Skip to content

Commit fb397a6

Browse files
ixxeL2097ixxeL2097
authored
Merge branch 'CloudPirates-io:main' into main
2 parents d1f2cc6 + 381bd76 commit fb397a6

19 files changed

+1014
-136
lines changed

‎charts/keycloak/Chart.lock‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ dependencies:
44
version: 1.1.1
55
- name: postgres
66
repository: oci://registry-1.docker.io/cloudpirates
7-
version: 0.6.1
7+
version: 0.7.2
88
- name: mariadb
99
repository: oci://registry-1.docker.io/cloudpirates
10-
version: 0.3.0
11-
digest: sha256:18c857c1e792fb60ef7577d542f549e8732fdcaf59caa47eb21bd75126ddc713
12-
generated: "2025-09-30T07:51:22.5152067+02:00"
10+
version: 0.3.2
11+
digest: sha256:886649f9f78f7bf1f296dabcca5eb8cd0dbd9d0fdb540a327e6a299817fd4b53
12+
generated: "2025-10-07T21:13:04.453964+02:00"

‎charts/keycloak/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: keycloak
33
description: Open Source Identity and Access Management Solution
44
type: application
5-
version: 0.2.1
5+
version: 0.3.0
66
appVersion: "26.3.4"
77
keywords:
88
- keycloak

‎charts/keycloak/README.md‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -114,15 +114,15 @@ The following table lists the configurable parameters of the Keycloak chart and
114114

115115
### Security
116116

117-
| Parameter | Description | Default |
118-
| ------------------------------------------ | ------------------------------------------------- | --------- |
119-
| `podSecurityContext.fsGroup` | Group ID for the volumes of the pod | `1001` |
120-
| `securityContext.allowPrivilegeEscalation` | Enable container privilege escalation | `false` |
121-
| `securityContext.runAsNonRoot` | Configure the container to run as a non-root user | `true` |
122-
| `securityContext.runAsUser` | User ID for the Keycloak container | `1001` |
123-
| `securityContext.runAsGroup` | Group ID for the Keycloak container | `1001` |
124-
| `securityContext.readOnlyRootFilesystem` | Mount container root filesystem as read-only | `false` |
125-
| `securityContext.capabilities.drop` | Linux capabilities to be dropped | `["ALL"]` |
117+
| Parameter | Description | Default |
118+
| --------------------------------------------------- | ------------------------------------------------- | --------- |
119+
| `podSecurityContext.fsGroup` | Group ID for the volumes of the pod | `1001` |
120+
| `containerSecurityContext.allowPrivilegeEscalation` | Enable container privilege escalation | `false` |
121+
| `containerSecurityContext.runAsNonRoot` | Configure the container to run as a non-root user | `true` |
122+
| `containerSecurityContext.runAsUser` | User ID for the Keycloak container | `1001` |
123+
| `containerSecurityContext.runAsGroup` | Group ID for the Keycloak container | `1001` |
124+
| `containerSecurityContext.readOnlyRootFilesystem` | Mount container root filesystem as read-only | `false` |
125+
| `containerSecurityContext.capabilities.drop` | Linux capabilities to be dropped | `["ALL"]` |
126126

127127
### Keycloak Configuration
128128

‎charts/keycloak/templates/deployment.yaml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,10 @@ spec:
3131
{{- with (include "keycloak.imagePullSecrets" .) }}
3232
{{ . | nindent 6 }}
3333
{{- end }}
34-
securityContext:
35-
{{- toYaml .Values.podSecurityContext | nindent 8 }}
34+
securityContext: {{ include "common.renderPodSecurityContext" . | nindent 8 }}
3635
initContainers:
3736
- name: copy-quarkus-lib
38-
securityContext:
39-
{{- toYaml .Values.securityContext | nindent 12 }}
37+
securityContext: {{ include "common.renderContainerSecurityContext" . | nindent 12 }}
4038
image: {{ include "keycloak.image" . }}
4139
imagePullPolicy: {{ .Values.image.imagePullPolicy }}
4240
command: ["sh", "-c", "cp -r /opt/keycloak/lib/quarkus/* /shared-quarkus/"]
@@ -45,10 +43,12 @@ spec:
4543
mountPath: /shared-quarkus
4644
{{- if .Values.postgres.enabled }}
4745
- name: wait-for-postgres
46+
securityContext: {{ include "common.renderContainerSecurityContext" . | nindent 12 }}
4847
image: {{ .Values.initContainers.waitForPostgres.image }}
4948
command: ["sh", "-c", "until pg_isready -h {{ .Release.Name }}-postgres -p 5432 -U postgres; do echo waiting for database; sleep 2; done;"]
5049
{{- else if .Values.mariadb.enabled }}
5150
- name: wait-for-mariadb
51+
securityContext: {{ include "common.renderContainerSecurityContext" . | nindent 12 }}
5252
image: {{ .Values.initContainers.waitForMariadb.image }}
5353
command: ["sh", "-c", "until mysqladmin ping -h {{ .Release.Name }}-mariadb -P 3306 --silent; do echo waiting for database; sleep 2; done;"]
5454
{{- end }}
@@ -57,8 +57,7 @@ spec:
5757
{{- end }}
5858
containers:
5959
- name: {{ .Chart.Name }}
60-
securityContext:
61-
{{- toYaml .Values.securityContext | nindent 12 }}
60+
securityContext: {{ include "common.renderContainerSecurityContext" . | nindent 12 }}
6261
image: {{ include "keycloak.image" . }}
6362
imagePullPolicy: {{ .Values.image.imagePullPolicy }}
6463
command:

‎charts/keycloak/values.schema.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@
103103
}
104104
}
105105
},
106-
"securityContext": {
106+
"containerSecurityContext": {
107107
"type": "object",
108108
"properties": {
109109
"allowPrivilegeEscalation": {

‎charts/keycloak/values.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -59,18 +59,18 @@ podSecurityContext:
5959
## @param podSecurityContext.fsGroup Group ID for the volumes of the pod
6060
fsGroup: 1001
6161

62-
securityContext:
63-
## @param securityContext.allowPrivilegeEscalation Enable container privilege escalation
62+
containerSecurityContext:
63+
## @param containerSecurityContext.allowPrivilegeEscalation Enable container privilege escalation
6464
allowPrivilegeEscalation: false
65-
## @param securityContext.runAsNonRoot Configure the container to run as a non-root user
65+
## @param containerSecurityContext.runAsNonRoot Configure the container to run as a non-root user
6666
runAsNonRoot: true
67-
## @param securityContext.runAsUser User ID for the Keycloak container
67+
## @param containerSecurityContext.runAsUser User ID for the Keycloak container
6868
runAsUser: 1001
69-
## @param securityContext.runAsGroup Group ID for the Keycloak container
69+
## @param containerSecurityContext.runAsGroup Group ID for the Keycloak container
7070
runAsGroup: 1001
71-
## @param securityContext.readOnlyRootFilesystem Mount container root filesystem as read-only
71+
## @param containerSecurityContext.readOnlyRootFilesystem Mount container root filesystem as read-only
7272
readOnlyRootFilesystem: false
73-
## @param securityContext.capabilities.drop Linux capabilities to be dropped
73+
## @param containerSecurityContext.capabilities.drop Linux capabilities to be dropped
7474
capabilities:
7575
drop:
7676
- ALL

‎charts/nginx/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: nginx
33
description: Nginx is a high-performance HTTP server and reverse proxy.
44
type: application
5-
version: 0.1.11
5+
version: 0.1.12
66
appVersion: "1.29.1"
77
keywords:
88
- nginx

‎charts/nginx/README.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,6 +306,46 @@ readinessProbe:
306306
| `ingress.tls` | TLS configuration for the Ingress | `[]` |
307307

308308

309+
### Metrics Parameters
310+
311+
| Parameter | Description | Default |
312+
|----------------------------------|--------------------------------------------------------------------|-----------|
313+
| `metrics.enabled` | Start a sidecar Prometheus exporter to expose Nginx metrics | `false` |
314+
| `metrics.image.registry` | Nginx exporter image registry | `docker.io` |
315+
| `metrics.image.repository` | Nginx exporter image repository | `nginx/nginx-prometheus-exporter` |
316+
| `metrics.image.tag` | Nginx exporter image tag | `"1.4@sha256:..."` |
317+
| `metrics.image.pullPolicy` | Nginx exporter image pull policy | `Always` |
318+
| `metrics.resources.limits.memory`| Memory limit for metrics container | `64Mi` |
319+
| `metrics.resources.requests.cpu` | CPU request for metrics container | `50m` |
320+
| `metrics.resources.requests.memory`| Memory request for metrics container | `64Mi` |
321+
| `metrics.extraArgs` | Extra arguments for nginx exporter | `[]` |
322+
| `metrics.service.type` | Metrics service type | `ClusterIP` |
323+
| `metrics.service.port` | Metrics service port | `9113` |
324+
| `metrics.service.annotations` | Additional custom annotations for Metrics service | `{}` |
325+
| `metrics.service.loadBalancerIP` | Load balancer IP if metrics service type is `LoadBalancer` | `""` |
326+
| `metrics.service.loadBalancerSourceRanges` | Allowed addresses for LoadBalancer metrics service | `[]` |
327+
| `metrics.service.clusterIP` | Static clusterIP or None for headless metrics service | `""` |
328+
| `metrics.service.nodePort` | NodePort value for LoadBalancer/NodePort metrics service types | `""` |
329+
| `metrics.serviceMonitor.enabled` | Create ServiceMonitor resource(s) for PrometheusOperator | `false` |
330+
| `metrics.serviceMonitor.namespace`| Namespace for ServiceMonitor resource(s) | `""` |
331+
| `metrics.serviceMonitor.interval`| Interval for scraping metrics | `30s` |
332+
| `metrics.serviceMonitor.scrapeTimeout`| Timeout for scraping metrics | `""` |
333+
| `metrics.serviceMonitor.relabelings`| Additional relabeling of metrics | `[]` |
334+
| `metrics.serviceMonitor.metricRelabelings`| Additional metric relabeling of metrics | `[]` |
335+
| `metrics.serviceMonitor.honorLabels`| Honor metrics labels | `false` |
336+
| `metrics.serviceMonitor.selector`| Prometheus instance selector labels | `{}` |
337+
| `metrics.serviceMonitor.annotations`| Additional annotations for ServiceMonitor | `{}` |
338+
| `metrics.serviceMonitor.namespaceSelector`| Namespace selector for ServiceMonitor | `{}` |
339+
340+
**Note:**
341+
To enable metrics, set `metrics.enabled: true` and ensure your Nginx configuration includes a stub status endpoint, e.g.:
342+
```nginx
343+
location /stub_status {
344+
stub_status on;
345+
}
346+
```
347+
348+
309349
### Extra Configuration Parameters
310350

311351
| Parameter | Description | Default |

‎charts/nginx/templates/_helpers.tpl‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,4 +97,11 @@ Return the custom NGINX stream server config configmap.
9797
{{- else -}}
9898
{{- include "common.fullname" . -}}
9999
{{- end -}}
100-
{{- end -}}
100+
{{- end -}}
101+
102+
{{/*
103+
Return the proper Nginx metrics image name
104+
*/}}
105+
{{- define "nginx.metrics.image" -}}
106+
{{- include "common.image" (dict "image" .Values.metrics.image "global" .Values.global) -}}
107+
{{- end }}

‎charts/nginx/templates/deployment.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,49 @@ spec:
202202
{{- toYaml .Values.cloneStaticSiteFromGit.extraVolumeMounts | nindent 12 }}
203203
{{- end }}
204204
{{- end }}
205+
{{- if .Values.metrics.enabled }}
206+
- name: metrics
207+
securityContext: {{ include "common.renderContainerSecurityContext" . | nindent 12 }}
208+
image: {{ include "nginx.metrics.image" . | quote }}
209+
imagePullPolicy: {{ include "common.imagePullPolicy" (dict "image" .Values.metrics.image) }}
210+
command:
211+
- nginx-prometheus-exporter
212+
- --nginx.scrape-uri=http://localhost:8080/stub_status
213+
{{- range .Values.metrics.extraArgs }}
214+
- {{ . }}
215+
{{- end }}
216+
args:
217+
{{- if .Values.metrics.extraArgs }}
218+
{{- range .Values.metrics.extraArgs }}
219+
{{- if not (hasPrefix "--" .) }}
220+
- {{ . }}
221+
{{- end }}
222+
{{- end }}
223+
{{- end }}
224+
ports:
225+
- name: metrics
226+
containerPort: 9113
227+
protocol: TCP
228+
livenessProbe:
229+
httpGet:
230+
path: /
231+
port: metrics
232+
initialDelaySeconds: 15
233+
periodSeconds: 15
234+
timeoutSeconds: 5
235+
failureThreshold: 3
236+
successThreshold: 1
237+
readinessProbe:
238+
httpGet:
239+
path: /
240+
port: metrics
241+
initialDelaySeconds: 5
242+
periodSeconds: 5
243+
timeoutSeconds: 1
244+
failureThreshold: 3
245+
successThreshold: 1
246+
resources: {{- toYaml .Values.metrics.resources | nindent 12 }}
247+
{{- end }}
205248
volumes:
206249
- name: emptydir
207250
emptyDir: {}

0 commit comments

Comments
 (0)