Merge branch 'master' of https://github.com/pega-vanhd1/pega-helm-charts

into bugfix/BUG-872590
pega-vanhd1 · Jul 17, 2024 · b553667 · b553667
2 parents aa5810f + a6d7fa9
commit b553667
Show file tree

Hide file tree

Showing 42 changed files with 736 additions and 145 deletions.
diff --git a/.github/workflows/github-actions-build.yml b/.github/workflows/github-actions-build.yml
@@ -2,7 +2,7 @@ name:  Pega Chart Build
 
 env:
   HELM_URL: https://get.helm.sh
-  HELM_TGZ: helm-v3.11.3-linux-amd64.tar.gz
+  HELM_TGZ: helm-v3.14.3-linux-amd64.tar.gz
   YAMLLINT_VERSION: 1.34.0
   GO_VERSION: 1.21.6
 

diff --git a/charts/addons/Chart.yaml b/charts/addons/Chart.yaml
@@ -3,4 +3,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: A Helm chart for Kubernetes
 name: addons
-version: "3.23.0"
+version: "3.24.0"
diff --git a/charts/backingservices/Chart.yaml b/charts/backingservices/Chart.yaml
@@ -17,4 +17,4 @@ description: Helm Chart to provision the latest Search and Reporting Service (SR
 # The chart version: Pega provides this as a useful way to track changes you make to this chart.
 # As a best practice, you should increment the version number each time you make changes to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: "3.23.0"
+version: "3.24.0"
diff --git a/charts/backingservices/charts/constellation-messaging/README.md b/charts/backingservices/charts/constellation-messaging/README.md
@@ -17,4 +17,5 @@ Complete information on the design of the service including architecture, scalab
 | `imagePullSecretNames`                            | List pre-existing secrets to be used for pulling docker images.                                                                                                                                                                                                                                                                                                           |
 | `pegaMessagingPort`                            | Defines the port used by the Service.                                                                                                                                                                                                                                                                                                           |
 | `pegaMessagingTargetPort`                            | Defines the port used by the Pod and Container.                                                                                                                                                                                                                                                                                                           |
+| `affinity`                            | Define pod affinity so that it is restricted to run on particular node(s), or to prefer to run on particular nodes.                                                                                                                                                                                                                                       |
 | `ingress`                               |  Allows optional configuration of a domain name, ingressClass, and annotations.  An ingress will be provisioned if a domain name is supplied.  Due to the diversity of network configurations, ingress vendors, and TLS requirements it may be necessary to define your ingress separately from this chart.
diff --git a/charts/backingservices/charts/constellation-messaging/templates/_helpers.tpl b/charts/backingservices/charts/constellation-messaging/templates/_helpers.tpl
@@ -0,0 +1,6 @@
+{{- define "podAffinity" }}
+{{- if .affinity }}
+affinity:
+{{- toYaml .affinity | nindent 2 }}
+{{- end }}
+{{ end }}
diff --git a/charts/backingservices/charts/constellation-messaging/templates/messaging-deployment.yaml b/charts/backingservices/charts/constellation-messaging/templates/messaging-deployment.yaml
@@ -23,10 +23,19 @@ spec:
       - name: c11n-messaging
         imagePullPolicy: {{ .Values.imagePullPolicy }}
         image: {{ .Values.image }}
+        resources:
+          {{ if .Values.resources }}
+          {{ toYaml .Values.resources | nindent 10 }}
+          {{- end }}
+        securityContext:
+          {{- if .Values.securityContext }}
+          {{ toYaml .Values.securityContext | nindent 10 }}
+          {{- end }}
         args:
           - --max-semi-space-size=1024
           - port={{ .Values.pegaMessagingTargetPort }}
           - path=/c11n-messaging
         ports:
         - containerPort: {{ .Values.pegaMessagingTargetPort }}
+{{- include "podAffinity" .Values | indent 6 }}
 {{ end }}
diff --git a/charts/backingservices/charts/constellation-messaging/values.yaml b/charts/backingservices/charts/constellation-messaging/values.yaml
@@ -13,6 +13,20 @@ imagePullPolicy: Always
 pegaMessagingPort: 3000
 pegaMessagingTargetPort: 3000
 
+# set memoryRequest &  memoryLimit to Limit memory usage for container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-memory
+# resources:
+#   requests:
+#     memory: # ex: 128Mi for MB or 2Gi for GB
+#   limits:
+#     memory: # ex: 256Mi for MB or 4Gi for GB
+securityContext:
+  seccompProfile:
+    # set seccompProfile to RuntimeDefault to not disable default seccomp profile https://kubernetes.io/docs/tutorials/security/seccomp/
+    type: Unconfined # RuntimeDefault
+  # DO NOT CHANGE readOnlyRootFilesystem VALUE to true, C11N MESSAGING WON'T WORK AS EXPECTED
+  readOnlyRootFilesystem: false
+  # set allowPrivilegeEscalation to false to Restrict container from acquiring additional privileges https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  allowPrivilegeEscalation: true # false
 serviceType: NodePort
 
 # An ingress will be provisioned if a hostname is defined, or omitted if the hostname is empty.

diff --git a/charts/backingservices/charts/constellation/README.md b/charts/backingservices/charts/constellation/README.md
@@ -48,6 +48,7 @@ The values.yaml file provides configuration options to define the values for the
 | `ingressAnnotations`                        | Specify additional annotations to add to the ingress.                                                                                                                                                                                                                                                                                          |
 | `customerAssetVolumeClaimName`                        | Specify the volume claim name to be used for storing customer assets.                                                                                                                                                                                                                                                                                          |
 | `imagePullSecretNames`                        | Specify a list of existing ImagePullSecrets to be added to the Deployment.                                                                                                                                                                                                                                                                                          |
+| `affinity`                        | Specify the pod affinity so that pods are restricted to run on particular node(s), or to prefer to run on particular nodes.    
 | `docker`.`registry`.`url`                        | Specify the image registry url.                                                                                                                                                                                                                                                                                          |
 | `docker`.`registry`.`username`                        | Specify the username for the docker registry.                                                                                                                                                                                                                                                                                          |
 | `docker`.`registry`.`password`                        | Specify the password for the docker registry.                                                                                                                                                                                                                                                                                          |

diff --git a/charts/backingservices/charts/constellation/templates/_helpers.tpl b/charts/backingservices/charts/constellation/templates/_helpers.tpl
@@ -8,3 +8,10 @@
 {{- end }}
 
 {{- define "deploymentName" }}{{ $deploymentNamePrefix := "constellation" }}{{ if (.Values.deployment) }}{{ if (.Values.deployment.name) }}{{ $deploymentNamePrefix = .Values.deployment.name }}{{ end }}{{ end }}{{ $deploymentNamePrefix }}{{- end }}
+
+{{- define "podAffinity" }}
+{{- if .affinity }}
+affinity:
+{{- toYaml .affinity | nindent 2 }}
+{{- end }}
+{{ end }}
diff --git a/charts/backingservices/charts/constellation/templates/clln-deployment.yaml b/charts/backingservices/charts/constellation/templates/clln-deployment.yaml
@@ -31,6 +31,14 @@ spec:
       containers:
       - name: constellation
         image: {{ .Values.docker.constellation.image }}
+        resources:
+          {{ if .Values.resources }}
+          {{ toYaml .Values.resources | nindent 10 }}
+          {{- end }}
+        securityContext:
+          {{- if .Values.securityContext }}
+          {{ toYaml .Values.securityContext | nindent 10 }}
+          {{- end }}
         {{ if .Values.customerAssetVolumeClaimName }}
         volumeMounts:
          - name: constellation-appstatic-assets
@@ -61,4 +69,5 @@ spec:
             port: 3000
         ports:
         - containerPort: 3000
+{{- include "podAffinity" .Values | indent 6 }}
 {{ end }}
diff --git a/charts/backingservices/charts/constellation/templates/clln-ingress.yaml b/charts/backingservices/charts/constellation/templates/clln-ingress.yaml
@@ -18,6 +18,9 @@ metadata:
     {{- toYaml .Values.ingressAnnotations | nindent 4 }}
     {{ end }}
 spec:
+{{- if .Values.ingressClassName }}
+  ingressClassName: {{ .Values.ingressClassName }}
+{{- end }}
   rules:
   - host: {{ .Values.domainName }}
     http:

diff --git a/charts/backingservices/charts/constellation/values.yaml b/charts/backingservices/charts/constellation/values.yaml
@@ -25,6 +25,22 @@ docker:
     image: cirrus-docker.jfrog.io/constellation-appstatic-service/docker-image:1.0.8-20221228123724
 logLevel: info
 urlPath: /c11n
+# ingressClassName is optional and will be included if defined.
+ingressClassName:
+# set memoryRequest &  memoryLimit to Limit memory usage for container https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-memory
+# resources:
+#   requests:
+#     memory: # ex: 128Mi for MB or 2Gi for GB
+#   limits:
+#     memory: # ex: 256Mi for MB or 4Gi for GB
+securityContext:
+  seccompProfile:
+    # set seccompProfile to RuntimeDefault to not disable default seccomp profile https://kubernetes.io/docs/tutorials/security/seccomp/
+    type: Unconfined # RuntimeDefault
+  # DO NOT CHANGE readOnlyRootFilesystem VALUE to true, C11N SERVICE WON'T WORK AS EXPECTED
+  readOnlyRootFilesystem: false
+  # set allowPrivilegeEscalation to false to Restrict container from acquiring additional privileges https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  allowPrivilegeEscalation: true # false
 replicas: 1
 livenessProbe:
   initialDelaySeconds: 5

diff --git a/charts/backingservices/charts/srs/README.md b/charts/backingservices/charts/srs/README.md
@@ -108,7 +108,7 @@ To deploy Pega Platform with the SRS backing service, the SRS helm chart require
 |-----------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `enabled`                               | Enable the Search and Reporting Service deployment as a backing service. Set this parameter to `true` to use SRS.                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | `deploymentName`                        | Specify the name of your SRS cluster. Your deployment creates resources prefixed with this string. This is also the service name for the SRS.                                                                                                                                                                                                                                                                                                                                                          |
-| `srsRuntime`                            | Use this section to define specific resource configuration options like image, replica count, cpu and memory resource settings in the SRS. The default minimum required number of replicas is 2, but as a best practice, deploy 3 replicas to maintain high availability.                                                                                                                                                                                                                                                                                                                                                            |
+| `srsRuntime`                            | Use this section to define specific resource configuration options like image, replica count, pod affinity, cpu and memory resource settings in the SRS. The default minimum required number of replicas is 2, but as a best practice, deploy 3 replicas to maintain high availability.                                                                                                                                                                                                                                                                                                                                                            |
 | `busybox`                               | When provisioning an internally managed Elasticsearch cluster, you can customize the location and pull policy of the Alpine image used during the deployment process by specifying `busybox.image` and `busybox.imagePullPolicy`.                                                                                                                                                                                                                                                                      |
 | `elasticsearch`                         | Define the elasticsearch cluster configurations. The [Elasticsearch](https://github.com/helm/charts/tree/master/stable/elasticsearch/values.yaml) chart defines the values for Elasticsearch provisioning in the SRS cluster. For internally provisioned Elasticsearch the default version is set to `7.17.9`. Set the `elasticsearch.imageTag` parameter in values.yaml to `7.16.3` to use this supported version in the SRS cluster.                                                                |
 | `k8sProvider`                               | Specify your Kubernetes provider name. Supported values are [`eks`, `aks`, `minikube`, `gke`, `openshift`, `pks`].. 

diff --git a/charts/backingservices/charts/srs/templates/_helpers.tpl b/charts/backingservices/charts/srs/templates/_helpers.tpl
@@ -222,3 +222,10 @@ Network policy: `openshift-dns` for openshift cluster, `kube-dns | core-dns` for
       port: 8080
 {{- end -}}
 {{- end -}}
+
+{{- define "podAffinity" }}
+{{- if .affinity }}
+affinity:
+{{- toYaml .affinity | nindent 2 }}
+{{- end }}
+{{ end }}
diff --git a/charts/backingservices/charts/srs/templates/srsservice_deployment.yaml b/charts/backingservices/charts/srs/templates/srsservice_deployment.yaml
@@ -147,4 +147,5 @@ spec:
                 name: srs-elastic-credentials
                 key: password
       {{ end }}
+{{- include "podAffinity" .Values.srsRuntime | indent 6 }}
   {{ end }}
diff --git a/charts/pega/Chart.yaml b/charts/pega/Chart.yaml
@@ -1,7 +1,7 @@
 ---
 apiVersion: v1
 name: pega
-version: "3.23.0"
+version: "3.24.0"
 description: Pega installation on kubernetes
 keywords:
 - pega