-
Notifications
You must be signed in to change notification settings - Fork 61
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: use k8s init and setup jobs and remove cockroach chart dependen…
…cy (#48) * feat: use pre-update hook for setup * improve timeouts * remove init job * remove support for k8s v1.16 and v1.17 * enable extraContainers for setup job * make sa a hook * remove pre-upgrade from sa * remove helm dependency cockroach * describe upgrade path * describe crdb chart 8.1.8 * catch up with tests * add crdb repo to tests * omit cleanup on github * retry accessibility checks * enable custom job annotations * enable custom pod annotations for jobs * enable configuring job container lifecyles * remove job container lifecycle * Update README.md * Update README.md * describe uninstalling the chart * Update README.md * default to zitadel v2.15.0 * await eventual consistency
- Loading branch information
1 parent
8c3c89e
commit 28ba175
Showing
19 changed files
with
553 additions
and
97 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,16 +2,11 @@ apiVersion: v2 | |
| name: zitadel | ||
| description: A Helm chart for ZITADEL v2 | ||
| type: application | ||
| appVersion: "v2.13.1" | ||
| version: 3.5.0 | ||
| kubeVersion: '>= 1.16.15-0' | ||
| appVersion: "v2.15.0" | ||
| version: 4.0.0 | ||
| kubeVersion: ">= 1.18.20-0" | ||
| icon: https://zitadel.zitadel.cloud/ui/login/resources/themes/zitadel/logo-dark.svg | ||
| dependencies: | ||
| - name: cockroachdb | ||
| version: ~8.1.0 | ||
| repository: https://charts.cockroachdb.com/ | ||
| condition: cockroachdb.enabled | ||
| maintainers: | ||
| - name: zitadel | ||
| email: [email protected] | ||
| url: https://zitadel.com | ||
| - name: zitadel | ||
| email: [email protected] | ||
| url: https://zitadel.com | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,166 @@ | ||
| {{- if .Values.initJob.enabled }} | ||
| apiVersion: batch/v1 | ||
| kind: Job | ||
| metadata: | ||
| name: "{{ include "zitadel.fullname" . }}-init" | ||
| labels: | ||
| {{- include "zitadel.labels" . | nindent 4 }} | ||
| app.kubernetes.io/component: init | ||
| annotations: | ||
| helm.sh/hook: pre-install,pre-upgrade | ||
| helm.sh/hook-delete-policy: before-hook-creation | ||
| helm.sh/hook-weight: "1" | ||
| spec: | ||
| backoffLimit: 5 | ||
| activeDeadlineSeconds: {{ .Values.initJob.activeDeadlineSeconds }} | ||
| template: | ||
| metadata: | ||
| labels: | ||
| {{- include "zitadel.selectorLabels" . | nindent 8 }} | ||
| app.kubernetes.io/component: init | ||
| {{- with .Values.initJob.podAnnotations }} | ||
| annotations: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| spec: | ||
| {{- with .Values.imagePullSecrets }} | ||
| imagePullSecrets: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| serviceAccountName: {{ include "zitadel.serviceAccountName" . }} | ||
| securityContext: | ||
| {{- toYaml .Values.podSecurityContext | nindent 8 }} | ||
| enableServiceLinks: false | ||
| restartPolicy: OnFailure | ||
| containers: | ||
| - name: "{{ .Chart.Name }}-init" | ||
| securityContext: | ||
| {{- toYaml .Values.securityContext | nindent 14 }} | ||
| image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" | ||
| imagePullPolicy: {{ .Values.image.pullPolicy }} | ||
| args: | ||
| - init | ||
| - --config | ||
| - /config/zitadel-config-yaml | ||
| {{- if .Values.zitadel.secretConfig }} | ||
| - --config | ||
| - /.secrets/zitadel-secrets-yaml | ||
| {{- end }} | ||
| {{- if .Values.zitadel.configSecretName }} | ||
| - --config | ||
| - /.secrets/config-yaml | ||
| {{- end }} | ||
| env: | ||
| - name: POD_IP | ||
| valueFrom: | ||
| fieldRef: | ||
| apiVersion: v1 | ||
| fieldPath: status.podIP | ||
| {{- if (or .Values.zitadel.dbSslRootCrt .Values.zitadel.dbSslRootCrtSecret) }} | ||
| - name: ZITADEL_DATABASE_COCKROACH_USER_SSL_ROOTCERT | ||
| value: /.secrets/ca.crt | ||
| - name: ZITADEL_DATABASE_COCKROACH_ADMIN_SSL_ROOTCERT | ||
| value: /.secrets/ca.crt | ||
| {{- end}} | ||
| {{- if .Values.zitadel.dbSslClientCrtSecret }} | ||
| - name: ZITADEL_DATABASE_COCKROACH_ADMIN_SSL_CERT | ||
| value: /.secrets/tls.crt | ||
| - name: ZITADEL_DATABASE_COCKROACH_ADMIN_SSL_KEY | ||
| value: /.secrets/tls.key | ||
| {{- end}} | ||
| {{- with .Values.env }} | ||
| {{- toYaml . | nindent 12 }} | ||
| {{- end }} | ||
| volumeMounts: | ||
| - name: zitadel-config-yaml | ||
