Skip to content

Commit 142ef88

Browse files
committed
Merge branch 'master' into Sheshagiri/master
2 parents 26d4214 + dbcd54d commit 142ef88

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+7419
-1600
lines changed

.circleci/config.yml

Lines changed: 20 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,8 @@ version: 2.1
44
orbs:
55
# https://circleci.com/orbs/registry/orb/circleci/kubernetes
66
kubernetes: circleci/[email protected]
7-
# Pins Helm to v2.x
8-
# TODO: Consider upgrading Helm to v3.0 (https://github.com/StackStorm/stackstorm-ha/issues/98)
97
# https://circleci.com/orbs/registry/orb/circleci/helm
10-
helm: circleci/helm@0.2.3
8+
helm: circleci/helm@1.1.1
119
# https://circleci.com/orbs/registry/orb/ccpgames/minikube
1210
minikube: ccpgames/[email protected]
1311

@@ -16,37 +14,26 @@ jobs:
1614
helm-lint:
1715
working_directory: ~/stackstorm-ha
1816
docker:
19-
# Pin Helm to v2.x, see https://github.com/StackStorm/stackstorm-ha/issues/98
20-
- image: lachlanevenson/k8s-helm:v2.16.9
17+
- image: lachlanevenson/k8s-helm:v3.5.3
2118
steps:
2219
- checkout
2320
- run:
2421
name: Prepare Helm
2522
command: |
2623
set -x
27-
helm init --client-only
2824
helm dependency update
2925
- run:
30-
name: Helm Lint Check (Community)
26+
name: Helm Lint Check
3127
command: helm lint
32-
- run:
33-
name: Helm Lint Check (Enterprise)
34-
command: helm lint --set enterprise.enabled=true --set enterprise.license=123asd456fake
3528
- run:
3629
name: Helm template
3730
command: |
38-
mkdir -p enterprise community
31+
mkdir -p community
3932
helm template --output-dir community .
40-
helm template --output-dir enterprise --set enterprise.enabled=true --set enterprise.license=123asd456fake .
4133
- persist_to_workspace:
4234
root: ~/stackstorm-ha/
4335
paths:
4436
- community
45-
- enterprise
46-
# TODO: Fill an issue in https://github.com/garethr/kubeval
47-
# 'charts' contains 3rd party templates which doesn't validate against schema due to minor 'object != null' API validation issues
48-
# See: https://circleci.com/gh/StackStorm/stackstorm-enterprise-ha/18
49-
#- charts
5037

5138
# Run Kubernetes lint checks
5239
k8s-lint:
@@ -56,64 +43,58 @@ jobs:
5643
- attach_workspace:
5744
at: .
5845
- run:
59-
name: K8s Kubeval Lint Check (Community)
46+
name: K8s Kubeval Lint Check
6047
command: kubeval $(find . -type f)
6148
working_directory: community/stackstorm-ha/templates/
62-
- run:
63-
name: K8s Kubeval Lint Check (Enterprise)
64-
command: kubeval $(find . -type f)
65-
working_directory: enterprise/stackstorm-ha/templates/
6649

6750
# Spin up minikube K8s cluster and run Helm chart & e2e tests on it
6851
helm-e2e:
6952
# 'large' 4 vCPUs & 15GB RAM CircleCI machine executor
70-
# required to deploy heavy 'stackstorm-ha' Helm release with RabbitMQ, MongoDB, etcd clusters and 25+ st2 Pods.
53+
# required to deploy heavy 'stackstorm-ha' Helm release with RabbitMQ, MongoDB, Redis clusters and 25+ st2 Pods.
7154
# https://circleci.com/docs/2.0/configuration-reference/#machine-executor-linux
7255
resource_class: large
7356
machine:
7457
# Available images https://circleci.com/docs/2.0/configuration-reference/#available-machine-images
75-
image: ubuntu-1604:201903-01
58+
image: ubuntu-2204:2022.04.1
7659
steps:
7760
- checkout
7861
- kubernetes/install
7962
- minikube/minikube-install:
8063
# https://github.com/kubernetes/minikube/releases
81-
version: v1.10.1
64+
version: v1.15.1
8265
- run:
8366
name: Install dependencies
8467
command: |
8568
sudo apt update || true
8669
# K8s 1.18 requires conntrack
8770
# See: https://github.com/kubernetes/minikube/issues/7179
8871
sudo apt install -y conntrack
72+
- run:
73+
name: Install Helm v3
74+
command: curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
8975
- run:
9076
name: Create new K8s cluster
9177
command: sudo -E minikube start --vm-driver=none
9278
environment:
9379
CHANGE_MINIKUBE_NONE_USER: true
94-
- helm/install-helm-on-cluster
9580
- run:
9681
name: Update stackstorm-ha chart dependencies
9782
command: helm dependency update
9883
- run:
99-
name: Helm install stackstorm-ha chart (Community)
100-
command: helm install --timeout 600 --debug --wait --name stackstorm-ha .
84+
name: Helm install stackstorm-ha chart
85+
command: helm install --timeout 10m0s --debug --wait --name-template stackstorm-ha .
10186
- run:
102-
name: Helm test (Community)
103-
command: helm test stackstorm-ha --parallel --cleanup
104-
- run:
105-
when: always
106-
name: Show created K8s resources (Community)
107-
command: kubectl get all
87+
name: Helm test
88+
command: helm test stackstorm-ha
10889
- run:
109-
name: Helm upgrade stackstorm-ha (Community -> Enterprise)
110-
command: helm upgrade --wait stackstorm-ha . --set enterprise.enabled=true --set enterprise.license=${EWC_LICENSE}
90+
name: Helm upgrade with RBAC enabled
91+
command: helm upgrade --set st2.rbac.enabled=true --timeout 5m0s --debug --wait stackstorm-ha .
11192
- run:
112-
name: Helm test (Enterprise)
113-
command: helm test stackstorm-ha --parallel
93+
name: Helm test with RBAC enabled
94+
command: helm test stackstorm-ha
11495
- run:
11596
when: always
116-
name: Show created K8s resources (Enterprise)
97+
name: Show created K8s resources
11798
command: kubectl get all
11899

119100
workflows:

.github/FUNDING.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# https://stackstorm.com/2020/06/12/sponsoring-stackstorm/
2+
# FAQ: https://stackstorm.com/donate/
3+
# Expenses: https://github.com/StackStorm/discussions/issues/36
4+
community_bridge: stackstorm

.github/workflows/unit-tests.yaml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
name: Unit Tests
3+
4+
on:
5+
push:
6+
branches:
7+
- master
8+
pull_request:
9+
branches:
10+
- master
11+
12+
jobs:
13+
helm-unittest:
14+
15+
runs-on: ubuntu-latest
16+
# strategy:
17+
# matrix:
18+
# Relevant tools installed by default on ubuntu 20.04:
19+
# - helm 3.8.0
20+
# - jq 1.6
21+
# - kind 0.11.1
22+
# - kubectl 1.23.3
23+
# - minikube 1.25.1
24+
# - python 3.8.10
25+
# - yamllint 1.26.3
26+
# - yq 4.19.1
27+
# see: https://github.com/actions/virtual-environments/blob/main/images/linux/Ubuntu2004-Readme.md
28+
29+
steps:
30+
- uses: actions/checkout@v2
31+
32+
- name: Install helm-unittest
33+
# We should periodically check to see if another fork has taken over maintenance,
34+
# as the de-facto "best" fork has changed several times over the years.
35+
run: |
36+
helm plugin install https://github.com/quintush/helm-unittest
37+
38+
- name: Install chart dependencies
39+
run: |
40+
helm dependency update
41+
42+
- name: Run helm-unittest
43+
# by default looks for tests/*_test.yaml
44+
run: |
45+
helm unittest --color --helm3 -f 'tests/unit/*_test.yaml' .

CHANGELOG.md

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,103 @@
11
# Changelog
22

3+
## In Development
4+
* Temporary workaround for #311 to use previous bitnami index from: https://github.com/bitnami/charts/issues/10539 (#312 #318) (by @0xhaven)
5+
* Refactor label definitions to be more consistent by building labels and label selectors in partial helper templates. (#299) (by @cognifloyd)
6+
* Use the correct `apiVersion` for `Ingress` to add support for Kubernetes `v1.22`. (by @arms11)
7+
8+
## v0.100.0
9+
* Switch st2 to `v3.7` as a new default stable version (#274)
10+
* Upgrade MongoDB `v4.0` -> `v4.4` as 4.0 has reached its EOL. (#304)
11+
* Migrate from `python 3.6` `Ubuntu Bionic` to `python 3.8` `Ubuntu Focal` as a base StackStorm OS (StackStorm/st2-dockerfiles#54)
12+
* Add support for use of overrides that are available in `v3.7` of st2 via helm charts. (#306)
13+
14+
## v0.90.0
15+
* Advanced Feature: Make securityContext (on Deployments/Jobs) and podSecurityContext (on Pods) configurable. This allows dropping all capabilities, for example. You can override the securityContext for `st2actionrunner`, `st2sensorcontainer`, and `st2client` if your actions or sensors need, for example, additional capabilites that the rest of StackStorm does not need. (#271) (by @cognifloyd)
16+
* Prefix template helpers with chart name and format helper comments as template comments. (#272) (by @cognifloyd)
17+
* New feature: Add `extra_volumes` to all python-based st2 deployments. This can facilitate changing log levels by loading logging conf file(s) from a custom ConfigMap. (#276) (by @cognifloyd)
18+
* Initialize basic unittest infrastructure using `helm-unittest`. Added tests for labels, custom annotations, SecurityContext, pullSecrets, pullPolicy, Resources, nodeSelector, tolerations, affinity, dnsPolicy, dnsConfig, ServiceAccount attach, postStartScript, both sensor-modes, env, envFrom, st2.packs.images, and st2.packs.volumes. (#284, #288, #292)
19+
* Allow partitioning sensors using the hash_range strategy instead of one sensor per pod. (#218) (by @cognifloyd)
20+
* New feature to include possibility for external services in st2api, st2stream and st2auth, setting default value for this services as `ClusterIP` and `hostname: ""`. Also, added new entry for custom_annotations_test.yaml and created new unit test services_test.yaml. (by @sandesvitor)
21+
* Advanced Feature: Add extra Helm hook Jobs. This minimizes the boilerplate required to run stackstorm workflows at various helm hook stages: post-install, pre-upgrade, post-upgrade. (#265) (by @cognifloyd)
22+
23+
## v0.80.0
24+
* Switch st2 to `v3.6` as a new default stable version (#274)
25+
* Explicitly differentiate sensor modes: `all-sensors-in-one-pod` vs `one-sensor-per-pod`. Exposes the mode in new `stackstorm/sensor-mode` annotation. (#222) (by @cognifloyd)
26+
* Allow adding custom env variables to any Deployment or Job. (#120) (by @AngryDeveloper)
27+
* Template the contents of st2.config and the values in st2chatops.env. This allows adding secrets defined elsewhere in values. (#249) (by @cognifloyd)
28+
* Set default/sample RBAC config files to "" (empty string) to prevent adding them. This is needed because they cannot be removed by overriding the roles/mappings values. (#247) (by @cognifloyd)
29+
* Make configuring `stackstorm/sensor-mode=all-sensors-in-one-pod` more obvious by using `st2.packs.sensors` only for `one-sensor-per-pod`. `all-sensors-in-one-pod` mode now only uses values from `st2sensorcontainer`. (#246) (by @cognifloyd)
30+
* Use "--convert" when loading keys into datastore (in key-load Job) so that `st2.keyvalue[].value` can be any basic JSON data type. (#253) (by @cognifloyd)
31+
* New feature: Add `extra_volumes` to `st2actionrunner`, `st2client`, `st2sensorcontainer`. This is useful for loading volumes to be used by actions or sensors. This might include secrets (like ssl certificates) and configuration (like system-wide ansible.cfg). (#254) (by @cognifloyd)
32+
* Some `helm upgrades` do not need to run all the jobs. An upgrade that only touches RBAC config, for example, does not need to run the register-content job. Use `--set 'jobs.skip={apikey_load,key_load,register_content}'` to skip the other jobs. (#255) (by @cognifloyd)
33+
* Refactor deployments/jobs to inject st2 username/password via `envFrom` instead of via `env`. (#257) (by @cognifloyd)
34+
* New feature: Add `envFromSecrets` to `st2actionrunner`, `st2client`, `st2sensorcontainer`, and jobs. This is useful for adding custom secrets to the environment. This complements the `extra_volumes` feature (loading secrets as files) to facilitate loading secrets that are not easily injected via the filesystem. (#259) (by @cognifloyd)
35+
* New feature to include `nodeSelector`, `affinity` and `tolerations` to `st2client`, allowing more flexibility to pod positioning. (#263) (by @sandesvitor)
36+
* Template `~/.st2/config`. This allows customizing the settings used by the `st2client` and jobs pods for using the st2 apis. (#262) (by @cognifloyd)
37+
* Fix indent for lifecycle postStart hook of `st2web` pod. (#268) (by @cognifloyd)
38+
* Advanced Feature: Allow `st2web` to serve HTTPS when the ssl certs are provided via `st2web.extra_volumes`. To enable this, add `ST2WEB_HTTPS: "1"` to `st2web.env` in your values file. (#264) (by @cognifloyd)
39+
* Custom annotations now apply to deployments and jobs, not just pods. (#270) (by @cognifloyd)
40+
* BREAKING CHANGE: Auto-generate `datastore_crypto_key` on install if not provided. This way all HA installs will have a datastore_crypto_key configured. This is only a breaking change for installations that do not want a `datastore_crypto_key`. To disable set `datastore_crypto_key` to `disable` instead of setting it to `""`, `null`, or leaving it unset. (#266) (by @cognifloyd)
41+
42+
## v0.70.0
43+
* New feature: Shared packs volumes `st2.packs.volumes`. Allow using cluster-specific persistent volumes to store packs, virtualenvs, and (optionally) configs. This enables using `st2 pack install`. It even works with `st2packs` images in `st2.packs.images`. (#199) (by @cognifloyd)
44+
* Updated redis constant sentinel ID which will allow other sentinel peers to update to the new given IP in case of pod failure or worker node reboots. (#191) (by @manisha-tanwar)
45+
* Removed reference to st2-license pullSecrets, which was missed when removing enterprise flags (#192) (by @cognifloyd)
46+
* Add optional imagePullSecrets to ServiceAccount using `serviceAccount.pullSecret` from values.yaml. If pods do not have imagePullSecrets (eg without `image.pullSecret` in values.yaml), k8s populates them from the ServiceAccount. (#196 & #239) (by @cognifloyd)
47+
* Reformat some yaml strings so that single quotes wrap strings that include double quotes (#194) (by @cognifloyd)
48+
* st2chatops change: If `st2chatops.env.ST2_API_KEY` is defined, do not set `ST2_AUTH_USERNAME` or `ST2_AUTH_PASSWORD` env vars any more. (#197) (by @cognifloyd)
49+
* Add image.tag overrides for all deployments. (#200) (by @cognifloyd)
50+
* If your k8s cluster admin requires custom annotations (eg: to indicate mongo or rabbitmq usage), you can now add those to each set of pods. (#195) (by @cognifloyd)
51+
* BREAKING CHANGE: Move secrets.st2.* values into st2.* (#203) (by @cognifloyd)
52+
* Auto-generate password and ssh_key secrets. (#203) (by @cognifloyd)
53+
* Add optional hubot-scripts volume to st2chatops pod. To add this, define `st2chatops.hubotScriptsVolume`. (#207) (by @cognifloyd)
54+
* Add advanced pod placment (nodeSelector, affinity, tolerations) to specs for batch Jobs pods. (#193) (by @cognifloyd)
55+
* Allow adding dnsPolicy and/or dnsConfig to all pods. (#201) (by @cognifloyd)
56+
* Move st2-config-vol volume definition and list of st2-config-vol volumeMounts to helpers to reduce duplication (#198) (by @cognifloyd)
57+
* Fix permissions for /home/stanley/.ssh/stanley_rsa using the postStart lifecycle hook (#219) (by @cognifloyd)
58+
* Make system_user configurable when using custom st2actionrunner images that do not provide stanley (#220) (by @cognifloyd)
59+
* Allow providing scripts in values for use in lifecycle postStart hooks of all deployments. (#206) (by @cognifloyd)
60+
* Add preRegisterContentCommand in an initContainer for register-content job to run last-minute content customizations (#213) (by @cognifloyd)
61+
* Fix a bug when datastore cryto keys are not able to read by the rules engine. ``datastore_crypto_key`` volume is now mounted on the ``st2rulesengine`` pods (#223) (by @moti1992)
62+
* Minimize required sensor config by using default values from st2sensorcontainer for each sensor in st2.packs.sensors (#221) (by @cognifloyd)
63+
* Do not template rabbitmq secrets file unless rabbitmq subchart is enabled. (#242) (by @cognifloyd)
64+
* Automatically stringify st2chatop.env values if needed. (#241) (by @cognifloyd)
65+
66+
## v0.60.0
67+
* Switch st2 version to `v3.5dev` as a new latest development version (#187)
68+
* Change st2packs definition to a list, to support multiple st2packs containers (#166) (by @moonrail)
69+
* Enabled RBAC/LDAP configuration for OSS version, removed enterprise flags (#182) (by @hnanchahal)
70+
* Fixed datastore_crypto_key secret name for rules engine (#188) (by @lordpengwin)
71+
72+
## v0.52.0
73+
* Improve resource allocation and scheduling by adding resources requests cpu/memory values for st2 Pods (#179)
74+
* Avoid cluster restart loop situations by making st2 Pod initContainers to wait for DB/MQ connection (#178)
75+
* Add option to define config.js for st2web (#165) (by @moonrail)
76+
77+
## v0.51.0
78+
* Added Redis with Sentinel to replace etcd as a coordination backend (#169)
79+
80+
## v0.50.0
81+
* Drop Helm `v2` support and fully migrate to Helm `v3` (#163)
82+
* Switch dependencies from deprecated `helm/charts` to new Bitnami Subcharts (#163)
83+
84+
## v0.41.0
85+
* Fix Helm 2 repository location to a new working URL https://charts.helm.sh/stable (#164) (by @manisha-tanwar)
86+
87+
## v0.40.0
88+
* Switch st2 version to `v3.4dev` as a new latest development version (#157)
89+
* Disable Enterprise testing in CI (#157)
90+
* Change pullPolicy to "IfNotPresent", as Docker-Hub Ratelimits now (#159) (by @moonrail)
91+
* Update `rabbitmq-ha` 3rd party chart from `1.44.1` to `1.46.1` (#158) (by @moonrail)
92+
* Enable `rabbitmqErlangCookie` for `rabbitmq-ha` by default, to ensure cluster-redeployments do not fail (#158) (by @moonrail)
93+
* Add `forceBoot` for `rabbitmq-ha` by default, to ensure cluster-redeployments do not fail due to unclean exits (#158) (by @moonrail)
94+
* Add option to define pull secret for st2 images (#162) (by @moonrail)
95+
96+
## v0.32.0
97+
* Fix a bug when datastore encrypted keys didn't work in scheduled rules. datastore_crypto_key is now shared with the ``st2scheduler`` pods (#148) (by @rahulshinde26)
98+
* Change NOTES.txt template for using ST2 CLI to include namespace argument in 'kubectl exec' command (#150) (by @rahulshinde26)
99+
* Move the apiVersion `extensions/v1beta1` to `networking.k8s.io/v1beta1` for ingress (#149) (by @jb-abbadie)
100+
3101
## v0.31.0
4102
* Fix chart compatibility with Helm versions >= `2.16.8` by downgrading `mongodb-replicaset` from `3.14.0` to `3.12.0` (#137) (by @AbhyudayaSharma)
5103
* Allow injection of datastore key in cluster (#115) (by @AngryDeveloper)

Chart.yaml

Lines changed: 31 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,46 @@
1-
apiVersion: v1
2-
# Update StackStorm version here to rely on other Docker images tags
3-
appVersion: 3.3dev
1+
apiVersion: v2
2+
# StackStorm version which refers to Docker images tag
3+
appVersion: "3.7"
44
name: stackstorm-ha
5-
version: 0.31.0
5+
version: 0.100.0
66
description: StackStorm K8s Helm Chart, optimized for running StackStorm in HA environment.
7-
home: https://stackstorm.com/#product
8-
icon: https://avatars1.githubusercontent.com/u/4969009
7+
home: https://stackstorm.com/
8+
icon: https://landscape.cncf.io/logos/stack-storm.svg
99
source:
10-
- https://github.com/stackstorm/stackstorm-ha
10+
- https://github.com/stackstorm/stackstorm-k8s
1111
keywords:
1212
- st2
1313
- stackstorm
1414
- devops
15+
- SRE
16+
- automation
1517
- chatops
1618
- event-driven
1719
- auto-remediation
1820
- IFTTT
1921
- HA
2022
maintainers:
21-
- name: Eugen C.
23+
- name: Eugen Cusmaunsa
24+
2225
url: https://github.com/armab
23-
- name: Warren Van Winckel
24-
url: https://github.com/warrenvw
2526
details:
26-
This Helm chart is a fully installable app that codifies StackStorm cluster optimized for HA and K8s environment.
27-
By default FOSS community version of st2 will be installed. Enterprise version can be enabled as an option.
28-
For configuration details check 'values.yaml'.
27+
This Helm chart is a fully installable app that codifies StackStorm cluster deployment optimized for HA and K8s environment.
28+
RabbitMQ-HA, MongoDB-HA clusters and Redis coordination backend st2 relies on will be deployed as 3rd party chart dependencies.
29+
For configuration details please check default values.yaml and README.
30+
dependencies:
31+
- name: rabbitmq
32+
version: 8.0.2
33+
repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
34+
condition: rabbitmq.enabled
35+
- name: mongodb
36+
version: 10.0.1
37+
repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
38+
condition: mongodb.enabled
39+
- name: external-dns
40+
version: 4.0.0
41+
repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
42+
condition: external-dns.enabled
43+
- name: redis
44+
version: 12.3.2
45+
repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
46+
condition: redis.enabled

0 commit comments

Comments
 (0)