mirror of
https://github.com/outbackdingo/cozystack.git
synced 2026-01-27 18:18:41 +00:00
Update kubeapps-15.0.2 (#103)
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
This commit is contained in:
Andrei Kvapil
@@ -1,12 +1,12 @@
|
||||
dependencies:
|
||||
- name: redis
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 18.19.2
|
||||
version: 19.0.2
|
||||
- name: postgresql
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 13.4.6
|
||||
version: 15.2.4
|
||||
- name: common
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 2.19.0
|
||||
digest: sha256:b4965a22517e61212e78abb8d1cbe86e800c8664b3139e2047f4bd62b3e55b24
|
||||
generated: "2024-03-13T11:51:34.216594+01:00"
|
||||
version: 2.19.1
|
||||
digest: sha256:2ff034d67cb1b9c11f0243b3ab9a6a8642bf12142df2f86043f9006adf6dbba1
|
||||
generated: "2024-04-08T09:01:34.727544997Z"
|
||||
|
||||
@@ -2,33 +2,33 @@ annotations:
|
||||
category: Infrastructure
|
||||
images: |
|
||||
- name: kubeapps-apis
|
||||
image: docker.io/bitnami/kubeapps-apis:2.9.0-debian-12-r19
|
||||
image: docker.io/bitnami/kubeapps-apis:2.10.0-debian-12-r0
|
||||
- name: kubeapps-apprepository-controller
|
||||
image: docker.io/bitnami/kubeapps-apprepository-controller:2.9.0-debian-12-r18
|
||||
image: docker.io/bitnami/kubeapps-apprepository-controller:2.10.0-debian-12-r0
|
||||
- name: kubeapps-asset-syncer
|
||||
image: docker.io/bitnami/kubeapps-asset-syncer:2.9.0-debian-12-r19
|
||||
image: docker.io/bitnami/kubeapps-asset-syncer:2.10.0-debian-12-r0
|
||||
- name: kubeapps-dashboard
|
||||
image: docker.io/bitnami/kubeapps-dashboard:2.9.0-debian-12-r18
|
||||
image: docker.io/bitnami/kubeapps-dashboard:2.10.0-debian-12-r0
|
||||
- name: kubeapps-oci-catalog
|
||||
image: docker.io/bitnami/kubeapps-oci-catalog:2.9.0-debian-12-r17
|
||||
image: docker.io/bitnami/kubeapps-oci-catalog:2.10.0-debian-12-r0
|
||||
- name: kubeapps-pinniped-proxy
|
||||
image: docker.io/bitnami/kubeapps-pinniped-proxy:2.9.0-debian-12-r17
|
||||
image: docker.io/bitnami/kubeapps-pinniped-proxy:2.10.0-debian-12-r0
|
||||
- name: nginx
|
||||
image: docker.io/bitnami/nginx:1.25.4-debian-12-r3
|
||||
image: docker.io/bitnami/nginx:1.25.4-debian-12-r7
|
||||
- name: oauth2-proxy
|
||||
image: docker.io/bitnami/oauth2-proxy:7.6.0-debian-12-r4
|
||||
image: docker.io/bitnami/oauth2-proxy:7.6.0-debian-12-r7
|
||||
licenses: Apache-2.0
|
||||
apiVersion: v2
|
||||
appVersion: 2.9.0
|
||||
appVersion: 2.10.0
|
||||
dependencies:
|
||||
- condition: packaging.flux.enabled
|
||||
name: redis
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 18.x.x
|
||||
version: 19.x.x
|
||||
- condition: packaging.helm.enabled
|
||||
name: postgresql
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
version: 13.x.x
|
||||
version: 15.x.x
|
||||
- name: common
|
||||
repository: oci://registry-1.docker.io/bitnamicharts
|
||||
tags:
|
||||
@@ -51,4 +51,4 @@ maintainers:
|
||||
name: kubeapps
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/kubeapps
|
||||
version: 14.7.2
|
||||
version: 15.0.2
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -2,7 +2,7 @@ annotations:
|
||||
category: Infrastructure
|
||||
licenses: Apache-2.0
|
||||
apiVersion: v2
|
||||
appVersion: 2.19.0
|
||||
appVersion: 2.19.1
|
||||
description: A Library Helm Chart for grouping common logic between bitnami charts.
|
||||
This chart is not deployable by itself.
|
||||
home: https://bitnami.com
|
||||
@@ -20,4 +20,4 @@ name: common
|
||||
sources:
|
||||
- https://github.com/bitnami/charts
|
||||
type: library
|
||||
version: 2.19.0
|
||||
version: 2.19.1
|
||||
|
||||
@@ -11,7 +11,7 @@ These presets are for basic testing and not meant to be used in production
|
||||
{{ include "common.resources.preset" (dict "type" "nano") -}}
|
||||
*/}}
|
||||
{{- define "common.resources.preset" -}}
|
||||
{{/* The limits are the requests increased by 50% (except ephemeral-storage)*/}}
|
||||
{{/* The limits are the requests increased by 50% (except ephemeral-storage and xlarge/2xlarge sizes)*/}}
|
||||
{{- $presets := dict
|
||||
"nano" (dict
|
||||
"requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi")
|
||||
@@ -34,11 +34,11 @@ These presets are for basic testing and not meant to be used in production
|
||||
"limits" (dict "cpu" "1.5" "memory" "3072Mi" "ephemeral-storage" "1024Mi")
|
||||
)
|
||||
"xlarge" (dict
|
||||
"requests" (dict "cpu" "2.0" "memory" "4096Mi" "ephemeral-storage" "50Mi")
|
||||
"requests" (dict "cpu" "1.5" "memory" "4096Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "3.0" "memory" "6144Mi" "ephemeral-storage" "1024Mi")
|
||||
)
|
||||
"2xlarge" (dict
|
||||
"requests" (dict "cpu" "4.0" "memory" "8192Mi" "ephemeral-storage" "50Mi")
|
||||
"requests" (dict "cpu" "1.5" "memory" "4096Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "6.0" "memory" "12288Mi" "ephemeral-storage" "1024Mi")
|
||||
)
|
||||
}}
|
||||
@@ -47,4 +47,4 @@ These presets are for basic testing and not meant to be used in production
|
||||
{{- else -}}
|
||||
{{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" .type (join "," (keys $presets)) | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -35,4 +35,4 @@ maintainers:
|
||||
name: redis
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/redis
|
||||
version: 18.19.2
|
||||
version: 19.0.2
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -28,8 +28,8 @@ spec:
|
||||
