Update Helm release postgresql to v14

Signed-off-by: Renovate Bot <[email protected]>
projectsyn · Feb 22, 2024 · d1122a5 · d1122a5
1 parent 29aabc2
commit d1122a5
Show file tree

Hide file tree

Showing 13 changed files with 159 additions and 53 deletions.
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -62,7 +62,7 @@ parameters:
         version: v2.3.0
       postgresql:
         source: https://charts.bitnami.com/bitnami
-        version: 12.12.10
+        version: 14.2.2
     # FQDN should be overwritten on the cluster level
     fqdn: keycloak.example.com
     # Disables dynamically resolving the hostname from request headers.

diff --git a/...tin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/networkpolicy.yaml b/...tin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/networkpolicy.yaml
@@ -6,21 +6,33 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
-  name: keycloak-postgresql-ingress
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
+  name: keycloak-postgresql
   namespace: syn-builtin
 spec:
-  ingress:
-    - from:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 5432
+      to:
         - podSelector:
             matchLabels:
-              app.kubernetes.io/instance: keycloakx
-              app.kubernetes.io/name: keycloakx
-      ports:
+              app.kubernetes.io/component: read
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/name: postgresql
+  ingress:
+    - ports:
         - port: 5432
   podSelector:
     matchLabels:
       app.kubernetes.io/component: primary
       app.kubernetes.io/instance: keycloak
       app.kubernetes.io/name: postgresql
+  policyTypes:
+    - Ingress
+    - Egress
diff --git a/...iltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/statefulset.yaml b/...iltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/statefulset.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: builtin
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
   name: keycloak-postgresql
   namespace: syn-builtin
 spec:
@@ -29,8 +29,8 @@ spec:
         app.kubernetes.io/instance: keycloak
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: postgresql
-        app.kubernetes.io/version: 15.4.0
-        helm.sh/chart: postgresql-12.12.10
+        app.kubernetes.io/version: 16.2.0
+        helm.sh/chart: postgresql-14.2.2
       name: keycloak-postgresql
     spec:
       affinity:
@@ -46,6 +46,7 @@ spec:
                     app.kubernetes.io/name: postgresql
                 topologyKey: kubernetes.io/hostname
               weight: 1
+      automountServiceAccountToken: false
       containers:
         - env:
             - name: BITNAMI_DEBUG
@@ -124,21 +125,31 @@ spec:
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 5
-          resources:
-            limits: {}
-            requests:
-              cpu: 250m
-              memory: 256Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
               drop:
                 - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: null
             seccompProfile:
               type: RuntimeDefault
           volumeMounts:
+            - mountPath: /tmp
+              name: empty-dir
+              subPath: tmp-dir
+            - mountPath: /opt/bitnami/postgresql/conf
+              name: empty-dir
+              subPath: app-conf-dir
+            - mountPath: /opt/bitnami/postgresql/tmp
+              name: empty-dir
+              subPath: app-tmp-dir
+            - mountPath: /opt/bitnami/postgresql/logs
+              name: empty-dir
+              subPath: app-logs-dir
             - mountPath: /opt/bitnami/postgresql/certs
               name: postgresql-certificates
               readOnly: true
@@ -165,16 +176,17 @@ spec:
           image: docker.io/bitnami/os-shell:11-debian-11-r93
           imagePullPolicy: IfNotPresent
           name: init-chmod-data
-          resources:
-            limits: {}
-            requests: {}
           securityContext:
             runAsGroup: 0
             runAsNonRoot: false
             runAsUser: 0
+            seLinuxOptions: null
             seccompProfile:
               type: RuntimeDefault
           volumeMounts:
+            - mountPath: /tmp
+              name: empty-dir
+              subPath: tmp-dir
             - mountPath: /bitnami/postgresql
               name: data
             - mountPath: /dev/shm
@@ -185,8 +197,13 @@ spec:
               name: postgresql-certificates
       securityContext:
         fsGroup: 1001
-      serviceAccountName: default
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
+      serviceAccountName: keycloak-postgresql
       volumes:
+        - emptyDir: {}
+          name: empty-dir
         - name: raw-certificates
           secret:
             secretName: keycloak-postgresql-tls

diff --git a/...ltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/svc-headless.yaml b/...ltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/svc-headless.yaml
@@ -8,8 +8,8 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
   name: keycloak-postgresql-hl
   namespace: syn-builtin
 spec:

diff --git a/...olden/builtin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/svc.yaml b/...olden/builtin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/svc.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
   name: keycloak-postgresql
   namespace: syn-builtin
 spec:

diff --git a/...en/builtin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml b/...en/builtin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
+  name: keycloak-postgresql
+  namespace: syn-builtin
diff --git a/...external/external/external/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml b/...external/external/external/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
+  name: keycloak-postgresql
+  namespace: syn-external
diff --git a/.../openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/networkpolicy.yaml b/.../openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/networkpolicy.yaml
@@ -6,21 +6,33 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
-  name: keycloak-postgresql-ingress
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
+  name: keycloak-postgresql
   namespace: syn-openshift-postgres
 spec:
-  ingress:
-    - from:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 5432
+      to:
         - podSelector:
             matchLabels:
-              app.kubernetes.io/instance: keycloakx
-              app.kubernetes.io/name: keycloakx
-      ports:
+              app.kubernetes.io/component: read
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/name: postgresql
+  ingress:
+    - ports:
         - port: 5432
   podSelector:
     matchLabels:
       app.kubernetes.io/component: primary
       app.kubernetes.io/instance: keycloak
       app.kubernetes.io/name: postgresql
+  policyTypes:
+    - Ingress
+    - Egress
diff --git a/...es/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/statefulset.yaml b/...es/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/statefulset.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: openshift-postgres
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
   name: keycloak-postgresql
   namespace: syn-openshift-postgres
 spec:
@@ -29,8 +29,8 @@ spec:
         app.kubernetes.io/instance: keycloak
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: postgresql
-        app.kubernetes.io/version: 15.4.0
-        helm.sh/chart: postgresql-12.12.10
+        app.kubernetes.io/version: 16.2.0
+        helm.sh/chart: postgresql-14.2.2
       name: keycloak-postgresql
     spec:
       affinity:
@@ -46,6 +46,7 @@ spec:
                     app.kubernetes.io/name: postgresql
                 topologyKey: kubernetes.io/hostname
               weight: 1
+      automountServiceAccountToken: false
       containers:
         - env:
             - name: BITNAMI_DEBUG
@@ -124,20 +125,30 @@ spec:
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 5
-          resources:
-            limits: {}
-            requests:
-              cpu: 250m
-              memory: 256Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
               drop:
                 - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
             runAsNonRoot: true
+            seLinuxOptions: null
             seccompProfile:
               type: RuntimeDefault
           volumeMounts:
+            - mountPath: /tmp
+              name: empty-dir
+              subPath: tmp-dir
+            - mountPath: /opt/bitnami/postgresql/conf
+              name: empty-dir
+              subPath: app-conf-dir
+            - mountPath: /opt/bitnami/postgresql/tmp
+              name: empty-dir
+              subPath: app-tmp-dir
+            - mountPath: /opt/bitnami/postgresql/logs
+              name: empty-dir
+              subPath: app-logs-dir
             - mountPath: /opt/bitnami/postgresql/certs
               name: postgresql-certificates
               readOnly: true
@@ -155,29 +166,35 @@ spec:
           image: docker.io/bitnami/os-shell:11-debian-11-r93
           imagePullPolicy: IfNotPresent
           name: copy-certs
-          resources:
-            limits: {}
-            requests:
-              cpu: 250m
-              memory: 256Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
               drop:
                 - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
             runAsNonRoot: true
+            seLinuxOptions: null
             seccompProfile:
               type: RuntimeDefault
           volumeMounts:
+            - mountPath: /tmp
+              name: empty-dir
+              subPath: tmp-dir
             - mountPath: /tmp/certs
               name: raw-certificates
             - mountPath: /opt/bitnami/postgresql/certs
               name: postgresql-certificates
       securityContext:
+        fsGroupChangePolicy: Always
         seccompProfile:
           type: RuntimeDefault
-      serviceAccountName: default
+        supplementalGroups: []
+        sysctls: []
+      serviceAccountName: keycloak-postgresql
       volumes:
+        - emptyDir: {}
+          name: empty-dir
         - name: raw-certificates
           secret:
             secretName: keycloak-postgresql-tls

diff --git a/...s/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/svc-headless.yaml b/...s/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/svc-headless.yaml
@@ -8,8 +8,8 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
   name: keycloak-postgresql-hl
   namespace: syn-openshift-postgres
 spec:

diff --git a/...t-postgres/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/svc.yaml b/...t-postgres/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/svc.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
   name: keycloak-postgresql
   namespace: syn-openshift-postgres
 spec:

diff --git a/...ostgres/openshift-postgres/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml b/...ostgres/openshift-postgres/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
+  name: keycloak-postgresql
+  namespace: syn-openshift-postgres
diff --git a/...nshift/openshift/openshift/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml b/...nshift/openshift/openshift/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.2.2
+  name: keycloak-postgresql
+  namespace: keycloak-dev