Skip to content

Commit 6de529f

Browse files
Merge branch 'dev' into valkey-compose
2 parents c26d78a + c05fff3 commit 6de529f

23 files changed

Lines changed: 673 additions & 251 deletions

.github/workflows/test-helm-chart.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,10 @@ jobs:
6868
- name: Check update of "artifacthub.io/changes" HELM annotation
6969
if: env.changed == 'true'
7070
run: |
71+
# fast fail if `git show` fails
72+
set -e
73+
set -o pipefail
74+
7175
target_branch=${{ env.ct-branch }}
7276
7377
echo "Checking Chart.yaml annotation changes"
@@ -76,10 +80,10 @@ jobs:
7680
current_annotation=$(yq e '.annotations."artifacthub.io/changes"' "helm/defectdojo/Chart.yaml")
7781
7882
# Get target branch version of Chart.yaml annotation
79-
target_annotation=$(git show "${{ env.ct-branch }}:helm/defectdojo/Chart.yaml" | yq e '.annotations."artifacthub.io/changes"' -)
83+
target_annotation=$(git show "origin/${{ env.ct-branch }}:helm/defectdojo/Chart.yaml" | yq e '.annotations."artifacthub.io/changes"' -)
8084
8185
if [[ "$current_annotation" == "$target_annotation" ]]; then
82-
echo "::error file=helm/defectdojo/Chart.yaml::The 'artifacthub.io/changes' annotation has not been updated compared to ${{ env.ct-branch }}"
86+
echo "::error::The HELM chart has been updated but the 'artifacthub.io/changes' annotation in 'Chart.yaml' has not been changed (compared to '${{ env.ct-branch }}' branch)"
8387
exit 1
8488
fi
8589

docs/content/en/open_source/upgrading/2.52.md

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,11 @@
22
title: 'Upgrading to DefectDojo Version 2.52.x'
33
toc_hide: true
44
weight: -20250804
5-
description: Replaced Redis with Valkey
5+
description: Replaced Redis with Valkey & Helm chart changes.
66
---
77

8+
## Valkey
9+
810
Since the license change at Redis the fork ValKey has become widely popular and is backed by industry giants such as AWS. AWS is advising to use ValKey over Redis and is using lower prices for ValKey compared to Redis.
911

1012
Defect Dojo 2.52 now uses ValKey as a message broker. Teh existing redit volume can be used by Valkey, so this is just a drop in replacement.
@@ -31,4 +33,34 @@ If you want to be 110% sure no tasks will be lost you could perform the upgrade
3133
`docker compose pull`
3234
`docker compose up -d`
3335

34-
There are no special instructions for upgrading to 2.52.x. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.52.0) for the contents of the release.
36+
## Helm Chart Changes
37+
38+
This release introduces more important changes to the Helm chart configuration:
39+
40+
### Breaking changes
41+
42+
#### Security context
43+
44+
This Helm chart extends security context capabilities to all deployed pods and containers.
45+
You can define a default pod and container security context globally using `securityContext.podSecurityContext` and `securityContext.containerSecurityContext` keys.
46+
Additionally, each deployment can specify its own pod and container security contexts, which will override or merge with the global ones.
47+
48+
#### Fine-grained resources
49+
50+
Now each container can specify the resource requests and limits.
51+
52+
#### Moved values
53+
54+
The following Helm chart values have been modified in this release:
55+
56+
- `securityContext.djangoSecurityContext` → deprecated in favor of container-specific security contexts (`celery.beat.containerSecurityContext`, `celery.worker.containerSecurityContext`, `django.uwsgi.containerSecurityContext` and `dbMigrationChecker.containerSecurityContext`)
57+
- `securityContext.nginxSecurityContext` → deprecated in favor of container-specific security contexts (`django.nginx.containerSecurityContext`)
58+
59+
### Other changes
60+
61+
- **Extra annotations**: Now we can add common annotations to all resources.
62+
63+
There are other instructions for upgrading to 2.52.x. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.52.0) for the contents of the release.
64+
65+
## Releas notes
66+
Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.52.0) for the contents of the release.

helm/defectdojo/README.md

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -524,17 +524,19 @@ A Helm chart for Kubernetes to install DefectDojo
524524
| admin.password | string | `""` | |
525525
| admin.secretKey | string | `""` | |
526526
| admin.user | string | `"admin"` | |
527-
| annotations | object | `{}` | |
527+
| alternativeHosts | list | `[]` | |
528528
| celery.annotations | object | `{}` | |
529529
| celery.beat.affinity | object | `{}` | |
530530
| celery.beat.annotations | object | `{}` | |
531+
| celery.beat.containerSecurityContext | object | `{}` | |
531532
| celery.beat.extraEnv | list | `[]` | |
532533
| celery.beat.extraInitContainers | list | `[]` | |
533534
| celery.beat.extraVolumeMounts | list | `[]` | |
534535
| celery.beat.extraVolumes | list | `[]` | |
535536
| celery.beat.livenessProbe | object | `{}` | |
536537
| celery.beat.nodeSelector | object | `{}` | |
537538
| celery.beat.podAnnotations | object | `{}` | |
539+
| celery.beat.podSecurityContext | object | `{}` | |
538540
| celery.beat.readinessProbe | object | `{}` | |
539541
| celery.beat.replicas | int | `1` | |
540542
| celery.beat.resources.limits.cpu | string | `"2000m"` | |
@@ -548,13 +550,15 @@ A Helm chart for Kubernetes to install DefectDojo
548550
| celery.worker.affinity | object | `{}` | |
549551
| celery.worker.annotations | object | `{}` | |
550552
| celery.worker.appSettings.poolType | string | `"solo"` | |
553+
| celery.worker.containerSecurityContext | object | `{}` | |
551554
| celery.worker.extraEnv | list | `[]` | |
552555
| celery.worker.extraInitContainers | list | `[]` | |
553556
| celery.worker.extraVolumeMounts | list | `[]` | |
554557
| celery.worker.extraVolumes | list | `[]` | |
555558
| celery.worker.livenessProbe | object | `{}` | |
556559
| celery.worker.nodeSelector | object | `{}` | |
557560
| celery.worker.podAnnotations | object | `{}` | |
561+
| celery.worker.podSecurityContext | object | `{}` | |
558562
| celery.worker.readinessProbe | object | `{}` | |
559563
| celery.worker.replicas | int | `1` | |
560564
| celery.worker.resources.limits.cpu | string | `"2000m"` | |
@@ -563,26 +567,35 @@ A Helm chart for Kubernetes to install DefectDojo
563567
| celery.worker.resources.requests.memory | string | `"128Mi"` | |
564568
| celery.worker.startupProbe | object | `{}` | |
565569
| celery.worker.tolerations | list | `[]` | |
570+
| cloudsql.containerSecurityContext | object | `{}` | |
566571
| cloudsql.enable_iam_login | bool | `false` | |
567572
| cloudsql.enabled | bool | `false` | |
573+
| cloudsql.extraEnv | list | `[]` | |
574+
| cloudsql.extraVolumeMounts | list | `[]` | |
568575
| cloudsql.image.pullPolicy | string | `"IfNotPresent"` | |
569576
| cloudsql.image.repository | string | `"gcr.io/cloudsql-docker/gce-proxy"` | |
570577
| cloudsql.image.tag | string | `"1.37.9"` | |
571578
| cloudsql.instance | string | `""` | |
579+
| cloudsql.resources | object | `{}` | |
572580
| cloudsql.use_private_ip | bool | `false` | |
573581
| cloudsql.verbose | bool | `true` | |
574582
| createPostgresqlSecret | bool | `false` | |
575583
| createRedisSecret | bool | `false` | |
576584
| createSecret | bool | `false` | |
585+
| dbMigrationChecker.containerSecurityContext | object | `{}` | |
577586
| dbMigrationChecker.enabled | bool | `true` | |
587+
| dbMigrationChecker.extraEnv | list | `[]` | |
588+
| dbMigrationChecker.extraVolumeMounts | list | `[]` | |
578589
| dbMigrationChecker.resources.limits.cpu | string | `"200m"` | |
579590
| dbMigrationChecker.resources.limits.memory | string | `"200Mi"` | |
580591
| dbMigrationChecker.resources.requests.cpu | string | `"100m"` | |
581592
| dbMigrationChecker.resources.requests.memory | string | `"100Mi"` | |
582593
| disableHooks | bool | `false` | |
583594
| django.affinity | object | `{}` | |
584595
| django.annotations | object | `{}` | |
596+
| django.extraEnv | list | `[]` | |
585597
| django.extraInitContainers | list | `[]` | |
598+
| django.extraVolumeMounts | list | `[]` | |
586599
| django.extraVolumes | list | `[]` | |
587600
| django.ingress.activateTLS | bool | `true` | |
588601
| django.ingress.annotations | object | `{}` | |
@@ -598,6 +611,7 @@ A Helm chart for Kubernetes to install DefectDojo
598611
| django.mediaPersistentVolume.persistentVolumeClaim.size | string | `"5Gi"` | |
599612
| django.mediaPersistentVolume.persistentVolumeClaim.storageClassName | string | `""` | |
600613
| django.mediaPersistentVolume.type | string | `"emptyDir"` | |
614+
| django.nginx.containerSecurityContext.runAsUser | int | `1001` | |
601615
| django.nginx.extraEnv | list | `[]` | |
602616
| django.nginx.extraVolumeMounts | list | `[]` | |
603617
| django.nginx.resources.limits.cpu | string | `"2000m"` | |
@@ -607,6 +621,7 @@ A Helm chart for Kubernetes to install DefectDojo
607621
| django.nginx.tls.enabled | bool | `false` | |
608622
| django.nginx.tls.generateCertificate | bool | `false` | |
609623
| django.nodeSelector | object | `{}` | |
624+
| django.podSecurityContext.fsGroup | int | `1001` | |
610625
| django.replicas | int | `1` | |
611626
| django.service.annotations | object | `{}` | |
612627
| django.service.type | string | `""` | |
@@ -619,6 +634,7 @@ A Helm chart for Kubernetes to install DefectDojo
619634
| django.uwsgi.certificates.certMountPath | string | `"/certs/"` | |
620635
| django.uwsgi.certificates.configName | string | `"defectdojo-ca-certs"` | |
621636
| django.uwsgi.certificates.enabled | bool | `false` | |
637+
| django.uwsgi.containerSecurityContext.runAsUser | int | `1001` | |
622638
| django.uwsgi.enableDebug | bool | `false` | |
623639
| django.uwsgi.extraEnv | list | `[]` | |
624640
| django.uwsgi.extraVolumeMounts | list | `[]` | |
@@ -644,6 +660,7 @@ A Helm chart for Kubernetes to install DefectDojo
644660
| django.uwsgi.startupProbe.periodSeconds | int | `5` | |
645661
| django.uwsgi.startupProbe.successThreshold | int | `1` | |
646662
| django.uwsgi.startupProbe.timeoutSeconds | int | `1` | |
663+
| extraAnnotations | object | `{}` | |
647664
| extraConfigs | object | `{}` | |
648665
| extraEnv | list | `[]` | |
649666
| extraLabels | object | `{}` | |
@@ -656,13 +673,15 @@ A Helm chart for Kubernetes to install DefectDojo
656673
| imagePullSecrets | string | `nil` | |
657674
| initializer.affinity | object | `{}` | |
658675
| initializer.annotations | object | `{}` | |
676+
| initializer.containerSecurityContext | object | `{}` | |
659677
| initializer.extraEnv | list | `[]` | |
660678
| initializer.extraVolumeMounts | list | `[]` | |
661679
| initializer.extraVolumes | list | `[]` | |
662680
| initializer.jobAnnotations | object | `{}` | |
663681
| initializer.keepSeconds | int | `60` | |
664682
| initializer.labels | object | `{}` | |
665683
| initializer.nodeSelector | object | `{}` | |
684+
| initializer.podSecurityContext | object | `{}` | |
666685
| initializer.resources.limits.cpu | string | `"2000m"` | |
667686
| initializer.resources.limits.memory | string | `"512Mi"` | |
668687
| initializer.resources.requests.cpu | string | `"100m"` | |
@@ -672,9 +691,13 @@ A Helm chart for Kubernetes to install DefectDojo
672691
| initializer.tolerations | list | `[]` | |
673692
| localsettingspy | string | `""` | |
674693
| monitoring.enabled | bool | `false` | |
694+
| monitoring.prometheus.containerSecurityContext | object | `{}` | |
675695
| monitoring.prometheus.enabled | bool | `false` | |
696+
| monitoring.prometheus.extraEnv | list | `[]` | |
697+
| monitoring.prometheus.extraVolumeMounts | list | `[]` | |
676698
| monitoring.prometheus.image | string | `"nginx/nginx-prometheus-exporter:1.4.2"` | |
677699
| monitoring.prometheus.imagePullPolicy | string | `"IfNotPresent"` | |
700+
| monitoring.prometheus.resources | object | `{}` | |
678701
| networkPolicy.annotations | object | `{}` | |
679702
| networkPolicy.egress | list | `[]` | |
680703
| networkPolicy.enabled | bool | `false` | |
@@ -715,12 +738,14 @@ A Helm chart for Kubernetes to install DefectDojo
715738
| repositoryPrefix | string | `"defectdojo"` | |
716739
| revisionHistoryLimit | int | `10` | |
717740
| secrets.annotations | object | `{}` | |
718-
| securityContext.djangoSecurityContext.runAsUser | int | `1001` | |
741+
| securityContext.containerSecurityContext.runAsNonRoot | bool | `true` | |
719742
| securityContext.enabled | bool | `true` | |
720-
| securityContext.nginxSecurityContext.runAsUser | int | `1001` | |
743+
| securityContext.podSecurityContext.runAsNonRoot | bool | `true` | |
721744
| serviceAccount.annotations | object | `{}` | |
722745
| serviceAccount.create | bool | `true` | |
723746
| serviceAccount.labels | object | `{}` | |
747+
| serviceAccount.name | string | `""` | |
748+
| siteUrl | string | `""` | |
724749
| tag | string | `"latest"` | |
725750
| tests.unitTests.resources.limits.cpu | string | `"500m"` | |
726751
| tests.unitTests.resources.limits.memory | string | `"512Mi"` | |

0 commit comments

Comments
 (0)