feat(container)!: Update image redis to v20 #132
+1
−1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
--- kubernetes/apps/database/redis/app Kustomization: flux-system/redis HelmRelease: database/redis
+++ kubernetes/apps/database/redis/app Kustomization: flux-system/redis HelmRelease: database/redis
@@ -13,13 +13,13 @@
spec:
chart: redis
sourceRef:
kind: HelmRepository
name: bitnami
namespace: flux-system
- version: 18.6.1
+ version: 20.3.0
install:
remediation:
retries: 3
interval: 30m
uninstall:
keepHistory: false |
--- HelmRelease: database/redis ServiceAccount: database/redis
+++ HelmRelease: database/redis ServiceAccount: database/redis
@@ -1,10 +1,10 @@
---
apiVersion: v1
kind: ServiceAccount
-automountServiceAccountToken: true
+automountServiceAccountToken: false
metadata:
name: redis
namespace: database
labels:
app.kubernetes.io/instance: redis
app.kubernetes.io/managed-by: Helm
--- HelmRelease: database/redis ConfigMap: database/redis-scripts
+++ HelmRelease: database/redis ConfigMap: database/redis-scripts
@@ -92,12 +92,19 @@
# check if there is a master
master_in_persisted_conf="$(get_full_hostname "$HOSTNAME")"
master_port_in_persisted_conf="$REDIS_MASTER_PORT_NUMBER"
master_in_sentinel="$(get_sentinel_master_info)"
redisRetVal=$?
+ if [[ -f /opt/bitnami/redis-sentinel/etc/sentinel.conf ]]; then
+ master_in_persisted_conf="$(awk '/monitor/ {print $4}' /opt/bitnami/redis-sentinel/etc/sentinel.conf)"
+ master_port_in_persisted_conf="$(awk '/monitor/ {print $5}' /opt/bitnami/redis-sentinel/etc/sentinel.conf)"
+ info "Found previous master ${master_in_persisted_conf}:${master_port_in_persisted_conf} in /opt/bitnami/redis-sentinel/etc/sentinel.conf"
+ debug "$(cat /opt/bitnami/redis-sentinel/etc/sentinel.conf | grep monitor)"
+ fi
+
if [[ $redisRetVal -ne 0 ]]; then
if [[ "$master_in_persisted_conf" == "$(get_full_hostname "$HOSTNAME")" ]]; then
# Case 1: No active sentinel and in previous sentinel.conf we were the master --> MASTER
info "Configuring the node as master"
export REDIS_REPLICATION_MODE="master"
else
@@ -198,16 +205,16 @@
# Sanitize inputs
value="${value//\\/\\\\}"
value="${value//&/\\&}"
value="${value//\?/\\?}"
[[ "$value" = "" ]] && value="\"$value\""
- replace_in_file "/opt/bitnami/redis-sentinel/etc/sentinel.conf" "^#*\s*${key} .*" "${key} ${value}" false
+ replace_in_file "/opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf" "^#*\s*${key} .*" "${key} ${value}" false
}
sentinel_conf_add() {
- echo $'\n'"$@" >> "/opt/bitnami/redis-sentinel/etc/sentinel.conf"
+ echo $'\n'"$@" >> "/opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf"
}
host_id() {
echo "$1" | openssl sha1 | awk '{print $2}'
}
get_sentinel_master_info() {
if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then
@@ -219,35 +226,43 @@
retry_while "eval $sentinel_info_command" 2 5
}
[[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")"
master_in_persisted_conf="$(get_full_hostname "$HOSTNAME")"
- if ! get_sentinel_master_info && [[ "$master_in_persisted_conf" == "$(get_full_hostname "$HOSTNAME")" ]]; then
- # No master found, lets create a master node
- export REDIS_REPLICATION_MODE="master"
-
- REDIS_MASTER_HOST=$(get_full_hostname "$HOSTNAME")
- REDIS_MASTER_PORT_NUMBER="$REDISPORT"
- else
- export REDIS_REPLICATION_MODE="replica"
-
- # Fetches current master's host and port
- REDIS_SENTINEL_INFO=($(get_sentinel_master_info))
+
+ if [[ -f /opt/bitnami/redis-sentinel/etc/sentinel.conf ]]; then
+ master_in_persisted_conf="$(awk '/monitor/ {print $4}' /opt/bitnami/redis-sentinel/etc/sentinel.conf)"
+ info "Found previous master $master_in_persisted_conf in /opt/bitnami/redis-sentinel/etc/sentinel.conf"
+ debug "$(cat /opt/bitnami/redis-sentinel/etc/sentinel.conf | grep monitor)"
+ fi
+ REDIS_SENTINEL_INFO=($(get_sentinel_master_info))
+ if [ "$?" -eq "0" ]; then
+ # current master's host and port obtained from other Sentinel
info "printing REDIS_SENTINEL_INFO=(${REDIS_SENTINEL_INFO[0]},${REDIS_SENTINEL_INFO[1]})"
REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]}
REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]}
+ else
+ REDIS_MASTER_HOST="$master_in_persisted_conf"
+ REDIS_MASTER_PORT_NUMBER="$REDISPORT"
+ fi
+ if [[ "$REDIS_MASTER_HOST" == "$(get_full_hostname "$HOSTNAME")" ]]; then
+ export REDIS_REPLICATION_MODE="master"
+ else
+ export REDIS_REPLICATION_MODE="replica"
fi
if [[ -n "$REDIS_EXTERNAL_MASTER_HOST" ]]; then
REDIS_MASTER_HOST="$REDIS_EXTERNAL_MASTER_HOST"
REDIS_MASTER_PORT_NUMBER="${REDIS_EXTERNAL_MASTER_PORT}"
fi
- cp /opt/bitnami/redis-sentinel/mounted-etc/sentinel.conf /opt/bitnami/redis-sentinel/etc/sentinel.conf
- printf "\nsentinel myid %s" "$(host_id "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
+ # To prevent incomplete configuration and as the redis container accesses /opt/bitnami/redis-sentinel/etc/sentinel.conf
+ # as well, prepare the new config in `prepare-sentinel.conf` and move it atomically to the ultimate destination when it is complete.
+ cp /opt/bitnami/redis-sentinel/mounted-etc/sentinel.conf /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+ printf "\nsentinel myid %s" "$(host_id "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
if [[ -z "$REDIS_MASTER_HOST" ]] || [[ -z "$REDIS_MASTER_PORT_NUMBER" ]]
then
# Prevent incorrect configuration to be written to sentinel.conf
error "Redis master host is configured incorrectly (host: $REDIS_MASTER_HOST, port: $REDIS_MASTER_PORT_NUMBER)"
exit 1
@@ -277,17 +292,18 @@
hostname="redis-node-$node"
ip="$(getent hosts "$hostname.$HEADLESS_SERVICE" | awk '{ print $1 }')"
add_known_sentinel "$hostname" "$ip"
add_known_replica "$hostname" "$ip"
done
- echo "" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
- echo "sentinel announce-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
- echo "sentinel resolve-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
- echo "sentinel announce-port $SERVPORT" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
- echo "sentinel announce-ip $(get_full_hostname "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf
+ echo "" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+ echo "sentinel announce-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+ echo "sentinel resolve-hostnames yes" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+ echo "sentinel announce-port $SERVPORT" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+ echo "sentinel announce-ip $(get_full_hostname "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf
+ mv /opt/bitnami/redis-sentinel/etc/prepare-sentinel.conf /opt/bitnami/redis-sentinel/etc/sentinel.conf
exec redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel
prestop-sentinel.sh: |
#!/bin/bash
. /opt/bitnami/scripts/libvalidations.sh
. /opt/bitnami/scripts/libos.sh
@@ -299,13 +315,13 @@
full_hostname="${hostname}.${HEADLESS_SERVICE}"
echo "${full_hostname}"
}
run_sentinel_command() {
if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then
- redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_PORT" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@"
+ redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_TLS_PORT_NUMBER" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@"
else
redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_PORT" sentinel "$@"
fi
}
sentinel_failover_finished() {
REDIS_SENTINEL_INFO=($(run_sentinel_command get-master-addr-by-name "redis-master"))
@@ -354,13 +370,13 @@
full_hostname="${hostname}.${HEADLESS_SERVICE}"
echo "${full_hostname}"
}
run_sentinel_command() {
if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then
- env -u REDISCLI_AUTH redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_PORT" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@"
+ env -u REDISCLI_AUTH redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_TLS_PORT_NUMBER" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@"
else
env -u REDISCLI_AUTH redis-cli -h "$REDIS_SERVICE" -p "$REDIS_SENTINEL_PORT" sentinel "$@"
fi
}
sentinel_failover_finished() {
REDIS_SENTINEL_INFO=($(run_sentinel_command get-master-addr-by-name "redis-master"))
--- HelmRelease: database/redis StatefulSet: database/redis-node
+++ HelmRelease: database/redis StatefulSet: database/redis-node
@@ -8,12 +8,13 @@
app.kubernetes.io/instance: redis
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: redis
app.kubernetes.io/component: node
spec:
replicas: 3
+ revisionHistoryLimit: 10
selector:
matchLabels:
app.kubernetes.io/instance: redis
app.kubernetes.io/name: redis
app.kubernetes.io/component: node
serviceName: redis-headless
@@ -26,20 +27,23 @@
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: redis
app.kubernetes.io/component: node
annotations:
checksum/configmap: 44827545caa1794c0c6696c4406beb71e64dd804ef278fe070efe561c4bc71b7
checksum/health: 07a9e9f1ff08347b0d2cd65e962feb94d6390f5b64a77ed1346867af2559df4a
- checksum/scripts: 04c034490f9758104676b11f6819c4f159bb0e4956d61091bf6dd68a76b327aa
+ checksum/scripts: aae9d6391abdd7877b9bc4cc8f75cd0ab9ba7f8241335f066f04e3e94a7e7a5e
checksum/secret: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
prometheus.io/port: '9121'
prometheus.io/scrape: 'true'
spec:
+ automountServiceAccountToken: false
securityContext:
fsGroup: 1001
- automountServiceAccountToken: true
+ fsGroupChangePolicy: Always
+ supplementalGroups: []
+ sysctls: []
serviceAccountName: redis
affinity:
podAffinity: null
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
@@ -52,13 +56,13 @@
weight: 1
nodeAffinity: null
enableServiceLinks: true
terminationGracePeriodSeconds: 30
containers:
- name: redis
- image: registry-1.docker.io/bitnami/redis:7.2.3-debian-11-r2
+ image: docker.io/bitnami/redis:7.4.1-debian-12-r2
imagePullPolicy: IfNotPresent
lifecycle:
preStop:
exec:
command:
- /bin/bash
@@ -66,15 +70,17 @@
- /opt/bitnami/scripts/start-scripts/prestop-redis.sh
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
- runAsGroup: 0
+ readOnlyRootFilesystem: true
+ runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
+ seLinuxOptions: {}
seccompProfile:
type: RuntimeDefault
command:
- /bin/bash
args:
- -c
@@ -130,29 +136,39 @@
exec:
command:
- sh
- -c
- /health/ping_readiness_local.sh 1
resources:
- limits: {}
- requests: {}
+ limits:
+ cpu: 150m
+ ephemeral-storage: 2Gi
+ memory: 192Mi
+ requests:
+ cpu: 100m
+ ephemeral-storage: 50Mi
+ memory: 128Mi
volumeMounts:
- name: start-scripts
mountPath: /opt/bitnami/scripts/start-scripts
- name: health
mountPath: /health
+ - name: sentinel-data
+ mountPath: /opt/bitnami/redis-sentinel/etc
- name: redis-data
mountPath: /data
- name: config
mountPath: /opt/bitnami/redis/mounted-etc
- - name: redis-tmp-conf
+ - name: empty-dir
mountPath: /opt/bitnami/redis/etc
- - name: tmp
+ subPath: app-conf-dir
+ - name: empty-dir
mountPath: /tmp
+ subPath: tmp-dir
- name: sentinel
- image: registry-1.docker.io/bitnami/redis-sentinel:7.2.3-debian-11-r2
+ image: docker.io/bitnami/redis-sentinel:7.4.1-debian-12-r2
imagePullPolicy: IfNotPresent
lifecycle:
preStop:
exec:
command:
- /bin/bash
@@ -160,15 +176,17 @@
- /opt/bitnami/scripts/start-scripts/prestop-sentinel.sh
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
- runAsGroup: 0
+ readOnlyRootFilesystem: true
+ runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
+ seLinuxOptions: {}
seccompProfile:
type: RuntimeDefault
command:
- /bin/bash
args:
- -c
@@ -216,36 +234,47 @@
exec:
command:
- sh
- -c
- /health/ping_sentinel.sh 1
resources:
- limits: {}
- requests: {}
+ limits:
+ cpu: 150m
+ ephemeral-storage: 2Gi
+ memory: 192Mi
+ requests:
+ cpu: 100m
+ ephemeral-storage: 50Mi
+ memory: 128Mi
volumeMounts:
+ - name: empty-dir
+ mountPath: /tmp
+ subPath: tmp-dir
- name: start-scripts
mountPath: /opt/bitnami/scripts/start-scripts
- name: health
mountPath: /health
- name: sentinel-data
mountPath: /opt/bitnami/redis-sentinel/etc
- name: redis-data
mountPath: /data
- name: config
mountPath: /opt/bitnami/redis-sentinel/mounted-etc
- name: metrics
- image: registry-1.docker.io/bitnami/redis-exporter:1.55.0-debian-11-r3
+ image: docker.io/bitnami/redis-exporter:1.66.0-debian-12-r2
imagePullPolicy: IfNotPresent
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
- runAsGroup: 0
+ readOnlyRootFilesystem: true
+ runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
+ seLinuxOptions: {}
seccompProfile:
type: RuntimeDefault
command:
- /bin/bash
- -c
- |
@@ -253,12 +282,14 @@
export REDIS_PASSWORD=$(cat /secrets/redis-password)
fi
redis_exporter
env:
- name: REDIS_ALIAS
value: redis
+ - name: REDIS_EXPORTER_WEB_LISTEN_ADDRESS
+ value: :9121
ports:
- name: metrics
containerPort: 9121
livenessProbe:
failureThreshold: 5
initialDelaySeconds: 10
@@ -274,15 +305,24 @@
successThreshold: 1
timeoutSeconds: 1
httpGet:
path: /
port: metrics
resources:
- limits: {}
- requests: {}
- volumeMounts: null
+ limits:
+ cpu: 150m
+ ephemeral-storage: 2Gi
+ memory: 192Mi
+ requests:
+ cpu: 100m
+ ephemeral-storage: 50Mi
+ memory: 128Mi
+ volumeMounts:
+ - name: empty-dir
+ mountPath: /tmp
+ subPath: tmp-dir
volumes:
- name: start-scripts
configMap:
name: redis-scripts
defaultMode: 493
- name: health
@@ -291,13 +331,11 @@
defaultMode: 493
- name: config
configMap:
name: redis-configuration
- name: sentinel-data
emptyDir: {}
- - name: redis-tmp-conf
- emptyDir: {}
- - name: tmp
+ - name: empty-dir
emptyDir: {}
- name: redis-data
emptyDir: {}
--- HelmRelease: database/redis NetworkPolicy: database/redis
+++ HelmRelease: database/redis NetworkPolicy: database/redis
@@ -0,0 +1,27 @@
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+ name: redis
+ namespace: database
+ labels:
+ app.kubernetes.io/instance: redis
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: redis
+spec:
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/instance: redis
+ app.kubernetes.io/name: redis
+ policyTypes:
+ - Ingress
+ - Egress
+ egress:
+ - {}
+ ingress:
+ - ports:
+ - port: 6379
+ - port: 26379
+ - ports:
+ - port: 9121
+
--- HelmRelease: database/redis PodDisruptionBudget: database/redis-node
+++ HelmRelease: database/redis PodDisruptionBudget: database/redis-node
@@ -0,0 +1,19 @@
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+ name: redis-node
+ namespace: database
+ labels:
+ app.kubernetes.io/instance: redis
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: redis
+ app.kubernetes.io/component: node
+spec:
+ maxUnavailable: 1
+ selector:
+ matchLabels:
+ app.kubernetes.io/instance: redis
+ app.kubernetes.io/name: redis
+ app.kubernetes.io/component: node
+ |
renovate
bot
force-pushed
the
renovate/redis-20.x
branch
2 times, most recently
from
403d6c8
to
d5a7094
Compare
renovate
bot
force-pushed
the
renovate/redis-20.x
branch
3 times, most recently
from
065f466
to
cf6a40f
Compare
renovate
bot
force-pushed
the
renovate/redis-20.x
branch
4 times, most recently
from
5a35ee5
to
247705c
Compare
renovate
bot
force-pushed
the
renovate/redis-20.x
branch
2 times, most recently
from
9da5241
to
1cd0d2a
Compare
renovate
bot
force-pushed
the
renovate/redis-20.x
branch
2 times, most recently
from
f389174
to
f93dc9e
Compare
renovate
bot
force-pushed
the
renovate/redis-20.x
branch
2 times, most recently
from
68895d0
to
a66ae00
Compare
renovate
bot
force-pushed
the
renovate/redis-20.x
branch
3 times, most recently
from
22e4e81
to
7fd863f
Compare
renovate
bot
force-pushed
the
renovate/redis-20.x
branch
from
7fd863f
to
39417f9
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
18.6.1->20.3.0Release Notes
bitnami/charts (redis)
v20.3.0v20.2.2v20.2.1v20.2.0v20.1.7v20.1.6v20.1.5v20.1.4v20.1.3v20.1.2v20.1.1v20.1.0v20.0.5v20.0.4v20.0.3v20.0.2v20.0.1v20.0.0v19.6.4v19.6.3v19.6.2v19.6.1v19.6.0v19.5.5v19.5.4v19.5.3v19.5.2v19.5.1v19.5.0v19.4.0v19.3.4v19.3.3v19.3.2v19.3.1v19.3.0v19.2.0v19.1.5v19.1.3v19.1.2v19.1.1v19.1.0v19.0.2v19.0.1v19.0.0v18.19.4v18.19.3v18.19.2v18.19.1v18.19.0v18.18.1v18.18.0v18.17.1v18.17.0v18.16.1v18.16.0v18.15.1v18.13.0v18.12.1v18.12.0v18.11.1v18.11.0v18.10.0v18.9.1v18.9.0v18.8.3v18.8.2v18.8.0v18.7.1v18.7.0v18.6.4v18.6.3v18.6.2Configuration
📅 Schedule: Branch creation - "on saturday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.