuration ConfigMap name. */}} {{- define "postgresql.extendedConfigurationCM" -}} {{- if .Values.extendedConfConfigMap -}} -{{- printf "%s" .Values.extendedConfConfigMap -}} +{{- printf "%s" (tpl .Values.extendedConfConfigMap $) -}} {{- else -}} {{- printf "%s-extended-configuration" (include "postgresql.fullname" .) -}} {{- end -}} @@ -242,7 +242,7 @@ Get the initialization scripts ConfigMap name. */}} {{- define "postgresql.initdbScriptsCM" -}} {{- if .Values.initdbScriptsConfigMap -}} -{{- printf "%s" .Values.initdbScriptsConfigMap -}} +{{- printf "%s" (tpl .Values.initdbScriptsConfigMap $) -}} {{- else -}} {{- printf "%s-init-scripts" (include "postgresql.fullname" .) -}} {{- end -}} @@ -252,7 +252,7 @@ Get the initialization scripts ConfigMap name. Get the initialization scripts Secret name. */}} {{- define "postgresql.initdbScriptsSecret" -}} -{{- printf "%s" .Values.initdbScriptsSecret -}} +{{- printf "%s" (tpl .Values.initdbScriptsSecret $) -}} {{- end -}} {{/* diff --git a/upstreamed/postgresql/templates/networkpolicy.yaml b/upstreamed/postgresql/templates/networkpolicy.yaml index 40496a763..67cf5a3e6 100644 --- a/upstreamed/postgresql/templates/networkpolicy.yaml +++ b/upstreamed/postgresql/templates/networkpolicy.yaml @@ -16,12 +16,17 @@ spec: ingress: # Allow inbound connections - ports: - - port: 5432 + - port: {{ template "postgresql.port" . }} {{- if not .Values.networkPolicy.allowExternal }} from: - podSelector: matchLabels: {{ template "postgresql.fullname" . }}-client: "true" + - podSelector: + matchLabels: + app: {{ template "postgresql.name" . }} + release: {{ .Release.Name | quote }} + role: slave {{- end }} # Allow prometheus scrapes - ports: diff --git a/upstreamed/postgresql/templates/serviceaccount.yaml b/upstreamed/postgresql/templates/serviceaccount.yaml new file mode 100644 index 000000000..27e5b516e --- /dev/null +++ b/upstreamed/postgresql/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if and (.Values.serviceAccount.enabled) (not .Values.serviceAccount.name) }} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "postgresql.name" . }} + chart: {{ template "postgresql.chart" . }} + release: {{ .Release.Name | quote }} + heritage: {{ .Release.Service | quote }} + name: {{ template "postgresql.fullname" . }} +{{- end }} \ No newline at end of file diff --git a/upstreamed/postgresql/templates/statefulset-slaves.yaml b/upstreamed/postgresql/templates/statefulset-slaves.yaml index 60f529017..2b035d176 100644 --- a/upstreamed/postgresql/templates/statefulset-slaves.yaml +++ b/upstreamed/postgresql/templates/statefulset-slaves.yaml @@ -53,6 +53,9 @@ spec: securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} {{- end }} + {{- if .Values.serviceAccount.enabled }} + serviceAccountName: {{ default (include "postgresql.fullname" . ) .Values.serviceAccount.name}} + {{- end }} {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} initContainers: - name: init-chmod-data @@ -64,7 +67,8 @@ spec: - sh - -c - | - chown -R {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} /bitnami + find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" | \ + xargs chown -R {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} if [ -d {{ .Values.persistence.mountPath }}/data ]; then chmod 0700 {{ .Values.persistence.mountPath }}/data; fi @@ -88,6 +92,8 @@ spec: env: - name: BITNAMI_DEBUG value: {{ ternary "true" "false" .Values.image.debug | quote }} + - name: POSTGRESQL_PORT_NUMBER + value: "{{ template "postgresql.port" . }}" {{- if .Values.persistence.mountPath }} - name: PGDATA value: {{ .Values.postgresqlDataDir | quote }} @@ -132,9 +138,9 @@ spec: - sh - -c {{- if (include "postgresql.database" .) }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d {{ (include "postgresql.database" .) | quote }} -h 127.0.0.1 + - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d {{ (include "postgresql.database" .) | quote }} -h 127.0.0.1 -p {{ template "postgresql.port" . }} {{- else }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -h 127.0.0.1 + - exec pg_isready -U {{ include "postgresql.username" . | quote }} -h 127.0.0.1 -p {{ template "postgresql.port" . }} {{- end }} initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.livenessProbe.periodSeconds }} @@ -149,9 +155,9 @@ spec: - sh - -c {{- if (include "postgresql.database" .) }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d {{ (include "postgresql.database" .) | quote }} -h 127.0.0.1 + - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d {{ (include "postgresql.database" .) | quote }} -h 127.0.0.1 -p {{ template "postgresql.port" . }} {{- else }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -h 127.0.0.1 + - exec pg_isready -U {{ include "postgresql.username" . | quote }} -h 127.0.0.1 -p {{ template "postgresql.port" . }} {{- end }} initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.readinessProbe.periodSeconds }} diff --git a/upstreamed/postgresql/templates/statefulset.yaml b/upstreamed/postgresql/templates/statefulset.yaml index 81b5d136f..bdc0ba974 100644 --- a/upstreamed/postgresql/templates/statefulset.yaml +++ b/upstreamed/postgresql/templates/statefulset.yaml @@ -55,7 +55,10 @@ spec: {{- end }} {{- if .Values.securityContext.enabled }} securityContext: - fsGroup: {{ .Values.securityContext.fsGroup }} + fsGroup: {{ .Values.securityContext.fsGroup }} + {{- end }} + {{- if .Values.serviceAccount.enabled }} + serviceAccountName: {{ default (include "postgresql.fullname" . ) .Values.serviceAccount.name }} {{- end }} {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} initContainers: @@ -68,7 +71,8 @@ spec: - sh - -c - | - chown -R {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} /bitnami + find {{ .Values.persistence.mountPath }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" | \ + xargs chown -R {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} if [ -d {{ .Values.persistence.mountPath }}/data ]; then chmod 0700 {{ .Values.persistence.mountPath }}/data; fi @@ -92,6 +96,8 @@ spec: env: - name: BITNAMI_DEBUG value: {{ ternary "true" "false" .Values.image.debug | quote }} + - name: POSTGRESQL_PORT_NUMBER + value: "{{ template "postgresql.port" . }}" {{- if .Values.postgresqlInitdbArgs }} - name: POSTGRES_INITDB_ARGS value: {{ .Values.postgresqlInitdbArgs | quote }} @@ -157,9 +163,9 @@ spec: - sh - -c {{- if (include "postgresql.database" .) }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d {{ (include "postgresql.database" .) | quote }} -h 127.0.0.1 + - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d {{ (include "postgresql.database" .) | quote }} -h 127.0.0.1 -p {{ template "postgresql.port" . }} {{- else }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -h 127.0.0.1 + - exec pg_isready -U {{ include "postgresql.username" . | quote }} -h 127.0.0.1 -p {{ template "postgresql.port" . }} {{- end }} initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.livenessProbe.periodSeconds }} @@ -174,9 +180,9 @@ spec: - sh - -c {{- if (include "postgresql.database" .) }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d {{ (include "postgresql.database" .) | quote }} -h 127.0.0.1 + - exec pg_isready -U {{ include "postgresql.username" . | quote }} -d {{ (include "postgresql.database" .) | quote }} -h 127.0.0.1 -p {{ template "postgresql.port" . }} {{- else }} - - exec pg_isready -U {{ include "postgresql.username" . | quote }} -h 127.0.0.1 + - exec pg_isready -U {{ include "postgresql.username" . | quote }} -h 127.0.0.1 -p {{ template "postgresql.port" . }} {{- end }} initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.readinessProbe.periodSeconds }} @@ -217,7 +223,7 @@ spec: {{- if .Values.metrics.securityContext.enabled }} securityContext: runAsUser: {{ .Values.metrics.securityContext.runAsUser }} - {{- end }} + {{- end }} env: {{- $database := required "In order to enable metrics you need to specify a database (.Values.postgresqlDatabase or .Values.global.postgresql.postgresqlDatabase)" (include "postgresql.database" .) }} - name: DATA_SOURCE_URI diff --git a/upstreamed/postgresql/templates/svc-headless.yaml b/upstreamed/postgresql/templates/svc-headless.yaml index 9414d609a..8198a187b 100644 --- a/upstreamed/postgresql/templates/svc-headless.yaml +++ b/upstreamed/postgresql/templates/svc-headless.yaml @@ -12,7 +12,7 @@ spec: clusterIP: None ports: - name: postgresql - port: 5432 + port: {{ template "postgresql.port" . }} targetPort: postgresql selector: app: {{ template "postgresql.name" . }} diff --git a/upstreamed/postgresql/values-production.yaml b/upstreamed/postgresql/values-production.yaml index 8a27e7dc9..6e9e3e8f7 100644 --- a/upstreamed/postgresql/values-production.yaml +++ b/upstreamed/postgresql/values-production.yaml @@ -14,7 +14,7 @@ global: image: registry: docker.io repository: bitnami/postgresql - tag: 10.7.0 + tag: 11.3.0-debian-9-r17 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -65,6 +65,13 @@ securityContext: fsGroup: 1001 runAsUser: 1001 +## Pod Service Account +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +serviceAccount: + enabled: false + ## Name of an already existing service account. Setting this value disables the automatic service account creation. + # name: + replication: enabled: true user: repl_user diff --git a/upstreamed/postgresql/values.yaml b/upstreamed/postgresql/values.yaml index 82f965778..a549279ad 100644 --- a/upstreamed/postgresql/values.yaml +++ b/upstreamed/postgresql/values.yaml @@ -14,7 +14,7 @@ global: image: registry: docker.io repository: bitnami/postgresql - tag: 10.7.0 + tag: 11.3.0-debian-9-r17 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -65,6 +65,13 @@ securityContext: fsGroup: 1001 runAsUser: 1001 +## Pod Service Account +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +serviceAccount: + enabled: false + ## Name of an already existing service account. Setting this value disables the automatic service account creation. + # name: + replication: enabled: false user: repl_user diff --git a/upstreamed/prestashop/Chart.yaml b/upstreamed/prestashop/Chart.yaml index b0c34c569..3a6e8f3b5 100644 --- a/upstreamed/prestashop/Chart.yaml +++ b/upstreamed/prestashop/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: prestashop -version: 6.5.1 +version: 6.5.2 appVersion: 1.7.5-2 description: A popular open source ecommerce solution. Professional tools are easily accessible to increase online sales including instant guest checkout, abandoned cart reminders and automated Email marketing. keywords: diff --git a/upstreamed/prestashop/README.md b/upstreamed/prestashop/README.md index c10ea8090..d452cf95b 100644 --- a/upstreamed/prestashop/README.md +++ b/upstreamed/prestashop/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the PrestaShop chart an | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | PrestaShop image registry | `docker.io` | | `image.repository` | PrestaShop image name | `bitnami/prestashop` | -| `image.tag` | PrestaShop image tag | `{VERSION}` | +| `image.tag` | PrestaShop image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `service.type` | Kubernetes Service type | `LoadBalancer` | @@ -159,6 +159,12 @@ $ helm install --name my-release -f values.yaml stable/prestashop > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami PrestaShop](https://github.com/bitnami/bitnami-docker-prestashop) image stores the PrestaShop data and configurations at the `/bitnami/prestashop` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/prestashop/templates/NOTES.txt b/upstreamed/prestashop/templates/NOTES.txt index fd08a3f2d..4f3163046 100644 --- a/upstreamed/prestashop/templates/NOTES.txt +++ b/upstreamed/prestashop/templates/NOTES.txt @@ -98,3 +98,10 @@ host. To configure PrestaShop to use and external database host: helm upgrade {{ .Release.Name }} stable/{{ .Chart.Name }} \ --set prestashopPassword=$APP_PASSWORD,prestashopHost=$APP_HOST,service.type={{ .Values.service.type }},mariadb.enabled=false{{- if not (empty .Values.externalDatabase.user) }},externalDatabase.user={{ .Values.externalDatabase.user }}{{- end }}{{- if not (empty .Values.externalDatabase.password) }},externalDatabase.password={{ .Values.externalDatabase.password }}{{- end }}{{- if not (empty .Values.externalDatabase.database) }},externalDatabase.database={{ .Values.externalDatabase.database }}{{- end }},externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST{{- if .Values.global }}{{- if .Values.global.imagePullSecrets }},global.imagePullSecrets={{ .Values.global.imagePullSecrets }}{{- end }}{{- end }} {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/prestashop/values.yaml b/upstreamed/prestashop/values.yaml index 7a1edeff0..d57275f87 100644 --- a/upstreamed/prestashop/values.yaml +++ b/upstreamed/prestashop/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/prestashop - tag: 1.7.5-2 + tag: 1.7.5-2-debian-9-r9 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/rabbitmq/Chart.yaml b/upstreamed/rabbitmq/Chart.yaml index 8098a21c3..4be6f272c 100644 --- a/upstreamed/rabbitmq/Chart.yaml +++ b/upstreamed/rabbitmq/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: rabbitmq -version: 5.5.0 -appVersion: 3.7.14 +version: 5.8.1 +appVersion: 3.7.15 description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP) keywords: - rabbitmq diff --git a/upstreamed/rabbitmq/README.md b/upstreamed/rabbitmq/README.md index eaf05fdc6..4abe48328 100644 --- a/upstreamed/rabbitmq/README.md +++ b/upstreamed/rabbitmq/README.md @@ -51,7 +51,7 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Rabbitmq Image registry | `docker.io` | | `image.repository` | Rabbitmq Image name | `bitnami/rabbitmq` | -| `image.tag` | Rabbitmq Image tag | `{VERSION}` | +| `image.tag` | Rabbitmq Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | | `image.debug` | Specify if debug values should be set | `false` | @@ -59,17 +59,18 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `podManagementPolicy` | Pod management policy | `OrderedReady` | | `rabbitmq.username` | RabbitMQ application username | `user` | | `rabbitmq.password` | RabbitMQ application password | _random 10 character long alphanumeric string_ | -| `rabbitmq.existingPasswordSecret` | Existing secret with RabbitMQ credentials | nil | +| `rabbitmq.existingPasswordSecret` | Existing secret with RabbitMQ credentials | `nil` | | `rabbitmq.erlangCookie` | Erlang cookie | _random 32 character long alphanumeric string_ | -| `rabbitmq.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie | nil | +| `rabbitmq.existingErlangSecret` | Existing secret with RabbitMQ Erlang cookie | `nil` | | `rabbitmq.plugins` | List of plugins to enable | `rabbitmq_management rabbitmq_peer_discovery_k8s` | | `rabbitmq.extraPlugins` | Extra plugings to enable | `nil` | | `rabbitmq.clustering.address_type` | Switch clustering mode | `ip` or `hostname` | | `rabbitmq.clustering.k8s_domain` | Customize internal k8s cluster domain | `cluster.local` | | `rabbitmq.logs` | Value for the RABBITMQ_LOGS environment variable | `-` | +| `rabbitmq.setUlimitNofiles` | Specify if max file descriptor limit should be set | `true` | | `rabbitmq.ulimitNofiles` | Max File Descriptor limit | `65536` | -| `rabbitmq.maxAvailableSchedulers | RabbitMQ maximum available scheduler threads | `2` | -| `rabbitmq.onlineSchedulers | RabbitMQ online scheduler threads | `1` | +| `rabbitmq.maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `2` | +| `rabbitmq.onlineSchedulers` | RabbitMQ online scheduler threads | `1` | | `rabbitmq.configuration` | Required cluster configuration | See values.yaml | | `rabbitmq.extraConfiguration` | Extra configuration to add to rabbitmq.conf | See values.yaml | | `service.type` | Kubernetes Service type | `ClusterIP` | @@ -80,7 +81,7 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `persistence.enabled` | Use a PVC to persist data | `true` | | `service.annotations` | service annotations as an array | [] | | `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | -| `persistence.existingClaim` | RabbitMQ data Persistent Volume existing claim name | "" | +| `persistence.existingClaim` | RabbitMQ data Persistent Volume existing claim name, evaluated as a template | "" | | `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | | `persistence.size` | Size of data volume | `8Gi` | | `persistence.path` | Mount path of the data volume | `/opt/bitnami/rabbitmq/var/lib/rabbitmq` | @@ -126,6 +127,7 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | | `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | | `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `forceBoot.enabled` | Executes 'rabbitmqctl force_boot' to force boot cluster shut down unexpectedly in an unknown order. Use it only if you prefer availability over integrity.) | `false` | The above parameters map to the env variables defined in [bitnami/rabbitmq](http://github.com/bitnami/bitnami-docker-rabbitmq). For more information please refer to the [bitnami/rabbitmq](http://github.com/bitnami/bitnami-docker-rabbitmq) image documentation. @@ -147,6 +149,12 @@ $ helm install --name my-release -f values.yaml stable/rabbitmq > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ### Load Definitions It is possible to [load a RabbitMQ definitions file to configure RabbitMQ](http://www.rabbitmq.com/management.html#load-definitions). Because definitions may contain RabbitMQ credentials, [store the JSON as a Kubernetes secret](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod). Within the secret's data, choose a key name that corresponds with the desired load definitions filename (i.e. `load_definition.json`) and use the JSON object as the value. For example: diff --git a/upstreamed/rabbitmq/templates/NOTES.txt b/upstreamed/rabbitmq/templates/NOTES.txt index 51b28ba02..f75554e7d 100644 --- a/upstreamed/rabbitmq/templates/NOTES.txt +++ b/upstreamed/rabbitmq/templates/NOTES.txt @@ -57,3 +57,10 @@ To Access the RabbitMQ Management interface: echo "URL : http://127.0.0.1:{{ .Values.service.managerPort }}/" {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/rabbitmq/templates/statefulset.yaml b/upstreamed/rabbitmq/templates/statefulset.yaml index ebb762c5c..881873878 100644 --- a/upstreamed/rabbitmq/templates/statefulset.yaml +++ b/upstreamed/rabbitmq/templates/statefulset.yaml @@ -86,7 +86,9 @@ spec: #copy the mounted configuration to both places cp /opt/bitnami/rabbitmq/conf/* /opt/bitnami/rabbitmq/etc/rabbitmq # Apply resources limits + {{- if .Values.rabbitmq.setUlimitNofiles }} ulimit -n "${RABBITMQ_ULIMIT_NOFILES}" + {{- end }} #replace the default password that is generated sed -i "s/CHANGEME/$RABBITMQ_PASSWORD/g" /opt/bitnami/rabbitmq/etc/rabbitmq/rabbitmq.conf #api check for probes @@ -100,6 +102,9 @@ spec: test "\${EXPECTED}" = "\${ACTUAL}" EOF chmod a+x /opt/bitnami/rabbitmq/sbin/rabbitmq-api-check + {{- if and .Values.persistence.enabled .Values.forceBoot.enabled }} + rabbitmqctl force_boot + {{- end }} exec rabbitmq-server {{- if .Values.resources }} resources: @@ -272,7 +277,9 @@ spec: {{- else if .Values.persistence.existingClaim }} - name: data persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim }} + {{- with .Values.persistence.existingClaim }} + claimName: {{ tpl . $ }} + {{- end }} {{- else }} volumeClaimTemplates: - metadata: diff --git a/upstreamed/rabbitmq/values-production.yaml b/upstreamed/rabbitmq/values-production.yaml index 6736dd0ea..becb1a8a9 100644 --- a/upstreamed/rabbitmq/values-production.yaml +++ b/upstreamed/rabbitmq/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/rabbitmq - tag: 3.7.14 + tag: 3.7.15-debian-9-r8 ## set to true if you would like to see extra information on logs ## it turns BASH and NAMI debugging in minideb @@ -81,6 +81,7 @@ rabbitmq: ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ## ref: https://www.rabbitmq.com/install-debian.html#kernel-resource-limits ## + setUlimitNofiles: true ulimitNofiles: '65536' ## RabbitMQ maximum available scheduler threads and online scheduler threads @@ -184,6 +185,8 @@ persistence: accessMode: ReadWriteOnce ## Existing PersistentVolumeClaims + ## The value is evaluated as a template + ## So, for example, the name can depend on .Release or .Chart # existingClaim: "" # If you change this value, you might have to adjust `rabbitmq.diskFreeLimit` as well. @@ -314,3 +317,10 @@ volumePermissions: # pullSecrets: # - myRegistryKeySecretName resources: {} + +## forceBoot: executes 'rabbitmqctl force_boot' to force boot cluster shut down unexpectedly in an +## unknown order. +## ref: https://www.rabbitmq.com/rabbitmqctl.8.html#force_boot +## +forceBoot: + enabled: false diff --git a/upstreamed/rabbitmq/values.yaml b/upstreamed/rabbitmq/values.yaml index 36221c6da..a901e8e74 100644 --- a/upstreamed/rabbitmq/values.yaml +++ b/upstreamed/rabbitmq/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/rabbitmq - tag: 3.7.14 + tag: 3.7.15-debian-9-r8 ## set to true if you would like to see extra information on logs ## it turns BASH and NAMI debugging in minideb @@ -80,6 +80,7 @@ rabbitmq: ## ref: https://github.com/bitnami/bitnami-docker-rabbitmq#environment-variables ## ref: https://www.rabbitmq.com/install-debian.html#kernel-resource-limits ## + setUlimitNofiles: true ulimitNofiles: '65536' ## RabbitMQ maximum available scheduler threads and online scheduler threads @@ -183,6 +184,8 @@ persistence: accessMode: ReadWriteOnce ## Existing PersistentVolumeClaims + ## The value is evaluated as a template + ## So, for example, the name can depend on .Release or .Chart # existingClaim: "" # If you change this value, you might have to adjust `rabbitmq.diskFreeLimit` as well. @@ -310,3 +313,10 @@ volumePermissions: # pullSecrets: # - myRegistryKeySecretName resources: {} + +## forceBoot: executes 'rabbitmqctl force_boot' to force boot cluster shut down unexpectedly in an +## unknown order. +## ref: https://www.rabbitmq.com/rabbitmqctl.8.html#force_boot +## +forceBoot: + enabled: false diff --git a/upstreamed/redis/Chart.yaml b/upstreamed/redis/Chart.yaml index 93fdee853..94b4152b5 100644 --- a/upstreamed/redis/Chart.yaml +++ b/upstreamed/redis/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: redis -version: 7.1.0 -appVersion: 4.0.14 +version: 8.0.4 +appVersion: 5.0.5 description: Open source, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. keywords: - redis diff --git a/upstreamed/redis/README.md b/upstreamed/redis/README.md index ba8eea074..945a07ab9 100644 --- a/upstreamed/redis/README.md +++ b/upstreamed/redis/README.md @@ -117,170 +117,170 @@ kubectl patch deployments my-release-redis-metrics --type=json -p='[{"op": "remo The following table lists the configurable parameters of the Redis chart and their default values. -| Parameter | Description | Default | | | -|-----------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|----------------------------------------------------|---------| -| `global.imageRegistry` | Global Docker image registry | `nil` | | | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | | -| `image.registry` | Redis Image registry | `docker.io` | | | -| `image.repository` | Redis Image name | `bitnami/redis` | | | -| `image.tag` | Redis Image tag | `{VERSION}` | | | -| `image.pullPolicy` | Image pull policy | `Always` | | | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | | | -| `cluster.enabled` | Use master-slave topology | `true` | | | -| `cluster.slaveCount` | Number of slaves | `1` | | | -| `existingSecret` | Name of existing secret object (for password authentication) | `nil` | | | -| `usePassword` | Use password | `true` | | | -| `usePasswordFile` | Mount passwords as files instead of environment variables | `false` | | | -| `password` | Redis password (ignored if existingSecret set) | Randomly generated | | | -| `configmap` | Redis configuration file to be used | See values.yaml | | | -| `clusterDomain` | Kubernetes DNS Domain name to use | `cluster.local` | | | -| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | | | -| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | | | -| `securityContext.enabled` | Enable security context (both redis master and slave pods) | `true` | | | -| `securityContext.fsGroup` | Group ID for the container (both redis master and slave pods) | `1001` | | | -| `securityContext.runAsUser` | User ID for the container (both redis master and slave pods) | `1001` | | | -| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | | | -| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the fullname template | | | -| `rbac.create` | Specifies whether RBAC resources should be created | `false` | | | -| `rbac.role.rules` | Rules to create | `[]` | | | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | | | -| `metrics.image.registry` | Redis exporter image registry | `docker.io` | | | -| `metrics.image.repository` | Redis exporter image name | `oliver006/redis_exporter` | | | -| `metrics.image.tag` | Redis exporter image tag | `v0.31.0` | | | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | | | -| `metrics.extraArgs` | Extra arguments for the binary; possible values [here](https://github.com/oliver006/redis_exporter#flags) | {} | | | -| `metrics.podLabels` | Additional labels for Metrics exporter pod | {} | | | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | {} | | | -| `metrics.service.type` | Kubernetes Service type (redis metrics) | `ClusterIP` | | | -| `metrics.service.annotations` | Annotations for the services to monitor (redis master and redis slave service) | {} | | | -| `metrics.service.loadBalancerIP` | loadBalancerIP if redis metrics service type is `LoadBalancer` | `nil` | | | -| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | | | -| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | | | -| `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `nil` | | | -| `metrics.serviceMonitor.interval` | How frequently to scrape metrics (use by default, falling back to Prometheus' default) | `nil` | | | -| `metrics.serviceMonitor.selector` | Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install | `{ prometheus: kube-prometheus }` | | | -| `metrics.priorityClassName` | Metrics exporter pod priorityClassName | {} | | | -| `persistence.existingClaim` | Provide an existing PersistentVolumeClaim | `nil` | | | -| `master.persistence.enabled` | Use a PVC to persist data (master node) | `true` | | | -| `master.persistence.path` | Path to mount the volume at, to use other images | `/data` | | | -| `master.persistence.subPath` | Subdirectory of the volume to mount at | `""` | | | -| `master.persistence.storageClass` | Storage class of backing PVC | `generic` | | | -| `master.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | | | -| `master.persistence.size` | Size of data volume | `8Gi` | | | -| `master.statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | | | -| `master.statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | | | -| `master.podLabels` | Additional labels for Redis master pod | {} | | | -| `master.podAnnotations` | Additional annotations for Redis master pod | {} | | | -| `redisPort` | Redis port (in both master and slaves) | `6379` | | | -| `master.command` | Redis master entrypoint string. The command `redis-server` is executed if this is not provided. | `/run.sh` | | | -| `master.disableCommands` | Array of Redis commands to disable (master) | `["FLUSHDB", "FLUSHALL"]` | | | -| `master.extraFlags` | Redis master additional command line flags | [] | | | -| `master.nodeSelector` | Redis master Node labels for pod assignment | {"beta.kubernetes.io/arch": "amd64"} | | | -| `master.tolerations` | Toleration labels for Redis master pod assignment | [] | | | -| `master.affinity` | Affinity settings for Redis master pod assignment | {} | | | -| `master.schedulerName` | Name of an alternate scheduler | `nil` | | | -| `master.service.type` | Kubernetes Service type (redis master) | `ClusterIP` | | | -| `master.service.port` | Kubernetes Service port (redis master) | `6379` | | | -| `master.service.nodePort` | Kubernetes Service nodePort (redis master) | `nil` | | | -| `master.service.annotations` | annotations for redis master service | {} | | | -| `master.service.loadBalancerIP` | loadBalancerIP if redis master service type is `LoadBalancer` | `nil` | | | -| `master.resources` | Redis master CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `100m` | | | -| `master.livenessProbe.enabled` | Turn on and off liveness probe (redis master pod) | `true` | | | -| `master.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis master pod) | `30` | | | -| `master.livenessProbe.periodSeconds` | How often to perform the probe (redis master pod) | `30` | | | -| `master.livenessProbe.timeoutSeconds` | When the probe times out (redis master pod) | `5` | | | -| `master.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis master pod) | `1` | | | -| `master.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | | | -| `master.readinessProbe.enabled` | Turn on and off readiness probe (redis master pod) | `true` | | | -| `master.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (redis master pod) | `5` | | | -| `master.readinessProbe.periodSeconds` | How often to perform the probe (redis master pod) | `10` | | | -| `master.readinessProbe.timeoutSeconds` | When the probe times out (redis master pod) | `1` | | | -| `master.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis master pod) | `1` | | | -| `master.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | | | -| `master.priorityClassName` | Redis Master pod priorityClassName | {} | | | -| `volumePermissions.enabled` | Enable init container that changes volume permissions in the registry (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | | | -| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | | | -| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | | | -| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | | | -| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | | | -| `volumePermissions.resources ` | Init container volume-permissions CPU/Memory resource requests/limits | {} | | | -| `slave.service.type` | Kubernetes Service type (redis slave) | `ClusterIP` | | | -| `slave.service.nodePort` | Kubernetes Service nodePort (redis slave) | `nil` | | | -| `slave.service.annotations` | annotations for redis slave service | {} | | | -| `slave.service.port` | Kubernetes Service port (redis slave) | `6379` | | | -| `slave.service.loadBalancerIP` | LoadBalancerIP if Redis slave service type is `LoadBalancer` | `nil` | | | -| `slave.command` | Redis slave entrypoint array. The docker image's ENTRYPOINT is used if this is not provided. | `/run.sh` | | | -| `slave.disableCommands` | Array of Redis commands to disable (slave) | `[FLUSHDB, FLUSHALL]` | | | -| `slave.extraFlags` | Redis slave additional command line flags | `[]` | | | -| `slave.livenessProbe.enabled` | Turn on and off liveness probe (redis slave pod) | `true` | | | -| `slave.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis slave pod) | `30` | | | -| `slave.livenessProbe.periodSeconds` | How often to perform the probe (redis slave pod) | `10` | | | -| `slave.livenessProbe.timeoutSeconds` | When the probe times out (redis slave pod) | `5` | | | -| `slave.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis slave pod) | `1` | | | -| `slave.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | | | -| `slave.readinessProbe.enabled` | Turn on and off slave.readiness probe (redis slave pod) | `true` | | | -| `slave.readinessProbe.initialDelaySeconds` | Delay before slave.readiness probe is initiated (redis slave pod) | `5` | | | -| `slave.readinessProbe.periodSeconds` | How often to perform the probe (redis slave pod) | `10` | | | -| `slave.readinessProbe.timeoutSeconds` | When the probe times out (redis slave pod) | `10` | | | -| `slave.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis slave pod) | `1` | | | -| `slave.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. (redis slave pod) | `5` | | | -| `slave.persistence.enabled` | Use a PVC to persist data (slave node) | `true` | | | -| `slave.persistence.path` | Path to mount the volume at, to use other images | `/data` | | | -| `slave.persistence.subPath` | Subdirectory of the volume to mount at | `""` | | | -| `slave.persistence.storageClass` | Storage class of backing PVC | `generic` | | | -| `slave.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | | | -| `slave.persistence.size` | Size of data volume | `8Gi` | | | -| `slave.statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | | | -| `slave.statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | | | -| `slave.podLabels` | Additional labels for Redis slave pod | `master.podLabels` | | | -| `slave.podAnnotations` | Additional annotations for Redis slave pod | `master.podAnnotations` | | | -| `slave.schedulerName` | Name of an alternate scheduler | `nil` | | | -| `slave.resources` | Redis slave CPU/Memory resource requests/limits | `{}` | | | -| `slave.affinity` | Enable node/pod affinity for slaves | {} | | | -| `slave.priorityClassName` | Redis Slave pod priorityClassName | {} | | | -| `sentinel.enabled` | Enable sentinel containers | `false` | | | -| `sentinel.masterSet` | Name of the sentinel master set | `mymaster` | | | -| `sentinel.initialCheckTimeout` | Timeout for querying the redis sentinel service for the active sentinel list | `5` | | | -| `sentinel.quorum` | Quorum for electing a new master | `2` | | | -| `sentinel.downAfterMilliseconds` | Timeout for detecting a Redis node is down | `60000` | | | -| `sentinel.failoverTimeout` | Timeout for performing a election failover | `18000` | | | -| `sentinel.parallelSyncs` | Number of parallel syncs in the cluster | `1` | | | -| `sentinel.port` | Redis Sentinel port | `26379` | | | -| `sentinel.service.type` | Kubernetes Service type (redis sentinel) | `ClusterIP` | | | -| `sentinel.service.nodePort` | Kubernetes Service nodePort (redis sentinel) | `nil` | | | -| `sentinel.service.annotations` | annotations for redis sentinel service | {} | | | -| `sentinel.service.redisPort` | Kubernetes Service port for Redis read only operations | `6379` | | | -| `sentinel.service.sentinelPort` | Kubernetes Service port for Redis sentinel | `26379` | | | -| `sentinel.service.redisNodePort` | Kubernetes Service node port for Redis read only operations | `` | | | -| `sentinel.service.sentinelNodePort` | Kubernetes Service node port for Redis sentinel | `` | | | -| `sentinel.service.loadBalancerIP` | LoadBalancerIP if Redis sentinel service type is `LoadBalancer` | `nil` | | | -| `sentinel.livenessProbe.enabled` | Turn on and off liveness probe (redis sentinel pod) | `true` | | | -| `sentinel.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis sentinel pod) | `5` | | | -| `sentinel.livenessProbe.periodSeconds` | How often to perform the probe (redis sentinel container) | `5` | | | -| `sentinel.livenessProbe.timeoutSeconds` | When the probe times out (redis sentinel container) | `5` | | | -| `sentinel.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis sentinel container) | `1` | | | -| `sentinel.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | | | -| `sentinel.readinessProbe.enabled` | Turn on and off sentinel.readiness probe (redis sentinel pod) | `true` | | | -| `sentinel.readinessProbe.initialDelaySeconds` | Delay before sentinel.readiness probe is initiated (redis sentinel pod) | `5` | | | -| `sentinel.readinessProbe.periodSeconds` | How often to perform the probe (redis sentinel pod) | `5` | | | -| `sentinel.readinessProbe.timeoutSeconds` | When the probe times out (redis sentinel container) | `1` | | | -| `sentinel.