Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[velero] Pass config trough tpl and implement reload trigger #525

Merged
merged 8 commits into from
Dec 13, 2023
Merged

[velero] Pass config trough tpl and implement reload trigger #525

merged 8 commits into from
Dec 13, 2023

Conversation

jkroepke
Copy link
Contributor

@jkroepke jkroepke commented Dec 2, 2023 •
edited
Loading

Special notes for your reviewer:

This PR implements to things:

Implement an optional pod trigger, if the secret has been changed. (Fixes vmware-tanzu/velero#5866)
Implement an flag to pass credentials to helm tpl function.

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]

  • DCO signed
  • Chart Version bumped
  • Variables are documented in the values.yaml or README.md
  • Title of the PR starts with chart name (e.g. [velero])

jenting
jenting reviewed Dec 2, 2023
View reviewed changes
Copy link
Collaborator

@jenting jenting left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this requires reloader to make the pod automatically restart when the secrets change?

@jkroepke
Copy link
Contributor Author

jkroepke commented Dec 3, 2023

@jenting No. The technic that I used here is described well at helm docs:

https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments

@jkroepke jkroepke requested a review from jenting December 3, 2023 08:05
jenting
jenting reviewed Dec 3, 2023
View reviewed changes
charts/velero/values.yaml Outdated Show resolved Hide resolved
@jkroepke
Remove tplConfig
a7549e6 
Signed-off-by: Jan-Otto Kröpke <[email protected]>
@jkroepke jkroepke requested a review from jenting December 3, 2023 15:14
@jenting
Copy link
Collaborator

jenting commented Dec 4, 2023

@jenting No. The technic that I used here is described well at helm docs:

https://helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments

I think it still depends on the executing the helm upgrade so the Pod will automatically restart when the secret change. Otherwise, we usually depends on the reloader.

jenting
jenting reviewed Dec 4, 2023
View reviewed changes
charts/velero/values.yaml Outdated Show resolved Hide resolved
@jkroepke
Copy link
Contributor Author

jkroepke commented Dec 4, 2023

@jenting No. The technic that I used here is described well at helm docs:
helm.sh/docs/howto/charts_tips_and_tricks/#automatically-roll-deployments

I think it still depends on the executing the helm upgrade so the Pod will automatically restart when the secret change. Otherwise, we usually depends on the reloader.

It's also GitOps compatible, because FluxCD uses helm upgrade and ArgoCD uses helm template which includes the checksums and forces a reloaded based on the checksums.

It also works, if helm is embedded into kustomize. Grafana Helm charts uses the mechanic, too.

@jkroepke
Copy link
Contributor Author

jkroepke commented Dec 4, 2023

Hi @jenting

I changed the checksum logic a bit that only the secrets are included for the checksum generation. This avoid pod-trigger, if the labels has been changed.

jenting
jenting reviewed Dec 4, 2023
View reviewed changes
Copy link
Collaborator

@jenting jenting left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible to support the case for the 'existingsecret'?
Because the secret might be generated externally, such as Vault. And we should support automatically update the secret sha256 checksum for the existingsecret as well.

@jkroepke
Copy link
Contributor Author

jkroepke commented Dec 4, 2023

Nope, thats not possible. For this use-case, you still need reloader.

jenting
jenting previously approved these changes Dec 4, 2023
View reviewed changes
Copy link
Collaborator

@jenting jenting left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code LGTM

@jenting
Copy link
Collaborator

jenting commented Dec 12, 2023

@jkroepke could you help rebase this PR and bump the chart version? Thanks.

@jkroepke
Update Chart.yaml
225569d 
Signed-off-by: Jan-Otto Kröpke <[email protected]>
@jkroepke
Copy link
Contributor Author

@jenting I do a merge from main here, since you do commits here on branch and with rebase, the signature gets invalid.

