diff --git a/bitnami/kubeapps/Chart.yaml b/bitnami/kubeapps/Chart.yaml index e64d3e24e..1e71df0ac 100644 --- a/bitnami/kubeapps/Chart.yaml +++ b/bitnami/kubeapps/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: kubeapps -version: 3.7.4 -appVersion: v1.10.3 +version: 3.8.0 +appVersion: v1.11.0 description: Kubeapps is a dashboard for your Kubernetes cluster that makes it easy to deploy and manage applications in your cluster using Helm icon: https://raw.githubusercontent.com/kubeapps/kubeapps/master/docs/img/logo.png keywords: diff --git a/bitnami/kubeapps/README.md b/bitnami/kubeapps/README.md index f416d5a2d..775edcecd 100644 --- a/bitnami/kubeapps/README.md +++ b/bitnami/kubeapps/README.md @@ -12,7 +12,7 @@ - Secure authentication to Kubeapps using an [OAuth2/OIDC provider](https://github.com/kubeapps/kubeapps/blob/master/docs/user/using-an-OIDC-provider.md) - Secure authorization based on Kubernetes [Role-Based Access Control](https://github.com/kubeapps/kubeapps/blob/master/docs/user/access-control.md) -## TL;DR; +## TL;DR For Helm 2: @@ -198,6 +198,16 @@ kubectl delete namespace kubeapps ## Troubleshooting +### Nginx Ipv6 error + +When starting the application, the Nginx server present in the services `kubeapps` and `kubeapps-internal-dashboard` may fail with the following: + +``` +nginx: [emerg] socket() [::]:8080 failed (97: Address family not supported by protocol) +``` + +This usually means that your cluster is not compatible with IPv6. To disable it, install kubeapps with the flag: `--set enableIPv6=false`. + ### Forbidden error while installing the Chart If during installation you run into an error similar to: diff --git a/bitnami/kubeapps/requirements.lock b/bitnami/kubeapps/requirements.lock index 5fa432d46..73a65d7da 100644 --- a/bitnami/kubeapps/requirements.lock +++ b/bitnami/kubeapps/requirements.lock @@ -1,9 +1,9 @@ dependencies: - name: mongodb repository: https://charts.bitnami.com/bitnami - version: 7.14.8 + version: 8.2.1 - name: postgresql repository: https://charts.bitnami.com/bitnami - version: 8.10.11 -digest: sha256:ab1c99273fd342dce2879dece3c38eb0d525a1df870758e873ca293cdd857a25 -generated: "2020-07-01T14:11:29.916518817+10:00" + version: 8.10.14 +digest: sha256:0ee57ab834a01756bd7861923711a4b2052726349fc47788ca033ddf4c44025d +generated: "2020-07-29T10:57:26.484335228+02:00" diff --git a/bitnami/kubeapps/requirements.yaml b/bitnami/kubeapps/requirements.yaml index 7457407ee..bc84035c9 100644 --- a/bitnami/kubeapps/requirements.yaml +++ b/bitnami/kubeapps/requirements.yaml @@ -1,9 +1,13 @@ dependencies: - name: mongodb - version: "~ 7.14.2" + version: ">= 8.2.1" repository: https://charts.bitnami.com/bitnami condition: mongodb.enabled - name: postgresql - version: ">= 0" + # TODO(andresmgot): Unable to upgrade to 9.X at the moment due to a breaking change + # in https://github.com/bitnami/charts/pull/3021, if we need to upgrade, it's necessary + # to tell users to execute this before: + # kubectl delete statefulset -n kubeapps kubeapps-postgresql-master kubeapps-postgresql-slave + version: "~ 8.10.11" repository: https://charts.bitnami.com/bitnami condition: postgresql.enabled diff --git a/bitnami/kubeapps/templates/apprepository-deployment.yaml b/bitnami/kubeapps/templates/apprepository-deployment.yaml index c49aaf023..b8a2a82e7 100644 --- a/bitnami/kubeapps/templates/apprepository-deployment.yaml +++ b/bitnami/kubeapps/templates/apprepository-deployment.yaml @@ -46,7 +46,7 @@ spec: - --repo-sync-cmd=/asset-syncer - --namespace={{ .Release.Namespace }} {{- if .Values.mongodb.enabled }} - - --database-secret-name={{ .Values.mongodb.existingSecret }} + - --database-secret-name={{ .Values.mongodb.auth.existingSecret }} - --database-secret-key=mongodb-root-password - --database-type=mongodb - --database-url={{ template "kubeapps.mongodb.fullname" . }} diff --git a/bitnami/kubeapps/templates/apprepository-jobs-postupgrade.yaml b/bitnami/kubeapps/templates/apprepository-jobs-postupgrade.yaml index 77cea0289..62d060e2e 100644 --- a/bitnami/kubeapps/templates/apprepository-jobs-postupgrade.yaml +++ b/bitnami/kubeapps/templates/apprepository-jobs-postupgrade.yaml @@ -62,7 +62,7 @@ spec: secretKeyRef: {{- if .Values.mongodb.enabled }} key: mongodb-root-password - name: {{ .Values.mongodb.existingSecret }} + name: {{ .Values.mongodb.auth.existingSecret }} {{- end }} {{- if .Values.postgresql.enabled }} key: postgresql-password diff --git a/bitnami/kubeapps/templates/assetsvc-deployment.yaml b/bitnami/kubeapps/templates/assetsvc-deployment.yaml index bb4862a2f..2bce766e0 100644 --- a/bitnami/kubeapps/templates/assetsvc-deployment.yaml +++ b/bitnami/kubeapps/templates/assetsvc-deployment.yaml @@ -49,7 +49,7 @@ spec: - name: DB_PASSWORD valueFrom: secretKeyRef: - name: {{ .Values.mongodb.existingSecret }} + name: {{ .Values.mongodb.auth.existingSecret }} key: mongodb-root-password - name: POD_NAMESPACE valueFrom: diff --git a/bitnami/kubeapps/templates/dashboard-config.yaml b/bitnami/kubeapps/templates/dashboard-config.yaml index 93a273430..8c5472a6e 100644 --- a/bitnami/kubeapps/templates/dashboard-config.yaml +++ b/bitnami/kubeapps/templates/dashboard-config.yaml @@ -8,7 +8,9 @@ data: vhost.conf: |- server { listen 8080; + {{- if .Values.enableIPv6 }} listen [::]:8080; + {{- end}} server_name _; gzip on; diff --git a/bitnami/kubeapps/templates/db-secret-bootstrap.yaml b/bitnami/kubeapps/templates/db-secret-bootstrap.yaml index 9c2589d34..f2ebfa2cd 100644 --- a/bitnami/kubeapps/templates/db-secret-bootstrap.yaml +++ b/bitnami/kubeapps/templates/db-secret-bootstrap.yaml @@ -1,9 +1,9 @@ -{{- if or .Values.mongodb.existingSecret .Values.postgresql.existingSecret -}} +{{- if or .Values.mongodb.auth.existingSecret .Values.postgresql.existingSecret -}} apiVersion: v1 kind: Secret metadata: {{- if .Values.mongodb.enabled }} - name: {{ .Values.mongodb.existingSecret }} + name: {{ .Values.mongodb.auth.existingSecret }} {{- end }} {{- if .Values.postgresql.enabled }} name: {{ .Values.postgresql.existingSecret }} diff --git a/bitnami/kubeapps/templates/db-secret-jobs-cleanup.yaml b/bitnami/kubeapps/templates/db-secret-jobs-cleanup.yaml index 9d0dc4c8f..638efb792 100644 --- a/bitnami/kubeapps/templates/db-secret-jobs-cleanup.yaml +++ b/bitnami/kubeapps/templates/db-secret-jobs-cleanup.yaml @@ -41,4 +41,4 @@ spec: - /bin/sh args: - -c - - "kubectl delete secret -n {{ .Release.Namespace }} {{ .Values.mongodb.existingSecret }} {{ .Values.postgresql.existingSecret }}|| true" + - "kubectl delete secret -n {{ .Release.Namespace }} {{ .Values.mongodb.auth.existingSecret }} {{ .Values.postgresql.existingSecret }}|| true" diff --git a/bitnami/kubeapps/templates/kubeapps-frontend-config.yaml b/bitnami/kubeapps/templates/kubeapps-frontend-config.yaml index a965236a2..bf303725c 100644 --- a/bitnami/kubeapps/templates/kubeapps-frontend-config.yaml +++ b/bitnami/kubeapps/templates/kubeapps-frontend-config.yaml @@ -40,7 +40,9 @@ data: server { listen 8080; + {{- if .Values.enableIPv6 }} listen [::]:8080; + {{- end}} server_name _; location /healthz { diff --git a/bitnami/kubeapps/templates/kubeapps-frontend-deployment.yaml