Skip to content

Commit a33b6bc

Browse files
wiktorchomikaccenturewiktorchomikaccenture
committed
Merge branch 'master' into ob
2 parents e93d482 + e3fca07 commit a33b6bc

40 files changed

+756
-404
lines changed

‎.github/workflows/docs.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ jobs:
1010
deploy-docs:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v2
14-
- uses: actions/setup-python@v2
13+
- uses: actions/checkout@v3
14+
- uses: actions/setup-python@v4
1515
with:
1616
python-version: 3.x
1717
- run: pip install mkdocs-material

‎.gitlab-ci.yml

+8-3
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ stages:
88
- initialization
99
- test.template
1010
- test.smoke
11-
- test.integration
1211
- test.examples
12+
- test.integration
1313
- publish
1414
- push
1515
- release
@@ -116,8 +116,7 @@ r.release:
116116
script:
117117
- ci_scripts/release_charts.sh
118118
rules:
119-
- if: $RELEASE == "true"
120-
- if: '$CI_COMMIT_TAG !~ "/^$/"'
119+
- if: $RELEASE == "true" && '$CI_COMMIT_TAG !~ "/^$/"'
121120

122121
################################################
123122
# ______ _____ _ _ _
@@ -133,3 +132,9 @@ clean-k8s:
133132
script:
134133
- ci_scripts/cleanup_kubernetes.sh
135134
when: always
135+
136+
delete-old-k8s:
137+
stage: final
138+
script:
139+
- ci_scripts/cleanup_old_kubernetes.sh
140+
when: always

‎DISCLAIMER

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/***************************************************************************
2-
* Copyright (C) 2022 Ping Identity Corporation
2+
* Copyright (C) 2023 Ping Identity Corporation
33
* All rights reserved.
44
*
55
* Ping Identity Corporation

‎LICENSE

+1-1
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@
187187
same "printed page" as the copyright notice for easier
188188
identification within third-party archives.
189189

190-
Copyright 2022 Ping Identity Corp.
190+
Copyright 2023 Ping Identity Corp.
191191

192192
Licensed under the Apache License, Version 2.0 (the "License");
193193
you may not use this file except in compliance with the License.

‎charts/ping-devops/Chart.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
apiVersion: v2
55
name: ping-devops
66
########################################################################
7-
# 0.9.9 - Refer to http://helm.pingidentity.com/release-notes/currentRelease
7+
# 0.9.11 - Refer to http://helm.pingidentity.com/release-notes/currentRelease
88
########################################################################
9-
version: 0.9.9
10-
description: Ping Identity helm charts - 1/03/2023
9+
version: 0.9.11
10+
description: Ping Identity helm charts - 3/03/2023
1111
type: application
1212
home: https://helm.pingidentity.com/
1313
icon: https://helm.pingidentity.com/img/logos/ping.png
14-
appVersion: "2212"
14+
appVersion: "2302"

‎charts/ping-devops/templates/NOTES.txt

+9-7
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,13 @@
2626
{{- $tag := ternary (toString .image.tag) "" .enabled }}
2727
{{- $workload := "" }}
2828
{{- if .workload }}
29-
{{- $workload := ternary (ternary "dep" "sts" (eq .workload.type "Deployment")) "" .enabled }}
29+
{{- $workload = ternary (ternary "dep" "sts" (eq .workload.type "Deployment")) "" .enabled }}
3030
{{- end }}
3131
{{- $numReplica := "" }}
3232
{{- if .container }}
33-
{{- $numReplica := ternary (toString .container.replicaCount) "" .enabled }}
33+
{{- if .container.replicaCount }}
34+
{{- $numReplica = ternary (toString .container.replicaCount) "" .enabled }}
35+
{{- end }}
3436
{{- end }}
3537
{{- $slash := ternary "/" "" .enabled }}
3638
{{- $cpur := "" }}
@@ -39,15 +41,15 @@
3941
{{- $meml := "" }}
4042
{{- if .container }}
4143
{{- if .container.resources }}
42-
{{- $cpur := ternary (toString .container.resources.requests.cpu) "" .enabled }}
43-
{{- $cpul := ternary (toString .container.resources.limits.cpu) "" .enabled }}
44-
{{- $memr := ternary (toString .container.resources.requests.memory) "" .enabled }}
45-
{{- $meml := ternary (toString .container.resources.limits.memory) "" .enabled }}
44+
{{- $cpur = ternary (toString .container.resources.requests.cpu) "" .enabled }}
45+
{{- $cpul = ternary (toString .container.resources.limits.cpu) "" .enabled }}
46+
{{- $memr = ternary (toString .container.resources.requests.memory) "" .enabled }}
47+
{{- $meml = ternary (toString .container.resources.limits.memory) "" .enabled }}
4648
{{- end }}
4749
{{- end }}
4850
{{- $ingEnabled := "" }}
4951
{{- if .ingress }}
50-
{{- $ingEnabled := .enabled | ternary (ternary " √ " "" .ingress.enabled) "" }}
52+
{{- $ingEnabled = .enabled | ternary (ternary " √ " "" .ingress.enabled) "" }}
5153
{{- end }}
5254
# {{ printf $format $prodEnabled $prodName $tag $workload $numReplica $cpur $slash $cpul $memr $slash $meml $ingEnabled }}
5355
{{- if .enabled }}

‎charts/ping-devops/templates/pingdirectory/service-load-balancer.yaml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{{- $top := . -}}
2+
{{- $prodName := "pingdirectory" -}}
3+
{{- $mergedValues := merge (index $top.Values "pingdirectory") $top.Values.global -}}
4+
{{- $params := list $top $mergedValues -}}
5+
6+
{{- if $mergedValues.services.loadBalancerServicePerPod -}}
7+
{{- range $i := until (int $mergedValues.container.replicaCount) }}
8+
---
9+
{{ $podName := (print (include "pinglib.fullname" $params) "-" $i) -}}
10+
{{- $hostname := (print (include "pinglib.fullname" $params) "-" $i $mergedValues.services.loadBalancerExternalDNSHostnameSuffix) -}}
11+
{{- include "pingdirectory.service-load-balancer" (list $top $mergedValues $podName $hostname $podName) -}}
12+
{{- end -}}
13+
{{- end -}}
14+
15+
16+
{{- define "pingdirectory.service-load-balancer" -}}
17+
{{- $top := index . 0 -}}
18+
{{- $v := index . 1 -}}
19+
{{- $serviceName := index . 2 -}}
20+
{{- $hostname := index . 3 -}}
21+
{{- $podName := index . 4 -}}
22+
apiVersion: v1
23+
kind: Service
24+
metadata:
25+
{{- include "pinglib.metadata.labels" . | nindent 2 -}}
26+
{{- if $v.annotations -}}
27+
{{- include "pinglib.metadata.annotations" . | nindent 2 -}}
28+
{{- else }}
29+
annotations:
30+
{{- end }}
31+
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
32+
external-dns.alpha.kubernetes.io/hostname: {{ $hostname }}
33+
name: {{ $serviceName }}
34+
spec:
35+
type: LoadBalancer
36+
selector:
37+
statefulset.kubernetes.io/pod-name: {{ $podName }}
38+
{{/* publishNotReadyAddresses must be true for pods to communicate via load balancers */}}
39+
publishNotReadyAddresses: true
40+
sessionAffinity: None
41+
ports:
42+
{{- range $serviceName, $val := $v.services }}
43+
{{- if kindIs "map" $val }}
44+
{{- if $val.loadBalancerService }}
45+
- name: {{ $serviceName }}
46+
port: {{ required "containerPort is required for services with loadBalancerService:true" $val.containerPort }}
47+
protocol: {{ default "TCP" $val.protocol }}
48+
{{- end }}
49+
{{- end }}
50+
{{- end }}
51+
{{- end -}}

‎charts/ping-devops/templates/pingdirectoryproxy/env-vars.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,9 @@
22

33

44
{{- define "pingdirectoryproxy.env-vars" -}}
5+
{{- $top := index . 0 -}}
56
data:
7+
K8S_STATEFUL_SET_NAME: {{ include "pinglib.fullname" . }}
8+
K8S_STATEFUL_SET_SERVICE_NAME: {{ include "pinglib.fullclusterservicename" . }}
9+
LDAPS_PORT: {{ $top.Values.pingdirectoryproxy.services.ldaps.containerPort | quote }}
610
{{- end -}}

‎charts/ping-devops/templates/pinglib/_hpa.tpl

+4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
{{- define "pinglib.hpa.tpl" -}}
22
{{- $top := index . 0 -}}
33
{{- $v := index . 1 -}}
4+
{{- if semverCompare ">1.22" $top.Capabilities.KubeVersion.Version }}
5+
apiVersion: autoscaling/v2
6+
{{- else }}
47
apiVersion: autoscaling/v2beta2
8+
{{- end }}
59
kind: HorizontalPodAutoscaler
610
metadata:
711
{{ include "pinglib.metadata.labels" . | nindent 2 }}

‎charts/ping-devops/templates/pinglib/_service.tpl

+3
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ metadata:
1313
{{- end }}
1414
name: {{ include "pinglib.fullname" . }}
1515
spec:
16+
{{- if $v.services.useLoadBalancerForDataService }}
17+
type: LoadBalancer
18+
{{- end }}
1619
ports:
1720
{{- range $serviceName, $val := $v.services }}
1821
{{- if kindIs "map" $val }}

‎charts/ping-devops/values.yaml

+60-10
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,7 @@ global:
179179
# By default the images uses will be indicated by these
180180
# variables. An example might look like:
181181
#
182-
# pingidentity/pingdataconsole:2212 (December, 2022)
182+
# pingidentity/pingdataconsole:2302 (February, 2023)
183183
#
184184
# @param global.image.repository Default image registry
185185
# @desc is not the fully-qualified name of the image
@@ -195,7 +195,7 @@ global:
195195
# @desc Example: image.name: pingfederate
196196
#
197197
# @param global.image.tag Default image tag
198-
# @default 2212
198+
# @default 2302
199199
#
200200
# @param global.image.pullPolicy Default image pull policy
201201
# @default IfNotPresent
@@ -204,7 +204,7 @@ global:
204204
repository: pingidentity
205205
repositoryFqn:
206206
name:
207-
tag: "2212"
207+
tag: "2302"
208208
pullPolicy: IfNotPresent
209209

210210
############################################################
@@ -297,6 +297,8 @@ global:
297297
runAsNonRoot: true
298298
runAsUser: 9031
299299
runAsGroup: 0
300+
seccompProfile:
301+
type: RuntimeDefault
300302
pingaccess:
301303
resources:
302304
limits:
@@ -310,6 +312,8 @@ global:
310312
runAsNonRoot: true
311313
runAsUser: 9031
312314
runAsGroup: 0
315+
seccompProfile:
316+
type: RuntimeDefault
313317

314318
############################################################
315319
# Services
@@ -320,11 +324,16 @@ global:
320324
#
321325
# @param global.services.clusterExternalDNSHostname
322326
# @desc Value for the external-dns.alpha.kubernetes.io/hostname annotation
327+
# @desc for the cluster service.
323328
# @default
324329
#
325330
# @param global.services.clusterServiceName If set, then this name will
326331
# @desc be used as the cluster service name (i.e clusterService == true).
327332
#
333+
# @param global.services.useLoadBalancerForDataService If true, the data service
334+
# @desc will be created with type: LoadBalancer.
335+
# @default false
336+
#
328337
# @param global.services.serviceName.dataService If true, a ClusterIP service is
329338
# @desc created reachable within the cluster. A single IP is provided and the
330339
# @desc service will round-robin across the backend containers
@@ -359,6 +368,7 @@ global:
359368
# clusterService: true
360369
# clusterExternalDNSHostname:
361370
# clusterServiceName:
371+
# useLoadBalancerForDataService: false
362372

363373

364374
############################################################
@@ -514,10 +524,9 @@ global:
514524
fsGroup: 0
515525
runAsUser: 9031
516526
runAsGroup: 0
517-
# allowPrivilegeEscalation: false
518-
# capabilities:
519-
# drop:
520-
# - ALL
527+
runAsNonRoot: true
528+
seccompProfile:
529+
type: RuntimeDefault
521530

522531
#############################################################
523532
# Horizontal Pod Autoscaling
@@ -605,7 +614,11 @@ global:
605614
#
606615
# See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
607616
############################################################
608-
securityContext: null
617+
securityContext:
618+
allowPrivilegeEscalation: false
619+
capabilities:
620+
drop:
621+
- ALL
609622
# @param global.container.replicaCount Number of replicas for workload
610623
# @default 1
611624
replicaCount: 1
@@ -776,7 +789,7 @@ sidecars: {}
776789
# sidecars:
777790
# logger:
778791
# name: log-container
779-
# image: pingidentity/pingtoolkit:2212
792+
# image: pingidentity/pingtoolkit:2302
780793
# volumeMounts:
781794
# - mountPath: /tmp/logs/
782795
# name: logger
@@ -793,7 +806,7 @@ initContainers: {}
793806
# initContainers:
794807
# init-example:
795808
# name: 01-init
796-
# image: pingidentity/pingtoolkit:2212
809+
# image: pingidentity/pingtoolkit:2302
797810
# command: ['sh', '-c', 'echo "InitContainer 1"']
798811

799812
#############################################################
@@ -840,6 +853,10 @@ ldap-sdk-tools:
840853
name: ldap-sdk-tools
841854
image:
842855
name: ldap-sdk-tools
856+
repository: pingidentity
857+
repositoryFqn:
858+
tag: "2302"
859+
pullPolicy: IfNotPresent
843860

844861
container:
845862
command: "tail -f /dev/null"
@@ -1082,6 +1099,21 @@ pingdirectory:
10821099
envs:
10831100
MAKELDIF_USERS: "20000"
10841101

1102+
# @param pingdirectory.services.serviceName.loadBalancerService If true, the
1103+
# @desc per-Pod LoadBalancer services enabled with
1104+
# @desc pingdirectory.services.loadBalancerServicePerPod will include this port.
1105+
# @default false
1106+
#
1107+
# @param pingdirectory.services.loadBalancerServicePerPod
1108+
# @desc Set to true to create a separate LoadBalancer service for each individual
1109+
# @desc Pod in the PingDirectory StatefulSet.
1110+
# @default false
1111+
#
1112+
# @param pingdirectory.services.loadBalancerExternalDNSHostnameSuffix
1113+
# @desc Value used for the external-dns.alpha.kubernetes.io/hostname annotation
1114+
# @desc for the LoadBalancer services. This value will be used as a suffix for
1115+
# @desc the hostname for each individual pod when
1116+
# @desc pingdirectory.services.loadBalancerServicePerPod is set to true.
10851117
services:
10861118
ldap:
10871119
servicePort: 389
@@ -1092,12 +1124,18 @@ pingdirectory:
10921124
containerPort: 1636
10931125
dataService: true
10941126
clusterService: true
1127+
loadBalancerService: true
10951128
https:
10961129
servicePort: 443
10971130
containerPort: 1443
10981131
ingressPort: 443
10991132
dataService: true
1133+
replication:
1134+
containerPort: 8989
1135+
loadBalancerService: true
11001136
clusterServiceName: pingdirectory-cluster
1137+
loadBalancerServicePerPod: false
1138+
#loadBalancerExternalDNSHostnameSuffix: .example.com
11011139

11021140
ingress:
11031141
hosts:
@@ -1614,6 +1652,10 @@ pd-replication-timing:
16141652
name: pd-replication-timing
16151653
image:
16161654
name: pingtoolkit
1655+
repository: pingidentity
1656+
repositoryFqn:
1657+
tag: "2302"
1658+
pullPolicy: IfNotPresent
16171659

16181660
envs:
16191661
SERVER_PROFILE_URL: https://github.com/pingidentity/pingidentity-server-profiles.git
@@ -1632,6 +1674,10 @@ pingtoolkit:
16321674
name: pingtoolkit
16331675
image:
16341676
name: pingtoolkit
1677+
repository: pingidentity
1678+
repositoryFqn:
1679+
tag: "2302"
1680+
pullPolicy: IfNotPresent
16351681

16361682
#############################################################
16371683
# testFramework
@@ -1733,5 +1779,9 @@ testFramework:
17331779
#########################################################
17341780
pod:
17351781
securityContext:
1782+
fsGroup: 0
17361783
runAsUser: 9031
17371784
runAsGroup: 0
1785+
runAsNonRoot: true
1786+
seccompProfile:
1787+
type: RuntimeDefault

0 commit comments

Comments
 (0)