@qiuming-best qiuming-best merged commit ab0db25 into vmware-tanzu:main Dec 13, 2023
11 checks passed
PrivatePuffin referenced this pull request in truecharts/public Dec 16, 2023
@truecharts-admin
chore(deps): update helm general non-major (#14784)
45f50c7 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cert-manager](https://togithub.com/cert-manager/cert-manager) | patch
| `v1.13.2` -> `v1.13.3` |
| [clickhouse](https://truecharts.org/charts/dependency/clickhouse)
([source](https://togithub.com/truecharts/charts)) | patch | `7.0.25` ->
`7.0.30` |
|
[common](https://togithub.com/truecharts/apps/tree/master/charts/common)
([source](https://togithub.com/truecharts/library-charts)) | minor |
`14.3.5` -> `14.5.0` |
|
[common](https://togithub.com/truecharts/apps/tree/master/charts/common)
([source](https://togithub.com/truecharts/library-charts)) | minor |
`15.0.1` -> `15.3.4` |
|
[common](https://togithub.com/truecharts/apps/tree/master/charts/common)
([source](https://togithub.com/truecharts/library-charts)) | minor |
`16.0.0` -> `16.2.6` |
|
[common](https://togithub.com/truecharts/apps/tree/master/charts/common)
([source](https://togithub.com/truecharts/library-charts)) | minor |
`15.2.0` -> `15.3.4` |
|
[common](https://togithub.com/truecharts/apps/tree/master/charts/common)
([source](https://togithub.com/truecharts/library-charts)) | minor |
`14.3.3` -> `14.5.0` |
|
[common](https://togithub.com/truecharts/apps/tree/master/charts/common)
([source](https://togithub.com/truecharts/library-charts)) | patch |
`15.3.1` -> `15.3.4` |
|
[kube-state-metrics](https://truecharts.org/charts/dependency/kube-state-metrics)
([source](https://togithub.com/truecharts/charts)) | patch | `3.0.38` ->
`3.0.41` |
| [mariadb](https://truecharts.org/charts/dependency/mariadb)
([source](https://togithub.com/truecharts/charts)) | patch | `9.0.40` ->
`9.0.43` |
|
[node-exporter](https://truecharts.org/charts/dependency/node-exporter)
([source](https://togithub.com/truecharts/charts)) | patch | `3.0.40` ->
`3.0.43` |
| [redis](https://truecharts.org/charts/dependency/redis)
([source](https://togithub.com/truecharts/charts)) | patch | `8.0.44` ->
`8.0.47` |
| [velero](https://togithub.com/vmware-tanzu/velero)
([source](https://togithub.com/vmware-tanzu/helm-charts)) | minor |
`5.1.4` -> `5.2.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>cert-manager/cert-manager (cert-manager)</summary>

###
[`v1.13.3`](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.13.3)

[Compare
Source](https://togithub.com/cert-manager/cert-manager/compare/v1.13.2...v1.13.3)

cert-manager is the easiest way to automatically manage certificates in
Kubernetes and OpenShift clusters.

> ⚠️ Read about the [**breaking changes in cert-manager
1.13**](https://togithub.com/cert-manager/cert-manager/releases/tag/v1.13.0)
before you upgrade from a < v1.13 version!

This patch release contains fixes for the following security
vulnerabilities in the cert-manager-controller:

- [`GO-2023-2334`](https://pkg.go.dev/vuln/GO-2023-2334): Decryption of
malicious PBES2 JWE objects can consume unbounded system resources.

If you use [ArtifactHub Security
report](https://artifacthub.io/packages/helm/cert-manager/cert-manager/1.13.2?modal=security-report)
or [trivy](https://trivy.dev/), this patch will also silence the
following warning about a vulnerability in code which is imported but
**not used** by the cert-manager-controller:

-
[`CVE-2023-47108`](https://access.redhat.com/security/cve/CVE-2023-47108):
DoS vulnerability in `otelgrpc` due to unbound cardinality metrics.

An ongoing security audit of cert-manager suggested some changes to the
webhook code to mitigate DoS attacks, and these are included in this
patch release.

