v19 Chart Release

CHANGELOG.md

@@ -61,3 +61,11 @@ in concourse/concourse#5141 (part of 6.0), riemann was completely removed, makin
 # v17.0.0:
 
 - Upgrade the PostgreSQL Chart to v11. As the backward compatibility is not guarantee when upgrading the PostgreSQL chart to this major version, a major bump was needed. Please refer to [PostgreSQL Chart](https://docs.bitnami.com/kubernetes/infrastructure/postgresql/administration/upgrade#to-1100) for details.
+
+# v18.0.0:
+
+- Upgrade the PostgreSQL Chart to v16. As the backward compatibility is not guarantee when upgrading the PostgreSQL chart to this major version, a major bump was needed.
+
+# v19.0.0:
+
+- Removed the [bitnami/postgresql](https://github.com/bitnami/charts/tree/main/bitnami/postgresql) chart dependency (see [bitnami/charts#35164](https://github.com/bitnami/charts/issues/35164)) and replaced it with a StatefulSet that deploys the `postgres` image from Docker Hub. See [this comment](https://github.com/concourse/concourse-chart/pull/389#issuecomment-3253724558) for a migration guide. Reminder that the PostgreSQL dependency has never been intended for production usage. [#389](https://github.com/concourse/concourse-chart/pull/389).

Chart.yaml

@@ -13,11 +13,6 @@ home: https://concourse-ci.org/
 sources:
   - https://github.com/concourse/concourse-chart
   - https://github.com/concourse/concourse
-dependencies:
-  - name: postgresql
-    version: 16.7.14
-    repository: https://charts.bitnami.com/bitnami
-    condition: postgresql.enabled
 maintainers:
   - name: concourse-team
     email: concourse@vmware.com

README.md

@@ -42,7 +42,7 @@ $ helm delete my-release
 
 The command removes nearly all the Kubernetes components associated with the chart and deletes the release.
 
-> ps: By default, a [namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) is created for the `main` team named after `${RELEASE}-main` and is kept untouched after a `helm delete`.
+> PS: By default, a [namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/) is created for the `main` team named after `${RELEASE}-main` and is kept untouched after a `helm delete`.
 > See the [Configuration section](#configuration) for how to control the behavior.
 
 
@@ -96,14 +96,39 @@ The following table lists the configurable parameters of the Concourse chart and
 | `persistence.worker.storageClass` | Concourse Worker Persistent Volume Storage Class | `generic` |
 | `persistence.worker.labels` | Concourse Worker Persistent Volume Labels | `{}` |
 | `postgresql.enabled` | Enable PostgreSQL as a chart dependency | `true` |
-| `postgresql.persistence.accessModes` | Persistent Volume Access Mode | `["ReadWriteOnce"]` |
+| `postgresql.fullnameOverride` | Provide a name to substitute for the full name of postgresql resources | `nil` |
+| `postgresql.labels` | Add additional labels to the postgresql statefulSet | `{}` |
+| `postgresql.service.enabled` | Enable postgresql service | `true` |
+| `postgresql.service.type` | Service type | `ClusterIP` |
+| `postgresql.service.clusterIPs` | Hardcode services IPs | `[]` |
+| `postgresql.service.extraSpec` | Add extra `spec` attributes to the postgresql service. | `{}` |
+| `postgresql.image` | Set the image repository | `postgres` |
+| `postgresql.imageTag` | Set the image tag, exclusive with imageDigest. | `17` |
+| `postgresql.imageDigest` | Set the image tag, exclusive with the imageTag | `""` |
+| `postgresql.version` | Set the postgresql major version, must match the one of your image. | `17` |
+| `postgresql.customPgData` | Customize the PG_DATA path, defaults to `/var/lib/postgres/{{postgresql.version}}/docker`. Adjust the dataVolumeMountPath to match with the new PG_DATA. e.g `/opt/postgresql/data` | `"17"` |
+| `postgresql.dataVolumeMountPath` | The mountPath of the volume that will contains the PG_DATA e.g `/opt/postgresql` | `nil` |
+| `postgresql.securityContext` | Add securityContext attributes to the statefulSet | `nil` |
+| `postgresql.annotations` | Add annotations to the postgresql statefulset | `nil` |
+| `postgresql.secretAnnotations` | Add annotations to the secret | `nil` |
+| `postgresql.configMapAnnotations` | Add annotations to the environment configmap | `nil` |
+| `postgresql.configOverride` | Override the default postgresql config file | `nil` |
+| `postgresql.resources` | Set the resources for the statefulSet | `{"requests":{"cpu":"250m","ephemeral-storage":"50Mi","memory":"256Mi"},"limits":{"cpu":"500m","ephemeral-storage":"2Gi","memory":"512Mi"}}` |
+| `postgresql.auth.user` | Set the postgres user | `concourse` |
+| `postgresql.auth.password` | Set the postgres password | `concourse` |
+| `postgresql.auth.database` | Set the postgres database name | `concourse` |
+| `postgresql.extraEnvironment` | Add extra arguments to the postgresql command | `{}` |
+| `postgresql.extraArgs` | Add extra environment variables | `{}` |
+| `postgresql.commandOverride` | Override the command of postgres | `[]` |
+| `postgresql.argsOverride` | Override the args of postgres | `[]` |
+| `postgresql.sensitiveEnvironment` | Add extra sensitive env vars (will be injected with a secret) | `{}` |
+| `postgresql.lifecycle` | Add a lifecycle attribute to the postgresql container, see [the k8s docs](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#lifecycle) | `nil` |
 | `postgresql.persistence.enabled` | Enable PostgreSQL persistence using Persistent Volume Claims | `true` |
-| `postgresql.persistence.size` | Persistent Volume Storage Size | `8Gi` |
+| `postgresql.persistence.pvcNameOverride` | Override the name of the pvc template in the postgresql statefulSet. Useful to re-use an existing pvc. | `""` |
 | `postgresql.persistence.storageClass` | Concourse data Persistent Volume Storage Class | `nil` |
+| `postgresql.persistence.accessModes` | Persistent Volume Access Mode | `["ReadWriteOnce"]` |
+| `postgresql.persistence.resources` | Set storage requests and limits | `{ "requests": { "storage": "8Gi" } }` |
 | `persistence.worker.selector` | Concourse Worker Persistent Volume selector | `nil` |
-| `postgresql.auth.database` | PostgreSQL Database to create | `concourse` |
-| `postgresql.auth.password` | PostgreSQL Password for the new user | `concourse` |
-| `postgresql.auth.username` | PostgreSQL User to create | `concourse` |
 | `rbac.apiVersion` | RBAC version | `v1beta1` |
 | `rbac.create` | Enables creation of RBAC resources | `true` |
 | `rbac.webServiceAccountName` | Name of the service account to use for web pods if `rbac.create` is `false` | `default` |
@@ -222,7 +247,7 @@ The following table lists the configurable parameters of the Concourse chart and
 | `web.prometheus.ServiceMonitor.enabled` | Enable the creation of a serviceMonitor object for the Prometheus operator | `false` |
 | `web.prometheus.ServiceMonitor.interval` | The interval the Prometheus endpoint is scraped | `30s` |
 | `web.prometheus.ServiceMonitor.namespace` | The namespace where the serviceMonitor object has to be created | `nil` |
-| `web.prometheus.ServiceMonitor.labels` | Additional lables for the serviceMonitor object | `nil` |
+| `web.prometheus.ServiceMonitor.labels` | Additional labels for the serviceMonitor object | `nil` |
 | `web.prometheus.ServiceMonitor.metricRelabelings` | Relabel metrics as defined [here](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) | `nil` |
 | `web.readinessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/api/v1/info` |
 | `web.readinessProbe.httpGet.port` | Name or number of the port to access on the container | `atc` |
@@ -518,7 +543,7 @@ web:
 
 ### PostgreSQL
 
-By default, this chart uses a PostgreSQL database deployed as a chart dependency (see the [PostgreSQL chart](https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md)), with default values for username, password, and database name. These can be modified by setting the `postgresql.auth.*` values.
+By default, this chart deploys a single postgresql instance as a statefulSet, the conection details will be shared with concourse. You can change the connection details using the attributes of the `postgresql.auth`.
 
 You can also bring your own PostgreSQL. To do so, set `postgresql.enabled` to `false`, and then configure Concourse's `postgres` values (`concourse.web.postgres.*`) See [values.yaml](values.yaml).
 
@@ -686,7 +711,7 @@ secrets:
 
 You can specify either `conjurAuthnApiKey` that corresponds to the Conjur host OR `conjurAuthnTokenFile` if running in K8s or IAM.
 
-If your Conjur instance is deployed with a self-signed SSL certifcate, you will need to set `conjurCACert` property in your `values.yaml`.
+If your Conjur instance is deployed with a self-signed SSL certificate, you will need to set `conjurCACert` property in your `values.yaml`.
 
 #### AWS Systems Manager Parameter Store (SSM)
 
@@ -724,7 +749,7 @@ Where `<kms-key-arn>` is the ARN of the KMS key used to encrypt the secrets in P
 
 To use Secrets Manager, set `concourse.web.kubernetes.enabled` to false, and set `concourse.web.awsSecretsManager.enabled` to true.
 
-Authentication can be configured to use an access key and secret key as well as a session token. This is done by setting `concourse.web.awsSecretsManager.keyAuth.enabled` to `true`. Alternatively, if it set to `false`, AWS IAM role based authentication (instance or pod credentials) is assumed. To use a session token, `concourse.web.awsSecretsManger.useSessionToken` should be set to `true`. The secret values can be managed using the values specified in this helm chart or separately. For more details, see https://concourse-ci.org/creds.html#asm.
+Authentication can be configured to use an access key and secret key as well as a session token. This is done by setting `concourse.web.awsSecretsManager.keyAuth.enabled` to `true`. Alternatively, if it set to `false`, AWS IAM role based authentication (instance or pod credentials) is assumed. To use a session token, `concourse.web.awsSecretsManager.useSessionToken` should be set to `true`. The secret values can be managed using the values specified in this helm chart or separately. For more details, see https://concourse-ci.org/creds.html#asm.
 
 For a given Concourse *team*, a pipeline looks for secrets in Secrets Manager using either `/concourse/{team}/{secret}` or `/concourse/{team}/{pipeline}/{secret}`; the patterns can be overridden using the `concourse.web.awsSecretsManager.teamSecretTemplate` and `concourse.web.awsSecretsManager.pipelineSecretTemplate` settings.
 

templates/_helpers.tpl

@@ -96,9 +96,9 @@ to strip that out.
 {{- end -}}
 
 {{/*
-Return the appropriate apiVersion for statefulset.
+Return the appropriate apiVersion for statefulSet.
 */}}
-{{- define "concourse.statefulset.apiVersion" -}}
+{{- define "concourse.statefulSet.apiVersion" -}}
 {{- $version := include "concourse.kubeVersion" . -}}
 {{- if semverCompare "<1.9-0" $version -}}
 {{- print "apps/v1beta2" -}}
@@ -452,12 +452,12 @@ Return concourse environment variables for postgresql configuration
 - name: CONCOURSE_POSTGRES_HOST
   value: {{ template "concourse.postgresql.fullname" . }}
 - name: CONCOURSE_POSTGRES_USER
-  value: {{ .Values.postgresql.auth.username | quote }}
+  value: {{ .Values.postgresql.auth.user | quote }}
 - name: CONCOURSE_POSTGRES_PASSWORD
   valueFrom:
     secretKeyRef:
-      name: {{ template "concourse.postgresql.fullname" . }}
-      key: password
+      name: "{{ template "concourse.postgresql.fullname" . }}-connection"
+      key: POSTGRES_PASSWORD
 - name: CONCOURSE_POSTGRES_DATABASE
   value: {{ .Values.postgresql.auth.database | quote }}
 {{- else }}

templates/postgres-config-override-configmap.yaml

@@ -0,0 +1,19 @@
+{{- if and .Values.postgresql.enabled .Values.postgresql.configOverride }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "concourse.postgresql.fullname" . }}-config-override"
+  {{- if .Values.postgresql.configMapAnnotations }}
+  annotations: "{{ toYaml .Values.postgresql.annotations | nindent 4 }}"
+  {{- end }}
+  labels:
+    app: {{ template "concourse.postgresql.fullname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    {{- with .Values.postgresql.labels }}
+{{ toYaml . | trim | indent 4 }}
+    {{- end }}
+data:
+  postgresql.conf: | {{- .Values.postgresql.configOverride | nindent 4 }}
+{{- end }}

templates/postgres-env-configmap.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.postgresql.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: "{{ template "concourse.postgresql.fullname" . }}-env"
+  {{- if .Values.postgresql.configMapAnnotations }}
+  annotations: "{{ toYaml .Values.postgresql.annotations | nindent 4 }}"
+  {{- end }}
+  labels:
+    app: {{ template "concourse.postgresql.fullname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    {{- with .Values.postgresql.labels }}
+{{ toYaml . | trim | indent 4 }}
+    {{- end }}
+data:
+  {{- with .Values.postgresql.extraEnvironment }}
+{{ toYaml . | trim | indent 2 }}
+  {{- end }}
+{{- end }}

templates/postgres-secret.yaml

@@ -0,0 +1,25 @@
+{{- if .Values.postgresql.enabled -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ template "concourse.postgresql.fullname" . }}-connection"
+  {{- if .Values.postgresql.secretAnnotations }}
+  annotations: "{{ toYaml .Values.postgresql.primary.annotations | nindent 4 }}"
+  {{- end }}
+  labels:
+    app: {{ template "concourse.postgresql.fullname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    {{- with .Values.postgresql.labels }}
+{{ toYaml . | trim | indent 4 }}
+    {{- end }}
+data:
+  POSTGRES_USER: {{ .Values.postgresql.auth.user | b64enc }}
+  POSTGRES_PASSWORD: {{ .Values.postgresql.auth.password | b64enc }}
+  POSTGRES_DB: {{ .Values.postgresql.auth.database | b64enc }}
+  {{- with .Values.postgresql.sensitiveEnvironment }}
+{{ toYaml . | trim | indent 2 }}
+  {{- end }}
+
+{{- end }}

templates/postgres-service.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.postgresql.service.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "concourse.postgresql.fullname" . }}
+  labels:
+    app: {{ template "concourse.postgresql.fullname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    {{- with .Values.postgresql.labels }}
+{{ toYaml . | trim | indent 4 }}
+    {{- end }}
+  {{- if .Values.postgresql.annotations }}
+  annotations: "{{ toYaml .Values.postgresql.annotations | nindent 4 }}"
+  {{- end }}
+spec:
+  type: {{ .Values.postgresql.service.type }}
+  ports:
+  - name: pgsql
+    port: 5432
+    targetPort: pgsql
+    protocol: TCP
+  selector:
+    app: {{ template "concourse.postgresql.fullname" . }}
+  {{- if eq .Values.postgresql.service.type "ClusterIP" }}
+  {{- if .Values.postgresql.service.clusterIPs }}
+  clusterIPs: {{- .Values.postgresql.service.clusterIPs | mustToJson }}
+  {{- end }}
+  {{- end }}
+  {{- with .Values.postgresql.service.extraSpec }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+{{- end }}
+