Update Helm release postgresql to v14

Signed-off-by: Renovate Bot <[email protected]>
projectsyn · Feb 12, 2024 · 649ff2a · 649ff2a
1 parent 29aabc2
commit 649ff2a
Show file tree

Hide file tree

Showing 17 changed files with 280 additions and 35 deletions.
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -62,7 +62,7 @@ parameters:
         version: v2.3.0
       postgresql:
         source: https://charts.bitnami.com/bitnami
-        version: 12.12.10
+        version: 14.0.5
     # FQDN should be overwritten on the cluster level
     fqdn: keycloak.example.com
     # Disables dynamically resolving the hostname from request headers.

diff --git a/...tin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/networkpolicy.yaml b/...tin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/networkpolicy.yaml
@@ -6,21 +6,33 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
-  name: keycloak-postgresql-ingress
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
+  name: keycloak-postgresql
   namespace: syn-builtin
 spec:
-  ingress:
-    - from:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 5432
+      to:
         - podSelector:
             matchLabels:
-              app.kubernetes.io/instance: keycloakx
-              app.kubernetes.io/name: keycloakx
-      ports:
+              app.kubernetes.io/component: read
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/name: postgresql
+  ingress:
+    - ports:
         - port: 5432
   podSelector:
     matchLabels:
       app.kubernetes.io/component: primary
       app.kubernetes.io/instance: keycloak
       app.kubernetes.io/name: postgresql
+  policyTypes:
+    - Ingress
+    - Egress
diff --git a/...iltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/statefulset.yaml b/...iltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/statefulset.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: builtin
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
   name: keycloak-postgresql
   namespace: syn-builtin
 spec:
@@ -29,8 +29,8 @@ spec:
         app.kubernetes.io/instance: keycloak
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: postgresql
-        app.kubernetes.io/version: 15.4.0
-        helm.sh/chart: postgresql-12.12.10
+        app.kubernetes.io/version: 16.2.0
+        helm.sh/chart: postgresql-14.0.5
       name: keycloak-postgresql
     spec:
       affinity:
@@ -46,6 +46,7 @@ spec:
                     app.kubernetes.io/name: postgresql
                 topologyKey: kubernetes.io/hostname
               weight: 1
+      automountServiceAccountToken: false
       containers:
         - env:
             - name: BITNAMI_DEBUG
@@ -134,8 +135,12 @@ spec:
             capabilities:
               drop:
                 - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsGroup: null
             runAsNonRoot: true
             runAsUser: 1001
+            seLinuxOptions: null
             seccompProfile:
               type: RuntimeDefault
           volumeMounts:
@@ -172,6 +177,7 @@ spec:
             runAsGroup: 0
             runAsNonRoot: false
             runAsUser: 0
+            seLinuxOptions: null
             seccompProfile:
               type: RuntimeDefault
           volumeMounts:
@@ -185,7 +191,10 @@ spec:
               name: postgresql-certificates
       securityContext:
         fsGroup: 1001
-      serviceAccountName: default
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
+      serviceAccountName: keycloak-postgresql
       volumes:
         - name: raw-certificates
           secret:

diff --git a/...ltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/svc-headless.yaml b/...ltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/svc-headless.yaml
@@ -8,8 +8,8 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
   name: keycloak-postgresql-hl
   namespace: syn-builtin
 spec:

diff --git a/...olden/builtin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/svc.yaml b/...olden/builtin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/primary/svc.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
   name: keycloak-postgresql
   namespace: syn-builtin
 spec:

diff --git a/...uiltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/read/networkpolicy.yaml b/...uiltin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/read/networkpolicy.yaml
@@ -0,0 +1,38 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: read
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
+  name: keycloak-postgresql-read
+  namespace: syn-builtin
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 5432
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/component: primary
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/name: postgresql
+  ingress:
+    - ports:
+        - port: 5432
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: read
+      app.kubernetes.io/instance: keycloak
+      app.kubernetes.io/name: postgresql
+  policyTypes:
+    - Ingress
+    - Egress
diff --git a/...en/builtin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml b/...en/builtin/builtin/builtin/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
+  name: keycloak-postgresql
+  namespace: syn-builtin
diff --git a/...rnal/external/external/01_keycloak_helmchart/postgresql/templates/read/networkpolicy.yaml b/...rnal/external/external/01_keycloak_helmchart/postgresql/templates/read/networkpolicy.yaml
@@ -0,0 +1,38 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    app.kubernetes.io/component: read
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
+  name: keycloak-postgresql-read
+  namespace: syn-external
+spec:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 5432
+      to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/component: primary
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/name: postgresql
+  ingress:
+    - ports:
+        - port: 5432
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: read
+      app.kubernetes.io/instance: keycloak
+      app.kubernetes.io/name: postgresql
+  policyTypes:
+    - Ingress
+    - Egress
diff --git a/...external/external/external/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml b/...external/external/external/01_keycloak_helmchart/postgresql/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: keycloak
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: postgresql
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
+  name: keycloak-postgresql
+  namespace: syn-external
diff --git a/.../openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/networkpolicy.yaml b/.../openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/networkpolicy.yaml
@@ -6,21 +6,33 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
-  name: keycloak-postgresql-ingress
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
+  name: keycloak-postgresql
   namespace: syn-openshift-postgres
 spec:
-  ingress:
-    - from:
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 5432
+      to:
         - podSelector:
             matchLabels:
-              app.kubernetes.io/instance: keycloakx
-              app.kubernetes.io/name: keycloakx
-      ports:
+              app.kubernetes.io/component: read
+              app.kubernetes.io/instance: keycloak
+              app.kubernetes.io/name: postgresql
+  ingress:
+    - ports:
         - port: 5432
   podSelector:
     matchLabels:
       app.kubernetes.io/component: primary
       app.kubernetes.io/instance: keycloak
       app.kubernetes.io/name: postgresql
+  policyTypes:
+    - Ingress
+    - Egress
diff --git a/...es/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/statefulset.yaml b/...es/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/statefulset.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: openshift-postgres
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
   name: keycloak-postgresql
   namespace: syn-openshift-postgres
 spec:
@@ -29,8 +29,8 @@ spec:
         app.kubernetes.io/instance: keycloak
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: postgresql
-        app.kubernetes.io/version: 15.4.0
-        helm.sh/chart: postgresql-12.12.10
+        app.kubernetes.io/version: 16.2.0
+        helm.sh/chart: postgresql-14.0.5
       name: keycloak-postgresql
     spec:
       affinity:
@@ -46,6 +46,7 @@ spec:
                     app.kubernetes.io/name: postgresql
                 topologyKey: kubernetes.io/hostname
               weight: 1
+      automountServiceAccountToken: false
       containers:
         - env:
             - name: BITNAMI_DEBUG
@@ -134,7 +135,11 @@ spec:
             capabilities:
               drop:
                 - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsGroup: null
             runAsNonRoot: true
+            seLinuxOptions: null
             seccompProfile:
               type: RuntimeDefault
           volumeMounts:
@@ -165,7 +170,11 @@ spec:
             capabilities:
               drop:
                 - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsGroup: null
             runAsNonRoot: true
+            seLinuxOptions: null
             seccompProfile:
               type: RuntimeDefault
           volumeMounts:
@@ -174,9 +183,12 @@ spec:
             - mountPath: /opt/bitnami/postgresql/certs
               name: postgresql-certificates
       securityContext:
+        fsGroupChangePolicy: Always
         seccompProfile:
           type: RuntimeDefault
-      serviceAccountName: default
+        supplementalGroups: []
+        sysctls: []
+      serviceAccountName: keycloak-postgresql
       volumes:
         - name: raw-certificates
           secret:

diff --git a/...s/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/svc-headless.yaml b/...s/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/svc-headless.yaml
@@ -8,8 +8,8 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
   name: keycloak-postgresql-hl
   namespace: syn-openshift-postgres
 spec:

diff --git a/...t-postgres/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/svc.yaml b/...t-postgres/openshift-postgres/01_keycloak_helmchart/postgresql/templates/primary/svc.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: keycloak
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: postgresql
-    app.kubernetes.io/version: 15.4.0
-    helm.sh/chart: postgresql-12.12.10
+    app.kubernetes.io/version: 16.2.0
+    helm.sh/chart: postgresql-14.0.5
   name: keycloak-postgresql
   namespace: syn-openshift-postgres
 spec: