kubeapps: bump chart version to 3.2.1

bitnami/kubeapps/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: kubeapps
-version: 3.2.0
-appVersion: v1.7.1
+version: 3.2.1
+appVersion: v1.7.2
 description: Kubeapps is a dashboard for your Kubernetes cluster that makes it easy to deploy and manage applications in your cluster using Helm
 icon: https://raw.githubusercontent.com/kubeapps/kubeapps/master/docs/img/logo.png
 keywords:

bitnami/kubeapps/templates/_helpers.tpl

@@ -150,6 +150,13 @@ Create name for the tiller-proxy based on the fullname
 {{ template "kubeapps.fullname" . }}-internal-tiller-proxy
 {{- end -}}
 
+{{/*
+Create name for kubeops based on the fullname
+*/}}
+{{- define "kubeapps.kubeops.fullname" -}}
+{{ template "kubeapps.fullname" . }}-internal-kubeops
+{{- end -}}
+
 {{/*
 Create name for the secrets related to an app repository
 */}}

bitnami/kubeapps/templates/kubeapps-frontend-config.yaml

@@ -62,7 +62,11 @@ data:
         proxy_set_header Authorization "Bearer $http_x_forwarded_access_token";
         {{- end }}
 
+        {{- if .Values.useHelm3 }}
+        proxy_pass http://{{ template "kubeapps.kubeops.fullname" . }}:{{ .Values.kubeops.service.port }};
+        {{- else }}
         proxy_pass http://{{ template "kubeapps.tiller-proxy.fullname" . }}:{{ .Values.tillerProxy.service.port }};
+        {{- end }}
       }
 
       location ~* /api/tiller-deploy {
@@ -71,7 +75,11 @@ data:
         proxy_read_timeout 10m;
         rewrite /api/tiller-deploy/(.*) /$1 break;
         rewrite /api/tiller-deploy / break;
+        {{- if .Values.useHelm3 }}
+        proxy_pass http://{{ template "kubeapps.kubeops.fullname" . }}:{{ .Values.kubeops.service.port }};
+        {{- else }}
         proxy_pass http://{{ template "kubeapps.tiller-proxy.fullname" . }}:{{ .Values.tillerProxy.service.port }};
+        {{- end }}
 
         {{- if .Values.frontend.proxypassAccessTokenAsBearer }}
         # Google Kubernetes Engine requires the access_token as the Bearer when talking to the k8s api server.
@@ -79,6 +87,19 @@ data:
         {{- end }}
       }
 
+      # The route for the Kubeapps backend API is not prefixed.
+      location ~* /api/ {
+        rewrite /api/(.*) /backend/$1 break;
+        rewrite /api/ /backend break;
+
+        {{- if .Values.frontend.proxypassAccessTokenAsBearer }}
+        # Google Kubernetes Engine requires the access_token as the Bearer when talking to the k8s api server.
+        proxy_set_header Authorization "Bearer $http_x_forwarded_access_token";
+        {{- end }}
+
+        proxy_pass http://{{ template "kubeapps.tiller-proxy.fullname" . }}:{{ .Values.tillerProxy.service.port }};
+      }
+
       location / {
         # Add the Authorization header if exists
         add_header Authorization $http_authorization;

bitnami/kubeapps/templates/kubeops-deployment.yaml

@@ -0,0 +1,63 @@
+{{- if .Values.useHelm3 -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "kubeapps.kubeops.fullname" . }}
+  labels:
+    app: {{ template "kubeapps.kubeops.fullname" . }}
+    chart: {{ template "kubeapps.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ .Values.kubeops.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ template "kubeapps.kubeops.fullname" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ template "kubeapps.kubeops.fullname" . }}
+        release: {{ .Release.Name }}
+    spec:
+      serviceAccountName: {{ template "kubeapps.kubeops.fullname" . }}
+      # Increase termination timeout to let remaining operations to finish before killing the pods
+      # This is because new releases/upgrades/deletions are synchronous operations
+      terminationGracePeriodSeconds: 300
+{{- include "kubeapps.imagePullSecrets" . | indent 6 }}
+      containers:
+      - name: kubeops
+        image: {{ template "kubeapps.image" (list .Values.kubeops.image .Values.global) }}
+        command:
+        - /kubeops
+        args:
+        - --user-agent-comment=kubeapps/{{ .Chart.AppVersion }}
+        - --chartsvc-url=http://{{ template "kubeapps.chartsvc.fullname" . }}:{{ .Values.chartsvc.service.port }}
+        ports:
+        - name: http
+          containerPort: {{ .Values.kubeops.service.port }}
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        resources:
+{{ toYaml .Values.kubeops.resources | indent 12 }}
+    {{- with .Values.kubeops.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+      {{- if .Values.securityContext.enabled }}
+      securityContext:
+        fsGroup: {{ .Values.securityContext.fsGroup }}
+        runAsUser: {{ .Values.securityContext.runAsUser }}
+      {{- end }}
+    {{- with .Values.kubeops.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.kubeops.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+{{- end }}{{/* matches useHelm3 */}}

bitnami/kubeapps/templates/kubeops-service.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.useHelm3 -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "kubeapps.kubeops.fullname" . }}
+  labels:
+    app: {{ template "kubeapps.name" . }}
+    chart: {{ template "kubeapps.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  type: ClusterIP
+  ports:
+  - port: {{ .Values.kubeops.service.port }}
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app: {{ template "kubeapps.kubeops.fullname" . }}
+    release: {{ .Release.Name }}
+{{- end }}{{/* matches useHelm3 */}}

bitnami/kubeapps/templates/kubeops-serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.useHelm3 -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "kubeapps.kubeops.fullname" . }}
+  labels:
+    app: {{ template "kubeapps.kubeops.fullname" . }}
+    chart: {{ template "kubeapps.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- end }}{{/* matches useHelm3 */}}

bitnami/kubeapps/templates/tiller-proxy-deployment.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.useHelm3 -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -68,6 +69,12 @@ spec:
           ports:
             - name: http
               containerPort: {{ .Values.tillerProxy.service.port }}
+          {{- if .Values.tillerProxy.livenessProbe }}
+          livenessProbe: {{- toYaml .Values.tillerProxy.livenessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.tillerProxy.readinessProbe }}
+          readinessProbe: {{- toYaml .Values.tillerProxy.readinessProbe | nindent 12 }}
+          {{- end }}
           {{- if .Values.tillerProxy.resources }}
           resources: {{- toYaml .Values.tillerProxy.resources | nindent 12 }}
           {{- end }}
@@ -80,3 +87,4 @@ spec:
           secret:
             secretName: {{ template "kubeapps.tiller-proxy.fullname" . }}
       {{- end }}
+{{- end }}{{/* matches useHelm3 */}}

bitnami/kubeapps/templates/tiller-proxy-rbac.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.useHelm3 -}}
 {{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
@@ -40,3 +41,4 @@ subjects:
     name: {{ template "kubeapps.tiller-proxy.fullname" . }}
     namespace: {{ .Release.Namespace }}
 {{- end -}}
+{{- end }}{{/* matches useHelm3 */}}

bitnami/kubeapps/templates/tiller-proxy-secret.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.useHelm3 -}}
 # The tls ca certificate is only required when tls.verify is set to true, we fail otherwise.
 {{- if .Values.tillerProxy.tls -}}
 {{- if and (.Values.tillerProxy.tls.verify) (not (.Values.tillerProxy.tls.ca)) -}}
@@ -22,3 +23,4 @@ data:
   tls.key: |-
 {{ .Values.tillerProxy.tls.key | b64enc | indent 4 }}
 {{- end -}}
+{{- end }}{{/* matches useHelm3 */}}

bitnami/kubeapps/templates/tiller-proxy-service.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.useHelm3 -}}
 apiVersion: v1
 kind: Service
 metadata:
@@ -17,3 +18,4 @@ spec:
   selector:
     app: {{ template "kubeapps.tiller-proxy.fullname" . }}
     release: {{ .Release.Name }}
+{{- end }}{{/* matches useHelm3 */}}

bitnami/kubeapps/templates/tiller-proxy-serviceaccount.yaml

@@ -1,3 +1,4 @@
+{{- if not .Values.useHelm3 -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -7,3 +8,4 @@ metadata:
     chart: {{ template "kubeapps.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+{{- end }}{{/* matches useHelm3 */}}

bitnami/kubeapps/values.yaml

@@ -8,6 +8,9 @@
 #     - myRegistryKeySecretName
 #   storageClass: myStorageClass
 
+# true for Helm 3; false for Helm 2:
+useHelm3: false # DOES NOT WORK YET; will act as a feature flag later on when we have Helm 3 support.
+
 ## The frontend service is the main reverse proxy used to access the Kubeapps UI
 ## To expose Kubeapps externally either configure the ingress object below or
 ## set frontend.service.type=LoadBalancer in the frontend configuration.
@@ -177,7 +180,7 @@ apprepository:
   image:
     registry: docker.io
     repository: bitnami/kubeapps-apprepository-controller
-    tag: 1.7.1-scratch-r0
+    tag: 1.7.2-scratch-r0
   ## Bitnami Kubeapps Charts Repo image
   ## Image used to perform chart repository syncs
   ## ref: https://hub.docker.com/r/bitnami/kubeapps-chart-repo/tags/
@@ -252,7 +255,7 @@ hooks:
   image:
     registry: docker.io
     repository: bitnami/kubectl
-    tag: 1.12.10-r23
+    tag: 1.16.3-r17
   ## Affinity for hooks' pods assignment
   ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
   ##
@@ -266,6 +269,27 @@ hooks:
   ##
   tolerations: {}
 
+# Kubeops is an interface between the Kubeapps Dashboard and Helm 3/Kubernetes.
+# Set useHelm3 to true to use Kubeops instead of Tiller Proxy.
+kubeops:
+  replicaCount: 2
+  image:
+    registry: docker.io
+    repository: kubeapps/kubeops
+    tag: latest
+  service:
+    port: 8080
+  resources:
+    limits:
+      cpu: 250m
+      memory: 256Mi
+    requests:
+      cpu: 25m
+      memory: 32Mi
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+
 ## Tiller Proxy is a secure REST API on top of Helm's Tiller component used to
 ## manage Helm chart releases in the cluster from Kubeapps. Set tillerProxy.host
 ## to configure a different Tiller host to use.
@@ -279,7 +303,7 @@ tillerProxy:
   image:
     registry: docker.io
     repository: bitnami/kubeapps-tiller-proxy
-    tag: 1.7.1-scratch-r0
+    tag: 1.7.2-scratch-r0
 
   ## Tiller Proxy service parameters
   ##
@@ -314,6 +338,21 @@ tillerProxy:
     requests:
       cpu: 25m
       memory: 32Mi
+  ## Tiller Proxy containers' liveness and readiness probes
+  ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
+  ##
+  livenessProbe:
+    httpGet:
+      path: /live
+      port: 8080
+    initialDelaySeconds: 60
+    timeoutSeconds: 5
+  readinessProbe:
+    httpGet:
+      path: /ready
+      port: 8080
+    initialDelaySeconds: 0
+    timeoutSeconds: 5
 
   ## Affinity for Tiller Proxy pods assignment
   ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
@@ -398,7 +437,7 @@ dashboard:
   image:
     registry: docker.io
     repository: bitnami/kubeapps-dashboard
-    tag: 1.7.1-debian-9-r10
+    tag: 1.7.2-debian-9-r0
   ## Dashboard service parameters
   ##
   service:
@@ -510,7 +549,7 @@ authProxy:
   image:
     registry: docker.io
     repository: bitnami/oauth2-proxy
-    tag: 4.0.0-r32
+    tag: 4.0.0-r92
   ## Mandatory parameters
   ##
   provider: ""