mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
GH-22120 - fix the permission of files in ~/.ssh/ in gocd-server and (#22126)
agent This is required to give access to private git repositories https://github.com/helm/charts/issues/22120 has more details Signed-off-by: Vikas Kumar <vikas@reachvikas.com>
This commit is contained in:
Vikas Kumar
@@ -1,3 +1,6 @@
|
||||
### 1.26.1
|
||||
* [7a9cd1bb4](https://github.com/kubernetes/charts/commit/7a9cd1bb4): Updated permissions of files in ~/.ssh directory
|
||||
|
||||
### 1.26.0
|
||||
* [ec6b96f](https://github.com/kubernetes/charts/commit/ec6b96f): Bump up GoCD Version to 20.3.0
|
||||
### 1.25.1
|
||||
@@ -266,7 +269,7 @@
|
||||
|
||||
### 1.4.0
|
||||
|
||||
* [f5249551](https://github.com/kubernetes/charts/commit/f5249551):
|
||||
* [f5249551](https://github.com/kubernetes/charts/commit/f5249551):
|
||||
- Bump up GoCD app version to 18.8.0
|
||||
- Updated kubernetes elastic agent plugin version to 1.0.2
|
||||
- Updated post install script
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
apiVersion: v1
|
||||
name: gocd
|
||||
home: https://www.gocd.org/
|
||||
version: 1.26.0
|
||||
version: 1.26.1
|
||||
appVersion: 20.3.0
|
||||
description: GoCD is an open-source continuous delivery server to model and visualize complex workflows with ease.
|
||||
icon: https://gocd.github.io/assets/images/go-icon-black-192x192.png
|
||||
|
||||
+11
-9
@@ -90,9 +90,9 @@ The following tables list the configurable parameters of the GoCD chart and thei
|
||||
| `server.service.type` | Type of GoCD server Kubernetes service | `NodePort` |
|
||||
| `server.service.loadBalancerSourceRanges` | GoCD server service Load Balancer source IP ranges to whitelist | `nil` |
|
||||
| `server.service.httpPort` | GoCD server service HTTP port | `8153` |
|
||||
| `server.service.nodeHttpPort` | GoCD server service node HTTP port. **Note**: A random nodePort will get assigned if not specified | `nil` |
|
||||
| `server.service.nodeHttpsPort` | GoCD server service node HTTPS port. **Note**: A random nodePort will get assigned if not specified | `nil` |
|
||||
| `server.ingress.enabled` | Enable/disable GoCD ingress. Allow traffic from outside the cluster via http. Do `kubectl describe ing` to get the public ip to access the gocd server. | `true` |
|
||||
| `server.service.nodeHttpPort` | GoCD server service node HTTP port. **Note**: A random nodePort will get assigned if not specified | `nil` |
|
||||
| `server.service.nodeHttpsPort` | GoCD server service node HTTPS port. **Note**: A random nodePort will get assigned if not specified | `nil` |
|
||||
| `server.ingress.enabled` | Enable/disable GoCD ingress. Allow traffic from outside the cluster via http. Do `kubectl describe ing` to get the public ip to access the gocd server. | `true` |
|
||||
| `server.ingress.hosts` | GoCD ingress hosts records. | `nil` |
|
||||
| `server.ingress.annotations` | GoCD ingress annotations. | `{}` |
|
||||
| `server.ingress.tls` | GoCD ingress TLS configuration. | `[]` |
|
||||
@@ -102,6 +102,7 @@ The following tables list the configurable parameters of the GoCD chart and thei
|
||||
| `server.hostAliases` | Aliases for IPs in /etc/hosts | `[]` |
|
||||
| `server.security.ssh.enabled` | Enable the use of SSH keys for GoCD server | `false` |
|
||||
| `server.security.ssh.secretName` | The name of the secret holding the SSH keys | `gocd-server-ssh` |
|
||||
| `server.security.ssh.defaultMode` | Permissions of files in ~/.ssh directory | `256` |
|
||||
| `server.securityContext.runAsUser` | The container user for all the GoCD server pods. | `1000` |
|
||||
| `server.securityContext.runAsGroup` | The container group for all the GoCD server pods. | `0` |
|
||||
| `server.securityContext.fsGroup` | The container supplementary group for all the GoCD server pods. | `0` |
|
||||
@@ -201,6 +202,7 @@ $ kubectl create secret generic gocd-server-ssh \
|
||||
| `agent.hostAliases` | Aliases for IPs in /etc/hosts | `[]` |
|
||||
| `agent.security.ssh.enabled` | Enable the use of SSH keys for GoCD agent | `false` |
|
||||
| `agent.security.ssh.secretName` | The name of the secret holding the SSH keys | `gocd-agent-ssh` |
|
||||
| `agent.security.ssh.defaultMode` | Permissions of files in ~/.ssh directory | `256` |
|
||||
| `agent.securityContext.runAsUser` | The container user for all the GoCD agent pods. | `1000` |
|
||||
| `agent.securityContext.runAsGroup` | The container group for all the GoCD agent pods. | `0` |
|
||||
| `agent.securityContext.fsGroup` | The container supplementary group for all the GoCD agent pods. | `0` |
|
||||
@@ -424,7 +426,7 @@ Possible states:
|
||||
|reuseTopLevelServiceAccount = false and name = 'agentSA'|The 'agentSA' service account will be used. The service account needs to exist and bound with the appropriate role. |
|
||||
|reuseTopLevelServiceAccount = true| The GoCD service account will be created and used for the agents in the specified namespace. The permissions associated with the GoCD SA are defined here - [Cluster role privileges](#cluster-role-privileges). |
|
||||
|
||||
# Adding plugins
|
||||
# Adding plugins
|
||||
|
||||
- Add the .jar file link from the releases section in the plugin's repo to the env.extraEnvVars section as a new environment variable.
|
||||
The environment variable name must have GOCD_PLUGIN_INSTALL prefixed to it like the following section
|
||||
@@ -441,16 +443,16 @@ env:
|
||||
|
||||
# Ingress
|
||||
|
||||
On a Kubernetes cluster, ingress is responsible for accepting incoming requests and forwarding them to the appropriate service in the backend.
|
||||
On a Kubernetes cluster, ingress is responsible for accepting incoming requests and forwarding them to the appropriate service in the backend.
|
||||
The ingress controller acts as a reverse proxy in front of the GoCD server. The GoCD agents within the cluster can bypass ingress and connect to the service directly.
|
||||
GoCD agents outside of the Kubernetes cluster may connect to the GoCD server via the Ingress or LoadBalancer.
|
||||
|
||||
You can secure an Ingress by specifying a `secret` that contains a TLS private key and certificate [here](https://github.com/helm/charts/blob/master/stable/gocd/values.yaml#L157).
|
||||
Please refer to [Ingress documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls) about how to configure TLS.
|
||||
Many ingress controllers make configuring TLS easy with the use of annotations. You can use ingress annotations to configure some of the TLS parameters like a managed SSL certificate, redirecting http to https, etc.
|
||||
Please refer to [Ingress documentation](https://kubernetes.io/docs/concepts/services-networking/ingress/#tls) about how to configure TLS.
|
||||
Many ingress controllers make configuring TLS easy with the use of annotations. You can use ingress annotations to configure some of the TLS parameters like a managed SSL certificate, redirecting http to https, etc.
|
||||
|
||||
| Parameter | Description |
|
||||
|---------------------------------------------|-----------------------------------------------------------------------------------------------|
|
||||
|---------------------------------------------|-----------------------------------------------------------------------------------------------|
|
||||
| ingress.kubernetes.io/force-ssl-redirect | Redirect non-TLS requests to TLS even when TLS is not configured. |
|
||||
| kubernetes.io/ingress.allow-http | Whether to accept non-TLS HTTP connections. Supported on GCE. Default: true |
|
||||
| alb.ingress.kubernetes.io/backend-protocol | Specifies the protocol used when route traffic to pods on EKS. |
|
||||
@@ -473,7 +475,7 @@ For GoCD, annotations can be configured [here](https://github.com/helm/charts/bl
|
||||
|
||||
# TLS for GoCD
|
||||
|
||||
As part of GoCD Release v20.2.0, GoCD changed how it handles SSL support. If you are upgrading to GoCD 20.2.0 or above, agents will have to be reconfigured to connect to the server. Know more about the GoCD SSL/TLS changes [here](https://github.com/gocd/gocd/issues/7872).
|
||||
As part of GoCD Release v20.2.0, GoCD changed how it handles SSL support. If you are upgrading to GoCD 20.2.0 or above, agents will have to be reconfigured to connect to the server. Know more about the GoCD SSL/TLS changes [here](https://github.com/gocd/gocd/issues/7872).
|
||||
|
||||
To set up TLS for GoCD, system admins will be required to front the GoCD server with a reverse proxy that supports TLS (like Apache, NGINX). Any existing agents that are using TLS, can connect to this reverse proxy. Reverse proxies have the advantage that they make it a lot easier and more convenient to setup and configure various TLS connection parameters. Refer the [GoCD documentation](https://docs.gocd.org/current/installation/configure-reverse-proxy.html) to setup a reverse proxy.
|
||||
|
||||
|
||||
@@ -54,6 +54,7 @@ spec:
|
||||
- name: ssh-secrets
|
||||
secret:
|
||||
secretName: {{ .Values.agent.security.ssh.secretName }}
|
||||
defaultMode: {{ .Values.agent.security.ssh.defaultMode | default 256 }}
|
||||
{{- end }}
|
||||
{{- if .Values.agent.initContainers }}
|
||||
initContainers:
|
||||
|
||||
@@ -58,6 +58,7 @@ spec:
|
||||
- name: ssh-secrets
|
||||
secret:
|
||||
secretName: {{ .Values.server.security.ssh.secretName }}
|
||||
defaultMode: {{ .Values.server.security.ssh.defaultMode | default 256 }}
|
||||
{{- end }}
|
||||
{{- if .Values.server.initContainers }}
|
||||
initContainers:
|
||||
|
||||
@@ -222,6 +222,8 @@ server:
|
||||
enabled: false
|
||||
# server.security.ssh.secretName specifies the name of the k8s secret object that contains the ssh key and known hosts
|
||||
secretName: gocd-server-ssh
|
||||
# server.security.ssh.defaultMode specifies the permission of the files in ~/.ssh directory
|
||||
defaultMode:
|
||||
|
||||
agent:
|
||||
# specifies overrides for agent specific service account creation
|
||||
@@ -371,6 +373,8 @@ agent:
|
||||
enabled: false
|
||||
# agent.security.ssh.secretName specifies the name of the k8s secret object that contains the ssh key and known hosts
|
||||
secretName: gocd-agent-ssh
|
||||
# agent.security.ssh.defaultMode specifies the permission of the files in ~/.ssh directory
|
||||
defaultMode:
|
||||
|
||||
## Configure GoCD agent resource requests and limits
|
||||
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
|
||||
|
||||
Reference in New Issue
Block a user