Skip to content

Commit fabbea9

Browse files
cognifloydcognifloyd
authored
Merge branch 'master' into feature/pull-policy
2 parents 8014b31 + b278850 commit fabbea9

File tree

8 files changed

+275
-27
lines changed

8 files changed

+275
-27
lines changed

‎CHANGELOG.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
# Changelog
22

3-
## In Development
3+
## Development
4+
* Fix syntax with ensure-packs-volumes-are-writable job (#403) (by @skiedude)
5+
* Add securityContext support to custom st2packs images, extra_hooks jobs; Also fallback to st2actionrunner securityContext for misc init container jobs and pods. (#410) (by @cognifloyd)
6+
* Stop generating the DataStore Secret (#385) and checksum labels (#391) when existing secret provided or disabled (by @bmarick)
7+
* Stop generating the checksum labels for Auth Secret (#392) when existing secret provided or disabled (by @bmarick)
8+
9+
## v1.0.0
410
* Bump to latest CircleCI orb versions (kubernetes@1.3.1 and helm@3.0.0 by @ZoeLeah)
511
* Remove unsupported k8s Versions (1.24.x and 1.25.x by @ZoeLeah)
612
* Update and add new K8s versions (1.28.3, 1.27.7 and 1.26.10 by @ZoeLeah)

‎Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
# StackStorm version which refers to Docker images tag
33
appVersion: "3.8"
44
name: stackstorm-ha
5-
version: 0.110.0
5+
version: 1.0.0
66
description: StackStorm K8s Helm Chart, optimized for running StackStorm in HA environment.
77
home: https://stackstorm.com/
88
icon: https://landscape.cncf.io/logos/stack-storm.svg

‎README.md

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -241,7 +241,7 @@ NOTE: With care, `st2packs` images can be used with `volumes`. Just make sure to
241241
If a pack is installed via an `st2packs` image and then it gets updated with `st2 pack install`, a subsequent `helm upgrade` will revert back to the version in the `st2packs` image.
242242

243243
#### Configure the storage volumes
244-
Enable the `st2.packs.voluems` section of Helm values and add volume definitions for both `packs` and `virtualenvs`.
244+
Enable the `st2.packs.volumes` section of Helm values and add volume definitions for both `packs` and `virtualenvs`.
245245
Each of the volume definitions should be customized for your cluster and storage solution.
246246

247247
For example, to use persistentVolumeClaims:
@@ -369,3 +369,11 @@ This approach allows not only extending sub-chart with custom objects and templa
369369
but also adds flexibility to include many sub-chart dependencies and pin versions as well as include all the sub-chart values in one single place.
370370
This approach is infra-as-code friendly and more reproducible. See official Helm documentation about
371371
[Subcharts](https://helm.sh/docs/chart_template_guide/#subcharts-and-global-values) and [Dependencies](https://helm.sh/docs/developing_charts/#managing-dependencies-manually-via-the-charts-directory).
372+
373+
## Releasing information
374+
In order to create a release, the steps are as follows:
375+
1. Create a pull request by updating [CHANGELOG.md](./CHANGELOG.md) by replacing the "In Development" heading with the new version, and [Chart.yaml](./Chart.yaml) by replacing the `version` value.
376+
2. Once the pull request is merged, create and push the matching tag (for example, if you are creating release `v1.0.0`, then the tag should also be `v1.0.0`).
377+
3. After the tag is pushed, create the corresponding [release](https://github.com/StackStorm/stackstorm-k8s/releases).
378+
4. After the release is created, switch to the `gh-pages` branch, and generate the updated [Helm index](https://helm.sh/docs/helm/helm_repo_index/), [package](https://helm.sh/docs/helm/helm_package/) and [provenance](https://helm.sh/docs/topics/provenance/).
379+
5. After committing and pushing the changes in the previous step, verify that the new release is present on [ArtifactHub](https://artifacthub.io/packages/helm/stackstorm/stackstorm-ha).

