Skip to content

Commit 4604be7

Browse files
mikhail-klimkomikhail-klimko
authored
onprem: 2.8.0-rc.3 (#67)
1 parent b5397ef commit 4604be7

File tree

11 files changed

+124
-49
lines changed

11 files changed

+124
-49
lines changed

‎codefresh/.ci/values/mtls-mongodb-redis.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
seed:
22
mongoSeedJob:
33
mongodbRootURI: mongodb://root:XT9nmM8dZDZ@cf-mongodb:27017/?authSource=admin
4+
mongodbRootOptions: authSource=admin
5+
mongodbRootPassword: XT9nmM8dZDZ
46

57
global:
68
appUrl: "" # placeholder for ${CF_APP_HOST}
@@ -86,9 +88,9 @@ mongodb:
8688
mongosh ${MONGODB_ROOT_URI} --eval "db.getSiblingDB('${MONGODB_DATABASE}').createCollection('test')"
8789
done
8890
89-
mongoimport --uri ${MONGODB_ROOT_URI} --db codefresh --collection idps --type json --legacy --file /usr/share/extras/idps.json
90-
mongoimport --uri ${MONGODB_ROOT_URI} --db codefresh --collection accounts --type json --legacy --file /usr/share/extras/accounts.json
91-
mongoimport --uri ${MONGODB_ROOT_URI} --db codefresh --collection users --type json --legacy --file /usr/share/extras/users.json
91+
# mongoimport --uri ${MONGODB_ROOT_URI} --db codefresh --collection idps --type json --legacy --file /usr/share/extras/idps.json
92+
# mongoimport --uri ${MONGODB_ROOT_URI} --db codefresh --collection accounts --type json --legacy --file /usr/share/extras/accounts.json
93+
# mongoimport --uri ${MONGODB_ROOT_URI} --db codefresh --collection users --type json --legacy --file /usr/share/extras/users.json
9294

9395
extraVolumeMounts:
9496
- name: extras

‎codefresh/Chart.lock‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -64,58 +64,58 @@ dependencies:
6464
version: 1.14.22
6565
- name: cfapi
6666
repository: oci://quay.io/codefresh/charts
67-
version: 21.279.3
67+
version: 21.279.4
6868
- name: cfapi
6969
repository: oci://quay.io/codefresh/charts
70-
version: 21.279.3
70+
version: 21.279.4
7171
- name: cfapi
7272
repository: oci://quay.io/codefresh/charts
73-
version: 21.279.3
73+
version: 21.279.4
7474
- name: cfapi
7575
repository: oci://quay.io/codefresh/charts
76-
version: 21.279.3
76+
version: 21.279.4
7777
- name: cfapi
7878
repository: oci://quay.io/codefresh/charts
79-
version: 21.279.3
79+
version: 21.279.4
8080
- name: cfapi
8181
repository: oci://quay.io/codefresh/charts
82-
version: 21.279.3
82+
version: 21.279.4
8383
- name: cfapi
8484
repository: oci://quay.io/codefresh/charts
85-
version: 21.279.3
85+
version: 21.279.4
8686
- name: cfapi
8787
repository: oci://quay.io/codefresh/charts
88-
version: 21.279.3
88+
version: 21.279.4
8989
- name: cfapi
9090
repository: oci://quay.io/codefresh/charts
91-
version: 21.279.3
91+
version: 21.279.4
9292
- name: cfapi
9393
repository: oci://quay.io/codefresh/charts
94-
version: 21.279.3
94+
version: 21.279.4
9595
- name: cfapi
9696
repository: oci://quay.io/codefresh/charts
97-
version: 21.279.3
97+
version: 21.279.4
9898
- name: cfapi
9999
repository: oci://quay.io/codefresh/charts
100-
version: 21.279.3
100+
version: 21.279.4
101101
- name: cfapi
102102
repository: oci://quay.io/codefresh/charts
103-
version: 21.279.3
103+
version: 21.279.4
104104
- name: cfapi
105105
repository: oci://quay.io/codefresh/charts
106-
version: 21.279.3
106+
version: 21.279.4
107107
- name: cfapi
108108
repository: oci://quay.io/codefresh/charts
109-
version: 21.279.3
109+
version: 21.279.4
110110
- name: cfapi
111111
repository: oci://quay.io/codefresh/charts
112-
version: 21.279.3
112+
version: 21.279.4
113113
- name: cfapi
114114
repository: oci://quay.io/codefresh/charts
115-
version: 21.279.3
115+
version: 21.279.4
116116
- name: cfapi
117117
repository: oci://quay.io/codefresh/charts
118-
version: 21.279.3
118+
version: 21.279.4
119119
- name: cfui
120120
repository: oci://quay.io/codefresh/charts
121121
version: 14.98.27
@@ -167,5 +167,5 @@ dependencies:
167167
- name: salesforce-reporter
168168
repository: oci://quay.io/codefresh/charts
169169
version: 1.30.11
170-
digest: sha256:657e1a67d919daf178a83ddd81736519ea6bdc9a1c0bfb2364dad583586c1c1b
171-
generated: "2025-06-02T16:12:53.480633+03:00"
170+
digest: sha256:5cfbe090f3f9e0ebf2f99d898635689d1eae3812fb3fbced10651809cb176d13
171+
generated: "2025-06-04T16:15:07.062564+03:00"

‎codefresh/Chart.yaml‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
description: Helm Chart for Codefresh On-Prem
33
name: codefresh
4-
version: 2.8.0-rc.2
4+
version: 2.8.0-rc.3
55
keywords:
66
- codefresh
77
home: https://codefresh.io/
@@ -19,11 +19,9 @@ annotations:
1919
# supported kinds are added, changed, deprecated, removed, fixed and security.
2020
artifacthub.io/changes: |
2121
- kind: fixed
22-
description: "Fix dependencies version"
23-
- kind: added
24-
description: "(cf-api): Add ability to assign admin/platform permissions for user for specified group during sync"
22+
description: "(cf-api): Fix internal feature-flags"
2523
- kind: fixed
26-
description: "(platform-analytics/postgresql): Fix pg_partman configuration"
24+
description: "Fix mongo-seed job with Mongo MTLS enabled"
2725
dependencies:
2826
- name: cf-common
2927
repository: oci://quay.io/codefresh/charts

‎codefresh/README.md‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Codefresh On-Premises
22

3-
![Version: 2.8.0-rc.2](https://img.shields.io/badge/Version-2.8.0--rc.2-informational?style=flat-square) ![AppVersion: 2.7.0](https://img.shields.io/badge/AppVersion-2.7.0-informational?style=flat-square)
3+
![Version: 2.8.0-rc.3](https://img.shields.io/badge/Version-2.8.0--rc.3-informational?style=flat-square) ![AppVersion: 2.7.0](https://img.shields.io/badge/AppVersion-2.7.0-informational?style=flat-square)
44

55
Helm chart for deploying [Codefresh On-Premises](https://codefresh.io/docs/docs/getting-started/intro-to-codefresh/) to Kubernetes.
66

@@ -389,6 +389,18 @@ postgresql:
389389
enabled: false
390390
```
391391
392+
Provide the following env vars to enable SSL connection to Postgres:
393+
394+
```yaml
395+
global:
396+
env:
397+
PGSSLMODE: "require"
398+
399+
helm-repo-manager:
400+
env:
401+
POSTGRES_DISABLE_SSL: "false"
402+
```
403+
392404
#### External Redis
393405
394406
```yaml
@@ -2589,6 +2601,8 @@ After platform upgrade, Consul fails with the error `refusing to rejoin cluster
25892601
| seed-e2e | object | `{"affinity":{},"backoffLimit":10,"enabled":false,"image":{"registry":"docker.io","repository":"mongo","tag":"latest"},"nodeSelector":{},"podSecurityContext":{},"resources":{},"tolerations":[],"ttlSecondsAfterFinished":300}` | CI |
25902602
| seed.enabled | bool | `true` | Enable all seed jobs |
25912603
| seed.mongoSeedJob | object | See below | Mongo Seed Job. Required at first install. Seeds the required data (default idp/user/account), creates cfuser and required databases. |
2604+
| seed.mongoSeedJob.env | object | `{}` | Extra env variables for seed job. |
2605+
| seed.mongoSeedJob.mongodbRootOptions | string | `""` | Extra options for connection string (e.g. `authSource=admin`). |
25922606
| seed.mongoSeedJob.mongodbRootPassword | string | `"XT9nmM8dZD"` | Root password in plain text (required ONLY for seed job!). |
25932607
| seed.mongoSeedJob.mongodbRootPasswordSecretKeyRef | object | `{}` | Root password from existing secret |
25942608
| seed.mongoSeedJob.mongodbRootUser | string | `"root"` | Root user in plain text (required ONLY for seed job!). |

‎codefresh/README.md.gotmpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -391,6 +391,18 @@ postgresql:
391391
enabled: false
392392
```
393393

394+
Provide the following env vars to enable SSL connection to Postgres:
395+
396+
```yaml
397+
global:
398+
env:
399+
PGSSLMODE: "require"
400+
401+
helm-repo-manager:
402+
env:
403+
POSTGRES_DISABLE_SSL: "false"
404+
```
405+
394406
#### External Redis
395407

396408
```yaml

‎codefresh/files/mongoSeedJobScript.sh‎

Lines changed: 38 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,12 @@ export MONGODB_ROOT_PASSWORD=...
1212
1313
COMMENT
1414

15-
# set -eou pipefail
15+
if [[ -n $DEBUG ]]; then
16+
set -o xtrace
17+
fi
1618

1719
ASSETS_PATH=${ASSETS_PATH:-/usr/share/extras/}
20+
MTLS_CERT_PATH=${MTLS_CERT_PATH:-/etc/ssl/mongodb/ca.pem}
1821

1922
MONGODB_DATABASES=(
2023
"archive"
@@ -34,12 +37,12 @@ MONGODB_DATABASES=(
3437
)
3538

3639
disableMongoTelemetry() {
37-
mongosh --nodb --eval "disableTelemetry()"
40+
mongosh --nodb --eval "disableTelemetry()" || true
3841
}
3942

4043
waitForMongoDB() {
4144
while true; do
42-
status=$(mongosh ${MONGODB_ROOT_URI} --eval "db.adminCommand('ping')" 2>&1)
45+
status=$(mongosh ${MONGODB_ROOT_URI} ${MONGO_URI_EXTRA_PARAMS} --eval "db.adminCommand('ping')" 2>&1)
4346

4447
echo -e "MongoDB status:\n$status"
4548
if $(echo $status | grep 'ok: 1' -q); then
@@ -56,12 +59,23 @@ parseMongoURI() {
5659
local parameters="$(echo $1 | grep '?' | cut -d '?' -f2)"; if [[ -n $parameters ]]; then parameters="?${parameters}"; fi
5760
local url="$(echo ${1/$proto/})"
5861
local userpass="$(echo $url | grep @ | cut -d@ -f1)"
59-
local hostport="$(echo $url | sed s/$userpass// | sed "s/\/\?$parameters//" | sed -re "s/\/\?|@//g" | sed 's/\/$//')"
62+
if [[ -z $userpass ]]; then
63+
local hostport="$(echo $url | sed "s/\/\?$parameters//" | sed -re "s/\/\?|@//g" | sed 's/\/$//')"
64+
MONGO_URI="$proto$hostport/${MONGODB_DATABASE}$parameters"
65+
else
66+
local hostport="$(echo $url | sed s/$userpass// | sed "s/\/\?$parameters//" | sed -re "s/\/\?|@//g" | sed 's/\/$//')"
67+
MONGODB_PASSWORD="$(echo $userpass | grep : | cut -d: -f2)"
68+
MONGODB_USER="$(echo $userpass | grep : | cut -d: -f1)"
69+
MONGO_URI="$proto$userpass@$hostport/${MONGODB_DATABASE}$parameters"
70+
fi
71+
72+
73+
if [[ -z $MONGODB_ROOT_OPTIONS ]]; then
74+
MONGODB_ROOT_URI="$proto${MONGODB_ROOT_USER}:${MONGODB_ROOT_PASSWORD}@$hostport/admin$parameters"
75+
else
76+
MONGODB_ROOT_URI="$proto${MONGODB_ROOT_USER}:${MONGODB_ROOT_PASSWORD}@$hostport/admin?${MONGODB_ROOT_OPTIONS}"
77+
fi
6078

61-
MONGODB_PASSWORD="$(echo $userpass | grep : | cut -d: -f2)"
62-
MONGODB_USER="$(echo $userpass | grep : | cut -d: -f1)"
63-
MONGO_URI="$proto$userpass@$hostport/${MONGODB_DATABASE}$parameters"
64-
MONGODB_ROOT_URI="$proto${MONGODB_ROOT_USER}:${MONGODB_ROOT_PASSWORD}@$hostport/admin$parameters"
6579
}
6680

6781
getMongoVersion() {
@@ -82,6 +96,14 @@ setPacks() {
8296

8397
parseMongoURI $MONGO_URI
8498

99+
if [[ -s ${MTLS_CERT_PATH} ]]; then
100+
MONGO_URI_EXTRA_PARAMS="--tls --tlsCertificateKeyFile ${MTLS_CERT_PATH} --tlsAllowInvalidHostnames --tlsAllowInvalidCertificates"
101+
MONGOIMPORT_EXTRA_PARAMS="--ssl --sslPEMKeyFile ${MTLS_CERT_PATH} --sslAllowInvalidHostnames --sslAllowInvalidCertificates"
102+
else
103+
MONGO_URI_EXTRA_PARAMS=""
104+
MONGOIMPORT_EXTRA_PARAMS=""
105+
fi
106+
85107
disableMongoTelemetry
86108

87109
waitForMongoDB
@@ -90,20 +112,20 @@ getMongoVersion
90112

91113
for MONGODB_DATABASE in ${MONGODB_DATABASES[@]}; do
92114
waitForMongoDB
93-
mongosh ${MONGODB_ROOT_URI} --eval "db.getSiblingDB(\"${MONGODB_DATABASE}\").createUser({user: \"${MONGODB_USER}\", pwd: \"${MONGODB_PASSWORD}\", roles: [\"readWrite\"]})" 2>&1 || true
115+
mongosh ${MONGODB_ROOT_URI} ${MONGO_URI_EXTRA_PARAMS} --eval "db.getSiblingDB(\"${MONGODB_DATABASE}\").createUser({user: \"${MONGODB_USER}\", pwd: \"${MONGODB_PASSWORD}\", roles: [\"readWrite\"]})" 2>&1 || true
94116
waitForMongoDB
95-
mongosh ${MONGODB_ROOT_URI} --eval "db.getSiblingDB(\"${MONGODB_DATABASE}\").changeUserPassword(\"${MONGODB_USER}\",\"${MONGODB_PASSWORD}\")" 2>&1 || true
117+
mongosh ${MONGODB_ROOT_URI} ${MONGO_URI_EXTRA_PARAMS} --eval "db.getSiblingDB(\"${MONGODB_DATABASE}\").changeUserPassword(\"${MONGODB_USER}\",\"${MONGODB_PASSWORD}\")" 2>&1 || true
96118
done
97119

98-
mongosh ${MONGODB_ROOT_URI} --eval "db.getSiblingDB(\"codefresh\").grantRolesToUser( \"${MONGODB_USER}\", [ { role: \"readWrite\", db: \"pipeline-manager\" } ] )" 2>&1 || true
99-
mongosh ${MONGODB_ROOT_URI} --eval "db.getSiblingDB(\"codefresh\").grantRolesToUser( \"${MONGODB_USER}\", [ { role: \"readWrite\", db: \"platform-analytics-postgres\" } ] )" 2>&1 || true
100-
mongosh ${MONGODB_ROOT_URI} --eval "db.getSiblingDB(\"codefresh\").changeUserPassword(\"${MONGODB_USER}\",\"${MONGODB_PASSWORD}\")" 2>&1 || true
120+
mongosh ${MONGODB_ROOT_URI} ${MONGO_URI_EXTRA_PARAMS} --eval "db.getSiblingDB(\"codefresh\").grantRolesToUser( \"${MONGODB_USER}\", [ { role: \"readWrite\", db: \"pipeline-manager\" } ] )" 2>&1 || true
121+
mongosh ${MONGODB_ROOT_URI} ${MONGO_URI_EXTRA_PARAMS} --eval "db.getSiblingDB(\"codefresh\").grantRolesToUser( \"${MONGODB_USER}\", [ { role: \"readWrite\", db: \"platform-analytics-postgres\" } ] )" 2>&1 || true
122+
mongosh ${MONGODB_ROOT_URI} ${MONGO_URI_EXTRA_PARAMS} --eval "db.getSiblingDB(\"codefresh\").changeUserPassword(\"${MONGODB_USER}\",\"${MONGODB_PASSWORD}\")" 2>&1 || true
101123

102124
if [[ $DEVELOPMENT_CHART == "true" ]]; then
103125
setSystemAdmin
104126
setPacks
105127
fi
106128

107-
mongoimport --uri ${MONGO_URI} --collection idps --type json --legacy --file ${ASSETS_PATH}idps.json
108-
mongoimport --uri ${MONGO_URI} --collection accounts --type json --legacy --file ${ASSETS_PATH}accounts.json
109-
mongoimport --uri ${MONGO_URI} --collection users --type json --legacy --file ${ASSETS_PATH}users.json
129+
mongoimport --uri ${MONGO_URI} ${MONGOIMPORT_EXTRA_PARAMS} --collection idps --type json --legacy --file ${ASSETS_PATH}idps.json
130+
mongoimport --uri ${MONGO_URI} ${MONGOIMPORT_EXTRA_PARAMS} --collection accounts --type json --legacy --file ${ASSETS_PATH}accounts.json
131+
mongoimport --uri ${MONGO_URI} ${MONGOIMPORT_EXTRA_PARAMS} --collection users --type json --legacy --file ${ASSETS_PATH}users.json

‎codefresh/files/postgresSeedJobScript.sh‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
#!/bin/bash
22

3-
set -xeuo pipefail
3+
DEBUG="${DEBUG:-false}"
4+
5+
set -euo pipefail
6+
7+
if [[ $DEBUG == "true" ]]; then
8+
set -xeuo pipefail
9+
echo "Running in debug mode"
10+
fi
411

512
POSTGRES_DATABASES=(
613
"codefresh"
@@ -51,4 +58,4 @@ function runSeed() {
5158
done
5259
}
5360

54-
runSeed
61+
runSeed

‎codefresh/templates/secrets/secret.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ data:
1717
MONGODB_PROTOCOL: {{ coalesce .Values.global.mongodbProtocol | default "mongodb" | b64enc }}
1818

1919
# legacy MONGODB_* secrets
20-
MONGODB_ROOT_USER: {{ coalesce .Values.global.mongodbRootUser .Values.seed.mongoSeedJob.mongodbRootUser | b64enc }}
21-
MONGODB_ROOT_PASSWORD: {{ urlquery (coalesce .Values.global.mongodbRootPassword .Values.seed.mongoSeedJob.mongodbRootPassword) | b64enc }}
20+
MONGODB_ROOT_USER: {{ coalesce .Values.seed.mongoSeedJob.mongodbRootUser .Values.global.mongodbRootUser | b64enc }}
21+
MONGODB_ROOT_PASSWORD: {{ urlquery (coalesce .Values.seed.mongoSeedJob.mongodbRootPassword .Values.global.mongodbRootPassword) | b64enc }}
2222
MONGO_URI: {{ .Values.global.mongoURI | default "empty" | b64enc}}
2323
MONGO_URI_RE_MANAGER: {{ include (printf "%s.classic.calculateMongoUri" $libTemplateName) (dict "dbName" "runtime-environment-manager" "mongoURI" .Values.global.mongoURI) | default "empty" | b64enc }}
2424
MONGODB_RE_DATABASE: {{ printf "%s" "runtime-environment-manager" | b64enc }}

‎codefresh/templates/seed/mongo-seed-job.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,19 @@ spec:
5252
{{- include "codefresh.mongodb-root-user-env-var-value" . | indent 12 }}
5353
- name: MONGODB_ROOT_PASSWORD
5454
{{- include "codefresh.mongodb-root-password-env-var-value" . | indent 12 }}
55+
- name: MONGODB_ROOT_OPTIONS
56+
value: {{ .Values.seed.mongoSeedJob.mongodbRootOptions | quote }}
5557
- name: DEVELOPMENT_CHART
5658
value: {{ .Values.developmentChart | quote }}
59+
{{- range $env, $val := .Values.seed.mongoSeedJob.env }}
60+
- name: {{ $env }}
61+
value: {{ $val | quote }}
62+
{{ end }}
63+
{{- range $env, $val := .Values.global.env }}
64+
- name: {{ $env }}
65+
value: {{ $val | quote }}
66+
{{ end }}
67+
5768
command:
5869
- "/bin/bash"
5970
- "-exc"

‎codefresh/templates/seed/postgres-seed-job.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,10 @@ spec:
4949
{{- include "codefresh.postgres-seed-user-env-var-value" . | indent 12 }}
5050
- name: POSTGRES_SEED_PASSWORD
5151
{{- include "codefresh.postgres-seed-password-env-var-value" . | indent 12 }}
52+
{{- range $env, $val := .Values.global.env }}
53+
- name: {{ $env }}
54+
value: {{ $val | quote }}
55+
{{ end }}
5256
resources:
5357
{{- toYaml .Values.seed.resources | nindent 10 }}
5458
command:

0 commit comments

Comments
 (0)