updates for rancher 2.7.17 (#241) (#242)

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

charts/rancher/Chart.yaml

@@ -1,9 +1,9 @@
 apiVersion: v2
 name: rancher
 description: Install Rancher Server to manage Kubernetes clusters across providers
-version: 2.9.3
-appVersion: v2.9.3
-kubeVersion: < 1.31.0-0
+version: 2.7.17
+appVersion: v2.7.17
+kubeVersion: < 1.28.0-0
 home: https://rancher.com
 icon: https://github.com/rancher/ui/blob/master/public/assets/images/logos/welcome-cow.svg
 keywords:

charts/rancher/templates/_helpers.tpl

@@ -27,9 +27,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
   {{- printf "%s-%s" .Chart.Name .Chart.Version | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
-{{/*
-Render Values in configurationSnippet
-*/}}
+# Render Values in configurationSnippet
 {{- define "configurationSnippet" -}}
   {{- tpl (.Values.ingress.configurationSnippet) . | nindent 6 -}}
 {{- end -}}
@@ -78,12 +76,26 @@ add below linux tolerations to workloads could be scheduled to those linux nodes
 {{- end -}}
 
 {{/*
-    Select correct auditLog image
+Define the chosen value for PSPs. If this value is "", then the user did not set the value. This will
+result in psps on <=1.24 and no psps on >=1.25. If the value is true/false, then the user specifically
+chose an option, and that option will be used. If it is set otherwise, then we fail so the user can correct
+the invalid value.
 */}}
-{{- define "auditLog_image" -}}
-  {{- if .Values.busyboxImage }}
-    {{- .Values.busyboxImage}}
-  {{- else }}
-    {{- .Values.auditLog.image.repository -}}:{{- .Values.auditLog.image.tag -}}
-  {{- end }}
+
+{{- define "rancher.chart_psp_enabled" -}}
+{{- if kindIs "bool" .Values.global.cattle.psp.enabled -}}
+{{ .Values.global.cattle.psp.enabled }}
+{{- else if empty .Values.global.cattle.psp.enabled -}}
+  {{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}}
+    {{- if (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") -}}
+true
+    {{- else -}}
+false
+    {{- end -}}
+  {{- else -}}
+true
+  {{- end -}}
+{{- else -}}
+{{- fail "Invalid value for .Values.global.cattle.psp.enabled - must be a bool of true, false, or \"\"" -}}
+{{- end -}}
 {{- end -}}

charts/rancher/templates/configMap.yaml

@@ -10,9 +10,4 @@ data:
   rancher-webhook: {{ .Values.webhook | quote }}
   {{- else if .Values.webhook }}
   rancher-webhook: {{ toYaml .Values.webhook | quote }}
-  {{- end }}
-  {{- if and .Values.fleet (kindIs "string" .Values.fleet) }}
-  fleet: {{ .Values.fleet | quote }}
-  {{- else if .Values.fleet }}
-  fleet: {{ toYaml .Values.fleet | quote }}
   {{- end }}

charts/rancher/templates/deployment.yaml

@@ -161,33 +161,26 @@ spec:
 {{- if .Values.extraEnv }}
 {{ toYaml .Values.extraEnv | indent 8}}
 {{- end }}
-        startupProbe:
+        livenessProbe:
           httpGet:
             path: /healthz
             port: 80
-          timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
-          failureThreshold: {{ .Values.startupProbe.failureThreshold }}
-          periodSeconds: {{ .Values.startupProbe.periodSeconds }}
-        livenessProbe:
+          initialDelaySeconds: {{.Values.livenessProbe.initialDelaySeconds | default 60 }}
+          periodSeconds: {{ .Values.livenessProbe.periodSeconds | default 30 }}
+        readinessProbe:
           httpGet:
             path: /healthz
             port: 80
-          {{- with .Values.livenessProbe.initialDelaySeconds}}
-          initialDelaySeconds: {{ . }}
-          {{- end }}
-          timeoutSeconds: {{.Values.livenessProbe.timeoutSeconds }}
-          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
-          failureThreshold: {{.Values.livenessProbe.failureThreshold }}
-        readinessProbe:
+          initialDelaySeconds: {{.Values.readinessProbe.initialDelaySeconds | default  5}}
+          periodSeconds: {{ .Values.readinessProbe.periodSeconds | default 30}}
+{{- if .Values.startupProbe }}
+        startupProbe:
           httpGet:
             path: /healthz
             port: 80
-          {{- with .Values.readinessProbe.initialDelaySeconds}}
-          initialDelaySeconds: {{ . }}
-          {{- end }}
-          timeoutSeconds: {{.Values.readinessProbe.timeoutSeconds }}
-          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
-          failureThreshold: {{.Values.readinessProbe.failureThreshold }}
+          failureThreshold: {{.Values.startupProbe.failureThreshold | default 1}}
+          periodSeconds: {{ .Values.startupProbe.periodSeconds | default 30}}
+{{- end }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
         volumeMounts:
@@ -227,8 +220,16 @@ spec:
 {{- if eq .Values.auditLog.destination "sidecar" }}
   {{- if gt (int .Values.auditLog.level) 0 }}
       # Make audit logs available for Rancher log collector tools.
-      - image: {{ include "auditLog_image" . }}
-        imagePullPolicy: {{ default .Values.auditLog.image.pullPolicy .Values.busyboxImagePullPolicy }}
+      {{- if .Values.busyboxImage }}
+      - image: {{ .Values.busyboxImage}}
+      {{- else }}
+      - image: {{ .Values.auditLog.image.repository }}:{{.Values.auditLog.image.tag}}
+      {{- end }}
+      {{- if .Values.busyboxImagePullPolicy }}
+        imagePullPolicy: {{ .Values.busyboxImagePullPolicy }}
+      {{- else }}
+        imagePullPolicy: {{ .Values.auditLog.image.pullPolicy }}
+      {{- end }}
         name: {{ template "rancher.name" . }}-audit-log
         command: ["tail"]
         args: ["-F", "/var/log/auditlog/rancher-api-audit.log"]

charts/rancher/templates/ingress.yaml

@@ -54,8 +54,8 @@ spec:
           servicePort: {{ .Values.ingress.servicePort }}
           {{- end }}
         {{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
-        pathType: {{ .Values.ingress.pathType }}
-        path: {{ .Values.ingress.path }}
+        pathType: ImplementationSpecific
+        path: "/"
         {{- end }}
 {{- if eq .Values.tls "ingress" }}
   tls:

charts/rancher/templates/post-delete-hook-cluster-role.yaml

@@ -30,6 +30,14 @@ rules:
   - apiGroups: [ "admissionregistration.k8s.io" ]
     resources: [ "validatingwebhookconfigurations", "mutatingwebhookconfigurations" ]
     verbs: [ "get", "list", "delete" ]
+  - apiGroups: [ "policy" ]
+    resources: [ "podsecuritypolicies" ]
+    verbs: ["delete", "create" ]
+{{- if eq (include "rancher.chart_psp_enabled" . ) "true" }}
+  - apiGroups: [ "policy" ]
+    resources: [ "podsecuritypolicies" ]
+    verbs: [ "use"]
+{{- end }}
   - apiGroups: [ "networking.k8s.io" ]
     resources: [ "ingresses" ]
     verbs: [ "delete" ]

charts/rancher/templates/post-delete-hook-psp.yaml

@@ -0,0 +1,34 @@
+{{- if eq (include "rancher.chart_psp_enabled" . ) "true" -}}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ include "rancher.fullname" . }}-post-delete
+  labels: {{ include "rancher.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": post-delete
+    "helm.sh/hook-weight": "1"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+spec:
+  privileged: false
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 1
+        max: 65535
+  readOnlyRootFilesystem: false
+  volumes:
+    - 'secret'
+    - 'configMap'
+{{- end }}

charts/rancher/values.yaml

@@ -6,11 +6,11 @@ additionalTrustedCAs: false
 antiAffinity: preferred
 topologyKey: kubernetes.io/hostname
 
-# Audit Logs
-# Source: https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log
+# Audit Logs https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
 # The audit log is piped to the console of the rancher-audit-log container in the rancher pod.
-# level: Verbosity of logs, 0 to 3. 0 is off, 3 most verbose.
-# Docs: https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels
+# https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
+# destination stream to sidecar container console or hostPath volume
+# level: Verbosity of logs, 0 to 3. 0 is off 3 is a lot.
 auditLog:
   destination: sidecar
   hostPath: /var/log/rancher/audit/
@@ -23,7 +23,7 @@ auditLog:
   # Important: update pkg/image/export/resolve.go when this default image is changed, so that it's reflected accordingly in rancher-images.txt generated for air-gapped setups.
   image:
     repository: "rancher/mirrored-bci-micro"
-    tag: 15.6.24.2
+    tag: 15.4.14.3
     # Override imagePullPolicy image
     # options: Always, Never, IfNotPresent
     pullPolicy: "IfNotPresent"
@@ -37,11 +37,6 @@ debug: false
 # When starting Rancher for the first time, bootstrap the admin as restricted-admin
 restrictedAdmin: false
 
-# Control how the Rancher agents validate TLS connections
-# Valid options: strict, or system-store
-# Note, for new installations empty will default to strict on 2.9+, or system-store on 2.8 or older
-agentTLSMode: ""
-
 # Extra environment variables passed to the rancher pods.
 # extraEnv:
 # - name: CATTLE_TLS_MIN_VERSION
@@ -65,9 +60,6 @@ ingress:
   includeDefaultExtraAnnotations: true
   extraAnnotations: {}
   ingressClassName: ""
-  # Certain ingress controllers will require the pathType or path to be set to a different value.
-  pathType: ImplementationSpecific
-  path: "/"
   # backend port number
   servicePort: 80
 
@@ -163,7 +155,7 @@ postDelete:
   enabled: true
   image:
     repository: rancher/shell
-    tag: v0.2.2
+    tag: v0.1.25
   namespaceList:
     - cattle-fleet-system
     - cattle-system
@@ -176,19 +168,19 @@ postDelete:
 # Set a bootstrap password. If leave empty, a random password will be generated.
 bootstrapPassword: ""
 
-startupProbe:
-  ## should be ready within 2 minutes
-  timeoutSeconds: 5
-  periodSeconds: 10
-  failureThreshold: 12
 livenessProbe:
-  timeoutSeconds: 5
+  initialDelaySeconds: 60
   periodSeconds: 30
-  failureThreshold: 5
 readinessProbe:
-  timeoutSeconds: 5
+  initialDelaySeconds: 5
   periodSeconds: 30
-  failureThreshold: 5
+
+global:
+  cattle:
+    psp:
+      # will default to true on 1.24 and below, and false for 1.25 and above
+      # can be changed manually to true or false to bypass version checks and force that option
+      enabled: ""
 
 # helm values to use when installing the rancher-webhook chart.
 # helm values set here will override all other global values used when installing the webhook such as priorityClassName and systemRegistry settings.