Skip to content

Commit 43434d6

Browse files
fernandezcuestakiblik
fernandezcuesta
and
kiblik
authored
feat: improve Helm chart (#12691)
* **Summary:** - Add extraInitContainers to celery+django deployments. - Add extraEnv to all deployments - Remove existing volume logic in favor of agnostic extraVolumes and extraVolumeMounts - Fix optional secret mounts + reference - Update bitnami chart reference (OCI) - Bump up redis chart * chore: add livenessProbe entries for celery * fix: reference to removed field * fix: conflict * chore: add reference to upstream chart * fix: missing default values from upstream chart used in templates * chore: rephrase * feat: allow deploy secret as regular non-hooked resources * fix: review * chore: restore Chart.lock * chore: update chart.lock * chore: wrap services url * fix: PR review suggestions * chore: mount extraVolumes in initContainers too * chore: move external db values to separate fields, add release notes * Update docs/content/en/open_source/upgrading/2.50.md Co-authored-by: kiblik <5609770+kiblik@users.noreply.github.com> * chore: bump chart version and remove bitnami dependency comment from RN * chore: move release notes to 2.51 * chore: restore 2.50.md --------- Co-authored-by: kiblik <5609770+kiblik@users.noreply.github.com>
1 parent 79a292b commit 43434d6

File tree

15 files changed

+318
-248
lines changed

15 files changed

+318
-248
lines changed

‎.github/workflows/k8s-tests.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -108,17 +108,17 @@ jobs:
108108
echo "INFO: status:"
109109
kubectl get pods
110110
echo "INFO: logs:"
111-
kubectl logs --selector=$3 --all-containers=true
111+
kubectl logs --selector=$3 --all-containers=true
112112
exit 1
113113
fi
114114
return ${?}
115115
}
116116
echo "Waiting for init job..."
117-
to_complete "condition=Complete" job "defectdojo.org/component=initializer"
117+
to_complete "condition=Complete" job "defectdojo.org/component=initializer"
118118
echo "Waiting for celery pods..."
119-
to_complete "condition=ready" pod "defectdojo.org/component=celery"
119+
to_complete "condition=ready" pod "defectdojo.org/component=celery"
120120
echo "Waiting for django pod..."
121-
to_complete "condition=ready" pod "defectdojo.org/component=django"
121+
to_complete "condition=ready" pod "defectdojo.org/component=django"
122122
echo "Pods up and ready to rumbole"
123123
kubectl get pods
124124
RETRY=0
@@ -132,15 +132,15 @@ jobs:
132132
--max-time 20 \
133133
--head \
134134
--header "Host: $DD_HOSTNAME" \
135-
http://$DJANGO_IP/login?next=/)
135+
"http://${DJANGO_IP}/login?next=/")
136136
echo $OUT
137-
CR=`echo $OUT | egrep "^HTTP" | cut -d' ' -f2`
137+
CR=$(echo $OUT | egrep "^HTTP" | cut -d' ' -f2)
138138
echo $CR
139139
if [[ $CR -ne 200 ]]; then
140140
echo $RETRY
141141
if [[ $RETRY -gt 2 ]]; then
142142
kubectl get pods
143-
echo `kubectl logs --tail=30 -l defectdojo.org/component=django -c uwsgi`
143+
echo $(kubectl logs --tail=30 -l defectdojo.org/component=django -c uwsgi)
144144
echo "ERROR: cannot display login screen; got HTTP code $CR"
145145
exit 1
146146
else
@@ -165,7 +165,7 @@ jobs:
165165
--data-raw "username=admin&password=$ADMIN_PASS" \
166166
--output /dev/null \
167167
--write-out "%{http_code}\n" \
168-
http://$DJANGO_IP/api/v2/api-token-auth/)
168+
"http://${DJANGO_IP}/api/v2/api-token-auth/")
169169
echo $CR
170170
if [[ $CR -ne 200 ]]; then
171171
echo "ERROR: login is not possible; got HTTP code $CR"
@@ -174,8 +174,8 @@ jobs:
174174
echo "Result received"
175175
fi
176176
echo "Final Check of components"
177-
errors=`kubectl get pods | grep Error | awk '{print $1}'`
178-
if [[ ! -z $errors ]]; then
177+
errors=$(kubectl get pods | grep Error | awk '{print $1}')
178+
if [[ ! -z $errors ]]; then
179179
echo "Few pods with errors"
180180
for line in $errors; do
181181
echo "Dumping log from $line"