‎templates/_helpers.tpl

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -346,7 +346,8 @@ Merge packs and virtualenvs from st2 with those from st2packs images
346346
- |
347347
/bin/cp -aR /opt/stackstorm/packs/. /opt/stackstorm/packs-shared &&
348348
/bin/cp -aR /opt/stackstorm/virtualenvs/. /opt/stackstorm/virtualenvs-shared
349-
{{- with $.Values.securityContext }}
349+
{{- with .securityContext | default $.Values.st2actionrunner.securityContext | default $.Values.securityContext }}
350+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
350351
securityContext: {{- toYaml . | nindent 8 }}
351352
{{- end }}
352353
{{- end }}
@@ -367,7 +368,8 @@ Merge packs and virtualenvs from st2 with those from st2packs images
367368
- |
368369
/bin/cp -aR /opt/stackstorm/packs/. /opt/stackstorm/packs-shared &&
369370
/bin/cp -aR /opt/stackstorm/virtualenvs/. /opt/stackstorm/virtualenvs-shared
370-
{{- with .Values.securityContext }}
371+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
372+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
371373
securityContext: {{- toYaml . | nindent 8 }}
372374
{{- end }}
373375
{{- end }}
@@ -386,7 +388,8 @@ Merge packs and virtualenvs from st2 with those from st2packs images
386388
- '-ec'
387389
- |
388390
/bin/cp -aR /opt/stackstorm/configs/. /opt/stackstorm/configs-shared
389-
{{- with .Values.securityContext }}
391+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
392+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
390393
securityContext: {{- toYaml . | nindent 8 }}
391394
{{- end }}
392395
{{- end }}

‎templates/deployments.yaml

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,9 @@ spec:
2828
labels: {{- include "stackstorm-ha.labels" (list $ "st2auth") | nindent 8 }}
2929
annotations:
3030
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
31+
{{- if not .Values.st2.existingAuthSecret }}
3132
checksum/auth: {{ include (print $.Template.BasePath "/secrets_st2auth.yaml") . | sha256sum }}
33+
{{- end }}
3234
{{- if .Values.st2auth.postStartScript }}
3335
checksum/post-start-script: {{ .Values.st2auth.postStartScript | sha256sum }}
3436
{{- end }}
@@ -164,7 +166,9 @@ spec:
164166
labels: {{- include "stackstorm-ha.labels" (list $ "st2api") | nindent 8 }}
165167
annotations:
166168
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
169+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
167170
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
171+
{{- end }}
168172
{{- if .Values.st2api.postStartScript }}
169173
checksum/post-start-script: {{ .Values.st2api.postStartScript | sha256sum }}
170174
{{- end }}
@@ -428,7 +432,7 @@ spec:
428432
- name: st2web
429433
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2web:{{ tpl (.Values.st2web.image.tag | default .Values.image.tag) . }}'
430434
imagePullPolicy: {{ .Values.image.pullPolicy }}
431-
{{- with default .Values.securityContext .Values.st2web.securityContext }}
435+
{{- with .Values.st2web.securityContext | default .Values.securityContext }}
432436
securityContext: {{- toYaml . | nindent 10 }}
433437
{{- end }}
434438
ports:
@@ -515,7 +519,7 @@ spec:
515519
{{- with .Values.dnsConfig }}
516520
dnsConfig: {{- toYaml . | nindent 8 }}
517521
{{- end }}
518-
{{- with default .Values.podSecurityContext .Values.st2client.podSecurityContext }}
522+
{{- with .Values.st2web.podSecurityContext | default .Values.podSecurityContext }}
519523
securityContext: {{- toYaml . | nindent 8 }}
520524
{{- end }}
521525
{{- with .Values.st2web.nodeSelector }}
@@ -548,7 +552,9 @@ spec:
548552
labels: {{- include "stackstorm-ha.labels" (list $ "st2rulesengine") | nindent 8 }}
549553
annotations:
550554
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
555+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
551556
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
557+
{{- end }}
552558
{{- if .Values.st2rulesengine.postStartScript }}
553559
checksum/post-start-script: {{ .Values.st2rulesengine.postStartScript | sha256sum }}
554560
{{- end }}
@@ -769,7 +775,9 @@ spec:
769775
labels: {{- include "stackstorm-ha.labels" (list $ "st2workflowengine") | nindent 8 }}
770776
annotations:
771777
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
778+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
772779
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
780+
{{- end }}
773781
{{- if .Values.st2workflowengine.postStartScript }}
774782
checksum/post-start-script: {{ .Values.st2workflowengine.postStartScript | sha256sum }}
775783
{{- end }}
@@ -886,7 +894,9 @@ spec:
886894
labels: {{- include "stackstorm-ha.labels" (list $ "st2scheduler") | nindent 8 }}
887895
annotations:
888896
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
897+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
889898
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
899+
{{- end }}
890900
{{- if .Values.st2scheduler.postStartScript }}
891901
checksum/post-start-script: {{ .Values.st2scheduler.postStartScript | sha256sum }}
892902
{{- end }}
@@ -1137,7 +1147,9 @@ spec:
11371147
annotations:
11381148
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") $ | sha256sum }}
11391149
checksum/packs: {{ include (print $.Template.BasePath "/configmaps_packs.yaml") $ | sha256sum }}
1150+
{{- if and (ne "disable" (default "" $.Values.st2.datastore_crypto_key)) (not $.Values.st2.existingDatastoreSecret) }}
11401151
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") $ | sha256sum }}
1152+
{{- end }}
11411153
{{- if $.Values.st2sensorcontainer.postStartScript }}
11421154
checksum/post-start-script: {{ $.Values.st2sensorcontainer.postStartScript | sha256sum }}
11431155
{{- end }}
@@ -1188,7 +1200,7 @@ spec:
11881200
- name: {{ $name }}
11891201
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2sensorcontainer:{{ tpl ($sensor.image.tag | default $.Values.image.tag) $ }}'
11901202
imagePullPolicy: {{ $.Values.image.pullPolicy }}
1191-
{{- with default $.Values.securityContext $sensor.securityContext }}
1203+
{{- with $sensor.securityContext | default $.Values.securityContext }}
11921204
securityContext: {{- toYaml . | nindent 10 }}
11931205
{{- end }}
11941206
{{- with $sensor.readinessProbe }}
@@ -1283,7 +1295,7 @@ spec:
12831295
{{- with $.Values.dnsConfig }}
12841296
dnsConfig: {{- toYaml . | nindent 8 }}
12851297
{{- end }}
1286-
{{- with default $.Values.podSecurityContext $sensor.podSecurityContext }}
1298+
{{- with $sensor.podSecurityContext | default $.Values.podSecurityContext }}
12871299
securityContext: {{- toYaml . | nindent 8 }}
12881300
{{- end }}
12891301
{{- with $sensor.nodeSelector }}
@@ -1319,7 +1331,9 @@ spec:
13191331
annotations:
13201332
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
13211333
checksum/ssh: {{ include (print $.Template.BasePath "/secrets_ssh.yaml") . | sha256sum }}
1334+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
13221335
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
1336+
{{- end }}
13231337
{{- if .Values.st2actionrunner.postStartScript }}
13241338
checksum/post-start-script: {{ .Values.st2actionrunner.postStartScript | sha256sum }}
13251339
{{- end }}
@@ -1354,7 +1368,7 @@ spec:
13541368
image: '{{ .image.repository | default (include "stackstorm-ha.imageRepository" $) }}/{{ .image.name | default "st2actionrunner" }}:{{ tpl (.image.tag | default $.Values.image.tag) $ }}'
13551369
{{- end }}
13561370
imagePullPolicy: {{ .Values.st2actionrunner.image.pullPolicy | default .Values.image.pullPolicy }}
1357-
{{- with default .Values.securityContext .Values.st2actionrunner.securityContext }}
1371+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
13581372
securityContext: {{- toYaml . | nindent 10 }}
13591373
{{- end }}
13601374
# TODO: Add liveness/readiness probes (#3)
@@ -1437,7 +1451,7 @@ spec:
14371451
{{- with .Values.dnsConfig }}
14381452
dnsConfig: {{- toYaml . | nindent 8 }}
14391453
{{- end }}
1440-
{{- with default .Values.podSecurityContext .Values.st2actionrunner.podSecurityContext }}
1454+
{{- with .Values.st2actionrunner.podSecurityContext | default .Values.podSecurityContext }}
14411455
securityContext: {{- toYaml . | nindent 8 }}
14421456
{{- end }}
14431457
{{- with .Values.st2actionrunner.nodeSelector }}
@@ -1573,9 +1587,13 @@ spec:
15731587
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
15741588
checksum/rbac: {{ include (print $.Template.BasePath "/configmaps_rbac.yaml") . | sha256sum }}
15751589
checksum/packs: {{ include (print $.Template.BasePath "/configmaps_packs.yaml") . | sha256sum }}
1590+
{{- if not .Values.st2.existingAuthSecret }}
15761591
checksum/auth: {{ include (print $.Template.BasePath "/secrets_st2auth.yaml") . | sha256sum }}
1592+
{{- end }}
15771593
checksum/ssh: {{ include (print $.Template.BasePath "/secrets_ssh.yaml") . | sha256sum }}
1594+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
15781595
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
1596+
{{- end }}
15791597
{{- if .Values.st2.overrides }}
15801598
checksum/overrides: {{ include (print $.Template.BasePath "/configmaps_overrides.yaml") . | sha256sum }}
15811599
{{- end }}
@@ -1601,7 +1619,7 @@ spec:
16011619
- name: generate-st2client-config
16021620
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.st2client.image.tag | default (.Values.st2actionrunner.image.tag | default .Values.image.tag)) . }}'
16031621
imagePullPolicy: {{ .Values.image.pullPolicy }}
1604-
{{- with .Values.securityContext }}
1622+
{{- with .Values.st2client.securityContext | default .Values.st2actionrunner.securityContext | default .Values.securityContext }}
16051623
securityContext: {{- toYaml . | nindent 10 }}
16061624
{{- end }}
16071625
envFrom:
@@ -1628,7 +1646,7 @@ spec:
16281646
- name: st2client
16291647
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.st2client.image.tag | default .Values.image.tag) . }}'
16301648
imagePullPolicy: {{ .Values.image.pullPolicy }}
1631-
{{- with default .Values.securityContext .Values.st2actionrunner.securityContext }}
1649+
{{- with .Values.st2client.securityContext | default .Values.st2actionrunner.securityContext | default .Values.securityContext }}
16321650
securityContext: {{- toYaml . | nindent 10 }}
16331651
{{- end }}
16341652
env:
@@ -1729,7 +1747,7 @@ spec:
17291747
{{- with .Values.dnsConfig }}
17301748
dnsConfig: {{- toYaml . | nindent 8 }}
17311749
{{- end }}
1732-
{{- with default .Values.podSecurityContext .Values.st2client.podSecurityContext }}
1750+
{{- with .Values.st2client.podSecurityContext | default .Values.st2actionrunner.podSecurityContext | default .Values.podSecurityContext }}
17331751
securityContext: {{- toYaml . | nindent 8 }}
17341752
{{- end }}
17351753
{{- with .Values.st2client.nodeSelector }}

