Update rancher/2.10.1

charts/rancher/BUILD-README.md

@@ -9,7 +9,7 @@ $ git clone https://github.com/paasup/service-catalog.git
 
 - 작업 브랜치로 체크아웃
 ```
-$ git checkout -b update-rancher/2.9.1
+$ git checkout -b update-rancher/2.10.1
 ```
 
 
@@ -51,7 +51,7 @@ $ git checkout -b update-rancher/2.9.1
   helm repo update
   
   # helm 차트 
-  helm pull rancher-latest/rancher --version="2.9.1"
+  helm pull rancher-latest/rancher --version="2.10.1"
   
   # 차트 변경
   tar xzvf rancher*.tgz
@@ -106,41 +106,41 @@ $ git checkout -b update-rancher/2.9.1
 - 갱신작업 진행후 commit
 ```
 $ git add .
-$ git commit -m "update rancher/2.9.1"
+$ git commit -m "update rancher/2.10.1"
 ```
 
 - main 브랜치에 체크아웃 후 merge
 ```
 $ git checkout main
-$ git merge update-rancher/2.9.1
+$ git merge update-rancher/2.10.1
 ```
 
 - git에 push 후 작업 브랜치 삭제
 ```
 $ git push -u origin main
-$ git branch -d update-rancher/2.9.1
+$ git branch -d update-rancher/2.10.1
 ```
 
 - git tag 추가 후 push
 ```
-$ git tag rancher/2.9.1
+$ git tag rancher/2.10.1
-$ git push origin rancher/2.9.1
+$ git push origin rancher/2.10.1
 ```
 
 
 
 ## 4. 차트 버전 정보
 
-- rancher/2.9.1
+- rancher/2.10.1
   - 서비스 배포를 위하여 custom-values.yam에 정의하였다. 
   - 차트의 빌드 방법과 배포 방법을  BUILD-README.md, CUSTOM-README.md 문서에 작성하였다.
-- rancher/2.9.1-1 
+- rancher/2.10.1-1 
   - 사설 인증서 사용시 전처리를 위한 Helm preinstall Hook을 추가하였다.
   - 변경 사항을 BUILD-README.md, CUSTOM-README.md 문서에 반영하였다.
-- rancher/2.9.1-2
+- rancher/2.10.1-2
   - Helm preinstall Hook에 rancher labels 추가
   - Helm preinstall Hook으로 생성된 자원을 삭제하기 위해 Helm postdelete Hook을 추가하였다.
   - 변경 사항을 BUILD-README.md 문서에 반영하였다.
-- rancher/2.9.1-3
+- rancher/2.10.1-3
   - Argocd post-delete Hook 이슈로 Hook을 삭제하였다.
   - Rancher 삭제 후처리를 위한 스크립트 수정 및 추가하였다.

charts/rancher/Chart.yaml

@@ -1,11 +1,11 @@
 apiVersion: v2
-appVersion: v2.9.1
+appVersion: v2.10.1
 description: Install Rancher Server to manage Kubernetes clusters across providers.
 home: https://rancher.com
-icon: https://github.com/rancher/ui/blob/master/public/assets/images/logos/welcome-cow.svg
+icon: https://raw.githubusercontent.com/rancher/ui/master/public/assets/images/logos/welcome-cow.svg
 keywords:
 - rancher
-kubeVersion: < 1.31.0-0
+kubeVersion: < 1.32.0-0
 maintainers:
 - email: charts@rancher.com
   name: Rancher Labs
@@ -13,4 +13,4 @@ name: rancher
 sources:
 - https://github.com/rancher/rancher
 - https://github.com/rancher/server-chart
-version: 2.9.1
+version: 2.10.1

charts/rancher/custom-values.yaml

@@ -13,9 +13,9 @@ ingress:
     nginx.ingress.kubernetes.io/proxy-body-size: 10m
 
     # cert-manager 사용시
-    # cert-manager.io/cluster-issuer: "selfsigned-issuer" 
+    cert-manager.io/cluster-issuer: "selfsigned-issuer" 
-    # cert-manager.io/duration: 8760h  
+    cert-manager.io/duration: 8760h  
-    # cert-manager.io/renew-before: 720h
+    cert-manager.io/renew-before: 720h
 
 
 # 사설 인증서 사용시 true

charts/rancher/templates/_helpers.tpl

@@ -27,7 +27,9 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
   {{- printf "%s-%s" .Chart.Name .Chart.Version | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
-# Render Values in configurationSnippet
+{{/*
+Render Values in configurationSnippet
+*/}}
 {{- define "configurationSnippet" -}}
   {{- tpl (.Values.ingress.configurationSnippet) . | nindent 6 -}}
 {{- end -}}
@@ -74,3 +76,14 @@ add below linux tolerations to workloads could be scheduled to those linux nodes
 {{- end -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+    Select correct auditLog image
+*/}}
+{{- define "auditLog_image" -}}
+  {{- if .Values.busyboxImage }}
+    {{- .Values.busyboxImage}}
+  {{- else }}
+    {{- .Values.auditLog.image.repository -}}:{{- .Values.auditLog.image.tag -}}
+  {{- end }}
+{{- end -}}

charts/rancher/templates/deployment.yaml

@@ -63,6 +63,9 @@ spec:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms: {{ include "linux-node-selector-terms" . | nindent 14 }}
       tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
+{{- if .Values.extraTolerations }}
+{{ toYaml .Values.extraTolerations | indent 8 }}
+{{- end }}
       containers:
       - image: {{ .Values.rancherImage }}:{{ default .Chart.AppVersion .Values.rancherImageTag }}
         imagePullPolicy: {{ default "IfNotPresent" .Values.rancherImagePullPolicy }}
@@ -210,16 +213,8 @@ spec:
 {{- if eq .Values.auditLog.destination "sidecar" }}
   {{- if gt (int .Values.auditLog.level) 0 }}
       # Make audit logs available for Rancher log collector tools.
-      {{- if .Values.busyboxImage }}
+      - image: {{ include "auditLog_image" . }}
-      - image: {{ .Values.busyboxImage}}
+        imagePullPolicy: {{ default .Values.auditLog.image.pullPolicy .Values.busyboxImagePullPolicy }}
-      {{- else }}
-      - image: {{ .Values.auditLog.image.repository }}:{{.Values.auditLog.image.tag}}
-      {{- end }}
-      {{- if .Values.busyboxImagePullPolicy }}
-        imagePullPolicy: {{ .Values.busyboxImagePullPolicy }}
-      {{- else }}
-        imagePullPolicy: {{ .Values.auditLog.image.pullPolicy }}
-      {{- end }}
         name: {{ template "rancher.name" . }}-audit-log
         command: ["tail"]
         args: ["-F", "/var/log/auditlog/rancher-api-audit.log"]

charts/rancher/templates/ingress.yaml

@@ -54,8 +54,8 @@ spec:
           servicePort: {{ .Values.ingress.servicePort }}
           {{- end }}
         {{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
-        pathType: {{ .Values.ingress.pathType }}
+        pathType: ImplementationSpecific
-        path: {{ .Values.ingress.path }}
+        path: "/"
         {{- end }}
 {{- if eq .Values.tls "ingress" }}
   tls:

charts/rancher/values.schema.json

@@ -5,6 +5,31 @@
       "type": ["string", "null"],
       "enum": ["strict", "system-store", "", null],
       "description": "agentTLSMode must be 'strict' or 'system-store' or null (defaults to system-store)"
+    },
+    "auditLog": {
+      "type": "object",
+      "properties": {
+        "destination": {
+          "type": "string",
+          "enum": ["sidecar", "hostPath"],
+          "description": "auditLog.destination must be either 'sidecar' or 'hostPath'"
+        },
+        "level": {
+          "type": "integer",
+          "enum": [0, 1, 2, 3],
+          "description": "auditLog.level must be a number 0-3; 0 to disable, 3 for most verbose"
+        }
+      }
+    },
+    "busyboxImage": {
+      "type": "string",
+      "description": "[DEPRECATED] This value is deprecated, use `auditLog.image.repository` & `auditLog.image.tag` instead.",
+      "deprecated": true
+    },
+    "busyboxImagePullPolicy": {
+      "type": "string",
+      "description": "[DEPRECATED] This value is deprecated, use `auditLog.image.pullPolicy` instead.",
+      "deprecated": true
     }
   },
   "required": [],

charts/rancher/values.yaml

@@ -6,11 +6,11 @@ additionalTrustedCAs: false
 antiAffinity: preferred
 topologyKey: kubernetes.io/hostname
 
-# Audit Logs https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
+# Audit Logs
+# Source: https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log
 # The audit log is piped to the console of the rancher-audit-log container in the rancher pod.
-# https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
+# level: Verbosity of logs, 0 to 3. 0 is off, 3 most verbose.
-# destination stream to sidecar container console or hostPath volume
+# Docs: https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels
-# level: Verbosity of logs, 0 to 3. 0 is off 3 is a lot.
 auditLog:
   destination: sidecar
   hostPath: /var/log/rancher/audit/
@@ -23,7 +23,7 @@ auditLog:
   # Important: update pkg/image/export/resolve.go when this default image is changed, so that it's reflected accordingly in rancher-images.txt generated for air-gapped setups.
   image:
     repository: "rancher/mirrored-bci-micro"
-    tag: 15.4.14.3
+    tag: 15.6.24.2
     # Override imagePullPolicy image
     # options: Always, Never, IfNotPresent
     pullPolicy: "IfNotPresent"
@@ -65,9 +65,6 @@ ingress:
   includeDefaultExtraAnnotations: true
   extraAnnotations: {}
   ingressClassName: ""
-  # Certain ingress controllers will require the pathType or path to be set to a different value.
-  pathType: ImplementationSpecific
-  path: "/"
   # backend port number
   servicePort: 80
 
@@ -163,7 +160,7 @@ postDelete:
   enabled: true
   image:
     repository: rancher/shell
-    tag: v0.2.1
+    tag: v0.3.0
   namespaceList:
     - cattle-fleet-system
     - cattle-system
@@ -181,6 +178,10 @@ startupProbe:
   timeoutSeconds: 5
   periodSeconds: 10
   failureThreshold: 12
+
+# Additional taints to tolerate
+extraTolerations: {}
+
 livenessProbe:
   timeoutSeconds: 5
   periodSeconds: 30