onprem: 2.5.7 (#11)

codefresh-io · Dec 1, 2024 · e3c3742 · e3c3742
1 parent 22bc634
commit e3c3742
Show file tree

Hide file tree

Showing 5 changed files with 106 additions and 68 deletions.
diff --git a/codefresh/.ci/runtime-images.sh b/codefresh/.ci/runtime-images.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+set -eux
+MYDIR=$(dirname $0)
+REPO_ROOT="${MYDIR}/../.."
+
+echo $REPO_ROOT
+
+echo "Update value with system/root runtime images"
+docker run \
+    -v "$REPO_ROOT:/codefresh" \
+    -v $HOME/.cfconfig:/.cfconfig \
+    -u $(id -u) \
+    --rm \
+    quay.io/codefresh/codefresh-shell:0.0.20 \
+    /bin/bash /codefresh/scripts/update_re_images.sh
diff --git a/codefresh/Chart.lock b/codefresh/Chart.lock
@@ -40,120 +40,120 @@ dependencies:
   version: 4.11.2
 - name: cluster-providers
   repository: oci://quay.io/codefresh/charts
-  version: 1.17.8
+  version: 1.17.10
 - name: kube-integration
   repository: oci://quay.io/codefresh/charts
-  version: 1.31.9
+  version: 1.31.11
 - name: charts-manager
   repository: oci://quay.io/codefresh/charts
   version: 1.18.2
 - name: cfsign
   repository: oci://quay.io/codefresh/charts
-  version: 1.8.4
+  version: 1.8.5
 - name: tasker-kubernetes
   repository: oci://quay.io/codefresh/charts
-  version: 1.26.10
+  version: 1.26.13
 - name: context-manager
   repository: oci://quay.io/codefresh/charts
   version: 2.30.2
 - name: pipeline-manager
   repository: oci://quay.io/codefresh/charts
-  version: 3.135.9
+  version: 3.135.10
 - name: gitops-dashboard-manager
   repository: oci://quay.io/codefresh/charts
-  version: 1.14.15
+  version: 1.14.16
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfapi
   repository: oci://quay.io/codefresh/charts
-  version: 21.260.40
+  version: 21.260.41
 - name: cfui
   repository: oci://quay.io/codefresh/charts
   version: 14.95.78
 - name: k8s-monitor
   repository: oci://quay.io/codefresh/charts
-  version: 4.11.8
+  version: 4.11.10
 - name: runtime-environment-manager
   repository: oci://quay.io/codefresh/charts
   version: 3.36.4
 - name: cf-broadcaster
   repository: oci://quay.io/codefresh/charts
-  version: 1.12.16
+  version: 1.12.17
 - name: helm-repo-manager
   repository: oci://quay.io/codefresh/charts
   version: 0.16.1
 - name: hermes
   repository: oci://quay.io/codefresh/charts
-  version: 0.21.10
+  version: 0.21.14
 - name: nomios
   repository: oci://quay.io/codefresh/charts
-  version: 0.11.7
+  version: 0.11.8
 - name: cronus
   repository: oci://quay.io/codefresh/charts
-  version: 0.8.7
+  version: 0.8.8
 - name: cf-platform-analytics
   repository: oci://quay.io/codefresh/charts
-  version: 0.49.66
+  version: 0.49.72
 - name: cf-platform-analytics
   repository: oci://quay.io/codefresh/charts
-  version: 0.49.66
+  version: 0.49.72
 - name: argo-platform
   repository: oci://quay.io/codefresh/charts
-  version: 1.3037.0-onprem-fb06d0a
+  version: 1.3038.0-onprem-eb2dd14
 - name: argo-hub-platform
   repository: oci://quay.io/codefresh/charts
   version: 0.1.16
 - name: cf-oidc-provider
   repository: oci://quay.io/codefresh/charts
   version: 0.0.15
-digest: sha256:1d70af531b08b8a225aeb1bcd099a6699b2a6c343f9c70f023384e1d2a69463c
-generated: "2024-10-22T10:56:07.99008+03:00"
+digest: sha256:4b761f88e2c4314cc474148cc0f545e78cd73f064e154b95a7fb1c6d118e47f2
+generated: "2024-12-01T13:47:00.682066+03:00"
diff --git a/codefresh/Chart.yaml b/codefresh/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 description: Helm Chart for Codefresh On-Prem
 name: codefresh
-version: 2.5.6
+version: 2.5.7
 keywords:
   - codefresh
 home: https://codefresh.io/
@@ -15,24 +15,11 @@ appVersion: 2.5.0
 annotations:
   # artifacthub.io/prerelease: "true"
   artifacthub.io/alternativeName: "codefresh-onprem"
-  # artifacthub.io/containsSecurityUpdates: "true"
+  artifacthub.io/containsSecurityUpdates: "true"
   # supported kinds are added, changed, deprecated, removed, fixed and security.
   artifacthub.io/changes: |
-    - kind: fixed
-      description: "permissions in cf-api for OpenShift"
-      links:
-      - name: JIRA Issue
-        url: https://codefresh-io.atlassian.net/browse/CR-25662
-    - kind: fixed
-      description: "pipeline-manager memory leak"
-      links:
-      - name: JIRA Issue
-        url: https://codefresh-io.atlassian.net/browse/CR-25053
-    - kind: fixed
-      description: "Secret template when postgres password contains special characters"
-      links:
-      - name: JIRA Issue
-        url: https://codefresh-io.atlassian.net/browse/CR-25131
+    - kind: security
+      description: "Misc security updates"
 dependencies:
   - name: cf-common
     repository: oci://quay.io/codefresh/charts
@@ -250,7 +237,7 @@ dependencies:
     repository: oci://quay.io/codefresh/charts
     condition: argo-platform.enabled
   - name: argo-platform
-    version: "1.3037.0-onprem-fb06d0a"
+    version: "1.3038.0-onprem-eb2dd14"
     repository: oci://quay.io/codefresh/charts
     condition: argo-platform.enabled
   - name: argo-hub-platform

diff --git a/codefresh/README.md b/codefresh/README.md
@@ -1,6 +1,6 @@
 ## Codefresh On-Premises
 
-![Version: 2.5.6](https://img.shields.io/badge/Version-2.5.6-informational?style=flat-square) ![AppVersion: 2.5.0](https://img.shields.io/badge/AppVersion-2.5.0-informational?style=flat-square)
+![Version: 2.5.7](https://img.shields.io/badge/Version-2.5.7-informational?style=flat-square) ![AppVersion: 2.5.0](https://img.shields.io/badge/AppVersion-2.5.0-informational?style=flat-square)
 
 Helm chart for deploying [Codefresh On-Premises](https://codefresh.io/docs/docs/getting-started/intro-to-codefresh/) to Kubernetes.
 
@@ -1999,7 +1999,8 @@ kubectl -n $NAMESPACE delete secret codefresh-certs-server
 | argo-platform.api-graphql.env | object | See below | Env vars |
 | argo-platform.api-graphql.hpa | object | `{"enabled":false}` | HPA |
 | argo-platform.api-graphql.hpa.enabled | bool | `false` | Enable autoscaler |
-| argo-platform.api-graphql.image | object | `{"registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh-io/argo-platform-api-graphql"}` | Image |
+| argo-platform.api-graphql.image | object | `{"digest":"","registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh-io/argo-platform-api-graphql"}` | Image |
+| argo-platform.api-graphql.image.digest | string | `""` | Digest |
 | argo-platform.api-graphql.image.registry | string | `"us-docker.pkg.dev/codefresh-enterprise/gcr.io"` | Registry |
 | argo-platform.api-graphql.image.repository | string | `"codefresh-io/argo-platform-api-graphql"` | Repository |
 | argo-platform.api-graphql.kind | string | `"Deployment"` | Controller kind. Currently, only `Deployment` is supported |
@@ -2026,11 +2027,12 @@ kubectl -n $NAMESPACE delete secret codefresh-certs-server
 | cf-platform-analytics-etlstarter.redis.enabled | bool | `false` | Disable redis subchart |
 | cf-platform-analytics-etlstarter.system-etl-postgres | object | `{"container":{"env":{"BLUE_GREEN_ENABLED":true}},"controller":{"cronjob":{"ttlSecondsAfterFinished":300}},"enabled":true}` | Only postgres ETL should be running in onprem |
 | cf-platform-analytics-platform | object | See below | platform-analytics |
-| cfapi | object | `{"affinity":{},"container":{"env":{"AUDIT_AUTO_CREATE_DB":true,"DEFAULT_SYSTEM_TYPE":"PROJECT_ONE","GITHUB_API_PATH_PREFIX":"/api/v3","LOGGER_LEVEL":"debug","OIDC_PROVIDER_PORT":"{{ .Values.global.oidcProviderPort }}","OIDC_PROVIDER_PROTOCOL":"{{ .Values.global.oidcProviderProtocol }}","OIDC_PROVIDER_TOKEN_ENDPOINT":"{{ .Values.global.oidcProviderTokenEndpoint }}","OIDC_PROVIDER_URI":"{{ .Values.global.oidcProviderService }}","ON_PREMISE":true,"RUNTIME_MONGO_DB":"codefresh","RUNTIME_REDIS_DB":0},"image":{"registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}},"controller":{"replicas":2},"enabled":true,"hpa":{"enabled":false,"maxReplicas":10,"minReplicas":2,"targetCPUUtilizationPercentage":70},"nodeSelector":{},"pdb":{"enabled":false,"minAvailable":"50%"},"podSecurityContext":{},"resources":{"limits":{},"requests":{"cpu":"200m","memory":"256Mi"}},"secrets":{"secret":{"enabled":true,"stringData":{"OIDC_PROVIDER_CLIENT_ID":"{{ .Values.global.oidcProviderClientId }}","OIDC_PROVIDER_CLIENT_SECRET":"{{ .Values.global.oidcProviderClientSecret }}"},"type":"Opaque"}},"tolerations":[]}` | cf-api |