b/bitnami/kubeapps/templates/kubeapps-frontend-deployment.yaml index 93a54f0d5..65f84feff 100644 --- a/bitnami/kubeapps/templates/kubeapps-frontend-deployment.yaml +++ b/bitnami/kubeapps/templates/kubeapps-frontend-deployment.yaml @@ -57,20 +57,21 @@ spec: {{- if .Values.authProxy.enabled }} - name: auth-proxy args: - - -provider={{ required "You must fill \".Values.authProxy.provider\" with the provider. Valid values at https://pusher.github.io/oauth2_proxy/auth-configuration" .Values.authProxy.provider }} - - -client-id={{ required "You must fill \".Values.authProxy.clientID\" with the Client ID of the provider" .Values.authProxy.clientID }} - - -client-secret={{ required "You must fill \".Values.authProxy.clientSecret\" with the Client Secret of the provider" .Values.authProxy.clientSecret }} - - -cookie-secret={{ required "You must fill \".Values.authProxy.cookieSecret\" with a 16, 24 or 32 byte base64 encoded seed string for secure cookies" .Values.authProxy.cookieSecret }} - - -upstream=http://localhost:8080/ - - -http-address=0.0.0.0:3000 - - -email-domain={{ .Values.authProxy.emailDomain }} - - -pass-basic-auth=false - - -pass-access-token=true - - -pass-authorization-header=true - - -skip-auth-regex=^\/config\.json$ - - -skip-auth-regex=^\/favicon.*\.png$ - - -skip-auth-regex=^\/static\/ - - -skip-auth-regex=^\/$ + - --provider={{ required "You must fill \".Values.authProxy.provider\" with the provider. Valid values at https://pusher.github.io/oauth2_proxy/auth-configuration" .Values.authProxy.provider }} + - --client-id={{ required "You must fill \".Values.authProxy.clientID\" with the Client ID of the provider" .Values.authProxy.clientID }} + - --client-secret={{ required "You must fill \".Values.authProxy.clientSecret\" with the Client Secret of the provider" .Values.authProxy.clientSecret }} + - --cookie-secret={{ required "You must fill \".Values.authProxy.cookieSecret\" with a 16, 24 or 32 byte base64 encoded seed string for secure cookies" .Values.authProxy.cookieSecret }} + - --upstream=http://localhost:8080/ + - --http-address=0.0.0.0:3000 + - --email-domain={{ .Values.authProxy.emailDomain }} + - --pass-basic-auth=false + - --pass-access-token=true + - --pass-authorization-header=true + - --skip-auth-regex=^\/config\.json$ + - --skip-auth-regex=^\/favicon.*\.png$ + - --skip-auth-regex=^\/static\/ + - --skip-auth-regex=^\/$ + - --scope=openid email groups {{- range .Values.authProxy.additionalFlags }} - {{ . }} {{- end }} diff --git a/bitnami/kubeapps/templates/kubeops-deployment.yaml b/bitnami/kubeapps/templates/kubeops-deployment.yaml index 52fb058b1..17dc9122f 100644 --- a/bitnami/kubeapps/templates/kubeops-deployment.yaml +++ b/bitnami/kubeapps/templates/kubeops-deployment.yaml @@ -54,6 +54,8 @@ spec: volumeMounts: - name: kubeops-config mountPath: /config + - name: ca-certs + mountPath: /etc/additional-clusters-cafiles {{- end }} env: - name: POD_NAMESPACE @@ -77,6 +79,8 @@ spec: - name: kubeops-config configMap: name: {{ template "kubeapps.kubeops-config.fullname" . }} + - name: ca-certs + emptyDir: {} {{- end }} {{- end }}{{/* matches useHelm3 */}} diff --git a/bitnami/kubeapps/values.yaml b/bitnami/kubeapps/values.yaml index 32f005cd1..993a4f15b 100644 --- a/bitnami/kubeapps/values.yaml +++ b/bitnami/kubeapps/values.yaml @@ -16,6 +16,9 @@ useHelm3: false ## When set to true, Kubeapps creates a ClusterRole to be able to list namespaces. allowNamespaceDiscovery: true +## Enable IPv6 Configuration for Nginx +enableIPv6: true + ## The frontend service is the main reverse proxy used to access the Kubeapps UI ## To expose