Running all stack

2026-01-06 08:23:16 +01:00
parent 5a0651106d
commit 3d416169e3
56 changed files with 1974 additions and 435 deletions
--- a/opencloud/charts/mongodb/values.yaml
+++ b/opencloud/charts/mongodb/values.yaml
@@ -12,6 +12,7 @@
 ## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)
 ## @param global.storageClass DEPRECATED: use global.defaultStorageClass instead
 ## @param global.namespaceOverride Override the namespace for resource deployed by the chart, but can itself be overridden by the local namespaceOverride
+## @param global.defaultFips Default value for the FIPS configuration (allowed values: '', restricted, relaxed, off). Can be overriden by the 'fips' object
 ##
 global:
  imageRegistry: ""
@@ -22,6 +23,11 @@ global:
  imagePullSecrets: []
  defaultStorageClass: ""
  storageClass: ""
+  ## Security parameters
+  ##
+  security:
+    ## @param global.security.allowInsecureImages Allows skipping image verification
+    allowInsecureImages: false
  namespaceOverride: ""
  ## Compatibility adaptations for Kubernetes platforms
  ##
@@ -32,6 +38,9 @@ global:
      ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
      ##
      adaptSecurityContext: auto
+  ##  Configure FIPS mode: '', 'restricted', 'relaxed', 'off'
+  ##
+  defaultFips: restricted
 ## @section Common parameters
 ##

@@ -101,6 +110,9 @@ serviceBindings:
 ## If you experience slow pod startups or slow running of the scripts you probably want to set this to `false`.
 ##
 enableServiceLinks: true
+## @param usePasswordFiles Mount credentials as files instead of using environment variables
+##
+usePasswordFiles: true
 ## Enable diagnostic mode in the deployment
 ##
 diagnosticMode:
@@ -129,9 +141,9 @@ diagnosticMode:
 ## @param image.debug Set to true if you would like to see extra information on logs
 ##
 image:
-  registry: docker.io
+  registry: registry-1.docker.io
  repository: bitnami/mongodb
-  tag: 8.0.3-debian-12-r0
+  tag: latest
  digest: ""
  ## Specify a imagePullPolicy
  ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
@@ -255,9 +267,9 @@ tls:
  ## @param tls.extraDnsNames Add extra dns names to the CA, can solve x509 auth issue for pod clients
  ##
  image:
-    registry: docker.io
+    registry: registry-1.docker.io
    repository: bitnami/nginx
-    tag: 1.27.2-debian-12-r2
+    tag: latest
    digest: ""
    pullPolicy: IfNotPresent
    ## Optionally specify an array of imagePullSecrets.
@@ -298,6 +310,10 @@ tls:
  ##     memory: 1024Mi
  ##
  resources: {}
+  ## @param tls.fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+  ##
+  fips:
+    openssl: ""
  ## Init Container securityContext
  ## ref: https://kubernetes.io/docs/concepts/security/pod-security-policy/
  ## @param tls.securityContext Init container generate-tls-cert Security context
@@ -614,6 +630,10 @@ resourcesPreset: "small"
 ##     memory: 1024Mi
 ##
 resources: {}
+## @param fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+##
+fips:
+  openssl: ""
 ## @param containerPorts.mongodb MongoDB(&reg;) container port
 ##
 containerPorts:
@@ -802,12 +822,11 @@ service:
  ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
  ##
  externalTrafficPolicy: Local
-  ## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin
-  ## Values: ClientIP or None
+  ## @param service.sessionAffinity Control where client requests go, to the same pod or round-robin. Allowed values: `ClientIP` or `None`
  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/
  ##
  sessionAffinity: None
-  ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity
+  ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity. Ignored if `service.sessionAffinity` is `None`
  ## sessionAffinityConfig:
  ##   clientIP:
  ##     timeoutSeconds: 300
@@ -819,6 +838,10 @@ service:
    ## @param service.headless.annotations Annotations for the headless service.
    ##
    annotations: {}
+  ## @param service.publishNotReadyAddresses Indicates that any agent which deals with endpoints for this Service should disregard any indications of ready/not-ready
+  ## ref: https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/
+  ##
+  publishNotReadyAddresses: false
 ## External Access to MongoDB(&reg;) nodes configuration
 ##
 externalAccess:
@@ -843,9 +866,9 @@ externalAccess:
    ## @param externalAccess.autoDiscovery.image.pullSecrets Init container auto-discovery image pull secrets
    ##
    image:
-      registry: docker.io
+      registry: registry-1.docker.io
      repository: bitnami/kubectl
-      tag: 1.31.2-debian-12-r3
+      tag: latest
      digest: ""
      ## Specify a imagePullPolicy
      ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
@@ -879,6 +902,10 @@ externalAccess:
    ##     memory: 1024Mi
    ##
    resources: {}
+    ## @param externalAccess.autoDiscovery.fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+    ##
+    fips:
+      openssl: ""
  ## Init container what mission is ensure public names can be resolved.
  ##
  dnsCheck:
@@ -892,9 +919,9 @@ externalAccess:
    ## @param externalAccess.dnsCheck.image.pullSecrets Init container dns-check image pull secrets
    ##
    image:
-      registry: docker.io
+      registry: registry-1.docker.io
      repository: bitnami/os-shell
-      tag: 12-debian-12-r32
+      tag: latest
      digest: ""
      ## Specify a imagePullPolicy
      ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
@@ -928,6 +955,10 @@ externalAccess:
    ##     memory: 1024Mi
    ##
    resources: {}
+    ## @param externalAccess.dnsCheck.fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+    ##
+    fips:
+      openssl: ""
  ## Parameters to configure a set of Pods that connect to an existing MongoDB(&reg;) deployment that lies outside of Kubernetes.
  ## @param externalAccess.externalMaster.enabled Use external master for bootstrapping
  ## @param externalAccess.externalMaster.host External master host to bootstrap from
@@ -1005,12 +1036,11 @@ externalAccess:
    ##     - external-dns.alpha.kubernetes.io/hostname: mongodb-1.example.com
    ##
    annotationsList: []
-    ## @param externalAccess.service.sessionAffinity Control where client requests go, to the same pod or round-robin
-    ## Values: ClientIP or None
+    ## @param externalAccess.service.sessionAffinity Control where client requests go, to the same pod or round-robin. Allowed values: `ClientIP` or `None`
    ## ref: https://kubernetes.io/docs/concepts/services-networking/service/
    ##
    sessionAffinity: None
-    ## @param externalAccess.service.sessionAffinityConfig Additional settings for the sessionAffinity
+    ## @param externalAccess.service.sessionAffinityConfig Additional settings for the sessionAffinity. Ignored if `externalAccess.service.sessionAffinity` is `None`
    ## sessionAffinityConfig:
    ##   clientIP:
    ##     timeoutSeconds: 300
@@ -1080,12 +1110,11 @@ externalAccess:
      ## @param externalAccess.hidden.service.annotations Service annotations for external access
      ##
      annotations: {}
-      ## @param externalAccess.hidden.service.sessionAffinity Control where client requests go, to the same pod or round-robin
-      ## Values: ClientIP or None
+      ## @param externalAccess.hidden.service.sessionAffinity Control where client requests go, to the same pod or round-robin. Allowed values: `ClientIP` or `None`
      ## ref: https://kubernetes.io/docs/concepts/services-networking/service/
      ##
      sessionAffinity: None
-      ## @param externalAccess.hidden.service.sessionAffinityConfig Additional settings for the sessionAffinity
+      ## @param externalAccess.hidden.service.sessionAffinityConfig Additional settings for the sessionAffinity. Ignored if `externalAccess.hidden.service.sessionAffinity` is `None`
      ## sessionAffinityConfig:
      ##   clientIP:
      ##     timeoutSeconds: 300
@@ -1193,6 +1222,10 @@ passwordUpdateJob:
  ##     memory: 1024Mi
  ##
  resources: {}
+  ## @param passwordUpdateJob.fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+  ##
+  fips:
+    openssl: ""
  ## @param passwordUpdateJob.customLivenessProbe Custom livenessProbe that overrides the default one
  ##
  customLivenessProbe: {}
@@ -1220,8 +1253,6 @@ passwordUpdateJob:
  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
  ##
  podAnnotations: {}
-
-
 ## @section Network policy parameters
 ##

@@ -1405,6 +1436,9 @@ backup:
    restartPolicy: OnFailure
    ## @param backup.cronjob.backoffLimit Set the cronjob parameter backoffLimit
    backoffLimit: 6
+    ## @param backup.cronjob.serviceAccount.name Set the cronjob parameter serviceAccountName. If you change from the default values make sure that the SA already exists.
+    serviceAccount:
+      name: "default"
    ## backup container's Security Context
    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
    ## @param backup.cronjob.containerSecurityContext.enabled Enabled containers' Security Context
@@ -1452,6 +1486,10 @@ backup:
    ##     memory: 1024Mi
    ##
    resources: {}
+    ## @param backup.cronjob.fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+    ##
+    fips:
+      openssl: ""
    ## @param backup.cronjob.command Set backup container's command to run
    ##
    command: []
@@ -1618,9 +1656,9 @@ volumePermissions:
  ## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array
  ##
  image:
-    registry: docker.io
+    registry: registry-1.docker.io
    repository: bitnami/os-shell
-    tag: 12-debian-12-r32
+    tag: latest
    digest: ""
    ## Specify a imagePullPolicy
    ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
@@ -1654,6 +1692,10 @@ volumePermissions:
  ##     memory: 1024Mi
  ##
  resources: {}
+  ## @param volumePermissions.fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+  ##
+  fips:
+    openssl: ""
  ## Init container Security Context
  ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser
  ## and not the below volumePermissions.securityContext.runAsUser
@@ -1872,6 +1914,10 @@ arbiter:
  ##     memory: 1024Mi
  ##
  resources: {}
+  ## @param arbiter.fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+  ##
+  fips:
+    openssl: ""
  ## @param arbiter.containerPorts.mongodb MongoDB(&reg;) arbiter container port
  ##
  containerPorts:
@@ -2215,6 +2261,10 @@ hidden:
  ##     memory: 1024Mi
  ##
  resources: {}
+  ## @param hidden.fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+  ##
+  fips:
+    openssl: ""
  ## @param hidden.containerPorts.mongodb MongoDB(&reg;) hidden container port
  ##
  containerPorts:
@@ -2418,9 +2468,9 @@ metrics:
  ## @param metrics.image.pullSecrets Specify docker-registry secret names as an array
  ##
  image:
-    registry: docker.io
+    registry: registry-1.docker.io
    repository: bitnami/mongodb-exporter
-    tag: 0.41.2-debian-12-r1
+    tag: latest
    digest: ""
    pullPolicy: IfNotPresent
    ## Optionally specify an array of imagePullSecrets.
@@ -2494,6 +2544,12 @@ metrics:
  ##     memory: 1024Mi
  ##
  resources: {}
+  ## @param metrics.fips.openssl Configure OpenSSL FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+  ## @param metrics.fips.golang Configure Golang FIPS mode: '', 'restricted', 'relaxed', 'off'. If empty (""), 'global.defaultFips' would be used
+  ##
+  fips:
+    openssl: ""
+    golang: relaxed
  ## @param metrics.containerPort Port of the Prometheus metrics container
  ##
  containerPort: 9216