From 290069c529a75110f0e1d31ffdb2c837eaadea61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miguel=20=C3=81ngel=20Cabrera=20Mi=C3=B1agorri?= Date: Fri, 18 Mar 2022 15:02:19 +0100 Subject: [PATCH] [bitnami/argo-workflows] Set rootOnlyrootFileSystem by default (#9357) * [bitnami/argo-workflows] Set rootOnlyrootFileSystem by default Signed-off-by: Miguel A. Cabrera Minagorri * [bitnami/argo-workflows] Update README Signed-off-by: Miguel A. Cabrera Minagorri --- bitnami/argo-workflows/Chart.lock | 8 +- bitnami/argo-workflows/Chart.yaml | 2 +- bitnami/argo-workflows/README.md | 431 +++++++++++++++-------------- bitnami/argo-workflows/values.yaml | 6 + 4 files changed, 233 insertions(+), 214 deletions(-) diff --git a/bitnami/argo-workflows/Chart.lock b/bitnami/argo-workflows/Chart.lock index 34a8ed16a..724aab4d2 100644 --- a/bitnami/argo-workflows/Chart.lock +++ b/bitnami/argo-workflows/Chart.lock @@ -1,12 +1,12 @@ dependencies: - name: postgresql repository: https://charts.bitnami.com/bitnami - version: 11.1.3 + version: 11.1.4 - name: mysql repository: https://charts.bitnami.com/bitnami version: 8.8.26 - name: common repository: https://charts.bitnami.com/bitnami - version: 1.11.2 -digest: sha256:eb41d103c6a76df4b274660d1df74871406cd21e95b091bd1a69fe833b907c56 -generated: "2022-03-02T12:14:51.2404+01:00" + version: 1.11.3 +digest: sha256:25e38e1aa779f73b9295c8c07e3bd3eee9302fc48086b2e108e14243d792035d +generated: "2022-03-09T16:21:54.362678571Z" diff --git a/bitnami/argo-workflows/Chart.yaml b/bitnami/argo-workflows/Chart.yaml index 9181fb452..ca76243fd 100644 --- a/bitnami/argo-workflows/Chart.yaml +++ b/bitnami/argo-workflows/Chart.yaml @@ -35,4 +35,4 @@ sources: - https://github.com/bitnami/bitnami-docker-argo-workflow-controller - https://github.com/bitnami/bitnami-docker-argo-workflow-exec - https://argoproj.github.io/workflows/ -version: 1.0.2 +version: 1.1.0 diff --git a/bitnami/argo-workflows/README.md b/bitnami/argo-workflows/README.md index 27e18cfcb..57fa38890 100644 --- a/bitnami/argo-workflows/README.md +++ b/bitnami/argo-workflows/README.md @@ -60,6 +60,7 @@ The command removes all the Kubernetes components associated with the chart and | `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | | `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` | + ### Common parameters | Name | Description | Value | @@ -74,223 +75,230 @@ The command removes all the Kubernetes components associated with the chart and | `rbac.singleNamespace` | Restrict Argo to only deploy into a single namespace by apply Roles and RoleBindings instead of the Cluster equivalents, and start argo-cli with the --namespaced flag. Use it in clusters with strict access policy. | `false` | | `createAggregateRoles` | Create Aggregated cluster roles | `true` | + ### Argo Workflows Server configuration parameters -| Name | Description | Value | -| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------- | -| `server.image.registry` | server image registry | `docker.io` | -| `server.image.repository` | server image repository | `bitnami/argo-workflow-cli` | -| `server.image.tag` | server image tag (immutable tags are recommended) | `3.2.8-scratch-r0` | -| `server.image.pullPolicy` | server image pull policy | `Always` | -| `server.image.pullSecrets` | server image pull secrets | `[]` | -| `server.enabled` | Enable server deployment | `true` | -| `server.replicaCount` | Number of server replicas to deploy | `1` | -| `server.livenessProbe.enabled` | Enable livenessProbe on server nodes | `true` | -| `server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | -| `server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` | -| `server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | -| `server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | -| `server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `server.readinessProbe.enabled` | Enable readinessProbe on server nodes | `true` | -| `server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | -| `server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `20` | -| `server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | -| `server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | -| `server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `server.startupProbe.enabled` | Enable startupProbe | `false` | -| `server.startupProbe.path` | Path to check for startupProbe | `/` | -| `server.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `300` | -| `server.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `server.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `server.startupProbe.failureThreshold` | Failure threshold for startupProbe | `6` | -| `server.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `server.customLivenessProbe` | Server custom livenessProbe that overrides the default one | `{}` | -| `server.customReadinessProbe` | Server custom readinessProbe that overrides the default one | `{}` | -| `server.customStartupProbe` | Server custom startupProbe that overrides the default one | `{}` | -| `server.resources.limits` | The resources limits for the server containers | `{}` | -| `server.resources.requests` | The requested resources for the server containers | `{}` | -| `server.podSecurityContext.enabled` | Enabled server pods' Security Context | `true` | -| `server.podSecurityContext.fsGroup` | Set server pod's Security Context fsGroup | `1001` | -| `server.containerSecurityContext.enabled` | Enabled server containers' Security Context | `true` | -| `server.containerSecurityContext.runAsUser` | Set server containers' Security Context runAsUser | `1001` | -| `server.containerSecurityContext.runAsNonRoot` | Set server containers' Security Context runAsNonRoot | `true` | -| `server.rbac.create` | Create RBAC resources for the Argo workflows server | `true` | -| `server.extraArgs` | Extra arguments for the server command line | `""` | -| `server.auth.enabled` | Enable authentication | `true` | -| `server.auth.mode` | Set authentication mode. Either `server`, `client` or `sso`. | `client` | -| `server.auth.sso.enabled` | Enable SSO configuration for the server auth mode | `false` | -| `server.auth.sso.issuer` | Root URL for the OIDC identity provider | `""` | -| `server.auth.sso.clientId.name` | Name of the secret containing the OIDC client ID | `""` | -| `server.auth.sso.clientId.key` | Key in the secret to obtain the OIDC client ID | `""` | -| `server.auth.sso.clientSecret.name` | Name of the secret containing the OIDC client secret | `""` | -| `server.auth.sso.clientSecret.key` | Key in the secret to obtain the OIDC client secret | `""` | -| `server.auth.sso.redirectUrl` | The OIDC redirect URL. Should be in the form /oauth2/callback. | `""` | -| `server.auth.sso.rbac.enabled` | Create RBAC resources for SSO | `true` | -| `server.auth.sso.rbac.secretWhitelist` | Restricts the secrets that the server can read | `[]` | -| `server.auth.sso.scopes` | Scopes requested from the SSO ID provider | `[]` | -| `server.clusterWorkflowTemplates.enabled` | Create ClusterRole and CRB for the controoler to access ClusterWorkflowTemplates | `true` | -| `server.clusterWorkflowTemplates.enableEditing` | Give the server permissions to edit ClusterWorkflowTemplates | `true` | -| `server.pdb.enabled` | Create Pod Disruption Budget for the server component | `false` | -| `server.pdb.minAvailable` | Sets the min number of pods availables for the Pod Disruption Budget | `1` | -| `server.pdb.maxUnavailable` | Sets the max number of pods unavailable for the Pod Disruption Budget | `1` | -| `server.secure` | Run Argo server in secure mode | `false` | -| `server.baseHref` | Base href of the Argo Workflows deployment | `/` | -| `server.containerPorts.web` | argo Server container port | `2746` | -| `server.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `server.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | -| `server.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | -| `server.command` | Override default container command (useful when using custom images) | `[]` | -| `server.args` | Override default container args (useful when using custom images) | `[]` | -| `server.hostAliases` | server pods host aliases | `[]` | -| `server.podLabels` | Extra labels for server pods | `{}` | -| `server.podAnnotations` | Annotations for server pods | `{}` | -| `server.podAffinityPreset` | Pod affinity preset. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `server.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `server.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `server.nodeAffinityPreset.key` | Node label key to match. Ignored if `server.affinity` is set | `""` | -| `server.nodeAffinityPreset.values` | Node label values to match. Ignored if `server.affinity` is set | `[]` | -| `server.affinity` | Affinity for server pods assignment | `{}` | -| `server.nodeSelector` | Node labels for server pods assignment | `{}` | -| `server.tolerations` | Tolerations for server pods assignment | `[]` | -| `server.updateStrategy.type` | server statefulset strategy type | `RollingUpdate` | -| `server.topologySpreadConstraints` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in | `[]` | -| `server.schedulerName` | Alternate scheduler for the server deployment | `""` | -| `server.priorityClassName` | server pods' priorityClassName | `""` | -| `server.lifecycleHooks` | for the server container(s) to automate configuration before or after startup | `{}` | -| `server.extraEnvVars` | Array with extra environment variables to add to server nodes | `[]` | -| `server.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for server nodes | `""` | -| `server.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for server nodes | `""` | -| `server.extraVolumes` | Optionally specify extra list of additional volumes for the server pod(s) | `[]` | -| `server.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the server container(s) | `[]` | -| `server.sidecars` | Add additional sidecar containers to the server pod(s) | `{}` | -| `server.initContainers` | Add additional init containers to the server pod(s) | `{}` | -| `server.service.type` | server service type | `ClusterIP` | -| `server.service.ports.http` | server service HTTP port | `80` | -| `server.service.nodePorts.http` | Node port for HTTP | `""` | -| `server.service.clusterIP` | server service Cluster IP | `""` | -| `server.service.loadBalancerIP` | server service Load Balancer IP | `""` | -| `server.service.loadBalancerSourceRanges` | server service Load Balancer sources | `[]` | -| `server.service.externalTrafficPolicy` | server service external traffic policy | `Cluster` | -| `server.service.annotations` | Additional custom annotations for server service | `{}` | -| `server.service.extraPorts` | Extra port to expose on the server service | `[]` | +| Name | Description | Value | +| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------- | +| `server.image.registry` | server image registry | `docker.io` | +| `server.image.repository` | server image repository | `bitnami/argo-workflow-cli` | +| `server.image.tag` | server image tag (immutable tags are recommended) | `3.2.9-scratch-r0` | +| `server.image.pullPolicy` | server image pull policy | `Always` | +| `server.image.pullSecrets` | server image pull secrets | `[]` | +| `server.enabled` | Enable server deployment | `true` | +| `server.replicaCount` | Number of server replicas to deploy | `1` | +| `server.livenessProbe.enabled` | Enable livenessProbe on server nodes | `true` | +| `server.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `server.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` | +| `server.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `server.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `server.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `server.readinessProbe.enabled` | Enable readinessProbe on server nodes | `true` | +| `server.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | +| `server.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `20` | +| `server.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `server.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `server.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `server.startupProbe.enabled` | Enable startupProbe | `false` | +| `server.startupProbe.path` | Path to check for startupProbe | `/` | +| `server.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `300` | +| `server.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `server.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `server.startupProbe.failureThreshold` | Failure threshold for startupProbe | `6` | +| `server.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `server.customLivenessProbe` | Server custom livenessProbe that overrides the default one | `{}` | +| `server.customReadinessProbe` | Server custom readinessProbe that overrides the default one | `{}` | +| `server.customStartupProbe` | Server custom startupProbe that overrides the default one | `{}` | +| `server.resources.limits` | The resources limits for the server containers | `{}` | +| `server.resources.requests` | The requested resources for the server containers | `{}` | +| `server.podSecurityContext.enabled` | Enabled server pods' Security Context | `true` | +| `server.podSecurityContext.fsGroup` | Set server pod's Security Context fsGroup | `1001` | +| `server.containerSecurityContext.enabled` | Enabled server containers' Security Context | `true` | +| `server.containerSecurityContext.runAsUser` | Set server containers' Security Context runAsUser | `1001` | +| `server.containerSecurityContext.runAsNonRoot` | Set server containers' Security Context runAsNonRoot | `true` | +| `server.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `true` | +| `server.rbac.create` | Create RBAC resources for the Argo workflows server | `true` | +| `server.extraArgs` | Extra arguments for the server command line | `""` | +| `server.auth.enabled` | Enable authentication | `true` | +| `server.auth.mode` | Set authentication mode. Either `server`, `client` or `sso`. | `client` | +| `server.auth.sso.enabled` | Enable SSO configuration for the server auth mode | `false` | +| `server.auth.sso.issuer` | Root URL for the OIDC identity provider | `""` | +| `server.auth.sso.clientId.name` | Name of the secret containing the OIDC client ID | `""` | +| `server.auth.sso.clientId.key` | Key in the secret to obtain the OIDC client ID | `""` | +| `server.auth.sso.clientSecret.name` | Name of the secret containing the OIDC client secret | `""` | +| `server.auth.sso.clientSecret.key` | Key in the secret to obtain the OIDC client secret | `""` | +| `server.auth.sso.redirectUrl` | The OIDC redirect URL. Should be in the form /oauth2/callback. | `""` | +| `server.auth.sso.rbac.enabled` | Create RBAC resources for SSO | `true` | +| `server.auth.sso.rbac.secretWhitelist` | Restricts the secrets that the server can read | `[]` | +| `server.auth.sso.scopes` | Scopes requested from the SSO ID provider | `[]` | +| `server.clusterWorkflowTemplates.enabled` | Create ClusterRole and CRB for the controoler to access ClusterWorkflowTemplates | `true` | +| `server.clusterWorkflowTemplates.enableEditing` | Give the server permissions to edit ClusterWorkflowTemplates | `true` | +| `server.pdb.enabled` | Create Pod Disruption Budget for the server component | `false` | +| `server.pdb.minAvailable` | Sets the min number of pods availables for the Pod Disruption Budget | `1` | +| `server.pdb.maxUnavailable` | Sets the max number of pods unavailable for the Pod Disruption Budget | `1` | +| `server.secure` | Run Argo server in secure mode | `false` | +| `server.baseHref` | Base href of the Argo Workflows deployment | `/` | +| `server.containerPorts.web` | argo Server container port | `2746` | +| `server.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `server.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `server.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `server.command` | Override default container command (useful when using custom images) | `[]` | +| `server.args` | Override default container args (useful when using custom images) | `[]` | +| `server.hostAliases` | server pods host aliases | `[]` | +| `server.podLabels` | Extra labels for server pods | `{}` | +| `server.podAnnotations` | Annotations for server pods | `{}` | +| `server.podAffinityPreset` | Pod affinity preset. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `server.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `server.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `server.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `server.nodeAffinityPreset.key` | Node label key to match. Ignored if `server.affinity` is set | `""` | +| `server.nodeAffinityPreset.values` | Node label values to match. Ignored if `server.affinity` is set | `[]` | +| `server.affinity` | Affinity for server pods assignment | `{}` | +| `server.nodeSelector` | Node labels for server pods assignment | `{}` | +| `server.tolerations` | Tolerations for server pods assignment | `[]` | +| `server.updateStrategy.type` | server statefulset strategy type | `RollingUpdate` | +| `server.topologySpreadConstraints` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in | `[]` | +| `server.schedulerName` | Alternate scheduler for the server deployment | `""` | +| `server.priorityClassName` | server pods' priorityClassName | `""` | +| `server.lifecycleHooks` | for the server container(s) to automate configuration before or after startup | `{}` | +| `server.extraEnvVars` | Array with extra environment variables to add to server nodes | `[]` | +| `server.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for server nodes | `""` | +| `server.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for server nodes | `""` | +| `server.extraVolumes` | Optionally specify extra list of additional volumes for the server pod(s) | `[]` | +| `server.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the server container(s) | `[]` | +| `server.sidecars` | Add additional sidecar containers to the server pod(s) | `{}` | +| `server.initContainers` | Add additional init containers to the server pod(s) | `{}` | +| `server.service.type` | server service type | `ClusterIP` | +| `server.service.ports.http` | server service HTTP port | `80` | +| `server.service.nodePorts.http` | Node port for HTTP | `""` | +| `server.service.clusterIP` | server service Cluster IP | `""` | +| `server.service.loadBalancerIP` | server service Load Balancer IP | `""` | +| `server.service.loadBalancerSourceRanges` | server service Load Balancer sources | `[]` | +| `server.service.externalTrafficPolicy` | server service external traffic policy | `Cluster` | +| `server.service.annotations` | Additional custom annotations for server service | `{}` | +| `server.service.extraPorts` | Extra port to expose on the server service | `[]` | + ### Argo Workflows Controller configuration parameters -| Name | Description | Value | -| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | -| `controller.image.registry` | controller image registry | `docker.io` | -| `controller.image.repository` | controller image repository | `bitnami/argo-workflow-controller` | -| `controller.image.tag` | controller image tag (immutable tags are recommended) | `3.2.8-scratch-r0` | -| `controller.image.pullPolicy` | controller image pull policy | `IfNotPresent` | -| `controller.image.pullSecrets` | controller image pull secrets | `[]` | -| `controller.replicaCount` | Number of controller replicas to deploy | `1` | -| `controller.livenessProbe.enabled` | Enable livenessProbe on controller nodes | `true` | -| `controller.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `90` | -| `controller.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` | -| `controller.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `30` | -| `controller.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | -| `controller.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | -| `controller.readinessProbe.enabled` | Enable readinessProbe on controller nodes | `true` | -| `controller.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `30` | -| `controller.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `60` | -| `controller.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `30` | -| `controller.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | -| `controller.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | -| `controller.startupProbe.enabled` | Enable startupProbe | `false` | -| `controller.startupProbe.path` | Path to check for startupProbe | `/` | -| `controller.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `300` | -| `controller.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `controller.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `controller.startupProbe.failureThreshold` | Failure threshold for startupProbe | `6` | -| `controller.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | -| `controller.customLivenessProbe` | Controller custom livenessProbe that overrides the default one | `{}` | -| `controller.customReadinessProbe` | Controller custom readinessProbe that overrides the default one | `{}` | -| `controller.customStartupProbe` | Controller custom startupProbe that overrides the default one | `{}` | -| `controller.resources.limits` | The resources limits for the controller containers | `{}` | -| `controller.resources.requests` | The requested resources for the controller containers | `{}` | -| `controller.podSecurityContext.enabled` | Enabled controller pods' Security Context | `true` | -| `controller.podSecurityContext.fsGroup` | Set controller pod's Security Context fsGroup | `1001` | -| `controller.containerSecurityContext.enabled` | Enabled controller containers' Security Context | `true` | -| `controller.containerSecurityContext.runAsUser` | Set controller containers' Security Context runAsUser | `1001` | -| `controller.containerSecurityContext.runAsNonRoot` | Set controller containers' Security Context runAsNonRoot | `true` | -| `controller.containerPorts.metrics` | Port to expose controller metrics | `9090` | -| `controller.containerPorts.telemetry` | Port to expose controller telemetry | `8081` | -| `controller.rbac.create` | Create RBAC resources for the Argo workflows controller | `true` | -| `controller.existingConfigMap` | | `""` | -| `controller.extraArgs` | Extra arguments for the controller command line | `""` | -| `controller.config` | Controller configmap configuration content | `{}` | -| `controller.instanceID.enabled` | Enable submission filtering based on instanceID attribute. Requires to set instanceID.useReleaseName or instanceID.explicitID | `false` | -| `controller.instanceID.useReleaseName` | Use the release name to filter submissions | `false` | -| `controller.instanceID.explicitID` | Filter submissions based on an explicit instance ID | `""` | -| `controller.containerRuntimeExecutor` | Specifies the container runtime for the executor | `k8sapi` | -| `controller.clusterWorkflowTemplates.enabled` | Whether to create a ClusterRole and Cluster Role Binding to access ClusterWokflowTemplates resources | `true` | -| `controller.metrics.enabled` | Enable controller metrics exporter | `false` | -| `controller.metrics.path` | Path to expose controller metrics | `/metrics` | -| `controller.metrics.serviceMonitor.enabled` | Enable prometheus service monitor configuration | `false` | -| `controller.telemetry.enabled` | Enable telemetry for the controller | `false` | -| `controller.telemetry.path` | Path to expose telemetry information | `/telemetry` | -| `controller.workflowWorkers` | Number of workflow workers to deploy | `32` | -| `controller.podWorkers` | Number of pod workers to deploy | `32` | -| `controller.workflowNamespaces` | Namespaces allowed to run workflows | `["default"]` | -| `controller.logging.level` | Level for the controller logging | `info` | -| `controller.logging.globalLevel` | Global logging level for the controller | `0` | -| `controller.pdb.enabled` | Create Pod Disruption Budget for the controller component | `false` | -| `controller.pdb.minAvailable` | Sets the min number of pods availables for the Pod Disruption Budget | `1` | -| `controller.pdb.maxUnavailable` | Sets the max number of pods unavailable for the Pod Disruption Budget | `1` | -| `controller.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `controller.serviceAccount.name` | Name for the service account | `""` | -| `controller.serviceAccount.automountServiceAccountToken` | Automount service account token for the controller service account | `true` | -| `controller.command` | Override default container command (useful when using custom images) | `[]` | -| `controller.args` | Override default container args (useful when using custom images) | `[]` | -| `controller.hostAliases` | controller pods host aliases | `[]` | -| `controller.podLabels` | Extra labels for controller pods | `{}` | -| `controller.podAnnotations` | Annotations for controller pods | `{}` | -| `controller.podAffinityPreset` | Pod affinity preset. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `controller.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `soft` | -| `controller.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `""` | -| `controller.nodeAffinityPreset.key` | Node label key to match. Ignored if `controller.affinity` is set | `""` | -| `controller.nodeAffinityPreset.values` | Node label values to match. Ignored if `controller.affinity` is set | `[]` | -| `controller.affinity` | Affinity for controller pods assignment | `{}` | -| `controller.nodeSelector` | Node labels for controller pods assignment | `{}` | -| `controller.tolerations` | Tolerations for controller pods assignment | `[]` | -| `controller.updateStrategy.type` | controller statefulset strategy type | `RollingUpdate` | -| `controller.topologySpreadConstraints` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in | `[]` | -| `controller.schedulerName` | Alternate scheduler for the server controller | `""` | -| `controller.priorityClassName` | controller pods' priorityClassName | `""` | -| `controller.lifecycleHooks` | for the controller container(s) to automate configuration before or after startup | `{}` | -| `controller.extraEnvVars` | Array with extra environment variables to add to controller nodes | `[]` | -| `controller.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for controller nodes | `""` | -| `controller.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for controller nodes | `""` | -| `controller.extraVolumes` | Optionally specify extra list of additional volumes for the controller pod(s) | `[]` | -| `controller.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the controller container(s) | `[]` | -| `controller.sidecars` | Add additional sidecar containers to the controller pod(s) | `{}` | -| `controller.initContainers` | Add additional init containers to the controller pod(s) | `{}` | -| `controller.service.type` | controller service type | `ClusterIP` | -| `controller.service.ports.metrics` | Metrics port for the controller | `8080` | -| `controller.service.ports.telemetry` | Telemetry port for the controller | `8081` | -| `controller.service.nodePorts.metrics` | Node port for HTTP | `""` | -| `controller.service.nodePorts.telemetry` | Node port for HTTPS | `""` | -| `controller.service.clusterIP` | controller service Cluster IP | `""` | -| `controller.service.loadBalancerIP` | controller service Load Balancer IP | `""` | -| `controller.service.loadBalancerSourceRanges` | controller service Load Balancer sources | `[]` | -| `controller.service.externalTrafficPolicy` | controller service external traffic policy | `Cluster` | -| `controller.service.annotations` | Additional custom annotations for controller service | `{}` | -| `controller.service.extraPorts` | Extra port to expose on the controller service | `[]` | +| Name | Description | Value | +| ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | +| `controller.image.registry` | controller image registry | `docker.io` | +| `controller.image.repository` | controller image repository | `bitnami/argo-workflow-controller` | +| `controller.image.tag` | controller image tag (immutable tags are recommended) | `3.2.9-scratch-r0` | +| `controller.image.pullPolicy` | controller image pull policy | `IfNotPresent` | +| `controller.image.pullSecrets` | controller image pull secrets | `[]` | +| `controller.replicaCount` | Number of controller replicas to deploy | `1` | +| `controller.livenessProbe.enabled` | Enable livenessProbe on controller nodes | `true` | +| `controller.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `90` | +| `controller.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `60` | +| `controller.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `30` | +| `controller.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `controller.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `controller.readinessProbe.enabled` | Enable readinessProbe on controller nodes | `true` | +| `controller.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `30` | +| `controller.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `60` | +| `controller.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `30` | +| `controller.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `controller.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `controller.startupProbe.enabled` | Enable startupProbe | `false` | +| `controller.startupProbe.path` | Path to check for startupProbe | `/` | +| `controller.startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `300` | +| `controller.startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `controller.startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `controller.startupProbe.failureThreshold` | Failure threshold for startupProbe | `6` | +| `controller.startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `controller.customLivenessProbe` | Controller custom livenessProbe that overrides the default one | `{}` | +| `controller.customReadinessProbe` | Controller custom readinessProbe that overrides the default one | `{}` | +| `controller.customStartupProbe` | Controller custom startupProbe that overrides the default one | `{}` | +| `controller.resources.limits` | The resources limits for the controller containers | `{}` | +| `controller.resources.requests` | The requested resources for the controller containers | `{}` | +| `controller.podSecurityContext.enabled` | Enabled controller pods' Security Context | `true` | +| `controller.podSecurityContext.fsGroup` | Set controller pod's Security Context fsGroup | `1001` | +| `controller.containerSecurityContext.enabled` | Enabled controller containers' Security Context | `true` | +| `controller.containerSecurityContext.runAsUser` | Set controller containers' Security Context runAsUser | `1001` | +| `controller.containerSecurityContext.runAsNonRoot` | Set controller containers' Security Context runAsNonRoot | `true` | +| `controller.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `true` | +| `controller.containerPorts.metrics` | Port to expose controller metrics | `9090` | +| `controller.containerPorts.telemetry` | Port to expose controller telemetry | `8081` | +| `controller.rbac.create` | Create RBAC resources for the Argo workflows controller | `true` | +| `controller.existingConfigMap` | | `""` | +| `controller.extraArgs` | Extra arguments for the controller command line | `""` | +| `controller.config` | Controller configmap configuration content | `{}` | +| `controller.instanceID.enabled` | Enable submission filtering based on instanceID attribute. Requires to set instanceID.useReleaseName or instanceID.explicitID | `false` | +| `controller.instanceID.useReleaseName` | Use the release name to filter submissions | `false` | +| `controller.instanceID.explicitID` | Filter submissions based on an explicit instance ID | `""` | +| `controller.containerRuntimeExecutor` | Specifies the container runtime for the executor | `k8sapi` | +| `controller.clusterWorkflowTemplates.enabled` | Whether to create a ClusterRole and Cluster Role Binding to access ClusterWokflowTemplates resources | `true` | +| `controller.metrics.enabled` | Enable controller metrics exporter | `false` | +| `controller.metrics.path` | Path to expose controller metrics | `/metrics` | +| `controller.metrics.serviceMonitor.enabled` | Enable prometheus service monitor configuration | `false` | +| `controller.telemetry.enabled` | Enable telemetry for the controller | `false` | +| `controller.telemetry.path` | Path to expose telemetry information | `/telemetry` | +| `controller.workflowWorkers` | Number of workflow workers to deploy | `32` | +| `controller.podWorkers` | Number of pod workers to deploy | `32` | +| `controller.workflowNamespaces` | Namespaces allowed to run workflows | `["default"]` | +| `controller.logging.level` | Level for the controller logging | `info` | +| `controller.logging.globalLevel` | Global logging level for the controller | `0` | +| `controller.pdb.enabled` | Create Pod Disruption Budget for the controller component | `false` | +| `controller.pdb.minAvailable` | Sets the min number of pods availables for the Pod Disruption Budget | `1` | +| `controller.pdb.maxUnavailable` | Sets the max number of pods unavailable for the Pod Disruption Budget | `1` | +| `controller.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `controller.serviceAccount.name` | Name for the service account | `""` | +| `controller.serviceAccount.automountServiceAccountToken` | Automount service account token for the controller service account | `true` | +| `controller.command` | Override default container command (useful when using custom images) | `[]` | +| `controller.args` | Override default container args (useful when using custom images) | `[]` | +| `controller.hostAliases` | controller pods host aliases | `[]` | +| `controller.podLabels` | Extra labels for controller pods | `{}` | +| `controller.podAnnotations` | Annotations for controller pods | `{}` | +| `controller.podAffinityPreset` | Pod affinity preset. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `controller.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `controller.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `controller.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `controller.nodeAffinityPreset.key` | Node label key to match. Ignored if `controller.affinity` is set | `""` | +| `controller.nodeAffinityPreset.values` | Node label values to match. Ignored if `controller.affinity` is set | `[]` | +| `controller.affinity` | Affinity for controller pods assignment | `{}` | +| `controller.nodeSelector` | Node labels for controller pods assignment | `{}` | +| `controller.tolerations` | Tolerations for controller pods assignment | `[]` | +| `controller.updateStrategy.type` | controller statefulset strategy type | `RollingUpdate` | +| `controller.topologySpreadConstraints` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in | `[]` | +| `controller.schedulerName` | Alternate scheduler for the server controller | `""` | +| `controller.priorityClassName` | controller pods' priorityClassName | `""` | +| `controller.lifecycleHooks` | for the controller container(s) to automate configuration before or after startup | `{}` | +| `controller.extraEnvVars` | Array with extra environment variables to add to controller nodes | `[]` | +| `controller.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for controller nodes | `""` | +| `controller.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for controller nodes | `""` | +| `controller.extraVolumes` | Optionally specify extra list of additional volumes for the controller pod(s) | `[]` | +| `controller.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the controller container(s) | `[]` | +| `controller.sidecars` | Add additional sidecar containers to the controller pod(s) | `{}` | +| `controller.initContainers` | Add additional init containers to the controller pod(s) | `{}` | +| `controller.service.type` | controller service type | `ClusterIP` | +| `controller.service.ports.metrics` | Metrics port for the controller | `8080` | +| `controller.service.ports.telemetry` | Telemetry port for the controller | `8081` | +| `controller.service.nodePorts.metrics` | Node port for HTTP | `""` | +| `controller.service.nodePorts.telemetry` | Node port for HTTPS | `""` | +| `controller.service.clusterIP` | controller service Cluster IP | `""` | +| `controller.service.loadBalancerIP` | controller service Load Balancer IP | `""` | +| `controller.service.loadBalancerSourceRanges` | controller service Load Balancer sources | `[]` | +| `controller.service.externalTrafficPolicy` | controller service external traffic policy | `Cluster` | +| `controller.service.annotations` | Additional custom annotations for controller service | `{}` | +| `controller.service.extraPorts` | Extra port to expose on the controller service | `[]` | + ### Executor configuration section -| Name | Description | Value | -| ------------------------------------------- | ------------------------------------------------------------- | ---------------------------- | -| `executor.image.registry` | executor image registry | `docker.io` | -| `executor.image.repository` | executor image repository | `bitnami/argo-workflow-exec` | -| `executor.image.tag` | executor image tag (immutable tags are recommended) | `3.2.7-debian-10-r7` | -| `executor.image.pullPolicy` | executor image pull policy | `Always` | -| `executor.image.pullSecrets` | executor image pull secrets | `[]` | -| `executor.resources.limits` | The resources limits for the init container | `{}` | -| `executor.resources.requests` | The requested resources for the init container | `{}` | -| `executor.extraEnvVars` | Array with extra environment variables to add to server nodes | `[]` | -| `executor.containerSecurityContext.enabled` | Enabled executor pods' Security Context | `true` | -| `executor.containerSecurityContext.fsGroup` | Set executor pod's Security Context fsGroup | `1001` | +| Name | Description | Value | +| ---------------------------------------------------------- | ------------------------------------------------------------- | ---------------------------- | +| `executor.image.registry` | executor image registry | `docker.io` | +| `executor.image.repository` | executor image repository | `bitnami/argo-workflow-exec` | +| `executor.image.tag` | executor image tag (immutable tags are recommended) | `3.2.8-debian-10-r24` | +| `executor.image.pullPolicy` | executor image pull policy | `Always` | +| `executor.image.pullSecrets` | executor image pull secrets | `[]` | +| `executor.resources.limits` | The resources limits for the init container | `{}` | +| `executor.resources.requests` | The requested resources for the init container | `{}` | +| `executor.extraEnvVars` | Array with extra environment variables to add to server nodes | `[]` | +| `executor.containerSecurityContext.enabled` | Enabled executor pods' Security Context | `true` | +| `executor.containerSecurityContext.fsGroup` | Set executor pod's Security Context fsGroup | `1001` | +| `executor.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Context | `true` | + ### Traffic Exposure Parameters @@ -310,6 +318,7 @@ The command removes all the Kubernetes components associated with the chart and | `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` | | `ingress.secrets` | Custom TLS certificates as secrets | `[]` | + ### Workflows configuration | Name | Description | Value | @@ -319,6 +328,7 @@ The command removes all the Kubernetes components associated with the chart and | `workflows.serviceAccount.automountServiceAccountToken` | Automount service account token for the workflows service account | `true` | | `workflows.rbac.create` | Whether to create RBAC resource to run workflows | `true` | + ### PostgreSQL subchart | Name | Description | Value | @@ -329,6 +339,7 @@ The command removes all the Kubernetes components associated with the chart and | `postgresql.auth.database` | PortgreSQL database name | `bn_argo_workflows` | | `postgresql.auth.password` | PortgreSQL database password | `""` | + ### MySQL subchart | Name | Description | Value | @@ -339,6 +350,7 @@ The command removes all the Kubernetes components associated with the chart and | `mysql.auth.database` | MySQL database name | `bn_argo_workflows` | | `mysql.auth.password` | MySQL database password | `""` | + ### External Database configuration | Name | Description | Value | @@ -352,6 +364,7 @@ The command removes all the Kubernetes components associated with the chart and | `externalDatabase.existingSecret` | The name of an existing secret with database credentials | `""` | | `externalDatabase.type` | Either postgresql or mysql | `""` | + See https://github.com/bitnami-labs/readme-generator-for-helm to create the table The above parameters map to the env variables defined in [bitnami/argo-workflow-cli](https://github.com/bitnami/bitnami-docker-argo-workflow-cli). For more information please refer to the [bitnami/argo-workflow-cli](https://github.com/bitnami/bitnami-docker-argo-workflow-cli) image documentation. diff --git a/bitnami/argo-workflows/values.yaml b/bitnami/argo-workflows/values.yaml index 7b0e7afa7..604761a89 100644 --- a/bitnami/argo-workflows/values.yaml +++ b/bitnami/argo-workflows/values.yaml @@ -161,11 +161,13 @@ server: ## @param server.containerSecurityContext.enabled Enabled server containers' Security Context ## @param server.containerSecurityContext.runAsUser Set server containers' Security Context runAsUser ## @param server.containerSecurityContext.runAsNonRoot Set server containers' Security Context runAsNonRoot + ## @param server.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte ## containerSecurityContext: enabled: true runAsUser: 1001 runAsNonRoot: true + readOnlyRootFilesystem: true ## Create RBAC resources for the Argo workflows server ## @param server.rbac.create Create RBAC resources for the Argo workflows server @@ -563,11 +565,13 @@ controller: ## @param controller.containerSecurityContext.enabled Enabled controller containers' Security Context ## @param controller.containerSecurityContext.runAsUser Set controller containers' Security Context runAsUser ## @param controller.containerSecurityContext.runAsNonRoot Set controller containers' Security Context runAsNonRoot + ## @param controller.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Conte ## containerSecurityContext: enabled: true runAsUser: 1001 runAsNonRoot: true + readOnlyRootFilesystem: true ## Server container port ## @param controller.containerPorts.metrics Port to expose controller metrics @@ -989,10 +993,12 @@ executor: ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod ## @param executor.containerSecurityContext.enabled Enabled executor pods' Security Context ## @param executor.containerSecurityContext.fsGroup Set executor pod's Security Context fsGroup + ## @param executor.containerSecurityContext.readOnlyRootFilesystem Set read only root file system pod's Security Context ## containerSecurityContext: enabled: true fsGroup: 1001 + readOnlyRootFilesystem: true ## @section Traffic Exposure Parameters ##