diff --git a/bitnami/airflow/Chart.yaml b/bitnami/airflow/Chart.yaml index 0ad86fbe6..938703f6c 100644 --- a/bitnami/airflow/Chart.yaml +++ b/bitnami/airflow/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: airflow -version: 1.0.1 +version: 2.0.0 appVersion: 1.10.3 description: Apache Airflow is a platform to programmatically author, schedule and monitor workflows. keywords: diff --git a/bitnami/airflow/README.md b/bitnami/airflow/README.md index b058d5219..60000853b 100644 --- a/bitnami/airflow/README.md +++ b/bitnami/airflow/README.md @@ -72,6 +72,8 @@ The following tables lists the configurable parameters of the Kafka chart and th | `git.tag` | Git image tag | `{TAG_NAME}` | | `git.pullPolicy` | Git image pull policy | `IfNotPresent` | | `git.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override airflow.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override ariflow.fullname template with a string | `nil` | | `updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | | `rollingUpdatePartition` | Partition update strategy | `nil` | | `airflow.configurationConfigMap` | Name of an existing config map containing the Airflow config file | `nil` | diff --git a/bitnami/airflow/templates/_helpers.tpl b/bitnami/airflow/templates/_helpers.tpl index 87b67bb48..4081b5b5c 100644 --- a/bitnami/airflow/templates/_helpers.tpl +++ b/bitnami/airflow/templates/_helpers.tpl @@ -3,7 +3,7 @@ Expand the name of the chart. */}} {{- define "airflow.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* diff --git a/bitnami/airflow/values-production.yaml b/bitnami/airflow/values-production.yaml index 86daa7019..e3241cee2 100644 --- a/bitnami/airflow/values-production.yaml +++ b/bitnami/airflow/values-production.yaml @@ -94,6 +94,14 @@ git: # pullSecrets: # - myRegistryKeySecretName +## String to partially override airflow.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override airflow.fullname template +## +# fullnameOverride: + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## diff --git a/bitnami/airflow/values.yaml b/bitnami/airflow/values.yaml index c17f20831..91b5bb13f 100644 --- a/bitnami/airflow/values.yaml +++ b/bitnami/airflow/values.yaml @@ -94,6 +94,14 @@ git: # pullSecrets: # - myRegistryKeySecretName +## String to partially override airflow.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override airflow.fullname template +## +# fullnameOverride: + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## diff --git a/bitnami/apache/Chart.yaml b/bitnami/apache/Chart.yaml index f0a51345a..ca9195db5 100644 --- a/bitnami/apache/Chart.yaml +++ b/bitnami/apache/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: apache -version: 4.3.2 +version: 5.1.1 appVersion: 2.4.39 description: Chart for Apache HTTP Server keywords: diff --git a/bitnami/apache/README.md b/bitnami/apache/README.md index fe5089b3b..e0b8b6daf 100644 --- a/bitnami/apache/README.md +++ b/bitnami/apache/README.md @@ -53,6 +53,8 @@ The following tables lists the configurable parameters of the Apache chart and t | `image.tag` | Apache Docker image tag | `{TAG_NAME}` | | `image.pullPolicy` | Apache Docker image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override apache.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override apache.fullname template with a string | `nil` | | `podAnnotations` | Pod annotations | `{}` | | `ingress.enabled` | Enable ingress controller resource | `false` | | `ingress.certManager` | Add annotations for cert-manager | `false` | @@ -66,8 +68,8 @@ The following tables lists the configurable parameters of the Apache chart and t | `ingress.secrets[0].key` | TLS Secret Key | `nil` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Apache exporter image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/bitnami/apache/templates/_helpers.tpl b/bitnami/apache/templates/_helpers.tpl index a06285e77..21abf6273 100644 --- a/bitnami/apache/templates/_helpers.tpl +++ b/bitnami/apache/templates/_helpers.tpl @@ -2,17 +2,25 @@ {{/* Expand the name of the chart. */}} -{{- define "name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- define "apache.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* Create a default fully qualified app name. We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} -{{- define "fullname" -}} +{{- define "apache.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} {{- end -}} {{/* diff --git a/bitnami/apache/templates/deployment.yaml b/bitnami/apache/templates/deployment.yaml index acceac077..24a02235e 100644 --- a/bitnami/apache/templates/deployment.yaml +++ b/bitnami/apache/templates/deployment.yaml @@ -1,22 +1,22 @@ apiVersion: extensions/v1beta1 kind: Deployment metadata: - name: {{ template "fullname" . }} + name: {{ template "apache.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "apache.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" spec: selector: matchLabels: - app: {{ template "fullname" . }} + app: {{ template "apache.fullname" . }} release: "{{ .Release.Name }}" replicas: 1 template: metadata: labels: - app: {{ template "fullname" . }} + app: {{ template "apache.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -36,7 +36,7 @@ spec: hostnames: - "status.localhost" containers: - - name: {{ template "fullname" . }} + - name: apache image: "{{ template "apache.image" . }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} ports: diff --git a/bitnami/apache/templates/ingress.yaml b/bitnami/apache/templates/ingress.yaml index f4f178943..3a4918b88 100644 --- a/bitnami/apache/templates/ingress.yaml +++ b/bitnami/apache/templates/ingress.yaml @@ -2,9 +2,9 @@ apiVersion: extensions/v1beta1 kind: Ingress metadata: - name: {{ template "fullname" . }} + name: {{ template "apache.fullname" . }} labels: - app: "{{ template "fullname" . }}" + app: "{{ template "apache.fullname" . }}" chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -23,7 +23,7 @@ spec: paths: - path: {{ default "/" .path }} backend: - serviceName: "{{ template "fullname" $ }}" + serviceName: "{{ template "apache.fullname" $ }}" servicePort: http {{- end }} {{- if .Values.ingress.tls }} diff --git a/bitnami/apache/templates/svc.yaml b/bitnami/apache/templates/svc.yaml index 2c712f3f2..daacd4d04 100644 --- a/bitnami/apache/templates/svc.yaml +++ b/bitnami/apache/templates/svc.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "fullname" . }} + name: {{ template "apache.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "apache.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -29,4 +29,4 @@ spec: nodePort: {{ .Values.service.nodePorts.https }} {{- end }} selector: - app: {{ template "fullname" . }} + app: {{ template "apache.fullname" . }} diff --git a/bitnami/apache/values.yaml b/bitnami/apache/values.yaml index 0a457e7da..9ae7bfdbf 100644 --- a/bitnami/apache/values.yaml +++ b/bitnami/apache/values.yaml @@ -25,6 +25,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override apache.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override apache.fullname template +## +# fullnameOverride: + ## Pod annotations ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## @@ -83,8 +91,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/cassandra/Chart.yaml b/bitnami/cassandra/Chart.yaml index 9a146c0f4..a78a5878f 100644 --- a/bitnami/cassandra/Chart.yaml +++ b/bitnami/cassandra/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: cassandra -version: 2.3.10 +version: 3.1.0 appVersion: 3.11.4 description: Apache Cassandra is a free and open-source distributed database management system designed to handle large amounts of data across many commodity servers, providing high availability with no single point of failure. Cassandra offers robust support for clusters spanning multiple datacenters, with asynchronous masterless replication allowing low latency operations for all clients. icon: https://bitnami.com/assets/stacks/cassandra/img/cassandra-stack-220x234.png diff --git a/bitnami/cassandra/README.md b/bitnami/cassandra/README.md index 755f25af0..ad1239fd8 100644 --- a/bitnami/cassandra/README.md +++ b/bitnami/cassandra/README.md @@ -46,79 +46,87 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the cassandra chart and their default values. -| Parameter | Description | Default | -| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | -| `global.imageRegistry` | Global Docker Image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Cassandra Image registry | `docker.io` | -| `image.repository` | Cassandra Image name | `bitnami/cassandra` | -| `image.tag` | Cassandra Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.nodePort` | Kubernetes Service nodePort | `nil` | -| `service.loadBalancerIP` | LoadBalancerIP if service type is `LoadBalancer` | `nil` | -| `service.annotations` | Annotations for the service | {} | -| `persistence.enabled` | Use PVCs to persist data | `true` | -| `persistence.storageClass` | Persistent Volume Storage Class | `generic` | -| `persistence.annotations` | Persistent Volume Claim annotations Annotations | {} | -| `persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | -| `persistence.size` | Persistent Volume Size | `8Gi` | -| `tlsEncryptionSecretName` | Secret with keystore, keystore password, truststore and truststore password | `{}` | -| `resources` | CPU/Memory resource requests/limits | `{}` | -| `existingConfiguration` | Pointer to a configMap that contains custom Cassandra configuration files. This will override any Cassandra configuration variable set in the chart | `{}` | -| `cluster.name` | Cassandra cluster name | `cassandra` | -| `cluster.replicaCount` | Number of Cassandra nodes | `1` | -| `cluster.seedCount` | Number of seed nodes (note: must be greater or equal than 1 and less or equal to `cluster.replicaCount`) | `1` | -| `cluster.numTokens` | Number of tokens for each node | `256` | -| `cluster.datacenter` | Datacenter name | `dc1` | -| `cluster.rack` | Rack name | `rack1` | -| `cluster.enableRPC` | Enable Thrift RPC endpoint | `true` | -| `cluster.minimumAvailable` | Minimum nuber of instances that must be available in the cluster (used of PodDisruptionBudget) | `1` | -| `cluster.internodeEncryption` | Set internode encryption. NOTE: A value different from 'none' requires setting `tlsEncryptionSecretName` | `none` | -| `cluster.clientEncryption` | Set client-server encryption. NOTE: A value different from 'false' requires setting `tlsEncryptionSecretName` | `false` | -| `cluster.jvm.extraOpts` | Set the value for Java Virtual Machine extra optinos (JVM_EXTRA_OPTS) | `nil` | -| `cluster.jvm.maxHeapSize` | Set Java Virtual Machine maximum heap size (MAX_HEAP_SIZE). Calculated automatically if `nil` | `nil` | -| `cluster.jvm.newHeapSize` | Set Java Virtual Machine new heap size (HEAP_NEWSIZE). Calculated automatically if `nil` | `nil` | -| `cluster.domain` | Set the kubernetes cluster domain | `cluster.local` | -| `service.port` | CQL Port for the Kubernetes service | `9042` | -| `service.thriftPort` | Thrift Port for the Kubernetes service | `9160` | -| `dbUser.user` | Cassandra admin user | `cassandra` | -| `dbUser.forcePassword` | Force the user to provide a non-empty password for `dbUser.user` | `false` | -| `dbUser.password` | Password for `dbUser.user`. Randomly generated if empty | (Random generated) | -| `dbUser.existingSecret` | Use an existing secret object for `dbUser.user` password (will ignore `dbUser.password`) | `nil` | -| `initDBConfigMap` | Configmap for initialization CQL commands (done in the first node). Useful for creating keyspaces at startup, for instance | `nil` | -| `livenessProbe.enabled` | Turn on and off liveness probe | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `30` | -| `livenessProbe.periodSeconds` | How often to perform the probe | `30` | -| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `readinessProbe.enabled` | Turn on and off readiness probe | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | -| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | -| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `podAnnotations` | Additional pod annotations | `{}` | -| `podLabels` | Additional pod labels | `{}` | -| `statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | -| `statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `affinity` | Enable node/pod affinity | {} | -| `tolerations` | Toleration labels for pod assignment | \[] | -| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | -| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Cassandra exporter Image registry | `docker.io` | -| `metrics.image.repository` | Cassandra exporter Image name | `criteo/cassandra_exporter` | -| `metrics.image.tag` | Cassandra exporter Image tag | `2.0.4` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter | `{prometheus.io/scrape: "true", prometheus.io/port: "8080"}` | -| `metrics.resources` | Exporter resource requests/limit | `{}` | +| Parameter | Description | Default | +| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | +| `global.imageRegistry` | Global Docker Image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Cassandra Image registry | `docker.io` | +| `image.repository` | Cassandra Image name | `bitnami/cassandra` | +| `image.tag` | Cassandra Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override cassandra.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override cassandra.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `service.type` | Kubernetes Service type | `ClusterIP` | +| `service.nodePort` | Kubernetes Service nodePort | `nil` | +| `service.loadBalancerIP` | LoadBalancerIP if service type is `LoadBalancer` | `nil` | +| `service.annotations` | Annotations for the service | {} | +| `persistence.enabled` | Use PVCs to persist data | `true` | +| `persistence.storageClass` | Persistent Volume Storage Class | `generic` | +| `persistence.annotations` | Persistent Volume Claim annotations Annotations | {} | +| `persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | +| `persistence.size` | Persistent Volume Size | `8Gi` | +| `tlsEncryptionSecretName` | Secret with keystore, keystore password, truststore and truststore password | `{}` | +| `resources` | CPU/Memory resource requests/limits | `{}` | +| `existingConfiguration` | Pointer to a configMap that contains custom Cassandra configuration files. This will override any Cassandra configuration variable set in the chart | `{}` | +| `cluster.name` | Cassandra cluster name | `cassandra` | +| `cluster.replicaCount` | Number of Cassandra nodes | `1` | +| `cluster.seedCount` | Number of seed nodes (note: must be greater or equal than 1 and less or equal to `cluster.replicaCount`) | `1` | +| `cluster.numTokens` | Number of tokens for each node | `256` | +| `cluster.datacenter` | Datacenter name | `dc1` | +| `cluster.rack` | Rack name | `rack1` | +| `cluster.enableRPC` | Enable Thrift RPC endpoint | `true` | +| `cluster.minimumAvailable` | Minimum nuber of instances that must be available in the cluster (used of PodDisruptionBudget) | `1` | +| `cluster.internodeEncryption` | Set internode encryption. NOTE: A value different from 'none' requires setting `tlsEncryptionSecretName` | `none` | +| `cluster.clientEncryption` | Set client-server encryption. NOTE: A value different from 'false' requires setting `tlsEncryptionSecretName` | `false` | +| `cluster.jvm.extraOpts` | Set the value for Java Virtual Machine extra optinos (JVM_EXTRA_OPTS) | `nil` | +| `cluster.jvm.maxHeapSize` | Set Java Virtual Machine maximum heap size (MAX_HEAP_SIZE). Calculated automatically if `nil` | `nil` | +| `cluster.jvm.newHeapSize` | Set Java Virtual Machine new heap size (HEAP_NEWSIZE). Calculated automatically if `nil` | `nil` | +| `cluster.domain` | Set the kubernetes cluster domain | `cluster.local` | +| `service.port` | CQL Port for the Kubernetes service | `9042` | +| `service.thriftPort` | Thrift Port for the Kubernetes service | `9160` | +| `dbUser.user` | Cassandra admin user | `cassandra` | +| `dbUser.forcePassword` | Force the user to provide a non-empty password for `dbUser.user` | `false` | +| `dbUser.password` | Password for `dbUser.user`. Randomly generated if empty | (Random generated) | +| `dbUser.existingSecret` | Use an existing secret object for `dbUser.user` password (will ignore `dbUser.password`) | `nil` | +| `initDBConfigMap` | Configmap for initialization CQL commands (done in the first node). Useful for creating keyspaces at startup, for instance | `nil` | +| `livenessProbe.enabled` | Turn on and off liveness probe | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `30` | +| `livenessProbe.periodSeconds` | How often to perform the probe | `30` | +| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `readinessProbe.enabled` | Turn on and off readiness probe | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | +| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | +| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `podAnnotations` | Additional pod annotations | `{}` | +| `podLabels` | Additional pod labels | `{}` | +| `statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | +| `statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `affinity` | Enable node/pod affinity | {} | +| `tolerations` | Toleration labels for pod assignment | \[] | +| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | +| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | Cassandra exporter Image registry | `docker.io` | +| `metrics.image.repository` | Cassandra exporter Image name | `criteo/cassandra_exporter` | +| `metrics.image.tag` | Cassandra exporter Image tag | `2.0.4` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter | `{prometheus.io/scrape: "true", prometheus.io/port: "8080"}` | +| `metrics.resources` | Exporter resource requests/limit | `{}` | The above parameters map to the env variables defined in [bitnami/cassandra](http://github.com/bitnami/bitnami-docker-cassandra). For more information please refer to the [bitnami/cassandra](http://github.com/bitnami/bitnami-docker-cassandra) image documentation. @@ -192,6 +200,15 @@ The [Bitnami cassandra](https://github.com/bitnami/bitnami-docker-cassandra) ima Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Configuration](#configuration) section to configure the PVC or to disable persistence. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Enable TLS for Cassandra You can enable TLS between client and server and between nodes. In order to do so, you need to set the following values: diff --git a/bitnami/cassandra/templates/_helpers.tpl b/bitnami/cassandra/templates/_helpers.tpl index 5f18affe3..f7e49408d 100644 --- a/bitnami/cassandra/templates/_helpers.tpl +++ b/bitnami/cassandra/templates/_helpers.tpl @@ -125,7 +125,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -133,8 +133,11 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -142,5 +145,31 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "cassandra.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/bitnami/cassandra/templates/service.yaml b/bitnami/cassandra/templates/service.yaml index fe2c51698..ee94e7d1e 100644 --- a/bitnami/cassandra/templates/service.yaml +++ b/bitnami/cassandra/templates/service.yaml @@ -7,6 +7,10 @@ metadata: chart: {{ template "cassandra.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} + annotations: + {{- range $key, $value := .Values.service.annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} spec: {{- if .Values.service.nodePort }} nodePort: {{ .Values.service.nodePort }} diff --git a/bitnami/cassandra/templates/statefulset.yaml b/bitnami/cassandra/templates/statefulset.yaml index cb094df3f..12a1a7530 100644 --- a/bitnami/cassandra/templates/statefulset.yaml +++ b/bitnami/cassandra/templates/statefulset.yaml @@ -58,6 +58,19 @@ spec: {{ toYaml . | indent 8 }} {{- end }} {{- include "cassandra.imagePullSecrets" . | indent 6 }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "cassandra.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/cassandra"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: /bitnami/cassandra + {{- end }} containers: - name: cassandra command: @@ -75,8 +88,7 @@ spec: /app-entrypoint.sh /run.sh image: {{ template "cassandra.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy | quote }} - resources: -{{ toYaml .Values.resources | indent 10 }} + resources: {{ toYaml .Values.resources | nindent 10 }} env: - name: CASSANDRA_CLUSTER_NAME value: {{ .Values.cluster.name }} diff --git a/bitnami/cassandra/values-production.yaml b/bitnami/cassandra/values-production.yaml index c5b5e3a2e..79d13ae6e 100644 --- a/bitnami/cassandra/values-production.yaml +++ b/bitnami/cassandra/values-production.yaml @@ -29,6 +29,32 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override cassandra.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override cassandra.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Specify a service type ## ref: http://kubernetes.io/docs/user-guide/services/ ## diff --git a/bitnami/cassandra/values.yaml b/bitnami/cassandra/values.yaml index 5a701b747..f96a2b48d 100644 --- a/bitnami/cassandra/values.yaml +++ b/bitnami/cassandra/values.yaml @@ -29,6 +29,32 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override cassandra.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override cassandra.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Specify a service type ## ref: http://kubernetes.io/docs/user-guide/services/ ## diff --git a/bitnami/consul/Chart.yaml b/bitnami/consul/Chart.yaml index 29c39f3dc..436ad00bd 100644 --- a/bitnami/consul/Chart.yaml +++ b/bitnami/consul/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: consul -version: 4.2.13 +version: 5.1.0 appVersion: 1.5.2 description: Highly available and distributed service discovery and key-value store designed with support for the modern data center to make distributed systems and configuration easy. home: https://www.consul.io/ diff --git a/bitnami/consul/README.md b/bitnami/consul/README.md index 125159a07..40a7fe860 100644 --- a/bitnami/consul/README.md +++ b/bitnami/consul/README.md @@ -49,75 +49,83 @@ $ helm delete --purge my-release The following tables lists the configurable parameters of the HashiCorp Consul chart and their default values. -| Parameter | Description | Default | -| ------------------------------------ | ---------------------------------------------------------------- | ---------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | HashiCorp Consul image registry | `docker.io` | -| `image.repository` | HashiCorp Consul image name | `bitnami/consul` | -| `image.tag` | HashiCorp Consul image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `replicas` | Number of replicas | `3` | -| `port` | HashiCorp Consul http listening port | `8500` | -| `service.rpcPort` | HashiCorp Consul rpc listening port | `8400` | -| `service.serflanPort` | Container serf lan listening port | `8301` | -| `service.serverPort` | Container server listening port | `8300` | -| `service.consulDnsPort` | Container dns listening port | `8600` | -| `service.uiPort` | HashiCorp Consul UI port | `80` | -| `datacenterName` | HashiCorp Consul datacenter name | `dc1` | -| `gossipKey` | Gossip key for all members | `nil` | -| `domain` | HashiCorp Consul domain | `consul` | -| `clientAddress` | Address in which HashiCorp Consul will bind client interfaces | `0.0.0.0` | -| `serflanAddress` | Address used for Serf LAN communications | `0.0.0.0` | -| `raftMultiplier` | Multiplier used to scale key Raft timing parameters | `10Gi` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | -| `updateStrategy.type` | Statefulset update strategy policy | `RollingUpdate` | -| `persistence.enabled` | Use a PVC to persist data | `true` | -| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | -| `persistence.size` | Size of data volume | `8Gi` | -| `persistence.annotations` | Annotations for the persistent volume | `nil` | -| `resources` | Container resource requests and limits | `{}` | -| `maxUnavailable` | Pod disruption Budget maxUnavailable | `1` | -| `nodeAffinity` | HashiCorp Consul pod node-affinity setting | `nil` | -| `antiAffinity` | HashiCorp Consul pod anti-affinity setting | `soft` | -| `ui.service.enabled` | Use a service to access HashiCorp Consul Ui | `true` | -| `ui.service.type` | Kubernetes Service Type | `ClusterIP` | -| `ui.service.annotations` | Annotations for HashiCorp Consul UI service | {} | -| `ui.service.loadBalancerIP` | IP if HashiCorp Consul UI service type is `LoadBalancer` | `nil` | -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.annotations` | Ingress annotations | `[]` | -| `ingress.hosts[0].name` | Hostname to your HashiCorp Consul installation | `consul-ui.local` | -| `ingress.hosts[0].path` | Path within the url structure | `/` | -| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `consul-ui.local-tls` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | -| `configmap` | HashiCorp Consul configuration to be injected as ConfigMap | `nil` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image` | Exporter image | `prom/consul-exporter` | -| `metrics.imageTag` | Exporter image tag | `v0.3.0` | -| `metrics.imagePullPolicy` | Exporter image pull policy | `IfNotPresent` | -| `metrics.resources` | Exporter resource requests/limit | `{}` | -| `metrics.podAnnotations` | Exporter annotations | `{}` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 30 | -| `livenessProbe.periodSeconds` | How often to perform the probe | 10 | -| `livenessProbe.timeoutSeconds` | When the probe times out | 5 | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1 | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | -| `podAnnotations` | Pod annotations | `{}` | -| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | 5 | -| `readinessProbe.periodSeconds` | How often to perform the probe | 10 | -| `readinessProbe.timeoutSeconds` | When the probe times out | 5 | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1 | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | +| Parameter | Description | Default | +| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | HashiCorp Consul image registry | `docker.io` | +| `image.repository` | HashiCorp Consul image name | `bitnami/consul` | +| `image.tag` | HashiCorp Consul image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override consul.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override consul.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `replicas` | Number of replicas | `3` | +| `port` | HashiCorp Consul http listening port | `8500` | +| `service.rpcPort` | HashiCorp Consul rpc listening port | `8400` | +| `service.serflanPort` | Container serf lan listening port | `8301` | +| `service.serverPort` | Container server listening port | `8300` | +| `service.consulDnsPort` | Container dns listening port | `8600` | +| `service.uiPort` | HashiCorp Consul UI port | `80` | +| `datacenterName` | HashiCorp Consul datacenter name | `dc1` | +| `gossipKey` | Gossip key for all members | `nil` | +| `domain` | HashiCorp Consul domain | `consul` | +| `clientAddress` | Address in which HashiCorp Consul will bind client interfaces | `0.0.0.0` | +| `serflanAddress` | Address used for Serf LAN communications | `0.0.0.0` | +| `raftMultiplier` | Multiplier used to scale key Raft timing parameters | `10Gi` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | +| `updateStrategy.type` | Statefulset update strategy policy | `RollingUpdate` | +| `persistence.enabled` | Use a PVC to persist data | `true` | +| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | +| `persistence.size` | Size of data volume | `8Gi` | +| `persistence.annotations` | Annotations for the persistent volume | `nil` | +| `resources` | Container resource requests and limits | `{}` | +| `maxUnavailable` | Pod disruption Budget maxUnavailable | `1` | +| `nodeAffinity` | HashiCorp Consul pod node-affinity setting | `nil` | +| `antiAffinity` | HashiCorp Consul pod anti-affinity setting | `soft` | +| `ui.service.enabled` | Use a service to access HashiCorp Consul Ui | `true` | +| `ui.service.type` | Kubernetes Service Type | `ClusterIP` | +| `ui.service.annotations` | Annotations for HashiCorp Consul UI service | {} | +| `ui.service.loadBalancerIP` | IP if HashiCorp Consul UI service type is `LoadBalancer` | `nil` | +| `ingress.enabled` | Enable ingress controller resource | `false` | +| `ingress.certManager` | Add annotations for cert-manager | `false` | +| `ingress.annotations` | Ingress annotations | `[]` | +| `ingress.hosts[0].name` | Hostname to your HashiCorp Consul installation | `consul-ui.local` | +| `ingress.hosts[0].path` | Path within the url structure | `/` | +| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `consul-ui.local-tls` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | +| `configmap` | HashiCorp Consul configuration to be injected as ConfigMap | `nil` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image` | Exporter image | `prom/consul-exporter` | +| `metrics.imageTag` | Exporter image tag | `v0.3.0` | +| `metrics.imagePullPolicy` | Exporter image pull policy | `IfNotPresent` | +| `metrics.resources` | Exporter resource requests/limit | `{}` | +| `metrics.podAnnotations` | Exporter annotations | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 30 | +| `livenessProbe.periodSeconds` | How often to perform the probe | 10 | +| `livenessProbe.timeoutSeconds` | When the probe times out | 5 | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1 | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | +| `podAnnotations` | Pod annotations | `{}` | +| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | 5 | +| `readinessProbe.periodSeconds` | How often to perform the probe | 10 | +| `readinessProbe.timeoutSeconds` | When the probe times out | 5 | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1 | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -161,6 +169,15 @@ The [Bitnami HashiCorp Consul](https://github.com/bitnami/bitnami-docker-consul) Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Configuration](#configuration) section to configure the PVC or to disable persistence. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Ingress This chart provides support for ingress resources. If you have an diff --git a/bitnami/consul/templates/_helpers.tpl b/bitnami/consul/templates/_helpers.tpl index 6750b9317..b6218bcf2 100644 --- a/bitnami/consul/templates/_helpers.tpl +++ b/bitnami/consul/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "consul.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. @@ -83,7 +91,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -91,8 +99,11 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -100,5 +111,31 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "consul.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/bitnami/consul/templates/statefulset.yaml b/bitnami/consul/templates/statefulset.yaml index 3d7298724..3de4f729c 100644 --- a/bitnami/consul/templates/statefulset.yaml +++ b/bitnami/consul/templates/statefulset.yaml @@ -76,8 +76,21 @@ spec: values: - "{{ template "consul.name" . }}" {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "consul.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/consul/data"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: /bitnami/consul/data + {{- end }} containers: - - name: "{{ template "consul.fullname" . }}" + - name: consul image: "{{ template "consul.image" . }}" imagePullPolicy: "{{ .Values.image.pullPolicy }}" ports: diff --git a/bitnami/consul/values-production.yaml b/bitnami/consul/values-production.yaml index 9751490ac..dc300e85f 100644 --- a/bitnami/consul/values-production.yaml +++ b/bitnami/consul/values-production.yaml @@ -26,6 +26,32 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override consul.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override consul.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Consul replicas replicas: 3 diff --git a/bitnami/consul/values.yaml b/bitnami/consul/values.yaml index fa848e82d..047f1d02e 100644 --- a/bitnami/consul/values.yaml +++ b/bitnami/consul/values.yaml @@ -26,6 +26,32 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override consul.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override consul.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Consul replicas replicas: 3 diff --git a/bitnami/elasticsearch/Chart.yaml b/bitnami/elasticsearch/Chart.yaml index 59cea69e1..17f28becf 100644 --- a/bitnami/elasticsearch/Chart.yaml +++ b/bitnami/elasticsearch/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: elasticsearch -version: 5.1.10 +version: 6.1.0 appVersion: 7.2.0 description: A highly scalable open-source full-text search and analytics engine keywords: diff --git a/bitnami/elasticsearch/README.md b/bitnami/elasticsearch/README.md index feb0032c6..c6292e856 100644 --- a/bitnami/elasticsearch/README.md +++ b/bitnami/elasticsearch/README.md @@ -49,136 +49,144 @@ $ helm delete --purge my-release The following table lists the configurable parameters of the Elasticsearch chart and their default values. -| Parameter | Description | Default | -|---------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Elasticsearch image registry | `docker.io` | -| `image.repository` | Elasticsearch image repository | `bitnami/elasticsearch` | -| `image.tag` | Elasticsearch image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `name` | Elasticsearch cluster name | `elastic` | -| `plugins` | Comma, semi-colon or space separated list of plugins to install at initialization | `nil` | -| `config` | Elasticsearch node custom configuration | `` | -| `master.name` | Master-eligible node pod name | `master` | -| `master.replicas` | Desired number of Elasticsearch master-eligible nodes | `2` | -| `master.heapSize` | Master-eligible node heap size | `128m` | -| `master.antiAffinity` | Master-eligible node pod anti-affinity policy | `soft` | -| `coordinating.nodeAffinity` | Master-eligible node affinity policy | `nil` | -| `master.service.type` | Kubernetes Service type (master-eligible nodes) | `ClusterIP` | -| `master.service.port` | Kubernetes Service port for Elasticsearch transport port (master-eligible nodes) | `9300` | -| `master.service.nodePort` | Kubernetes Service nodePort (master-eligible nodes) | `nil` | -| `master.service.annotations` | Annotations for master-eligible nodes service | {} | -| `master.service.loadBalancerIP` | loadBalancerIP if master-eligible nodes service type is `LoadBalancer` | `nil` | -| `master.resources` | CPU/Memory resource requests/limits for master-eligible nodes pods | `requests: { cpu: "25m", memory: "256Mi" }` | -| `master.livenessProbe.enabled` | Enable/disable the liveness probe (master-eligible nodes pod) | `true` | -| `master.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (master-eligible nodes pod) | `90` | -| `master.livenessProbe.periodSeconds` | How often to perform the probe (master-eligible nodes pod) | `10` | -| `master.livenessProbe.timeoutSeconds` | When the probe times out (master-eligible nodes pod) | `5` | -| `master.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (master-eligible nodes pod) | `1` | -| `master.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `master.podAnnotations` | Annotations for master pods. | `{}` | -| `master.readinessProbe.enabled` | Enable/disable the readiness probe (master-eligible nodes pod) | `true` | -| `master.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (master-eligible nodes pod) | `90` | -| `master.readinessProbe.periodSeconds` | How often to perform the probe (master-eligible nodes pod) | `10` | -| `master.readinessProbe.timeoutSeconds` | When the probe times out (master-eligible nodes pod) | `5` | -| `master.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (master-eligible nodes pod) | `1` | -| `master.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | -| `discovery.name` | Discover node pod name | `discovery` | -| `coordinating.name` | Coordinating-only node pod name | `coordinating-only` | -| `coordinating.replicas` | Desired number of Elasticsearch coordinating-only nodes | `2` | -| `coordinating.heapSize` | Coordinating-only node heap size | `128m` | -| `coordinating.antiAffinity` | Coordinating-only node pod anti-affinity policy | `soft` | -| `coordinating.nodeAffinity` | Coordinating-only node affinity policy | `nil` | -| `coordinating.podAnnotations` | Annotations for coordniating pods. | `{}` | -| `coordinating.service.type` | Kubernetes Service type (coordinating-only nodes) | `ClusterIP` | -| `coordinating.service.port` | Kubernetes Service port for REST API (coordinating-only nodes) | `9200` | -| `coordinating.service.nodePort` | Kubernetes Service nodePort (coordinating-only nodes) | `nil` | -| `coordinating.service.annotations` | Annotations for coordinating-only nodes service | {} | -| `coordinating.service.loadBalancerIP` | loadBalancerIP if coordinating-only nodes service type is `LoadBalancer` | `nil` | -| `coordinating.resources` | CPU/Memory resource requests/limits for coordinating-only nodes pods | `requests: { cpu: "25m", memory: "256Mi" }` | -| `coordinating.livenessProbe.enabled` | Enable/disable the liveness probe (coordinating-only nodes pod) | `true` | -| `coordinating.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (coordinating-only nodes pod) | `90` | -| `coordinating.livenessProbe.periodSeconds` | How often to perform the probe (coordinating-only nodes pod) | `10` | -| `coordinating.livenessProbe.timeoutSeconds` | When the probe times out (coordinating-only nodes pod) | `5` | -| `coordinating.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (coordinating-only nodes pod) | `1` | -| `coordinating.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `coordinating.readinessProbe.enabled` | Enable/disable the readiness probe (coordinating-only nodes pod) | `true` | -| `coordinating.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (coordinating-only nodes pod) | `90` | -| `coordinating.readinessProbe.periodSeconds` | How often to perform the probe (coordinating-only nodes pod) | `10` | -| `coordinating.readinessProbe.timeoutSeconds` | When the probe times out (coordinating-only nodes pod) | `5` | -| `coordinating.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (coordinating-only nodes pod) | `1` | -| `coordinating.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `data.name` | Data node pod name | `data` | -| `data.replicas` | Desired number of Elasticsearch data nodes | `3` | -| `data.updateStrategy.type` | Update strategy for Data statefulset | `RollingUpdate` | -| `data.updateStrategy.rollingUpdatePartition` | Partition update strategy for Data statefulset | `nil` | -| `data.heapSize` | Data node heap size | `1024m` | -| `data.antiAffinity` | Data pod anti-affinity policy | `soft` | -| `data.nodeAffinity` | Data pod node affinity policy | `nil` | -| `data.resources` | CPU/Memory resource requests/limits for data nodes | `requests: { cpu: "25m", memory: "1152Mi" }` | -| `data.persistence.enabled` | Enable persistence using a `PersistentVolumeClaim` | `true` | -| `data.persistence.annotations` | Persistent Volume Claim annotations | `{}` | -| `data.persistence.storageClass` | Persistent Volume Storage Class | `` | -| `data.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | -| `data.persistence.size` | Persistent Volume Size | `8Gi` | -| `data.livenessProbe.enabled` | Enable/disable the liveness probe (data nodes pod) | `true` | -| `data.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (data nodes pod) | `90` | -| `data.livenessProbe.periodSeconds` | How often to perform the probe (data nodes pod) | `10` | -| `data.livenessProbe.timeoutSeconds` | When the probe times out (data nodes pod) | `5` | -| `data.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (data nodes pod) | `1` | -| `data.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `data.podAnnotations` | Annotations for data pods. | `{}` | -| `data.readinessProbe.enabled` | Enable/disable the readiness probe (data nodes pod) | `true` | -| `data.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (data nodes pod) | `90` | -| `data.readinessProbe.periodSeconds` | How often to perform the probe (data nodes pod) | `10` | -| `data.readinessProbe.timeoutSeconds` | When the probe times out (data nodes pod) | `5` | -| `data.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (data nodes pod) | `1` | -| `data.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `ingest.enabled` | Enable ingest nodes | `false` | -| `ingest.name` | Ingest node pod name | `ingest` | -| `ingest.replicas` | Desired number of Elasticsearch ingest nodes | `2` | -| `ingest.heapSize` | Ingest node heap size | `128m` | -| `ingest.antiAffinity` | Ingest node pod anti-affinity policy | `soft` | -| `ingest.nodeAffinity` | Ingest node pod affinity policy | `nil` | -| `ingest.service.type` | Kubernetes Service type (ingest nodes) | `ClusterIP` | -| `ingest.service.port` | Kubernetes Service port Elasticsearch transport port (ingest nodes) | `9300` | -| `ingest.service.nodePort` | Kubernetes Service nodePort (ingest nodes) | `nil` | -| `ingest.service.annotations` | Annotations for ingest nodes service | {} | -| `ingest.service.loadBalancerIP` | loadBalancerIP if ingest nodes service type is `LoadBalancer` | `nil` | -| `ingest.resources` | CPU/Memory resource requests/limits for ingest nodes pods | `requests: { cpu: "25m", memory: "256Mi" }` | -| `ingest.livenessProbe.enabled` | Enable/disable the liveness probe (ingest nodes pod) | `true` | -| `ingest.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (ingest nodes pod) | `90` | -| `ingest.livenessProbe.periodSeconds` | How often to perform the probe (ingest nodes pod) | `10` | -| `ingest.livenessProbe.timeoutSeconds` | When the probe times out (ingest nodes pod) | `5` | -| `ingest.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (ingest nodes pod) | `1` | -| `ingest.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `ingest.podAnnotations` | Annotations for ingest pods. | `{}` | -| `ingest.readinessProbe.enabled` | Enable/disable the readiness probe (ingest nodes pod) | `true` | -| `ingest.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (ingest nodes pod) | `90` | -| `ingest.readinessProbe.periodSeconds` | How often to perform the probe (ingest nodes pod) | `10` | -| `ingest.readinessProbe.timeoutSeconds` | When the probe times out (ingest nodes pod) | `5` | -| `ingest.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (ingest nodes pod) | `1` | -| `ingest.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `metrics.enabled` | Enable prometheus exporter | `false` | -| `metrics.name` | Metrics pod name | `metrics` | -| `metrics.image.registry` | Metrics exporter image registry | `docker.io` | -| `metrics.image.repository` | Metrics exporter image repository | `bitnami/elasticsearch-exporter` | -| `metrics.image.tag` | Metrics exporter image tag | `1.0.2` | -| `metrics.image.pullPolicy` | Metrics exporter image pull policy | `IfNotPresent` | -| `metrics.service.type` | Metrics exporter endpoint service type | `ClusterIP` | -| `metrics.resources` | Metrics exporter resource requests/limit | `requests: { cpu: "25m" }` | -| `metrics.podAnnotations` | Annotations for metrics pods. | `{}` | -| `sysctlImage.enabled` | Enable kernel settings modifier image | `false` | -| `sysctlImage.registry` | Kernel settings modifier image registry | `docker.io` | -| `sysctlImage.repository` | Kernel settings modifier image repository | `bitnami/minideb` | -| `sysctlImage.tag` | Kernel settings modifier image tag | `latest` | -| `sysctlImage.pullPolicy` | Kernel settings modifier image pull policy | `Always` | +| Parameter | Description | Default | +| ------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Elasticsearch image registry | `docker.io` | +| `image.repository` | Elasticsearch image repository | `bitnami/elasticsearch` | +| `image.tag` | Elasticsearch image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override elasticsearch.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override elasticsearch.fullname template with a string | `nil` | +| `name` | Elasticsearch cluster name | `elastic` | +| `plugins` | Comma, semi-colon or space separated list of plugins to install at initialization | `nil` | +| `config` | Elasticsearch node custom configuration | `` | +| `master.name` | Master-eligible node pod name | `master` | +| `master.replicas` | Desired number of Elasticsearch master-eligible nodes | `2` | +| `master.heapSize` | Master-eligible node heap size | `128m` | +| `master.antiAffinity` | Master-eligible node pod anti-affinity policy | `soft` | +| `coordinating.nodeAffinity` | Master-eligible node affinity policy | `nil` | +| `master.service.type` | Kubernetes Service type (master-eligible nodes) | `ClusterIP` | +| `master.service.port` | Kubernetes Service port for Elasticsearch transport port (master-eligible nodes) | `9300` | +| `master.service.nodePort` | Kubernetes Service nodePort (master-eligible nodes) | `nil` | +| `master.service.annotations` | Annotations for master-eligible nodes service | {} | +| `master.service.loadBalancerIP` | loadBalancerIP if master-eligible nodes service type is `LoadBalancer` | `nil` | +| `master.resources` | CPU/Memory resource requests/limits for master-eligible nodes pods | `requests: { cpu: "25m", memory: "256Mi" }` | +| `master.livenessProbe.enabled` | Enable/disable the liveness probe (master-eligible nodes pod) | `true` | +| `master.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (master-eligible nodes pod) | `90` | +| `master.livenessProbe.periodSeconds` | How often to perform the probe (master-eligible nodes pod) | `10` | +| `master.livenessProbe.timeoutSeconds` | When the probe times out (master-eligible nodes pod) | `5` | +| `master.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (master-eligible nodes pod) | `1` | +| `master.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `master.podAnnotations` | Annotations for master pods. | `{}` | +| `master.readinessProbe.enabled` | Enable/disable the readiness probe (master-eligible nodes pod) | `true` | +| `master.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (master-eligible nodes pod) | `90` | +| `master.readinessProbe.periodSeconds` | How often to perform the probe (master-eligible nodes pod) | `10` | +| `master.readinessProbe.timeoutSeconds` | When the probe times out (master-eligible nodes pod) | `5` | +| `master.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (master-eligible nodes pod) | `1` | +| `master.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | +| `discovery.name` | Discover node pod name | `discovery` | +| `coordinating.name` | Coordinating-only node pod name | `coordinating-only` | +| `coordinating.replicas` | Desired number of Elasticsearch coordinating-only nodes | `2` | +| `coordinating.heapSize` | Coordinating-only node heap size | `128m` | +| `coordinating.antiAffinity` | Coordinating-only node pod anti-affinity policy | `soft` | +| `coordinating.nodeAffinity` | Coordinating-only node affinity policy | `nil` | +| `coordinating.podAnnotations` | Annotations for coordniating pods. | `{}` | +| `coordinating.service.type` | Kubernetes Service type (coordinating-only nodes) | `ClusterIP` | +| `coordinating.service.port` | Kubernetes Service port for REST API (coordinating-only nodes) | `9200` | +| `coordinating.service.nodePort` | Kubernetes Service nodePort (coordinating-only nodes) | `nil` | +| `coordinating.service.annotations` | Annotations for coordinating-only nodes service | {} | +| `coordinating.service.loadBalancerIP` | loadBalancerIP if coordinating-only nodes service type is `LoadBalancer` | `nil` | +| `coordinating.resources` | CPU/Memory resource requests/limits for coordinating-only nodes pods | `requests: { cpu: "25m", memory: "256Mi" }` | +| `coordinating.livenessProbe.enabled` | Enable/disable the liveness probe (coordinating-only nodes pod) | `true` | +| `coordinating.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (coordinating-only nodes pod) | `90` | +| `coordinating.livenessProbe.periodSeconds` | How often to perform the probe (coordinating-only nodes pod) | `10` | +| `coordinating.livenessProbe.timeoutSeconds` | When the probe times out (coordinating-only nodes pod) | `5` | +| `coordinating.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (coordinating-only nodes pod) | `1` | +| `coordinating.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `coordinating.readinessProbe.enabled` | Enable/disable the readiness probe (coordinating-only nodes pod) | `true` | +| `coordinating.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (coordinating-only nodes pod) | `90` | +| `coordinating.readinessProbe.periodSeconds` | How often to perform the probe (coordinating-only nodes pod) | `10` | +| `coordinating.readinessProbe.timeoutSeconds` | When the probe times out (coordinating-only nodes pod) | `5` | +| `coordinating.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (coordinating-only nodes pod) | `1` | +| `coordinating.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `data.name` | Data node pod name | `data` | +| `data.replicas` | Desired number of Elasticsearch data nodes | `3` | +| `data.updateStrategy.type` | Update strategy for Data statefulset | `RollingUpdate` | +| `data.updateStrategy.rollingUpdatePartition` | Partition update strategy for Data statefulset | `nil` | +| `data.heapSize` | Data node heap size | `1024m` | +| `data.antiAffinity` | Data pod anti-affinity policy | `soft` | +| `data.nodeAffinity` | Data pod node affinity policy | `nil` | +| `data.resources` | CPU/Memory resource requests/limits for data nodes | `requests: { cpu: "25m", memory: "1152Mi" }` | +| `data.persistence.enabled` | Enable persistence using a `PersistentVolumeClaim` | `true` | +| `data.persistence.annotations` | Persistent Volume Claim annotations | `{}` | +| `data.persistence.storageClass` | Persistent Volume Storage Class | `` | +| `data.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | +| `data.persistence.size` | Persistent Volume Size | `8Gi` | +| `data.livenessProbe.enabled` | Enable/disable the liveness probe (data nodes pod) | `true` | +| `data.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (data nodes pod) | `90` | +| `data.livenessProbe.periodSeconds` | How often to perform the probe (data nodes pod) | `10` | +| `data.livenessProbe.timeoutSeconds` | When the probe times out (data nodes pod) | `5` | +| `data.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (data nodes pod) | `1` | +| `data.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `data.podAnnotations` | Annotations for data pods. | `{}` | +| `data.readinessProbe.enabled` | Enable/disable the readiness probe (data nodes pod) | `true` | +| `data.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (data nodes pod) | `90` | +| `data.readinessProbe.periodSeconds` | How often to perform the probe (data nodes pod) | `10` | +| `data.readinessProbe.timeoutSeconds` | When the probe times out (data nodes pod) | `5` | +| `data.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (data nodes pod) | `1` | +| `data.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `ingest.enabled` | Enable ingest nodes | `false` | +| `ingest.name` | Ingest node pod name | `ingest` | +| `ingest.replicas` | Desired number of Elasticsearch ingest nodes | `2` | +| `ingest.heapSize` | Ingest node heap size | `128m` | +| `ingest.antiAffinity` | Ingest node pod anti-affinity policy | `soft` | +| `ingest.nodeAffinity` | Ingest node pod affinity policy | `nil` | +| `ingest.service.type` | Kubernetes Service type (ingest nodes) | `ClusterIP` | +| `ingest.service.port` | Kubernetes Service port Elasticsearch transport port (ingest nodes) | `9300` | +| `ingest.service.nodePort` | Kubernetes Service nodePort (ingest nodes) | `nil` | +| `ingest.service.annotations` | Annotations for ingest nodes service | {} | +| `ingest.service.loadBalancerIP` | loadBalancerIP if ingest nodes service type is `LoadBalancer` | `nil` | +| `ingest.resources` | CPU/Memory resource requests/limits for ingest nodes pods | `requests: { cpu: "25m", memory: "256Mi" }` | +| `ingest.livenessProbe.enabled` | Enable/disable the liveness probe (ingest nodes pod) | `true` | +| `ingest.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (ingest nodes pod) | `90` | +| `ingest.livenessProbe.periodSeconds` | How often to perform the probe (ingest nodes pod) | `10` | +| `ingest.livenessProbe.timeoutSeconds` | When the probe times out (ingest nodes pod) | `5` | +| `ingest.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (ingest nodes pod) | `1` | +| `ingest.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `ingest.podAnnotations` | Annotations for ingest pods. | `{}` | +| `ingest.readinessProbe.enabled` | Enable/disable the readiness probe (ingest nodes pod) | `true` | +| `ingest.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (ingest nodes pod) | `90` | +| `ingest.readinessProbe.periodSeconds` | How often to perform the probe (ingest nodes pod) | `10` | +| `ingest.readinessProbe.timeoutSeconds` | When the probe times out (ingest nodes pod) | `5` | +| `ingest.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (ingest nodes pod) | `1` | +| `ingest.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `metrics.enabled` | Enable prometheus exporter | `false` | +| `metrics.name` | Metrics pod name | `metrics` | +| `metrics.image.registry` | Metrics exporter image registry | `docker.io` | +| `metrics.image.repository` | Metrics exporter image repository | `bitnami/elasticsearch-exporter` | +| `metrics.image.tag` | Metrics exporter image tag | `1.0.2` | +| `metrics.image.pullPolicy` | Metrics exporter image pull policy | `IfNotPresent` | +| `metrics.service.type` | Metrics exporter endpoint service type | `ClusterIP` | +| `metrics.resources` | Metrics exporter resource requests/limit | `requests: { cpu: "25m" }` | +| `metrics.podAnnotations` | Annotations for metrics pods. | `{}` | +| `sysctlImage.enabled` | Enable kernel settings modifier image | `false` | +| `sysctlImage.registry` | Kernel settings modifier image registry | `docker.io` | +| `sysctlImage.repository` | Kernel settings modifier image repository | `bitnami/minideb` | +| `sysctlImage.tag` | Kernel settings modifier image tag | `latest` | +| `sysctlImage.pullPolicy` | Kernel settings modifier image pull policy | `Always` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -370,6 +378,15 @@ The [Bitnami Elasticsearch](https://github.com/bitnami/bitnami-docker-elasticsea By default, the chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning. See the [Configuration](#configuration) section to configure the PVC. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Troubleshooting Currently, Elasticsearch requires some changes in the kernel of the host machine to work as expected. If those values are not set in the underlying operating system, the ES containers fail to boot with ERROR messages. More information about these requirements can be found in the links below: diff --git a/bitnami/elasticsearch/templates/_helpers.tpl b/bitnami/elasticsearch/templates/_helpers.tpl index 1130b4eb3..0eb89e600 100644 --- a/bitnami/elasticsearch/templates/_helpers.tpl +++ b/bitnami/elasticsearch/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "elasticsearch.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. @@ -160,7 +168,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -171,8 +179,11 @@ imagePullSecrets: {{- range .Values.sysctlImage.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -183,5 +194,31 @@ imagePullSecrets: {{- range .Values.sysctlImage.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "elasticsearch.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/bitnami/elasticsearch/templates/data-statefulset.yaml b/bitnami/elasticsearch/templates/data-statefulset.yaml index 0ff44529e..edda4b128 100644 --- a/bitnami/elasticsearch/templates/data-statefulset.yaml +++ b/bitnami/elasticsearch/templates/data-statefulset.yaml @@ -66,9 +66,9 @@ spec: {{- if .Values.data.nodeAffinity }} {{ toYaml .Values.data.nodeAffinity | indent 8 }} {{- end }} + initContainers: {{- if .Values.sysctlImage.enabled }} ## Image that performs the sysctl operation to modify Kernel settings (needed sometimes to avoid boot errors) - initContainers: - name: sysctl image: {{ template "elasticsearch.sysctl.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy | quote }} @@ -76,6 +76,18 @@ spec: securityContext: privileged: true {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.data.persistence.enabled }} + - name: volume-permissions + image: "{{ template "elasticsearch.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/elasticsearch/data"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: "/bitnami/elasticsearch/data" + {{- end }} containers: - name: "elasticsearch" image: {{ template "elasticsearch.image" . }} diff --git a/bitnami/elasticsearch/values-production.yaml b/bitnami/elasticsearch/values-production.yaml index df5d80ab3..50b297581 100644 --- a/bitnami/elasticsearch/values-production.yaml +++ b/bitnami/elasticsearch/values-production.yaml @@ -45,6 +45,32 @@ sysctlImage: # pullSecrets: # - myRegistryKeySecretName +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + +## String to partially override elasticsearch.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override elasticsearch.fullname template +## +# fullnameOverride: + ## Elasticsearch cluster name ## name: elastic diff --git a/bitnami/elasticsearch/values.yaml b/bitnami/elasticsearch/values.yaml index 8667392f9..d08ee8c58 100644 --- a/bitnami/elasticsearch/values.yaml +++ b/bitnami/elasticsearch/values.yaml @@ -45,6 +45,32 @@ sysctlImage: # pullSecrets: # - myRegistryKeySecretName +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + +## String to partially override elasticsearch.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override elasticsearch.fullname template +## +# fullnameOverride: + ## Elasticsearch cluster name ## name: elastic diff --git a/bitnami/etcd/Chart.yaml b/bitnami/etcd/Chart.yaml index 322371994..a30ec168a 100644 --- a/bitnami/etcd/Chart.yaml +++ b/bitnami/etcd/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: etcd -version: 3.1.1 +version: 4.1.0 appVersion: 3.3.13 description: etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines keywords: diff --git a/bitnami/etcd/README.md b/bitnami/etcd/README.md index 006775b76..6f736fd17 100644 --- a/bitnami/etcd/README.md +++ b/bitnami/etcd/README.md @@ -45,84 +45,90 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the etcd chart and their default values. -| Parameter | Description | Default | -| ----------------------------------------- | ------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | etcd image registry | `docker.io` | -| `image.repository` | etcd image name | `bitnami/etcd` | -| `image.tag` | etcd image tag | `{TAG_NAME}` | -| `image.pullPolicy` | etcd image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.debug` | Specify if debug values should be set | `false` | -| `nameOverride` | String to partially override etcd.fullname template with a string (will prepend the release name) | `nil` | -| `fullnameOverride` | String to fully override etcd.fullname template with a string | `nil` | -| `statefulset.updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | -| `statefulset.rollingUpdatePartition` | Partition for Rolling Update strategy | `nil` | -| `statefulset.podManagementPolicy` | Pod management policy for the stateful set | `OrderedReady` | -| `statefulset.replicaCount` | Number of etcd nodes | `1` | -| `configFileConfigMap` | ConfigMap that contains a etcd.conf.yaml to be mounted | `nil` | -| `envVarsConfigMap` | ConfigMap that contains environment variables to be set in the container | `nil` | -| `allowNoneAuthentication` | Allow to use etcd without configuring RBAC authentication | `true` | -| `maxProcs` | Set GOMAXPROCS environment variable to limit the number of CPUs | `nil` | -| `auth.rbac.enabled` | Switch to enable the etcd authentication. | `true` | -| `auth.rbac.rootPassword` | Password for the root user | `nil` | -| `auth.rbac.existingSecret` | Name of the existing secret containing the root password | `nil` | -| `auth.client.secureTransport` | Switch to encrypt client communication using TLS certificates | `false` | -| `auth.client.useAutoTLS` | Switch to automatically create the TLS certificates | `false` | -| `auth.client.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret. | `secret` | -| `auth.client.existingSecret` | Name of the existing secret containing cert files for client communication. | `nil` | -| `auth.peer.secureTransport` | Switch to encrypt peer communication using TLS certificates | `false` | -| `auth.peer.useAutoTLS` | Switch to automatically create the TLS certificates | `false` | -| `auth.peer.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret. | `false` | -| `auth.peer.existingSecret` | Name of the existing secret containing cert files for peer communication. | `nil` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `service.dnsBase` | Kubernetes service cluster dns base name | `svc.cluster.local` | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.port` | etcd client port | `2379` | -| `service.nodePort` | Port to bind to for NodePort service type (client port) | `nil` | -| `service.peerPort` | etcd peer port | `2380` | -| `service.peerNodePort` | Port to bind to for NodePort service type (peer port) | `nil` | -| `service.annotations` | Annotations for etcd service | `{}` | -| `service.loadBalancerIP` | loadBalancerIP if etcd service type is `LoadBalancer` | `nil` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for etcd volume | `nil` | -| `persistence.accessMode` | PVC Access Mode for etcd volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for etcd volume | `8Gi` | -| `persistence.annotations` | Annotations for the PVC | `{}` | -| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | -| `livenessProbe.enabled` | Turn on and off liveness probe | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `10` | -| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | -| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `2` | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | -| `readinessProbe.enabled` | Turn on and off readiness probe | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `15` | -| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | -| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | -| `podAnnotations` | Annotations to be added to pods | `{}` | -| `nodeAffinity` | Node Affinity rules for pod assignment. The value is evaluated as a template. | `{}` | -| `podAffinity` | Affinity rules for pod assignment. The value is evaluated as a template. | `{}` | -| `podAntiAffinity` | Anti-Affinity rules for pod assignment. Allowed values: `soft` and `hard` | `soft` | -| `nodeSelector` | Node labels for pod assignment. The value is evaluated as a template. | `{}` | -| `tolerations` | Tolerations for pod assignment. The value is evaluated as a template. | `{}` | -| `metrics.enabled` | Enable Prometheus exporter to expose etcd metrics | `false` | -| `metrics.podAnnotations` | Annotations for enabling prometheus to access the metrics endpoint | {`prometheus.io/scrape: "true",prometheus.io/port: "2379"`} | -| `startFromSnapshot.enabled` | Initialize new cluster recovering an existing snapshot | `false` | -| `startFromSnapshot.existingClaim` | PVC containing the existing snapshot | `nil` | -| `startFromSnapshot.snapshotFilename` | Snapshot filename | `nil` | -| `disasterRecovery.enabled` | Enable auto disaster recovery by periodically snapshotting the keyspace | `false` | -| `disasterRecovery.cronjob.schedule` | Schedule in Cron format to save snapshots | `*/30 * * * *` | -| `disasterRecovery.cronjob.historyLimit` | Number of successful finished jobs to retain | `1` | -| `disasterRecovery.cronjob.podAnnotations` | Pod annotations for cronjob pods | `{}` | -| `disasterRecovery.pvc.existingClaim` | Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. | `nil` | -| `disasterRecovery.pvc.size` | PVC Storage Request | `2Gi` | -| `disasterRecovery.pvc.storageClassName` | Storage Class for snapshots volume | `nfs` | +| Parameter | Description | Default | +| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | etcd image registry | `docker.io` | +| `image.repository` | etcd image name | `bitnami/etcd` | +| `image.tag` | etcd image tag | `{TAG_NAME}` | +| `image.pullPolicy` | etcd image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug values should be set | `false` | +| `nameOverride` | String to partially override etcd.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override etcd.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `statefulset.updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | +| `statefulset.rollingUpdatePartition` | Partition for Rolling Update strategy | `nil` | +| `statefulset.podManagementPolicy` | Pod management policy for the stateful set | `OrderedReady` | +| `statefulset.replicaCount` | Number of etcd nodes | `1` | +| `configFileConfigMap` | ConfigMap that contains a etcd.conf.yaml to be mounted | `nil` | +| `envVarsConfigMap` | ConfigMap that contains environment variables to be set in the container | `nil` | +| `allowNoneAuthentication` | Allow to use etcd without configuring RBAC authentication | `true` | +| `maxProcs` | Set GOMAXPROCS environment variable to limit the number of CPUs | `nil` | +| `auth.rbac.enabled` | Switch to enable the etcd authentication. | `true` | +| `auth.rbac.rootPassword` | Password for the root user | `nil` | +| `auth.rbac.existingSecret` | Name of the existing secret containing the root password | `nil` | +| `auth.client.secureTransport` | Switch to encrypt client communication using TLS certificates | `false` | +| `auth.client.useAutoTLS` | Switch to automatically create the TLS certificates | `false` | +| `auth.client.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret. | `secret` | +| `auth.client.existingSecret` | Name of the existing secret containing cert files for client communication. | `nil` | +| `auth.peer.secureTransport` | Switch to encrypt peer communication using TLS certificates | `false` | +| `auth.peer.useAutoTLS` | Switch to automatically create the TLS certificates | `false` | +| `auth.peer.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret. | `false` | +| `auth.peer.existingSecret` | Name of the existing secret containing cert files for peer communication. | `nil` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `service.dnsBase` | Kubernetes service cluster dns base name | `svc.cluster.local` | +| `service.type` | Kubernetes Service type | `ClusterIP` | +| `service.port` | etcd client port | `2379` | +| `service.nodePort` | Port to bind to for NodePort service type (client port) | `nil` | +| `service.peerPort` | etcd peer port | `2380` | +| `service.peerNodePort` | Port to bind to for NodePort service type (peer port) | `nil` | +| `service.annotations` | Annotations for etcd service | `{}` | +| `service.loadBalancerIP` | loadBalancerIP if etcd service type is `LoadBalancer` | `nil` | +| `persistence.enabled` | Enable persistence using PVC | `true` | +| `persistence.storageClass` | PVC Storage Class for etcd volume | `nil` | +| `persistence.accessMode` | PVC Access Mode for etcd volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for etcd volume | `8Gi` | +| `persistence.annotations` | Annotations for the PVC | `{}` | +| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | +| `livenessProbe.enabled` | Turn on and off liveness probe | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `10` | +| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | +| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `2` | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | +| `readinessProbe.enabled` | Turn on and off readiness probe | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `15` | +| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | +| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | `1` | +| `podAnnotations` | Annotations to be added to pods | `{}` | +| `nodeAffinity` | Node Affinity rules for pod assignment. The value is evaluated as a template. | `{}` | +| `podAffinity` | Affinity rules for pod assignment. The value is evaluated as a template. | `{}` | +| `podAntiAffinity` | Anti-Affinity rules for pod assignment. Allowed values: `soft` and `hard` | `soft` | +| `nodeSelector` | Node labels for pod assignment. The value is evaluated as a template. | `{}` | +| `tolerations` | Tolerations for pod assignment. The value is evaluated as a template. | `{}` | +| `metrics.enabled` | Enable Prometheus exporter to expose etcd metrics | `false` | +| `metrics.podAnnotations` | Annotations for enabling prometheus to access the metrics endpoint | {`prometheus.io/scrape: "true",prometheus.io/port: "2379"`} | +| `startFromSnapshot.enabled` | Initialize new cluster recovering an existing snapshot | `false` | +| `startFromSnapshot.existingClaim` | PVC containing the existing snapshot | `nil` | +| `startFromSnapshot.snapshotFilename` | Snapshot filename | `nil` | +| `disasterRecovery.enabled` | Enable auto disaster recovery by periodically snapshotting the keyspace | `false` | +| `disasterRecovery.cronjob.schedule` | Schedule in Cron format to save snapshots | `*/30 * * * *` | +| `disasterRecovery.cronjob.historyLimit` | Number of successful finished jobs to retain | `1` | +| `disasterRecovery.cronjob.podAnnotations` | Pod annotations for cronjob pods | `{}` | +| `disasterRecovery.pvc.existingClaim` | Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. | `nil` | +| `disasterRecovery.pvc.size` | PVC Storage Request | `2Gi` | +| `disasterRecovery.pvc.storageClassName` | Storage Class for snapshots volume | `nfs` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -296,6 +302,15 @@ $ helm install --name my-release bitnami/etcd \ --set persistence.size=8Gi ``` +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ### Disaster recovery You can enable auto disaster recovery by periodically snapshotting the keyspace. If the cluster permanently loses more than (N-1)/2 members, it tries to recover the cluster from a previous snapshot. diff --git a/bitnami/etcd/templates/_helpers.tpl b/bitnami/etcd/templates/_helpers.tpl index 4382239e4..c68031b52 100644 --- a/bitnami/etcd/templates/_helpers.tpl +++ b/bitnami/etcd/templates/_helpers.tpl @@ -3,7 +3,7 @@ Expand the name of the chart. */}} {{- define "etcd.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* @@ -146,17 +146,23 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if .Values.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if .Values.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} {{- end -}} @@ -212,3 +218,26 @@ etcd: mode "hard". Please set a valid mode (--set podAntiAffinity="xxxx") {{- end -}} {{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "etcd.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/etcd/templates/scripts-configmap.yaml b/bitnami/etcd/templates/scripts-configmap.yaml index 186c4339d..64a6724a5 100644 --- a/bitnami/etcd/templates/scripts-configmap.yaml +++ b/bitnami/etcd/templates/scripts-configmap.yaml @@ -94,7 +94,7 @@ data: ## Check wether the member was succesfully removed from the cluster should_add_new_member() { return_value=0 - if (grep -E "^Member [a-z0-9]+ removed from cluster [a-z0-9]+$" "$(dirname "$ETCD_DATA_DIR")/member_removal.log" > /dev/null) || \ + if (grep -E "^Member[[:space:]]+[a-z0-9]+ removed from cluster [a-z0-9]+$" "$(dirname "$ETCD_DATA_DIR")/member_removal.log" > /dev/null) || \ ! ([[ -d "$ETCD_DATA_DIR/member/snap" ]] && [[ -f "$ETCD_DATA_DIR/member_id" ]]); then rm -rf $ETCD_DATA_DIR/* else @@ -193,9 +193,6 @@ data: # Constants AUTH_OPTIONS="{{ $etcdAuthOptions }}" - ETCDCTL_ENDPOINTS="{{range $i, $e := until $replicaCount }}{{ $etcdClientProtocol }}://{{ $etcdFullname }}-{{ $e }}.{{ $etcdHeadlessServiceName }}.{{ $releaseNamespace }}.{{ $dnsBase }}:{{ $clientPort }},{{ end }}" - # Remove the last comma "," introduced in the string - export ETCDCTL_ENDPOINTS="$(sed 's/,/ /g' <<< $ETCDCTL_ENDPOINTS | awk '{$1=$1};1' | sed 's/ /,/g')" etcdctl $AUTH_OPTIONS endpoint health >/dev/null 2>&1 {{- if .Values.disasterRecovery.enabled }} diff --git a/bitnami/etcd/templates/statefulset.yaml b/bitnami/etcd/templates/statefulset.yaml index dbff2b517..302328f55 100644 --- a/bitnami/etcd/templates/statefulset.yaml +++ b/bitnami/etcd/templates/statefulset.yaml @@ -79,6 +79,19 @@ spec: {{- with .Values.tolerations }} tolerations: {{ tpl (toYaml .) $ | nindent 8 }} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "etcd.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/etcd"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: "/bitnami/etcd" + {{- end }} containers: # Variables to populate static cluster {{- $replicaCount := int .Values.statefulset.replicaCount }} diff --git a/bitnami/etcd/values-production.yaml b/bitnami/etcd/values-production.yaml index dbd6a75ac..21c977349 100644 --- a/bitnami/etcd/values-production.yaml +++ b/bitnami/etcd/values-production.yaml @@ -31,11 +31,39 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false - ## String to partially override etcd.fullname template (will maintain the release name) - # nameOverride: +## String to partially override etcd.fullname template (will maintain the release name) +## +# nameOverride: - ## String to fully override etcd.fullname template - # fullnameOverride: +## String to fully override etcd.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + +## String to partially override etcd.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override etcd.fullname template +## +# fullnameOverride: statefulset: ## Update strategy, can be set to RollingUpdate or OnDelete by default. @@ -49,7 +77,7 @@ statefulset: ## Pod management policy ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies ## - podManagementPolicy: OrderedReady + podManagementPolicy: Parallel ## Number od replicas ## replicaCount: 3 diff --git a/bitnami/etcd/values.yaml b/bitnami/etcd/values.yaml index b96563492..04dfa0a36 100644 --- a/bitnami/etcd/values.yaml +++ b/bitnami/etcd/values.yaml @@ -31,11 +31,31 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false - ## String to partially override etcd.fullname template (will maintain the release name) - # nameOverride: +## String to partially override etcd.fullname template (will maintain the release name) +## +# nameOverride: - ## String to fully override etcd.fullname template - # fullnameOverride: +## String to fully override etcd.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} statefulset: ## Update strategy, can be set to RollingUpdate or OnDelete by default. @@ -49,7 +69,7 @@ statefulset: ## Pod management policy ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies ## - podManagementPolicy: OrderedReady + podManagementPolicy: Parallel ## Number od replicas ## replicaCount: 1 diff --git a/bitnami/harbor/Chart.yaml b/bitnami/harbor/Chart.yaml index 2e6018d96..27c6d2ed3 100644 --- a/bitnami/harbor/Chart.yaml +++ b/bitnami/harbor/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: harbor -version: 0.0.5 +version: 2.1.1 appVersion: 1.8.1 description: Harbor is an an open source trusted cloud native registry project that stores, signs, and scans content keywords: diff --git a/bitnami/harbor/README.md b/bitnami/harbor/README.md index 3b0867a25..84ec7f918 100644 --- a/bitnami/harbor/README.md +++ b/bitnami/harbor/README.md @@ -100,6 +100,15 @@ If Harbor is deployed behind the proxy, set it as the URL of proxy. Secrets and certificates must be setup to avoid changes on every Helm upgrade (see: [#107](https://github.com/goharbor/harbor-helm/issues/107)). +### Adjust permissions of persistent volume mountpoint + +As the images run as non-root by default, it is necessary to adjust the ownership of the persistent volumes so that the containers can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ### Configure the deployment options: The following table lists the configurable parameters of the Harbor chart and the default values. They can be configured in `values.yaml` or set via `--set` flag during installation. @@ -109,7 +118,7 @@ The following table lists the configurable parameters of the Harbor chart and th | **Expose** | | `service.type` | The way how to expose the service: `Ingress`, `ClusterIP`, `NodePort` or `LoadBalancer` | `ingress` | | `service.tls.enabled` | Enable the tls or not | `true` | -| `service.ingress.controller` | The ingress controller type. Currently supports `default` and `gce` | `default` | +| `service.ingress.controller` | The ingress controller type. Currently supports `default`, `gce` and `ncp` | `default` | | `service.tls.secretName` | Fill the name of secret if you want to use your own TLS certificate and private key. The secret must contain two keys named `tls.crt` and `tls.key` that contain the certificate and private key to use for TLS. Will be generated automatically if not set | `nil` | | `service.tls.notarySecretName` | By default, the Notary service will use the same cert and key as described above. Fill the name of secret if you want to use a separated one. Only needed when the `service.type` is `ingress`. | `nil` | | `service.tls.commonName` | The common name used to generate the certificate, it's necessary when the `service.type` is `ClusterIP` or `NodePort` and `service.tls.secretName` is null | `nil` | @@ -131,6 +140,8 @@ The following table lists the configurable parameters of the Harbor chart and th | `service.loadBalancer.ports.httpPort` | The service port Harbor listens on when serving with HTTP | `80` | | `service.loadBalancer.ports.httpsPort` | The service port Harbor listens on when serving with HTTP | `30002` | | `service.loadBalancer.ports.notaryPort` | The service port Notary listens on. Only needed when `notary.enabled` is set to `true` | `nil` | +| `service.loadBalancer.annotations` | The annotations attached to the loadBalancer service | {} | +| `service.loadBalancer.sourceRanges` | List of IP address ranges to assign to loadBalancerSourceRanges | [] | | **Persistence** | | `persistence.enabled` | Enable the data persistence or not | `true` | | `persistence.resourcePolicy` | Setting it to `keep` to avoid removing PVCs during a helm delete operation. Leaving it empty will delete PVCs after the chart deleted | `keep` | @@ -147,11 +158,19 @@ The following table lists the configurable parameters of the Harbor chart and th | `persistence.imageChartStorage.disableredirect` | The configuration for managing redirects from content backends. For backends which do not supported it (such as using minio for `s3` storage type), please set it to `true` to disable redirects. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#redirect) for more information about the detail | `false` | | `persistence.imageChartStorage.type` | The type of storage for images and charts: `filesystem`, `azure`, `gcs`, `s3`, `swift` or `oss`. The type must be `filesystem` if you want to use persistent volumes for registry and chartmuseum. Refer to the [guide](https://github.com/docker/distribution/blob/master/docs/configuration.md#storage) for more information about the detail | `filesystem` | | **General** | +| `nameOverride` | String to partially override harbor.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override harbor.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | | `externalURL` | The external URL for Harbor core service | `https://core.harbor.domain` | | `imagePullPolicy` | The image pull policy | `IfNotPresent` | | `logLevel` | The log level | `debug` | | `forcePassword` | Option to ensure all passwords and keys are set by the user | `false` | -| `harborAdminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | `Harbor12345` | +| `harborAdminPassword` | The initial password of Harbor admin. Change it from portal after launching Harbor | _random 10 character long alphanumeric string_ | | `secretkey` | The key used for encryption. Must be a string of 16 chars | `not-a-secure-key` | | **Nginx** (if expose the service via `ingress`, the Nginx will not be used) | | `nginxImage.registry` | Registry for Nginx image | `docker.io` | @@ -344,4 +363,40 @@ This chart includes a `values-production.yaml` file where you can find some para It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. -Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. \ No newline at end of file +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +## Upgrade + +## 2.0.0 + +In this version, two major changes were performed: + +- This **chart depends on the Redis 5 chart instead of Redis 4**. There is a breaking change that will affect releases with `metrics.enabled: true`, since the default tag for the exporter image is now `v1.x.x`. This introduces many changes including metrics names. You'll want to use [this dashboard](https://github.com/oliver006/redis_exporter/blob/master/contrib/grafana_prometheus_redis_dashboard.json) now. Please see the [redis_exporter github page](https://github.com/oliver006/redis_exporter#upgrading-from-0x-to-1x) for more details. +- This **chart depends on the PostgreSQL 11 chart instead of PostgreSQL 10**. You can find the main difference and notable changes in the following links: [https://www.postgresql.org/about/news/1894/](https://www.postgresql.org/about/news/1894/) and [https://www.postgresql.org/about/featurematrix/](https://www.postgresql.org/about/featurematrix/). + +For major releases of PostgreSQL, the internal data storage format is subject to change, thus complicating upgrades, you can see some errors like the following one in the logs: + +```bash +Welcome to the Bitnami postgresql container +Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-postgresql +Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-postgresql/issues +Send us your feedback at containers@bitnami.com + +INFO ==> ** Starting PostgreSQL setup ** +NFO ==> Validating settings in POSTGRESQL_* env vars.. +INFO ==> Initializing PostgreSQL database... +INFO ==> postgresql.conf file not detected. Generating it... +INFO ==> pg_hba.conf file not detected. Generating it... +INFO ==> Deploying PostgreSQL with persisted data... +INFO ==> Configuring replication parameters +INFO ==> Loading custom scripts... +INFO ==> Enabling remote connections +INFO ==> Stopping PostgreSQL... +INFO ==> ** PostgreSQL setup finished! ** + +INFO ==> ** Starting PostgreSQL ** + [1] FATAL: database files are incompatible with server + [1] DETAIL: The data directory was initialized by PostgreSQL version 10, which is not compatible with this version 11.3. +``` + +In this case, you should migrate the data from the old PostgreSQL chart to the new one following an approach similar to that described in [this section](https://www.postgresql.org/docs/current/upgrading.html#UPGRADING-VIA-PGDUMPALL) from the official documentation. Basically, create a database dump in the old chart, move and restore it in the new one. diff --git a/bitnami/harbor/requirements.lock b/bitnami/harbor/requirements.lock index c5f582600..9deb15b34 100644 --- a/bitnami/harbor/requirements.lock +++ b/bitnami/harbor/requirements.lock @@ -1,9 +1,9 @@ dependencies: - name: postgresql repository: https://charts.bitnami.com/bitnami - version: 4.2.2 + version: 6.0.0 - name: redis repository: https://charts.bitnami.com/bitnami - version: 7.1.1 -digest: sha256:df803216464c2e9422e4a97214aad873cc91214543ab8eb399da8005db862a95 -generated: 2019-05-28T18:02:33.507059362+02:00 + version: 8.1.5 +digest: sha256:ede675b32be35e162fd579435285659a802d0dbf0c79827200cbc621f7414e64 +generated: "2019-07-23T13:39:31.954606+02:00" diff --git a/bitnami/harbor/requirements.yaml b/bitnami/harbor/requirements.yaml index 33999c441..50cbf6b7d 100644 --- a/bitnami/harbor/requirements.yaml +++ b/bitnami/harbor/requirements.yaml @@ -1,9 +1,9 @@ dependencies: - name: postgresql - version: 4.x.x + version: 6.x.x repository: https://charts.bitnami.com/bitnami condition: postgresql.enabled - name: redis - version: 7.x.x + version: 8.x.x repository: https://charts.bitnami.com/bitnami condition: redis.enabled diff --git a/bitnami/harbor/templates/_helpers.tpl b/bitnami/harbor/templates/_helpers.tpl index cdf4d1b01..c5a8693b9 100644 --- a/bitnami/harbor/templates/_helpers.tpl +++ b/bitnami/harbor/templates/_helpers.tpl @@ -19,9 +19,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "harbor.fullname" -}} -{{- $name := default "harbor" .Values.nameOverride -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Helm required labels */}} {{- define "harbor.labels" -}} @@ -534,7 +542,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.harbor.coreImage.pullSecrets .Values.portalImage.pullSecrets .Values.jobserviceImage.pullSecrets .Values.registryImage.pullSecrets .Values.registryctlImage.pullSecrets .Values.nginxImage.pullSecrets}} +{{- else if or .Values.harbor.coreImage.pullSecrets .Values.portalImage.pullSecrets .Values.jobserviceImage.pullSecrets .Values.registryImage.pullSecrets .Values.registryctlImage.pullSecrets .Values.nginxImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.harbor.coreImage.pullSecrets }} - name: {{ . }} @@ -554,8 +562,11 @@ imagePullSecrets: {{- range .Values.nginxImage.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.harbor.coreImage.pullSecrets .Values.portalImage.pullSecrets .Values.jobserviceImage.pullSecrets .Values.registryImage.pullSecrets .Values.registryctlImage.pullSecrets .Values.nginxImage.pullSecrets}} +{{- else if or .Values.harbor.coreImage.pullSecrets .Values.portalImage.pullSecrets .Values.jobserviceImage.pullSecrets .Values.registryImage.pullSecrets .Values.registryctlImage.pullSecrets .Values.nginxImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.harbor.coreImage.pullSecrets }} - name: {{ . }} @@ -575,6 +586,9 @@ imagePullSecrets: {{- range .Values.nginxImage.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} {{- end -}} @@ -636,3 +650,26 @@ harbor: External PostgreSQL password {{- end -}} {{- end -}} {{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "harbor.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/harbor/templates/ingress/ingress.yaml b/bitnami/harbor/templates/ingress/ingress.yaml index 0117083f9..bb05c2147 100644 --- a/bitnami/harbor/templates/ingress/ingress.yaml +++ b/bitnami/harbor/templates/ingress/ingress.yaml @@ -1,6 +1,28 @@ {{- if eq .Values.service.type "Ingress" }} {{- $ingress := .Values.service.ingress -}} {{- $tls := .Values.service.tls -}} +{{- if eq .Values.service.ingress.controller "gce" }} + {{- $_ := set . "portal_path" "/*" -}} + {{- $_ := set . "api_path" "/api/*" -}} + {{- $_ := set . "service_path" "/service/*" -}} + {{- $_ := set . "v2_path" "/v2/*" -}} + {{- $_ := set . "chartrepo_path" "/chartrepo/*" -}} + {{- $_ := set . "controller_path" "/c/*" -}} +{{- else if eq .Values.service.ingress.controller "ncp" }} + {{- $_ := set . "portal_path" "/" -}} + {{- $_ := set . "api_path" "/api/.*" -}} + {{- $_ := set . "service_path" "/service/.*" -}} + {{- $_ := set . "v2_path" "/v2/.*" -}} + {{- $_ := set . "chartrepo_path" "/chartrepo/.*" -}} + {{- $_ := set . "controller_path" "/c/.*" -}} +{{- else }} + {{- $_ := set . "portal_path" "/" -}} + {{- $_ := set . "api_path" "/api/" -}} + {{- $_ := set . "service_path" "/service/" -}} + {{- $_ := set . "v2_path" "/v2/" -}} + {{- $_ := set . "chartrepo_path" "/chartrepo/" -}} + {{- $_ := set . "controller_path" "/c/" -}} +{{- end }} apiVersion: extensions/v1beta1 kind: Ingress metadata: @@ -34,73 +56,35 @@ spec: {{- end }} {{- end }} {{- end }} -{{- if eq .Values.service.ingress.controller "gce" }} - rules: - - http: - paths: - - path: /* - backend: - serviceName: "{{ template "harbor.portal" . }}" - servicePort: http - - path: /api/* - backend: - serviceName: "{{ template "harbor.core" . }}" - servicePort: http - - path: /service/* - backend: - serviceName: "{{ template "harbor.core" . }}" - servicePort: http - - path: /v2/* - backend: - serviceName: "{{ template "harbor.core" . }}" - servicePort: http - - path: /chartrepo/* - backend: - serviceName: "{{ template "harbor.core" . }}" - servicePort: http - - path: /c/* - backend: - serviceName: "{{ template "harbor.core" . }}" - servicePort: http - {{- if $ingress.hosts.core }} - host: {{ $ingress.hosts.core }} - {{- end }} - {{- if .Values.notary.enabled }} - - http: - paths: - - path: / - backend: - serviceName: "{{ template "harbor.notary-server" . }}" - servicePort: notary-server - {{- if $ingress.hosts.notary }} - host: {{ $ingress.hosts.notary }} - {{- end }} + {{- if eq .Values.service.ingress.controller "ncp" }} + backend: + serviceName: "{{ template "harbor.portal" . }}" + servicePort: http {{- end }} -{{- else }} rules: - http: paths: - - path: / + - path: {{ .portal_path }} backend: serviceName: "{{ template "harbor.portal" . }}" servicePort: http - - path: /api/ + - path: {{ .api_path }} backend: serviceName: "{{ template "harbor.core" . }}" servicePort: http - - path: /service/ + - path: {{ .service_path }} backend: serviceName: "{{ template "harbor.core" . }}" servicePort: http - - path: /v2/ + - path: {{ .v2_path }} backend: serviceName: "{{ template "harbor.core" . }}" servicePort: http - - path: /chartrepo/ + - path: {{ .chartrepo_path }} backend: serviceName: "{{ template "harbor.core" . }}" servicePort: http - - path: /c/ + - path: {{ .controller_path }} backend: serviceName: "{{ template "harbor.core" . }}" servicePort: http @@ -119,4 +103,3 @@ spec: {{- end }} {{- end }} {{- end }} -{{- end }} \ No newline at end of file diff --git a/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml b/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml index 677ba2110..6b9d336e0 100644 --- a/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml +++ b/bitnami/harbor/templates/jobservice/jobservice-dpl.yaml @@ -28,6 +28,20 @@ spec: fsGroup: {{ .Values.securityContext.fsGroup }} runAsUser: {{ .Values.securityContext.runAsUser }} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "harbor.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/var/log/jobs"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: job-logs + mountPath: /var/log/jobs + subPath: {{ .Values.persistence.persistentVolumeClaim.jobservice.subPath }} + {{- end }} containers: - name: jobservice image: "{{ template "harbor.jobserviceImage" . }}" diff --git a/bitnami/harbor/templates/nginx/deployment.yaml b/bitnami/harbor/templates/nginx/deployment.yaml index e9dcd9cd1..24a63d6e6 100644 --- a/bitnami/harbor/templates/nginx/deployment.yaml +++ b/bitnami/harbor/templates/nginx/deployment.yaml @@ -7,7 +7,7 @@ metadata: {{- include "harbor.labels" . | nindent 4 }} app.kubernetes.io/component: nginx spec: - replicas: 1 + replicas: {{ .Values.nginx.replicas }} selector: matchLabels: {{ include "harbor.matchLabels" . | nindent 6 }} app.kubernetes.io/component: nginx @@ -109,4 +109,4 @@ spec: {{- with .Values.nginx.tolerations }} tolerations: {{ tpl (toYaml .) $ | nindent 8 }} {{- end }} - {{- end }} \ No newline at end of file + {{- end }} diff --git a/bitnami/harbor/templates/nginx/service.yaml b/bitnami/harbor/templates/nginx/service.yaml index 5708d6547..a5a7605fa 100644 --- a/bitnami/harbor/templates/nginx/service.yaml +++ b/bitnami/harbor/templates/nginx/service.yaml @@ -55,8 +55,16 @@ spec: {{- $loadBalancer := .Values.service.loadBalancer }} name: {{ $loadBalancer.name }} labels: {{ include "harbor.labels" . | nindent 4 }} + {{- with $loadBalancer.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} spec: type: LoadBalancer + {{- with $loadBalancer.sourceRanges }} + loadBalancerSourceRanges: + {{- toYaml . | nindent 4 }} + {{- end }} ports: - name: http port: {{ $loadBalancer.ports.httpPort }} @@ -75,4 +83,4 @@ spec: selector: {{- include "harbor.matchLabels" . | nindent 4 }} app.kubernetes.io/component: nginx -{{- end }} \ No newline at end of file +{{- end }} diff --git a/bitnami/harbor/templates/notary/notary-svc.yaml b/bitnami/harbor/templates/notary/notary-svc.yaml index 7dfd0278c..ee5daed58 100644 --- a/bitnami/harbor/templates/notary/notary-svc.yaml +++ b/bitnami/harbor/templates/notary/notary-svc.yaml @@ -10,6 +10,7 @@ spec: {{- end }} ports: - port: 4443 + targetPort: notary-server selector: {{ include "harbor.matchLabels" . | nindent 4 }} component: notary-server diff --git a/bitnami/harbor/templates/registry/registry-dpl.yaml b/bitnami/harbor/templates/registry/registry-dpl.yaml index 0145a5745..c84888268 100644 --- a/bitnami/harbor/templates/registry/registry-dpl.yaml +++ b/bitnami/harbor/templates/registry/registry-dpl.yaml @@ -29,6 +29,20 @@ spec: fsGroup: {{ .Values.securityContext.fsGroup }} runAsUser: {{ .Values.securityContext.runAsUser }} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "harbor.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: registry-data + mountPath: {{ .Values.persistence.imageChartStorage.filesystem.rootdirectory }} + subPath: {{ .Values.persistence.persistentVolumeClaim.registry.subPath }} + {{- end }} containers: - name: registry image: "{{ template "harbor.registryImage" . }}" diff --git a/bitnami/harbor/values-production.yaml b/bitnami/harbor/values-production.yaml index 4a870fee0..75daabefb 100644 --- a/bitnami/harbor/values-production.yaml +++ b/bitnami/harbor/values-production.yaml @@ -13,7 +13,7 @@ coreImage: registry: docker.io repository: bitnami/harbor-core - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -37,7 +37,7 @@ coreImage: portalImage: registry: docker.io repository: bitnami/harbor-portal - tag: 1.8.1-debian-9-r0 + tag: 1.8.1-debian-9-r10 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -61,7 +61,7 @@ portalImage: jobserviceImage: registry: docker.io repository: bitnami/harbor-jobservice - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -85,7 +85,7 @@ jobserviceImage: registryImage: registry: docker.io repository: bitnami/harbor-registry - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -109,7 +109,7 @@ registryImage: registryctlImage: registry: docker.io repository: bitnami/harbor-registryctl - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -133,7 +133,7 @@ registryctlImage: clairImage: registry: docker.io repository: bitnami/harbor-clair - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -157,7 +157,7 @@ clairImage: notaryServerImage: registry: docker.io repository: bitnami/harbor-notary-server - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -181,7 +181,7 @@ notaryServerImage: notarySignerImage: registry: docker.io repository: bitnami/harbor-notary-signer - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -223,6 +223,32 @@ nginxImage: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override harbor.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override harbor.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + service: # Set the way how to expose the service. Set the type as "Ingress", # "ClusterIP", "NodePort" or "LoadBalancer" and fill the information @@ -245,7 +271,7 @@ service: # described above. Fill the name of secret if you want to use a # separated one. Only needed when the type is "ingress". notarySecretName: "" - # The commmon name used to generate the certificate, it's necessary + # The common name used to generate the certificate, it's necessary # when the type isn't "ingress" and "secretName" is null commonName: "" ingress: @@ -255,6 +281,7 @@ service: # set to the type of ingress controller if it has specific requirements. # leave as `default` for most ingress controllers. # set to `gce` if using the GCE ingress controller + # set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller controller: default annotations: ingress.kubernetes.io/ssl-redirect: "true" @@ -303,6 +330,8 @@ service: # The service port Notary listens on. Only needed when notary.enabled # is set to true notaryPort: 4443 + annotations: {} + sourceRanges: [] # The external URL for Harbor core service. It is used to # 1) populate the docker/helm commands showed on portal @@ -319,6 +348,13 @@ service: # If Harbor is deployed behind the proxy, set it as the URL of proxy externalURL: https://core.harbor.domain +## UAA Authentication Options +# If you're using UAA for authentication behind a self-signed +# certificate you will need to provide the CA Cert. +# Set uaaSecretName below to provide a pre-created secret that +# contains a base64 encoded CA Certificate named `ca.crt`. +# uaaSecretName: + ## Kubernetes Security Context ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ## diff --git a/bitnami/harbor/values.yaml b/bitnami/harbor/values.yaml index 2b303f6ca..1efd73c59 100644 --- a/bitnami/harbor/values.yaml +++ b/bitnami/harbor/values.yaml @@ -13,7 +13,7 @@ coreImage: registry: docker.io repository: bitnami/harbor-core - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -37,7 +37,7 @@ coreImage: portalImage: registry: docker.io repository: bitnami/harbor-portal - tag: 1.8.1-debian-9-r0 + tag: 1.8.1-debian-9-r10 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -61,7 +61,7 @@ portalImage: jobserviceImage: registry: docker.io repository: bitnami/harbor-jobservice - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -85,7 +85,7 @@ jobserviceImage: registryImage: registry: docker.io repository: bitnami/harbor-registry - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -109,7 +109,7 @@ registryImage: registryctlImage: registry: docker.io repository: bitnami/harbor-registryctl - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -133,7 +133,7 @@ registryctlImage: clairImage: registry: docker.io repository: bitnami/harbor-clair - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -157,7 +157,7 @@ clairImage: notaryServerImage: registry: docker.io repository: bitnami/harbor-notary-server - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -181,7 +181,7 @@ notaryServerImage: notarySignerImage: registry: docker.io repository: bitnami/harbor-notary-signer - tag: 1.8.1-debian-9-r3 + tag: 1.8.1-debian-9-r12 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -223,6 +223,32 @@ nginxImage: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override harbor.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override harbor.fullname template +## +# fullnameOverride: + + ## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + service: # Set the way how to expose the service. Set the type as "Ingress", # "ClusterIP", "NodePort" or "LoadBalancer" and fill the information @@ -245,7 +271,7 @@ service: # described above. Fill the name of secret if you want to use a # separated one. Only needed when the type is "ingress". notarySecretName: "" - # The commmon name used to generate the certificate, it's necessary + # The common name used to generate the certificate, it's necessary # when the type isn't "ingress" and "secretName" is null commonName: "" ingress: @@ -255,6 +281,7 @@ service: # set to the type of ingress controller if it has specific requirements. # leave as `default` for most ingress controllers. # set to `gce` if using the GCE ingress controller + # set to `ncp` if using the NCP (NSX-T Container Plugin) ingress controller controller: default annotations: ingress.kubernetes.io/ssl-redirect: "true" @@ -303,6 +330,8 @@ service: # The service port Notary listens on. Only needed when notary.enabled # is set to true notaryPort: 4443 + annotations: {} + sourceRanges: [] # The external URL for Harbor core service. It is used to # 1) populate the docker/helm commands showed on portal @@ -319,6 +348,13 @@ service: # If Harbor is deployed behind the proxy, set it as the URL of proxy externalURL: https://core.harbor.domain +## UAA Authentication Options +# If you're using UAA for authentication behind a self-signed +# certificate you will need to provide the CA Cert. +# Set uaaSecretName below to provide a pre-created secret that +# contains a base64 encoded CA Certificate named `ca.crt`. +# uaaSecretName: + ## Kubernetes Security Context ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ## diff --git a/bitnami/jenkins/Chart.yaml b/bitnami/jenkins/Chart.yaml index 82ff2648c..ceffd3346 100644 --- a/bitnami/jenkins/Chart.yaml +++ b/bitnami/jenkins/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: jenkins -version: 2.3.9 -appVersion: 2.176.1 +version: 3.0.1 +appVersion: 2.176.2 description: The leading open source automation server keywords: - jenkins diff --git a/bitnami/jenkins/README.md b/bitnami/jenkins/README.md index 636a4ffea..cb4ba4bd2 100644 --- a/bitnami/jenkins/README.md +++ b/bitnami/jenkins/README.md @@ -45,52 +45,54 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Jenkins chart and their default values. -| Parameter | Description | Default | -|----------------------------|----------------------------------------|---------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Jenkins image registry | `docker.io` | -| `image.repository` | Jenkins Image name | `bitnami/jenkins` | -| `image.tag` | Jenkins Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Jenkins image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `jenkinsUser` | User of the application | `user` | -| `jenkinsPassword` | Application password | _random 10 character alphanumeric string_ | -| `jenkinsHome` | Jenkins home directory | `/opt/bitnami/jenkins/jenkins_home` | -| `disableInitialization` | Allows to disable the initial Bitnami configuration for Jenkins | `no` | -| `javaOpts` | Customize JVM parameters | `nil` | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port | `80` | -| `service.httpsPort` | Service HTTPS port | `443` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `service.nodePorts.https` | Kubernetes https node port | `""` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.loadBalancerIP` | LoadBalancer service IP address | `""` | -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.annotations` | Ingress annotations | `[]` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.hosts[0].name` | Hostname to your jenkins installation | `jenkins.local` | -| `ingress.hosts[0].path` | Path within the url structure | `/` | -| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | -| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `jenkins.local-tls-secret` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for Jenkins volume | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | PVC Access Mode for Jenkins volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for Jenkins volume | `8Gi` | -| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | -| `podAnnotations` | Pod annotations | `{}` | -| `metrics.enabled` | Start a side-car Jenkins prometheus exporter | `false` | -| `metrics.image.registry` | Jenkins exporter image registry | `docker.io` | -| `metrics.image.repository` | Jenkins exporter image name | `tolleiv/jenkins_exporter` | -| `metrics.image.tag` | Jenkins exporter image tag | `latest` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9118"}` | -| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | +Parameter | Description | Default +--- | --- | --- +`global.imageRegistry` | Global Docker image registry | `nil` +`global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) +`image.registry` | Jenkins image registry | `docker.io` +`image.repository` | Jenkins Image name | `bitnami/jenkins` +`image.tag` | Jenkins Image tag | `{TAG_NAME}` +`image.pullPolicy` | Jenkins image pull policy | `IfNotPresent` +`image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) +`nameOverride` | String to partially override jenkins.fullname template with a string (will prepend the release name) | `nil` +`fullnameOverride` | String to fully override jenkins.fullname template with a string | `nil` +`jenkinsUser` | User of the application | `user` +`jenkinsPassword` | Application password | _random 10 character alphanumeric string_ +`jenkinsHome` | Jenkins home directory | `/opt/bitnami/jenkins/jenkins_home` +`disableInitialization` | Allows to disable the initial Bitnami configuration for Jenkins | `no` +`javaOpts` | Customize JVM parameters | `nil` +`service.type` | Kubernetes Service type | `LoadBalancer` +`service.port` | Service HTTP port | `80` +`service.httpsPort` | Service HTTPS port | `443` +`service.nodePorts.http` | Kubernetes http node port | `""` +`service.nodePorts.https` | Kubernetes https node port | `""` +`service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` +`service.loadBalancerIP` | LoadBalancer service IP address | `""` +`ingress.enabled` | Enable ingress controller resource | `false` +`ingress.annotations` | Ingress annotations | `[]` +`ingress.certManager` | Add annotations for cert-manager | `false` +`ingress.hosts[0].name` | Hostname to your jenkins installation | `jenkins.local` +`ingress.hosts[0].path` | Path within the url structure | `/` +`ingress.hosts[0].tls`| Utilize TLS backend in ingress | `false` +`ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` +`ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `jenkins.local-tls-secret` +`ingress.secrets[0].name`| TLS Secret Name | `nil` +`ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` +`ingress.secrets[0].key` | TLS Secret Key | `nil` +`persistence.enabled` | Enable persistence using PVC | `true` +`persistence.storageClass`| PVC Storage Class for Jenkins volume | `nil` (uses alpha storage class annotation) +`persistence.accessMode` | PVC Access Mode for Jenkins volume | `ReadWriteOnce` +`persistence.size` | PVC Storage Request for Jenkins volume | `8Gi` +`resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` +`podAnnotations` | Pod annotations | `{}` +`metrics.enabled` | Start a side-car Jenkins prometheus exporter | `false` +`metrics.image.registry` | Jenkins exporter image registry | `docker.io` +`metrics.image.repository` | Jenkins exporter image name | `tolleiv/jenkins_exporter` +`metrics.image.tag` | Jenkins exporter image tag | `latest` +`metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` +`metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) +`metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9118"}` +`metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` The above parameters map to the env variables defined in [bitnami/jenkins](http://github.com/bitnami/bitnami-docker-jenkins). For more information please refer to the [bitnami/jenkins](http://github.com/bitnami/bitnami-docker-jenkins) image documentation. diff --git a/bitnami/jenkins/templates/_helpers.tpl b/bitnami/jenkins/templates/_helpers.tpl index 4763ddfc6..9aacd8c74 100644 --- a/bitnami/jenkins/templates/_helpers.tpl +++ b/bitnami/jenkins/templates/_helpers.tpl @@ -2,7 +2,7 @@ {{/* Expand the name of the chart. */}} -{{- define "name" -}} +{{- define "jenkins.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} @@ -18,9 +18,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "jenkins.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Return the proper Jenkins image name diff --git a/bitnami/jenkins/values.yaml b/bitnami/jenkins/values.yaml index 419a57a37..1c5a04a87 100644 --- a/bitnami/jenkins/values.yaml +++ b/bitnami/jenkins/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/jenkins - tag: 2.176.1-debian-9-r13 + tag: 2.176.2-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override jenkins.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override jenkins.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-jenkins#configuration ## diff --git a/bitnami/kafka/Chart.yaml b/bitnami/kafka/Chart.yaml index be06c0815..4119cf57e 100644 --- a/bitnami/kafka/Chart.yaml +++ b/bitnami/kafka/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: kafka -version: 3.0.13 +version: 4.1.0 appVersion: 2.3.0 description: Apache Kafka is a distributed streaming platform. keywords: diff --git a/bitnami/kafka/README.md b/bitnami/kafka/README.md index 93009b6d3..032b5b1f2 100644 --- a/bitnami/kafka/README.md +++ b/bitnami/kafka/README.md @@ -45,121 +45,127 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Kafka chart and their default values. -| Parameter | Description | Default | -| --------------------------------------- | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Kafka image registry | `docker.io` | -| `image.repository` | Kafka Image name | `bitnami/kafka` | -| `image.tag` | Kafka Image tag | `{VERSION}` | -| `image.pullPolicy` | Kafka image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.debug` | Specify if debug values should be set | `false` | -| `nameOverride` | String to partially override kafka.fullname template with a string (will append the release name) | `nil` | -| `fullnameOverride` | String to fully override kafka.fullname template with a string | `nil` | -| `updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | -| `rollingUpdatePartition` | Partition update strategy | `nil` | -| `podDisruptionBudget.maxUnavailable` | Max number of pods down simultaneously | `1` | -| `replicaCount` | Number of Kafka nodes | `1` | -| `config` | Configuration file for Kafka | `nil` | -| `allowPlaintextListener` | Allow to use the PLAINTEXT listener | `true` | -| `listeners` | The address the socket server listens on. | `nil` | -| `advertisedListeners` | Hostname and port the broker will advertise to producers and consumers. | `nil` | -| `listenerSecurityProtocolMap` | The protocol->listener mapping. | `nil` | -| `interBrokerListenerName` | The listener that the brokers should communicate on. | `nil` | -| `brokerId` | ID of the Kafka node | `-1` | -| `deleteTopicEnable` | Switch to enable topic deletion or not. | `false` | -| `heapOpts` | Kafka's Java Heap size. | `-Xmx1024m -Xms1024m` | -| `logFlushIntervalMessages` | The number of messages to accept before forcing a flush of data to disk. | `10000` | -| `logFlushIntervalMs` | The maximum amount of time a message can sit in a log before we force a flush. | `1000` | -| `logRetentionBytes` | A size-based retention policy for logs. | `_1073741824` | -| `logRetentionCheckIntervalMs` | The interval at which log segments are checked to see if they can be deleted. | `300000` | -| `logRetentionHours` | The minimum age of a log file to be eligible for deletion due to age. | `168` | -| `logSegmentBytes` | The maximum size of a log segment file. When this size is reached a new log segment will be created. | `_1073741824` | -| `logMessageFormatVersion` | Logging message format version. | `` | -| `logsDirs` | A comma separated list of directories under which to store log files. | `/opt/bitnami/kafka/data` | -| `maxMessageBytes` | The largest record batch size allowed by Kafka. | `1000012` | -| `defaultReplicationFactor` | Default replication factors for automatically created topics | `1` | -| `offsetsTopicReplicationFactor` | The replication factor for the offsets topic | `1` | -| `transactionStateLogReplicationFactor ` | The replication factor for the transaction topic | `1` | -| `transactionStateLogMinIsr ` | Overridden min.insync.replicas config for the transaction topic | `1` | -| `numIoThreads` | The number of threads doing disk I/O. | `8` | -| `numNetworkThreads` | The number of threads handling network requests. | `3` | -| `numPartitions` | The default number of log partitions per topic. | `1` | -| `numRecoveryThreadsPerDataDir` | The number of threads per data directory to be used for log recovery at startup and flushing at shutdown. | `1` | -| `socketReceiveBufferBytes` | The receive buffer (SO_RCVBUF) used by the socket server. | `102400` | -| `socketRequestMaxBytes` | The maximum size of a request that the socket server will accept (protection against OOM). | `_104857600` | -| `socketSendBufferBytes` | The send buffer (SO_SNDBUF) used by the socket server. | `102400` | -| `zookeeperConnectionTimeoutMs` | Timeout in ms for connecting to Zookeeper. | `6000` | -| `extraEnvVars` | Extra environment variables to add to kafka pods | `nil` | -| `sslEndpointIdentificationAlgorithm` | The endpoint identification algorithm to validate server hostname using server certificate. | `https` | -| `auth.enabled` | Switch to enable the kafka authentication. | `false` | -| `auth.existingSecret` | Name of the existing secret containing credentials for brokerUser, interBrokerUser and zookeeperUser. | `nil` | -| `auth.certificatesSecret` | Name of the existing secret containing the certificate files that will be used by Kafka. | `nil` | -| `auth.certificatesPassword` | Password for the above certificates if they are password protected. | `nil` | -| `auth.brokerUser` | Kafka client user. | `user` | -| `auth.brokerPassword` | Kafka client password. | `nil` | -| `auth.interBrokerUser` | Kafka inter broker communication user | `admin` | -| `auth.interBrokerPassword` | Kafka inter broker communication password. | `nil` | -| `auth.zookeeperUser` | Kafka Zookeeper user. | `nil` | -| `auth.zookeeperPassword` | Kafka Zookeeper password. | `nil` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.port` | Kafka port | `9092` | -| `service.nodePort` | Kubernetes Service nodePort | `nil` | -| `service.loadBalancerIP` | loadBalancerIP for Kafka Service | `nil` | -| `service.annotations` | Service annotations | `` | -| `persistence.enabled` | Enable Kafka persistence using PVC, note that Zookeeper perisstency is unaffected | `true` | -| `persistence.existingClaim` | Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. | `nil` | -| `persistence.storageClass` | PVC Storage Class for Kafka volume | `nil` | -| `persistence.accessMode` | PVC Access Mode for Kafka volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for Kafka volume | `8Gi` | -| `persistence.annotations` | Annotations for the PVC | `{}` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `[]` | -| `affinity` | Map of node/pod affinities | `{}` | -| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | -| `livenessProbe.enabled` | would you like a livessProbed to be enabled | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 30 | -| `livenessProbe.periodSeconds` | How often to perform the probe | 10 | -| `livenessProbe.timeoutSeconds` | When the probe times out | 5 | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | -| `readinessProbe.enabled` | would you like a readinessProbe to be enabled | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 5 | -| `readinessProbe.periodSeconds` | How often to perform the probe | 10 | -| `readinessProbe.timeoutSeconds` | When the probe times out | 5 | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | -| `metrics.kafka.enabled` | Whether or not to create a separate Kafka exporter | `false` | -| `metrics.kafka.image.registry` | Kafka exporter image registry | `docker.io` | -| `metrics.kafka.image.repository` | Kafka exporter image name | `danielqsj/kafka-exporter` | -| `metrics.kafka.image.tag` | Kafka exporter image tag | `v1.0.1` | -| `metrics.kafka.image.pullPolicy` | Kafka exporter image pull policy | `IfNotPresent` | -| `metrics.kafka.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.kafka.interval` | Interval that Prometheus scrapes Kafka metrics when using Prometheus Operator | `10s` | -| `metrics.kafka.port` | Kafka Exporter Port which exposes metrics in Prometheus format for scraping | `9308` | -| `metrics.kafka.resources` | Allows setting resource limits for kafka-exporter pod | `{}` | -| `metrics.jmx.resources` | Allows setting resource limits for jmx sidecar container | `{}` | -| `metrics.jmx.enabled` | Whether or not to expose JMX metrics to Prometheus | `false` | -| `metrics.jmx.image.registry` | JMX exporter image registry | `docker.io` | -| `metrics.jmx.image.repository` | JMX exporter image name | `solsson/kafka-prometheus-jmx-exporter@sha256` | -| `metrics.jmx.image.tag` | JMX exporter image tag | `a23062396cd5af1acdf76512632c20ea6be76885dfc20cd9ff40fb23846557e8` | -| `metrics.jmx.image.pullPolicy` | JMX exporter image pull policy | `IfNotPresent` | -| `metrics.jmx.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.jmx.interval` | Interval that Prometheus scrapes JMX metrics when using Prometheus Operator | `10s` | -| `metrics.jmx.exporterPort` | JMX Exporter Port which exposes metrics in Prometheus format for scraping | `5556` | -| `metrics.jmx.configMap.enabled` | Enable the default ConfigMap for JMX | `true` | -| `metrics.jmx.configMap.overrideConfig` | Allows config file to be generated by passing values to ConfigMap | `{}` | -| `metrics.jmx.configMap.overrideName` | Allows setting the name of the ConfigMap to be used | `""` | -| `metrics.jmx.jmxPort` | The jmx port which JMX style metrics are exposed (note: these are not scrapeable by Prometheus) | `5555` | -| `metrics.jmx.whitelistObjectNames` | Allows setting which JMX objects you want to expose to via JMX stats to JMX Exporter | (see `values.yaml`) | -| `zookeeper.enabled` | Switch to enable or disable the Zookeeper helm chart | `true` | -| `zookeeper.persistence.enabled` | Enable Zookeeper persistence using PVC | `true` | -| `externalZookeeper.servers` | Server or list of external Zookeeper servers to use. | `nil` | +| Parameter | Description | Default | +| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Kafka image registry | `docker.io` | +| `image.repository` | Kafka Image name | `bitnami/kafka` | +| `image.tag` | Kafka Image tag | `{VERSION}` | +| `image.pullPolicy` | Kafka image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug values should be set | `false` | +| `nameOverride` | String to partially override kafka.fullname template with a string (will append the release name) | `nil` | +| `fullnameOverride` | String to fully override kafka.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `updateStrategy` | Update strategy for the stateful set | `RollingUpdate` | +| `rollingUpdatePartition` | Partition update strategy | `nil` | +| `podDisruptionBudget.maxUnavailable` | Max number of pods down simultaneously | `1` | +| `replicaCount` | Number of Kafka nodes | `1` | +| `config` | Configuration file for Kafka | `nil` | +| `allowPlaintextListener` | Allow to use the PLAINTEXT listener | `true` | +| `listeners` | The address the socket server listens on. | `nil` | +| `advertisedListeners` | Hostname and port the broker will advertise to producers and consumers. | `nil` | +| `listenerSecurityProtocolMap` | The protocol->listener mapping. | `nil` | +| `interBrokerListenerName` | The listener that the brokers should communicate on. | `nil` | +| `brokerId` | ID of the Kafka node | `-1` | +| `deleteTopicEnable` | Switch to enable topic deletion or not. | `false` | +| `heapOpts` | Kafka's Java Heap size. | `-Xmx1024m -Xms1024m` | +| `logFlushIntervalMessages` | The number of messages to accept before forcing a flush of data to disk. | `10000` | +| `logFlushIntervalMs` | The maximum amount of time a message can sit in a log before we force a flush. | `1000` | +| `logRetentionBytes` | A size-based retention policy for logs. | `_1073741824` | +| `logRetentionCheckIntervalMs` | The interval at which log segments are checked to see if they can be deleted. | `300000` | +| `logRetentionHours` | The minimum age of a log file to be eligible for deletion due to age. | `168` | +| `logSegmentBytes` | The maximum size of a log segment file. When this size is reached a new log segment will be created. | `_1073741824` | +| `logMessageFormatVersion` | Logging message format version. | `` | +| `logsDirs` | A comma separated list of directories under which to store log files. | `/opt/bitnami/kafka/data` | +| `maxMessageBytes` | The largest record batch size allowed by Kafka. | `1000012` | +| `defaultReplicationFactor` | Default replication factors for automatically created topics | `1` | +| `offsetsTopicReplicationFactor` | The replication factor for the offsets topic | `1` | +| `transactionStateLogReplicationFactor ` | The replication factor for the transaction topic | `1` | +| `transactionStateLogMinIsr ` | Overridden min.insync.replicas config for the transaction topic | `1` | +| `numIoThreads` | The number of threads doing disk I/O. | `8` | +| `numNetworkThreads` | The number of threads handling network requests. | `3` | +| `numPartitions` | The default number of log partitions per topic. | `1` | +| `numRecoveryThreadsPerDataDir` | The number of threads per data directory to be used for log recovery at startup and flushing at shutdown. | `1` | +| `socketReceiveBufferBytes` | The receive buffer (SO_RCVBUF) used by the socket server. | `102400` | +| `socketRequestMaxBytes` | The maximum size of a request that the socket server will accept (protection against OOM). | `_104857600` | +| `socketSendBufferBytes` | The send buffer (SO_SNDBUF) used by the socket server. | `102400` | +| `zookeeperConnectionTimeoutMs` | Timeout in ms for connecting to Zookeeper. | `6000` | +| `extraEnvVars` | Extra environment variables to add to kafka pods | `nil` | +| `sslEndpointIdentificationAlgorithm` | The endpoint identification algorithm to validate server hostname using server certificate. | `https` | +| `auth.enabled` | Switch to enable the kafka authentication. | `false` | +| `auth.existingSecret` | Name of the existing secret containing credentials for brokerUser, interBrokerUser and zookeeperUser. | `nil` | +| `auth.certificatesSecret` | Name of the existing secret containing the certificate files that will be used by Kafka. | `nil` | +| `auth.certificatesPassword` | Password for the above certificates if they are password protected. | `nil` | +| `auth.brokerUser` | Kafka client user. | `user` | +| `auth.brokerPassword` | Kafka client password. | `nil` | +| `auth.interBrokerUser` | Kafka inter broker communication user | `admin` | +| `auth.interBrokerPassword` | Kafka inter broker communication password. | `nil` | +| `auth.zookeeperUser` | Kafka Zookeeper user. | `nil` | +| `auth.zookeeperPassword` | Kafka Zookeeper password. | `nil` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | +| `service.type` | Kubernetes Service type | `ClusterIP` | +| `service.port` | Kafka port | `9092` | +| `service.nodePort` | Kubernetes Service nodePort | `nil` | +| `service.loadBalancerIP` | loadBalancerIP for Kafka Service | `nil` | +| `service.annotations` | Service annotations | `` | +| `persistence.enabled` | Enable Kafka persistence using PVC, note that Zookeeper perisstency is unaffected | `true` | +| `persistence.existingClaim` | Provide an existing `PersistentVolumeClaim`, the value is evaluated as a template. | `nil` | +| `persistence.storageClass` | PVC Storage Class for Kafka volume | `nil` | +| `persistence.accessMode` | PVC Access Mode for Kafka volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for Kafka volume | `8Gi` | +| `persistence.annotations` | Annotations for the PVC | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `[]` | +| `affinity` | Map of node/pod affinities | `{}` | +| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | +| `livenessProbe.enabled` | would you like a livessProbed to be enabled | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 30 | +| `livenessProbe.periodSeconds` | How often to perform the probe | 10 | +| `livenessProbe.timeoutSeconds` | When the probe times out | 5 | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | +| `readinessProbe.enabled` | would you like a readinessProbe to be enabled | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 5 | +| `readinessProbe.periodSeconds` | How often to perform the probe | 10 | +| `readinessProbe.timeoutSeconds` | When the probe times out | 5 | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 6 | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | +| `metrics.kafka.enabled` | Whether or not to create a separate Kafka exporter | `false` | +| `metrics.kafka.image.registry` | Kafka exporter image registry | `docker.io` | +| `metrics.kafka.image.repository` | Kafka exporter image name | `danielqsj/kafka-exporter` | +| `metrics.kafka.image.tag` | Kafka exporter image tag | `v1.0.1` | +| `metrics.kafka.image.pullPolicy` | Kafka exporter image pull policy | `IfNotPresent` | +| `metrics.kafka.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.kafka.interval` | Interval that Prometheus scrapes Kafka metrics when using Prometheus Operator | `10s` | +| `metrics.kafka.port` | Kafka Exporter Port which exposes metrics in Prometheus format for scraping | `9308` | +| `metrics.kafka.resources` | Allows setting resource limits for kafka-exporter pod | `{}` | +| `metrics.jmx.resources` | Allows setting resource limits for jmx sidecar container | `{}` | +| `metrics.jmx.enabled` | Whether or not to expose JMX metrics to Prometheus | `false` | +| `metrics.jmx.image.registry` | JMX exporter image registry | `docker.io` | +| `metrics.jmx.image.repository` | JMX exporter image name | `solsson/kafka-prometheus-jmx-exporter@sha256` | +| `metrics.jmx.image.tag` | JMX exporter image tag | `a23062396cd5af1acdf76512632c20ea6be76885dfc20cd9ff40fb23846557e8` | +| `metrics.jmx.image.pullPolicy` | JMX exporter image pull policy | `IfNotPresent` | +| `metrics.jmx.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.jmx.interval` | Interval that Prometheus scrapes JMX metrics when using Prometheus Operator | `10s` | +| `metrics.jmx.exporterPort` | JMX Exporter Port which exposes metrics in Prometheus format for scraping | `5556` | +| `metrics.jmx.configMap.enabled` | Enable the default ConfigMap for JMX | `true` | +| `metrics.jmx.configMap.overrideConfig` | Allows config file to be generated by passing values to ConfigMap | `{}` | +| `metrics.jmx.configMap.overrideName` | Allows setting the name of the ConfigMap to be used | `""` | +| `metrics.jmx.jmxPort` | The jmx port which JMX style metrics are exposed (note: these are not scrapeable by Prometheus) | `5555` | +| `metrics.jmx.whitelistObjectNames` | Allows setting which JMX objects you want to expose to via JMX stats to JMX Exporter | (see `values.yaml`) | +| `zookeeper.enabled` | Switch to enable or disable the Zookeeper helm chart | `true` | +| `zookeeper.persistence.enabled` | Enable Zookeeper persistence using PVC | `true` | +| `externalZookeeper.servers` | Server or list of external Zookeeper servers to use. | `nil` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -301,6 +307,15 @@ The [Bitnami Kafka](https://github.com/bitnami/bitnami-docker-kafka) image store Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Configuration](#configuration) section to configure the PVC or to disable persistence. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Upgrading ### To 2.0.0 diff --git a/bitnami/kafka/templates/NOTES.txt b/bitnami/kafka/templates/NOTES.txt index a75459923..4fd2ce14a 100644 --- a/bitnami/kafka/templates/NOTES.txt +++ b/bitnami/kafka/templates/NOTES.txt @@ -23,29 +23,29 @@ Kafka can be accessed via port 9092 on the following DNS name from within your c To create a topic run the following command: export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "kafka.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka" -o jsonpath="{.items[0].metadata.name}") - kubectl exec -it $POD_NAME -- kafka-topics.sh --create --zookeeper {{ template "kafka.zookeeper.fullname" . }}:2181 --replication-factor 1 --partitions 1 --topic test + kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME -- kafka-topics.sh --create --zookeeper {{ template "kafka.zookeeper.fullname" . }}:2181 --replication-factor 1 --partitions 1 --topic test To list all the topics run the following command: export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "kafka.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka" -o jsonpath="{.items[0].metadata.name}") - kubectl exec -it $POD_NAME -- kafka-topics.sh --list --zookeeper {{ template "kafka.zookeeper.fullname" . }}:2181 + kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME -- kafka-topics.sh --list --zookeeper {{ template "kafka.zookeeper.fullname" . }}:2181 To start a kafka producer run the following command: export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "kafka.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka" -o jsonpath="{.items[0].metadata.name}") {{- if .Values.auth.enabled }} - kubectl exec -it $POD_NAME -- kafka-console-producer.sh --broker-list 127.0.0.1:9092 --topic test --producer.config /opt/bitnami/kafka/conf/producer.properties + kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME -- kafka-console-producer.sh --broker-list 127.0.0.1:9092 --topic test --producer.config /opt/bitnami/kafka/conf/producer.properties {{- else }} - kubectl exec -it $POD_NAME -- kafka-console-producer.sh --broker-list localhost:9092 --topic test + kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME -- kafka-console-producer.sh --broker-list localhost:9092 --topic test {{- end }} To start a kafka consumer run the following command: export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "kafka.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka" -o jsonpath="{.items[0].metadata.name}") {{- if .Values.auth.enabled }} - kubectl exec -it $POD_NAME -- kafka-console-consumer.sh --bootstrap-server 127.0.0.1:9092 --topic test --consumer.config /opt/bitnami/kafka/conf/consumer.properties + kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME -- kafka-console-consumer.sh --bootstrap-server 127.0.0.1:9092 --topic test --consumer.config /opt/bitnami/kafka/conf/consumer.properties {{- else }} - kubectl exec -it $POD_NAME -- kafka-console-consumer.sh --bootstrap-server localhost:9092 --topic test --from-beginning + kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME -- kafka-console-consumer.sh --bootstrap-server localhost:9092 --topic test --from-beginning {{- end }} To connect to your Kafka server from outside the cluster execute the following commands: @@ -80,7 +80,7 @@ To connect to your Kafka server from outside the cluster execute the following c You should get the content of that file and write it in your host machine: export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ template "kafka.name" . }},app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/component=kafka" -o jsonpath="{.items[0].metadata.name}") - kubectl exec -it $POD_NAME -- cat /opt/bitnami/kafka/conf/kafka_jaas.conf >> kafka_jaas.conf + kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME -- cat /opt/bitnami/kafka/conf/kafka_jaas.conf >> kafka_jaas.conf Finally, before using your client you need to export the following env var: diff --git a/bitnami/kafka/templates/_helpers.tpl b/bitnami/kafka/templates/_helpers.tpl index 49feea4ad..767dac05a 100644 --- a/bitnami/kafka/templates/_helpers.tpl +++ b/bitnami/kafka/templates/_helpers.tpl @@ -3,7 +3,7 @@ Expand the name of the chart. */}} {{- define "kafka.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* @@ -100,13 +100,18 @@ Also, we can't use a single if because lazy evaluation is not an option {{- end -}} {{- end -}} +{{/* Create a default fully qualified zookeeper name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "kafka.zookeeper.fullname" -}} +{{- if .Values.zookeeper.fullnameOverride -}} +{{- .Values.zookeeper.fullnameOverride | trunc 24 | trimSuffix "-" -}} +{{- else -}} {{- $name := default "zookeeper" .Values.zookeeper.nameOverride -}} {{- printf "%s-%s" .Release.Name $name | trunc 24 | trimSuffix "-" -}} {{- end -}} +{{- end -}} {{/* Return the proper Docker Image Registry Secret Names @@ -123,7 +128,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -134,8 +139,11 @@ imagePullSecrets: {{- range .Values.metrics.jmx.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.kafka.image.pullSecrets .Values.metrics.jmx.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -146,5 +154,31 @@ imagePullSecrets: {{- range .Values.metrics.jmx.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "kafka.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/bitnami/kafka/templates/statefulset.yaml b/bitnami/kafka/templates/statefulset.yaml index a781af818..550e71780 100644 --- a/bitnami/kafka/templates/statefulset.yaml +++ b/bitnami/kafka/templates/statefulset.yaml @@ -58,8 +58,21 @@ spec: affinity: {{ toYaml .Values.affinity | indent 8 }} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "kafka.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/kafka"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: "/bitnami/kafka" + {{- end }} containers: - - name: "{{ template "kafka.fullname" . }}" + - name: kafka image: "{{ template "kafka.image" . }}" imagePullPolicy: "{{ .Values.image.pullPolicy }}" resources: diff --git a/bitnami/kafka/values-production.yaml b/bitnami/kafka/values-production.yaml index 40b6c1551..9615ea7f6 100644 --- a/bitnami/kafka/values-production.yaml +++ b/bitnami/kafka/values-production.yaml @@ -37,6 +37,24 @@ image: ## String to fully override kafka.fullname template # fullnameOverride: +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## @@ -282,7 +300,7 @@ affinity: {} ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## -resources: +resources: {} # limits: # cpu: 200m # memory: 1Gi diff --git a/bitnami/kafka/values.yaml b/bitnami/kafka/values.yaml index ddbf90453..ac5d348a3 100644 --- a/bitnami/kafka/values.yaml +++ b/bitnami/kafka/values.yaml @@ -37,6 +37,24 @@ image: ## String to fully override kafka.fullname template # fullnameOverride: +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## @@ -282,7 +300,7 @@ affinity: {} ## Configure resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## -resources: +resources: {} # limits: # cpu: 200m # memory: 1Gi diff --git a/bitnami/kubeapps/Chart.yaml b/bitnami/kubeapps/Chart.yaml index 10ad3dbba..a65204661 100644 --- a/bitnami/kubeapps/Chart.yaml +++ b/bitnami/kubeapps/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: kubeapps -version: 2.0.0 +version: 2.0.1 appVersion: v1.4.1 description: Kubeapps is a dashboard for your Kubernetes cluster that makes it easy to deploy and manage applications in your cluster using Helm icon: https://raw.githubusercontent.com/kubeapps/kubeapps/master/docs/img/logo.png diff --git a/bitnami/kubeapps/templates/apprepositories.yaml b/bitnami/kubeapps/templates/apprepositories.yaml index 14573db02..9d6213efd 100644 --- a/bitnami/kubeapps/templates/apprepositories.yaml +++ b/bitnami/kubeapps/templates/apprepositories.yaml @@ -25,12 +25,24 @@ metadata: spec: type: helm url: {{ .url }} - {{- if $.Values.securityContext.enabled }} +{{- if or $.Values.securityContext.enabled $.Values.apprepository.initialReposProxy.enabled}} syncJobPodTemplate: spec: - securityContext: + {{- if $.Values.apprepository.initialReposProxy.enabled }} + containers: + - env: + - name: https_proxy + value: {{ $.Values.apprepository.initialReposProxy.https_proxy }} + - name: http_proxy + value: {{ $.Values.apprepository.initialReposProxy.http_proxy }} + - name: no_proxy + value: {{ $.Values.apprepository.initialReposProxy.no_proxy }} + {{- end }} + {{- if $.Values.securityContext.enabled }} + securityContext: runAsUser: {{ $.Values.securityContext.runAsUser }} {{- end }} +{{- end }} {{- if or .caCert .authorizationHeader }} auth: {{- if .caCert }} diff --git a/bitnami/kubeapps/values.yaml b/bitnami/kubeapps/values.yaml index bb896ac16..077445f19 100644 --- a/bitnami/kubeapps/values.yaml +++ b/bitnami/kubeapps/values.yaml @@ -105,6 +105,11 @@ apprepository: registry: docker.io repository: bitnami/kubeapps-chart-repo tag: 1.8.0-r0 + initialReposProxy: + enabled: false +# http_proxy: "http://yourproxy:3128" +# https_proxy: "http://yourproxy:3128" +# no_proxy: "0.0.0.0/0" initialRepos: - name: stable url: https://kubernetes-charts.storage.googleapis.com diff --git a/bitnami/magento/README.md b/bitnami/magento/README.md index aa8ff4002..18f950f95 100644 --- a/bitnami/magento/README.md +++ b/bitnami/magento/README.md @@ -57,6 +57,8 @@ The following table lists the configurable parameters of the Magento chart and t | `image.debug` | Specify if debug values should be set | `false` | | `image.pullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override magento.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override magento.fullname template with a string | `nil` | | `magentoHost` | Magento host to create application URLs | `nil` | | `magentoLoadBalancerIP` | `loadBalancerIP` for the magento Service | `nil` | | `magentoUsername` | User of the application | `user` | @@ -91,6 +93,9 @@ The following table lists the configurable parameters of the Magento chart and t | `mariadb.db.user` | Database user to create | `bn_magento` | | `mariadb.db.password` | Password for the database | _random 10 character long alphanumeric string_ | | `elasticsearch.enabled` | Use the Elasticsearch chart as search engine | `true` | +| `elasticsearch.image.registry` | Elasticsearch image registry | `docker.io` | +| `elasticsearch.image.repository` | Elasticsearch image name | `bitnami/elasticsearch` | +| `elasticsearch.image.tag` | Elasticsearch image tag | `{TAG_NAME}` | | `elasticsearch.sysctlImage.enabled` | Enable kernel settings modifier image for Elasticsearch | `false` | | `elasticsearch.master.replicas` | Desired number of Elasticsearch master-eligible nodes | `1` | | `elasticsearch.coordinating.replicas` | Desired number of Elasticsearch coordinating-only nodes | `1` | @@ -126,8 +131,8 @@ The following table lists the configurable parameters of the Magento chart and t | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/bitnami/magento/templates/_helpers.tpl b/bitnami/magento/templates/_helpers.tpl index 8ec2c7f2d..3e5531dcf 100644 --- a/bitnami/magento/templates/_helpers.tpl +++ b/bitnami/magento/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "magento.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create a random alphanumeric password string. diff --git a/bitnami/magento/values-production.yaml b/bitnami/magento/values-production.yaml index c805e1ef1..70e438dea 100644 --- a/bitnami/magento/values-production.yaml +++ b/bitnami/magento/values-production.yaml @@ -31,6 +31,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override magento.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override magento.fullname template +## +# fullnameOverride: + ## Magento host to create application URLs ## ref: https://github.com/bitnami/bitnami-docker-magento#configuration ## @@ -164,6 +172,12 @@ elasticsearch: ## Whether to deploy a elasticsearch server to use as magento's search engine ## To use an external server set this to false and configure the externalElasticsearch parameters enabled: true + ## Tag for the Bitnami Elasticsearch image to use + ## ref: https://github.com/bitnami/bitnami-docker-elasticsearch + image: + registry: docker.io + repository: bitnami/elasticsearch + tag: 6.8.1-debian-9-r23 ## Enable to perform the sysctl operation sysctlImage: enabled: false @@ -318,8 +332,8 @@ metrics: enabled: true image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/magento/values.yaml b/bitnami/magento/values.yaml index 8f9bd2529..22155fdc1 100644 --- a/bitnami/magento/values.yaml +++ b/bitnami/magento/values.yaml @@ -31,6 +31,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override magento.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override magento.fullname template +## +# fullnameOverride: + ## Magento host to create application URLs ## ref: https://github.com/bitnami/bitnami-docker-magento#configuration ## @@ -164,6 +172,12 @@ elasticsearch: ## Whether to deploy a elasticsearch server to use as magento's search engine ## To use an external server set this to false and configure the externalElasticsearch parameters enabled: true + ## Tag for the Bitnami Elasticsearch image to use + ## ref: https://github.com/bitnami/bitnami-docker-elasticsearch + image: + registry: docker.io + repository: bitnami/elasticsearch + tag: 6.8.1-debian-9-r23 ## Enable to perform the sysctl operation sysctlImage: enabled: false @@ -318,8 +332,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/memcached/Chart.yaml b/bitnami/memcached/Chart.yaml index 4f5ea06d0..cc28f8043 100644 --- a/bitnami/memcached/Chart.yaml +++ b/bitnami/memcached/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: memcached -version: 1.5.11 +version: 2.1.0 appVersion: 1.5.16 description: Chart for Memcached keywords: diff --git a/bitnami/memcached/README.md b/bitnami/memcached/README.md index 3169856fc..70293007a 100644 --- a/bitnami/memcached/README.md +++ b/bitnami/memcached/README.md @@ -45,31 +45,33 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Memcached chart and their default values. -| Parameter | Description | Default | -|-----------------------------|-------------------------------------|---------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Memcached image registry | `docker.io` | -| `image.repository` | Memcached Image name | `bitnami/memcached` | -| `image.tag` | Memcached Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Memcached image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `memcachedUsername` | Memcached admin user | `nil` | -| `memcachedPassword` | Memcached admin password | `nil` | -| `serviceType` | Kubernetes Service type | `ClusterIP` | -| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | -| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | MongoDB exporter image registry | `docker.io` | -| `metrics.image.repository` | MongoDB exporter image name | `prom/memcached-exporter` | -| `metrics.image.tag` | MongoDB exporter image tag | `v0.4.1` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | {} | -| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | +| Parameter | Description | Default | +|-----------------------------|--------------------------------------------------------------------------------------------------------|---------------------------------------------------------| +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Memcached image registry | `docker.io` | +| `image.repository` | Memcached Image name | `bitnami/memcached` | +| `image.tag` | Memcached Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Memcached image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override memcached.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override memcached.fullname template with a string | `nil` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `memcachedUsername` | Memcached admin user | `nil` | +| `memcachedPassword` | Memcached admin password | `nil` | +| `serviceType` | Kubernetes Service type | `ClusterIP` | +| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | +| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | Memcached exporter image registry | `docker.io` | +| `metrics.image.repository` | Memcached exporter image name | `bitnami/memcached-exporter` | +| `metrics.image.tag` | Memcached exporter image tag | `{TAG_NAME}` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | {} | +| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | The above parameters map to the env variables defined in [bitnami/memcached](http://github.com/bitnami/bitnami-docker-memcached). For more information please refer to the [bitnami/memcached](http://github.com/bitnami/bitnami-docker-memcached) image documentation. diff --git a/bitnami/memcached/templates/NOTES.txt b/bitnami/memcached/templates/NOTES.txt index 767f8b9d1..1099409e4 100644 --- a/bitnami/memcached/templates/NOTES.txt +++ b/bitnami/memcached/templates/NOTES.txt @@ -1,7 +1,7 @@ ** Please be patient while the chart is being deployed ** -Memcached can be accessed on port 11211 on the following DNS name from within your cluster: {{ template "fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} +Memcached can be accessed on port 11211 on the following DNS name from within your cluster: {{ template "memcached.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} {{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} diff --git a/bitnami/memcached/templates/_helpers.tpl b/bitnami/memcached/templates/_helpers.tpl index b90a5ae76..0b363ae0f 100644 --- a/bitnami/memcached/templates/_helpers.tpl +++ b/bitnami/memcached/templates/_helpers.tpl @@ -2,17 +2,25 @@ {{/* Expand the name of the chart. */}} -{{- define "name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- define "memcached.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* Create a default fully qualified app name. We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} -{{- define "fullname" -}} +{{- define "memcached.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} {{- end -}} {{/* diff --git a/bitnami/memcached/templates/deployment.yaml b/bitnami/memcached/templates/deployment.yaml index a3488abb4..5249e3e8d 100644 --- a/bitnami/memcached/templates/deployment.yaml +++ b/bitnami/memcached/templates/deployment.yaml @@ -1,21 +1,21 @@ apiVersion: extensions/v1beta1 kind: Deployment metadata: - name: {{ template "fullname" . }} + name: {{ template "memcached.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "memcached.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" spec: selector: matchLabels: - app: {{ template "fullname" . }} + app: {{ template "memcached.fullname" . }} release: "{{ .Release.Name }}" template: metadata: labels: - app: {{ template "fullname" . }} + app: {{ template "memcached.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" {{- if or .Values.podAnnotations .Values.metrics.enabled }} @@ -35,7 +35,7 @@ spec: {{- end }} {{- include "memcached.imagePullSecrets" . | indent 6 }} containers: - - name: {{ template "fullname" . }} + - name: memcached image: "{{ template "memcached.image" . }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} env: @@ -44,7 +44,7 @@ spec: - name: MEMCACHED_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "memcached.fullname" . }} key: memcached-password ports: - name: memcache diff --git a/bitnami/memcached/templates/secrets.yaml b/bitnami/memcached/templates/secrets.yaml index 0b46cfeb4..4426e4ab3 100644 --- a/bitnami/memcached/templates/secrets.yaml +++ b/bitnami/memcached/templates/secrets.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Secret metadata: - name: {{ template "fullname" . }} + name: {{ template "memcached.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "memcached.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" diff --git a/bitnami/memcached/templates/svc.yaml b/bitnami/memcached/templates/svc.yaml index 82305196f..0d4660801 100644 --- a/bitnami/memcached/templates/svc.yaml +++ b/bitnami/memcached/templates/svc.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "fullname" . }} + name: {{ template "memcached.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "memcached.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -14,4 +14,4 @@ spec: port: 11211 targetPort: memcache selector: - app: {{ template "fullname" . }} + app: {{ template "memcached.fullname" . }} diff --git a/bitnami/memcached/values-production.yaml b/bitnami/memcached/values-production.yaml index 240867a01..c5b78bd49 100644 --- a/bitnami/memcached/values-production.yaml +++ b/bitnami/memcached/values-production.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override memcached.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override memcached.fullname template +## +# fullnameOverride: + ## Pod Security Context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ## @@ -76,8 +84,8 @@ metrics: enabled: true image: registry: docker.io - repository: prom/memcached-exporter - tag: v0.4.1 + repository: bitnami/memcached-exporter + tag: 0.5.0-debian-9-r1 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/memcached/values.yaml b/bitnami/memcached/values.yaml index c094427e9..6138da64e 100644 --- a/bitnami/memcached/values.yaml +++ b/bitnami/memcached/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override memcached.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override memcached.fullname template +## +# fullnameOverride: + ## Pod Security Context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ## @@ -76,8 +84,8 @@ metrics: enabled: false image: registry: docker.io - repository: prom/memcached-exporter - tag: v0.4.1 + repository: bitnami/memcached-exporter + tag: 0.5.0-debian-9-r1 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/metrics-server/Chart.yaml b/bitnami/metrics-server/Chart.yaml index 6437ee6ee..2ca2d22e2 100644 --- a/bitnami/metrics-server/Chart.yaml +++ b/bitnami/metrics-server/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: metrics-server -version: 2.3.8 +version: 3.0.0 appVersion: 0.3.3 description: Metrics Server is a cluster-wide aggregator of resource usage data. Metrics Server collects metrics from the Summary API, exposed by Kubelet on each node. keywords: diff --git a/bitnami/metrics-server/README.md b/bitnami/metrics-server/README.md index a9781ab60..e5dcdf9f1 100644 --- a/bitnami/metrics-server/README.md +++ b/bitnami/metrics-server/README.md @@ -53,6 +53,8 @@ The following tables lists the configurable parameters of the Metrics Server cha | `image.repository` | Metrics Server image name | `bitnami/metrics-server` | | `image.tag` | Metrics Server image tag | `{TAG_NAME}` | | `image.pullPolicy` | Metrics Server image pull policy | `IfNotPresent` | +| `nameOverride` | String to partially override metrics-server.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override metrics-server.fullname template with a string | `nil` | | `securePort` | Port where metrics-server will be running | `8443` | | `service.type` | Kubernetes Service type | `ClusterIP` | | `service.port` | Kubernetes Service port | `443` | diff --git a/bitnami/metrics-server/templates/_helpers.tpl b/bitnami/metrics-server/templates/_helpers.tpl index fe18478db..bfb4a13f4 100644 --- a/bitnami/metrics-server/templates/_helpers.tpl +++ b/bitnami/metrics-server/templates/_helpers.tpl @@ -3,17 +3,24 @@ Expand the name of the chart. */}} {{- define "metrics-server.name" -}} -{{- $name := default .Chart.Name .Values.nameOverride | replace "-" "" -}} -{{- default $name | trunc 24 -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* Create a default fully qualified app name. -We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "metrics-server.fullname" -}} -{{- $name := default .Chart.Name .Values.nameOverride | replace "-" "" -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} {{- end -}} {{/* diff --git a/bitnami/metrics-server/values.yaml b/bitnami/metrics-server/values.yaml index 7be1931fc..48cf7bcad 100644 --- a/bitnami/metrics-server/values.yaml +++ b/bitnami/metrics-server/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override metrics-server.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override metrics-server.fullname template +## +# fullnameOverride: + rbac: # Specifies whether RBAC resources should be created create: true diff --git a/bitnami/minio/Chart.yaml b/bitnami/minio/Chart.yaml index 557dd8314..81d597955 100644 --- a/bitnami/minio/Chart.yaml +++ b/bitnami/minio/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 -version: 0.1.18 -appVersion: 2019.7.5 +version: 1.1.2 +appVersion: 2019.7.24 description: MinIO is an object storage server, compatible with Amazon S3 cloud storage service, mainly used for storing unstructured data (such as photos, videos, log files, etc.) keywords: - minio diff --git a/bitnami/minio/README.md b/bitnami/minio/README.md index e49386ae6..22a600528 100644 --- a/bitnami/minio/README.md +++ b/bitnami/minio/README.md @@ -45,78 +45,86 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the MinIO chart and their default values. -| Parameter | Description | Default | -| ---------------------------------------| -------------------------------------------------------------------------------------------- | ------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `global.minio.existingSecret` | Name of existing secret to use for MinIO credentials (overrides `existingSecret`) | `nil` | -| `global.minio.accessKey` | MinIO Access Key (overrides `accessKey.password`) | `nil` | -| `global.minio.secretKey` | MinIO Secret Key (overrides `secretKey.password`) | `nil` | -| `image.registry` | MinIO image registry | `docker.io` | -| `image.repository` | MinIO image name | `bitnami/minio` | -| `image.tag` | MinIO image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.debug` | Specify if debug logs should be enabled | `false` | -| `clientImage.registry` | MinIO Client image registry | `docker.io` | -| `clientImage.repository` | MinIO Client image name | `bitnami/minio-client` | -| `clientImage.tag` | MinIO Client image tag | `{TAG_NAME}` | -| `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | -| `statefulset.replicaCount` | Number of pods (only for Minio distributed mode). Should be 4 <= x <= 32 | `4` | -| `statefulset.updateStrategy` | Statefulset update strategy policy | `RollingUpdate` | -| `statefulset.podManagementpolicy` | Statefulset pods management policy | `Parallel` | -| `existingSecret` | Existing secret with MinIO credentials | `nil` | -| `useCredentialsFile` | Have the secret mounted as a file instead of env vars | `false` | -| `accessKey.password` | MinIO Access Key. Ignored if existing secret is provided. | _random 10 character alphanumeric string_ | -| `accessKey.forcePassword` | Force users to specify an Access Key | `false` | -| `secretKey.password` | MinIO Secret Key. Ignored if existing secret is provided. | _random 40 character alphanumeric string_ | -| `secretKey.forcePassword` | Force users to specify an Secret Key | `false` | -| `defaultBuckets` | Comma, semi-colon or space separated list of buckets to create (only in standalone mode) | `nil` | -| `disableWebUI` | Disable MinIO Web UI | `false` | -| `extraEnv` | Any extra environment variables you would like to pass to the pods | `{}` | -| `podAnnotations` | Annotations to be added to pods | `{}` | -| `antiAffinity` | Pod anti-affinity policy | `soft` | -| `nodeAffinity` | Node affinity policy | `nil` | -| `resources` | Pod resources | `{}` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | -| `livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `60` | -| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | -| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | -| `readinessProbe.enabled` | Enable/disable the Readiness probe | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | -| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | -| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `persistence.enabled` | Use a PVC to persist data | `true` | -| `persistence.mountPath` | Path to mount the volume at | `/data` | -| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | -| `persistence.size` | Size of data volume | `8Gi` | -| `persistence.annotations` | Persistent Volume annotations | `{}` | -| `persistence.existingClaim` | Name of an existing PVC to use (only in "standalone" mode) | `nil` | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.port` | MinIO service port | `9000` | -| `service.nodePort` | Port to bind to for NodePort service type | `nil` | -| `service.loadBalancerIP` | Static IP Address to use for LoadBalancer service type | `nil` | -| `service.annotations` | Kubernetes service annotations | `{}` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.annotations` | Ingress annotations | `[]` | -| `ingress.hosts[0].name` | Hostname to your MinIO installation | `minio.local` | -| `ingress.hosts[0].path` | Path within the url structure | `/` | -| `ingress.tls[0].hosts[0]` | TLS hosts | `minio.local` | -| `ingress.tls[0].secretName` | TLS Secret (certificates) | `minio.local-tls` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | -| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | -| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | +| Parameter | Description | Default | +| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `global.minio.existingSecret` | Name of existing secret to use for MinIO credentials (overrides `existingSecret`) | `nil` | +| `global.minio.accessKey` | MinIO Access Key (overrides `accessKey.password`) | `nil` | +| `global.minio.secretKey` | MinIO Secret Key (overrides `secretKey.password`) | `nil` | +| `image.registry` | MinIO image registry | `docker.io` | +| `image.repository` | MinIO image name | `bitnami/minio` | +| `image.tag` | MinIO image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug logs should be enabled | `false` | +| `nameOverride` | String to partially override minio.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override minio.fullname template with a string | `nil` | +| `clientImage.registry` | MinIO Client image registry | `docker.io` | +| `clientImage.repository` | MinIO Client image name | `bitnami/minio-client` | +| `clientImage.tag` | MinIO Client image tag | `{TAG_NAME}` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | +| `statefulset.replicaCount` | Number of pods (only for Minio distributed mode). Should be 4 <= x <= 32 | `4` | +| `statefulset.updateStrategy` | Statefulset update strategy policy | `RollingUpdate` | +| `statefulset.podManagementpolicy` | Statefulset pods management policy | `Parallel` | +| `existingSecret` | Existing secret with MinIO credentials | `nil` | +| `useCredentialsFile` | Have the secret mounted as a file instead of env vars | `false` | +| `accessKey.password` | MinIO Access Key. Ignored if existing secret is provided. | _random 10 character alphanumeric string_ | +| `accessKey.forcePassword` | Force users to specify an Access Key | `false` | +| `secretKey.password` | MinIO Secret Key. Ignored if existing secret is provided. | _random 40 character alphanumeric string_ | +| `secretKey.forcePassword` | Force users to specify an Secret Key | `false` | +| `defaultBuckets` | Comma, semi-colon or space separated list of buckets to create (only in standalone mode) | `nil` | +| `disableWebUI` | Disable MinIO Web UI | `false` | +| `extraEnv` | Any extra environment variables you would like to pass to the pods | `{}` | +| `podAnnotations` | Annotations to be added to pods | `{}` | +| `antiAffinity` | Pod anti-affinity policy | `soft` | +| `nodeAffinity` | Node affinity policy | `nil` | +| `resources` | Pod resources | `{}` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | +| `livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `60` | +| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | +| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | +| `readinessProbe.enabled` | Enable/disable the Readiness probe | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | +| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | +| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `persistence.enabled` | Use a PVC to persist data | `true` | +| `persistence.mountPath` | Path to mount the volume at | `/data` | +| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | +| `persistence.size` | Size of data volume | `8Gi` | +| `persistence.annotations` | Persistent Volume annotations | `{}` | +| `persistence.existingClaim` | Name of an existing PVC to use (only in "standalone" mode) | `nil` | +| `service.type` | Kubernetes Service type | `ClusterIP` | +| `service.port` | MinIO service port | `9000` | +| `service.nodePort` | Port to bind to for NodePort service type | `nil` | +| `service.loadBalancerIP` | Static IP Address to use for LoadBalancer service type | `nil` | +| `service.annotations` | Kubernetes service annotations | `{}` | +| `ingress.certManager` | Add annotations for cert-manager | `false` | +| `ingress.annotations` | Ingress annotations | `[]` | +| `ingress.hosts[0].name` | Hostname to your MinIO installation | `minio.local` | +| `ingress.hosts[0].path` | Path within the url structure | `/` | +| `ingress.tls[0].hosts[0]` | TLS hosts | `minio.local` | +| `ingress.tls[0].secretName` | TLS Secret (certificates) | `minio.local-tls` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | +| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | +| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -228,3 +236,12 @@ MinIO exports Prometheus metrics at `/minio/prometheus/metrics`. To allow Promet The [Bitnami MinIO](https://github.com/bitnami/bitnami-docker-minio) image stores data at the `/data` path of the container. The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning. + +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. diff --git a/bitnami/minio/templates/_helpers.tpl b/bitnami/minio/templates/_helpers.tpl index 4d2572950..9b0c6a596 100644 --- a/bitnami/minio/templates/_helpers.tpl +++ b/bitnami/minio/templates/_helpers.tpl @@ -4,7 +4,7 @@ Expand the name of the chart. */}} {{- define "minio.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* @@ -12,8 +12,16 @@ Create a default fully qualified app name. We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "minio.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} {{- end -}} {{/* @@ -47,8 +55,9 @@ Return the proper MinIO Client image name Return the proper Docker Image Registry Secret Names */}} {{- define "minio.imagePullSecrets" -}} -{{- $imagePullSecrets := coalesce .Values.global.imagePullSecrets .Values.image.pullSecrets -}} +{{- $imagePullSecrets := coalesce .Values.global.imagePullSecrets .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets -}} {{- if $imagePullSecrets }} +imagePullSecrets: {{- range $imagePullSecrets }} - name: {{ . }} {{- end -}} @@ -152,3 +161,26 @@ WARNING: Rolling tag detected ({{ .Values.clientImage.repository }}:{{ .Values.c +info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ {{- end }} {{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "minio.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/minio/templates/deployment-standalone.yaml b/bitnami/minio/templates/deployment-standalone.yaml index 3a612ec69..171cab91b 100644 --- a/bitnami/minio/templates/deployment-standalone.yaml +++ b/bitnami/minio/templates/deployment-standalone.yaml @@ -51,6 +51,19 @@ spec: securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "minio.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} containers: - name: "minio" image: {{ include "minio.image" . }} diff --git a/bitnami/minio/templates/statefulset.yaml b/bitnami/minio/templates/statefulset.yaml index b1b66d19c..4c320de76 100644 --- a/bitnami/minio/templates/statefulset.yaml +++ b/bitnami/minio/templates/statefulset.yaml @@ -61,6 +61,19 @@ spec: securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "minio.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} containers: - name: "minio" image: {{ include "minio.image" . }} diff --git a/bitnami/minio/values-production.yaml b/bitnami/minio/values-production.yaml index e96782ac9..cb8263c75 100644 --- a/bitnami/minio/values-production.yaml +++ b/bitnami/minio/values-production.yaml @@ -18,7 +18,7 @@ global: image: registry: docker.io repository: bitnami/minio - tag: 2019.7.3-debian-9-r2 + tag: 2019.7.24-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -36,13 +36,39 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override minio.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override minio.fullname template +## +# fullnameOverride: + ## Bitnami MinIO Client image version ## ref: https://hub.docker.com/r/bitnami/minio-client/tags/ ## clientImage: registry: docker.io repository: bitnami/minio-client - tag: 2019.7.3-debian-9-r2 + tag: 2019.7.24-debian-9-r0 + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} ## MinIO server mode. Allowed values: standalone or distributed. ## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide diff --git a/bitnami/minio/values.yaml b/bitnami/minio/values.yaml index cd00638bb..686e416e7 100644 --- a/bitnami/minio/values.yaml +++ b/bitnami/minio/values.yaml @@ -18,7 +18,7 @@ global: image: registry: docker.io repository: bitnami/minio - tag: 2019.7.3-debian-9-r2 + tag: 2019.7.24-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -36,13 +36,39 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override minio.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override minio.fullname template +## +# fullnameOverride: + ## Bitnami MinIO Client image version ## ref: https://hub.docker.com/r/bitnami/minio-client/tags/ ## clientImage: registry: docker.io repository: bitnami/minio-client - tag: 2019.7.3-debian-9-r2 + tag: 2019.7.24-debian-9-r0 + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} ## MinIO server mode. Allowed values: standalone or distributed. ## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide diff --git a/bitnami/mxnet/Chart.yaml b/bitnami/mxnet/Chart.yaml index 8f1b8f8ea..27528714a 100644 --- a/bitnami/mxnet/Chart.yaml +++ b/bitnami/mxnet/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: mxnet -version: 0.0.4 -appVersion: 1.4.1 +version: 1.1.0 +appVersion: 1.5.0 description: A flexible and efficient library for deep learning keywords: - mxnet diff --git a/bitnami/mxnet/README.md b/bitnami/mxnet/README.md index 04f767ebd..c46b30698 100644 --- a/bitnami/mxnet/README.md +++ b/bitnami/mxnet/README.md @@ -45,66 +45,74 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the MinIO chart and their default values. -| Parameter | Description | Default | -|--------------------------------------|----------------------------------------------------------------------------------------------|---------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | MXNet image registry | `docker.io` | -| `image.repository` | MXNet image name | `bitnami/MXNet` | -| `image.tag` | MXNet image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.debug` | Specify if debug logs should be enabled | `false` | -| `git.registry` | Git image registry | `docker.io` | -| `git.repository` | Git image name | `bitnami/git` | -| `git.tag` | Git image tag | `{TAG_NAME}` | -| `git.pullPolicy` | Git image pull policy | `IfNotPresent` | -| `git.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `service.type` | Kubernetes service type | `ClusterIP` | -| `entrypoint.file` | Main entrypoint to your application. If not speficied, it will be a `sleep infinity` command | `''` | -| `entrypoint.args` | Args required by your entrypoint | `nil` | -| `entrypoint.workDir` | Working directory for launching the entrypoint | `'/app'` | -| `podManagementPolicy` | StatefulSet (worker and server nodes) pod management policy | `Parallel` | -| `mode` | Run MXNet in standalone or distributed mode (possible values: `standalone`, `distributed`) | `standalone` | -| `serverCount` | Number of server nodes that will execute your code | `1` | -| `workerCount` | Number of worker nodes that will execute your code | `1` | -| `schedulerPort` | MXNet scheduler port (only for distributed mode) | `49875` | -| `configMap` | Config map that contains the files you want to load in MXNet | `nil` | -| `cloneFilesFromGit.enabled` | Enable in order to download files from git repository | `false` | -| `cloneFilesFromGit.repository` | Repository that holds the files | `nil` | -| `cloneFilesFromGit.revision` | Revision from the repository to checkout | `master` | -| `commonExtraEnvVars` | Extra environment variables to add to server, scheduler and worker nodes | `nil` | -| `workerExtraEnvVars` | Extra environment variables to add to the worker nodes | `nil` | -| `serverExtraEnvVars` | Extra environment variables to add to the server nodes | `nil` | -| `schedulerExtraEnvVars` | Extra environment variables to add to the scheduler node | `nil` | -| `sidecars` | Attach additional containers to the pods (scheduler, worker and server nodes) | `nil` | -| `initContainers` | Attach additional init containers to the pods (scheduler, worker and server nodes) | `nil` | -| `existingSecret` | Name of a secret with sensitive data to mount in the pods | `nil` | -| `nodeSelector` | Node labels for pod assignment (this value is evaluated as a template) | `{}` | -| `tolerations` | Toleration labels for pod assignment (this value is evaluated as a template) | `[]` | -| `affinity` | Map of node/pod affinities (this value is evaluated as a template) | `{}` | -| `resources` | Pod resources | `{}` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `5` | -| `livenessProbe.periodSeconds` | How often to perform the probe | `5` | -| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `readinessProbe.enabled` | Enable/disable the Readiness probe | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | -| `readinessProbe.periodSeconds` | How often to perform the probe | `5` | -| `readinessProbe.timeoutSeconds` | When the probe times out | `1` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `persistence.enabled` | Use a PVC to persist data | `false` | -| `persistence.mountPath` | Path to mount the volume at | `/bitnami/mxnet` | -| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | -| `persistence.size` | Size of data volume | `8Gi` | -| `persistence.annotations` | Persistent Volume annotations | `{}` | +| Parameter | Description | Default | +| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | MXNet image registry | `docker.io` | +| `image.repository` | MXNet image name | `bitnami/MXNet` | +| `image.tag` | MXNet image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug logs should be enabled | `false` | +| `nameOverride` | String to partially override mxnet.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override mxnet.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `git.registry` | Git image registry | `docker.io` | +| `git.repository` | Git image name | `bitnami/git` | +| `git.tag` | Git image tag | `{TAG_NAME}` | +| `git.pullPolicy` | Git image pull policy | `IfNotPresent` | +| `git.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `service.type` | Kubernetes service type | `ClusterIP` | +| `entrypoint.file` | Main entrypoint to your application. If not speficied, it will be a `sleep infinity` command | `''` | +| `entrypoint.args` | Args required by your entrypoint | `nil` | +| `entrypoint.workDir` | Working directory for launching the entrypoint | `'/app'` | +| `podManagementPolicy` | StatefulSet (worker and server nodes) pod management policy | `Parallel` | +| `mode` | Run MXNet in standalone or distributed mode (possible values: `standalone`, `distributed`) | `standalone` | +| `serverCount` | Number of server nodes that will execute your code | `1` | +| `workerCount` | Number of worker nodes that will execute your code | `1` | +| `schedulerPort` | MXNet scheduler port (only for distributed mode) | `49875` | +| `configMap` | Config map that contains the files you want to load in MXNet | `nil` | +| `cloneFilesFromGit.enabled` | Enable in order to download files from git repository | `false` | +| `cloneFilesFromGit.repository` | Repository that holds the files | `nil` | +| `cloneFilesFromGit.revision` | Revision from the repository to checkout | `master` | +| `commonExtraEnvVars` | Extra environment variables to add to server, scheduler and worker nodes | `nil` | +| `workerExtraEnvVars` | Extra environment variables to add to the worker nodes | `nil` | +| `serverExtraEnvVars` | Extra environment variables to add to the server nodes | `nil` | +| `schedulerExtraEnvVars` | Extra environment variables to add to the scheduler node | `nil` | +| `sidecars` | Attach additional containers to the pods (scheduler, worker and server nodes) | `nil` | +| `initContainers` | Attach additional init containers to the pods (scheduler, worker and server nodes) | `nil` | +| `existingSecret` | Name of a secret with sensitive data to mount in the pods | `nil` | +| `nodeSelector` | Node labels for pod assignment (this value is evaluated as a template) | `{}` | +| `tolerations` | Toleration labels for pod assignment (this value is evaluated as a template) | `[]` | +| `affinity` | Map of node/pod affinities (this value is evaluated as a template) | `{}` | +| `resources` | Pod resources | `{}` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `5` | +| `livenessProbe.periodSeconds` | How often to perform the probe | `5` | +| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `readinessProbe.enabled` | Enable/disable the Readiness probe | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | +| `readinessProbe.periodSeconds` | How often to perform the probe | `5` | +| `readinessProbe.timeoutSeconds` | When the probe times out | `1` | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `persistence.enabled` | Use a PVC to persist data | `false` | +| `persistence.mountPath` | Path to mount the volume at | `/bitnami/mxnet` | +| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | +| `persistence.size` | Size of data volume | `8Gi` | +| `persistence.annotations` | Persistent Volume annotations | `{}` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -193,7 +201,7 @@ $ helm install --name my-release \ bitnami/mxnet ``` -In case you want to add a file that includes sensitive information, pass a secret object using the `existingSecret` parameter. All the files in the secret will be mounted in the `/secrets` folder. +In case you want to add a file that includes sensitive information, pass a secret object using the `existingSecret` parameter. All the files in the secret will be mounted in the `/secrets` folder. ### Distributed training example @@ -267,6 +275,15 @@ The [Bitnami MXNet](https://github.com/bitnami/bitnami-docker-mxnet) image can p The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Sidecars and Init Containers If you have a need for additional containers to run within the same pod as MXNet (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. diff --git a/bitnami/mxnet/templates/_helpers.tpl b/bitnami/mxnet/templates/_helpers.tpl index 42bcbecea..0a58ef051 100644 --- a/bitnami/mxnet/templates/_helpers.tpl +++ b/bitnami/mxnet/templates/_helpers.tpl @@ -105,7 +105,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -113,8 +113,11 @@ imagePullSecrets: {{- range .Values.git.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -122,6 +125,9 @@ imagePullSecrets: {{- range .Values.git.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} {{- end -}} @@ -185,3 +191,26 @@ mxnet: serverCount Please set a valid worker count size (--set serverCount=X) {{- end -}} {{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "mxnet.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/mxnet/templates/server-statefulset.yml b/bitnami/mxnet/templates/server-statefulset.yml index 52103aec3..1ece57efb 100644 --- a/bitnami/mxnet/templates/server-statefulset.yml +++ b/bitnami/mxnet/templates/server-statefulset.yml @@ -41,8 +41,8 @@ spec: {{- with .Values.affinity }} affinity: {{ tpl (toYaml .) $ | nindent 8 }} {{- end }} - {{- if .Values.cloneFilesFromGit.enabled }} initContainers: + {{- if .Values.cloneFilesFromGit.enabled }} - name: git-clone-repository image: {{ include "git.image" . }} imagePullPolicy: {{ .Values.git.pullPolicy | quote }} @@ -55,6 +55,18 @@ spec: - name: git-cloned-files mountPath: /app {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: "{{ template "mxnet.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} {{- if .Values.initContainers }} {{- toYaml .Values.initContainers | nindent 6 }} {{- end }} @@ -63,7 +75,7 @@ spec: workingDir: {{ .Values.entrypoint.workDir }} image: {{ include "mxnet.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy }} - command: + command: - bash - -c - | @@ -88,7 +100,7 @@ spec: value: {{ .Values.schedulerPort | quote }} {{- if .Values.commonExtraEnvVars }} {{- include "mxnet.parseEnvVars" .Values.commonExtraEnvVars | nindent 8 }} - {{- end }} + {{- end }} {{- if .Values.serverExtraEnvVars }} {{- include "mxnet.parseEnvVars" .Values.serverExtraVars | nindent 8 }} {{- end }} @@ -183,4 +195,4 @@ spec: - name: data emptyDir: {} {{- end }} -{{- end }} \ No newline at end of file +{{- end }} diff --git a/bitnami/mxnet/templates/standalone-deployment.yaml b/bitnami/mxnet/templates/standalone-deployment.yaml index fae98d893..0a6cd5be2 100644 --- a/bitnami/mxnet/templates/standalone-deployment.yaml +++ b/bitnami/mxnet/templates/standalone-deployment.yaml @@ -40,8 +40,8 @@ spec: {{- with .Values.affinity }} affinity: {{ tpl (toYaml .) $ | nindent 8 }} {{- end }} - {{- if .Values.cloneFilesFromGit.enabled }} initContainers: + {{- if .Values.cloneFilesFromGit.enabled }} - name: git-clone-repository image: {{ include "git.image" . }} imagePullPolicy: {{ .Values.git.pullPolicy | quote }} @@ -54,6 +54,18 @@ spec: - name: git-cloned-files mountPath: /app {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: "{{ template "mxnet.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} {{- if .Values.initContainers }} {{- toYaml .Values.initContainers | nindent 6 }} {{- end }} @@ -62,7 +74,7 @@ spec: workingDir: {{ .Values.entrypoint.workDir }} image: {{ include "mxnet.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy }} - command: + command: - bash - -c - | @@ -70,7 +82,7 @@ spec: env: {{- if .Values.commonExtraEnvVars }} {{- include "mxnet.parseEnvVars" .Values.commonExtraEnvVars | nindent 8 }} - {{- end }} + {{- end }} ports: - name: mxnet containerPort: {{ .Values.schedulerPort }} diff --git a/bitnami/mxnet/templates/worker-statefulset.yml b/bitnami/mxnet/templates/worker-statefulset.yml index 1d2c112e8..9cd4b2bb8 100644 --- a/bitnami/mxnet/templates/worker-statefulset.yml +++ b/bitnami/mxnet/templates/worker-statefulset.yml @@ -41,8 +41,8 @@ spec: {{- with .Values.affinity }} affinity: {{ tpl (toYaml .) $ | nindent 8 }} {{- end }} - {{- if .Values.cloneFilesFromGit.enabled }} initContainers: + {{- if .Values.cloneFilesFromGit.enabled }} - name: git-clone-repository image: {{ include "git.image" . }} imagePullPolicy: {{ .Values.git.pullPolicy | quote }} @@ -55,6 +55,18 @@ spec: - name: git-cloned-files mountPath: /app {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: "{{ template "mxnet.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} {{- if .Values.initContainers }} {{- toYaml .Values.initContainers | nindent 6 }} {{- end }} @@ -63,7 +75,7 @@ spec: workingDir: {{ .Values.entrypoint.workDir }} image: {{ include "mxnet.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy }} - command: + command: - bash - -c - | @@ -88,7 +100,7 @@ spec: value: {{ .Values.schedulerPort | quote }} {{- if .Values.commonExtraEnvVars }} {{- include "mxnet.parseEnvVars" .Values.commonExtraEnvVars | nindent 8 }} - {{- end }} + {{- end }} {{- if .Values.workerExtraEnvVars }} {{- include "mxnet.parseEnvVars" .Values.workerExtraVars | nindent 8 }} {{- end }} @@ -183,4 +195,4 @@ spec: - name: data emptyDir: {} {{- end }} -{{- end }} \ No newline at end of file +{{- end }} diff --git a/bitnami/mxnet/values-production.yaml b/bitnami/mxnet/values-production.yaml index 18455793d..4bbd6ad23 100644 --- a/bitnami/mxnet/values-production.yaml +++ b/bitnami/mxnet/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/mxnet - tag: 1.4.1-debian-9-r9 + tag: 1.5.0-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -31,6 +31,32 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override mxnet.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override mxnet.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Bitnami git image version ## ref: https://hub.docker.com/r/bitnami/git/tags/ ## diff --git a/bitnami/mxnet/values.yaml b/bitnami/mxnet/values.yaml index 937a68dd0..2c8fd189e 100644 --- a/bitnami/mxnet/values.yaml +++ b/bitnami/mxnet/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/mxnet - tag: 1.4.1-debian-9-r9 + tag: 1.5.0-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -31,6 +31,32 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override mxnet.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override mxnet.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Bitnami git image version ## ref: https://hub.docker.com/r/bitnami/git/tags/ ## diff --git a/bitnami/mysql/Chart.yaml b/bitnami/mysql/Chart.yaml index fc630187d..783fb64c4 100644 --- a/bitnami/mysql/Chart.yaml +++ b/bitnami/mysql/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: mysql -version: 5.0.7 -appVersion: 8.0.16 +version: 6.2.1 +appVersion: 8.0.17 description: Chart to create a Highly available MySQL cluster keywords: - mysql diff --git a/bitnami/mysql/README.md b/bitnami/mysql/README.md index 91d0b722f..683b64b9b 100644 --- a/bitnami/mysql/README.md +++ b/bitnami/mysql/README.md @@ -45,82 +45,90 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the MySQL chart and their default values. -| Parameter | Description | Default | -|-------------------------------------------|----------------------------------------------------------------------------|-------------------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | MySQL image registry | `docker.io` | -| `image.repository` | MySQL Image name | `bitnami/mysql` | -| `image.tag` | MySQL Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | MySQL image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `service.type` | Kubernetes service type | `ClusterIP` | -| `service.port` | MySQL service port | `3306` | -| `root.password` | Password for the `root` user | _random 10 character alphanumeric string_ | -| `root.forcePassword` | Force users to specify a password. That is required for 'helm upgrade' to work properly | `false` | -| `db.user` | Username of new user to create (should be different from replication.user) | `nil` | -| `db.password` | Password for the new user | _random 10 character alphanumeric string if `db.user` is defined_ | -| `db.name` | Name for new database to create | `my_database` | -| `db.forcePassword` | Force users to specify a password. That is required for 'helm upgrade' to work properly | `false` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | -| `replication.enabled` | MySQL replication enabled | `true` | -| `replication.user` | MySQL replication user (should be different from db.user) | `replicator` | -| `replication.password` | MySQL replication user password | _random 10 character alphanumeric string_ | -| `replication.forcePassword` | Force users to specify a password. That is required for 'helm upgrade' to work properly | `false` | -| `master.antiAffinity` | Master pod anti-affinity policy | `soft` | -| `master.updateStrategy.type` | Master statefulset update strategy policy | `RollingUpdate` | -| `master.persistence.enabled` | Enable persistence using a `PersistentVolumeClaim` | `true` | -| `master.persistence.existingClaim` | Provide an existing `PersistentVolumeClaim` | `nil` | -| `master.persistence.mountPath` | Configure `PersistentVolumeClaim` mount path | `/bitnami/mysql` | -| `master.persistence.annotations` | Persistent Volume Claim annotations | `{}` | -| `master.persistence.storageClass` | Persistent Volume Storage Class | `` | -| `master.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | -| `master.persistence.size` | Persistent Volume Size | `8Gi` | -| `master.config` | Config file for the MySQL Master server | `_default values in the values.yaml file_` | -| `master.resources` | CPU/Memory resource requests/limits for master node | `{}` | -| `master.livenessProbe.enabled` | Turn on and off liveness probe (master) | `true` | -| `master.livenessProbe.initialDelaySeconds`| Delay before liveness probe is initiated (master) | `120` | -| `master.livenessProbe.periodSeconds` | How often to perform the probe (master) | `10` | -| `master.livenessProbe.timeoutSeconds` | When the probe times out (master) | `1` | -| `master.livenessProbe.successThreshold` | Minimum consecutive successes for the probe (master) | `1` | -| `master.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe (master) | `3` | -| `master.readinessProbe.enabled` | Turn on and off readiness probe (master) | `true` | -| `master.readinessProbe.initialDelaySeconds`| Delay before readiness probe is initiated (master) | `30` | -| `master.readinessProbe.periodSeconds` | How often to perform the probe (master) | `10` | -| `master.readinessProbe.timeoutSeconds` | When the probe times out (master) | `1` | -| `master.readinessProbe.successThreshold` | Minimum consecutive successes for the probe (master) | `1` | -| `master.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe (master) | `3` | -| `slave.replicas` | Desired number of slave replicas | `1` | -| `slave.antiAffinity` | Slave pod anti-affinity policy | `soft` | -| `slave.updateStrategy.type` | Slave statefulset update strategy policy | `RollingUpdate` | -| `slave.persistence.enabled` | Enable persistence using a `PersistentVolumeClaim` | `true` | -| `slave.persistence.mountPath` | Configure `PersistentVolumeClaim` mount path | `/bitnami/mysql` | -| `slave.persistence.annotations` | Persistent Volume Claim annotations | `{}` | -| `slave.persistence.storageClass` | Persistent Volume Storage Class | `` | -| `slave.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | -| `slave.persistence.size` | Persistent Volume Size | `8Gi` | -| `slave.config` | Config file for the MySQL Slave replicas | `_default values in the values.yaml file_` | -| `slave.resources` | CPU/Memory resource requests/limits for slave node | `{}` | -| `slave.livenessProbe.enabled` | Turn on and off liveness probe (slave) | `true` | -| `slave.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (slave) | `120` | -| `slave.livenessProbe.periodSeconds` | How often to perform the probe (slave) | `10` | -| `slave.livenessProbe.timeoutSeconds` | When the probe times out (slave) | `1` | -| `slave.livenessProbe.successThreshold` | Minimum consecutive successes for the probe (slave) | `1` | -| `slave.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe (slave) | `3` | -| `slave.readinessProbe.enabled` | Turn on and off readiness probe (slave) | `true` | -| `slave.readinessProbe.initialDelaySeconds`| Delay before readiness probe is initiated (slave) | `30` | -| `slave.readinessProbe.periodSeconds` | How often to perform the probe (slave) | `10` | -| `slave.readinessProbe.timeoutSeconds` | When the probe times out (slave) | `1` | -| `slave.readinessProbe.successThreshold` | Minimum consecutive successes for the probe (slave) | `1` | -| `slave.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe (slave) | `3` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image` | Exporter image name | `prom/mysqld-exporter` | -| `metrics.imageTag` | Exporter image tag | `v0.10.0` | -| `metrics.imagePullPolicy` | Exporter image pull policy | `IfNotPresent` | -| `metrics.resources` | Exporter resource requests/limit | `nil` | +| Parameter | Description | Default | +| ------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | MySQL image registry | `docker.io` | +| `image.repository` | MySQL Image name | `bitnami/mysql` | +| `image.tag` | MySQL Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | MySQL image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override mysql.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override mysql.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `service.type` | Kubernetes service type | `ClusterIP` | +| `service.port` | MySQL service port | `3306` | +| `root.password` | Password for the `root` user | _random 10 character alphanumeric string_ | +| `root.forcePassword` | Force users to specify a password. That is required for 'helm upgrade' to work properly | `false` | +| `db.user` | Username of new user to create (should be different from replication.user) | `nil` | +| `db.password` | Password for the new user | _random 10 character alphanumeric string if `db.user` is defined_ | +| `db.name` | Name for new database to create | `my_database` | +| `db.forcePassword` | Force users to specify a password. That is required for 'helm upgrade' to work properly | `false` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | +| `replication.enabled` | MySQL replication enabled | `true` | +| `replication.user` | MySQL replication user (should be different from db.user) | `replicator` | +| `replication.password` | MySQL replication user password | _random 10 character alphanumeric string_ | +| `replication.forcePassword` | Force users to specify a password. That is required for 'helm upgrade' to work properly | `false` | +| `master.antiAffinity` | Master pod anti-affinity policy | `soft` | +| `master.updateStrategy.type` | Master statefulset update strategy policy | `RollingUpdate` | +| `master.persistence.enabled` | Enable persistence using a `PersistentVolumeClaim` | `true` | +| `master.persistence.existingClaim` | Provide an existing `PersistentVolumeClaim` | `nil` | +| `master.persistence.mountPath` | Configure `PersistentVolumeClaim` mount path | `/bitnami/mysql` | +| `master.persistence.annotations` | Persistent Volume Claim annotations | `{}` | +| `master.persistence.storageClass` | Persistent Volume Storage Class | `` | +| `master.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | +| `master.persistence.size` | Persistent Volume Size | `8Gi` | +| `master.config` | Config file for the MySQL Master server | `_default values in the values.yaml file_` | +| `master.resources` | CPU/Memory resource requests/limits for master node | `{}` | +| `master.livenessProbe.enabled` | Turn on and off liveness probe (master) | `true` | +| `master.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (master) | `120` | +| `master.livenessProbe.periodSeconds` | How often to perform the probe (master) | `10` | +| `master.livenessProbe.timeoutSeconds` | When the probe times out (master) | `1` | +| `master.livenessProbe.successThreshold` | Minimum consecutive successes for the probe (master) | `1` | +| `master.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe (master) | `3` | +| `master.readinessProbe.enabled` | Turn on and off readiness probe (master) | `true` | +| `master.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (master) | `30` | +| `master.readinessProbe.periodSeconds` | How often to perform the probe (master) | `10` | +| `master.readinessProbe.timeoutSeconds` | When the probe times out (master) | `1` | +| `master.readinessProbe.successThreshold` | Minimum consecutive successes for the probe (master) | `1` | +| `master.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe (master) | `3` | +| `slave.replicas` | Desired number of slave replicas | `1` | +| `slave.antiAffinity` | Slave pod anti-affinity policy | `soft` | +| `slave.updateStrategy.type` | Slave statefulset update strategy policy | `RollingUpdate` | +| `slave.persistence.enabled` | Enable persistence using a `PersistentVolumeClaim` | `true` | +| `slave.persistence.mountPath` | Configure `PersistentVolumeClaim` mount path | `/bitnami/mysql` | +| `slave.persistence.annotations` | Persistent Volume Claim annotations | `{}` | +| `slave.persistence.storageClass` | Persistent Volume Storage Class | `` | +| `slave.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | +| `slave.persistence.size` | Persistent Volume Size | `8Gi` | +| `slave.config` | Config file for the MySQL Slave replicas | `_default values in the values.yaml file_` | +| `slave.resources` | CPU/Memory resource requests/limits for slave node | `{}` | +| `slave.livenessProbe.enabled` | Turn on and off liveness probe (slave) | `true` | +| `slave.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (slave) | `120` | +| `slave.livenessProbe.periodSeconds` | How often to perform the probe (slave) | `10` | +| `slave.livenessProbe.timeoutSeconds` | When the probe times out (slave) | `1` | +| `slave.livenessProbe.successThreshold` | Minimum consecutive successes for the probe (slave) | `1` | +| `slave.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe (slave) | `3` | +| `slave.readinessProbe.enabled` | Turn on and off readiness probe (slave) | `true` | +| `slave.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (slave) | `30` | +| `slave.readinessProbe.periodSeconds` | How often to perform the probe (slave) | `10` | +| `slave.readinessProbe.timeoutSeconds` | When the probe times out (slave) | `1` | +| `slave.readinessProbe.successThreshold` | Minimum consecutive successes for the probe (slave) | `1` | +| `slave.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe (slave) | `3` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image` | Exporter image name | `bitnami/mysqld-exporter` | +| `metrics.imageTag` | Exporter image tag | `{TAG_NAME}` | +| `metrics.imagePullPolicy` | Exporter image pull policy | `IfNotPresent` | +| `metrics.resources` | Exporter resource requests/limit | `nil` | The above parameters map to the env variables defined in [bitnami/mysql](http://github.com/bitnami/bitnami-docker-mysql). For more information please refer to the [bitnami/mysql](http://github.com/bitnami/bitnami-docker-mysql) image documentation. @@ -192,6 +200,15 @@ The [Bitnami MySQL](https://github.com/bitnami/bitnami-docker-mysql) image store The chart mounts a [Persistent Volume](kubernetes.io/docs/user-guide/persistent-volumes/) volume at this location. The volume is created using dynamic volume provisioning by default. An existing PersistentVolumeClaim can be defined. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Upgrading It's necessary to set the `root.password` parameter when upgrading for readiness/liveness probes to work properly. When you install this chart for the first time, some notes will be displayed providing the credentials you must use under the 'Administrator credentials' section. Please note down the password and run the command below to upgrade your chart: diff --git a/bitnami/mysql/templates/NOTES.txt b/bitnami/mysql/templates/NOTES.txt index 44d09edca..721a98c6c 100644 --- a/bitnami/mysql/templates/NOTES.txt +++ b/bitnami/mysql/templates/NOTES.txt @@ -7,7 +7,7 @@ Tip: Services: - echo Master: {{ template "fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.service.port }} + echo Master: {{ template "mysql.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.service.port }} {{- if .Values.replication.enabled }} echo Slave: {{ template "mysql.slave.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.service.port }} {{- end }} @@ -15,17 +15,17 @@ Services: Administrator credentials: echo Username: root - echo Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.mysql-root-password}" | base64 --decode) + echo Password : $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "mysql.fullname" . }} -o jsonpath="{.data.mysql-root-password}" | base64 --decode) To connect to your database: 1. Run a pod that you can use as a client: - kubectl run {{ template "fullname" . }}-client --rm --tty -i --restart='Never' --image {{ template "mysql.image" . }} --namespace {{ .Release.Namespace }} --command -- bash + kubectl run {{ template "mysql.fullname" . }}-client --rm --tty -i --restart='Never' --image {{ template "mysql.image" . }} --namespace {{ .Release.Namespace }} --command -- bash 2. To connect to master service (read/write): - mysql -h {{ template "fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} -uroot -p {{ .Values.db.name }} + mysql -h {{ template "mysql.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} -uroot -p {{ .Values.db.name }} {{- if .Values.replication.enabled }} @@ -38,7 +38,7 @@ To upgrade this helm chart: 1. Obtain the password as described on the 'Administrator credentials' section and set the 'root.password' parameter as shown below: - ROOT_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.mysql-root-password}" | base64 --decode) + ROOT_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "mysql.fullname" . }} -o jsonpath="{.data.mysql-root-password}" | base64 --decode) helm upgrade {{ .Release.Name }} bitnami/mysql --set root.password=$ROOT_PASSWORD {{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} diff --git a/bitnami/mysql/templates/_helpers.tpl b/bitnami/mysql/templates/_helpers.tpl index 30be81665..3c6387d7c 100644 --- a/bitnami/mysql/templates/_helpers.tpl +++ b/bitnami/mysql/templates/_helpers.tpl @@ -2,26 +2,52 @@ {{/* Expand the name of the chart. */}} -{{- define "name" -}} +{{- define "mysql.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end }} +{{- end -}} {{/* Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} -{{- define "fullname" -}} +{{- define "mysql.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end }} +{{- end -}} +{{- end -}} +{{- end -}} {{- define "mysql.master.fullname" -}} -{{- printf "%s-%s" .Release.Name "mysql-master" | trunc 63 | trimSuffix "-" -}} -{{- end }} +{{- if .Values.fullnameOverride -}} +{{- printf "%s-%s" .Values.fullnameOverride "master" | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- printf "%s-%s" .Release.Name "master" | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s-%s" .Release.Name $name "master" | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} {{- define "mysql.slave.fullname" -}} -{{- printf "%s-%s" .Release.Name "mysql-slave" | trunc 63 | trimSuffix "-" -}} -{{- end }} +{{- if .Values.fullnameOverride -}} +{{- printf "%s-%s" .Values.fullnameOverride "slave" | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- printf "%s-%s" .Release.Name "slave" | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s-%s" .Release.Name $name "slave" | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} {{- define "mysql.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} @@ -88,7 +114,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -96,8 +122,11 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -105,5 +134,31 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "mysql.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/bitnami/mysql/templates/initialization-configmap.yaml b/bitnami/mysql/templates/initialization-configmap.yaml index 3db8f2298..14fa61e90 100644 --- a/bitnami/mysql/templates/initialization-configmap.yaml +++ b/bitnami/mysql/templates/initialization-configmap.yaml @@ -4,7 +4,7 @@ kind: ConfigMap metadata: name: {{ template "mysql.master.fullname" . }}-init-scripts labels: - app: {{ template "name" . }} + app: {{ template "mysql.name" . }} component: "master" chart: {{ template "mysql.chart" . }} release: {{ .Release.Name | quote }} diff --git a/bitnami/mysql/templates/master-configmap.yaml b/bitnami/mysql/templates/master-configmap.yaml index 6a38e7875..8cf5eb5c8 100644 --- a/bitnami/mysql/templates/master-configmap.yaml +++ b/bitnami/mysql/templates/master-configmap.yaml @@ -4,7 +4,7 @@ kind: ConfigMap metadata: name: {{ template "mysql.master.fullname" . }} labels: - app: {{ template "name" . }} + app: {{ template "mysql.name" . }} component: "master" chart: {{ template "mysql.chart" . }} release: {{ .Release.Name | quote }} diff --git a/bitnami/mysql/templates/master-statefulset.yaml b/bitnami/mysql/templates/master-statefulset.yaml index 657cbf934..428be1bf8 100644 --- a/bitnami/mysql/templates/master-statefulset.yaml +++ b/bitnami/mysql/templates/master-statefulset.yaml @@ -3,7 +3,7 @@ kind: StatefulSet metadata: name: {{ template "mysql.master.fullname" . }} labels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" chart: {{ template "mysql.chart" . }} component: "master" release: {{ .Release.Name | quote }} @@ -11,7 +11,7 @@ metadata: spec: selector: matchLabels: - app: {{ template "name" . }} + app: {{ template "mysql.name" . }} release: "{{ .Release.Name }}" component: "master" serviceName: "{{ template "mysql.master.fullname" . }}" @@ -24,7 +24,7 @@ spec: template: metadata: labels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" chart: {{ template "mysql.chart" . }} component: "master" release: {{ .Release.Name | quote }} @@ -51,7 +51,7 @@ spec: - topologyKey: "kubernetes.io/hostname" labelSelector: matchLabels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" release: "{{ .Release.Name }}" {{- else if eq .Values.master.antiAffinity "soft" }} affinity: @@ -62,10 +62,23 @@ spec: topologyKey: kubernetes.io/hostname labelSelector: matchLabels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" release: "{{ .Release.Name }}" {{- end }} {{- include "mysql.imagePullSecrets" . | indent 6 }} + {{- if and .Values.volumePermissions.enabled .Values.master.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "mysql.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.master.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: "{{ .Values.master.persistence.mountPath }}" + {{- end }} containers: - name: "mysql" image: {{ template "mysql.image" . }} @@ -74,7 +87,7 @@ spec: - name: MYSQL_ROOT_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "mysql.fullname" . }} key: mysql-root-password {{- if .Values.db.user }} - name: MYSQL_USER @@ -82,7 +95,7 @@ spec: - name: MYSQL_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "mysql.fullname" . }} key: mysql-password {{- end }} - name: MYSQL_DATABASE @@ -95,7 +108,7 @@ spec: - name: MYSQL_REPLICATION_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "mysql.fullname" . }} key: mysql-replication-password {{- end }} ports: @@ -147,7 +160,7 @@ spec: - name: MYSQL_ROOT_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "mysql.fullname" . }} key: mysql-root-password command: [ 'sh', '-c', 'DATA_SOURCE_NAME="root:$MYSQL_ROOT_PASSWORD@(localhost:3306)/" /bin/mysqld_exporter' ] ports: @@ -189,7 +202,7 @@ spec: - metadata: name: data labels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" component: "master" release: {{ .Release.Name | quote }} heritage: {{ .Release.Service | quote }} diff --git a/bitnami/mysql/templates/master-svc.yaml b/bitnami/mysql/templates/master-svc.yaml index 0aabbec27..7d9210204 100644 --- a/bitnami/mysql/templates/master-svc.yaml +++ b/bitnami/mysql/templates/master-svc.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "fullname" . }} + name: {{ template "mysql.fullname" . }} labels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" component: "master" chart: {{ template "mysql.chart" . }} release: {{ .Release.Name | quote }} @@ -20,6 +20,6 @@ spec: targetPort: metrics {{- end }} selector: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" component: "master" release: "{{ .Release.Name }}" diff --git a/bitnami/mysql/templates/secrets.yaml b/bitnami/mysql/templates/secrets.yaml index 483517def..1df6c8d70 100644 --- a/bitnami/mysql/templates/secrets.yaml +++ b/bitnami/mysql/templates/secrets.yaml @@ -2,9 +2,9 @@ apiVersion: v1 kind: Secret metadata: - name: {{ template "fullname" . }} + name: {{ template "mysql.fullname" . }} labels: - app: {{ template "name" . }} + app: {{ template "mysql.name" . }} chart: {{ template "mysql.chart" . }} release: {{ .Release.Name | quote }} heritage: {{ .Release.Service | quote }} @@ -35,4 +35,4 @@ data: mysql-replication-password: {{ required "A MySQL Replication Password is required!" .Values.replication.password }} {{- end }} {{- end }} -{{- end }} \ No newline at end of file +{{- end }} diff --git a/bitnami/mysql/templates/slave-configmap.yaml b/bitnami/mysql/templates/slave-configmap.yaml index 1ba17ec0b..0f83208c7 100644 --- a/bitnami/mysql/templates/slave-configmap.yaml +++ b/bitnami/mysql/templates/slave-configmap.yaml @@ -4,7 +4,7 @@ kind: ConfigMap metadata: name: {{ template "mysql.slave.fullname" . }} labels: - app: {{ template "name" . }} + app: {{ template "mysql.name" . }} component: "slave" chart: {{ template "mysql.chart" . }} release: {{ .Release.Name | quote }} diff --git a/bitnami/mysql/templates/slave-statefulset.yaml b/bitnami/mysql/templates/slave-statefulset.yaml index ce80d8841..783422d7a 100644 --- a/bitnami/mysql/templates/slave-statefulset.yaml +++ b/bitnami/mysql/templates/slave-statefulset.yaml @@ -4,7 +4,7 @@ kind: StatefulSet metadata: name: {{ template "mysql.slave.fullname" . }} labels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" chart: {{ template "mysql.chart" . }} component: "slave" release: {{ .Release.Name | quote }} @@ -12,7 +12,7 @@ metadata: spec: selector: matchLabels: - app: {{ template "name" . }} + app: {{ template "mysql.name" . }} release: "{{ .Release.Name }}" component: "slave" serviceName: "{{ template "mysql.slave.fullname" . }}" @@ -25,7 +25,7 @@ spec: template: metadata: labels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" chart: {{ template "mysql.chart" . }} component: "slave" release: {{ .Release.Name | quote }} @@ -52,7 +52,7 @@ spec: - topologyKey: "kubernetes.io/hostname" labelSelector: matchLabels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" release: "{{ .Release.Name }}" {{- else if eq .Values.slave.antiAffinity "soft" }} affinity: @@ -63,10 +63,23 @@ spec: topologyKey: kubernetes.io/hostname labelSelector: matchLabels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" release: "{{ .Release.Name }}" {{- end }} {{- include "mysql.imagePullSecrets" . | indent 6 }} + {{- if and .Values.volumePermissions.enabled .Values.slave.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "mysql.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.slave.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: "{{ .Values.slave.persistence.mountPath }}" + {{- end }} containers: - name: "mysql" image: {{ template "mysql.image" . }} @@ -75,7 +88,7 @@ spec: - name: MYSQL_REPLICATION_MODE value: "slave" - name: MYSQL_MASTER_HOST - value: {{ template "fullname" . }} + value: {{ template "mysql.fullname" . }} - name: MYSQL_MASTER_PORT_NUMBER value: "3306" - name: MYSQL_MASTER_ROOT_USER @@ -83,14 +96,14 @@ spec: - name: MYSQL_MASTER_ROOT_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "mysql.fullname" . }} key: mysql-root-password - name: MYSQL_REPLICATION_USER value: "{{ .Values.replication.user }}" - name: MYSQL_REPLICATION_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "mysql.fullname" . }} key: mysql-replication-password ports: - name: mysql @@ -133,7 +146,7 @@ spec: - name: MYSQL_MASTER_ROOT_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "mysql.fullname" . }} key: mysql-root-password command: [ 'sh', '-c', 'DATA_SOURCE_NAME="root:$MYSQL_MASTER_ROOT_PASSWORD@(localhost:3306)/" /bin/mysqld_exporter' ] ports: @@ -165,7 +178,7 @@ spec: - metadata: name: data labels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" component: "slave" release: {{ .Release.Name | quote }} heritage: {{ .Release.Service | quote }} diff --git a/bitnami/mysql/templates/slave-svc.yaml b/bitnami/mysql/templates/slave-svc.yaml index 392712fd0..65fc5537f 100644 --- a/bitnami/mysql/templates/slave-svc.yaml +++ b/bitnami/mysql/templates/slave-svc.yaml @@ -4,7 +4,7 @@ kind: Service metadata: name: {{ template "mysql.slave.fullname" . }} labels: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" chart: {{ template "mysql.chart" . }} component: "slave" release: {{ .Release.Name | quote }} @@ -21,7 +21,7 @@ spec: targetPort: metrics {{- end }} selector: - app: "{{ template "name" . }}" + app: "{{ template "mysql.name" . }}" component: "slave" release: "{{ .Release.Name }}" {{- end }} diff --git a/bitnami/mysql/values-production.yaml b/bitnami/mysql/values-production.yaml index 16217d4f8..889dbbb23 100644 --- a/bitnami/mysql/values-production.yaml +++ b/bitnami/mysql/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/mysql - tag: 8.0.16-debian-9-r33 + tag: 8.0.17-debian-9-r1 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,32 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override mysql.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override mysql.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + service: ## Kubernetes service type type: ClusterIP @@ -265,8 +291,8 @@ metrics: enabled: true image: registry: docker.io - repository: prom/mysqld-exporter - tag: v0.10.0 + repository: bitnami/mysqld-exporter + tag: 0.12.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/mysql/values.yaml b/bitnami/mysql/values.yaml index a8739f14f..0387f3407 100644 --- a/bitnami/mysql/values.yaml +++ b/bitnami/mysql/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/mysql - tag: 8.0.16-debian-9-r33 + tag: 8.0.17-debian-9-r1 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,32 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override mysql.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override mysql.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + service: ## Kubernetes service type type: ClusterIP @@ -265,8 +291,8 @@ metrics: enabled: false image: registry: docker.io - repository: prom/mysqld-exporter - tag: v0.10.0 + repository: bitnami/mysqld-exporter + tag: 0.12.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/nginx-ingress-controller/Chart.yaml b/bitnami/nginx-ingress-controller/Chart.yaml index ebe692e39..70f85f96b 100644 --- a/bitnami/nginx-ingress-controller/Chart.yaml +++ b/bitnami/nginx-ingress-controller/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: nginx-ingress-controller -version: 3.4.9 +version: 4.0.0 appVersion: 0.24.1 description: Chart for the nginx Ingress controller keywords: diff --git a/bitnami/nginx-ingress-controller/README.md b/bitnami/nginx-ingress-controller/README.md index 48f23b084..dfcdf8aee 100644 --- a/bitnami/nginx-ingress-controller/README.md +++ b/bitnami/nginx-ingress-controller/README.md @@ -55,6 +55,8 @@ Parameter | Description | Default `image.repository` | Controller container image repository | `bitnami/nginx-ingress-controller` `image.tag` | Controller container image tag | `{TAG_NAME}` `image.pullPolicy` | Controller container image pull policy | `IfNotPresent` +`nameOverride` | String to partially override nginx-ingress-controller.fullname template with a string (will prepend the release name) | `nil` +`fullnameOverride` | String to fully override nginx-ingress-controller.fullname template with a string | `nil` `config` | Nginx ConfigMap entries | `use-geoip: "false", use-geoip2: "true"` `hostNetwork` | If the nginx deployment / daemonset should run on the host's network namespace. Do not set this when `service.externalIPs` is set and `kube-proxy` is used as there will be a port-conflict for port `80` | false `defaultBackendService` | Default 404 backend service; required only if `defaultBackend.enabled = false` | `""` diff --git a/bitnami/nginx-ingress-controller/templates/_helpers.tpl b/bitnami/nginx-ingress-controller/templates/_helpers.tpl index 6c1a75c35..53f0c01e7 100644 --- a/bitnami/nginx-ingress-controller/templates/_helpers.tpl +++ b/bitnami/nginx-ingress-controller/templates/_helpers.tpl @@ -11,6 +11,9 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "nginx-ingress.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} {{- if contains $name .Release.Name -}} {{- .Release.Name | trunc 63 | trimSuffix "-" -}} @@ -18,6 +21,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} {{- end -}} +{{- end -}} {{/* Construct the path for the publish-service. diff --git a/bitnami/nginx-ingress-controller/values-production.yaml b/bitnami/nginx-ingress-controller/values-production.yaml index 89f81d90d..71a24ca62 100644 --- a/bitnami/nginx-ingress-controller/values-production.yaml +++ b/bitnami/nginx-ingress-controller/values-production.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override nginx-ingress-controller.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override nginx-ingress-controller.fullname template +## +# fullnameOverride: + config: use-geoip: "false" use-geoip2: "true" diff --git a/bitnami/nginx-ingress-controller/values.yaml b/bitnami/nginx-ingress-controller/values.yaml index 0547741c0..8fbb396dd 100644 --- a/bitnami/nginx-ingress-controller/values.yaml +++ b/bitnami/nginx-ingress-controller/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override nginx-ingress-controller.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override nginx-ingress-controller.fullname template +## +# fullnameOverride: + config: use-geoip: "false" use-geoip2: "true" diff --git a/bitnami/nginx/Chart.yaml b/bitnami/nginx/Chart.yaml index 440bbc959..207713ccc 100644 --- a/bitnami/nginx/Chart.yaml +++ b/bitnami/nginx/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: nginx -version: 3.4.0 +version: 4.1.0 appVersion: 1.16.0 description: Chart for the nginx server keywords: diff --git a/bitnami/nginx/README.md b/bitnami/nginx/README.md index 5354bdd74..9fc981d2f 100644 --- a/bitnami/nginx/README.md +++ b/bitnami/nginx/README.md @@ -51,12 +51,14 @@ The following tables lists the configurable parameters of the NGINX Open Source | `image.tag` | NGINX Image tag | `{TAG_NAME}` | | `image.pullPolicy` | NGINX image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override nginx.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override nginx.fullname template with a string | `nil` | | `serverBlock` | Custom NGINX server block | `nil` | | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Promethus exporter image registry | `docker.io` | -| `metrics.image.repository` | Promethus exporter image name | `nginx/nginx-prometheus-exporter` | -| `metrics.image.tag` | Promethus exporter image tag | `0.1.0` | +| `metrics.image.repository` | Promethus exporter image name | `bitnami/nginx-exporter` | +| `metrics.image.tag` | Promethus exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9113"}` | diff --git a/bitnami/nginx/templates/_helpers.tpl b/bitnami/nginx/templates/_helpers.tpl index 75b6ee1eb..7612538a8 100644 --- a/bitnami/nginx/templates/_helpers.tpl +++ b/bitnami/nginx/templates/_helpers.tpl @@ -2,17 +2,25 @@ {{/* Expand the name of the chart. */}} -{{- define "name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- define "nginx.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* Create a default fully qualified app name. We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} -{{- define "fullname" -}} +{{- define "nginx.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} {{- end -}} {{/* diff --git a/bitnami/nginx/templates/deployment.yaml b/bitnami/nginx/templates/deployment.yaml index 35d824c28..a3b3bce71 100644 --- a/bitnami/nginx/templates/deployment.yaml +++ b/bitnami/nginx/templates/deployment.yaml @@ -1,22 +1,22 @@ apiVersion: extensions/v1beta1 kind: Deployment metadata: - name: {{ template "fullname" . }} + name: {{ template "nginx.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "nginx.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" spec: selector: matchLabels: - app: {{ template "fullname" . }} + app: {{ template "nginx.fullname" . }} release: "{{ .Release.Name }}" replicas: 1 template: metadata: labels: - app: {{ template "fullname" . }} + app: {{ template "nginx.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -32,7 +32,7 @@ spec: spec: {{- include "nginx.imagePullSecrets" . | indent 6 }} containers: - - name: {{ template "fullname" . }} + - name: nginx image: "{{ template "nginx.image" . }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} ports: @@ -74,5 +74,5 @@ spec: {{- if .Values.serverBlock }} - name: nginx-server-block configMap: - name: {{ template "fullname" . }} + name: {{ template "nginx.fullname" . }} {{- end }} diff --git a/bitnami/nginx/templates/ingress.yaml b/bitnami/nginx/templates/ingress.yaml index 2733dacaf..24c1fb826 100644 --- a/bitnami/nginx/templates/ingress.yaml +++ b/bitnami/nginx/templates/ingress.yaml @@ -2,9 +2,9 @@ apiVersion: extensions/v1beta1 kind: Ingress metadata: - name: {{ template "fullname" . }} + name: {{ template "nginx.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "nginx.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -23,7 +23,7 @@ spec: paths: - path: {{ default "/" .path }} backend: - serviceName: "{{ template "fullname" $ }}" + serviceName: "{{ template "nginx.fullname" $ }}" servicePort: http {{- end }} {{- if .Values.ingress.tls }} diff --git a/bitnami/nginx/templates/server-host.yaml b/bitnami/nginx/templates/server-host.yaml index 220c9d9b4..60a491efb 100644 --- a/bitnami/nginx/templates/server-host.yaml +++ b/bitnami/nginx/templates/server-host.yaml @@ -2,9 +2,9 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ template "fullname" . }} + name: {{ template "nginx.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "nginx.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" diff --git a/bitnami/nginx/templates/svc.yaml b/bitnami/nginx/templates/svc.yaml index fb6b9b613..da2e4eb2c 100644 --- a/bitnami/nginx/templates/svc.yaml +++ b/bitnami/nginx/templates/svc.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "fullname" . }} + name: {{ template "nginx.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "nginx.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -27,4 +27,4 @@ spec: nodePort: {{ .Values.service.nodePorts.http }} {{- end }} selector: - app: {{ template "fullname" . }} + app: {{ template "nginx.fullname" . }} diff --git a/bitnami/nginx/templates/tls-secrets.yaml b/bitnami/nginx/templates/tls-secrets.yaml index c6dd8207d..b265a5c1c 100644 --- a/bitnami/nginx/templates/tls-secrets.yaml +++ b/bitnami/nginx/templates/tls-secrets.yaml @@ -5,7 +5,7 @@ kind: Secret metadata: name: {{ .name }} labels: - app: {{ template "fullname" . }} + app: {{ template "nginx.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" diff --git a/bitnami/nginx/values.yaml b/bitnami/nginx/values.yaml index 89bcddb88..d0e2977c3 100644 --- a/bitnami/nginx/values.yaml +++ b/bitnami/nginx/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override nginx.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override nginx.fullname template +## +# fullnameOverride: + ## Kubernetes configuration ## For minikube, set this to NodePort, elsewhere use LoadBalancer ## @@ -147,8 +155,8 @@ metrics: enabled: false image: registry: docker.io - repository: nginx/nginx-prometheus-exporter - tag: 0.1.0 + repository: bitnami/nginx-exporter + tag: 0.4.2-debian-9-r1 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/bitnami/node/Chart.yaml b/bitnami/node/Chart.yaml index ad7b2705e..842a3c028 100644 --- a/bitnami/node/Chart.yaml +++ b/bitnami/node/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: node -version: 8.1.10 +version: 9.1.0 appVersion: 10.16.0 description: Event-driven I/O server-side JavaScript environment based on V8 keywords: diff --git a/bitnami/node/README.md b/bitnami/node/README.md index 338a4e2d0..718669f44 100644 --- a/bitnami/node/README.md +++ b/bitnami/node/README.md @@ -50,50 +50,58 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the Node chart and their default values. -| Parameter | Description | Default | -|-----------------------------------------|-----------------------------------------------------------|-----------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | NodeJS image registry | `docker.io` | -| `image.repository` | NodeJS image name | `bitnami/node` | -| `image.tag` | NodeJS image tag | `{TAG_NAME}` | -| `image.pullPolicy` | NodeJS image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `git.registry` | Git image registry | `docker.io` | -| `git.repository` | Git image name | `bitnami/git` | -| `git.tag` | Git image tag | `{TAG_NAME}` | -| `git.pullPolicy` | Git image pull policy | `IfNotPresent` | -| `repository` | Repo of the application | `https://github.com/bitnami/sample-mean.git` | -| `revision` | Revision to checkout | `master` | -| `replicas` | Number of replicas for the application | `1` | -| `applicationPort` | Port where the application will be running | `3000` | -| `extraEnv` | Any extra environment variables to be pass to the pods | `{}` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.port` | Kubernetes Service port | `80` | -| `service.annotations` | Annotations for the Service | {} | -| `service.loadBalancerIP` | LoadBalancer IP if Service type is `LoadBalancer` | `nil` | -| `service.nodePort` | NodePort if Service type is `LoadBalancer` or `NodePort` | `nil` | -| `persistence.enabled` | Enable persistence using PVC | `false` | -| `persistence.path` | Path to persisted directory | `/app/data` | -| `persistence.accessMode` | PVC Access Mode | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request | `1Gi` | -| `mongodb.install` | Wheter to install or not the MongoDB chart | `true` | -| `externaldb.secretName` | Secret containing existing database credentials | `nil` | -| `externaldb.type` | Type of database that defines the database secret mapping | `osba` | -| `externaldb.broker.serviceInstanceName` | The existing ServiceInstance to be used | `nil` | -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.hosts[0].name` | Hostname to your Node installation | `node.local` | -| `ingress.hosts[0].path` | Path within the url structure | `/` | -| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.hosts[0].certManager` | Add annotations for cert-manager | `false` | -| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `node.local-tls-secret` | -| `ingress.hosts[0].annotations` | Annotations for this host's ingress record | `[]` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | +| Parameter | Description | Default | +| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | NodeJS image registry | `docker.io` | +| `image.repository` | NodeJS image name | `bitnami/node` | +| `image.tag` | NodeJS image tag | `{TAG_NAME}` | +| `image.pullPolicy` | NodeJS image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override node.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override node.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `git.registry` | Git image registry | `docker.io` | +| `git.repository` | Git image name | `bitnami/git` | +| `git.tag` | Git image tag | `{TAG_NAME}` | +| `git.pullPolicy` | Git image pull policy | `IfNotPresent` | +| `repository` | Repo of the application | `https://github.com/bitnami/sample-mean.git` | +| `revision` | Revision to checkout | `master` | +| `replicas` | Number of replicas for the application | `1` | +| `applicationPort` | Port where the application will be running | `3000` | +| `extraEnv` | Any extra environment variables to be pass to the pods | `{}` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `service.type` | Kubernetes Service type | `ClusterIP` | +| `service.port` | Kubernetes Service port | `80` | +| `service.annotations` | Annotations for the Service | {} | +| `service.loadBalancerIP` | LoadBalancer IP if Service type is `LoadBalancer` | `nil` | +| `service.nodePort` | NodePort if Service type is `LoadBalancer` or `NodePort` | `nil` | +| `persistence.enabled` | Enable persistence using PVC | `false` | +| `persistence.path` | Path to persisted directory | `/app/data` | +| `persistence.accessMode` | PVC Access Mode | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request | `1Gi` | +| `mongodb.install` | Wheter to install or not the MongoDB chart | `true` | +| `externaldb.secretName` | Secret containing existing database credentials | `nil` | +| `externaldb.type` | Type of database that defines the database secret mapping | `osba` | +| `externaldb.broker.serviceInstanceName` | The existing ServiceInstance to be used | `nil` | +| `ingress.enabled` | Enable ingress controller resource | `false` | +| `ingress.hosts[0].name` | Hostname to your Node installation | `node.local` | +| `ingress.hosts[0].path` | Path within the url structure | `/` | +| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.hosts[0].certManager` | Add annotations for cert-manager | `false` | +| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `node.local-tls-secret` | +| `ingress.hosts[0].annotations` | Annotations for this host's ingress record | `[]` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | The above parameters map to the env variables defined in [bitnami/node](http://github.com/bitnami/bitnami-docker-node). For more information please refer to the [bitnami/node](http://github.com/bitnami/bitnami-docker-node) image documentation. @@ -128,6 +136,15 @@ The [Bitnami Node](https://github.com/bitnami/bitnami-docker-node) image stores Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Configuration](#configuration) section to configure the PVC or to disable persistence. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Set up an Ingress controller First install the nginx-ingress controller via helm: diff --git a/bitnami/node/templates/_helpers.tpl b/bitnami/node/templates/_helpers.tpl index 35d68681b..06b7146fd 100644 --- a/bitnami/node/templates/_helpers.tpl +++ b/bitnami/node/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "node.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. @@ -102,7 +110,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -110,8 +118,11 @@ imagePullSecrets: {{- range .Values.git.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -119,6 +130,9 @@ imagePullSecrets: {{- range .Values.git.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} {{- end -}} @@ -133,3 +147,26 @@ WARNING: Rolling tag detected ({{ .Values.git.repository }}:{{ .Values.git.tag } +info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ {{- end }} {{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "node.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/node/templates/deployment.yaml b/bitnami/node/templates/deployment.yaml index 8d58a5176..d64ff9c21 100644 --- a/bitnami/node/templates/deployment.yaml +++ b/bitnami/node/templates/deployment.yaml @@ -46,6 +46,18 @@ spec: volumeMounts: - name: app mountPath: /app + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: "{{ template "node.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.path }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.path }} + {{- end }} containers: - name: {{ template "node.fullname" . }} image: "{{ template "node.image" . }}" diff --git a/bitnami/node/values.yaml b/bitnami/node/values.yaml index 5c7db3556..52bbfa7e6 100644 --- a/bitnami/node/values.yaml +++ b/bitnami/node/values.yaml @@ -26,6 +26,32 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override node.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override node.fullname template +## +# fullnameOverride: + + ## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Bitnami git image version ## ref: https://hub.docker.com/r/bitnami/git/tags/ ## diff --git a/bitnami/pytorch/Chart.yaml b/bitnami/pytorch/Chart.yaml index 20b035a99..578c5cfef 100644 --- a/bitnami/pytorch/Chart.yaml +++ b/bitnami/pytorch/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: pytorch -version: 0.0.7 +version: 1.1.0 appVersion: 1.1.0 description: Deep learning platform that accelerates the transition from research prototyping to production deployment keywords: diff --git a/bitnami/pytorch/README.md b/bitnami/pytorch/README.md index acd079276..aeb042297 100644 --- a/bitnami/pytorch/README.md +++ b/bitnami/pytorch/README.md @@ -45,57 +45,65 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the MinIO chart and their default values. -| Parameter | Description | Default | -| ------------------------------------ | -------------------------------------------------------------------------------------------- | ------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | PyTorch image registry | `docker.io` | -| `image.repository` | PyTorch image name | `bitnami/pytorch` | -| `image.tag` | PyTorch image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.debug` | Specify if debug logs should be enabled | `false` | -| `git.registry` | Git image registry | `docker.io` | -| `git.repository` | Git image name | `bitnami/git` | -| `git.tag` | Git image tag | `{TAG_NAME}` | -| `git.pullPolicy` | Git image pull policy | `IfNotPresent` | -| `git.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| service.type | Kubernetes service type | `ClusterIP` | -| `entrypoint.file` | Main entrypoint to your application | `''` | -| `entrypoint.args` | Args required by your entrypoint | `nil` | -| `mode` | Run PyTorch in standalone or distributed mode (possible values: `standalone`, `distributed`) | `standalone` | -| `worldSize` | Number of nodes that will execute your code | `nil` | -| `port` | PyTorch master port | `49875` | -| `configMap` | Config map that contains the files you want to load in PyTorch | `nil` | -| `cloneFilesFromGit.enabled` | Enable in order to download files from git repository | `false` | -| `cloneFilesFromGit.repository` | Repository that holds the files | `nil` | -| `cloneFilesFromGit.revision` | Revision from the repository to checkout | `master` | -| `extraEnvVars` | Extra environment variables to add to master and workers pods | `nil` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `[]` | -| `affinity` | Map of node/pod affinities | `{}` | -| `resources` | Pod resources | `{}` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `5` | -| `livenessProbe.periodSeconds` | How often to perform the probe | `5` | -| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `readinessProbe.enabled` | Enable/disable the Readiness probe | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | -| `readinessProbe.periodSeconds` | How often to perform the probe | `5` | -| `readinessProbe.timeoutSeconds` | When the probe times out | `1` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `persistence.enabled` | Use a PVC to persist data | `true` | -| `persistence.mountPath` | Path to mount the volume at | `/bitnami/pytorch` | -| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | -| `persistence.size` | Size of data volume | `8Gi` | -| `persistence.annotations` | Persistent Volume annotations | `{}` | +| Parameter | Description | Default | +| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | PyTorch image registry | `docker.io` | +| `image.repository` | PyTorch image name | `bitnami/pytorch` | +| `image.tag` | PyTorch image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug logs should be enabled | `false` | +| `git.registry` | Git image registry | `docker.io` | +| `git.repository` | Git image name | `bitnami/git` | +| `git.tag` | Git image tag | `{TAG_NAME}` | +| `git.pullPolicy` | Git image pull policy | `IfNotPresent` | +| `git.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override pytorch.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override pytorch.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| service.type | Kubernetes service type | `ClusterIP` | +| `entrypoint.file` | Main entrypoint to your application | `''` | +| `entrypoint.args` | Args required by your entrypoint | `nil` | +| `mode` | Run PyTorch in standalone or distributed mode (possible values: `standalone`, `distributed`) | `standalone` | +| `worldSize` | Number of nodes that will execute your code | `nil` | +| `port` | PyTorch master port | `49875` | +| `configMap` | Config map that contains the files you want to load in PyTorch | `nil` | +| `cloneFilesFromGit.enabled` | Enable in order to download files from git repository | `false` | +| `cloneFilesFromGit.repository` | Repository that holds the files | `nil` | +| `cloneFilesFromGit.revision` | Revision from the repository to checkout | `master` | +| `extraEnvVars` | Extra environment variables to add to master and workers pods | `nil` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `[]` | +| `affinity` | Map of node/pod affinities | `{}` | +| `resources` | Pod resources | `{}` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `5` | +| `livenessProbe.periodSeconds` | How often to perform the probe | `5` | +| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `readinessProbe.enabled` | Enable/disable the Readiness probe | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | +| `readinessProbe.periodSeconds` | How often to perform the probe | `5` | +| `readinessProbe.timeoutSeconds` | When the probe times out | `1` | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | +| `persistence.enabled` | Use a PVC to persist data | `true` | +| `persistence.mountPath` | Path to mount the volume at | `/bitnami/pytorch` | +| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | Use volume as ReadOnly or ReadWrite | `ReadWriteOnce` | +| `persistence.size` | Size of data volume | `8Gi` | +| `persistence.annotations` | Persistent Volume annotations | `{}` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -182,3 +190,12 @@ $ helm install --name my-release \ The [Bitnami PyTorch](https://github.com/bitnami/bitnami-docker-pytorch) image can persist data. If enabled, the persisted path is `/bitnami/pytorch` by default. The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning. + +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. diff --git a/bitnami/pytorch/templates/_helpers.tpl b/bitnami/pytorch/templates/_helpers.tpl index 5792a4ce5..43536c84d 100644 --- a/bitnami/pytorch/templates/_helpers.tpl +++ b/bitnami/pytorch/templates/_helpers.tpl @@ -92,7 +92,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -100,8 +100,11 @@ imagePullSecrets: {{- range .Values.git.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.git.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -109,6 +112,9 @@ imagePullSecrets: {{- range .Values.git.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} {{- end -}} @@ -157,3 +163,26 @@ WARNING: Rolling tag detected ({{ .Values.git.repository }}:{{ .Values.git.tag } +info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ {{- end }} {{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "pytorch.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/pytorch/templates/deployment.yaml b/bitnami/pytorch/templates/deployment.yaml index fab7d3a42..409cd5e1a 100644 --- a/bitnami/pytorch/templates/deployment.yaml +++ b/bitnami/pytorch/templates/deployment.yaml @@ -9,7 +9,7 @@ metadata: app.kubernetes.io/managed-by: {{ .Release.Service }} app.kubernetes.io/component: "master" spec: - replicas: 1 + replicas: 1 selector: matchLabels: app.kubernetes.io/name: {{ include "pytorch.name" . }} @@ -39,8 +39,8 @@ spec: {{- if .Values.affinity }} affinity: {{ toYaml .Values.affinity | nindent 8 }} {{- end }} - {{- if .Values.cloneFilesFromGit.enabled }} initContainers: + {{- if .Values.cloneFilesFromGit.enabled }} - name: git-clone-repository image: {{ include "git.image" . }} imagePullPolicy: {{ .Values.git.pullPolicy | quote }} @@ -55,11 +55,23 @@ spec: - name: git-cloned-files mountPath: /app {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: "{{ template "pytorch.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.path }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.path }} + {{- end }} containers: - name: master image: {{ include "pytorch.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy }} - command: + command: - bash - -c - | diff --git a/bitnami/pytorch/templates/statefulset.yml b/bitnami/pytorch/templates/statefulset.yml index c6ad52746..5bcf00d36 100644 --- a/bitnami/pytorch/templates/statefulset.yml +++ b/bitnami/pytorch/templates/statefulset.yml @@ -39,8 +39,8 @@ spec: {{- if .Values.affinity }} affinity: {{ toYaml .Values.affinity | nindent 8 }} {{- end }} - {{- if .Values.cloneFilesFromGit.enabled }} initContainers: + {{- if .Values.cloneFilesFromGit.enabled }} - name: git-clone-repository image: {{ include "git.image" . }} imagePullPolicy: {{ .Values.git.pullPolicy | quote }} @@ -55,11 +55,23 @@ spec: - name: git-cloned-files mountPath: /app {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: "{{ template "pytorch.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.path }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.path }} + {{- end }} containers: - name: worker image: {{ include "pytorch.image" . }} imagePullPolicy: {{ .Values.image.pullPolicy }} - command: + command: - bash - -c - | diff --git a/bitnami/pytorch/values-production.yaml b/bitnami/pytorch/values-production.yaml index c21dcafd1..42a3bf914 100644 --- a/bitnami/pytorch/values-production.yaml +++ b/bitnami/pytorch/values-production.yaml @@ -46,6 +46,32 @@ git: # pullSecrets: # - myRegistryKeySecretName + ## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + +## String to partially override pytorch.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override pytorch.fullname template +## +# fullnameOverride: + service: ## Kubernetes service type, ClusterIP and NodePort are supported at present type: ClusterIP diff --git a/bitnami/pytorch/values.yaml b/bitnami/pytorch/values.yaml index ea5a710ca..0ae7ef4d4 100644 --- a/bitnami/pytorch/values.yaml +++ b/bitnami/pytorch/values.yaml @@ -46,6 +46,32 @@ git: # pullSecrets: # - myRegistryKeySecretName +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + +## String to partially override pytorch.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override pytorch.fullname template +## +# fullnameOverride: + service: ## Kubernetes service type, ClusterIP and NodePort are supported at present type: ClusterIP diff --git a/bitnami/spark/Chart.yaml b/bitnami/spark/Chart.yaml index 792091fc3..f4a79a86d 100644 --- a/bitnami/spark/Chart.yaml +++ b/bitnami/spark/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 +version: 1.0.1 appVersion: 2.4.3 description: Spark is a fast and general-purpose cluster computing system. name: spark -version: 0.0.3 icon: https://bitnami.com/assets/stacks/spark/img/spark-stack-220x234-1ea65541e9e427ca5b93300e61d4778576c7f679ae02addb86a2641b0ca70476.png home: https://spark.apache.org/ sources: diff --git a/bitnami/spark/README.md b/bitnami/spark/README.md index 4f37fe95b..1ba9f1a71 100644 --- a/bitnami/spark/README.md +++ b/bitnami/spark/README.md @@ -49,6 +49,8 @@ The following tables lists the configurable parameters of the spark chart and th | `image.tag` | spark Image tag | `{TAG_NAME}` | | `image.pullPolicy` | spark image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override spark.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override spark.fullname template with a string | `nil` | | `master.debug` | Specify if debug values should be set on the master | `false` | | `master.webPort` | Specify the port where the web interface will listen on the master | `8080` | | `master.clusterPort` | Specify the port where the master listens to communicate with workers | `7077` | diff --git a/bitnami/spark/templates/statefulset-master.yaml b/bitnami/spark/templates/statefulset-master.yaml index 845d17279..43fae3891 100644 --- a/bitnami/spark/templates/statefulset-master.yaml +++ b/bitnami/spark/templates/statefulset-master.yaml @@ -23,6 +23,7 @@ spec: app.kubernetes.io/instance: {{ .Release.Name }} helm.sh/chart: {{ include "spark.chart" . }} app.kubernetes.io/component: master + spec: {{- if .Values.master.nodeSelector }} nodeSelector: {{- toYaml .Values.master.nodeSelector | nindent 8 }} @@ -35,7 +36,6 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} - spec: {{- include "spark.imagePullSecrets" . | nindent 6 }} {{- if .Values.master.securityContext.enabled }} securityContext: diff --git a/bitnami/spark/templates/statefulset-worker.yaml b/bitnami/spark/templates/statefulset-worker.yaml index 515905aa9..e518712f0 100644 --- a/bitnami/spark/templates/statefulset-worker.yaml +++ b/bitnami/spark/templates/statefulset-worker.yaml @@ -23,6 +23,7 @@ spec: app.kubernetes.io/instance: {{ .Release.Name }} helm.sh/chart: {{ include "spark.chart" . }} app.kubernetes.io/component: worker + spec: {{- if .Values.worker.nodeSelector }} nodeSelector: {{- toYaml .Values.worker.nodeSelector | nindent 8 }} @@ -35,7 +36,6 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} - spec: {{- include "spark.imagePullSecrets" . | nindent 6 }} {{- if .Values.worker.securityContext.enabled }} securityContext: diff --git a/bitnami/spark/values-production.yaml b/bitnami/spark/values-production.yaml index ad5800ae6..56974cd5b 100644 --- a/bitnami/spark/values-production.yaml +++ b/bitnami/spark/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/spark - tag: 2.4.3-debian-9-r13 + tag: 2.4.3-debian-9-r27 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -24,6 +24,13 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override spark.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override spark.fullname template +## +# fullnameOverride: ## Spark Components configuration ## diff --git a/bitnami/spark/values.yaml b/bitnami/spark/values.yaml index 808c587b2..955d23e47 100644 --- a/bitnami/spark/values.yaml +++ b/bitnami/spark/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/spark - tag: 2.4.3-debian-9-r13 + tag: 2.4.3-debian-9-r27 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -24,6 +24,13 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override spark.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override spark.fullname template +## +# fullnameOverride: ## Spark Components configuration ## diff --git a/bitnami/tensorflow-resnet/Chart.yaml b/bitnami/tensorflow-resnet/Chart.yaml index 5575b6ec9..6b5b91279 100755 --- a/bitnami/tensorflow-resnet/Chart.yaml +++ b/bitnami/tensorflow-resnet/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: tensorflow-resnet -version: 0.1.6 -appVersion: 1.13.0 +version: 1.0.0 +appVersion: 1.14.0 description: Open-source software library serving the ResNet machine learning model. keywords: - tensorflow diff --git a/bitnami/tensorflow-resnet/README.md b/bitnami/tensorflow-resnet/README.md index 3d33d461a..be5d97895 100755 --- a/bitnami/tensorflow-resnet/README.md +++ b/bitnami/tensorflow-resnet/README.md @@ -69,6 +69,8 @@ The following tables lists the configurable parameters of the TensorFlow ResNet | `server.image.tag` | TensorFlow Serving Image tag | `{TAG_NAME}` | | `server.image.pullPolicy` | TensorFlow Serving image pull policy | `IfNotPresent` | | `server.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override tensorflow-resnet.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override tensorflow-resnet.fullname template with a string | `nil` | | `replicaCount` | Desired number of pods | `1` | | `server.port` | Tensorflow server port | `8500` | | `client.image.registry` | TensorFlow ResNet image registry | `docker.io` | diff --git a/bitnami/tensorflow-resnet/templates/NOTES.txt b/bitnami/tensorflow-resnet/templates/NOTES.txt index be4367846..0d9dd1107 100755 --- a/bitnami/tensorflow-resnet/templates/NOTES.txt +++ b/bitnami/tensorflow-resnet/templates/NOTES.txt @@ -7,20 +7,20 @@ {{- if contains "NodePort" .Values.serviceType }} export APP_HOST=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - export APP_PORT=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.spec.ports[0].nodePort}") + export APP_PORT=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "tensorflow-resnet.fullname" . }} -o jsonpath="{.spec.ports[0].nodePort}") {{- else if contains "LoadBalancer" .Values.serviceType }} NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "fullname" . }}' + Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "tensorflow-resnet.fullname" . }}' - export APP_HOST=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") - export APP_PORT=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.spec.ports[0].port}") + export APP_HOST=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "tensorflow-resnet.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + export APP_PORT=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "tensorflow-resnet.fullname" . }} -o jsonpath="{.spec.ports[0].port}") {{- else if contains "ClusterIP" .Values.serviceType }} export APP_HOST=127.0.0.1 - export APP_PORT=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.spec.ports[0].port}") + export APP_PORT=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "tensorflow-resnet.fullname" . }} -o jsonpath="{.spec.ports[0].port}") kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "tensorflow-resnet.fullname" . }} $APP_PORT:$APP_PORT & {{- end }} diff --git a/bitnami/tensorflow-resnet/templates/_helpers.tpl b/bitnami/tensorflow-resnet/templates/_helpers.tpl index 116ecfe30..09d043d19 100644 --- a/bitnami/tensorflow-resnet/templates/_helpers.tpl +++ b/bitnami/tensorflow-resnet/templates/_helpers.tpl @@ -2,7 +2,7 @@ {{/* Expand the name of the chart. */}} -{{- define "name" -}} +{{- define "tensorflow-resnet.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} @@ -10,10 +10,18 @@ Expand the name of the chart. Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} -{{- define "fullname" -}} +{{- define "tensorflow-resnet.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Return the proper tensorflow-resnet server image name diff --git a/bitnami/tensorflow-resnet/templates/deployment.yaml b/bitnami/tensorflow-resnet/templates/deployment.yaml index 505769a1d..c50771dd5 100644 --- a/bitnami/tensorflow-resnet/templates/deployment.yaml +++ b/bitnami/tensorflow-resnet/templates/deployment.yaml @@ -1,22 +1,22 @@ apiVersion: extensions/v1beta1 kind: Deployment metadata: - name: {{ template "fullname" . }} + name: {{ template "tensorflow-resnet.fullname" . }} labels: - app: {{ template "name" . }} + app: {{ template "tensorflow-resnet.name" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" spec: selector: matchLabels: - app: {{ template "name" . }} + app: {{ template "tensorflow-resnet.name" . }} release: "{{ .Release.Name }}" replicas: {{ .Values.replicaCount }} template: metadata: labels: - app: {{ template "name" . }} + app: {{ template "tensorflow-resnet.name" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" {{- if or .Values.podAnnotations .Values.metrics.enabled }} diff --git a/bitnami/tensorflow-resnet/templates/svc.yaml b/bitnami/tensorflow-resnet/templates/svc.yaml index 1f0d4466a..e9b919d3c 100644 --- a/bitnami/tensorflow-resnet/templates/svc.yaml +++ b/bitnami/tensorflow-resnet/templates/svc.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "fullname" . }} + name: {{ template "tensorflow-resnet.fullname" . }} labels: - app: {{ template "name" . }} + app: {{ template "tensorflow-resnet.name" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -13,4 +13,4 @@ spec: - port: {{ .Values.server.port }} protocol: TCP selector: - app: {{ template "name" . }} + app: {{ template "tensorflow-resnet.name" . }} diff --git a/bitnami/tensorflow-resnet/values.yaml b/bitnami/tensorflow-resnet/values.yaml index 0431dc173..ed7df8656 100755 --- a/bitnami/tensorflow-resnet/values.yaml +++ b/bitnami/tensorflow-resnet/values.yaml @@ -16,7 +16,7 @@ server: image: registry: docker.io repository: bitnami/tensorflow-serving - tag: 1.13.0-debian-9-r73 + tag: 1.13.0-debian-9-r102 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -37,7 +37,7 @@ client: image: registry: docker.io repository: bitnami/tensorflow-resnet - tag: 1.13.0-debian-9-r78 + tag: 1.14.0-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -50,6 +50,14 @@ client: # pullSecrets: # - myRegistryKeySecretName +## String to partially override tensorflow-resnet.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override tensorflow-resnet.fullname template +## +# fullnameOverride: + ## Kubernetes configuration ## For minikube, set this to NodePort, elsewhere use LoadBalancer ## diff --git a/bitnami/tomcat/Chart.yaml b/bitnami/tomcat/Chart.yaml index 9589673a8..3fa120f6e 100644 --- a/bitnami/tomcat/Chart.yaml +++ b/bitnami/tomcat/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: tomcat -version: 3.0.7 -appVersion: 9.0.21 +version: 4.1.0 +appVersion: 9.0.22 description: Chart for Apache Tomcat keywords: - tomcat diff --git a/bitnami/tomcat/README.md b/bitnami/tomcat/README.md index 33643fdeb..7322b1e72 100644 --- a/bitnami/tomcat/README.md +++ b/bitnami/tomcat/README.md @@ -45,31 +45,39 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Tomcat chart and their default values. -| Parameter | Description | Default | -|---------------------------------|----------------------------------------------|---------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods)| -| `image.registry` | Tomcat image registry | `docker.io` | -| `image.repository` | Tomcat Image name | `bitnami/tomcat` | -| `image.tag` | Tomcat Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Tomcat image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `tomcatUsername` | Tomcat admin user | `user` | -| `tomcatPassword` | Tomcat admin password | _random 10 character alphanumeric string_ | -| `tomcatAllowRemoteManagement` | Enable remote access to management interface | `0` (disabled) | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port | `80` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.loadBalancerIP` | LoadBalancer service IP address | `""` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for Tomcat volume | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | PVC Access Mode for Tomcat volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for Tomcat volume | `8Gi` | -| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| Parameter | Description | Default | +| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Tomcat image registry | `docker.io` | +| `image.repository` | Tomcat Image name | `bitnami/tomcat` | +| `image.tag` | Tomcat Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Tomcat image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override tomcat.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override tomcat.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `tomcatUsername` | Tomcat admin user | `user` | +| `tomcatPassword` | Tomcat admin password | _random 10 character alphanumeric string_ | +| `tomcatAllowRemoteManagement` | Enable remote access to management interface | `0` (disabled) | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.port` | Service HTTP port | `80` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.loadBalancerIP` | LoadBalancer service IP address | `""` | +| `persistence.enabled` | Enable persistence using PVC | `true` | +| `persistence.storageClass` | PVC Storage Class for Tomcat volume | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | PVC Access Mode for Tomcat volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for Tomcat volume | `8Gi` | +| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | The above parameters map to the env variables defined in [bitnami/tomcat](http://github.com/bitnami/bitnami-docker-tomcat). For more information please refer to the [bitnami/tomcat](http://github.com/bitnami/bitnami-docker-tomcat) image documentation. @@ -103,6 +111,15 @@ The [Bitnami Tomcat](https://github.com/bitnami/bitnami-docker-tomcat) image sto Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Configuration](#configuration) section to configure the PVC or to disable persistence. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Upgrading ### To 2.1.0 diff --git a/bitnami/tomcat/templates/NOTES.txt b/bitnami/tomcat/templates/NOTES.txt index 9cb46f661..212978cad 100644 --- a/bitnami/tomcat/templates/NOTES.txt +++ b/bitnami/tomcat/templates/NOTES.txt @@ -5,29 +5,29 @@ {{- if contains "NodePort" .Values.service.type }} - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "fullname" . }}) + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "tomcat.fullname" . }}) export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") echo http://$NODE_IP:$NODE_PORT/ {{- else if contains "LoadBalancer" .Values.service.type }} -** Please ensure an external IP is associated to the {{ template "fullname" . }} service before proceeding ** -** Watch the status using: kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "fullname" . }} ** +** Please ensure an external IP is associated to the {{ template "tomcat.fullname" . }} service before proceeding ** +** Watch the status using: kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "tomcat.fullname" . }} ** - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "tomcat.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") {{- $port:=.Values.service.port | toString }} echo URL : http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.service.port }}{{ end }}/ echo Management URL : http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.service.port }}{{ end }}/manager {{- else if contains "ClusterIP" .Values.service.type }} echo URL : http://127.0.0.1:8080/ echo Management URL : http://127.0.0.1:8080/manager - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "fullname" . }} 8080:{{ .Values.service.port }} + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "tomcat.fullname" . }} 8080:{{ .Values.service.port }} {{- end }} 2. Login with the following credentials echo Username: {{ .Values.tomcatUsername }} - echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.tomcat-password}" | base64 --decode) + echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "tomcat.fullname" . }} -o jsonpath="{.data.tomcat-password}" | base64 --decode) {{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} diff --git a/bitnami/tomcat/templates/_helpers.tpl b/bitnami/tomcat/templates/_helpers.tpl index 9db1b8424..99942233f 100644 --- a/bitnami/tomcat/templates/_helpers.tpl +++ b/bitnami/tomcat/templates/_helpers.tpl @@ -2,7 +2,7 @@ {{/* Expand the name of the chart. */}} -{{- define "name" -}} +{{- define "tomcat.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} @@ -10,10 +10,18 @@ Expand the name of the chart. Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} -{{- define "fullname" -}} +{{- define "tomcat.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Return the proper Tomcat image name @@ -53,16 +61,45 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if .Values.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if .Values.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "tomcat.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/bitnami/tomcat/templates/deployment.yaml b/bitnami/tomcat/templates/deployment.yaml index 72641b365..549a23341 100644 --- a/bitnami/tomcat/templates/deployment.yaml +++ b/bitnami/tomcat/templates/deployment.yaml @@ -1,21 +1,21 @@ apiVersion: extensions/v1beta1 kind: Deployment metadata: - name: {{ template "fullname" . }} + name: {{ template "tomcat.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "tomcat.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" spec: selector: matchLabels: - app: {{ template "fullname" . }} + app: {{ template "tomcat.fullname" . }} release: "{{ .Release.Name }}" template: metadata: labels: - app: {{ template "fullname" . }} + app: {{ template "tomcat.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" spec: @@ -25,8 +25,21 @@ spec: runAsUser: {{ .Values.securityContext.runAsUser }} {{- end}} {{- include "tomcat.imagePullSecrets" . | indent 6 }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "tomcat.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/tomcat"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: /bitnami/tomcat + {{- end }} containers: - - name: {{ template "fullname" . }} + - name: tomcat image: "{{ template "tomcat.image" . }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} env: @@ -35,7 +48,7 @@ spec: - name: TOMCAT_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "tomcat.fullname" . }} key: tomcat-password - name: TOMCAT_ALLOW_REMOTE_MANAGEMENT value: {{ .Values.tomcatAllowRemoteManagement | quote }} @@ -59,13 +72,13 @@ spec: resources: {{ toYaml .Values.resources | indent 10 }} volumeMounts: - - name: tomcat-data + - name: data mountPath: /bitnami/tomcat volumes: - - name: tomcat-data + - name: data {{- if .Values.persistence.enabled }} persistentVolumeClaim: - claimName: {{ template "fullname" . }} + claimName: {{ template "tomcat.fullname" . }} {{- else }} emptyDir: {} {{- end -}} diff --git a/bitnami/tomcat/templates/pvc.yaml b/bitnami/tomcat/templates/pvc.yaml index 14c4e2fc0..52396aaab 100644 --- a/bitnami/tomcat/templates/pvc.yaml +++ b/bitnami/tomcat/templates/pvc.yaml @@ -2,9 +2,9 @@ kind: PersistentVolumeClaim apiVersion: v1 metadata: - name: {{ template "fullname" . }} + name: {{ template "tomcat.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "tomcat.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" diff --git a/bitnami/tomcat/templates/secrets.yaml b/bitnami/tomcat/templates/secrets.yaml index 2f70f550f..f46fb74eb 100644 --- a/bitnami/tomcat/templates/secrets.yaml +++ b/bitnami/tomcat/templates/secrets.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Secret metadata: - name: {{ template "fullname" . }} + name: {{ template "tomcat.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "tomcat.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" diff --git a/bitnami/tomcat/templates/svc.yaml b/bitnami/tomcat/templates/svc.yaml index 8c7493ac6..115c87e66 100644 --- a/bitnami/tomcat/templates/svc.yaml +++ b/bitnami/tomcat/templates/svc.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "fullname" . }} + name: {{ template "tomcat.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "tomcat.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -23,4 +23,4 @@ spec: nodePort: {{ .Values.service.nodePorts.http }} {{- end }} selector: - app: {{ template "fullname" . }} + app: {{ template "tomcat.fullname" . }} diff --git a/bitnami/tomcat/values.yaml b/bitnami/tomcat/values.yaml index b2b9e711d..bf91046d1 100644 --- a/bitnami/tomcat/values.yaml +++ b/bitnami/tomcat/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/tomcat - tag: 9.0.21-debian-9-r21 + tag: 9.0.22-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,32 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override tomcat.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override tomcat.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Pod Security Context ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ## diff --git a/bitnami/wildfly/Chart.yaml b/bitnami/wildfly/Chart.yaml index 32f241c28..58f691c13 100644 --- a/bitnami/wildfly/Chart.yaml +++ b/bitnami/wildfly/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: wildfly -version: 2.2.8 +version: 3.1.0 appVersion: 17.0.1 description: Chart for Wildfly keywords: diff --git a/bitnami/wildfly/README.md b/bitnami/wildfly/README.md index e9c9919a0..3a40daba8 100644 --- a/bitnami/wildfly/README.md +++ b/bitnami/wildfly/README.md @@ -45,32 +45,40 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the WildFly chart and their default values. -| Parameter | Description | Default | -|---------------------------------|----------------------------------------|------------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | WildFly image registry | `docker.io` | -| `image.repository` | WildFly Image name | `bitnami/wildfly` | -| `image.tag` | WildFly Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | WildFly image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `wildflyUsername` | WildFly admin user | `user` | -| `wildflyPassword` | WildFly admin password | _random 10 character alphanumeric string_ | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port | `80` | -| `service.mgmtPort` | Service Management port | `9990` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `service.nodePorts.mgmt` | Kubernetes management node port | `""` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.loadBalancerIP` | LoadBalancer service IP address | `""` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for WildFly volume | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | PVC Access Mode for WildFly volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for WildFly volume | `8Gi` | -| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| Parameter | Description | Default | +| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | WildFly image registry | `docker.io` | +| `image.repository` | WildFly Image name | `bitnami/wildfly` | +| `image.tag` | WildFly Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | WildFly image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override wildfly.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override wildfly.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `wildflyUsername` | WildFly admin user | `user` | +| `wildflyPassword` | WildFly admin password | _random 10 character alphanumeric string_ | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.port` | Service HTTP port | `80` | +| `service.mgmtPort` | Service Management port | `9990` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `service.nodePorts.mgmt` | Kubernetes management node port | `""` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.loadBalancerIP` | LoadBalancer service IP address | `""` | +| `persistence.enabled` | Enable persistence using PVC | `true` | +| `persistence.storageClass` | PVC Storage Class for WildFly volume | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | PVC Access Mode for WildFly volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for WildFly volume | `8Gi` | +| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | The above parameters map to the env variables defined in [bitnami/wildfly](http://github.com/bitnami/bitnami-docker-wildfly). For more information please refer to the [bitnami/wildfly](http://github.com/bitnami/bitnami-docker-wildfly) image documentation. @@ -105,6 +113,15 @@ The [Bitnami WildFly](https://github.com/bitnami/bitnami-docker-wildfly) image s Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Configuration](#configuration) section to configure the PVC or to disable persistence. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Upgrading ### To 2.1.0 diff --git a/bitnami/wildfly/templates/NOTES.txt b/bitnami/wildfly/templates/NOTES.txt index d9293cbad..ce27fc898 100644 --- a/bitnami/wildfly/templates/NOTES.txt +++ b/bitnami/wildfly/templates/NOTES.txt @@ -5,29 +5,29 @@ {{- if contains "NodePort" .Values.service.type }} - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "fullname" . }}) + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "wildfly.fullname" . }}) export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") echo http://$NODE_IP:$NODE_PORT/ {{- else if contains "LoadBalancer" .Values.service.type }} -** Please ensure an external IP is associated to the {{ template "fullname" . }} service before proceeding ** -** Watch the status using: kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "fullname" . }} ** +** Please ensure an external IP is associated to the {{ template "wildfly.fullname" . }} service before proceeding ** +** Watch the status using: kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "wildfly.fullname" . }} ** - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "wildfly.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") {{- $port:=.Values.service.port | toString }} echo URL : http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.service.port }}{{ end }}/ echo Management Url : http://$SERVICE_IP:{{ .Values.service.mgmtPort }}/ {{- else if contains "ClusterIP" .Values.service.type }} echo URL : http://127.0.0.1:8080/ echo Management URL : http://127.0.0.1:9990/ - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "fullname" . }} 8080:{{ .Values.service.port}} 9990:{{ .Values.service.mgmtPort }} + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "wildfly.fullname" . }} 8080:{{ .Values.service.port}} 9990:{{ .Values.service.mgmtPort }} {{- end }} 2. Login with the following credentials echo Username: {{ .Values.wildflyUsername }} - echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "fullname" . }} -o jsonpath="{.data.wildfly-password}" | base64 --decode) + echo Password: $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "wildfly.fullname" . }} -o jsonpath="{.data.wildfly-password}" | base64 --decode) {{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} diff --git a/bitnami/wildfly/templates/_helpers.tpl b/bitnami/wildfly/templates/_helpers.tpl index 7b1456e95..ff7ffed1c 100644 --- a/bitnami/wildfly/templates/_helpers.tpl +++ b/bitnami/wildfly/templates/_helpers.tpl @@ -2,17 +2,25 @@ {{/* Expand the name of the chart. */}} -{{- define "name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- define "wildfly.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* Create a default fully qualified app name. -We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} -{{- define "fullname" -}} +{{- define "wildfly.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} {{- end -}} {{/* @@ -53,16 +61,45 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if .Values.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if .Values.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "wildfly.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/bitnami/wildfly/templates/deployment.yaml b/bitnami/wildfly/templates/deployment.yaml index 5827db4c8..3eb985e54 100644 --- a/bitnami/wildfly/templates/deployment.yaml +++ b/bitnami/wildfly/templates/deployment.yaml @@ -1,21 +1,21 @@ apiVersion: extensions/v1beta1 kind: Deployment metadata: - name: {{ template "fullname" . }} + name: {{ template "wildfly.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "wildfly.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" spec: selector: matchLabels: - app: {{ template "fullname" . }} + app: {{ template "wildfly.fullname" . }} release: "{{ .Release.Name }}" template: metadata: labels: - app: {{ template "fullname" . }} + app: {{ template "wildfly.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" spec: @@ -25,8 +25,21 @@ spec: runAsUser: {{ .Values.securityContext.runAsUser }} {{- end }} {{- include "wildfly.imagePullSecrets" . | indent 6 }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "wildfly.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/wildfly"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: /bitnami/wildfly + {{- end }} containers: - - name: {{ template "fullname" . }} + - name: wildlfy image: "{{ template "wildfly.image" . }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} env: @@ -35,7 +48,7 @@ spec: - name: WILDFLY_PASSWORD valueFrom: secretKeyRef: - name: {{ template "fullname" . }} + name: {{ template "wildfly.fullname" . }} key: wildfly-password ports: - name: http @@ -59,13 +72,13 @@ spec: resources: {{ toYaml .Values.resources | indent 10 }} volumeMounts: - - name: wildfly-data + - name: data mountPath: /bitnami/wildfly volumes: - - name: wildfly-data + - name: data {{- if .Values.persistence.enabled }} persistentVolumeClaim: - claimName: {{ template "fullname" . }} + claimName: {{ template "wildfly.fullname" . }} {{- else }} emptyDir: {} {{- end -}} diff --git a/bitnami/wildfly/templates/pvc.yaml b/bitnami/wildfly/templates/pvc.yaml index 14c4e2fc0..b1afa2d04 100644 --- a/bitnami/wildfly/templates/pvc.yaml +++ b/bitnami/wildfly/templates/pvc.yaml @@ -2,9 +2,9 @@ kind: PersistentVolumeClaim apiVersion: v1 metadata: - name: {{ template "fullname" . }} + name: {{ template "wildfly.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "wildfly.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" diff --git a/bitnami/wildfly/templates/secrets.yaml b/bitnami/wildfly/templates/secrets.yaml index 6d442c922..0b87f6fbc 100644 --- a/bitnami/wildfly/templates/secrets.yaml +++ b/bitnami/wildfly/templates/secrets.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Secret metadata: - name: {{ template "fullname" . }} + name: {{ template "wildfly.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "wildfly.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" diff --git a/bitnami/wildfly/templates/svc.yaml b/bitnami/wildfly/templates/svc.yaml index f6f24642e..8399f8636 100644 --- a/bitnami/wildfly/templates/svc.yaml +++ b/bitnami/wildfly/templates/svc.yaml @@ -1,9 +1,9 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "fullname" . }} + name: {{ template "wildfly.fullname" . }} labels: - app: {{ template "fullname" . }} + app: {{ template "wildfly.fullname" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" release: "{{ .Release.Name }}" heritage: "{{ .Release.Service }}" @@ -29,4 +29,4 @@ spec: nodePort: {{ .Values.service.nodePorts.mgmt }} {{- end }} selector: - app: {{ template "fullname" . }} + app: {{ template "wildfly.fullname" . }} diff --git a/bitnami/wildfly/values.yaml b/bitnami/wildfly/values.yaml index d45454ddc..65b30fa16 100644 --- a/bitnami/wildfly/values.yaml +++ b/bitnami/wildfly/values.yaml @@ -26,6 +26,32 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override wildfly.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override wildfly.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## diff --git a/bitnami/zookeeper/Chart.yaml b/bitnami/zookeeper/Chart.yaml index 936afbec0..00b4024de 100644 --- a/bitnami/zookeeper/Chart.yaml +++ b/bitnami/zookeeper/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: zookeeper -version: 3.0.6 +version: 4.1.0 appVersion: 3.5.5 description: A centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services for distributed applications. keywords: diff --git a/bitnami/zookeeper/README.md b/bitnami/zookeeper/README.md index 4a442bb44..1deb43b0d 100644 --- a/bitnami/zookeeper/README.md +++ b/bitnami/zookeeper/README.md @@ -45,79 +45,85 @@ The command removes all the Kubernetes components associated with the chart and The following tables lists the configurable parameters of the Zookeeper chart and their default values. -| Parameter | Description | Default | -|---------------------------------------|---------------------------------------------------------------------|----------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Zookeeper image registry | `docker.io` | -| `image.repository` | Zookeeper Image name | `bitnami/zookeeper` | -| `image.tag` | Zookeeper Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Zookeeper image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.debug` | Specify if debug values should be set | `false` | -| `nameOverride` | String to partially override zookeeper.fullname template with a string (will append the release name) | `nil` | -| `fullnameOverride` | String to fully override zookeeper.fullname template with a string | `nil` | -| `updateStrategy` | Update strategies | `RollingUpdate` | -| `podDisruptionBudget.maxUnavailable` | Max number of pods down simultaneously | `1` | -| `rollingUpdatePartition` | Partition update strategy | `nil` | -| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | -| `podManagementpolicy` | Pod management policy | `Parallel` | -| `replicaCount` | Number of ZooKeeper nodes | `1` | -| `tickTime` | Basic time unit in milliseconds used by ZooKeeper for heartbeats | `2000` | -| `initLimit` | Time the ZooKeeper servers in quorum have to connect to a leader | `10` | -| `syncLimit` | How far out of date a server can be from a leader | `5` | -| `maxClientCnxns` | Number of concurrent connections that a single client may make to a single member | `60` | -| `allowAnonymousLogin` | Allow to accept connections from unauthenticated users | `yes` | -| `auth.existingSecret` | Use existing secret (ignores previous password) | `nil` | -| `auth.enabled` | Enable Zookeeper auth | `false` | -| `auth.clientUser` | User that will use Zookeeper clients to auth | `nil` | -| `auth.clientPassword` | Password that will use Zookeeper clients to auth | `nil` | -| `auth.serverUsers` | List of user to be created | `nil` | -| `auth.serverPasswords` | List of passwords to assign to users when created | `nil` | -| `heapSize` | Size in MB for the Java Heap options (Xmx and XMs) | `[]` | -| `logLevel` | Log level of Zookeeper server | `ERROR` | -| `jvmFlags` | Default JVMFLAGS for the ZooKeeper process | `nil` | -| `config` | Configure ZooKeeper with a custom zoo.conf file | `nil` | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.port` | ZooKeeper port | `2181` | -| `service.followerPort` | ZooKeeper follower port | `2888` | -| `service.electionPort` | ZooKeeper election port | `3888` | -| `service.publishNotReadyAddresses` | If the ZooKeeper headless service should publish DNS records for not ready pods | `true` | -| `securityContext.enabled` | Enable security context (ZooKeeper master pod) | `true` | -| `securityContext.fsGroup` | Group ID for the container (ZooKeeper master pod) | `1001` | -| `securityContext.runAsUser` | User ID for the container (ZooKeeper master pod) | `1001` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for Zookeeper volume | `nil` | -| `persistence.accessMode` | PVC Access Mode for Zookeeper volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for Zookeeper volume | `8Gi` | -| `persistence.annotations` | Annotations for the PVC | `{}` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `[]` | -| `affinity` | Map of node/pod affinities | `{}` | -| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | -| `livenessProbe.enabled` | would you like a livessProbed to be enabled | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 30 | -| `livenessProbe.periodSeconds` | How often to perform the probe | 10 | -| `livenessProbe.timeoutSeconds` | When the probe times out | 5 | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | 6 | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | -| `readinessProbe.enabled` | Would you like a readinessProbe to be enabled | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 5 | -| `readinessProbe.periodSeconds` | How often to perform the probe | 10 | -| `readinessProbe.timeoutSeconds` | When the probe times out | 5 | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | 6 | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | ZooKeeper exporter image registry | `docker.io` | -| `metrics.image.repository` | ZooKeeper exporter image name | `javsalgar/zookeeper-exporter` | -| `metrics.image.tag` | ZooKeeper exporter image tag | `latest` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | -| `metrics.podLabels` | Additional labels for Metrics exporter pod | `{}` | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9141"}` | -| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | -| `metrics.tolerations` | Exporter toleration labels for pod assignment | `[]` | -| `metrics.timeoutSeconds` | Timeout in seconds the exporter uses to scrape its targets | 3 | +| Parameter | Description | Default | +| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Zookeeper image registry | `docker.io` | +| `image.repository` | Zookeeper Image name | `bitnami/zookeeper` | +| `image.tag` | Zookeeper Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Zookeeper image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug values should be set | `false` | +| `nameOverride` | String to partially override zookeeper.fullname template with a string (will append the release name) | `nil` | +| `fullnameOverride` | String to fully override zookeeper.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `updateStrategy` | Update strategies | `RollingUpdate` | +| `podDisruptionBudget.maxUnavailable` | Max number of pods down simultaneously | `1` | +| `rollingUpdatePartition` | Partition update strategy | `nil` | +| `clusterDomain` | Kubernetes cluster domain | `cluster.local` | +| `podManagementpolicy` | Pod management policy | `Parallel` | +| `replicaCount` | Number of ZooKeeper nodes | `1` | +| `tickTime` | Basic time unit in milliseconds used by ZooKeeper for heartbeats | `2000` | +| `initLimit` | Time the ZooKeeper servers in quorum have to connect to a leader | `10` | +| `syncLimit` | How far out of date a server can be from a leader | `5` | +| `maxClientCnxns` | Number of concurrent connections that a single client may make to a single member | `60` | +| `allowAnonymousLogin` | Allow to accept connections from unauthenticated users | `yes` | +| `auth.existingSecret` | Use existing secret (ignores previous password) | `nil` | +| `auth.enabled` | Enable Zookeeper auth | `false` | +| `auth.clientUser` | User that will use Zookeeper clients to auth | `nil` | +| `auth.clientPassword` | Password that will use Zookeeper clients to auth | `nil` | +| `auth.serverUsers` | List of user to be created | `nil` | +| `auth.serverPasswords` | List of passwords to assign to users when created | `nil` | +| `heapSize` | Size in MB for the Java Heap options (Xmx and XMs) | `[]` | +| `logLevel` | Log level of Zookeeper server | `ERROR` | +| `jvmFlags` | Default JVMFLAGS for the ZooKeeper process | `nil` | +| `config` | Configure ZooKeeper with a custom zoo.conf file | `nil` | +| `service.type` | Kubernetes Service type | `ClusterIP` | +| `service.port` | ZooKeeper port | `2181` | +| `service.followerPort` | ZooKeeper follower port | `2888` | +| `service.electionPort` | ZooKeeper election port | `3888` | +| `service.publishNotReadyAddresses` | If the ZooKeeper headless service should publish DNS records for not ready pods | `true` | +| `securityContext.enabled` | Enable security context (ZooKeeper master pod) | `true` | +| `securityContext.fsGroup` | Group ID for the container (ZooKeeper master pod) | `1001` | +| `securityContext.runAsUser` | User ID for the container (ZooKeeper master pod) | `1001` | +| `persistence.enabled` | Enable persistence using PVC | `true` | +| `persistence.storageClass` | PVC Storage Class for Zookeeper volume | `nil` | +| `persistence.accessMode` | PVC Access Mode for Zookeeper volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for Zookeeper volume | `8Gi` | +| `persistence.annotations` | Annotations for the PVC | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `[]` | +| `affinity` | Map of node/pod affinities | `{}` | +| `resources` | CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `250m` | +| `livenessProbe.enabled` | would you like a livessProbed to be enabled | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 30 | +| `livenessProbe.periodSeconds` | How often to perform the probe | 10 | +| `livenessProbe.timeoutSeconds` | When the probe times out | 5 | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | 6 | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | +| `readinessProbe.enabled` | Would you like a readinessProbe to be enabled | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 5 | +| `readinessProbe.periodSeconds` | How often to perform the probe | 10 | +| `readinessProbe.timeoutSeconds` | When the probe times out | 5 | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | 6 | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed | 1 | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | ZooKeeper exporter image registry | `docker.io` | +| `metrics.image.repository` | ZooKeeper exporter image name | `javsalgar/zookeeper-exporter` | +| `metrics.image.tag` | ZooKeeper exporter image tag | `latest` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | +| `metrics.podLabels` | Additional labels for Metrics exporter pod | `{}` | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9141"}` | +| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | +| `metrics.tolerations` | Exporter toleration labels for pod assignment | `[]` | +| `metrics.timeoutSeconds` | Timeout in seconds the exporter uses to scrape its targets | 3 | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -174,6 +180,15 @@ The [Bitnami Zookeeper](https://github.com/bitnami/bitnami-docker-zookeeper) ima Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Configuration](#configuration) section to configure the PVC or to disable persistence. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Upgrading ### To 3.0.0 diff --git a/bitnami/zookeeper/templates/_helpers.tpl b/bitnami/zookeeper/templates/_helpers.tpl index fac78d68c..33d11d3a5 100644 --- a/bitnami/zookeeper/templates/_helpers.tpl +++ b/bitnami/zookeeper/templates/_helpers.tpl @@ -3,7 +3,7 @@ Expand the name of the chart. */}} {{- define "zookeeper.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* @@ -13,13 +13,13 @@ If release name contains chart name it will be used as a full name. */}} {{- define "zookeeper.fullname" -}} {{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 24 | trimSuffix "-" -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} {{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} {{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 24 | trimSuffix "-" -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} {{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 24 | trimSuffix "-" -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} {{- end -}} {{- end -}} @@ -92,7 +92,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -100,8 +100,11 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -109,6 +112,9 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} {{- end -}} @@ -133,3 +139,26 @@ Return ZooKeeper Servers Passwords {{- randAlphaNum 10 -}} {{- end -}} {{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "zookeeper.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} diff --git a/bitnami/zookeeper/templates/statefulset.yaml b/bitnami/zookeeper/templates/statefulset.yaml index b8e0f4fbe..b832854ef 100644 --- a/bitnami/zookeeper/templates/statefulset.yaml +++ b/bitnami/zookeeper/templates/statefulset.yaml @@ -48,8 +48,21 @@ spec: {{- if .Values.affinity }} affinity: {{ toYaml .Values.affinity | nindent 8 }} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: "{{ template "zookeeper.volumePermissions.image" . }}" + imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/zookeeper"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: /bitnami/zookeeper + {{- end }} containers: - - name: "{{ template "zookeeper.fullname" . }}" + - name: zookeeper image: "{{ template "zookeeper.image" . }}" imagePullPolicy: {{ .Values.image.pullPolicy | quote }} {{- if .Values.securityContext.enabled }} diff --git a/bitnami/zookeeper/values-production.yaml b/bitnami/zookeeper/values-production.yaml index d8c035d3f..3495b877d 100644 --- a/bitnami/zookeeper/values-production.yaml +++ b/bitnami/zookeeper/values-production.yaml @@ -37,6 +37,24 @@ image: ## String to fully override zookeeper.fullname template # fullnameOverride: +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## diff --git a/bitnami/zookeeper/values.yaml b/bitnami/zookeeper/values.yaml index 430ba0c2a..d83734804 100644 --- a/bitnami/zookeeper/values.yaml +++ b/bitnami/zookeeper/values.yaml @@ -37,6 +37,24 @@ image: ## String to fully override zookeeper.fullname template # fullnameOverride: +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## StatefulSet controller supports automated updates. There are two valid update strategies: RollingUpdate and OnDelete ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets ## diff --git a/upstreamed/dokuwiki/Chart.yaml b/upstreamed/dokuwiki/Chart.yaml index e850a61ee..ebc668b4c 100644 --- a/upstreamed/dokuwiki/Chart.yaml +++ b/upstreamed/dokuwiki/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: dokuwiki -version: 4.3.2 +version: 5.1.0 appVersion: 0.20180422.201901061035 description: DokuWiki is a standards-compliant, simple to use wiki optimized for creating documentation. It is targeted at developer teams, workgroups, and small companies. diff --git a/upstreamed/dokuwiki/README.md b/upstreamed/dokuwiki/README.md index f33aad844..58e473bf9 100644 --- a/upstreamed/dokuwiki/README.md +++ b/upstreamed/dokuwiki/README.md @@ -54,6 +54,8 @@ The following table lists the configurable parameters of the DokuWiki chart and | `image.tag` | DokuWiki image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override dokuwiki.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override dokuwiki.fullname template with a string | `nil` | | `dokuwikiUsername` | User of the application | `user` | | `dokuwikiFullName` | User's full name | `User Name` | | `dokuwikiPassword` | Application password | _random 10 character alphanumeric string_ | @@ -99,8 +101,8 @@ The following table lists the configurable parameters of the DokuWiki chart and | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/dokuwiki/templates/_helpers.tpl b/upstreamed/dokuwiki/templates/_helpers.tpl index 836064c9a..3b7eab4db 100644 --- a/upstreamed/dokuwiki/templates/_helpers.tpl +++ b/upstreamed/dokuwiki/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "dokuwiki.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. diff --git a/upstreamed/dokuwiki/values.yaml b/upstreamed/dokuwiki/values.yaml index d12c60090..c35e838aa 100644 --- a/upstreamed/dokuwiki/values.yaml +++ b/upstreamed/dokuwiki/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override dokuwiki.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override dokuwiki.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-dokuwiki#environment-variables ## @@ -183,8 +191,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r1 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/drupal/Chart.yaml b/upstreamed/drupal/Chart.yaml index 5076741aa..040b24487 100644 --- a/upstreamed/drupal/Chart.yaml +++ b/upstreamed/drupal/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: drupal -version: 3.3.6 -appVersion: 8.7.4 +version: 4.1.1 +appVersion: 8.7.5 description: One of the most versatile open source content management systems. keywords: - drupal diff --git a/upstreamed/drupal/README.md b/upstreamed/drupal/README.md index 53c2ec0a6..72cf41152 100644 --- a/upstreamed/drupal/README.md +++ b/upstreamed/drupal/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the Drupal chart and th | `image.tag` | Drupal Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Drupal image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override drupal.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override drupal.fullname template with a string | `nil` | | `drupalProfile` | Drupal installation profile | `standard` | | `drupalUsername` | User of the application | `user` | | `drupalPassword` | Application password | _random 10 character long alphanumeric string_ | @@ -98,8 +100,8 @@ The following table lists the configurable parameters of the Drupal chart and th | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/drupal/templates/_helpers.tpl b/upstreamed/drupal/templates/_helpers.tpl index 933ca769e..3e8ec59b0 100644 --- a/upstreamed/drupal/templates/_helpers.tpl +++ b/upstreamed/drupal/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "drupal.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. diff --git a/upstreamed/drupal/values.yaml b/upstreamed/drupal/values.yaml index 82e49da1f..bba9390fe 100644 --- a/upstreamed/drupal/values.yaml +++ b/upstreamed/drupal/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/drupal - tag: 8.7.4-debian-9-r0 + tag: 8.7.5-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override drupal.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override drupal.fullname template +## +# fullnameOverride: + ## Installation Profile ## ref: https://github.com/bitnami/bitnami-docker-drupal#configuration ## @@ -246,8 +254,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/external-dns/Chart.yaml b/upstreamed/external-dns/Chart.yaml index ca2471332..982bb1919 100644 --- a/upstreamed/external-dns/Chart.yaml +++ b/upstreamed/external-dns/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: external-dns -version: 2.2.0 +version: 2.3.3 appVersion: 0.5.15 description: ExternalDNS is a Kubernetes addon that configures public DNS servers with information about exposed Kubernetes services to make them discoverable. keywords: diff --git a/upstreamed/external-dns/README.md b/upstreamed/external-dns/README.md index 69591bf78..09ba113a6 100644 --- a/upstreamed/external-dns/README.md +++ b/upstreamed/external-dns/README.md @@ -54,18 +54,20 @@ The following table lists the configurable parameters of the external-dns chart | `image.tag` | ExternalDNS Image tag | `{TAG_NAME}` | | `image.pullPolicy` | ExternalDNS image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override external-dns.fullname template with a string (will prepend the release name)| `nil` | +| `fullnameOverride` | String to fully override external-dns.fullname template with a string | `nil` | | `sources` | K8s resources type to be observed for new DNS entries by ExternalDNS | `[service, ingress]` | | `provider` | DNS provider where the DNS records will be created (mandatory) (options: aws, azure, google, ...) | `aws` | | `publishInternalServices` | Whether to publish DNS records for ClusterIP services or not | `false` | -| `aws.credentials.accessKey` | When using the AWS provider, set `aws_access_key_id` in the AWS credentials (optional) | `""` | -| `aws.credentials.secretKey` | When using the AWS provider, set `aws_secret_access_key` in the AWS credentials (optional) | `""` | +| `aws.credentials.accessKey` | When using the AWS provider, set `aws_access_key_id` in the AWS credentials (optional) | `""` | +| `aws.credentials.secretKey` | When using the AWS provider, set `aws_secret_access_key` in the AWS credentials (optional) | `""` | | `aws.credentials.mountPath` | When using the AWS provider, determine `mountPath` for `credentials` secret | `"/.aws"` | | `aws.region` | When using the AWS provider, `AWS_DEFAULT_REGION` to set in the environment (optional) | `us-east-1` | | `aws.zoneType` | When using the AWS provider, filter for zones of this type (optional, options: public, private) | `""` | | `aws.assumeRoleArn` | When using the AWS provider, assume role by specifying --aws-assume-role to the external-dns daemon | `""` | | `aws.batchChangeSize` | When using the AWS provider, set the maximum number of changes that will be applied in each batch | `1000` | | `azure.secretName` | When using the Azure provider, set the secret containing the `azure.json` file | `""` | -| `azure.resoureGroup` | When using the Azure provider, set the Azure Resource Group | `""` | +| `azure.resourceGroup` | When using the Azure provider, set the Azure Resource Group | `""` | | `cloudflare.apiKey` | When using the Cloudflare provider, `CF_API_KEY` to set (optional) | `""` | | `cloudflare.email` | When using the Cloudflare provider, `CF_API_EMAIL` to set (optional) | `""` | | `cloudflare.proxied` | When using the Cloudflare provider, enable the proxy feature (DDOS protection, CDN...) (optional) | `true` | @@ -78,7 +80,7 @@ The following table lists the configurable parameters of the external-dns chart | `google.serviceAccountSecret` | When using the Google provider, specify the existing secret which contains credentials.json (optional) | `""` | | `google.serviceAccountKey` | When using the Google provider, specify the service account key JSON file. (required when `google.serviceAccountSecret` is not provided. In this case a new secret will be created holding this service account | `""` | | `infoblox.gridHost` | When using the Infoblox provider, specify the Infoblox Grid host (required when provider=infoblox) | `""` | -| `infoblox.wapiUsername` | When using the Infoblox provider, specify the Infoblox WAPI username | `"admin"` | +| `infoblox.wapiUsername` | When using the Infoblox provider, specify the Infoblox WAPI username | `"admin"` | | `infoblox.wapiPassword` | When using the Infoblox provider, specify the Infoblox WAPI password (required when provider=infoblox) | `""` | | `infoblox.domainFilter` | When using the Infoblox provider, specify the domain (optional) | `""` | | `infoblox.noSslVerify` | When using the Infoblox provider, disable SSL verification (optional) | `false` | @@ -93,6 +95,9 @@ The following table lists the configurable parameters of the external-dns chart | `rfc2136.tsigKeyname` | When using the rfc2136 provider, specify the tsig keyname to enable security (optional) | `"externaldns-key"` | | `rfc2136.tsigSecretAlg` | When using the rfc2136 provider, specify the tsig secret to enable security (optional) | `"hmac-sha256"` | | `rfc2136.tsigAxfr` | When using the rfc2136 provider, enable AFXR to enable security (optional) | `true` | +| `pdns.apiUrl` | When using the PowerDNS provider, specify the API URL of the server. | `""` | +| `pdns.apiPort` | When using the PowerDNS provider, specify the API port of the server. | `8081` | +| `pdns.apiKey` | When using the PowerDNS provider, specify the API key of the server. | `""` | | `annotationFilter` | Filter sources managed by external-dns via annotation using label selector (optional) | `""` | | `domainFilters` | Limit possible target zones by domain suffixes (optional) | `[]` | | `zoneIdFilters` | Limit possible target zones by zone id (optional) | `[]` | @@ -110,9 +115,9 @@ The following table lists the configurable parameters of the external-dns chart | `extraArgs` | Extra arguments to be passed to external-dns | `{}` | | `extraEnv` | Extra environment variables to be passed to external-dns | `[]` | | `replicas` | Desired number of ExternalDNS replicas | `1` | -| `affinity` | Affinity for pod assignment (this value is evaluated as a template) | `{}` | -| `nodeSelector` | Node labels for pod assignment (this value is evaluated as a template) | `{}` | -| `tolerations` | Tolerations for pod assignment (this value is evaluated as a template) | `[]` | +| `affinity` | Affinity for pod assignment (this value is evaluated as a template) | `{}` | +| `nodeSelector` | Node labels for pod assignment (this value is evaluated as a template) | `{}` | +| `tolerations` | Tolerations for pod assignment (this value is evaluated as a template) | `[]` | | `podAnnotations` | Additional annotations to apply to the pod. | `{}` | | `podLabels` | Additional labels to be added to pods | {} | | `podSecurityContext.fsGroup` | Group ID for the container | `1001` | @@ -130,7 +135,7 @@ The following table lists the configurable parameters of the external-dns chart | `rbac.create` | Wether to create & use RBAC resources or not | `false` | | `rbac.serviceAccountName` | ServiceAccount (ignored if rbac.create == true) | `default` | | `rbac.apiVersion` | Version of the RBAC API | `v1beta1` | -| `rbac.pspEnabled` | PodSecurityPolicy | `false` | +| `rbac.pspEnabled` | PodSecurityPolicy | `false` | | `resources` | CPU/Memory resource requests/limits. | `{}` | | `livenessProbe` | Deployment Liveness Probe | See `values.yaml` | | `readinessProbe` | Deployment Readiness Probe | See `values.yaml` | diff --git a/upstreamed/external-dns/templates/_helpers.tpl b/upstreamed/external-dns/templates/_helpers.tpl index 15519eb8c..c3f2e61d8 100644 --- a/upstreamed/external-dns/templates/_helpers.tpl +++ b/upstreamed/external-dns/templates/_helpers.tpl @@ -130,6 +130,8 @@ Compile all warnings into a single message, and call fail. {{- $messages := append $messages (include "external-dns.validateValues.aws" .) -}} {{- $messages := append $messages (include "external-dns.validateValues.infoblox.gridHost" .) -}} {{- $messages := append $messages (include "external-dns.validateValues.infoblox.wapiPassword" .) -}} +{{- $messages := append $messages (include "external-dns.validateValues.pdns.apiUrl" .) -}} +{{- $messages := append $messages (include "external-dns.validateValues.pdns.apiKey" .) -}} {{- $messages := without $messages "" -}} {{- $message := join "\n" $messages -}} @@ -201,6 +203,30 @@ external-dns: infoblox.wapiPassword {{- end -}} {{- end -}} +{{/* +Validate values of External DNS: +- must provide the PowerDNS API URL when provider is "pdns" +*/}} +{{- define "external-dns.validateValues.pdns.apiUrl" -}} +{{- if and (eq .Values.provider "pdns") (not .Values.pdns.apiUrl) -}} +external-dns: pdns.apiUrl + You must provide the the PowerDNS API URL when provider="pdns". + Please set the apiUrl parameter (--set pdns.apiUrl="xxxx") +{{- end -}} +{{- end -}} + +{{/* +Validate values of External DNS: +- must provide the PowerDNS API key when provider is "pdns" +*/}} +{{- define "external-dns.validateValues.pdns.apiKey" -}} +{{- if and (eq .Values.provider "pdns") (not .Values.pdns.apiKey) -}} +external-dns: pdns.apiKey + You must provide the the PowerDNS API key when provider="pdns". + Please set the apiKey parameter (--set pdns.apiKey="xxxx") +{{- end -}} +{{- end -}} + {{/* Check if there are rolling tags in the images */}} {{- define "external-dns.checkRollingTags" -}} {{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} diff --git a/upstreamed/external-dns/templates/deployment.yaml b/upstreamed/external-dns/templates/deployment.yaml index 190ea8453..2e3d59824 100755 --- a/upstreamed/external-dns/templates/deployment.yaml +++ b/upstreamed/external-dns/templates/deployment.yaml @@ -9,15 +9,16 @@ spec: matchLabels: {{ include "external-dns.matchLabels" . | nindent 6 }} template: metadata: - {{- if or .Values.podAnnotations .Values.metrics.enabled }} - annotations: {{ include "external-dns.podAnnotations" . | nindent 8 }} - {{- end }} labels: {{ include "external-dns.labels" . | nindent 8 }} + annotations: + {{- if or .Values.podAnnotations .Values.metrics.enabled }} + {{ include "external-dns.podAnnotations" . | nindent 8 }} + {{- end }} {{- if or (and .Values.aws.credentials.secretKey .Values.aws.credentials.accessKey) .Values.cloudflare.apiKey .Values.digitalocean.apiToken (and .Values.infoblox.wapiUsername .Values.infoblox.wapiPassword) .Values.rfc2136.tsigSecret .Values.extraEnv .Values.google.serviceAccountKey }} - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum | trunc 63 }} + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} {{- end }} {{- if and (eq .Values.provider "designate") .Values.designate.customCA.enabled }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum | trunc 63 }} + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} {{- end }} spec: {{- include "external-dns.imagePullSecrets" . | indent 6 }} @@ -105,8 +106,8 @@ spec: {{- end }} # Azure Arguments {{- if eq .Values.provider "azure" }} - {{- if .Values.azure.resoureGroup }} - - --azure-resource-group={{ .Values.azure.resoureGroup }} + {{- if .Values.azure.resourceGroup }} + - --azure-resource-group={{ .Values.azure.resourceGroup }} {{- end }} {{- end }} # Cloudflare arguments @@ -152,6 +153,11 @@ spec: - --rfc2136-insecure {{- end }} {{- end }} + # PowerDNS arguments + {{- if eq .Values.provider "pdns" }} + - --pdns-server={{ .Values.pdns.apiUrl }}:{{ .Values.pdns.apiPort }} + - --pdns-api-key=$(PDNS_API_KEY) + {{- end }} # Extra arguments {{- range $key, $value := .Values.extraArgs }} {{- if $value }} @@ -236,6 +242,14 @@ spec: - name: OPENSTACK_CA_FILE value: {{ .Values.designate.customCA.mountPath }}/{{ .Values.designate.customCA.filename }} {{- end }} + # PowerDNS environment variables + {{- if and (eq .Values.provider "pdns") .Values.pdns.apiKey }} + - name: PDNS_API_KEY + valueFrom: + secretKeyRef: + name: {{ template "external-dns.fullname" . }} + key: pdns_api_key + {{- end }} # Extra environment variables {{- $root := . -}} {{- range .Values.extraEnv }} diff --git a/upstreamed/external-dns/templates/secret.yaml b/upstreamed/external-dns/templates/secret.yaml index 9083a821a..56d54f751 100644 --- a/upstreamed/external-dns/templates/secret.yaml +++ b/upstreamed/external-dns/templates/secret.yaml @@ -1,4 +1,4 @@ -{{- if or .Values.aws.assumeRoleArn (and .Values.aws.credentials.secretKey .Values.aws.credentials.accessKey) .Values.cloudflare.apiKey .Values.digitalocean.apiToken .Values.google.serviceAccountKey (and .Values.infoblox.wapiUsername .Values.infoblox.wapiPassword) .Values.rfc2136.tsigSecret .Values.extraEnv }} +{{- if or .Values.aws.assumeRoleArn (and .Values.aws.credentials.secretKey .Values.aws.credentials.accessKey) .Values.cloudflare.apiKey .Values.digitalocean.apiToken .Values.google.serviceAccountKey (and .Values.infoblox.wapiUsername .Values.infoblox.wapiPassword) .Values.rfc2136.tsigSecret .Values.pdns.apiKey .Values.extraEnv }} apiVersion: v1 kind: Secret metadata: @@ -30,6 +30,9 @@ data: {{- if .Values.rfc2136.tsigSecret }} rfc2136_tsig_secret: {{ .Values.rfc2136.tsigSecret | b64enc | quote }} {{- end }} + {{- if .Values.pdns.apiKey }} + pdns_api_key: {{ .Values.pdns.apiKey | b64enc | quote }} + {{- end }} {{- range $key, $value := .Values.extraEnv }} {{ $key }}: {{ $value | b64enc | quote }} {{- end }} diff --git a/upstreamed/external-dns/values-production.yaml b/upstreamed/external-dns/values-production.yaml index 7613c90c0..9df69898d 100644 --- a/upstreamed/external-dns/values-production.yaml +++ b/upstreamed/external-dns/values-production.yaml @@ -81,7 +81,7 @@ azure: secretName: "" ## Azure resource group to use ## - resoureGroup: "" + resourceGroup: "" ## Cloudflare configuration to be set via arguments/env. variables ## @@ -159,6 +159,13 @@ rfc2136: tsigKeyname: externaldns-key tsigAxfr: true +## PowerDNS configuration to be set via arguments/env. variables +## +pdns: + apiUrl: "" + apiPort: "8081" + apiKey: "" + ## Limit possible target zones by domain suffixes (optional) ## domainFilters: [] @@ -285,7 +292,7 @@ rbac: ## Kubernetes Security Context ## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ ## -securityContext: {} +securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: diff --git a/upstreamed/external-dns/values.yaml b/upstreamed/external-dns/values.yaml index 99d9c557a..469bb0976 100644 --- a/upstreamed/external-dns/values.yaml +++ b/upstreamed/external-dns/values.yaml @@ -81,7 +81,7 @@ azure: secretName: "" ## Azure resource group to use ## - resoureGroup: "" + resourceGroup: "" ## Cloudflare configuration to be set via arguments/env. variables ## @@ -159,6 +159,13 @@ rfc2136: tsigKeyname: externaldns-key tsigAxfr: true +## PowerDNS configuration to be set via arguments/env. variables +## +pdns: + apiUrl: "" + apiPort: "8081" + apiKey: "" + ## Limit possible target zones by domain suffixes (optional) ## domainFilters: [] diff --git a/upstreamed/ghost/Chart.yaml b/upstreamed/ghost/Chart.yaml index 0ce9efe10..09c85b191 100644 --- a/upstreamed/ghost/Chart.yaml +++ b/upstreamed/ghost/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: ghost -version: 6.7.25 -appVersion: 2.25.4 +version: 6.7.31 +appVersion: 2.25.7 description: A simple, powerful publishing platform that allows you to share your stories with the world keywords: - ghost diff --git a/upstreamed/ghost/README.md b/upstreamed/ghost/README.md index 7e99ea0d9..2c8063504 100644 --- a/upstreamed/ghost/README.md +++ b/upstreamed/ghost/README.md @@ -56,12 +56,14 @@ The following table lists the configurable parameters of the Ghost chart and the | `image.tag` | Ghost Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override ghost.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override ghost.fullname template with a string | `nil` | | `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | | `volumePermissions.image.repository`| Init container volume-permissions image name | `bitnami/minideb` | | `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | | `volumePermissions.image.pullPolicy`| Init container volume-permissions image pull policy | `Always` | | `ghostHost` | Ghost host to create application URLs | `nil` | -| `ghostPort` | Ghost port to use in application URLs (defaults to `service.port` if `nil`) | `nil` | +| `ghostPort` | Ghost port to use in application URLs (defaults to `service.port` if `nil`) | `nil` | | `ghostProtocol` | Protocol (http or https) to use in the application URLs | `http` | | `ghostPath` | Ghost path to create application URLs | `nil` | | `ghostUsername` | User of the application | `user@example.com` | @@ -83,7 +85,7 @@ The following table lists the configurable parameters of the Ghost chart and the | `service.nodePorts.http` | Kubernetes http node port | `""` | | `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | | `service.loadBalancerIP` | LoadBalancerIP for the Ghost service | `` | -| `service.annotations` | Service annotations | `` | +| `service.annotations` | Service annotations | `` | | `ingress.enabled` | Enable ingress controller resource | `false` | | `ingress.annotations` | Ingress annotations | `[]` | | `ingress.certManager` | Add annotations for cert-manager | `false` | diff --git a/upstreamed/ghost/requirements.lock b/upstreamed/ghost/requirements.lock index 05a9344c6..ec4810e7c 100644 --- a/upstreamed/ghost/requirements.lock +++ b/upstreamed/ghost/requirements.lock @@ -3,4 +3,4 @@ dependencies: repository: https://kubernetes-charts.storage.googleapis.com/ version: 5.11.3 digest: sha256:b3053e73f5c114f55a794eccea2606cc9fe8a669eaab1716246994bbdd37a473 -generated: 2019-07-01T13:59:23.740415441Z +generated: 2019-07-16T10:19:06.007402028Z diff --git a/upstreamed/ghost/values.yaml b/upstreamed/ghost/values.yaml index 2027792e1..05dfee8a8 100644 --- a/upstreamed/ghost/values.yaml +++ b/upstreamed/ghost/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/ghost - tag: 2.25.4-debian-9-r0 + tag: 2.25.7-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override ghost.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override ghost.fullname template +## +# fullnameOverride: + ## Init containers parameters: ## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup ## diff --git a/upstreamed/jasperreports/Chart.yaml b/upstreamed/jasperreports/Chart.yaml index 29657f3cc..e9025882a 100644 --- a/upstreamed/jasperreports/Chart.yaml +++ b/upstreamed/jasperreports/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: jasperreports -version: 4.2.6 +version: 5.0.0 appVersion: 7.2.0 description: The JasperReports server can be used as a stand-alone or embedded reporting and BI server that offers web-based reporting, analytic tools and visualization, diff --git a/upstreamed/jasperreports/README.md b/upstreamed/jasperreports/README.md index d13aa13bf..a0b2644f5 100644 --- a/upstreamed/jasperreports/README.md +++ b/upstreamed/jasperreports/README.md @@ -47,55 +47,57 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the JasperReports chart and their default values. -| Parameter | Description | Default | -|-------------------------------|----------------------------------------------|----------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | JasperReports image registry | `docker.io` | -| `image.repository` | JasperReports Image name | `bitnami/jasperreports` | -| `image.tag` | JasperReports Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `jasperreportsUsername` | User of the application | `user` | -| `jasperreportsPassword` | Application password | _random 10 character long alphanumeric string_ | -| `jasperreportsEmail` | User email | `user@example.com` | -| `smtpHost` | SMTP host | `nil` | -| `smtpPort` | SMTP port | `nil` | -| `smtpEmail` | SMTP email | `nil` | -| `smtpUser` | SMTP user | `nil` | -| `smtpPassword` | SMTP password | `nil` | -| `smtpProtocol` | SMTP protocol [`ssl`, `none`] | `nil` | -| `allowEmptyPassword` | Allow DB blank passwords | `yes` | -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.annotations` | Ingress annotations | `[]` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.hosts[0].name` | Hostname to your JasperReports installation | `jasperreports.local` | -| `ingress.hosts[0].path` | Path within the url structure | `/` | -| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | -| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `jasperreports.local-tls-secret` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | -| `externalDatabase.host` | Host of the external database | `nil` | -| `externalDatabase.port` | Port of the external database | `3306` | -| `externalDatabase.user` | Existing username in the external db | `bn_jasperreports` | -| `externalDatabase.password` | Password for the above username | `nil` | -| `externalDatabase.database` | Name of the existing database | `bitnami_jasperreports` | -| `mariadb.enabled` | Whether to use the MariaDB chart | `true` | -| `mariadb.db.name` | Database name to create | `bitnami_jasperreports` | -| `mariadb.db.user` | Database user to create | `bn_jasperreports` | -| `mariadb.db.password` | Password for the database | `nil` | -| `mariadb.rootUser.password` | MariaDB admin password | `nil` | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.port` | Service HTTP port | `80` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for JasperReports volume | `nil` (uses alpha storage annotation) | -| `persistence.accessMode` | PVC Access Mode for JasperReports volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for JasperReports volume | `8Gi` | -| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| Parameter | Description | Default | +|----------------------------------|----------------------------------------------|----------------------------------------------------------| +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | JasperReports image registry | `docker.io` | +| `image.repository` | JasperReports Image name | `bitnami/jasperreports` | +| `image.tag` | JasperReports Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override jasperreports.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override jasperreports.fullname template with a string | `nil` | +| `jasperreportsUsername` | User of the application | `user` | +| `jasperreportsPassword` | Application password | _random 10 character long alphanumeric string_ | +| `jasperreportsEmail` | User email | `user@example.com` | +| `smtpHost` | SMTP host | `nil` | +| `smtpPort` | SMTP port | `nil` | +| `smtpEmail` | SMTP email | `nil` | +| `smtpUser` | SMTP user | `nil` | +| `smtpPassword` | SMTP password | `nil` | +| `smtpProtocol` | SMTP protocol [`ssl`, `none`] | `nil` | +| `allowEmptyPassword` | Allow DB blank passwords | `yes` | +| `ingress.enabled` | Enable ingress controller resource | `false` | +| `ingress.annotations` | Ingress annotations | `[]` | +| `ingress.certManager` | Add annotations for cert-manager | `false` | +| `ingress.hosts[0].name` | Hostname to your JasperReports installation | `jasperreports.local` | +| `ingress.hosts[0].path` | Path within the url structure | `/` | +| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | +| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `jasperreports.local-tls-secret` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | +| `externalDatabase.host` | Host of the external database | `nil` | +| `externalDatabase.port` | Port of the external database | `3306` | +| `externalDatabase.user` | Existing username in the external db | `bn_jasperreports` | +| `externalDatabase.password` | Password for the above username | `nil` | +| `externalDatabase.database` | Name of the existing database | `bitnami_jasperreports` | +| `mariadb.enabled` | Whether to use the MariaDB chart | `true` | +| `mariadb.db.name` | Database name to create | `bitnami_jasperreports` | +| `mariadb.db.user` | Database user to create | `bn_jasperreports` | +| `mariadb.db.password` | Password for the database | `nil` | +| `mariadb.rootUser.password` | MariaDB admin password | `nil` | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.port` | Service HTTP port | `80` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `persistence.enabled` | Enable persistence using PVC | `true` | +| `persistence.storageClass` | PVC Storage Class for JasperReports volume | `nil` (uses alpha storage annotation) | +| `persistence.accessMode` | PVC Access Mode for JasperReports volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for JasperReports volume | `8Gi` | +| `resources` | CPU/Memory resource requests/limits | `{Memory: 512Mi, CPU: 300m}` | The above parameters map to the env variables defined in [bitnami/jasperreports](http://github.com/bitnami/bitnami-docker-jasperreports). For more information please refer to the [bitnami/jasperreports](http://github.com/bitnami/bitnami-docker-jasperreports) image documentation. diff --git a/upstreamed/jasperreports/templates/_helpers.tpl b/upstreamed/jasperreports/templates/_helpers.tpl index ca05bc7fa..0253a76f8 100644 --- a/upstreamed/jasperreports/templates/_helpers.tpl +++ b/upstreamed/jasperreports/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "jasperreports.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. diff --git a/upstreamed/jasperreports/values.yaml b/upstreamed/jasperreports/values.yaml index 881089519..978f62aff 100644 --- a/upstreamed/jasperreports/values.yaml +++ b/upstreamed/jasperreports/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override jasperreports.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override jasperreports.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-jasperreports#configuration ## diff --git a/upstreamed/joomla/Chart.yaml b/upstreamed/joomla/Chart.yaml index 14e3e14f7..6280de7a7 100644 --- a/upstreamed/joomla/Chart.yaml +++ b/upstreamed/joomla/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: joomla -version: 4.3.5 -appVersion: 3.9.8 +version: 5.1.1 +appVersion: 3.9.10 description: PHP content management system (CMS) for publishing web content keywords: - joomla diff --git a/upstreamed/joomla/README.md b/upstreamed/joomla/README.md index ca0560472..548ca5ff5 100644 --- a/upstreamed/joomla/README.md +++ b/upstreamed/joomla/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the Joomla! chart and t | `image.tag` | Joomla! Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override joomla.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override joomla.fullname template with a string | `nil` | | `joomlaUsername` | User of the application | `user` | | `joomlaPassword` | Application password | _random 10 character long alphanumeric string_ | | `joomlaEmail` | Admin email | `user@example.com` | @@ -117,8 +119,8 @@ The following table lists the configurable parameters of the Joomla! chart and t | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/joomla/requirements.lock b/upstreamed/joomla/requirements.lock index 8f78b1174..88403cb16 100644 --- a/upstreamed/joomla/requirements.lock +++ b/upstreamed/joomla/requirements.lock @@ -3,4 +3,4 @@ dependencies: repository: https://kubernetes-charts.storage.googleapis.com/ version: 5.11.3 digest: sha256:0593b73b2163fbbbae061de1aa2b8280d43f8a423a91e1c7375c0b6c86784b1c -generated: 2019-07-01T13:33:56.628962561Z +generated: 2019-07-09T22:21:57.659633368Z diff --git a/upstreamed/joomla/templates/_helpers.tpl b/upstreamed/joomla/templates/_helpers.tpl index 9862ea702..d81e51cd6 100644 --- a/upstreamed/joomla/templates/_helpers.tpl +++ b/upstreamed/joomla/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "joomla.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. diff --git a/upstreamed/joomla/values.yaml b/upstreamed/joomla/values.yaml index 681a13af9..baafbce24 100644 --- a/upstreamed/joomla/values.yaml +++ b/upstreamed/joomla/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/joomla - tag: 3.9.8-debian-9-r21 + tag: 3.9.10-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override joomla.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override joomla.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-joomla#environment-variables ## @@ -262,8 +270,8 @@ metrics: image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/kubewatch/Chart.yaml b/upstreamed/kubewatch/Chart.yaml index f8b730671..800184ecf 100644 --- a/upstreamed/kubewatch/Chart.yaml +++ b/upstreamed/kubewatch/Chart.yaml @@ -1,5 +1,5 @@ name: kubewatch -version: 0.8.2 +version: 0.8.5 apiVersion: v1 appVersion: 0.0.4 home: https://github.com/bitnami-labs/kubewatch diff --git a/upstreamed/kubewatch/README.md b/upstreamed/kubewatch/README.md index 88bf2486f..da12e6543 100644 --- a/upstreamed/kubewatch/README.md +++ b/upstreamed/kubewatch/README.md @@ -37,49 +37,51 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the kubewatch chart and their default values. -| Parameter | Description | Default | -| ---------------------------------------- | ------------------------------------ | --------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `affinity` | node/pod affinities | None | -| `image.registry` | Image registry | `docker.io` | -| `image.repository` | Image repository | `bitnami/kubewatch` | -| `image.tag` | Image tag | `{VERSION}` | -| `image.pullPolicy` | Image pull policy | `Always` | -| `nodeSelector` | node labels for pod assignment | `{}` | -| `podAnnotations` | annotations to add to each pod | `{}` | -| `podLabels` | additional labesl to add to each pod | `{}` | -| `replicaCount` | desired number of pods | `1` | -| `rbac.create` | If true, create & use RBAC resources | `true` | -| `serviceAccount.create` | If true, create a serviceAccount | `true` | -| `serviceAccount.name` | existing ServiceAccount to use (ignored if rbac.create=true) | `` | -| `resources` | pod resource requests & limits | `{}` | -| `slack.enabled` | Enable Slack notifications | `true` | -| `slack.channel` | Slack channel to notify | `""` | -| `slack.token` | Slack API token | `""` | -| `hipchat.enabled` | Enable HipChat notifications | `false` | -| `hipchat.url` | HipChat URL | `""` | -| `hipchat.room` | HipChat room to notify | `""` | -| `hipchat.token` | HipChat token | `""` | -| `mattermost.enabled` | Enable Mattermost notifications | `false` | -| `mattermost.channel` | Mattermost channel to notify | `""` | -| `mattermost.username` | Mattermost user to notify | `""` | -| `mattermost.url` | Mattermost URL | `""` | -| `flock.enabled` | Enable Flock notifications | `false` | -| `flock.url` | Flock URL | `""` | -| `webhook.enabled` | Enable Webhook notifications | `false` | -| `webhook.url` | Webhook URL | `""` | -| `tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `[]` | -| `namespaceToWatch` | namespace to watch, leave it empty for watching all | `""` | -| `resourcesToWatch` | list of resources which kubewatch should watch and notify slack | `{pod: true, deployment: true}` | -| `resourcesToWatch.pod` | watch changes to [Pods](https://kubernetes.io/docs/concepts/workloads/pods/pod-overview/) | `true` | -| `resourcesToWatch.deployment` | watch changes to [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) | `true` | -| `resourcesToWatch.replicationcontroller` | watch changes to [ReplicationControllers](https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/) | `false` | -| `resourcesToWatch.replicaset` | watch changes to [ReplicaSets](https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/) | `false` | -| `resourcesToWatch.daemonset` | watch changes to [DaemonSets](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) | `false` | -| `resourcesToWatch.services` | watch changes to [Services](https://kubernetes.io/docs/concepts/services-networking/service/) | `false` | -| `resourcesToWatch.job` | watch changes to [Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/) | `false` | -| `resourcesToWatch.persistentvolume` | watch changes to [PersistentVolumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) | `false` | +| Parameter | Description | Default | +| ---------------------------------------- | ---------------------------------------------------------------------------------------------------------- | --------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `affinity` | node/pod affinities | None | +| `image.registry` | Image registry | `docker.io` | +| `image.repository` | Image repository | `bitnami/kubewatch` | +| `image.tag` | Image tag | `{VERSION}` | +| `image.pullPolicy` | Image pull policy | `Always` | +| `nameOverride` | String to partially override kubewatch.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override kubewatch.fullname template with a string | `nil` | +| `nodeSelector` | node labels for pod assignment | `{}` | +| `podAnnotations` | annotations to add to each pod | `{}` | +| `podLabels` | additional labesl to add to each pod | `{}` | +| `replicaCount` | desired number of pods | `1` | +| `rbac.create` | If true, create & use RBAC resources | `true` | +| `serviceAccount.create` | If true, create a serviceAccount | `true` | +| `serviceAccount.name` | existing ServiceAccount to use (ignored if rbac.create=true) | `` | +| `resources` | pod resource requests & limits | `{}` | +| `slack.enabled` | Enable Slack notifications | `true` | +| `slack.channel` | Slack channel to notify | `""` | +| `slack.token` | Slack API token | `""` | +| `hipchat.enabled` | Enable HipChat notifications | `false` | +| `hipchat.url` | HipChat URL | `""` | +| `hipchat.room` | HipChat room to notify | `""` | +| `hipchat.token` | HipChat token | `""` | +| `mattermost.enabled` | Enable Mattermost notifications | `false` | +| `mattermost.channel` | Mattermost channel to notify | `""` | +| `mattermost.username` | Mattermost user to notify | `""` | +| `mattermost.url` | Mattermost URL | `""` | +| `flock.enabled` | Enable Flock notifications | `false` | +| `flock.url` | Flock URL | `""` | +| `webhook.enabled` | Enable Webhook notifications | `false` | +| `webhook.url` | Webhook URL | `""` | +| `tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `[]` | +| `namespaceToWatch` | namespace to watch, leave it empty for watching all | `""` | +| `resourcesToWatch` | list of resources which kubewatch should watch and notify slack | `{pod: true, deployment: true}` | +| `resourcesToWatch.pod` | watch changes to [Pods](https://kubernetes.io/docs/concepts/workloads/pods/pod-overview/) | `true` | +| `resourcesToWatch.deployment` | watch changes to [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) | `true` | +| `resourcesToWatch.replicationcontroller` | watch changes to [ReplicationControllers](https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/) | `false` | +| `resourcesToWatch.replicaset` | watch changes to [ReplicaSets](https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/) | `false` | +| `resourcesToWatch.daemonset` | watch changes to [DaemonSets](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) | `false` | +| `resourcesToWatch.services` | watch changes to [Services](https://kubernetes.io/docs/concepts/services-networking/service/) | `false` | +| `resourcesToWatch.job` | watch changes to [Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/) | `false` | +| `resourcesToWatch.persistentvolume` | watch changes to [PersistentVolumes](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) | `false` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/upstreamed/kubewatch/values.yaml b/upstreamed/kubewatch/values.yaml index e8748c3ec..f236d3e7b 100644 --- a/upstreamed/kubewatch/values.yaml +++ b/upstreamed/kubewatch/values.yaml @@ -58,6 +58,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override kubewatch.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override kubewatch.fullname template +## +# fullnameOverride: + rbac: # If true, create & use RBAC resources # diff --git a/upstreamed/mariadb/Chart.yaml b/upstreamed/mariadb/Chart.yaml index c53bbc58b..eee5b5a9a 100644 --- a/upstreamed/mariadb/Chart.yaml +++ b/upstreamed/mariadb/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: mariadb -version: 6.5.5 +version: 6.7.1 appVersion: 10.3.16 description: Fast, reliable, scalable, and easy to use open-source relational database system. MariaDB Server is intended for mission-critical, heavy-load production systems as well as for embedding into mass-deployed software. Highly available MariaDB cluster. keywords: diff --git a/upstreamed/mariadb/README.md b/upstreamed/mariadb/README.md index b1ba58126..374d3fbd1 100644 --- a/upstreamed/mariadb/README.md +++ b/upstreamed/mariadb/README.md @@ -57,6 +57,14 @@ The following table lists the configurable parameters of the MariaDB chart and t | `image.pullPolicy` | MariaDB image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug logs should be enabled | `false` | +| `nameOverride` | String to partially override mariadb.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override mariadb.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | | `service.type` | Kubernetes service type | `ClusterIP` | | `service.clusterIp` | Specific cluster IP when service type is cluster IP. Use None for headless service | `nil` | | `service.port` | MySQL service port | `3306` | @@ -148,8 +156,8 @@ The following table lists the configurable parameters of the MariaDB chart and t | `slave.podDisruptionBudget.maxUnavailable`| Maximum number / percentage of pods that may be made unavailable | `nil` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Exporter image registry | `docker.io` | -| `metrics.image.repository` | Exporter image name | `prom/mysqld-exporter` | -| `metrics.image.tag` | Exporter image tag | `v0.10.0` | +| `metrics.image.repository` | Exporter image name | `bitnami/mysqld-exporter` | +| `metrics.image.tag` | Exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Exporter image pull policy | `IfNotPresent` | | `metrics.resources` | Exporter resource requests/limit | `nil` | | `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | @@ -229,6 +237,15 @@ The [Bitnami MariaDB](https://github.com/bitnami/bitnami-docker-mariadb) image s The chart mounts a [Persistent Volume](kubernetes.io/docs/user-guide/persistent-volumes/) volume at this location. The volume is created using dynamic volume provisioning, by default. An existing PersistentVolumeClaim can be defined. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Extra Init Containers The feature allows for specifying a template string for a initContainer in the master/slave pod. Usecases include situations when you need some pre-run setup. For example, in IKS (IBM Cloud Kubernetes Service), non-root users do not have write permission on the volume mount path for NFS-powered file storage. So, you could use a initcontainer to `chown` the mount. See a example below, where we add an initContainer on the master pod that reports to an external resource that the db is going to starting. diff --git a/upstreamed/mariadb/templates/_helpers.tpl b/upstreamed/mariadb/templates/_helpers.tpl index 98fed6406..62d25e9bd 100644 --- a/upstreamed/mariadb/templates/_helpers.tpl +++ b/upstreamed/mariadb/templates/_helpers.tpl @@ -124,7 +124,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -132,8 +132,11 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -141,5 +144,31 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "mariadb.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/upstreamed/mariadb/templates/master-statefulset.yaml b/upstreamed/mariadb/templates/master-statefulset.yaml index e7f35fb17..a79947337 100644 --- a/upstreamed/mariadb/templates/master-statefulset.yaml +++ b/upstreamed/mariadb/templates/master-statefulset.yaml @@ -85,10 +85,22 @@ spec: {{ toYaml . | indent 8 }} {{- end }} {{- include "mariadb.imagePullSecrets" . | indent 6 }} - {{- if .Values.master.extraInitContainers }} initContainers: + {{- if .Values.master.extraInitContainers }} {{ tpl .Values.master.extraInitContainers . | indent 6}} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.master.persistence.enabled }} + - name: volume-permissions + image: {{ template "mariadb.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.master.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.master.persistence.mountPath }} + {{- end }} containers: - name: "mariadb" image: {{ template "mariadb.image" . }} diff --git a/upstreamed/mariadb/templates/slave-statefulset.yaml b/upstreamed/mariadb/templates/slave-statefulset.yaml index 45158e1a8..73430e070 100644 --- a/upstreamed/mariadb/templates/slave-statefulset.yaml +++ b/upstreamed/mariadb/templates/slave-statefulset.yaml @@ -86,10 +86,22 @@ spec: {{ toYaml . | indent 8 }} {{- end }} {{- include "mariadb.imagePullSecrets" . | indent 6 }} - {{- if .Values.master.extraInitContainers }} initContainers: + {{- if .Values.master.extraInitContainers }} {{ tpl .Values.master.extraInitContainers . | indent 6}} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.slave.persistence.enabled }} + - name: volume-permissions + image: {{ template "mariadb.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "/bitnami/mariadb"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: /bitnami/mariadb + {{- end }} containers: - name: "mariadb" image: {{ template "mariadb.image" . }} diff --git a/upstreamed/mariadb/values-production.yaml b/upstreamed/mariadb/values-production.yaml index d8a03b74b..9e4484423 100644 --- a/upstreamed/mariadb/values-production.yaml +++ b/upstreamed/mariadb/values-production.yaml @@ -18,7 +18,7 @@ image: registry: docker.io repository: bitnami/mariadb - tag: 10.3.16-debian-9-r16 + tag: 10.3.16-debian-9-r29 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -36,6 +36,32 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override mariadb.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override mariadb.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + service: ## Kubernetes service type, ClusterIP and NodePort are supported at present type: ClusterIP @@ -383,8 +409,8 @@ metrics: enabled: true image: registry: docker.io - repository: prom/mysqld-exporter - tag: v0.10.0 + repository: bitnami/mysqld-exporter + tag: 0.12.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/mariadb/values.yaml b/upstreamed/mariadb/values.yaml index 4839ccf7c..2509de6d1 100644 --- a/upstreamed/mariadb/values.yaml +++ b/upstreamed/mariadb/values.yaml @@ -18,7 +18,7 @@ image: registry: docker.io repository: bitnami/mariadb - tag: 10.3.16-debian-9-r16 + tag: 10.3.16-debian-9-r29 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -36,6 +36,32 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override mariadb.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override mariadb.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + service: ## Kubernetes service type, ClusterIP and NodePort are supported at present type: ClusterIP @@ -383,8 +409,8 @@ metrics: enabled: false image: registry: docker.io - repository: prom/mysqld-exporter - tag: v0.10.0 + repository: bitnami/mysqld-exporter + tag: 0.12.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/mediawiki/Chart.yaml b/upstreamed/mediawiki/Chart.yaml index 0a5b9bb7e..281b66121 100644 --- a/upstreamed/mediawiki/Chart.yaml +++ b/upstreamed/mediawiki/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: mediawiki -version: 6.3.6 +version: 7.1.1 appVersion: 1.33.0 description: Extremely powerful, scalable software and a feature-rich wiki implementation that uses PHP to process and display data stored in a database. home: http://www.mediawiki.org/ diff --git a/upstreamed/mediawiki/README.md b/upstreamed/mediawiki/README.md index d0d9b178c..b7aff068e 100644 --- a/upstreamed/mediawiki/README.md +++ b/upstreamed/mediawiki/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the MediaWiki chart and | `image.tag` | MediaWiki Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override mediawiki.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override mediawiki.fullname template with a string | `nil` | | `mediawikiUser` | User of the application | `user` | | `mediawikiPassword` | Application password | _random 10 character long alphanumeric string_ | | `mediawikiEmail` | Admin email | `user@example.com` | @@ -113,8 +115,8 @@ The following table lists the configurable parameters of the MediaWiki chart and | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/mediawiki/templates/_helpers.tpl b/upstreamed/mediawiki/templates/_helpers.tpl index 57adf0e7e..3f75466fe 100644 --- a/upstreamed/mediawiki/templates/_helpers.tpl +++ b/upstreamed/mediawiki/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "mediawiki.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. diff --git a/upstreamed/mediawiki/values.yaml b/upstreamed/mediawiki/values.yaml index 3685f6a02..eb42fcc92 100644 --- a/upstreamed/mediawiki/values.yaml +++ b/upstreamed/mediawiki/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override mediawiki.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override mediawiki.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-mediawiki#environment-variables ## @@ -259,8 +267,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/mongodb/Chart.yaml b/upstreamed/mongodb/Chart.yaml index 60e99a448..86e1ef048 100644 --- a/upstreamed/mongodb/Chart.yaml +++ b/upstreamed/mongodb/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: mongodb -version: 6.1.0 +version: 6.2.0 appVersion: 4.0.10 description: NoSQL document-oriented database that stores JSON-like documents with dynamic schemas, simplifying the integration of data in content-driven applications. keywords: diff --git a/upstreamed/mongodb/README.md b/upstreamed/mongodb/README.md index 46332c348..523625dde 100644 --- a/upstreamed/mongodb/README.md +++ b/upstreamed/mongodb/README.md @@ -45,118 +45,126 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the MongoDB chart and their default values. -| Parameter | Description | Default | -| -------------------------------------------------- | -------------------------------------------------------------------------------------------- | ------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | MongoDB image registry | `docker.io` | -| `image.repository` | MongoDB Image name | `bitnami/mongodb` | -| `image.tag` | MongoDB Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.debug` | Specify if debug logs should be enabled | `false` | -| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` | -| `usePassword` | Enable password authentication | `true` | -| `existingSecret` | Existing secret with MongoDB credentials | `nil` | -| `mongodbRootPassword` | MongoDB admin password | `random alphanumeric string (10)` | -| `mongodbUsername` | MongoDB custom user | `nil` | -| `mongodbPassword` | MongoDB custom user password | `random alphanumeric string (10)` | -| `mongodbDatabase` | Database to create | `nil` | -| `mongodbEnableIPv6` | Switch to enable/disable IPv6 on MongoDB | `false` | -| `mongodbDirectoryPerDB` | Switch to enable/disable DirectoryPerDB on MongoDB | `false` | -| `mongodbSystemLogVerbosity` | MongoDB systen log verbosity level | `0` | -| `mongodbDisableSystemLog` | Whether to disable MongoDB system log or not | `false` | -| `mongodbExtraFlags` | MongoDB additional command line flags | `[]` | -| `service.annotations` | Kubernetes service annotations | `{}` | -| `service.type` | Kubernetes Service type | `ClusterIP` | -| `service.clusterIP` | Static clusterIP or None for headless services | `nil` | -| `service.nodePort` | Port to bind to for NodePort service type | `nil` | -| `service.loadBalancerIP` | Static IP Address to use for LoadBalancer service type | `nil` | -| `service.externalIPs` | External IP list to use with ClusterIP service type | `[]` | -| `service.loadBalancerSourceRanges` | List of IP ranges allowed access to load balancer (if supported) | `[]` (does not add IP range restrictions to the service)| -| `port` | MongoDB service port | `27017` | -| `replicaSet.enabled` | Switch to enable/disable replica set configuration | `false` | -| `replicaSet.name` | Name of the replica set | `rs0` | -| `replicaSet.useHostnames` | Enable DNS hostnames in the replica set config | `true` | -| `replicaSet.key` | Key used for authentication in the replica set | `random alphanumeric string (10)` | -| `replicaSet.replicas.secondary` | Number of secondary nodes in the replica set | `1` | -| `replicaSet.replicas.arbiter` | Number of arbiter nodes in the replica set | `1` | -| `replicaSet.pdb.enabled` | Switch to enable/disable Pod Disruption Budget | `true` | -| `replicaSet.pdb.minAvailable.primary` | PDB (min available) for the MongoDB Primary nodes | `1` | -| `replicaSet.pdb.minAvailable.secondary` | PDB (min available) for the MongoDB Secondary nodes | `1` | -| `replicaSet.pdb.minAvailable.arbiter` | PDB (min available) for the MongoDB Arbiter nodes | `1` | -| `replicaSet.pdb.maxUnavailable.primary` | PDB (max unavailable) for the MongoDB Primary nodes | `nil` | -| `replicaSet.pdb.maxUnavailable.secondary` | PDB (max unavailable) for the MongoDB Secondary nodes | `nil` | -| `replicaSet.pdb.maxUnavailable.arbiter` | PDB (max unavailable) for the MongoDB Arbiter nodes | `nil` | -| `podAnnotations` | Annotations to be added to pods | `{}` | -| `podLabels` | Additional labels for the pod(s). | `{}` | -| `resources` | Pod resources | `{}` | -| `priorityClassName` | Pod priority class name | `` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `affinity` | Affinity for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `{}` | -| `updateStrategy` | Statefulsets update strategy policy | `RollingUpdate` | -| `securityContext.enabled` | Enable security context | `true` | -| `securityContext.fsGroup` | Group ID for the container | `1001` | -| `securityContext.runAsUser` | User ID for the container | `1001` | -| `schedulerName` | Name of the k8s scheduler (other than default) | `nil` | -| `persistence.enabled` | Use a PVC to persist data | `true` | -| `persistence.mountPath` | Path to mount the volume at | `/bitnami/mongodb` | -| `persistence.subPath` | Subdirectory of the volume to mount at | `""` | -| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | -| `persistence.accessModes` | Use volume as ReadOnly or ReadWrite | `[ReadWriteOnce]` | -| `persistence.size` | Size of data volume | `8Gi` | -| `persistence.annotations` | Persistent Volume annotations | `{}` | -| `persistence.existingClaim` | Name of an existing PVC to use (avoids creating one if this is given) | `nil` | -| `extraInitContainers` | Additional init containers as a string to be passed to the `tpl` function | `{}` | -| `livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | -| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `30` | -| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | -| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | -| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | -| `readinessProbe.enabled` | Enable/disable the Readiness probe | `true` | -| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | -| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | -| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | -| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | -| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | -| `initConfigMap.name` | Custom config map with init scripts | `nil` | -| `configmap` | MongoDB configuration file to be used | `nil` | -| `ingress.enabled` | Enables Ingress. Tested with nginx-ingress version `1.3.1` | `false` | -| `ingress.annotations` | Ingress annotations | `{}` | -| `ingress.labels` | Custom labels | `{}` | -| `ingress.paths` | Ingress paths | `[/]` | -| `ingress.hosts` | Ingress accepted hostnames | `[]` | -| `ingress.tls` | Ingress TLS configuration | `[ { secretName: secret-tls, hosts: [] } ]` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | MongoDB exporter image registry | `docker.io` | -| `metrics.image.repository` | MongoDB exporter image name | `forekshub/percona-mongodb-exporter` | -| `metrics.image.tag` | MongoDB exporter image tag | `latest` | -| `metrics.image.pullPolicy` | Image pull policy | `Always` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations.prometheus.io/scrape` | Additional annotations for Metrics exporter pod | `true` | -| `metrics.podAnnotations.prometheus.io/port` | Additional annotations for Metrics exporter pod | `"9216"` | -| `metrics.extraArgs` | String with extra arguments for the MongoDB Exporter | `` | -| `metrics.resources` | Exporter resource requests/limit | `{}` | -| `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using PrometheusOperator | `false` | -| `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `nil` | -| `metrics.serviceMonitor.additionalLabels` | Used to pass Labels that are required by the Installed Prometheus Operator | `{}` | -| `metrics.serviceMonitor.relabellings` | Specify Metric Relabellings to add to the scrape endpoint | `nil` | -| `metrics.serviceMonitor.alerting.rules` | Define individual alerting rules as required | `{}` | -| `metrics.serviceMonitor.alerting.additionalLabels` | Used to pass Labels that are required by the Installed Prometheus Operator | `{}` | -| `metrics.livenessProbe.enabled` | Enable/disable the Liveness Check of Prometheus metrics exporter | `false` | -| `metrics.livenessProbe.initialDelaySeconds` | Initial Delay for Liveness Check of Prometheus metrics exporter | `15` | -| `metrics.livenessProbe.periodSeconds` | How often to perform Liveness Check of Prometheus metrics exporter | `5` | -| `metrics.livenessProbe.timeoutSeconds` | Timeout for Liveness Check of Prometheus metrics exporter | `5` | -| `metrics.livenessProbe.failureThreshold` | Failure Threshold for Liveness Check of Prometheus metrics exporter | `3` | -| `metrics.livenessProbe.successThreshold` | Success Threshold for Liveness Check of Prometheus metrics exporter | `1` | -| `metrics.readinessProbe.enabled` | Enable/disable the Readiness Check of Prometheus metrics exporter | `false` | -| `metrics.readinessProbe.initialDelaySeconds` | Initial Delay for Readiness Check of Prometheus metrics exporter | `5` | -| `metrics.readinessProbe.periodSeconds` | How often to perform Readiness Check of Prometheus metrics exporter | `5` | -| `metrics.readinessProbe.timeoutSeconds` | Timeout for Readiness Check of Prometheus metrics exporter | `1` | -| `metrics.readinessProbe.failureThreshold` | Failure Threshold for Readiness Check of Prometheus metrics exporter | `3` | -| `metrics.readinessProbe.successThreshold` | Success Threshold for Readiness Check of Prometheus metrics exporter | `1` | +| Parameter | Description | Default | +| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | MongoDB image registry | `docker.io` | +| `image.repository` | MongoDB Image name | `bitnami/mongodb` | +| `image.tag` | MongoDB Image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.debug` | Specify if debug logs should be enabled | `false` | +| `nameOverride` | String to partially override mongodb.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override mongodb.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` | +| `usePassword` | Enable password authentication | `true` | +| `existingSecret` | Existing secret with MongoDB credentials | `nil` | +| `mongodbRootPassword` | MongoDB admin password | `random alphanumeric string (10)` | +| `mongodbUsername` | MongoDB custom user | `nil` | +| `mongodbPassword` | MongoDB custom user password | `random alphanumeric string (10)` | +| `mongodbDatabase` | Database to create | `nil` | +| `mongodbEnableIPv6` | Switch to enable/disable IPv6 on MongoDB | `false` | +| `mongodbDirectoryPerDB` | Switch to enable/disable DirectoryPerDB on MongoDB | `false` | +| `mongodbSystemLogVerbosity` | MongoDB systen log verbosity level | `0` | +| `mongodbDisableSystemLog` | Whether to disable MongoDB system log or not | `false` | +| `mongodbExtraFlags` | MongoDB additional command line flags | `[]` | +| `service.annotations` | Kubernetes service annotations | `{}` | +| `service.type` | Kubernetes Service type | `ClusterIP` | +| `service.clusterIP` | Static clusterIP or None for headless services | `nil` | +| `service.nodePort` | Port to bind to for NodePort service type | `nil` | +| `service.loadBalancerIP` | Static IP Address to use for LoadBalancer service type | `nil` | +| `service.externalIPs` | External IP list to use with ClusterIP service type | `[]` | +| `service.loadBalancerSourceRanges` | List of IP ranges allowed access to load balancer (if supported) | `[]` (does not add IP range restrictions to the service) | +| `port` | MongoDB service port | `27017` | +| `replicaSet.enabled` | Switch to enable/disable replica set configuration | `false` | +| `replicaSet.name` | Name of the replica set | `rs0` | +| `replicaSet.useHostnames` | Enable DNS hostnames in the replica set config | `true` | +| `replicaSet.key` | Key used for authentication in the replica set | `random alphanumeric string (10)` | +| `replicaSet.replicas.secondary` | Number of secondary nodes in the replica set | `1` | +| `replicaSet.replicas.arbiter` | Number of arbiter nodes in the replica set | `1` | +| `replicaSet.pdb.enabled` | Switch to enable/disable Pod Disruption Budget | `true` | +| `replicaSet.pdb.minAvailable.primary` | PDB (min available) for the MongoDB Primary nodes | `1` | +| `replicaSet.pdb.minAvailable.secondary` | PDB (min available) for the MongoDB Secondary nodes | `1` | +| `replicaSet.pdb.minAvailable.arbiter` | PDB (min available) for the MongoDB Arbiter nodes | `1` | +| `replicaSet.pdb.maxUnavailable.primary` | PDB (max unavailable) for the MongoDB Primary nodes | `nil` | +| `replicaSet.pdb.maxUnavailable.secondary` | PDB (max unavailable) for the MongoDB Secondary nodes | `nil` | +| `replicaSet.pdb.maxUnavailable.arbiter` | PDB (max unavailable) for the MongoDB Arbiter nodes | `nil` | +| `podAnnotations` | Annotations to be added to pods | `{}` | +| `podLabels` | Additional labels for the pod(s). | `{}` | +| `resources` | Pod resources | `{}` | +| `priorityClassName` | Pod priority class name | `` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `affinity` | Affinity for pod assignment | `{}` | +| `tolerations` | Toleration labels for pod assignment | `{}` | +| `updateStrategy` | Statefulsets update strategy policy | `RollingUpdate` | +| `securityContext.enabled` | Enable security context | `true` | +| `securityContext.fsGroup` | Group ID for the container | `1001` | +| `securityContext.runAsUser` | User ID for the container | `1001` | +| `schedulerName` | Name of the k8s scheduler (other than default) | `nil` | +| `persistence.enabled` | Use a PVC to persist data | `true` | +| `persistence.mountPath` | Path to mount the volume at | `/bitnami/mongodb` | +| `persistence.subPath` | Subdirectory of the volume to mount at | `""` | +| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) | +| `persistence.accessModes` | Use volume as ReadOnly or ReadWrite | `[ReadWriteOnce]` | +| `persistence.size` | Size of data volume | `8Gi` | +| `persistence.annotations` | Persistent Volume annotations | `{}` | +| `persistence.existingClaim` | Name of an existing PVC to use (avoids creating one if this is given) | `nil` | +| `extraInitContainers` | Additional init containers as a string to be passed to the `tpl` function | `{}` | +| `livenessProbe.enabled` | Enable/disable the Liveness probe | `true` | +| `livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `30` | +| `livenessProbe.periodSeconds` | How often to perform the probe | `10` | +| `livenessProbe.timeoutSeconds` | When the probe times out | `5` | +| `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | +| `readinessProbe.enabled` | Enable/disable the Readiness probe | `true` | +| `readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `5` | +| `readinessProbe.periodSeconds` | How often to perform the probe | `10` | +| `readinessProbe.timeoutSeconds` | When the probe times out | `5` | +| `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` | +| `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` | +| `initConfigMap.name` | Custom config map with init scripts | `nil` | +| `configmap` | MongoDB configuration file to be used | `nil` | +| `ingress.enabled` | Enables Ingress. Tested with nginx-ingress version `1.3.1` | `false` | +| `ingress.annotations` | Ingress annotations | `{}` | +| `ingress.labels` | Custom labels | `{}` | +| `ingress.paths` | Ingress paths | `[/]` | +| `ingress.hosts` | Ingress accepted hostnames | `[]` | +| `ingress.tls` | Ingress TLS configuration | `[ { secretName: secret-tls, hosts: [] } ]` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | MongoDB exporter image registry | `docker.io` | +| `metrics.image.repository` | MongoDB exporter image name | `forekshub/percona-mongodb-exporter` | +| `metrics.image.tag` | MongoDB exporter image tag | `latest` | +| `metrics.image.pullPolicy` | Image pull policy | `Always` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.podAnnotations.prometheus.io/scrape` | Additional annotations for Metrics exporter pod | `true` | +| `metrics.podAnnotations.prometheus.io/port` | Additional annotations for Metrics exporter pod | `"9216"` | +| `metrics.extraArgs` | String with extra arguments for the MongoDB Exporter | `` | +| `metrics.resources` | Exporter resource requests/limit | `{}` | +| `metrics.serviceMonitor.enabled` | Create ServiceMonitor Resource for scraping metrics using PrometheusOperator | `false` | +| `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `nil` | +| `metrics.serviceMonitor.additionalLabels` | Used to pass Labels that are required by the Installed Prometheus Operator | `{}` | +| `metrics.serviceMonitor.relabellings` | Specify Metric Relabellings to add to the scrape endpoint | `nil` | +| `metrics.serviceMonitor.alerting.rules` | Define individual alerting rules as required | `{}` | +| `metrics.serviceMonitor.alerting.additionalLabels` | Used to pass Labels that are required by the Installed Prometheus Operator | `{}` | +| `metrics.livenessProbe.enabled` | Enable/disable the Liveness Check of Prometheus metrics exporter | `false` | +| `metrics.livenessProbe.initialDelaySeconds` | Initial Delay for Liveness Check of Prometheus metrics exporter | `15` | +| `metrics.livenessProbe.periodSeconds` | How often to perform Liveness Check of Prometheus metrics exporter | `5` | +| `metrics.livenessProbe.timeoutSeconds` | Timeout for Liveness Check of Prometheus metrics exporter | `5` | +| `metrics.livenessProbe.failureThreshold` | Failure Threshold for Liveness Check of Prometheus metrics exporter | `3` | +| `metrics.livenessProbe.successThreshold` | Success Threshold for Liveness Check of Prometheus metrics exporter | `1` | +| `metrics.readinessProbe.enabled` | Enable/disable the Readiness Check of Prometheus metrics exporter | `false` | +| `metrics.readinessProbe.initialDelaySeconds` | Initial Delay for Readiness Check of Prometheus metrics exporter | `5` | +| `metrics.readinessProbe.periodSeconds` | How often to perform Readiness Check of Prometheus metrics exporter | `5` | +| `metrics.readinessProbe.timeoutSeconds` | Timeout for Readiness Check of Prometheus metrics exporter | `1` | +| `metrics.readinessProbe.failureThreshold` | Failure Threshold for Readiness Check of Prometheus metrics exporter | `3` | +| `metrics.readinessProbe.successThreshold` | Success Threshold for Readiness Check of Prometheus metrics exporter | `1` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, @@ -248,6 +256,15 @@ The [Bitnami MongoDB](https://github.com/bitnami/bitnami-docker-mongodb) image s The chart mounts a [Persistent Volume](http://kubernetes.io/docs/user-guide/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Upgrading ### To 6.0.0 diff --git a/upstreamed/mongodb/templates/_helpers.tpl b/upstreamed/mongodb/templates/_helpers.tpl index 26f739d60..0f1a1119b 100644 --- a/upstreamed/mongodb/templates/_helpers.tpl +++ b/upstreamed/mongodb/templates/_helpers.tpl @@ -115,7 +115,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -123,8 +123,11 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.image.pullSecrets }} - name: {{ . }} @@ -132,5 +135,31 @@ imagePullSecrets: {{- range .Values.metrics.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "mongodb.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} {{- end -}} {{- end -}} diff --git a/upstreamed/mongodb/templates/deployment-standalone.yaml b/upstreamed/mongodb/templates/deployment-standalone.yaml index fa1991d9e..ef1adec73 100644 --- a/upstreamed/mongodb/templates/deployment-standalone.yaml +++ b/upstreamed/mongodb/templates/deployment-standalone.yaml @@ -55,10 +55,22 @@ spec: {{ toYaml .Values.tolerations | indent 8 }} {{- end }} {{- include "mongodb.imagePullSecrets" . | indent 6 }} - {{- if .Values.extraInitContainers }} initContainers: + {{- if .Values.extraInitContainers }} {{ tpl .Values.extraInitContainers . | indent 6}} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: {{ template "mongodb.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} containers: - name: {{ template "mongodb.fullname" . }} image: {{ template "mongodb.image" . }} @@ -70,8 +82,8 @@ spec: {{- end }} env: {{- if .Values.image.debug}} - - name: NAMI_DEBUG - value: "1" + - name: BITNAMI_DEBUG + value: "true" {{- end }} {{- if .Values.usePassword }} {{- if and .Values.mongodbUsername .Values.mongodbDatabase }} diff --git a/upstreamed/mongodb/templates/statefulset-arbiter-rs.yaml b/upstreamed/mongodb/templates/statefulset-arbiter-rs.yaml index 3877b3aa0..35ed641e9 100644 --- a/upstreamed/mongodb/templates/statefulset-arbiter-rs.yaml +++ b/upstreamed/mongodb/templates/statefulset-arbiter-rs.yaml @@ -77,8 +77,8 @@ spec: name: mongodb env: {{- if .Values.image.debug}} - - name: NAMI_DEBUG - value: "1" + - name: BITNAMI_DEBUG + value: "true" {{- end }} - name: MONGODB_SYSTEM_LOG_VERBOSITY value: {{ .Values.mongodbSystemLogVerbosity | quote }} diff --git a/upstreamed/mongodb/templates/statefulset-primary-rs.yaml b/upstreamed/mongodb/templates/statefulset-primary-rs.yaml index 1c3132e2c..bb9d32575 100644 --- a/upstreamed/mongodb/templates/statefulset-primary-rs.yaml +++ b/upstreamed/mongodb/templates/statefulset-primary-rs.yaml @@ -64,10 +64,22 @@ spec: {{ toYaml .Values.tolerations | indent 8 }} {{- end }} {{- include "mongodb.imagePullSecrets" . | indent 6 }} - {{- if .Values.extraInitContainers }} initContainers: + {{- if .Values.extraInitContainers }} {{ tpl .Values.extraInitContainers . | indent 6}} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: {{ template "mongodb.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: datadir + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} containers: - name: {{ template "mongodb.name" . }}-primary image: {{ template "mongodb.image" . }} @@ -82,8 +94,8 @@ spec: name: mongodb env: {{- if .Values.image.debug}} - - name: NAMI_DEBUG - value: "1" + - name: BITNAMI_DEBUG + value: "true" {{- end }} - name: MONGODB_SYSTEM_LOG_VERBOSITY value: {{ .Values.mongodbSystemLogVerbosity | quote }} diff --git a/upstreamed/mongodb/templates/statefulset-secondary-rs.yaml b/upstreamed/mongodb/templates/statefulset-secondary-rs.yaml index 678db231e..426f4ae31 100644 --- a/upstreamed/mongodb/templates/statefulset-secondary-rs.yaml +++ b/upstreamed/mongodb/templates/statefulset-secondary-rs.yaml @@ -65,10 +65,22 @@ spec: {{ toYaml .Values.tolerations | indent 8 }} {{- end }} {{- include "mongodb.imagePullSecrets" . | indent 6 }} - {{- if .Values.extraInitContainers }} initContainers: + {{- if .Values.extraInitContainers }} {{ tpl .Values.extraInitContainers . | indent 6}} {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + - name: volume-permissions + image: {{ template "mongodb.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }}", "{{ .Values.persistence.mountPath }}"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: datadir + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} containers: - name: {{ template "mongodb.name" . }}-secondary image: {{ template "mongodb.image" . }} @@ -83,8 +95,8 @@ spec: name: mongodb env: {{- if .Values.image.debug}} - - name: NAMI_DEBUG - value: "1" + - name: BITNAMI_DEBUG + value: "true" {{- end }} - name: MONGODB_SYSTEM_LOG_VERBOSITY value: {{ .Values.mongodbSystemLogVerbosity | quote }} diff --git a/upstreamed/mongodb/values-production.yaml b/upstreamed/mongodb/values-production.yaml index b1dec316e..9a252ebe4 100644 --- a/upstreamed/mongodb/values-production.yaml +++ b/upstreamed/mongodb/values-production.yaml @@ -17,7 +17,7 @@ image: ## Bitnami MongoDB image tag ## ref: https://hub.docker.com/r/bitnami/mongodb/tags/ ## - tag: 4.0.10-debian-9-r39 + tag: 4.0.10-debian-9-r53 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -30,10 +30,36 @@ image: # - myRegistryKeySecretName ## Set to true if you would like to see extra information on logs - ## It turns NAMI debugging in minideb - ## ref: https://github.com/bitnami/minideb-extras/#turn-on-nami-debugging + ## It turns on Bitnami debugging in minideb-extras-base + ## ref: https://github.com/bitnami/minideb-extras-base debug: false +## String to partially override mongodb.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override mongodb.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Enable authentication ## ref: https://docs.mongodb.com/manual/tutorial/enable-authentication/ # diff --git a/upstreamed/mongodb/values.yaml b/upstreamed/mongodb/values.yaml index 2a19f31f5..c21849e4b 100644 --- a/upstreamed/mongodb/values.yaml +++ b/upstreamed/mongodb/values.yaml @@ -17,7 +17,7 @@ image: ## Bitnami MongoDB image tag ## ref: https://hub.docker.com/r/bitnami/mongodb/tags/ ## - tag: 4.0.10-debian-9-r39 + tag: 4.0.10-debian-9-r53 ## Specify a imagePullPolicy ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## @@ -30,10 +30,36 @@ image: # - myRegistryKeySecretName ## Set to true if you would like to see extra information on logs - ## It turns NAMI debugging in minideb - ## ref: https://github.com/bitnami/minideb-extras/#turn-on-nami-debugging + ## It turns on Bitnami debugging in minideb-extras-base + ## ref: https://github.com/bitnami/minideb-extras-base debug: false +## String to partially override mongodb.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override mongodb.fullname template +## +# fullnameOverride: + + ## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Enable authentication ## ref: https://docs.mongodb.com/manual/tutorial/enable-authentication/ # diff --git a/upstreamed/moodle/Chart.yaml b/upstreamed/moodle/Chart.yaml index 6e376c15a..7f24c2cd6 100644 --- a/upstreamed/moodle/Chart.yaml +++ b/upstreamed/moodle/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: moodle -version: 4.2.8 +version: 5.1.1 appVersion: 3.7.1 description: Moodle is a learning platform designed to provide educators, administrators and learners with a single robust, secure and integrated system to create personalised learning environments keywords: diff --git a/upstreamed/moodle/README.md b/upstreamed/moodle/README.md index 4056bc7da..1cdb1a65f 100644 --- a/upstreamed/moodle/README.md +++ b/upstreamed/moodle/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the Moodle chart and th | `image.tag` | Moodle Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override moodle.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override moodle.fullname template with a string | `nil` | | `moodleUsername` | User of the application | `user` | | `moodlePassword` | Application password | _random 10 character alphanumeric string_ | | `moodleEmail` | Admin email | `user@example.com` | @@ -118,8 +120,8 @@ The following table lists the configurable parameters of the Moodle chart and th | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/moodle/templates/_helpers.tpl b/upstreamed/moodle/templates/_helpers.tpl index ae6ee9a05..6f7c22e05 100644 --- a/upstreamed/moodle/templates/_helpers.tpl +++ b/upstreamed/moodle/templates/_helpers.tpl @@ -11,24 +11,33 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "moodle.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "moodle.mariadb.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- printf "%s-%s" .Values.fullnameOverride "mariadb" | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} {{- printf "%s-%s" .Release.Name "mariadb" | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s-%s" .Release.Name $name "mariadb" | trunc 63 | trimSuffix "-" -}} +{{- end -}} {{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -*/}} -{{- define "moodle.moodle.fullname" -}} -{{- printf "%s-%s" .Release.Name "moodle" | trunc 63 | trimSuffix "-" -}} {{- end -}} {{/* diff --git a/upstreamed/moodle/templates/deployment.yaml b/upstreamed/moodle/templates/deployment.yaml index b8b3a1559..18df17325 100644 --- a/upstreamed/moodle/templates/deployment.yaml +++ b/upstreamed/moodle/templates/deployment.yaml @@ -154,7 +154,7 @@ spec: - name: moodle-data {{- if .Values.persistence.enabled }} persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim | default (include "moodle.moodle.fullname" . ) }} + claimName: {{ .Values.persistence.existingClaim | default (include "moodle.fullname" . ) }} {{- else }} emptyDir: {} {{- end }} diff --git a/upstreamed/moodle/values.yaml b/upstreamed/moodle/values.yaml index f02189e42..3accaf9c0 100644 --- a/upstreamed/moodle/values.yaml +++ b/upstreamed/moodle/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override moodle.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override moodle.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-moodle#configuration ## @@ -283,8 +291,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/nats/Chart.yaml b/upstreamed/nats/Chart.yaml index 979e918a4..ecc7db57c 100644 --- a/upstreamed/nats/Chart.yaml +++ b/upstreamed/nats/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: nats -version: 3.0.1 -appVersion: 2.0.0 +version: 4.0.0 +appVersion: 2.0.2 description: An open-source, cloud-native messaging system keywords: - nats diff --git a/upstreamed/nats/README.md b/upstreamed/nats/README.md index e2b253f13..31d4097f9 100644 --- a/upstreamed/nats/README.md +++ b/upstreamed/nats/README.md @@ -54,6 +54,8 @@ The following table lists the configurable parameters of the NATS chart and thei | `image.tag` | NATS Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override nats.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override nats.fullname template with a string | `nil` | | `auth.enabled` | Switch to enable/disable client authentication | `true` | | `auth.user` | Client authentication user | `nats_cluster` | | `auth.password` | Client authentication password | `random alhpanumeric string (10)` | diff --git a/upstreamed/nats/templates/_helpers.tpl b/upstreamed/nats/templates/_helpers.tpl index 6159ca095..b52eed847 100644 --- a/upstreamed/nats/templates/_helpers.tpl +++ b/upstreamed/nats/templates/_helpers.tpl @@ -12,9 +12,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "nats.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{- define "nats.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} diff --git a/upstreamed/nats/values-production.yaml b/upstreamed/nats/values-production.yaml index 1601d79e9..0d3c812ac 100644 --- a/upstreamed/nats/values-production.yaml +++ b/upstreamed/nats/values-production.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/nats - tag: 2.0.0-debian-9-r4 + tag: 2.0.2-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - name: myRegistryKeySecretName +## String to partially override nats.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override nats.fullname template +## +# fullnameOverride: + ## NATS replicas replicaCount: 3 diff --git a/upstreamed/nats/values.yaml b/upstreamed/nats/values.yaml index 7b2865d64..e9c3f6a86 100644 --- a/upstreamed/nats/values.yaml +++ b/upstreamed/nats/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/nats - tag: 2.0.0-debian-9-r4 + tag: 2.0.2-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - name: myRegistryKeySecretName +## String to partially override nats.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override nats.fullname template +## +# fullnameOverride: + ## NATS replicas replicaCount: 1 diff --git a/upstreamed/odoo/Chart.yaml b/upstreamed/odoo/Chart.yaml index 311cfde8c..bd34c5ea3 100644 --- a/upstreamed/odoo/Chart.yaml +++ b/upstreamed/odoo/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: odoo -version: 8.1.5 -appVersion: 12.0.20190615 +version: 9.0.0 +appVersion: 12.0.20190715 description: A suite of web based open source business apps. home: https://www.odoo.com/ icon: https://bitnami.com/assets/stacks/odoo/img/odoo-stack-110x117.png diff --git a/upstreamed/odoo/README.md b/upstreamed/odoo/README.md index ebc0e16dc..243c84977 100644 --- a/upstreamed/odoo/README.md +++ b/upstreamed/odoo/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the Odoo chart and thei | `image.tag` | Odoo Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `Always` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override odoo.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override odoo.fullname template with a string | `nil` | | `odooUsername` | User of the application | `user@example.com` | | `odooPassword` | Admin account password | _random 10 character long alphanumeric string_ | | `odooEmail` | Admin account email | `user@example.com` | diff --git a/upstreamed/odoo/requirements.lock b/upstreamed/odoo/requirements.lock index 6fd79f226..d821227f1 100644 --- a/upstreamed/odoo/requirements.lock +++ b/upstreamed/odoo/requirements.lock @@ -3,4 +3,4 @@ dependencies: repository: https://kubernetes-charts.storage.googleapis.com/ version: 4.2.2 digest: sha256:477f1a3eee8875f68a4a7d22735d5dddd539149f52ec214b6314af9804d171e9 -generated: 2019-07-01T12:18:19.507733988Z +generated: 2019-07-15T09:05:57.305438728Z diff --git a/upstreamed/odoo/templates/_helpers.tpl b/upstreamed/odoo/templates/_helpers.tpl index fd57f8739..a2b9c2bf5 100644 --- a/upstreamed/odoo/templates/_helpers.tpl +++ b/upstreamed/odoo/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "odoo.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. diff --git a/upstreamed/odoo/values.yaml b/upstreamed/odoo/values.yaml index e41ef370b..dbf7c04a4 100644 --- a/upstreamed/odoo/values.yaml +++ b/upstreamed/odoo/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/odoo - tag: 12.0.20190615-debian-9-r15 + tag: 12.0.20190715-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override odoo.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override odoo.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-odoo#configuration ## diff --git a/upstreamed/opencart/Chart.yaml b/upstreamed/opencart/Chart.yaml index 7c5465be1..410a91443 100644 --- a/upstreamed/opencart/Chart.yaml +++ b/upstreamed/opencart/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: opencart -version: 4.5.3 +version: 5.1.1 appVersion: 3.0.3-2 description: A free and open source e-commerce platform for online merchants. It provides a professional and reliable foundation for a successful online store. keywords: diff --git a/upstreamed/opencart/README.md b/upstreamed/opencart/README.md index 762977dce..fbc027401 100644 --- a/upstreamed/opencart/README.md +++ b/upstreamed/opencart/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the OpenCart chart and | `image.tag` | OpenCart Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override opencart.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override opencart.fullname template with a string | `nil` | | `opencartHost` | OpenCart host to create application URLs | `nil` | | `service.type` | Kubernetes Service type | `LoadBalancer` | | `service.port` | Service HTTP port | `80` | @@ -103,8 +105,8 @@ The following table lists the configurable parameters of the OpenCart chart and | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/opencart/templates/_helpers.tpl b/upstreamed/opencart/templates/_helpers.tpl index cccd57823..b52bffbce 100644 --- a/upstreamed/opencart/templates/_helpers.tpl +++ b/upstreamed/opencart/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "opencart.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. diff --git a/upstreamed/opencart/values.yaml b/upstreamed/opencart/values.yaml index 68c5e7d9e..87fd479dd 100644 --- a/upstreamed/opencart/values.yaml +++ b/upstreamed/opencart/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override opencart.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override opencart.fullname template +## +# fullnameOverride: + ## OpenCart host to create application URLs ## ref: https://github.com/bitnami/bitnami-docker-opencart#configuration ## @@ -234,8 +242,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/orangehrm/Chart.yaml b/upstreamed/orangehrm/Chart.yaml index f2bf405cb..2e8957a18 100644 --- a/upstreamed/orangehrm/Chart.yaml +++ b/upstreamed/orangehrm/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: orangehrm -version: 4.4.4 +version: 5.1.1 appVersion: 4.3.2-0 description: OrangeHRM is a free HR management system that offers a wealth of modules to suit the needs of your business. diff --git a/upstreamed/orangehrm/README.md b/upstreamed/orangehrm/README.md index b1c9d5d49..a2ea36350 100644 --- a/upstreamed/orangehrm/README.md +++ b/upstreamed/orangehrm/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the OrangeHRM chart and | `image.tag` | OrangeHRM Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override orangehrm.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override orangehrm.fullname template with a string | `nil` | | `orangehrmUsername` | User of the application | `user` | | `orangehrmPassword` | Application password | _random 10 character long alphanumeric string_ | | `smtpHost` | SMTP host | `nil` | @@ -102,9 +104,9 @@ The following table lists the configurable parameters of the OrangeHRM chart and | `mariadb.persistence.size` | PVC Storage Request for MariaDB volume | `8Gi` | | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.registry` | Apache exporter image registry | `docker.io` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/orangehrm/templates/_helpers.tpl b/upstreamed/orangehrm/templates/_helpers.tpl index 53374ec7f..16ac1dccc 100644 --- a/upstreamed/orangehrm/templates/_helpers.tpl +++ b/upstreamed/orangehrm/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "orangehrm.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. diff --git a/upstreamed/orangehrm/values.yaml b/upstreamed/orangehrm/values.yaml index 394ab2007..66ac8b782 100644 --- a/upstreamed/orangehrm/values.yaml +++ b/upstreamed/orangehrm/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override orangehrm.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override orangehrm.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-orangehrm#configuration ## @@ -225,8 +233,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/osclass/Chart.yaml b/upstreamed/osclass/Chart.yaml index 262378ae4..92f1d1218 100644 --- a/upstreamed/osclass/Chart.yaml +++ b/upstreamed/osclass/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: osclass -version: 4.4.3 +version: 5.1.1 appVersion: 3.7.4 description: Osclass is a php script that allows you to quickly create and manage your own free classifieds site. diff --git a/upstreamed/osclass/README.md b/upstreamed/osclass/README.md index f277b0508..145f0baa4 100644 --- a/upstreamed/osclass/README.md +++ b/upstreamed/osclass/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the Osclass chart and t | `image.tag` | Osclass Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override osclass.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override osclass.fullname template with a string | `nil` | | `osclassHost` | Osclass host to create application URLs | `nil` | | `osclassLoadBalancerIP` | `loadBalancerIP` for the Osclass Service | `nil` | | `osclassUsername` | User of the application | `user` | @@ -103,9 +105,9 @@ The following table lists the configurable parameters of the Osclass chart and t | `mariadb.persistence.size` | PVC Storage Request for MariaDB volume | `8Gi` | | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.registry` | Apache exporter image registry | `docker.io` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/osclass/templates/_helpers.tpl b/upstreamed/osclass/templates/_helpers.tpl index a60c101e0..a9ca080f8 100644 --- a/upstreamed/osclass/templates/_helpers.tpl +++ b/upstreamed/osclass/templates/_helpers.tpl @@ -11,9 +11,18 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "osclass.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} + {{/* Create a default fully qualified app name. diff --git a/upstreamed/osclass/values.yaml b/upstreamed/osclass/values.yaml index 7a29fa6d6..80073c2f5 100644 --- a/upstreamed/osclass/values.yaml +++ b/upstreamed/osclass/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override osclass.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override osclass.fullname template +## +# fullnameOverride: + ## Osclass host to create application URLs ## ref: https://github.com/bitnami/bitnami-docker-osclass#configuration ## @@ -249,8 +257,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/owncloud/Chart.yaml b/upstreamed/owncloud/Chart.yaml index eddadd45a..7676ebe2e 100644 --- a/upstreamed/owncloud/Chart.yaml +++ b/upstreamed/owncloud/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: owncloud -version: 4.3.3 -appVersion: 10.2.0 +version: 5.1.1 +appVersion: 10.2.1 description: A file sharing server that puts the control and security of your own data back into your hands. keywords: - owncloud diff --git a/upstreamed/owncloud/README.md b/upstreamed/owncloud/README.md index cc69b6a48..ac9c693ff 100644 --- a/upstreamed/owncloud/README.md +++ b/upstreamed/owncloud/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the ownCloud chart and | `image.tag` | ownCloud Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override owncloud.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override owncloud.fullname template with a string | `nil` | | `ingress.enabled` | Enable ingress controller resource | `false` | | `ingress.hosts[0].name` | Hostname to your ownCloud installation | `owncloud.local` | | `ingress.hosts[0].path` | Path within the url structure | `/` | @@ -91,15 +93,15 @@ The following table lists the configurable parameters of the ownCloud chart and | `persistence.owncloud.accessMode` | PVC Access Mode for ownCloud volume | `ReadWriteOnce` | | `persistence.owncloud.size` | PVC Storage Request for ownCloud volume | `8Gi` | | `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | -| `podAnnotations` | Pod annotations | `{}` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | -| `metrics.resources` | Exporter resource requests/limit | {} | +| `podAnnotations` | Pod annotations | `{}` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | Apache exporter image registry | `docker.io` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | +| `metrics.resources` | Exporter resource requests/limit | {} | The above parameters map to the env variables defined in [bitnami/owncloud](http://github.com/bitnami/bitnami-docker-owncloud). For more information please refer to the [bitnami/owncloud](http://github.com/bitnami/bitnami-docker-owncloud) image documentation. diff --git a/upstreamed/owncloud/requirements.lock b/upstreamed/owncloud/requirements.lock index 09a298232..34ebb00b2 100644 --- a/upstreamed/owncloud/requirements.lock +++ b/upstreamed/owncloud/requirements.lock @@ -3,4 +3,4 @@ dependencies: repository: https://kubernetes-charts.storage.googleapis.com/ version: 5.11.3 digest: sha256:0593b73b2163fbbbae061de1aa2b8280d43f8a423a91e1c7375c0b6c86784b1c -generated: 2019-06-10T08:59:03.110123795Z +generated: 2019-07-09T22:56:41.31818926Z diff --git a/upstreamed/owncloud/templates/_helpers.tpl b/upstreamed/owncloud/templates/_helpers.tpl index 1e3ad787d..5f9962fa2 100644 --- a/upstreamed/owncloud/templates/_helpers.tpl +++ b/upstreamed/owncloud/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "owncloud.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. diff --git a/upstreamed/owncloud/values.yaml b/upstreamed/owncloud/values.yaml index 4a5077f92..ca7628813 100644 --- a/upstreamed/owncloud/values.yaml +++ b/upstreamed/owncloud/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/owncloud - tag: 10.2.0-debian-9-r20 + tag: 10.2.1-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override owncloud.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override owncloud.fullname template +## +# fullnameOverride: + ## For Kubernetes v1.4, v1.5 and v1.6, use 'extensions/v1beta1' ## For Kubernetes v1.7, use 'networking.k8s.io/v1' networkPolicyApiVersion: extensions/v1beta1 @@ -227,8 +235,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/parse/Chart.yaml b/upstreamed/parse/Chart.yaml index e565f650f..83885cdb6 100644 --- a/upstreamed/parse/Chart.yaml +++ b/upstreamed/parse/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: parse -version: 6.2.13 -appVersion: 3.5.0 +version: 7.1.0 +appVersion: 3.6.0 description: Parse is a platform that enables users to add a scalable and powerful backend to launch a full-featured app for iOS, Android, JavaScript, Windows, Unity, and more. keywords: - parse diff --git a/upstreamed/parse/README.md b/upstreamed/parse/README.md index eaf9b4cd5..510dabad5 100644 --- a/upstreamed/parse/README.md +++ b/upstreamed/parse/README.md @@ -45,67 +45,75 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the Parse chart and their default values. -| Parameter | Description | Default | -|---------------------------------------|------------------------------------------|-------------------------------------------------------- | -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port (Dashboard) | `80` | -| `service.loadBalancerIP` | `loadBalancerIP` for the Parse Service | `nil` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `server.image.registry` | Parse image registry | `docker.io` | -| `server.image.repository` | Parse image name | `bitnami/parse` | -| `server.image.tag` | Parse image tag | `{TAG_NAME}` | -| `server.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `server.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `server.securityContext.enabled` | Enable security context for Parse Server | `true` | -| `server.securityContext.fsGroup` | Group ID for Parse Server container | `1001` | -| `server.securityContext.runAsUser` | User ID for Parse Server container | `1001` | -| `server.port` | Parse server server port | `1337` | -| `server.mountPath` | Parse server API mount path | `/parse` | -| `server.appId` | Parse server App Id | `myappID` | -| `server.masterKey` | Parse server Master Key | `random 10 character alphanumeric string` | -| `server.resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | -| `dashboard.enabled` | Enable parse dashboard | `true` | -| `dashboard.image.registry` | Dashboard image registry | `docker.io` | -| `dashboard.image.repository` | Dashboard image name | `bitnami/parse-dashboard` | -| `dashboard.image.tag` | Dashboard image tag | `{TAG_NAME}` | -| `dashboard.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `dashboard.securityContext.enabled` | Enable security context for Dashboard | `true` | -| `dashboard.securityContext.fsGroup` | Group ID for Dashboard container | `1001` | -| `dashboard.securityContext.runAsUser` | User ID for Dashboard container | `1001` | -| `dashboard.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `dashboard.username` | Dashboard username | `user` | -| `dashboard.password` | Dashboard user password | `random 10 character alphanumeric string` | -| `dashboard.appName` | Dashboard application name | `MyDashboard` | -| `dashboard.resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | -| `persistence.enabled` | Enable Parse persistence using PVC | `true` | -| `persistence.storageClass` | PVC Storage Class for Parse volume | `nil` (uses alpha storage class annotation) | -| `persistence.accessMode` | PVC Access Mode for Parse volume | `ReadWriteOnce` | -| `persistence.size` | PVC Storage Request for Parse volume | `8Gi` | -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.annotations` | Ingress annotations | `[]` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.dashboard.hosts[0].name` | Hostname to your Parse Dashboard installation | `ghost.local` | -| `ingress.dashboard.hosts[0].path` | Path within the url structure | `/` | -| `ingress.dashboard.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.dashboard.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | -| `ingress.dashboard.hosts[0].tlsSecret` | TLS Secret (certificates) | `ghost.local-tls-secret` | -| `ingress.server.hosts[0].name` | Hostname to your Parse Server installation | `ghost.local` | -| `ingress.server.hosts[0].path` | Path within the url structure | `/` | -| `ingress.server.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.server.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | -| `ingress.server.hosts[0].tlsSecret` | TLS Secret (certificates) | `ghost.local-tls-secret` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | -| `mongodb.usePassword` | Enable MongoDB password authentication | `true` | -| `mongodb.password` | MongoDB admin password | `nil` | -| `mongodb.persistence.enabled` | Enable MongoDB persistence using PVC | `true` | -| `mongodb.persistence.storageClass` | PVC Storage Class for MongoDB volume | `nil` (uses alpha storage class annotation) | -| `mongodb.persistence.accessMode` | PVC Access Mode for MongoDB volume | `ReadWriteOnce` | -| `mongodb.persistence.size` | PVC Storage Request for MongoDB volume | `8Gi` | +| Parameter | Description | Default | +| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override parse.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override parse.fullname template with a string | `nil` | +| `volumePermissions.enabled` | Enable init container that changes volume permissions in the data directory (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | +| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | +| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | +| `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | +| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | +| `volumePermissions.resources` | Init container resource requests/limit | `nil` | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.port` | Service HTTP port (Dashboard) | `80` | +| `service.loadBalancerIP` | `loadBalancerIP` for the Parse Service | `nil` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `server.image.registry` | Parse image registry | `docker.io` | +| `server.image.repository` | Parse image name | `bitnami/parse` | +| `server.image.tag` | Parse image tag | `{TAG_NAME}` | +| `server.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `server.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `server.securityContext.enabled` | Enable security context for Parse Server | `true` | +| `server.securityContext.fsGroup` | Group ID for Parse Server container | `1001` | +| `server.securityContext.runAsUser` | User ID for Parse Server container | `1001` | +| `server.port` | Parse server server port | `1337` | +| `server.mountPath` | Parse server API mount path | `/parse` | +| `server.appId` | Parse server App Id | `myappID` | +| `server.masterKey` | Parse server Master Key | `random 10 character alphanumeric string` | +| `server.resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| `dashboard.enabled` | Enable parse dashboard | `true` | +| `dashboard.image.registry` | Dashboard image registry | `docker.io` | +| `dashboard.image.repository` | Dashboard image name | `bitnami/parse-dashboard` | +| `dashboard.image.tag` | Dashboard image tag | `{TAG_NAME}` | +| `dashboard.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `dashboard.securityContext.enabled` | Enable security context for Dashboard | `true` | +| `dashboard.securityContext.fsGroup` | Group ID for Dashboard container | `1001` | +| `dashboard.securityContext.runAsUser` | User ID for Dashboard container | `1001` | +| `dashboard.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `dashboard.username` | Dashboard username | `user` | +| `dashboard.password` | Dashboard user password | `random 10 character alphanumeric string` | +| `dashboard.appName` | Dashboard application name | `MyDashboard` | +| `dashboard.resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| `persistence.enabled` | Enable Parse persistence using PVC | `true` | +| `persistence.storageClass` | PVC Storage Class for Parse volume | `nil` (uses alpha storage class annotation) | +| `persistence.accessMode` | PVC Access Mode for Parse volume | `ReadWriteOnce` | +| `persistence.size` | PVC Storage Request for Parse volume | `8Gi` | +| `ingress.enabled` | Enable ingress controller resource | `false` | +| `ingress.annotations` | Ingress annotations | `[]` | +| `ingress.certManager` | Add annotations for cert-manager | `false` | +| `ingress.dashboard.hosts[0].name` | Hostname to your Parse Dashboard installation | `ghost.local` | +| `ingress.dashboard.hosts[0].path` | Path within the url structure | `/` | +| `ingress.dashboard.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.dashboard.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | +| `ingress.dashboard.hosts[0].tlsSecret` | TLS Secret (certificates) | `ghost.local-tls-secret` | +| `ingress.server.hosts[0].name` | Hostname to your Parse Server installation | `ghost.local` | +| `ingress.server.hosts[0].path` | Path within the url structure | `/` | +| `ingress.server.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.server.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | +| `ingress.server.hosts[0].tlsSecret` | TLS Secret (certificates) | `ghost.local-tls-secret` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | +| `mongodb.usePassword` | Enable MongoDB password authentication | `true` | +| `mongodb.password` | MongoDB admin password | `nil` | +| `mongodb.persistence.enabled` | Enable MongoDB persistence using PVC | `true` | +| `mongodb.persistence.storageClass` | PVC Storage Class for MongoDB volume | `nil` (uses alpha storage class annotation) | +| `mongodb.persistence.accessMode` | PVC Access Mode for MongoDB volume | `ReadWriteOnce` | +| `mongodb.persistence.size` | PVC Storage Request for MongoDB volume | `8Gi` | The above parameters map to the env variables defined in [bitnami/parse](http://github.com/bitnami/bitnami-docker-parse). For more information please refer to the [bitnami/parse](http://github.com/bitnami/bitnami-docker-parse) image documentation. @@ -154,6 +162,15 @@ The [Bitnami Parse](https://github.com/bitnami/bitnami-docker-parse) image store Persistent Volume Claims are used to keep the data across deployments. This is known to work in GCE, AWS, and minikube. See the [Configuration](#configuration) section to configure the PVC or to disable persistence. +### Adjust permissions of persistent volume mountpoint + +As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it. + +By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. +As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination. + +You can enable this initContainer by setting `volumePermissions.enabled` to `true`. + ## Upgrading ### To 5.1.0 diff --git a/upstreamed/parse/requirements.lock b/upstreamed/parse/requirements.lock index a417b411d..472d4cc3c 100644 --- a/upstreamed/parse/requirements.lock +++ b/upstreamed/parse/requirements.lock @@ -3,4 +3,4 @@ dependencies: repository: https://kubernetes-charts.storage.googleapis.com/ version: 5.20.3 digest: sha256:37f3adda3a19361c8f04c153e794c057712fb190ef55586ca80e3c13c5786dc3 -generated: 2019-07-04T01:14:33.557753142Z +generated: 2019-07-12T14:19:10.021655379Z diff --git a/upstreamed/parse/templates/_helpers.tpl b/upstreamed/parse/templates/_helpers.tpl index 39a34e9dc..64d505e0f 100644 --- a/upstreamed/parse/templates/_helpers.tpl +++ b/upstreamed/parse/templates/_helpers.tpl @@ -18,16 +18,32 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "parse.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} - +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "parse.mongodb.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- printf "%s-%s" .Values.fullnameOverride "mongodb" | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} {{- printf "%s-%s" .Release.Name "mongodb" | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s-%s" .Release.Name $name "mongodb" | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} {{- end -}} {{/* @@ -112,7 +128,7 @@ imagePullSecrets: {{- range .Values.global.imagePullSecrets }} - name: {{ . }} {{- end }} -{{- else if or .Values.server.image.pullSecrets .Values.dashboard.image.pullSecrets }} +{{- else if or .Values.server.image.pullSecrets .Values.dashboard.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.server.image.pullSecrets }} - name: {{ . }} @@ -120,8 +136,11 @@ imagePullSecrets: {{- range .Values.dashboard.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} -{{- else if or .Values.server.image.pullSecrets .Values.dashboard.image.pullSecrets }} +{{- else if or .Values.server.image.pullSecrets .Values.dashboard.image.pullSecrets .Values.volumePermissions.image.pullSecrets }} imagePullSecrets: {{- range .Values.server.image.pullSecrets }} - name: {{ . }} @@ -129,6 +148,9 @@ imagePullSecrets: {{- range .Values.dashboard.image.pullSecrets }} - name: {{ . }} {{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} {{- end -}} @@ -143,3 +165,26 @@ WARNING: Rolling tag detected ({{ .Values.dashboard.image.repository }}:{{ .Valu +info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ {{- end }} {{- end -}} + +{{/* +Return the proper image name (for the init container volume-permissions image) +*/}} +{{- define "parse.volumePermissions.image" -}} +{{- $registryName := .Values.volumePermissions.image.registry -}} +{{- $repositoryName := .Values.volumePermissions.image.repository -}} +{{- $tag := .Values.volumePermissions.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} diff --git a/upstreamed/parse/templates/server-deployment.yaml b/upstreamed/parse/templates/server-deployment.yaml index bba9a358d..ac9a48009 100644 --- a/upstreamed/parse/templates/server-deployment.yaml +++ b/upstreamed/parse/templates/server-deployment.yaml @@ -29,6 +29,19 @@ spec: runAsUser: {{ .Values.server.securityContext.runAsUser }} {{- end }} {{- include "parse.imagePullSecrets" . | indent 6 }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: volume-permissions + image: {{ template "parse.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: ["chown", "-R", "{{ .Values.server.securityContext.runAsUser }}:{{ .Values.server.securityContext.fsGroup }}", "/bitnami/parse"] + securityContext: + runAsUser: 0 + resources: {{ toYaml .Values.volumePermissions.resources | nindent 10 }} + volumeMounts: + - name: parse-data + mountPath: /bitnami/parse + {{- end }} containers: - name: {{ template "parse.fullname" . }} image: {{ template "parse.server.image" . }} diff --git a/upstreamed/parse/values.yaml b/upstreamed/parse/values.yaml index 79c5c9e54..234822ce1 100644 --- a/upstreamed/parse/values.yaml +++ b/upstreamed/parse/values.yaml @@ -7,6 +7,32 @@ # imagePullSecrets: # - myRegistryKeySecretName +## String to partially override parse.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override parse.fullname template +## +# fullnameOverride: + +## Init containers parameters: +## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section. +## +volumePermissions: + enabled: false + image: + registry: docker.io + repository: bitnami/minideb + tag: latest + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## + # pullSecrets: + # - myRegistryKeySecretName + resources: {} + ## Kubernetes serviceType for Parse Deployment ## ref: http://kubernetes.io/docs/user-guide/services/#publishing-services---service-types ## @@ -36,7 +62,7 @@ server: image: registry: docker.io repository: bitnami/parse - tag: 3.5.0-debian-9-r0 + tag: 3.6.0-debian-9-r1 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -96,7 +122,7 @@ dashboard: image: registry: docker.io repository: bitnami/parse-dashboard - tag: 1.3.3-debian-9-r17 + tag: 1.3.3-debian-9-r23 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images diff --git a/upstreamed/phabricator/Chart.yaml b/upstreamed/phabricator/Chart.yaml index a77da8157..da0023377 100644 --- a/upstreamed/phabricator/Chart.yaml +++ b/upstreamed/phabricator/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: phabricator -version: 5.0.2 -appVersion: 2019.25.0 +version: 6.1.1 +appVersion: 2019.26.0 description: Collection of open source web applications that help software companies build better software. keywords: - phabricator diff --git a/upstreamed/phabricator/README.md b/upstreamed/phabricator/README.md index 917f97c9f..fa8d07381 100644 --- a/upstreamed/phabricator/README.md +++ b/upstreamed/phabricator/README.md @@ -47,62 +47,64 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the Phabricator chart and their default values. -| Parameter | Description | Default | -|----------------------------------------|----------------------------------------------|----------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | Phabricator image registry | `docker.io` | -| `image.repository` | Phabricator image name | `bitnami/phabricator` | -| `image.tag` | Phabricator image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `phabricatorHost` | Phabricator host to create application URLs | `nil` | -| `phabricatorAlternateFileDomain` | Phabricator alternate domain to upload files | `nil` | -| `phabricatorUsername` | User of the application | `user` | -| `phabricatorPassword` | Application password | _random 10 character long alphanumeric string_ | -| `phabricatorEmail` | Admin email | `user@example.com` | -| `phabricatorFirstName` | First name | `First Name` | -| `phabricatorLastName` | Last name | `Last Name` | -| `smtpHost` | SMTP host | `nil` | -| `smtpPort` | SMTP port | `nil` | -| `smtpUser` | SMTP user | `nil` | -| `smtpPassword` | SMTP password | `nil` | -| `smtpProtocol` | SMTP protocol [`ssl`, `tls`] | `nil` | -| `mariadb.rootUser.password` | MariaDB admin password | `nil` | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port | `80` | -| `service.httpsPort` | Service HTTP port | `443` | -| `service.loadBalancerIP` | `loadBalancerIP` for the Phabricator Service | `nil` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `service.nodePorts.https` | Kubernetes https node port | `""` | -| `persistence.enabled` | Enable persistence using PVC | `true` | -| `persistence.phabricator.storageClass` | PVC Storage Class for Phabricator volume | `nil` (uses alpha storage class annotation) | -| `persistence.phabricator.accessMode` | PVC Access Mode for Phabricator volume | `ReadWriteOnce` | -| `persistence.phabricator.size` | PVC Storage Request for Phabricator volume | `8Gi` | -| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.hosts[0].name` | Hostname to your Phabricator installation | `phabricator.local` | -| `ingress.hosts[0].path` | Path within the url structure | `/` | -| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.hosts[0].certManager` | Add annotations for cert-manager | `false` | -| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `phabricator.local-tls-secret` | -| `ingress.hosts[0].annotations` | Annotations for this host's ingress record | `[]` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | -| `podAnnotations` | Pod annotations | `{}` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| Parameter | Description | Default | +|----------------------------------------|--------------------------------------------------|----------------------------------------------------------| +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | Phabricator image registry | `docker.io` | +| `image.repository` | Phabricator image name | `bitnami/phabricator` | +| `image.tag` | Phabricator image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override phabricator.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override phabricator.fullname template with a string | `nil` | +| `phabricatorHost` | Phabricator host to create application URLs | `nil` | +| `phabricatorAlternateFileDomain` | Phabricator alternate domain to upload files | `nil` | +| `phabricatorUsername` | User of the application | `user` | +| `phabricatorPassword` | Application password | _random 10 character long alphanumeric string_ | +| `phabricatorEmail` | Admin email | `user@example.com` | +| `phabricatorFirstName` | First name | `First Name` | +| `phabricatorLastName` | Last name | `Last Name` | +| `smtpHost` | SMTP host | `nil` | +| `smtpPort` | SMTP port | `nil` | +| `smtpUser` | SMTP user | `nil` | +| `smtpPassword` | SMTP password | `nil` | +| `smtpProtocol` | SMTP protocol [`ssl`, `tls`] | `nil` | +| `mariadb.rootUser.password` | MariaDB admin password | `nil` | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.port` | Service HTTP port | `80` | +| `service.httpsPort` | Service HTTP port | `443` | +| `service.loadBalancerIP` | `loadBalancerIP` for the Phabricator Service | `nil` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `service.nodePorts.https` | Kubernetes https node port | `""` | +| `persistence.enabled` | Enable persistence using PVC | `true` | +| `persistence.phabricator.storageClass` | PVC Storage Class for Phabricator volume | `nil` (uses alpha storage class annotation) | +| `persistence.phabricator.accessMode` | PVC Access Mode for Phabricator volume | `ReadWriteOnce` | +| `persistence.phabricator.size` | PVC Storage Request for Phabricator volume | `8Gi` | +| `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | +| `ingress.enabled` | Enable ingress controller resource | `false` | +| `ingress.hosts[0].name` | Hostname to your Phabricator installation | `phabricator.local` | +| `ingress.hosts[0].path` | Path within the url structure | `/` | +| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.hosts[0].certManager` | Add annotations for cert-manager | `false` | +| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `phabricator.local-tls-secret` | +| `ingress.hosts[0].annotations` | Annotations for this host's ingress record | `[]` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | +| `podAnnotations` | Pod annotations | `{}` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | Apache exporter image registry | `docker.io` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | -| `metrics.resources` | Exporter resource requests/limit | {} | -| `nodeSelector` | Node labels for pod assignment | `nil` | -| `affinity` | Node/pod affinities | `nil` | -| `tolerations` | List of node taints to tolerate | `nil` | +| `metrics.resources` | Exporter resource requests/limit | {} | +| `nodeSelector` | Node labels for pod assignment | `nil` | +| `affinity` | Node/pod affinities | `nil` | +| `tolerations` | List of node taints to tolerate | `nil` | The above parameters map to the env variables defined in [bitnami/phabricator](http://github.com/bitnami/bitnami-docker-phabricator). For more information please refer to the [bitnami/phabricator](http://github.com/bitnami/bitnami-docker-phabricator) image documentation. diff --git a/upstreamed/phabricator/requirements.lock b/upstreamed/phabricator/requirements.lock index 7ebcd9492..3fa58178f 100644 --- a/upstreamed/phabricator/requirements.lock +++ b/upstreamed/phabricator/requirements.lock @@ -1,6 +1,6 @@ dependencies: - name: mariadb repository: https://kubernetes-charts.storage.googleapis.com/ - version: 6.5.2 + version: 6.5.5 digest: sha256:98f8faaf456130a5ab8958a3f87b17ea1eed6a40f39fdbf1ee50c3d295ede5ef -generated: 2019-07-01T14:00:00.863100139Z +generated: 2019-07-09T13:15:11.733379632Z diff --git a/upstreamed/phabricator/templates/_helpers.tpl b/upstreamed/phabricator/templates/_helpers.tpl index 2c9d214c9..8e0b99222 100644 --- a/upstreamed/phabricator/templates/_helpers.tpl +++ b/upstreamed/phabricator/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "phabricator.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. diff --git a/upstreamed/phabricator/values.yaml b/upstreamed/phabricator/values.yaml index 09bb998d1..76a6f621c 100644 --- a/upstreamed/phabricator/values.yaml +++ b/upstreamed/phabricator/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/phabricator - tag: 2019.25.0-debian-9-r9 + tag: 2019.26.0-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override phabricator.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override phabricator.fullname template +## +# fullnameOverride: + ## Phabricator host to create application URLs ## ref: https://github.com/bitnami/bitnami-docker-phabricator#configuration ## @@ -211,8 +219,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/phpbb/Chart.yaml b/upstreamed/phpbb/Chart.yaml index 2684e01bf..1211692d6 100644 --- a/upstreamed/phpbb/Chart.yaml +++ b/upstreamed/phpbb/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: phpbb -version: 4.4.3 +version: 5.1.1 appVersion: 3.2.7 description: Community forum that supports the notion of users and groups, file attachments, full-text search, notifications and more. keywords: diff --git a/upstreamed/phpbb/README.md b/upstreamed/phpbb/README.md index 2094895a4..b7cf4b89a 100644 --- a/upstreamed/phpbb/README.md +++ b/upstreamed/phpbb/README.md @@ -55,7 +55,9 @@ The following table lists the configurable parameters of the phpBB chart and the | `image.repository` | phpBB image name | `bitnami/phpbb` | | `image.tag` | phpBB image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override phpbb.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override phpbb.fullname template with a string | `nil` | | `phpbbUser` | User of the application | `user` | | `phpbbPassword` | Application password | _random 10 character long alphanumeric string_ | | `phpbbEmail` | Admin email | `user@example.com` | @@ -68,44 +70,44 @@ The following table lists the configurable parameters of the phpBB chart and the | `externalDatabase.user` | Existing username in the external db | `bn_phpbb` | | `externalDatabase.password` | Password for the above username | `nil` | | `externalDatabase.database` | Name of the existing database | `bitnami_phpbb` | -| `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.annotations` | Ingress annotations | `[]` | -| `ingress.certManager` | Add annotations for cert-manager | `false` | -| `ingress.hosts[0].name` | Hostname to your phpbb installation | `phpbb.local` | -| `ingress.hosts[0].path` | Path within the url structure | `/` | -| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | -| `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | -| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `phpbb.local-tls-secret` | -| `ingress.secrets[0].name` | TLS Secret Name | `nil` | -| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | -| `ingress.secrets[0].key` | TLS Secret Key | `nil` | +| `ingress.enabled` | Enable ingress controller resource | `false` | +| `ingress.annotations` | Ingress annotations | `[]` | +| `ingress.certManager` | Add annotations for cert-manager | `false` | +| `ingress.hosts[0].name` | Hostname to your phpbb installation | `phpbb.local` | +| `ingress.hosts[0].path` | Path within the url structure | `/` | +| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.hosts[0].tlsHosts` | Array of TLS hosts for ingress record (defaults to `ingress.hosts[0].name` if `nil`) | `nil` | +| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `phpbb.local-tls-secret` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | | `mariadb.enabled` | Use or not the MariaDB chart | `true` | -| `mariadb.rootUser.password` | MariaDB admin password | `nil` | -| `mariadb.db.name` | Database name to create | `bitnami_phpbb` | -| `mariadb.db.user` | Database user to create | `bn_phpbb` | -| `mariadb.db.password` | Password for the database | _random 10 character long alphanumeric string_ | -| `service.type` | Kubernetes Service type | `LoadBalancer` | -| `service.port` | Service HTTP port (Dashboard) | `80` | -| `nodePorts.http` | Kubernetes http node port | `""` | -| `nodePorts.https` | Kubernetes https node port | `""` | -| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | -| `service.nodePorts.http` | Kubernetes http node port | `""` | -| `service.nodePorts.https` | Kubernetes https node port | `""` | -| `service.loadBalancerIP` | LoadBalancer service IP | `""` | +| `mariadb.rootUser.password` | MariaDB admin password | `nil` | +| `mariadb.db.name` | Database name to create | `bitnami_phpbb` | +| `mariadb.db.user` | Database user to create | `bn_phpbb` | +| `mariadb.db.password` | Password for the database | _random 10 character long alphanumeric string_ | +| `service.type` | Kubernetes Service type | `LoadBalancer` | +| `service.port` | Service HTTP port (Dashboard) | `80` | +| `nodePorts.http` | Kubernetes http node port | `""` | +| `nodePorts.https` | Kubernetes https node port | `""` | +| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` | +| `service.nodePorts.http` | Kubernetes http node port | `""` | +| `service.nodePorts.https` | Kubernetes https node port | `""` | +| `service.loadBalancerIP` | LoadBalancer service IP | `""` | | `persistence.enabled` | Enable persistence using PVC | `true` | | `persistence.phpbb.storageClass` | PVC Storage Class for phpBB volume | `nil` (uses alpha storage class annotation) | | `persistence.phpbb.accessMode` | PVC Access Mode for phpBB volume | `ReadWriteOnce` | | `persistence.phpbb.size` | PVC Storage Request for phpBB volume | `8Gi` | | `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | -| `podAnnotations` | Pod annotations | `{}` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | -| `metrics.resources` | Exporter resource requests/limit | {} | +| `podAnnotations` | Pod annotations | `{}` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | Apache exporter image registry | `docker.io` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}`| +| `metrics.resources` | Exporter resource requests/limit | {} | The above parameters map to the env variables defined in [bitnami/phpbb](http://github.com/bitnami/bitnami-docker-phpbb). For more information please refer to the [bitnami/phpbb](http://github.com/bitnami/bitnami-docker-phpbb) image documentation. diff --git a/upstreamed/phpbb/templates/_helpers.tpl b/upstreamed/phpbb/templates/_helpers.tpl index fa1476b58..b4aedddc8 100644 --- a/upstreamed/phpbb/templates/_helpers.tpl +++ b/upstreamed/phpbb/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "phpbb.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. diff --git a/upstreamed/phpbb/values.yaml b/upstreamed/phpbb/values.yaml index 10d48afb0..a9cfb0f37 100644 --- a/upstreamed/phpbb/values.yaml +++ b/upstreamed/phpbb/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override phpbb.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override phpbb.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-phpbb#environment-variables ## @@ -230,8 +238,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/phpmyadmin/Chart.yaml b/upstreamed/phpmyadmin/Chart.yaml index 30d413c49..bafd2b174 100644 --- a/upstreamed/phpmyadmin/Chart.yaml +++ b/upstreamed/phpmyadmin/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: phpmyadmin -version: 2.2.5 +version: 2.3.1 appVersion: 4.9.0-1 description: phpMyAdmin is an mysql administration frontend keywords: diff --git a/upstreamed/phpmyadmin/README.md b/upstreamed/phpmyadmin/README.md index d391a70e2..a8c8a88cd 100644 --- a/upstreamed/phpmyadmin/README.md +++ b/upstreamed/phpmyadmin/README.md @@ -44,39 +44,41 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the phpMyAdmin chart and their default values. -| Parameter | Description | Default | -|----------------------------|------------------------------------------|---------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `image.registry` | phpMyAdmin image registry | `docker.io` | -| `image.repository` | phpMyAdmin image name | `bitnami/phpmyadmin` | -| `image.tag` | phpMyAdmin image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `service.type` | Type of service for phpMyAdmin frontend | `ClusterIP` | -| `service.port` | Port to expose service | `80` | -| `db.port` | Database port to use to connect | `3306` | -| `db.chartName` | Database suffix if included in the same release | `nil` | -| `db.host` | Database host to connect to | `nil` | -| `db.bundleTestDB` | Deploy a MariaDB instance for testing purposes | `false` | -| `ingress.enabled` | Ingress resource to be added | `false` | -| `ingress.annotations` | Ingress annotations | `{ingress.kubernetes.io/rewrite-target: /, nginx.ingress.kubernetes.io/rewrite-target: /}` | -| `ingress.path` | Path to access frontend | `/` | -| `ingress.host` | Ingress host | `nil` | -| `ingress.tls` | TLS for ingress | `[]` | -| `resources` | CPU/Memory resource requests/limits | `{}` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `tolerations` | List of node taints to tolerate | `[]` | -| `affinity` | Map of node/pod affinities | `{}` | -| `podAnnotations` | Pod annotations | `{}` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | -| `metrics.resources` | Exporter resource requests/limit | {} | +| Parameter | Description | Default | +|-----------------------------|---------------------------------------------------|---------------------------------------------------------| +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.registry` | phpMyAdmin image registry | `docker.io` | +| `image.repository` | phpMyAdmin image name | `bitnami/phpmyadmin` | +| `image.tag` | phpMyAdmin image tag | `{TAG_NAME}` | +| `image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override phpmyadmin.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override phpmyadmin.fullname template with a string | `nil` | +| `service.type` | Type of service for phpMyAdmin frontend | `ClusterIP` | +| `service.port` | Port to expose service | `80` | +| `db.port` | Database port to use to connect | `3306` | +| `db.chartName` | Database suffix if included in the same release | `nil` | +| `db.host` | Database host to connect to | `nil` | +| `db.bundleTestDB` | Deploy a MariaDB instance for testing purposes | `false` | +| `ingress.enabled` | Ingress resource to be added | `false` | +| `ingress.annotations` | Ingress annotations | `{ingress.kubernetes.io/rewrite-target: /, nginx.ingress.kubernetes.io/rewrite-target: /}` | +| `ingress.path` | Path to access frontend | `/` | +| `ingress.host` | Ingress host | `nil` | +| `ingress.tls` | TLS for ingress | `[]` | +| `resources` | CPU/Memory resource requests/limits | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | List of node taints to tolerate | `[]` | +| `affinity` | Map of node/pod affinities | `{}` | +| `podAnnotations` | Pod annotations | `{}` | +| `metrics.enabled` | Start a side-car prometheus exporter | `false` | +| `metrics.image.registry` | Apache exporter image registry | `docker.io` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | +| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | +| `metrics.resources` | Exporter resource requests/limit | {} | For more information please refer to the [bitnami/phpmyadmin](http://github.com/bitnami/bitnami-docker-Phpmyadmin) image documentation. diff --git a/upstreamed/phpmyadmin/requirements.lock b/upstreamed/phpmyadmin/requirements.lock index 991890bc8..c45ba3753 100644 --- a/upstreamed/phpmyadmin/requirements.lock +++ b/upstreamed/phpmyadmin/requirements.lock @@ -3,4 +3,4 @@ dependencies: repository: https://kubernetes-charts.storage.googleapis.com/ version: 5.11.3 digest: sha256:527badbbb783f27ccfe621bc74311f1a845cbfded31c24671c45490abd4a4fad -generated: 2019-06-10T07:12:38.566370302Z +generated: 2019-07-16T03:49:45.760102852Z diff --git a/upstreamed/phpmyadmin/values.yaml b/upstreamed/phpmyadmin/values.yaml index 99ca14541..a9964426c 100644 --- a/upstreamed/phpmyadmin/values.yaml +++ b/upstreamed/phpmyadmin/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/phpmyadmin - tag: 4.9.0-1-debian-9-r7 + tag: 4.9.0-1-debian-9-r42 ## Specify a imagePullPolicy pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. @@ -23,6 +23,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override phpmyadmin.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override phpmyadmin.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-phpmyadmin#environment-variables ## @@ -97,8 +105,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/postgresql/Chart.yaml b/upstreamed/postgresql/Chart.yaml index 780e5916b..7eb07cc0f 100644 --- a/upstreamed/postgresql/Chart.yaml +++ b/upstreamed/postgresql/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: postgresql -version: 5.3.11 +version: 6.2.0 appVersion: 11.4.0 description: Chart for PostgreSQL, an object-relational database management system (ORDBMS) with an emphasis on extensibility and on standards-compliance. keywords: diff --git a/upstreamed/postgresql/README.md b/upstreamed/postgresql/README.md index 8e7d48132..f96c019d9 100644 --- a/upstreamed/postgresql/README.md +++ b/upstreamed/postgresql/README.md @@ -60,6 +60,8 @@ The following tables lists the configurable parameters of the PostgreSQL chart a | `image.pullPolicy` | PostgreSQL Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify Image pull secrets | `nil` (does not add image pull secrets to deployed pods) | | `image.debug` | Specify if debug values should be set | `false` | +| `nameOverride` | String to partially override postgresql.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override postgresql.fullname template with a string | `nil` | | `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | | `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/minideb` | | `volumePermissions.image.tag` | Init container volume-permissions image tag | `latest` | @@ -149,8 +151,8 @@ The following tables lists the configurable parameters of the PostgreSQL chart a | `metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `nil` | | `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout. If not set, the Prometheus default scrape timeout is used | `nil` | | `metrics.image.registry` | PostgreSQL Image registry | `docker.io` | -| `metrics.image.repository` | PostgreSQL Image name | `wrouesnel/postgres_exporter` | -| `metrics.image.tag` | PostgreSQL Image tag | `v0.4.7` | +| `metrics.image.repository` | PostgreSQL Image name | `bitnami/postgres-exporter` | +| `metrics.image.tag` | PostgreSQL Image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | PostgreSQL Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify Image pull secrets | `nil` (does not add image pull secrets to deployed pods) | | `metrics.securityContext.enabled` | Enable security context for metrics | `false` | diff --git a/upstreamed/postgresql/templates/_helpers.tpl b/upstreamed/postgresql/templates/_helpers.tpl index 27f73c6c2..2c456f636 100644 --- a/upstreamed/postgresql/templates/_helpers.tpl +++ b/upstreamed/postgresql/templates/_helpers.tpl @@ -12,13 +12,16 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this */}} {{- define "postgresql.fullname" -}} {{- if .Values.fullnameOverride -}} -{{- printf .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} {{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} {{- end -}} - +{{- end -}} {{/* Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). @@ -309,4 +312,4 @@ Get the readiness probe command {{- if contains "bitnami/" .Values.image.repository }} [ -f /opt/bitnami/postgresql/tmp/.initialized ] {{- end -}} -{{- end -}} \ No newline at end of file +{{- end -}} diff --git a/upstreamed/postgresql/templates/statefulset-slaves.yaml b/upstreamed/postgresql/templates/statefulset-slaves.yaml index 2cd0f04a0..33b332a81 100644 --- a/upstreamed/postgresql/templates/statefulset-slaves.yaml +++ b/upstreamed/postgresql/templates/statefulset-slaves.yaml @@ -94,6 +94,8 @@ spec: env: - name: BITNAMI_DEBUG value: {{ ternary "true" "false" .Values.image.debug | quote }} + - name: POSTGRESQL_VOLUME_DIR + value: "{{ .Values.persistence.mountPath }}" - name: POSTGRESQL_PORT_NUMBER value: "{{ template "postgresql.port" . }}" {{- if .Values.persistence.mountPath }} diff --git a/upstreamed/postgresql/templates/statefulset.yaml b/upstreamed/postgresql/templates/statefulset.yaml index f29829460..9b1c113d2 100644 --- a/upstreamed/postgresql/templates/statefulset.yaml +++ b/upstreamed/postgresql/templates/statefulset.yaml @@ -100,6 +100,8 @@ spec: value: {{ ternary "true" "false" .Values.image.debug | quote }} - name: POSTGRESQL_PORT_NUMBER value: "{{ template "postgresql.port" . }}" + - name: POSTGRESQL_VOLUME_DIR + value: "{{ .Values.persistence.mountPath }}" {{- if .Values.postgresqlInitdbArgs }} - name: POSTGRES_INITDB_ARGS value: {{ .Values.postgresqlInitdbArgs | quote }} diff --git a/upstreamed/postgresql/values-production.yaml b/upstreamed/postgresql/values-production.yaml index b44ff8760..cf84ee6ea 100644 --- a/upstreamed/postgresql/values-production.yaml +++ b/upstreamed/postgresql/values-production.yaml @@ -14,7 +14,7 @@ global: image: registry: docker.io repository: bitnami/postgresql - tag: 11.4.0-debian-9-r12 + tag: 11.4.0-debian-9-r34 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -32,6 +32,14 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override postgresql.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override postgresql.fullname template +## +# fullnameOverride: + ## ## Init containers parameters: ## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup @@ -337,8 +345,8 @@ metrics: # scrapeTimeout: 10s image: registry: docker.io - repository: wrouesnel/postgres_exporter - tag: v0.4.7 + repository: bitnami/postgres-exporter + tag: 0.5.1-debian-9-r0 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/postgresql/values.yaml b/upstreamed/postgresql/values.yaml index 259f856d4..dc86943ca 100644 --- a/upstreamed/postgresql/values.yaml +++ b/upstreamed/postgresql/values.yaml @@ -14,7 +14,7 @@ global: image: registry: docker.io repository: bitnami/postgresql - tag: 11.4.0-debian-9-r12 + tag: 11.4.0-debian-9-r34 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -32,6 +32,14 @@ image: ## ref: https://github.com/bitnami/minideb-extras/#turn-on-bash-debugging debug: false +## String to partially override postgresql.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override postgresql.fullname template +## +# fullnameOverride: + ## ## Init containers parameters: ## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup @@ -337,8 +345,8 @@ metrics: # scrapeTimeout: 10s image: registry: docker.io - repository: wrouesnel/postgres_exporter - tag: v0.4.7 + repository: bitnami/postgres-exporter + tag: 0.5.1-debian-9-r0 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/prestashop/Chart.yaml b/upstreamed/prestashop/Chart.yaml index ae64a6e5a..5bb8ea542 100644 --- a/upstreamed/prestashop/Chart.yaml +++ b/upstreamed/prestashop/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: prestashop -version: 6.6.3 -appVersion: 1.7.5-2 +version: 7.1.1 +appVersion: 1.7.6-0 description: A popular open source ecommerce solution. Professional tools are easily accessible to increase online sales including instant guest checkout, abandoned cart reminders and automated Email marketing. keywords: - prestashop diff --git a/upstreamed/prestashop/README.md b/upstreamed/prestashop/README.md index a8db99c2d..8fe327629 100644 --- a/upstreamed/prestashop/README.md +++ b/upstreamed/prestashop/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the PrestaShop chart an | `image.tag` | PrestaShop image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override prestashop.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override prestashop.fullname template with a string | `nil` | | `service.type` | Kubernetes Service type | `LoadBalancer` | | `service.port` | Service HTTP port | `80` | | `service.httpsPort` | Service HTTPS port | `443` | @@ -118,8 +120,8 @@ The following table lists the configurable parameters of the PrestaShop chart an | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/prestashop/requirements.lock b/upstreamed/prestashop/requirements.lock index ead1430ab..afa09a45b 100644 --- a/upstreamed/prestashop/requirements.lock +++ b/upstreamed/prestashop/requirements.lock @@ -3,4 +3,4 @@ dependencies: repository: https://kubernetes-charts.storage.googleapis.com/ version: 5.11.3 digest: sha256:0593b73b2163fbbbae061de1aa2b8280d43f8a423a91e1c7375c0b6c86784b1c -generated: 2019-06-10T03:05:14.043753652Z +generated: 2019-07-11T13:28:38.859937585Z diff --git a/upstreamed/prestashop/templates/_helpers.tpl b/upstreamed/prestashop/templates/_helpers.tpl index 86a67622f..b4777def9 100644 --- a/upstreamed/prestashop/templates/_helpers.tpl +++ b/upstreamed/prestashop/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "prestashop.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. diff --git a/upstreamed/prestashop/values.yaml b/upstreamed/prestashop/values.yaml index 61fed39b2..61fee3506 100644 --- a/upstreamed/prestashop/values.yaml +++ b/upstreamed/prestashop/values.yaml @@ -13,7 +13,7 @@ image: registry: docker.io repository: bitnami/prestashop - tag: 1.7.5-2-debian-9-r24 + tag: 1.7.6-0-debian-9-r0 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override prestashop.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override prestashop.fullname template +## +# fullnameOverride: + ## PrestaShop host to create application URLs ## ref: https://github.com/bitnami/bitnami-docker-prestashop#configuration ## @@ -280,8 +288,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/rabbitmq/Chart.yaml b/upstreamed/rabbitmq/Chart.yaml index fa2e603bc..b06771c10 100644 --- a/upstreamed/rabbitmq/Chart.yaml +++ b/upstreamed/rabbitmq/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: rabbitmq -version: 6.1.5 +version: 6.2.2 appVersion: 3.7.16 description: Open source message broker software that implements the Advanced Message Queuing Protocol (AMQP) keywords: diff --git a/upstreamed/rabbitmq/README.md b/upstreamed/rabbitmq/README.md index 579c6fa1f..885f7219e 100644 --- a/upstreamed/rabbitmq/README.md +++ b/upstreamed/rabbitmq/README.md @@ -55,6 +55,8 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | | `image.debug` | Specify if debug values should be set | `false` | +| `nameOverride` | String to partially override rabbitmq.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override rabbitmq.fullname template with a string | `nil` | | `rbacEnabled` | Specify if rbac is enabled in your cluster | `true` | | `podManagementPolicy` | Pod management policy | `OrderedReady` | | `rabbitmq.username` | RabbitMQ application username | `user` | @@ -71,6 +73,7 @@ The following table lists the configurable parameters of the RabbitMQ chart and | `rabbitmq.ulimitNofiles` | Max File Descriptor limit | `65536` | | `rabbitmq.maxAvailableSchedulers` | RabbitMQ maximum available scheduler threads | `2` | | `rabbitmq.onlineSchedulers` | RabbitMQ online scheduler threads | `1` | +| `rabbitmq.env` | RabbitMQ [environment variables](https://www.rabbitmq.com/configure.html#customise-environment) | `{}` | | `rabbitmq.configuration` | Required cluster configuration | See values.yaml | | `rabbitmq.extraConfiguration` | Extra configuration to add to rabbitmq.conf | See values.yaml | | `rabbitmq.advancedConfiguration` | Extra configuration (in classic format) to add to advanced.config | See values.yaml | diff --git a/upstreamed/rabbitmq/templates/statefulset.yaml b/upstreamed/rabbitmq/templates/statefulset.yaml index 4c5aff228..d6d5a7c01 100644 --- a/upstreamed/rabbitmq/templates/statefulset.yaml +++ b/upstreamed/rabbitmq/templates/statefulset.yaml @@ -228,6 +228,10 @@ spec: secretKeyRef: name: {{ template "rabbitmq.secretPasswordName" . }} key: rabbitmq-password + {{- range $key, $value := .Values.rabbitmq.env }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} {{- if .Values.metrics.enabled }} - name: metrics image: {{ template "rabbitmq.metrics.image" . }} diff --git a/upstreamed/rabbitmq/values-production.yaml b/upstreamed/rabbitmq/values-production.yaml index bdf4e5ce4..ee9a772da 100644 --- a/upstreamed/rabbitmq/values-production.yaml +++ b/upstreamed/rabbitmq/values-production.yaml @@ -32,6 +32,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override rabbitmq.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override rabbitmq.fullname template +## +# fullnameOverride: + ## Use an alternate scheduler, e.g. "stork". ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ ## @@ -110,6 +118,10 @@ rabbitmq: enabled: false secretName: load-definition + ## environment variables to configure rabbitmq + ## ref: https://www.rabbitmq.com/configure.html#customise-environment + env: {} + ## Configuration file content: required cluster configuration ## Do not override unless you know what you are doing. To add more configuration, use `extraConfiguration` of `advancedConfiguration` instead configuration: |- @@ -129,9 +141,9 @@ rabbitmq: extraConfiguration: |- #disk_free_limit.absolute = 50MB #management.load_definitions = /app/load_definition.json - + ## Configuration file content: advanced configuration - ## Use this as additional configuraton in classic config format (Erlang term configuration format) + ## Use this as additional configuraton in classic config format (Erlang term configuration format) advancedConfiguration: |- ## Kubernetes service type diff --git a/upstreamed/rabbitmq/values.yaml b/upstreamed/rabbitmq/values.yaml index fab7bfafb..e39b43a78 100644 --- a/upstreamed/rabbitmq/values.yaml +++ b/upstreamed/rabbitmq/values.yaml @@ -32,6 +32,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override rabbitmq.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override rabbitmq.fullname template +## +# fullnameOverride: + ## Use an alternate scheduler, e.g. "stork". ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ ## @@ -110,6 +118,10 @@ rabbitmq: enabled: false secretName: load-definition + ## environment variables to configure rabbitmq + ## ref: https://www.rabbitmq.com/configure.html#customise-environment + env: {} + ## Configuration file content: required cluster configuration ## Do not override unless you know what you are doing. To add more configuration, use `extraConfiguration` of `advancedConfiguration` instead configuration: |- diff --git a/upstreamed/redis/Chart.yaml b/upstreamed/redis/Chart.yaml index 23449ee9d..0c0db5f14 100644 --- a/upstreamed/redis/Chart.yaml +++ b/upstreamed/redis/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: redis -version: 8.0.19 +version: 9.0.0 appVersion: 5.0.5 description: Open source, advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. keywords: diff --git a/upstreamed/redis/README.md b/upstreamed/redis/README.md index ded848ca0..7ceb8fb6d 100644 --- a/upstreamed/redis/README.md +++ b/upstreamed/redis/README.md @@ -130,13 +130,15 @@ The following table lists the configurable parameters of the Redis chart and the | `image.tag` | Redis Image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | +| `nameOverride` | String to partially override redis.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override redis.fullname template with a string | `nil` | | `cluster.enabled` | Use master-slave topology | `true` | | `cluster.slaveCount` | Number of slaves | `1` | | `existingSecret` | Name of existing secret object (for password authentication) | `nil` | | `usePassword` | Use password | `true` | | `usePasswordFile` | Mount passwords as files instead of environment variables | `false` | | `password` | Redis password (ignored if existingSecret set) | Randomly generated | -| `configmap` | Redis configuration file to be used | See values.yaml | +| `configmap` | Additional common Redis node configuration | See values.yaml | | `clusterDomain` | Kubernetes DNS Domain name to use | `cluster.local` | | `networkPolicy.enabled` | Enable NetworkPolicy | `false` | | `networkPolicy.allowExternal` | Don't require client label for connections | `true` | @@ -149,21 +151,21 @@ The following table lists the configurable parameters of the Redis chart and the | `rbac.role.rules` | Rules to create | `[]` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Redis exporter image registry | `docker.io` | -| `metrics.image.repository` | Redis exporter image name | `oliver006/redis_exporter` | -| `metrics.image.tag` | Redis exporter image tag | `v1.0.3` | +| `metrics.image.repository` | Redis exporter image name | `bitnami/redis-exporter` | +| `metrics.image.tag` | Redis exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | | `metrics.extraArgs` | Extra arguments for the binary; possible values [here](https://github.com/oliver006/redis_exporter#flags) | {} | | `metrics.podLabels` | Additional labels for Metrics exporter pod | {} | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | {} | -| `metrics.service.type` | Kubernetes Service type (redis metrics) | `ClusterIP` | -| `metrics.service.annotations` | Annotations for the services to monitor (redis master and redis slave service) | {} | -| `metrics.service.loadBalancerIP` | loadBalancerIP if redis metrics service type is `LoadBalancer` | `nil` | | `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | | `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | | `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `nil` | | `metrics.serviceMonitor.interval` | How frequently to scrape metrics (use by default, falling back to Prometheus' default) | `nil` | | `metrics.serviceMonitor.selector` | Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install | `{ prometheus: kube-prometheus }` | +| `metrics.service.type` | Kubernetes Service type (redis metrics) | `ClusterIP` | +| `metrics.service.annotations` | Annotations for the services to monitor (redis master and redis slave service) | {} | +| `metrics.service.loadBalancerIP` | loadBalancerIP if redis metrics service type is `LoadBalancer` | `nil` | | `metrics.priorityClassName` | Metrics exporter pod priorityClassName | {} | | `persistence.existingClaim` | Provide an existing PersistentVolumeClaim | `nil` | | `master.persistence.enabled` | Use a PVC to persist data (master node) | `true` | @@ -178,6 +180,7 @@ The following table lists the configurable parameters of the Redis chart and the | `master.podAnnotations` | Additional annotations for Redis master pod | {} | | `redisPort` | Redis port (in both master and slaves) | `6379` | | `master.command` | Redis master entrypoint string. The command `redis-server` is executed if this is not provided. | `/run.sh` | +| `master.configmap` | Additional Redis configuration for the master nodes | `nil` | | `master.disableCommands` | Array of Redis commands to disable (master) | `["FLUSHDB", "FLUSHALL"]` | | `master.extraFlags` | Redis master additional command line flags | [] | | `master.nodeSelector` | Redis master Node labels for pod assignment | {"beta.kubernetes.io/arch": "amd64"} | @@ -215,6 +218,7 @@ The following table lists the configurable parameters of the Redis chart and the | `slave.service.port` | Kubernetes Service port (redis slave) | `6379` | | `slave.service.loadBalancerIP` | LoadBalancerIP if Redis slave service type is `LoadBalancer` | `nil` | | `slave.command` | Redis slave entrypoint array. The docker image's ENTRYPOINT is used if this is not provided. | `/run.sh` | +| `slave.configmap` | Additional Redis configuration for the slave nodes | `nil` | | `slave.disableCommands` | Array of Redis commands to disable (slave) | `[FLUSHDB, FLUSHALL]` | | `slave.extraFlags` | Redis slave additional command line flags | `[]` | | `slave.livenessProbe.enabled` | Turn on and off liveness probe (redis slave pod) | `true` | @@ -251,6 +255,7 @@ The following table lists the configurable parameters of the Redis chart and the | `sentinel.failoverTimeout` | Timeout for performing a election failover | `18000` | | `sentinel.parallelSyncs` | Number of parallel syncs in the cluster | `1` | | `sentinel.port` | Redis Sentinel port | `26379` | +| `sentinel.configmap` | Additional Redis configuration for the sentinel nodes | `nil` | | `sentinel.service.type` | Kubernetes Service type (redis sentinel) | `ClusterIP` | | `sentinel.service.nodePort` | Kubernetes Service nodePort (redis sentinel) | `nil` | | `sentinel.service.annotations` | annotations for redis sentinel service | {} | @@ -360,8 +365,8 @@ By default, the chart mounts a [Persistent Volume](http://kubernetes.io/docs/use ### Existing PersistentVolumeClaim 1. Create the PersistentVolume -1. Create the PersistentVolumeClaim -1. Install the chart +2. Create the PersistentVolumeClaim +3. Install the chart ```bash $ helm install --set persistence.existingClaim=PVC_NAME stable/redis @@ -414,6 +419,9 @@ In case the current master crashes, the Sentinel containers will elect a new mas ## Notable changes +### 9.0.0 +The metrics exporter has been changed from a separate deployment to a sidecar container, due to the latest changes in the Redis exporter code. Check the [official page](https://github.com/oliver006/redis_exporter/) for more information. The metrics container image was changed from oliver006/redis_exporter to bitnami/redis-exporter (Bitnami's maintained package of oliver006/redis_exporter). + ### 7.0.0 In order to improve the performance in case of slave failure, we added persistence to the read-only slaves. That means that we moved from Deployment to StatefulSets. This should not affect upgrades from previous versions of the chart, as the deployments did not contain any persistence at all. diff --git a/upstreamed/redis/ci/extra-flags-values.yaml b/upstreamed/redis/ci/extra-flags-values.yaml new file mode 100644 index 000000000..71132f76e --- /dev/null +++ b/upstreamed/redis/ci/extra-flags-values.yaml @@ -0,0 +1,11 @@ +master: + extraFlags: + - --maxmemory-policy allkeys-lru + persistence: + enabled: false +slave: + extraFlags: + - --maxmemory-policy allkeys-lru + persistence: + enabled: false +usePassword: false diff --git a/upstreamed/redis/ci/production-sentinel-values.yaml b/upstreamed/redis/ci/production-sentinel-values.yaml index 0be0d3330..cd14a4e22 100644 --- a/upstreamed/redis/ci/production-sentinel-values.yaml +++ b/upstreamed/redis/ci/production-sentinel-values.yaml @@ -420,8 +420,8 @@ metrics: image: registry: docker.io - repository: oliver006/redis_exporter - tag: v1.0.3 + repository: bitnami/redis-exporter + tag: 1.0.3-debian-9-r0 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -430,31 +430,28 @@ metrics: # pullSecrets: # - myRegistryKeySecretName + ## Metrics exporter resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## + # resources: {} + ## Metrics exporter pod priorityClassName + # priorityClassName: {} service: type: ClusterIP ## Use serviceLoadBalancerIP to request a specific static IP, ## otherwise leave blank # loadBalancerIP: - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9121" - - ## Metrics exporter resource requests and limits - ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ - ## - # resources: {} + annotations: {} ## Extra arguments for Metrics exporter, for example: ## extraArgs: ## check-keys: myKey,myOtherKey # extraArgs: {} - ## Metrics exporter labels and tolerations for pod assignment - # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} - # tolerations: [] - ## Metrics exporter pod Annotation and Labels - # podAnnotations: {} + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9121" # podLabels: {} # Enable this if you're using https://github.com/coreos/prometheus-operator @@ -469,10 +466,6 @@ metrics: ## [Kube Prometheus Selector Label](https://github.com/helm/charts/tree/master/stable/prometheus-operator#exporters) selector: prometheus: kube-prometheus - - ## Metrics exporter pod priorityClassName - # priorityClassName: {} - ## ## Init containers parameters: ## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup diff --git a/upstreamed/redis/ci/production-values.yaml b/upstreamed/redis/ci/production-values.yaml index 05303a5cd..34abab38b 100644 --- a/upstreamed/redis/ci/production-values.yaml +++ b/upstreamed/redis/ci/production-values.yaml @@ -420,8 +420,8 @@ metrics: image: registry: docker.io - repository: oliver006/redis_exporter - tag: v1.0.3 + repository: bitnami/redis-exporter + tag: 1.0.3-debian-9-r0 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -430,15 +430,6 @@ metrics: # pullSecrets: # - myRegistryKeySecretName - service: - type: ClusterIP - ## Use serviceLoadBalancerIP to request a specific static IP, - ## otherwise leave blank - # loadBalancerIP: - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9121" - ## Metrics exporter resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## @@ -448,13 +439,19 @@ metrics: ## extraArgs: ## check-keys: myKey,myOtherKey # extraArgs: {} - - ## Metrics exporter labels and tolerations for pod assignment - # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} - # tolerations: [] + ## Metrics exporter pod priorityClassName + # priorityClassName: {} + service: + type: ClusterIP + ## Use serviceLoadBalancerIP to request a specific static IP, + ## otherwise leave blank + # loadBalancerIP: + annotations: {} ## Metrics exporter pod Annotation and Labels - # podAnnotations: {} + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9121" # podLabels: {} # Enable this if you're using https://github.com/coreos/prometheus-operator @@ -470,9 +467,6 @@ metrics: selector: prometheus: kube-prometheus - ## Metrics exporter pod priorityClassName - # priorityClassName: {} - ## ## Init containers parameters: ## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup diff --git a/upstreamed/redis/templates/_helpers.tpl b/upstreamed/redis/templates/_helpers.tpl index febc84b0a..bf6c5e6a4 100644 --- a/upstreamed/redis/templates/_helpers.tpl +++ b/upstreamed/redis/templates/_helpers.tpl @@ -150,7 +150,7 @@ Get the password secret. */}} {{- define "redis.secretName" -}} {{- if .Values.existingSecret -}} -{{- printf "%s" .Values.existingSecret -}} +{{- printf "%s" (tpl .Values.existingSecret .) -}} {{- else -}} {{- printf "%s" (include "redis.fullname" .) -}} {{- end -}} diff --git a/upstreamed/redis/templates/configmap.yaml b/upstreamed/redis/templates/configmap.yaml index a82e2c78d..e6005e77f 100644 --- a/upstreamed/redis/templates/configmap.yaml +++ b/upstreamed/redis/templates/configmap.yaml @@ -15,6 +15,10 @@ data: {{- end }} master.conf: |- dir {{ .Values.master.persistence.path }} +{{- if .Values.master.configmap }} + # User-supplied master configuration: +{{ .Values.master.configmap | indent 4 }} +{{- end }} {{- if .Values.master.disableCommands }} {{- range .Values.master.disableCommands }} rename-command {{ . }} "" @@ -23,6 +27,10 @@ data: replica.conf: |- dir {{ .Values.slave.persistence.path }} slave-read-only yes +{{- if .Values.slave.configmap }} + # User-supplied slave configuration: +{{ .Values.slave.configmap | indent 4 }} +{{- end }} {{- if .Values.slave.disableCommands }} {{- range .Values.slave.disableCommands }} rename-command {{ . }} "" @@ -30,11 +38,15 @@ data: {{- end }} {{- if .Values.sentinel.enabled }} sentinel.conf: |- - dir "/tmp" - bind 0.0.0.0 - port {{ .Values.sentinel.port }} - sentinel monitor {{ .Values.sentinel.masterSet }} {{ template "redis.fullname" . }}-master-0.{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} {{ .Values.redisPort }} {{ .Values.sentinel.quorum }} - sentinel down-after-milliseconds {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.downAfterMilliseconds }} - sentinel failover-timeout {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.failoverTimeout }} - sentinel parallel-syncs {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.parallelSyncs }} + dir "/tmp" + bind 0.0.0.0 + port {{ .Values.sentinel.port }} + sentinel monitor {{ .Values.sentinel.masterSet }} {{ template "redis.fullname" . }}-master-0.{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} {{ .Values.redisPort }} {{ .Values.sentinel.quorum }} + sentinel down-after-milliseconds {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.downAfterMilliseconds }} + sentinel failover-timeout {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.failoverTimeout }} + sentinel parallel-syncs {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.parallelSyncs }} +{{- if .Values.sentinel.configmap }} + # User-supplied sentinel configuration: +{{ .Values.sentinel.configmap | indent 4 }} +{{- end }} {{- end }} diff --git a/upstreamed/redis/templates/metrics-deployment.yaml b/upstreamed/redis/templates/metrics-deployment.yaml deleted file mode 100644 index acd961717..000000000 --- a/upstreamed/redis/templates/metrics-deployment.yaml +++ /dev/null @@ -1,93 +0,0 @@ -{{- if .Values.metrics.enabled }} -apiVersion: extensions/v1beta1 -kind: Deployment -metadata: - name: {{ template "redis.fullname" . }}-metrics - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" -spec: - selector: - matchLabels: - release: "{{ .Release.Name }}" - role: metrics - app: {{ template "redis.name" . }} - template: - metadata: - labels: - release: "{{ .Release.Name }}" - chart: {{ template "redis.chart" . }} - role: metrics - app: {{ template "redis.name" . }} - {{- if .Values.metrics.podLabels }} -{{ toYaml .Values.metrics.podLabels | indent 8 }} - {{- end }} - annotations: - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} - {{- if .Values.metrics.podAnnotations }} -{{ toYaml .Values.metrics.podAnnotations | indent 8 }} - {{- end }} - spec: -{{- include "redis.imagePullSecrets" . | indent 6 }} - {{- if .Values.metrics.nodeSelector }} - nodeSelector: -{{ toYaml .Values.metrics.nodeSelector | indent 8 }} - {{- end }} - serviceAccountName: "{{ template "redis.serviceAccountName" . }}" - {{- if .Values.metrics.priorityClassName }} - priorityClassName: "{{ .Values.metrics.priorityClassName }}" - {{- end }} - {{- if .Values.metrics.tolerations }} - tolerations: -{{ toYaml .Values.metrics.tolerations | indent 8 }} - {{- end }} - containers: - - name: metrics - image: {{ template "redis.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - args: - {{- range $key, $value := .Values.metrics.extraArgs }} - - --{{ $key }}={{ $value }} - {{- end }} - env: - - name: REDIS_ADDR - {{- if and .Values.cluster.enabled .Values.sentinel.enabled }} - value: {{ printf "%s:%d" ( include "redis.fullname" . ) ( int .Values.sentinel.service.redisPort ) | quote }} - {{- else if .Values.cluster.enabled }} - value: {{ printf "%s-master:%d,%s-slave:%d" ( include "redis.fullname" . ) ( int .Values.redisPort ) ( include "redis.fullname" . ) ( int .Values.redisPort ) | quote }} - {{- else }} - value: {{ printf "%s-master:%d" ( include "redis.fullname" . ) (int .Values.redisPort) | quote }} - {{- end }} - - name: REDIS_ALIAS - value: {{ template "redis.fullname" . }} - {{- if .Values.usePassword }} - {{- if .Values.usePasswordFile }} - - name: REDIS_PASSWORD_FILE - value: "/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: redis-password - {{- end }} - {{- end }} - volumeMounts: - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /secrets/ - {{- end }} - ports: - - name: metrics - containerPort: 9121 - resources: -{{ toYaml .Values.metrics.resources | indent 10 }} - volumes: - {{- if .Values.usePasswordFile }} - - name: redis-password - secret: - secretName: {{ template "redis.secretName" . }} - {{- end }} -{{- end }} diff --git a/upstreamed/redis/templates/metrics-svc.yaml b/upstreamed/redis/templates/metrics-svc.yaml index a2105152c..132b3bf48 100644 --- a/upstreamed/redis/templates/metrics-svc.yaml +++ b/upstreamed/redis/templates/metrics-svc.yaml @@ -25,5 +25,4 @@ spec: selector: app: {{ template "redis.name" . }} release: {{ .Release.Name }} - role: metrics -{{- end }} +{{- end }} \ No newline at end of file diff --git a/upstreamed/redis/templates/redis-master-statefulset.yaml b/upstreamed/redis/templates/redis-master-statefulset.yaml index 2bafaa144..e05663ddf 100644 --- a/upstreamed/redis/templates/redis-master-statefulset.yaml +++ b/upstreamed/redis/templates/redis-master-statefulset.yaml @@ -24,6 +24,10 @@ spec: {{- if .Values.master.podLabels }} {{ toYaml .Values.master.podLabels | indent 8 }} {{- end }} +{{- if .Values.metrics.podLabels }} +{{ toYaml .Values.metrics.podLabels | indent 8 }} +{{- end }} + annotations: checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} @@ -31,6 +35,9 @@ spec: {{- if .Values.master.podAnnotations }} {{ toYaml .Values.master.podAnnotations | indent 8 }} {{- end }} + {{- if .Values.metrics.podAnnotations }} +{{ toYaml .Values.metrics.podAnnotations | indent 8 }} + {{- end }} spec: {{- include "redis.imagePullSecrets" . | indent 6 }} {{- if .Values.securityContext.enabled }} @@ -91,6 +98,11 @@ spec: {{- end }} ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") + {{- if .Values.master.extraFlags }} + {{- range .Values.master.extraFlags }} + ARGS+=({{ . | quote }}) + {{- end }} + {{- end }} {{- if .Values.master.command }} {{ .Values.master.command }} ${ARGS[@]} {{- else }} @@ -253,6 +265,40 @@ spec: - name: sentinel-tmp-conf mountPath: /opt/bitnami/redis-sentinel/etc/ {{- end }} +{{- if .Values.metrics.enabled }} + - name: metrics + image: {{ template "redis.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + args: + {{- range $key, $value := .Values.metrics.extraArgs }} + - --{{ $key }}={{ $value }} + {{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "redis.fullname" . }} + {{- if .Values.usePassword }} + {{- if .Values.usePasswordFile }} + - name: REDIS_PASSWORD_FILE + value: "/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: redis-password + {{- end }} + {{- end }} + volumeMounts: + {{- if .Values.usePasswordFile }} + - name: redis-password + mountPath: /secrets/ + {{- end }} + ports: + - name: metrics + containerPort: 9121 + resources: +{{ toYaml .Values.metrics.resources | indent 10 }} +{{- end }} {{- $needsVolumePermissions := and .Values.volumePermissions.enabled (and ( and .Values.master.persistence.enabled (not .Values.persistence.existingClaim) ) .Values.securityContext.enabled) }} {{- if or $needsVolumePermissions .Values.sysctlImage.enabled }} initContainers: diff --git a/upstreamed/redis/templates/redis-slave-statefulset.yaml b/upstreamed/redis/templates/redis-slave-statefulset.yaml index 32eae3305..b891a37c0 100644 --- a/upstreamed/redis/templates/redis-slave-statefulset.yaml +++ b/upstreamed/redis/templates/redis-slave-statefulset.yaml @@ -31,6 +31,9 @@ spec: app: {{ template "redis.name" . }} {{- if .Values.slave.podLabels }} {{ toYaml .Values.slave.podLabels | indent 8 }} + {{- end }} + {{- if .Values.metrics.podLabels }} +{{ toYaml .Values.metrics.podLabels | indent 8 }} {{- end }} annotations: checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} @@ -39,6 +42,9 @@ spec: {{- if .Values.slave.podAnnotations }} {{ toYaml .Values.slave.podAnnotations | indent 8 }} {{- end }} + {{- if .Values.metrics.podAnnotations }} +{{ toYaml .Values.metrics.podAnnotations | indent 8 }} + {{- end }} spec: {{- include "redis.imagePullSecrets" . | indent 6 }} {{- if .Values.securityContext.enabled }} @@ -104,6 +110,11 @@ spec: {{- end }} ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf") + {{- if .Values.slave.extraFlags }} + {{- range .Values.slave.extraFlags }} + ARGS+=({{ . | quote }}) + {{- end }} + {{- end }} {{- if .Values.slave.command }} {{ .Values.slave.command }} "${ARGS[@]}" {{- else }} @@ -281,6 +292,40 @@ spec: - name: sentinel-tmp-conf mountPath: /opt/bitnami/redis-sentinel/etc {{- end }} +{{- if .Values.metrics.enabled }} + - name: metrics + image: {{ template "redis.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + args: + {{- range $key, $value := .Values.metrics.extraArgs }} + - --{{ $key }}={{ $value }} + {{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "redis.fullname" . }} + {{- if .Values.usePassword }} + {{- if .Values.usePasswordFile }} + - name: REDIS_PASSWORD_FILE + value: "/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: redis-password + {{- end }} + {{- end }} + volumeMounts: + {{- if .Values.usePasswordFile }} + - name: redis-password + mountPath: /secrets/ + {{- end }} + ports: + - name: metrics + containerPort: 9121 + resources: +{{ toYaml .Values.metrics.resources | indent 10 }} +{{- end }} {{- $needsVolumePermissions := and .Values.volumePermissions.enabled (and .Values.slave.persistence.enabled .Values.securityContext.enabled) }} {{- if or $needsVolumePermissions .Values.sysctlImage.enabled }} initContainers: diff --git a/upstreamed/redis/values-production.yaml b/upstreamed/redis/values-production.yaml index 08eaa636e..65f72dcd8 100644 --- a/upstreamed/redis/values-production.yaml +++ b/upstreamed/redis/values-production.yaml @@ -29,6 +29,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override redis.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override redis.fullname template +## +# fullnameOverride: + ## Cluster settings cluster: enabled: true @@ -66,6 +74,10 @@ sentinel: failoverTimeout: 18000 parallelSyncs: 1 port: 26379 + ## Additional Redis configuration for the sentinel nodes + ## ref: https://redis.io/topics/config + ## + configmap: ## Configure extra options for Redis Sentinel liveness and readiness probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) ## @@ -189,6 +201,10 @@ master: ## Can be used to specify command line arguments, for example: ## command: "/run.sh" + ## Additional Redis configuration for the master nodes + ## ref: https://redis.io/topics/config + ## + configmap: ## Redis additional command line flags ## ## Can be used to specify command line flags, for example: @@ -332,6 +348,10 @@ slave: ## Can be used to specify command line arguments, for example: ## command: "/run.sh" + ## Additional Redis configuration for the slave nodes + ## ref: https://redis.io/topics/config + ## + configmap: ## Redis extra flags extraFlags: [] ## List of Redis commands to disable @@ -421,8 +441,8 @@ metrics: image: registry: docker.io - repository: oliver006/redis_exporter - tag: v1.0.3 + repository: bitnami/redis-exporter + tag: 1.0.3-debian-9-r0 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -431,15 +451,6 @@ metrics: # pullSecrets: # - myRegistryKeySecretName - service: - type: ClusterIP - ## Use serviceLoadBalancerIP to request a specific static IP, - ## otherwise leave blank - # loadBalancerIP: - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9121" - ## Metrics exporter resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## @@ -450,12 +461,18 @@ metrics: ## check-keys: myKey,myOtherKey # extraArgs: {} - ## Metrics exporter labels and tolerations for pod assignment - # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} - # tolerations: [] - + ## Metrics exporter pod priorityClassName + # priorityClassName: {} + service: + type: ClusterIP + ## Use serviceLoadBalancerIP to request a specific static IP, + ## otherwise leave blank + # loadBalancerIP: + annotations: {} ## Metrics exporter pod Annotation and Labels - # podAnnotations: {} + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9121" # podLabels: {} # Enable this if you're using https://github.com/coreos/prometheus-operator @@ -471,9 +488,6 @@ metrics: selector: prometheus: kube-prometheus - ## Metrics exporter pod priorityClassName - # priorityClassName: {} - ## ## Init containers parameters: ## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup diff --git a/upstreamed/redis/values.yaml b/upstreamed/redis/values.yaml index 8aa96944e..3a46271b9 100644 --- a/upstreamed/redis/values.yaml +++ b/upstreamed/redis/values.yaml @@ -29,6 +29,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override redis.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override redis.fullname template +## +# fullnameOverride: + ## Cluster settings cluster: enabled: true @@ -66,6 +74,10 @@ sentinel: failoverTimeout: 18000 parallelSyncs: 1 port: 26379 + ## Additional Redis configuration for the sentinel nodes + ## ref: https://redis.io/topics/config + ## + configmap: ## Configure extra options for Redis Sentinel liveness and readiness probes ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) ## @@ -189,6 +201,10 @@ master: ## Can be used to specify command line arguments, for example: ## command: "/run.sh" + ## Additional Redis configuration for the master nodes + ## ref: https://redis.io/topics/config + ## + configmap: ## Redis additional command line flags ## ## Can be used to specify command line flags, for example: @@ -332,6 +348,10 @@ slave: ## Can be used to specify command line arguments, for example: ## command: "/run.sh" + ## Additional Redis configuration for the slave nodes + ## ref: https://redis.io/topics/config + ## + configmap: ## Redis extra flags extraFlags: [] ## List of Redis commands to disable @@ -421,8 +441,8 @@ metrics: image: registry: docker.io - repository: oliver006/redis_exporter - tag: v1.0.3 + repository: bitnami/redis-exporter + tag: 1.0.3-debian-9-r0 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. @@ -430,16 +450,6 @@ metrics: ## # pullSecrets: # - myRegistryKeySecretName - - service: - type: ClusterIP - ## Use serviceLoadBalancerIP to request a specific static IP, - ## otherwise leave blank - # loadBalancerIP: - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9121" - ## Metrics exporter resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## @@ -450,12 +460,10 @@ metrics: ## check-keys: myKey,myOtherKey # extraArgs: {} - ## Metrics exporter labels and tolerations for pod assignment - # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} - # tolerations: [] - ## Metrics exporter pod Annotation and Labels - # podAnnotations: {} + podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9121" # podLabels: {} # Enable this if you're using https://github.com/coreos/prometheus-operator @@ -473,6 +481,12 @@ metrics: ## Metrics exporter pod priorityClassName # priorityClassName: {} + service: + type: ClusterIP + ## Use serviceLoadBalancerIP to request a specific static IP, + ## otherwise leave blank + # loadBalancerIP: + annotations: {} ## ## Init containers parameters: diff --git a/upstreamed/redmine/Chart.yaml b/upstreamed/redmine/Chart.yaml index 6881e2dd2..171a3aecd 100644 --- a/upstreamed/redmine/Chart.yaml +++ b/upstreamed/redmine/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: redmine -version: 10.0.7 +version: 11.0.0 appVersion: 4.0.4 description: A flexible project management web application. keywords: diff --git a/upstreamed/redmine/README.md b/upstreamed/redmine/README.md index 6dc30ee07..37974a5de 100644 --- a/upstreamed/redmine/README.md +++ b/upstreamed/redmine/README.md @@ -63,7 +63,9 @@ The following table lists the configurable parameters of the Redmine chart and t | `image.repository` | Redmine image name | `bitnami/redmine` | | `image.tag` | Redmine image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override redmine.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override redmine.fullname template with a string | `nil` | | `redmineUsername` | User of the application | `user` | | `redminePassword` | Application password | _random 10 character long alphanumeric string_ | | `redmineEmail` | Admin email | `user@example.com` | diff --git a/upstreamed/redmine/templates/_helpers.tpl b/upstreamed/redmine/templates/_helpers.tpl index e3c2048dc..eea79fc45 100644 --- a/upstreamed/redmine/templates/_helpers.tpl +++ b/upstreamed/redmine/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "redmine.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. diff --git a/upstreamed/redmine/values.yaml b/upstreamed/redmine/values.yaml index ef1afaf6e..304d4928c 100644 --- a/upstreamed/redmine/values.yaml +++ b/upstreamed/redmine/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override redmine.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override redmine.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-redmine/#environment-variables ## diff --git a/upstreamed/suitecrm/Chart.yaml b/upstreamed/suitecrm/Chart.yaml index 47e87918b..a52825e51 100644 --- a/upstreamed/suitecrm/Chart.yaml +++ b/upstreamed/suitecrm/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: suitecrm -version: 5.4.5 +version: 6.1.1 appVersion: 7.11.6 description: SuiteCRM is a completely open source enterprise-grade Customer Relationship Management (CRM) application. SuiteCRM is a software fork of the popular customer relationship management (CRM) system SugarCRM. keywords: diff --git a/upstreamed/suitecrm/README.md b/upstreamed/suitecrm/README.md index 0e5b368a5..e0a08effc 100644 --- a/upstreamed/suitecrm/README.md +++ b/upstreamed/suitecrm/README.md @@ -55,7 +55,9 @@ The following table lists the configurable parameters of the SuiteCRM chart and | `image.repository` | SuiteCRM image name | `bitnami/suitecrm` | | `image.tag` | SuiteCRM image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array| `[]` (does not add image pull secrets to deployed pods)| +| `image.pullSecrets` | Specify docker-registry secret names as an array| `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override suitecrm.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override suitecrm.fullname template with a string | `nil` | | `suitecrmHost` | SuiteCRM host to create application URLs | `nil` | | `suitecrmUsername` | User of the application | `user` | | `suitecrmPassword` | Application password | _random 10 character alphanumeric string_ | @@ -104,9 +106,9 @@ The following table lists the configurable parameters of the SuiteCRM chart and | `resources` | CPU/Memory resource requests/limits | Memory: `512Mi`, CPU: `300m` | | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.registry` | Apache exporter image registry | `docker.io` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/suitecrm/templates/_helpers.tpl b/upstreamed/suitecrm/templates/_helpers.tpl index 457a226fc..d7806a595 100644 --- a/upstreamed/suitecrm/templates/_helpers.tpl +++ b/upstreamed/suitecrm/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "suitecrm.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. diff --git a/upstreamed/suitecrm/values.yaml b/upstreamed/suitecrm/values.yaml index d5ae7898b..caa365b35 100644 --- a/upstreamed/suitecrm/values.yaml +++ b/upstreamed/suitecrm/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override suitecrm.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override suitecrm.fullname template +## +# fullnameOverride: + ## SuiteCRM host to create application URLs ## ref: https://github.com/bitnami/bitnami-docker-suitecrm#configuration ## @@ -251,8 +259,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/testlink/Chart.yaml b/upstreamed/testlink/Chart.yaml index 38fe6edfe..a45f8a886 100644 --- a/upstreamed/testlink/Chart.yaml +++ b/upstreamed/testlink/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: testlink -version: 4.4.3 +version: 5.1.1 appVersion: 1.9.19 description: Web-based test management system that facilitates software quality assurance. icon: https://bitnami.com/assets/stacks/testlink/img/testlink-stack-220x234.png diff --git a/upstreamed/testlink/README.md b/upstreamed/testlink/README.md index 2fa513cda..e605efb19 100644 --- a/upstreamed/testlink/README.md +++ b/upstreamed/testlink/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the TestLink chart and | `image.tag` | TestLink image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override testlink.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override testlink.fullname template with a string | `nil` | | `testlinkUsername` | Admin username | `user` | | `testlinkPassword` | Admin user password | _random 10 character long alphanumeric string_ | | `testlinkEmail` | Admin user email | `user@example.com` | @@ -102,8 +104,8 @@ The following table lists the configurable parameters of the TestLink chart and | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/testlink/templates/_helpers.tpl b/upstreamed/testlink/templates/_helpers.tpl index d2ebf7345..7a9833b10 100644 --- a/upstreamed/testlink/templates/_helpers.tpl +++ b/upstreamed/testlink/templates/_helpers.tpl @@ -11,9 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "testlink.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} +{{- end -}} +{{- end -}} {{/* Create chart name and version as used by the chart label. diff --git a/upstreamed/testlink/values.yaml b/upstreamed/testlink/values.yaml index e4158bdd4..456bc5d78 100644 --- a/upstreamed/testlink/values.yaml +++ b/upstreamed/testlink/values.yaml @@ -26,6 +26,13 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override testlink.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override testlink.fullname template +## +# fullnameOverride: ## List of nodeSelectors to limit where testlink can run ## i.e @@ -244,8 +251,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/wordpress/Chart.yaml b/upstreamed/wordpress/Chart.yaml index 226007e91..10974323e 100644 --- a/upstreamed/wordpress/Chart.yaml +++ b/upstreamed/wordpress/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: wordpress -version: 5.13.0 +version: 6.1.1 appVersion: 5.2.2 description: Web publishing platform for building blogs and websites. icon: https://bitnami.com/assets/stacks/wordpress/img/wordpress-stack-220x234.png diff --git a/upstreamed/wordpress/README.md b/upstreamed/wordpress/README.md index 3148a2ab6..cf90b949f 100644 --- a/upstreamed/wordpress/README.md +++ b/upstreamed/wordpress/README.md @@ -56,6 +56,8 @@ The following table lists the configurable parameters of the WordPress chart and | `image.tag` | WordPress image tag | `{TAG_NAME}` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | +| `nameOverride` | String to partially override wordpress.fullname template with a string (will prepend the release name) | `nil` | +| `fullnameOverride` | String to fully override wordpress.fullname template with a string | `nil` | | `wordpressSkipInstall` | Skip wizard installation | `false` | | `wordpressUsername` | User of the application | `user` | | `wordpressPassword` | Application password | _random 10 character long alphanumeric string_ | @@ -119,8 +121,8 @@ The following table lists the configurable parameters of the WordPress chart and | `podAnnotations` | Pod annotations | `{}` | | `metrics.enabled` | Start a side-car prometheus exporter | `false` | | `metrics.image.registry` | Apache exporter image registry | `docker.io` | -| `metrics.image.repository` | Apache exporter image name | `lusotycoon/apache-exporter` | -| `metrics.image.tag` | Apache exporter image tag | `v0.5.0` | +| `metrics.image.repository` | Apache exporter image name | `bitnami/apache-exporter` | +| `metrics.image.tag` | Apache exporter image tag | `{TAG_NAME}` | | `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | | `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | `{prometheus.io/scrape: "true", prometheus.io/port: "9117"}` | diff --git a/upstreamed/wordpress/templates/_helpers.tpl b/upstreamed/wordpress/templates/_helpers.tpl index fe4bd97a2..2391d077d 100644 --- a/upstreamed/wordpress/templates/_helpers.tpl +++ b/upstreamed/wordpress/templates/_helpers.tpl @@ -11,10 +11,17 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). */}} {{- define "wordpress.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} - +{{- end -}} +{{- end -}} {{/* Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). diff --git a/upstreamed/wordpress/values-production.yaml b/upstreamed/wordpress/values-production.yaml index 316632cec..18e706334 100644 --- a/upstreamed/wordpress/values-production.yaml +++ b/upstreamed/wordpress/values-production.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override wordpress.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override wordpress.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-wordpress#environment-variables ## @@ -331,8 +339,8 @@ metrics: enabled: true image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. diff --git a/upstreamed/wordpress/values.yaml b/upstreamed/wordpress/values.yaml index 0c192f86b..2ab5e39e1 100644 --- a/upstreamed/wordpress/values.yaml +++ b/upstreamed/wordpress/values.yaml @@ -26,6 +26,14 @@ image: # pullSecrets: # - myRegistryKeySecretName +## String to partially override wordpress.fullname template (will maintain the release name) +## +# nameOverride: + +## String to fully override wordpress.fullname template +## +# fullnameOverride: + ## User of the application ## ref: https://github.com/bitnami/bitnami-docker-wordpress#environment-variables ## @@ -326,8 +334,8 @@ metrics: enabled: false image: registry: docker.io - repository: lusotycoon/apache-exporter - tag: v0.5.0 + repository: bitnami/apache-exporter + tag: 0.7.0-debian-9-r2 pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace.