puppetlabs · Xtigyro · Jan 16, 2023 · Jan 16, 2023
@@ -5,6 +5,16 @@ numbering uses [semantic versioning](http://semver.org).
 
 NOTE: The change log until version `v0.2.4` is auto-generated.
 
+## [v7.1.0](https://github.com/puppetlabs/puppetserver-helm-chart/tree/v7.0.0) (2023-01-xx)
+- Fix `extraLabels` issue (https://github.com/puppetlabs/puppetserver-helm-chart/issues/135) apply code from PR https://github.com/puppetlabs/puppetserver-helm-chart/pull/137
+- Fix: Rename all kubernetes resource with the release name as prefix
+- Fix: move all configmap in /tmp to avoid Read Only error in puppetserver init container
+- Fix: do not create r10k code credential secret if ssh or https existingSecret
+- Fix: do not create r10k hiera credential secret if ssh or https existingSecret
+- Fix: `r10k_hiera.yaml` templating, call the right variable
+- Fix: crl script execution on puppetdb
+- feat: bump R10k to `v3.15.2`.
+
 ## [v7.0.0](https://github.com/puppetlabs/puppetserver-helm-chart/tree/v7.0.0) (2023-01-05)
 
 - fix: autoscaling apiVersion, `autoscaling/v2` is available since 1.23

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: puppetserver
-version: 7.0.0
+version: 7.1.0
 appVersion: 7.9.2
 description: Puppet automates the delivery and operation of software.
 keywords: ["puppet", "puppetserver", "automation", "iac", "infrastructure", "cm", "ci", "cd"]

@@ -159,6 +159,7 @@ The following table lists the configurable parameters of the Puppetserver chart
 | `global.postgresql.auth.password`| puppetdb and postgresql password |`unbreakablePassword`|
 | `global.postgresql.auth.existingSecret`| existing k8s secret that holds puppetdb and postgresql username and password |``|
 | `global.postgresql.*`| please refer to https://github.com/bitnami/charts/tree/main/bitnami/postgresql#global-parameters |``|
+| `global.extraEnv.*`| add extra environment variables to all containers |``|
 | `puppetserver.name` | puppetserver component label | `puppetserver`|
 | `puppetserver.image` | puppetserver image | `puppet/puppetserver`|
 | `puppetserver.tag` | puppetserver img tag | `6.12.1`|
@@ -178,6 +179,7 @@ The following table lists the configurable parameters of the Puppetserver chart
 | `puppetserver.masters.livenessProbeTimeout` | the timeout for the puppetserver masters liveness probe  | `10`|
 | `puppetserver.masters.livenessProbeFailureThreshold` | the failure threshold for the puppetserver masters liveness probe | `3`|
 | `puppetserver.masters.livenessProbeSuccessThreshold` | the success threshold for the puppetserver masters liveness probe | `1`|
+| `puppetserver.masters.startupProbePeriodSeconds` | the timeout for the puppetserver masters startup probe  | `60`|
 | `puppetserver.masters.fqdns.alternateServerNames` | puppetserver masters alternate fqdns |``|
 | `puppetserver.masters.service.type` | puppetserver masters svc type | `ClusterIP`|
 | `puppetserver.masters.service.ports` | puppetserver masters svc exposed ports | `puppetserver`|
@@ -269,7 +271,7 @@ The following table lists the configurable parameters of the Puppetserver chart
 | `puppetserver.extraInitArgs`| puppetserver additional initArgs |``|
 | `r10k.name` | r10k component label | `r10k`|
 | `r10k.image` | r10k img | `puppet/r10k`|
-| `r10k.tag` | r10k img tag | `3.5.1`|
+| `r10k.tag` | r10k img tag | `3.15.2`|
 | `r10k.pullPolicy` | r10k img pull policy | `IfNotPresent`|
 | `r10k.code.resources` | r10k control repo resource limits |``|
 | `r10k.code.cronJob.enabled` | enable or disable r10k control repo cron job schedule policy | `true`|
@@ -363,7 +365,6 @@ The following table lists the configurable parameters of the Puppetserver chart
 | `singleCA.resources`| crl container resource limits |``|
 | `singleCA.config`| override the default crl script to retrieve the crl.pem |`see values.yaml`|
 | `singleCA.crl.url`| set the url where crl.pem is located (MANDATORY) |``|
-| `singleCA.crl.credential.existingSecret`| set credential of `crl.url` if needed |``|
 | `singleCA.puppetdb.overrideHostname`| override the puppetdb hostname, needed when using CA where you can't add private SAN name |``|
 | `singleCA.certificates.existingSecret.puppetserver`| existing k8s secret that holds `ca.pem`, `puppet.pem` & `puppet.key` |``|
 | `singleCA.certificates.existingSecret.puppetdb`| existing k8s secret that holds `ca.pem`, `puppetdb.pem` & `puppetdb.key` |``|

@@ -149,21 +149,21 @@ app.kubernetes.io/component: {{ .Values.puppetserver.name }}-serverdata
 Set mandatory Puppet Server Masters' Service name.
 */}}
 {{- define "puppetserver.puppetserver-masters.serviceName" -}}
-puppet
+{{ template "puppetserver.fullname" . }}-puppet
 {{- end -}}
 
 {{/*
 Set secondary Puppet Server Masters' Service name for Puppet Agents.
 */}}
 {{- define "puppetserver.puppetserver.agents-to-masters.serviceName" -}}
-agents-to-puppet
+{{ template "puppetserver.fullname" . }}-agents-to-puppet
 {{- end -}}
 
 {{/*
 Set mandatory Puppet Server Compilers' Service name.
 */}}
 {{- define "puppetserver.puppetserver-compilers.serviceName" -}}
-puppet-compilers
+{{ template "puppetserver.fullname" . }}-puppet-compilers
 {{- end -}}
 
 {{/*
@@ -273,7 +273,7 @@ Create the name for the PuppetDB password secret.
 {{- if .Values.global.postgresql.auth.existingSecret -}}
   {{- .Values.global.postgresql.auth.existingSecret -}}
 {{- else -}}
-  puppetdb-secret
+  {{ template "puppetdb.fullname" . }}-postgresql
 {{- end -}}
 {{- end -}}
 
@@ -284,7 +284,7 @@ Create the name for the r10k.code.viaSsh secret.
 {{- if .Values.r10k.code.viaSsh.credentials.existingSecret -}}
   {{- .Values.r10k.code.viaSsh.credentials.existingSecret -}}
 {{- else -}}
-  r10k-code-creds
+  {{ template "puppetserver.fullname" . }}-r10k-code-creds
 {{- end -}}
 {{- end -}}
 
@@ -295,7 +295,7 @@ Create the name for the r10k.code.viaHttps secret.
 {{- if .Values.r10k.code.viaHttps.credentials.existingSecret -}}
   {{- .Values.r10k.code.viaHttps.credentials.existingSecret -}}
 {{- else -}}
-  r10k-code-creds
+  {{ template "puppetserver.fullname" . }}-r10k-code-creds
 {{- end -}}
 {{- end -}}
 
@@ -306,7 +306,7 @@ Create the name for the r10k.hiera.viaSsh secret.
 {{- if .Values.r10k.hiera.viaSsh.credentials.existingSecret -}}
   {{- .Values.r10k.hiera.viaSsh.credentials.existingSecret -}}
 {{- else -}}
-  r10k-hiera-creds
+  {{ template "puppetserver.fullname" . }}-r10k-hiera-creds
 {{- end -}}
 {{- end -}}
 
@@ -317,7 +317,7 @@ Create the name for the r10k.hiera.viaHttps secret.
 {{- if .Values.r10k.hiera.viaHttps.credentials.existingSecret -}}
   {{- .Values.r10k.hiera.viaHttps.credentials.existingSecret -}}
 {{- else -}}
-  r10k-hiera-creds
+  {{ template "puppetserver.fullname" . }}-r10k-hiera-creds
 {{- end -}}
 {{- end -}}
 
@@ -334,14 +334,14 @@ check if hiera is define
 Create the name for the hiera eyaml private key Secrets.
 */}}
 {{- define "puppetserver.hiera.privateSecret" -}}
-  eyamlpriv-secret
+  {{ template "puppetserver.fullname" . }}-eyamlpriv-secret
 {{- end -}}
 
 {{/*
 Create the name for the hiera eyaml public cert Secrets.
 */}}
 {{- define "puppetserver.hiera.publicSecret" -}}
-  eyamlpub-secret
+  {{ template "puppetserver.fullname" . }}-eyamlpub-secret
 {{- end -}}
 
 {{/*
@@ -358,15 +358,24 @@ Return the appropriate apiVersion for podsecuritypolicy.
 {{/*
 Define puppetserver service Account name
 */}}
-{{- define "puppetserver.puppetserver.serviceAccount.name" -}}
-{{ default "puppetserver" .Values.puppetserver.serviceAccount.accountName }}
+{{- define "puppetserver.serviceAccountName" -}}
+{{ default ( include "puppetserver.fullname" . ) .Values.puppetserver.serviceAccount.accountName }}
+{{- end -}}
+
+{{/*
+Create a default puppetdb fully qualified app name.
+We truncate at 52 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "puppetdb.fullname" -}}
+{{ template "puppetserver.fullname" . }}-puppetdb
 {{- end -}}
 
 {{/*
 Define puppetdb service Account name
 */}}
-{{- define "puppetserver.puppetdb.serviceAccount.name" -}}
-{{ default "puppetdb" .Values.puppetdb.serviceAccount.accountName }}
+{{- define "puppetdb.serviceAccountName" -}}
+{{ default ( include "puppetdb.fullname" . ) .Values.puppetdb.serviceAccount.accountName }}
 {{- end -}}
 
 {{/*
@@ -382,6 +391,25 @@ Return PostgreSQL host name
 {{- end -}}
 {{- end -}}
 
+{{/*
+Return puppetserver certificate name without extension
+*/}}
+{{- define "singleCA.puppetserver.certname" -}}
+{{- if .Values.singleCA.enabled }}
+{{- printf "%s" .Values.singleCA.certificates.secretKeys.puppetCert | trimSuffix ".pem" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return puppetdb certificate name without extension
+*/}}
+{{- define "singleCA.puppetdb.certname" -}}
+{{- if .Values.singleCA.enabled }}
+{{- printf "%s" .Values.singleCA.certificates.secretKeys.puppetdbCert | trimSuffix ".pem" -}}
+
+{{- end -}}
+{{- end -}}
+
 {{/* *************************************************************************************
 The following definitions were more complex and necessary during part of this development.
 Now they are essentially just stubs but left here in case they might be needed again soon.

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: hiera-config
+  name: {{ template "puppetserver.fullname" . }}-hiera-config
   labels:
     {{- include "puppetserver.hiera.labels" . | nindent 4 }}
 data:

@@ -8,7 +8,8 @@ metadata:
   annotations:
     "helm.sh/hook": "pre-install"
     "helm.sh/hook-weight": "2"
-    "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed"
+    "helm.sh/resource-policy": keep
+    # "helm.sh/hook-delete-policy": "hook-succeeded,hook-failed" #TODO: issue when no pvc is define. pvc is delete at the end of the job because pupeptserver is not started
 spec:
   activeDeadlineSeconds: {{.Values.puppetserver.preGeneratedCertsJob.jobDeadline}}
   template:
@@ -19,7 +20,7 @@ spec:
     spec:
       restartPolicy: Never
       {{- if .Values.puppetserver.serviceAccount.enabled }}
-      serviceAccountName: {{ include "puppetserver.puppetserver.serviceAccount.name" . }}
+      serviceAccountName: {{ include "puppetserver.serviceAccountName" . }}
       {{- end }}
       containers:
         - name: copy-ro-puppetserver-certs
@@ -31,28 +32,31 @@ spec:
               {{- if .Values.singleCA.enabled }}
               mkdir -p /etc/puppetlabs/puppet/ssl/certs/;
               mkdir -p /etc/puppetlabs/puppet/ssl/private_keys/;
-              cp /puppet-certs/puppetserver/ca.pem /etc/puppetlabs/puppet/ssl/certs/ca.pem;
-              cp /puppet-certs/puppetserver/{{ template "puppetserver.puppetserver-masters.serviceName" . }}.pem /etc/puppetlabs/puppet/ssl/certs/{{ template "puppetserver.puppetserver-masters.serviceName" . }}.pem;
-              cp /puppet-certs/puppetserver/{{ template "puppetserver.puppetserver-masters.serviceName" . }}.key /etc/puppetlabs/puppet/ssl/private_keys/{{ template "puppetserver.puppetserver-masters.serviceName" . }}.pem;
-              ls /puppet-certs/crl/;
-              cp /puppet-certs/crl/crl_entrypoint.sh /etc/puppetlabs/puppet/ssl/crl_entrypoint.sh;
-              cp /puppet-certs/crl/crl_cronjob.sh /etc/puppetlabs/puppet/ssl/crl_cronjob.sh;
-              cp /puppet-certs/crl/crl.sh /etc/puppetlabs/puppet/ssl/crl.sh;
+              cp /tmp/puppetserver/ca.pem /etc/puppetlabs/puppet/ssl/certs/ca.pem;
+              cp /tmp/puppetserver/{{ template "singleCA.puppetserver.certname" . }}.pem /etc/puppetlabs/puppet/ssl/certs/puppet.pem;
+              cp /tmp/puppetserver/{{ template "singleCA.puppetserver.certname" . }}.key /etc/puppetlabs/puppet/ssl/private_keys/puppet.pem;
+              chown puppet:puppet /etc/puppetlabs/puppet/ssl/certs/puppet.pem /etc/puppetlabs/puppet/ssl/private_keys/puppet.pem /etc/puppetlabs/puppet/ssl/certs/ca.pem;
+              cp /tmp/crl/crl_entrypoint.sh /etc/puppetlabs/puppet/ssl/crl_entrypoint.sh;
+              cp /tmp/crl/crl_cronjob.sh /etc/puppetlabs/puppet/ssl/crl_cronjob.sh;
+              cp /tmp/crl/crl.sh /etc/puppetlabs/puppet/ssl/crl.sh;
               chown puppet:puppet /etc/puppetlabs/puppet/ssl/crl_entrypoint.sh /etc/puppetlabs/puppet/ssl/crl_cronjob.sh /etc/puppetlabs/puppet/ssl/crl.sh;
               chmod +x /etc/puppetlabs/puppet/ssl/crl_entrypoint.sh /etc/puppetlabs/puppet/ssl/crl_cronjob.sh /etc/puppetlabs/puppet/ssl/crl.sh;
-              {{- else }}
-              CERTS_FILE=`ls /puppet-certs/puppetserver`;
-              tar xf /puppet-certs/puppetserver/"$CERTS_FILE" -C /etc/puppetlabs/puppet/ssl;
+              {{- else if .Values.puppetserver.preGeneratedCertsJob.enabled }}
+              CERTS_FILE=`ls /tmp/puppetserver`;
+              tar xf /tmp/puppetserver/"$CERTS_FILE" -C /etc/puppetlabs/puppet/ssl;
               {{- end }}
           volumeMounts:
             - name: puppetserver-certs
-              mountPath: /puppet-certs/puppetserver
+              mountPath: /tmp/puppetserver
             - name: puppet-puppet-storage
               mountPath: /etc/puppetlabs/puppet/
             {{- if .Values.singleCA.enabled }}
             - name: crl-volume
-              mountPath: /puppet-certs/crl
+              mountPath: /tmp/crl
             {{- end }}
+          securityContext:
+            runAsUser: 999   # "puppet" UID
+            runAsGroup: 999 # "puppet" GID
         - name: copy-ro-puppetdb-certs
           image: "{{.Values.puppetdb.image}}:{{.Values.puppetdb.tag}}"
           imagePullPolicy: "{{.Values.puppetdb.pullPolicy}}"
@@ -62,27 +66,33 @@ spec:
               {{- if .Values.singleCA.enabled }}
               mkdir -p /opt/puppetlabs/server/data/puppetdb/certs/certs/;
               mkdir -p /opt/puppetlabs/server/data/puppetdb/certs/private_keys/;
-              cp /puppet-certs/puppetdb/ca.pem /opt/puppetlabs/server/data/puppetdb/certs/certs/ca.pem;
-              cp /puppet-certs/puppetdb/puppetdb.pem /opt/puppetlabs/server/data/puppetdb/certs/certs/puppetdb.pem;
-              cp /puppet-certs/puppetdb/puppetdb.key /opt/puppetlabs/server/data/puppetdb/certs/private_keys/puppetdb.pem;
-              cp /puppet-crl/puppetdb/crl_entrypoint.sh /opt/puppetlabs/server/data/puppetdb/certs/crl_entrypoint.sh;
-              cp /puppet-crl/puppetdb/crl_cronjob.sh /opt/puppetlabs/server/data/puppetdb/certs/crl_cronjob.sh;
-              cp /puppet-crl/puppetdb/crl.sh /opt/puppetlabs/server/data/puppetdb/certs/crl.sh;
-              chown puppetdb:puppetdb /opt/puppetlabs/server/data/puppetdb/certs/crl_entrypoint.sh /opt/puppetlabs/server/data/puppetdb/certs/crl_cronjob.sh /opt/puppetlabs/server/data/puppetdb/certs/crl.sh;
-              chmod +x /opt/puppetlabs/server/data/puppetdb/certs/crl_entrypoint.sh /opt/puppetlabs/server/data/puppetdb/certs/crl_cronjob.sh /opt/puppetlabs/server/data/puppetdb/certs/crl.sh;
-              {{- else }}
-              CERTS_FILE=`ls /puppet-certs/puppetdb`;
-              tar xf /puppet-certs/puppetdb/"$CERTS_FILE" -C /opt/puppetlabs/server/data/puppetdb/certs --strip-components 1;
+              mkdir -p /opt/puppetlabs/server/data/puppetdb/scripts/;
+              cp /tmp/puppetdb/ca.pem /opt/puppetlabs/server/data/puppetdb/certs/certs/ca.pem;
+              cp /tmp/puppetdb/{{ template "singleCA.puppetdb.certname" . }}.pem /opt/puppetlabs/server/data/puppetdb/certs/certs/{{ template "singleCA.puppetdb.certname" . }}.pem;
+              cp /tmp/puppetdb/{{ template "singleCA.puppetdb.certname" . }}.key /opt/puppetlabs/server/data/puppetdb/certs/private_keys/{{ template "singleCA.puppetdb.certname" . }}.pem;
+              chown puppetdb:puppetdb /opt/puppetlabs/server/data/puppetdb/certs/certs/ca.pem /opt/puppetlabs/server/data/puppetdb/certs/certs/{{ template "singleCA.puppetdb.certname" . }}.pem /opt/puppetlabs/server/data/puppetdb/certs/private_keys/{{ template "singleCA.puppetdb.certname" . }}.pem;
+              cp /tmp/crl/crl_entrypoint.sh /opt/puppetlabs/server/data/puppetdb/scripts/crl_entrypoint.sh;
+              cp /tmp/crl/crl_cronjob.sh /opt/puppetlabs/server/data/puppetdb/scripts/crl_cronjob.sh;
+              cp /tmp/crl/crl.sh /opt/puppetlabs/server/data/puppetdb/scripts/crl.sh;
+              chown -R puppetdb:puppetdb /opt/puppetlabs/server/data/puppetdb/scripts;
+              chmod +x /opt/puppetlabs/server/data/puppetdb/scripts/*.sh;
+              ls -la /opt/puppetlabs/server/data/puppetdb/scripts/;
+              {{- else if .Values.puppetserver.preGeneratedCertsJob.enabled }}
+              CERTS_FILE=`ls /tmp/puppetdb`;
+              tar xf /tmp/puppetdb/"$CERTS_FILE" -C /opt/puppetlabs/server/data/puppetdb/certs --strip-components 1;
               {{- end }}
           volumeMounts:
             - name: puppetdb-certs
-              mountPath: /puppet-certs/puppetdb
+              mountPath: /tmp/puppetdb
             - name: puppetdb-storage
-              mountPath: /opt/puppetlabs/server/data/puppetdb/certs
+              mountPath: /opt/puppetlabs/server/data/puppetdb
             {{- if .Values.singleCA.enabled }}
             - name: crl-volume
-              mountPath: /puppet-crl/puppetdb
+              mountPath: /tmp/crl
             {{- end }}
+          securityContext:
+            runAsUser: 999   # "puppetdb" UID
+            runAsGroup: 999 # "puppetdb" GID
       imagePullSecrets:
       {{- with .Values.global.imagePullSecrets }}
       {{ toYaml . }}
@@ -93,14 +103,14 @@ spec:
           {{- toYaml .Values.puppetserver.masters.customPersistentVolumeClaim.puppet.config | nindent 10 }}
         {{- else }}
           persistentVolumeClaim:
-            claimName: puppet-puppet-claim
+            claimName: {{ template "puppetserver.fullname" . }}-puppet-claim
         {{- end }}
         - name: puppetdb-storage
         {{- if .Values.puppetdb.customPersistentVolumeClaim.storage.enable }}
           {{- toYaml .Values.puppetdb.customPersistentVolumeClaim.storage.config | nindent 10 }}
         {{- else }}
           persistentVolumeClaim:
-            claimName: puppetdb-claim
+            claimName: {{ include "puppetdb.fullname" . }}-claim
         {{- end }}
         - name: puppetserver-certs
         {{- if not .Values.singleCA.enabled }}
@@ -121,6 +131,6 @@ spec:
         {{- if .Values.singleCA.enabled }}
         - name: crl-volume
           configMap:
-            name: crl-config
+            name: {{ template "puppetserver.fullname" . }}-crl-config
         {{- end }}
 {{- end }}
@@ -1,6 +1,6 @@
 {{- if and .Values.puppetboard.enabled .Values.puppetboard.ingress.enabled }}
 {{- $releaseName := .Release.Name -}}
-{{- $serviceName := "puppetdb" }}
+{{- $serviceName := ( include "puppetdb.fullname" . ) }}
 {{- $servicePort := .Values.puppetboard.port -}}
 {{- $pathType := .Values.puppetboard.ingress.pathType | default "ImplementationSpecific" -}}
 {{- $apiIsStable := eq (include "puppetserver.ingress.isStable" .) "true" -}}
@@ -13,11 +13,12 @@ metadata:
     {{ toYaml .Values.puppetboard.ingress.annotations | nindent 4 }}
   {{- end }}
   labels:
+  {{- include "puppetserver.puppetdb.matchLabels" . | nindent 4 }}
     {{- include "puppetserver.puppetdb.labels" . | nindent 4 }}
     {{- range $key, $value := .Values.puppetboard.ingress.extraLabels }}
     {{ $key }}: {{ $value }}
     {{- end }}
-  name: puppetboard
+  name: {{ template "puppetdb.fullname" . }}-puppetboard
 spec:
   {{- if $apiIsStable }}
   {{- if .Values.puppetboard.ingress.ingressClassName }}

@@ -2,9 +2,12 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: puppetdb-custom-configs
+  name: {{ template "puppetdb.fullname" . }}-custom-configs
   labels:
     {{- include "puppetserver.puppetdb.labels" . | nindent 4 }}
+    {{- range $key, $value := .Values.puppetdb.extraLabels }}
+    {{ $key }}: {{ $value }}
+    {{- end }}
 data:
 {{- toYaml .Values.puppetdb.customconfigs.configmaps | nindent 2 }}
 {{- end }}