##### Changes

##### Bug or Regression

- The webhook server now returns HTTP error 413 (Content Too Large) for
requests with body size `>= 3MiB`. This is to mitigate DoS attacks that
attempt to crash the webhook process by sending large requests that
exceed the available memory.
([#&#8203;6507](https://togithub.com/cert-manager/cert-manager/pull/6507),
[@&#8203;inteon](https://togithub.com/inteon))
- The webhook server now returns HTTP error 400 (Bad Request) if the
request contains an empty body.
([#&#8203;6507](https://togithub.com/cert-manager/cert-manager/pull/6507),
[@&#8203;inteon](https://togithub.com/inteon))
- The webhook server now returns HTTP error 500 (Internal Server Error)
rather than crashing, if the code panics while handling a request.
([#&#8203;6507](https://togithub.com/cert-manager/cert-manager/pull/6507),
[@&#8203;inteon](https://togithub.com/inteon))
- Mitigate potential "Slowloris" attacks by setting `ReadHeaderTimeout`
in all `http.Server` instances.
([#&#8203;6538](https://togithub.com/cert-manager/cert-manager/pull/6538),
[@&#8203;wallrj](https://togithub.com/wallrj))
- Upgrade Go modules: `otel`, `docker`, and `jose` to fix CVE alerts.
See GHSA-8pgv-569h-w5rw,
GHSA-jq35-85cj-fj4p, and
GHSA-2c7c-3mj9-8fqh.
([#&#8203;6514](https://togithub.com/cert-manager/cert-manager/pull/6514),
[@&#8203;inteon](https://togithub.com/inteon))

##### Dependencies

##### Added

*Nothing has changed.*

##### Changed

-   `cloud.google.com/go/firestore`: `v1.11.0 → v1.12.0`
-   `cloud.google.com/go`: `v0.110.6 → v0.110.7`
- `github.com/felixge/httpsnoop`: [`v1.0.3 →
v1.0.4`](https://togithub.com/felixge/httpsnoop/compare/v1.0.3...v1.0.4)
- `github.com/go-jose/go-jose/v3`: [`v3.0.0 →
v3.0.1`](https://togithub.com/go-jose/go-jose/v3/compare/v3.0.0...v3.0.1)
- `github.com/go-logr/logr`: [`v1.2.4 →
v1.3.0`](https://togithub.com/go-logr/logr/compare/v1.2.4...v1.3.0)
- `github.com/golang/glog`: [`v1.1.0 →
v1.1.2`](https://togithub.com/golang/glog/compare/v1.1.0...v1.1.2)
- `github.com/google/go-cmp`: [`v0.5.9 →
v0.6.0`](https://togithub.com/google/go-cmp/compare/v0.5.9...v0.6.0)
-
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`:
`v0.45.0 → v0.46.0`
- `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`:
`v0.44.0 → v0.46.0`
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`:
`v1.19.0 → v1.20.0`
- `go.opentelemetry.io/otel/exporters/otlp/otlptrace`: `v1.19.0 →
v1.20.0`
-   `go.opentelemetry.io/otel/metric`: `v1.19.0 → v1.20.0`
-   `go.opentelemetry.io/otel/sdk`: `v1.19.0 → v1.20.0`
-   `go.opentelemetry.io/otel/trace`: `v1.19.0 → v1.20.0`
-   `go.opentelemetry.io/otel`: `v1.19.0 → v1.20.0`
-   `go.uber.org/goleak`: `v1.2.1 → v1.3.0`
-   `golang.org/x/sys`: `v0.13.0 → v0.14.0`
-   `google.golang.org/genproto/googleapis/api`: `f966b18 → b8732ec`
-   `google.golang.org/genproto`: `f966b18 → b8732ec`
-   `google.golang.org/grpc`: `v1.58.3 → v1.59.0`

##### Removed

*Nothing has changed.*

</details>

<details>
<summary>truecharts/charts (clickhouse)</summary>

###
[`v7.0.30`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.30)

[Compare
Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.29...clickhouse-7.0.30)

ClickHouse is a column-oriented database management system (DBMS) for
online analytical processing of queries (OLAP).

###
[`v7.0.29`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.29)

[Compare
Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.28...clickhouse-7.0.29)

ClickHouse is a column-oriented database management system (DBMS) for
online analytical processing of queries (OLAP).

###
[`v7.0.28`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.28)

[Compare
Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.27...clickhouse-7.0.28)

ClickHouse is a column-oriented database management system (DBMS) for
online analytical processing of queries (OLAP).

###
[`v7.0.27`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.27)

[Compare
Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.26...clickhouse-7.0.27)

ClickHouse is a column-oriented database management system (DBMS) for
online analytical processing of queries (OLAP).

###
[`v7.0.26`](https://togithub.com/truecharts/charts/releases/tag/clickhouse-7.0.26)

[Compare
Source](https://togithub.com/truecharts/charts/compare/clickhouse-7.0.25...clickhouse-7.0.26)

ClickHouse is a column-oriented database management system (DBMS) for
online analytical processing of queries (OLAP).

</details>

<details>
<summary>truecharts/library-charts (common)</summary>

###
[`v14.5.0`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.5.0)

[Compare
Source](https://togithub.com/truecharts/library-charts/compare/common-14.4.0...common-14.5.0)

Function library for TrueCharts

###
[`v14.4.0`](https://togithub.com/truecharts/library-charts/releases/tag/common-14.4.0)

[Compare
Source](https://togithub.com/truecharts/library-charts/compare/common-14.3.5...common-14.4.0)

Function library for TrueCharts

</details>

<details>
<summary>vmware-tanzu/helm-charts (velero)</summary>

###
[`v5.2.0`](https://togithub.com/vmware-tanzu/helm-charts/releases/tag/velero-5.2.0)

[Compare
Source](https://togithub.com/vmware-tanzu/helm-charts/compare/velero-5.1.7...velero-5.2.0)

A Helm chart for velero

#### What's Changed

- \[velero] Pass config trough tpl and implement reload trigger by
[@&#8203;jkroepke](https://togithub.com/jkroepke) in
[https://github.com/vmware-tanzu/helm-charts/pull/525](https://togithub.com/vmware-tanzu/helm-charts/pull/525)

**Full Changelog**:
vmware-tanzu/helm-charts@velero-5.1.7...velero-5.2.0

###
[`v5.1.7`](https://togithub.com/vmware-tanzu/helm-charts/releases/tag/velero-5.1.7)

[Compare
Source](https://togithub.com/vmware-tanzu/helm-charts/compare/velero-5.1.6...velero-5.1.7)

A Helm chart for velero

#### What's Changed

- \[velero]: Feature push new charts to GHCR OCI registry as well by
[@&#8203;ishuar](https://togithub.com/ishuar) in
[https://github.com/vmware-tanzu/helm-charts/pull/523](https://togithub.com/vmware-tanzu/helm-charts/pull/523)
- \[velero] feat: Add additional templating options for Velero upgrade
CRDs job by [@&#8203;cbuto](https://togithub.com/cbuto) in
[https://github.com/vmware-tanzu/helm-charts/pull/528](https://togithub.com/vmware-tanzu/helm-charts/pull/528)

#### New Contributors

- [@&#8203;cbuto](https://togithub.com/cbuto) made their first
contribution in
[https://github.com/vmware-tanzu/helm-charts/pull/528](https://togithub.com/vmware-tanzu/helm-charts/pull/528)

**Full Changelog**:
vmware-tanzu/helm-charts@velero-5.1.6...velero-5.1.7

###
[`v5.1.6`](https://togithub.com/vmware-tanzu/helm-charts/releases/tag/velero-5.1.6)

[Compare
Source](https://togithub.com/vmware-tanzu/helm-charts/compare/velero-5.1.5...velero-5.1.6)

A Helm chart for velero

#### What's Changed

- \[velero]: Disable default values for upgradeJobResources by
[@&#8203;ishuar](https://togithub.com/ishuar) in
[https://github.com/vmware-tanzu/helm-charts/pull/524](https://togithub.com/vmware-tanzu/helm-charts/pull/524)

**Full Changelog**:
vmware-tanzu/helm-charts@velero-5.1.5...velero-5.1.6

###
[`v5.1.5`](https://togithub.com/vmware-tanzu/helm-charts/releases/tag/velero-5.1.5)

[Compare
Source](https://togithub.com/vmware-tanzu/helm-charts/compare/velero-5.1.4...velero-5.1.5)

A Helm chart for velero

#### What's Changed

- Bump velero/velero from 1.12.1 to v1.12.2 in /charts/velero by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/vmware-tanzu/helm-charts/pull/522](https://togithub.com/vmware-tanzu/helm-charts/pull/522)

**Full Changelog**:
vmware-tanzu/helm-charts@velero-5.1.4...velero-5.1.5

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 10pm on tuesday" in timezone
Europe/Amsterdam, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://togithub.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy41OS44IiwidXBkYXRlZEluVmVyIjoiMzcuOTEuNSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jenting jenting jenting approved these changes

@qiuming-best qiuming-best qiuming-best approved these changes

Assignees

@jkroepke jkroepke

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

When the cloud-credentials for S3 bucket updated, the Velero service can't read it automatically.
3 participants
@jkroepke @jenting @qiuming-best