‎templates/jobs.yaml

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -412,7 +412,8 @@ spec:
412412
- name: st2-register-content-custom-init
413413
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.jobs.image.tag | default (.Values.st2actionrunner.image.tag | default .Values.image.tag)) . }}'
414414
imagePullPolicy: {{ .Values.image.pullPolicy }}
415-
{{- with .Values.securityContext }}
415+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
416+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
416417
securityContext: {{- toYaml . | nindent 10 }}
417418
{{- end }}
418419
command: {{- toYaml $.Values.jobs.preRegisterContentCommand | nindent 8 }}
@@ -426,7 +427,8 @@ spec:
426427
- name: st2-register-content
427428
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.jobs.image.tag | default (.Values.st2actionrunner.image.tag | default .Values.image.tag)) . }}'
428429
imagePullPolicy: {{ .Values.image.pullPolicy }}
429-
{{- with .Values.securityContext }}
430+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
431+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
430432
securityContext: {{- toYaml . | nindent 10 }}
431433
{{- end }}
432434
command:
@@ -471,7 +473,8 @@ spec:
471473
{{- with .Values.dnsConfig }}
472474
dnsConfig: {{- toYaml . | nindent 8 }}
473475
{{- end }}
474-
{{- with .Values.podSecurityContext }}
476+
{{- with .Values.st2actionrunner.podSecurityContext | default .Values.podSecurityContext }}
477+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
475478
securityContext: {{- toYaml . | nindent 8 }}
476479
{{- end }}
477480
{{- with .Values.jobs.nodeSelector }}
@@ -541,7 +544,7 @@ spec:
541544
and then delete this st2canary pod manually.
542545
INTRO
543546
544-
function __handle_error__(){
547+
function __handle_error__ {
545548
cat <<- 'FAIL'
546549
ERROR: One or more volumes in st2.packs.volumes (from helm values) does not meet
547550
StackStorm's shared volumes requirements!
@@ -578,6 +581,7 @@ spec:
578581
{{- toYaml $.Values.st2.packs.volumes.configs | nindent 10 }}
579582
{{- end }}
580583
# st2canary job does not support extra_volumes. Let us know if you need this.
584+
restartPolicy: Never
581585
{{- if $.Values.dnsPolicy }}
582586
dnsPolicy: {{ $.Values.dnsPolicy }}
583587
{{- end }}
@@ -641,7 +645,7 @@ spec:
641645
- name: generate-st2client-config
642646
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2actionrunner:{{ tpl ($.Values.jobs.image.tag | default ($.Values.st2actionrunner.image.tag | default $.Values.image.tag)) $ }}'
643647
imagePullPolicy: {{ $.Values.image.pullPolicy }}
644-
{{- with $.Values.securityContext }}
648+
{{- with $.Values.st2actionrunner.securityContext | default $.Values.securityContext }}
645649
securityContext: {{- toYaml . | nindent 10 }}
646650
{{- end }}
647651
envFrom:
@@ -668,7 +672,7 @@ spec:
668672
- name: {{ $name }}
669673
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2actionrunner:{{ tpl ($.Values.jobs.image.tag | default ($.Values.st2actionrunner.image.tag | default $.Values.image.tag)) $ }}'
670674
imagePullPolicy: {{ $.Values.image.pullPolicy }}
671-
{{- with $.Values.securityContext }}
675+
{{- with .securityContext | default $.Values.st2actionrunner.securityContext | default $.Values.securityContext }}
672676
securityContext: {{- toYaml . | nindent 10 }}
673677
{{- end }}
674678
{{- if $.Values.jobs.env }}
@@ -718,7 +722,7 @@ spec:
718722
{{- with $.Values.dnsConfig }}
719723
dnsConfig: {{- toYaml . | nindent 8 }}
720724
{{- end }}
721-
{{- with $.Values.podSecurityContext }}
725+
{{- with .podSecurityContext | default $.Values.st2actionrunner.podSecurityContext | default $.Values.podSecurityContext }}
722726
securityContext: {{- toYaml . | nindent 8 }}
723727
{{- end }}
724728
{{- with $.Values.jobs.nodeSelector }}

0 commit comments

Comments
 (0)