{{- if .Values.metrics.podMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.podMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.podMonitor.relabellings }}
|
||||
relabelings: {{- toYaml .Values.metrics.podMonitor.relabellings | nindent 6 }}
|
||||
{{- with concat .Values.metrics.podMonitor.relabelings .Values.metrics.podMonitor.relabellings }}
|
||||
relabelings: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.podMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{- toYaml .Values.metrics.podMonitor.metricRelabelings | nindent 6 }}
|
||||
@@ -45,8 +45,8 @@ spec:
|
||||
{{- if .honorLabels }}
|
||||
honorLabels: {{ .honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .relabellings }}
|
||||
relabelings: {{- toYaml .relabellings | nindent 6 }}
|
||||
{{- with concat .Values.metrics.podMonitor.relabelings .Values.metrics.podMonitor.relabellings }}
|
||||
relabelings: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .metricRelabelings }}
|
||||
metricRelabelings: {{- toYaml .metricRelabelings | nindent 6 }}
|
||||
|
||||
@@ -598,8 +598,9 @@ spec:
|
||||
image: {{ template "redis.kubectl.image" . }}
|
||||
imagePullPolicy: {{ .Values.kubectl.image.pullPolicy | quote }}
|
||||
command: {{- toYaml .Values.kubectl.command | nindent 12 }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
{{- if .Values.kubectl.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.kubectl.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: kubectl-shared
|
||||
mountPath: /etc/shared
|
||||
|
||||
@@ -28,8 +28,8 @@ spec:
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabellings }}
|
||||
relabelings: {{- toYaml .Values.metrics.serviceMonitor.relabellings | nindent 6 }}
|
||||
{{- with concat .Values.metrics.serviceMonitor.relabelings .Values.metrics.serviceMonitor.relabellings }}
|
||||
relabelings: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{- toYaml .Values.metrics.serviceMonitor.metricRelabelings | nindent 6 }}
|
||||
@@ -45,8 +45,8 @@ spec:
|
||||
{{- if .honorLabels }}
|
||||
honorLabels: {{ .honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .relabellings }}
|
||||
relabelings: {{- toYaml .relabellings | nindent 6 }}
|
||||
{{- with concat .Values.metrics.serviceMonitor.relabelings .Values.metrics.serviceMonitor.relabellings }}
|
||||
relabelings: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .metricRelabelings }}
|
||||
metricRelabelings: {{- toYaml .metricRelabelings | nindent 6 }}
|
||||
|
||||
@@ -30,7 +30,7 @@ global:
|
||||
openshift:
|
||||
## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
|
||||
##
|
||||
adaptSecurityContext: disabled
|
||||
adaptSecurityContext: auto
|
||||
## @section Common parameters
|
||||
##
|
||||
|
||||
@@ -275,7 +275,7 @@ master:
|
||||
## @param master.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if master.resources is set (master.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
resourcesPreset: "nano"
|
||||
## @param master.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
@@ -315,12 +315,12 @@ master:
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
@@ -737,7 +737,7 @@ replica:
|
||||
## @param replica.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if replica.resources is set (replica.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
resourcesPreset: "nano"
|
||||
## @param replica.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
@@ -777,12 +777,12 @@ replica:
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
@@ -1306,7 +1306,7 @@ sentinel:
|
||||
## @param sentinel.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if sentinel.resources is set (sentinel.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
resourcesPreset: "nano"
|
||||
## @param sentinel.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
@@ -1332,12 +1332,12 @@ sentinel:
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
@@ -1708,12 +1708,12 @@ metrics:
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
@@ -1729,7 +1729,7 @@ metrics:
|
||||
## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
resourcesPreset: "nano"
|
||||
## @param metrics.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
@@ -1812,7 +1812,10 @@ metrics:
|
||||
## @param metrics.serviceMonitor.scrapeTimeout The timeout after which the scrape is ended
|
||||
##
|
||||
scrapeTimeout: ""
|
||||
## @param metrics.serviceMonitor.relabellings Metrics RelabelConfigs to apply to samples before scraping.
|
||||
## @param metrics.serviceMonitor.relabelings Metrics RelabelConfigs to apply to samples before scraping.
|
||||
##
|
||||
relabelings: []
|
||||
## @skip metrics.serviceMonitor.relabellings DEPRECATED: Use `metrics.serviceMonitor.relabelings` instead.
|
||||
##
|
||||
relabellings: []
|
||||
## @param metrics.serviceMonitor.metricRelabelings Metrics RelabelConfigs to apply to samples before ingestion.
|
||||
@@ -1866,7 +1869,10 @@ metrics:
|
||||
## @param metrics.podMonitor.scrapeTimeout The timeout after which the scrape is ended
|
||||
##
|
||||
scrapeTimeout: ""
|
||||
## @param metrics.podMonitor.relabellings Metrics RelabelConfigs to apply to samples before scraping.
|
||||
## @param metrics.podMonitor.relabelings Metrics RelabelConfigs to apply to samples before scraping.
|
||||
##
|
||||
relabelings: []
|
||||
## @skip metrics.podMonitor.relabellings DEPRECATED: Use `metrics.podMonitor.relabelings` instead.
|
||||
##
|
||||
relabellings: []
|
||||
## @param metrics.podMonitor.metricRelabelings Metrics RelabelConfigs to apply to samples before ingestion.
|
||||
@@ -1988,7 +1994,7 @@ volumePermissions:
|
||||
## @param volumePermissions.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
resourcesPreset: "nano"
|
||||
## @param volumePermissions.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
@@ -2009,7 +2015,7 @@ volumePermissions:
|
||||
## "auto" is especially useful for OpenShift which has scc with dynamic user ids (and 0 is not allowed)
|
||||
##
|
||||
containerSecurityContext:
|
||||
seLinuxOptions: null
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 0
|
||||
|
||||
## Kubectl InitContainer
|
||||
@@ -2046,6 +2052,30 @@ kubectl:
|
||||
## @param kubectl.command kubectl command to execute
|
||||
##
|
||||
command: ["/opt/bitnami/scripts/kubectl-scripts/update-master-label.sh"]
|
||||
## Configure Container Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param kubectl.containerSecurityContext.enabled Enabled kubectl containers' Security Context
|
||||
## @param kubectl.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
|
||||
## @param kubectl.containerSecurityContext.runAsUser Set kubectl containers' Security Context runAsUser
|
||||
## @param kubectl.containerSecurityContext.runAsGroup Set kubectl containers' Security Context runAsGroup
|
||||
## @param kubectl.containerSecurityContext.runAsNonRoot Set kubectl containers' Security Context runAsNonRoot
|
||||
## @param kubectl.containerSecurityContext.allowPrivilegeEscalation Set kubectl containers' Security Context allowPrivilegeEscalation
|
||||
## @param kubectl.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context read-only root filesystem
|
||||
## @param kubectl.containerSecurityContext.seccompProfile.type Set kubectl containers' Security Context seccompProfile
|
||||
## @param kubectl.containerSecurityContext.capabilities.drop Set kubectl containers' Security Context capabilities to drop
|
||||
##
|
||||
containerSecurityContext:
|
||||
enabled: true
|
||||
seLinuxOptions: {}
|
||||
runAsUser: 1001
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
## Bitnami Kubectl resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param kubectl.resources.limits The resources limits for the kubectl containers
|
||||
@@ -2096,7 +2126,7 @@ sysctl:
|
||||
## @param sysctl.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if sysctl.resources is set (sysctl.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
resourcesPreset: "nano"
|
||||
## @param sysctl.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
|
||||
@@ -8,7 +8,7 @@ apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "kubeapps.apprepository.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.apprepository.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -0,0 +1,59 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.packaging.helm.enabled .Values.apprepository.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "kubeapps.apprepository.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.apprepository.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: apprepository
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.apprepository.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: apprepository
|
||||
{{- if .Values.apprepository.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
{{- range $port := .Values.apprepository.networkPolicy.kubeAPIServerPorts }}
|
||||
- port: {{ $port }}
|
||||
{{- end }}
|
||||
# Allow connection to PostgreSQL
|
||||
- ports:
|
||||
- port: {{ include "kubeapps.postgresql.port" . }}
|
||||
{{- if .Values.postgresql.enabled }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: postgresql
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
{{- if .Values.apprepository.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.apprepository.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
{{- if .Values.apprepository.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.apprepository.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -12,7 +12,7 @@ apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "kubeapps.apprepository.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: apprepository
|
||||
{{- if .Values.commonAnnotations }}
|
||||
@@ -73,7 +73,7 @@ apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "kubeapps.apprepository.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: apprepository
|
||||
{{- if .Values.commonAnnotations }}
|
||||
@@ -112,7 +112,7 @@ apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ printf "%s-repositories-read" .Release.Name }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: apprepository
|
||||
{{- if .Values.commonAnnotations }}
|
||||
@@ -132,7 +132,7 @@ apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ printf "%s-repositories-write" .Release.Name }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: apprepository
|
||||
{{- if .Values.commonAnnotations }}
|
||||
|
||||
@@ -8,7 +8,7 @@ apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kubeapps.apprepository.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.apprepository.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -8,7 +8,7 @@ apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kubeapps.dashboard-config.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.dashboard.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -3,12 +3,12 @@ Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.dashboard.enabled -}}
|
||||
{{- if .Values.dashboard.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "kubeapps.dashboard.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.dashboard.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -0,0 +1,71 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.dashboard.enabled .Values.dashboard.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "kubeapps.dashboard.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.dashboard.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: dashboard
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.dashboard.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: dashboard
|
||||
{{- if .Values.dashboard.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
{{- range $port := .Values.dashboard.networkPolicy.kubeAPIServerPorts }}
|
||||
- port: {{ $port }}
|
||||
{{- end }}
|
||||
{{- if .Values.dashboard.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.dashboard.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
# Allow inbound connections
|
||||
- ports:
|
||||
- port: {{ .Values.dashboard.containerPorts.http }}
|
||||
{{- if not .Values.dashboard.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.dashboard.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.dashboard.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.dashboard.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.dashboard.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.dashboard.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.dashboard.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -8,7 +8,7 @@ apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kubeapps.dashboard.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.dashboard.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -7,7 +7,7 @@ apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kubeapps.frontend-config.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.frontend.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -7,7 +7,7 @@ apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.frontend.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -0,0 +1,77 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.frontend.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.frontend.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: frontend
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.frontend.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: frontend
|
||||
{{- if .Values.frontend.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
{{- range $port := .Values.frontend.networkPolicy.kubeAPIServerPorts }}
|
||||
- port: {{ $port }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
# Allow inbound connections
|
||||
- ports:
|
||||
- port: {{ .Values.frontend.containerPorts.http }}
|
||||
{{- if and .Values.authProxy.enabled (not .Values.authProxy.external) }}
|
||||
- port: {{ .Values.authProxy.containerPorts.proxy }}
|
||||
{{- end }}
|
||||
{{- if .Values.pinnipedProxy.enabled }}
|
||||
- port: {{ .Values.pinnipedProxy.containerPorts.pinnipedProxy }}
|
||||
{{- end }}
|
||||
{{- if not .Values.frontend.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.frontend.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.frontend.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.frontend.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.frontend.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.frontend.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -8,7 +8,7 @@ apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kubeapps.oauth2_proxy-secret.name" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.frontend.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -7,7 +7,7 @@ apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.frontend.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
@@ -64,7 +64,7 @@ apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kubeapps.pinniped-proxy.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: frontend
|
||||
{{- if or .Values.pinnipedProxy.service.annotations .Values.commonAnnotations }}
|
||||
|
||||
@@ -15,7 +15,7 @@ apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}-http-api
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.ingress.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
@@ -75,7 +75,7 @@ apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.featureFlags.apiOnly.grpc.annotations .Values.ingress.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.featureFlags.apiOnly.grpc.annotations .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
|
||||
@@ -8,7 +8,7 @@ apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ template "common.names.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.ingress.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.ingress.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
|
||||
@@ -7,7 +7,7 @@ apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-configmap" (include "kubeapps.kubeappsapis.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.kubeappsapis.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -7,7 +7,7 @@ apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "kubeapps.kubeappsapis.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.kubeappsapis.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -0,0 +1,74 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.kubeappsapis.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ template "kubeapps.kubeappsapis.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.kubeappsapis.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: kubeappsapis
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.kubeappsapis.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: kubeappsapis
|
||||
{{- if .Values.kubeappsapis.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
# Allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
{{- range $port := .Values.kubeappsapis.networkPolicy.kubeAPIServerPorts }}
|
||||
- port: {{ $port }}
|
||||
{{- end }}
|
||||
{{- if .Values.kubeappsapis.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.kubeappsapis.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
# Allow inbound connections
|
||||
- ports:
|
||||
- port: {{ .Values.kubeappsapis.containerPorts.http }}
|
||||
{{- if .Values.ociCatalog.enabled }}
|
||||
- port: {{ .Values.ociCatalog.containerPorts.grpc }}
|
||||
{{- end }}
|
||||
{{- if not .Values.kubeappsapis.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
{{- if .Values.kubeappsapis.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.kubeappsapis.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.kubeappsapis.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.kubeappsapis.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.kubeappsapis.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.kubeappsapis.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -53,6 +53,6 @@ roleRef:
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "kubeapps.kubeappsapis.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -7,7 +7,7 @@ apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "kubeapps.kubeappsapis.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.kubeappsapis.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -8,7 +8,7 @@ apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "kubeapps.kubeappsapis.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.kubeappsapis.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -8,7 +8,7 @@ apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kubeapps.clusters-config.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -30,7 +30,7 @@ apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ $secretName }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
|
||||
@@ -26,7 +26,7 @@ global:
|
||||
openshift:
|
||||
## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
|
||||
##
|
||||
adaptSecurityContext: disabled
|
||||
adaptSecurityContext: auto
|
||||
## @section Common parameters
|
||||
|
||||
## @param kubeVersion Override Kubernetes version
|
||||
@@ -211,7 +211,7 @@ frontend:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/nginx
|
||||
tag: 1.25.4-debian-12-r3
|
||||
tag: 1.25.4-debian-12-r7
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
@@ -258,22 +258,21 @@ frontend:
|
||||
type: RollingUpdate
|
||||
## Frontend containers' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param frontend.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production).