| mountPath: /config | ||
| - name: chowned-secrets | ||
| mountPath: /.secrets | ||
| resources: | ||
| {{- toYaml .Values.initJob.resources | nindent 14 }} | ||
| {{- if .Values.initJob.extraContainers }} | ||
| {{- toYaml .Values.initJob.extraContainers | nindent 8 }} | ||
| {{- end }} | ||
| initContainers: | ||
| - args: | ||
| - "{{ include "zitadel.joincpcommands" (dict "commands" (list | ||
| (include "zitadel.makecpcommand" (dict "value" .Values.zitadel.secretConfig "path" "/zitadel-secrets-yaml/*" )) | ||
| (include "zitadel.makecpcommand" (dict "value" (or .Values.zitadel.dbSslRootCrt .Values.zitadel.dbSslRootCrtSecret) "path" "/db-ssl-root-crt/*" )) | ||
| (include "zitadel.makecpcommand" (dict "value" .Values.zitadel.dbSslClientCrtSecret "path" "/db-ssl-client-crt/*" )) | ||
| (include "zitadel.makecpcommand" (dict "value" .Values.zitadel.configSecretName "path" "/zitadel-config-yaml/*" )) | ||
| )) }} chown -R 1000:1000 /chowned-secrets/* && chmod 400 /chowned-secrets/*" | ||
| command: | ||
| - sh | ||
| - -c | ||
| image: "{{ .Values.chownImage.repository }}:{{ .Values.chownImage.tag }}" | ||
| imagePullPolicy: {{ .Values.chownImage.pullPolicy }} | ||
| name: chown | ||
| volumeMounts: | ||
| - name: chowned-secrets | ||
| mountPath: /chowned-secrets | ||
| {{- if .Values.zitadel.secretConfig }} | ||
| - name: zitadel-secrets-yaml | ||
| mountPath: /zitadel-secrets-yaml | ||
| {{- end }} | ||
| {{- if .Values.zitadel.configSecretName }} | ||
| - name: zitadel-secret-config-yaml | ||
| mountPath: /zitadel-config-yaml | ||
| {{- end }} | ||
| {{- if (or .Values.zitadel.dbSslRootCrt .Values.zitadel.dbSslRootCrtSecret) }} | ||
| - name: db-ssl-root-crt | ||
| mountPath: /db-ssl-root-crt | ||
| {{- end }} | ||
| {{- if .Values.zitadel.dbSslClientCrtSecret }} | ||
| - name: db-ssl-client-crt | ||
| mountPath: /db-ssl-client-crt | ||
| {{- end }} | ||
| securityContext: | ||
| runAsNonRoot: false | ||
| runAsUser: 0 | ||
| volumes: | ||
| - name: zitadel-config-yaml | ||
| configMap: | ||
| name: zitadel-config-yaml | ||
| {{- if .Values.zitadel.secretConfig }} | ||
| - name: zitadel-secrets-yaml | ||
| secret: | ||
| secretName: zitadel-secrets-yaml | ||
| {{- end }} | ||
| {{- if .Values.zitadel.configSecretName }} | ||
| - name: zitadel-secret-config-yaml | ||
| secret: | ||
| secretName: {{ .Values.zitadel.configSecretName }} | ||
| {{- end }} | ||
| {{- if .Values.zitadel.dbSslRootCrt }} | ||
| - name: db-ssl-root-crt | ||
| secret: | ||
| secretName: db-ssl-root-crt | ||
| {{- end }} | ||
| {{- if .Values.zitadel.dbSslRootCrtSecret }} | ||
| - name: db-ssl-root-crt | ||
| secret: | ||
| secretName: {{ .Values.zitadel.dbSslRootCrtSecret }} | ||
| {{- end }} | ||
| {{- if .Values.zitadel.dbSslClientCrtSecret }} | ||
| - name: db-ssl-client-crt | ||
| secret: | ||
| secretName: {{ .Values.zitadel.dbSslClientCrtSecret }} | ||
| {{- end }} | ||
| {{- if (or (and .Values.zitadel.masterkey .Values.zitadel.masterkeySecretName) (and (not .Values.zitadel.masterkey) (not .Values.zitadel.masterkeySecretName)) ) }} | ||
| {{- fail "Eighter set .Values.zitadel.masterkey or .Values.zitadel.masterkeySecretName exclusively" }} | ||
| {{- end }} | ||
| - name: chowned-secrets | ||
| emptyDir: {} | ||
| {{- with .Values.nodeSelector }} | ||
| nodeSelector: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{- with .Values.affinity }} | ||
| affinity: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{- with .Values.tolerations }} | ||
| tolerations: | ||
| {{- toYaml . | nindent 8 }} | ||
| {{- end }} | ||
| {{ end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,12 @@ | ||
| {{- if (and .Values.cockroachdb.enabled .Values.cockroachdb.tls.enabled (not ((((.Values.zitadel.secretConfig).Database).cockroach).User).Password)) }} | ||
| {{- fail ".Values.zitadel.secretConfig.Database.cockroach.User.Password is mandatory for tls enabled cockroach" }} | ||
| {{- end }} | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| type: Opaque | ||
| metadata: | ||
| name: zitadel-secrets-yaml | ||
| annotations: | ||
| helm.sh/hook: pre-install,pre-upgrade | ||
| helm.sh/hook-delete-policy: before-hook-creation | ||
| helm.sh/hook-weight: "0" | ||
| stringData: | ||
| zitadel-secrets-yaml: |- | ||
| {{ .Values.zitadel.secretConfig | toYaml | nindent 4 }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.