diff --git a/bitnami/ejbca/CHANGELOG.md b/bitnami/ejbca/CHANGELOG.md index 4bcbf905f9..5d895745ba 100644 --- a/bitnami/ejbca/CHANGELOG.md +++ b/bitnami/ejbca/CHANGELOG.md @@ -1,8 +1,12 @@ # Changelog -## 16.0.1 (2024-11-16) +## 16.1.0 (2024-12-10) -* [bitnami/ejbca] Release 16.0.1 ([#30485](https://github.com/bitnami/charts/pull/30485)) +* [bitnami/ejbca] Detect non-standard images ([#30879](https://github.com/bitnami/charts/pull/30879)) + +## 16.0.1 (2024-11-16) + +* [bitnami/ejbca] Release 16.0.1 (#30485) ([efd14a3](https://github.com/bitnami/charts/commit/efd14a3db551878a23b069b1ef6f4ac37b145e32)), closes [#30485](https://github.com/bitnami/charts/issues/30485) ## 16.0.0 (2024-11-12) diff --git a/bitnami/ejbca/Chart.lock b/bitnami/ejbca/Chart.lock index 12990b8473..7a7c2748f4 100644 --- a/bitnami/ejbca/Chart.lock +++ b/bitnami/ejbca/Chart.lock @@ -1,9 +1,9 @@ dependencies: - name: mariadb repository: oci://registry-1.docker.io/bitnamicharts - version: 20.0.0 + version: 20.1.1 - name: common repository: oci://registry-1.docker.io/bitnamicharts - version: 2.27.0 -digest: sha256:f2778c936bac0bad137df5b1d51eb8d7591bdc7749db7edb2c78a5384fa3846f -generated: "2024-11-08T16:11:38.448357185+01:00" + version: 2.28.0 +digest: sha256:37ae939f8a3502a391d1a867ef6de6a87e3ac56258a6e36507dd71a1fbd55d54 +generated: "2024-12-10T16:56:32.37801+01:00" diff --git a/bitnami/ejbca/Chart.yaml b/bitnami/ejbca/Chart.yaml index aeeb521bfa..a382d07b27 100644 --- a/bitnami/ejbca/Chart.yaml +++ b/bitnami/ejbca/Chart.yaml @@ -35,4 +35,4 @@ maintainers: name: ejbca sources: - https://github.com/bitnami/charts/tree/main/bitnami/ejbca -version: 16.0.1 +version: 16.1.0 diff --git a/bitnami/ejbca/README.md b/bitnami/ejbca/README.md index 8afc9d0835..79e583e0d7 100644 --- a/bitnami/ejbca/README.md +++ b/bitnami/ejbca/README.md @@ -158,12 +158,13 @@ Persistent Volume Claims are used to keep the data across deployments. This is k ### Global parameters -| Name | Description | Value | -| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------ | -| `global.imageRegistry` | Global Docker image registry | `""` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | -| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` | -| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | +| Name | Description | Value | +| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | +| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` | +| `global.security.allowInsecureImages` | Allows skipping image verification | `false` | +| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` | ### Common parameters @@ -383,6 +384,10 @@ Find more information about how to deal with common errors related to Bitnami's ## Upgrading +### To 16.1.0 + +This version introduces image verification for security purposes. To disable it, set `global.security.allowInsecureImages` to `true`. More details at [GitHub issue](https://github.com/bitnami/charts/issues/30850). + ### To 16.0.0 This major bump updates the MariaDB subchart to version 20.0.0. This subchart updates the StatefulSet objects `serviceName` to use a headless service, as the current non-headless service attached to it was not providing DNS entries. This will cause an upgrade issue because it changes "immutable fields". To workaround it, delete the StatefulSet objects as follows (replace the RELEASE_NAME placeholder): diff --git a/bitnami/ejbca/templates/NOTES.txt b/bitnami/ejbca/templates/NOTES.txt index ddc3209a6b..37b6716e00 100644 --- a/bitnami/ejbca/templates/NOTES.txt +++ b/bitnami/ejbca/templates/NOTES.txt @@ -96,4 +96,5 @@ To access your EJBCA site from outside the cluster follow the steps below: {{- include "common.warnings.rollingTag" .Values.image }} {{- include "common.warnings.resources" (dict "sections" (list "") "context" $) }} -{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image) "context" $) }} \ No newline at end of file +{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image) "context" $) }} +{{- include "common.errors.insecureImages" (dict "images" (list .Values.image) "context" $) }} diff --git a/bitnami/ejbca/values.yaml b/bitnami/ejbca/values.yaml index a93b6e2ac6..7a0d7938f4 100644 --- a/bitnami/ejbca/values.yaml +++ b/bitnami/ejbca/values.yaml @@ -18,6 +18,11 @@ global: ## imagePullSecrets: [] defaultStorageClass: "" + ## Security parameters + ## + security: + ## @param global.security.allowInsecureImages Allows skipping image verification + allowInsecureImages: false ## Compatibility adaptations for Kubernetes platforms ## compatibility: