Release 0.4.1 (#125)

* upgrade app-proxy 1.2566.1

* fix version typo

* feat: update argocd to 2.9-2023.12.22-f5398c630

* disallow usage of codefresh-token as secret name for runtime token

* bumped app-proxy to `1.2585.0` (#127)

* add validations on secret names

* feat: update argocd to 2.9-2023.12.28-a52e719a5

* make app-proxy init container image the same as main container

* update docs

* update workflows chart to 0.22.10-2-CR-20826

* feat: update argocd to 2.9-2023.12.28-a52e719a5

* back reporter changes (#135)

---------

Co-authored-by: pashakostohrys <pavel@codefresh.io>
Co-authored-by: Ilia Medvedev <ilia.medvedev@codefresh.io>
Co-authored-by: Noam Gal <noam.gal@codefresh.io>
Co-authored-by: Denys Melnyk <denis@codefresh.io>

Author: 5 people

charts/gitops-runtime/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-appVersion: 0.1.37
+appVersion: 0.1.38
 description: A Helm chart for Codefresh gitops runtime
 name: gitops-runtime
-version: 0.4.0
+version: 0.4.1
 home: https://github.com/codefresh-io/gitops-runtime-helm
 icon: https://avatars1.githubusercontent.com/u/11412079?v=3
 keywords:
@@ -15,27 +15,25 @@ annotations:
   artifacthub.io/alternativeName: "codefresh-gitops-runtime"
   artifacthub.io/changes: |
     - kind: changed
-      description: Update app-proxy
+      description: Update app version to 0.1.38
     - kind: changed
-      description: Update app version to 0.1.37
-    - kind: added
-      description: Support Codefresh hosted runtimes registration flow
-    - kind: fixed
-      description: fail templating when runtime.name is not provided and ingress is enabled
+      description: Update argo-cd to 2.9-2023.12.28-a52e719a5
     - kind: changed
-      description: Update Argo-CD to 5.51.6-1-cap-2.9-2023.12.06-e6258156d (2.9.3)
+      description: Update app-proxy to 1.2585.0
     - kind: changed
-      description: Update Argo-Rollouts to 2.32.5-2-cap-init (1.6.1)
+      description: Update argo-workflows to 0.22.10-2-CR-20826
+    - kind: fixed
+      description: fail template if secretKeyRef uses reserved secret name codefresh-token
 dependencies:
 - name: argo-cd
   repository: https://codefresh-io.github.io/argo-helm
-  version: 5.51.6-1-cap-2.9-2023.12.06-e6258156d
+  version: 5.51.6-3-cap-2.9-2023.12.28-a52e719a5
 - name: argo-events
   repository: https://codefresh-io.github.io/argo-helm
   version: 2.0.9-1-cap-CR-19893
 - name: argo-workflows
   repository: https://codefresh-io.github.io/argo-helm
-  version: 0.22.10-1-CR-17426
+  version: 0.22.10-2-CR-20826
   condition: argo-workflows.enabled
 - name: argo-rollouts
   repository: https://codefresh-io.github.io/argo-helm

charts/gitops-runtime/README.md

@@ -1,5 +1,5 @@
 ## Codefresh gitops runtime
-![Version: 0.4.0](https://img.shields.io/badge/Version-0.4.0-informational?style=flat-square) ![AppVersion: 0.1.37](https://img.shields.io/badge/AppVersion-0.1.37-informational?style=flat-square)
+![Version: 0.4.1](https://img.shields.io/badge/Version-0.4.1-informational?style=flat-square) ![AppVersion: 0.1.38](https://img.shields.io/badge/AppVersion-0.1.38-informational?style=flat-square)
 
 ## Prerequisites
 
@@ -27,7 +27,7 @@ We have created a helper utility to resolve this issue:
 The utility is packaged in a container image. Below are instructions on executing the utility using Docker:
 
 ```
-docker run -v <output_dir>:/output quay.io/codefresh/gitops-runtime-private-registry-utils:0.4.0 <local_registry>
+docker run -v <output_dir>:/output quay.io/codefresh/gitops-runtime-private-registry-utils:0.4.1 <local_registry>
 ```
 `output_dir` - is a local directory where the utility will output files. <br>
 `local_registry` - is your local registry where you want to mirror the images to
@@ -100,14 +100,14 @@ sealed-secrets:
 | app-proxy.image-enrichment.serviceAccount.name | string | `"codefresh-image-enrichment-sa"` | Name of the service account to create or the name of the existing one to use |
 | app-proxy.image.pullPolicy | string | `"IfNotPresent"` |  |
 | app-proxy.image.repository | string | `"quay.io/codefresh/cap-app-proxy"` |  |
-| app-proxy.image.tag | string | `"1.2565.0"` |  |
+| app-proxy.image.tag | string | `"1.2585.0"` |  |
 | app-proxy.imagePullSecrets | list | `[]` |  |
 | app-proxy.initContainer.command[0] | string | `"./init.sh"` |  |
 | app-proxy.initContainer.env | object | `{}` |  |
 | app-proxy.initContainer.extraVolumeMounts | list | `[]` | Extra volume mounts for init container |
 | app-proxy.initContainer.image.pullPolicy | string | `"IfNotPresent"` |  |
 | app-proxy.initContainer.image.repository | string | `"quay.io/codefresh/cap-app-proxy-init"` |  |
-| app-proxy.initContainer.image.tag | string | `"1.2565.0"` |  |
+| app-proxy.initContainer.image.tag | string | `"1.2585.0"` |  |
 | app-proxy.initContainer.resources.limits.cpu | string | `"1"` |  |
 | app-proxy.initContainer.resources.limits.memory | string | `"512Mi"` |  |
 | app-proxy.initContainer.resources.requests.cpu | string | `"0.2"` |  |

charts/gitops-runtime/templates/_helpers.tpl

@@ -1,3 +1,10 @@
+{{/* Validation for secretKeyRef to avoid conflicting secret names with secrets created by controllers */}}
+{{- define "codefresh-gitops-runtime.secret-name-validation"}}
+  {{- $reservedSecretNames := list "codefresh-token" }}
+  {{- if has .name $reservedSecretNames }}
+    {{- fail (printf "%s is a reserved name and is not allowed. Please use a different secret name" .name) }}
+  {{- end }}
+{{- end }}
 {{/*
 Expand the name of the chart.
 */}}
@@ -161,6 +168,7 @@ valueFrom:
     key: token
     optional: true
   {{- else if .Values.global.codefresh.userToken.secretKeyRef  }}
+    {{- include "codefresh-gitops-runtime.secret-name-validation" .Values.global.codefresh.userToken.secretKeyRef }}
 valueFrom:
   secretKeyRef:
   {{- .Values.global.codefresh.userToken.secretKeyRef | toYaml | nindent 4 }}
@@ -244,6 +252,7 @@ Output comma separated list of installed runtime components
   {{- include "codefresh-gitops-runtime.runtime-gitcreds.password.default-secret-name" . }}
   {{- else if .Values.global.runtime.gitCredentials.password.secretKeyRef }}
     {{- if hasKey .Values.global.runtime.gitCredentials.password.secretKeyRef "name" }}
+      {{- include "codefresh-gitops-runtime.secret-name-validation" .Values.global.runtime.gitCredentials.password.secretKeyRef }}
       {{- print .Values.global.runtime.gitCredentials.password.secretKeyRef.name }}
     {{- else }}
     {{ fail "secretKeyRef for global.runtime.gitCredentials.password illegal - must have name field"}}
@@ -270,4 +279,4 @@ valueFrom:
     key: {{ include "codefresh-gitops-runtime.runtime-gitcreds.password.secretkey" . }}
     optional: true
 {{- end }}
-# ------------------------------------------------------------------------------------------------------------
+# ------------------------------------------------------------------------------------------------------------

charts/gitops-runtime/tests/installation-token_test.yaml

@@ -73,3 +73,14 @@ tests:
           secretKeyRef:
             name: mysecret
             key: mykey
+
+- it: codefresh-token is not allowed
+  template: 'app-proxy/deployment.yaml'
+  values:
+  - ./values/mandatory-values-no-token.yaml
+  set:
+    global.codefresh.userToken.secretKeyRef.name: codefresh-token
+    global.codefresh.userToken.secretKeyRef.key: token
+  asserts:
+  - failedTemplate:
+      errorMessage: 'codefresh-token is a reserved name and is not allowed. Please use a different secret name'

charts/gitops-runtime/values.yaml

@@ -418,15 +418,15 @@ app-proxy:
           tag: 1.1.10-main
   image:
     repository: quay.io/codefresh/cap-app-proxy
-    tag: 1.2565.0
+    tag: 1.2585.0
     pullPolicy: IfNotPresent
   # -- Extra volume mounts for main container
   extraVolumeMounts: []
 
   initContainer:
     image:
       repository: quay.io/codefresh/cap-app-proxy-init
-      tag: 1.2565.0
+      tag: 1.2585.0
       pullPolicy: IfNotPresent
     command:
       - ./init.sh