From 0bfe6ee78eeeea5625c32bb5a591512d67e6c54e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christopher=20Larivi=C3=A8re?= Date: Fri, 18 Apr 2025 14:20:54 -0400 Subject: [PATCH 01/10] feat(gw-apis): Support GW-APIS HTTPRoute MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - add helm unittest to run helm unit tests on specific helm templates - modify readme to add web.route.* - update values - update .gitignore/.helmignore Signed-off-by: Christopher Larivière --- .gitignore | 2 + .helmignore | 2 + README.md | 27 ++++ templates/web-route.yaml | 38 +++++ .../unittest/gateway-apis/web-route-test.yaml | 151 ++++++++++++++++++ values.yaml | 35 ++++ 6 files changed, 255 insertions(+) create mode 100644 templates/web-route.yaml create mode 100644 test/unittest/gateway-apis/web-route-test.yaml diff --git a/.gitignore b/.gitignore index eea54c36..f389ff1e 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,5 @@ charts [._]s[a-rt-v][a-z] [._]ss[a-gi-z] [._]sw[a-p] + +__snapshot__ \ No newline at end of file diff --git a/.helmignore b/.helmignore index 8904c0d2..e09cb823 100644 --- a/.helmignore +++ b/.helmignore @@ -20,3 +20,5 @@ .idea/ *.tmprojt tests/ + +__snapshot__/ \ No newline at end of file diff --git a/README.md b/README.md index e6853e18..85b36fab 100644 --- a/README.md +++ b/README.md @@ -198,6 +198,11 @@ The following table lists the configurable parameters of the Concourse chart and | `web.ingress.ingressClassName` | IngressClass to register to | `nil` | | `web.ingress.rulesOverride` | Concourse Web Ingress rules (override) (alternate to `web.ingress.hosts`) | `[]` | | `web.ingress.tls` | Concourse Web Ingress TLS configuration | `[]` | +| `web.route.annotations` | Concourse Web HTTPRoute annotations | `{}` | +| `web.route.enabled` | Enable Concourse Web HTTPRoute | `false` | +| `web.route.hosts` | Concourse Web HTTPRoutes Hostnames | `[]` | +| `web.route.labels` | Concourse Web HTTPRoute labels | `{}` | +| `web.route.parentRefs` | Concourse Web HTTPRoute parentRefs (gateways) | `{}` | | `web.keySecretsPath` | Specify the mount directory of the web keys secrets | `/concourse-keys` | | `web.labels`| Additional labels to be added to the web deployment `metadata.labels` | `{}` | | `web.deploymentAnnotations` | Additional annotations to be added to the web deployment `metadata.annotations` | `{}` | @@ -768,3 +773,25 @@ Instead, you may add a comment specifying the default, such as This prevents the behaviour drifting from that of the binary in case the binary's default values change. We understand that the comment stating the binary's default can become stale. The current solution is a suboptimal one. It may be improved in the future by generating a list of the default values from the binary. + +## Helm Unit Test + +When running unit tests for helm, from the root of the repository, you can simply run the following. + +```bash +helm unittest -f test/unittest/**/*.yaml . +``` + +If you are debugging specific tests, simply target the folder or yaml file you want to run tests on. + +`Folder` + +```bash +helm unittest -f test/unittest/gateway-apis/*.yaml . +``` + +`Specific Test Suite` + +```bash +helm unittest -f test/unittest/gateway-apis/web-route-test.yaml . +``` \ No newline at end of file diff --git a/templates/web-route.yaml b/templates/web-route.yaml new file mode 100644 index 00000000..1b5918bc --- /dev/null +++ b/templates/web-route.yaml @@ -0,0 +1,38 @@ +{{- if .Values.web.enabled -}} +{{- if .Values.web.route.enabled -}} +{{- $route := .Values.web.route -}} +{{- $releaseName := .Release.Name -}} +{{- $serviceName := include "concourse.web.fullname" . -}} +{{- $servicePort := .Values.concourse.web.bindPort -}} +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: {{ template "concourse.web.fullname" . }} + labels: + app: {{ template "concourse.web.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + {{- with $route.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $route.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + parentRefs: + {{- toYaml $route.parentRefs | nindent 2 }} + hostnames: + {{- toYaml $route.hosts | nindent 2 }} + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: {{ $serviceName }} + port: {{ $servicePort }} + namespace: {{ .Release.Namespace | quote }} +{{- end -}} +{{- end -}} diff --git a/test/unittest/gateway-apis/web-route-test.yaml b/test/unittest/gateway-apis/web-route-test.yaml new file mode 100644 index 00000000..5cbe2c39 --- /dev/null +++ b/test/unittest/gateway-apis/web-route-test.yaml @@ -0,0 +1,151 @@ +suite: GatewayApis + +tests: + - it: Route Disabled + set: + web: + route: + enabled: false + template: web-route.yaml + asserts: + - hasDocuments: + count: 0 + + - it: Route Exposure + set: + web: + route: + enabled: true + parentRefs: + - name: test-parent + namespace: test-namespace + group: gateway.networking.k8s.io + sectionName: test-section + kind: Gateway + hostnames: + - concourse.example.com + template: web-route.yaml + asserts: + - equal: + path: spec.hostnames[0] + value: concourse.example.com + - equal: + path: spec.parentRefs[0].name + value: test-parent + - equal: + path: spec.parentRefs[0].namespace + value: test-namespace + - equal: + path: spec.parentRefs[0].group + value: gateway.networking.k8s.io + - equal: + path: spec.parentRefs[0].sectionName + value: test-section + - equal: + path: spec.parentRefs[0].kind + value: Gateway + + - it: Route Extra Annotations + set: + web: + route: + enabled: true + annotations: + test.annotation: test-annotation + parentRefs: + - name: test-parent + namespace: test-namespace + hostnames: + - concourse.example.com + template: templates/web-route.yaml + asserts: + - equal: + path: metadata.annotations["test.annotation"] + value: test-annotation + + - it: Route Extra Labels + set: + web: + route: + enabled: true + labels: + test.label: test-label + parentRefs: + - name: test-parent + namespace: test-namespace + hostnames: + - concourse.example.com + template: web-route.yaml + asserts: + - equal: + path: metadata.labels["test.label"] + value: test-label + + - it: Route Service Exposure + set: + web: + route: + enabled: true + parentRefs: + - name: test-parent + namespace: test-namespace + hostnames: + - concourse.example.com + template: web-route.yaml + asserts: + - equal: + path: spec.rules[0].backendRefs[0].name + value: RELEASE-NAME-web + - equal: + path: spec.rules[0].matches[0].path.value + value: / + - equal: + path: spec.rules[0].backendRefs[0].port + value: 8080 + + - it: Multiple Hostnames + set: + web: + route: + enabled: true + parentRefs: + - name: test-parent + namespace: test-namespace + hostnames: + - concourse.example.com + - concourse.alternate.com + template: web-route.yaml + asserts: + - equal: + path: spec.hostnames[0] + value: concourse.example.com + - equal: + path: spec.hostnames[1] + value: concourse.alternate.com + - lengthEqual: + path: spec.hostnames + count: 2 + + - it: Multiple ParentRefs + set: + web: + route: + enabled: true + parentRefs: + - name: test-parent-1 + namespace: test-namespace-1 + - name: test-parent-2 + namespace: test-namespace-2 + hostnames: + - concourse.example.com + template: web-route.yaml + asserts: + - equal: + path: spec.parentRefs[0].name + value: test-parent-1 + - equal: + path: spec.parentRefs[1].name + value: test-parent-2 + - lengthEqual: + path: spec.parentRefs + count: 2 diff --git a/values.yaml b/values.yaml index 3351860d..640efe24 100644 --- a/values.yaml +++ b/values.yaml @@ -2441,6 +2441,41 @@ web: ## tls: + ## Route configuration + ## Ref: https://gateway-api.sigs.k8s.io/api-types/httproute/ + ## + route: + + ## Enable HTTPRoutes + ## + enabled: false + + ## Label to be added to the web route. + ## Example: + ## my.label: my-label-value + ## + labels: {} + + ## Annotations to be added to the web route. + ## Example: + ## my.annotation: my-annotation-value + ## + annotations: {} + + ## Gateway API Parent Refs + ## Example + ## - name: envoy + ## namespace: networking + ## sectionName: https + ## group: gateway.networking.k8s.io + ## kind: Gateway + parentRefs: {} + + ## Hosts to attach to the HTTPRoute + ## Example: + ## - "concourse.example.com" + hosts: [] + ## Configuration values for Concourse Worker components. ## For more information regarding the characteristics of ## Concourse Workers, see https://concourse-ci.org/concourse-worker.html From 698e4686b338289f4f21c0dc7b04139553aad8b9 Mon Sep 17 00:00:00 2001 From: Taylor Silva Date: Thu, 31 Jul 2025 16:11:22 -0400 Subject: [PATCH 02/10] create emptyDir for worker when using kind Deployment it seems the root container volume is read-only, so we can't write whatever we want to it anymore. Resolved by copying what we do in the StatefulSet and creating an emptyDir volume for the work dir Signed-off-by: Taylor Silva --- templates/worker-deployment.yaml | 11 +++++++++++ values.yaml | 3 ++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/templates/worker-deployment.yaml b/templates/worker-deployment.yaml index 38b4a1c4..463c832c 100644 --- a/templates/worker-deployment.yaml +++ b/templates/worker-deployment.yaml @@ -116,6 +116,10 @@ spec: subPath: worker-additional-certs.pem readOnly: true {{- end }} + {{- if include "concourse.are-there-additional-volumes.with-the-name.concourse-work-dir" . | not }} + - name: concourse-work-dir + mountPath: {{ .Values.concourse.worker.workDir | quote }} + {{- end }} {{- if .Values.worker.additionalVolumeMounts }} {{ toYaml .Values.worker.additionalVolumeMounts | indent 12 }} @@ -147,6 +151,13 @@ spec: release: {{ .Release.Name | quote }} {{- end }} volumes: + {{- if include "concourse.are-there-additional-volumes.with-the-name.concourse-work-dir" . | not }} + - name: concourse-work-dir + emptyDir: + {{- if .Values.worker.emptyDirSize }} + sizeLimit: {{ .Values.worker.emptyDirSize | quote }} + {{- end }} + {{- end }} {{- if .Values.worker.additionalVolumes }} {{ toYaml .Values.worker.additionalVolumes | indent 8 }} {{- end }} diff --git a/values.yaml b/values.yaml index bca116a1..e873766d 100644 --- a/values.yaml +++ b/values.yaml @@ -2683,7 +2683,8 @@ worker: ## Ignored for Kind Deployment podManagementPolicy: Parallel - ## When persistance is disabled this value will be used to limit the emptyDir volume size + ## When persistance is disabled or using a Deployment, this value will be used + ## to limit the emptyDir volume size ## Ref: https://kubernetes.io/docs/concepts/storage/volumes/#emptydir ## ## Example: 20Gi From 3d113d0116879b6467a2a0d9263376eeccd9bb90 Mon Sep 17 00:00:00 2001 From: "brandon.cate" Date: Tue, 12 Aug 2025 13:48:33 -0500 Subject: [PATCH 03/10] make pdb match labels equal worer pod match labels Signed-off-by: brandon.cate --- templates/worker-policy.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/templates/worker-policy.yaml b/templates/worker-policy.yaml index 890623b3..c92a35db 100644 --- a/templates/worker-policy.yaml +++ b/templates/worker-policy.yaml @@ -17,4 +17,8 @@ spec: selector: matchLabels: app: {{ template "concourse.worker.fullname" . }} + release: {{ .Release.Name }} + {{- with .Values.worker.labels }} +{{ toYaml . | trim | indent 6 }} + {{- end }} {{- end }} From 22b09a21f32645bdb6cfefe4814bd61ee4071ccf Mon Sep 17 00:00:00 2001 From: "brandon.cate" Date: Tue, 12 Aug 2025 14:02:53 -0500 Subject: [PATCH 04/10] make pdb match labels equal worker pod match labels Signed-off-by: brandon.cate --- templates/worker-policy.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/templates/worker-policy.yaml b/templates/worker-policy.yaml index c92a35db..d2806392 100644 --- a/templates/worker-policy.yaml +++ b/templates/worker-policy.yaml @@ -18,7 +18,4 @@ spec: matchLabels: app: {{ template "concourse.worker.fullname" . }} release: {{ .Release.Name }} - {{- with .Values.worker.labels }} -{{ toYaml . | trim | indent 6 }} - {{- end }} {{- end }} From a2d678f52f7093f41adda4f59e2c1ce46b6ff57f Mon Sep 17 00:00:00 2001 From: "brandon.cate" Date: Tue, 12 Aug 2025 14:50:58 -0500 Subject: [PATCH 05/10] add persistentVolumeClaimRetentionPolicy option into worker Signed-off-by: brandon.cate --- README.md | 419 +++++++++++++++--------------- templates/worker-statefulset.yaml | 4 + values.yaml | 11 + 3 files changed, 225 insertions(+), 209 deletions(-) diff --git a/README.md b/README.md index 61dbfba3..ac87e729 100644 --- a/README.md +++ b/README.md @@ -81,215 +81,216 @@ See [Configuration](#configuration) and [`values.yaml`](./values.yaml) for the c The following table lists the configurable parameters of the Concourse chart and their default values. -| Parameter | Description | Default | -| ----------------------- | ---------------------------------- | ---------------------------------------------------------- | -| `fullnameOverride` | Provide a name to substitute for the full names of resources | `nil` | -| `imageDigest` | Specific image digest to use in place of a tag. | `nil` | -| `imagePullPolicy` | Concourse image pull policy | `IfNotPresent` | -| `imagePullSecrets` | Array of imagePullSecrets in the namespace for pulling images | `[]` | -| `imageTag` | Concourse image version | `7.13.2` | -| `image` | Concourse image | `concourse/concourse` | -| `nameOverride` | Provide a name in place of `concourse` for `app:` labels | `nil` | -| `persistence.enabled` | Enable Concourse persistence using Persistent Volume Claims | `true` | -| `persistence.worker.accessMode` | Concourse Worker Persistent Volume Access Mode | `ReadWriteOnce` | -| `persistence.worker.size` | Concourse Worker Persistent Volume Storage Size | `20Gi` | -| `persistence.worker.storageClass` | Concourse Worker Persistent Volume Storage Class | `generic` | -| `persistence.worker.labels` | Concourse Worker Persistent Volume Labels | `{}` | -| `postgresql.enabled` | Enable PostgreSQL as a chart dependency | `true` | -| `postgresql.persistence.accessModes` | Persistent Volume Access Mode | `["ReadWriteOnce"]` | -| `postgresql.persistence.enabled` | Enable PostgreSQL persistence using Persistent Volume Claims | `true` | -| `postgresql.persistence.size` | Persistent Volume Storage Size | `8Gi` | -| `postgresql.persistence.storageClass` | Concourse data Persistent Volume Storage Class | `nil` | -| `persistence.worker.selector` | Concourse Worker Persistent Volume selector | `nil` | -| `postgresql.auth.database` | PostgreSQL Database to create | `concourse` | -| `postgresql.auth.password` | PostgreSQL Password for the new user | `concourse` | -| `postgresql.auth.username` | PostgreSQL User to create | `concourse` | -| `rbac.apiVersion` | RBAC version | `v1beta1` | -| `rbac.create` | Enables creation of RBAC resources | `true` | -| `rbac.webServiceAccountName` | Name of the service account to use for web pods if `rbac.create` is `false` | `default` | -| `rbac.webServiceAccountAnnotations` | Any annotations to be attached to the web service account | `{}` | -| `rbac.workerServiceAccountName` | Name of the service account to use for workers if `rbac.create` is `false` | `default` | -| `rbac.workerServiceAccountAnnotations` | Any annotations to be attached to the worker service account | `{}` | -| `podSecurityPolicy.create` | Enables creation of podSecurityPolicy resources | `false` | -| `podSecurityPolicy.allowedWorkerVolumes` | List of volumes allowed by the podSecurityPolicy for the worker pods | *See [values.yaml](values.yaml)* | -| `podSecurityPolicy.allowedWebVolumes` | List of volumes allowed by the podSecurityPolicy for the web pods | *See [values.yaml](values.yaml)* | -| `secrets.annotations`| Annotations to be added to the secrets | `{}` | -| `secrets.awsSecretsmanagerAccessKey` | AWS Access Key ID for Secrets Manager access | `nil` | -| `secrets.awsSecretsmanagerSecretKey` | AWS Secret Access Key ID for Secrets Manager access | `nil` | -| `secrets.awsSecretsmanagerSessionToken` | AWS Session Token for Secrets Manager access | `nil` | -| `secrets.awsSsmAccessKey` | AWS Access Key ID for SSM access | `nil` | -| `secrets.awsSsmSecretKey` | AWS Secret Access Key ID for SSM access | `nil` | -| `secrets.awsSsmSessionToken` | AWS Session Token for SSM access | `nil` | -| `secrets.bitbucketCloudClientId` | Client ID for the BitbucketCloud OAuth | `nil` | -| `secrets.bitbucketCloudClientSecret` | Client Secret for the BitbucketCloud OAuth | `nil` | -| `secrets.cfCaCert` | CA certificate for cf auth provider | `nil` | -| `secrets.cfClientId` | Client ID for cf auth provider | `nil` | -| `secrets.cfClientSecret` | Client secret for cf auth provider | `nil` | -| `secrets.conjurAccount` | Account for Conjur auth provider | `nil` | -| `secrets.conjurAuthnLogin` | Host username for Conjur auth provider | `nil` | -| `secrets.conjurAuthnApiKey` | API key for host used for Conjur auth provider. Either API key or token file can be used, but not both. | `nil` | -| `secrets.conjurAuthnTokenFile` | Token file used for Conjur auth provider if running in Kubernetes or IAM. Either token file or API key can be used, but not both. | `nil` | -| `secrets.conjurCACert` | CA Cert used if Conjur instance is deployed with a self-signed certificate | `nil` | -| `secrets.create` | Create the secret resource from the following values. *See [Secrets](#secrets)* | `true` | -| `secrets.credhubCaCert` | Value of PEM-encoded CA cert file to use to verify the CredHub server SSL cert. | `nil` | -| `secrets.credhubClientId` | Client ID for CredHub authorization. | `nil` | -| `secrets.credhubClientSecret` | Client secret for CredHub authorization. | `nil` | -| `secrets.credhubClientKey` | Client key for Credhub authorization. | `nil` | -| `secrets.credhubClientCert` | Client cert for Credhub authorization | `nil` | -| `secrets.encryptionKey` | current encryption key | `nil` | -| `secrets.githubCaCert` | CA certificate for Enterprise Github OAuth | `nil` | -| `secrets.githubClientId` | Application client ID for GitHub OAuth | `nil` | -| `secrets.githubClientSecret` | Application client secret for GitHub OAuth | `nil` | -| `secrets.gitlabClientId` | Application client ID for GitLab OAuth | `nil` | -| `secrets.gitlabClientSecret` | Application client secret for GitLab OAuth | `nil` | -| `secrets.hostKeyPub` | Concourse Host Public Key | *See [values.yaml](values.yaml)* | -| `secrets.hostKey` | Concourse Host Private Key | *See [values.yaml](values.yaml)* | -| `secrets.influxdbPassword` | Password used to authenticate with influxdb | `nil` | -| `secrets.ldapCaCert` | CA Certificate for LDAP | `nil` | -| `secrets.localUsers` | Create concourse local users. Default username and password are `test:test` *See [values.yaml](values.yaml)* | -| `secrets.microsoftClientId` | Client ID for Microsoft authorization. | `nil ` | -| `secrets.microsoftClientSecret` | Client secret for Microsoft authorization. | `nil` | -| `secrets.oauthCaCert` | CA certificate for Generic OAuth | `nil` | -| `secrets.oauthClientId` | Application client ID for Generic OAuth | `nil` | -| `secrets.oauthClientSecret` | Application client secret for Generic OAuth | `nil` | -| `secrets.oidcCaCert` | CA certificate for OIDC Oauth | `nil` | -| `secrets.oidcClientId` | Application client ID for OIDI OAuth | `nil` | -| `secrets.oidcClientSecret` | Application client secret for OIDC OAuth | `nil` | -| `secrets.oldEncryptionKey` | old encryption key, used for key rotation | `nil` | -| `secrets.postgresCaCert` | PostgreSQL CA certificate | `nil` | -| `secrets.postgresClientCert` | PostgreSQL Client certificate | `nil` | -| `secrets.postgresClientKey` | PostgreSQL Client key | `nil` | -| `secrets.postgresPassword` | PostgreSQL User Password | `nil` | -| `secrets.postgresUser` | PostgreSQL User Name | `nil` | -| `secrets.samlCaCert` | CA Certificate for SAML | `nil` | -| `secrets.sessionSigningKey` | Concourse Session Signing Private Key | *See [values.yaml](values.yaml)* | -| `secrets.syslogCaCert` | SSL certificate to verify Syslog server | `nil` | -| `secrets.teamAuthorizedKeys` | Array of team names and worker public keys for external workers | `nil` | -| `secrets.vaultAuthParam` | Paramter to pass when logging in via the backend | `nil` | -| `secrets.vaultCaCert` | CA certificate use to verify the vault server SSL cert | `nil` | -| `secrets.vaultClientCert` | Vault Client Certificate | `nil` | -| `secrets.vaultClientKey` | Vault Client Key | `nil` | -| `secrets.vaultClientToken` | Vault periodic client token | `nil` | -| `secrets.webTlsCert` | TLS certificate for the web component to terminate TLS connections | `nil` | -| `secrets.webTlsKey` | An RSA private key, used to encrypt HTTPS traffic | `nil` | -| `secrets.webTlsCaCert` | TLS CA certificate for the web component to terminate TLS connections | `nil` | -| `secrets.workerKeyPub` | Concourse Worker Public Key | *See [values.yaml](values.yaml)* | -| `secrets.workerKey` | Concourse Worker Private Key | *See [values.yaml](values.yaml)* | -| `secrets.workerAdditionalCerts` | Concourse Worker Additional Certificates | *See [values.yaml](values.yaml)* | -| `web.additionalAffinities` | Additional affinities to apply to web pods. E.g: node affinity | `{}` | -| `web.additionalVolumeMounts` | VolumeMounts to be added to the web pods | `nil` | -| `web.additionalVolumes` | Volumes to be added to the web pods | `nil` | -| `web.annotations`| Annotations to be added to the web pods | `{}` | -| `web.authSecretsPath` | Specify the mount directory of the web auth secrets | `/concourse-auth` | -| `web.credhubSecretsPath` | Specify the mount directory of the web credhub secrets | `/concourse-credhub` | -| `web.datadog.agentHostUseHostIP` | Use IP of Pod's node overrides `agentHost` | `false` | -| `web.datadog.agentHost` | Datadog Agent host | `127.0.0.1` | -| `web.datadog.agentPort` | Datadog Agent port | `8125` | -| `web.datadog.agentUdsFilepath` | Datadog agent unix domain socket (uds) filepath to expose dogstatsd metrics (ex. `/tmp/datadog.socket`) | `nil` | -| `web.datadog.enabled` | Enable or disable Datadog metrics | `false` | -| `web.datadog.prefix` | Prefix for emitted metrics | `"concourse.ci"` | -| `web.enabled` | Enable or disable the web component | `true` | -| `web.env` | Configure additional environment variables for the web containers | `[]` | -| `web.command` | Override the docker image command | `nil` | -| `web.args` | Docker image command arguments | `["web"]` | -| `web.ingress.annotations` | Concourse Web Ingress annotations | `{}` | -| `web.ingress.enabled` | Enable Concourse Web Ingress | `false` | -| `web.ingress.hosts` | Concourse Web Ingress Hostnames | `[]` | -| `web.ingress.ingressClassName` | IngressClass to register to | `nil` | -| `web.ingress.rulesOverride` | Concourse Web Ingress rules (override) (alternate to `web.ingress.hosts`) | `[]` | -| `web.ingress.tls` | Concourse Web Ingress TLS configuration | `[]` | -| `web.keySecretsPath` | Specify the mount directory of the web keys secrets | `/concourse-keys` | -| `web.labels`| Additional labels to be added to the web deployment `metadata.labels` | `{}` | -| `web.deploymentAnnotations` | Additional annotations to be added to the web deployment `metadata.annotations` | `{}` | -| `web.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `web.livenessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/api/v1/info` | -| `web.livenessProbe.httpGet.port` | Name or number of the port to access on the container | `atc` | -| `web.livenessProbe.initialDelaySeconds` | Number of seconds after the container has started before liveness probes are initiated | `10` | -| `web.livenessProbe.periodSeconds` | How often (in seconds) to perform the probe | `15` | -| `web.livenessProbe.timeoutSeconds` | Number of seconds after which the probe times out | `3` | -| `web.nameOverride` | Override the Concourse Web components name | `nil` | -| `web.nodeSelector` | Node selector for web nodes | `{}` | -| `web.podLabels`| Additional labels to be added to the web deployment `spec.template.metadata.labels`, setting pods `metadata.labels` | `{}` | -| `web.postgresqlSecretsPath` | Specify the mount directory of the web postgresql secrets | `/concourse-postgresql` | -| `web.prometheus.enabled` | Enable the Prometheus metrics endpoint | `false` | -| `web.prometheus.bindIp` | IP to listen on to expose Prometheus metrics | `0.0.0.0` | -| `web.prometheus.bindPort` | Port to listen on to expose Prometheus metrics | `9391` | -| `web.prometheus.ServiceMonitor.enabled` | Enable the creation of a serviceMonitor object for the Prometheus operator | `false` | -| `web.prometheus.ServiceMonitor.interval` | The interval the Prometheus endpoint is scraped | `30s` | -| `web.prometheus.ServiceMonitor.namespace` | The namespace where the serviceMonitor object has to be created | `nil` | -| `web.prometheus.ServiceMonitor.labels` | Additional lables for the serviceMonitor object | `nil` | -| `web.prometheus.ServiceMonitor.metricRelabelings` | Relabel metrics as defined [here](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) | `nil` | -| `web.readinessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/api/v1/info` | -| `web.readinessProbe.httpGet.port` | Name or number of the port to access on the container | `atc` | -| `web.replicas` | Number of Concourse Web replicas | `1` | -| `web.resources.requests.cpu` | Minimum amount of cpu resources requested | `100m` | -| `web.resources.requests.memory` | Minimum amount of memory resources requested | `128Mi` | -| `web.service.api.annotations` | Concourse Web API Service annotations | `nil` | -| `web.service.api.NodePort` | Sets the nodePort for api when using `NodePort` | `nil` | -| `web.service.api.labels` | Additional concourse web api service labels | `nil` | -| `web.service.api.loadBalancerIP` | The IP to use when web.service.api.type is LoadBalancer | `nil` | -| `web.service.api.clusterIP` | The IP to use when web.service.api.type is ClusterIP | `nil` | -| `web.service.api.loadBalancerSourceRanges` | Concourse Web API Service Load Balancer Source IP ranges | `nil` | -| `web.service.api.tlsNodePort` | Sets the nodePort for api tls when using `NodePort` | `nil` | -| `web.service.api.type` | Concourse Web API service type | `ClusterIP` | -| `web.service.api.port.name` | Sets the port name for web service with `targetPort` `atc` | `atc` | -| `web.service.api.tlsPort.name` | Sets the port name for web service with `targetPort` `atc-tls` | `atc-tls` | -| `web.service.workerGateway.annotations` | Concourse Web workerGateway Service annotations | `nil` | -| `web.service.workerGateway.labels` | Additional concourse web workerGateway service labels | `nil` | -| `web.service.workerGateway.loadBalancerIP` | The IP to use when web.service.workerGateway.type is LoadBalancer | `nil` | -| `web.service.workerGateway.clusterIP` | The IP to use when web.service.workerGateway.type is ClusterIP | `None` | -| `web.service.workerGateway.loadBalancerSourceRanges` | Concourse Web workerGateway Service Load Balancer Source IP ranges | `nil` | -| `web.service.workerGateway.NodePort` | Sets the nodePort for workerGateway when using `NodePort` | `nil` | -| `web.service.workerGateway.type` | Concourse Web workerGateway service type | `ClusterIP` | -| `web.service.prometheus.annotations` | Concourse Web Prometheus Service annotations | `nil` | -| `web.service.prometheus.labels` | Additional concourse web prometheus service labels | `nil` | -| `web.shareProcessNamespace` | Enable or disable the process namespace sharing for the web nodes | `false` | -| `web.priorityClassName` | Sets a PriorityClass for the web pods | `nil` | -| `web.sidecarContainers` | Array of extra containers to run alongside the Concourse web container | `nil` | -| `web.databaseInitContainers` | Array of database init containers to run before the Concourse database migrations are applied | `nil` | -| `web.extraInitContainers` | Array of extra init containers to run before the Concourse web container | `nil` | -| `web.strategy` | Strategy for updates to deployment. | `{}` | -| `web.syslogSecretsPath` | Specify the mount directory of the web syslog secrets | `/concourse-syslog` | -| `web.tlsSecretsPath` | Where in the container the web TLS secrets should be mounted | `/concourse-web-tls` | -| `web.tolerations` | Tolerations for the web nodes | `[]` | -| `web.vaultSecretsPath` | Specify the mount directory of the web vault secrets | `/concourse-vault` | -| `web.vault.tokenPath` | Specify the path to a file containing a vault client authentication token | `nil` | -| `worker.additionalAffinities` | Additional affinities to apply to worker pods. E.g: node affinity | `{}` | -| `worker.additionalVolumeMounts` | VolumeMounts to be added to the worker pods | `nil` | -| `worker.additionalPorts` | Additional ports to be added to worker pods | `[]` | -| `worker.additionalVolumes` | Volumes to be added to the worker pods | `nil` | -| `worker.annotations` | Annotations to be added to the worker pods | `{}` | -| `worker.autoscaling` | Enable and configure pod autoscaling | `{}` | -| `worker.cleanUpWorkDirOnStart` | Removes any previous state created in `concourse.worker.workDir` | `true` | -| `worker.emptyDirSize` | When persistance is disabled this value will be used to limit the emptyDir volume size | `nil` | -| `worker.enabled` | Enable or disable the worker component. You should set postgres.enabled=false in order not to get an unnecessary Postgres chart deployed | `true` | -| `worker.env` | Configure additional environment variables for the worker container(s) | `[]` | -| `worker.hardAntiAffinity` | Should the workers be forced (as opposed to preferred) to be on different nodes? | `false` | -| `worker.hardAntiAffinityLabels` | Set of labels used for hard anti affinity rule | `{}` | -| `worker.keySecretsPath` | Specify the mount directory of the worker keys secrets | `/concourse-keys` | -| `worker.deploymentAnnotations` | Additional annotations to be added to the worker deployment `metadata.annotations` | `{}` | -| `worker.certsPath` | Specify the path for additional worker certificates | `/etc/ssl/certs` | -| `worker.kind` | Choose between `StatefulSet` to preserve state or `Deployment` for ephemeral workers | `StatefulSet` | -| `worker.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `worker.livenessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/` | -| `worker.livenessProbe.httpGet.port` | Name or number of the port to access on the container | `worker-hc` | -| `worker.livenessProbe.initialDelaySeconds` | Number of seconds after the container has started before liveness probes are initiated | `10` | -| `worker.livenessProbe.periodSeconds` | How often (in seconds) to perform the probe | `15` | -| `worker.livenessProbe.timeoutSeconds` | Number of seconds after which the probe times out | `3` | -| `worker.minAvailable` | Minimum number of workers available after an eviction | `1` | -| `worker.nameOverride` | Override the Concourse Worker components name | `nil` | -| `worker.nodeSelector` | Node selector for worker nodes | `{}` | -| `worker.podManagementPolicy` | `OrderedReady` or `Parallel` (requires Kubernetes >= 1.7) | `Parallel` | -| `worker.readinessProbe` | Periodic probe of container service readiness | `{}` | -| `worker.replicas` | Number of Concourse Worker replicas | `2` | -| `worker.resources.requests.cpu` | Minimum amount of cpu resources requested | `100m` | -| `worker.resources.requests.memory` | Minimum amount of memory resources requested | `512Mi` | -| `worker.sidecarContainers` | Array of extra containers to run alongside the Concourse worker container | `nil` | -| `worker.extraInitContainers` | Array of extra init containers to run before the Concourse worker container | `nil` | -| `worker.priorityClassName` | Sets a PriorityClass for the worker pods | `nil` | -| `worker.terminationGracePeriodSeconds` | Upper bound for graceful shutdown to allow the worker to drain its tasks | `60` | -| `worker.tolerations` | Tolerations for the worker nodes | `[]` | -| `worker.updateStrategy` | `OnDelete` or `RollingUpdate` (requires Kubernetes >= 1.7) | `RollingUpdate` | +| Parameter | Description | Default | +|------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------| +| `fullnameOverride` | Provide a name to substitute for the full names of resources | `nil` | +| `imageDigest` | Specific image digest to use in place of a tag. | `nil` | +| `imagePullPolicy` | Concourse image pull policy | `IfNotPresent` | +| `imagePullSecrets` | Array of imagePullSecrets in the namespace for pulling images | `[]` | +| `imageTag` | Concourse image version | `7.13.2` | +| `image` | Concourse image | `concourse/concourse` | +| `nameOverride` | Provide a name in place of `concourse` for `app:` labels | `nil` | +| `persistence.enabled` | Enable Concourse persistence using Persistent Volume Claims | `true` | +| `persistence.worker.accessMode` | Concourse Worker Persistent Volume Access Mode | `ReadWriteOnce` | +| `persistence.worker.size` | Concourse Worker Persistent Volume Storage Size | `20Gi` | +| `persistence.worker.storageClass` | Concourse Worker Persistent Volume Storage Class | `generic` | +| `persistence.worker.labels` | Concourse Worker Persistent Volume Labels | `{}` | +| `postgresql.enabled` | Enable PostgreSQL as a chart dependency | `true` | +| `postgresql.persistence.accessModes` | Persistent Volume Access Mode | `["ReadWriteOnce"]` | +| `postgresql.persistence.enabled` | Enable PostgreSQL persistence using Persistent Volume Claims | `true` | +| `postgresql.persistence.size` | Persistent Volume Storage Size | `8Gi` | +| `postgresql.persistence.storageClass` | Concourse data Persistent Volume Storage Class | `nil` | +| `persistence.worker.selector` | Concourse Worker Persistent Volume selector | `nil` | +| `postgresql.auth.database` | PostgreSQL Database to create | `concourse` | +| `postgresql.auth.password` | PostgreSQL Password for the new user | `concourse` | +| `postgresql.auth.username` | PostgreSQL User to create | `concourse` | +| `rbac.apiVersion` | RBAC version | `v1beta1` | +| `rbac.create` | Enables creation of RBAC resources | `true` | +| `rbac.webServiceAccountName` | Name of the service account to use for web pods if `rbac.create` is `false` | `default` | +| `rbac.webServiceAccountAnnotations` | Any annotations to be attached to the web service account | `{}` | +| `rbac.workerServiceAccountName` | Name of the service account to use for workers if `rbac.create` is `false` | `default` | +| `rbac.workerServiceAccountAnnotations` | Any annotations to be attached to the worker service account | `{}` | +| `podSecurityPolicy.create` | Enables creation of podSecurityPolicy resources | `false` | +| `podSecurityPolicy.allowedWorkerVolumes` | List of volumes allowed by the podSecurityPolicy for the worker pods | *See [values.yaml](values.yaml)* | +| `podSecurityPolicy.allowedWebVolumes` | List of volumes allowed by the podSecurityPolicy for the web pods | *See [values.yaml](values.yaml)* | +| `secrets.annotations` | Annotations to be added to the secrets | `{}` | +| `secrets.awsSecretsmanagerAccessKey` | AWS Access Key ID for Secrets Manager access | `nil` | +| `secrets.awsSecretsmanagerSecretKey` | AWS Secret Access Key ID for Secrets Manager access | `nil` | +| `secrets.awsSecretsmanagerSessionToken` | AWS Session Token for Secrets Manager access | `nil` | +| `secrets.awsSsmAccessKey` | AWS Access Key ID for SSM access | `nil` | +| `secrets.awsSsmSecretKey` | AWS Secret Access Key ID for SSM access | `nil` | +| `secrets.awsSsmSessionToken` | AWS Session Token for SSM access | `nil` | +| `secrets.bitbucketCloudClientId` | Client ID for the BitbucketCloud OAuth | `nil` | +| `secrets.bitbucketCloudClientSecret` | Client Secret for the BitbucketCloud OAuth | `nil` | +| `secrets.cfCaCert` | CA certificate for cf auth provider | `nil` | +| `secrets.cfClientId` | Client ID for cf auth provider | `nil` | +| `secrets.cfClientSecret` | Client secret for cf auth provider | `nil` | +| `secrets.conjurAccount` | Account for Conjur auth provider | `nil` | +| `secrets.conjurAuthnLogin` | Host username for Conjur auth provider | `nil` | +| `secrets.conjurAuthnApiKey` | API key for host used for Conjur auth provider. Either API key or token file can be used, but not both. | `nil` | +| `secrets.conjurAuthnTokenFile` | Token file used for Conjur auth provider if running in Kubernetes or IAM. Either token file or API key can be used, but not both. | `nil` | +| `secrets.conjurCACert` | CA Cert used if Conjur instance is deployed with a self-signed certificate | `nil` | +| `secrets.create` | Create the secret resource from the following values. *See [Secrets](#secrets)* | `true` | +| `secrets.credhubCaCert` | Value of PEM-encoded CA cert file to use to verify the CredHub server SSL cert. | `nil` | +| `secrets.credhubClientId` | Client ID for CredHub authorization. | `nil` | +| `secrets.credhubClientSecret` | Client secret for CredHub authorization. | `nil` | +| `secrets.credhubClientKey` | Client key for Credhub authorization. | `nil` | +| `secrets.credhubClientCert` | Client cert for Credhub authorization | `nil` | +| `secrets.encryptionKey` | current encryption key | `nil` | +| `secrets.githubCaCert` | CA certificate for Enterprise Github OAuth | `nil` | +| `secrets.githubClientId` | Application client ID for GitHub OAuth | `nil` | +| `secrets.githubClientSecret` | Application client secret for GitHub OAuth | `nil` | +| `secrets.gitlabClientId` | Application client ID for GitLab OAuth | `nil` | +| `secrets.gitlabClientSecret` | Application client secret for GitLab OAuth | `nil` | +| `secrets.hostKeyPub` | Concourse Host Public Key | *See [values.yaml](values.yaml)* | +| `secrets.hostKey` | Concourse Host Private Key | *See [values.yaml](values.yaml)* | +| `secrets.influxdbPassword` | Password used to authenticate with influxdb | `nil` | +| `secrets.ldapCaCert` | CA Certificate for LDAP | `nil` | +| `secrets.localUsers` | Create concourse local users. Default username and password are `test:test` *See [values.yaml](values.yaml)* | +| `secrets.microsoftClientId` | Client ID for Microsoft authorization. | `nil ` | +| `secrets.microsoftClientSecret` | Client secret for Microsoft authorization. | `nil` | +| `secrets.oauthCaCert` | CA certificate for Generic OAuth | `nil` | +| `secrets.oauthClientId` | Application client ID for Generic OAuth | `nil` | +| `secrets.oauthClientSecret` | Application client secret for Generic OAuth | `nil` | +| `secrets.oidcCaCert` | CA certificate for OIDC Oauth | `nil` | +| `secrets.oidcClientId` | Application client ID for OIDI OAuth | `nil` | +| `secrets.oidcClientSecret` | Application client secret for OIDC OAuth | `nil` | +| `secrets.oldEncryptionKey` | old encryption key, used for key rotation | `nil` | +| `secrets.postgresCaCert` | PostgreSQL CA certificate | `nil` | +| `secrets.postgresClientCert` | PostgreSQL Client certificate | `nil` | +| `secrets.postgresClientKey` | PostgreSQL Client key | `nil` | +| `secrets.postgresPassword` | PostgreSQL User Password | `nil` | +| `secrets.postgresUser` | PostgreSQL User Name | `nil` | +| `secrets.samlCaCert` | CA Certificate for SAML | `nil` | +| `secrets.sessionSigningKey` | Concourse Session Signing Private Key | *See [values.yaml](values.yaml)* | +| `secrets.syslogCaCert` | SSL certificate to verify Syslog server | `nil` | +| `secrets.teamAuthorizedKeys` | Array of team names and worker public keys for external workers | `nil` | +| `secrets.vaultAuthParam` | Paramter to pass when logging in via the backend | `nil` | +| `secrets.vaultCaCert` | CA certificate use to verify the vault server SSL cert | `nil` | +| `secrets.vaultClientCert` | Vault Client Certificate | `nil` | +| `secrets.vaultClientKey` | Vault Client Key | `nil` | +| `secrets.vaultClientToken` | Vault periodic client token | `nil` | +| `secrets.webTlsCert` | TLS certificate for the web component to terminate TLS connections | `nil` | +| `secrets.webTlsKey` | An RSA private key, used to encrypt HTTPS traffic | `nil` | +| `secrets.webTlsCaCert` | TLS CA certificate for the web component to terminate TLS connections | `nil` | +| `secrets.workerKeyPub` | Concourse Worker Public Key | *See [values.yaml](values.yaml)* | +| `secrets.workerKey` | Concourse Worker Private Key | *See [values.yaml](values.yaml)* | +| `secrets.workerAdditionalCerts` | Concourse Worker Additional Certificates | *See [values.yaml](values.yaml)* | +| `web.additionalAffinities` | Additional affinities to apply to web pods. E.g: node affinity | `{}` | +| `web.additionalVolumeMounts` | VolumeMounts to be added to the web pods | `nil` | +| `web.additionalVolumes` | Volumes to be added to the web pods | `nil` | +| `web.annotations` | Annotations to be added to the web pods | `{}` | +| `web.authSecretsPath` | Specify the mount directory of the web auth secrets | `/concourse-auth` | +| `web.credhubSecretsPath` | Specify the mount directory of the web credhub secrets | `/concourse-credhub` | +| `web.datadog.agentHostUseHostIP` | Use IP of Pod's node overrides `agentHost` | `false` | +| `web.datadog.agentHost` | Datadog Agent host | `127.0.0.1` | +| `web.datadog.agentPort` | Datadog Agent port | `8125` | +| `web.datadog.agentUdsFilepath` | Datadog agent unix domain socket (uds) filepath to expose dogstatsd metrics (ex. `/tmp/datadog.socket`) | `nil` | +| `web.datadog.enabled` | Enable or disable Datadog metrics | `false` | +| `web.datadog.prefix` | Prefix for emitted metrics | `"concourse.ci"` | +| `web.enabled` | Enable or disable the web component | `true` | +| `web.env` | Configure additional environment variables for the web containers | `[]` | +| `web.command` | Override the docker image command | `nil` | +| `web.args` | Docker image command arguments | `["web"]` | +| `web.ingress.annotations` | Concourse Web Ingress annotations | `{}` | +| `web.ingress.enabled` | Enable Concourse Web Ingress | `false` | +| `web.ingress.hosts` | Concourse Web Ingress Hostnames | `[]` | +| `web.ingress.ingressClassName` | IngressClass to register to | `nil` | +| `web.ingress.rulesOverride` | Concourse Web Ingress rules (override) (alternate to `web.ingress.hosts`) | `[]` | +| `web.ingress.tls` | Concourse Web Ingress TLS configuration | `[]` | +| `web.keySecretsPath` | Specify the mount directory of the web keys secrets | `/concourse-keys` | +| `web.labels` | Additional labels to be added to the web deployment `metadata.labels` | `{}` | +| `web.deploymentAnnotations` | Additional annotations to be added to the web deployment `metadata.annotations` | `{}` | +| `web.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `web.livenessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/api/v1/info` | +| `web.livenessProbe.httpGet.port` | Name or number of the port to access on the container | `atc` | +| `web.livenessProbe.initialDelaySeconds` | Number of seconds after the container has started before liveness probes are initiated | `10` | +| `web.livenessProbe.periodSeconds` | How often (in seconds) to perform the probe | `15` | +| `web.livenessProbe.timeoutSeconds` | Number of seconds after which the probe times out | `3` | +| `web.nameOverride` | Override the Concourse Web components name | `nil` | +| `web.nodeSelector` | Node selector for web nodes | `{}` | +| `web.podLabels` | Additional labels to be added to the web deployment `spec.template.metadata.labels`, setting pods `metadata.labels` | `{}` | +| `web.postgresqlSecretsPath` | Specify the mount directory of the web postgresql secrets | `/concourse-postgresql` | +| `web.prometheus.enabled` | Enable the Prometheus metrics endpoint | `false` | +| `web.prometheus.bindIp` | IP to listen on to expose Prometheus metrics | `0.0.0.0` | +| `web.prometheus.bindPort` | Port to listen on to expose Prometheus metrics | `9391` | +| `web.prometheus.ServiceMonitor.enabled` | Enable the creation of a serviceMonitor object for the Prometheus operator | `false` | +| `web.prometheus.ServiceMonitor.interval` | The interval the Prometheus endpoint is scraped | `30s` | +| `web.prometheus.ServiceMonitor.namespace` | The namespace where the serviceMonitor object has to be created | `nil` | +| `web.prometheus.ServiceMonitor.labels` | Additional lables for the serviceMonitor object | `nil` | +| `web.prometheus.ServiceMonitor.metricRelabelings` | Relabel metrics as defined [here](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) | `nil` | +| `web.readinessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/api/v1/info` | +| `web.readinessProbe.httpGet.port` | Name or number of the port to access on the container | `atc` | +| `web.replicas` | Number of Concourse Web replicas | `1` | +| `web.resources.requests.cpu` | Minimum amount of cpu resources requested | `100m` | +| `web.resources.requests.memory` | Minimum amount of memory resources requested | `128Mi` | +| `web.service.api.annotations` | Concourse Web API Service annotations | `nil` | +| `web.service.api.NodePort` | Sets the nodePort for api when using `NodePort` | `nil` | +| `web.service.api.labels` | Additional concourse web api service labels | `nil` | +| `web.service.api.loadBalancerIP` | The IP to use when web.service.api.type is LoadBalancer | `nil` | +| `web.service.api.clusterIP` | The IP to use when web.service.api.type is ClusterIP | `nil` | +| `web.service.api.loadBalancerSourceRanges` | Concourse Web API Service Load Balancer Source IP ranges | `nil` | +| `web.service.api.tlsNodePort` | Sets the nodePort for api tls when using `NodePort` | `nil` | +| `web.service.api.type` | Concourse Web API service type | `ClusterIP` | +| `web.service.api.port.name` | Sets the port name for web service with `targetPort` `atc` | `atc` | +| `web.service.api.tlsPort.name` | Sets the port name for web service with `targetPort` `atc-tls` | `atc-tls` | +| `web.service.workerGateway.annotations` | Concourse Web workerGateway Service annotations | `nil` | +| `web.service.workerGateway.labels` | Additional concourse web workerGateway service labels | `nil` | +| `web.service.workerGateway.loadBalancerIP` | The IP to use when web.service.workerGateway.type is LoadBalancer | `nil` | +| `web.service.workerGateway.clusterIP` | The IP to use when web.service.workerGateway.type is ClusterIP | `None` | +| `web.service.workerGateway.loadBalancerSourceRanges` | Concourse Web workerGateway Service Load Balancer Source IP ranges | `nil` | +| `web.service.workerGateway.NodePort` | Sets the nodePort for workerGateway when using `NodePort` | `nil` | +| `web.service.workerGateway.type` | Concourse Web workerGateway service type | `ClusterIP` | +| `web.service.prometheus.annotations` | Concourse Web Prometheus Service annotations | `nil` | +| `web.service.prometheus.labels` | Additional concourse web prometheus service labels | `nil` | +| `web.shareProcessNamespace` | Enable or disable the process namespace sharing for the web nodes | `false` | +| `web.priorityClassName` | Sets a PriorityClass for the web pods | `nil` | +| `web.sidecarContainers` | Array of extra containers to run alongside the Concourse web container | `nil` | +| `web.databaseInitContainers` | Array of database init containers to run before the Concourse database migrations are applied | `nil` | +| `web.extraInitContainers` | Array of extra init containers to run before the Concourse web container | `nil` | +| `web.strategy` | Strategy for updates to deployment. | `{}` | +| `web.syslogSecretsPath` | Specify the mount directory of the web syslog secrets | `/concourse-syslog` | +| `web.tlsSecretsPath` | Where in the container the web TLS secrets should be mounted | `/concourse-web-tls` | +| `web.tolerations` | Tolerations for the web nodes | `[]` | +| `web.vaultSecretsPath` | Specify the mount directory of the web vault secrets | `/concourse-vault` | +| `web.vault.tokenPath` | Specify the path to a file containing a vault client authentication token | `nil` | +| `worker.additionalAffinities` | Additional affinities to apply to worker pods. E.g: node affinity | `{}` | +| `worker.additionalVolumeMounts` | VolumeMounts to be added to the worker pods | `nil` | +| `worker.additionalPorts` | Additional ports to be added to worker pods | `[]` | +| `worker.additionalVolumes` | Volumes to be added to the worker pods | `nil` | +| `worker.annotations` | Annotations to be added to the worker pods | `{}` | +| `worker.autoscaling` | Enable and configure pod autoscaling | `{}` | +| `worker.cleanUpWorkDirOnStart` | Removes any previous state created in `concourse.worker.workDir` | `true` | +| `worker.emptyDirSize` | When persistance is disabled this value will be used to limit the emptyDir volume size | `nil` | +| `worker.enabled` | Enable or disable the worker component. You should set postgres.enabled=false in order not to get an unnecessary Postgres chart deployed | `true` | +| `worker.env` | Configure additional environment variables for the worker container(s) | `[]` | +| `worker.hardAntiAffinity` | Should the workers be forced (as opposed to preferred) to be on different nodes? | `false` | +| `worker.hardAntiAffinityLabels` | Set of labels used for hard anti affinity rule | `{}` | +| `worker.keySecretsPath` | Specify the mount directory of the worker keys secrets | `/concourse-keys` | +| `worker.deploymentAnnotations` | Additional annotations to be added to the worker deployment `metadata.annotations` | `{}` | +| `worker.certsPath` | Specify the path for additional worker certificates | `/etc/ssl/certs` | +| `worker.kind` | Choose between `StatefulSet` to preserve state or `Deployment` for ephemeral workers | `StatefulSet` | +| `worker.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `worker.livenessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/` | +| `worker.livenessProbe.httpGet.port` | Name or number of the port to access on the container | `worker-hc` | +| `worker.livenessProbe.initialDelaySeconds` | Number of seconds after the container has started before liveness probes are initiated | `10` | +| `worker.livenessProbe.periodSeconds` | How often (in seconds) to perform the probe | `15` | +| `worker.livenessProbe.timeoutSeconds` | Number of seconds after which the probe times out | `3` | +| `worker.minAvailable` | Minimum number of workers available after an eviction | `1` | +| `worker.nameOverride` | Override the Concourse Worker components name | `nil` | +| `worker.nodeSelector` | Node selector for worker nodes | `{}` | +| `worker.podManagementPolicy` | `OrderedReady` or `Parallel` (requires Kubernetes >= 1.7) | `Parallel` | +| `worker.readinessProbe` | Periodic probe of container service readiness | `{}` | +| `worker.replicas` | Number of Concourse Worker replicas | `2` | +| `worker.resources.requests.cpu` | Minimum amount of cpu resources requested | `100m` | +| `worker.resources.requests.memory` | Minimum amount of memory resources requested | `512Mi` | +| `worker.sidecarContainers` | Array of extra containers to run alongside the Concourse worker container | `nil` | +| `worker.extraInitContainers` | Array of extra init containers to run before the Concourse worker container | `nil` | +| `worker.priorityClassName` | Sets a PriorityClass for the worker pods | `nil` | +| `worker.terminationGracePeriodSeconds` | Upper bound for graceful shutdown to allow the worker to drain its tasks | `60` | +| `worker.tolerations` | Tolerations for the worker nodes | `[]` | +| `worker.persistentVolumeClaimRetentionPolicy` | `Retain` or `Delete` (requires Kubernetes >= 1.32) | `Retain` | +| `worker.updateStrategy` | `OnDelete` or `RollingUpdate` (requires Kubernetes >= 1.7) | `RollingUpdate` | For configurable Concourse parameters, refer to [`values.yaml`](values.yaml)' `concourse` section. All parameters under this section are strictly mapped from the `concourse` binary commands. diff --git a/templates/worker-statefulset.yaml b/templates/worker-statefulset.yaml index e7de2692..f16bb518 100644 --- a/templates/worker-statefulset.yaml +++ b/templates/worker-statefulset.yaml @@ -231,6 +231,10 @@ spec: {{- end }} {{- end }} {{- end }} + {{- if semverCompare ">=1.32-0" .Capabilities.KubeVersion.Version -}} + persistentVolumeClaimRetentionPolicy: +{{ toYaml .Values.worker.persistentVolumeClaimRetentionPolicy | indent 4 }} + {{- end }} {{- if semverCompare "^1.7-0" .Capabilities.KubeVersion.Version }} updateStrategy: {{ toYaml .Values.worker.updateStrategy | indent 4 }} diff --git a/values.yaml b/values.yaml index e873766d..9e930f3d 100644 --- a/values.yaml +++ b/values.yaml @@ -2662,6 +2662,17 @@ worker: ## terminationGracePeriodSeconds: 60 + ## Controls how PVCs are deleted during the lifecycle of a StatefulSet (requires Kubernetes 1.32+) + ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention + ## + ## "Retain" is default functionality. + ## "Delete" whenDeleted - all PVCs are deleted after their Pods have been deleted + ## "Delete" whenScaled - only PVCs are deleted when corresponding pod being scaled down is deleted + ## + persistentVolumeClaimRetentionPolicy: + whenDeleted: Retain + whenScaled: Retain + ## Strategy for StatefulSet updates (requires Kubernetes 1.6+) ## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset ## From f09abe579793581073be0cb6ed4b180a84289f32 Mon Sep 17 00:00:00 2001 From: "brandon.cate" Date: Tue, 12 Aug 2025 14:53:15 -0500 Subject: [PATCH 06/10] unformat README.md to be consistent Signed-off-by: brandon.cate --- README.md | 420 +++++++++++++++++++++++++++--------------------------- 1 file changed, 210 insertions(+), 210 deletions(-) diff --git a/README.md b/README.md index ac87e729..a8efcee7 100644 --- a/README.md +++ b/README.md @@ -81,216 +81,216 @@ See [Configuration](#configuration) and [`values.yaml`](./values.yaml) for the c The following table lists the configurable parameters of the Concourse chart and their default values. -| Parameter | Description | Default | -|------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------| -| `fullnameOverride` | Provide a name to substitute for the full names of resources | `nil` | -| `imageDigest` | Specific image digest to use in place of a tag. | `nil` | -| `imagePullPolicy` | Concourse image pull policy | `IfNotPresent` | -| `imagePullSecrets` | Array of imagePullSecrets in the namespace for pulling images | `[]` | -| `imageTag` | Concourse image version | `7.13.2` | -| `image` | Concourse image | `concourse/concourse` | -| `nameOverride` | Provide a name in place of `concourse` for `app:` labels | `nil` | -| `persistence.enabled` | Enable Concourse persistence using Persistent Volume Claims | `true` | -| `persistence.worker.accessMode` | Concourse Worker Persistent Volume Access Mode | `ReadWriteOnce` | -| `persistence.worker.size` | Concourse Worker Persistent Volume Storage Size | `20Gi` | -| `persistence.worker.storageClass` | Concourse Worker Persistent Volume Storage Class | `generic` | -| `persistence.worker.labels` | Concourse Worker Persistent Volume Labels | `{}` | -| `postgresql.enabled` | Enable PostgreSQL as a chart dependency | `true` | -| `postgresql.persistence.accessModes` | Persistent Volume Access Mode | `["ReadWriteOnce"]` | -| `postgresql.persistence.enabled` | Enable PostgreSQL persistence using Persistent Volume Claims | `true` | -| `postgresql.persistence.size` | Persistent Volume Storage Size | `8Gi` | -| `postgresql.persistence.storageClass` | Concourse data Persistent Volume Storage Class | `nil` | -| `persistence.worker.selector` | Concourse Worker Persistent Volume selector | `nil` | -| `postgresql.auth.database` | PostgreSQL Database to create | `concourse` | -| `postgresql.auth.password` | PostgreSQL Password for the new user | `concourse` | -| `postgresql.auth.username` | PostgreSQL User to create | `concourse` | -| `rbac.apiVersion` | RBAC version | `v1beta1` | -| `rbac.create` | Enables creation of RBAC resources | `true` | -| `rbac.webServiceAccountName` | Name of the service account to use for web pods if `rbac.create` is `false` | `default` | -| `rbac.webServiceAccountAnnotations` | Any annotations to be attached to the web service account | `{}` | -| `rbac.workerServiceAccountName` | Name of the service account to use for workers if `rbac.create` is `false` | `default` | -| `rbac.workerServiceAccountAnnotations` | Any annotations to be attached to the worker service account | `{}` | -| `podSecurityPolicy.create` | Enables creation of podSecurityPolicy resources | `false` | -| `podSecurityPolicy.allowedWorkerVolumes` | List of volumes allowed by the podSecurityPolicy for the worker pods | *See [values.yaml](values.yaml)* | -| `podSecurityPolicy.allowedWebVolumes` | List of volumes allowed by the podSecurityPolicy for the web pods | *See [values.yaml](values.yaml)* | -| `secrets.annotations` | Annotations to be added to the secrets | `{}` | -| `secrets.awsSecretsmanagerAccessKey` | AWS Access Key ID for Secrets Manager access | `nil` | -| `secrets.awsSecretsmanagerSecretKey` | AWS Secret Access Key ID for Secrets Manager access | `nil` | -| `secrets.awsSecretsmanagerSessionToken` | AWS Session Token for Secrets Manager access | `nil` | -| `secrets.awsSsmAccessKey` | AWS Access Key ID for SSM access | `nil` | -| `secrets.awsSsmSecretKey` | AWS Secret Access Key ID for SSM access | `nil` | -| `secrets.awsSsmSessionToken` | AWS Session Token for SSM access | `nil` | -| `secrets.bitbucketCloudClientId` | Client ID for the BitbucketCloud OAuth | `nil` | -| `secrets.bitbucketCloudClientSecret` | Client Secret for the BitbucketCloud OAuth | `nil` | -| `secrets.cfCaCert` | CA certificate for cf auth provider | `nil` | -| `secrets.cfClientId` | Client ID for cf auth provider | `nil` | -| `secrets.cfClientSecret` | Client secret for cf auth provider | `nil` | -| `secrets.conjurAccount` | Account for Conjur auth provider | `nil` | -| `secrets.conjurAuthnLogin` | Host username for Conjur auth provider | `nil` | -| `secrets.conjurAuthnApiKey` | API key for host used for Conjur auth provider. Either API key or token file can be used, but not both. | `nil` | -| `secrets.conjurAuthnTokenFile` | Token file used for Conjur auth provider if running in Kubernetes or IAM. Either token file or API key can be used, but not both. | `nil` | -| `secrets.conjurCACert` | CA Cert used if Conjur instance is deployed with a self-signed certificate | `nil` | -| `secrets.create` | Create the secret resource from the following values. *See [Secrets](#secrets)* | `true` | -| `secrets.credhubCaCert` | Value of PEM-encoded CA cert file to use to verify the CredHub server SSL cert. | `nil` | -| `secrets.credhubClientId` | Client ID for CredHub authorization. | `nil` | -| `secrets.credhubClientSecret` | Client secret for CredHub authorization. | `nil` | -| `secrets.credhubClientKey` | Client key for Credhub authorization. | `nil` | -| `secrets.credhubClientCert` | Client cert for Credhub authorization | `nil` | -| `secrets.encryptionKey` | current encryption key | `nil` | -| `secrets.githubCaCert` | CA certificate for Enterprise Github OAuth | `nil` | -| `secrets.githubClientId` | Application client ID for GitHub OAuth | `nil` | -| `secrets.githubClientSecret` | Application client secret for GitHub OAuth | `nil` | -| `secrets.gitlabClientId` | Application client ID for GitLab OAuth | `nil` | -| `secrets.gitlabClientSecret` | Application client secret for GitLab OAuth | `nil` | -| `secrets.hostKeyPub` | Concourse Host Public Key | *See [values.yaml](values.yaml)* | -| `secrets.hostKey` | Concourse Host Private Key | *See [values.yaml](values.yaml)* | -| `secrets.influxdbPassword` | Password used to authenticate with influxdb | `nil` | -| `secrets.ldapCaCert` | CA Certificate for LDAP | `nil` | -| `secrets.localUsers` | Create concourse local users. Default username and password are `test:test` *See [values.yaml](values.yaml)* | -| `secrets.microsoftClientId` | Client ID for Microsoft authorization. | `nil ` | -| `secrets.microsoftClientSecret` | Client secret for Microsoft authorization. | `nil` | -| `secrets.oauthCaCert` | CA certificate for Generic OAuth | `nil` | -| `secrets.oauthClientId` | Application client ID for Generic OAuth | `nil` | -| `secrets.oauthClientSecret` | Application client secret for Generic OAuth | `nil` | -| `secrets.oidcCaCert` | CA certificate for OIDC Oauth | `nil` | -| `secrets.oidcClientId` | Application client ID for OIDI OAuth | `nil` | -| `secrets.oidcClientSecret` | Application client secret for OIDC OAuth | `nil` | -| `secrets.oldEncryptionKey` | old encryption key, used for key rotation | `nil` | -| `secrets.postgresCaCert` | PostgreSQL CA certificate | `nil` | -| `secrets.postgresClientCert` | PostgreSQL Client certificate | `nil` | -| `secrets.postgresClientKey` | PostgreSQL Client key | `nil` | -| `secrets.postgresPassword` | PostgreSQL User Password | `nil` | -| `secrets.postgresUser` | PostgreSQL User Name | `nil` | -| `secrets.samlCaCert` | CA Certificate for SAML | `nil` | -| `secrets.sessionSigningKey` | Concourse Session Signing Private Key | *See [values.yaml](values.yaml)* | -| `secrets.syslogCaCert` | SSL certificate to verify Syslog server | `nil` | -| `secrets.teamAuthorizedKeys` | Array of team names and worker public keys for external workers | `nil` | -| `secrets.vaultAuthParam` | Paramter to pass when logging in via the backend | `nil` | -| `secrets.vaultCaCert` | CA certificate use to verify the vault server SSL cert | `nil` | -| `secrets.vaultClientCert` | Vault Client Certificate | `nil` | -| `secrets.vaultClientKey` | Vault Client Key | `nil` | -| `secrets.vaultClientToken` | Vault periodic client token | `nil` | -| `secrets.webTlsCert` | TLS certificate for the web component to terminate TLS connections | `nil` | -| `secrets.webTlsKey` | An RSA private key, used to encrypt HTTPS traffic | `nil` | -| `secrets.webTlsCaCert` | TLS CA certificate for the web component to terminate TLS connections | `nil` | -| `secrets.workerKeyPub` | Concourse Worker Public Key | *See [values.yaml](values.yaml)* | -| `secrets.workerKey` | Concourse Worker Private Key | *See [values.yaml](values.yaml)* | -| `secrets.workerAdditionalCerts` | Concourse Worker Additional Certificates | *See [values.yaml](values.yaml)* | -| `web.additionalAffinities` | Additional affinities to apply to web pods. E.g: node affinity | `{}` | -| `web.additionalVolumeMounts` | VolumeMounts to be added to the web pods | `nil` | -| `web.additionalVolumes` | Volumes to be added to the web pods | `nil` | -| `web.annotations` | Annotations to be added to the web pods | `{}` | -| `web.authSecretsPath` | Specify the mount directory of the web auth secrets | `/concourse-auth` | -| `web.credhubSecretsPath` | Specify the mount directory of the web credhub secrets | `/concourse-credhub` | -| `web.datadog.agentHostUseHostIP` | Use IP of Pod's node overrides `agentHost` | `false` | -| `web.datadog.agentHost` | Datadog Agent host | `127.0.0.1` | -| `web.datadog.agentPort` | Datadog Agent port | `8125` | -| `web.datadog.agentUdsFilepath` | Datadog agent unix domain socket (uds) filepath to expose dogstatsd metrics (ex. `/tmp/datadog.socket`) | `nil` | -| `web.datadog.enabled` | Enable or disable Datadog metrics | `false` | -| `web.datadog.prefix` | Prefix for emitted metrics | `"concourse.ci"` | -| `web.enabled` | Enable or disable the web component | `true` | -| `web.env` | Configure additional environment variables for the web containers | `[]` | -| `web.command` | Override the docker image command | `nil` | -| `web.args` | Docker image command arguments | `["web"]` | -| `web.ingress.annotations` | Concourse Web Ingress annotations | `{}` | -| `web.ingress.enabled` | Enable Concourse Web Ingress | `false` | -| `web.ingress.hosts` | Concourse Web Ingress Hostnames | `[]` | -| `web.ingress.ingressClassName` | IngressClass to register to | `nil` | -| `web.ingress.rulesOverride` | Concourse Web Ingress rules (override) (alternate to `web.ingress.hosts`) | `[]` | -| `web.ingress.tls` | Concourse Web Ingress TLS configuration | `[]` | -| `web.keySecretsPath` | Specify the mount directory of the web keys secrets | `/concourse-keys` | -| `web.labels` | Additional labels to be added to the web deployment `metadata.labels` | `{}` | -| `web.deploymentAnnotations` | Additional annotations to be added to the web deployment `metadata.annotations` | `{}` | -| `web.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `web.livenessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/api/v1/info` | -| `web.livenessProbe.httpGet.port` | Name or number of the port to access on the container | `atc` | -| `web.livenessProbe.initialDelaySeconds` | Number of seconds after the container has started before liveness probes are initiated | `10` | -| `web.livenessProbe.periodSeconds` | How often (in seconds) to perform the probe | `15` | -| `web.livenessProbe.timeoutSeconds` | Number of seconds after which the probe times out | `3` | -| `web.nameOverride` | Override the Concourse Web components name | `nil` | -| `web.nodeSelector` | Node selector for web nodes | `{}` | -| `web.podLabels` | Additional labels to be added to the web deployment `spec.template.metadata.labels`, setting pods `metadata.labels` | `{}` | -| `web.postgresqlSecretsPath` | Specify the mount directory of the web postgresql secrets | `/concourse-postgresql` | -| `web.prometheus.enabled` | Enable the Prometheus metrics endpoint | `false` | -| `web.prometheus.bindIp` | IP to listen on to expose Prometheus metrics | `0.0.0.0` | -| `web.prometheus.bindPort` | Port to listen on to expose Prometheus metrics | `9391` | -| `web.prometheus.ServiceMonitor.enabled` | Enable the creation of a serviceMonitor object for the Prometheus operator | `false` | -| `web.prometheus.ServiceMonitor.interval` | The interval the Prometheus endpoint is scraped | `30s` | -| `web.prometheus.ServiceMonitor.namespace` | The namespace where the serviceMonitor object has to be created | `nil` | -| `web.prometheus.ServiceMonitor.labels` | Additional lables for the serviceMonitor object | `nil` | -| `web.prometheus.ServiceMonitor.metricRelabelings` | Relabel metrics as defined [here](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) | `nil` | -| `web.readinessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/api/v1/info` | -| `web.readinessProbe.httpGet.port` | Name or number of the port to access on the container | `atc` | -| `web.replicas` | Number of Concourse Web replicas | `1` | -| `web.resources.requests.cpu` | Minimum amount of cpu resources requested | `100m` | -| `web.resources.requests.memory` | Minimum amount of memory resources requested | `128Mi` | -| `web.service.api.annotations` | Concourse Web API Service annotations | `nil` | -| `web.service.api.NodePort` | Sets the nodePort for api when using `NodePort` | `nil` | -| `web.service.api.labels` | Additional concourse web api service labels | `nil` | -| `web.service.api.loadBalancerIP` | The IP to use when web.service.api.type is LoadBalancer | `nil` | -| `web.service.api.clusterIP` | The IP to use when web.service.api.type is ClusterIP | `nil` | -| `web.service.api.loadBalancerSourceRanges` | Concourse Web API Service Load Balancer Source IP ranges | `nil` | -| `web.service.api.tlsNodePort` | Sets the nodePort for api tls when using `NodePort` | `nil` | -| `web.service.api.type` | Concourse Web API service type | `ClusterIP` | -| `web.service.api.port.name` | Sets the port name for web service with `targetPort` `atc` | `atc` | -| `web.service.api.tlsPort.name` | Sets the port name for web service with `targetPort` `atc-tls` | `atc-tls` | -| `web.service.workerGateway.annotations` | Concourse Web workerGateway Service annotations | `nil` | -| `web.service.workerGateway.labels` | Additional concourse web workerGateway service labels | `nil` | -| `web.service.workerGateway.loadBalancerIP` | The IP to use when web.service.workerGateway.type is LoadBalancer | `nil` | -| `web.service.workerGateway.clusterIP` | The IP to use when web.service.workerGateway.type is ClusterIP | `None` | -| `web.service.workerGateway.loadBalancerSourceRanges` | Concourse Web workerGateway Service Load Balancer Source IP ranges | `nil` | -| `web.service.workerGateway.NodePort` | Sets the nodePort for workerGateway when using `NodePort` | `nil` | -| `web.service.workerGateway.type` | Concourse Web workerGateway service type | `ClusterIP` | -| `web.service.prometheus.annotations` | Concourse Web Prometheus Service annotations | `nil` | -| `web.service.prometheus.labels` | Additional concourse web prometheus service labels | `nil` | -| `web.shareProcessNamespace` | Enable or disable the process namespace sharing for the web nodes | `false` | -| `web.priorityClassName` | Sets a PriorityClass for the web pods | `nil` | -| `web.sidecarContainers` | Array of extra containers to run alongside the Concourse web container | `nil` | -| `web.databaseInitContainers` | Array of database init containers to run before the Concourse database migrations are applied | `nil` | -| `web.extraInitContainers` | Array of extra init containers to run before the Concourse web container | `nil` | -| `web.strategy` | Strategy for updates to deployment. | `{}` | -| `web.syslogSecretsPath` | Specify the mount directory of the web syslog secrets | `/concourse-syslog` | -| `web.tlsSecretsPath` | Where in the container the web TLS secrets should be mounted | `/concourse-web-tls` | -| `web.tolerations` | Tolerations for the web nodes | `[]` | -| `web.vaultSecretsPath` | Specify the mount directory of the web vault secrets | `/concourse-vault` | -| `web.vault.tokenPath` | Specify the path to a file containing a vault client authentication token | `nil` | -| `worker.additionalAffinities` | Additional affinities to apply to worker pods. E.g: node affinity | `{}` | -| `worker.additionalVolumeMounts` | VolumeMounts to be added to the worker pods | `nil` | -| `worker.additionalPorts` | Additional ports to be added to worker pods | `[]` | -| `worker.additionalVolumes` | Volumes to be added to the worker pods | `nil` | -| `worker.annotations` | Annotations to be added to the worker pods | `{}` | -| `worker.autoscaling` | Enable and configure pod autoscaling | `{}` | -| `worker.cleanUpWorkDirOnStart` | Removes any previous state created in `concourse.worker.workDir` | `true` | -| `worker.emptyDirSize` | When persistance is disabled this value will be used to limit the emptyDir volume size | `nil` | -| `worker.enabled` | Enable or disable the worker component. You should set postgres.enabled=false in order not to get an unnecessary Postgres chart deployed | `true` | -| `worker.env` | Configure additional environment variables for the worker container(s) | `[]` | -| `worker.hardAntiAffinity` | Should the workers be forced (as opposed to preferred) to be on different nodes? | `false` | -| `worker.hardAntiAffinityLabels` | Set of labels used for hard anti affinity rule | `{}` | -| `worker.keySecretsPath` | Specify the mount directory of the worker keys secrets | `/concourse-keys` | -| `worker.deploymentAnnotations` | Additional annotations to be added to the worker deployment `metadata.annotations` | `{}` | -| `worker.certsPath` | Specify the path for additional worker certificates | `/etc/ssl/certs` | -| `worker.kind` | Choose between `StatefulSet` to preserve state or `Deployment` for ephemeral workers | `StatefulSet` | -| `worker.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | -| `worker.livenessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/` | -| `worker.livenessProbe.httpGet.port` | Name or number of the port to access on the container | `worker-hc` | -| `worker.livenessProbe.initialDelaySeconds` | Number of seconds after the container has started before liveness probes are initiated | `10` | -| `worker.livenessProbe.periodSeconds` | How often (in seconds) to perform the probe | `15` | -| `worker.livenessProbe.timeoutSeconds` | Number of seconds after which the probe times out | `3` | -| `worker.minAvailable` | Minimum number of workers available after an eviction | `1` | -| `worker.nameOverride` | Override the Concourse Worker components name | `nil` | -| `worker.nodeSelector` | Node selector for worker nodes | `{}` | -| `worker.podManagementPolicy` | `OrderedReady` or `Parallel` (requires Kubernetes >= 1.7) | `Parallel` | -| `worker.readinessProbe` | Periodic probe of container service readiness | `{}` | -| `worker.replicas` | Number of Concourse Worker replicas | `2` | -| `worker.resources.requests.cpu` | Minimum amount of cpu resources requested | `100m` | -| `worker.resources.requests.memory` | Minimum amount of memory resources requested | `512Mi` | -| `worker.sidecarContainers` | Array of extra containers to run alongside the Concourse worker container | `nil` | -| `worker.extraInitContainers` | Array of extra init containers to run before the Concourse worker container | `nil` | -| `worker.priorityClassName` | Sets a PriorityClass for the worker pods | `nil` | -| `worker.terminationGracePeriodSeconds` | Upper bound for graceful shutdown to allow the worker to drain its tasks | `60` | -| `worker.tolerations` | Tolerations for the worker nodes | `[]` | -| `worker.persistentVolumeClaimRetentionPolicy` | `Retain` or `Delete` (requires Kubernetes >= 1.32) | `Retain` | -| `worker.updateStrategy` | `OnDelete` or `RollingUpdate` (requires Kubernetes >= 1.7) | `RollingUpdate` | +| Parameter | Description | Default | +| ----------------------- | ---------------------------------- | ---------------------------------- | +| `fullnameOverride` | Provide a name to substitute for the full names of resources | `nil` | +| `imageDigest` | Specific image digest to use in place of a tag. | `nil` | +| `imagePullPolicy` | Concourse image pull policy | `IfNotPresent` | +| `imagePullSecrets` | Array of imagePullSecrets in the namespace for pulling images | `[]` | +| `imageTag` | Concourse image version | `7.13.2` | +| `image` | Concourse image | `concourse/concourse` | +| `nameOverride` | Provide a name in place of `concourse` for `app:` labels | `nil` | +| `persistence.enabled` | Enable Concourse persistence using Persistent Volume Claims | `true` | +| `persistence.worker.accessMode` | Concourse Worker Persistent Volume Access Mode | `ReadWriteOnce` | +| `persistence.worker.size` | Concourse Worker Persistent Volume Storage Size | `20Gi` | +| `persistence.worker.storageClass` | Concourse Worker Persistent Volume Storage Class | `generic` | +| `persistence.worker.labels` | Concourse Worker Persistent Volume Labels | `{}` | +| `postgresql.enabled` | Enable PostgreSQL as a chart dependency | `true` | +| `postgresql.persistence.accessModes` | Persistent Volume Access Mode | `["ReadWriteOnce"]` | +| `postgresql.persistence.enabled` | Enable PostgreSQL persistence using Persistent Volume Claims | `true` | +| `postgresql.persistence.size` | Persistent Volume Storage Size | `8Gi` | +| `postgresql.persistence.storageClass` | Concourse data Persistent Volume Storage Class | `nil` | +| `persistence.worker.selector` | Concourse Worker Persistent Volume selector | `nil` | +| `postgresql.auth.database` | PostgreSQL Database to create | `concourse` | +| `postgresql.auth.password` | PostgreSQL Password for the new user | `concourse` | +| `postgresql.auth.username` | PostgreSQL User to create | `concourse` | +| `rbac.apiVersion` | RBAC version | `v1beta1` | +| `rbac.create` | Enables creation of RBAC resources | `true` | +| `rbac.webServiceAccountName` | Name of the service account to use for web pods if `rbac.create` is `false` | `default` | +| `rbac.webServiceAccountAnnotations` | Any annotations to be attached to the web service account | `{}` | +| `rbac.workerServiceAccountName` | Name of the service account to use for workers if `rbac.create` is `false` | `default` | +| `rbac.workerServiceAccountAnnotations` | Any annotations to be attached to the worker service account | `{}` | +| `podSecurityPolicy.create` | Enables creation of podSecurityPolicy resources | `false` | +| `podSecurityPolicy.allowedWorkerVolumes` | List of volumes allowed by the podSecurityPolicy for the worker pods | *See [values.yaml](values.yaml)* | +| `podSecurityPolicy.allowedWebVolumes` | List of volumes allowed by the podSecurityPolicy for the web pods | *See [values.yaml](values.yaml)* | +| `secrets.annotations`| Annotations to be added to the secrets | `{}` | +| `secrets.awsSecretsmanagerAccessKey` | AWS Access Key ID for Secrets Manager access | `nil` | +| `secrets.awsSecretsmanagerSecretKey` | AWS Secret Access Key ID for Secrets Manager access | `nil` | +| `secrets.awsSecretsmanagerSessionToken` | AWS Session Token for Secrets Manager access | `nil` | +| `secrets.awsSsmAccessKey` | AWS Access Key ID for SSM access | `nil` | +| `secrets.awsSsmSecretKey` | AWS Secret Access Key ID for SSM access | `nil` | +| `secrets.awsSsmSessionToken` | AWS Session Token for SSM access | `nil` | +| `secrets.bitbucketCloudClientId` | Client ID for the BitbucketCloud OAuth | `nil` | +| `secrets.bitbucketCloudClientSecret` | Client Secret for the BitbucketCloud OAuth | `nil` | +| `secrets.cfCaCert` | CA certificate for cf auth provider | `nil` | +| `secrets.cfClientId` | Client ID for cf auth provider | `nil` | +| `secrets.cfClientSecret` | Client secret for cf auth provider | `nil` | +| `secrets.conjurAccount` | Account for Conjur auth provider | `nil` | +| `secrets.conjurAuthnLogin` | Host username for Conjur auth provider | `nil` | +| `secrets.conjurAuthnApiKey` | API key for host used for Conjur auth provider. Either API key or token file can be used, but not both. | `nil` | +| `secrets.conjurAuthnTokenFile` | Token file used for Conjur auth provider if running in Kubernetes or IAM. Either token file or API key can be used, but not both. | `nil` | +| `secrets.conjurCACert` | CA Cert used if Conjur instance is deployed with a self-signed certificate | `nil` | +| `secrets.create` | Create the secret resource from the following values. *See [Secrets](#secrets)* | `true` | +| `secrets.credhubCaCert` | Value of PEM-encoded CA cert file to use to verify the CredHub server SSL cert. | `nil` | +| `secrets.credhubClientId` | Client ID for CredHub authorization. | `nil` | +| `secrets.credhubClientSecret` | Client secret for CredHub authorization. | `nil` | +| `secrets.credhubClientKey` | Client key for Credhub authorization. | `nil` | +| `secrets.credhubClientCert` | Client cert for Credhub authorization | `nil` | +| `secrets.encryptionKey` | current encryption key | `nil` | +| `secrets.githubCaCert` | CA certificate for Enterprise Github OAuth | `nil` | +| `secrets.githubClientId` | Application client ID for GitHub OAuth | `nil` | +| `secrets.githubClientSecret` | Application client secret for GitHub OAuth | `nil` | +| `secrets.gitlabClientId` | Application client ID for GitLab OAuth | `nil` | +| `secrets.gitlabClientSecret` | Application client secret for GitLab OAuth | `nil` | +| `secrets.hostKeyPub` | Concourse Host Public Key | *See [values.yaml](values.yaml)* | +| `secrets.hostKey` | Concourse Host Private Key | *See [values.yaml](values.yaml)* | +| `secrets.influxdbPassword` | Password used to authenticate with influxdb | `nil` | +| `secrets.ldapCaCert` | CA Certificate for LDAP | `nil` | +| `secrets.localUsers` | Create concourse local users. Default username and password are `test:test` *See [values.yaml](values.yaml)* | +| `secrets.microsoftClientId` | Client ID for Microsoft authorization. | `nil ` | +| `secrets.microsoftClientSecret` | Client secret for Microsoft authorization. | `nil` | +| `secrets.oauthCaCert` | CA certificate for Generic OAuth | `nil` | +| `secrets.oauthClientId` | Application client ID for Generic OAuth | `nil` | +| `secrets.oauthClientSecret` | Application client secret for Generic OAuth | `nil` | +| `secrets.oidcCaCert` | CA certificate for OIDC Oauth | `nil` | +| `secrets.oidcClientId` | Application client ID for OIDI OAuth | `nil` | +| `secrets.oidcClientSecret` | Application client secret for OIDC OAuth | `nil` | +| `secrets.oldEncryptionKey` | old encryption key, used for key rotation | `nil` | +| `secrets.postgresCaCert` | PostgreSQL CA certificate | `nil` | +| `secrets.postgresClientCert` | PostgreSQL Client certificate | `nil` | +| `secrets.postgresClientKey` | PostgreSQL Client key | `nil` | +| `secrets.postgresPassword` | PostgreSQL User Password | `nil` | +| `secrets.postgresUser` | PostgreSQL User Name | `nil` | +| `secrets.samlCaCert` | CA Certificate for SAML | `nil` | +| `secrets.sessionSigningKey` | Concourse Session Signing Private Key | *See [values.yaml](values.yaml)* | +| `secrets.syslogCaCert` | SSL certificate to verify Syslog server | `nil` | +| `secrets.teamAuthorizedKeys` | Array of team names and worker public keys for external workers | `nil` | +| `secrets.vaultAuthParam` | Paramter to pass when logging in via the backend | `nil` | +| `secrets.vaultCaCert` | CA certificate use to verify the vault server SSL cert | `nil` | +| `secrets.vaultClientCert` | Vault Client Certificate | `nil` | +| `secrets.vaultClientKey` | Vault Client Key | `nil` | +| `secrets.vaultClientToken` | Vault periodic client token | `nil` | +| `secrets.webTlsCert` | TLS certificate for the web component to terminate TLS connections | `nil` | +| `secrets.webTlsKey` | An RSA private key, used to encrypt HTTPS traffic | `nil` | +| `secrets.webTlsCaCert` | TLS CA certificate for the web component to terminate TLS connections | `nil` | +| `secrets.workerKeyPub` | Concourse Worker Public Key | *See [values.yaml](values.yaml)* | +| `secrets.workerKey` | Concourse Worker Private Key | *See [values.yaml](values.yaml)* | +| `secrets.workerAdditionalCerts` | Concourse Worker Additional Certificates | *See [values.yaml](values.yaml)* | +| `web.additionalAffinities` | Additional affinities to apply to web pods. E.g: node affinity | `{}` | +| `web.additionalVolumeMounts` | VolumeMounts to be added to the web pods | `nil` | +| `web.additionalVolumes` | Volumes to be added to the web pods | `nil` | +| `web.annotations`| Annotations to be added to the web pods | `{}` | +| `web.authSecretsPath` | Specify the mount directory of the web auth secrets | `/concourse-auth` | +| `web.credhubSecretsPath` | Specify the mount directory of the web credhub secrets | `/concourse-credhub` | +| `web.datadog.agentHostUseHostIP` | Use IP of Pod's node overrides `agentHost` | `false` | +| `web.datadog.agentHost` | Datadog Agent host | `127.0.0.1` | +| `web.datadog.agentPort` | Datadog Agent port | `8125` | +| `web.datadog.agentUdsFilepath` | Datadog agent unix domain socket (uds) filepath to expose dogstatsd metrics (ex. `/tmp/datadog.socket`) | `nil` | +| `web.datadog.enabled` | Enable or disable Datadog metrics | `false` | +| `web.datadog.prefix` | Prefix for emitted metrics | `"concourse.ci"` | +| `web.enabled` | Enable or disable the web component | `true` | +| `web.env` | Configure additional environment variables for the web containers | `[]` | +| `web.command` | Override the docker image command | `nil` | +| `web.args` | Docker image command arguments | `["web"]` | +| `web.ingress.annotations` | Concourse Web Ingress annotations | `{}` | +| `web.ingress.enabled` | Enable Concourse Web Ingress | `false` | +| `web.ingress.hosts` | Concourse Web Ingress Hostnames | `[]` | +| `web.ingress.ingressClassName` | IngressClass to register to | `nil` | +| `web.ingress.rulesOverride` | Concourse Web Ingress rules (override) (alternate to `web.ingress.hosts`) | `[]` | +| `web.ingress.tls` | Concourse Web Ingress TLS configuration | `[]` | +| `web.keySecretsPath` | Specify the mount directory of the web keys secrets | `/concourse-keys` | +| `web.labels`| Additional labels to be added to the web deployment `metadata.labels` | `{}` | +| `web.deploymentAnnotations` | Additional annotations to be added to the web deployment `metadata.annotations` | `{}` | +| `web.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `web.livenessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/api/v1/info` | +| `web.livenessProbe.httpGet.port` | Name or number of the port to access on the container | `atc` | +| `web.livenessProbe.initialDelaySeconds` | Number of seconds after the container has started before liveness probes are initiated | `10` | +| `web.livenessProbe.periodSeconds` | How often (in seconds) to perform the probe | `15` | +| `web.livenessProbe.timeoutSeconds` | Number of seconds after which the probe times out | `3` | +| `web.nameOverride` | Override the Concourse Web components name | `nil` | +| `web.nodeSelector` | Node selector for web nodes | `{}` | +| `web.podLabels`| Additional labels to be added to the web deployment `spec.template.metadata.labels`, setting pods `metadata.labels` | `{}` | +| `web.postgresqlSecretsPath` | Specify the mount directory of the web postgresql secrets | `/concourse-postgresql` | +| `web.prometheus.enabled` | Enable the Prometheus metrics endpoint | `false` | +| `web.prometheus.bindIp` | IP to listen on to expose Prometheus metrics | `0.0.0.0` | +| `web.prometheus.bindPort` | Port to listen on to expose Prometheus metrics | `9391` | +| `web.prometheus.ServiceMonitor.enabled` | Enable the creation of a serviceMonitor object for the Prometheus operator | `false` | +| `web.prometheus.ServiceMonitor.interval` | The interval the Prometheus endpoint is scraped | `30s` | +| `web.prometheus.ServiceMonitor.namespace` | The namespace where the serviceMonitor object has to be created | `nil` | +| `web.prometheus.ServiceMonitor.labels` | Additional lables for the serviceMonitor object | `nil` | +| `web.prometheus.ServiceMonitor.metricRelabelings` | Relabel metrics as defined [here](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) | `nil` | +| `web.readinessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/api/v1/info` | +| `web.readinessProbe.httpGet.port` | Name or number of the port to access on the container | `atc` | +| `web.replicas` | Number of Concourse Web replicas | `1` | +| `web.resources.requests.cpu` | Minimum amount of cpu resources requested | `100m` | +| `web.resources.requests.memory` | Minimum amount of memory resources requested | `128Mi` | +| `web.service.api.annotations` | Concourse Web API Service annotations | `nil` | +| `web.service.api.NodePort` | Sets the nodePort for api when using `NodePort` | `nil` | +| `web.service.api.labels` | Additional concourse web api service labels | `nil` | +| `web.service.api.loadBalancerIP` | The IP to use when web.service.api.type is LoadBalancer | `nil` | +| `web.service.api.clusterIP` | The IP to use when web.service.api.type is ClusterIP | `nil` | +| `web.service.api.loadBalancerSourceRanges` | Concourse Web API Service Load Balancer Source IP ranges | `nil` | +| `web.service.api.tlsNodePort` | Sets the nodePort for api tls when using `NodePort` | `nil` | +| `web.service.api.type` | Concourse Web API service type | `ClusterIP` | +| `web.service.api.port.name` | Sets the port name for web service with `targetPort` `atc` | `atc` | +| `web.service.api.tlsPort.name` | Sets the port name for web service with `targetPort` `atc-tls` | `atc-tls` | +| `web.service.workerGateway.annotations` | Concourse Web workerGateway Service annotations | `nil` | +| `web.service.workerGateway.labels` | Additional concourse web workerGateway service labels | `nil` | +| `web.service.workerGateway.loadBalancerIP` | The IP to use when web.service.workerGateway.type is LoadBalancer | `nil` | +| `web.service.workerGateway.clusterIP` | The IP to use when web.service.workerGateway.type is ClusterIP | `None` | +| `web.service.workerGateway.loadBalancerSourceRanges` | Concourse Web workerGateway Service Load Balancer Source IP ranges | `nil` | +| `web.service.workerGateway.NodePort` | Sets the nodePort for workerGateway when using `NodePort` | `nil` | +| `web.service.workerGateway.type` | Concourse Web workerGateway service type | `ClusterIP` | +| `web.service.prometheus.annotations` | Concourse Web Prometheus Service annotations | `nil` | +| `web.service.prometheus.labels` | Additional concourse web prometheus service labels | `nil` | +| `web.shareProcessNamespace` | Enable or disable the process namespace sharing for the web nodes | `false` | +| `web.priorityClassName` | Sets a PriorityClass for the web pods | `nil` | +| `web.sidecarContainers` | Array of extra containers to run alongside the Concourse web container | `nil` | +| `web.databaseInitContainers` | Array of database init containers to run before the Concourse database migrations are applied | `nil` | +| `web.extraInitContainers` | Array of extra init containers to run before the Concourse web container | `nil` | +| `web.strategy` | Strategy for updates to deployment. | `{}` | +| `web.syslogSecretsPath` | Specify the mount directory of the web syslog secrets | `/concourse-syslog` | +| `web.tlsSecretsPath` | Where in the container the web TLS secrets should be mounted | `/concourse-web-tls` | +| `web.tolerations` | Tolerations for the web nodes | `[]` | +| `web.vaultSecretsPath` | Specify the mount directory of the web vault secrets | `/concourse-vault` | +| `web.vault.tokenPath` | Specify the path to a file containing a vault client authentication token | `nil` | +| `worker.additionalAffinities` | Additional affinities to apply to worker pods. E.g: node affinity | `{}` | +| `worker.additionalVolumeMounts` | VolumeMounts to be added to the worker pods | `nil` | +| `worker.additionalPorts` | Additional ports to be added to worker pods | `[]` | +| `worker.additionalVolumes` | Volumes to be added to the worker pods | `nil` | +| `worker.annotations` | Annotations to be added to the worker pods | `{}` | +| `worker.autoscaling` | Enable and configure pod autoscaling | `{}` | +| `worker.cleanUpWorkDirOnStart` | Removes any previous state created in `concourse.worker.workDir` | `true` | +| `worker.emptyDirSize` | When persistance is disabled this value will be used to limit the emptyDir volume size | `nil` | +| `worker.enabled` | Enable or disable the worker component. You should set postgres.enabled=false in order not to get an unnecessary Postgres chart deployed | `true` | +| `worker.env` | Configure additional environment variables for the worker container(s) | `[]` | +| `worker.hardAntiAffinity` | Should the workers be forced (as opposed to preferred) to be on different nodes? | `false` | +| `worker.hardAntiAffinityLabels` | Set of labels used for hard anti affinity rule | `{}` | +| `worker.keySecretsPath` | Specify the mount directory of the worker keys secrets | `/concourse-keys` | +| `worker.deploymentAnnotations` | Additional annotations to be added to the worker deployment `metadata.annotations` | `{}` | +| `worker.certsPath` | Specify the path for additional worker certificates | `/etc/ssl/certs` | +| `worker.kind` | Choose between `StatefulSet` to preserve state or `Deployment` for ephemeral workers | `StatefulSet` | +| `worker.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded | `5` | +| `worker.livenessProbe.httpGet.path` | Path to access on the HTTP server when performing the healthcheck | `/` | +| `worker.livenessProbe.httpGet.port` | Name or number of the port to access on the container | `worker-hc` | +| `worker.livenessProbe.initialDelaySeconds` | Number of seconds after the container has started before liveness probes are initiated | `10` | +| `worker.livenessProbe.periodSeconds` | How often (in seconds) to perform the probe | `15` | +| `worker.livenessProbe.timeoutSeconds` | Number of seconds after which the probe times out | `3` | +| `worker.minAvailable` | Minimum number of workers available after an eviction | `1` | +| `worker.nameOverride` | Override the Concourse Worker components name | `nil` | +| `worker.nodeSelector` | Node selector for worker nodes | `{}` | +| `worker.podManagementPolicy` | `OrderedReady` or `Parallel` (requires Kubernetes >= 1.7) | `Parallel` | +| `worker.readinessProbe` | Periodic probe of container service readiness | `{}` | +| `worker.replicas` | Number of Concourse Worker replicas | `2` | +| `worker.resources.requests.cpu` | Minimum amount of cpu resources requested | `100m` | +| `worker.resources.requests.memory` | Minimum amount of memory resources requested | `512Mi` | +| `worker.sidecarContainers` | Array of extra containers to run alongside the Concourse worker container | `nil` | +| `worker.extraInitContainers` | Array of extra init containers to run before the Concourse worker container | `nil` | +| `worker.priorityClassName` | Sets a PriorityClass for the worker pods | `nil` | +| `worker.terminationGracePeriodSeconds` | Upper bound for graceful shutdown to allow the worker to drain its tasks | `60` | +| `worker.tolerations` | Tolerations for the worker nodes | `[]` | +| `worker.persistentVolumeClaimRetentionPolicy` | `Retain` or `Delete` (requires Kubernetes >= 1.32) | `Retain` | +| `worker.updateStrategy` | `OnDelete` or `RollingUpdate` (requires Kubernetes >= 1.7) | `RollingUpdate` | For configurable Concourse parameters, refer to [`values.yaml`](values.yaml)' `concourse` section. All parameters under this section are strictly mapped from the `concourse` binary commands. From c3d8149e11de8cdfb6d4f3a71f928194f34e6a30 Mon Sep 17 00:00:00 2001 From: "brandon.cate" Date: Tue, 12 Aug 2025 14:54:03 -0500 Subject: [PATCH 07/10] unformat README.md to be consistent 2 Signed-off-by: brandon.cate --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a8efcee7..71b910b8 100644 --- a/README.md +++ b/README.md @@ -81,8 +81,8 @@ See [Configuration](#configuration) and [`values.yaml`](./values.yaml) for the c The following table lists the configurable parameters of the Concourse chart and their default values. -| Parameter | Description | Default | -| ----------------------- | ---------------------------------- | ---------------------------------- | +| Parameter | Description | Default | +| ----------------------- | ---------------------------------- | ---------------------------------------------------------- | | `fullnameOverride` | Provide a name to substitute for the full names of resources | `nil` | | `imageDigest` | Specific image digest to use in place of a tag. | `nil` | | `imagePullPolicy` | Concourse image pull policy | `IfNotPresent` | From 6c9e83c162443f987b6a1c68effb9a04207da035 Mon Sep 17 00:00:00 2001 From: "brandon.cate" Date: Tue, 12 Aug 2025 15:16:52 -0500 Subject: [PATCH 08/10] whitespace trim Signed-off-by: brandon.cate --- templates/worker-statefulset.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/worker-statefulset.yaml b/templates/worker-statefulset.yaml index f16bb518..f4913c64 100644 --- a/templates/worker-statefulset.yaml +++ b/templates/worker-statefulset.yaml @@ -231,7 +231,7 @@ spec: {{- end }} {{- end }} {{- end }} - {{- if semverCompare ">=1.32-0" .Capabilities.KubeVersion.Version -}} + {{ if semverCompare ">=1.32-0" .Capabilities.KubeVersion.Version -}} persistentVolumeClaimRetentionPolicy: {{ toYaml .Values.worker.persistentVolumeClaimRetentionPolicy | indent 4 }} {{- end }} From cc4e2e14791461a152bc9fef250d83b0e90cf132 Mon Sep 17 00:00:00 2001 From: narner90 Date: Tue, 19 Aug 2025 13:44:13 -0600 Subject: [PATCH 09/10] Remove extra quotes from CONCOURSE_VAULT_CLIENT_TOKEN_PATH Signed-off-by: narner90 --- templates/web-deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/web-deployment.yaml b/templates/web-deployment.yaml index b403c3a9..2a483d45 100644 --- a/templates/web-deployment.yaml +++ b/templates/web-deployment.yaml @@ -623,7 +623,7 @@ spec: {{- end }} {{- if .Values.concourse.web.vault.tokenPath }} - name: CONCOURSE_VAULT_CLIENT_TOKEN_PATH - value: "{{ .Values.concourse.web.vault.tokenPath | quote }}" + value: {{ .Values.concourse.web.vault.tokenPath | quote }} {{- end }} {{- if eq .Values.concourse.web.vault.authBackend "cert" }} - name: CONCOURSE_VAULT_CLIENT_CERT From ab662e70d565418fef218797e4ea9d971e7b8798 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christopher=20Larivi=C3=A8re?= Date: Tue, 26 Aug 2025 20:05:53 -0400 Subject: [PATCH 10/10] incorrect mapping in values file + update readme MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Christopher Larivière --- README.md | 6 +++--- templates/web-route.yaml | 6 +++++- values.yaml | 4 ++-- 3 files changed, 10 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 85b36fab..abde3cd9 100644 --- a/README.md +++ b/README.md @@ -200,9 +200,9 @@ The following table lists the configurable parameters of the Concourse chart and | `web.ingress.tls` | Concourse Web Ingress TLS configuration | `[]` | | `web.route.annotations` | Concourse Web HTTPRoute annotations | `{}` | | `web.route.enabled` | Enable Concourse Web HTTPRoute | `false` | -| `web.route.hosts` | Concourse Web HTTPRoutes Hostnames | `[]` | -| `web.route.labels` | Concourse Web HTTPRoute labels | `{}` | -| `web.route.parentRefs` | Concourse Web HTTPRoute parentRefs (gateways) | `{}` | +| `web.route.hostnames` | Concourse Web HTTPRoutes Hostnames | `[]` | +| `web.route.parentRefs` | Concourse Web HTTPRoute parentRefs (gateways) | `[]` | +| `web.route.labels` | Concourse Web HTTPRoute labels | `[]` | | `web.keySecretsPath` | Specify the mount directory of the web keys secrets | `/concourse-keys` | | `web.labels`| Additional labels to be added to the web deployment `metadata.labels` | `{}` | | `web.deploymentAnnotations` | Additional annotations to be added to the web deployment `metadata.annotations` | `{}` | diff --git a/templates/web-route.yaml b/templates/web-route.yaml index 1b5918bc..ba1b3b97 100644 --- a/templates/web-route.yaml +++ b/templates/web-route.yaml @@ -21,10 +21,14 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: + {{- if and $route.parentRefs (gt (len $route.parentRefs) 0) }} parentRefs: {{- toYaml $route.parentRefs | nindent 2 }} + {{- end }} + {{- if and $route.hostnames (gt (len $route.hostnames) 0) }} hostnames: - {{- toYaml $route.hosts | nindent 2 }} + {{- toYaml $route.hostnames | nindent 2 }} + {{- end }} rules: - matches: - path: diff --git a/values.yaml b/values.yaml index 640efe24..9907f1f4 100644 --- a/values.yaml +++ b/values.yaml @@ -2469,12 +2469,12 @@ web: ## sectionName: https ## group: gateway.networking.k8s.io ## kind: Gateway - parentRefs: {} + parentRefs: [] ## Hosts to attach to the HTTPRoute ## Example: ## - "concourse.example.com" - hosts: [] + hostnames: [] ## Configuration values for Concourse Worker components. ## For more information regarding the characteristics of