|
||||
## @param frontend.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if frontend.resources is set (frontend.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
## @param frontend.resources.limits.cpu The CPU limits for the NGINX container
|
||||
## @param frontend.resources.limits.memory The memory limits for the NGINX container
|
||||
## @param frontend.resources.requests.cpu The requested CPU for the NGINX container
|
||||
## @param frontend.resources.requests.memory The requested memory for the NGINX container
|
||||
resourcesPreset: "micro"
|
||||
## @param frontend.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
resources: {}
|
||||
## @param frontend.extraEnvVars Array with extra environment variables to add to the NGINX container
|
||||
## e.g:
|
||||
## extraEnvVars:
|
||||
@@ -322,10 +321,10 @@ frontend:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
@@ -537,6 +536,64 @@ frontend:
|
||||
## timeoutSeconds: 300
|
||||
##
|
||||
sessionAffinityConfig: {}
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param frontend.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param frontend.networkPolicy.allowExternal Don't require server label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## server label will have network access to the ports server is listening
|
||||
## on. When true, server will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param frontend.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param frontend.networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)
|
||||
##
|
||||
kubeAPIServerPorts: [443, 6443, 8443]
|
||||
## @param frontend.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param frontend.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param frontend.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param frontend.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
## @section Dashboard parameters
|
||||
|
||||
## Dashboard parameters
|
||||
@@ -558,7 +615,7 @@ dashboard:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/kubeapps-dashboard
|
||||
tag: 2.9.0-debian-12-r18
|
||||
tag: 2.10.0-debian-12-r0
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
@@ -654,22 +711,21 @@ dashboard:
|
||||
http: 8080
|
||||
## Dashboard containers' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param dashboard.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if dashboard.resources is set (dashboard.resources is recommended for production).
|
||||
## @param dashboard.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if dashboard.resources is set (dashboard.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
## @param dashboard.resources.limits.cpu The CPU limits for the Dashboard container
|
||||
## @param dashboard.resources.limits.memory The memory limits for the Dashboard container
|
||||
## @param dashboard.resources.requests.cpu The requested CPU for the Dashboard container
|
||||
## @param dashboard.resources.requests.memory The requested memory for the Dashboard container
|
||||
resourcesPreset: "micro"
|
||||
## @param dashboard.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
resources: {}
|
||||
## Configure Pods Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param dashboard.podSecurityContext.enabled Enabled Dashboard pods' Security Context
|
||||
@@ -701,10 +757,10 @@ dashboard:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
@@ -876,6 +932,64 @@ dashboard:
|
||||
## @param dashboard.service.annotations Additional custom annotations for Dashboard service
|
||||
##
|
||||
annotations: {}
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param dashboard.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param dashboard.networkPolicy.allowExternal Don't require server label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## server label will have network access to the ports server is listening
|
||||
## on. When true, server will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param dashboard.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param dashboard.networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)
|
||||
##
|
||||
kubeAPIServerPorts: [443, 6443, 8443]
|
||||
## @param dashboard.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param dashboard.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param dashboard.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param dashboard.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
## @section AppRepository Controller parameters
|
||||
|
||||
## AppRepository Controller parameters
|
||||
@@ -893,7 +1007,7 @@ apprepository:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/kubeapps-apprepository-controller
|
||||
tag: 2.9.0-debian-12-r18
|
||||
tag: 2.10.0-debian-12-r0
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
@@ -920,7 +1034,7 @@ apprepository:
|
||||
syncImage:
|
||||
registry: docker.io
|
||||
repository: bitnami/kubeapps-asset-syncer
|
||||
tag: 2.9.0-debian-12-r19
|
||||
tag: 2.10.0-debian-12-r0
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
@@ -1029,22 +1143,21 @@ apprepository:
|
||||
type: RollingUpdate
|
||||
## AppRepository Controller containers' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param apprepository.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if apprepository.resources is set (apprepository.resources is recommended for production).
|
||||
## @param apprepository.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if apprepository.resources is set (apprepository.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
## @param apprepository.resources.limits.cpu The CPU limits for the AppRepository Controller container
|
||||
## @param apprepository.resources.limits.memory The memory limits for the AppRepository Controller container
|
||||
## @param apprepository.resources.requests.cpu The requested CPU for the AppRepository Controller container
|
||||
## @param apprepository.resources.requests.memory The requested memory for the AppRepository Controller container
|
||||
resourcesPreset: "micro"
|
||||
## @param apprepository.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
resources: {}
|
||||
## Configure Pods Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param apprepository.podSecurityContext.enabled Enabled AppRepository Controller pods' Security Context
|
||||
@@ -1076,10 +1189,10 @@ apprepository:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
@@ -1199,6 +1312,52 @@ apprepository:
|
||||
## command: ['sh', '-c', 'echo "hello world"']
|
||||
##
|
||||
initContainers: []
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param apprepository.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param apprepository.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param apprepository.networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)
|
||||
##
|
||||
kubeAPIServerPorts: [443, 6443, 8443]
|
||||
## @param apprepository.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param apprepository.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## AppRepository Controller Service Account
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
|
||||
## @param apprepository.serviceAccount.create Specifies whether a ServiceAccount should be created
|
||||
@@ -1232,7 +1391,7 @@ authProxy:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/oauth2-proxy
|
||||
tag: 7.6.0-debian-12-r4
|
||||
tag: 7.6.0-debian-12-r7
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
@@ -1342,10 +1501,10 @@ authProxy:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
@@ -1353,22 +1512,21 @@ authProxy:
|
||||
type: "RuntimeDefault"
|
||||
## OAuth2 Proxy containers' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param authProxy.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if authProxy.resources is set (authProxy.resources is recommended for production).
