fix(helm): update gitlab (8.8.0 → 8.8.1) #4246
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
Path: @@ -1290,8 +1290,8 @@
release: gitlab
heritage: Helm
data:
- gitlabVersion: "17.8.0"
- gitlabChartVersion: "8.8.0"
+ gitlabVersion: "17.8.1"
+ gitlabChartVersion: "8.8.1"
---
# Source: gitlab/charts/minio/templates/minio_pvc.yaml
kind: PersistentVolumeClaim
@@ -1507,13 +1507,13 @@
release: gitlab
heritage: Helm
annotations:
- checksum/config: 41fa28b9bdbde80fa6d1c0c7d40a34f8e08a603c2e3aedddef4e0a73ad10cea6
- checksum/config-sshd: 189235d94a7a7b3862c596a6e0920ca03c1181635c0f47bb462ccde2b5b4061b
+ checksum/config: c4b2dcdc00a8e01b92bec95a5a3c5b6663f7f4f4486a12144dc456cf179985e1
+ checksum/config-sshd: 9c8d19d20778ec2ec5bd40363aae9dd85cb7af8239da44e1f4cb87cabdd3a2b9
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
spec:
initContainers:
- name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -1535,7 +1535,7 @@
cpu: 50m
- name: configure
command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -1699,7 +1699,7 @@
heritage: Helm
queue-pod-name: all-in-1
annotations:
- checksum/configmap: 397b17c4983de67012ada60ccc893e373fe13ff683970cb2789af1cbbf896ae3
+ checksum/configmap: d785c65bfdc2b9db2773cce693a9050d3aeeb0209a562e490dc11aa8c6c4ed22
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
gitlab.com/prometheus_scrape: "true"
gitlab.com/prometheus_port: "3807"
@@ -1727,7 +1727,7 @@
terminationGracePeriodSeconds: 30
initContainers:
- name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -1750,7 +1750,7 @@
cpu: 50m
- name: configure
command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -1775,7 +1775,7 @@
requests:
cpu: 50m
- name: dependencies
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -1822,7 +1822,7 @@
cpu: 50m
containers:
- name: sidekiq
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-sidekiq-ce:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2045,7 +2045,7 @@
release: gitlab
heritage: Helm
annotations:
- checksum/config: 6b910fc2702a932092ffd1e6168c08573b37888bc67f7034716a788363c9e202
+ checksum/config: ac5326de4aab1662207b89db0fee5811a844c046ac41ffd833ca6c715eab9c72
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
spec:
securityContext:
@@ -2057,7 +2057,7 @@
automountServiceAccountToken: false
initContainers:
- name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2080,7 +2080,7 @@
cpu: 50m
- name: configure
command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2120,7 +2120,7 @@
- /bin/bash
- -c
- cp -v -r -L /etc/gitlab/.s3cfg $HOME/.s3cfg && while sleep 3600; do :; done # alpine sleep has no infinity
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2329,7 +2329,7 @@
heritage: Helm
gitlab.com/webservice-name: default
annotations:
- checksum/config: 75427e4584e12d92460e8753c8a4d0fbd5d443c1a1e8748fab7e549f308b4224
+ checksum/config: 089cd73d777f29bca88e8010efa9410d352dd0c806edf3efd188ca59ddb3844b
cluster-autoscaler.kubernetes.io/safe-to-evict: "true"
gitlab.com/prometheus_scrape: "true"
gitlab.com/prometheus_port: "8083"
@@ -2357,7 +2357,7 @@
automountServiceAccountToken: false
initContainers:
- name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2381,7 +2381,7 @@
- name: configure
command: ['sh']
args: ['-c', 'sh -x /config-webservice/configure ; sh -x /config-workhorse/configure ; mkdir -p -m 3770 /tmp/gitlab']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2415,7 +2415,7 @@
requests:
cpu: 50m
- name: dependencies
- image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2459,7 +2459,7 @@
cpu: 50m
containers:
- name: webservice
- image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2566,7 +2566,7 @@
cpu: 300m
memory: 2.5G
- name: gitlab-workhorse
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ce:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2824,7 +2824,7 @@
medium: "Memory"
initContainers:
- name: configure
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2924,7 +2924,7 @@