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis sentinel container) | `1` | | | -| `sentinel.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. (redis sentinel container) | `5` | | | -| `sentinel.resources` | Redis sentinel CPU/Memory resource requests/limits | `{}` | | | -| `sentinel.image.registry` | Redis Sentinel Image registry | `docker.io` | | | -| `sentinel.image.repository` | Redis Sentinel Image name | `bitnami/redis-sentinel` | | | -| `sentinel.image.tag` | Redis Sentinel Image tag | `{VERSION}` | | | -| `sentinel.image.pullPolicy` | Image pull policy | `Always` | | | -| `sentinel.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | | | -| `cluster.enabled` | Use master-slave topology | `sysctlImage.enabled` | Enable an init container to modify Kernel settings | `false` | -| `sysctlImage.command` | sysctlImage command to execute | [] | | | -| `sysctlImage.registry` | sysctlImage Init container registry | `docker.io` | | | -| `sysctlImage.repository` | sysctlImage Init container name | `bitnami/minideb` | | | -| `sysctlImage.tag` | sysctlImage Init container tag | `latest` | | | -| `sysctlImage.pullPolicy` | sysctlImage Init container pull policy | `Always` | | | -| `sysctlImage.mountHostSys` | Mount the host `/sys` folder to `/host-sys` | `false` | | | -| `sysctlImage.resources` | sysctlImage Init container CPU/Memory resource requests/limits | {} | | | +| Parameter | Description | Default | +|-----------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------| +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Redis Image registry | `docker.io` | +| `image.repository` | Redis Image name | `bitnami/redis` | +| `image.tag` | Redis Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `Always` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | +| `cluster.enabled` | Use master-slave topology | `true` | +| `cluster.slaveCount` | Number of slaves | `1` | +| `existingSecret` | Name of existing secret object (for password authentication) | `nil` | +| `usePassword` | Use password | `true` | +| `usePasswordFile` | Mount passwords as files instead of environment variables | `false` | +| `password` | Redis password (ignored if existingSecret set) | Randomly generated | +| `configmap` | Redis configuration file to be used | See values.yaml | +| `clusterDomain` | Kubernetes DNS Domain name to use | `cluster.local` | +| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | +| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | +| `securityContext.enabled` | Enable security context (both redis master and slave pods) | `true` | +| `securityContext.fsGroup` | Group ID for the container (both redis master and slave pods) | `1001` | +| `securityContext.runAsUser` | User ID for the container (both redis master and slave pods) | `1001` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | +| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the fullname template | +| `rbac.create` | Specifies whether RBAC resources should be created | `false` | +| `rbac.role.rules` | Rules to create | `[]` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | Redis exporter image registry | `docker.io` | +| `metrics.image.repository` | Redis exporter image name | `oliver006/redis_exporter` | +| `metrics.image.tag` | Redis exporter image tag | `v0.31.0` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | +| `metrics.extraArgs` | Extra arguments for the binary; possible values [here](https://github.com/oliver006/redis_exporter#flags) | {} | +| `metrics.podLabels` | Additional labels for Metrics exporter pod | {} | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | {} | +| `metrics.service.type` | Kubernetes Service type (redis metrics) | `ClusterIP` | +| `metrics.service.annotations` | Annotations for the services to monitor (redis master and redis slave service) | {} | +| `metrics.service.loadBalancerIP` | loadBalancerIP if redis metrics service type is `LoadBalancer` | `nil` | +| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | +| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | +| `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `nil` | +| `metrics.serviceMonitor.interval` | How frequently to scrape metrics (use by default, falling back to Prometheus' default) | `nil` | +| `metrics.serviceMonitor.selector` | Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install | `{ prometheus: kube-prometheus }` | +| `metrics.priorityClassName` | Metrics exporter pod priorityClassName | {} | +| `persistence.existingClaim` | Provide an existing PersistentVolumeClaim | `nil` | +| `master.persistence.enabled` | Use a PVC to persist data (master node) | `true` | +| `master.persistence.path` | Path to mount the volume at, to use other images | `/data` | +| `master.persistence.subPath` | Subdirectory of the volume to mount at | `""` | +| `master.persistence.storageClass` | Storage class of backing PVC | `generic` | +| `master.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | +| `master.persistence.size` | Size of data volume | `8Gi` | +| `master.statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | +| `master.statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | +| `master.podLabels` | Additional labels for Redis master pod | {} | +| `master.podAnnotations` | Additional annotations for Redis master pod | {} | +| `redisPort` | Redis port (in both master and slaves) | `6379` | +| `master.command` | Redis master entrypoint string. The command `redis-server` is executed if this is not provided. | `/run.sh` | +| `master.disableCommands` | Array of Redis commands to disable (master) | `["FLUSHDB", "FLUSHALL"]` | +| `master.extraFlags` | Redis master additional command line flags | [] | +| `master.nodeSelector` | Redis master Node labels for pod assignment | {"beta.kubernetes.io/arch": "amd64"} | +| `master.tolerations` | Toleration labels for Redis master pod assignment | [] | +| `master.affinity` | Affinity settings for Redis master pod assignment | {} | +| `master.schedulerName` | Name of an alternate scheduler | `nil` | +| `master.service.type` | Kubernetes Service type (redis master) | `ClusterIP` | +| `master.service.port` | Kubernetes Service port (redis master) | `6379` | +| `master.service.nodePort` | Kubernetes Service nodePort (redis master) | `nil` | +| `master.service.annotations` | annotations for redis master service | {} | +| `master.service.loadBalancerIP` | loadBalancerIP if redis master service type is `LoadBalancer` | `nil` | +| `master.resources` | Redis master CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `100m` | +| `master.livenessProbe.enabled` | Turn on and off liveness probe (redis master pod) | `true` | +| `master.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis master pod) | `30` | +| `master.livenessProbe.periodSeconds` | How often to perform the probe (redis master pod) | `30` | +| `master.livenessProbe.timeoutSeconds` | When the probe times out (redis master pod) | `5` | +| `master.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis master pod) | `1` | +| `master.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `master.readinessProbe.enabled` | Turn on and off readiness probe (redis master pod) | `true` | +| `master.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (redis master pod) | `5` | +| `master.readinessProbe.periodSeconds` | How often to perform the probe (redis master pod) | `10` | +| `master.readinessProbe.timeoutSeconds` | When the probe times out (redis master pod) | `1` | +| `master.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis master pod) | `1` | +| `master.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `master.priorityClassName` | Redis Master pod priorityClassName | {} | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the registry (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` | +| `volumePermissions.resources ` | Init container volume-permissions CPU/Memory resource requests/limits | {} | +| `slave.service.type` | Kubernetes Service type (redis slave) | `ClusterIP` | +| `slave.service.nodePort` | Kubernetes Service nodePort (redis slave) | `nil` | +| `slave.service.annotations` | annotations for redis slave service | {} | +| `slave.service.port` | Kubernetes Service port (redis slave) | `6379` | +| `slave.service.loadBalancerIP` | LoadBalancerIP if Redis slave service type is `LoadBalancer` | `nil` | +| `slave.command` | Redis slave entrypoint array. The docker image's ENTRYPOINT is used if this is not provided. | `/run.sh` | +| `slave.disableCommands` | Array of Redis commands to disable (slave) | `[FLUSHDB, FLUSHALL]` | +| `slave.extraFlags` | Redis slave additional command line flags | `[]` | +| `slave.livenessProbe.enabled` | Turn on and off liveness probe (redis slave pod) | `true` | +| `slave.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis slave pod) | `30` | +| `slave.livenessProbe.periodSeconds` | How often to perform the probe (redis slave pod) | `10` | +| `slave.livenessProbe.timeoutSeconds` | When the probe times out (redis slave pod) | `5` | +| `slave.