Skip to content

Commit 16b42b5

Browse files
Merge branch 'main' into APL-540
2 parents c0b93eb + e186417 commit 16b42b5

File tree

109 files changed

+429
-439
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

109 files changed

+429
-439
lines changed

chart/chart-index/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ dependencies:
1515
version: 0.23.0
1616
repository: https://cloudnative-pg.github.io/charts
1717
- name: external-dns
18-
version: 8.3.9
18+
version: 8.7.8
1919
repository: https://charts.bitnami.com/bitnami
2020
- name: falco
2121
version: 3.8.5

charts/external-dns/Chart.lock

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
dependencies:
22
- name: common
33
repository: oci://registry-1.docker.io/bitnamicharts
4-
version: 2.23.0
5-
digest: sha256:fbd6439f12ded949c04553b9c52a4c8153a8f2790147d972b314ddcd46921a14
6-
generated: "2024-10-02T00:30:49.768617272Z"
4+
version: 2.30.0
5+
digest: sha256:46afdf79eae69065904d430f03f7e5b79a148afed20aa45ee83ba88adc036169
6+
generated: "2025-02-19T17:06:43.001843167Z"

charts/external-dns/Chart.yaml

+5-4
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@ annotations:
22
category: DeveloperTools
33
images: |
44
- name: external-dns
5-
image: docker.io/bitnami/external-dns:0.15.0-debian-12-r2
5+
image: docker.io/bitnami/external-dns:0.16.1-debian-12-r0
66
licenses: Apache-2.0
7+
tanzuCategory: clusterUtility
78
apiVersion: v2
8-
appVersion: 0.15.0
9+
appVersion: 0.16.1
910
dependencies:
1011
- name: common
1112
repository: oci://registry-1.docker.io/bitnamicharts
@@ -15,7 +16,7 @@ dependencies:
1516
description: ExternalDNS is a Kubernetes addon that configures public DNS servers
1617
with information about exposed Kubernetes services to make them discoverable.
1718
home: https://bitnami.com
18-
icon: https://bitnami.com/assets/stacks/external-dns/img/external-dns-stack-220x234.png
19+
icon: https://dyltqmyl993wv.cloudfront.net/assets/stacks/external-dns/img/external-dns-stack-220x234.png
1920
keywords:
2021
- external-dns
2122
- network
@@ -26,4 +27,4 @@ maintainers:
2627
name: external-dns
2728
sources:
2829
- https://github.com/bitnami/charts/tree/main/bitnami/external-dns
29-
version: 8.3.9
30+
version: 8.7.8

charts/external-dns/README.md

+53-22
Large diffs are not rendered by default.

charts/external-dns/charts/common/Chart.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@ annotations:
22
category: Infrastructure
33
licenses: Apache-2.0
44
apiVersion: v2
5-
appVersion: 2.23.0
5+
appVersion: 2.30.0
66
description: A Library Helm Chart for grouping common logic between bitnami charts.
77
This chart is not deployable by itself.
88
home: https://bitnami.com
9-
icon: https://bitnami.com/downloads/logos/bitnami-mark.png
9+
icon: https://dyltqmyl993wv.cloudfront.net/downloads/logos/bitnami-mark.png
1010
keywords:
1111
- common
1212
- helper
@@ -20,4 +20,4 @@ name: common
2020
sources:
2121
- https://github.com/bitnami/charts/tree/main/bitnami/common
2222
type: library
23-
version: 2.23.0
23+
version: 2.30.0

charts/external-dns/charts/common/README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ tag:
6161

6262
pullPolicy:
6363
type: string
64-
description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
64+
description: Specify a imagePullPolicy.'
6565

6666
pullSecrets:
6767
type: array
@@ -214,13 +214,13 @@ helm install test mychart --set path.to.value00="",path.to.value01=""
214214

215215
#### Useful links
216216

217-
- <https://docs.vmware.com/en/VMware-Tanzu-Application-Catalog/services/tutorials/GUID-resolve-helm2-helm3-post-migration-issues-index.html>
217+
- <https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-resolve-helm2-helm3-post-migration-issues-index.html>
218218
- <https://helm.sh/docs/topics/v2_v3_migration/>
219219
- <https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/>
220220

221221
## License
222222

223-
Copyright &copy; 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
223+
Copyright &copy; 2025 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
224224

225225
Licensed under the Apache License, Version 2.0 (the "License");
226226
you may not use this file except in compliance with the License.

charts/external-dns/charts/common/templates/_affinities.tpl

+18-2
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,14 @@ Return a topologyKey definition
6060

6161
{{/*
6262
Return a soft podAffinity/podAntiAffinity definition
63-
{{ include "common.affinities.pods.soft" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "context" $) -}}
63+
{{ include "common.affinities.pods.soft" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}}
6464
*/}}
6565
{{- define "common.affinities.pods.soft" -}}
6666
{{- $component := default "" .component -}}
6767
{{- $customLabels := default (dict) .customLabels -}}
6868
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
6969
{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
70+
{{- $extraNamespaces := default (list) .extraNamespaces -}}
7071
preferredDuringSchedulingIgnoredDuringExecution:
7172
- podAffinityTerm:
7273
labelSelector:
@@ -77,6 +78,13 @@ preferredDuringSchedulingIgnoredDuringExecution:
7778
{{- range $key, $value := $extraMatchLabels }}
7879
{{ $key }}: {{ $value | quote }}
7980
{{- end }}
81+
{{- if $extraNamespaces }}
82+
namespaces:
83+
- {{ .context.Release.Namespace }}
84+
{{- with $extraNamespaces }}
85+
{{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
86+
{{- end }}
87+
{{- end }}
8088
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
8189
weight: 1
8290
{{- range $extraPodAffinityTerms }}
@@ -96,13 +104,14 @@ preferredDuringSchedulingIgnoredDuringExecution:
96104

97105
{{/*
98106
Return a hard podAffinity/podAntiAffinity definition
99-
{{ include "common.affinities.pods.hard" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "context" $) -}}
107+
{{ include "common.affinities.pods.hard" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}}
100108
*/}}
101109
{{- define "common.affinities.pods.hard" -}}
102110
{{- $component := default "" .component -}}
103111
{{- $customLabels := default (dict) .customLabels -}}
104112
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
105113
{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
114+
{{- $extraNamespaces := default (list) .extraNamespaces -}}
106115
requiredDuringSchedulingIgnoredDuringExecution:
107116
- labelSelector:
108117
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 8 }}
@@ -112,6 +121,13 @@ requiredDuringSchedulingIgnoredDuringExecution:
112121
{{- range $key, $value := $extraMatchLabels }}
113122
{{ $key }}: {{ $value | quote }}
114123
{{- end }}
124+
{{- if $extraNamespaces }}
125+
namespaces:
126+
- {{ .context.Release.Namespace }}
127+
{{- with $extraNamespaces }}
128+
{{ include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
129+
{{- end }}
130+
{{- end }}
115131
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
116132
{{- range $extraPodAffinityTerms }}
117133
- labelSelector:

charts/external-dns/charts/common/templates/_capabilities.tpl

+31-7
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,20 @@ Return the target Kubernetes version
1212
{{- default (default .Capabilities.KubeVersion.Version .Values.kubeVersion) ((.Values.global).kubeVersion) -}}
1313
{{- end -}}
1414

