mirror of
https://github.com/bitnami/charts.git
synced 2026-08-10 14:15:55 +08:00
[bitnami/apache] fix: 🔒 Move service-account token auto-mount to pod declaration (#22478)
* [bitnami/apache] fix: 🔒 Move service-account token auto-mount to pod declaration Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> * fix: 🐛 Set mount to false Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> * Update README.md with readme-generator-for-helm Signed-off-by: Bitnami Containers <bitnami-bot@vmware.com> * fix: 🐛 Correct helper name Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> --------- Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com> Signed-off-by: Bitnami Containers <bitnami-bot@vmware.com> Co-authored-by: Bitnami Containers <bitnami-bot@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
co-authored by
Bitnami Containers
Bitnami Containers
parent
325f583a3b
commit
f824fb5553
@@ -35,4 +35,4 @@ maintainers:
|
||||
name: apache
|
||||
sources:
|
||||
- https://github.com/bitnami/charts/tree/main/bitnami/apache
|
||||
version: 10.3.1
|
||||
version: 10.4.0
|
||||
|
||||
+31
-26
@@ -116,6 +116,7 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `httpdConfConfigMap` | Name of a config map with the httpd.conf file contents | `""` |
|
||||
| `podLabels` | Extra labels for Apache pods | `{}` |
|
||||
| `podAnnotations` | Pod annotations | `{}` |
|
||||
| `automountServiceAccountToken` | Mount Service Account token in pod | `false` |
|
||||
| `hostAliases` | Add deployment host aliases | `[]` |
|
||||
| `priorityClassName` | Apache Server pods' priorityClassName | `""` |
|
||||
| `schedulerName` | Name of the k8s scheduler (other than default) | `""` |
|
||||
@@ -222,32 +223,36 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
### Metrics Parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
|
||||
| `metrics.enabled` | Start a sidecar prometheus exporter to expose Apache metrics | `false` |
|
||||
| `metrics.image.registry` | Apache Exporter image registry | `REGISTRY_NAME` |
|
||||
| `metrics.image.repository` | Apache Exporter image repository | `REPOSITORY_NAME/apache-exporter` |
|
||||
| `metrics.image.digest` | Apache Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `metrics.image.pullPolicy` | Apache Exporter image pull policy | `IfNotPresent` |
|
||||
| `metrics.image.pullSecrets` | Apache Exporter image pull secrets | `[]` |
|
||||
| `metrics.image.debug` | Apache Exporter image debug mode | `false` |
|
||||
| `metrics.podAnnotations` | Additional custom annotations for Apache exporter service | `{}` |
|
||||
| `metrics.resources.limits` | The resources limits for the container | `{}` |
|
||||
| `metrics.resources.requests` | The requested resources for the container | `{}` |
|
||||
| `metrics.containerPort` | Apache Prometheus Exporter container port | `9141` |
|
||||
| `metrics.service.port` | Metrics service port | `9117` |
|
||||
| `metrics.service.annotations` | Additional custom annotations for Metrics service | `{}` |
|
||||
| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator PodMonitor (also requires `metrics.enabled` to be `true`) | `false` |
|
||||
| `metrics.serviceMonitor.namespace` | Namespace for the PodMonitor Resource (defaults to the Release Namespace) | `""` |
|
||||
| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `""` |
|
||||
| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` |
|
||||
| `metrics.serviceMonitor.labels` | Labels that can be used so PodMonitor will be discovered by Prometheus | `{}` |
|
||||
| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` |
|
||||
| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` |
|
||||
| `metrics.prometheusRule.enabled` | if `true`, creates a Prometheus Operator PrometheusRule (also requires `metrics.enabled` to be `true` and `metrics.prometheusRule.rules`) | `false` |
|
||||
| `metrics.prometheusRule.namespace` | Namespace for the PrometheusRule Resource (defaults to the Release Namespace) | `""` |
|
||||
| `metrics.prometheusRule.labels` | Labels that can be used so PrometheusRule will be discovered by Prometheus | `{}` |
|
||||
| `metrics.prometheusRule.rules` | Prometheus Rule definitions | `[]` |
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
|
||||
| `metrics.enabled` | Start a sidecar prometheus exporter to expose Apache metrics | `false` |
|
||||
| `metrics.image.registry` | Apache Exporter image registry | `REGISTRY_NAME` |
|
||||
| `metrics.image.repository` | Apache Exporter image repository | `REPOSITORY_NAME/apache-exporter` |
|
||||
| `metrics.image.digest` | Apache Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `metrics.image.pullPolicy` | Apache Exporter image pull policy | `IfNotPresent` |
|
||||
| `metrics.image.pullSecrets` | Apache Exporter image pull secrets | `[]` |
|
||||
| `metrics.image.debug` | Apache Exporter image debug mode | `false` |
|
||||
| `metrics.podAnnotations` | Additional custom annotations for Apache exporter service | `{}` |
|
||||
| `metrics.resources.limits` | The resources limits for the container | `{}` |
|
||||
| `metrics.resources.requests` | The requested resources for the container | `{}` |
|
||||
| `metrics.containerPort` | Apache Prometheus Exporter container port | `9141` |
|
||||
| `metrics.service.port` | Metrics service port | `9117` |
|
||||
| `metrics.service.annotations` | Additional custom annotations for Metrics service | `{}` |
|
||||
| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator PodMonitor (also requires `metrics.enabled` to be `true`) | `false` |
|
||||
| `metrics.serviceMonitor.namespace` | Namespace for the PodMonitor Resource (defaults to the Release Namespace) | `""` |
|
||||
| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped. | `""` |
|
||||
| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` |
|
||||
| `metrics.serviceMonitor.labels` | Labels that can be used so PodMonitor will be discovered by Prometheus | `{}` |
|
||||
| `metrics.serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping | `[]` |
|
||||
| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` |
|
||||
| `metrics.prometheusRule.enabled` | if `true`, creates a Prometheus Operator PrometheusRule (also requires `metrics.enabled` to be `true` and `metrics.prometheusRule.rules`) | `false` |
|
||||
| `metrics.prometheusRule.namespace` | Namespace for the PrometheusRule Resource (defaults to the Release Namespace) | `""` |
|
||||
| `metrics.prometheusRule.labels` | Labels that can be used so PrometheusRule will be discovered by Prometheus | `{}` |
|
||||
| `metrics.prometheusRule.rules` | Prometheus Rule definitions | `[]` |
|
||||
| `serviceAccount.create` | Enable creation of ServiceAccount for WordPress pod | `true` |
|
||||
| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
|
||||
| `serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` |
|
||||
| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
|
||||
|
||||
### Network policies section
|
||||
|
||||
|
||||
@@ -18,6 +18,17 @@ Return the proper Apache Docker Image Registry Secret Names
|
||||
{{- include "common.images.pullSecrets" (dict "images" (list .Values.image .Values.metrics.image) "global" .Values.global) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "apache.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name (for the metrics image)
|
||||
*/}}
|
||||
|
||||
@@ -38,6 +38,7 @@ spec:
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "apache.imagePullSecrets" . | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- if .Values.hostAliases }}
|
||||
# yamllint disable rule:indentation
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
|
||||
@@ -47,6 +48,7 @@ spec:
|
||||
schedulerName: {{ .Values.schedulerName }}
|
||||
{{- end }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
serviceAccountName: {{ include "apache.serviceAccountName" .}}
|
||||
{{- if .Values.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- /*
|
||||
Copyright VMware, Inc.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "apache.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end -}}
|
||||
@@ -190,6 +190,9 @@ podLabels: {}
|
||||
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
##
|
||||
podAnnotations: {}
|
||||
## @param automountServiceAccountToken Mount Service Account token in pod
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## @param hostAliases [array] Add deployment host aliases
|
||||
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
|
||||
##
|
||||
@@ -719,6 +722,25 @@ metrics:
|
||||
##
|
||||
rules: []
|
||||
|
||||
## Service Account
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
|
||||
##
|
||||
serviceAccount:
|
||||
## @param serviceAccount.create Enable creation of ServiceAccount for WordPress pod
|
||||
##
|
||||
create: true
|
||||
## @param serviceAccount.name The name of the ServiceAccount to use.
|
||||
## If not set and create is true, a name is generated using the common.names.fullname template
|
||||
##
|
||||
name: ""
|
||||
## @param serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created
|
||||
## Can be set to false if pods using this serviceAccount do not need to use K8s API
|
||||
##
|
||||
automountServiceAccountToken: false
|
||||
## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount
|
||||
##
|
||||
annotations: {}
|
||||
|
||||
## @section Network policies section
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
|
||||
##
|
||||
|
||||
Reference in New Issue
Block a user