Kubernetes: (re)add reflector chart#1452
Merged
YuryHrytsuk merged 1 commit intoJul 8, 2026
Merged
Conversation
Add reflector chart respecting security guidelines. We have to introduce our own chart as there is no way to add network policy. Once emberstack/kubernetes-reflector#664 is merged, we can ditch our own chart and use reflector chart directly. Related PR/s * config (helmfile) changes https://git.speag.com/oSparc/osparc-ops-deployment-configuration/-/merge_requests/2135
mrnicegyu11
approved these changes
Jul 8, 2026
mrnicegyu11
left a comment
mrnicegyu11
left a comment
Member
There was a problem hiding this comment.
lgtm, didnt I just review a similar PR yesterday?
Collaborator
Author
you reviewed a different PR yesterday #1444 |
mrnicegyu11
pushed a commit
to mrnicegyu11/osparc-ops-environments
that referenced
this pull request
Jul 8, 2026
Add reflector chart respecting security guidelines. We have to introduce our own chart as there is no way to add network policy. Once emberstack/kubernetes-reflector#664 is merged, we can ditch our own chart and use reflector chart directly. Related PR/s * config (helmfile) changes https://git.speag.com/oSparc/osparc-ops-deployment-configuration/-/merge_requests/2135
mrnicegyu11
added a commit
that referenced
this pull request
Jul 8, 2026
* wip * Add csi-s3 and have portainer use it * Change request @Hrytsuk 1GB max portainer volume size * Arch Linux Certificates Customization * Fix pgsql exporter failure * [Kubernetes] Introduce on-prem persistent Storage (Longhorn) 🎉 (#979) * Introduce longhorn chart * Further longhorn configuration * Longhorn: further settings configuration * Fix longhorn configuration bugs Extra: introduce longhorn pv vales for portainer * Add comment for deletion longhorn * Further longhorn configuration * Add README.md for Longhorn wit FAQ * Update Longhorn readme * Update readme * Futher LH configuration * Update LH's Readme * Update Longhorn Readme * Improve LH's Readme * LH: Reduce reserved default disk space to 5% Since we use a dedicated disk for LH, we can go ahead with 5% * Use values to set Longhorn storage class * Update LH's Readme * LH Readme: add requirements reference * PR Review: bring back portainer s3 pv * LH: decrease portinaer volume size * Experimental: Try to add tracing to simcore-traefik on master * Fixes ITISFoundation/osparc-simcore#7363 * Arch Linux Certificates Customization - 2 * Revert: disable loki & vector-dev, oldschool graylog logging (#1223) * wip * Add csi-s3 and have portainer use it * Change request @Hrytsuk 1GB max portainer volume size * Arch Linux Certificates Customization * Fix pgsql exporter failure * [Kubernetes] Introduce on-prem persistent Storage (Longhorn) 🎉 (#979) * Introduce longhorn chart * Further longhorn configuration * Longhorn: further settings configuration * Fix longhorn configuration bugs Extra: introduce longhorn pv vales for portainer * Add comment for deletion longhorn * Further longhorn configuration * Add README.md for Longhorn wit FAQ * Update Longhorn readme * Update readme * Futher LH configuration * Update LH's Readme * Update Longhorn Readme * Improve LH's Readme * LH: Reduce reserved default disk space to 5% Since we use a dedicated disk for LH, we can go ahead with 5% * Use values to set Longhorn storage class * Update LH's Readme * LH Readme: add requirements reference * PR Review: bring back portainer s3 pv * LH: decrease portinaer volume size * Experimental: Try to add tracing to simcore-traefik on master * Fixes ITISFoundation/osparc-simcore#7363 * Arch Linux Certificates Customization - 2 * Send docker logs directly to graylog * revert arch linux customization --------- Co-authored-by: Dustin Kaiser <mrnicegyu11@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> * Enable Chatbot for S4L products (#1221) * wip * Add csi-s3 and have portainer use it * Change request @Hrytsuk 1GB max portainer volume size * Arch Linux Certificates Customization * Fix pgsql exporter failure * [Kubernetes] Introduce on-prem persistent Storage (Longhorn) 🎉 (#979) * Introduce longhorn chart * Further longhorn configuration * Longhorn: further settings configuration * Fix longhorn configuration bugs Extra: introduce longhorn pv vales for portainer * Add comment for deletion longhorn * Further longhorn configuration * Add README.md for Longhorn wit FAQ * Update Longhorn readme * Update readme * Futher LH configuration * Update LH's Readme * Update Longhorn Readme * Improve LH's Readme * LH: Reduce reserved default disk space to 5% Since we use a dedicated disk for LH, we can go ahead with 5% * Use values to set Longhorn storage class * Update LH's Readme * LH Readme: add requirements reference * PR Review: bring back portainer s3 pv * LH: decrease portinaer volume size * Experimental: Try to add tracing to simcore-traefik on master * Fixes ITISFoundation/osparc-simcore#7363 * Arch Linux Certificates Customization - 2 * Remove frontend vendor chatbot service * wip --------- Co-authored-by: Dustin Kaiser <mrnicegyu11@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> * Kubernetes: fix global network policy (#1227) * Add authentication middleware to cahtbot vendor service * Revert "Kubernetes: fix global network policy (#1227)" This reverts commit 2d3adb1. * Add ACME DNS Resolver for gitlabCD and k8s (#1217) * wip * Add csi-s3 and have portainer use it * Change request @Hrytsuk 1GB max portainer volume size * Arch Linux Certificates Customization * Fix pgsql exporter failure * [Kubernetes] Introduce on-prem persistent Storage (Longhorn) 🎉 (#979) * Introduce longhorn chart * Further longhorn configuration * Longhorn: further settings configuration * Fix longhorn configuration bugs Extra: introduce longhorn pv vales for portainer * Add comment for deletion longhorn * Further longhorn configuration * Add README.md for Longhorn wit FAQ * Update Longhorn readme * Update readme * Futher LH configuration * Update LH's Readme * Update Longhorn Readme * Improve LH's Readme * LH: Reduce reserved default disk space to 5% Since we use a dedicated disk for LH, we can go ahead with 5% * Use values to set Longhorn storage class * Update LH's Readme * LH Readme: add requirements reference * PR Review: bring back portainer s3 pv * LH: decrease portinaer volume size * Experimental: Try to add tracing to simcore-traefik on master * Fixes ITISFoundation/osparc-simcore#7363 * Arch Linux Certificates Customization - 2 * wip * wip * this might work * k8s wip * wip * wip --------- Co-authored-by: Dustin Kaiser <mrnicegyu11@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> * Propagate chatbot rest api enabled env (#1360) * move services around (cleanup) * add first services * add more prometheus configs * add all instrumented simcore services to grafana dashboard * add newline in grafana dashboard json * minor improvement to simcore service grafana dashboard * end with empty lineto please gh * several other minor changes * another minor fix * ensure newline * fix files which don't match itis/main * Add tracing sampling percentage (#1230) * move services around (cleanup) * add first services * add more prometheus configs * add all instrumented simcore services to grafana dashboard * add newline in grafana dashboard json * minor improvement to simcore service grafana dashboard * end with empty lineto please gh * several other minor changes * another minor fix * ensure newline * remove TRACING_OPENTELEMETRY_COLLECTOR_SAMPLING_PERCENTAGE and add TRACING_SAMPLING_PROBABILITY * fix files which don't match itis/main * TRACING_SAMPLING_PROBABILITY -> TRACING_OPENTELEMETRY_SAMPLING_PROBABILITY --------- Co-authored-by: Dustin Kaiser <8209087+mrnicegyu11@users.noreply.github.com> * get rid of not needed files * propagate env to chatbot --------- Co-authored-by: Dustin Kaiser <8209087+mrnicegyu11@users.noreply.github.com> * Ensure otel collector port propagates to chatbot (#1425) * move services around (cleanup) * add first services * add more prometheus configs * add all instrumented simcore services to grafana dashboard * add newline in grafana dashboard json * minor improvement to simcore service grafana dashboard * end with empty lineto please gh * several other minor changes * another minor fix * ensure newline * fix files which don't match itis/main * Add tracing sampling percentage (#1230) * move services around (cleanup) * add first services * add more prometheus configs * add all instrumented simcore services to grafana dashboard * add newline in grafana dashboard json * minor improvement to simcore service grafana dashboard * end with empty lineto please gh * several other minor changes * another minor fix * ensure newline * remove TRACING_OPENTELEMETRY_COLLECTOR_SAMPLING_PERCENTAGE and add TRACING_SAMPLING_PROBABILITY * fix files which don't match itis/main * TRACING_SAMPLING_PROBABILITY -> TRACING_OPENTELEMETRY_SAMPLING_PROBABILITY --------- Co-authored-by: Dustin Kaiser <8209087+mrnicegyu11@users.noreply.github.com> * get rid of not needed files * update chatbot otel collector endpoint * Update propagated env vars --------- Co-authored-by: Dustin Kaiser <8209087+mrnicegyu11@users.noreply.github.com> * Kubernetes network global deny policy hardening (#1429) * Kubernetes: update global network deny policy Remove installed by us app from exceptions (e.g. traefik, lognhorn, etc.) Related issues/s * closes #1138 * Stricten global network deny policy * Stricten calico apiserver policy * Kubernetes enforce container resource limits (#1431) * Kubernetes: update global network deny policy Remove installed by us app from exceptions (e.g. traefik, lognhorn, etc.) Related issues/s * closes #1138 * Stricten global network deny policy * Stricten calico apiserver policy * Kubernetes: globally enforce container resource limits Add validation admission policy (https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/) to enforce all containers to define resource limits. This enforcement can be skipped by using special pod metadata label (see comment in policy'c template) Note: Validation Admission Policy require Kubernetes version 1.30+ Related issue/s * #1122 Related PR/s * updated kubernetes to 1.30 https://git.speag.com/oSparc/osparc-infra/-/merge_requests/356 * unignor values * do not ignore values*.yaml * CI: trivy scan charts (#1435) * CI: trivy scan charts * fix trivy github action version * fix trivy github action version * fix trivy github action version * update helmfile deps in action * fix helmfile plugin setting * try fix * fix * udpate how ci triggered * check helmfile.ci.yaml coverage * remove existing unused charts to start from scratch * add exception to trivy * Remove GPU operator policy * fix end-of-file pre-commit; * remove outdated exception * fix trivy exception doc * Update workflow trigger events * use trivy github format * keep trivy color in actions * remove useless setting * Added open telemetry collector upgrade notes (#1414) * added upgrade note * using approriate env var * removed unsued * Add renovate to track (for now: kubernetes) dependencies (#1437) * Add renovate to track (for now: kubernetes) dependencies This PR adds a workflow that runs daily at 4:00 AM (UTC most likely) to monitor existing Chart and helmilfe dependencies. It does create a `Dashboard` issue where it lists all necessary updates and creates for each update a PR. This workflow can also be trigger manually if necessary Read more https://github.com/renovatebot/renovate Github action https://github.com/renovatebot/github-action Related issue/s * #1428 * remove workflow to rely on github app * Add renovate badge to README.md * Add badge and schedule * Fix kubernetes deploy pipelines (#1441) * Run renovate daily (#1442) Fix existing schedule which is most likely wrong. * Renovate: set minimum release age to 60d (#1443) Wait 2 months before updating dependency to reduce risk of supply chain attacks and other potential problems. After 2 months we can be more sure that a new dep version is stable. Read more at https://docs.renovatebot.com/key-concepts/minimum-release-age/ * Renovate: monitor github workflows's deps (#1446) * Update actions/setup-python action to v6 (#1447) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Fix monitoring pgsql-query-exporter wrong image (#1445) The previos image+tag combination does not exist anymore. See albertodonato/query-exporter#362 It is also recommend in the issue above to use dockerhub images. * Update actions/checkout action to v6 (#1449) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Update helmfile/helmfile-action action to v2.4.4 (#1448) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> * Update github/codeql-action action to v4 (#1450) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Kubernetes: (re)add cert-manager (#1444) * Kubernetes: (re)add cert-manager * fix trivy findings * remove helmfile ignore * fix namespace * comment on sleector * Fix acme config Error: Failed to render chart: exit status 1: Error: values don't meet the specifications of the schema(s) in the following chart(s): cert-manager: - (root): Additional property skipDNSResolutionCheck is not allowed Error: plugin "diff" exited with erro * Kubernetes: (re)add reflector chart (#1452) Add reflector chart respecting security guidelines. We have to introduce our own chart as there is no way to add network policy. Once emberstack/kubernetes-reflector#664 is merged, we can ditch our own chart and use reflector chart directly. Related PR/s * config (helmfile) changes https://git.speag.com/oSparc/osparc-ops-deployment-configuration/-/merge_requests/2135 * Add API worker to monitored network * fixy fix --------- Co-authored-by: Dustin Kaiser <mrnicegyu11@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> Co-authored-by: Mads Bisgaard <126242332+bisgaard-itis@users.noreply.github.com> Co-authored-by: Andrei Neagu <5694077+GitHK@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
48 tasks
mrnicegyu11
added a commit
to mrnicegyu11/osparc-ops-environments
that referenced
this pull request
Jul 9, 2026
* wip * Add csi-s3 and have portainer use it * Change request @Hrytsuk 1GB max portainer volume size * Arch Linux Certificates Customization * Fix pgsql exporter failure * [Kubernetes] Introduce on-prem persistent Storage (Longhorn) 🎉 (ITISFoundation#979) * Introduce longhorn chart * Further longhorn configuration * Longhorn: further settings configuration * Fix longhorn configuration bugs Extra: introduce longhorn pv vales for portainer * Add comment for deletion longhorn * Further longhorn configuration * Add README.md for Longhorn wit FAQ * Update Longhorn readme * Update readme * Futher LH configuration * Update LH's Readme * Update Longhorn Readme * Improve LH's Readme * LH: Reduce reserved default disk space to 5% Since we use a dedicated disk for LH, we can go ahead with 5% * Use values to set Longhorn storage class * Update LH's Readme * LH Readme: add requirements reference * PR Review: bring back portainer s3 pv * LH: decrease portinaer volume size * Experimental: Try to add tracing to simcore-traefik on master * Fixes ITISFoundation/osparc-simcore#7363 * Arch Linux Certificates Customization - 2 * Revert: disable loki & vector-dev, oldschool graylog logging (ITISFoundation#1223) * wip * Add csi-s3 and have portainer use it * Change request @Hrytsuk 1GB max portainer volume size * Arch Linux Certificates Customization * Fix pgsql exporter failure * [Kubernetes] Introduce on-prem persistent Storage (Longhorn) 🎉 (ITISFoundation#979) * Introduce longhorn chart * Further longhorn configuration * Longhorn: further settings configuration * Fix longhorn configuration bugs Extra: introduce longhorn pv vales for portainer * Add comment for deletion longhorn * Further longhorn configuration * Add README.md for Longhorn wit FAQ * Update Longhorn readme * Update readme * Futher LH configuration * Update LH's Readme * Update Longhorn Readme * Improve LH's Readme * LH: Reduce reserved default disk space to 5% Since we use a dedicated disk for LH, we can go ahead with 5% * Use values to set Longhorn storage class * Update LH's Readme * LH Readme: add requirements reference * PR Review: bring back portainer s3 pv * LH: decrease portinaer volume size * Experimental: Try to add tracing to simcore-traefik on master * Fixes ITISFoundation/osparc-simcore#7363 * Arch Linux Certificates Customization - 2 * Send docker logs directly to graylog * revert arch linux customization --------- Co-authored-by: Dustin Kaiser <mrnicegyu11@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> * Enable Chatbot for S4L products (ITISFoundation#1221) * wip * Add csi-s3 and have portainer use it * Change request @Hrytsuk 1GB max portainer volume size * Arch Linux Certificates Customization * Fix pgsql exporter failure * [Kubernetes] Introduce on-prem persistent Storage (Longhorn) 🎉 (ITISFoundation#979) * Introduce longhorn chart * Further longhorn configuration * Longhorn: further settings configuration * Fix longhorn configuration bugs Extra: introduce longhorn pv vales for portainer * Add comment for deletion longhorn * Further longhorn configuration * Add README.md for Longhorn wit FAQ * Update Longhorn readme * Update readme * Futher LH configuration * Update LH's Readme * Update Longhorn Readme * Improve LH's Readme * LH: Reduce reserved default disk space to 5% Since we use a dedicated disk for LH, we can go ahead with 5% * Use values to set Longhorn storage class * Update LH's Readme * LH Readme: add requirements reference * PR Review: bring back portainer s3 pv * LH: decrease portinaer volume size * Experimental: Try to add tracing to simcore-traefik on master * Fixes ITISFoundation/osparc-simcore#7363 * Arch Linux Certificates Customization - 2 * Remove frontend vendor chatbot service * wip --------- Co-authored-by: Dustin Kaiser <mrnicegyu11@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> * Kubernetes: fix global network policy (ITISFoundation#1227) * Add authentication middleware to cahtbot vendor service * Revert "Kubernetes: fix global network policy (ITISFoundation#1227)" This reverts commit 2d3adb1. * Add ACME DNS Resolver for gitlabCD and k8s (ITISFoundation#1217) * wip * Add csi-s3 and have portainer use it * Change request @Hrytsuk 1GB max portainer volume size * Arch Linux Certificates Customization * Fix pgsql exporter failure * [Kubernetes] Introduce on-prem persistent Storage (Longhorn) 🎉 (ITISFoundation#979) * Introduce longhorn chart * Further longhorn configuration * Longhorn: further settings configuration * Fix longhorn configuration bugs Extra: introduce longhorn pv vales for portainer * Add comment for deletion longhorn * Further longhorn configuration * Add README.md for Longhorn wit FAQ * Update Longhorn readme * Update readme * Futher LH configuration * Update LH's Readme * Update Longhorn Readme * Improve LH's Readme * LH: Reduce reserved default disk space to 5% Since we use a dedicated disk for LH, we can go ahead with 5% * Use values to set Longhorn storage class * Update LH's Readme * LH Readme: add requirements reference * PR Review: bring back portainer s3 pv * LH: decrease portinaer volume size * Experimental: Try to add tracing to simcore-traefik on master * Fixes ITISFoundation/osparc-simcore#7363 * Arch Linux Certificates Customization - 2 * wip * wip * this might work * k8s wip * wip * wip --------- Co-authored-by: Dustin Kaiser <mrnicegyu11@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> * Propagate chatbot rest api enabled env (ITISFoundation#1360) * move services around (cleanup) * add first services * add more prometheus configs * add all instrumented simcore services to grafana dashboard * add newline in grafana dashboard json * minor improvement to simcore service grafana dashboard * end with empty lineto please gh * several other minor changes * another minor fix * ensure newline * fix files which don't match itis/main * Add tracing sampling percentage (ITISFoundation#1230) * move services around (cleanup) * add first services * add more prometheus configs * add all instrumented simcore services to grafana dashboard * add newline in grafana dashboard json * minor improvement to simcore service grafana dashboard * end with empty lineto please gh * several other minor changes * another minor fix * ensure newline * remove TRACING_OPENTELEMETRY_COLLECTOR_SAMPLING_PERCENTAGE and add TRACING_SAMPLING_PROBABILITY * fix files which don't match itis/main * TRACING_SAMPLING_PROBABILITY -> TRACING_OPENTELEMETRY_SAMPLING_PROBABILITY --------- Co-authored-by: Dustin Kaiser <8209087+mrnicegyu11@users.noreply.github.com> * get rid of not needed files * propagate env to chatbot --------- Co-authored-by: Dustin Kaiser <8209087+mrnicegyu11@users.noreply.github.com> * Ensure otel collector port propagates to chatbot (ITISFoundation#1425) * move services around (cleanup) * add first services * add more prometheus configs * add all instrumented simcore services to grafana dashboard * add newline in grafana dashboard json * minor improvement to simcore service grafana dashboard * end with empty lineto please gh * several other minor changes * another minor fix * ensure newline * fix files which don't match itis/main * Add tracing sampling percentage (ITISFoundation#1230) * move services around (cleanup) * add first services * add more prometheus configs * add all instrumented simcore services to grafana dashboard * add newline in grafana dashboard json * minor improvement to simcore service grafana dashboard * end with empty lineto please gh * several other minor changes * another minor fix * ensure newline * remove TRACING_OPENTELEMETRY_COLLECTOR_SAMPLING_PERCENTAGE and add TRACING_SAMPLING_PROBABILITY * fix files which don't match itis/main * TRACING_SAMPLING_PROBABILITY -> TRACING_OPENTELEMETRY_SAMPLING_PROBABILITY --------- Co-authored-by: Dustin Kaiser <8209087+mrnicegyu11@users.noreply.github.com> * get rid of not needed files * update chatbot otel collector endpoint * Update propagated env vars --------- Co-authored-by: Dustin Kaiser <8209087+mrnicegyu11@users.noreply.github.com> * Kubernetes network global deny policy hardening (ITISFoundation#1429) * Kubernetes: update global network deny policy Remove installed by us app from exceptions (e.g. traefik, lognhorn, etc.) Related issues/s * closes ITISFoundation#1138 * Stricten global network deny policy * Stricten calico apiserver policy * Kubernetes enforce container resource limits (ITISFoundation#1431) * Kubernetes: update global network deny policy Remove installed by us app from exceptions (e.g. traefik, lognhorn, etc.) Related issues/s * closes ITISFoundation#1138 * Stricten global network deny policy * Stricten calico apiserver policy * Kubernetes: globally enforce container resource limits Add validation admission policy (https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/) to enforce all containers to define resource limits. This enforcement can be skipped by using special pod metadata label (see comment in policy'c template) Note: Validation Admission Policy require Kubernetes version 1.30+ Related issue/s * ITISFoundation#1122 Related PR/s * updated kubernetes to 1.30 https://git.speag.com/oSparc/osparc-infra/-/merge_requests/356 * unignor values * do not ignore values*.yaml * CI: trivy scan charts (ITISFoundation#1435) * CI: trivy scan charts * fix trivy github action version * fix trivy github action version * fix trivy github action version * update helmfile deps in action * fix helmfile plugin setting * try fix * fix * udpate how ci triggered * check helmfile.ci.yaml coverage * remove existing unused charts to start from scratch * add exception to trivy * Remove GPU operator policy * fix end-of-file pre-commit; * remove outdated exception * fix trivy exception doc * Update workflow trigger events * use trivy github format * keep trivy color in actions * remove useless setting * Added open telemetry collector upgrade notes (ITISFoundation#1414) * added upgrade note * using approriate env var * removed unsued * Add renovate to track (for now: kubernetes) dependencies (ITISFoundation#1437) * Add renovate to track (for now: kubernetes) dependencies This PR adds a workflow that runs daily at 4:00 AM (UTC most likely) to monitor existing Chart and helmilfe dependencies. It does create a `Dashboard` issue where it lists all necessary updates and creates for each update a PR. This workflow can also be trigger manually if necessary Read more https://github.com/renovatebot/renovate Github action https://github.com/renovatebot/github-action Related issue/s * ITISFoundation#1428 * remove workflow to rely on github app * Add renovate badge to README.md * Add badge and schedule * Fix kubernetes deploy pipelines (ITISFoundation#1441) * Run renovate daily (ITISFoundation#1442) Fix existing schedule which is most likely wrong. * Renovate: set minimum release age to 60d (ITISFoundation#1443) Wait 2 months before updating dependency to reduce risk of supply chain attacks and other potential problems. After 2 months we can be more sure that a new dep version is stable. Read more at https://docs.renovatebot.com/key-concepts/minimum-release-age/ * Renovate: monitor github workflows's deps (ITISFoundation#1446) * Update actions/setup-python action to v6 (ITISFoundation#1447) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Fix monitoring pgsql-query-exporter wrong image (ITISFoundation#1445) The previos image+tag combination does not exist anymore. See albertodonato/query-exporter#362 It is also recommend in the issue above to use dockerhub images. * Update actions/checkout action to v6 (ITISFoundation#1449) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Update helmfile/helmfile-action action to v2.4.4 (ITISFoundation#1448) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> * Update github/codeql-action action to v4 (ITISFoundation#1450) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Kubernetes: (re)add cert-manager (ITISFoundation#1444) * Kubernetes: (re)add cert-manager * fix trivy findings * remove helmfile ignore * fix namespace * comment on sleector * Fix acme config Error: Failed to render chart: exit status 1: Error: values don't meet the specifications of the schema(s) in the following chart(s): cert-manager: - (root): Additional property skipDNSResolutionCheck is not allowed Error: plugin "diff" exited with erro * Kubernetes: (re)add reflector chart (ITISFoundation#1452) Add reflector chart respecting security guidelines. We have to introduce our own chart as there is no way to add network policy. Once emberstack/kubernetes-reflector#664 is merged, we can ditch our own chart and use reflector chart directly. Related PR/s * config (helmfile) changes https://git.speag.com/oSparc/osparc-ops-deployment-configuration/-/merge_requests/2135 * Add API worker to monitored network * fixy fix --------- Co-authored-by: Dustin Kaiser <mrnicegyu11@users.noreply.github.com> Co-authored-by: YH <50014626+YuryHrytsuk@users.noreply.github.com> Co-authored-by: Mads Bisgaard <126242332+bisgaard-itis@users.noreply.github.com> Co-authored-by: Andrei Neagu <5694077+GitHK@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What do these changes do?
Add reflector chart respecting security guidelines. We need
reflectorto copy TLS certificates generated fromcert-managertotraefik.We cannot use
traefikcert generation viacert-managerdirectly becauseWe have to introduce our own chart as there is no way to add network policy. Once emberstack/kubernetes-reflector#664 is merged, we can ditch our own chart and use reflector chart directly.
Related issue/s
Related PR/s
Checklist