Previously (https://github.com/helm/charts/pull/14545), configuration
was added to allow folks to leverage CredHub as a credential management
for Concourse.
While that allowed people to have that functionality, it was only
partially implemented - mutual TLS was still missing.
This commit aims at addressing that by introducing a
`authenticationMode` key that allows one to either specify certificates
for the authentication, or certificates:
```yaml
concourse:
web:
credhub:
enabled: true
authenticationMode: "secrets"
secrets:
credhubClientId: $client_id
credhubClientSecret: $client_secret
```
or
```yaml
concourse:
web:
credhub:
enabled: true
authenticationMode: "mtls"
secrets:
credhubClientKey: $key
credhubClientCert: $cert
```
In case none of them are set, it fails to render.
Signed-off-by: Ciro S. Costa <cscosta@pivotal.io>
Co-authored-by: Bishoy Youssef <byoussef@pivotal.io>
There's been a long time since the last upgrade that we did to the
subchart that Concourse optionally depends on.
With the upgrade, some values set in the `postgresql` chart changed. As
those are exposed in `concourse`'s `values` too (and we version our
Chart based on its public interface - values.yaml), this made it deserve
a major version bump.
For those users not making use of the subchart (or changing the default
values), no changes ar necessary.
For those who *are* configuring `postgresql.*` values - changes will
almost certainly be necessary.
closes#11610
Signed-off-by: Ciro S. Costa <cscosta@pivotal.io>
* [stable/concourse] Update image tag to 5.3.0
Signed-off-by: Bin Ju <bju@pivotal.io>
Co-authored-by: Taylor Silva <tsilva@pivotal.io>
Signed-off-by: Bin Ju <bju@pivotal.io>
* [stable/concourse] Update readme with correct imageTag value
Signed-off-by: Bin Ju <bju@pivotal.io>
Co-authored-by: Taylor Silva <tsilva@pivotal.io>
* Add possibility to set strategy for rollingUpdates (web)
Signed-off-by: Yann David <davidyann88@gmail.com>
* Bump minor instead of patch
Signed-off-by: Yann David <davidyann88@gmail.com>
* stable/concourse: separate worker, web deployments
- Added .Values.Web.enabled and .Values.worker.enabled (with default to
true).
- if only .Values.web.enable is enabled: only web resources are going to
be created, as well as secrets namespace.
- if only .Values.worker.enable is enabled: only worker resources are going to
be created.
- moved the worker specific and web specific secrets each to a seprate
file and secrets object.
- added .Values.concourse.worker.tsa.port and utilised
.Values.concourse.worker.host in order to alow the user to set the
`CONCOURSE_TSA_HOST` easily.
- removed the template `concourse.concourse.fullname` as it is not used
anymore.
- bumped the chart version to 6.0.0, as this adds new ways to use the
chart.
- added the new variables to the README doc.
for the issue: helm/charts#11280
Signed-off-by: Taylor Silva <tsilva@pivotal.io>
Co-authored-by: Bishoy Youssef <byoussef@pivotal.io>
Signed-off-by: Taylor Silva <tsilva@pivotal.io>
* [stable/concourse] bumping chart version and updating the Readme
Signed-off-by: Taylor Silva <tsilva@pivotal.io>
Co-authored-by: Bishoy Youssef <byoussef@pivotal.io>
* Adds a required check yaml for having either the web or worker enabled
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* Adds required for concourse.worker.tsa in case of worker only deployments
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* updates readme
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* adds changelog file
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* Apply suggestions from code review
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* Bumped major chart version
Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz>
* Added documentation to explain how authentication paramters work.
Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz>
* Added new keyauth variables and conditionals to match them for secrets manager and systems manager. Session token must now be explictly enabled if used.
Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz>
* Fixed typo with awsSsm paramter name
Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz>
* Fixed minor version
Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz>
* Uncommented session token flag and set default to false.
Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz>
* Added missing backticks that broke formatting
Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz>
* [stable/concourse] Easier way to add team workers
- Previously, in order to add an external worker to the web deployment,
worker keys were to be added as a seprate secret or a config map and
then mounted as an addtional volume to the web pod.
- With this feature, only team names and public keys are to be added to
the secrets as an array and the creation of secrets and mounting the
volumes is done automatically.
- Also, removed `.Values.concourse.Web.teamAuthorizedKeys` as it won't
be used anymore.
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* fixing per Ciro's comments
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* concourse/stable bump major version
- also, fixing linting error.
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* adds security caveats and extra reads
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* rename teamKeys to teamAuthorizedKeys
Signed-off-by: Bishoy Youssef <byoussef@pivotal.io>
* [stable/concourse] Upgrade to 5.0 (breaking)
This commit provides the necessary updates to fully support the latest
version of Concourse: 5.0.
BREAKING:
- `concourse.web.auth.mainTeam.allowAllUsers`, which was previously used
to allow any logged user to be part of `main`, has now been removed;
- `concourse.worker.bindDebugPort` is now
`concourse.worker.debugBindPort`;
- `concourse.worker.baggageclaim.bindDebugPort` is now
`concourse.worker.baggageclaim.debugBindPort`;
- `concourse.worker.garden.*` variables that would previously turn into
environment variables that got translated to `gdn`-specfic tunings are
not values that can be set through `concourse.worker.garden` anymore.
These can still be provided through environment variables though -
`CONCOURSE_GARDEN_...` works as before.
DEPRECATIONS:
- `concourse.worker.peerIp` is not used anymore;
- `worker.fatalErrors` are not used anymore in favor of worker
healthchecks through a specific port (`worker-hc`) in the worker
container.
ENHANCEMENTS:
- reduced complexity in the liveness probe for the worker, removing the
need for custom scripts to verify its health;
- bitbucket cloud is now supported through
`secrets.bitbucket-cloud-client*` and other `concourse.web.*`
configurations;
- AWS region settings can now be configured at environment-var level
instead of arguments;
- garden configuration can be specified through `ini` files that can be
passed through `configmap`s;
- RBAC configuration for local users can be specified through
`configmap`s
- ability to opt-out of the automatic removal of
`concourse.worker.workDir` contents
- ability to specify whether `land`ing or `retire`ing should be
performed when terminating the worker pod (through the configuration
of `worker.shutdownSignal`);
- ability to specify custom readinessProbe for the worker;
- more consistent `values.yaml` examples and documentation.
Concourse-specific release notes (that are do not affect the Chart
structure itself) can be found in the Concourse website:
- https://concourse-ci.org/download.html#v500
Signed-off-by: Ciro S. Costa <cscosta@pivotal.io>
* [stable/concourse] Updates README to match values for 5.0
Signed-off-by: Ciro S. Costa <cscosta@pivotal.io>
Previously, it was not possible to include neither additional volumes
nor volume mounts to the web instance.
This ends up prohibiting and operator of specifying configuration for
team authorized keys, or any other future configuration that might
depend on files on disk.
Signed-off-by: Ciro S. Costa <cscosta@pivotal.io>
This commit improves:
- notes regarding the use of the default `test:test` default user that
concourse adds; and
- README instructions
- so that we don't use the future tense too much; and
- instructions regarding credential management and postgresql match the
actual `values.yml` structure.
Signed-off-by: Ciro S. Costa <cscosta@pivotal.io>
* specify additional labels for web service
Signed-off-by: Richard Godden <goddenrich@gmail.com>
* added web service labels to README
Signed-off-by: Richard Godden <goddenrich@gmail.com>
* bump version
Signed-off-by: Richard Godden <goddenrich@gmail.com>
* bump version
Signed-off-by: David J. M. Karlsen <david@davidkarlsen.com>
* control the mount paths of the secret keys and certs
Signed-off-by: Richard Godden <goddenrich@gmail.com>
* added variables to readme
Signed-off-by: Richard Godden <goddenrich@gmail.com>
* secrets mountpath now has defaults
Signed-off-by: Richard Godden <goddenrich@gmail.com>
* using web and worker keys to specify secrets mount path
Signed-off-by: Richard Godden <goddenrich@gmail.com>
* lint
Signed-off-by: Richard Godden <goddenrich@gmail.com>
* changed secrets path keys in README
Signed-off-by: Richard Godden <goddenrich@gmail.com>
* setting secret mount path defaults in the values.yaml instead of the templates
Signed-off-by: rgodden <rgodden@thoughtmachine.net>
* specifying mount path for tls
Signed-off-by: rgodden <rgodden@thoughtmachine.net>
* bump version
Signed-off-by: rgodden <rgodden@thoughtmachine.net>
`imagePullSecrets` can now be specified in order to
be able to pull the image from a registry that requires
auth.
closeshelm/charts#9228.
Signed-off-by: Ciro S. Costa <cscosta@pivotal.io>
Following the example set by the grafana chart (see [1]), this commit
turns `web` probes into configurable entities.
It also makes use of `/api/v1/info` as the default endpoint for
performing the requests against so `web` doesn't return the whole
initial page as a return value (instead, just a very small json from
`/api/v1/info`).
Signed-off-by: Ciro S. Costa <cscosta@pivotal.io>
Previously, configuring ATC as an HTTPS-enabled service wasn't
an easy thing to do.
After this commit, such capability is achieved by configuring
the `tls` object under `concourse.web`:
concourse:
web:
tls: { enabled: true , bindPort: 443 }
With that configured, a cert and a key gets injected into the
containers via secrets:
secrets:
webTlsCert: |
<my_cert_chain>
webTlsKey: |
<my_private_key>
Which are then referenced in the right environment variables and
exposed in the service using the proper port.
Signed-off-by: Ciro S. Costa <cscosta@pivotal.io>
vault auth params are sensitive credentials and should be treated as
secret
This returns auth params functionality closer to concourse chart v1.16.1,
but it is a breaking change compared to that version
Signed-off-by: Chris Hiestand <chrishiestand@gmail.com>
* [stable/concourse] Refactor values.yml to map concourse binary commands
* support concourse version 4.1
* update auth
* refactor credentialsManager and metrics sections in values.yml
* allow config concourse parameters through env insteand of args for
flexibility
Signed-off-by: Rui Yang <ryang@pivotal.io>
* [stable/concourse] add postgresql secrets for its sslmod
*remove check guard for required secrets
*typo fixes
Signed-off-by: Rui Yang <ryang@pivotal.io>
* [stable/concourse] fix prometheus port reference
Signed-off-by: Rui Yang <ryang@pivotal.io>
* [stable/concourse] quotes env vars that take a list of values
Signed-off-by: Rui Yang <ryang@pivotal.io>
* [stable/concourse] bump concourse version to 4.2.1
Signed-off-by: Rui Yang <ryang@pivotal.io>
* [stable/concourse] quote int variables
Signed-off-by: Rui Yang <ryang@pivotal.io>
* Allow user to specify a static IP for the Concourse loadbalancer
Signed-off-by: Divya Dadlani <ddadlani@pivotal.io>
* update readme with loadBalancerIP entry; bump version to 1.15.0;
* update readme description of looadBalancerIP
* Add optional values for additional volumes and volumeMounts
* I have an addiction to additions...
* Add value to override working directory
* Bump minor instead of patch
* Add readme update for new attributes.
* Version bump to 1.15.0
* revert bump to 1.14.0
* [concourse] add nodeselector for web
* bump chart version
* typo
* update values.yaml and README
* bump chart version
* Bump minor version for new feature
* Add support for AWS Secrets Manager
* Rename credentialManager.secretsmanager to credentialManager.awsSecretsManager
* Bump minor version for new feature
Concourse 3.13.0 adds support for exporting metrics to Datadog (see
https://github.com/concourse/atc/pull/269). This adds support for the
new flags, and bumps the Concourse version.
* adding https option to use ACM in AWS and also whitelisting for service type LoadBalancer
* fixing check for range of IPs
* removing extraneous space
* adding description of value
* bumping version
* bumping to 1.6.0
* Fix Vault for `cert` and `token` auth
- `caCert` was renamed to `useCaCert` but not in README or values.yaml
- `vault-client-key` and `vault-client-cert` should only need to be set
when the auth mode has been set to `cert`. Without the check, `approle`
and `token` auth will fail (due to Go not being able to parse the PEM
of "")
* Bump minor
Taylor Silva
Jamie KlassenandJames Thomson
Zoe TianandZoe Tian
Ciro S. CostaandBishoy Youssef
Zabielski, Kamil
taha-au
Taylor SilvaandTaylor Silva
Aaron Gershman
Yann David
Bishoy YoussefandBishoy Youssef
tareks
Ciro S. Costa
Richard Godden
Richard Alberto
Carlos Tadeu Panato Junior
Chris Hiestand
Rui Yang
Divya Dadlani
Norbert Buchmüller
Kamil Szczygieł
Kurt McAlpine
AdamDang
Naoki Ainoya
Dan Wendorf
Daniel Whatmuff
Brian Martin
josecv
Chengfei Shang
Will Tran
Dylan Arbour
Ma Huihuang
Kai Chen