diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 6400bcd..85f7949 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -277,7 +277,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | | `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tornjak.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `tornjak.image.tag` | Overrides the image tag whose default is the chart appVersion | `v1.4.0` | +| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` | +| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v1.4.1` | | `tornjak.service.type` | Type of service resource | `ClusterIP` | | `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | | `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index ca26abb..1b1f0ed 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -231,7 +231,7 @@ spec: - name: tornjak securityContext: {{- toYaml .Values.controllerManager.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image "global" .Values.global) }} + image: {{ template "spire-lib.image" (dict "appVersion" .Values.tornjak.image.defaultTag "image" .Values.tornjak.image "global" .Values.global "ubi" true) }} imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }} {{- if eq (include "spire-tornjak.connectionType" .) "http" }} startupProbe: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5d2fa3f..3082a50 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -608,14 +608,16 @@ tornjak: ## @param tornjak.image.repository The repository within the registry ## @param tornjak.image.pullPolicy The image pull policy ## @param tornjak.image.version This value is deprecated in favor of tag. (Will be removed in a future release) - ## @param tornjak.image.tag Overrides the image tag whose default is the chart appVersion + ## @param tornjak.image.tag Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications + ## @param tornjak.image.defaultTag Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. ## image: registry: ghcr.io repository: spiffe/tornjak-backend pullPolicy: IfNotPresent version: "" - tag: "v1.4.0" + tag: "" + defaultTag: "v1.4.1" service: ## @param tornjak.service.type Type of service resource diff --git a/charts/spire/charts/tornjak-frontend/Chart.yaml b/charts/spire/charts/tornjak-frontend/Chart.yaml index 1e72c8e..761a916 100644 --- a/charts/spire/charts/tornjak-frontend/Chart.yaml +++ b/charts/spire/charts/tornjak-frontend/Chart.yaml @@ -3,7 +3,7 @@ name: tornjak-frontend description: A Helm chart to deploy Tornjak frontend type: application version: 0.1.0 -appVersion: "v1.4.0" +appVersion: "v1.4.1" home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: - https://github.com/spiffe/tornjak diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml index 8fbf210..5cc188a 100644 --- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml @@ -24,7 +24,7 @@ spec: {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - name: {{ include "tornjak-frontend.fullname" . }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global "ubi" true) }} imagePullPolicy: {{ .Values.image.pullPolicy }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 8536e22..658b0e7 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -55,7 +55,11 @@ {{- if eq (substr 0 7 $tag) "sha256:" }} {{- printf "%s/%s@%s" $registry $repo $tag }} {{- else if .appVersion }} -{{- printf "%s%s:%s" $registry $repo (default .appVersion $tag) }} +{{- $appVersion := .appVersion }} +{{- if and (hasKey . "ubi") (dig "openshift" false .global) }} +{{- $appVersion = printf "ubi-%s" $appVersion }} +{{- end }} +{{- printf "%s%s:%s" $registry $repo (default $appVersion $tag) }} {{- else if $tag }} {{- printf "%s%s:%s" $registry $repo $tag }} {{- else }} diff --git a/examples/openshift/openshift-values.yaml b/examples/openshift/openshift-values.yaml index b447597..cef5b03 100644 --- a/examples/openshift/openshift-values.yaml +++ b/examples/openshift/openshift-values.yaml @@ -19,11 +19,6 @@ global: pod-security.kubernetes.io/audit: privileged spire-server: - tornjak: - image: - registry: ghcr.io - repository: spiffe/tornjak-backend - tag: ubi-v1.4.1 nodeAttestor: k8sPsat: serviceAccountAllowList: ["spire-system:spire-agent"] @@ -56,10 +51,6 @@ spiffe-oidc-discovery-provider: tornjak-frontend: workingDir: /opt/app-root/src - image: - registry: ghcr.io - repository: spiffe/tornjak-frontend - tag: ubi-v1.4.1 podSecurityContext: runAsUser: null runAsGroup: null