sdefsdf

.github/workflows/lint-and-test.yml

@@ -14,21 +14,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v4.3.0
         with:
-          version: latest
+          version: v3.18.4 # Also update in release.yml
 
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.3.1
+        uses: helm/chart-testing-action@v2.7.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -53,20 +53,3 @@ jobs:
       - name: Run chart-testing (lint)
         run: ct lint --config ct.yaml --lint-conf lintconf.yaml
         if: steps.list-changed.outputs.changed == 'true'
-
-      - name: Create kind cluster
-        uses: helm/kind-action@v1.5.0
-        if: steps.list-changed.outputs.changed == 'true'
-        #with:
-        #  kubectl_version: v1.22.0
-
-      # Install Dependencies
-      - name: Install Required dependencies
-        if: steps.list-changed.outputs.changed == 'true'
-        run: |
-          kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
-          kubectl create -f https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.58.0/bundle.yaml
-
-      - name: Run chart-testing (install)
-        run: ct install --config ct.yaml
-        if: steps.list-changed.outputs.changed == 'true'

.github/workflows/pr-label.yml

@@ -13,6 +13,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: size-label
-        uses: "pascalgn/size-label-action@v0.4.2"
+        uses: "pascalgn/size-label-action@v0.5.5"
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/pr-validate.yml

@@ -12,7 +12,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: morrisoncole/pr-lint-action@v1.5.0
+      - uses: morrisoncole/pr-lint-action@v1.7.1
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           title-regex: '^\[[a-zA-Z0-9\,\_\-]+\]\:.+'

.github/workflows/release.yml

@@ -17,14 +17,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Install Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
         with:
-          version: v3.10.1 # Also update in lint-and-test.yaml
+          version: v3.18.4 # Also update in lint-and-test.yml
 
       - name: Add dependency chart repos
         run: |
@@ -35,7 +35,7 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.4.1
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
         with:
           charts_dir: charts
         env:

.gitignore

@@ -26,3 +26,5 @@ Sessionx.vim
 .idea/
 .intellij/
 *.iml
+.project
+.settings

.pre-commit-config.yaml

@@ -2,20 +2,20 @@
 repos:
 
   - repo: https://github.com/pre-commit/pre-commit-hooks.git
-    rev: v4.3.0
+    rev: v5.0.0
     hooks:
       - id: end-of-file-fixer
         exclude_types: ['markdown']
-        stages: [commit]
+        stages: [pre-commit]
       - id: trailing-whitespace
         exclude_types: ['markdown']
-        stages: [commit]
+        stages: [pre-commit]
       - id: mixed-line-ending
-        stages: [commit]
+        stages: [pre-commit]
       - id: check-byte-order-marker
-        stages: [commit]
+        stages: [pre-commit]
       - id: check-executables-have-shebangs
-        stages: [commit]
+        stages: [pre-commit]
       - id: check-merge-conflict
 
   - repo: local
@@ -26,11 +26,11 @@ repos:
         args: ["helm-docs"]
         language: system
         pass_filenames: false
-        stages: [commit]
+        stages: [pre-commit]
       - id: ct-lint
         name: ct-lint
         entry: make
         args: ["helm-lint"]
         language: system
         pass_filenames: false
-        stages: [commit]
+        stages: [pre-commit]

CODEOWNERS

@@ -1 +1 @@
-*      @bedag/sre
+* @bedag/syx2 @bedag/apc

Makefile

@@ -2,11 +2,11 @@
 # Helm
 SRC_ROOT = $(shell git rev-parse --show-toplevel)
 
-helm-docs: HELMDOCS_VERSION := v1.11.0
+helm-docs: HELMDOCS_VERSION := v1.14.2
 helm-docs: docker
 	@docker run -v "$(SRC_ROOT):/helm-docs" jnorwood/helm-docs:$(HELMDOCS_VERSION) --chart-search-root /helm-docs
 
-helm-lint: CT_VERSION := v3.3.1
+helm-lint: CT_VERSION := v3.13.0
 helm-lint: docker
 	@docker run -v "$(SRC_ROOT):/workdir" --entrypoint /bin/sh quay.io/helmpack/chart-testing:$(CT_VERSION) -c "cd /workdir; ct lint --config ct.yaml --lint-conf lintconf.yaml --all --debug"
 

charts/common/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: common
 description: "Bedag's common Helm chart to use for creating other Helm charts"
-version: 10.2.0
+version: 12.7.0
 # A chart can be either an 'application' or a 'library' chart.
 #
 # Application charts are a collection of templates that can be packaged into versioned archives
@@ -27,4 +27,5 @@ annotations:
   artifacthub.io/prerelease: "false"
   artifacthub.io/license: Apache-2.0
   artifacthub.io/changes: |
-    - "[Added]: support for clusterIP field"
+    - "[Changed]: extra annotations and labels support sprig statements"
+    - "[Added]: Possibility to optionally set appVersion in values"

charts/common/README.md

@@ -1,6 +1,6 @@
 # common
 
-![Version: 10.2.0](https://img.shields.io/badge/Version-10.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 12.7.0](https://img.shields.io/badge/Version-12.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Bedag's common Helm chart to use for creating other Helm charts
 
@@ -23,32 +23,37 @@ Major Changes to functions are documented with the version affected. **Before up
 |logPersistence removed|8.0.0|Removes logPersistence functionality as it can be achieved with volumeMounts & extraVolumeClaimTemplates and is buggy anyway.|https://github.com/bedag/helm-charts/pull/68|
 |networkpolicy template changes|9.0.0|add possibility to define more than one Port in networkpolicy|https://github.com/bedag/helm-charts/pull/70|
 |networkpolicy template changes|10.0.0|add possibility to create multiple networkpolicies|https://github.com/bedag/helm-charts/pull/77|
+|ingress template changes|11.0.0|add possibility to create multiple ingress objects|https://github.com/bedag/helm-charts/pull/134
+|ingress template changes|12.0.0|support defining multiple hosts and secrets for one ingress|https://github.com/bedag/helm-charts/pull/138
 
 # Values by Component
 
 ## Ingress
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| ingress.annotations | object | `{"nginx.ingress.kubernetes.io/ssl-redirect":"true"}` | annotations is a dictionary for defining ingress controller specific annotations |
-| ingress.deploy | bool | `false` | deploy has to be set to true for rendering to be applied |
-| ingress.ingressClassName | string | `""` | ingressClassName, defines the class of the ingress controller. |
-| ingress.rules[0] | object | `{"host":"myapp.cluster.local","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}}` | host is the URL which ingress is listening |
-| ingress.rules[0].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends |
-| ingress.rules[0].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends |
-| ingress.rules[0].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to |
-| ingress.rules[0].http.paths[0].backend.serviceNameSuffix | string | `"component-1"` | serviceNameSuffix describes the suffix of the serviceName |
-| ingress.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) |
-| ingress.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening |
-| ingress.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") |
-| ingress.tls.existing.secret | string | `""` | name of an existing secret with tls.crt & tls.key content |
-| ingress.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. |
-| ingress.tls.provided.key | string | `""` | The key must not have a passphrase |
-| ingress.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: |
-| ingress.tls.self.alternativeDnsNames | list | `[]` | alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom |
-| ingress.tls.self.commonName | string | `"*.cluster.local"` | commonName of the certificate (mandatory) |
-| ingress.tls.self.ipAddresses | list | `[]` | ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section |
-| ingress.tls.self.validityDuration | int | `365` | validityDuration defines how long the certificate is valid (in days) |
+| ingresses.ingress-1.annotations | object | `{"nginx.ingress.kubernetes.io/ssl-redirect":"true"}` | annotations is a dictionary for defining ingress controller specific annotations |
+| ingresses.ingress-1.annotations."nginx.ingress.kubernetes.io/ssl-redirect" | string | `"true"` | nginx.ingress.kubernetes.io/ssl-redirect needs to be set to 'true' when using SSL/TLS offloading with a LB outside of Kubernetes |
+| ingresses.ingress-1.deploy | bool | `false` | deploy has to be set to true for rendering to be applied |
+| ingresses.ingress-1.ingressClassName | string | `""` | ingressClassName, defines the class of the ingress controller. |
+| ingresses.ingress-1.rules | list | `[{"host":"myapp.cluster.local","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]},"secretName":""}]` | rules is a list of host rules used to configure the Ingress |
+| ingresses.ingress-1.rules[0] | object | `{"host":"myapp.cluster.local","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]},"secretName":""}` | host is the URL which ingress is listening |
+| ingresses.ingress-1.rules[0].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends |
+| ingresses.ingress-1.rules[0].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends |
+| ingresses.ingress-1.rules[0].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to |
+| ingresses.ingress-1.rules[0].http.paths[0].backend.serviceNameSuffix | string | `"component-1"` | serviceNameSuffix describes the suffix of the serviceName |
+| ingresses.ingress-1.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) |
+| ingresses.ingress-1.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening |
+| ingresses.ingress-1.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") |
+| ingresses.ingress-1.rules[0].secretName | string | `""` | name of existing secrets with tls.crt & tls.key content |
+| ingresses.ingress-1.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. |
+| ingresses.ingress-1.tls.provided.key | string | `""` | The key must not have a passphrase |
+| ingresses.ingress-1.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: |
+| ingresses.ingress-1.tls.self.alternativeDnsNames | list | `[]` | alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom |
+| ingresses.ingress-1.tls.self.commonName | string | `"*.cluster.local"` | commonName of the certificate (mandatory) |
+| ingresses.ingress-1.tls.self.ipAddresses | list | `[]` | ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section |
+| ingresses.ingress-1.tls.self.validityDuration | int | `365` | validityDuration defines how long the certificate is valid (in days) |
+| ingresses.ingress-1.tls.type | string | `"none"` | define your type of tls certificate, it can be one of: none: tls will be disabled existing: use an existing secret already present in the namespace. Requires `secretName` to be specified in `.rules.host` provided: use an officially generated certificate/key k8s: use the default k8s-ingress tls. no further configuration needed self: generate a self signed certificate, which is stored as secret. Needs commonName and validityDuration at least |
 
 ## ServiceMonitor
 

charts/common/README.md.gotmpl

@@ -32,6 +32,8 @@ Major Changes to functions are documented with the version affected. **Before up
 |logPersistence removed|8.0.0|Removes logPersistence functionality as it can be achieved with volumeMounts & extraVolumeClaimTemplates and is buggy anyway.|https://github.com/bedag/helm-charts/pull/68|
 |networkpolicy template changes|9.0.0|add possibility to define more than one Port in networkpolicy|https://github.com/bedag/helm-charts/pull/70|
 |networkpolicy template changes|10.0.0|add possibility to create multiple networkpolicies|https://github.com/bedag/helm-charts/pull/77|
+|ingress template changes|11.0.0|add possibility to create multiple ingress objects|https://github.com/bedag/helm-charts/pull/134
+|ingress template changes|12.0.0|support defining multiple hosts and secrets for one ingress|https://github.com/bedag/helm-charts/pull/138
 {{/*
   Chart Values
 */}}
@@ -49,7 +51,7 @@ Major Changes to functions are documented with the version affected. **Before up
 
 {{ template "table.heading" . }}
 {{- range .Values }}
-  {{- if and (hasPrefix "ingress." .Key) }}
+  {{- if and (hasPrefix "ingresses.ingress-1" .Key) }}
 | {{ .Key }} | {{ .Type }} | {{ if .Default }}{{ .Default }}{{ else }}{{ .AutoDefault }}{{ end }} | {{ if .Description }}{{ .Description }}{{ else }}{{ .AutoDescription }}{{ end }} |
   {{- end }}
 {{- end }}

charts/common/ci/values.test.yaml

@@ -1,3 +1,19 @@
+# includes is used to include the desired template functions (see templates/includes.yaml)
+includes:
+  networkpolicy: true
+  deployment: true
+  statefulset: true
+  service: true
+  envSecret: true
+  envConfigMap: true
+  # files is needed for mounted volumes (secrets or configmaps)
+  files: true
+  configFiles: true
+  binaryFiles: true
+  pvcs: true
+  job: true
+  cronjob: true
+
 # start common.ingress
 ingress:
   deploy: true
@@ -64,6 +80,15 @@ components:
     controller:
       deploy: true
       type: "Deployment"
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "foo.local"
+        - "bar.local"
+      - ip: "10.1.2.3"
+        hostnames:
+        - "foo.remote"
+        - "bar.remote"
 
       containers:
         container-1:
@@ -139,6 +164,12 @@ components:
               mountPath: /opt/my-binary-license
               content: 'base64 encoded data'
           resources: {}
+      initContainers:
+        init-container-1:
+          image:
+            repository: db-init
+            tag: "latest"
+          resources: {}
   component-2:
     # start common.service
     services:
@@ -179,7 +210,22 @@ components:
         - name: emptydir-volume
           type: "emptyDir"
           sizeLimit: 100Mi
+        - name: secret-store
+          type: "csi"
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: "azure-kvname"
 
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "foo.local"
+        - "bar.local"
+      - ip: "10.1.2.3"
+        hostnames:
+        - "foo.remote"
+        - "bar.remote"
       containers:
         container-1:
           image:
@@ -257,6 +303,16 @@ components:
         runAsNonRoot: true
         runAsUser: 1001
 
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "foo.local"
+        - "bar.local"
+      - ip: "10.1.2.3"
+        hostnames:
+        - "foo.remote"
+        - "bar.remote"
+
       # start containers
       # dictionary of containers in a pod
       containers:
@@ -317,6 +373,16 @@ components:
         runAsNonRoot: true
         runAsUser: 1001
 
+      hostAliases:
+      - ip: "127.0.0.1"
+        hostnames:
+        - "foo.local"
+        - "bar.local"
+      - ip: "10.1.2.3"
+        hostnames:
+        - "foo.remote"
+        - "bar.remote"
+
       # start containers
       # dictionary of containers in a pod
       containers:

charts/common/templates/_binaryfiles.yaml

@@ -4,7 +4,7 @@
 {{- if $componentValues.controller }}
 {{- if $componentValues.controller.deploy }}
 {{- if or $componentValues.controller.containers $componentValues.controller.initContainers }}
-{{- $containers := merge ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
+{{- $containers := merge (dict) ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
 {{- range $containerName, $containerValues := $containers }}
 {{- $configBinarys := $containerValues.binaryFiles }}
 {{- if $configBinarys }}

charts/common/templates/_configfiles.yaml

@@ -30,7 +30,7 @@ Sensitive configs goes inside a Secret and non-sensitive configs are put in a Co
 {{- if $componentValues.controller }}
 {{- if $componentValues.controller.deploy }}
 {{- if or $componentValues.controller.containers $componentValues.controller.initContainers }}
-{{- $containers := merge ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
+{{- $containers := merge (dict) ($componentValues.controller.containers | default dict) ($componentValues.controller.initContainers | default dict) }}
 {{- range $containerName, $containerValues := $containers }}
 {{- $configFiles := $containerValues.configFiles }}
 {{- if $configFiles }}