dip/service-catalog
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

dipup 사용 차트를 카탈로그에 동기화 (7개 갱신 + 5개 신규)

Browse Source 
dipup 이 go:embed 로 직접 보관·관리하던 Helm 차트를 카탈로그로 옮기는 첫 단계다.
두 저장소가 각자 CVE/SBOM 파이프라인을 운영하는 이중화를 해소하려면, 먼저 카탈로그가
dipup 과 같은 차트·같은 이미지를 보게 만들어야 한다.

배경: CVE 파이프라인 구성 이전에 두 곳에서 같은 차트를 유지하기 어려워 dipup 이 별도로
차트를 관리해 왔고, 그 결과 버전이 갈라졌다. 겹치는 10개 중 버전까지 일치하는 것은
postgresql-ha·dnsup 2개뿐이었다.

## 버전 갱신 (7개) — 신규 버전 디렉토리 추가, 구버전은 보존

| 차트 | 기존 | 신규 | appVersion |
|---|---|---|---|
| apisix | 2.14.0 | 2.16.0 | 3.16.0 → 3.17.0 |
| argo-cd | 7.7.0 | 7.8.11 | v2.13.0 → v2.14.5 |
| cert-manager | v1.16.1 | v1.21.0 | 동일 |
| gitea | 12.4.0 | 12.6.0 | 1.24.6 → 1.26.1 |
| harbor | 1.16.2 | 1.19.1 | 2.12.2 → 2.15.1 |
| kyverno | 3.4.1 | 3.8.2 | v1.14.1 → v1.18.2 |
| rancher | 2.10.1 | 2.14.3 | v2.10.1 → v2.14.3 |

차트 본문은 dipup 이 임베딩한 .tgz 를 그대로 전개했다(네트워크 pull 이 아니라 dipup 이
실제 배포하는 바이트와 동일함을 보장하기 위함). BUILD-README/CUSTOM-README/custom-values
3개 파일은 구버전에서 승계했다.

## 신규 추가 (5개)

infisical-standalone 1.9.0, longhorn 109.3.1+up1.11.2, longhorn-crd 109.3.1+up1.11.2,
metallb 0.16.1, secrets-operator v0.10.33.

longhorn/longhorn-crd 는 업스트림이 아니라 Rancher 패키징 차트(109.x 라인, Rancher 2.14
계열과 짝)다. BUILD-README 의 `helm repo add` 라인은 chart_version_detector 가 파싱하는
계약이라 실제 업스트림 repo 를 검증해 기재했고, 감지기로 현재/최신 버전이 정상 조회되는
것을 확인했다.

## custom-values — 버전과 결합된 이미지 핀 정리

카탈로그 스캐너가 dipup 의 effective image 를 보게 하려면 이미지 핀이 맞아야 한다.

- **kyverno: 승계본이 3.8.2 에서 깨져 재작성.** 3.4.1 은 정리 훅이
  `registry: ~ / repository: bitnami/kubectl` 이라 bitnamilegacy 오버라이드가 맞았지만,
  3.8.2 는 `registry: ghcr.io / repository: kyverno/readiness-checker` 로 바뀌었다.
  그대로 옮기면 ghcr.io/bitnamilegacy/kubectl 이라는 없는 좌표가 된다. 해당 오버라이드를
  제거하고, 3.8.2 에서 삭제된 policyReportsCleanup 키도 함께 뺐다. 남는 조치는 tag 고정뿐
  (기본 tag 가 비어 latest 로 떨어짐 → v1.18.2 로 고정).
- apisix: 3.16.0-keycloak-authz → 3.17.0-keycloak-authz (차트 appVersion 과 함께 이동)
- gitea: image.tag 1.26.4 핀 추가 — 차트 기본 1.26.1 대비 CRITICAL 2→0, HIGH 44→12
- infisical: image.tag v0.162.7 핀 — 기본 v0.158.x 는 stale Debian base 로 OS 기인 CVE
  다수(fixable CRITICAL 53→5, HIGH 491→55). redis/postgresql 은 bitnamilegacy 좌표로.
- longhorn: 실측 기반 리소스 튜닝(manager request, guaranteedInstanceManagerCPU,
  systemManagedCSIComponentsResourceLimits). replica 수처럼 노드 수에 의존하는 값은
  넣지 않았다 — 소비 측에서 주입한다.

## 검증

12개 차트 전부 `helm template --kube-version 1.34.1` 렌더 성공. 렌더 결과 이미지가
dipup 배포 이미지와 일치함을 확인(paasup/apisix:3.17.0-keycloak-authz,
gitea:1.26.4-rootless, readiness-checker:v1.18.2, infisical:v0.162.7).

## 범위에서 뺀 것

- **keycloak**: 카탈로그는 codecentric(app 17.0.1-legacy), dipup 은 bitnami(app 26.2.4)로
  계보가 다르다. 이슈 #1(bitnami 대체 방안 검토)의 결론이 나온 뒤 처리한다.
- **rancher-monitoring(-crd)**: 14c05f1 에서 불필요 판단으로 제거된 차트이고
  victoria-metrics 스택으로 대체 예정이라 추가하지 않는다.
- **dip-api/dip-console**: 자체 개발 차트로 각 앱 저장소가 출처다. 대조 결과 앱 저장소와
  dipup 사본이 일치해 카탈로그가 개입할 이유가 없다.
- **postgresql-ha/dnsup**: 이미 버전이 일치해 작업 대상이 아니었다.

## 후속 과제

dnsup 은 카탈로그·dipup 사본(1.0.1)이 원본(dip-console-api helm/dnsup 1.0.0)보다 앞서
있다. 1.0.1 에만 있는 service.LoadBalancerIP·service.annotations 지원을 원본으로 백포트한
뒤, 카탈로그에서 dnsup 을 제거하는 것이 자체 개발 차트 출처 원칙에 맞다.
This commit is contained in:
wbsong111
2026-08-06 09:42:24 +09:00
parent 9d5a10b09c
commit 16321b52c7
1262 changed files with 314285 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
manifests/helm/cert-manager/v1.21.0/templates/crd-cert-manager.io_certificaterequests.yaml
+323
View File
@@ -0,0 +1,323 @@
{{- if or .Values.crds.enabled .Values.installCRDs }}
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: "certificaterequests.cert-manager.io"
{{- if .Values.crds.keep }}
annotations:
helm.sh/resource-policy: keep
{{- end }}
labels:
{{- include "cert-manager.crd-labels" . | nindent 4 }}
spec:
group: cert-manager.io
names:
categories:
- cert-manager
kind: CertificateRequest
listKind: CertificateRequestList
plural: certificaterequests
shortNames:
- cr
- crs
singular: certificaterequest
scope: Namespaced
versions:
- additionalPrinterColumns:
- jsonPath: .status.conditions[?(@.type == "Approved")].status
name: Approved
type: string
- jsonPath: .status.conditions[?(@.type == "Denied")].status
name: Denied
type: string
- jsonPath: .status.conditions[?(@.type == "Ready")].status
name: Ready
type: string
- jsonPath: .spec.issuerRef.name
name: Issuer
type: string
- jsonPath: .spec.username
name: Requester
type: string
- jsonPath: .status.conditions[?(@.type == "Ready")].message
name: Status
priority: 1
type: string
- description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
jsonPath: .metadata.creationTimestamp
name: Age
type: date
name: v1
schema:
openAPIV3Schema:
description: |-
A CertificateRequest is used to request a signed certificate from one of the
configured issuers.
All fields within the CertificateRequest's `spec` are immutable after creation.
A CertificateRequest will either succeed or fail, as denoted by its `Ready` status
condition and its `status.failureTime` field.
A CertificateRequest is a one-shot resource, meaning it represents a single
point in time request for a certificate and cannot be re-used.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: |-
Specification of the desired state of the CertificateRequest resource.
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
properties:
duration:
description: |-
Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
issuer may choose to ignore the requested duration, just like any other
requested attribute.
type: string
extra:
additionalProperties:
items:
type: string
type: array
description: |-
Extra contains extra attributes of the user that created the CertificateRequest.
Populated by the cert-manager webhook on creation and immutable.
type: object
groups:
description: |-
Groups contains group membership of the user that created the CertificateRequest.
Populated by the cert-manager webhook on creation and immutable.
items:
type: string
type: array
x-kubernetes-list-type: atomic
isCA:
description: |-
Requested basic constraints isCA value. Note that the issuer may choose
to ignore the requested isCA value, just like any other requested attribute.
NOTE: If the CSR in the `Request` field has a BasicConstraints extension,
it must have the same isCA value as specified here.
If true, this will automatically add the `cert sign` usage to the list
of requested `usages`.
type: boolean
issuerRef:
description: |-
Reference to the issuer responsible for issuing the certificate.
If the issuer is namespace-scoped, it must be in the same namespace
as the Certificate. If the issuer is cluster-scoped, it can be used
from any namespace.
The `name` field of the reference must always be specified.
properties:
group:
description: |-
Group of the issuer being referred to.
Defaults to 'cert-manager.io'.
type: string
kind:
description: |-
Kind of the issuer being referred to.
Defaults to 'Issuer'.
type: string
name:
description: Name of the issuer being referred to.
type: string
required:
- name
type: object
request:
description: |-
The PEM-encoded X.509 certificate signing request to be submitted to the
issuer for signing.
If the CSR has a BasicConstraints extension, its isCA attribute must
match the `isCA` value of this CertificateRequest.
If the CSR has a KeyUsage extension, its key usages must match the
key usages in the `usages` field of this CertificateRequest.
If the CSR has a ExtKeyUsage extension, its extended key usages
must match the extended key usages in the `usages` field of this
CertificateRequest.
format: byte
type: string
uid:
description: |-
UID contains the uid of the user that created the CertificateRequest.
Populated by the cert-manager webhook on creation and immutable.
type: string
usages:
description: |-
Requested key usages and extended key usages.
NOTE: If the CSR in the `Request` field has uses the KeyUsage or
ExtKeyUsage extension, these extensions must have the same values
as specified here without any additional values.
If unset, defaults to `digital signature` and `key encipherment`.
items:
description: |-
KeyUsage specifies valid usage contexts for keys.
See:
https://tools.ietf.org/html/rfc5280#section-4.2.1.3
https://tools.ietf.org/html/rfc5280#section-4.2.1.12
Valid KeyUsage values are as follows:
"signing",
"digital signature",
"content commitment",
"key encipherment",
"key agreement",
"data encipherment",
"cert sign",
"crl sign",
"encipher only",
"decipher only",
"any",
"server auth",
"client auth",
"code signing",
"email protection",
"s/mime",
"ipsec end system",
"ipsec tunnel",
"ipsec user",
"timestamping",
"ocsp signing",
"microsoft sgc",
"netscape sgc"
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
type: string
type: array
x-kubernetes-list-type: atomic
username:
description: |-
Username contains the name of the user that created the CertificateRequest.
Populated by the cert-manager webhook on creation and immutable.
type: string
required:
- issuerRef
- request
type: object
status:
description: |-
Status of the CertificateRequest.
This is set and managed automatically.
Read-only.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
properties:
ca:
description: |-
The PEM encoded X.509 certificate of the signer, also known as the CA
(Certificate Authority).
This is set on a best-effort basis by different issuers.
If not set, the CA is assumed to be unknown/not available.
format: byte
type: string
certificate:
description: |-
The PEM encoded X.509 certificate resulting from the certificate
signing request.
If not set, the CertificateRequest has either not been completed or has
failed. More information on failure can be found by checking the
`conditions` field.
format: byte
type: string
conditions:
description: |-
List of status conditions to indicate the status of a CertificateRequest.
Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.
items:
description: CertificateRequestCondition contains condition information for a CertificateRequest.
properties:
lastTransitionTime:
description: |-
LastTransitionTime is the timestamp corresponding to the last status
change of this condition.
format: date-time
type: string
message:
description: |-
Message is a human readable description of the details of the last
transition, complementing reason.
type: string
reason:
description: |-
Reason is a brief machine readable explanation for the condition's last
transition.
type: string
status:
description: Status of the condition, one of (`True`, `False`, `Unknown`).
enum:
- "True"
- "False"
- Unknown
type: string
type:
description: |-
Type of the condition, known values are (`Ready`, `InvalidRequest`,
`Approved`, `Denied`).
type: string
required:
- status
- type
type: object
type: array
x-kubernetes-list-map-keys:
- type
x-kubernetes-list-type: map
failureTime:
description: |-
FailureTime stores the time that this CertificateRequest failed. This is
used to influence garbage collection and back-off.
format: date-time
type: string
type: object
type: object
selectableFields:
- jsonPath: .spec.issuerRef.group
- jsonPath: .spec.issuerRef.kind
- jsonPath: .spec.issuerRef.name
served: true
storage: true
subresources:
status: {}
{{- end }}