From d56cc6d5826c22c1f1abbc3ec93a0af444833e8d Mon Sep 17 00:00:00 2001 From: wbsong111 Date: Tue, 7 Jan 2025 09:22:37 +0900 Subject: [PATCH] Update rancher/2.10.1 --- charts/rancher/BUILD-README.md | 22 ++++++++++----------- charts/rancher/Chart.yaml | 8 ++++---- charts/rancher/custom-values.yaml | 6 +++--- charts/rancher/templates/_helpers.tpl | 15 +++++++++++++- charts/rancher/templates/deployment.yaml | 15 +++++--------- charts/rancher/templates/ingress.yaml | 4 ++-- charts/rancher/values.schema.json | 25 ++++++++++++++++++++++++ charts/rancher/values.yaml | 19 +++++++++--------- 8 files changed, 74 insertions(+), 40 deletions(-) diff --git a/charts/rancher/BUILD-README.md b/charts/rancher/BUILD-README.md index 91097bd..10227ab 100644 --- a/charts/rancher/BUILD-README.md +++ b/charts/rancher/BUILD-README.md @@ -9,7 +9,7 @@ $ git clone https://github.com/paasup/service-catalog.git - 작업 브랜치로 체크아웃 ``` -$ git checkout -b update-rancher/2.9.1 +$ git checkout -b update-rancher/2.10.1 ``` @@ -51,7 +51,7 @@ $ git checkout -b update-rancher/2.9.1 helm repo update # helm 차트 - helm pull rancher-latest/rancher --version="2.9.1" + helm pull rancher-latest/rancher --version="2.10.1" # 차트 변경 tar xzvf rancher*.tgz @@ -106,41 +106,41 @@ $ git checkout -b update-rancher/2.9.1 - 갱신작업 진행후 commit ``` $ git add . -$ git commit -m "update rancher/2.9.1" +$ git commit -m "update rancher/2.10.1" ``` - main 브랜치에 체크아웃 후 merge ``` $ git checkout main -$ git merge update-rancher/2.9.1 +$ git merge update-rancher/2.10.1 ``` - git에 push 후 작업 브랜치 삭제 ``` $ git push -u origin main -$ git branch -d update-rancher/2.9.1 +$ git branch -d update-rancher/2.10.1 ``` - git tag 추가 후 push ``` -$ git tag rancher/2.9.1 -$ git push origin rancher/2.9.1 +$ git tag rancher/2.10.1 +$ git push origin rancher/2.10.1 ``` ## 4. 차트 버전 정보 -- rancher/2.9.1 +- rancher/2.10.1 - 서비스 배포를 위하여 custom-values.yam에 정의하였다. - 차트의 빌드 방법과 배포 방법을 BUILD-README.md, CUSTOM-README.md 문서에 작성하였다. -- rancher/2.9.1-1 +- rancher/2.10.1-1 - 사설 인증서 사용시 전처리를 위한 Helm preinstall Hook을 추가하였다. - 변경 사항을 BUILD-README.md, CUSTOM-README.md 문서에 반영하였다. -- rancher/2.9.1-2 +- rancher/2.10.1-2 - Helm preinstall Hook에 rancher labels 추가 - Helm preinstall Hook으로 생성된 자원을 삭제하기 위해 Helm postdelete Hook을 추가하였다. - 변경 사항을 BUILD-README.md 문서에 반영하였다. -- rancher/2.9.1-3 +- rancher/2.10.1-3 - Argocd post-delete Hook 이슈로 Hook을 삭제하였다. - Rancher 삭제 후처리를 위한 스크립트 수정 및 추가하였다. \ No newline at end of file diff --git a/charts/rancher/Chart.yaml b/charts/rancher/Chart.yaml index ac4b8c3..66d7c7f 100644 --- a/charts/rancher/Chart.yaml +++ b/charts/rancher/Chart.yaml @@ -1,11 +1,11 @@ apiVersion: v2 -appVersion: v2.9.1 +appVersion: v2.10.1 description: Install Rancher Server to manage Kubernetes clusters across providers. home: https://rancher.com -icon: https://github.com/rancher/ui/blob/master/public/assets/images/logos/welcome-cow.svg +icon: https://raw.githubusercontent.com/rancher/ui/master/public/assets/images/logos/welcome-cow.svg keywords: - rancher -kubeVersion: < 1.31.0-0 +kubeVersion: < 1.32.0-0 maintainers: - email: charts@rancher.com name: Rancher Labs @@ -13,4 +13,4 @@ name: rancher sources: - https://github.com/rancher/rancher - https://github.com/rancher/server-chart -version: 2.9.1 +version: 2.10.1 diff --git a/charts/rancher/custom-values.yaml b/charts/rancher/custom-values.yaml index 553d0d8..ae6e7ff 100644 --- a/charts/rancher/custom-values.yaml +++ b/charts/rancher/custom-values.yaml @@ -13,9 +13,9 @@ ingress: nginx.ingress.kubernetes.io/proxy-body-size: 10m # cert-manager 사용시 - # cert-manager.io/cluster-issuer: "selfsigned-issuer" - # cert-manager.io/duration: 8760h - # cert-manager.io/renew-before: 720h + cert-manager.io/cluster-issuer: "selfsigned-issuer" + cert-manager.io/duration: 8760h + cert-manager.io/renew-before: 720h # 사설 인증서 사용시 true diff --git a/charts/rancher/templates/_helpers.tpl b/charts/rancher/templates/_helpers.tpl index 1b5ad55..9854523 100644 --- a/charts/rancher/templates/_helpers.tpl +++ b/charts/rancher/templates/_helpers.tpl @@ -27,7 +27,9 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- printf "%s-%s" .Chart.Name .Chart.Version | trunc 63 | trimSuffix "-" -}} {{- end -}} -# Render Values in configurationSnippet +{{/* +Render Values in configurationSnippet +*/}} {{- define "configurationSnippet" -}} {{- tpl (.Values.ingress.configurationSnippet) . | nindent 6 -}} {{- end -}} @@ -74,3 +76,14 @@ add below linux tolerations to workloads could be scheduled to those linux nodes {{- end -}} {{- end -}} {{- end -}} + +{{/* + Select correct auditLog image +*/}} +{{- define "auditLog_image" -}} + {{- if .Values.busyboxImage }} + {{- .Values.busyboxImage}} + {{- else }} + {{- .Values.auditLog.image.repository -}}:{{- .Values.auditLog.image.tag -}} + {{- end }} +{{- end -}} diff --git a/charts/rancher/templates/deployment.yaml b/charts/rancher/templates/deployment.yaml index 06f9401..fbbb789 100644 --- a/charts/rancher/templates/deployment.yaml +++ b/charts/rancher/templates/deployment.yaml @@ -63,6 +63,9 @@ spec: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: {{ include "linux-node-selector-terms" . | nindent 14 }} tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.extraTolerations }} +{{ toYaml .Values.extraTolerations | indent 8 }} +{{- end }} containers: - image: {{ .Values.rancherImage }}:{{ default .Chart.AppVersion .Values.rancherImageTag }} imagePullPolicy: {{ default "IfNotPresent" .Values.rancherImagePullPolicy }} @@ -210,16 +213,8 @@ spec: {{- if eq .Values.auditLog.destination "sidecar" }} {{- if gt (int .Values.auditLog.level) 0 }} # Make audit logs available for Rancher log collector tools. - {{- if .Values.busyboxImage }} - - image: {{ .Values.busyboxImage}} - {{- else }} - - image: {{ .Values.auditLog.image.repository }}:{{.Values.auditLog.image.tag}} - {{- end }} - {{- if .Values.busyboxImagePullPolicy }} - imagePullPolicy: {{ .Values.busyboxImagePullPolicy }} - {{- else }} - imagePullPolicy: {{ .Values.auditLog.image.pullPolicy }} - {{- end }} + - image: {{ include "auditLog_image" . }} + imagePullPolicy: {{ default .Values.auditLog.image.pullPolicy .Values.busyboxImagePullPolicy }} name: {{ template "rancher.name" . }}-audit-log command: ["tail"] args: ["-F", "/var/log/auditlog/rancher-api-audit.log"] diff --git a/charts/rancher/templates/ingress.yaml b/charts/rancher/templates/ingress.yaml index 16eb292..d772f96 100644 --- a/charts/rancher/templates/ingress.yaml +++ b/charts/rancher/templates/ingress.yaml @@ -54,8 +54,8 @@ spec: servicePort: {{ .Values.ingress.servicePort }} {{- end }} {{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }} - pathType: {{ .Values.ingress.pathType }} - path: {{ .Values.ingress.path }} + pathType: ImplementationSpecific + path: "/" {{- end }} {{- if eq .Values.tls "ingress" }} tls: diff --git a/charts/rancher/values.schema.json b/charts/rancher/values.schema.json index d72b73f..d1eef67 100644 --- a/charts/rancher/values.schema.json +++ b/charts/rancher/values.schema.json @@ -5,6 +5,31 @@ "type": ["string", "null"], "enum": ["strict", "system-store", "", null], "description": "agentTLSMode must be 'strict' or 'system-store' or null (defaults to system-store)" + }, + "auditLog": { + "type": "object", + "properties": { + "destination": { + "type": "string", + "enum": ["sidecar", "hostPath"], + "description": "auditLog.destination must be either 'sidecar' or 'hostPath'" + }, + "level": { + "type": "integer", + "enum": [0, 1, 2, 3], + "description": "auditLog.level must be a number 0-3; 0 to disable, 3 for most verbose" + } + } + }, + "busyboxImage": { + "type": "string", + "description": "[DEPRECATED] This value is deprecated, use `auditLog.image.repository` & `auditLog.image.tag` instead.", + "deprecated": true + }, + "busyboxImagePullPolicy": { + "type": "string", + "description": "[DEPRECATED] This value is deprecated, use `auditLog.image.pullPolicy` instead.", + "deprecated": true } }, "required": [], diff --git a/charts/rancher/values.yaml b/charts/rancher/values.yaml index 1d35985..49f15c3 100644 --- a/charts/rancher/values.yaml +++ b/charts/rancher/values.yaml @@ -6,11 +6,11 @@ additionalTrustedCAs: false antiAffinity: preferred topologyKey: kubernetes.io/hostname -# Audit Logs https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/ +# Audit Logs +# Source: https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log # The audit log is piped to the console of the rancher-audit-log container in the rancher pod. -# https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/ -# destination stream to sidecar container console or hostPath volume -# level: Verbosity of logs, 0 to 3. 0 is off 3 is a lot. +# level: Verbosity of logs, 0 to 3. 0 is off, 3 most verbose. +# Docs: https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels auditLog: destination: sidecar hostPath: /var/log/rancher/audit/ @@ -23,7 +23,7 @@ auditLog: # Important: update pkg/image/export/resolve.go when this default image is changed, so that it's reflected accordingly in rancher-images.txt generated for air-gapped setups. image: repository: "rancher/mirrored-bci-micro" - tag: 15.4.14.3 + tag: 15.6.24.2 # Override imagePullPolicy image # options: Always, Never, IfNotPresent pullPolicy: "IfNotPresent" @@ -65,9 +65,6 @@ ingress: includeDefaultExtraAnnotations: true extraAnnotations: {} ingressClassName: "" - # Certain ingress controllers will require the pathType or path to be set to a different value. - pathType: ImplementationSpecific - path: "/" # backend port number servicePort: 80 @@ -163,7 +160,7 @@ postDelete: enabled: true image: repository: rancher/shell - tag: v0.2.1 + tag: v0.3.0 namespaceList: - cattle-fleet-system - cattle-system @@ -181,6 +178,10 @@ startupProbe: timeoutSeconds: 5 periodSeconds: 10 failureThreshold: 12 + +# Additional taints to tolerate +extraTolerations: {} + livenessProbe: timeoutSeconds: 5 periodSeconds: 30