[xray] 3.36.2 release

cedvict · Nov 15, 2021 · c8efb59 · c8efb59
1 parent 71249e9
commit c8efb59
Show file tree

Hide file tree

Showing 8 changed files with 121 additions and 23 deletions.
diff --git a/stable/xray/CHANGELOG.md b/stable/xray/CHANGELOG.md
@@ -1,10 +1,19 @@
 # JFrog Xray Chart Changelog
 All changes to this chart will be documented in this file.
 
-## [103.35.0] - Oct 8, 2021
+## [103.36.2] - Oct 14, 2021
+* Added default values cpu and memeory in initContainers
+* Updated router version to `7.26.0`
+* Updated (`rbac.create` and `serviceAccount.create` to false by default) for least privileges
+* Fixed incorrect data type for `Values.router.serviceRegistry.insecure` in default values.yaml [GH-1514](https://github.com/jfrog/charts/pull/1514/files)
+* **IMPORTANT**
+* Changed init-container images from `alpine` to `ubi8/ubi-minimal`
+* Fixed incorrect data type for `Values.router.serviceRegistry.insecure` in default values.yaml [GH-1514](https://github.com/jfrog/charts/pull/1514/files)
+* Added Observability service
+
+## [103.34.0] - Sep 20, 2021
 * Added min kubeVersion ">= 1.14.0-0" in chart.yaml
 * Update alpine tag version to `3.14.2`
-* Fixed incorrect data type for `Values.router.serviceRegistry.insecure` in default values.yaml [GH-1514](https://github.com/jfrog/charts/pull/1514/files)
 
 ## [103.32.3] - Sep 08, 2021
 * Dropped NET_RAW capability for the containers

diff --git a/stable/xray/Chart.yaml b/stable/xray/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 3.35.0
+appVersion: 3.36.2
 dependencies:
 - condition: postgresql.enabled
   name: postgresql
@@ -23,4 +23,4 @@ name: xray
 sources:
 - https://github.com/jfrog/charts
 type: application
-version: 103.35.0
+version: 103.36.2
diff --git a/stable/xray/README.md b/stable/xray/README.md
@@ -4,7 +4,7 @@
 
 ## Prerequisites Details
 
-* Kubernetes 1.12+
+* Kubernetes 1.14+
 
 ## Chart Details
 

diff --git a/stable/xray/ci/test-values.yaml b/stable/xray/ci/test-values.yaml
@@ -35,3 +35,8 @@ autoscaling:
   minReplicas: 1
   maxReplicas: 3
   targetCPUUtilizationPercentage: 70
+rbac:
+  create: true
+serviceAccount:
+  create: true
+  automountServiceAccountToken: true
diff --git a/stable/xray/logo/xray-logo.png b/stable/xray/logo/xray-logo.png
diff --git a/stable/xray/templates/xray-serviceaccount.yaml b/stable/xray/templates/xray-serviceaccount.yaml
@@ -8,4 +8,5 @@ metadata:
     release: {{ .Release.Name | quote }}
     heritage: {{ .Release.Service | quote }}
   name: {{ template "xray.serviceAccountName" . }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 {{- end }}
diff --git a/stable/xray/templates/xray-statefulset.yaml b/stable/xray/templates/xray-statefulset.yaml
@@ -166,12 +166,15 @@ spec:
         resources:
 {{ toYaml .Values.initContainers.resources | indent 10 }}
         command:
-        - 'sh'
-        - '-c'
-        - >
-          until nc -z -w 2 {{ .Release.Name }}-postgresql {{ .Values.postgresql.service.port }} && echo database ok; do
-            sleep 2;
-          done;
+        - /bin/bash
+        - -c
+        - |
+          echo "Waiting for postgresql to come up"
+          ready=false;
+          while ! $ready; do echo waiting;
+            timeout 2s bash -c "</dev/tcp/{{ .Release.Name }}-postgresql/{{ .Values.postgresql.service.port }}"; exit_status=$?;
+            if [[ $exit_status -eq 0 ]]; then ready=true; echo "database ok"; fi; sleep 1; 
+          done
       {{- end }}
     {{- if or .Values.common.customInitContainers .Values.global.customInitContainers }}
 {{ tpl (include "xray.customInitContainers" .) . | indent 6 }}
@@ -226,6 +229,37 @@ spec:
         readinessProbe:
 {{ tpl .Values.router.readinessProbe.config . | indent 10 }}
 {{- end }}
+      - name: {{ .Values.observability.name }}
+        image: {{ include "xray.getImageInfoByValue" (list . "observability") }}
+        imagePullPolicy: {{ .Values.observability.image.imagePullPolicy }}
+        securityContext:
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - NET_RAW
+        command:
+          - '/bin/sh'
+          - '-c'
+          - >
+          {{- with .Values.common.preStartCommand }}
+            echo "Running custom common preStartCommand command";
+            {{ tpl . $ }};
+          {{- end }}
+            exec /opt/jfrog/observability/app/bin/entrypoint-observability.sh;
+        volumeMounts:
+        - name: data-volume
+          mountPath: "{{ .Values.observability.persistence.mountPath }}"
+        resources:
+{{ toYaml .Values.observability.resources | indent 10 }}
+      {{- if .Values.observability.startupProbe.enabled }}
+        startupProbe:
+{{ tpl .Values.observability.startupProbe.config . | indent 10 }}
+      {{- end }}
+      {{- if .Values.observability.livenessProbe.enabled }}
+        livenessProbe:
+{{ tpl .Values.observability.livenessProbe.config . | indent 10 }}
+      {{- end }}
       - name: {{ .Values.server.name }}
         image: {{ include "xray.getImageInfoByValue" (list . "server") }}
         imagePullPolicy: {{ .Values.imagePullPolicy }}

diff --git a/stable/xray/values.yaml b/stable/xray/values.yaml
@@ -28,6 +28,7 @@ global:
 
   # customSidecarContainers: |
 
+  ## certificates added to this secret will be copied to $JFROG_HOME/xray/var/etc/security/keys/trusted directory
   customCertificates:
     enabled: false
     # certificateSecretName:
@@ -40,18 +41,18 @@ global:
 ##
 # fullnameOverride:
 
-initContainerImage: releases-docker.jfrog.io/alpine:3.14.2
+initContainerImage: releases-docker.jfrog.io/ubi-minimal:8.4-210
 imagePullPolicy: IfNotPresent
 
 # Init containers
 initContainers:
-  resources: {}
-#    requests:
-#      memory: "64Mi"
-#      cpu: "10m"
-#    limits:
-#      memory: "128Mi"
-#      cpu: "250m"
+  resources:
+    requests:
+      memory: "50Mi"
+      cpu: "10m"
+    limits:
+      memory: "1Gi"
+      cpu: "1"
 
 # For supporting pulling from private registries
 imagePullSecrets:
@@ -77,6 +78,7 @@ xray:
   persistence:
     mountPath: /var/opt/jfrog/xray
 
+  ## certificates added to this secret will be copied to $JFROG_HOME/xray/var/etc/security/keys/trusted directory
   customCertificates:
     enabled: false
     # certificateSecretName:
@@ -109,7 +111,7 @@ xray:
     router:
       topology:
         local:
-          requiredServiceTypes: 'jfxr,jfxana,jfxidx,jfxpst'
+          requiredServiceTypes: 'jfxr,jfxana,jfxidx,jfxpst,jfob'
       serviceRegistry:
         insecure: {{ .Values.router.serviceRegistry.insecure }}
     shared:
@@ -150,7 +152,7 @@ xray:
 ## Role Based Access
 ## Ref: https://kubernetes.io/docs/admin/authorization/rbac/
 rbac:
-  create: true
+  create: false
   role:
     ## Rules to create. It follows the role specification
     rules:
@@ -213,10 +215,12 @@ autoscaling:
 ## Ref: https://kubernetes.io/docs/admin/service-accounts-admin/
 ##
 serviceAccount:
-  create: true
+  create: false
   ## The name of the ServiceAccount to use.
   ## If not set and create is true, a name is generated using the fullname template
   name:
+  ## Explicitly mounts the API credentials for the Service Account
+  automountServiceAccountToken: false
 
 # PostgreSQL
 ## Configuration values for the postgresql dependency
@@ -774,7 +778,7 @@ router:
   image:
     registry: releases-docker.jfrog.io
     repository: jfrog/router
-    tag: 7.25.1
+    tag: 7.26.0
     imagePullPolicy: IfNotPresent
   serviceRegistry:
     ## Service registry (Access) TLS verification skipped if enabled
@@ -842,6 +846,51 @@ router:
   # Add any of the loggers to a sidecar if you want to be able to see them with kubectl logs or a log collector in your k8s cluster
   loggers: []
 
+observability:
+  name: observability
+  image:
+    registry: releases-docker.jfrog.io
+    repository: jfrog/observability
+    tag: 1.1.3
+    imagePullPolicy: IfNotPresent
+  resources: {}
+  #  requests:
+  #    memory: "100Mi"
+  #    cpu: "100m"
+  #  limits:
+  #    memory: "1Gi"
+  #    cpu: "1"
+
+  livenessProbe:
+    enabled: true
+    config: |
+      exec:
+        command:
+          - sh
+          - -c
+          - curl --fail --max-time 1 http://localhost:8036/api/v1/system/liveness
+      initialDelaySeconds: {{ if semverCompare "<v1.20.0-0" .Capabilities.KubeVersion.Version }}90{{ else }}0{{ end }}
+      failureThreshold: 10
+      timeoutSeconds: 5
+      periodSeconds: 10
+      successThreshold: 1
+
+  startupProbe:
+    enabled: true
+    config: |
+      exec:
+        command:
+          - sh
+          - -c
+          - curl --fail --max-time 1 http://localhost:8036/api/v1/system/readiness
+      initialDelaySeconds: 30
+      failureThreshold: 90
+      periodSeconds: 5
+      timeoutSeconds: 5
+
+  persistence:
+    mountPath: "/var/opt/jfrog/observability"
+
 # Filebeat Sidecar container
 ## The provided filebeat configuration is for Xray logs. It assumes you have a logstash installed and configured properly.
 filebeat: