DevFW-CICD/argocd-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'main' into atgane

Browse source
This commit is contained in:
Marco Maurer 2025-01-28 10:06:11 +01:00
commit 1e8ba786d1
19 changed files with 99 additions and 72 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.github/workflows/lint-and-test.yml vendored
View file

@ -38,7 +38,7 @@ jobs:
- name: Setup Chart Linting
id: lint
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
with:
# Note: Also update in scripts/lint.sh
version: v3.11.0

2
.github/workflows/publish.yml vendored
View file

@ -59,7 +59,7 @@ jobs:
PGP_PASSPHRASE: "${{ secrets.PGP_PASSPHRASE }}"
- name: Run chart-releaser
uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
with:
config: "./.github/configs/cr.yaml"
env:

3
.github/workflows/renovate.yaml vendored
View file

@ -26,12 +26,13 @@ jobs:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Self-hosted Renovate
uses: renovatebot/github-action@3f10d7a25cf0aa7b37519aa771ed9143fcbb5da5 # v41.0.10
uses: renovatebot/github-action@d385c88822a237acaead89c462fa0aef7502748f # v41.0.11
with:
configurationFile: .github/configs/renovate-config.js
# renovate: datasource=docker depName=ghcr.io/renovatebot/renovate
renovate-version: 39.86.4
token: '${{ steps.get_token.outputs.token }}'
mount-docker-socket: true
env:
LOG_LEVEL: 'debug'
RENOVATE_REPOSITORIES: '${{ github.repository }}'

2
.github/workflows/scorecard.yml vendored
View file

@ -68,6 +68,6 @@ jobs:
# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
uses: github/codeql-action/upload-sarif@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
with:
sarif_file: results.sarif

2
.github/workflows/stale.yml vendored
View file

@ -14,7 +14,7 @@ jobs:
pull-requests: write # for actions/stale to close stale PRs
runs-on: ubuntu-latest
steps:
- uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
- uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
# Number of days of inactivity before an issue becomes stale

2
charts/argo-cd/Chart.yaml
View file

@ -3,7 +3,7 @@ appVersion: v2.13.3
kubeVersion: ">=1.25.0-0"
description: A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.
name: argo-cd
version: 7.7.17
version: 7.7.21
home: https://github.com/argoproj/argo-helm
icon: https://argo-cd.readthedocs.io/en/stable/assets/logo.png
sources:

7
charts/argo-cd/README.md
View file

@ -730,6 +730,7 @@ NAME: my-release
| configs.clusterCredentials | object | `{}` (See [values.yaml]) | Provide one or multiple [external cluster credentials] |
| configs.cm."admin.enabled" | bool | `true` | Enable local admin user |
| configs.cm."application.instanceLabelKey" | string | `"argocd.argoproj.io/instance"` | The name of tracking label used by Argo CD for resource pruning |
| configs.cm."application.sync.impersonation.enabled" | bool | `false` | Enable control of the service account used for the sync operation (alpha) |
| configs.cm."exec.enabled" | bool | `false` | Enable exec feature in Argo UI |
| configs.cm."server.rbac.log.enforce.enable" | bool | `false` | Enable logs RBAC enforcement |
| configs.cm."statusbadge.enabled" | bool | `false` | Enable Status Badge |
@ -1264,7 +1265,7 @@ NAME: my-release
| redis.exporter.env | list | `[]` | Environment variables to pass to the Redis exporter |
| redis.exporter.image.imagePullPolicy | string | `""` (defaults to global.image.imagePullPolicy) | Image pull policy for the redis-exporter |
| redis.exporter.image.repository | string | `"public.ecr.aws/bitnami/redis-exporter"` | Repository to use for the redis-exporter |
| redis.exporter.image.tag | string | `"1.58.0"` | Tag to use for the redis-exporter |
| redis.exporter.image.tag | string | `"1.67.0"` | Tag to use for the redis-exporter |
| redis.exporter.livenessProbe.enabled | bool | `false` | Enable Kubernetes liveness probe for Redis exporter |
| redis.exporter.livenessProbe.failureThreshold | int | `5` | Minimum consecutive failures for the [probe] to be considered failed after having succeeded |
| redis.exporter.livenessProbe.initialDelaySeconds | int | `30` | Number of seconds after the container has started before [probe] is initiated |
@ -1282,7 +1283,7 @@ NAME: my-release
| redis.extraContainers | list | `[]` | Additional containers to be added to the redis pod |
| redis.image.imagePullPolicy | string | `""` (defaults to global.image.imagePullPolicy) | Redis image pull policy |
| redis.image.repository | string | `"public.ecr.aws/docker/library/redis"` | Redis repository |
| redis.image.tag | string | `"7.4.1-alpine"` | Redis tag |
| redis.image.tag | string | `"7.4.2-alpine"` | Redis tag |
| redis.imagePullSecrets | list | `[]` (defaults to global.imagePullSecrets) | Secrets with credentials to pull images from a private registry |
| redis.initContainers | list | `[]` | Init containers to add to the redis pod |
| redis.livenessProbe.enabled | bool | `false` | Enable Kubernetes liveness probe for Redis server |
@ -1368,7 +1369,7 @@ The main options are listed here:
| redis-ha.haproxy.tolerations | list | `[]` | [Tolerations] for use with node taints for haproxy pods. |
| redis-ha.hardAntiAffinity | bool | `true` | Whether the Redis server pods should be forced to run on separate nodes. |
| redis-ha.image.repository | string | `"public.ecr.aws/docker/library/redis"` | Redis repository |
| redis-ha.image.tag | string | `"7.4.1-alpine"` | Redis tag |
| redis-ha.image.tag | string | `"7.4.2-alpine"` | Redis tag |
| redis-ha.persistentVolume.enabled | bool | `false` | Configures persistence on Redis nodes |
| redis-ha.redis.config | object | See [values.yaml] | Any valid redis config options in this section will be applied to each server (see `redis-ha` chart) |
| redis-ha.redis.config.save | string | `'""'` | Will save the DB if both the given number of seconds and the given number of write operations against the DB occurred. `""` is disabled |

2
charts/argo-cd/templates/argocd-server/ingress.yaml
View file

@ -14,7 +14,7 @@ metadata:
{{- with .Values.server.ingress.annotations }}
annotations:
{{- range $key, $value := . }}
{{ $key }}: {{ tpl $value $ | quote }}
{{ $key }}: {{ tpl (toString $value) $ | quote }}
{{- end }}
{{- end }}
spec:

10
charts/argo-cd/values.yaml
View file

@ -175,6 +175,10 @@ configs:
# -- The name of tracking label used by Argo CD for resource pruning
application.instanceLabelKey: argocd.argoproj.io/instance
# -- Enable control of the service account used for the sync operation (alpha)
## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/app-sync-using-impersonation/
application.sync.impersonation.enabled: false
# -- Enable logs RBAC enforcement
## Ref: https://argo-cd.readthedocs.io/en/latest/operator-manual/upgrading/2.3-2.4/#enable-logs-rbac-enforcement
server.rbac.log.enforce.enable: false
@ -1284,7 +1288,7 @@ redis:
# -- Redis repository
repository: public.ecr.aws/docker/library/redis
# -- Redis tag
tag: 7.4.1-alpine
tag: 7.4.2-alpine
# -- Redis image pull policy
# @default -- `""` (defaults to global.image.imagePullPolicy)
imagePullPolicy: ""
@ -1300,7 +1304,7 @@ redis:
# -- Repository to use for the redis-exporter
repository: public.ecr.aws/bitnami/redis-exporter
# -- Tag to use for the redis-exporter
tag: 1.58.0
tag: 1.67.0
# -- Image pull policy for the redis-exporter
# @default -- `""` (defaults to global.image.imagePullPolicy)
imagePullPolicy: ""
@ -1570,7 +1574,7 @@ redis-ha:
# -- Redis repository
repository: public.ecr.aws/docker/library/redis
# -- Redis tag
tag: 7.4.1-alpine
tag: 7.4.2-alpine
## Prometheus redis-exporter sidecar
exporter:
# -- Enable Prometheus redis-exporter sidecar

4
charts/argocd-image-updater/Chart.yaml
View file

@ -2,7 +2,7 @@ apiVersion: v2
name: argocd-image-updater
description: A Helm chart for Argo CD Image Updater, a tool to automatically update the container images of Kubernetes workloads which are managed by Argo CD
type: application
version: 0.11.4
version: 0.12.0
appVersion: v0.15.2
home: https://github.com/argoproj-labs/argocd-image-updater
icon: https://argocd-image-updater.readthedocs.io/en/stable/assets/logo.png
@ -19,4 +19,4 @@ annotations:
url: https://argoproj.github.io/argo-helm/pgp_keys.asc
artifacthub.io/changes: |
- kind: changed
description: Bump argocd-image-updater to v0.15.2
description: ConfigMap and Secret names are now configurable

6
charts/argocd-image-updater/README.md
View file

@ -70,6 +70,7 @@ The `config.registries` value can be used exactly as it looks in the documentati
|-----|------|---------|-------------|
| affinity | object | `{}` | Kubernetes affinity settings for the deployment |
| authScripts.enabled | bool | `false` | Whether to mount the defined scripts that can be used to authenticate with a registry, the scripts will be mounted at `/scripts` |
| authScripts.name | string | `"argocd-image-updater-authscripts"` | Name of the authentication scripts ConfigMap |
| authScripts.scripts | object | `{}` | Map of key-value pairs where the key consists of the name of the script and the value the contents |
| config.applicationsAPIKind | string | `""` | API kind that is used to manage Argo CD applications (`kubernetes` or `argocd`) |
| config.argocd.grpcWeb | bool | `true` | Use the gRPC-web protocol to connect to the Argo CD API |
@ -77,6 +78,7 @@ The `config.registries` value can be used exactly as it looks in the documentati
| config.argocd.plaintext | bool | `false` | If specified, use an unencrypted HTTP connection to the Argo CD API instead of TLS. |
| config.argocd.serverAddress | string | `""` | Connect to the Argo CD API server at server address |
| config.argocd.token | string | `""` | If specified, the secret with Argo CD API key will be created. |
| config.argocd.tokenSecretName | string | `"argocd-image-updater-secret"` | Name of the Secret containing the token |
| config.disableKubeEvents | bool | `false` | Disable kubernetes events |
| config.gitCommitMail | string | `""` | E-Mail address to use for Git commits |
| config.gitCommitSignOff | bool | `false` | Enables sign off on commits |
@ -85,8 +87,10 @@ The `config.registries` value can be used exactly as it looks in the documentati
| config.gitCommitTemplate | string | `""` | Changing the Git commit message |
| config.gitCommitUser | string | `""` | Username to use for Git commits |
| config.logLevel | string | `"info"` | Argo CD Image Update log level |
| config.name | string | `"argocd-image-updater-config"` | Name of the ConfigMap |
| config.registries | list | `[]` | Argo CD Image Updater registries list configuration. More information [here](https://argocd-image-updater.readthedocs.io/en/stable/configuration/registries/) |
| config.sshConfig | object | `{}` | Argo CD Image Updater ssh client parameter configuration. |
| config.sshConfig.config | string | `""` | Argo CD Image Updater ssh client parameter configuration. |
| config.sshConfig.name | string | `"argocd-image-updater-ssh-config"` | Name of the sshConfig ConfigMap |
| createClusterRoles | bool | `true` | Create cluster roles for cluster-wide installation. |
| extraArgs | list | `[]` | Extra arguments for argocd-image-updater not defined in `config.argocd`. If a flag contains both key and value, they need to be split to a new entry |
| extraEnv | list | `[]` | Extra environment variables for argocd-image-updater |

2
charts/argocd-image-updater/templates/configmap-authscripts.yaml
View file

@ -4,7 +4,7 @@ kind: ConfigMap
metadata:
labels:
{{- include "argocd-image-updater.labels" . | nindent 4 }}
name: argocd-image-updater-authscripts
name: {{ .Values.authScripts.name }}
namespace: {{ include "argocd-image-updater.namespace" . | quote }}
data:
{{- toYaml .Values.authScripts.scripts | nindent 2}}

10
charts/argocd-image-updater/templates/configmap-sshconfig.yaml
View file

@ -1,11 +1,17 @@
{{- $sshConfig := omit .Values.config.sshConfig "name" }}
{{- range $key, $val := $sshConfig }}
{{- if not $val }}
{{ $_ := unset $sshConfig $key }}
{{- end }}
{{- end }}
apiVersion: v1
kind: ConfigMap
metadata:
labels:
{{- include "argocd-image-updater.labels" . | nindent 4 }}
name: argocd-image-updater-ssh-config
name: {{ .Values.config.sshConfig.name }}
namespace: {{ include "argocd-image-updater.namespace" . | quote }}
{{- with .Values.config.sshConfig }}
{{- with $sshConfig }}
data:
{{- toYaml . | nindent 2 }}
{{- end }}

2
charts/argocd-image-updater/templates/configmap.yaml
View file

@ -4,7 +4,7 @@ kind: ConfigMap
metadata:
labels:
{{- include "argocd-image-updater.labels" . | nindent 4 }}
name: argocd-image-updater-config
name: {{ .Values.config.name }}
namespace: {{ include "argocd-image-updater.namespace" . | quote }}
data:
{{- with .Values.config.applicationsAPIKind }}

32
charts/argocd-image-updater/templates/deployment.yaml
View file

@ -44,79 +44,79 @@ spec:
valueFrom:
configMapKeyRef:
key: applications_api
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: ARGOCD_GRPC_WEB
valueFrom:
configMapKeyRef:
key: argocd.grpc_web
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: ARGOCD_SERVER
valueFrom:
configMapKeyRef:
key: argocd.server_addr
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: ARGOCD_INSECURE
valueFrom:
configMapKeyRef:
key: argocd.insecure
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: ARGOCD_PLAINTEXT
valueFrom:
configMapKeyRef:
key: argocd.plaintext
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: ARGOCD_TOKEN
valueFrom:
secretKeyRef:
key: argocd.token
name: argocd-image-updater-secret
name: {{ .Values.config.argocd.tokenSecretName }}
optional: true
- name: IMAGE_UPDATER_LOGLEVEL
valueFrom:
configMapKeyRef:
key: log.level
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: GIT_COMMIT_USER
valueFrom:
configMapKeyRef:
key: git.user
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: GIT_COMMIT_EMAIL
valueFrom:
configMapKeyRef:
key: git.email
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: IMAGE_UPDATER_KUBE_EVENTS
valueFrom:
configMapKeyRef:
key: kube.events
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: GIT_COMMIT_SIGNING_KEY
valueFrom:
configMapKeyRef:
key: git.commit-signing-key
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: GIT_COMMIT_SIGNING_METHOD
valueFrom:
configMapKeyRef:
key: git.commit-signing-method
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
- name: GIT_COMMIT_SIGN_OFF
valueFrom:
configMapKeyRef:
key: git.commit-sign-off
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
{{- with .Values.extraEnv }}
{{- toYaml . | nindent 10 }}
@ -177,13 +177,13 @@ spec:
path: registries.conf
- key: git.commit-message-template
path: commit.template
name: argocd-image-updater-config
name: {{ .Values.config.name }}
optional: true
name: image-updater-conf
{{- if .Values.authScripts.enabled }}
- configMap:
defaultMode: 0777
name: argocd-image-updater-authscripts
name: {{ .Values.authScripts.name }}
name: authscripts
{{- end }}
- configMap:
@ -191,7 +191,7 @@ spec:
optional: true
name: ssh-known-hosts
- configMap:
name: argocd-image-updater-ssh-config
name: {{ .Values.config.sshConfig.name }}
optional: true
name: ssh-config
- name: ssh-signing-key

2
charts/argocd-image-updater/templates/secret.yaml
View file

@ -2,7 +2,7 @@
apiVersion: v1
kind: Secret
metadata:
name: argocd-image-updater-secret
name: {{ .Values.config.argocd.tokenSecretName }}
namespace: {{ include "argocd-image-updater.namespace" . | quote }}
labels:
{{- include "argocd-image-updater.labels" . | nindent 4 }}

12
charts/argocd-image-updater/values.yaml
View file

@ -109,6 +109,8 @@ volumes: []
# emptyDir: {}
config:
# -- Name of the ConfigMap
name: argocd-image-updater-config
# -- API kind that is used to manage Argo CD applications (`kubernetes` or `argocd`)
applicationsAPIKind: ""
@ -125,6 +127,8 @@ config:
plaintext: false
# -- If specified, the secret with Argo CD API key will be created.
token: ""
# -- Name of the Secret containing the token
tokenSecretName: "argocd-image-updater-secret"
# -- Disable kubernetes events
disableKubeEvents: false
@ -175,9 +179,11 @@ config:
# credentials: ext:/scripts/auth1.sh
# credsexpire: 10h
# -- Argo CD Image Updater ssh client parameter configuration.
sshConfig:
{}
# -- Name of the sshConfig ConfigMap
name: argocd-image-updater-ssh-config
# -- Argo CD Image Updater ssh client parameter configuration.
config: ""
# config: |
# Host *
# PubkeyAcceptedAlgorithms +ssh-rsa
@ -188,6 +194,8 @@ config:
authScripts:
# -- Whether to mount the defined scripts that can be used to authenticate with a registry, the scripts will be mounted at `/scripts`
enabled: false
# -- Name of the authentication scripts ConfigMap
name: argocd-image-updater-authscripts
# -- Map of key-value pairs where the key consists of the name of the script and the value the contents
scripts: {}
# auth1.sh: |

27
renovate.json
View file

@ -83,31 +83,24 @@
"argoproj/argo-workflows",
"argoproj/argo-cd",
"argoproj/argo-events",
"argoproj/argo-rollouts"
"argoproj/argo-rollouts",
"argoproj-labs/argocd-image-updater",
"argoprojlabs/argocd-extension-installer",
"public.ecr.aws/bitnami/redis-exporter",
"public.ecr.aws/docker/library/redis"
],
"commitMessagePrefix": "chore({{{replace 'argoproj/' '' depName}}}):",
"commitMessagePrefix": "chore({{parentDir}}):",
"postUpgradeTasks": {
"commands": ["./scripts/renovate-bump-version.sh {{depName}}"]
}
},
{
"matchPackagePatterns": ["argoproj-labs/argocd-image-updater"],
"commitMessagePrefix": "chore({{{replace 'argoproj-labs/' '' depName}}}):",
"postUpgradeTasks": {
"commands": ["./scripts/renovate-bump-version.sh {{depName}}"]
"commands": [
"./scripts/renovate-bump-version.sh -c {{parentDir}} -d {{depName}} -v {{newVersion}}",
"./scripts/helm-docs.sh"
]
}
},
{
"matchPackagePatterns": ["redis-ha"],
"enabled": false
},
{
"matchPackagePatterns": ["public.ecr.aws/bitnami/redis-exporter"],
"commitMessagePrefix": "chore({{{replace 'public.ecr.aws/' '' depName}}}):",
"postUpgradeTasks": {
"commands": ["./scripts/renovate-bump-version.sh {{depName}}"]
}
},
{
"matchPackageNames": ["ghcr.io/renovatebot/renovate"],
"extends": ["schedule:monthly"]

42
scripts/renovate-bump-version.sh
View file

@ -1,31 +1,41 @@
#!/bin/bash
depName="${1}"
if [ -z "${depName}" ]; then
echo "Missing argument 'depName'" >&2
echo "Example usage: $0 argoproj/argo-cd" >&2
while getopts c:d:v: opt; do
case ${opt} in
c) chart=${OPTARG} ;;
d) dependency_name=${OPTARG} ;;
v) dependency_version=${OPTARG} ;;
*)
echo 'Usage:' >&2
echo '-c: chart Related Helm chart name' >&2
echo '-d dependency Name of the updated dependency' >&2
echo '-v version New version of the updated dependency' >&2
exit 1
esac
done
if [ -z "${dependency_name}" ] || [ -z "${dependency_version}" ] || [ -z "${chart}" ] ; then
echo 'Missing relevant CLI flag(s).' >&2
exit 1
fi
chartName=$(echo "$depName" | sed -e "s+^argoproj/++" -e "s+^argoproj-labs/++")
echo "Changed chart name is: $chartName"
echo "----------------------------------------"
parentDir="charts/${chartName}"
chart_yaml_path="charts/${chart}/Chart.yaml"
# Split dependency by '/' and only use last element
# This way we can drop prefixes like "argoproj/..." , "argoproj-labs/..." , "quay.io/foo/..."
dependency_name="${dependency_name##*/}"
# Bump the chart version by one patch version
version=$(grep '^version:' "${parentDir}/Chart.yaml" | awk '{print $2}')
version=$(grep '^version:' "${chart_yaml_path}" | awk '{print $2}')
major=$(echo "${version}" | cut -d. -f1)
minor=$(echo "${version}" | cut -d. -f2)
patch=$(echo "${version}" | cut -d. -f3)
patch=$((patch + 1))
sed -i "s/^version:.*/version: ${major}.${minor}.${patch}/g" "${parentDir}/Chart.yaml"
sed -i "s/^version:.*/version: ${major}.${minor}.${patch}/g" "${chart_yaml_path}"
# Add a changelog entry
appVersion=$(grep '^appVersion:' "${parentDir}/Chart.yaml" | awk '{print $2}')
sed -i -e '/^ artifacthub.io\/changes: |/,$ d' "${parentDir}/Chart.yaml"
sed -i -e '/^ artifacthub.io\/changes: |/,$ d' "${chart_yaml_path}"
{
echo " artifacthub.io/changes: |"
echo " - kind: changed"
echo " description: Bump ${chartName} to ${appVersion}"
} >> "${parentDir}/Chart.yaml"
cat "${parentDir}/Chart.yaml"
echo " description: Bump ${dependency_name} to ${dependency_version}"
} >> "${chart_yaml_path}"
cat "${chart_yaml_path}"