diff --git a/bitnami/redmine/Chart.yaml b/bitnami/redmine/Chart.yaml index 8c4bc7cca..e9f3f4f15 100644 --- a/bitnami/redmine/Chart.yaml +++ b/bitnami/redmine/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: redmine -version: 14.1.21 +version: 14.2.0 appVersion: 4.1.1 description: A flexible project management web application. keywords: diff --git a/bitnami/redmine/README.md b/bitnami/redmine/README.md index dff4e7c84..42fc2a877 100644 --- a/bitnami/redmine/README.md +++ b/bitnami/redmine/README.md @@ -169,6 +169,20 @@ The following table lists the configurable parameters of the Redmine chart and t | `mailReceiver.priority` | Defines a new task priority | `""` | | `mailReceiver.assignedTo` | Defines a new task priority | `""` | | `mailReceiver.allowOverride` | Defines if email content is allowed to set attributes values. Values is a comma separated list of attributes or `all` to alllow all attributes | `""` | +| `certificates.customCertificate.certificateSecret` | Secret containing the certificate and key to add | `""` | +| `certificates.customCertificate.chainSecret.name` | Name of the secret containing the certificate chain | `""` | +| `certificates.customCertificate.chainSecret.key` | Key of the certificate chain file inside the secret | `""` | +| `certificates.customCertificate.certificateLocation` | Location in the container to store the certificate | `/etc/ssl/certs/ssl-cert-snakeoil.pem` | +| `certificates.customCertificate.keyLocation` | Location in the container to store the private key | `/etc/ssl/private/ssl-cert-snakeoil.key` | +| `certificates.customCertificate.chainLocation` | Location in the container to store the certificate chain | `/etc/ssl/certs/chain.pem` | +| `certificates.customCA` | Defines a list of secrets to import into the container trust store | `[]` | +| `certificates.image.registry` | Container sidecar registry | `docker.io` | +| `certificates.image.repository` | Container sidecar image | `bitnami/minideb` | +| `certificates.image.tag` | Container sidecar image tag | `buster` | +| `certificates.image.pullPolicy` | Container sidecar image pull policy | `IfNotPresent` | +| `certificates.image.pullSecrets` | Container sidecar image pull secrets | `image.pullSecrets` | +| `certificates.extraEnvVars` | Container sidecar extra environment variables (eg proxy) | `[]` | + The above parameters map to the env variables defined in [bitnami/redmine](http://github.com/bitnami/bitnami-docker-redmine). For more information please refer to the [bitnami/redmine](http://github.com/bitnami/bitnami-docker-redmine) image documentation. @@ -223,6 +237,26 @@ The following example includes two PVCs, one for Redmine and another for MariaDB $ helm install test --set persistence.existingClaim=PVC_REDMINE,mariadb.persistence.existingClaim=PVC_MARIADB bitnami/redmine ``` +## CA Certificates + +Custom CA certificates not included in the base docker image can be added with +the following configuration. The secret must exist in the same namespace as the +deployment. Will load all certificates files it finds in the secret. + +```yaml +certificates: + customCAs: + - secret: my-ca-1 + - secret: my-ca-2 +``` + +###Secret +Secret can be created with: + +```bash +kubectl create secret generic my-ca-1 --from-file my-ca-1.crt +``` + ## Upgrading ### 14.0.0 diff --git a/bitnami/redmine/templates/_certificates.tpl b/bitnami/redmine/templates/_certificates.tpl new file mode 100644 index 000000000..aed154a36 --- /dev/null +++ b/bitnami/redmine/templates/_certificates.tpl @@ -0,0 +1,126 @@ +{{/* Templates for certificates injection */}} + +{{/* +Return the proper Redmine image name +*/}} +{{- define "certificates.image" -}} +{{- $registryName := default .Values.certificates.image.registry .Values.image.registry -}} +{{- $repositoryName := .Values.certificates.image.repository -}} +{{- $tag := .Values.certificates.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{- define "certificates.initContainer" -}} +{{- if .Values.certificates.customCAs }} +- name: certificates + image: {{ template "certificates.image" . }} + imagePullPolicy: {{ default .Values.image.pullPolicy .Values.certificates.image.pullPolicy }} + imagePullSecrets: + {{- range (default .Values.image.pullSecrets .Values.certificates.image.pullSecrets) }} + - name: {{ . }} + {{- end }} + command: + {{- if .Values.certificates.customCertificate.certificateSecret }} + - sh + - -c + - if command -v apk >/dev/null; then apk add --no-cache ca-certificates openssl && update-ca-certificates; + else apt-get update && apt-get install -y ca-certificates openssl; fi + {{- else }} + - sh + - -c + - if command -v apk >/dev/null; then apk add --no-cache ca-certificates openssl && update-ca-certificates; + else apt-get update && apt-get install -y ca-certificates openssl; fi + && openssl req -new -x509 -days 3650 -nodes -sha256 + -subj "/CN=$(hostname)" -addext "subjectAltName = DNS:$(hostname)" + -out /etc/ssl/certs/ssl-cert-snakeoil.pem + -keyout /etc/ssl/private/ssl-cert-snakeoil.key -extensions v3_req + {{- end }} + {{- if .Values.certificates.extraEnvVars }} + env: + {{- tpl (toYaml .Values.certificates.extraEnvVars) $ | nindent 2 }} + {{- end }} + volumeMounts: + - name: etc-ssl-certs + mountPath: /etc/ssl/certs + readOnly: false + - name: etc-ssl-private + mountPath: /etc/ssl/private + readOnly: false + - name: custom-ca-certificates + mountPath: /usr/local/share/ca-certificates + readOnly: true +{{- end }} +{{- end }} + +{{- define "certificates.volumes" -}} +{{- if .Values.certificates.customCAs }} +- name: etc-ssl-certs + emptyDir: + medium: "Memory" +- name: etc-ssl-private + emptyDir: + medium: "Memory" +- name: custom-ca-certificates + projected: + defaultMode: 0400 + sources: + {{- range $index, $customCA := .Values.certificates.customCAs }} + - secret: + name: {{ $customCA.secret }} + # items not specified, will mount all keys + {{- end }} +{{- end -}} +{{- if .Values.certificates.customCertificate.certificateSecret }} +- name: custom-certificate + secret: + secretName: {{ .Values.certificates.customCertificate.certificateSecret }} +{{- if .Values.certificates.customCertificate.chainSecret }} +- name: custom-certificate-chain + secret: + secretName: {{ .Values.certificates.customCertificate.chainSecret.name }} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "certificates.volumeMount" -}} +{{- if .Values.certificates.customCAs }} +- name: etc-ssl-certs + mountPath: /etc/ssl/certs/ + readOnly: false +- name: etc-ssl-private + mountPath: /etc/ssl/private/ + readOnly: false +- name: custom-ca-certificates + mountPath: /usr/local/share/ca-certificates + readOnly: true +{{- end -}} +{{- if .Values.certificates.customCertificate.certificateSecret }} +- name: custom-certificate + mountPath: {{ .Values.certificates.customCertificate.certificateLocation }} + subPath: tls.crt + readOnly: true +- name: custom-certificate + mountPath: {{ .Values.certificates.customCertificate.keyLocation }} + subPath: tls.key + readOnly: true +{{- if .Values.certificates.customCertificate.chainSecret }} +- name: custom-certificate-chain + mountPath: {{ .Values.certificates.customCertificate.chainLocation }} + subPath: {{ .Values.certificates.customCertificate.chainSecret.key }} + readOnly: true +{{- end }} +{{- end -}} +{{- end -}} diff --git a/bitnami/redmine/templates/deployment.yaml b/bitnami/redmine/templates/deployment.yaml index 94630e614..e8b6f2a26 100644 --- a/bitnami/redmine/templates/deployment.yaml +++ b/bitnami/redmine/templates/deployment.yaml @@ -28,6 +28,8 @@ spec: {{- with .Values.securityContext }} securityContext: {{- toYaml . | nindent 8 }} {{- end }} + initContainers: + {{- include "certificates.initContainer" . | indent 8 }} containers: - name: {{ template "redmine.fullname" . }} image: {{ template "redmine.image" . }} @@ -145,9 +147,11 @@ spec: failureThreshold: {{ .Values.readinessProbe.failureThreshold }} {{- end }} volumeMounts: + {{- include "certificates.volumeMount" . | indent 12 }} - name: redmine-data mountPath: /bitnami/redmine volumes: + {{- include "certificates.volumes" . | indent 8 }} - name: redmine-data {{- if .Values.persistence.enabled }} persistentVolumeClaim: diff --git a/bitnami/redmine/values.yaml b/bitnami/redmine/values.yaml index c3aef5522..9ea187358 100644 --- a/bitnami/redmine/values.yaml +++ b/bitnami/redmine/values.yaml @@ -14,7 +14,7 @@ image: registry: docker.io repository: bitnami/redmine - tag: 4.1.1-debian-10-r60 + tag: 4.1.1-debian-10-r64 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -388,7 +388,7 @@ mailReceiver: image: registry: docker.io repository: bitnami/redmine - tag: 4.1.1-debian-10-r59 + tag: 4.1.1-debian-10-r62 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -470,3 +470,32 @@ mailReceiver: ## Defines a list of attributes which can be overrided by received email body ## "all" means that all attributes can be overrided allowOverride: "" + +# Add custom certificates and certificate authorities to redmine container +certificates: + customCertificate: + certificateSecret: "" + chainSecret: {} + # name: secret-name + # key: secret-key + certificateLocation: /etc/ssl/certs/ssl-cert-snakeoil.pem + keyLocation: /etc/ssl/private/ssl-cert-snakeoil.key + chainLocation: /etc/ssl/certs/mychain.pem + customCA: [] + # - secret: custom-CA + # - secret: more-custom-CAs + image: + registry: docker.io + repository: bitnami/minideb + tag: buster + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + # pullPolicy: + # pullSecrets + # - myRegistryKeySecretName + extraEnvVars: [] + # - name: myvar + # value: myval