15+
{{/*
16+
Return true if the apiVersion is supported
17+
Usage:
18+
{{ include "common.capabilities.apiVersions.has" (dict "version" "batch/v1" "context" $) }}
19+
*/}}
20+
{{- define "common.capabilities.apiVersions.has" -}}
21+
{{- $providedAPIVersions := default .context.Values.apiVersions ((.context.Values.global).apiVersions) -}}
22+
{{- if and (empty $providedAPIVersions) (.context.Capabilities.APIVersions.Has .version) -}}
23+
{{- true -}}
24+
{{- else if has .version $providedAPIVersions -}}
25+
{{- true -}}
26+
{{- end -}}
27+
{{- end -}}
28+
1529
{{/*
1630
Return the appropriate apiVersion for poddisruptionbudget.
1731
*/}}
@@ -36,6 +50,18 @@ Return the appropriate apiVersion for networkpolicy.
3650
{{- end -}}
3751
{{- end -}}
3852

53+
{{/*
54+
Return the appropriate apiVersion for job.
55+
*/}}
56+
{{- define "common.capabilities.job.apiVersion" -}}
57+
{{- $kubeVersion := include "common.capabilities.kubeVersion" . -}}
58+
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.21-0" $kubeVersion) -}}
59+
{{- print "batch/v1beta1" -}}
60+
{{- else -}}
61+
{{- print "batch/v1" -}}
62+
{{- end -}}
63+
{{- end -}}
64+
3965
{{/*
4066
Return the appropriate apiVersion for cronjob.
4167
*/}}
@@ -157,14 +183,12 @@ Return the appropriate apiVersion for Vertical Pod Autoscaler.
157183
*/}}
158184
{{- define "common.capabilities.vpa.apiVersion" -}}
159185
{{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}}
160-
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.23-0" $kubeVersion) -}}
161-
{{- if .beta2 -}}
162-
{{- print "autoscaling/v2beta2" -}}
163-
{{- else -}}
164-
{{- print "autoscaling/v2beta1" -}}
165-
{{- end -}}
186+
{{- if and (not (empty $kubeVersion)) (semverCompare "<1.11-0" $kubeVersion) -}}
187+
{{- print "autoscaling/v1beta1" -}}
188+
{{- else if and (not (empty $kubeVersion)) (semverCompare "<1.25-0" $kubeVersion) -}}
189+
{{- print "autoscaling/v1beta2" -}}
166190
{{- else -}}
167-
{{- print "autoscaling/v2" -}}
191+
{{- print "autoscaling/v1" -}}
168192
{{- end -}}
169193
{{- end -}}
170194

charts/external-dns/charts/common/templates/_compatibility.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ Usage:
4040
{{- end -}}
4141
{{/* Remove fields that are disregarded when running the container in privileged mode */}}
4242
{{- if $adaptedContext.privileged -}}
43-
{{- $adaptedContext = omit $adaptedContext "capabilities" "seLinuxOptions" -}}
43+
{{- $adaptedContext = omit $adaptedContext "capabilities" -}}
4444
{{- end -}}
4545
{{- omit $adaptedContext "enabled" | toYaml -}}
4646
{{- end -}}

charts/external-dns/charts/common/templates/_errors.tpl

+58-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ SPDX-License-Identifier: APACHE-2.0
55

66
{{/* vim: set filetype=mustache: */}}
77
{{/*
8-
Through error when upgrading using empty passwords values that must not be empty.
8+
Throw error when upgrading using empty passwords values that must not be empty.
99
1010
Usage:
1111
{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}}
@@ -26,3 +26,60 @@ Required password params:
2626
{{- printf $errorString $validationErrors | fail -}}
2727
{{- end -}}
2828
{{- end -}}
29+
30+
{{/*
31+
Throw error when original container images are replaced.
32+
The error can be bypassed by setting the "global.security.allowInsecureImages" to true. In this case,
33+
a warning message will be shown instead.
34+
35+
Usage:
36+
{{ include "common.errors.insecureImages" (dict "images" (list .Values.path.to.the.imageRoot) "context" $) }}
37+
*/}}
38+
{{- define "common.errors.insecureImages" -}}
39+
{{- $relocatedImages := list -}}
40+
{{- $replacedImages := list -}}
41+
{{- $retaggedImages := list -}}
42+
{{- $globalRegistry := ((.context.Values.global).imageRegistry) -}}
43+
{{- $originalImages := .context.Chart.Annotations.images -}}
44+
{{- range .images -}}
45+
{{- $registryName := default .registry $globalRegistry -}}
46+
{{- $fullImageNameNoTag := printf "%s/%s" $registryName .repository -}}
47+
{{- $fullImageName := printf "%s:%s" $fullImageNameNoTag .tag -}}
48+
{{- if not (contains $fullImageNameNoTag $originalImages) -}}
49+
{{- if not (contains $registryName $originalImages) -}}
50+
{{- $relocatedImages = append $relocatedImages $fullImageName -}}
51+
{{- else if not (contains .repository $originalImages) -}}
52+
{{- $replacedImages = append $replacedImages $fullImageName -}}
53+
{{- end -}}
54+
{{- end -}}
55+
{{- if not (contains (printf "%s:%s" .repository .tag) $originalImages) -}}
56+
{{- $retaggedImages = append $retaggedImages $fullImageName -}}
57+
{{- end -}}
58+
{{- end -}}
59+
60+
{{- if and (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) (((.context.Values.global).security).allowInsecureImages) -}}
61+
{{- print "\n\n⚠ SECURITY WARNING: Verifying original container images was skipped. Please note this Helm chart was designed, tested, and validated on multiple platforms using a specific set of Bitnami and Tanzu Application Catalog containers. Substituting other containers is likely to cause degraded security and performance, broken chart features, and missing environment variables.\n" -}}
62+
{{- else if (or (gt (len $relocatedImages) 0) (gt (len $replacedImages) 0)) -}}
63+
{{- $errorString := "Original containers have been substituted for unrecognized ones. Deploying this chart with non-standard containers is likely to cause degraded security and performance, broken chart features, and missing environment variables." -}}
64+
{{- $errorString = print $errorString "\n\nUnrecognized images:" -}}
65+
{{- range (concat $relocatedImages $replacedImages) -}}
66+
{{- $errorString = print $errorString "\n - " . -}}
67+
{{- end -}}
68+
{{- if or (contains "docker.io/bitnami/" $originalImages) (contains "docker.io/bitnamiprem/" $originalImages) -}}
69+
{{- $errorString = print "\n\n⚠ ERROR: " $errorString -}}
70+
{{- $errorString = print $errorString "\n\nIf you are sure you want to proceed with non-standard containers, you can skip container image verification by setting the global parameter 'global.security.allowInsecureImages' to true." -}}
71+
{{- $errorString = print $errorString "\nFurther information can be obtained at https://github.com/bitnami/charts/issues/30850" -}}
72+
{{- print $errorString | fail -}}
73+
{{- else if gt (len $replacedImages) 0 -}}
74+
{{- $errorString = print "\n\n⚠ WARNING: " $errorString -}}
75+
{{- print $errorString -}}
76+
{{- end -}}
77+
{{- else if gt (len $retaggedImages) 0 -}}
78+
{{- $warnString := "\n\n⚠ WARNING: Original containers have been retagged. Please note this Helm chart was tested, and validated on multiple platforms using a specific set of Tanzu Application Catalog containers. Substituting original image tags could cause unexpected behavior." -}}
79+
{{- $warnString = print $warnString "\n\nRetagged images:" -}}
80+
{{- range $retaggedImages -}}
81+
{{- $warnString = print $warnString "\n - " . -}}
82+
{{- end -}}
83+
{{- print $warnString -}}
84+
{{- end -}}
85+
{{- end -}}

charts/external-dns/charts/common/templates/_secrets.tpl

+11-4
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ Params:
6767
Generate secret password or retrieve one if already created.
6868
6969
Usage:
70-
{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }}
70+
{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "honorProvidedValues" false "context" $) }}
7171

7272
Params:
7373
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
@@ -80,12 +80,15 @@ Params:
8080
- failOnNew - Boolean - Optional - Default to true. If set to false, skip errors adding new keys to existing secrets.
8181
- skipB64enc - Boolean - Optional - Default to false. If set to true, no the secret will not be base64 encrypted.
8282
- skipQuote - Boolean - Optional - Default to false. If set to true, no quotes will be added around the secret.
83+
- honorProvidedValues - Boolean - Optional - Default to false. If set to true, the values in providedValues have higher priority than an existing secret
8384
The order in which this function returns a secret password:
84-
1. Already existing 'Secret' resource
85+
1. Password provided via the values.yaml if honorProvidedValues = true
86+
(If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned)
87+
2. Already existing 'Secret' resource
8588
(If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned)
86-
2. Password provided via the values.yaml
89+
3. Password provided via the values.yaml if honorProvidedValues = false
8790
(If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned)
88-
3. Randomly generated secret password
91+
4. Randomly generated secret password
8992
(A new random secret password with the length specified in the 'length' parameter will be generated and returned)
9093

9194
*/}}
@@ -106,6 +109,10 @@ The order in which this function returns a secret password:
106109
{{- end -}}
107110
{{- end }}
108111

112+
{{- if and $providedPasswordValue .honorProvidedValues }}
113+
{{- $password = $providedPasswordValue | toString }}
114+
{{- end }}
115+
109116
{{- if not $password }}
110117
{{- if $providedPasswordValue }}
111118
{{- $password = $providedPasswordValue | toString }}

charts/external-dns/charts/common/templates/_tplvalues.tpl

+14
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,17 @@ Usage:
3636
{{- end -}}
3737
{{ $dst | toYaml }}
3838
{{- end -}}
39+
40+
{{/*
41+
Merge a list of values that contains template after rendering them.
42+
Merge precedence is consistent with https://masterminds.github.io/sprig/dicts.html#mergeoverwrite-mustmergeoverwrite
43+
Usage:
44+
{{ include "common.tplvalues.merge-overwrite" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }}
45+
*/}}
46+
{{- define "common.tplvalues.merge-overwrite" -}}
47+
{{- $dst := dict -}}
48+
{{- range .values -}}
49+
{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | mergeOverwrite $dst -}}
50+
{{- end -}}
51+
{{ $dst | toYaml }}
52+
{{- end -}}

charts/external-dns/charts/common/templates/_warnings.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ Usage:
1313

1414
{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }}
1515
WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
16-
+info https://docs.vmware.com/en/VMware-Tanzu-Application-Catalog/services/tutorials/GUID-understand-rolling-tags-containers-index.html
16+
+info https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-understand-rolling-tags-containers-index.html
1717
{{- end }}
1818
{{- end -}}
1919

charts/external-dns/charts/common/templates/validations/_cassandra.tpl

-26
Original file line numberDiff line numberDiff line change
@@ -4,32 +4,6 @@ SPDX-License-Identifier: APACHE-2.0
44
*/}}
55

66
{{/* vim: set filetype=mustache: */}}
7-
{{/*
8-
Validate Cassandra required passwords are not empty.
9-
10-
Usage:
11-
{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
12-
Params:
13-
- secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret"
14-
- subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
15-
*/}}
16-
{{- define "common.validations.values.cassandra.passwords" -}}
17-
{{- $existingSecret := include "common.cassandra.values.existingSecret" . -}}
18-
{{- $enabled := include "common.cassandra.values.enabled" . -}}
19-
{{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}}
20-
{{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}}
21-
22-
{{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
23-
{{- $requiredPasswords := list -}}
24-
25-
{{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}}
26-
{{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
27-
28-
{{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
29-
30-
{{- end -}}
31-
{{- end -}}
32-
337
{{/*
348
Auxiliary function to get the right value for existingSecret.
359

0 commit comments

Comments
 (0)