Merge branch 'main' into flux-update/2.1.2

licenses.d2iq.yaml

@@ -5,7 +5,7 @@ ignore:
   - docker.io/bitnami/external-dns:0.13.6-debian-11-r11
   - docker.io/bitnami/postgresql:11.16.0-debian-11-r9
   - docker.io/bitnami/postgresql:15.2.0-debian-11-r21
-  - docker.io/bitnami/redis-cluster:7.0.12-debian-11-r2
+  - docker.io/bitnami/memcached:1.6.15-debian-11-r8
   - docker.io/library/busybox:1
   - gcr.io/kubecost1/cost-model:prod-1.106.2
   - gcr.io/kubecost1/frontend:prod-1.106.2
@@ -89,7 +89,7 @@ resources:
       - license_path: LICENSE
         ref: v${image_tag}
         url: https://github.com/fluent/fluent-bit
-  - container_image: docker.io/gitea/gitea:1.20.3-rootless
+  - container_image: docker.io/gitea/gitea:1.19.2-rootless
     sources:
       - license_path: LICENSE
         ref: v${image_tag%-rootless}
@@ -184,11 +184,11 @@ resources:
     sources:
       - ref: ${image_tag}
         url: https://github.com/mesosphere/kommander-auditing-pipeline
-  - container_image: docker.io/mesosphere/dex-controller:v0.12.2
+  - container_image: docker.io/mesosphere/dex-controller:v0.13.0
     sources:
       - ref: ${image_tag}
         url: https://github.com/mesosphere/dex-controller
-  - container_image: docker.io/mesosphere/dex-k8s-authenticator:v1.2.5-d2iq
+  - container_image: docker.io/mesosphere/dex-k8s-authenticator:v1.3.1-d2iq
     sources:
       - license_path: LICENSE
         ref: ${image_tag}
@@ -203,11 +203,11 @@ resources:
       - license_path: LICENSE
         ref: ${image_tag%-server-backend-proxy}
         url: https://github.com/ghostunnel/ghostunnel
-  - container_image: docker.io/mesosphere/insights-management:v1.0.0-dev.1
+  - container_image: docker.io/mesosphere/insights-management:v1.0.0-dev.3
     sources:
       - ref: ${image_tag}
         url: https://github.com/mesosphere/dkp-insights
-  - container_image: docker.io/mesosphere/insights:v1.0.0-dev.1
+  - container_image: docker.io/mesosphere/insights:v1.0.0-dev.3
     sources:
       - ref: ${image_tag}
         url: https://github.com/mesosphere/dkp-insights
@@ -487,22 +487,22 @@ resources:
       - license_path: LICENSE
         ref: ${image_tag}.0
         url: https://github.com/FairwindsOps/polaris
-  - container_image: quay.io/jetstack/cert-manager-cainjector:v1.12.3
+  - container_image: quay.io/jetstack/cert-manager-cainjector:v1.13.1
     sources:
       - license_path: LICENSE
         ref: ${image_tag}
         url: https://github.com/cert-manager/cert-manager
-  - container_image: quay.io/jetstack/cert-manager-controller:v1.12.3
+  - container_image: quay.io/jetstack/cert-manager-controller:v1.13.1
     sources:
       - license_path: LICENSE
         ref: ${image_tag}
         url: https://github.com/cert-manager/cert-manager
-  - container_image: quay.io/jetstack/cert-manager-ctl:v1.12.3
+  - container_image: quay.io/jetstack/cert-manager-ctl:v1.13.1
     sources:
       - license_path: LICENSE
         ref: ${image_tag}
         url: https://github.com/cert-manager/cert-manager
-  - container_image: quay.io/jetstack/cert-manager-webhook:v1.12.3
+  - container_image: quay.io/jetstack/cert-manager-webhook:v1.13.1
     sources:
       - license_path: LICENSE
         ref: ${image_tag}

services/cert-manager/1.12.3/cert-manager-namespace.yaml → services/cert-manager/1.13.1/cert-manager-namespace.yaml

@@ -9,7 +9,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/cert-manager/1.12.3/cert-manager-namespace
+  path: ./services/cert-manager/1.13.1/cert-manager-namespace
   sourceRef:
     kind: GitRepository
     name: management

services/cert-manager/1.12.3/defaults/cm.yaml → services/cert-manager/1.13.1/defaults/cm.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: cert-manager-1.12.3-d2iq-defaults
+  name: cert-manager-1.13.1-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |-

services/cert-manager/1.12.3/priorityclass-resource-quota.yaml → services/cert-manager/1.13.1/priorityclass-resource-quota.yaml

@@ -11,7 +11,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/cert-manager/1.12.3/priorityclass-resource-quota
+  path: ./services/cert-manager/1.13.1/priorityclass-resource-quota
   sourceRef:
     kind: GitRepository
     name: management

services/cert-manager/1.12.3/release.yaml → services/cert-manager/1.13.1/release.yaml

@@ -11,7 +11,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/cert-manager/1.12.3/release
+  path: ./services/cert-manager/1.13.1/release
   sourceRef:
     kind: GitRepository
     name: management

services/cert-manager/1.12.3/release/release.yaml → services/cert-manager/1.13.1/release/release.yaml

@@ -11,7 +11,7 @@ spec:
         kind: HelmRepository
         name: charts.jetstack.io
         namespace: kommander-flux
-      version: v1.12.3
+      version: v1.13.1
   interval: 15s
   install:
     crds: CreateReplace
@@ -26,7 +26,7 @@ spec:
   targetNamespace: cert-manager
   valuesFrom:
     - kind: ConfigMap
-      name: cert-manager-1.12.3-d2iq-defaults
+      name: cert-manager-1.13.1-d2iq-defaults
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
@@ -41,7 +41,7 @@ spec:
         kind: HelmRepository
         name: mesosphere.github.io-charts-stable
         namespace: kommander-flux
-      version: v1.12.3
+      version: v1.13.1
   interval: 15s
   install:
     remediation:

services/cert-manager/1.12.3/root-ca.yaml → services/cert-manager/1.13.1/root-ca.yaml

@@ -9,7 +9,7 @@ spec:
   wait: true
   interval: 6h
   retryInterval: 1m
-  path: ./services/cert-manager/1.12.3/root-ca
+  path: ./services/cert-manager/1.13.1/root-ca
   sourceRef:
     kind: GitRepository
     name: management

services/cert-manager/bootstrap/kustomization.yaml

@@ -13,5 +13,5 @@ patchesJson6902:
       kind: HelmRelease
       name: cert-manager
 resources:
-  - ../1.12.3/
-  - ../1.12.3/defaults/
+  - ../1.13.1/
+  - ../1.13.1/defaults/

services/dex-k8s-authenticator/1.2.18/defaults/cm.yaml → services/dex-k8s-authenticator/1.3.1/defaults/cm.yaml

@@ -1,15 +1,15 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: dex-k8s-authenticator-1.2.18-d2iq-defaults
+  name: dex-k8s-authenticator-1.3.1-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |-
     ---
     priorityClassName: "dkp-high-priority"
     image:
       repository: mesosphere/dex-k8s-authenticator
-      tag: v1.2.5-d2iq
+      tag: v1.3.1-d2iq
     env:
       ENABLE_MULTI_TENANCY: "true"
     ingress:

services/dex-k8s-authenticator/1.2.18/dex-k8s-authenticator.yaml → services/dex-k8s-authenticator/1.3.1/dex-k8s-authenticator.yaml

@@ -21,7 +21,7 @@ spec:
         kind: HelmRepository
         name: mesosphere.github.io-charts-staging
         namespace: kommander-flux
-      version: 1.2.18
+      version: 1.3.1
   interval: 15s
   install:
     crds: CreateReplace
@@ -34,5 +34,5 @@ spec:
   releaseName: dex-k8s-authenticator
   valuesFrom:
     - kind: ConfigMap
-      name: dex-k8s-authenticator-1.2.18-d2iq-defaults
+      name: dex-k8s-authenticator-1.3.1-d2iq-defaults
   targetNamespace: ${releaseNamespace}

services/dex/2.13.4/defaults/cm.yaml → services/dex/2.13.6/defaults/cm.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: dex-2.13.4-d2iq-defaults
+  name: dex-2.13.6-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |-
@@ -65,6 +65,8 @@ data:
             params:
               - "state"
               - "tenant-id"
+              - "client_id"
+              - "scope"
           config:
             url: "https://dex-dex-controller-webhook-service:18443/connectors"
             tlsRootCAFile: "/etc/dex/tls/client/ca.crt"

services/dex/2.13.4/dex.yaml → services/dex/2.13.6/dex.yaml

@@ -11,7 +11,7 @@ spec:
         kind: HelmRepository
         name: mesosphere.github.io-charts-stable
         namespace: kommander-flux
-      version: 2.13.4
+      version: 2.13.6
   interval: 15s
   install:
     crds: CreateReplace
@@ -24,5 +24,5 @@ spec:
   releaseName: dex
   valuesFrom:
     - kind: ConfigMap
-      name: dex-2.13.4-d2iq-defaults
+      name: dex-2.13.6-d2iq-defaults
   targetNamespace: ${releaseNamespace}

services/dkp-insights-management/1.0.0/defaults/cm.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: dkp-insights-management-1.0.0-dev.1-d2iq-defaults
+  name: dkp-insights-management-1.0.0-dev.3-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |
@@ -30,7 +30,7 @@ data:
       imagePullPolicy: IfNotPresent
       registry: docker.io
       repository: mesosphere/insights-management
-      tag: v1.0.0-dev.1
+      tag: v1.0.0-dev.3
     insightsCRIngress:
       globalRateLimitAverageQPS: 100
       globalRateLimitBurst: 100

services/dkp-insights-management/1.0.0/helmrelease/helmrelease.yaml

@@ -11,7 +11,7 @@ spec:
         kind: HelmRepository
         name: mesosphere.github.io-dkp-insights-charts-management
         namespace: kommander-flux
-      version: v1.0.0-dev.1
+      version: v1.0.0-dev.3
   dependsOn:
     - name: kubefed
       namespace: ${releaseNamespace}
@@ -28,4 +28,4 @@ spec:
       retries: 30
   valuesFrom:
     - kind: ConfigMap
-      name: dkp-insights-management-1.0.0-dev.1-d2iq-defaults
+      name: dkp-insights-management-1.0.0-dev.3-d2iq-defaults

services/dkp-insights/1.0.0/defaults/cm.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: dkp-insights-1.0.0-dev.1-d2iq-defaults
+  name: dkp-insights-1.0.0-dev.3-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |
@@ -200,7 +200,7 @@ data:
       imagePullPolicy: IfNotPresent
       registry: docker.io
       repository: mesosphere/insights
-      tag: v1.0.0-dev.1
+      tag: v1.0.0-dev.3
     initdb:
       resources:
         limits:

services/dkp-insights/1.0.0/helmrelease/helmrelease.yaml

@@ -11,7 +11,7 @@ spec:
         kind: HelmRepository
         name: mesosphere.github.io-dkp-insights-charts-attached
         namespace: kommander-flux
-      version: v1.0.0-dev.1
+      version: v1.0.0-dev.3
   install:
     remediation:
       retries: 30
@@ -21,6 +21,14 @@ spec:
   upgrade:
     remediation:
       retries: 30
+      # After the database migration has happened, the previous version of
+      # Insights will no longer work. Hence, the default `rollback` strategy
+      # can be worse than no remediation at all.
+      # On the other hand, we go to significant lengths to ensure
+      # that Insights work after being uninstalled and reinstalled again
+      # using previously persisted data (note that uninstall does not delete
+      # corresponding persistent volumes).
+      strategy: uninstall
   valuesFrom:
     - kind: ConfigMap
-      name: dkp-insights-1.0.0-dev.1-d2iq-defaults
+      name: dkp-insights-1.0.0-dev.3-d2iq-defaults

services/gitea/9.3.0/defaults/cm.yaml → services/gitea/8.2.0/defaults/cm.yaml

@@ -1,15 +1,14 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: gitea-9.3.0-d2iq-defaults
+  name: gitea-8.2.0-d2iq-defaults
   namespace: ${releaseNamespace}
 data:
   values.yaml: |-
     ---
     priorityClassName: "dkp-critical-priority"
     image:
       rootless: true
-      pullPolicy: IfNotPresent
     ingress:
       enabled: true
       annotations:
@@ -22,9 +21,9 @@ data:
             pathType: ImplementationSpecific
     gitea:
       additionalConfigFromEnvs:
-        - name: GITEA__SERVER__SSL_MIN_VERSION
+        - name: ENV_TO_INI__SERVER__SSL_MIN_VERSION
           value: tlsv1.3
-        - name: GITEA__SERVER__SSL_MAX_VERSION
+        - name: ENV_TO_INI__SERVER__SSL_MAX_VERSION
           value: tlsv1.3
       admin:
         existingSecret: ${adminCredentialsSecret}
@@ -38,17 +37,6 @@ data:
         service:
           REQUIRE_SIGNIN_VIEW: false
           DISABLE_REGISTRATION: true
-        session:
-          PROVIDER: redis
-          PROVIDER_CONFIG: redis+cluster://:gitea@gitea-redis-cluster-headless.${releaseNamespace}.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-        cache:
-          ENABLED: true
-          ADAPTER: redis
-          HOST: redis+cluster://:gitea@gitea-redis-cluster-headless.${releaseNamespace}.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-        queue:
-          TYPE: redis
-          CONN_STR: redis+cluster://:gitea@gitea-redis-cluster-headless.${releaseNamespace}.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
-
       startupProbe:
         enabled: true
         tcpSocket:
@@ -58,40 +46,28 @@ data:
         periodSeconds: 10
         successThreshold: 1
         failureThreshold: 10
-      # We use startupProbe unlike the default configuration,
-      # to shorten readiness time, set initialDelaySeconds to 5 seconds.
-      livenessProbe:
-        initialDelaySeconds: 5
-    deployment:
+    statefulset:
       annotations:
         secret.reloader.stakater.com/reload: ${tlsCertificateSecret}
     service:
       http:
         port: 443
         clusterIP:
     extraVolumes:
-      - name: git-tls
-        secret:
-          secretName: ${tlsCertificateSecret}
+    - name: git-tls
+      secret:
+        secretName: ${tlsCertificateSecret}
     extraVolumeMounts:
-      - name: git-tls
-        readOnly: true
-        mountPath: "/git-tls"
+    - name: git-tls
+      readOnly: true
+      mountPath: "/git-tls"
     clusterDomain: cluster.local.
-    redis-cluster:
+    memcached:
       priorityClassName: "dkp-critical-priority"
-      cluster:
-        nodes: 6
-    postgresql-ha:
-      enabled: false
+      image:
+        tag: 1.6.15-debian-11-r8
     postgresql:
-      enabled: true
       primary:
         priorityClassName: "dkp-critical-priority"
       image:
         tag: 11.16.0-debian-11-r9
-    persistence:
-      enabled: true
-      create: false
-      mount: true
-      claimName: "data-gitea-0"