Merge branch 'main' into organizations

uselagoon · Oct 16, 2023 · 49d9bf2 · 49d9bf2
2 parents 0534e9d + 2d0af7d
commit 49d9bf2
Show file tree

Hide file tree

Showing 16 changed files with 144 additions and 19 deletions.
diff --git a/.github/workflows/lint-test-matrix.yaml b/.github/workflows/lint-test-matrix.yaml
@@ -19,7 +19,7 @@ jobs:
         - v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: "0"
 

diff --git a/.github/workflows/lint-test.yaml b/.github/workflows/lint-test.yaml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Install Helm
       run: |
         cd /tmp
@@ -61,7 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: "0"
 
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: "0"
 

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: "0"
 

diff --git a/.github/workflows/test-suite.yaml b/.github/workflows/test-suite.yaml
@@ -40,7 +40,7 @@ jobs:
       continue-on-error: true
 
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         fetch-depth: "0"
 

diff --git a/Makefile b/Makefile
@@ -117,7 +117,7 @@ install-mariadb:
 		--wait \
 		--timeout $(TIMEOUT) \
 		$$($(KUBECTL) get ns mariadb > /dev/null 2>&1 && echo --set auth.rootPassword=$$($(KUBECTL) get secret --namespace mariadb mariadb -o json | $(JQ) -r '.data."mariadb-root-password" | @base64d')) \
-		--version=11.5.7 \
+		--version=12.2.9 \
 		mariadb \
 		bitnami/mariadb
 

diff --git a/charts/lagoon-build-deploy/Chart.yaml b/charts/lagoon-build-deploy/Chart.yaml
@@ -16,13 +16,13 @@ kubeVersion: ">= 1.21.0-0"
 
 type: application
 
-version: 0.24.0
+version: 0.25.2
 
-appVersion: v0.14.0
+appVersion: v0.15.2
 
 annotations:
   artifacthub.io/changes: |
     - kind: changed
-      description: update remote-controller appVersion to v0.14.0
+      description: update remote-controller appVersion to v0.15.2
     - kind: changed
-      description: updated lagoontask crd, will require crds to be re-applied
+      description: added flag support for enabling k8up v2 support
diff --git a/charts/lagoon-build-deploy/templates/deployment.yaml b/charts/lagoon-build-deploy/templates/deployment.yaml
@@ -119,6 +119,9 @@ spec:
         {{- with .Values.lagoonFeatureFlagBackupWeeklyRandom }}
         - "--lagoon-feature-flag-backup-weekly-random={{ . }}"
         {{- end }}
+        {{- with .Values.lagoonFeatureFlagSupportK8upV2 }}
+        - "--lagoon-feature-flag-support-k8upv2={{ . }}"
+        {{- end }}
         {{- with .Values.lagoonBackupDefaultSchedule }}
         - "--backup-default-schedule={{ . }}"
         {{- end }}

diff --git a/charts/lagoon-build-deploy/values.yaml b/charts/lagoon-build-deploy/values.yaml
@@ -48,6 +48,7 @@ namespacePrefix: ""
 # lagoonFeatureFlagDefaultInsights: disabled
 # lagoonFeatureFlagForceRWX2RWO: disabled
 # lagoonFeatureFlagDefaultRWX2RWO: disabled
+# lagoonFeatureFlagSupportK8upV2: false
 
 # It is also possible to define feature flags using `extraEnvs` by defining them like so
 # this method is useful for enabling features on the fly, ones that might not have built in support

diff --git a/charts/lagoon-remote/Chart.lock b/charts/lagoon-remote/Chart.lock
@@ -1,7 +1,7 @@
 dependencies:
 - name: lagoon-build-deploy
   repository: https://uselagoon.github.io/lagoon-charts/
-  version: 0.24.0
+  version: 0.25.2
 - name: dioscuri
   repository: https://amazeeio.github.io/charts/
   version: 0.4.1
@@ -11,5 +11,5 @@ dependencies:
 - name: nats
   repository: https://nats-io.github.io/k8s/helm/charts/
   version: 0.19.17
-digest: sha256:5bf74bd117c2e5ae31d4084a588c52dd9408bbcc54cd0c86abf763d35f583412
-generated: "2023-07-28T09:49:56.393491706+08:00"
+digest: sha256:8ca3385f69f64eed0be9276ea4fb5b59e13e0caac5777e50bfae80fd6fd29cb0
+generated: "2023-10-06T10:49:35.479733592+11:00"
diff --git a/charts/lagoon-remote/Chart.yaml b/charts/lagoon-remote/Chart.yaml
@@ -19,11 +19,11 @@ type: application
 # This is the chart version. This version number should be incremented each
 # time you make changes to the chart and its templates, including the app
 # version.
-version: 0.81.0
+version: 0.83.2
 
