From 7c383c8ba63858e3ffc3d5d7a5b0aa999761458b Mon Sep 17 00:00:00 2001 From: alina-codefresh Date: Tue, 22 Sep 2026 13:13:28 +0300 Subject: [PATCH 1/9] chore: fix security vulnerabilities for gitops-runtime-installer * update base image for runtime installer * update cap-app-proxy and enricher images --- charts/gitops-runtime/README.md | 10 +++++----- charts/gitops-runtime/values.yaml | 8 ++++---- installer-image/Dockerfile | 4 ++-- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index 362caebe..5d01ebc9 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -507,13 +507,13 @@ global: | app-proxy.extraVolumeMounts | list | `[]` | Extra volume mounts for main container | | app-proxy.extraVolumes | list | `[]` | extra volumes | | app-proxy.fullnameOverride | string | `"cap-app-proxy"` | | -| app-proxy.image-enrichment | object | `{"config":{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.32"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.32"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.32"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400},"enabled":true,"serviceAccount":{"annotations":null,"create":true,"name":"codefresh-image-enrichment-sa"}}` | Image enrichment process configuration | -| app-proxy.image-enrichment.config | object | `{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.32"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.32"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.32"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400}` | Configurations for image enrichment workflow | +| app-proxy.image-enrichment | object | `{"config":{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.33"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.33"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.33"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400},"enabled":true,"serviceAccount":{"annotations":null,"create":true,"name":"codefresh-image-enrichment-sa"}}` | Image enrichment process configuration | +| app-proxy.image-enrichment.config | object | `{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.33"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.33"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.33"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400}` | Configurations for image enrichment workflow | | app-proxy.image-enrichment.config.clientHeartbeatIntervalInSeconds | int | `5` | Client heartbeat interval in seconds for image enrichemnt workflow | | app-proxy.image-enrichment.config.concurrencyCmKey | string | `"imageReportExecutor"` | The name of the key in the configmap to use as synchronization semaphore | | app-proxy.image-enrichment.config.concurrencyCmName | string | `"workflow-synchronization-semaphores"` | The name of the configmap to use as synchronization semaphore, see https://argoproj.github.io/argo-workflows/synchronization/ | -| app-proxy.image-enrichment.config.images | object | `{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.32"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.32"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.32"}}` | Enrichemnt images | -| app-proxy.image-enrichment.config.images.reportImage | object | `{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.32"}` | Report image enrichment task image | +| app-proxy.image-enrichment.config.images | object | `{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.33"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.33"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.33"}}` | Enrichemnt images | +| app-proxy.image-enrichment.config.images.reportImage | object | `{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.33"}` | Report image enrichment task image | | app-proxy.image-enrichment.config.podGcStrategy | string | `"OnWorkflowCompletion"` | Pod grabage collection strategy. By default all pods will be deleted when the enrichment workflow completes. | | app-proxy.image-enrichment.config.ttlActiveInSeconds | int | `900` | Maximum allowed runtime for the enrichment workflow | | app-proxy.image-enrichment.config.ttlAfterCompletionInSeconds | int | `86400` | Number of seconds to live after completion | @@ -524,7 +524,7 @@ global: | app-proxy.image-enrichment.serviceAccount.name | string | `"codefresh-image-enrichment-sa"` | Name of the service account to create or the name of the existing one to use | | app-proxy.image.pullPolicy | string | `"IfNotPresent"` | | | app-proxy.image.repository | string | `"quay.io/codefresh/cap-app-proxy"` | | -| app-proxy.image.tag | string | `"1.4140.0"` | | +| app-proxy.image.tag | string | `"1.4141.0"` | | | app-proxy.imagePullSecrets | list | `[]` | | | app-proxy.initContainer.command[0] | string | `"./init.sh"` | | | app-proxy.initContainer.env | object | `{}` | | diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index a746e237..7659b229 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -469,20 +469,20 @@ app-proxy: reportImage: registry: quay.io repository: codefreshplugins/argo-hub-codefresh-csdp-report-image-info - tag: 1.1.32 + tag: 1.1.33 # Git enrichment task image gitEnrichment: registry: quay.io repository: codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info - tag: 1.1.32 + tag: 1.1.33 # Jira enrichment task image jiraEnrichment: registry: quay.io repository: codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info - tag: 1.1.32 + tag: 1.1.33 image: repository: quay.io/codefresh/cap-app-proxy - tag: 1.4140.0 + tag: 1.4141.0 pullPolicy: IfNotPresent # -- Extra volume mounts for main container extraVolumeMounts: [] diff --git a/installer-image/Dockerfile b/installer-image/Dockerfile index 0727f703..6beded7d 100644 --- a/installer-image/Dockerfile +++ b/installer-image/Dockerfile @@ -1,7 +1,7 @@ # syntax=docker/dockerfile:1 # DHI source: https://hub.docker.com/repository/docker/octopusdeploy/dhi-golang/tags/1.25-debian13-dev -FROM octopusdeploy/dhi-golang:1.25-debian13-dev@sha256:e6e6523b8d28c9e31354de5ecf58b849c18410b2bb7065b533066740fca549af AS build +FROM octopusdeploy/dhi-golang:1.27-debian13-dev@sha256:baa8e6b0fe23dcfdcaec24af47e091660ba539685fe8340d0f5172227afadaf8 AS build ARG TARGETARCH ARG CF_CLI_VERSION=v1.0.9 RUN go install github.com/davidrjonas/semver-cli@latest \ @@ -11,7 +11,7 @@ ADD --unpack=true --chown=nonroot:nonroot --chmod=755 https://github.com/codefre # DHI source: https://hub.docker.com/repository/docker/octopusdeploy/dhi-debian-base/customizations/8106437942896324135 -FROM octopusdeploy/dhi-debian-base:trixie_cf-gitops-runtime-installer-debian13@sha256:5b361e78a890b74f7949f996e57b6d45043da7d70c22928868d614d2eecf48c9 AS production +FROM octopusdeploy/dhi-debian-base:trixie_cf-gitops-runtime-installer-debian13@sha256:2e5be5688d72eaa8c578f7608b77c84b2024f510874d93a056f601d2901cd38b AS production ARG TARGETARCH COPY --from=build --chown=nonroot:nonroot --chmod=755 /tmp/cf/cf-linux-${TARGETARCH} /usr/local/bin/cf COPY --from=build --chown=nonroot:nonroot --chmod=755 /tmp/semver-cli /usr/local/bin/semver-cli From ed607ec4f3c22506d8feb454f5f33f1ac231f711 Mon Sep 17 00:00:00 2001 From: alina-codefresh Date: Fri, 25 Sep 2026 12:34:11 +0300 Subject: [PATCH 2/9] chore: fix security vulnerabilities * update codefresh-tunnel version * update nginx,kubectl containers * update cap-app-proxy * update app-proxy image * update docs * bump codefresh plugin images --------- Co-authored-by: Bohdan Pysarenko --- charts/gitops-runtime/Chart.yaml | 2 +- charts/gitops-runtime/README.md | 16 ++++++++-------- charts/gitops-runtime/values.yaml | 14 +++++++------- 3 files changed, 16 insertions(+), 16 deletions(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index 75db7209..04273f2d 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -30,7 +30,7 @@ dependencies: condition: sealed-secrets.enabled - name: codefresh-tunnel-client repository: oci://quay.io/codefresh/charts - version: 0.1.25 + version: 0.1.26 alias: tunnel-client condition: tunnel-client.enabled - name: redis-ha diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index 5d01ebc9..ba96dfb9 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -507,13 +507,13 @@ global: | app-proxy.extraVolumeMounts | list | `[]` | Extra volume mounts for main container | | app-proxy.extraVolumes | list | `[]` | extra volumes | | app-proxy.fullnameOverride | string | `"cap-app-proxy"` | | -| app-proxy.image-enrichment | object | `{"config":{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.33"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.33"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.33"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400},"enabled":true,"serviceAccount":{"annotations":null,"create":true,"name":"codefresh-image-enrichment-sa"}}` | Image enrichment process configuration | -| app-proxy.image-enrichment.config | object | `{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.33"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.33"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.33"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400}` | Configurations for image enrichment workflow | +| app-proxy.image-enrichment | object | `{"config":{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.34"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.34"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.34"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400},"enabled":true,"serviceAccount":{"annotations":null,"create":true,"name":"codefresh-image-enrichment-sa"}}` | Image enrichment process configuration | +| app-proxy.image-enrichment.config | object | `{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.34"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.34"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.34"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400}` | Configurations for image enrichment workflow | | app-proxy.image-enrichment.config.clientHeartbeatIntervalInSeconds | int | `5` | Client heartbeat interval in seconds for image enrichemnt workflow | | app-proxy.image-enrichment.config.concurrencyCmKey | string | `"imageReportExecutor"` | The name of the key in the configmap to use as synchronization semaphore | | app-proxy.image-enrichment.config.concurrencyCmName | string | `"workflow-synchronization-semaphores"` | The name of the configmap to use as synchronization semaphore, see https://argoproj.github.io/argo-workflows/synchronization/ | -| app-proxy.image-enrichment.config.images | object | `{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.33"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.33"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.33"}}` | Enrichemnt images | -| app-proxy.image-enrichment.config.images.reportImage | object | `{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.33"}` | Report image enrichment task image | +| app-proxy.image-enrichment.config.images | object | `{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.34"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.34"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.34"}}` | Enrichemnt images | +| app-proxy.image-enrichment.config.images.reportImage | object | `{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.34"}` | Report image enrichment task image | | app-proxy.image-enrichment.config.podGcStrategy | string | `"OnWorkflowCompletion"` | Pod grabage collection strategy. By default all pods will be deleted when the enrichment workflow completes. | | app-proxy.image-enrichment.config.ttlActiveInSeconds | int | `900` | Maximum allowed runtime for the enrichment workflow | | app-proxy.image-enrichment.config.ttlAfterCompletionInSeconds | int | `86400` | Number of seconds to live after completion | @@ -524,14 +524,14 @@ global: | app-proxy.image-enrichment.serviceAccount.name | string | `"codefresh-image-enrichment-sa"` | Name of the service account to create or the name of the existing one to use | | app-proxy.image.pullPolicy | string | `"IfNotPresent"` | | | app-proxy.image.repository | string | `"quay.io/codefresh/cap-app-proxy"` | | -| app-proxy.image.tag | string | `"1.4141.0"` | | +| app-proxy.image.tag | string | `"1.4154.0"` | | | app-proxy.imagePullSecrets | list | `[]` | | | app-proxy.initContainer.command[0] | string | `"./init.sh"` | | | app-proxy.initContainer.env | object | `{}` | | | app-proxy.initContainer.extraVolumeMounts | list | `[]` | Extra volume mounts for init container | | app-proxy.initContainer.image.pullPolicy | string | `"IfNotPresent"` | | | app-proxy.initContainer.image.repository | string | `"quay.io/codefresh/cap-app-proxy-init"` | | -| app-proxy.initContainer.image.tag | string | `"1.4140.0"` | | +| app-proxy.initContainer.image.tag | string | `"1.4154.0"` | | | app-proxy.initContainer.resources.limits | object | `{}` | | | app-proxy.initContainer.resources.requests.cpu | string | `"0.2"` | | | app-proxy.initContainer.resources.requests.memory | string | `"256Mi"` | | @@ -748,7 +748,7 @@ global: | internal-router.fullnameOverride | string | `"internal-router"` | | | internal-router.image.pullPolicy | string | `"IfNotPresent"` | | | internal-router.image.repository | string | `"docker.io/nginxinc/nginx-unprivileged"` | | -| internal-router.image.tag | string | `"1.31.3-alpine3.24"` | | +| internal-router.image.tag | string | `"1.31.6-alpine3.24"` | | | internal-router.imagePullSecrets | list | `[]` | | | internal-router.ipv6 | object | `{"enabled":false}` | For ipv6 enabled clusters switch ipv6 enabled to true | | internal-router.nameOverride | string | `""` | | @@ -805,7 +805,7 @@ global: | redis-ha.topologySpreadConstraints.maxSkew | string | `""` (defaults to `1`) | Max skew of pods tolerated | | redis-ha.topologySpreadConstraints.topologyKey | string | `""` (defaults to `topology.kubernetes.io/zone`) | Topology key for spread | | redis-ha.topologySpreadConstraints.whenUnsatisfiable | string | `""` (defaults to `ScheduleAnyway`) | Enforcement policy, hard or soft | -| redis-secret-init | object | `{"affinity":{},"image":{"registry":"docker.io","repository":"alpine/kubectl","tag":"1.36.2"},"nodeSelector":{},"tolerations":[]}` | Enable hook job to create redis secret | +| redis-secret-init | object | `{"affinity":{},"image":{"registry":"docker.io","repository":"alpine/kubectl","tag":"1.37.0"},"nodeSelector":{},"tolerations":[]}` | Enable hook job to create redis secret | | redis.image | object | `{"registry":"public.ecr.aws","repository":"docker/library/redis","tag":"8.2.1-alpine"}` | Redis image | | redis.metrics | object | `{"enabled":true,"env":{},"envFrom":[],"image":{"registry":"ghcr.io","repository":"oliver006/redis_exporter","tag":"v1.72.1"},"livenessProbe":{"enabled":true,"failureThreshold":5,"initialDelaySeconds":30,"periodSeconds":15,"successThreshold":1,"timeoutSeconds":15},"readinessProbe":{"enabled":true,"failureThreshold":5,"initialDelaySeconds":30,"periodSeconds":15,"successThreshold":1,"timeoutSeconds":15},"resources":{},"serviceMonitor":{"enabled":false}}` | Enable metrics sidecar | | redis.metrics.serviceMonitor | object | `{"enabled":false}` | Enable a prometheus ServiceMonitor | diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index 7659b229..abbe7769 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -350,7 +350,7 @@ internal-router: image: repository: docker.io/nginxinc/nginx-unprivileged pullPolicy: IfNotPresent - tag: 1.31.3-alpine3.24 + tag: 1.31.6-alpine3.24 imagePullSecrets: [] nameOverride: "" fullnameOverride: "internal-router" @@ -469,27 +469,27 @@ app-proxy: reportImage: registry: quay.io repository: codefreshplugins/argo-hub-codefresh-csdp-report-image-info - tag: 1.1.33 + tag: 1.1.34 # Git enrichment task image gitEnrichment: registry: quay.io repository: codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info - tag: 1.1.33 + tag: 1.1.34 # Jira enrichment task image jiraEnrichment: registry: quay.io repository: codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info - tag: 1.1.33 + tag: 1.1.34 image: repository: quay.io/codefresh/cap-app-proxy - tag: 1.4141.0 + tag: 1.4154.0 pullPolicy: IfNotPresent # -- Extra volume mounts for main container extraVolumeMounts: [] initContainer: image: repository: quay.io/codefresh/cap-app-proxy-init - tag: 1.4140.0 + tag: 1.4154.0 pullPolicy: IfNotPresent command: - ./init.sh @@ -745,7 +745,7 @@ redis-secret-init: image: registry: docker.io repository: alpine/kubectl - tag: 1.36.2 + tag: 1.37.0 nodeSelector: {} tolerations: [] affinity: {} From 262702eedd722a6444cadd215df21d76aa533b80 Mon Sep 17 00:00:00 2001 From: alina-codefresh Date: Thu, 1 Oct 2026 17:54:17 +0300 Subject: [PATCH 3/9] update runtime to 0.31.3 --- charts/gitops-runtime/Chart.yaml | 2 +- charts/gitops-runtime/README.md | 18 +++++++++--------- charts/gitops-runtime/values.yaml | 16 ++++++++-------- installer-image/Dockerfile | 6 +++--- 4 files changed, 21 insertions(+), 21 deletions(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index 04273f2d..accdc86d 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -22,7 +22,7 @@ dependencies: version: 10.2.2 - name: argo-workflows repository: https://codefresh-io.github.io/argo-helm - version: 0.45.25-v3.6.7-cap-CFS-15235 + version: 0.45.26-v3.6.7-cap-CFS-17793 condition: argo-workflows.enabled - name: sealed-secrets repository: https://bitnami.github.io/sealed-secrets diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index ba96dfb9..70524e50 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -507,13 +507,13 @@ global: | app-proxy.extraVolumeMounts | list | `[]` | Extra volume mounts for main container | | app-proxy.extraVolumes | list | `[]` | extra volumes | | app-proxy.fullnameOverride | string | `"cap-app-proxy"` | | -| app-proxy.image-enrichment | object | `{"config":{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.34"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.34"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.34"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400},"enabled":true,"serviceAccount":{"annotations":null,"create":true,"name":"codefresh-image-enrichment-sa"}}` | Image enrichment process configuration | -| app-proxy.image-enrichment.config | object | `{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.34"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.34"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.34"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400}` | Configurations for image enrichment workflow | +| app-proxy.image-enrichment | object | `{"config":{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.35"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.35"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.35"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400},"enabled":true,"serviceAccount":{"annotations":null,"create":true,"name":"codefresh-image-enrichment-sa"}}` | Image enrichment process configuration | +| app-proxy.image-enrichment.config | object | `{"clientHeartbeatIntervalInSeconds":5,"concurrencyCmKey":"imageReportExecutor","concurrencyCmName":"workflow-synchronization-semaphores","images":{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.35"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.35"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.35"}},"podGcStrategy":"OnWorkflowCompletion","ttlActiveInSeconds":900,"ttlAfterCompletionInSeconds":86400}` | Configurations