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis slave pod) | `1` | +| `slave.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `slave.readinessProbe.enabled` | Turn on and off slave.readiness probe (redis slave pod) | `true` | +| `slave.readinessProbe.initialDelaySeconds` | Delay before slave.readiness probe is initiated (redis slave pod) | `5` | +| `slave.readinessProbe.periodSeconds` | How often to perform the probe (redis slave pod) | `10` | +| `slave.readinessProbe.timeoutSeconds` | When the probe times out (redis slave pod) | `10` | +| `slave.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis slave pod) | `1` | +| `slave.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. (redis slave pod) | `5` | +| `slave.persistence.enabled` | Use a PVC to persist data (slave node) | `true` | +| `slave.persistence.path` | Path to mount the volume at, to use other images | `/data` | +| `slave.persistence.subPath` | Subdirectory of the volume to mount at | `""` | +| `slave.persistence.storageClass` | Storage class of backing PVC | `generic` | +| `slave.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | +| `slave.persistence.size` | Size of data volume | `8Gi` | +| `slave.statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | +| `slave.statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | +| `slave.podLabels` | Additional labels for Redis slave pod | `master.podLabels` | +| `slave.podAnnotations` | Additional annotations for Redis slave pod | `master.podAnnotations` | +| `slave.schedulerName` | Name of an alternate scheduler | `nil` | +| `slave.resources` | Redis slave CPU/Memory resource requests/limits | `{}` | +| `slave.affinity` | Enable node/pod affinity for slaves | {} | +| `slave.priorityClassName` | Redis Slave pod priorityClassName | {} | +| `sentinel.enabled` | Enable sentinel containers | `false` | +| `sentinel.masterSet` | Name of the sentinel master set | `mymaster` | +| `sentinel.initialCheckTimeout` | Timeout for querying the redis sentinel service for the active sentinel list | `5` | +| `sentinel.quorum` | Quorum for electing a new master | `2` | +| `sentinel.downAfterMilliseconds` | Timeout for detecting a Redis node is down | `60000` | +| `sentinel.failoverTimeout` | Timeout for performing a election failover | `18000` | +| `sentinel.parallelSyncs` | Number of parallel syncs in the cluster | `1` | +| `sentinel.port` | Redis Sentinel port | `26379` | +| `sentinel.service.type` | Kubernetes Service type (redis sentinel) | `ClusterIP` | +| `sentinel.service.nodePort` | Kubernetes Service nodePort (redis sentinel) | `nil` | +| `sentinel.service.annotations` | annotations for redis sentinel service | {} | +| `sentinel.service.redisPort` | Kubernetes Service port for Redis read only operations | `6379` | +| `sentinel.service.sentinelPort` | Kubernetes Service port for Redis sentinel | `26379` | +| `sentinel.service.redisNodePort` | Kubernetes Service node port for Redis read only operations | `` | +| `sentinel.service.sentinelNodePort` | Kubernetes Service node port for Redis sentinel | `` | +| `sentinel.service.loadBalancerIP` | LoadBalancerIP if Redis sentinel service type is `LoadBalancer` | `nil` | +| `sentinel.livenessProbe.enabled` | Turn on and off liveness probe (redis sentinel pod) | `true` | +| `sentinel.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis sentinel pod) | `5` | +| `sentinel.livenessProbe.periodSeconds` | How often to perform the probe (redis sentinel container) | `5` | +| `sentinel.livenessProbe.timeoutSeconds` | When the probe times out (redis sentinel container) | `5` | +| `sentinel.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis sentinel container) | `1` | +| `sentinel.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `sentinel.readinessProbe.enabled` | Turn on and off sentinel.readiness probe (redis sentinel pod) | `true` | +| `sentinel.readinessProbe.initialDelaySeconds` | Delay before sentinel.readiness probe is initiated (redis sentinel pod) | `5` | +| `sentinel.readinessProbe.periodSeconds` | How often to perform the probe (redis sentinel pod) | `5` | +| `sentinel.readinessProbe.timeoutSeconds` | When the probe times out (redis sentinel container) | `1` | +| `sentinel.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis sentinel container) | `1` | +| `sentinel.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. (redis sentinel container) | `5` | +| `sentinel.resources` | Redis sentinel CPU/Memory resource requests/limits | `{}` | +| `sentinel.image.registry` | Redis Sentinel Image registry | `docker.io` | +| `sentinel.image.repository` | Redis Sentinel Image name | `bitnami/redis-sentinel` | +| `sentinel.image.tag` | Redis Sentinel Image tag | `{TAG_NAME}` | +| `sentinel.image.pullPolicy` | Image pull policy | `Always` | +| `sentinel.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | +| `sysctlImage.enabled` | Enable an init container to modify Kernel settings | `false` | +| `sysctlImage.command` | sysctlImage command to execute | [] | +| `sysctlImage.registry` | sysctlImage Init container registry | `docker.io` | +| `sysctlImage.repository` | sysctlImage Init container name | `bitnami/minideb` | +| `sysctlImage.tag` | sysctlImage Init container tag | `latest` | +| `sysctlImage.pullPolicy` | sysctlImage Init container pull policy | `Always` | +| `sysctlImage.mountHostSys` | Mount the host `/sys` folder to `/host-sys` | `false` | +| `sysctlImage.resources` | sysctlImage Init container CPU/Memory resource requests/limits | {} | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -302,6 +302,12 @@ $ helm install --name my-release -f values.yaml stable/redis > **Note for minikube users**: Current versions of minikube (v0.24.1 at the time of writing) provision `hostPath` persistent volumes that are only writable by root. Using chart defaults cause pod failure for the Redis pod as it attempts to write to the `/bitnami` directory. Consider installing Redis with `--set persistence.enabled=false`. See minikube issue [1990](https://github.com/kubernetes/minikube/issues/1990) for more information. +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## NetworkPolicy To enable network policy for Redis, install diff --git a/upstreamed/redis/ci/production-sentinel-values.yaml b/upstreamed/redis/ci/production-sentinel-values.yaml index d4d9a38bb..aef8038b4 100644 --- a/upstreamed/redis/ci/production-sentinel-values.yaml +++ b/upstreamed/redis/ci/production-sentinel-values.yaml @@ -16,7 +16,7 @@ image: ## Bitnami Redis image tag ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links ## - tag: 4.0.14 + tag: 5.0.5-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -53,7 +53,7 @@ sentinel: ## Bitnami Redis image tag ## ref: https://github.com/bitnami/bitnami-docker-redis-sentinel#supported-tags-and-respective-dockerfile-links ## - tag: 4.0.14 + tag: 5.0.5-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/redis/ci/production-values.yaml b/upstreamed/redis/ci/production-values.yaml index c141c6418..95e55c148 100644 --- a/upstreamed/redis/ci/production-values.yaml +++ b/upstreamed/redis/ci/production-values.yaml @@ -16,7 +16,7 @@ image: ## Bitnami Redis image tag ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links ## - tag: 4.0.14 + tag: 5.0.5-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -53,7 +53,7 @@ sentinel: ## Bitnami Redis image tag ## ref: https://github.com/bitnami/bitnami-docker-redis-sentinel#supported-tags-and-respective-dockerfile-links ## - tag: 4.0.14 + tag: 5.0.5-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/redis/templates/NOTES.txt b/upstreamed/redis/templates/NOTES.txt index 82052528f..e275c5243 100644 --- a/upstreamed/redis/templates/NOTES.txt +++ b/upstreamed/redis/templates/NOTES.txt @@ -100,3 +100,5 @@ To connect to your database from outside the cluster execute the following comma {{- end }} {{- end }} + +{{ include "redis.checkRollingTags" . }} diff --git a/upstreamed/redis/templates/_helpers.tpl b/upstreamed/redis/templates/_helpers.tpl index 51cc5e762..d15b22f20 100644 --- a/upstreamed/redis/templates/_helpers.tpl +++ b/upstreamed/redis/templates/_helpers.tpl @@ -225,3 +225,15 @@ imagePullSecrets: {{- end }} {{- end -}} {{- end -}} + +{{/* Check if there are rolling tags in the images */}} +{{- define "redis.checkRollingTags" -}} +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- if and (contains "bitnami/" .Values.sentinel.image.repository) (not (.Values.sentinel.image.tag | regexFind "-r\\d+$")) }} +WARNING: Rolling tag detected ({{ .Values.sentinel.image.repository }}:{{ .Values.sentinel.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} +{{- end -}} diff --git a/upstreamed/redis/templates/redis-slave-statefulset.yaml b/upstreamed/redis/templates/redis-slave-statefulset.yaml index 97c87f75c..db96d966c 100644 --- a/upstreamed/redis/templates/redis-slave-statefulset.yaml +++ b/upstreamed/redis/templates/redis-slave-statefulset.yaml @@ -91,9 +91,9 @@ spec: cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf fi ARGS=("--port" "${REDIS_PORT}") + ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") {{- if .Values.usePassword }} ARGS+=("--requirepass" "${REDIS_PASSWORD}") - ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}") {{- else }} ARGS+=("--protected-mode" "no") @@ -338,7 +338,10 @@ spec: emptyDir: {} - name: redis-tmp-conf emptyDir: {} - {{- if and .Values.slave.persistence.enabled }} + {{- if not .Values.slave.persistence.enabled }} + - name: redis-data + emptyDir: {} + {{- else }} volumeClaimTemplates: - metadata: name: redis-data diff --git a/upstreamed/redis/values-production.yaml b/upstreamed/redis/values-production.yaml index 9fd6b60db..b9ed0273c 100644 --- a/upstreamed/redis/values-production.yaml +++ b/upstreamed/redis/values-production.yaml @@ -16,7 +16,7 @@ image: ## Bitnami Redis image tag ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links ## - tag: 4.0.14 + tag: 5.0.5-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -53,7 +53,7 @@ sentinel: ## Bitnami Redis image tag ## ref: https://github.com/bitnami/bitnami-docker-redis-sentinel#supported-tags-and-respective-dockerfile-links ## - tag: 4.0.14 + tag: 5.0.5-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/redis/values.yaml b/upstreamed/redis/values.yaml index f6a10b114..22c143c72 100644 --- a/upstreamed/redis/values.yaml +++ b/upstreamed/redis/values.yaml @@ -16,7 +16,7 @@ image: ## Bitnami Redis image tag ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links ## - tag: 4.0.14 + tag: 5.0.5-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -47,7 +47,7 @@ sentinel: ## Bitnami Redis image tag ## ref: https://github.com/bitnami/bitnami-docker-redis-sentinel#supported-tags-and-respective-dockerfile-links ## - tag: 4.0.14 + tag: 5.0.5-debian-9-r14 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/redmine/Chart.yaml b/upstreamed/redmine/Chart.yaml index 43255d758..40c027fe5 100644 --- a/upstreamed/redmine/Chart.yaml +++ b/upstreamed/redmine/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: redmine -version: 10.0.0 +version: 10.0.1 appVersion: 4.0.3 description: A flexible project management web application. keywords: diff --git a/upstreamed/redmine/README.md b/upstreamed/redmine/README.md index 9f6310a7d..d39c399b1 100644 --- a/upstreamed/redmine/README.md +++ b/upstreamed/redmine/README.md @@ -61,7 +61,7 @@ The following table lists the configurable parameters of the Redmine chart and t | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | Redmine image registry | `docker.io` | | `image.repository` | Redmine image name | `bitnami/redmine` | -| `image.tag` | Redmine image tag | `{VERSION}` | +| `image.tag` | Redmine image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `redmineUsername` | User of the application | `user` | @@ -135,6 +135,12 @@ $ helm install --name my-release -f values.yaml stable/redmine > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Replicas Redmine writes uploaded files to a persistent volume. By default that volume diff --git a/upstreamed/redmine/templates/NOTES.txt b/upstreamed/redmine/templates/NOTES.txt index 589917616..24e55791f 100644 --- a/upstreamed/redmine/templates/NOTES.txt +++ b/upstreamed/redmine/templates/NOTES.txt @@ -50,3 +50,10 @@ You have 4 alternatives: echo Username: {{ .Values.redmineUsername }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "redmine.fullname" . }} -o jsonpath="{.data.redmine-password}" | base64 --decode) {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/redmine/values.yaml b/upstreamed/redmine/values.yaml index a160d77ac..4090a7943 100644 --- a/upstreamed/redmine/values.yaml +++ b/upstreamed/redmine/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/redmine - tag: 4.0.3 + tag: 4.0.3-debian-9-r31 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/suitecrm/Chart.yaml b/upstreamed/suitecrm/Chart.yaml index e4c7c5ea5..a934eb01a 100644 --- a/upstreamed/suitecrm/Chart.yaml +++ b/upstreamed/suitecrm/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: suitecrm -version: 5.3.3 +version: 5.3.4 appVersion: 7.11.4 description: SuiteCRM is a completely open source enterprise-grade Customer Relationship Management (CRM) application. SuiteCRM is a software fork of the popular customer relationship management (CRM) system SugarCRM. keywords: diff --git a/upstreamed/suitecrm/README.md b/upstreamed/suitecrm/README.md index f558b29e2..b8364c77f 100644 --- a/upstreamed/suitecrm/README.md +++ b/upstreamed/suitecrm/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the SuiteCRM chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | SuiteCRM image registry | `docker.io` | | `image.repository` | SuiteCRM image name | `bitnami/suitecrm` | -| `image.tag` | SuiteCRM image tag | `{VERSION}` | +| `image.tag` | SuiteCRM image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array| `[]` (does not add image pull secrets to deployed pods)| | `suitecrmHost` | SuiteCRM host to create application URLs | `nil` | @@ -146,6 +146,12 @@ $ helm install --name my-release -f values.yaml stable/suitecrm > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami SuiteCRM](https://github.com/bitnami/bitnami-docker-suitecrm) image stores the SuiteCRM data and configurations at the `/bitnami/suitecrm` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/suitecrm/templates/NOTES.txt b/upstreamed/suitecrm/templates/NOTES.txt index e3e0780cf..676faf21f 100644 --- a/upstreamed/suitecrm/templates/NOTES.txt +++ b/upstreamed/suitecrm/templates/NOTES.txt @@ -95,3 +95,10 @@ host. To configure SuiteCRM to use and external database host: helm upgrade {{ .Release.Name }} stable/suitecrm \ --set suitecrmPassword=$APP_PASSWORD,suitecrmHost=$APP_HOST,service.type={{ .Values.service.type }},mariadb.enabled=false{{- if not (empty .Values.externalDatabase.user) }},externalDatabase.user={{ .Values.externalDatabase.user }}{{- end }}{{- if not (empty .Values.externalDatabase.password) }},externalDatabase.password={{ .Values.externalDatabase.password }}{{- end }}{{- if not (empty .Values.externalDatabase.database) }},externalDatabase.database={{ .Values.externalDatabase.database }}{{- end }},externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/suitecrm/values.yaml b/upstreamed/suitecrm/values.yaml index 1dd821c70..a2abacf5a 100644 --- a/upstreamed/suitecrm/values.yaml +++ b/upstreamed/suitecrm/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/suitecrm - tag: 7.11.4 + tag: 7.11.4-debian-9-r18 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/testlink/Chart.yaml b/upstreamed/testlink/Chart.yaml index ad96879db..21671f009 100644 --- a/upstreamed/testlink/Chart.yaml +++ b/upstreamed/testlink/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: testlink -version: 4.3.0 +version: 4.3.1 appVersion: 1.9.19 description: Web-based test management system that facilitates software quality assurance. icon: https://bitnami.com/assets/stacks/testlink/img/testlink-stack-220x234.png diff --git a/upstreamed/testlink/README.md b/upstreamed/testlink/README.md index 0fbdc9ddb..163c0dbcc 100644 --- a/upstreamed/testlink/README.md +++ b/upstreamed/testlink/README.md @@ -53,7 +53,7 @@ The following table lists the configurable parameters of the TestLink chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | TestLink image registry | `docker.io` | | `image.repository` | TestLink image name | `bitnami/testlink` | -| `image.tag` | TestLink image tag | `{VERSION}` | +| `image.tag` | TestLink image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `testlinkUsername` | Admin username | `user` | @@ -132,6 +132,12 @@ $ helm install --name my-release -f values.yaml stable/testlink > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Persistence The [Bitnami TestLink](https://github.com/bitnami/bitnami-docker-testlink) image stores the TestLink data and configurations at the `/bitnami/testlink` and `/bitnami/apache` paths of the container. diff --git a/upstreamed/testlink/templates/NOTES.txt b/upstreamed/testlink/templates/NOTES.txt index 29e7ad269..bf1c344f8 100644 --- a/upstreamed/testlink/templates/NOTES.txt +++ b/upstreamed/testlink/templates/NOTES.txt @@ -43,3 +43,10 @@ host. To configure TestLink to use and external database host: helm upgrade {{ .Release.Name }} --set service.type={{ .Values.service.type }},mariadb.enabled=false,externalDatabase.host=YOUR_EXTERNAL_DATABASE_HOST stable/testlink {{- end }} + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/testlink/values.yaml b/upstreamed/testlink/values.yaml index 3f71aec50..479e72af2 100644 --- a/upstreamed/testlink/values.yaml +++ b/upstreamed/testlink/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/testlink - tag: 1.9.19 + tag: 1.9.19-debian-9-r95 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/wordpress/Chart.yaml b/upstreamed/wordpress/Chart.yaml index beab4f015..ccbe2e529 100644 --- a/upstreamed/wordpress/Chart.yaml +++ b/upstreamed/wordpress/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: wordpress -version: 5.9.3 -appVersion: 5.2.0 +version: 5.9.7 +appVersion: 5.2.1 description: Web publishing platform for building blogs and websites. icon: https://bitnami.com/assets/stacks/wordpress/img/wordpress-stack-220x234.png keywords: diff --git a/upstreamed/wordpress/README.md b/upstreamed/wordpress/README.md index b00960f77..aa4ce7cbb 100644 --- a/upstreamed/wordpress/README.md +++ b/upstreamed/wordpress/README.md @@ -53,9 +53,10 @@ The following table lists the configurable parameters of the WordPress chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.registry` | WordPress image registry | `docker.io` | | `image.repository` | WordPress image name | `bitnami/wordpress` | -| `image.tag` | WordPress image tag | `{VERSION}` | +| `image.tag` | WordPress image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `wordpressSkipInstall` | Skip wizard installation | `false` | | `wordpressUsername` | User of the application | `user` | | `wordpressPassword` | Application password | _random 10 character long alphanumeric string_ | | `wordpressEmail` | Admin email | `user@example.com` | @@ -64,8 +65,8 @@ The following table lists the configurable parameters of the WordPress chart and | `wordpressBlogName` | Blog name | `User's Blog!` | | `wordpressTablePrefix` | Table prefix | `wp_` | | `allowEmptyPassword` | Allow DB blank passwords | `true` | -| `allowOverrideNone` | Set Apache AllowOverride directive to None | `no` | -| `customHTAccessCM` | Configmap with custom wordpress-htaccess.conf directives | `nil` | +| `allowOverrideNone` | Set Apache AllowOverride directive to None | `false` | +| `customHTAccessCM` | Configmap with custom wordpress-htaccess.conf directives | `nil` | | `smtpHost` | SMTP host | `nil` | | `smtpPort` | SMTP port | `nil` | | `smtpUser` | SMTP user | `nil` | @@ -90,7 +91,7 @@ The following table lists the configurable parameters of the WordPress chart and | `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | | `service.nodePorts.http` | Kubernetes http node port | `""` | | `service.nodePorts.https` | Kubernetes https node port | `""` | -| `service.extraPorts` | Extra ports to expose in the service (normally used with the `sidecar` value) | `nil` | +| `service.extraPorts` | Extra ports to expose in the service (normally used with the `sidecar` value) | `nil` | | `healthcheckHttps` | Use https for liveliness and readiness | `false` | | `livenessProbeHeaders` | Headers to use for livenessProbe | `nil` | | `readinessProbeHeaders` | Headers to use for readinessProbe | `nil` | @@ -120,8 +121,8 @@ The following table lists the configurable parameters of the WordPress chart and | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | -| `metrics.resources` | Exporter resource requests/limit | {} | -| `sidecars` | Attach additional containers to the pod | `nil` | +| `metrics.resources` | Exporter resource requests/limit | `{}` | +| `sidecars` | Attach additional containers to the pod | `nil` | The above parameters map to the env variables defined in [bitnami/wordpress](http://github.com/bitnami/bitnami-docker-wordpress). For more information please refer to the [bitnami/wordpress](http://github.com/bitnami/bitnami-docker-wordpress) image documentation. @@ -143,6 +144,12 @@ $ helm install --name my-release -f values.yaml stable/wordpress > **Tip**: You can use the default [values.yaml](values.yaml) +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + ## Production and horizontal scaling The following repo contains the recommended production settings for wordpress capture in an alternative [values file](values-production.yaml). Please read carefully the comments in the values-production.yaml file to set up your environment appropriately. diff --git a/upstreamed/wordpress/templates/NOTES.txt b/upstreamed/wordpress/templates/NOTES.txt index 82fe5bc7e..66afc3d96 100644 --- a/upstreamed/wordpress/templates/NOTES.txt +++ b/upstreamed/wordpress/templates/NOTES.txt @@ -37,3 +37,10 @@ echo Username: {{ .Values.wordpressUsername }} echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "wordpress.fullname" . }} -o jsonpath="{.data.wordpress-password}" | base64 --decode) + +{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | regexFind "-r\\d+$")) }} + +WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ + +{{- end }} diff --git a/upstreamed/wordpress/templates/deployment.yaml b/upstreamed/wordpress/templates/deployment.yaml index 278b77e59..d2ea4e1bc 100644 --- a/upstreamed/wordpress/templates/deployment.yaml +++ b/upstreamed/wordpress/templates/deployment.yaml @@ -40,11 +40,7 @@ spec: imagePullPolicy: {{ .Values.image.pullPolicy | quote }} env: - name: ALLOW_EMPTY_PASSWORD - {{- if .Values.allowEmptyPassword }} - value: "yes" - {{- else }} - value: "no" - {{- end }} + value: {{ ternary "yes" "no" .Values.allowEmptyPassword | quote }} - name: MARIADB_HOST {{- if .Values.mariadb.enabled }} value: {{ template "mariadb.fullname" . }} @@ -93,11 +89,11 @@ spec: - name: WORDPRESS_LAST_NAME value: {{ .Values.wordpressLastName | quote }} - name: WORDPRESS_HTACCESS_OVERRIDE_NONE - value: {{ .Values.allowOverrideNone | quote }} + value: {{ ternary "yes" "no" .Values.allowOverrideNone | quote }} - name: WORDPRESS_BLOG_NAME value: {{ .Values.wordpressBlogName | quote }} - name: WORDPRESS_SKIP_INSTALL - value: {{ .Values.wordpressSkipInstall | quote }} + value: {{ ternary "yes" "no" .Values.wordpressSkipInstall | quote }} - name: WORDPRESS_TABLE_PREFIX value: {{ .Values.wordpressTablePrefix | quote }} {{- if .Values.smtpHost }} @@ -135,12 +131,10 @@ spec: livenessProbe: httpGet: path: /wp-login.php - {{- if not .Values.healthcheckHttps }} - port: http - {{- else }} - port: https + port: {{ ternary "https" "http" .Values.healthcheckHttps }} + {{- if .Values.healthcheckHttps }} scheme: HTTPS - {{- end }} + {{- end }} {{- if .Values.livenessProbeHeaders }} httpHeaders: {{ toYaml .Values.livenessProbeHeaders | indent 14 }} @@ -149,12 +143,10 @@ spec: readinessProbe: httpGet: path: /wp-login.php - {{- if not .Values.healthcheckHttps }} - port: http - {{- else }} - port: https + port: {{ ternary "https" "http" .Values.healthcheckHttps }} + {{- if .Values.healthcheckHttps }} scheme: HTTPS - {{- end }} + {{- end }} {{- if .Values.readinessProbeHeaders }} httpHeaders: {{ toYaml .Values.readinessProbeHeaders | indent 14 }} diff --git a/upstreamed/wordpress/values-production.yaml b/upstreamed/wordpress/values-production.yaml index 92979e736..8f6bb14e3 100644 --- a/upstreamed/wordpress/values-production.yaml +++ b/upstreamed/wordpress/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/wordpress - tag: 5.2.0 + tag: 5.2.1-debian-9-r1 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -61,14 +61,18 @@ wordpressTablePrefix: wp_ ## Skip wizard installation (only if you use an external database that already contains WordPress data) ## ref: https://github.com/bitnami/bitnami-docker-wordpress#connect-wordpress-docker-container-to-an-existing-database ## -wordpressSkipInstall: "no" +wordpressSkipInstall: false -## Set to `yes` to allow the container to be started with blank passwords +## Set to `false` to allow the container to be started with blank passwords ## ref: https://github.com/bitnami/bitnami-docker-wordpress#environment-variables -allowEmptyPassword: "yes" +## +allowEmptyPassword: true ## Set Apache allowOverride to None -allowOverrideNone: "yes" + +## +allowOverrideNone: true + # ConfigMap with custom wordpress-htaccess.conf file (requires allowOverrideNone to true) customHTAccessCM: diff --git a/upstreamed/wordpress/values.yaml b/upstreamed/wordpress/values.yaml index 43775f896..d226e61e9 100644 --- a/upstreamed/wordpress/values.yaml +++ b/upstreamed/wordpress/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/wordpress - tag: 5.2.0 + tag: 5.2.1-debian-9-r1 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -65,14 +65,17 @@ wordpressTablePrefix: wp_ ## Skip wizard installation (only if you use an external database that already contains WordPress data) ## ref: https://github.com/bitnami/bitnami-docker-wordpress#connect-wordpress-docker-container-to-an-existing-database ## -wordpressSkipInstall: "no" +wordpressSkipInstall: false ## Set to `false` to allow the container to be started with blank passwords ## ref: https://github.com/bitnami/bitnami-docker-wordpress#environment-variables +## allowEmptyPassword: true ## Set Apache allowOverride to None -allowOverrideNone: "no" +## ref: https://github.com/bitnami/bitnami-docker-wordpress#environment-variables +## +allowOverrideNone: false # ConfigMap with custom wordpress-htaccess.conf file (requires allowOverrideNone to true) customHTAccessCM: