Skip to content

Commit 9f4b1bc

Browse files
cognifloydcognifloyd
authored
Merge branch 'master' into feature/pack-config-templating
2 parents 4a95c49 + b278850 commit 9f4b1bc

8 files changed

+275
-27
lines changed

‎CHANGELOG.md

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
# Changelog
22

3-
## In Development
3+
## Development
4+
* Fix syntax with ensure-packs-volumes-are-writable job (#403) (by @skiedude)
5+
* Add securityContext support to custom st2packs images, extra_hooks jobs; Also fallback to st2actionrunner securityContext for misc init container jobs and pods. (#410) (by @cognifloyd)
6+
* Stop generating the DataStore Secret (#385) and checksum labels (#391) when existing secret provided or disabled (by @bmarick)
7+
* Stop generating the checksum labels for Auth Secret (#392) when existing secret provided or disabled (by @bmarick)
8+
9+
## v1.0.0
410
* Bump to latest CircleCI orb versions ([email protected] and [email protected] by @ZoeLeah)
511
* Remove unsupported k8s Versions (1.24.x and 1.25.x by @ZoeLeah)
612
* Update and add new K8s versions (1.28.3, 1.27.7 and 1.26.10 by @ZoeLeah)

‎Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
# StackStorm version which refers to Docker images tag
33
appVersion: "3.8"
44
name: stackstorm-ha
5-
version: 0.110.0
5+
version: 1.0.0
66
description: StackStorm K8s Helm Chart, optimized for running StackStorm in HA environment.
77
home: https://stackstorm.com/
88
icon: https://landscape.cncf.io/logos/stack-storm.svg

‎README.md

+9-1
Original file line numberDiff line numberDiff line change
@@ -241,7 +241,7 @@ NOTE: With care, `st2packs` images can be used with `volumes`. Just make sure to
241241
If a pack is installed via an `st2packs` image and then it gets updated with `st2 pack install`, a subsequent `helm upgrade` will revert back to the version in the `st2packs` image.
242242

243243
#### Configure the storage volumes
244-
Enable the `st2.packs.voluems` section of Helm values and add volume definitions for both `packs` and `virtualenvs`.
244+
Enable the `st2.packs.volumes` section of Helm values and add volume definitions for both `packs` and `virtualenvs`.
245245
Each of the volume definitions should be customized for your cluster and storage solution.
246246

247247
For example, to use persistentVolumeClaims:
@@ -369,3 +369,11 @@ This approach allows not only extending sub-chart with custom objects and templa
369369
but also adds flexibility to include many sub-chart dependencies and pin versions as well as include all the sub-chart values in one single place.
370370
This approach is infra-as-code friendly and more reproducible. See official Helm documentation about
371371
[Subcharts](https://helm.sh/docs/chart_template_guide/#subcharts-and-global-values) and [Dependencies](https://helm.sh/docs/developing_charts/#managing-dependencies-manually-via-the-charts-directory).
372+
373+
## Releasing information
374+
In order to create a release, the steps are as follows:
375+
1. Create a pull request by updating [CHANGELOG.md](./CHANGELOG.md) by replacing the "In Development" heading with the new version, and [Chart.yaml](./Chart.yaml) by replacing the `version` value.
376+
2. Once the pull request is merged, create and push the matching tag (for example, if you are creating release `v1.0.0`, then the tag should also be `v1.0.0`).
377+
3. After the tag is pushed, create the corresponding [release](https://github.com/StackStorm/stackstorm-k8s/releases).
378+
4. After the release is created, switch to the `gh-pages` branch, and generate the updated [Helm index](https://helm.sh/docs/helm/helm_repo_index/), [package](https://helm.sh/docs/helm/helm_package/) and [provenance](https://helm.sh/docs/topics/provenance/).
379+
5. After committing and pushing the changes in the previous step, verify that the new release is present on [ArtifactHub](https://artifacthub.io/packages/helm/stackstorm/stackstorm-ha).

‎templates/_helpers.tpl

+6-3
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,8 @@ Merge packs and virtualenvs from st2 with those from st2packs images
344344
- |
345345
/bin/cp -aR /opt/stackstorm/packs/. /opt/stackstorm/packs-shared &&
346346
/bin/cp -aR /opt/stackstorm/virtualenvs/. /opt/stackstorm/virtualenvs-shared
347-
{{- with $.Values.securityContext }}
347+
{{- with .securityContext | default $.Values.st2actionrunner.securityContext | default $.Values.securityContext }}
348+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
348349
securityContext: {{- toYaml . | nindent 8 }}
349350
{{- end }}
350351
{{- end }}
@@ -365,7 +366,8 @@ Merge packs and virtualenvs from st2 with those from st2packs images
365366
- |
366367
/bin/cp -aR /opt/stackstorm/packs/. /opt/stackstorm/packs-shared &&
367368
/bin/cp -aR /opt/stackstorm/virtualenvs/. /opt/stackstorm/virtualenvs-shared
368-
{{- with .Values.securityContext }}
369+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
370+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
369371
securityContext: {{- toYaml . | nindent 8 }}
370372
{{- end }}
371373
{{- end }}
@@ -384,7 +386,8 @@ Merge packs and virtualenvs from st2 with those from st2packs images
384386
- '-ec'
385387
- |
386388
/bin/cp -aR /opt/stackstorm/configs/. /opt/stackstorm/configs-shared
387-
{{- with .Values.securityContext }}
389+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
390+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
388391
securityContext: {{- toYaml . | nindent 8 }}
389392
{{- end }}
390393
{{- end }}

‎templates/deployments.yaml

+27-9
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,9 @@ spec:
2828
labels: {{- include "stackstorm-ha.labels" (list $ "st2auth") | nindent 8 }}
2929
annotations:
3030
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
31+
{{- if not .Values.st2.existingAuthSecret }}
3132
checksum/auth: {{ include (print $.Template.BasePath "/secrets_st2auth.yaml") . | sha256sum }}
33+
{{- end }}
3234
{{- if .Values.st2auth.postStartScript }}
3335
checksum/post-start-script: {{ .Values.st2auth.postStartScript | sha256sum }}
3436
{{- end }}
@@ -164,7 +166,9 @@ spec:
164166
labels: {{- include "stackstorm-ha.labels" (list $ "st2api") | nindent 8 }}
165167
annotations:
166168
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
169+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
167170
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
171+
{{- end }}
168172
{{- if .Values.st2api.postStartScript }}
169173
checksum/post-start-script: {{ .Values.st2api.postStartScript | sha256sum }}
170174
{{- end }}
@@ -428,7 +432,7 @@ spec:
428432
- name: st2web
429433
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2web:{{ tpl (.Values.st2web.image.tag | default .Values.image.tag) . }}'
430434
imagePullPolicy: {{ .Values.image.pullPolicy }}
431-
{{- with default .Values.securityContext .Values.st2web.securityContext }}
435+
{{- with .Values.st2web.securityContext | default .Values.securityContext }}
432436
securityContext: {{- toYaml . | nindent 10 }}
433437
{{- end }}
434438
ports:
@@ -515,7 +519,7 @@ spec:
515519
{{- with .Values.dnsConfig }}
516520
dnsConfig: {{- toYaml . | nindent 8 }}
517521
{{- end }}
518-
{{- with default .Values.podSecurityContext .Values.st2client.podSecurityContext }}
522+
{{- with .Values.st2web.podSecurityContext | default .Values.podSecurityContext }}
519523
securityContext: {{- toYaml . | nindent 8 }}
520524
{{- end }}
521525
{{- with .Values.st2web.nodeSelector }}
@@ -548,7 +552,9 @@ spec:
548552
labels: {{- include "stackstorm-ha.labels" (list $ "st2rulesengine") | nindent 8 }}
549553
annotations:
550554
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
555+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
551556
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
557+
{{- end }}
552558
{{- if .Values.st2rulesengine.postStartScript }}
553559
checksum/post-start-script: {{ .Values.st2rulesengine.postStartScript | sha256sum }}
554560
{{- end }}
@@ -769,7 +775,9 @@ spec:
769775
labels: {{- include "stackstorm-ha.labels" (list $ "st2workflowengine") | nindent 8 }}
770776
annotations:
771777
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
778+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
772779
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
780+
{{- end }}
773781
{{- if .Values.st2workflowengine.postStartScript }}
774782
checksum/post-start-script: {{ .Values.st2workflowengine.postStartScript | sha256sum }}
775783
{{- end }}
@@ -886,7 +894,9 @@ spec:
886894
labels: {{- include "stackstorm-ha.labels" (list $ "st2scheduler") | nindent 8 }}
887895
annotations:
888896
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
897+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
889898
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
899+
{{- end }}
890900
{{- if .Values.st2scheduler.postStartScript }}
891901
checksum/post-start-script: {{ .Values.st2scheduler.postStartScript | sha256sum }}
892902
{{- end }}
@@ -1137,7 +1147,9 @@ spec:
11371147
annotations:
11381148
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") $ | sha256sum }}
11391149
checksum/packs: {{ include (print $.Template.BasePath "/configmaps_packs.yaml") $ | sha256sum }}
1150+
{{- if and (ne "disable" (default "" $.Values.st2.datastore_crypto_key)) (not $.Values.st2.existingDatastoreSecret) }}
11401151
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") $ | sha256sum }}
1152+
{{- end }}
11411153
{{- if $.Values.st2sensorcontainer.postStartScript }}
11421154
checksum/post-start-script: {{ $.Values.st2sensorcontainer.postStartScript | sha256sum }}
11431155
{{- end }}
@@ -1187,7 +1199,7 @@ spec:
11871199
- name: {{ $name }}
11881200
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2sensorcontainer:{{ tpl ($sensor.image.tag | default $.Values.image.tag) $ }}'
11891201
imagePullPolicy: {{ $.Values.image.pullPolicy }}
1190-
{{- with default $.Values.securityContext $sensor.securityContext }}
1202+
{{- with $sensor.securityContext | default $.Values.securityContext }}
11911203
securityContext: {{- toYaml . | nindent 10 }}
11921204
{{- end }}
11931205
{{- with $sensor.readinessProbe }}
@@ -1282,7 +1294,7 @@ spec:
12821294
{{- with $.Values.dnsConfig }}
12831295
dnsConfig: {{- toYaml . | nindent 8 }}
12841296
{{- end }}
1285-
{{- with default $.Values.podSecurityContext $sensor.podSecurityContext }}
1297+
{{- with $sensor.podSecurityContext | default $.Values.podSecurityContext }}
12861298
securityContext: {{- toYaml . | nindent 8 }}
12871299
{{- end }}
12881300
{{- with $sensor.nodeSelector }}
@@ -1318,7 +1330,9 @@ spec:
13181330
annotations:
13191331
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
13201332
checksum/ssh: {{ include (print $.Template.BasePath "/secrets_ssh.yaml") . | sha256sum }}
1333+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
13211334
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
1335+
{{- end }}
13221336
{{- if .Values.st2actionrunner.postStartScript }}
13231337
checksum/post-start-script: {{ .Values.st2actionrunner.postStartScript | sha256sum }}
13241338
{{- end }}
@@ -1353,7 +1367,7 @@ spec:
13531367
image: '{{ .image.repository | default (include "stackstorm-ha.imageRepository" $) }}/{{ .image.name | default "st2actionrunner" }}:{{ tpl (.image.tag | default $.Values.image.tag) $ }}'
13541368
{{- end }}
13551369
imagePullPolicy: {{ .Values.st2actionrunner.image.pullPolicy | default .Values.image.pullPolicy }}
1356-
{{- with default .Values.securityContext .Values.st2actionrunner.securityContext }}
1370+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
13571371
securityContext: {{- toYaml . | nindent 10 }}
13581372
{{- end }}
13591373
# TODO: Add liveness/readiness probes (#3)
@@ -1436,7 +1450,7 @@ spec:
14361450
{{- with .Values.dnsConfig }}
14371451
dnsConfig: {{- toYaml . | nindent 8 }}
14381452
{{- end }}
1439-
{{- with default .Values.podSecurityContext .Values.st2actionrunner.podSecurityContext }}
1453+
{{- with .Values.st2actionrunner.podSecurityContext | default .Values.podSecurityContext }}
14401454
securityContext: {{- toYaml . | nindent 8 }}
14411455
{{- end }}
14421456
{{- with .Values.st2actionrunner.nodeSelector }}
@@ -1572,9 +1586,13 @@ spec:
15721586
checksum/config: {{ include (print $.Template.BasePath "/configmaps_st2-conf.yaml") . | sha256sum }}
15731587
checksum/rbac: {{ include (print $.Template.BasePath "/configmaps_rbac.yaml") . | sha256sum }}
15741588
checksum/packs: {{ include (print $.Template.BasePath "/configmaps_packs.yaml") . | sha256sum }}
1589+
{{- if not .Values.st2.existingAuthSecret }}
15751590
checksum/auth: {{ include (print $.Template.BasePath "/secrets_st2auth.yaml") . | sha256sum }}
1591+
{{- end }}
15761592
checksum/ssh: {{ include (print $.Template.BasePath "/secrets_ssh.yaml") . | sha256sum }}
1593+
{{- if and (ne "disable" (default "" .Values.st2.datastore_crypto_key)) (not .Values.st2.existingDatastoreSecret) }}
15771594
checksum/datastore-key: {{ include (print $.Template.BasePath "/secrets_datastore_crypto_key.yaml") . | sha256sum }}
1595+
{{- end }}
15781596
{{- if .Values.st2.overrides }}
15791597
checksum/overrides: {{ include (print $.Template.BasePath "/configmaps_overrides.yaml") . | sha256sum }}
15801598
{{- end }}
@@ -1600,7 +1618,7 @@ spec:
16001618
- name: generate-st2client-config
16011619
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.st2client.image.tag | default (.Values.st2actionrunner.image.tag | default .Values.image.tag)) . }}'
16021620
imagePullPolicy: {{ .Values.image.pullPolicy }}
1603-
{{- with .Values.securityContext }}
1621+
{{- with .Values.st2client.securityContext | default .Values.st2actionrunner.securityContext | default .Values.securityContext }}
16041622
securityContext: {{- toYaml . | nindent 10 }}
16051623
{{- end }}
16061624
envFrom:
@@ -1627,7 +1645,7 @@ spec:
16271645
- name: st2client
16281646
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.st2client.image.tag | default .Values.image.tag) . }}'
16291647
imagePullPolicy: {{ .Values.image.pullPolicy }}
1630-
{{- with default .Values.securityContext .Values.st2actionrunner.securityContext }}
1648+
{{- with .Values.st2client.securityContext | default .Values.st2actionrunner.securityContext | default .Values.securityContext }}
16311649
securityContext: {{- toYaml . | nindent 10 }}
16321650
{{- end }}
16331651
env:
@@ -1728,7 +1746,7 @@ spec:
17281746
{{- with .Values.dnsConfig }}
17291747
dnsConfig: {{- toYaml . | nindent 8 }}
17301748
{{- end }}
1731-
{{- with default .Values.podSecurityContext .Values.st2client.podSecurityContext }}
1749+
{{- with .Values.st2client.podSecurityContext | default .Values.st2actionrunner.podSecurityContext | default .Values.podSecurityContext }}
17321750
securityContext: {{- toYaml . | nindent 8 }}
17331751
{{- end }}
17341752
{{- with .Values.st2client.nodeSelector }}

‎templates/jobs.yaml

+11-7
Original file line numberDiff line numberDiff line change
@@ -411,7 +411,8 @@ spec:
411411
- name: st2-register-content-custom-init
412412
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.jobs.image.tag | default (.Values.st2actionrunner.image.tag | default .Values.image.tag)) . }}'
413413
imagePullPolicy: {{ .Values.image.pullPolicy }}
414-
{{- with .Values.securityContext }}
414+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
415+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
415416
securityContext: {{- toYaml . | nindent 10 }}
416417
{{- end }}
417418
command: {{- toYaml $.Values.jobs.preRegisterContentCommand | nindent 8 }}
@@ -425,7 +426,8 @@ spec:
425426
- name: st2-register-content
426427
image: '{{ template "stackstorm-ha.imageRepository" . }}/st2actionrunner:{{ tpl (.Values.jobs.image.tag | default (.Values.st2actionrunner.image.tag | default .Values.image.tag)) . }}'
427428
imagePullPolicy: {{ .Values.image.pullPolicy }}
428-
{{- with .Values.securityContext }}
429+
{{- with .Values.st2actionrunner.securityContext | default .Values.securityContext }}
430+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
429431
securityContext: {{- toYaml . | nindent 10 }}
430432
{{- end }}
431433
command:
@@ -470,7 +472,8 @@ spec:
470472
{{- with .Values.dnsConfig }}
471473
dnsConfig: {{- toYaml . | nindent 8 }}
472474
{{- end }}
473-
{{- with .Values.podSecurityContext }}
475+
{{- with .Values.st2actionrunner.podSecurityContext | default .Values.podSecurityContext }}
476+
{{/* st2actionrunner is likely the most permissive so use that if defined. */}}
474477
securityContext: {{- toYaml . | nindent 8 }}
475478
{{- end }}
476479
{{- with .Values.jobs.nodeSelector }}
@@ -540,7 +543,7 @@ spec:
540543
and then delete this st2canary pod manually.
541544
INTRO
542545
543-
function __handle_error__(){
546+
function __handle_error__ {
544547
cat <<- 'FAIL'
545548
ERROR: One or more volumes in st2.packs.volumes (from helm values) does not meet
546549
StackStorm's shared volumes requirements!
@@ -577,6 +580,7 @@ spec:
577580
{{- toYaml $.Values.st2.packs.volumes.configs | nindent 10 }}
578581
{{- end }}
579582
# st2canary job does not support extra_volumes. Let us know if you need this.
583+
restartPolicy: Never
580584
{{- if $.Values.dnsPolicy }}
581585
dnsPolicy: {{ $.Values.dnsPolicy }}
582586
{{- end }}
@@ -640,7 +644,7 @@ spec:
640644
- name: generate-st2client-config
641645
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2actionrunner:{{ tpl ($.Values.jobs.image.tag | default ($.Values.st2actionrunner.image.tag | default $.Values.image.tag)) $ }}'
642646
imagePullPolicy: {{ $.Values.image.pullPolicy }}
643-
{{- with $.Values.securityContext }}
647+
{{- with $.Values.st2actionrunner.securityContext | default $.Values.securityContext }}
644648
securityContext: {{- toYaml . | nindent 10 }}
645649
{{- end }}
646650
envFrom:
@@ -667,7 +671,7 @@ spec:
667671
- name: {{ $name }}
668672
image: '{{ template "stackstorm-ha.imageRepository" $ }}/st2actionrunner:{{ tpl ($.Values.jobs.image.tag | default ($.Values.st2actionrunner.image.tag | default $.Values.image.tag)) $ }}'
669673
imagePullPolicy: {{ $.Values.image.pullPolicy }}
670-
{{- with $.Values.securityContext }}
674+
{{- with .securityContext | default $.Values.st2actionrunner.securityContext | default $.Values.securityContext }}
671675
securityContext: {{- toYaml . | nindent 10 }}
672676
{{- end }}
673677
{{- if $.Values.jobs.env }}
@@ -717,7 +721,7 @@ spec:
717721
{{- with $.Values.dnsConfig }}
718722
dnsConfig: {{- toYaml . | nindent 8 }}
719723
{{- end }}
720-
{{- with $.Values.podSecurityContext }}
724+
{{- with .podSecurityContext | default $.Values.st2actionrunner.podSecurityContext | default $.Values.podSecurityContext }}
721725
securityContext: {{- toYaml . | nindent 8 }}
722726
{{- end }}
723727
{{- with $.Values.jobs.nodeSelector }}

0 commit comments

Comments
 (0)