From df6254554b1d333bebb8767c0a6a24508a268e7d Mon Sep 17 00:00:00 2001 From: "Ciro S. Costa" Date: Mon, 20 May 2019 07:23:12 -0400 Subject: [PATCH] [stable/concourse] Update flags for 5.2 (#13295) * [stable/concourse] Update flags for next Concourse release - Adds `CONCOURSE_CLUSTER_NAME` (concourse.web.clusterName) - https://github.com/concourse/concourse/pull/3736 Signed-off-by: Ciro S. Costa * [stable/concourse] add generic secret configurations With the introduction generic caching, we no longer need the vault-specific cacheing flags, while at the same time, having the need of providing new ones (generic). https://github.com/concourse/concourse/pull/3628 Signed-off-by: Ciro S. Costa * [stable/concourse] add auditing flags With the introduction of auditing capabilities (see Auditor#3577 [1]), it's now possible to configure in a per-subsystem basis which API requests an installation should audit. This commit adds the necessary support for such flags. [1]: https://github.com/concourse/concourse/pull/3577 Signed-off-by: Ciro S. Costa * [stable/concourse] update image version to 5.2.0 Signed-off-by: Ciro S. Costa Co-authored-by: Krishna Mannem * [stable/concourse] Add time based build log retention flags concourse/concourse#3560 Signed-off-by: Ciro S. Costa Co-authored-by: Krishna Mannem * [stable/concourse] add support for externalGardenUrl With the addition of `external-garden-url` to the `concourse worker` command, one is now able to reference a non-embedded garden server to be used as the target for container creation. https://github.com/concourse/concourse/pull/3806 Signed-off-by: Ciro S. Costa --- stable/concourse/Chart.yaml | 4 +- .../concourse/templates/web-deployment.yaml | 68 ++++++++++++++-- .../templates/worker-statefulset.yaml | 6 +- stable/concourse/values.yaml | 77 ++++++++++++++++--- 4 files changed, 135 insertions(+), 20 deletions(-) diff --git a/stable/concourse/Chart.yaml b/stable/concourse/Chart.yaml index 7008e70334..9806d9b983 100644 --- a/stable/concourse/Chart.yaml +++ b/stable/concourse/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: concourse -version: 6.1.1 -appVersion: 5.1.0 +version: 6.2.0 +appVersion: 5.2.0 description: Concourse is a simple and scalable CI system. icon: https://avatars1.githubusercontent.com/u/7809479 keywords: diff --git a/stable/concourse/templates/web-deployment.yaml b/stable/concourse/templates/web-deployment.yaml index 6f1718c961..3c89ab6038 100644 --- a/stable/concourse/templates/web-deployment.yaml +++ b/stable/concourse/templates/web-deployment.yaml @@ -52,10 +52,50 @@ spec: args: - web env: + {{- if .Values.concourse.web.clusterName }} + - name: CONCOURSE_CLUSTER_NAME + value: {{ .Values.concourse.web.clusterName | quote }} + {{- end }} {{- if .Values.concourse.web.enableGlobalResources }} - name: CONCOURSE_ENABLE_GLOBAL_RESOURCES value: {{ .Values.concourse.web.enableGlobalResources | quote }} {{- end }} + {{- if .Values.concourse.web.enableBuildAuditing }} + - name: CONCOURSE_ENABLE_BUILD_AUDITING + value: {{ .Values.concourse.web.enableBuildAuditing | quote }} + {{- end }} + {{- if .Values.concourse.web.enableContainerAuditing }} + - name: CONCOURSE_ENABLE_CONTAINER_AUDITING + value: {{ .Values.concourse.web.enableContainerAuditing | quote }} + {{- end }} + {{- if .Values.concourse.web.enableJobAuditing }} + - name: CONCOURSE_ENABLE_JOB_AUDITING + value: {{ .Values.concourse.web.enableJobAuditing | quote }} + {{- end }} + {{- if .Values.concourse.web.enablePipelineAuditing }} + - name: CONCOURSE_ENABLE_PIPELINE_AUDITING + value: {{ .Values.concourse.web.enablePipelineAuditing | quote }} + {{- end }} + {{- if .Values.concourse.web.enableResourceAuditing }} + - name: CONCOURSE_ENABLE_RESOURCE_AUDITING + value: {{ .Values.concourse.web.enableResourceAuditing | quote }} + {{- end }} + {{- if .Values.concourse.web.enableSystemAuditing }} + - name: CONCOURSE_ENABLE_SYSTEM_AUDITING + value: {{ .Values.concourse.web.enableSystemAuditing | quote }} + {{- end }} + {{- if .Values.concourse.web.enableTeamAuditing }} + - name: CONCOURSE_ENABLE_TEAM_AUDITING + value: {{ .Values.concourse.web.enableTeamAuditing | quote }} + {{- end }} + {{- if .Values.concourse.web.enableWorkerAuditing }} + - name: CONCOURSE_ENABLE_WORKER_AUDITING + value: {{ .Values.concourse.web.enableWorkerAuditing | quote }} + {{- end }} + {{- if .Values.concourse.web.enableVolumeAuditing }} + - name: CONCOURSE_ENABLE_VOLUME_AUDITING + value: {{ .Values.concourse.web.enableVolumeAuditing | quote }} + {{- end }} {{- if .Values.concourse.web.secretRetryAttempts }} - name: CONCOURSE_SECRET_RETRY_ATTEMPTS value: {{ .Values.concourse.web.secretRetryAttempts | quote }} @@ -64,6 +104,18 @@ spec: - name: CONCOURSE_SECRET_RETRY_INTERVAL value: {{ .Values.concourse.web.secretRetryInterval | quote }} {{- end }} + {{- if .Values.concourse.web.secretCacheDuration }} + - name: CONCOURSE_SECRET_CACHE_DURATION + value: {{ .Values.concourse.web.secretCacheDuration | quote }} + {{- end }} + {{- if .Values.concourse.web.secretCacheEnabled }} + - name: CONCOURSE_SECRET_CACHE_ENABLED + value: {{ .Values.concourse.web.secretCacheEnabled | quote }} + {{- end }} + {{- if .Values.concourse.web.secretCachePurgeInterval }} + - name: CONCOURSE_SECRET_CACHE_PURGE_INTERVAL + value: {{ .Values.concourse.web.secretCachePurgeInterval | quote }} + {{- end }} {{- if .Values.concourse.web.awsSecretsManager.region }} - name: CONCOURSE_AWS_SECRETSMANAGER_REGION value: {{ .Values.concourse.web.awsSecretsManager.region | quote }} @@ -204,6 +256,14 @@ spec: - name: CONCOURSE_MAX_BUILD_LOGS_TO_RETAIN value: {{ .Values.concourse.web.maxBuildLogsToRetain | quote }} {{- end }} + {{- if .Values.concourse.web.defaultDaysToRetainBuildLogs }} + - name: CONCOURSE_DEFAULT_DAYS_TO_RETAIN_BUILD_LOGS + value: {{ .Values.concourse.web.defaultDaysToRetainBuildLogs | quote }} + {{- end }} + {{- if .Values.concourse.web.maxDaysToRetainBuildLogs }} + - name: CONCOURSE_MAX_DAYS_TO_RETAIN_BUILD_LOGS + value: {{ .Values.concourse.web.maxDaysToRetainBuildLogs | quote }} + {{- end }} {{- if .Values.concourse.web.defaultTaskCpuLimit }} - name: CONCOURSE_DEFAULT_TASK_CPU_LIMIT value: {{ .Values.concourse.web.defaultTaskCpuLimit | quote }} @@ -384,10 +444,6 @@ spec: - name: CONCOURSE_VAULT_AUTH_BACKEND_MAX_TTL value: {{ .Values.concourse.web.vault.authBackendMaxTtl | quote }} {{- end }} - {{- if .Values.concourse.web.vault.cache }} - - name: CONCOURSE_VAULT_CACHE - value: {{ .Values.concourse.web.vault.cache | quote }} - {{- end }} {{- if .Values.concourse.web.vault.caPath }} - name: CONCOURSE_VAULT_CA_PATH value: {{ .Values.concourse.web.vault.caPath | quote }} @@ -396,10 +452,6 @@ spec: - name: CONCOURSE_VAULT_INSECURE_SKIP_VERIFY value: {{ .Values.concourse.web.vault.insecureSkipVerify | quote }} {{- end }} - {{- if .Values.concourse.web.vault.maxLease }} - - name: CONCOURSE_VAULT_MAX_LEASE - value: {{ .Values.concourse.web.vault.maxLease | quote }} - {{- end }} {{- if .Values.concourse.web.vault.retryInitial }} - name: CONCOURSE_VAULT_RETRY_INITIAL value: {{ .Values.concourse.web.vault.retryInitial | quote }} diff --git a/stable/concourse/templates/worker-statefulset.yaml b/stable/concourse/templates/worker-statefulset.yaml index dc6bb0ac73..7af3841861 100644 --- a/stable/concourse/templates/worker-statefulset.yaml +++ b/stable/concourse/templates/worker-statefulset.yaml @@ -181,8 +181,12 @@ spec: value: "{{ .Values.worker.keySecretsPath }}/host_key.pub" - name: CONCOURSE_TSA_WORKER_PRIVATE_KEY value: "{{ .Values.worker.keySecretsPath }}/worker_key" + {{- if .Values.concourse.worker.externalGardenUrl }} + - name: CONCOURSE_EXTERNAL_GARDEN_URL + value: {{ .Values.concourse.worker.externalGardenUrl | quote }} + {{- end }} {{- if .Values.concourse.worker.garden.useHoudini }} - - name: CONCOURSE_GARDEN_USE_HOUDINI + - name: CONCOURSE_GARDEN_USE_HOUDINI value: {{ .Values.concourse.worker.garden.useHoudini | quote }} {{- end }} {{- if .Values.concourse.worker.garden.bin }} diff --git a/stable/concourse/values.yaml b/stable/concourse/values.yaml index 1ddb44c1a3..adbf95871e 100644 --- a/stable/concourse/values.yaml +++ b/stable/concourse/values.yaml @@ -19,7 +19,7 @@ image: concourse/concourse ## of `concourse/concourse`. ## Ref: https://hub.docker.com/r/concourse/concourse/tags/ ## -imageTag: "5.1.0" +imageTag: "5.2.0" ## Specific image digest to use in place of a tag. ## Ref: https://kubernetes.io/docs/concepts/configuration/overview/#container-images @@ -52,11 +52,51 @@ concourse: ## through the `concourse web` command. ## web: + ## A name for this Concourse cluster, to be displayed on the dashboard page. + ## + clusterName: + ## Enable equivalent resources across pipelines and teams to share a single version history. ## Ref: https://concourse-ci.org/global-resources.html ## enableGlobalResources: true + ## Enable auditing for all api requests connected to builds. + ## + enableBuildAuditing: false + + ## Enable auditing for all api requests connected to containers. + ## + enableContainerAuditing: false + + ## Enable auditing for all api requests connected to jobs. + ## + enableJobAuditing: false + + ## Enable auditing for all api requests connected to pipelines. + ## + enablePipelineAuditing: false + + ## Enable auditing for all api requests connected to resources. + ## + enableResourceAuditing: false + + ## Enable auditing for all api requests connected to system transactions. + ## + enableSystemAuditing: false + + ## Enable auditing for all api requests connected to teams. + ## + enableTeamAuditing: false + + ## Enable auditing for all api requests connected to workers. + ## + enableWorkerAuditing: false + + ## Enable auditing for all api requests connected to volumes. + ## + enableVolumeAuditing: false + ## The number of attempts secret will be retried to be fetched, ## in case a retryable error happens. ## @@ -66,6 +106,20 @@ concourse: ## secretRetryInterval: + ## Enable in-memory cache for secrets. + ## + secretCacheEnabled: false + + ## If the cache is enabled, secret values will be cached for not longer + ## than this duration (it can be less, if underlying secret lease time + ## is smaller). + ## + secretCacheDuration: + + ## If the cache is enabled, expired items will be removed on this internal. + ## + secretCachePurgeInterval: + ## Minimum level of logs to see. Possible options: debug, info, error. ## logLevel: @@ -174,6 +228,14 @@ concourse: ## maxBuildLogsToRetain: + ## Default days to retain build logs. 0 means unlimited. + ## + defaultDaysToRetainBuildLogs: + + ## Maximum days to retain build logs, 0 means not specified. Will override values configured in jobs. + ## + maxDaysToRetainBuildLogs: + ## Default max number of cpu shares per task, 0 means unlimited. ## defaultTaskCpuLimit: @@ -329,14 +391,6 @@ concourse: ## authBackend: "" - ## Cache returned secrets for their lease duration in memory - ## - cache: false - - ## If the cache is enabled, and this is set, override secrets lease duration with a maximum value - ## - maxLease: - ## Path to a directory of PEMEncoded CA cert files to verify the vault server SSL cert. ## caPath: @@ -1024,6 +1078,11 @@ concourse: ## workerPrivateKey: + ## API endpoint of an externally managed Garden server to use instead of + ## running the embedded Garden server. + ## + externalGardenUrl: + garden: ## Path to the 'gdn' executable (or leave as 'gdn' to find it in $PATH) ##