+| cfapi | object | `{"affinity":{},"container":{"env":{"AUDIT_AUTO_CREATE_DB":true,"DEFAULT_SYSTEM_TYPE":"PROJECT_ONE","GITHUB_API_PATH_PREFIX":"/api/v3","LOGGER_LEVEL":"debug","OIDC_PROVIDER_PORT":"{{ .Values.global.oidcProviderPort }}","OIDC_PROVIDER_PROTOCOL":"{{ .Values.global.oidcProviderProtocol }}","OIDC_PROVIDER_TOKEN_ENDPOINT":"{{ .Values.global.oidcProviderTokenEndpoint }}","OIDC_PROVIDER_URI":"{{ .Values.global.oidcProviderService }}","ON_PREMISE":true,"RUNTIME_MONGO_DB":"codefresh","RUNTIME_REDIS_DB":0},"image":{"digest":"","registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}},"controller":{"replicas":2},"enabled":true,"hpa":{"enabled":false,"maxReplicas":10,"minReplicas":2,"targetCPUUtilizationPercentage":70},"nodeSelector":{},"pdb":{"enabled":false,"minAvailable":"50%"},"podSecurityContext":{},"resources":{"limits":{},"requests":{"cpu":"200m","memory":"256Mi"}},"secrets":{"secret":{"enabled":true,"stringData":{"OIDC_PROVIDER_CLIENT_ID":"{{ .Values.global.oidcProviderClientId }}","OIDC_PROVIDER_CLIENT_SECRET":"{{ .Values.global.oidcProviderClientSecret }}"},"type":"Opaque"}},"tolerations":[]}` | cf-api |
 | cfapi-internal.<<.affinity | object | `{}` |  |
-| cfapi-internal.<<.container | object | `{"env":{"AUDIT_AUTO_CREATE_DB":true,"DEFAULT_SYSTEM_TYPE":"PROJECT_ONE","GITHUB_API_PATH_PREFIX":"/api/v3","LOGGER_LEVEL":"debug","OIDC_PROVIDER_PORT":"{{ .Values.global.oidcProviderPort }}","OIDC_PROVIDER_PROTOCOL":"{{ .Values.global.oidcProviderProtocol }}","OIDC_PROVIDER_TOKEN_ENDPOINT":"{{ .Values.global.oidcProviderTokenEndpoint }}","OIDC_PROVIDER_URI":"{{ .Values.global.oidcProviderService }}","ON_PREMISE":true,"RUNTIME_MONGO_DB":"codefresh","RUNTIME_REDIS_DB":0},"image":{"registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}}` | Container configuration |
+| cfapi-internal.<<.container | object | `{"env":{"AUDIT_AUTO_CREATE_DB":true,"DEFAULT_SYSTEM_TYPE":"PROJECT_ONE","GITHUB_API_PATH_PREFIX":"/api/v3","LOGGER_LEVEL":"debug","OIDC_PROVIDER_PORT":"{{ .Values.global.oidcProviderPort }}","OIDC_PROVIDER_PROTOCOL":"{{ .Values.global.oidcProviderProtocol }}","OIDC_PROVIDER_TOKEN_ENDPOINT":"{{ .Values.global.oidcProviderTokenEndpoint }}","OIDC_PROVIDER_URI":"{{ .Values.global.oidcProviderService }}","ON_PREMISE":true,"RUNTIME_MONGO_DB":"codefresh","RUNTIME_REDIS_DB":0},"image":{"digest":"","registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}}` | Container configuration |
 | cfapi-internal.<<.container.env | object | See below | Env vars |
-| cfapi-internal.<<.container.image | object | `{"registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}` | Image |
+| cfapi-internal.<<.container.image | object | `{"digest":"","registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}` | Image |
+| cfapi-internal.<<.container.image.digest | string | `""` | Digest |
 | cfapi-internal.<<.container.image.registry | string | `"us-docker.pkg.dev/codefresh-enterprise/gcr.io"` | Registry prefix |
 | cfapi-internal.<<.container.image.repository | string | `"codefresh/cf-api"` | Repository |
 | cfapi-internal.<<.controller | object | `{"replicas":2}` | Controller configuration |
@@ -2053,9 +2055,10 @@ kubectl -n $NAMESPACE delete secret codefresh-certs-server
 | cfapi-internal.<<.secrets.secret.type | string | `"Opaque"` |  |
 | cfapi-internal.<<.tolerations | list | `[]` |  |
 | cfapi-internal.enabled | bool | `false` |  |
-| cfapi.container | object | `{"env":{"AUDIT_AUTO_CREATE_DB":true,"DEFAULT_SYSTEM_TYPE":"PROJECT_ONE","GITHUB_API_PATH_PREFIX":"/api/v3","LOGGER_LEVEL":"debug","OIDC_PROVIDER_PORT":"{{ .Values.global.oidcProviderPort }}","OIDC_PROVIDER_PROTOCOL":"{{ .Values.global.oidcProviderProtocol }}","OIDC_PROVIDER_TOKEN_ENDPOINT":"{{ .Values.global.oidcProviderTokenEndpoint }}","OIDC_PROVIDER_URI":"{{ .Values.global.oidcProviderService }}","ON_PREMISE":true,"RUNTIME_MONGO_DB":"codefresh","RUNTIME_REDIS_DB":0},"image":{"registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}}` | Container configuration |
+| cfapi.container | object | `{"env":{"AUDIT_AUTO_CREATE_DB":true,"DEFAULT_SYSTEM_TYPE":"PROJECT_ONE","GITHUB_API_PATH_PREFIX":"/api/v3","LOGGER_LEVEL":"debug","OIDC_PROVIDER_PORT":"{{ .Values.global.oidcProviderPort }}","OIDC_PROVIDER_PROTOCOL":"{{ .Values.global.oidcProviderProtocol }}","OIDC_PROVIDER_TOKEN_ENDPOINT":"{{ .Values.global.oidcProviderTokenEndpoint }}","OIDC_PROVIDER_URI":"{{ .Values.global.oidcProviderService }}","ON_PREMISE":true,"RUNTIME_MONGO_DB":"codefresh","RUNTIME_REDIS_DB":0},"image":{"digest":"","registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}}` | Container configuration |
 | cfapi.container.env | object | See below | Env vars |
-| cfapi.container.image | object | `{"registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}` | Image |
+| cfapi.container.image | object | `{"digest":"","registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/cf-api"}` | Image |
+| cfapi.container.image.digest | string | `""` | Digest |
 | cfapi.container.image.registry | string | `"us-docker.pkg.dev/codefresh-enterprise/gcr.io"` | Registry prefix |
 | cfapi.container.image.repository | string | `"codefresh/cf-api"` | Repository |
 | cfapi.controller | object | `{"replicas":2}` | Controller configuration |
@@ -2213,5 +2216,5 @@ kubectl -n $NAMESPACE delete secret codefresh-certs-server
 | seed.postgresSeedJob.postgresPasswordSecretKeyRef | optional | `{}` | Password for "postgres" admin user from existing secret |
 | seed.postgresSeedJob.postgresUser | optional | `""` | "postgres" admin user in plain text (required ONLY for seed job!) Must be a privileged user allowed to create databases and grant roles. If omitted, username and password from `.Values.global.postgresUser/postgresPassword` will be used. |
 | seed.postgresSeedJob.postgresUserSecretKeyRef | optional | `{}` | "postgres" admin user from exising secret |
-| tasker-kubernetes | object | `{"affinity":{},"container":{"image":{"registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/tasker-kubernetes"}},"enabled":true,"hpa":{"enabled":false},"nodeSelector":{},"pdb":{"enabled":false},"podSecurityContext":{},"resources":{"limits":{},"requests":{"cpu":"100m","memory":"128Mi"}},"tolerations":[]}` | tasker-kubernetes |
+| tasker-kubernetes | object | `{"affinity":{},"container":{"image":{"digest":"","registry":"us-docker.pkg.dev/codefresh-enterprise/gcr.io","repository":"codefresh/tasker-kubernetes"}},"enabled":true,"hpa":{"enabled":false},"nodeSelector":{},"pdb":{"enabled":false},"podSecurityContext":{},"resources":{"limits":{},"requests":{"cpu":"100m","memory":"128Mi"}},"tolerations":[]}` | tasker-kubernetes |
 | webTLS | object | `{"cert":"","enabled":false,"key":"","secretName":"star.codefresh.io"}` | DEPRECATED - Use `.Values.ingress.tls` instead TLS secret for Ingress |