CHANGELOG.md

@@ -2,6 +2,18 @@
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.4-bb.4]
+### Added
+- Added configuration for setting the `kubectl` image
+
+## [3.0.4-bb.3]
+### Updated
+- Added mTLS exception for GRPC communication
+
+## [3.0.4-bb.2]
+### Updated
+- Update loki-simple-scalable PeerAuthentication template to use matchLabels
+
 ## [3.0.4-bb.1]
 ### Added
 - Added cypress and script testing to the chart

README.md

 # loki
 
-![Version: 3.0.4-bb.1](https://img.shields.io/badge/Version-3.0.4--bb.1-informational?style=flat-square) ![AppVersion: v2.5.0](https://img.shields.io/badge/AppVersion-v2.5.0-informational?style=flat-square)
+![Version: 3.0.4-bb.4](https://img.shields.io/badge/Version-3.0.4--bb.4-informational?style=flat-square) ![AppVersion: v2.5.0](https://img.shields.io/badge/AppVersion-v2.5.0-informational?style=flat-square)
 
 BigBang amalgamation of Grafana upstream charts to provide several ways of deploying Loki; like Prometheus, but for logs.
 
@@ -132,7 +132,7 @@ helm install loki chart/
 | gel.externalLicenseName | string | `"enterprise-logs-license"` |  |
 | gel.externalLicenseVersion | string | `"0"` |  |
 | gel.license | object | `{"cluster_name":null,"contents":"NOTAVALIDLICENSE"}` | Grafana Enterprise Logs license In order to use Grafana Enterprise Logs features, you will need to provide the contents of your Grafana Enterprise Logs license, either by providing the contents of the license.jwt, or the name Kubernetes Secret that contains your license.jwt. To set the license contents, use the flag `--set-file 'license.contents=./license.jwt'` |
-| gel.tokengen | object | `{"annotations":{},"enable":true,"env":[],"extraArgs":{},"extraVolumeMounts":[],"extraVolumes":[],"labels":{},"priorityClassName":null,"securityContext":{"fsGroup":10001,"runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001}}` | Configuration for `tokengen` target |
+| gel.tokengen | object | `{"annotations":{},"enable":true,"env":[],"extraArgs":{},"extraVolumeMounts":[],"extraVolumes":[],"image":{"registry":"registry1.dso.mil","repository":"ironbank/opensource/kubernetes/kubectl","tag":"v1.22.2"},"labels":{},"priorityClassName":null,"securityContext":{"fsGroup":10001,"runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001}}` | Configuration for `tokengen` target |
 | gel.tokengen.enable | bool | `true` | Whether the job should be part of the deployment |
 | gel.tokengen.extraArgs | object | `{}` | Additional CLI arguments for the `tokengen` target |
 | gel.tokengen.env | list | `[]` | Additional Kubernetes environment |
@@ -141,6 +141,9 @@ helm install loki chart/
 | gel.tokengen.extraVolumes | list | `[]` | Additional volumes for Pods |
 | gel.tokengen.extraVolumeMounts | list | `[]` | Additional volume mounts for Pods |
 | gel.tokengen.securityContext | object | `{"fsGroup":10001,"runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001}` | Run containers as user `enterprise-logs(uid=10001)` |
+| gel.tokengen.image.registry | string | `"registry1.dso.mil"` | Registry for kubectl image |
+| gel.tokengen.image.repository | string | `"ironbank/opensource/kubernetes/kubectl"` | Repository for kubectl image |
+| gel.tokengen.image.tag | string | `"v1.22.2"` | Tag for kubectl image |
 | gel.adminApi | object | `{"affinity":{},"annotations":{},"env":[],"extraArgs":{},"extraContainers":[],"extraVolumeMounts":[],"extraVolumes":[],"initContainers":[],"labels":{},"livenessProbe":{"httpGet":{"path":"/ready","port":"http-metrics"},"initialDelaySeconds":45},"nodeSelector":{},"persistence":{"subPath":null},"readinessProbe":{"httpGet":{"path":"/ready","port":"http-metrics"},"initialDelaySeconds":45},"replicas":1,"resources":{},"securityContext":{"runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001},"service":{"annotations":{},"labels":{}},"strategy":{"type":"RollingUpdate"},"terminationGracePeriodSeconds":60,"tolerations":[]}` | Configuration for the `admin-api` target |
 | gel.adminApi.replicas | int | `1` | Define the amount of instances |
 | gel.adminApi.extraArgs | object | `{}` | Additional CLI arguments for the `admin-api` target |
@@ -148,7 +151,7 @@ helm install loki chart/
 | gel.adminApi.annotations | object | `{}` | Additional annotations for the `admin-api` Deployment |
 | gel.adminApi.service | object | `{"annotations":{},"labels":{}}` | Additional labels and annotations for the `admin-api` Service |
 | gel.adminApi.securityContext | object | `{"runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001}` | Run container as user `enterprise-logs(uid=10001)` `fsGroup` must not be specified, because these security options are applied on container level not on Pod level. |
-| gel.adminApi.resources | object | `{}` | Request and limit Kubernetes resources -- Values are defined in small.yaml and large.yaml |
+| gel.adminApi.resources | object | `{}` | Request and limit Kubernetes resources Values are defined in small.yaml and large.yaml |
 | gel.adminApi.extraVolumes | list | `[]` | Additional volumes for Pods |
 | gel.adminApi.extraVolumeMounts | list | `[]` | Additional volume mounts for Pods |
 | gel.adminApi.affinity | object | `{}` | Affinity for admin-api Pods |
@@ -162,7 +165,7 @@ helm install loki chart/
 | gel.gateway.annotations | object | `{}` | Additional annotations for the `gateway` Pod |
 | gel.gateway.service | object | `{"annotations":{},"labels":{}}` | Additional labels and annotations for the `gateway` Service |
 | gel.gateway.securityContext | object | `{"fsGroup":10001,"runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001}` | Run container as user `enterprise-logs(uid=10001)` |
-| gel.gateway.resources | object | `{}` | Request and limit Kubernetes resources -- Values are defined in small.yaml and large.yaml |
+| gel.gateway.resources | object | `{}` | Request and limit Kubernetes resources Values are defined in small.yaml and large.yaml |
 | gel.gateway.extraVolumes | list | `[]` | Additional volumes for Pods |
 | gel.gateway.extraVolumeMounts | list | `[]` | Additional volume mounts for Pods |
 | gel.gateway.affinity | object | `{}` | Affinity for gateway Pods |
@@ -176,7 +179,7 @@ helm install loki chart/
 | gel.compactor.annotations | object | `{}` | Additional annotations for the `compactor` Pod |
 | gel.compactor.service | object | `{"annotations":{},"labels":{}}` | Additional labels and annotations for the `compactor` Service |
 | gel.compactor.securityContext | object | `{"fsGroup":10001,"runAsGroup":10001,"runAsNonRoot":true,"runAsUser":10001}` | Run containers as user `enterprise-logs(uid=10001)` |
-| gel.compactor.resources | object | `{}` | Request and limit Kubernetes resources -- Values are defined in small.yaml and large.yaml |
+| gel.compactor.resources | object | `{}` | Request and limit Kubernetes resources Values are defined in small.yaml and large.yaml |
 | gel.compactor.extraVolumes | list | `[]` | Additional volumes for Pods |
 | gel.compactor.extraVolumeMounts | list | `[]` | Additional volume mounts for Pods |
 | gel.compactor.affinity | object | `{"podAntiAffinity":{"preferredDuringSchedulingIgnoredDuringExecution":[{"podAffinityTerm":{"labelSelector":{"matchExpressions":[{"key":"target","operator":"In","values":["compactor"]}]},"topologyKey":"kubernetes.io/hostname"},"weight":100}]}}` | Affinity for compactor Pods |
@@ -188,7 +191,8 @@ helm install loki chart/
 | bbtests.cypress.envs.cypress_check_datasource | string | `"false"` |  |
 | bbtests.cypress.envs.cypress_grafana_url | string | `"http://monitoring-grafana.monitoring.svc.cluster.local"` |  |
 | bbtests.scripts.image | string | `"registry1.dso.mil/ironbank/big-bang/base:1.17.0"` |  |
-| bbtests.scripts.envs.LOKI_URL | string | `"http://{{ template \"tempo.fullname\" . }}.{{ .Release.Namespace }}.svc:3100"` |  |
+| bbtests.scripts.envs.LOKI_URL | string | `"http://{{ template \"loki.fullname\" . }}.{{ .Release.Namespace }}.svc:3100"` |  |
+| bbtests.scripts.envs.LOKI_VERSION | string | `"{{ .Values.loki.image.tag }}"` |  |
 
 ## Contributing
 

chart/Chart.yaml

 apiVersion: v2
 name: loki
-version: 3.0.4-bb.1
+version: 3.0.4-bb.4
 appVersion: v2.5.0
 kubeVersion: "^1.10.0-0"
 description: "BigBang amalgamation of Grafana upstream charts to provide several ways of deploying Loki; like Prometheus, but for logs."

chart/templates/bigbang/peerauthentication/loki-simple-scalable.yaml

@@ -9,11 +9,14 @@ spec:
     mode: {{ .Values.istio.mtls.mode }}
   selector:
     matchLabels:
-      {{- include "loki.selectorLabels" . | nindent 6 }}
-  {{- if and (eq .Values.istio.mtls.mode "STRICT") (.Capabilities.APIVersions.Has "monitoring.coreos.com/v1") (index .Values "loki-simple-scalable").serviceMonitor.enabled }}
-  # Monitoring exception
+      {{- include "loki.matchLabels" . | nindent 6 }}
   portLevelMtls:
+    # Monitoring exception
+    {{- if and (eq .Values.istio.mtls.mode "STRICT") (.Capabilities.APIVersions.Has "monitoring.coreos.com/v1") (index .Values "loki-simple-scalable").serviceMonitor.enabled }}
     "3100":
       mode: PERMISSIVE
-  {{- end }}
+    {{- end }}
+    # GRPC exception to support Loki internal communication
+    "9095":
+      mode: PERMISSIVE
 {{- end }}

chart/templates/enterprise/tokengen/job-tokengen.yaml

@@ -68,7 +68,7 @@ spec:
             {{- end }}
       containers:
         - name: create-secret
-          image: registry1.dso.mil/ironbank/opensource/kubernetes/kubectl:v1.22.2
+          image: {{ printf "%s/%s:%s" .Values.gel.tokengen.image.registry .Values.gel.tokengen.image.repository .Values.gel.tokengen.image.tag }}
           imagePullPolicy: {{ .Values.gel.image.pullPolicy }}
           command:
             - /bin/bash

chart/values.yaml

@@ -359,6 +359,14 @@ gel:
 
     priorityClassName: null
 
+    image:
+      # -- Registry for kubectl image
+      registry: registry1.dso.mil
+      # -- Repository for kubectl image
+      repository: ironbank/opensource/kubernetes/kubectl
+      # -- Tag for kubectl image
+      tag: v1.22.2
+
   # -- Configuration for the `admin-api` target
   adminApi:
     # -- Define the amount of instances
@@ -402,7 +410,7 @@ gel:
       initialDelaySeconds: 45
 
     # -- Request and limit Kubernetes resources
-    # -- Values are defined in small.yaml and large.yaml
+    # Values are defined in small.yaml and large.yaml
     resources: {}
 
     initContainers: []
@@ -462,7 +470,7 @@ gel:
       initialDelaySeconds: 45
 
     # -- Request and limit Kubernetes resources
-    # -- Values are defined in small.yaml and large.yaml
+    # Values are defined in small.yaml and large.yaml
     resources: {}
 
     env: []
@@ -513,7 +521,7 @@ gel:
       type: RollingUpdate
 
     # -- Request and limit Kubernetes resources
-    # -- Values are defined in small.yaml and large.yaml
+    # Values are defined in small.yaml and large.yaml
     resources: {}
 
     persistentVolume: