zammad 6.0 update (#188)

Signed-off-by: André Bauer <[email protected]>
zammad · Jun 21, 2023 · 69e85f0 · 69e85f0
1 parent cd0a653
commit 69e85f0
Show file tree

Hide file tree

Showing 6 changed files with 77 additions and 33 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -28,7 +28,7 @@ jobs:
           LINTER_RULES_PATH: .github/linters
           VALIDATE_ALL_CODEBASE: false
           VALIDATE_JSCPD: false
-          VALIDATE_KUBERNETES_KUBEVAL: false
+          VALIDATE_KUBERNETES_KUBECONFORM: false
           VALIDATE_YAML: false
 
   lint-chart:

diff --git a/zammad/Chart.yaml b/zammad/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: zammad
-version: 8.3.1
-appVersion: 5.4.1-28
+version: 9.0.0
+appVersion: 6.0.0-27
 description: Zammad is a web based open source helpdesk/customer support system with many features to manage customer communication via several channels like telephone, facebook, twitter, chat and e-mails.
 home: https://zammad.org
 icon: https://raw.githubusercontent.com/zammad/zammad-documentation/main/images/zammad_logo_600x520.png
@@ -16,17 +16,17 @@ maintainers:
 dependencies:
   - name: elasticsearch
     repository: https://charts.bitnami.com/bitnami
-    version: 19.8.1
+    version: 19.10.2
     condition: zammadConfig.elasticsearch.enabled
   - name: memcached
-    version: 6.4.2
+    version: 6.5.2
     repository: https://charts.bitnami.com/bitnami
     condition: zammadConfig.memcached.enabled
   - name: postgresql
-    version: 12.4.3
+    version: 12.5.7
     repository: https://charts.bitnami.com/bitnami
     condition: zammadConfig.postgresql.enabled
   - name: redis
-    version: 17.10.3
+    version: 17.11.5
     repository: https://charts.bitnami.com/bitnami
     condition: zammadConfig.redis.enabled
diff --git a/zammad/README.md b/zammad/README.md
@@ -101,6 +101,20 @@ Open your browser on <http://localhost:8080>
 
 ## Upgrading
 
+### From chart version 8.x to 9.0.0
+
+- Zammads PVC changed to only hold contents of /opt/zammad/var instead whole Zammad content
+  - A new PVC `zammad-var` is created for this (the old zammad PVC is kept in case you need data from there)
+  - to update Zammad you have to delete the zammad statefulset first, as the volume config is changed
+    - `kubectl delete sts zammad`
+    - `helm upgrade zammad zammad/zammad`
+  - Zammads initContainer does also no rsync anymore
+- DB config is now done via `DATABASE_URL` env var instead of creating a database.yml in the config directory
+- Zammads pod securitycontext has new default setting for "seccompProfile:" with value "type: RuntimeDefault"
+- Docker registry changed to ghcr.io/zammad/zammad
+- auto_wizard.json needs to be placd into /opt/zammad/var directory now
+- All subcharts have been updated
+
 ### From chart version 7.x to 8.0.0
 
 SecurityContexts of pod and containers are configurable now.

diff --git a/zammad/templates/configmap-init.yaml b/zammad/templates/configmap-init.yaml
@@ -23,7 +23,6 @@ data:
   postgresql-init: |-
     #!/bin/bash
     set -e
-    sed -e "s#.*adapter:.*#  adapter: postgresql#g" -e "s#.*database:.*#  database: {{ .Values.zammadConfig.postgresql.db }}#g" -e "s#.*username:.*#  username: {{ .Values.zammadConfig.postgresql.user }}#g" -e "s#.*password:.*#  password: ${POSTGRESQL_PASS}\\n  host: {{ if .Values.zammadConfig.postgresql.enabled }}{{ .Release.Name }}-postgresql{{ else }}{{ .Values.zammadConfig.postgresql.host }}{{ end }}\\n  port: {{ .Values.zammadConfig.postgresql.port }}#g" < contrib/packager.io/database.yml.pkgr > config/database.yml
     if ! (bundle exec rails r 'puts User.any?' 2> /dev/null | grep -q true); then
         bundle exec rake db:migrate
         bundle exec rake db:seed
@@ -34,11 +33,8 @@ data:
   zammad-init: |-
     #!/bin/bash
     set -e
-    rsync -av {{ .Values.zammadConfig.initContainers.zammad.extraRsyncParams }} --delete --exclude 'config/database.yml' --exclude 'public/assets/images/*' --exclude 'storage/fs/*' "${ZAMMAD_TMP_DIR}/" "${ZAMMAD_DIR}"
-    rsync -av {{ .Values.zammadConfig.initContainers.zammad.extraRsyncParams }} "${ZAMMAD_TMP_DIR}"/public/assets/images/ "${ZAMMAD_DIR}"/public/assets/images
-    sed -i -e "s#config.action_dispatch.trusted_proxies =.*#config.action_dispatch.trusted_proxies = {{ .Values.zammadConfig.railsserver.trustedProxies }}#" config/environments/production.rb
     if [ -n "${AUTOWIZARD_JSON}" ]; then
-        echo "${AUTOWIZARD_JSON}" | base64 -d > auto_wizard.json
+        echo "${AUTOWIZARD_JSON}" | base64 -d > /opt/zammad/var/auto_wizard.json
     fi
     rm -f /opt/zammad/tmp/pids/*.pid
     echo "zammad init complete :)"
diff --git a/zammad/templates/statefulset.yaml b/zammad/templates/statefulset.yaml
@@ -60,8 +60,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumeMounts:
-            - name: {{ template "zammad.fullname" . }}
-              mountPath: /opt/zammad
+            - name: {{ template "zammad.fullname" . }}-var
+              mountPath: /opt/zammad/var
         {{- end }}
         - name: zammad-init
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
@@ -97,8 +97,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumeMounts:
-            - name: {{ template "zammad.fullname" . }}
-              mountPath: /opt/zammad
+            - name: {{ template "zammad.fullname" . }}-var
+              mountPath: /opt/zammad/var
             - name: {{ template "zammad.fullname" . }}-init
               mountPath: /docker-entrypoint.sh
               readOnly: true
@@ -123,6 +123,8 @@ spec:
                 secretKeyRef:
                   name: {{ template "zammad.postgresqlSecretName" . }}
                   key: {{ .Values.secrets.postgresql.secretKey }}
+            - name: DATABASE_URL
+              value: "postgres://{{ .Values.zammadConfig.postgresql.user }}:$(POSTGRESQL_PASS)@{{ if .Values.zammadConfig.postgresql.enabled }}{{ .Release.Name }}-postgresql{{ else }}{{ .Values.zammadConfig.postgresql.host }}{{ end }}:{{ .Values.zammadConfig.postgresql.port }}/{{ .Values.zammadConfig.postgresql.db }}"
           {{- if .Values.extraEnv }}
             {{- toYaml .Values.extraEnv | nindent 12 }}
           {{- end }}
@@ -135,8 +137,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumeMounts:
-            - name: {{ template "zammad.fullname" . }}
-              mountPath: /opt/zammad
+            - name: {{ template "zammad.fullname" . }}-var
+              mountPath: /opt/zammad/var
             - name: {{ template "zammad.fullname" . }}-init
               mountPath: /docker-entrypoint.sh
               readOnly: true
@@ -157,6 +159,13 @@ spec:
               value: "{{ if .Values.zammadConfig.memcached.enabled }}{{ .Release.Name }}-memcached{{ else }}{{ .Values.zammadConfig.memcached.host }}{{ end }}:{{ .Values.zammadConfig.memcached.port }}"
             - name: REDIS_URL
               value: "redis://:$(REDIS_PASSWORD)@{{ if .Values.zammadConfig.redis.enabled }}{{ .Release.Name }}-redis-master{{ else }}{{ .Values.zammadConfig.redis.host }}{{ end }}:{{ .Values.zammadConfig.redis.port }}"
+            - name: POSTGRESQL_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "zammad.postgresqlSecretName" . }}
+                  key: {{ .Values.secrets.postgresql.secretKey }}
+            - name: DATABASE_URL
+              value: "postgres://{{ .Values.zammadConfig.postgresql.user }}:$(POSTGRESQL_PASS)@{{ if .Values.zammadConfig.postgresql.enabled }}{{ .Release.Name }}-postgresql{{ else }}{{ .Values.zammadConfig.postgresql.host }}{{ end }}:{{ .Values.zammadConfig.postgresql.port }}/{{ .Values.zammadConfig.postgresql.db }}"
           {{- if or .Values.zammadConfig.elasticsearch.pass .Values.secrets.elasticsearch.useExisting }}
             - name: ELASTICSEARCH_PASSWORD
               valueFrom:
@@ -176,8 +185,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumeMounts:
-          - name: {{ template "zammad.fullname" . }}
-            mountPath: /opt/zammad
+          - name: {{ template "zammad.fullname" . }}-var
+            mountPath: /opt/zammad/var
           - name: {{ template "zammad.fullname" . }}-init
             mountPath: /docker-entrypoint.sh
             readOnly: true
@@ -218,8 +227,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumeMounts:
-            - name: {{ include "zammad.fullname" . }}
-              mountPath: /opt/zammad
+            - name: {{ include "zammad.fullname" . }}-var
+              mountPath: /opt/zammad/var
             - name: {{ include "zammad.fullname" . }}-nginx
               mountPath: /etc/nginx/nginx.conf
               subPath: nginx.conf
@@ -257,8 +266,17 @@ spec:
           {{- end }}
             - name: MEMCACHE_SERVERS
               value: "{{ if .Values.zammadConfig.memcached.enabled }}{{ .Release.Name }}-memcached{{ else }}{{ .Values.zammadConfig.memcached.host }}{{ end }}:{{ .Values.zammadConfig.memcached.port }}"
+            - name: RAILS_TRUSTED_PROXIES
+              value: "{{ .Values.zammadConfig.railsserver.trustedProxies }}"
             - name: REDIS_URL
               value: "redis://:$(REDIS_PASSWORD)@{{ if .Values.zammadConfig.redis.enabled }}{{ .Release.Name }}-redis-master{{ else }}{{ .Values.zammadConfig.redis.host }}{{ end }}:{{ .Values.zammadConfig.redis.port }}"
+            - name: POSTGRESQL_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "zammad.postgresqlSecretName" . }}
+                  key: {{ .Values.secrets.postgresql.secretKey }}
+            - name: DATABASE_URL
+              value: "postgres://{{ .Values.zammadConfig.postgresql.user }}:$(POSTGRESQL_PASS)@{{ if .Values.zammadConfig.postgresql.enabled }}{{ .Release.Name }}-postgresql{{ else }}{{ .Values.zammadConfig.postgresql.host }}{{ end }}:{{ .Values.zammadConfig.postgresql.port }}/{{ .Values.zammadConfig.postgresql.db }}"
           {{- if .Values.extraEnv }}
           {{- toYaml .Values.extraEnv | nindent 12 }}
           {{- end }}
@@ -282,8 +300,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumeMounts:
-            - name: {{ template "zammad.fullname" . }}
-              mountPath: /opt/zammad
+            - name: {{ template "zammad.fullname" . }}-var
+              mountPath: /opt/zammad/var
         - name: {{ .Chart.Name }}-scheduler
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -304,6 +322,13 @@ spec:
               value: "{{ if .Values.zammadConfig.memcached.enabled }}{{ .Release.Name }}-memcached{{ else }}{{ .Values.zammadConfig.memcached.host }}{{ end }}:{{ .Values.zammadConfig.memcached.port }}"
             - name: REDIS_URL
               value: "redis://:$(REDIS_PASSWORD)@{{ if .Values.zammadConfig.redis.enabled }}{{ .Release.Name }}-redis-master{{ else }}{{ .Values.zammadConfig.redis.host }}{{ end }}:{{ .Values.zammadConfig.redis.port }}"
+            - name: POSTGRESQL_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "zammad.postgresqlSecretName" . }}
+                  key: {{ .Values.secrets.postgresql.secretKey }}
+            - name: DATABASE_URL
+              value: "postgres://{{ .Values.zammadConfig.postgresql.user }}:$(POSTGRESQL_PASS)@{{ if .Values.zammadConfig.postgresql.enabled }}{{ .Release.Name }}-postgresql{{ else }}{{ .Values.zammadConfig.postgresql.host }}{{ end }}:{{ .Values.zammadConfig.postgresql.port }}/{{ .Values.zammadConfig.postgresql.db }}"
           {{- if .Values.extraEnv }}
           {{- toYaml .Values.extraEnv | nindent 12 }}
           {{- end }}
@@ -316,8 +341,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumeMounts:
-            - name: {{ template "zammad.fullname" . }}
-              mountPath: /opt/zammad
+            - name: {{ template "zammad.fullname" . }}-var
+              mountPath: /opt/zammad/var
         - name: {{ .Chart.Name }}-websocket
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -341,7 +366,14 @@ spec:
             - name: MEMCACHE_SERVERS
               value: "{{ if .Values.zammadConfig.memcached.enabled }}{{ .Release.Name }}-memcached{{ else }}{{ .Values.zammadConfig.memcached.host }}{{ end }}:{{ .Values.zammadConfig.memcached.port }}"
             - name: REDIS_URL
-              value: "redis://:$(REDIS_PASSWORD)@{{ if .Values.zammadConfig.redis.enabled }}{{ .Release.Name }}-redis-master{{ else }}{{ .Values.zammadConfig.redis.host }}{{ end }}:{{ .Values.zammadConfig.redis.port }}"          
+              value: "redis://:$(REDIS_PASSWORD)@{{ if .Values.zammadConfig.redis.enabled }}{{ .Release.Name }}-redis-master{{ else }}{{ .Values.zammadConfig.redis.host }}{{ end }}:{{ .Values.zammadConfig.redis.port }}"
+            - name: POSTGRESQL_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ template "zammad.postgresqlSecretName" . }}
+                  key: {{ .Values.secrets.postgresql.secretKey }}
+            - name: DATABASE_URL
+              value: "postgres://{{ .Values.zammadConfig.postgresql.user }}:$(POSTGRESQL_PASS)@{{ if .Values.zammadConfig.postgresql.enabled }}{{ .Release.Name }}-postgresql{{ else }}{{ .Values.zammadConfig.postgresql.host }}{{ end }}:{{ .Values.zammadConfig.postgresql.port }}/{{ .Values.zammadConfig.postgresql.db }}"
           {{- if .Values.extraEnv }}
           {{- toYaml .Values.extraEnv | nindent 12 }}
           {{- end }}
@@ -365,8 +397,8 @@ spec:
             {{- toYaml . | nindent 12 }}
           {{- end }}
           volumeMounts:
-            - name: {{ template "zammad.fullname" . }}
-              mountPath: /opt/zammad
+            - name: {{ template "zammad.fullname" . }}-var
+              mountPath: /opt/zammad/var
       {{- with .Values.securityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
@@ -392,7 +424,7 @@ spec:
   {{- else if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
   volumeClaimTemplates:
     - metadata:
-        name: {{ template "zammad.fullname" . }}
+        name: {{ template "zammad.fullname" . }}-var
       spec:
         accessModes:
         {{- range .Values.persistence.accessModes }}

diff --git a/zammad/values.yaml b/zammad/values.yaml
@@ -1,5 +1,5 @@
 image:
-  repository: zammad/zammad-docker-compose
+  repository: ghcr.io/zammad/zammad
   # if not set appVersion field from Chart.yaml is used as default
   tag: ""
   pullPolicy: IfNotPresent
@@ -49,6 +49,8 @@ securityContext:
   runAsUser: 1000
   runAsNonRoot: true
   runAsGroup: 1000
+  seccompProfile:
+    type: RuntimeDefault
 
 zammadConfig:
   elasticsearch:
@@ -330,7 +332,7 @@ volumePermissions:
   enabled: false
   image:
     repository: alpine
-    tag: "3.18.0"
+    tag: "3.18.2"
     pullPolicy: IfNotPresent
 
 # Configuration for persistence
@@ -344,7 +346,7 @@ persistence:
   accessModes:
     - ReadWriteOnce
   storageClass: ""
-  size: 15Gi
+  size: 5Gi
   annotations: {}
 
 # running zammad with more than 1 replica will need a ReadWriteMany storage volume!