updates for rancher 2.7.16 (#235)

* updates for airgapped-docs 0.1.7 (#229) Signed-off-by: Adam Martin <[email protected]> * Fix ipv issue by making ipv4 and ipv6 configurable & fix svc ports. (#228) * Fix ipv issue by making ipv4 and ipv6 configurable & fix svc ports. * Update chart version * Add support for restricted PSA * Update Chart.yaml * Update Chart.yaml * updates for rancher 2.7.16 (#234) Signed-off-by: Adam Martin <[email protected]> --------- Signed-off-by: Adam Martin <[email protected]> Co-authored-by: Adam Toy <[email protected]>
rancherfederal · Oct 25, 2024 · 73c152a · 73c152a
1 parent 66f087b
commit 73c152a
Show file tree

Hide file tree

Showing 6 changed files with 70 additions and 44 deletions.
diff --git a/charts/rancher/Chart.yaml b/charts/rancher/Chart.yaml
@@ -1,9 +1,9 @@
 apiVersion: v2
 name: rancher
 description: Install Rancher Server to manage Kubernetes clusters across providers
-version: 2.9.2
-appVersion: v2.9.2
-kubeVersion: < 1.31.0-0
+version: 2.7.16
+appVersion: v2.7.16
+kubeVersion: < 1.28.0-0
 home: https://rancher.com
 icon: https://github.com/rancher/ui/blob/master/public/assets/images/logos/welcome-cow.svg
 keywords:

diff --git a/charts/rancher/templates/deployment.yaml b/charts/rancher/templates/deployment.yaml
@@ -154,40 +154,29 @@ spec:
               name: "bootstrap-secret"
               key: "bootstrapPassword"
 {{- end }}
-{{- if .Values.agentTLSMode }}
-        - name: CATTLE_AGENT_TLS_MODE
-          value: "{{ .Values.agentTLSMode }}"
-{{- end }}
 {{- if .Values.extraEnv }}
 {{ toYaml .Values.extraEnv | indent 8}}
 {{- end }}
-        startupProbe:
+        livenessProbe:
           httpGet:
             path: /healthz
             port: 80
-          timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
-          failureThreshold: {{ .Values.startupProbe.failureThreshold }}
-          periodSeconds: {{ .Values.startupProbe.periodSeconds }}
-        livenessProbe:
+          initialDelaySeconds: {{.Values.livenessProbe.initialDelaySeconds | default 60 }}
+          periodSeconds: {{ .Values.livenessProbe.periodSeconds | default 30 }}
+        readinessProbe:
           httpGet:
             path: /healthz
             port: 80
-          {{- with .Values.livenessProbe.initialDelaySeconds}}
-          initialDelaySeconds: {{ . }}
-          {{- end }}
-          timeoutSeconds: {{.Values.livenessProbe.timeoutSeconds }}
-          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
-          failureThreshold: {{.Values.livenessProbe.failureThreshold }}
-        readinessProbe:
+          initialDelaySeconds: {{.Values.readinessProbe.initialDelaySeconds | default  5}}
+          periodSeconds: {{ .Values.readinessProbe.periodSeconds | default 30}}
+{{- if .Values.startupProbe }}
+        startupProbe:
           httpGet:
             path: /healthz
             port: 80
-          {{- with .Values.readinessProbe.initialDelaySeconds}}
-          initialDelaySeconds: {{ . }}
-          {{- end }}
-          timeoutSeconds: {{.Values.readinessProbe.timeoutSeconds }}
-          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-          failureThreshold: {{.Values.readinessProbe.failureThreshold }}
+          failureThreshold: {{.Values.startupProbe.failureThreshold | default 1}}
+          periodSeconds: {{ .Values.startupProbe.periodSeconds | default 30}}
+{{- end }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
         volumeMounts:

diff --git a/charts/rancher/templates/ingress.yaml b/charts/rancher/templates/ingress.yaml
@@ -54,8 +54,8 @@ spec:
           servicePort: {{ .Values.ingress.servicePort }}
           {{- end }}
         {{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
-        pathType: {{ .Values.ingress.pathType }}
-        path: {{ .Values.ingress.path }}
+        pathType: ImplementationSpecific
+        path: "/"
         {{- end }}
 {{- if eq .Values.tls "ingress" }}
   tls:

diff --git a/charts/rancher/templates/post-delete-hook-cluster-role.yaml b/charts/rancher/templates/post-delete-hook-cluster-role.yaml
@@ -30,6 +30,14 @@ rules:
   - apiGroups: [ "admissionregistration.k8s.io" ]
     resources: [ "validatingwebhookconfigurations", "mutatingwebhookconfigurations" ]
     verbs: [ "get", "list", "delete" ]
+  - apiGroups: [ "policy" ]
+    resources: [ "podsecuritypolicies" ]
+    verbs: ["delete", "create" ]
+{{- if eq (include "rancher.chart_psp_enabled" . ) "true" }}
+  - apiGroups: [ "policy" ]
+    resources: [ "podsecuritypolicies" ]
+    verbs: [ "use"]
+{{- end }}
   - apiGroups: [ "networking.k8s.io" ]
     resources: [ "ingresses" ]
     verbs: [ "delete" ]

diff --git a/charts/rancher/templates/post-delete-hook-psp.yaml b/charts/rancher/templates/post-delete-hook-psp.yaml
@@ -0,0 +1,34 @@
+{{- if eq (include "rancher.chart_psp_enabled" . ) "true" -}}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ include "rancher.fullname" . }}-post-delete
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+spec:
+  privileged: false
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+  volumes:
+    - 'secret'
+    - 'configMap'
+{{- end }}
diff --git a/charts/rancher/values.yaml b/charts/rancher/values.yaml
@@ -37,11 +37,6 @@ debug: false
 # When starting Rancher for the first time, bootstrap the admin as restricted-admin
 restrictedAdmin: false
 
-# Control how the Rancher agents validate TLS connections
-# Valid options: strict, or system-store
-# Note, for new installations empty will default to strict on 2.9+, or system-store on 2.8 or older
-agentTLSMode: ""
-
 # Extra environment variables passed to the rancher pods.
 # extraEnv:
 # - name: CATTLE_TLS_MIN_VERSION
@@ -65,7 +60,7 @@ ingress:
   includeDefaultExtraAnnotations: true
   extraAnnotations: {}
   ingressClassName: ""
-  # Certain ingress controllers will require the pathType or path to be set to a different value.
+  # Certain ingress controllers will will require the pathType or path to be set to a different value.
   pathType: ImplementationSpecific
   path: "/"
   # backend port number
@@ -163,7 +158,7 @@ postDelete:
   enabled: true
   image:
     repository: rancher/shell
-    tag: v0.2.1
+    tag: v0.1.25
   namespaceList:
     - cattle-fleet-system
     - cattle-system
@@ -176,19 +171,19 @@ postDelete:
 # Set a bootstrap password. If leave empty, a random password will be generated.
 bootstrapPassword: ""
 
-startupProbe:
-  ## should be ready within 2 minutes
-  timeoutSeconds: 5
-  periodSeconds: 10
-  failureThreshold: 12
 livenessProbe:
-  timeoutSeconds: 5
+  initialDelaySeconds: 60
   periodSeconds: 30
-  failureThreshold: 5
 readinessProbe:
-  timeoutSeconds: 5
+  initialDelaySeconds: 5
   periodSeconds: 30
-  failureThreshold: 5
+
+global:
+  cattle:
+    psp:
+      # will default to true on 1.24 and below, and false for 1.25 and above
+      # can be changed manually to true or false to bypass version checks and force that option
+      enabled: ""
 
 # helm values to use when installing the rancher-webhook chart.
 # helm values set here will override all other global values used when installing the webhook such as priorityClassName and systemRegistry settings.
@@ -202,4 +197,4 @@ carbide:
   whitelabel:
     enabled: true
     image: carbide/carbide-whitelabel
-    tag: "0.1.4"
+    tag: "0.1.4"