github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-22 13:57:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/pomerium] Sync 4.2.2 for bug fixes (#20229)

Browse Source 
* Fixes the annotations in deployments and services (#48)

Signed-off-by: Victor Noël <victornoel@users.noreply.github.com>

* * docs: fix ingress default value

Signed-off-by: Bobby DeSimone <desimone@users.noreply.github.com>

Co-authored-by: Victor Noël <victornoel@users.noreply.github.com>
Co-authored-by: Bobby DeSimone <desimone@users.noreply.github.com>
This commit is contained in:
Travis Groth
2020-01-19 09:53:35 -08:00
committed by Kubernetes Prow Robot
co-authored by Victor Noël Bobby DeSimone
parent 70d0e2a776
commit cac6bbde93
7 changed files with 72 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/pomerium/Chart.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
apiVersion: v1
name: pomerium
version: 4.2.0
version: 4.2.2
appVersion: 0.5.2
home: http://www.pomerium.io/
icon: https://www.pomerium.io/logo.svg
stable/pomerium/README.md
+18 -12
View File
@@ -69,18 +69,20 @@ The command removes nearly all the Kubernetes components associated with the cha
In default configuration, this chart will automatically generate TLS certificates in a helm `pre-install` hook for the Pomerium services to communicate with.
Upon delete, you will need to manually delete the generated secrets. Example:
Upon delete, you will need to manually delete the generated secrets. Example:
```console
kubectl delete secret -l app.kubernetes.io/name=pomerium
```
You may force recreation of your TLS certificates by setting `config.forceGenerateTLS` to `true`. Delete any existing TLS secrets first to prevent errors, and make sure you set back to `false` for your next helm upgrade command or your deployment will fail due to existing Secrets.
You may force recreation of your TLS certificates by setting `config.forceGenerateTLS` to `true`. Delete any existing TLS secrets first to prevent errors, and make sure you set back to `false` for your next helm upgrade command or your deployment will fail due to existing Secrets.
### Self Provisioned
If you wish to provide your own TLS certificates in secrets, you should:
1) turn `generateTLS` to `false`
2) specify `authenticate.existingTLSSecret`, `authorize.existingTLSSecret`, and `proxy.existingTLSSecret`, pointing at the appropriate TLS certificate for each service.
1. turn `generateTLS` to `false`
2. specify `authenticate.existingTLSSecret`, `authorize.existingTLSSecret`, and `proxy.existingTLSSecret`, pointing at the appropriate TLS certificate for each service.
All services can share the secret if appropriate.
@@ -146,7 +148,7 @@ A full listing of Pomerium's configuration variables can be found on the [config
| `tracing.provider` | Specifies the tracing provider to configure (Valid options: Jaeger) | Required |
| `tracing.jaeger.collector_endpoint` | The jaeger collector endpoint | Required |
| `tracing.jaeger.agent_endpoint` | The jaeger agent endpoint | Required |
| `ingress.enabled` | Enables Ingress for pomerium | `false` |
| `ingress.enabled` | Enables Ingress for pomerium | `true` |
| `ingress.annotations` | Ingress annotations | `{}` |
| `ingress.hosts` | Ingress accepted hostnames | `[]` |
| `ingress.tls` | Ingress TLS configuration | `[]` |
@@ -157,22 +159,25 @@ A full listing of Pomerium's configuration variables can be found on the [config
## Changelog
### 4.0.0
- Upgrade to Pomerium v0.4.0
- Handle breaking changes from Pomerium
### 3.0.0
- Refactor TLS certificates to use Kubernetes TLS secrets
- Generate TLS certificates in a hook to prevent certificate churn
### 2.0.0
- Expose replica count for individual services
- Switch Authorize service to CluserIP for client side load balancing
- Switch Authorize service to ClusterIP for client side load balancing
- You must run pomerium v0.3.0+ to support this feature correctly
## Upgrading
### 4.0.0
- There are no user facing changes in this chart release
- See [Pomerium Changelog](https://www.pomerium.io/docs/upgrading.html#since-0-3-0) for internal details
@@ -194,14 +199,15 @@ A full listing of Pomerium's configuration variables can be found on the [config
- [Move and convert your certificates](scripts/upgrade-v3.0.0.sh) to type TLS Secrets and configure `[service].existingTLSSecret` to point to your secrets
- **OR:** To continue using your certificates from the existing config, set `config.existingLegacyTLSSecret` to `true`
****
---
### 2.0.0
- You will need to run `helm upgrade --force` to recreate the authorize service correctly
## Metrics Discovery Configuration
This chart provices two ways to surface metrics for discovery. Under normal circumstances, you will only set up one method.
This chart provides two ways to surface metrics for discovery. Under normal circumstances, you will only set up one method.
### Prometheus Operator
@@ -217,15 +223,14 @@ serviceMonitor:
enabled: true
labels:
release: prometheus # default
```
Example ServiceMonitor configuration:
```yaml
serviceMonitorSelector:
matchLabels:
release: prometheus # operator chart default
serviceMonitorSelector:
matchLabels:
release: prometheus # operator chart default
```
### Prometheus kubernetes_sd_configs
@@ -243,6 +248,7 @@ service:
```
Example prometheus discovery config:
```yaml
- job_name: 'pomerium'
metrics_path: /metrics
stable/pomerium/templates/authenticate-service.yaml
+11 -9
View File
@@ -11,15 +11,17 @@ metadata:
{{- if .Values.service.labels }}
{{ toYaml .Values.service.labels | indent 4 }}
{{- end }}
annotations:
{{- if .Values.authenticate.service.annotations }}
{{- range $key, $value := .Values.authenticate.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.service.annotations }}
{{- range $key, $value := .Values.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- if or .Values.authenticate.service.annotations .Values.service.annotations }}
annotations:
{{- if .Values.authenticate.service.annotations }}
{{- range $key, $value := .Values.authenticate.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.service.annotations }}
{{- range $key, $value := .Values.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
spec:
type: {{ .Values.service.type }}
stable/pomerium/templates/authorize-deployment.yaml
+10 -8
View File
@@ -10,15 +10,17 @@ metadata:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: authorize
name: {{ template "pomerium.authorize.fullname" . }}
{{- if or .Values.authorize.deployment.annotations .Values.annotations }}
annotations:
{{- if .Values.authorize.deployment.annotations }}
{{- range $key, $value := .Values.authorize.deployment.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.annotations }}
{{- range $key, $value := .Values.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- if .Values.authorize.deployment.annotations }}
{{- range $key, $value := .Values.authorize.deployment.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.annotations }}
{{- range $key, $value := .Values.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
spec:
replicas: {{ default .Values.replicaCount .Values.authorize.replicaCount }}
stable/pomerium/templates/authorize-service.yaml
+11 -9
View File
@@ -11,15 +11,17 @@ metadata:
{{- if .Values.service.labels }}
{{ toYaml .Values.service.labels | indent 4 }}
{{- end }}
annotations:
{{- if .Values.authorize.service.annotations }}
{{- range $key, $value := .Values.authorize.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.service.annotations }}
{{- range $key, $value := .Values.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- if or .Values.authorize.service.annotations .Values.service.annotations }}
annotations:
{{- if .Values.authorize.service.annotations }}
{{- range $key, $value := .Values.authorize.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.service.annotations }}
{{- range $key, $value := .Values.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
spec:
{{- if .Values.service.authorize.headless }}
stable/pomerium/templates/proxy-deployment.yaml
+10 -8
View File
@@ -10,15 +10,17 @@ metadata:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: proxy
name: {{ template "pomerium.proxy.fullname" . }}
{{- if or .Values.proxy.deployment.annotations .Values.annotations }}
annotations:
{{- if .Values.proxy.deployment.annotations }}
{{- range $key, $value := .Values.proxy.deployment.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.annotations }}
{{- range $key, $value := .Values.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- if .Values.proxy.deployment.annotations }}
{{- range $key, $value := .Values.proxy.deployment.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.annotations }}
{{- range $key, $value := .Values.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
spec:
replicas: {{ default .Values.replicaCount .Values.proxy.replicaCount }}
stable/pomerium/templates/proxy-service.yaml
+11 -9
View File
@@ -11,15 +11,17 @@ metadata:
{{- if .Values.service.labels }}
{{ toYaml .Values.service.labels | indent 4 }}
{{- end }}
annotations:
{{- if .Values.proxy.service.annotations }}
{{- range $key, $value := .Values.proxy.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.service.annotations }}
{{- range $key, $value := .Values.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- if or .Values.proxy.service.annotations .Values.service.annotations }}
annotations:
{{- if .Values.proxy.service.annotations }}
{{- range $key, $value := .Values.proxy.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- else if .Values.service.annotations }}
{{- range $key, $value := .Values.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
spec:
type: {{ .Values.service.type }}