|
||||
## @param authProxy.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if authProxy.resources is set (authProxy.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
## @param authProxy.resources.limits.cpu The CPU limits for the OAuth2 Proxy container
|
||||
## @param authProxy.resources.limits.memory The memory limits for the OAuth2 Proxy container
|
||||
## @param authProxy.resources.requests.cpu The requested CPU for the OAuth2 Proxy container
|
||||
## @param authProxy.resources.requests.memory The requested memory for the OAuth2 Proxy container
|
||||
resourcesPreset: "micro"
|
||||
## @param authProxy.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
resources: {}
|
||||
## @section Pinniped Proxy parameters
|
||||
|
||||
## Pinniped Proxy configuration for converting user OIDC tokens to k8s client authorization certs
|
||||
@@ -1389,7 +1547,7 @@ pinnipedProxy:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/kubeapps-pinniped-proxy
|
||||
tag: 2.9.0-debian-12-r17
|
||||
tag: 2.10.0-debian-12-r0
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
@@ -1473,10 +1631,10 @@ pinnipedProxy:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
@@ -1484,24 +1642,21 @@ pinnipedProxy:
|
||||
type: "RuntimeDefault"
|
||||
## Pinniped Proxy containers' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param pinnipedProxy.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if pinnipedProxy.resources is set (pinnipedProxy.resources is recommended for production).
|
||||
## @param pinnipedProxy.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if pinnipedProxy.resources is set (pinnipedProxy.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
## Pinniped Proxy containers' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param pinnipedProxy.resources.limits.cpu The CPU limits for the Pinniped Proxy container
|
||||
## @param pinnipedProxy.resources.limits.memory The memory limits for the Pinniped Proxy container
|
||||
## @param pinnipedProxy.resources.requests.cpu The requested CPU for the Pinniped Proxy container
|
||||
## @param pinnipedProxy.resources.requests.memory The requested memory for the Pinniped Proxy container
|
||||
resourcesPreset: "micro"
|
||||
## @param pinnipedProxy.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
resources: {}
|
||||
## Pinniped Proxy service parameters
|
||||
##
|
||||
service:
|
||||
@@ -1609,19 +1764,22 @@ postgresql:
|
||||
enabled: false
|
||||
## PostgreSQL containers' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param postgresql.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if postgresql.resources is set (postgresql.resources is recommended for production).
|
||||
## @param postgresql.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if postgresql.resources is set (postgresql.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
## @param postgresql.resources.limits The resources limits for the PostgreSQL container
|
||||
## @param postgresql.resources.requests.cpu The requested CPU for the PostgreSQL container
|
||||
## @param postgresql.resources.requests.memory The requested memory for the PostgreSQL container
|
||||
resourcesPreset: "micro"
|
||||
## @param postgresql.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 250m
|
||||
##
|
||||
resources: {}
|
||||
## @section kubeappsapis parameters
|
||||
kubeappsapis:
|
||||
## @param kubeappsapis.enabledPlugins Manually override which plugins are enabled for the Kubeapps-APIs service
|
||||
@@ -1704,7 +1862,7 @@ kubeappsapis:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/kubeapps-apis
|
||||
tag: 2.9.0-debian-12-r19
|
||||
tag: 2.10.0-debian-12-r0
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
@@ -1765,22 +1923,21 @@ kubeappsapis:
|
||||
http: 50051
|
||||
## KubeappsAPIs containers' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param kubeappsapis.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if kubeappsapis.resources is set (kubeappsapis.resources is recommended for production).
|
||||
## @param kubeappsapis.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if kubeappsapis.resources is set (kubeappsapis.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
## @param kubeappsapis.resources.limits.cpu The CPU limits for the KubeappsAPIs container
|
||||
## @param kubeappsapis.resources.limits.memory The memory limits for the KubeappsAPIs container
|
||||
## @param kubeappsapis.resources.requests.cpu The requested CPU for the KubeappsAPIs container
|
||||
## @param kubeappsapis.resources.requests.memory The requested memory for the KubeappsAPIs container
|
||||
resourcesPreset: "micro"
|
||||
## @param kubeappsapis.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
resources: {}
|
||||
## Configure Pods Security Context
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
## @param kubeappsapis.podSecurityContext.enabled Enabled KubeappsAPIs pods' Security Context
|
||||
@@ -1812,10 +1969,10 @@ kubeappsapis:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
@@ -1987,6 +2144,64 @@ kubeappsapis:
|
||||
## @param kubeappsapis.service.annotations Additional custom annotations for KubeappsAPIs service
|
||||
##
|
||||
annotations: {}
|
||||
## Network Policies
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
networkPolicy:
|
||||
## @param kubeappsapis.networkPolicy.enabled Specifies whether a NetworkPolicy should be created
|
||||
##
|
||||
enabled: true
|
||||
## @param kubeappsapis.networkPolicy.allowExternal Don't require server label for connections
|
||||
## The Policy model to apply. When set to false, only pods with the correct
|
||||
## server label will have network access to the ports server is listening
|
||||
## on. When true, server will accept connections from any source
|
||||
## (with the correct destination port).
|
||||
##
|
||||
allowExternal: true
|
||||
## @param kubeappsapis.networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
|
||||
##
|
||||
allowExternalEgress: true
|
||||
## @param kubeappsapis.networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)
|
||||
##
|
||||
kubeAPIServerPorts: [443, 6443, 8443]
|
||||
## @param kubeappsapis.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolice
|
||||
## e.g:
|
||||
## extraIngress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## from:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
extraIngress: []
|
||||
## @param kubeappsapis.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
|
||||
## e.g:
|
||||
## extraEgress:
|
||||
## - ports:
|
||||
## - port: 1234
|
||||
## to:
|
||||
## - podSelector:
|
||||
## - matchLabels:
|
||||
## - role: frontend
|
||||
## - podSelector:
|
||||
## - matchExpressions:
|
||||
## - key: role
|
||||
## operator: In
|
||||
## values:
|
||||
## - frontend
|
||||
##
|
||||
extraEgress: []
|
||||
## @param kubeappsapis.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
|
||||
## @param kubeappsapis.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
|
||||
##
|
||||
ingressNSMatchLabels: {}
|
||||
ingressNSPodMatchLabels: {}
|
||||
## kubeappsapis Service Account
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
|
||||
## @param kubeappsapis.serviceAccount.create Specifies whether a ServiceAccount should be created
|
||||
@@ -2017,7 +2232,7 @@ ociCatalog:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/kubeapps-oci-catalog
|
||||
tag: 2.9.0-debian-12-r17
|
||||
tag: 2.10.0-debian-12-r0
|
||||
digest: ""
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
@@ -2057,22 +2272,21 @@ ociCatalog:
|
||||
grpc: 50061
|
||||
## OCI Catalog containers' resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
## @param ociCatalog.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if ociCatalog.resources is set (ociCatalog.resources is recommended for production).
|
||||
## @param ociCatalog.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if ociCatalog.resources is set (ociCatalog.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "none"
|
||||
## @param ociCatalog.resources.limits.cpu The CPU limits for the OCI Catalog container
|
||||
## @param ociCatalog.resources.limits.memory The memory limits for the OCI Catalog container
|
||||
## @param ociCatalog.resources.requests.cpu The requested CPU for the OCI Catalog container
|
||||
## @param ociCatalog.resources.requests.memory The requested memory for the OCI Catalog container
|
||||
resourcesPreset: "micro"
|
||||
## @param ociCatalog.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
resources: {}
|
||||
## Configure Container Security Context (only main container)
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
|
||||
## @param ociCatalog.containerSecurityContext.enabled Enabled containers' Security Context
|
||||
@@ -2090,10 +2304,10 @@ ociCatalog:
|
||||
enabled: true
|
||||
seLinuxOptions: null
|
||||
runAsUser: 1001
|
||||
runAsGroup: 0
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
@@ -2211,6 +2425,23 @@ redis:
|
||||
## @param redis.master.persistence.enabled Enable Redis® master data persistence using PVC
|
||||
##
|
||||
enabled: false
|
||||
## Redis® master resource requests and limits
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
|
||||
## @param redis.master.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if master.resources is set (master.resources is recommended for production).
|
||||
## More information: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15
|
||||
##
|
||||
resourcesPreset: "nano"
|
||||
## @param redis.master.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
|
||||
## Example:
|
||||
## resources:
|
||||
## requests:
|
||||
## cpu: 2
|
||||
## memory: 512Mi
|
||||
## limits:
|
||||
## cpu: 3
|
||||
## memory: 1024Mi
|
||||
##
|
||||
resources: {}
|
||||
replica:
|
||||
## @param redis.replica.replicaCount Number of Redis® replicas to deploy
|
||||
##
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:ebf11c0997c964a7eeadabecf3bade4c42f623cd03d4c742c8e0748d744f2b48",
|
||||
"containerimage.digest": "sha256:1f2ba6374064bdc927fc7e61c95f58a6f76c121c828d438d212f8772bc52b170"
|
||||
"containerimage.config.digest": "sha256:ac9429d9bf66dd913a37fa9c22a6a2ccdc5d6bef50986bfef7868b5643ecaab2",
|
||||
"containerimage.digest": "sha256:b551704d07e93f9837d36bb610ae5d10508325c31e9bd98a019452eed12ed96f"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/dashboard:v0.3.1
|
||||
ghcr.io/aenix-io/cozystack/dashboard:latest
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
# Copyright 2018-2023 the Kubeapps contributors.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
FROM bitnami/node:20.11.0 AS build
|
||||
FROM bitnami/node:20.12.1 AS build
|
||||
WORKDIR /app
|
||||
|
||||
ARG VERSION=2.9.0
|
||||
ARG VERSION=2.10.0
|
||||
RUN wget -O- https://github.com/vmware-tanzu/kubeapps/archive/refs/tags/v${VERSION}.tar.gz | tar xzf - --strip-components=2 kubeapps-${VERSION}/dashboard
|
||||
|
||||
COPY apple-touch-icon.png favicon-16x16.png favicon-32x32.png favicon.ico mstile-144x144.png mstile-150x150.png mstile-310x150.png mstile-310x310.png mstile-70x70.png safari-pinned-tab.svg public/
|
||||
@@ -26,8 +26,22 @@ RUN yarn install --frozen-lockfile
|
||||
RUN yarn run prettier-check && yarn run ts-compile-check
|
||||
RUN yarn run build
|
||||
|
||||
RUN sed -i 's/hsl(206, 25%, 25%)/hsl(225, 6%, 13%)/g' $(grep -rl 'hsl(206, 25\%, 25\%)')
|
||||
RUN sed -i 's/#304250/#202124/g' $(grep -rl "#304250")
|
||||
RUN sed -i \
|
||||
-e 's/#2d4048/#202124/g' \
|
||||
-e 's/#25333d/#1e2023/g' \
|
||||
-e 's/#fcfdfd/#f3f4f5/g' \
|
||||
-e 's/#f1f6f8/#e7e9eb/g' \
|
||||
-e 's/#e3eaed/#d3d6da/g' \
|
||||
-e 's/#cbd4d8/#b7bbc1/g' \
|
||||
-e 's/#aeb8bc/#989da3/g' \
|
||||
-e 's/#859399/#7b7f85/g' \
|
||||
-e 's/#6a7a81/#63666b/g' \
|
||||
-e 's/#4f6169/#4f5256/g' \
|
||||
-e 's/#3a4d55/#3a3d41/g' \
|
||||
-e 's/#2d4048/#202124/g' \
|
||||
-e 's/#21333b/#1a1c1f/g' \
|
||||
-e 's/#1b2b32/#141619/g' \
|
||||
$(grep -rl "#2d4048\|#25333d\|#fcfdfd\|#f1f6f8\|#e3eaed\|#cbd4d8\|#aeb8bc\|#859399\|#6a7a81\|#4f6169\|#3a4d55\|#2d4048\|#21333b\|#1b2b32")
|
||||
|
||||
FROM bitnami/nginx:1.25.2
|
||||
COPY --from=build /app/build /app
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"containerimage.config.digest": "sha256:e5f295cce1b460e2423f07326e812a201fac6ab594ecfc75eddfa81f46fd10fb",
|
||||
"containerimage.digest": "sha256:6e32bb3f1afaf93e4e619d5655c43dcd1bf10e0d30aa8136e738484f1b0bd474"
|
||||
"containerimage.config.digest": "sha256:ab059b6397905b2a2084def06582e61b49c4a8a3374747e87b08c82621357420",
|
||||
"containerimage.digest": "sha256:9c1093da42482f116b27407edcdf8b24122885e295cbb632e565213c66fc07c0"