‎docs/content/en/open_source/upgrading/2.51.md‎

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,48 @@
22
title: 'Upgrading to DefectDojo Version 2.51.x'
33
toc_hide: true
44
weight: -20250902
5-
description: No special instructions.
5+
description: Helm chart changes.
66
---
7-
There are no special instructions for upgrading to 2.51.x. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.51.0) for the contents of the release.
7+
8+
## Helm Chart Changes
9+
10+
This release introduces several important changes to the Helm chart configuration:
11+
12+
### Breaking changes
13+
14+
#### Volume Management Improvements
15+
16+
- **Streamlined volume configuration**: The existing volume logic has been removed and replaced with more flexible `extraVolumes` and `extraVolumeMounts` options that provide deployment-agnostic volume management.
17+
18+
> The previous volume implementation prevented mounting projected volumes (such as secret mounts with renamed key names) and per-container volume mounts (like nginx emptyDir when readOnlyRootFs is enforced).
19+
> The new approach resolves these limitations.
20+
21+
#### Moved values
22+
23+
The following Helm chart values have been modified in this release:
24+
25+
- `redis.transportEncryption.enabled` → `redis.tls.enabled` (aligned with upstream Helm chart)
26+
- `redis.scheme` → `redis.sentinel.enabled` (controls deployment mode and aligns with upstream chart)
27+
- `redis.redisServer` → `redisServer` (prevents potential schema conflicts with upstream chart)
28+
- `redis.transportEncryption.params` → `redisParams` (prevents potential schema conflicts with upstream chart)
29+
- `postgresql.postgresServer` → `postgresServer` (prevents potential schema conflicts with upstream chart)
30+
31+
### New features
32+
33+
#### Container and Environment Enhancements
34+
35+
- **Added extraInitContainers support**: Both Celery and Django deployments now support additional init containers through the `extraInitContainers` configuration option.
36+
- **Enhanced probe configuration for Celery**: Added support for customizing liveness, readiness, and startup probes in both Celery beat and worker deployments.
37+
- **Enhanced environment variable management**: All deployments now include `extraEnv` support for adding custom environment variables. For backwards compatibility, `.Values.extraEnv` can be used to inject common environment variables to all workloads.
38+
39+
### Other changes
40+
41+
- **Celery pod annotations**: Now we can add annotations to Celery beat/worker pods separately.
42+
- **Flexible secret deployment**: Added the capability to deploy secrets as regular (non-hooked) resources to address compatibility issues encountered with CI/CD tools (such as ArgoCD).
43+
- **Optional secret references**: Some secret references are now optional, allowing the chart to function even when certain secrets are not created.
44+
- **Fixed secret mounting**: Resolved issues with optional secret mounts and references.
45+
- **Improved code organization**: Minor Helm chart refactoring to enhance readability and maintainability.
46+
47+
---
48+
49+
There are other instructions for upgrading to 2.51.x. Check the [Release Notes](https://github.com/DefectDojo/django-DefectDojo/releases/tag/2.51.0) for the contents of the release.

‎helm/defectdojo/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
appVersion: "2.51.0-dev"
33
description: A Helm chart for Kubernetes to install DefectDojo
44
name: defectdojo
5-
version: 1.6.206-dev
5+
version: 1.7.0-dev
66
icon: https://www.defectdojo.org/img/favicon.ico
77
maintainers:
88
- name: madchap

‎helm/defectdojo/templates/_helpers.tpl‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,16 @@ Create the name of the service account to use
5353
{{- printf "%s-%s" .Release.Name "postgresql" | trunc 63 | trimSuffix "-" -}}
5454
{{- end -}}
5555
{{- else -}}
56-
{{- printf "%s" ( .Values.postgresql.postgresServer | default "127.0.0.1" ) -}}
56+
{{- .Values.postgresServer | default "127.0.0.1" | quote -}}
5757
{{- end -}}
5858
{{- end -}}
59+
5960
{{- define "redis.hostname" -}}
6061
{{- if eq .Values.celery.broker "redis" -}}
6162
{{- if .Values.redis.enabled -}}
6263
{{- printf "%s-%s" .Release.Name "redis-master" | trunc 63 | trimSuffix "-" -}}
6364
{{- else -}}
64-
{{- printf "%s" (.Values.celery.brokerHost | default .Values.redis.redisServer) -}}
65+
{{- .Values.redisServer | default "127.0.0.1" | quote -}}
6566
{{- end -}}
6667
{{- end -}}
6768
{{- end -}}
@@ -71,9 +72,9 @@ Create the name of the service account to use
7172
*/}}
7273
{{- define "redis.scheme" -}}
7374
{{- if eq .Values.celery.broker "redis" -}}
74-
{{- if .Values.redis.transportEncryption.enabled -}}
75+
{{- if .Values.redis.tls.enabled -}}
7576
{{- printf "rediss" -}}
76-
{{- else if eq .Values.redis.scheme "sentinel" -}}
77+
{{- else if .Values.redis.sentinel.enabled -}}
7778
{{- printf "sentinel" -}}
7879
{{- else -}}
7980
{{- printf "redis" -}}

‎helm/defectdojo/templates/celery-beat-deployment.yaml‎

Lines changed: 33 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -11,18 +11,16 @@ metadata:
1111
app.kubernetes.io/managed-by: {{ .Release.Service }}
1212
helm.sh/chart: {{ include "defectdojo.chart" . }}
1313
{{- with .Values.extraLabels }}
14-
{{- toYaml . | nindent 4 }}
14+
{{- toYaml . | nindent 4 }}
1515
{{- end }}
16-
{{- if .Values.celery.annotations }}
16+
{{- with mergeOverwrite .Values.celery.annotations .Values.celery.beat.annotations }}
1717
annotations:
18-
{{- with .Values.celery.annotations }}
19-
{{- toYaml . | nindent 4 }}
20-
{{- end }}
21-
{{- end }}
18+
{{- toYaml . | nindent 4 }}
19+
{{- end }}
2220
spec:
2321
replicas: {{ .Values.celery.beat.replicas }}
24-
{{- if .Values.revisionHistoryLimit }}
25-
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
22+
{{- with .Values.revisionHistoryLimit }}
23+
revisionHistoryLimit: {{ . }}
2624
{{- end }}
2725
selector:
2826
matchLabels:
@@ -44,7 +42,7 @@ spec:
4442
{{- toYaml . | nindent 8 }}
4543
{{- end }}
4644
annotations:
47-
{{- with .Values.celery.beat.annotations }}
45+
{{- with mergeOverwrite .Values.celery.annotations .Values.celery.beat.podAnnotations }}
4846
{{- toYaml . | nindent 8 }}
4947
{{- end }}
5048
{{- if eq (.Values.trackConfig | default "disabled") "enabled" }}
@@ -54,9 +52,9 @@ spec:
5452
{{- end }}
5553
spec:
5654
serviceAccountName: {{ include "defectdojo.serviceAccountName" . }}
57-
{{- if .Values.imagePullSecrets }}
55+
{{- with .Values.imagePullSecrets }}
5856
imagePullSecrets:
59-
- name: {{ .Values.imagePullSecrets }}
57+
- name: {{ . }}
6058
{{- end }}
6159
volumes:
6260
- name: run
@@ -71,22 +69,16 @@ spec:
7169
configMap:
7270
name: {{ .Values.django.uwsgi.certificates.configName }}
7371
{{- end }}
74-
{{- range .Values.celery.extraVolumes }}
75-
- name: userconfig-{{ .name }}
76-
{{ .type }}:
77-
{{- if (eq .type "configMap") }}
78-
name: {{ .name }}
79-
{{- else if (eq .type "secret") }}
80-
secretName: {{ .name }}
81-
{{- else if (eq .type "hostPath") }}
82-
type: {{ .pathType | default "Directory" }}
83-
path: {{ .hostPath }}
84-
{{- end }}
72+
{{- with .Values.celery.beat.extraVolumes }}
73+
{{- . | toYaml | nindent 6 }}
8574
{{- end }}
86-
{{- if or .Values.dbMigrationChecker.enabled .Values.cloudsql.enabled }}
75+
{{- if coalesce .Values.dbMigrationChecker.enabled .Values.cloudsql.enabled .Values.celery.beat.extraInitContainers }}
8776
initContainers:
77+
{{- range .Values.celery.beat.extraInitContainers }}
78+
- {{- . | toYaml | nindent 8 }}
79+
{{- end }}
8880
{{- end }}
89-
{{- if .Values.cloudsql.enabled }}
81+
{{- if .Values.cloudsql.enabled }}
9082
- name: cloudsql-proxy
9183
image: {{ .Values.cloudsql.image.repository }}:{{ .Values.cloudsql.image.tag }}
9284
imagePullPolicy: {{ .Values.cloudsql.image.pullPolicy }}
@@ -115,6 +107,15 @@ spec:
115107
name: celery
116108
image: "{{ template "celery.repository" . }}:{{ .Values.tag }}"
117109
imagePullPolicy: {{ .Values.imagePullPolicy }}
110+
{{- with .Values.celery.beat.livenessProbe }}
111+
livenessProbe: {{ toYaml . | nindent 10 }}
112+
{{- end }}
113+
{{- with .Values.celery.beat.readinessProbe }}
114+
readinessProbe: {{ toYaml . | nindent 10 }}
115+
{{- end }}
116+
{{- with .Values.celery.beat.startupProbe }}
117+
startupProbe: {{ toYaml . | nindent 10 }}
118+
{{- end }}
118119
{{- if .Values.securityContext.enabled }}
119120
securityContext:
120121
{{- toYaml .Values.securityContext.djangoSecurityContext | nindent 10 }}
@@ -128,15 +129,12 @@ spec:
128129
mountPath: /app/dojo/settings/local_settings.py
129130
subPath: file
130131
{{- end }}
131-
{{- if .Values.django.uwsgi.certificates.enabled }}
132+
{{- if .Values.django.uwsgi.certificates.enabled }}
132133
- name: cert-mount
133134
mountPath: {{ .Values.django.uwsgi.certificates.certMountPath }}
134135
{{- end }}
135-
{{- range .Values.celery.extraVolumes }}
136-
- name: userconfig-{{ .name }}
137-
readOnly: true
138-
mountPath: {{ .path }}
139-
subPath: {{ .subPath }}
136+
{{- with .Values.celery.beat.extraVolumeMounts }}
137+
{{- . | toYaml | nindent 8 }}
140138
{{- end }}
141139
envFrom:
142140
- configMapRef:
@@ -162,8 +160,12 @@ spec:
162160
secretKeyRef:
163161
name: {{ $fullName }}
164162
key: DD_SECRET_KEY
163+
optional: true
165164
{{- with .Values.extraEnv }}
166-
{{- toYaml . | nindent 8 }}
165+
{{- . | toYaml | nindent 8 }}
166+
{{- end }}
167+
{{- with .Values.celery.beat.extraEnv }}
168+
{{- . | toYaml | nindent 8 }}
167169
{{- end }}
168170
resources:
169171
{{- toYaml .Values.celery.beat.resources | nindent 10 }}

‎helm/defectdojo/templates/celery-worker-deployment.yaml‎

Lines changed: 31 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,14 @@ metadata:
1313
{{- with .Values.extraLabels }}
1414
{{- toYaml . | nindent 4 }}
1515
{{- end }}
16-
{{- if .Values.celery.annotations }}
16+
{{- with mergeOverwrite .Values.celery.annotations .Values.celery.worker.annotations }}
1717
annotations:
18-
{{- with .Values.celery.annotations }}
19-
{{- toYaml . | nindent 4 }}
20-
{{- end }}
21-
{{- end }}
18+
{{- toYaml . | nindent 4 }}
19+
{{- end }}
2220
spec:
2321
replicas: {{ .Values.celery.worker.replicas }}
24-
{{- if .Values.revisionHistoryLimit }}
25-
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
22+
{{- with .Values.revisionHistoryLimit }}
23+
revisionHistoryLimit: {{ . }}
2624
{{- end }}
2725
selector:
2826
matchLabels:
@@ -44,7 +42,7 @@ spec:
4442
{{- toYaml . | nindent 8 }}
4543
{{- end }}
4644
annotations:
47-
{{- with .Values.celery.worker.annotations }}
45+
{{- with mergeOverwrite .Values.celery.annotations .Values.celery.worker.podAnnotations }}
4846
{{- toYaml . | nindent 8 }}
4947
{{- end }}
5048
{{- if eq (.Values.trackConfig | default "disabled") "enabled" }}
@@ -54,9 +52,9 @@ spec:
5452
{{- end }}
5553
spec:
5654
serviceAccountName: {{ include "defectdojo.serviceAccountName" . }}
57-
{{- if .Values.imagePullSecrets }}
55+
{{- with .Values.imagePullSecrets }}
5856
imagePullSecrets:
59-
- name: {{ .Values.imagePullSecrets }}
57+
- name: {{ . }}
6058
{{- end }}
6159
volumes:
6260
{{- if .Values.localsettingspy }}
@@ -69,20 +67,14 @@ spec:
6967
configMap:
7068
name: {{ .Values.django.uwsgi.certificates.configName }}
7169
{{- end }}
72-
{{- range .Values.celery.extraVolumes }}
73-
- name: userconfig-{{ .name }}
74-
{{ .type }}:
75-
{{- if (eq .type "configMap") }}
76-
name: {{ .name }}
77-
{{- else if (eq .type "secret") }}
78-
secretName: {{ .name }}
79-
{{- else if (eq .type "hostPath") }}
80-
type: {{ .pathType | default "Directory" }}
81-
path: {{ .hostPath }}
82-
{{- end }}
70+
{{- with .Values.celery.worker.extraVolumes }}
71+
{{- . | toYaml | nindent 6 }}
8372
{{- end }}
84-
{{- if or .Values.dbMigrationChecker.enabled .Values.cloudsql.enabled }}
73+
{{- if coalesce .Values.dbMigrationChecker.enabled .Values.cloudsql.enabled .Values.celery.worker.extraInitContainers }}
8574
initContainers:
75+
{{- range .Values.celery.worker.extraInitContainers }}
76+
- {{- . | toYaml | nindent 8 }}
77+
{{- end }}
8678
{{- end }}
8779
{{- if .Values.cloudsql.enabled }}
8880
- name: cloudsql-proxy
@@ -111,13 +103,22 @@ spec:
111103
- name: celery
112104
image: "{{ template "celery.repository" . }}:{{ .Values.tag }}"
113105
imagePullPolicy: {{ .Values.imagePullPolicy }}
106+
{{- with .Values.celery.worker.livenessProbe }}
107+
livenessProbe: {{ toYaml . | nindent 10 }}
108+
{{- end }}
109+
{{- with .Values.celery.worker.readinessProbe }}
110+
readinessProbe: {{ toYaml . | nindent 10 }}
111+
{{- end }}
112+
{{- with .Values.celery.worker.startupProbe }}
113+
startupProbe: {{ toYaml . | nindent 10 }}
114+
{{- end }}
114115
{{- if .Values.securityContext.enabled }}
115116
securityContext:
116117
{{- toYaml .Values.securityContext.djangoSecurityContext | nindent 10 }}
117118
{{- end }}
118119
command: ['/entrypoint-celery-worker.sh']
119120
volumeMounts:
120-
{{- if .Values.localsettingspy }}
121+
{{- if .Values.localsettingspy }}
121122
- name: localsettingspy
122123
readOnly: true
123124
mountPath: /app/dojo/settings/local_settings.py
@@ -127,11 +128,8 @@ spec:
127128
- name: cert-mount
128129
mountPath: {{ .Values.django.uwsgi.certificates.certMountPath }}
129130
{{- end }}
130-
{{- range .Values.celery.extraVolumes }}
131-
- name: userconfig-{{ .name }}
132-
readOnly: true
133-
mountPath: {{ .path }}
134-
subPath: {{ .subPath }}
131+
{{- with .Values.celery.worker.extraVolumeMounts }}
132+
{{- . | toYaml | nindent 8 }}
135133
{{- end }}
136134
envFrom:
137135
- configMapRef:
@@ -157,8 +155,12 @@ spec:
157155
secretKeyRef:
158156
name: {{ $fullName }}
159157
key: DD_SECRET_KEY
158+
optional: true
160159
{{- with .Values.extraEnv }}
161-
{{- toYaml . | nindent 8 }}
160+
{{- . | toYaml | nindent 8 }}
161+
{{- end }}
162+
{{- with .Values.celery.worker.extraEnv }}
163+
{{- . | toYaml | nindent 8 }}
162164
{{- end }}
163165
resources:
164166
{{- toYaml .Values.celery.worker.resources | nindent 10 }}

0 commit comments

Comments
 (0)