Merge branch 'main' into dependabot/github_actions/github-actions-dependencies-7f8b2388fc

Author: svcAPLBot

chart/chart-index/Chart.yaml

@@ -9,7 +9,7 @@ dependencies:
     version: 9.4.17
     repository: https://argoproj.github.io/argo-helm
   - name: argocd-image-updater
-    version: 1.0.1
+    version: 1.1.4
     repository: oci://ghcr.io/argoproj/argo-helm/argocd-image-updater
   - name: cert-manager
     version: v1.19.4

charts/argocd-image-updater/Chart.yaml

@@ -1,12 +1,12 @@
 annotations:
   artifacthub.io/changes: |
-    - kind: changed
-      description: Bump argocd-image-updater to v1.0.1
+    - kind: added
+      description: Add service.enabled value to allow Service creation independently of ingress.enabled
   artifacthub.io/signKey: |
     fingerprint: 2B8F22F57260EFA67BE1C5824B11F800CD9D2252
     url: https://argoproj.github.io/argo-helm/pgp_keys.asc
 apiVersion: v2
-appVersion: v1.0.1
+appVersion: v1.1.1
 description: A Helm chart for Argo CD Image Updater, a tool to automatically update
   the container images of Kubernetes workloads which are managed by Argo CD
 home: https://github.com/argoproj-labs/argocd-image-updater
@@ -20,4 +20,4 @@ maintainers:
   url: https://argoproj.github.io/
 name: argocd-image-updater
 type: application
-version: 1.0.1
+version: 1.1.4

charts/argocd-image-updater/README.md

@@ -10,18 +10,34 @@ docker run --rm --volume "$(pwd):/helm-docs" -u $(id -u) jnorwood/helm-docs:late
 ## Installation
 
 ```console
-helm install oci://ghcr.io/argoproj/argo-helm/argocd-image-updater --namespace argocd-image-updater-system
+helm install oci://ghcr.io/argoproj/argo-helm/argocd-image-updater --namespace <desired installation namespace>
 ```
 
 If you still use the classic approach of installing Helm charts (non-OCI), you can do so by adding the Argo Helm repository and installing the chart with the following commands:
 
 ```console
 helm repo add argo https://argoproj.github.io/argo-helm
-helm install argocd-image-updater argo/argocd-image-updater --namespace argocd-image-updater-system
+helm install argocd-image-updater argo/argocd-image-updater --namespace <desired installation namespace>
 ```
 
 The Argo CD Image Updater controller **must** be run in the same Kubernetes cluster where your Argo CD `Application` resources are managed. The current controller architecture (v1.0+) does not support connecting to a remote Kubernetes cluster to manage applications.
 
+### Choosing the installation namespace
+
+> You have two options for where to install the Argo CD Image Updater:
+>
+> #### Option 1: Install into the Argo CD namespace (Recommended)
+>
+> The simplest approach is to install the image updater into the same namespace as your Argo CD installation. This
+> requires minimal configuration. (..)
+>
+> #### Option 2: Install into a separate namespace
+>
+> For better workload isolation, you can install the image updater into its own namespace. This use case requires
+> several manual configuration steps. (..)
+
+For the full details, please read [Installation methods] in the upstream docs.
+
 ## Prerequisites
 
 * Helm v3.0.0+
@@ -32,6 +48,13 @@ For full list of changes please check ArtifactHub [changelog].
 
 Highlighted versions provide information about additional steps that should be performed by user when upgrading to newer version.
 
+### 1.0.3 (app version 1.0.2)
+
+The upstream project changed the recommended installation namespace from `argocd-image-updater-system` to the same
+namespace as Argo CD is installed in.
+
+Please read [Installation methods] and/or [PR #1356] for more information.
+
 ### 1.0.0
 
 This chart release includes the upstream breaking changes introduced in Argo CD Image Updater 1.0.0.
@@ -124,6 +147,7 @@ The `config.registries` value can be used exactly as it looks in the documentati
 | resources | object | `{}` | Pod memory and cpu resource settings for the deployment |
 | securityContext | object | See [values.yaml] | Security context settings for the deployment |
 | service.annotations | object | `{}` | Service annotations |
+| service.enabled | bool | `false` | Enable a Service for the webhook endpoint. A Service is created when this is set to true or when `ingress.enabled` is true |
 | service.externalIPs | list | `[]` | Service external IPs |
 | service.externalTrafficPolicy | string | `"Cluster"` | Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints |
 | service.labels | object | `{}` | Service labels |
@@ -150,3 +174,5 @@ Autogenerated from chart metadata using [helm-docs](https://github.com/norwoodj/
 
 [Configuration of Container Registries]: https://argocd-image-updater.readthedocs.io/en/stable/configuration/registries/
 [Support ECR authentication]: https://github.com/argoproj-labs/argocd-image-updater/issues/112
+[Installation methods]: https://github.com/argoproj-labs/argocd-image-updater/blob/v1.0.2/docs/install/installation.md#installation-methods
+[PR #1356]: https://github.com/argoproj-labs/argocd-image-updater/pull/1356

charts/argocd-image-updater/crds/crd-imageupdaters.yaml

@@ -47,7 +47,7 @@ spec:
               applicationRefs:
                 description: |-
                   ApplicationRefs indicates the set of applications to be managed.
-                  ApplicationRefs is a list of rules to select Argo CD Applications within the `spec.namespace`.
+                  ApplicationRefs is a list of rules to select Argo CD Applications within the ImageUpdater CR's namespace.
                   Each reference can also provide specific overrides for the global settings defined above.
                 items:
                   description: ApplicationRef contains various criteria by which to
@@ -57,6 +57,7 @@ spec:
                       description: |-
                         CommonUpdateSettings overrides the global CommonUpdateSettings for applications
                         matched by this selector.
+                        This field is ignored when UseAnnotations is true.
                       properties:
                         allowTags:
                           description: |-
@@ -103,6 +104,7 @@ spec:
                         Images contains a list of configurations that how images should be updated.
                         These rules apply to applications selected by namePattern in ApplicationRefs, and each
                         image can override global/ApplicationRef settings.
+                        This field is ignored when UseAnnotations is true.
                       items:
                         description: |-
                           ImageConfig defines how a specific container image should be discovered, updated,
@@ -182,25 +184,23 @@ spec:
                                     description: |-
                                       Name is the dot-separated path to the Helm key for the image repository/name part.
                                       Example: "image.repository", "frontend.deployment.image.name".
-                                      This field is required if the Helm target is used.
+                                      If neither spec nor name/tag are set, defaults to "image.name".
+                                      If spec is set, this field is ignored.
                                     type: string
                                   spec:
                                     description: |-
-                                      Spec is an optional dot-separated path to a Helm key where the full image string
+                                      Spec is the dot-separated path to a Helm key where the full image string
                                       (e.g., "image/name:1.0") should be written.
                                       Use this if your Helm chart expects the entire image reference in a single field,
-                                      rather than separate name/tag fields. If this is set, other Helm parameter-related
-                                      options will be ignored.
+                                      rather than separate name/tag fields. If this is set, name and tag will be ignored.
                                     type: string
                                   tag:
                                     description: |-
                                       Tag is the dot-separated path to the Helm key for the image tag part.
                                       Example: "image.tag", "frontend.deployment.image.version".
-                                      This field is required if the Helm target is used.
+                                      If neither spec nor name/tag are set, defaults to "image.tag".
+                                      If spec is set, this field is ignored.
                                     type: string
-                                required:
-                                - name
-                                - tag
                                 type: object
                               kustomize:
                                 description: |-
@@ -227,7 +227,6 @@ spec:
                         - alias
                         - imageName
                         type: object
-                      minItems: 1
                       type: array
                       x-kubernetes-list-map-keys:
                       - alias
@@ -283,10 +282,21 @@ spec:
                       description: NamePattern indicates the glob pattern for application
                         name
                       type: string
+                    useAnnotations:
+                      default: false
+                      description: |-
+                        UseAnnotations When true, read image configuration from Application's
+                        argocd-image-updater.argoproj.io/* annotations instead of
+                        requiring explicit Images[] configuration in this CR.
+                        When this field is set to true, only namePattern and labelSelectors are used for
+                        application selection. All other fields (CommonUpdateSettings, WriteBackConfig, Images)
+                        are ignored.
+                      type: boolean
                     writeBackConfig:
                       description: |-
                         WriteBackConfig overrides the global WriteBackConfig settings for applications
                         matched by this selector.
+                        This field is ignored when UseAnnotations is true.
                       properties:
                         gitConfig:
                           description: |-
@@ -324,9 +334,13 @@ spec:
                       - method
                       type: object
                   required:
-                  - images
                   - namePattern
                   type: object
+                  x-kubernetes-validations:
+                  - message: Either useAnnotations must be true, or images must be
+                      provided with at least one item
+                    rule: '!(has(self.useAnnotations) && self.useAnnotations == true)
+                      ? (has(self.images) && size(self.images) > 0) : true'
                 minItems: 1
                 type: array
                 x-kubernetes-list-map-keys:
@@ -381,8 +395,10 @@ spec:
               namespace:
                 description: |-
                   Namespace indicates the target namespace of the applications.
-                  This is the namespace where the controller will look for Argo CD Applications
-                  matching the criteria in ApplicationRefs.
+
+                  Deprecated: This field is deprecated and will be removed in a future release.
+                  The controller now uses the ImageUpdater CR's namespace (metadata.namespace)
+                  to determine which namespace to search for applications. This field is ignored.
                 type: string
               writeBackConfig:
                 description: |-
@@ -426,7 +442,6 @@ spec:
                 type: object
             required:
             - applicationRefs
-            - namespace
             type: object
           status:
             description: ImageUpdaterStatus defines the observed state of ImageUpdater

charts/argocd-image-updater/templates/deployment.yaml

@@ -34,20 +34,24 @@ spec:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
         - name: {{ include "argocd-image-updater.fullname" . }}-controller
-          command:
-            - /manager
           args:
             - --metrics-bind-address=:{{ .Values.containerPorts.metrics }}
             - run
             {{- with .Values.extraArgs }}
               {{- toYaml . | nindent 12 }}
             {{- end }}
           env:
+          - name: ARGOCD_NAMESPACE
+            valueFrom:
+              configMapKeyRef:
+                key: argocd.namespace
+                name: {{ .Values.config.name }}
+                optional: true
           - name: IMAGE_UPDATER_INTERVAL
             valueFrom:
               configMapKeyRef:
                 key: interval
-                name: argocd-image-updater-config
+                name: {{ .Values.config.name }}
                 optional: true
           - name: IMAGE_UPDATER_LOGLEVEL
             valueFrom:
@@ -71,7 +75,7 @@ spec:
             valueFrom:
               configMapKeyRef:
                 key: max_concurrent_reconciles
-                name: a{{ .Values.config.name }}
+                name: {{ .Values.config.name }}
                 optional: true
           - name: GIT_COMMIT_USER
             valueFrom:
@@ -112,13 +116,13 @@ spec:
           - name: ENABLE_WEBHOOK
             valueFrom:
               configMapKeyRef:
-                name: argocd-image-updater-config
+                name: {{ .Values.config.name }}
                 key: webhook.enable
                 optional: true
           - name: WEBHOOK_PORT
             valueFrom:
               configMapKeyRef:
-                name: argocd-image-updater-config
+                name: {{ .Values.config.name }}
                 key: webhook.port
                 optional: true
           - name: QUAY_WEBHOOK_SECRET
@@ -148,7 +152,7 @@ spec:
           - name: WEBHOOK_RATELIMIT_ALLOWED
             valueFrom:
               configMapKeyRef:
-                name: argocd-image-updater-config
+                name: {{ .Values.config.name }}
                 key: webhook.ratelimit-allowed
                 optional: true
           {{- with .Values.extraEnv }}

charts/argocd-image-updater/templates/metrics-service.yaml

@@ -17,7 +17,7 @@ metadata:
   namespace: {{ include "argocd-image-updater.namespace" . | quote }}
 spec:
   ports:
-    - name: https
+    - name: metrics
       protocol: TCP
       port: {{ .Values.metrics.service.servicePort }}
       targetPort: metrics
@@ -38,6 +38,10 @@ spec:
   - ports:
     - port: metrics
       protocol: TCP
+    {{- if .Values.ingress.enabled }}
+    - port: webhook
+      protocol: TCP
+    {{- end }}
   podSelector:
     matchLabels:
       {{- include "argocd-image-updater.selectorLabels" . | nindent 6 }}

charts/argocd-image-updater/templates/rbac.yaml

@@ -59,7 +59,6 @@ metadata:
   labels:
     {{- include "argocd-image-updater.labels" . | nindent 4 }}
   name: {{ include "argocd-image-updater.fullname" . }}
-  namespace: {{ include "argocd-image-updater.namespace" . | quote }}
 rules:
   - apiGroups:
     - ""
@@ -110,7 +109,6 @@ metadata:
   labels:
     {{- include "argocd-image-updater.labels" . | nindent 4 }}
   name: {{ include "argocd-image-updater.fullname" . }}
-  namespace: {{ include "argocd-image-updater.namespace" . | quote }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

charts/argocd-image-updater/templates/service.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.ingress.enabled }}
+{{- if or .Values.ingress.enabled .Values.service.enabled }}
 apiVersion: v1
 kind: Service
 metadata:

charts/argocd-image-updater/values.yaml

@@ -216,7 +216,7 @@ authScripts:
     #   #!/bin/sh
     #   echo "auth script 2 here"
     # azure-workload-identity.sh: |
-    #   #!/bin:sh
+    #   #!/bin/sh
     #   # Example script for Azure Workload Identity.
     #   # This script would typically use environment variables set by the workload identity
     #   # to acquire an Azure AD token and authenticate with Azure Container Registry (ACR).
@@ -316,6 +316,8 @@ containerPorts:
 
 ## Service configuration
 service:
+  # -- Enable a Service for the webhook endpoint. A Service is created when this is set to true or when `ingress.enabled` is true
+  enabled: false
   # -- Service annotations
   annotations: {}
   # -- Service labels