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
ghcr.io/aenix-io/cozystack/kubeapps-apis:v0.3.1
|
||||
ghcr.io/aenix-io/cozystack/kubeapps-apis:latest
|
||||
|
||||
@@ -1,21 +1,19 @@
|
||||
# Copyright 2021-2023 the Kubeapps contributors.
|
||||
# Copyright 2021-2024 the Kubeapps contributors.
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# syntax = docker/dockerfile:1
|
||||
|
||||
FROM alpine as source
|
||||
ARG VERSION=v2.9.0
|
||||
ARG VERSION=v2.10.0
|
||||
RUN apk add --no-cache patch
|
||||
WORKDIR /source
|
||||
RUN wget -O- https://github.com/vmware-tanzu/kubeapps/archive/refs/tags/${VERSION}.tar.gz | tar xzf - --strip-components=1
|
||||
COPY fix-flux.diff /patches/fix-flux.diff
|
||||
COPY labels.diff /patches/labels.diff
|
||||
COPY reconcile-strategy.diff /patches/reconcile-strategy.diff
|
||||
RUN patch -p1 < /patches/fix-flux.diff
|
||||
RUN patch -p1 < /patches/labels.diff
|
||||
RUN patch -p1 < /patches/reconcile-strategy.diff
|
||||
|
||||
FROM bitnami/golang:1.21.1 as builder
|
||||
FROM bitnami/golang:1.22.2 as builder
|
||||
WORKDIR /go/src/github.com/vmware-tanzu/kubeapps
|
||||
COPY --from=source /source/go.mod /source/go.sum ./
|
||||
ARG VERSION="devel"
|
||||
@@ -25,16 +23,16 @@ ARG TARGETARCH
|
||||
ARG lint
|
||||
|
||||
# https://github.com/bufbuild/buf/releases/
|
||||
ARG BUF_VERSION="1.26.0"
|
||||
ARG BUF_VERSION="1.30.1"
|
||||
|
||||
# https://github.com/golangci/golangci-lint/releases
|
||||
ARG GOLANGCILINT_VERSION="1.53.3"
|
||||
ARG GOLANGCILINT_VERSION="1.57.2"
|
||||
|
||||
# https://github.com/grpc-ecosystem/grpc-health-probe/releases/
|
||||
ARG GRPC_HEALTH_PROBE_VERSION="0.4.19"
|
||||
ARG GRPC_HEALTH_PROBE_VERSION="0.4.25"
|
||||
|
||||
# Install lint tools
|
||||
RUN if [ ! -z "$lint" ]; then \
|
||||
RUN if [ ! -z ${lint:-} ]; then \
|
||||
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v$GOLANGCILINT_VERSION; \
|
||||
fi
|
||||
|
||||
@@ -55,7 +53,7 @@ RUN --mount=type=cache,target=/go/pkg/mod \
|
||||
COPY --from=source /source/pkg pkg
|
||||
COPY --from=source /source/cmd cmd
|
||||
|
||||
RUN if [ ! -z "$lint" ]; then \
|
||||
RUN if [ ! -z ${lint:-} ]; then \
|
||||
# Run golangci-lint to detect issues
|
||||
golangci-lint run --timeout=10m ./cmd/kubeapps-apis/... && \
|
||||
golangci-lint run --timeout=10m ./pkg/...; \
|
||||
@@ -67,6 +65,7 @@ RUN /tmp/buf lint ./cmd/kubeapps-apis
|
||||
# Build the main grpc server
|
||||
RUN --mount=type=cache,target=/go/pkg/mod \
|
||||
--mount=type=cache,target=/root/.cache/go-build \
|
||||
GOPROXY="https://proxy.golang.org,direct" \
|
||||
go build \
|
||||
-ldflags "-X github.com/vmware-tanzu/kubeapps/cmd/kubeapps-apis/cmd.version=$VERSION" \
|
||||
./cmd/kubeapps-apis
|
||||
|
||||
@@ -1,27 +1,27 @@
|
||||
diff --git b/system/kubeapps/images/kubeapps-apis/Dockerfile a/system/kubeapps/images/kubeapps-apis/Dockerfile
|
||||
index e5fcd8c..f72964d 100644
|
||||
--- b/system/kubeapps/images/kubeapps-apis/Dockerfile
|
||||
+++ a/system/kubeapps/images/kubeapps-apis/Dockerfile
|
||||
@@ -3,9 +3,17 @@
|
||||
@@ -3,9 +3,19 @@
|
||||
|
||||
# syntax = docker/dockerfile:1
|
||||
|
||||
+FROM alpine as source
|
||||
+ARG VERSION=v2.9.0
|
||||
+ARG VERSION=v2.10.0
|
||||
+RUN apk add --no-cache patch
|
||||
+WORKDIR /source
|
||||
+RUN wget -O- https://github.com/vmware-tanzu/kubeapps/archive/refs/tags/${VERSION}.tar.gz | tar xzf - --strip-components=1
|
||||
+COPY fix-flux.diff /patches/fix-flux.diff
|
||||
+RUN patch -p1 < /patches/fix-flux.diff
|
||||
+COPY labels.diff /patches/labels.diff
|
||||
+COPY reconcile-strategy.diff /patches/reconcile-strategy.diff
|
||||
+RUN patch -p1 < /patches/labels.diff
|
||||
+RUN patch -p1 < /patches/reconcile-strategy.diff
|
||||
+
|
||||
FROM bitnami/golang:1.21.1 as builder
|
||||
FROM bitnami/golang:1.22.2 as builder
|
||||
WORKDIR /go/src/github.com/vmware-tanzu/kubeapps
|
||||
-COPY go.mod go.sum ./
|
||||
+COPY --from=source /source/go.mod /source/go.sum ./
|
||||
ARG VERSION="devel"