Kubeapps externally either configure the ingress object below or ## set frontend.service.type=LoadBalancer in the frontend configuration. @@ -105,7 +108,7 @@ frontend: image: registry: docker.io repository: bitnami/nginx - tag: 1.18.0-debian-10-r38 + tag: 1.19.1-debian-10-r16 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -193,7 +196,7 @@ apprepository: image: registry: docker.io repository: bitnami/kubeapps-apprepository-controller - tag: 1.10.3-scratch-r0 + tag: 1.11.0-scratch-r0 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -205,7 +208,7 @@ apprepository: syncImage: registry: docker.io repository: bitnami/kubeapps-asset-syncer - tag: 1.10.3-scratch-r0 + tag: 1.11.0-scratch-r0 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -279,7 +282,7 @@ hooks: image: registry: docker.io repository: bitnami/kubectl - tag: 1.16.3-debian-10-r85 + tag: 1.16.3-debian-10-r176 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -305,7 +308,7 @@ kubeops: image: registry: docker.io repository: bitnami/kubeapps-kubeops - tag: 1.10.3-scratch-r0 + tag: 1.11.0-scratch-r0 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -352,7 +355,7 @@ tillerProxy: image: registry: docker.io repository: bitnami/kubeapps-tiller-proxy - tag: 1.10.3-scratch-r0 + tag: 1.11.0-scratch-r1 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -430,7 +433,7 @@ assetsvc: image: registry: docker.io repository: bitnami/kubeapps-assetsvc - tag: 1.10.3-scratch-r0 + tag: 1.11.0-scratch-r0 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -495,7 +498,7 @@ dashboard: image: registry: docker.io repository: bitnami/kubeapps-dashboard - tag: 1.10.3-debian-10-r0 + tag: 1.11.0-debian-10-r0 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -561,7 +564,8 @@ mongodb: size: 8Gi ## MongoDB credentials are handled by kubeapps to facilitate upgrades ## - existingSecret: kubeapps-mongodb + auth: + existingSecret: kubeapps-mongodb ## Pod Security Context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ## @@ -633,7 +637,7 @@ securityContext: testImage: registry: docker.io repository: bitnami/nginx - tag: 1.18.0-debian-10-r38 + tag: 1.19.1-debian-10-r16 # Auth Proxy for OIDC support # ref: https://github.com/kubeapps/kubeapps/blob/master/docs/user/using-an-OIDC-provider.md @@ -646,7 +650,7 @@ authProxy: image: registry: docker.io repository: bitnami/oauth2-proxy - tag: 5.1.0-debian-10-r24 + tag: 6.0.0-debian-10-r23 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -668,10 +672,10 @@ authProxy: ## Additional flags for oauth2-proxy ## additionalFlags: [] - # - -ssl-insecure-skip-verify - # - -cookie-secure=false - # - -scope=https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/cloud-platform - # - -oidc-issuer-url=https://accounts.google.com # Only needed if provider is oidc + # - --ssl-insecure-skip-verify + # - --cookie-secure=false + # - --scope=https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/cloud-platform + # - --oidc-issuer-url=https://accounts.google.com # Only needed if provider is oidc ## OAuth2 Proxy containers' resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## @@ -696,6 +700,9 @@ featureFlags: invalidateCache: true operators: false # additionalClusters is a WIP feature for multi-cluster support. + # The base64-encoded certificateAuthorityData can be obtained from the additional cluster's kube config + # file, for example: + # kubectl --kubeconfig ~/.kube/kind-config-kubeapps-additional config view --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' additionalClusters: [] # additionalClusters: # - name: second-cluster