From 02c8d53b8ed5ddf7464a65fcb6006e8f5dec74b0 Mon Sep 17 00:00:00 2001 From: Vishal Choudhary Date: Wed, 18 Sep 2024 17:30:20 +0530 Subject: [PATCH 1/2] feat: install apiservices using helm hooks (#192) * feat: install apiservices using helm hooks Signed-off-by: Vishal Choudhary * fix: chart linter Signed-off-by: Vishal Choudhary * fix: bump chainsaw Signed-off-by: Vishal Choudhary * fix: add patch permissions Signed-off-by: Vishal Choudhary * fix: simplify permissions Signed-off-by: Vishal Choudhary * fix: charts and images Signed-off-by: Vishal Choudhary --------- Signed-off-by: Vishal Choudhary --- .github/workflows/migration-tests.yaml | 7 +- Makefile | 4 +- charts/reports-server/README.md | 20 ++- .../reports-server/templates/api-service.yaml | 7 +- .../templates/cluster-roles.yaml | 20 +++ .../hooks/post-install-api-services.yaml | 128 ++++++++++++++++++ .../hooks/pre-delete-api-service-cleanup.yaml | 76 +++++++++++ charts/reports-server/templates/roles.yaml | 32 +++++ charts/reports-server/values.yaml | 74 ++++++++-- config/install-inmemory.yaml | 58 ++++++++ config/install.yaml | 58 ++++++++ docs/INSTALL.md | 2 +- docs/MIGRATION.md | 27 ---- 13 files changed, 465 insertions(+), 48 deletions(-) create mode 100644 charts/reports-server/templates/hooks/post-install-api-services.yaml create mode 100644 charts/reports-server/templates/hooks/pre-delete-api-service-cleanup.yaml delete mode 100644 docs/MIGRATION.md diff --git a/.github/workflows/migration-tests.yaml b/.github/workflows/migration-tests.yaml index 5579fe2..dfb1edc 100644 --- a/.github/workflows/migration-tests.yaml +++ b/.github/workflows/migration-tests.yaml @@ -92,12 +92,7 @@ jobs: set -e kubectl create ns reports-server export HELM=${{ steps.helm.outputs.helm-path }} - make kind-migrate - - name: Install api services - run: | - set -e - export HELM=${{ steps.helm.outputs.helm-path }} - make kind-apply-api-services + make kind-install - name: Wait for report server ready run: | set -e diff --git a/Makefile b/Makefile index ec127b6..7790ee4 100644 --- a/Makefile +++ b/Makefile @@ -158,6 +158,7 @@ codegen-helm-docs: ## Generate helm docs codegen-install-manifest: $(HELM) ## Create install manifest @echo Generate latest install manifest... >&2 @$(HELM) template reports-server --namespace reports-server ./charts/reports-server/ \ + --set apiServicesManagement.installApiServices.enabled=true \ --set image.tag=latest \ --set templating.enabled=true \ | $(SED) -e '/^#.*/d' \ @@ -166,6 +167,7 @@ codegen-install-manifest: $(HELM) ## Create install manifest codegen-install-manifest-inmemory: $(HELM) ## Create install manifest without postgres @echo Generate latest install manifest... >&2 @$(HELM) template reports-server --namespace reports-server ./charts/reports-server/ \ + --set apiServicesManagement.installApiServices.enabled=true \ --set image.tag=latest \ --set config.debug=true \ --set postgresql.enabled=false \ @@ -244,7 +246,7 @@ kind-migrate: $(HELM) kind-load ## Build image, load it in kind cluster and depl --set image.registry=$(KO_REGISTRY) \ --set image.repository=$(PACKAGE) \ --set image.tag=$(GIT_SHA) \ - --set apiServices.enabled=false + --set apiServicesManagement.installApiServices.enabled=false .PHONY: kind-apply-api-services kind-apply-api-services: $(HELM) kind-load ## Build image, load it in kind cluster and deploy helm chart diff --git a/charts/reports-server/README.md b/charts/reports-server/README.md index 483ad64..19f115b 100644 --- a/charts/reports-server/README.md +++ b/charts/reports-server/README.md @@ -25,8 +25,6 @@ helm install reports-server --namespace reports-server --create-namespace report | postgresql.enabled | bool | `true` | Deploy postgresql dependency chart | | postgresql.auth.postgresPassword | string | `"reports"` | | | postgresql.auth.database | string | `"reportsdb"` | | -| apiServices.enabled | bool | `true` | Store reports in reports-server | -| apiServices.installEphemeralReportsService | bool | `true` | Store ephemeral reports in reports-server | | nameOverride | string | `""` | Name override | | fullnameOverride | string | `""` | Full name override | | replicaCount | int | `1` | Number of pod replicas | @@ -79,6 +77,24 @@ helm install reports-server --namespace reports-server --create-namespace report | config.db.sslrootcert | string | `""` | Database SSL root cert | | config.db.sslkey | string | `""` | Database SSL key | | config.db.sslcert | string | `""` | Database SSL cert | +| apiServicesManagement.enabled | bool | `true` | Create a helm hooks to install and delete api services | +| apiServicesManagement.installApiServices | object | `{"enabled":false,"installEphemeralReportsService":true}` | Install api services in manifest | +| apiServicesManagement.installApiServices.enabled | bool | `false` | Store reports in reports-server | +| apiServicesManagement.installApiServices.installEphemeralReportsService | bool | `true` | Store ephemeral reports in reports-server | +| apiServicesManagement.image.registry | string | `"docker.io"` | Image registry | +| apiServicesManagement.image.repository | string | `"bitnami/kubectl"` | Image repository | +| apiServicesManagement.image.tag | string | `"1.30.2"` | Image tag Defaults to `latest` if omitted | +| apiServicesManagement.image.pullPolicy | string | `nil` | Image pull policy Defaults to image.pullPolicy if omitted | +| apiServicesManagement.imagePullSecrets | list | `[]` | Image pull secrets | +| apiServicesManagement.podSecurityContext | object | `{}` | Security context for the pod | +| apiServicesManagement.nodeSelector | object | `{}` | Node labels for pod assignment | +| apiServicesManagement.tolerations | list | `[]` | List of node taints to tolerate | +| apiServicesManagement.podAntiAffinity | object | `{}` | Pod anti affinity constraints. | +| apiServicesManagement.podAffinity | object | `{}` | Pod affinity constraints. | +| apiServicesManagement.podLabels | object | `{}` | Pod labels. | +| apiServicesManagement.podAnnotations | object | `{}` | Pod annotations. | +| apiServicesManagement.nodeAffinity | object | `{}` | Node affinity constraints. | +| apiServicesManagement.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the hook containers | ## Source Code diff --git a/charts/reports-server/templates/api-service.yaml b/charts/reports-server/templates/api-service.yaml index 02fc3ac..f8a4b30 100644 --- a/charts/reports-server/templates/api-service.yaml +++ b/charts/reports-server/templates/api-service.yaml @@ -1,4 +1,4 @@ -{{- if .Values.apiServices.enabled }} +{{- if .Values.apiServicesManagement.installApiServices.enabled }} --- apiVersion: apiregistration.k8s.io/v1 kind: APIService @@ -20,7 +20,7 @@ spec: version: v1alpha2 versionPriority: 100 -{{- if .Values.apiServices.installEphemeralReportsService }} +{{- if .Values.apiServicesManagement.installApiServices.installEphemeralReportsService }} --- apiVersion: apiregistration.k8s.io/v1 kind: APIService @@ -42,4 +42,5 @@ spec: version: v1 versionPriority: 100 {{- end }} -{{- end }} \ No newline at end of file +{{- end }} + diff --git a/charts/reports-server/templates/cluster-roles.yaml b/charts/reports-server/templates/cluster-roles.yaml index bb51d48..f87e119 100644 --- a/charts/reports-server/templates/cluster-roles.yaml +++ b/charts/reports-server/templates/cluster-roles.yaml @@ -22,6 +22,26 @@ rules: - update - watch - deletecollection +{{- if .Values.apiServicesManagement.enabled }} +- apiGroups: + - apiregistration.k8s.io + resources: + - apiservices + verbs: + - create +- apiGroups: + - apiregistration.k8s.io + resources: + - apiservices + verbs: + - get + - delete + - update + - patch + resourceNames: + - v1.reports.kyverno.io + - v1alpha2.wgpolicyk8s.io +{{- end }} - apiGroups: - wgpolicyk8s.io resources: diff --git a/charts/reports-server/templates/hooks/post-install-api-services.yaml b/charts/reports-server/templates/hooks/post-install-api-services.yaml new file mode 100644 index 0000000..f028ae6 --- /dev/null +++ b/charts/reports-server/templates/hooks/post-install-api-services.yaml @@ -0,0 +1,128 @@ +{{- if .Values.apiServicesManagement.enabled -}} +{{- if not .Values.templating.enabled -}} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "reports-server.fullname" . }}-post-install-install-api-services + namespace: {{ $.Release.Namespace }} + labels: + {{- include "reports-server.labels" . | nindent 4 }} + annotations: + helm.sh/hook: post-install + helm.sh/hook-weight: "100" +spec: + backoffLimit: 2 + template: + metadata: + {{- with .Values.apiServicesManagement.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.apiServicesManagement.podLabels }} + labels: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccount: {{ include "reports-server.serviceAccountName" . }} + {{- with .Values.apiServicesManagement.podSecurityContext }} + securityContext: + {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + restartPolicy: Never + {{- with .Values.apiServicesManagement.imagePullSecrets | default .Values.imagePullSecrets }} + imagePullSecrets: + {{- tpl (toYaml .) $ | nindent 8 }} + {{- end }} + containers: + - name: kubectl + image: "{{ .Values.apiServicesManagement.image.registry }}/{{ .Values.apiServicesManagement.image.repository }}:{{ .Values.apiServicesManagement.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.apiServicesManagement.image.pullPolicy }} + command: + - /bin/bash + - '-c' + - |- + set -euo pipefail + kubectl wait -n {{ $.Release.Namespace }} pod --for=condition=ready -l app.kubernetes.io/name={{ include "reports-server.fullname" . }} --timeout=120s + kubectl apply -f - < Date: Wed, 18 Sep 2024 17:30:41 +0530 Subject: [PATCH 2/2] chore(deps): Bump github/codeql-action from 2.13.4 to 3.26.7 (#197) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.13.4 to 3.26.7. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cdcdbb579706841c47f7063dda365e292e5cad7a...8214744c546c1e5c8f03dde8fab3a7353211988d) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Vishal Choudhary --- .github/workflows/codeql.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index ffe2108..0d5a561 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -38,7 +38,7 @@ jobs: exit-code: '0' vuln-type: os,library - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4 + uses: github/codeql-action/upload-sarif@8214744c546c1e5c8f03dde8fab3a7353211988d # v3.26.7 with: sarif_file: trivy-results.sarif category: code \ No newline at end of file