fix: add redis updates for cve fix and skaha limit range object

Author: at88mph

helm/applications/science-portal/values.yaml

@@ -139,6 +139,9 @@ tolerations: []
 
 # For the token caching
 redis:
+  image:
+    repository: redis
+    tag: 8.2.2-bookworm
   architecture: 'standalone'
   auth:
     enabled: false

helm/applications/skaha/templates/NOTES.txt

@@ -31,3 +31,10 @@ If user Jobs remain Pending:
 - Ensure LocalQueue exists in {{ .Values.skahaWorkload.namespace }} and references your configured ClusterQueue.
 - Verify ClusterQueue quotas are sufficient.
 - Confirm priority classes referenced by sessions exist or are created.
+
+Experimental Features Configured:
+{{- if and .Values.experimentalFeatures .Values.experimentalFeatures.enabled }}
+{{ include "skaha.experimentalFeatureGates" $ }}
+{{- else }}
+None
+{{- end }}

helm/applications/skaha/templates/_helpers.tpl

@@ -120,7 +120,7 @@ The init containers for the launch scripts.
             drop:
               - ALL
       - name: init-users-groups
-        image: {{ $.Values.deployment.skaha.sessions.initContainerImage | default "redis:7.4.2-alpine3.21" }}
+        image: {{ $.Values.deployment.skaha.sessions.initContainerImage | default "redis:8.2.2-bookworm" }}
         command: ["/init-users-groups/init-users-groups.sh"]
         env:
         - name: HOME

helm/applications/skaha/templates/limit-range.yaml

@@ -12,7 +12,18 @@ spec:
 {{- with .limitSpec }}
   limits:
     - type: Container
-{{ . | toYaml | indent 6 }}
+{{- if .max }}
+      max:
+{{ toYaml .max | indent 8 }}
+{{- end }}
+{{- if .default }}
+      default:
+{{ toYaml .default | indent 8 }}
+{{- end }}
+{{- if .defaultRequest }}
+      defaultRequest:
+{{ toYaml .defaultRequest | indent 8 }}
+{{- end }}
 {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1

helm/applications/skaha/values.yaml

@@ -97,10 +97,11 @@ deployment:
       imagePullPolicy: Always 
 
       # Optionally configure the initContainer image for Redis.  Useful for those not able to reach docker.io
-      # Defaults to redis-7.4.2-alpine3.21.
+      # Defaults to redis:8.2.2-bookworm.
       # Example:
       #   initContainerImage: "private-image-repo/project/my-own-redis:1.0"
       # initContainerImage:
+      initContainerImage: "redis:8.2.2-bookworm"
 
       # Optionally configure the Kueue system to handle large workloads.  Configurable per session type (e.g. desktop, notebook, etc.).
       # Leaving this empty will default to submitting Jobs to the base Kubernetes system.
@@ -289,6 +290,8 @@ experimentalFeatures:
 
   # YAML to pass to a LimitRange object called "{{ .Release.Name }}-session-limit-range" in the workload Namespace to define the resource limits.
   # These limits will be applied to Container objects (User Sessions).
+  # **NOTE**: This requires the experimentalFeatures.enabled to be true as well as the sessionLimitRange.enabled to be true.
+  # **NOTE**: The min clause is ignored due to hard-coded resources for Desktop and Firefly sessions.  The `defaultRequest` is used instead for these session types.
   # See https://kubernetes.io/docs/concepts/policy/limit-range/
   #
   # Example:
@@ -299,10 +302,6 @@ experimentalFeatures:
   #       memory: "96Gi"
   #       cpu: "12"
   #       "nvidia.com/gpu": "4"
-  #     min:
-  #       memory: "1Gi"
-  #       cpu: "1"
-  #       "nvidia.com/gpu": "0"
   #     default:  # actually refers to default limit
   #       memory: "32Gi"
   #       cpu: "8"
@@ -330,6 +329,9 @@ storage:
 
 # For caching images from the Image Repository and for the writing the POSIX Users and Groups to be shared with Job files
 redis:
+  image:
+    repository: redis
+    tag: 8.2.2-bookworm
   architecture: 'standalone'
   auth:
     enabled: false

helm/applications/storage-ui/values.yaml

@@ -140,6 +140,9 @@ tolerations: []
 
 # For the token caching
 redis:
+  image:
+    repository: redis
+    tag: 8.2.2-bookworm
   architecture: 'standalone'
   auth:
     enabled: false