Merge branch 'main' into ldap-password-secret

timetinytim · timetinytim · commit 7e4ebe28c8c2 · 2025-10-20T11:35:06.000+02:00
diff --git a/.github/workflows/test-chart.yml b/.github/workflows/test-chart.yml
@@ -75,21 +75,21 @@ jobs:
           # available for use in the templates, currently we need v3.6.0 or
           # higher.
           #
-          - k3s-channel: v1.28
-            helm-version: v3.8.0
+          - k3s-channel: v1.33
+            helm-version: v3.19.0
 
     env:
       HELM_EXPERIMENTAL_OCI: "1"
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
 
       # This action starts a k8s cluster with NetworkPolicy enforcement and
       # installs both kubectl and helm.
       #
       # ref: https://github.com/jupyterhub/action-k3s-helm#readme
       #
-      - uses: jupyterhub/action-k3s-helm@v3
+      - uses: jupyterhub/action-k3s-helm@v4
         with:
           k3s-channel: ${{ matrix.k3s-channel }}
           helm-version: ${{ matrix.helm-version }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,23 @@ externalAuth:
       key: password
 ```
 
+# 6.5.7
+
+- Updated all dependent chart images to bitnami legacy repositories.
+- Updated chart test jobs.
+- Added additional configuration options:
+```yaml
+mastodon:
+  s3:
+    protocol: https
+...
+elasticsearch:
+  caSecret:
+  indexPrefix:
+...
+jobLabels:
+```
+
 # 6.5.6
 
 - Update the mastodon version to v4.4.7
diff --git a/Chart.lock b/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
   version: 14.2.3
 - name: redis
   repository: oci://registry-1.docker.io/bitnamicharts
-  version: 18.16.1
-digest: sha256:684daaf2067d96e2aa6d93e9d29b7b13fc586f6ae929342e5e9c7c169b1c0748
-generated: "2024-02-23T15:14:47.536480528-08:00"
+  version: 22.0.7
+digest: sha256:003679b2c163c0b349b0d621475cdb85c0556f803f2f959a50cef350d3ce956e
+generated: "2025-10-08T05:16:23.08106463Z"
diff --git a/Chart.yaml b/Chart.yaml
@@ -32,6 +32,6 @@ dependencies:
     repository: oci://registry-1.docker.io/bitnamicharts
     condition: postgresql.enabled
   - name: redis
-    version: 18.16.1
+    version: 22.0.7
     repository: oci://registry-1.docker.io/bitnamicharts
     condition: redis.enabled
diff --git a/templates/_db-migrate.tpl b/templates/_db-migrate.tpl
@@ -33,6 +33,10 @@ spec:
   template:
     metadata:
       name: {{ include "mastodon.fullname" . }}-db-migrate
+      {{- with .Values.jobLabels }}
+      labels:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.jobAnnotations }}
       annotations:
         {{- toYaml . | nindent 8 }}
diff --git a/templates/configmap-env.yaml b/templates/configmap-env.yaml
@@ -38,10 +38,16 @@ data:
   ES_PRESET: {{ .Values.elasticsearch.preset | default "single_node_cluster" | quote }}
   ES_HOST: {{ include "mastodon.elasticsearch.fullHostname" .}}
   ES_PORT: {{ .Values.elasticsearch.port | default "9200" | quote }}
+  {{- if .Values.elasticsearch.caSecret }}
+  ES_CA_FILE: /opt/opensearch/config/ca.certs
+  {{- end }}
   {{- end }}
   {{- with .Values.elasticsearch.user }}
   ES_USER: {{ . }}
   {{- end }}
+  {{- if .Values.elasticsearch.indexPrefix }}
+  ES_PREFIX: {{ .Values.elasticsearch.indexPrefix | quote }}
+  {{- end }}
   LOCAL_DOMAIN: {{ .Values.mastodon.local_domain }}
   {{- with .Values.mastodon.web_domain }}
   WEB_DOMAIN: {{ . }}
@@ -93,7 +99,7 @@ data:
   S3_ENABLED: "true"
   S3_ENDPOINT: {{ .Values.mastodon.s3.endpoint }}
   S3_HOSTNAME: {{ .Values.mastodon.s3.hostname }}
-  S3_PROTOCOL: "https"
+  S3_PROTOCOL: {{ .Values.mastodon.s3.protocol }}
   {{- if .Values.mastodon.s3.permission }}
   S3_PERMISSION: {{ .Values.mastodon.s3.permission }}
   {{- end }}
@@ -195,7 +201,7 @@ data:
   OIDC_DISCOVERY: {{ .Values.externalAuth.oidc.discovery | quote }}
   OIDC_SCOPE: {{ .Values.externalAuth.oidc.scope | quote }}
   OIDC_UID_FIELD: {{ .Values.externalAuth.oidc.uid_field }}
-  OIDC_CLIENT_ID: {{ .Values.externalAuth.oidc.client_id }}
+  OIDC_CLIENT_ID: {{ .Values.externalAuth.oidc.client_id | quote }}
   OIDC_CLIENT_SECRET: {{ .Values.externalAuth.oidc.client_secret }}
   OIDC_REDIRECT_URI: {{ .Values.externalAuth.oidc.redirect_uri }}
   OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED: {{ .Values.externalAuth.oidc.assume_email_is_verified | quote }}
diff --git a/templates/cronjob-media-remove.yaml b/templates/cronjob-media-remove.yaml
@@ -12,6 +12,10 @@ spec:
       template:
         metadata:
           name: {{ include "mastodon.fullname" . }}-media-remove
+          {{- with .Values.jobLabels }}
+          labels:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           {{- with .Values.jobAnnotations }}
           annotations:
             {{- toYaml . | nindent 12 }}
diff --git a/templates/deployment-sidekiq.yaml b/templates/deployment-sidekiq.yaml
@@ -88,6 +88,11 @@ spec:
           persistentVolumeClaim:
             claimName: {{ template "mastodon.pvc.system" $context }}
       {{- end }}
+      {{- if $context.Values.elasticsearch.caSecret.name }}
+        - name: elasticsearch-ca
+          secret:
+            secretName: {{ $context.Values.elasticsearch.caSecret.name }}
+      {{- end }}
       {{- include "mastodon.statsdExporterVolume" $ | indent 8 }}
       {{- if dig "customDatabaseConfigYml" "configMapRef" "name" false . }}
         - name: config-database-yml
@@ -256,6 +261,12 @@ spec:
             - name: system
               mountPath: /opt/mastodon/public/system
           {{- end }}
+          {{- if $context.Values.elasticsearch.caSecret.name }}
+            - name: elasticsearch-ca
+              mountPath: /opt/opensearch/config/ca.certs
+              subPath: {{ $context.Values.elasticsearch.caSecret.key }}
+              readOnly: true
+          {{- end }}
           {{- if dig "customDatabaseConfigYml" "configMapRef" "name" false . }}
             - name: config-database-yml
               mountPath: /opt/mastodon/config/database.yml
diff --git a/templates/deployment-web.yaml b/templates/deployment-web.yaml
@@ -69,6 +69,11 @@ spec:
           persistentVolumeClaim:
             claimName: {{ template "mastodon.pvc.system" . }}
       {{- end }}
+      {{- if .Values.elasticsearch.caSecret.name }}
+        - name: elasticsearch-ca
+          secret:
+            secretName: {{ .Values.elasticsearch.caSecret.name}}
+      {{- end }}
       {{- include "mastodon.statsdExporterVolume" $ | indent 8 }}
       {{- if .Values.mastodon.web.customDatabaseConfigYml.configMapRef.name }}
         - name: config-database-yml
@@ -227,6 +232,12 @@ spec:
             - name: system
               mountPath: /opt/mastodon/public/system
           {{- end }}
+          {{- if .Values.elasticsearch.caSecret.name }}
+            - name: elasticsearch-ca
+              mountPath: /opt/opensearch/config/ca.certs
+              subPath: {{ .Values.elasticsearch.caSecret.key }}
+              readOnly: true
+          {{- end }}
           {{- if .Values.mastodon.web.customDatabaseConfigYml.configMapRef.name }}
             - name: config-database-yml
               mountPath: /opt/mastodon/config/database.yml
diff --git a/templates/job-assets-copy.yaml b/templates/job-assets-copy.yaml
@@ -13,6 +13,10 @@ spec:
   template:
     metadata:
       name: {{ include "mastodon.fullname" . }}-assets-upload
+      {{- with .Values.jobLabels }}
+      labels:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.jobAnnotations }}
       annotations:
         {{- toYaml . | nindent 8 }}
diff --git a/templates/job-create-admin.yaml b/templates/job-create-admin.yaml
@@ -13,6 +13,10 @@ spec:
   template:
     metadata:
       name: {{ include "mastodon.fullname" . }}-create-admin
+      {{- with .Values.jobLabels }}
+      labels:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.jobAnnotations }}
       annotations:
         {{- toYaml . | nindent 8 }}
diff --git a/templates/job-deploy-search.yaml b/templates/job-deploy-search.yaml
@@ -14,6 +14,10 @@ spec:
   template:
     metadata:
       name: {{ include "mastodon.fullname" . }}-deploy-search
+      {{- with .Values.jobLabels }}
+      labels:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.jobAnnotations }}
       annotations:
         {{- toYaml . | nindent 8 }}
diff --git a/values.yaml b/values.yaml
@@ -160,6 +160,7 @@ mastodon:
     existingSecret: ""
     bucket: ""
     endpoint: ""
+    protocol: https
     hostname: ""
     region: ""
     permission: ""
@@ -623,8 +624,8 @@ elasticsearch:
   # RAILS_ENV=production bundle exec rake chewy:sync
   # (https://docs.joinmastodon.org/admin/optional/elasticsearch/)
   enabled: true
-  # @ignored
   image:
+    repository: bitnamilegacy/elasticsearch
     tag: 7
 
   # If you are using an external ES cluster, use `enabled: false` and set the hostname, port,
@@ -651,6 +652,15 @@ elasticsearch:
   metrics:
     nodeSelector: {}
 
+  caSecret: {}
+  #  # caSecret.name is the name of the secret containing the CA certificate.
+  #  name:
+  #  # caSecret.key is the key in the secret containing the CA certificate.
+  #  key: ca.crt
+
+  # elasticsearchIndexPrefix specifies the prefix for Elasticsearch indices used by this Mastodon server
+  # indexPrefix: ""
+
 # Configuration for PostgreSQL.
 # When enabled, the bitnami helm chart is used for PostgreSQL deployment, and
 # all values here correspond to their values file. Please see the bitnami chart
@@ -664,6 +674,8 @@ postgresql:
   # Please note that certain features do not work when enabling the included
   # database, namely automatic schema creation when the app is first installed.
   enabled: true
+  image:
+    repository: bitnamilegacy/postgresql
   # postgresqlHostname: preexisting-postgresql
   # postgresqlPort: 5432
 
@@ -725,6 +737,9 @@ redis:
   # disable if you want to use an existing redis instance; in which case the
   # values below must match those of that external redis instance
   enabled: true
+  image:
+    registry: docker.io
+    repository: bitnamilegacy/redis
   hostname: ""
   port: 6379
   auth:
@@ -914,6 +929,9 @@ podAnnotations: {}
 # cause all pods to be recreated every `helm upgrade` regardless of whether their config or spec changes.
 revisionPodAnnotation: true
 
+# The labels set with jobLabels will be added to all mastodon job pods
+jobLabels: {}
+
 # The annotations set with jobAnnotations will be added to all mastodon job pods
 jobAnnotations: {}
 