|
||||
ARG TARGETARCH
|
||||
|
||||
@@ -40,8 +48,8 @@ RUN --mount=type=cache,target=/go/pkg/mod \
|
||||
@@ -40,8 +52,8 @@
|
||||
|
||||
# We don't copy the pkg and cmd directories until here so the above layers can
|
||||
# be reused.
|
||||
@@ -30,5 +30,5 @@ index e5fcd8c..f72964d 100644
|
||||
+COPY --from=source /source/pkg pkg
|
||||
+COPY --from=source /source/cmd cmd
|
||||
|
||||
RUN if [ ! -z "$lint" ]; then \
|
||||
RUN if [ ! -z ${lint:-} ]; then \
|
||||
# Run golangci-lint to detect issues
|
||||
|
||||
@@ -1,28 +0,0 @@
|
||||
diff --git a/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/repo.go b/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/repo.go
|
||||
index 8886f4d479e..1ab08c074a5 100644
|
||||
--- a/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/repo.go
|
||||
+++ b/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/repo.go
|
||||
@@ -579,9 +579,9 @@ func (s *repoEventSink) onAddRepo(key string, obj ctrlclient.Object) (interface{
|
||||
// ref https://fluxcd.io/docs/components/source/helmrepositories/#status
|
||||
func (s *repoEventSink) onAddHttpRepo(repo sourcev1.HelmRepository) ([]byte, bool, error) {
|
||||
if artifact := repo.GetArtifact(); artifact != nil {
|
||||
- if checksum := artifact.Checksum; checksum == "" {
|
||||
+ if checksum := artifact.Digest; checksum == "" {
|
||||
return nil, false, connect.NewError(connect.CodeInternal,
|
||||
- fmt.Errorf("expected field status.artifact.checksum not found on HelmRepository\n[%s]",
|
||||
+ fmt.Errorf("expected field status.artifact.digest not found on HelmRepository\n[%s]",
|
||||
common.PrettyPrint(repo)))
|
||||
} else {
|
||||
return s.indexAndEncode(checksum, repo)
|
||||
@@ -721,9 +721,9 @@ func (s *repoEventSink) onModifyHttpRepo(key string, oldValue interface{}, repo
|
||||
// ref https://fluxcd.io/docs/components/source/helmrepositories/#status
|
||||
var newChecksum string
|
||||
if artifact := repo.GetArtifact(); artifact != nil {
|
||||
- if newChecksum = artifact.Checksum; newChecksum == "" {
|
||||
+ if newChecksum = artifact.Digest; newChecksum == "" {
|
||||
return nil, false, connect.NewError(connect.CodeInternal,
|
||||
- fmt.Errorf("expected field status.artifact.checksum not found on HelmRepository\n[%s]",
|
||||
+ fmt.Errorf("expected field status.artifact.digest not found on HelmRepository\n[%s]",
|
||||
common.PrettyPrint(repo)))
|
||||
}
|
||||
} else {
|
||||
@@ -1,5 +1,5 @@
|
||||
diff --git a/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/release.go b/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/release.go
|
||||
index fe7ca772d..3b46afbd1 100644
|
||||
index c489cb6ca..8884a6484 100644
|
||||
--- a/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/release.go
|
||||
+++ b/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/release.go
|
||||
@@ -29,8 +29,10 @@ import (
|
||||
@@ -16,7 +16,7 @@ index fe7ca772d..3b46afbd1 100644
|
||||
@@ -54,7 +56,10 @@ func (s *Server) listReleasesInCluster(ctx context.Context, headers http.Header,
|
||||
// see any results created/updated/deleted after the first request is issued
|
||||
// To fix this, we must make use of resourceVersion := relList.GetResourceVersion()
|
||||
var relList helmv2.HelmReleaseList
|
||||
var relList helmv2beta2.HelmReleaseList
|
||||
- if err = client.List(ctx, &relList); err != nil {
|
||||
+ listOptions := ctrlclient.ListOptions{
|
||||
+ LabelSelector: labels.SelectorFromSet(labels.Set{"cozystack.io/ui": "true"}),
|
||||
@@ -25,18 +25,18 @@ index fe7ca772d..3b46afbd1 100644
|
||||
return nil, connecterror.FromK8sError("list", "HelmRelease", namespace+"/*", err)
|
||||
} else {
|
||||
return relList.Items, nil
|
||||
@@ -511,6 +516,9 @@ func (s *Server) newFluxHelmRelease(chart *models.Chart, targetName types.Namesp
|
||||
@@ -512,6 +517,9 @@ func (s *Server) newFluxHelmRelease(chart *models.Chart, targetName types.Namesp
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: chart.Name + "-" + targetName.Name,
|
||||
Name: targetName.Name,
|
||||
Namespace: targetName.Namespace,
|
||||
+ Labels: map[string]string{
|
||||
+ "cozystack.io/ui": "true",
|
||||
+ },
|
||||
},
|
||||
Spec: helmv2.HelmReleaseSpec{
|
||||
Chart: helmv2.HelmChartTemplate{
|
||||
Spec: helmv2beta2.HelmReleaseSpec{
|
||||
Chart: helmv2beta2.HelmChartTemplate{
|
||||
diff --git a/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/repo.go b/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/repo.go
|
||||
index 1ab08c074..cd7b3b9aa 100644
|
||||
index 790b21514..539276a17 100644
|
||||
--- a/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/repo.go
|
||||
+++ b/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/repo.go
|
||||
@@ -32,6 +32,7 @@ import (
|
||||
@@ -49,7 +49,7 @@ index 1ab08c074..cd7b3b9aa 100644
|
||||
log "k8s.io/klog/v2"
|
||||
@@ -64,7 +65,8 @@ func (s *Server) listReposInNamespace(ctx context.Context, headers http.Header,
|
||||
|
||||
var repoList sourcev1.HelmRepositoryList
|
||||
var repoList sourcev1beta2.HelmRepositoryList
|
||||
listOptions := ctrlclient.ListOptions{
|
||||
- Namespace: ns,
|
||||
+ Namespace: ns,
|
||||
@@ -57,3 +57,13 @@ index 1ab08c074..cd7b3b9aa 100644
|
||||
}
|
||||
if err := client.List(backgroundCtx, &repoList, &listOptions); err != nil {
|
||||
return nil, connecterror.FromK8sError("list", "HelmRepository", "", err)
|
||||
@@ -927,6 +929,9 @@ func newFluxHelmRepo(
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: targetName.Name,
|
||||
Namespace: targetName.Namespace,
|
||||
+ Labels: map[string]string{
|
||||
+ "cozystack.io/ui": "true",
|
||||
+ },
|
||||
},
|
||||
Spec: sourcev1beta2.HelmRepositorySpec{
|
||||
URL: url,
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
diff --git a/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/release.go b/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/release.go
|
||||
index fe7ca772d..8111feb1c 100644
|
||||
index 8884a6484..4bf77071c 100644
|
||||
--- a/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/release.go
|
||||
+++ b/cmd/kubeapps-apis/plugins/fluxv2/packages/v1alpha1/release.go
|
||||
@@ -521,6 +529,7 @@ func (s *Server) newFluxHelmRelease(chart *models.Chart, targetName types.Namesp
|
||||
Kind: sourcev1.HelmRepositoryKind,
|
||||
@@ -530,6 +530,7 @@ func (s *Server) newFluxHelmRelease(chart *models.Chart, targetName types.Namesp
|
||||
Kind: sourcev1beta2.HelmRepositoryKind,
|
||||
Namespace: chart.Repo.Namespace,
|
||||
},
|
||||
+ ReconcileStrategy: "Revision",
|
||||
|
||||
@@ -15,3 +15,12 @@ kubeapps:
|
||||
#serviceaccount-selector {
|
||||
display: none;
|
||||
}
|
||||
.login-moreinfo {
|
||||
display: none;
|
||||
}
|
||||
a[href="#/docs"] {
|
||||
display: none;
|
||||
}
|
||||
.login-group .clr-form-control .clr-control-label {
|
||||
display: none;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user