for image enrichment workflow | | app-proxy.image-enrichment.config.clientHeartbeatIntervalInSeconds | int | `5` | Client heartbeat interval in seconds for image enrichemnt workflow | | app-proxy.image-enrichment.config.concurrencyCmKey | string | `"imageReportExecutor"` | The name of the key in the configmap to use as synchronization semaphore | | app-proxy.image-enrichment.config.concurrencyCmName | string | `"workflow-synchronization-semaphores"` | The name of the configmap to use as synchronization semaphore, see https://argoproj.github.io/argo-workflows/synchronization/ | -| app-proxy.image-enrichment.config.images | object | `{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.34"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.34"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.34"}}` | Enrichemnt images | -| app-proxy.image-enrichment.config.images.reportImage | object | `{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.34"}` | Report image enrichment task image | +| app-proxy.image-enrichment.config.images | object | `{"gitEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info","tag":"1.1.35"},"jiraEnrichment":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info","tag":"1.1.35"},"reportImage":{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.35"}}` | Enrichemnt images | +| app-proxy.image-enrichment.config.images.reportImage | object | `{"registry":"quay.io","repository":"codefreshplugins/argo-hub-codefresh-csdp-report-image-info","tag":"1.1.35"}` | Report image enrichment task image | | app-proxy.image-enrichment.config.podGcStrategy | string | `"OnWorkflowCompletion"` | Pod grabage collection strategy. By default all pods will be deleted when the enrichment workflow completes. | | app-proxy.image-enrichment.config.ttlActiveInSeconds | int | `900` | Maximum allowed runtime for the enrichment workflow | | app-proxy.image-enrichment.config.ttlAfterCompletionInSeconds | int | `86400` | Number of seconds to live after completion | @@ -524,14 +524,14 @@ global: | app-proxy.image-enrichment.serviceAccount.name | string | `"codefresh-image-enrichment-sa"` | Name of the service account to create or the name of the existing one to use | | app-proxy.image.pullPolicy | string | `"IfNotPresent"` | | | app-proxy.image.repository | string | `"quay.io/codefresh/cap-app-proxy"` | | -| app-proxy.image.tag | string | `"1.4154.0"` | | +| app-proxy.image.tag | string | `"1.4159.0"` | | | app-proxy.imagePullSecrets | list | `[]` | | | app-proxy.initContainer.command[0] | string | `"./init.sh"` | | | app-proxy.initContainer.env | object | `{}` | | | app-proxy.initContainer.extraVolumeMounts | list | `[]` | Extra volume mounts for init container | | app-proxy.initContainer.image.pullPolicy | string | `"IfNotPresent"` | | | app-proxy.initContainer.image.repository | string | `"quay.io/codefresh/cap-app-proxy-init"` | | -| app-proxy.initContainer.image.tag | string | `"1.4154.0"` | | +| app-proxy.initContainer.image.tag | string | `"1.4159.0"` | | | app-proxy.initContainer.resources.limits | object | `{}` | | | app-proxy.initContainer.resources.requests.cpu | string | `"0.2"` | | | app-proxy.initContainer.resources.requests.memory | string | `"256Mi"` | | @@ -602,7 +602,7 @@ global: | argo-cd.redis-ha.image.tag | string | `"8.2.2-alpine"` | Redis tag | | argo-cd.redis.image.repository | string | `"ecr-public.aws.com/docker/library/redis"` | Redis repository | | argo-cd.redis.image.tag | string | `"8.2.2-alpine"` | Redis tag | -| argo-gateway | object | `{"affinity":{},"hpa":{"enabled":true,"maxReplicas":10,"minReplicas":1,"targetCPUUtilizationPercentage":70},"image":{"registry":"quay.io","repository":"codefresh/cf-argocd-extras","tag":"7477f32"},"livenessProbe":{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":10},"nodeSelector":{},"pdb":{"enabled":true,"maxUnavailable":"","minAvailable":"50%"},"readinessProbe":{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":10},"resources":{"requests":{"cpu":"100m","memory":"128Mi"}},"service":{"type":"ClusterIP"},"serviceAccount":{"create":true},"serviceMonitor":{"enabled":false,"interval":"30s","labels":{},"scrapeTimeout":"10s"},"tolerations":[]}` | Argo Gateway Argo Gateway is used to perform operations on ArgoCD from Codefresh platform | +| argo-gateway | object | `{"affinity":{},"hpa":{"enabled":true,"maxReplicas":10,"minReplicas":1,"targetCPUUtilizationPercentage":70},"image":{"registry":"quay.io","repository":"codefresh/cf-argocd-extras","tag":"70aa9f5"},"livenessProbe":{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":10},"nodeSelector":{},"pdb":{"enabled":true,"maxUnavailable":"","minAvailable":"50%"},"readinessProbe":{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":10},"resources":{"requests":{"cpu":"100m","memory":"128Mi"}},"service":{"type":"ClusterIP"},"serviceAccount":{"create":true},"serviceMonitor":{"enabled":false,"interval":"30s","labels":{},"scrapeTimeout":"10s"},"tolerations":[]}` | Argo Gateway Argo Gateway is used to perform operations on ArgoCD from Codefresh platform | | argo-workflows.crds.install | bool | `true` | Install and upgrade CRDs | | argo-workflows.enabled | bool | `true` | | | argo-workflows.executor.resources.requests.ephemeral-storage | string | `"10Mi"` | | @@ -664,7 +664,7 @@ global: | gitops-operator.env.<<[0].OTEL_TRACES_SAMPLER | string | `"parentbased_always_on"` | OTel sampler to be used for traces. Ref: https://opentelemetry.io/docs/specs/otel/configuration/sdk-environment-variables/ | | gitops-operator.env.GITOPS_OPERATOR_VERSION | string | `"0.11.1"` | | | gitops-operator.fullnameOverride | string | `""` | | -| gitops-operator.image | object | `{"registry":"quay.io","repository":"codefresh/codefresh-gitops-operator","tag":"06ed649"}` | GitOps operator image | +| gitops-operator.image | object | `{"registry":"quay.io","repository":"codefresh/codefresh-gitops-operator","tag":"569808d"}` | GitOps operator image | | gitops-operator.imagePullSecrets | list | `[]` | | | gitops-operator.nameOverride | string | `""` | | | gitops-operator.nodeSelector | object | `{}` | | @@ -694,7 +694,7 @@ global: | global.codefresh.userToken | object | `{"secretKeyRef":{},"token":""}` | User token. Used for runtime registration against the patform. One of token (for plain text value) or secretKeyRef must be provided. | | global.codefresh.userToken.secretKeyRef | object | `{}` | User token that references an existing secret containing the token. | | global.codefresh.userToken.token | string | `""` | User token in plain text. The chart creates and manages the secret for this token. | -| global.event-reporters | object | `{"affinity":{},"config":{},"image":{"registry":"quay.io","repository":"codefresh/cf-argocd-extras","tag":"7477f32"},"livenessProbe":{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":10},"nodeSelector":{},"pdb":{"enabled":true,"maxUnavailable":"","minAvailable":"50%"},"readinessProbe":{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":10},"replicaCount":2,"resources":{"requests":{"cpu":"100m","memory":"128Mi"}},"service":{"ports":{"http":{"port":8088,"targetPort":8088},"metrics":{"port":8087,"targetPort":8087}},"type":"ClusterIP"},"serviceAccount":{"create":true},"serviceMonitor":{"enabled":false,"interval":"30s","labels":{},"scrapeTimeout":"10s"},"tolerations":[]}` | Global settings for event reporters Event reporters are used for reporting runtime and cluster resources to Codefresh platform | +| global.event-reporters | object | `{"affinity":{},"config":{},"image":{"registry":"quay.io","repository":"codefresh/cf-argocd-extras","tag":"70aa9f5"},"livenessProbe":{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":10},"nodeSelector":{},"pdb":{"enabled":true,"maxUnavailable":"","minAvailable":"50%"},"readinessProbe":{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":10},"replicaCount":2,"resources":{"requests":{"cpu":"100m","memory":"128Mi"}},"service":{"ports":{"http":{"port":8088,"targetPort":8088},"metrics":{"port":8087,"targetPort":8087}},"type":"ClusterIP"},"serviceAccount":{"create":true},"serviceMonitor":{"enabled":false,"interval":"30s","labels":{},"scrapeTimeout":"10s"},"tolerations":[]}` | Global settings for event reporters Event reporters are used for reporting runtime and cluster resources to Codefresh platform | | global.httpProxy | string | `""` | global HTTP_PROXY for all components | | global.httpsProxy | string | `""` | global HTTPS_PROXY for all components | | global.imageRegistry | string | `""` | | diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index abbe7769..1f102cf4 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -159,7 +159,7 @@ global: image: registry: quay.io repository: codefresh/cf-argocd-extras - tag: "7477f32" + tag: "70aa9f5" nodeSelector: {} tolerations: [] affinity: {} @@ -469,27 +469,27 @@ app-proxy: reportImage: registry: quay.io repository: codefreshplugins/argo-hub-codefresh-csdp-report-image-info - tag: 1.1.34 + tag: 1.1.35 # Git enrichment task image gitEnrichment: registry: quay.io repository: codefreshplugins/argo-hub-codefresh-csdp-image-enricher-git-info - tag: 1.1.34 + tag: 1.1.35 # Jira enrichment task image jiraEnrichment: registry: quay.io repository: codefreshplugins/argo-hub-codefresh-csdp-image-enricher-jira-info - tag: 1.1.34 + tag: 1.1.35 image: repository: quay.io/codefresh/cap-app-proxy - tag: 1.4154.0 + tag: 1.4159.0 pullPolicy: IfNotPresent # -- Extra volume mounts for main container extraVolumeMounts: [] initContainer: image: repository: quay.io/codefresh/cap-app-proxy-init - tag: 1.4154.0 + tag: 1.4159.0 pullPolicy: IfNotPresent command: - ./init.sh @@ -670,7 +670,7 @@ gitops-operator: image: registry: quay.io repository: codefresh/codefresh-gitops-operator - tag: 06ed649 + tag: 569808d env: !!merge <<: - *otel-config @@ -702,7 +702,7 @@ argo-gateway: image: registry: quay.io repository: codefresh/cf-argocd-extras - tag: "7477f32" + tag: "70aa9f5" nodeSelector: {} tolerations: [] affinity: {} diff --git a/installer-image/Dockerfile b/installer-image/Dockerfile index 6beded7d..6fde072b 100644 --- a/installer-image/Dockerfile +++ b/installer-image/Dockerfile @@ -1,9 +1,9 @@ # syntax=docker/dockerfile:1 # DHI source: https://hub.docker.com/repository/docker/octopusdeploy/dhi-golang/tags/1.25-debian13-dev -FROM octopusdeploy/dhi-golang:1.27-debian13-dev@sha256:baa8e6b0fe23dcfdcaec24af47e091660ba539685fe8340d0f5172227afadaf8 AS build +FROM octopusdeploy/dhi-golang:1.27-debian13-dev@sha256:e2e776afd69ca84181107b77325df3debb5e81f5386c6c4c4b0f5ab6681d8175 AS build ARG TARGETARCH -ARG CF_CLI_VERSION=v1.0.9 +ARG CF_CLI_VERSION=v1.0.10 RUN go install github.com/davidrjonas/semver-cli@latest \ && cp $GOPATH/bin/semver-cli /tmp/semver-cli RUN apt-get update && apt-get install -y --no-install-recommends sed && rm -rf /var/lib/apt/lists/* @@ -11,7 +11,7 @@ ADD --unpack=true --chown=nonroot:nonroot --chmod=755 https://github.com/codefre # DHI source: https://hub.docker.com/repository/docker/octopusdeploy/dhi-debian-base/customizations/8106437942896324135 -FROM octopusdeploy/dhi-debian-base:trixie_cf-gitops-runtime-installer-debian13@sha256:2e5be5688d72eaa8c578f7608b77c84b2024f510874d93a056f601d2901cd38b AS production +FROM octopusdeploy/dhi-debian-base:trixie_cf-gitops-runtime-installer-debian13@sha256:00340d01b29d04e01363bfb754380d47155fc75d0af3f311d09d849d43bab518 AS production ARG TARGETARCH COPY --from=build --chown=nonroot:nonroot --chmod=755 /tmp/cf/cf-linux-${TARGETARCH} /usr/local/bin/cf COPY --from=build --chown=nonroot:nonroot --chmod=755 /tmp/semver-cli /usr/local/bin/semver-cli From 6eb8984533e6793132a93c2a22c6bdba4c7e373f Mon Sep 17 00:00:00 2001 From: Bohdan Pysarenko Date: Wed, 14 Oct 2026 11:25:32 +0300 Subject: [PATCH 4/9] disable gitops-operator --- charts/gitops-runtime/README.md | 41 ++++++++++--------- charts/gitops-runtime/README.md.gotmpl | 39 +++++++++--------- .../gitops-runtime/tests/custom-ca_test.yaml | 2 + .../tests/external_argocd_test.yaml | 2 + .../tests/gitops-controller-misc_test.yaml | 2 + .../tests/gitops-operator-disabled_test.yaml | 11 +++++ .../tests/gitops-operator_test.yaml | 2 + .../tests/global_constraints_test.yaml | 2 + charts/gitops-runtime/values-ha.yaml | 1 + .../values-multi-runtimes-first.yaml | 1 + .../gitops-runtime/values-multi-runtimes.yaml | 1 + charts/gitops-runtime/values.yaml | 3 +- .../setup/values/runtime.values.yaml | 5 +++ 13 files changed, 72 insertions(+), 40 deletions(-) create mode 100644 charts/gitops-runtime/tests/gitops-operator-disabled_test.yaml diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index 70524e50..9e8d2c8f 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -16,6 +16,7 @@ - [Upgrading](#upgrading) - [To 0.23.x](#to-023x) - [> 0.24.x](#-024x) + - [To 0.32.x](#to-032x) ## Prerequisites @@ -60,9 +61,6 @@ argo-workflows: enabled: false tunnel-client: enabled: false -gitops-operator: - crds: - install: false ``` Note that for the first runtime in the cluster, you have to configure it to install the CRDs, with setting these values: @@ -76,9 +74,6 @@ argo-cd: argo-workflows: crds: install: true -gitops-operator: - crds: - install: true ``` > [!WARNING] @@ -279,19 +274,6 @@ app-proxy: matchLabels: app: cap-app-proxy -gitops-operator: - replicaCount: 2 - pdb: - enabled: true - minAvailable: 1 - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app: gitops-operator - internal-router: replicaCount: 2 pdb: @@ -456,6 +438,25 @@ global: ... ``` +### To 0.32.x + +#### GitOps operator is disabled by default + +The GitOps operator has reached End-of-Life and `.Values.gitops-operator.enabled` now defaults to `false`. +On upgrade, the chart removes the `gitops-operator` Deployment, ServiceAccount, RBAC, PDB, the `promotion-template` ServiceAccount/RBAC, and the operator CRDs +(`products`, `promotionflows`, `promotionpolicies`, `promotiontasks`, `promotiontemplates`, `restrictedgitsources` in the `codefresh.io` group). + +> [!WARNING] +> Deleting a CRD deletes all custom resources of that kind in the cluster. +> To keep the CRDs and their resources, set `gitops-operator.crds.keep: true` in your **currently installed** release (run `helm upgrade` with it first), and only then upgrade to 0.32.x. + +If you still rely on the GitOps operator, enable it explicitly when upgrading: + +```yaml +gitops-operator: + enabled: true +``` + ## Values | Key | Type | Default | Description | @@ -649,7 +650,7 @@ global: | gitops-operator.crds.annotations | object | `{}` | Annotations on gitops operator CRDs | | gitops-operator.crds.install | bool | `true` | Whether or not to install CRDs | | gitops-operator.crds.keep | bool | `false` | Keep CRDs if gitops runtime release is uninstalled | -| gitops-operator.enabled | bool | `true` | | +| gitops-operator.enabled | bool | `false` | Enable the GitOps operator. Disabled by default, the operator is End-of-Life. Set to `true` only if you still rely on it | | gitops-operator.env.<<[0].OTEL_EXPORTER_OTLP_COMPRESSION | string | `"gzip"` | Specifies the compression algorithm to be used for all telemetry data. Ref: https://opentelemetry.io/docs/specs/otel/protocol/exporter/ | | gitops-operator.env.<<[0].OTEL_EXPORTER_OTLP_ENDPOINT | string | `"http://localhost:4317"` | Base endpoint URL for all OpenTelemetry signals. Ref: https://opentelemetry.io/docs/languages/sdk-configuration/otlp-exporter/ | | gitops-operator.env.<<[0].OTEL_EXPORTER_OTLP_PROTOCOL | string | `"grpc"` | Specifies the OTLP transport protocol to be used for all telemetry data. Ref: https://opentelemetry.io/docs/languages/sdk-configuration/otlp-exporter/ | diff --git a/charts/gitops-runtime/README.md.gotmpl b/charts/gitops-runtime/README.md.gotmpl index 35280e35..4956cb24 100644 --- a/charts/gitops-runtime/README.md.gotmpl +++ b/charts/gitops-runtime/README.md.gotmpl @@ -16,6 +16,7 @@ - [Upgrading](#upgrading) - [To 0.23.x](#to-023x) - [> 0.24.x](#-024x) + - [To 0.32.x](#to-032x) ## Prerequisites @@ -60,9 +61,6 @@ argo-workflows: enabled: false tunnel-client: enabled: false -gitops-operator: - crds: - install: false ``` Note that for the first runtime in the cluster, you have to configure it to install the CRDs, with setting these values: @@ -76,9 +74,6 @@ argo-cd: argo-workflows: crds: install: true -gitops-operator: - crds: - install: true ``` > [!WARNING] @@ -284,19 +279,6 @@ app-proxy: matchLabels: app: cap-app-proxy -gitops-operator: - replicaCount: 2 - pdb: - enabled: true - minAvailable: 1 - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: DoNotSchedule - labelSelector: - matchLabels: - app: gitops-operator - internal-router: replicaCount: 2 pdb: @@ -461,4 +443,23 @@ global: ... ``` +### To 0.32.x + +#### GitOps operator is disabled by default + +The GitOps operator has reached End-of-Life and `.Values.gitops-operator.enabled` now defaults to `false`. +On upgrade, the chart removes the `gitops-operator` Deployment, ServiceAccount, RBAC, PDB, the `promotion-template` ServiceAccount/RBAC, and the operator CRDs +(`products`, `promotionflows`, `promotionpolicies`, `promotiontasks`, `promotiontemplates`, `restrictedgitsources` in the `codefresh.io` group). + +> [!WARNING] +> Deleting a CRD deletes all custom resources of that kind in the cluster. +> To keep the CRDs and their resources, set `gitops-operator.crds.keep: true` in your **currently installed** release (run `helm upgrade` with it first), and only then upgrade to 0.32.x. + +If you still rely on the GitOps operator, enable it explicitly when upgrading: + +```yaml +gitops-operator: + enabled: true +``` + {{ template "chart.valuesSection" . }} diff --git a/charts/gitops-runtime/tests/custom-ca_test.yaml b/charts/gitops-runtime/tests/custom-ca_test.yaml index afd63ede..cc0f1289 100644 --- a/charts/gitops-runtime/tests/custom-ca_test.yaml +++ b/charts/gitops-runtime/tests/custom-ca_test.yaml @@ -11,6 +11,8 @@ templates: - _components/cap-app-proxy/_deployment.yaml - _components/cap-app-proxy/_config.yaml - codefresh-cm.yaml +set: + gitops-operator.enabled: true tests: - it: test chart created secret contents - default secret key diff --git a/charts/gitops-runtime/tests/external_argocd_test.yaml b/charts/gitops-runtime/tests/external_argocd_test.yaml index e145efd5..88f8cfa8 100644 --- a/charts/gitops-runtime/tests/external_argocd_test.yaml +++ b/charts/gitops-runtime/tests/external_argocd_test.yaml @@ -8,6 +8,8 @@ templates: - _components/gitops-operator/* - app-proxy/external-argocd-token.yaml - codefresh-cm.yaml +set: + gitops-operator.enabled: true tests: - it: app-proxy ConfigMap should have valid ArgoCd URL values: diff --git a/charts/gitops-runtime/tests/gitops-controller-misc_test.yaml b/charts/gitops-runtime/tests/gitops-controller-misc_test.yaml index 01cfe401..702c0aa5 100644 --- a/charts/gitops-runtime/tests/gitops-controller-misc_test.yaml +++ b/charts/gitops-runtime/tests/gitops-controller-misc_test.yaml @@ -2,6 +2,8 @@ suite: misc tests on gitops-operator templates generation templates: - gitops-operator/* - _components/gitops-operator/* +set: + gitops-operator.enabled: true tests: - it: override both images works template: gitops-operator/deployment.yaml diff --git a/charts/gitops-runtime/tests/gitops-operator-disabled_test.yaml b/charts/gitops-runtime/tests/gitops-operator-disabled_test.yaml new file mode 100644 index 00000000..2d8d13a9 --- /dev/null +++ b/charts/gitops-runtime/tests/gitops-operator-disabled_test.yaml @@ -0,0 +1,11 @@ +# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json +suite: Test GitOps Operator is disabled by default +templates: + - gitops-operator/* +values: + - ./values/mandatory-values.yaml +tests: + - it: should not render any gitops-operator resources by default + asserts: + - hasDocuments: + count: 0 diff --git a/charts/gitops-runtime/tests/gitops-operator_test.yaml b/charts/gitops-runtime/tests/gitops-operator_test.yaml index 8368a827..4bdfdd4a 100644 --- a/charts/gitops-runtime/tests/gitops-operator_test.yaml +++ b/charts/gitops-runtime/tests/gitops-operator_test.yaml @@ -3,6 +3,8 @@ suite: Test GitOps Operator templates: - gitops-operator/** - _components/gitops-operator/** +set: + gitops-operator.enabled: true tests: - it: should have LEADER_ELECT set to true if replicaCount is greater than 1 values: diff --git a/charts/gitops-runtime/tests/global_constraints_test.yaml b/charts/gitops-runtime/tests/global_constraints_test.yaml index 3081e1f7..7ddc90c8 100644 --- a/charts/gitops-runtime/tests/global_constraints_test.yaml +++ b/charts/gitops-runtime/tests/global_constraints_test.yaml @@ -19,6 +19,8 @@ templates: - codefresh-cm.yaml values: - ./values/mandatory-values.yaml +set: + gitops-operator.enabled: true tests: - it: components should have nodeSelector and tolerations from .Values.global values: diff --git a/charts/gitops-runtime/values-ha.yaml b/charts/gitops-runtime/values-ha.yaml index ae9463af..b46e9e3c 100644 --- a/charts/gitops-runtime/values-ha.yaml +++ b/charts/gitops-runtime/values-ha.yaml @@ -17,6 +17,7 @@ app-proxy: matchLabels: app: cap-app-proxy +# gitops-operator is disabled by default (End-of-Life). gitops-operator: replicaCount: 2 pdb: diff --git a/charts/gitops-runtime/values-multi-runtimes-first.yaml b/charts/gitops-runtime/values-multi-runtimes-first.yaml index 7edbb31b..e9052bfd 100644 --- a/charts/gitops-runtime/values-multi-runtimes-first.yaml +++ b/charts/gitops-runtime/values-multi-runtimes-first.yaml @@ -8,6 +8,7 @@ argo-cd: argo-workflows: crds: install: true +# gitops-operator is disabled by default (End-of-Life). gitops-operator: crds: install: true diff --git a/charts/gitops-runtime/values-multi-runtimes.yaml b/charts/gitops-runtime/values-multi-runtimes.yaml index 5450bdd1..4f20f1a3 100644 --- a/charts/gitops-runtime/values-multi-runtimes.yaml +++ b/charts/gitops-runtime/values-multi-runtimes.yaml @@ -23,6 +23,7 @@ argo-workflows: enabled: false tunnel-client: enabled: false +# gitops-operator is disabled by default (End-of-Life). gitops-operator: crds: install: false diff --git a/charts/gitops-runtime/values.yaml b/charts/gitops-runtime/values.yaml index 1f102cf4..2c39ff23 100644 --- a/charts/gitops-runtime/values.yaml +++ b/charts/gitops-runtime/values.yaml @@ -640,7 +640,8 @@ app-proxy: # gitops-operator #----------------------------------------------------------------------------------------------------------------------- gitops-operator: - enabled: true + # -- Enable the GitOps operator. Disabled by default, the operator is End-of-Life. Set to `true` only if you still rely on it + enabled: false replicaCount: 1 # -- Codefresh gitops operator crds crds: diff --git a/tests/component-tests/setup/values/runtime.values.yaml b/tests/component-tests/setup/values/runtime.values.yaml index 316ebe80..194c889f 100644 --- a/tests/component-tests/setup/values/runtime.values.yaml +++ b/tests/component-tests/setup/values/runtime.values.yaml @@ -12,6 +12,7 @@ # - Configures internal router and app-proxy for test networking. # - Sets a unique runtime name and disables validation steps. # - Uses a test-specific image tag for the gitops-operator. +# - Enables the gitops-operator (disabled by default in the chart). # # These values are used by the Helm install command in the test suite. # ----------------------------------------------------------------------------- @@ -49,3 +50,7 @@ internal-router: app-proxy: config: cors: "http://mockserver.mockserver:1080" + +# gitops-operator is disabled by default; component tests cover promotions, so it must be enabled +gitops-operator: + enabled: true From 27d855d20b50588e64cd250cc96e118b18a8412c Mon Sep 17 00:00:00 2001 From: Bohdan Pysarenko Date: Wed, 14 Oct 2026 12:12:08 +0300 Subject: [PATCH 5/9] disable codefresh-gitops-operator --- charts/gitops-runtime/Chart.yaml | 6 +++--- charts/gitops-runtime/README.md.gotmpl | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index 6f9391dc..0c858eb5 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 appVersion: 0.1.72 description: A Helm chart for Codefresh gitops runtime name: gitops-runtime -version: 0.31.3 +version: 0.32.0 home: https://github.com/codefresh-io/gitops-runtime-helm icon: https://avatars1.githubusercontent.com/u/11412079?v=3 keywords: @@ -15,10 +15,10 @@ annotations: artifacthub.io/alternativeName: "codefresh-gitops-runtime" artifacthub.io/changes: |- - kind: changed - description: 'Release 0.31.3' + description: 'Release 0.32.0' links: - name: 'Release notes' - url: 'https://github.com/codefresh-io/gitops-runtime-helm/releases/tag/0.31.3' + url: 'https://github.com/codefresh-io/gitops-runtime-helm/releases/tag/0.32.0' dependencies: - name: argo-cd repository: https://argoproj.github.io/argo-helm diff --git a/charts/gitops-runtime/README.md.gotmpl b/charts/gitops-runtime/README.md.gotmpl index ee955ee1..7ca242db 100644 --- a/charts/gitops-runtime/README.md.gotmpl +++ b/charts/gitops-runtime/README.md.gotmpl @@ -456,7 +456,7 @@ On upgrade, the chart removes the `gitops-operator` Deployment, ServiceAccount, > Deleting a CRD deletes all custom resources of that kind in the cluster. > To keep the CRDs and their resources, set `gitops-operator.crds.keep: true` in your **currently installed** release (run `helm upgrade` with it first), and only then upgrade to 0.32.x. -If you still rely on the GitOps operator, enable it explicitly when upgrading: +If you still rely on the GitOps operator(you use restricted-git-sources with your runtime), enable it explicitly when upgrading: ```yaml gitops-operator: From 5d09095ebb6a2b083db7f0d41834f8d9ae74c86f Mon Sep 17 00:00:00 2001 From: "codefresh-git-integration[bot]" <151943927+codefresh-git-integration[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 09:15:02 +0000 Subject: [PATCH 6/9] CI Automatic commit - align Chart version --- charts/gitops-runtime/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index 0c858eb5..d7378b20 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 appVersion: 0.1.72 description: A Helm chart for Codefresh gitops runtime name: gitops-runtime -version: 0.32.0 +version: 0.31.4 home: https://github.com/codefresh-io/gitops-runtime-helm icon: https://avatars1.githubusercontent.com/u/11412079?v=3 keywords: From d7745fe5c955f217c723a0be527f203c5c37fff7 Mon Sep 17 00:00:00 2001 From: Bohdan Pysarenko Date: Wed, 14 Oct 2026 12:16:20 +0300 Subject: [PATCH 7/9] fix readme --- charts/gitops-runtime/README.md | 30 ++++++++++++++++++++++---- charts/gitops-runtime/README.md.gotmpl | 22 +++++++++++++++++++ 2 files changed, 48 insertions(+), 4 deletions(-) diff --git a/charts/gitops-runtime/README.md b/charts/gitops-runtime/README.md index 1a2d4c80..01bd18d0 100644 --- a/charts/gitops-runtime/README.md +++ b/charts/gitops-runtime/README.md @@ -1,5 +1,5 @@ ## Codefresh gitops runtime -![Version: 0.31.3](https://img.shields.io/badge/Version-0.31.3-informational?style=flat-square) ![AppVersion: 0.1.72](https://img.shields.io/badge/AppVersion-0.1.72-informational?style=flat-square) +![Version: 0.32.0](https://img.shields.io/badge/Version-0.32.0-informational?style=flat-square) ![AppVersion: 0.1.72](https://img.shields.io/badge/AppVersion-0.1.72-informational?style=flat-square) ## Table of Content @@ -61,6 +61,10 @@ argo-workflows: enabled: false tunnel-client: enabled: false +# gitops-operator is disabled by default (End-of-Life). +gitops-operator: + crds: + install: false ``` Note that for the first runtime in the cluster, you have to configure it to install the CRDs, with setting these values: @@ -74,6 +78,10 @@ argo-cd: argo-workflows: crds: install: true +# gitops-operator is disabled by default (End-of-Life). +gitops-operator: + crds: + install: true ``` > [!WARNING] @@ -202,7 +210,7 @@ We have created a helper utility to resolve this issue: The utility is packaged in a container image. Below are instructions on executing the utility using Docker: ``` -docker run -v :/output quay.io/codefresh/gitops-runtime-private-registry-utils:0.31.3 +docker run -v :/output quay.io/codefresh/gitops-runtime-private-registry-utils:0.32.0 ``` `output_dir` - is a local directory where the utility will output files.
`local_registry` - is your local registry where you want to mirror the images to @@ -215,7 +223,7 @@ The utility will output 4 files into the folder: For usage with external ArgoCD run the utility with `EXTERNAL_ARGOCD` environment variable set to `true`. ``` -docker run -e EXTERNAL_ARGOCD=true -v :/output quay.io/codefresh/gitops-runtime-private-registry-utils:0.31.3 +docker run -e EXTERNAL_ARGOCD=true -v :/output quay.io/codefresh/gitops-runtime-private-registry-utils:0.32.0 ``` ## Openshift @@ -275,6 +283,20 @@ app-proxy: matchLabels: app: cap-app-proxy +# gitops-operator is disabled by default (End-of-Life). +gitops-operator: + replicaCount: 2 + pdb: + enabled: true + minAvailable: 1 + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app: gitops-operator + internal-router: replicaCount: 2 pdb: @@ -451,7 +473,7 @@ On upgrade, the chart removes the `gitops-operator` Deployment, ServiceAccount, > Deleting a CRD deletes all custom resources of that kind in the cluster. > To keep the CRDs and their resources, set `gitops-operator.crds.keep: true` in your **currently installed** release (run `helm upgrade` with it first), and only then upgrade to 0.32.x. -If you still rely on the GitOps operator, enable it explicitly when upgrading: +If you still rely on the GitOps operator(you use restricted-git-sources with your runtime), enable it explicitly when upgrading: ```yaml gitops-operator: diff --git a/charts/gitops-runtime/README.md.gotmpl b/charts/gitops-runtime/README.md.gotmpl index 7ca242db..fa7e29b8 100644 --- a/charts/gitops-runtime/README.md.gotmpl +++ b/charts/gitops-runtime/README.md.gotmpl @@ -61,6 +61,10 @@ argo-workflows: enabled: false tunnel-client: enabled: false +# gitops-operator is disabled by default (End-of-Life). +gitops-operator: + crds: + install: false ``` Note that for the first runtime in the cluster, you have to configure it to install the CRDs, with setting these values: @@ -74,6 +78,10 @@ argo-cd: argo-workflows: crds: install: true +# gitops-operator is disabled by default (End-of-Life). +gitops-operator: + crds: + install: true ``` > [!WARNING] @@ -280,6 +288,20 @@ app-proxy: matchLabels: app: cap-app-proxy +# gitops-operator is disabled by default (End-of-Life). +gitops-operator: + replicaCount: 2 + pdb: + enabled: true + minAvailable: 1 + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + app: gitops-operator + internal-router: replicaCount: 2 pdb: From 80e8b3bbf61ae3e8a7e07da6d79b3cdb4aa7d7a1 Mon Sep 17 00:00:00 2001 From: Bohdan Pysarenko Date: Wed, 14 Oct 2026 12:17:58 +0300 Subject: [PATCH 8/9] fix version --- charts/gitops-runtime/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index d7378b20..0c858eb5 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 appVersion: 0.1.72 description: A Helm chart for Codefresh gitops runtime name: gitops-runtime -version: 0.31.4 +version: 0.32.0 home: https://github.com/codefresh-io/gitops-runtime-helm icon: https://avatars1.githubusercontent.com/u/11412079?v=3 keywords: From e7f08b028ba733068b42760036f171488d832d3e Mon Sep 17 00:00:00 2001 From: "codefresh-git-integration[bot]" <151943927+codefresh-git-integration[bot]@users.noreply.github.com> Date: Wed, 14 Oct 2026 09:20:28 +0000 Subject: [PATCH 9/9] CI Automatic commit - align Chart version --- charts/gitops-runtime/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/gitops-runtime/Chart.yaml b/charts/gitops-runtime/Chart.yaml index 0c858eb5..d7378b20 100644 --- a/charts/gitops-runtime/Chart.yaml +++ b/charts/gitops-runtime/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 appVersion: 0.1.72 description: A Helm chart for Codefresh gitops runtime name: gitops-runtime -version: 0.32.0 +version: 0.31.4 home: https://github.com/codefresh-io/gitops-runtime-helm icon: https://avatars1.githubusercontent.com/u/11412079?v=3 keywords: