Merge branch 'main' into feat/jobs-migrate-analytics

charts/flagsmith/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: flagsmith
 description: Flagsmith
 type: application
-version: 0.43.0
-appVersion: 2.118.1
+version: 0.49.0
+appVersion: 2.120.0
 dependencies:
   - name: postgresql
     repository: https://charts.bitnami.com/bitnami

charts/flagsmith/templates/NOTES.txt

@@ -9,6 +9,12 @@ kubectl -n {{ .Release.Namespace }} port-forward svc/{{ include "flagsmith.fulln
 
 Then access http://localhost:8080 in a browser.
 
+{{- if .Values.api.bootstrap.enabled }}
+To see the password reset link for pre-created admin user, run:
+
+kubectl -n {{ .Release.Namespace }} logs pods/{{ include "flagsmith.fullname" . }}-api -c bootstrap
+{{- end }}
+
 {{ if not (and .Values.ingress.frontend.enabled .Values.ingress.api.enabled) }}
 
 {{- $noIngressFor := (list) -}}
@@ -24,16 +30,19 @@ for information about how to gain web access to the application.
 
 {{- end }}
 
-{{- if not .Values.api.secretKey }}
+{{- if or (not .Values.api.secretKeyFromExistingSecret.enabled) (not .Values.api.secretKey) }}
 
 ######################################
 ##### Warning: no secret key set #####
 ######################################
 
 No secret key is set, a new one will be randomly generated at each
 deployment. For production systems, it is strongly recommended to
-generate a large random value and set it at `api.secretKey`. It must
-be kept secret.
+generate a large random value, store it in a secret, and set the following values:
+
+`api.secretKeyFromExistingSecret.enabled` to `true`
+`api.secretKeyFromExistingSecret.name` to secret name
+`api.secretKeyFromExistingSecret.key` to secret key
 
 See https://docs.flagsmith.com/deployment/locally-api#creating-a-secret-key
 {{- end }}

charts/flagsmith/templates/deployment-api.yaml

@@ -70,6 +70,9 @@ spec:
         {{- $securityContext = $securityContext | merge (omit .Values.api.defaultPodSecurityContext "enabled") }}
         {{- end }}
         {{- toYaml $securityContext | nindent 8 }}
+      {{- if .Values.api.serviceAccountName }}
+      serviceAccountName: {{ .Values.api.serviceAccountName }}
+      {{- end }}
       initContainers:
 {{- if .Values.api.enableMigrateDbInitContainer }}
       - name: migrate-db
@@ -78,6 +81,26 @@ spec:
         args: ["migrate"]
         env: {{ include (print $.Template.BasePath "/_api_environment.yaml") . | nindent 8 }}
 {{- end }}
+{{- if .Values.api.bootstrap.enabled }}
+      - name: bootstrap
+        image: {{ .Values.api.image.repository }}:{{ .Values.api.image.tag | default (printf "%s" .Chart.AppVersion) }}
+        imagePullPolicy: {{ .Values.api.image.imagePullPolicy }}
+        command: ["/bin/sh", "-c"]
+        args: ["python manage.py waitfordb && python manage.py bootstrap"]
+        env: {{ include (print $.Template.BasePath "/_api_environment.yaml") . | nindent 8 }}
+          {{- if .Values.api.bootstrap.adminEmail }}
+          - name: ADMIN_EMAIL
+            value: {{ .Values.api.bootstrap.adminEmail }}
+          {{- end }}
+          {{- if .Values.api.bootstrap.organisationName }}
+          - name: ORGANISATION_NAME
+            value: {{ .Values.api.bootstrap.organisationName }}
+          {{- end }}
+          {{- if .Values.api.bootstrap.projectName }}
+          - name: PROJECT_NAME
+            value: {{ .Values.api.bootstrap.projectName }}
+          {{- end }}
+{{- end }}
 {{- if .Values.api.influxdbSetup.enabled }}
       - name: influxdb-setup
         image: {{ .Values.api.image.repository }}:{{ .Values.api.image.tag | default (printf "%s" .Chart.AppVersion) }}
@@ -97,8 +120,11 @@ spec:
       - name: {{ .Chart.Name }}-api
         image: {{ .Values.api.image.repository }}:{{ .Values.api.image.tag | default (printf "%s" .Chart.AppVersion) }}
         imagePullPolicy: {{ .Values.api.image.imagePullPolicy }}
-        # command: ["sleep", "3600"]
+        {{- if .Values.api.enableMigrateAndServe }}
+        args: ["migrate-and-serve"]
+        {{- else }}
         args: ["serve"]
+        {{- end }}
         ports:
         - containerPort: {{ .Values.service.api.port }}
         env: {{ include (print $.Template.BasePath "/_api_environment.yaml") . | nindent 8 }}

charts/flagsmith/templates/deployment-frontend.yaml

@@ -64,6 +64,9 @@ spec:
         {{- $securityContext = $securityContext | merge (omit .Values.frontend.defaultPodSecurityContext "enabled") }}
         {{- end }}
         {{- toYaml $securityContext | nindent 8 }}
+      {{- if .Values.frontend.serviceAccountName }}
+      serviceAccountName: {{ .Values.frontend.serviceAccountName }}
+      {{- end }}
 {{- with .Values.frontend.extraInitContainers }}
       initContainers:
 {{- toYaml . | nindent 6 }}

charts/flagsmith/templates/deployment-pgbouncer.yaml

@@ -65,6 +65,9 @@ spec:
         {{- $securityContext = $securityContext | merge (omit .Values.pgbouncer.defaultPodSecurityContext "enabled") }}
         {{- end }}
         {{- toYaml $securityContext | nindent 8 }}
+      {{- if .Values.pgbouncer.serviceAccountName }}
+      serviceAccountName: {{ .Values.pgbouncer.serviceAccountName }}
+      {{- end }}
 {{- with .Values.pgbouncer.extraInitContainers }}
       initContainers:
 {{- toYaml . | nindent 6 }}

charts/flagsmith/templates/deployment-task-processor.yaml

@@ -68,6 +68,9 @@ spec:
         {{- $securityContext = $securityContext | merge (omit .Values.taskProcessor.defaultPodSecurityContext "enabled") }}
         {{- end }}
         {{- toYaml $securityContext | nindent 8 }}
+      {{- if .Values.taskProcessor.serviceAccountName }}
+      serviceAccountName: {{ .Values.taskProcessor.serviceAccountName }}
+      {{- end }}
 {{- with .Values.taskProcessor.extraInitContainers }}
       initContainers:
 {{- toYaml . | nindent 6 }}

charts/flagsmith/templates/jobs-migrate-db.yaml

@@ -52,6 +52,9 @@ spec:
         {{- $securityContext = $securityContext | merge (omit .Values.jobs.migrateDb.defaultPodSecurityContext "enabled") }}
         {{- end }}
         {{- toYaml $securityContext | nindent 8 }}
+      {{- if .Values.jobs.migrateDb.serviceAccountName }}
+      serviceAccountName: {{ .Values.jobs.migrateDb.serviceAccountName }}
+      {{- end }}
       {{- if .Values.jobs.migrateDb.shareProcessNamespace }}
       shareProcessNamespace: true
       {{- end }}

charts/flagsmith/values.yaml

@@ -79,6 +79,14 @@ api:
   logging:
     format: generic # options are generic or json.
   enableMigrateDbInitContainer: true
+  bootstrap:
+    # Set to `true` to create initial superuser, organisation, and project.
+    # If `adminEmail`, `organisationName` or `projectName` not set, defaults are used.
+    # Bootstrapping does nothing if app database is not empty.
+    enabled: false
+    adminEmail: null
+    organisationName: null
+    projectName: null
 
 frontend:
   # Set this to `false` to switch off the frontend (deployment,