automountServiceAccountToken: false
initContainers:
- name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -2946,7 +2946,7 @@
requests:
cpu: 50m
- name: configure
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -3183,7 +3183,7 @@
release: gitlab
heritage: Helm
annotations:
- checksum/config: 70a17fc172f958aa2b79c0415d2ce5b27aaab5ebc002e550f7ca4f8997a106da
+ checksum/config: b074b0c98639f81c1ecac43eae5043386fcd8f5014610c484d1fda22bf98aaa1
gitlab.com/prometheus_scrape: "true"
gitlab.com/prometheus_port: "9236"
gitlab.com/prometheus_path: /metrics
@@ -3194,7 +3194,7 @@
terminationGracePeriodSeconds: 30
initContainers:
- name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -3216,7 +3216,7 @@
cpu: 50m
- name: configure
command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -3255,7 +3255,7 @@
automountServiceAccountToken: false
containers:
- name: gitaly
- image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitaly:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -3529,7 +3529,7 @@
apiVersion: batch/v1
kind: Job
metadata:
- name: gitlab-migrations-5a2b4e0
+ name: gitlab-migrations-af6783c
namespace: default
labels:
app: migrations
@@ -3553,7 +3553,7 @@
automountServiceAccountToken: false
initContainers:
- name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -3575,7 +3575,7 @@
cpu: 50m
- name: configure
command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -3601,7 +3601,7 @@
restartPolicy: OnFailure
containers:
- name: migrations
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v17.8.1"
args:
- /scripts/wait-for-deps
- /scripts/db-migrate
@@ -3705,7 +3705,7 @@
apiVersion: batch/v1
kind: Job
metadata:
- name: gitlab-minio-create-buckets-fb0231a
+ name: gitlab-minio-create-buckets-49733fd
namespace: default
labels:
app: minio
@@ -3785,11 +3785,11 @@
metadata:
labels:
app: toolbox
- chart: toolbox-8.8.0
+ chart: toolbox-8.8.1
release: gitlab
heritage: Helm
annotations:
- checksum/config: 6b910fc2702a932092ffd1e6168c08573b37888bc67f7034716a788363c9e202
+ checksum/config: ac5326de4aab1662207b89db0fee5811a844c046ac41ffd833ca6c715eab9c72
cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
spec:
restartPolicy: OnFailure
@@ -3801,7 +3801,7 @@
type: RuntimeDefault
initContainers:
- name: certificates
- image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/certificates:v17.8.1
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -3824,7 +3824,7 @@
cpu: 50m
- name: configure
command: ['sh', '/config/configure']
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -3854,7 +3854,7 @@
- /bin/bash
- -c
- cp /etc/gitlab/.s3cfg $HOME/.s3cfg && backup-utility # alpine sleep has no infinity
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ce:v17.8.1"
securityContext:
allowPrivilegeEscalation: false
capabilities:
@@ -4125,7 +4125,7 @@
"helm.sh/hook-weight": "-3"
"helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
data:
- generate-secrets: "# vim: set filetype=sh:\n\nnamespace=default\nrelease=gitlab\nenv=production\n\npushd $(mktemp -d)\n\n# Args pattern, length\nfunction gen_random(){\n head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2\n}\n\n# Args: length\nfunction gen_random_base64(){\n local len=\"$1\"\n head -c \"$len\" /dev/urandom | base64 -w0\n}\n\n# Args: yaml file, search path\nfunction fetch_rails_value(){\n local value=$(yq --prettyPrint --no-colors \".${2}\" $1)\n\n # Don't return null values\n if [ \"${value}\" != \"null\" ]; then echo \"${value}\"; fi\n}\n\n# Args: secretname\nfunction label_secret(){\n local secret_name=$1\n# Remove application labels if they exist\n kubectl --namespace=$namespace label \\\n secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\n\n kubectl --namespace=$namespace label \\\n --overwrite \\\n secret $secret_name app=gitlab chart=gitlab-8.8.0 release=gitlab heritage=Helm \n}\n\n# Args: secretname, args\nfunction generate_secret_if_needed(){\n local secret_args=( \"${@:2}\")\n local secret_name=$1\n\n if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then\n kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]}\n else\n echo \"secret \\\"$secret_name\\\" already exists.\"\n\n for arg in \"${secret_args[@]}\"; do\n local from=$(echo -n ${arg} | cut -d '=' -f1)\n\n if [ -z \"${from##*literal*}\" ]; then\n local key=$(echo -n ${arg} | cut -d '=' -f2)\n local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-)\n local flags=\"--namespace=$namespace --allow-missing-template-keys=false\"\n\n if ! $(kubectl $flags get secret $secret_name -ojsonpath=\"{.data.${key}}\" > /dev/null 2>&1); then\n echo \"key \\\"${key}\\\" does not exist. patching it in.\"\n\n if [ \"${desiredValue}\" != \"\" ]; then\n desiredValue=$(echo -n \"${desiredValue}\" | base64 -w 0)\n fi\n\n kubectl --namespace=$namespace patch secret ${secret_name} -p \"{\\\"data\\\":{\\\"$key\\\":\\\"${desiredValue}\\\"}}\"\n fi\n fi\n done\n fi\n\n label_secret $secret_name\n}\n\n# Initial root password\ngenerate_secret_if_needed \"gitlab-gitlab-initial-root-password\" --from-literal=\"password\"=$(gen_random 'a-zA-Z0-9' 64)\n\n\n# Redis password\ngenerate_secret_if_needed \"gitlab-redis-secret\" --from-literal=\"secret\"=$(gen_random 'a-zA-Z0-9' 64)\n\n\n\n\n# Gitlab shell\ngenerate_secret_if_needed \"gitlab-gitlab-shell-secret\" --from-literal=\"secret\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Gitaly secret\ngenerate_secret_if_needed \"gitlab-gitaly-secret\" --from-literal=\"token\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Minio secret\ngenerate_secret_if_needed \"gitlab-minio-secret\" --from-literal=accesskey=$(gen_random 'a-zA-Z0-9' 64) --from-literal=secretkey=$(gen_random 'a-zA-Z0-9' 64)\n\n\n# Gitlab runner secret\ngenerate_secret_if_needed \"gitlab-gitlab-runner-secret\" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token=\"\"\n\n# GitLab Pages API secret\n\n\n# GitLab Pages auth secret for hashing cookie store when using access control\n\n\n# GitLab Pages OAuth secret\n\n\n\n\n# Gitlab-suggested-reviewers secret\ngenerate_secret_if_needed \"gitlab-gitlab-suggested-reviewers\" --from-literal=\"suggested_reviewers_secret\"=$(gen_random 'a-zA-Z0-9' 32 | base64)\n\n\n\n\n\n# Registry certificates\nmkdir -p certs\nopenssl req -new -newkey rsa:4096 -subj \"/CN=gitlab-issuer\" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650\ngenerate_secret_if_needed \"gitlab-registry-secret\" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt\n\n# config/secrets.yaml\nif [ -n \"$env\" ]; then\n rails_secret=\"gitlab-rails-secret\"\n\n # Fetch the values from the existing secret if it exists\n if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then\n kubectl --namespace=$namespace get secret $rails_secret -o jsonpath=\"{.data.secrets\\.yml}\" | base64 --decode > secrets.yml\n secret_key_base=$(fetch_rails_value secrets.yml \"${env}.secret_key_base\")\n otp_key_base=$(fetch_rails_value secrets.yml \"${env}.otp_key_base\")\n db_key_base=$(fetch_rails_value secrets.yml \"${env}.db_key_base\")\n openid_connect_signing_key=$(fetch_rails_value secrets.yml \"${env}.openid_connect_signing_key\")\n encrypted_settings_key_base=$(fetch_rails_value secrets.yml \"${env}.encrypted_settings_key_base\")\n\n active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_primary_key\")\n active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_deterministic_key\")\n active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_key_derivation_salt\")\n fi;\n\n # Generate defaults for any unset secrets\n secret_key_base=\"${secret_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n otp_key_base=\"${otp_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n db_key_base=\"${db_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n openid_connect_signing_key=\"${openid_connect_signing_key:-$(openssl genrsa 2048)}\"\n encrypted_settings_key_base=\"${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n\n # 1. We set the following two keys as an array to support keys rotation.\n # The last key in the array is always used to encrypt data:\n # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21\n # while all the keys are used (in the order they're defined) to decrypt data:\n # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26.\n # This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that\n # runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976\n # 2. We use the same method and length as Rails' defaults:\n # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540\n active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-\"- $(gen_random 'a-zA-Z0-9' 32)\"}\n active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-\"- $(gen_random 'a-zA-Z0-9' 32)\"}\n active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)}\n\n # Update the existing secret\n cat << EOF > rails-secrets.yml\napiVersion: v1\nkind: Secret\nmetadata:\n name: $rails_secret\ntype: Opaque\nstringData:\n secrets.yml: |-\n $env:\n secret_key_base: $secret_key_base\n otp_key_base: $otp_key_base\n db_key_base: $db_key_base\n encrypted_settings_key_base: $encrypted_settings_key_base\n openid_connect_signing_key: |\n$(echo \"${openid_connect_signing_key}\" | awk '{print \" \" $0}')\n active_record_encryption_primary_key:\n $active_record_encryption_primary_keys\n active_record_encryption_deterministic_key:\n $active_record_encryption_deterministic_keys\n active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt\nEOF\n kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml\n label_secret $rails_secret\nfi\n\n# Shell ssh host keys\nssh-keygen -A\nmkdir -p host_keys\ncp /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key.pub /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key.pub host_keys/\ngenerate_secret_if_needed \"gitlab-gitlab-shell-host-keys\" --from-file host_keys\n\n# Gitlab-workhorse secret\ngenerate_secret_if_needed \"gitlab-gitlab-workhorse-secret\" --from-literal=\"shared_secret\"=$(gen_random 'a-zA-Z0-9' 32 | base64)\n\n# Registry http.secret secret\ngenerate_secret_if_needed \"gitlab-registry-httpsecret\" --from-literal=\"secret\"=$(gen_random 'a-z0-9' 128 | base64 -w 0)\n\n# Container Registry notification_secret\ngenerate_secret_if_needed \"gitlab-registry-notification\" --from-literal=\"secret\"=[\\\"$(gen_random 'a-zA-Z0-9' 32)\\\"]\n\n\n\n# Zoekt basic auth credentials\ngenerate_secret_if_needed gitlab-zoekt-basicauth --from-literal=gitlab_username=gitlab --from-literal=gitlab_password=$(gen_random 'a-zA-Z0-9' 64)\n"
+ generate-secrets: "# vim: set filetype=sh:\n\nnamespace=default\nrelease=gitlab\nenv=production\n\npushd $(mktemp -d)\n\n# Args pattern, length\nfunction gen_random(){\n head -c 4096 /dev/urandom | LC_CTYPE=C tr -cd $1 | head -c $2\n}\n\n# Args: length\nfunction gen_random_base64(){\n local len=\"$1\"\n head -c \"$len\" /dev/urandom | base64 -w0\n}\n\n# Args: yaml file, search path\nfunction fetch_rails_value(){\n local value=$(yq --prettyPrint --no-colors \".${2}\" $1)\n\n # Don't return null values\n if [ \"${value}\" != \"null\" ]; then echo \"${value}\"; fi\n}\n\n# Args: secretname\nfunction label_secret(){\n local secret_name=$1\n# Remove application labels if they exist\n kubectl --namespace=$namespace label \\\n secret $secret_name $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\n\n kubectl --namespace=$namespace label \\\n --overwrite \\\n secret $secret_name app=gitlab chart=gitlab-8.8.1 release=gitlab heritage=Helm \n}\n\n# Args: secretname, args\nfunction generate_secret_if_needed(){\n local secret_args=( \"${@:2}\")\n local secret_name=$1\n\n if ! $(kubectl --namespace=$namespace get secret $secret_name > /dev/null 2>&1); then\n kubectl --namespace=$namespace create secret generic $secret_name ${secret_args[@]}\n else\n echo \"secret \\\"$secret_name\\\" already exists.\"\n\n for arg in \"${secret_args[@]}\"; do\n local from=$(echo -n ${arg} | cut -d '=' -f1)\n\n if [ -z \"${from##*literal*}\" ]; then\n local key=$(echo -n ${arg} | cut -d '=' -f2)\n local desiredValue=$(echo -n ${arg} | cut -d '=' -f3-)\n local flags=\"--namespace=$namespace --allow-missing-template-keys=false\"\n\n if ! $(kubectl $flags get secret $secret_name -ojsonpath=\"{.data.${key}}\" > /dev/null 2>&1); then\n echo \"key \\\"${key}\\\" does not exist. patching it in.\"\n\n if [ \"${desiredValue}\" != \"\" ]; then\n desiredValue=$(echo -n \"${desiredValue}\" | base64 -w 0)\n fi\n\n kubectl --namespace=$namespace patch secret ${secret_name} -p \"{\\\"data\\\":{\\\"$key\\\":\\\"${desiredValue}\\\"}}\"\n fi\n fi\n done\n fi\n\n label_secret $secret_name\n}\n\n# Initial root password\ngenerate_secret_if_needed \"gitlab-gitlab-initial-root-password\" --from-literal=\"password\"=$(gen_random 'a-zA-Z0-9' 64)\n\n\n# Redis password\ngenerate_secret_if_needed \"gitlab-redis-secret\" --from-literal=\"secret\"=$(gen_random 'a-zA-Z0-9' 64)\n\n\n\n\n# Gitlab shell\ngenerate_secret_if_needed \"gitlab-gitlab-shell-secret\" --from-literal=\"secret\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Gitaly secret\ngenerate_secret_if_needed \"gitlab-gitaly-secret\" --from-literal=\"token\"=$(gen_random 'a-zA-Z0-9' 64)\n\n# Minio secret\ngenerate_secret_if_needed \"gitlab-minio-secret\" --from-literal=accesskey=$(gen_random 'a-zA-Z0-9' 64) --from-literal=secretkey=$(gen_random 'a-zA-Z0-9' 64)\n\n\n# Gitlab runner secret\ngenerate_secret_if_needed \"gitlab-gitlab-runner-secret\" --from-literal=runner-registration-token=$(gen_random 'a-zA-Z0-9' 64) --from-literal=runner-token=\"\"\n\n# GitLab Pages API secret\n\n\n# GitLab Pages auth secret for hashing cookie store when using access control\n\n\n# GitLab Pages OAuth secret\n\n\n\n\n# Gitlab-suggested-reviewers secret\ngenerate_secret_if_needed \"gitlab-gitlab-suggested-reviewers\" --from-literal=\"suggested_reviewers_secret\"=$(gen_random 'a-zA-Z0-9' 32 | base64)\n\n\n\n\n\n# Registry certificates\nmkdir -p certs\nopenssl req -new -newkey rsa:4096 -subj \"/CN=gitlab-issuer\" -nodes -x509 -keyout certs/registry-example-com.key -out certs/registry-example-com.crt -days 3650\ngenerate_secret_if_needed \"gitlab-registry-secret\" --from-file=registry-auth.key=certs/registry-example-com.key --from-file=registry-auth.crt=certs/registry-example-com.crt\n\n# config/secrets.yaml\nif [ -n \"$env\" ]; then\n rails_secret=\"gitlab-rails-secret\"\n\n # Fetch the values from the existing secret if it exists\n if $(kubectl --namespace=$namespace get secret $rails_secret > /dev/null 2>&1); then\n kubectl --namespace=$namespace get secret $rails_secret -o jsonpath=\"{.data.secrets\\.yml}\" | base64 --decode > secrets.yml\n secret_key_base=$(fetch_rails_value secrets.yml \"${env}.secret_key_base\")\n otp_key_base=$(fetch_rails_value secrets.yml \"${env}.otp_key_base\")\n db_key_base=$(fetch_rails_value secrets.yml \"${env}.db_key_base\")\n openid_connect_signing_key=$(fetch_rails_value secrets.yml \"${env}.openid_connect_signing_key\")\n encrypted_settings_key_base=$(fetch_rails_value secrets.yml \"${env}.encrypted_settings_key_base\")\n\n active_record_encryption_primary_keys=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_primary_key\")\n active_record_encryption_deterministic_keys=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_deterministic_key\")\n active_record_encryption_key_derivation_salt=$(fetch_rails_value secrets.yml \"${env}.active_record_encryption_key_derivation_salt\")\n fi;\n\n # Generate defaults for any unset secrets\n secret_key_base=\"${secret_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n otp_key_base=\"${otp_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n db_key_base=\"${db_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n openid_connect_signing_key=\"${openid_connect_signing_key:-$(openssl genrsa 2048)}\"\n encrypted_settings_key_base=\"${encrypted_settings_key_base:-$(gen_random 'a-f0-9' 128)}\" # equivalent to secureRandom.hex(64)\n\n # 1. We set the following two keys as an array to support keys rotation.\n # The last key in the array is always used to encrypt data:\n # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/key_provider.rb#L21\n # while all the keys are used (in the order they're defined) to decrypt data:\n # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/encryption/cipher.rb#L26.\n # This allows to rotate keys by adding a new key as the last key, and start a re-encryption process that\n # runs in the background: https://gitlab.com/gitlab-org/gitlab/-/issues/494976\n # 2. We use the same method and length as Rails' defaults:\n # https://github.com/rails/rails/blob/v7.0.8.4/activerecord/lib/active_record/railties/databases.rake#L537-L540\n active_record_encryption_primary_keys=${active_record_encryption_primary_keys:-\"- $(gen_random 'a-zA-Z0-9' 32)\"}\n active_record_encryption_deterministic_keys=${active_record_encryption_deterministic_keys:-\"- $(gen_random 'a-zA-Z0-9' 32)\"}\n active_record_encryption_key_derivation_salt=${active_record_encryption_key_derivation_salt:-$(gen_random 'a-zA-Z0-9' 32)}\n\n # Update the existing secret\n cat << EOF > rails-secrets.yml\napiVersion: v1\nkind: Secret\nmetadata:\n name: $rails_secret\ntype: Opaque\nstringData:\n secrets.yml: |-\n $env:\n secret_key_base: $secret_key_base\n otp_key_base: $otp_key_base\n db_key_base: $db_key_base\n encrypted_settings_key_base: $encrypted_settings_key_base\n openid_connect_signing_key: |\n$(echo \"${openid_connect_signing_key}\" | awk '{print \" \" $0}')\n active_record_encryption_primary_key:\n $active_record_encryption_primary_keys\n active_record_encryption_deterministic_key:\n $active_record_encryption_deterministic_keys\n active_record_encryption_key_derivation_salt: $active_record_encryption_key_derivation_salt\nEOF\n kubectl --validate=false --namespace=$namespace apply -f rails-secrets.yml\n label_secret $rails_secret\nfi\n\n# Shell ssh host keys\nssh-keygen -A\nmkdir -p host_keys\ncp /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key.pub /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_rsa_key.pub host_keys/\ngenerate_secret_if_needed \"gitlab-gitlab-shell-host-keys\" --from-file host_keys\n\n# Gitlab-workhorse secret\ngenerate_secret_if_needed \"gitlab-gitlab-workhorse-secret\" --from-literal=\"shared_secret\"=$(gen_random 'a-zA-Z0-9' 32 | base64)\n\n# Registry http.secret secret\ngenerate_secret_if_needed \"gitlab-registry-httpsecret\" --from-literal=\"secret\"=$(gen_random 'a-z0-9' 128 | base64 -w 0)\n\n# Container Registry notification_secret\ngenerate_secret_if_needed \"gitlab-registry-notification\" --from-literal=\"secret\"=[\\\"$(gen_random 'a-zA-Z0-9' 32)\\\"]\n\n\n\n# Zoekt basic auth credentials\ngenerate_secret_if_needed gitlab-zoekt-basicauth --from-literal=gitlab_username=gitlab --from-literal=gitlab_password=$(gen_random 'a-zA-Z0-9' 64)\n"
---
# Source: gitlab/templates/upgrade_check_hook.yaml
apiVersion: v1
@@ -4275,7 +4275,7 @@
apiVersion: v1
kind: Pod
metadata:
- name: gitlab-webservice-test-runner-kxyg5
+ name: gitlab-webservice-test-runner-or88g
namespace: default
annotations:
"helm.sh/hook": test
@@ -4287,7 +4287,7 @@
spec:
containers:
- name: test-runner
- image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ce:v17.8.1
command: ['sh', '/tests/test_login']
volumeMounts:
- name: tests
@@ -4312,7 +4312,7 @@
apiVersion: batch/v1
kind: Job
metadata:
- name: gitlab-shared-secrets-a8df407
+ name: gitlab-shared-secrets-a2b5eb4
namespace: default
labels:
app: gitlab
@@ -4339,7 +4339,7 @@
restartPolicy: Never
containers:
- name: gitlab
- image: registry.gitlab.com/gitlab-org/build/cng/kubectl:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/kubectl:v17.8.1
command: ['/bin/bash', '/scripts/generate-secrets']
securityContext:
allowPrivilegeEscalation: false
@@ -4366,7 +4366,7 @@
apiVersion: batch/v1
kind: Job
metadata:
- name: gitlab-shared-secrets-a8df407-selfsign
+ name: gitlab-shared-secrets-a2b5eb4-selfsign
namespace: default
labels:
app: gitlab
@@ -4390,7 +4390,7 @@
restartPolicy: Never
initContainers:
- name: cfssl-self-sign
- image: registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign:v17.8.1
env:
- name: CA_SUBJECT
value: "GitLab Helm Chart" # defaults to GitLab in container
@@ -4416,11 +4416,11 @@
cpu: 50m
containers:
- name: kubectl
- image: registry.gitlab.com/gitlab-org/build/cng/kubectl:v17.8.0
+ image: registry.gitlab.com/gitlab-org/build/cng/kubectl:v17.8.1
command:
- /bin/bash
- -exc
- - "certname=gitlab-wildcard-tls\n# create wildcard certificate secret\nkubectl create secret tls $certname \\\n --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true\nkubectl --namespace=$namespace label \\\n secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\nkubectl --namespace=$namespace label --overwrite \\\n secret $certname app=gitlab chart=gitlab-8.8.0 release=gitlab heritage=Helm \n# create CA certificate secret\nkubectl create secret generic ${certname}-ca \\\n --from-file=cfssl_ca=/output/ca.pem || true\nkubectl --namespace=$namespace label \\\n secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\nkubectl --namespace=$namespace label --overwrite \\\n secret ${certname}-ca app=gitlab chart=gitlab-8.8.0 release=gitlab heritage=Helm \n# create certificate chain for GitLab Runner\ncat /output/ca.pem /output/wildcard.pem > /tmp/git.${BASE_DOMAIN}.crt\nkubectl create secret generic ${certname}-chain \\\n --from-file=/tmp/git.${BASE_DOMAIN}.crt || true\nkubectl --namespace=$namespace label \\\n secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\nkubectl --namespace=$namespace label --overwrite \\\n secret ${certname}-chain app=gitlab chart=gitlab-8.8.0 release=gitlab heritage=Helm \n"
+ - "certname=gitlab-wildcard-tls\n# create wildcard certificate secret\nkubectl create secret tls $certname \\\n --cert=/output/wildcard.pem --key=/output/wildcard-key.pem || true\nkubectl --namespace=$namespace label \\\n secret $certname $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\nkubectl --namespace=$namespace label --overwrite \\\n secret $certname app=gitlab chart=gitlab-8.8.1 release=gitlab heritage=Helm \n# create CA certificate secret\nkubectl create secret generic ${certname}-ca \\\n --from-file=cfssl_ca=/output/ca.pem || true\nkubectl --namespace=$namespace label \\\n secret ${certname}-ca $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\nkubectl --namespace=$namespace label --overwrite \\\n secret ${certname}-ca app=gitlab chart=gitlab-8.8.1 release=gitlab heritage=Helm \n# create certificate chain for GitLab Runner\ncat /output/ca.pem /output/wildcard.pem > /tmp/git.${BASE_DOMAIN}.crt\nkubectl create secret generic ${certname}-chain \\\n --from-file=/tmp/git.${BASE_DOMAIN}.crt || true\nkubectl --namespace=$namespace label \\\n secret ${certname}-chain $(echo 'app.kubernetes.io/name=gitlab' | sed -E 's/=[^ ]*/-/g')\nkubectl --namespace=$namespace label --overwrite \\\n secret ${certname}-chain app=gitlab chart=gitlab-8.8.1 release=gitlab heritage=Helm \n"
volumeMounts:
- name: certs-path
mountPath: /output
@@ -4461,7 +4461,7 @@
restartPolicy: Never
containers:
- name: run-check
- image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.0"
+ image: "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.8.1"
command: ['/bin/sh', '/scripts/runcheck']
securityContext:
allowPrivilegeEscalation: false
@@ -4472,9 +4472,9 @@
runAsUser: 65534
env:
- name: GITLAB_VERSION
- value: '17.8.0'
+ value: '17.8.1'
- name: CHART_VERSION
- value: '8.8.0'
+ value: '8.8.1'
volumeMounts:
- name: chart-info
mountPath: /chart-info |
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.8.0->8.8.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
gitlab-org/charts/gitlab (gitlab)
v8.8.1Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.