 dependencies:
 - name: lagoon-build-deploy
-  version: ~0.24.0
+  version: ~0.25.0
   repository: https://uselagoon.github.io/lagoon-charts/
   condition: lagoon-build-deploy.enabled
 - name: dioscuri
@@ -45,6 +45,4 @@ dependencies:
 annotations:
   artifacthub.io/changes: |
     - kind: changed
-      description: update lagoon-ssh-portal to v0.30.1
-    - kind: changed
-      description: update NATS chart dependency to v0.19.17
+      description: update lagoon-build-deploy to v0.25.2
diff --git a/charts/lagoon-remote/templates/_helpers.tpl b/charts/lagoon-remote/templates/_helpers.tpl
@@ -155,6 +155,43 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 
 
 
+{{/*
+Create the name of the service account to use for sshCore.
+*/}}
+{{- define "lagoon-remote.sshCore.serviceAccountName" -}}
+{{- default (include "lagoon-remote.sshCore.fullname" .) .Values.sshCore.serviceAccount.name }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name for sshCore.
+*/}}
+{{- define "lagoon-remote.sshCore.fullname" -}}
+{{- include "lagoon-remote.fullname" . }}-ssh-core
+{{- end }}
+
+{{/*
+Common labels sshCore.
+*/}}
+{{- define "lagoon-remote.sshCore.labels" -}}
+helm.sh/chart: {{ include "lagoon-remote.chart" . }}
+{{ include "lagoon-remote.sshCore.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels sshCore.
+*/}}
+{{- define "lagoon-remote.sshCore.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "lagoon-remote.name" . }}
+app.kubernetes.io/component: {{ include "lagoon-remote.sshCore.fullname" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+
+
 {{/*
 Create the name of the service account to use for sshPortal.
 */}}

diff --git a/charts/lagoon-remote/templates/ssh-core.clusterrole.yaml b/charts/lagoon-remote/templates/ssh-core.clusterrole.yaml
@@ -0,0 +1,36 @@
+{{- if .Values.sshCore.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "lagoon-remote.sshCore.fullname" . }}
+  labels:
+    {{- include "lagoon-remote.sshCore.labels" . | nindent 4 }}
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments/scale
+  verbs:
+  - get
+  - update
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+- apiGroups:
+  - ""
+  resources:
+  - pods/exec
+  verbs:
+  - create
+{{- end }}
diff --git a/charts/lagoon-remote/templates/ssh-core.clusterrolebinding.yaml b/charts/lagoon-remote/templates/ssh-core.clusterrolebinding.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.sshCore.enabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "lagoon-remote.sshCore.fullname" . }}
+  labels:
+    {{- include "lagoon-remote.sshCore.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "lagoon-remote.sshCore.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace | quote }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "lagoon-remote.sshCore.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
diff --git a/charts/lagoon-remote/templates/ssh-core.secret.yaml b/charts/lagoon-remote/templates/ssh-core.secret.yaml
@@ -0,0 +1,11 @@
+{{- if .Values.sshCore.enabled -}}
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: {{ include "lagoon-remote.sshCore.serviceAccountName" . }}-token
+  labels:
+    {{- include "lagoon-remote.sshCore.labels" . | nindent 4 }}
+  annotations:
+    kubernetes.io/service-account.name: {{ include "lagoon-remote.sshCore.serviceAccountName" . }}
+{{- end }}
diff --git a/charts/lagoon-remote/templates/ssh-core.serviceaccount.yaml b/charts/lagoon-remote/templates/ssh-core.serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.sshCore.enabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "lagoon-remote.sshCore.serviceAccountName" . }}
+  labels:
+    {{- include "lagoon-remote.sshCore.labels" . | nindent 4 }}
+  {{- with .Values.sshCore.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/lagoon-remote/values.yaml b/charts/lagoon-remote/values.yaml
@@ -113,6 +113,17 @@ kubernetesBuildDeploy:
     # If not set, a name is generated using the fullname template.
     name:
 
+# sshCore creates a restricted, non-expiring ServiceAccount token for use by
+# lagoon-core.
+sshCore:
+  enabled: false
+  serviceAccount:
+    annotations: {}
+    # The name of the service account to use.
+    # If not set, a name is generated using the fullname
+    # template
+    name: ""
+
 # sshPortal is an optional service providing low-latency SSH connectivity to
 # Lagoon environments.
 sshPortal: