BREAKING CHANGE refactor: port all enterprise apps to new common and add apps (#7738)

* use new common

* more porting and add notes.txt

* portals

* add vaultwarden and authelia to enterprise

* some changes

* authelia porting

* fix grafana

* fixup metallb

* more

* traefik

* some initial blocky work

* fixes

* more work on enterprise train

* containers

* labels

* no message

* some more fixes

* update questions for new enterprise apps

* something

* remove postgresql dependency from enterprise train apps

* fix some traefik bugs

* remove prometheus affinities for now

* authelia postgresql fixes

* bump and fix install test errors

* bump common for probe fixes

* fix questions

* more questions fixes

* add some metrics improvements

* some more fixes

* whoops

* some authelia fixes

* fix blocky and authelia

* bump common for postgresql fixes

* hmm

* bump common

* bump redis to disable double manifest loading

* dont enc secrets for authelia

* traefik, blocky and authelia fixes

* traefik caps on protocols

* bump redis for password fixes

* ensure roles are clusterwide

* ok

* redis/common bumps

* remove blocky webui and change config location

* whoops

* redis fix

* more blocky tryouts

* authelia whoops

* bump blocky version

* disable prometheus controller

* oops

* bump common on prometheus for custom service selector labels

* rename prometheus selector labels on service

* damn

* more work

* blocky 100 tryout

* blocky root tryout

* fix blocky config and remove fsgroup

* dont drop caps

* Update common.yaml

Signed-off-by: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>

* Update values.yaml

Signed-off-by: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>

* Update values.yaml

Signed-off-by: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>

* revert update for blocky

* use old-style mount for blocky

* put update back for blocky

* add initial postgresl query log support

* hmm

* small lint

* bump common

---------

Signed-off-by: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
Co-authored-by: Stavros kois <s.kois@outlook.com>
Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com>

charts/dev/testapp/questions.yaml

@@ -4,7 +4,8 @@ portals:
 # Include{portalLink}
 questions:
 # Include{global}
-# Include{workload}\n# Include{workloadDeployment}
+# Include{workload}
+# Include{workloadDeployment}
 # Include{replicas1}
 # Include{podSpec}
 # Include{containerMain}

charts/enterprise/authelia/.helmignore

@@ -0,0 +1,30 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# OWNERS file for Kubernetes
+OWNERS
+# helm-docs templates
+*.gotmpl
+# docs folder
+/docs
+# icon
+icon.png

charts/enterprise/authelia/Chart.yaml

@@ -0,0 +1,44 @@
+apiVersion: v2
+appVersion: "4.37.5"
+dependencies:
+  - name: common
+    repository: https://library-charts.truecharts.org
+    version: 12.2.9
+  - condition: redis.enabled
+    name: redis
+    repository: https://deps.truecharts.org
+    version: 6.0.4
+deprecated: false
+description: Authelia is a Single Sign-On Multi-Factor portal for web apps
+home: https://truecharts.org/charts/stable/authelia
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/authelia.png
+keywords:
+  - authelia
+  - authentication
+  - login
+  - SSO
+  - Authentication
+  - Security
+  - Two-Factor
+  - U2F
+  - YubiKey
+  - Push Notifications
+  - LDAP
+kubeVersion: ">=1.16.0-0"
+maintainers:
+  - email: info@truecharts.org
+    name: TrueCharts
+    url: https://truecharts.org
+name: authelia
+sources:
+  - https://github.com/truecharts/charts/tree/master/charts/stable/authelia
+  - https://ghcr.io/authelia/authelia
+  - https://github.com/authelia/chartrepo
+  - https://github.com/authelia/authelia
+type: application
+version: 15.0.0
+annotations:
+  truecharts.org/catagories: |
+    - security
+  truecharts.org/SCALE-support: "true"
+  truecharts.org/grade: U

charts/enterprise/authelia/LICENSE

@@ -0,0 +1,106 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             The TrueCharts Project, it's owner and it's contributors
+Licensed Work:        The TrueCharts "Cert-Manager" Helm Chart
+Additional Use Grant: You may use the licensed work in production, as long
+                      as it is directly sourced from a TrueCharts provided
+                      official repository, catalog or source. You may also make private
+                      modification to the directly sourced licenced work,
+                      when used in production.
+
+                      The following cases are, due to their nature, also
+                      defined as 'production use' and explicitly prohibited:
+                      - Bundling, including or displaying the licensed work
+                      with(in) another work intended for production use,
+                      with the apparent intend of facilitating and/or
+                      promoting production use by third parties in
+                      violation of this license.
+
+Change Date:          2050-01-01
+
+Change License:       3-clause BSD license
+
+For information about alternative licensing arrangements for the Software,
+please contact: legal@truecharts.org
+
+Notice
+
+The Business Source License (this document, or the “License”) is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
+“Business Source License” is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

charts/enterprise/authelia/README.md

@@ -0,0 +1,27 @@
+# README
+
+## General Info
+
+TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
+However only installations using the TrueNAS SCALE Apps system are supported.
+
+For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/)
+
+**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
+
+
+## Support
+
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- See the [Website](https://truecharts.org)
+- Check our [Discord](https://discord.gg/tVsPTHWTtr)
+- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
+
+---
+
+## Sponsor TrueCharts
+
+TrueCharts can only exist due to the incredible effort of our staff.
+Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
+
+*All Rights Reserved - The TrueCharts Project*

charts/enterprise/authelia/templates/NOTES.txt

@@ -0,0 +1 @@
+{{- include "tc.v1.common.lib.chart.notes" $ -}}

charts/enterprise/authelia/templates/_configmap.tpl

@@ -0,0 +1,245 @@
+{{/* Define the configmap */}}
+{{- define "authelia.configmap.paths" -}}
+enabled: true
+data:
+  AUTHELIA_SERVER_DISABLE_HEALTHCHECK: "true"
+  AUTHELIA_JWT_SECRET_FILE: "/secrets/JWT_TOKEN"
+  AUTHELIA_SESSION_SECRET_FILE: "/secrets/SESSION_ENCRYPTION_KEY"
+  AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE: "/secrets/ENCRYPTION_KEY"
+  AUTHELIA_STORAGE_POSTGRES_PASSWORD_FILE: "/secrets/STORAGE_PASSWORD"
+  {{- if .Values.authentication_backend.ldap.enabled }}
+  AUTHELIA_AUTHENTICATION_BACKEND_LDAP_PASSWORD_FILE: "/secrets/LDAP_PASSWORD"
+  {{- end }}
+  {{- if .Values.notifier.smtp.enabled }}
+  AUTHELIA_NOTIFIER_SMTP_PASSWORD_FILE: "/secrets/SMTP_PASSWORD"
+  {{- end }}
+  AUTHELIA_SESSION_REDIS_PASSWORD_FILE: "/secrets/REDIS_PASSWORD"
+  {{- if .Values.redisProvider.high_availability.enabled }}
+  AUTHELIA_SESSION_REDIS_HIGH_AVAILABILITY_SENTINEL_PASSWORD_FILE: "/secrets/REDIS_SENTINEL_PASSWORD"
+  {{- end }}
+  {{- if .Values.duo_api.enabled }}
+  AUTHELIA_DUO_API_SECRET_KEY_FILE: "/secrets/DUO_API_KEY"
+  {{- end }}
+  {{- if .Values.identity_providers.oidc.enabled }}
+  AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE: "/secrets/OIDC_HMAC_SECRET"
+  AUTHELIA_IDENTITY_PROVIDERS_OIDC_ISSUER_PRIVATE_KEY_FILE: "/secrets/OIDC_PRIVATE_KEY"
+  {{- end }}
+
+{{- end -}}
+
+{{- define "authelia.configmap.configfile" -}}
+enabled: true
+data:
+  configuration.yaml: |
+    ---
+    theme: {{ default "light" .Values.theme }}
+    default_redirection_url: {{ default (printf "https://www.%s" .Values.domain) .Values.default_redirection_url }}
+    server:
+      host: 0.0.0.0
+      port: {{ default 9091 .Values.server.port }}
+      {{- if not (eq "" (default "" .Values.server.path)) }}
+      path: {{ .Values.server.path }}
+      {{- end }}
+      read_buffer_size: {{ default 4096 .Values.server.read_buffer_size }}
+      write_buffer_size: {{ default 4096 .Values.server.write_buffer_size }}
+      enable_pprof: {{ default false .Values.server.enable_pprof }}
+      enable_expvars: {{ default false .Values.server.enable_expvars }}
+    log:
+      level: {{ default "info" .Values.log.level }}
+      format: {{ default "text" .Values.log.format }}
+      {{- if not (eq "" (default "" .Values.log.file_path)) }}
+      file_path: {{ .Values.log.file_path }}
+      keep_stdout: true
+      {{- end }}
+    totp:
+      issuer: {{ default .Values.domain .Values.totp.issuer }}
+      period: {{ default 30 .Values.totp.period }}
+      skew: {{ default 1 .Values.totp.skew }}
+    {{- if .Values.duo_api.enabled }}
+    duo_api:
+      hostname: {{ .Values.duo_api.hostname }}
+      integration_key: {{ .Values.duo_api.integration_key }}
+    {{- end }}
+    {{- with $auth := .Values.authentication_backend }}
+    authentication_backend:
+      disable_reset_password: {{ $auth.disable_reset_password }}
+    {{- if $auth.file.enabled }}
+      file:
+        path: {{ $auth.file.path }}
+        password: {{ toYaml $auth.file.password | nindent 10 }}
+    {{- end }}
+    {{- if $auth.ldap.enabled }}
+      ldap:
+        implementation: {{ default "custom" $auth.ldap.implementation }}
+        url: {{ $auth.ldap.url }}
+        timeout: {{ default "5s" $auth.ldap.timeout }}
+        start_tls: {{ $auth.ldap.start_tls }}
+        tls:
+          {{- if hasKey $auth.ldap.tls "server_name" }}
+          server_name: {{ default $auth.ldap.host $auth.ldap.tls.server_name }}
+          {{- end }}
+          minimum_version: {{ default "TLS1.2" $auth.ldap.tls.minimum_version }}
+          skip_verify: {{ default false $auth.ldap.tls.skip_verify }}
+    {{- if $auth.ldap.base_dn }}
+        base_dn: {{ $auth.ldap.base_dn }}
+    {{- end }}
+    {{- if $auth.ldap.username_attribute }}
+        username_attribute: {{ $auth.ldap.username_attribute }}
+    {{- end }}
+    {{- if $auth.ldap.additional_users_dn }}
+        additional_users_dn: {{ $auth.ldap.additional_users_dn }}
+    {{- end }}
+    {{- if $auth.ldap.users_filter }}
+        users_filter: {{ $auth.ldap.users_filter }}
+    {{- end }}
+    {{- if $auth.ldap.additional_groups_dn }}
+        additional_groups_dn: {{ $auth.ldap.additional_groups_dn }}
+    {{- end }}
+    {{- if $auth.ldap.groups_filter }}
+        groups_filter: {{ $auth.ldap.groups_filter }}
+    {{- end }}
+    {{- if $auth.ldap.group_name_attribute }}
+        group_name_attribute: {{ $auth.ldap.group_name_attribute }}
+    {{- end }}
+    {{- if $auth.ldap.mail_attribute }}
+        mail_attribute: {{ $auth.ldap.mail_attribute }}
+    {{- end }}
+    {{- if $auth.ldap.display_name_attribute }}
+        display_name_attribute: {{ $auth.ldap.display_name_attribute }}
+    {{- end }}
+        user: {{ $auth.ldap.user }}
+    {{- end }}
+    {{- end }}
+    {{- with $session := .Values.session }}
+    session:
+      name: {{ default "authelia_session" $session.name }}
+      domain: {{ required "A valid .Values.domain entry required!" $.Values.domain }}
+      same_site: {{ default "lax" $session.same_site }}
+      expiration: {{ default "1M" $session.expiration }}
+      inactivity: {{ default "5m" $session.inactivity }}
+      remember_me_duration: {{ default "1M" $session.remember_me_duration }}
+    {{- end }}
+      redis:
+        host: {{ .Values.redis.url.plain }}
+      {{- with $redis := .Values.redisProvider }}
+        port: {{ default 6379 $redis.port }}
+        {{- if not (eq $redis.username "") }}
+        username: {{ $redis.username }}
+        {{- end }}
+        maximum_active_connections: {{ default 8 $redis.maximum_active_connections }}
+        minimum_idle_connections: {{ default 0 $redis.minimum_idle_connections }}
+    {{- if $redis.tls.enabled }}
+        tls:
+          server_name: {{ $redis.tls.server_name }}
+          minimum_version: {{ default "TLS1.2" $redis.tls.minimum_version }}
+          skip_verify: {{ $redis.tls.skip_verify }}
+    {{- end }}
+    {{- if $redis.high_availability.enabled }}
+        high_availability:
+          sentinel_name: {{ $redis.high_availability.sentinel_name }}
+    {{- if $redis.high_availability.nodes }}
+          nodes: {{ toYaml $redis.high_availability.nodes | nindent 10 }}
+    {{- end }}
+          route_by_latency: {{ $redis.high_availability.route_by_latency }}
+          route_randomly: {{ $redis.high_availability.route_randomly }}
+      {{- end }}
+    {{- end }}
+    regulation: {{ toYaml .Values.regulation | nindent 6 }}
+    storage:
+      postgres:
+        host: {{ $.Values.cnpg.main.creds.host }}
+    {{- with $storage := .Values.storage }}
+        port: {{ default 5432 $storage.postgres.port }}
+        database: {{ default "authelia" $storage.postgres.database }}
+        username: {{ default "authelia" $storage.postgres.username }}
+        timeout: {{ default "5s" $storage.postgres.timeout }}
+        sslmode: {{ default "disable" $storage.postgres.sslmode }}
+    {{- end }}
+    {{- with $notifier := .Values.notifier }}
+    notifier:
+      disable_startup_check: {{ $.Values.notifier.disable_startup_check }}
+    {{- if $notifier.filesystem.enabled }}
+      filesystem:
+        filename: {{ $notifier.filesystem.filename }}
+    {{- end }}
+    {{- if $notifier.smtp.enabled }}
+      smtp:
+        host: {{ $notifier.smtp.host }}
+        port: {{ default 25 $notifier.smtp.port }}
+        timeout: {{ default "5s" $notifier.smtp.timeout }}
+        {{- with $notifier.smtp.username }}
+        username: {{ . }}
+        {{- end }}
+        sender: {{ $notifier.smtp.sender }}
+        identifier: {{ $notifier.smtp.identifier }}
+        subject: {{ $notifier.smtp.subject | quote }}
+        startup_check_address: {{ $notifier.smtp.startup_check_address }}
+        disable_require_tls: {{ $notifier.smtp.disable_require_tls }}
+        disable_html_emails: {{ $notifier.smtp.disable_html_emails }}
+        tls:
+          server_name: {{ default $notifier.smtp.host $notifier.smtp.tls.server_name }}
+          minimum_version: {{ default "TLS1.2" $notifier.smtp.tls.minimum_version }}
+          skip_verify: {{ default false $notifier.smtp.tls.skip_verify }}
+    {{- end }}
+    {{- end }}
+    {{- if .Values.identity_providers.oidc.enabled }}
+    identity_providers:
+      oidc:
+        access_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.access_token_lifespan }}
+        authorize_code_lifespan: {{ default "1m" .Values.identity_providers.oidc.authorize_code_lifespan }}
+        id_token_lifespan: {{ default "1h" .Values.identity_providers.oidc.id_token_lifespan }}
+        refresh_token_lifespan: {{ default "90m" .Values.identity_providers.oidc.refresh_token_lifespan }}
+        enable_client_debug_messages: {{ default false .Values.identity_providers.oidc.enable_client_debug_messages }}
+        minimum_parameter_entropy: {{ default 8 .Values.identity_providers.oidc.minimum_parameter_entropy }}
+        {{- if gt (len .Values.identity_providers.oidc.clients) 0 }}
+        clients:
+    {{- range $client := .Values.identity_providers.oidc.clients }}
+        - id: {{ $client.id }}
+          description: {{ default $client.id $client.description }}
+          secret: {{ default (randAlphaNum 128) $client.secret }}
+          {{- if $client.public }}
+          public: {{ $client.public }}
+          {{- end }}
+          authorization_policy: {{ default "two_factor" $client.authorization_policy }}
+          consent_mode: {{ default "auto" $client.consent_mode}}
+          redirect_uris:
+          {{- range $client.redirect_uris }}
+          - {{ . }}
+          {{- end }}
+          {{- if $client.audience }}
+          audience: {{ toYaml $client.audience | nindent 10 }}
+          {{- end }}
+          scopes: {{ toYaml (default (list "openid" "profile" "email" "groups") $client.scopes) | nindent 10 }}
+          grant_types: {{ toYaml (default (list "refresh_token" "authorization_code") $client.grant_types) | nindent 10 }}
+          response_types: {{ toYaml (default (list "code") $client.response_types) | nindent 10 }}
+          {{- if $client.response_modes }}
+          response_modes: {{ toYaml $client.response_modes | nindent 10 }}
+          {{- end }}
+          userinfo_signing_algorithm: {{ default "none" $client.userinfo_signing_algorithm }}
+    {{- end }}
+    {{- end }}
+    {{- end }}
+    access_control:
+    {{- if (eq (len .Values.access_control.rules) 0) }}
+      {{- if (eq .Values.access_control.default_policy "bypass") }}
+      default_policy: one_factor
+      {{- else if (eq .Values.access_control.default_policy "deny") }}
+      default_policy: two_factor
+      {{- else }}
+      default_policy: {{ .Values.access_control.default_policy }}
+      {{- end }}
+    {{- else }}
+      default_policy: {{ .Values.access_control.default_policy }}
+    {{- end }}
+    {{- if (eq (len .Values.access_control.networks) 0) }}
+      networks: []
+    {{- else }}
+      networks: {{ toYaml .Values.access_control.networks | nindent 6 }}
+    {{- end }}
+    {{- if (eq (len .Values.access_control.rules) 0) }}
+      rules: []
+    {{- else }}
+      rules: {{ toYaml .Values.access_control.rules | nindent 6 }}
+    {{- end }}
+    ...
+{{- end -}}

charts/enterprise/authelia/templates/_secrets.tpl

@@ -0,0 +1,59 @@
+{{/* Define the secrets */}}
+{{- define "authelia.secrets" -}}
+{{- $autheliaprevious := lookup "v1" "Secret" .Release.Namespace "authelia-secrets" }}
+{{- $oidckey := "" }}
+{{- $oidcsecret := "" }}
+{{- $jwtsecret := "" }}
+{{- $sessionsecret := "" }}
+{{- $encryptionkey := "" }}
+enabled: true
+data:
+  {{- if $autheliaprevious }}
+  SESSION_ENCRYPTION_KEY: {{ index $autheliaprevious.data "SESSION_ENCRYPTION_KEY"  }}
+  JWT_TOKEN: {{ index $autheliaprevious.data "JWT_TOKEN"  }}
+  {{- if ( hasKey $autheliaprevious.data "ENCRYPTION_KEY" ) }}
+  ENCRYPTION_KEY: {{ index $autheliaprevious.data "ENCRYPTION_KEY"  }}
+  {{- else }}
+  {{- $encryptionkey := randAlphaNum 100 }}
+  ENCRYPTION_KEY: {{ $encryptionkey }}
+  {{- end }}
+  {{- else }}
+  {{- $jwtsecret := randAlphaNum 50 }}
+  {{- $sessionsecret := randAlphaNum 50 }}
+  {{- $encryptionkey := randAlphaNum 100 }}
+  SESSION_ENCRYPTION_KEY: {{ $sessionsecret }}
+  JWT_TOKEN: {{ $jwtsecret}}
+  ENCRYPTION_KEY: {{ $encryptionkey }}
+  {{- end }}
+
+  {{- if .Values.authentication_backend.ldap.enabled }}
+  LDAP_PASSWORD: {{ .Values.authentication_backend.ldap.plain_password }}
+  {{- end }}
+
+  {{- if and .Values.notifier.smtp.enabled .Values.notifier.smtp.plain_password }}
+  SMTP_PASSWORD: {{ .Values.notifier.smtp.plain_password }}
+  {{- end }}
+
+  {{- if .Values.duo_api.enabled }}
+  DUO_API_KEY: {{ .Values.duo_api.plain_api_key }}
+  {{- end }}
+
+  STORAGE_PASSWORD: {{ $.Values.cnpg.main.creds.password | trimAll "\"" }}
+
+  REDIS_PASSWORD: {{ .Values.redis.redisPassword | trimAll "\"" }}
+  {{- if .Values.redisProvider.high_availability.enabled}}
+  REDIS_SENTINEL_PASSWORD: {{ .Values.redis.sentinelPassword | trimAll "\"" }}
+  {{- end }}
+
+  {{- if $autheliaprevious }}
+  {{- if and ( hasKey $autheliaprevious.data "OIDC_PRIVATE_KEY" ) ( hasKey $autheliaprevious.data "OIDC_HMAC_SECRET" ) }}
+  OIDC_PRIVATE_KEY: {{ index $autheliaprevious.data "OIDC_PRIVATE_KEY"  }}
+  OIDC_HMAC_SECRET: {{ index $autheliaprevious.data "OIDC_HMAC_SECRET" }}
+  {{- else }}
+  {{- $oidckey := genPrivateKey "rsa"   }}
+  {{- $oidcsecret := randAlphaNum 32 }}
+  OIDC_PRIVATE_KEY: {{ $oidckey }}
+  OIDC_HMAC_SECRET: {{ $oidcsecret }}
+  {{- end }}
+  {{- end }}
+{{- end -}}

charts/enterprise/authelia/templates/common.yaml

@@ -0,0 +1,77 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.v1.common.loader.init" . }}
+
+{{/* Render configmap for authelia */}}
+{{- $configmapPaths := include "authelia.configmap.paths" . | fromYaml -}}
+{{- if $configmapPaths -}}
+  {{- $_ := set .Values.configmap "authelia-paths" $configmapPaths -}}
+{{- end -}}
+
+{{- $configmapFile := include "authelia.configmap.configfile" . | fromYaml -}}
+{{- if $configmapFile -}}
+  {{- $_ := set .Values.configmap "authelia-configfile" $configmapFile -}}
+{{- end -}}
+
+{{/* Render secrets for authelia */}}
+{{- $secret := include "authelia.secrets" . | fromYaml -}}
+{{- if $secret -}}
+  {{- $_ := set .Values.secret "authelia-secrets" $secret -}}
+{{- end -}}
+
+{{/* Append the general configMap volume to the volumes */}}
+{{- define "authelia.configmapVolume" -}}
+enabled: true
+mountPath: /configuration.yaml
+subPath: configuration.yaml
+readOnly: true
+type: "configmap"
+objectName: authelia-configfile
+{{- end -}}
+
+{{/* Append the general secret volumes to the volumes */}}
+{{- define "authelia.secretVolumes" -}}
+enabled: true
+mountPath: "/secrets"
+readOnly: true
+type: "secret"
+objectName: authelia-secrets
+items:
+  - key: "JWT_TOKEN"
+    path: JWT_TOKEN
+  - key: "SESSION_ENCRYPTION_KEY"
+    path: SESSION_ENCRYPTION_KEY
+  - key: "ENCRYPTION_KEY"
+    path: ENCRYPTION_KEY
+  - key: "STORAGE_PASSWORD"
+    path: STORAGE_PASSWORD
+    {{- if .Values.authentication_backend.ldap.enabled }}
+  - key: "LDAP_PASSWORD"
+    path: LDAP_PASSWORD
+    {{- end }}
+    {{- if .Values.notifier.smtp.enabled }}
+  - key: "SMTP_PASSWORD"
+    path: SMTP_PASSWORD
+    {{- end }}
+  - key: "REDIS_PASSWORD"
+    path: REDIS_PASSWORD
+    {{- if .Values.redisProvider.high_availability.enabled}}
+  - key: "REDIS_SENTINEL_PASSWORD"
+    path: REDIS_SENTINEL_PASSWORD
+    {{- end }}
+    {{- if .Values.duo_api.enabled }}
+  - key: "DUO_API_KEY"
+    path: DUO_API_KEY
+    {{- end }}
+    {{- if .Values.identity_providers.oidc.enabled }}
+  - key: "OIDC_PRIVATE_KEY"
+    path: OIDC_PRIVATE_KEY
+  - key: "OIDC_HMAC_SECRET"
+    path: OIDC_HMAC_SECRET
+    {{- end }}
+{{- end -}}
+
+{{- $_ := set .Values.persistence "authelia-configfile" (include "authelia.configmapVolume" . | fromYaml) -}}
+{{- $_ := set .Values.persistence "authelia-secrets" (include "authelia.secretVolumes" . | fromYaml) -}}
+
+{{/* Render the templates */}}
+{{ include "tc.v1.common.loader.apply" . }}

charts/enterprise/authelia/values.yaml

@@ -0,0 +1,619 @@
+image:
+  repository: tccr.io/truecharts/authelia
+  pullPolicy: IfNotPresent
+  tag: 4.37.5@sha256:76a4617539534cec140fd98a12f721b878524f2df3a3653f3df8ff2b7eaab586
+
+workload:
+  main:
+    podSpec:
+      containers:
+        main:
+          command: ["authelia"]
+          args: ["--config=/configuration.yaml"]
+          envFrom:
+            - configMapRef:
+                name: authelia-paths
+          # probes:
+          #   liveness:
+          #     type: HTTP
+          #     path: /api/health"
+
+          #   readiness:
+          #     type: HTTP
+          #     path: "/api/health"
+
+          #   startup:
+          #     type: HTTP
+          #     path: "/api/health"
+
+service:
+  main:
+    ports:
+      main:
+        port: 9091
+        targetPort: 9091
+
+persistence:
+  config:
+    enabled: true
+    mountPath: "/config"
+
+cnpg:
+  main:
+    enabled: true
+    user: authelia
+    database: authelia
+
+# Enabled redis
+# ... for more options see https://github.com/tccr.io/truecharts/charts/tree/master/tccr.io/truecharts/redis
+redis:
+  enabled: true
+
+domain: example.com
+
+##
+## Server Configuration
+##
+server:
+  ##
+  ## Port sets the configured port for the daemon, service, and the probes.
+  ## Default is 9091 and should not need to be changed.
+  ##
+  port: 9091
+
+  ## Buffers usually should be configured to be the same value.
+  ## Explanation at https://www.authelia.com/docs/configuration/server.html
+  ## Read buffer size adjusts the server's max incoming request size in bytes.
+  ## Write buffer size does the same for outgoing responses.
+  read_buffer_size: 4096
+  write_buffer_size: 4096
+  ## Set the single level path Authelia listens on.
+  ## Must be alphanumeric chars and should not contain any slashes.
+  path: ""
+
+log:
+  ## Level of verbosity for logs: info, debug, trace.
+  level: trace
+
+  ## Format the logs are written as: json, text.
+  format: text
+
+  ## TODO: Statefulness check should check if this is set, and the configMap should enable it.
+  ## File path where the logs will be written. If not set logs are written to stdout.
+  # file_path: /config/authelia.log
+
+## Default redirection URL
+##
+## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
+## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
+## in such a case.
+##
+## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
+## Default is https://www.<domain> (value at the top of the values.yaml).
+default_redirection_url: ""
+# default_redirection_url: https://example.com
+
+theme: light
+
+##
+## TOTP Configuration
+##
+## Parameters used for TOTP generation
+totp:
+  ## The issuer name displayed in the Authenticator application of your choice
+  ## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names
+  ## Defaults to <domain>.
+  issuer: ""
+  ## The period in seconds a one-time password is current for. Changing this will require all users to register
+  ## their TOTP applications again. Warning: before changing period read the docs link below.
+  period: 30
+  ## The skew controls number of one-time passwords either side of the current one that are valid.
+  ## Warning: before changing skew read the docs link below.
+  ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation.
+  skew: 1
+
+##
+## Duo Push API Configuration
+##
+## Parameters used to contact the Duo API. Those are generated when you protect an application of type
+## "Partner Auth API" in the management panel.
+duo_api:
+  enabled: false
+  hostname: api-123456789.example.com
+  integration_key: ABCDEF
+  plain_api_key: ""
+
+##
+## Authentication Backend Provider Configuration
+##
+## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
+##
+## The available providers are: `file`, `ldap`. You must use one and only one of these providers.
+authentication_backend:
+  ## Disable both the HTML element and the API for reset password functionality
+  disable_reset_password: false
+
+  ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
+  ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
+  ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
+  ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
+  ## See the below documentation for more information.
+  ## Duration Notation docs:  https://www.authelia.com/docs/configuration/index.html#duration-notation-format
+  ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval
+  refresh_interval: 5m
+
+  ## LDAP backend configuration.
+  ##
+  ## This backend allows Authelia to be scaled to more
+  ## than one instance and therefore is recommended for
+  ## production.
+  ldap:
+    ## Enable LDAP Backend.
+    enabled: false
+
+    ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
+    ## Acceptable options are as follows:
+    ## - 'activedirectory' - For Microsoft Active Directory.
+    ## - 'custom' - For custom specifications of attributes and filters.
+    ## This currently defaults to 'custom' to maintain existing behaviour.
+    ##
+    ## Depending on the option here certain other values in this section have a default value, notably all of the
+    ## attribute mappings have a default value that this config overrides, you can read more about these default values
+    ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults
+    implementation: activedirectory
+
+    ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
+    ## Scheme can be ldap or ldaps in the format (port optional).
+    url: ldap://openldap.default.svc.cluster.local
+
+    ## Connection Timeout.
+    timeout: 5s
+
+    ## Use StartTLS with the LDAP connection.
+    start_tls: false
+
+    tls:
+      ## Server Name for certificate validation (in case it's not set correctly in the URL).
+      server_name: ""
+
+      ## Skip verifying the server certificate (to allow a self-signed certificate).
+      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
+      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
+      skip_verify: false
+
+      ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
+      minimum_version: TLS1.2
+
+    ## The base dn for every LDAP query.
+    base_dn: DC=example,DC=com
+
+    ## The attribute holding the username of the user. This attribute is used to populate the username in the session
+    ## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
+    ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
+    ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
+    ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
+    ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
+    ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
+    ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
+    username_attribute: ""
+
+    ## An additional dn to define the scope to all users.
+    additional_users_dn: OU=Users
+
+    ## The users filter used in search queries to find the user profile based on input filled in login form.
+    ## Various placeholders are available in the user filter:
+    ## - {input} is a placeholder replaced by what the user inputs in the login form.
+    ## - {username_attribute} is a mandatory placeholder replaced by what is configured in `username_attribute`.
+    ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
+    ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
+    ##   versions, so please don't use it.
+    ##
+    ## Recommended settings are as follows:
+    ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
+    ## - OpenLDAP:
+    ##   - (&({username_attribute}={input})(objectClass=person))
+    ##   - (&({username_attribute}={input})(objectClass=inetOrgPerson))
+    ##
+    ## To allow sign in both with username and email, one can use a filter like
+    ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
+    users_filter: ""
+
+    ## An additional dn to define the scope of groups.
+    additional_groups_dn: OU=Groups
+
+    ## The groups filter used in search queries to find the groups of the user.
+    ## - {input} is a placeholder replaced by what the user inputs in the login form.
+    ## - {username} is a placeholder replace by the username stored in LDAP (based on `username_attribute`).
+    ## - {dn} is a matcher replaced by the user distinguished name, aka, user DN.
+    ## - {username_attribute} is a placeholder replaced by what is configured in `username_attribute`.
+    ## - {mail_attribute} is a placeholder replaced by what is configured in `mail_attribute`.
+    ## - DON'T USE - {0} is an alias for {input} supported for backward compatibility but it will be deprecated in later
+    ##   versions, so please don't use it.
+    ## - DON'T USE - {1} is an alias for {username} supported for backward compatibility but it will be deprecated in
+    ##   later version, so please don't use it.
+    ##
+    ## If your groups use the `groupOfUniqueNames` structure use this instead:
+    ##    (&(uniquemember={dn})(objectclass=groupOfUniqueNames))
+    groups_filter: ""
+
+    ## The attribute holding the name of the group
+    group_name_attribute: ""
+
+    ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
+    ## first one returned by the LDAP server is used.
+    mail_attribute: ""
+
+    ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
+    display_name_attribute: ""
+
+    ## The username of the admin user.
+    user: CN=Authelia,DC=example,DC=com
+    plain_password: ""
+
+  ##
+  ## File (Authentication Provider)
+  ##
+  ## With this backend, the users database is stored in a file which is updated when users reset their passwords.
+  ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
+  ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
+  ## implications it is highly recommended you leave the default values. Before considering changing these settings
+  ## please read the docs page below:
+  ## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning
+  ##
+  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
+  ##
+  file:
+    enabled: true
+    path: /config/users_database.yml
+    password:
+      algorithm: argon2id
+      iterations: 1
+      key_length: 32
+      salt_length: 16
+      memory: 1024
+      parallelism: 8
+
+##
+## Access Control Configuration
+##
+## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
+##
+## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
+## to anyone. Otherwise restrictions follow the rules defined.
+##
+## Note: One can use the wildcard * to match any subdomain.
+## It must stand at the beginning of the pattern. (example: *.mydomain.com)
+##
+## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
+##
+## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
+##
+## - 'domain' defines which domain or set of domains the rule applies to.
+##
+## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
+##    provided. If provided, the parameter represents either a user or a group. It should be of the form
+##    'user:<username>' or 'group:<groupname>'.
+##
+## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
+##
+## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
+##   is optional and matches any resource if not provided.
+##
+## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
+access_control:
+  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
+  ## resource if there is no policy to be applied to the user.
+  default_policy: deny
+
+  networks: []
+  # networks:
+  # - name: private
+  #   networks:
+  #   - 10.0.0.0/8
+  #   - 172.16.0.0/12
+  #   - 192.168.0.0/16
+  # - name: vpn
+  #   networks:
+  #   - 10.9.0.0/16
+
+  rules: []
+  # rules:
+  # - domain: public.example.com
+  #   policy: bypass
+  # - domain: "*.example.com"
+  #   policy: bypass
+  #   methods:
+  #   - OPTIONS
+  # - domain: secure.example.com
+  #   policy: one_factor
+  #   networks:
+  #   - private
+  #   - vpn
+  #   - 192.168.1.0/24
+  #   - 10.0.0.1
+  # - domain:
+  #   - secure.example.com
+  #   - private.example.com
+  #   policy: two_factor
+  # - domain: singlefactor.example.com
+  #   policy: one_factor
+  # - domain: "mx2.mail.example.com"
+  #   subject: "group:admins"
+  #   policy: deny
+  # - domain: "*.example.com"
+  #   subject:
+  #   - "group:admins"
+  #   - "group:moderators"
+  #   policy: two_factor
+  # - domain: dev.example.com
+  #   resources:
+  #   - "^/groups/dev/.*$"
+  #   subject: "group:dev"
+  #   policy: two_factor
+  # - domain: dev.example.com
+  #   resources:
+  #   - "^/users/john/.*$"
+  #   subject:
+  #   - ["group:dev", "user:john"]
+  #   - "group:admins"
+  #   policy: two_factor
+  # - domain: "{user}.example.com"
+  #   policy: bypass
+
+##
+## Session Provider Configuration
+##
+## The session cookies identify the user once logged in.
+## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
+session:
+  ## The name of the session cookie. (default: authelia_session).
+  name: authelia_session
+
+  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
+  ## Please read https://www.authelia.com/docs/configuration/session.html#same_site
+  same_site: lax
+
+  ## The time in seconds before the cookie expires and session is reset.
+  expiration: 1h
+
+  ## The inactivity time in seconds before the session is reset.
+  inactivity: 5m
+
+  ## The remember me duration.
+  ## Value is in seconds, or duration notation. Value of 0 disables remember me.
+  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
+  ## Longer periods are considered less secure because a stolen cookie will last longer giving attackers more time to
+  ## spy or attack. Currently the default is 1M or 1 month.
+  remember_me_duration: 1M
+
+##
+## Redis Provider
+##
+## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
+##
+## The redis connection details
+redisProvider:
+  port: 6379
+
+  ## Optional username to be used with authentication.
+  # username: authelia
+  username: ""
+
+  ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
+  database_index: 0
+
+  ## The maximum number of concurrent active connections to Redis.
+  maximum_active_connections: 8
+
+  ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
+  minimum_idle_connections: 0
+
+  ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
+  tls:
+    enabled: false
+
+    ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
+    server_name: ""
+
+    ## Skip verifying the server certificate (to allow a self-signed certificate).
+    ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
+    ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
+    skip_verify: false
+
+    ## Minimum TLS version for the connection.
+    minimum_version: TLS1.2
+
+  ## The Redis HA configuration options.
+  ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
+  high_availability:
+    enabled: false
+    enabledSecret: false
+    ## Sentinel Name / Master Name
+    sentinel_name: mysentinel
+
+    ## The additional nodes to pre-seed the redis provider with (for sentinel).
+    ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
+    ## For high availability to be used you must have either defined; the host above or at least one node below.
+    nodes: []
+    # nodes:
+    #   - host: sentinel-0.databases.svc.cluster.local
+    #     port: 26379
+    #   - host: sentinel-1.databases.svc.cluster.local
+    #     port: 26379
+
+    ## Choose the host with the lowest latency.
+    route_by_latency: false
+
+    ## Choose the host randomly.
+    route_randomly: false
+
+##
+## Regulation Configuration
+##
+## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are done
+## in a short period of time.
+regulation:
+  ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
+  max_retries: 3
+
+  ## The time range during which the user can attempt login before being banned. The user is banned if the
+  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
+  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
+  find_time: 2m
+
+  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
+  ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format
+  ban_time: 5m
+
+##
+## Storage Provider Configuration
+##
+## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
+storage:
+  ##
+  ## PostgreSQL (Storage Provider)
+  ##
+  postgres:
+    port: 5432
+    database: authelia
+    username: authelia
+    sslmode: disable
+    timeout: 5s
+
+##
+## Notification Provider
+##
+##
+## Notifications are sent to users when they require a password reset, a u2f registration or a TOTP registration.
+## The available providers are: filesystem, smtp. You must use one and only one of these providers.
+notifier:
+  ## You can disable the notifier startup check by setting this to true.
+  disable_startup_check: false
+
+  ##
+  ## File System (Notification Provider)
+  ##
+  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html
+  ##
+  filesystem:
+    enabled: true
+    filename: /config/notification.txt
+
+  ##
+  ## SMTP (Notification Provider)
+  ##
+  ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
+  ## [Security] By default Authelia will:
+  ##   - force all SMTP connections over TLS including unauthenticated connections
+  ##      - use the disable_require_tls boolean value to disable this requirement
+  ##        (only works for unauthenticated connections)
+  ##   - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
+  ##     (configure in tls section)
+  smtp:
+    enabled: false
+    enabledSecret: false
+    host: smtp.mail.svc.cluster.local
+    port: 25
+    timeout: 5s
+    username: test
+    plain_password: test
+    sender: admin@example.com
+    ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
+    identifier: localhost
+    ## Subject configuration of the emails sent.
+    ## {title} is replaced by the text from the notifier
+    subject: "[Authelia] {title}"
+    ## This address is used during the startup check to verify the email configuration is correct.
+    ## It's not important what it is except if your email server only allows local delivery.
+    startup_check_address: test@authelia.com
+    disable_require_tls: false
+    disable_html_emails: false
+
+    tls:
+      ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
+      server_name: ""
+
+      ## Skip verifying the server certificate (to allow a self-signed certificate).
+      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
+      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
+      skip_verify: false
+
+      ## Minimum TLS version for either StartTLS or SMTPS.
+      minimum_version: TLS1.2
+
+identity_providers:
+  oidc:
+    ## Enables this in the config map. Currently in beta stage.
+    ## See https://www.authelia.com/docs/configuration/identity-providers/oidc.html#roadmap
+    enabled: false
+
+    access_token_lifespan: 1h
+    authorize_code_lifespan: 1m
+    id_token_lifespan: 1h
+    refresh_token_lifespan: 90m
+
+    enable_client_debug_messages: false
+
+    ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for
+    ## security reasons.
+    minimum_parameter_entropy: 8
+
+    clients: []
+    # clients:
+    # -
+    ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration.
+    # id: myapp
+
+    ## The description to show to users when they end up on the consent screen. Defaults to the ID above.
+    # description: My Application
+
+    ## The client secret is a shared secret between Authelia and the consumer of this client.
+    # secret: apple123
+
+    ## Sets the client to public. This should typically not be set, please see the documentation for usage.
+    # public: false
+
+    ## The policy to require for this client; one_factor or two_factor.
+    # authorization_policy: two_factor
+
+    ## Configures the consent mode; auto, explicit or implicit
+    # consent_mode: auto
+
+    ## Audience this client is allowed to request.
+    # audience: []
+
+    ## Scopes this client is allowed to request.
+    # scopes:
+    #   - openid
+    #   - profile
+    #   - email
+    #   - groups
+
+    ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client.
+    # redirect_uris:
+    #   - https://oidc.example.com/oauth2/callback
+
+    ## Grant Types configures which grants this client can obtain.
+    ## It's not recommended to configure this unless you know what you're doing.
+    # grant_types:
+    #   - refresh_token
+    #   - authorization_code
+
+    ## Response Types configures which responses this client can be sent.
+    ## It's not recommended to configure this unless you know what you're doing.
+    # response_types:
+    #   - code
+
+    ## Response Modes configures which response modes this client supports.
+    ## It's not recommended to configure this unless you know what you're doing.
+    # response_modes:
+    #   - form_post
+    #   - query
+    #   - fragment
+
+    ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256.
+    # userinfo_signing_algorithm: none
+
+portal:
+  open:
+    enabled: true

charts/enterprise/blocky/Chart.yaml

@@ -3,11 +3,11 @@ appVersion: "0.19"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 11.1.2
+    version: 12.2.12
   - condition: redis.enabled
     name: redis
     repository: https://deps.truecharts.org
-    version: 5.0.33
+    version: 6.0.4
 description: Blocky is a DNS proxy, DNS enhancer and ad-blocker for the local network written in Go
 home: https://truecharts.org/charts/enterprise/blocky
 icon: https://truecharts.org/img/hotlink-ok/chart-icons/blocky.png
@@ -26,7 +26,7 @@ sources:
   - https://0xerr0r.github.io/blocky/
   - https://github.com/0xERR0R/blocky
   - https://github.com/Mozart409/blocky-frontend
-version: 4.0.24
+version: 5.0.0
 annotations:
   truecharts.org/catagories: |
     - network

charts/enterprise/blocky/questions.yaml

@@ -768,31 +768,30 @@ questions:
 # Include{ingressTraefik}
 # Include{ingressList}
 # Include{securityContextRoot}
-
+              - variable: runAsUser
-        - variable: runAsUser
+                label: "runAsUser"
-          label: runAsUser
+                description: "The UserID of the user running the application"
-          description: The UserID of the user running the application
+                schema:
-          schema:
+                  type: int
-            type: int
+                  default: 568
-            default: 568
+              - variable: runAsGroup
-        - variable: runAsGroup
+                label: "runAsGroup"
-          label: runAsGroup
+                description: "The groupID of the user running the application"
-          description: The groupID this App of the user running the application
+                schema:
-          schema:
+                  type: int
-            type: int
+                  default: 568
-            default: 568
 # Include{securityContextContainer}
 # Include{securityContextAdvanced}
 # Include{securityContextPod}
-        - variable: fsGroup
+              - variable: fsGroup
-          label: fsGroup
+                label: "fsGroup"
-          description: The group that should own ALL storage.
+                description: "The group that should own ALL storage."
-          schema:
+                schema:
-            type: int
+                  type: int
-            default: 568
+                  default: 568
-
 # Include{resources}
 # Include{metrics}
+# Include{prometheusRule}
 # Include{advanced}
 # Include{addons}
 # Include{codeserver}

charts/enterprise/blocky/templates/NOTES.txt

@@ -0,0 +1 @@
+{{- include "tc.v1.common.lib.chart.notes" $ -}}

charts/enterprise/blocky/templates/_blockyConfig.tpl

@@ -1,14 +1,7 @@
 {{/* Define the config */}}
 {{- define "blocky.configmap" -}}
-{{- $configName := printf "%s-config" (include "tc.common.names.fullname" .) }}
+{{- $config := mustMerge ( include "blocky.config" . | fromYaml ) ( .Values.blockyConfig ) }}
-{{- $config := merge ( include "blocky.config" . | fromYaml ) ( .Values.blockyConfig ) }}
+enabled: true
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ $configName }}
-  labels:
-    {{- include "tc.common.labels" . | nindent 4 }}
 data:
   config.yml: |
 {{ $config | toYaml | indent 4 }}
@@ -25,6 +18,23 @@ redis:
 prometheus:
   enable: true
   path: /metrics
+queryLog:
+  # optional one of: postgresql, csv, csv-client. If empty, log to console
+  type: {{ .Values.queryLog.type }}
+  # directory (should be mounted as volume in docker) for csv, db connection string for mysql/postgresql
+  #postgresql target: postgres://user:password@db_host_or_ip:5432/db_name
+  {{- if eq .Values.queryLog.type "postgresql" }}
+  target: {{ .Values.cnpg.creds.std }}
+  {{- else }}
+  target: {{ .Values.queryLog.target }}
+  {{- end }}
+  # if > 0, deletes log files which are older than ... days
+  logRetentionDays: {{ .Values.queryLog.logRetentionDays | default 0 }}
+  # optional: Max attempts to create specific query log writer
+  creationAttempts: {{ .Values.queryLog.creationAttempts | default 3 }}
+  # optional: Time between the creation attempts
+  creationCooldown: {{ .Values.queryLog.creationAttempts | default "2s" }}
+
 upstream:
   default:
 {{- .Values.defaultUpstreams | toYaml | nindent 8 }}
@@ -41,14 +51,15 @@ port: {{ .Values.service.dnsudp.ports.dnsudp.targetPort }}
 tlsPort: {{ .Values.service.dot.ports.dot.targetPort }}
 {{- end }}
 
-{{- if .Values.service.http.enabled }}
+{{- if .Values.service.main.enabled }}
-httpPort: {{ .Values.service.http.ports.http.targetPort }}
+httpPort: {{ .Values.service.main.ports.main.targetPort }}
 {{- end }}
 
 {{- if .Values.service.https.enabled }}
 httpsPort: {{ .Values.service.https.ports.https.targetPort }}
 {{- end }}
 
+
 {{- if .Values.certFile }}
 certFile: {{ .Values.certFile }}
 {{- end }}

charts/enterprise/blocky/templates/_k8sgateway.tpl

@@ -7,36 +7,22 @@ securityContext:
   readOnlyRootFilesystem: true
   runAsNonRoot: false
 args: ["-conf", "/etc/coredns/Corefile"]
-ports:
-  - containerPort: {{ .Values.service.k8sgateway.ports.k8sgateway.targetPort }}
-    name: main
 volumeMounts:
   - name: config-volume
     mountPath: /etc/coredns
-readinessProbe:
+probe:
-  httpGet:
+  readiness:
-    path: /ready
+    httpGet:
-    port: 8181
+      path: /ready
-  initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
+      port: 8181
-  timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
+  liveness:
-  periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
+    httpGet:
-  failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
+      path: /health
-livenessProbe:
+      port: 8080
-  httpGet:
+  startup:
-    path: /health
+    httpGet:
-    port: 8080
+      path: /ready
-  initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
+      port: 8181
-  timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
-  periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
-  failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
-startupProbe:
-  httpGet:
-    path: /ready
-    port: 8181
-  initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
-  timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
-  periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
-  failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
 {{- end -}}
 
 {{/*
@@ -53,14 +39,8 @@ Create the matchable regex from domain
 {{/* Define the configmap */}}
 {{- define "k8sgateway.configmap" -}}
 {{- $values := .Values.k8sgateway }}
-{{- $fqdn := ( include "tc.common.names.fqdn" . ) }}
+{{- $fqdn := ( include "tc.v1.common.lib.chart.names.fqdn" . ) }}
----
+enabled: true
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "tc.common.names.fullname" . }}-corefile
-  labels:
-    {{- include "tc.common.labels" . | nindent 4 }}
 data:
   Corefile: |-
     .:{{ .Values.service.k8sgateway.ports.k8sgateway.targetPort }} {

charts/enterprise/blocky/templates/_prometheusrules.tpl

@@ -1,21 +0,0 @@
-{{- define "blocky.prometheusrule" -}}
-{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }}
----
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: {{ include "tc.common.names.fullname" . }}
-  labels:
-    {{- include "tc.common.labels" . | nindent 4 }}
-    {{- with .Values.metrics.prometheusRule.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  groups:
-    - name: {{ include "tc.common.names.fullname" . }}
-      rules:
-        {{- with .Values.metrics.prometheusRule.rules }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
-{{- end }}
-{{- end -}}

charts/enterprise/blocky/templates/_servicemonitor.tpl

@@ -1,27 +0,0 @@
-{{- define "blocky.servicemonitor" -}}
-{{- if .Values.metrics.enabled }}
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: {{ include "tc.common.names.fullname" . }}
-  labels:
-    {{- include "tc.common.labels" . | nindent 4 }}
-    {{- with .Values.metrics.serviceMonitor.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  selector:
-    matchLabels:
-      {{- include "tc.common.labels.selectorLabels" . | nindent 6 }}
-  endpoints:
-    - port: http
-      {{- with .Values.metrics.serviceMonitor.interval }}
-      interval: {{ . }}
-      {{- end }}
-      {{- with .Values.metrics.serviceMonitor.scrapeTimeout }}
-      scrapeTimeout: {{ . }}
-      {{- end }}
-      path: /metrics
-{{- end }}
-{{- end -}}

charts/enterprise/blocky/templates/_webui.tpl

@@ -1,48 +0,0 @@
-{{- define "blocky.frontend" -}}
-image: {{ .Values.WebUIImage.repository }}:{{ .Values.WebUIImage.tag }}
-imagePullPolicy: {{ .Values.WebUIImage.pullPolicy }}
-securityContext:
-  runAsUser: 568
-  runAsGroup: 568
-  readOnlyRootFilesystem: true
-  runAsNonRoot: true
-ports:
-  - containerPort: {{ .Values.service.main.ports.main.targetPort }}
-    name: main
-readinessProbe:
-  httpGet:
-    path: /
-    port: {{ .Values.service.main.ports.main.targetPort }}
-  initialDelaySeconds: {{ .Values.probes.readiness.spec.initialDelaySeconds }}
-  timeoutSeconds: {{ .Values.probes.readiness.spec.timeoutSeconds }}
-  periodSeconds: {{ .Values.probes.readiness.spec.periodSeconds }}
-  failureThreshold: {{ .Values.probes.readiness.spec.failureThreshold }}
-livenessProbe:
-  httpGet:
-    path: /
-    port: {{ .Values.service.main.ports.main.targetPort }}
-  initialDelaySeconds: {{ .Values.probes.liveness.spec.initialDelaySeconds }}
-  timeoutSeconds: {{ .Values.probes.liveness.spec.timeoutSeconds }}
-  periodSeconds: {{ .Values.probes.liveness.spec.periodSeconds }}
-  failureThreshold: {{ .Values.probes.liveness.spec.failureThreshold }}
-startupProbe:
-  httpGet:
-    path: /
-    port: {{ .Values.service.main.ports.main.targetPort }}
-  initialDelaySeconds: {{ .Values.probes.startup.spec.initialDelaySeconds }}
-  timeoutSeconds: {{ .Values.probes.startup.spec.timeoutSeconds }}
-  periodSeconds: {{ .Values.probes.startup.spec.periodSeconds }}
-  failureThreshold: {{ .Values.probes.startup.spec.failureThreshold }}
-env:
-  - name: NODE_ENV
-    value: "production"
-{{- $url := .Values.webUI.apiURL }}
-{{- if .Values.ingress.main.enabled }}
-  {{- with (first .Values.ingress.main.hosts) }}
-  {{- $url = (  printf "https://%s" .host ) }}
-  {{- end }}
-{{- else }}
-{{- end }}
-  - name: API_URL
-    value: "{{ $url }}"
-{{- end -}}

charts/enterprise/blocky/templates/common.yaml

@@ -1,60 +1,57 @@
 {{/* Make sure all variables are set properly */}}
-{{- include "tc.common.loader.init" . }}
+{{- include "tc.v1.common.loader.init" . }}
 
-{{ include "blocky.configmap" . }}
+
+{{/* Render configmap for blocky */}}
+{{- $configmapFile := include "blocky.configmap" . | fromYaml -}}
+{{- if $configmapFile -}}
+  {{- $_ := set .Values.configmap "config" $configmapFile -}}
+{{- end -}}
+
+{{- $gatewayconfig := include "k8sgateway.configmap" . | fromYaml -}}
+{{- if $gatewayconfig -}}
+  {{- $_ := set .Values.configmap "corefile" $gatewayconfig -}}
+{{- end -}}
 
 {{/* Always mount the configmap, with the basic config, plus the 'blockyConfig' */}}
 {{- define "blocky.configmap.mount" -}}
 enabled: true
-type: custom
+type: configmap
 mountPath: /app/config.yml
-subPath: config.yml
+objectName: config
 readOnly: true
-volumeSpec:
+subPath: config.yml
-  configMap:
-    name: '{{ printf "%s-config" (include "tc.common.names.fullname" .) }}'
 {{- end -}}
 
 {{/* Append the general configMap volume to the volumes */}}
 {{- define "k8sgateway.configvolume" -}}
-enabled: "true"
+enabled: true
+type: configmap
 mountPath: "/etc/coredns"
+objectName: corefile
 readOnly: true
-type: "custom"
+items:
-volumeSpec:
+   - key: Corefile
-  configMap:
+     path: Corefile
-    name: {{ include "tc.common.names.fullname" . }}-corefile
-    items:
-    - key: Corefile
-      path: Corefile
 {{- end -}}
 
 {{- $_ := set .Values.persistence "tc-config" (include "blocky.configmap.mount" . | fromYaml) -}}
 
-{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "true" -}}
-{{- $_ := set .Values.podAnnotations "prometheus.io/path" "/metrics" -}}
-{{- $_ := set .Values.podAnnotations "prometheus.io/port" (.Values.service.http.ports.http.port | toString) -}}
-
-{{- if .Values.webUI.enabled -}}
-{{- $_ := set .Values.additionalContainers "frontend" (include "blocky.frontend" . | fromYaml) -}}
-{{- end -}}
-
 {{- if and .Values.k8sgateway.enabled .Values.k8sgateway.domains -}}
-{{- include "k8sgateway.configmap" . }}
 {{- $_ := set .Values.persistence "config-volume" (include "k8sgateway.configvolume" . | fromYaml) -}}
-{{- $_ := set .Values.additionalContainers "k8sgateway" (include "k8sgateway.container" . | fromYaml) -}}
+{{- $_ := set .Values.workload.main.podSpec.containers "k8sgateway" (include "k8sgateway.container" . | fromYaml) -}}
 {{- end -}}
 
 {{/* Define path for api */}}
 {{- define "blocky.api" -}}
-{{- $fullname := include "tc.common.names.fullname" . -}}
+{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" . -}}
 path: "/api"
 # -- Ignored if not kubeVersion >= 1.14-0
 pathType: Prefix
 service:
   # -- Overrides the service name reference for this path
-  name: {{ printf "%s-http" $fullname }}
+  name: {{ printf "%s-main" $fullname }}
-  port: {{ .Values.service.http.ports.http.port }}
+  port: {{ .Values.service.main.ports.main.port }}
 {{- end -}}
 
 {{/* inject websocket path to all main ingress hosts*/}}
@@ -74,14 +71,14 @@ service:
 
 {{/* Define path for DoH */}}
 {{- define "blocky.doh" -}}
-{{- $fullname := include "tc.common.names.fullname" . -}}
+{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" . -}}
 path: "/dns-query"
 # -- Ignored if not kubeVersion >= 1.14-0
 pathType: Prefix
 service:
   # -- Overrides the service name reference for this path
-  name: {{ printf "%s-http" $fullname }}
+  name: {{ printf "%s-main" $fullname }}
-  port: {{ .Values.service.http.ports.http.port }}
+  port: {{ .Values.service.main.ports.main.port }}
 {{- end -}}
 
 {{/* inject websocket path to all main ingress hosts*/}}
@@ -99,8 +96,5 @@ service:
 {{/* inject api paths in ingress */}}
 {{- include "blocky.dohinjector" . }}
 
-{{- include "blocky.servicemonitor" . -}}
-{{- include "blocky.prometheusrule" . -}}
-
 {{/* Render the templates */}}
-{{ include "tc.common.loader.apply" . }}
+{{ include "tc.v1.common.loader.apply" . }}

charts/enterprise/blocky/values.yaml

@@ -1,13 +1,6 @@
 image:
-  # repository: spx01/blocky
-  # tag: development@sha256:ddb35986cbc924de11cd37ccf625ff6bd0896fad456e57ee9c0bd67bd034770e
   repository: tccr.io/truecharts/blocky
-  tag: v0.19@sha256:77a474542f12f480deca33ff0a6375846918b86988c13f858620839d8818ca84
+  tag: v0.20.0@sha256:873c357493403b5985c38b7cc16f278b8268ba51bc6e95b076fd00cfb010f085
-  pullPolicy: IfNotPresent
-
-WebUIImage:
-  repository: tccr.io/truecharts/blocky-frontend
-  tag: v0.0.3@sha256:81058f20520dcdb80c9883b6f21b338446fefc333e3ca8bd7d17336a24a5d842
   pullPolicy: IfNotPresent
 
 k8sgatewayImage:
@@ -15,15 +8,32 @@ k8sgatewayImage:
   pullPolicy: IfNotPresent
   tag: 0.3.3@sha256:246e7006afaf57a398b02e417a31d6f14fb43562901388772778f60be586b807
 
-controller:
+workload:
-  # -- Set additional annotations on the deployment/statefulset/daemonset
+  main:
-  # -- Number of desired pods
+    replicas: 2
-  replicas: 2
+    strategy: RollingUpdate
-  # -- Set the controller upgrade strategy
+    podSpec:
-  # For Deployments, valid values are Recreate (default) and RollingUpdate.
+      containers:
-  # For StatefulSets, valid values are OnDelete and RollingUpdate (default).
+        main:
-  # DaemonSets ignore this.
+          probes:
-  strategy: RollingUpdate
+            liveness:
+              enabled: false
+              type: exec
+              command:
+                - /app/blocky
+                - healthcheck
+            readiness:
+              enabled: false
+              type: exec
+              command:
+                - /app/blocky
+                - healthcheck
+            startup:
+              enabled: false
+              type: exec
+              command:
+                - /app/blocky
+                - healthcheck
 
 # -- Blocky Config File content
 blockyConfig: {}
@@ -31,61 +41,20 @@ blockyConfig: {}
 #   default:
 #     - 1.1.1.1
 
-# -- Configures blocky webUI
-# Requires apiURL or ingress
-webUI:
-  # -- Enable the WebUI
-  enabled: true
-  # -- url to the api, used by the WebUI. Only required when not using ingress
-  apiURL: "127.0.0.1:4000"
-
 # -- some general blocky settings
 blocky:
   # -- Enable prometheus annotations
   enablePrometheus: true
 
-probes:
-  liveness:
-    enabled: false
-    # TODO: Enable after v0.20 is released.
-    # Current version does not include the healthcheck command
-    # enabled: true
-    # custom: true
-    # spec:
-    #   exec:
-    #     command:
-    #       - /app/blocky
-    #       - healthcheck
-  readiness:
-    enabled: false
-    # TODO: Enable after v0.20 is released.
-    # Current version does not include the healthcheck command
-    # enabled: true
-    # custom: true
-    # spec:
-    #   exec:
-    #     command:
-    #       - /app/blocky
-    #       - healthcheck
-  startup:
-    enabled: false
-    # TODO: Enable after v0.20 is released.
-    # Current version does not include the healthcheck command
-    # enabled: true
-    # custom: true
-    # spec:
-    #   exec:
-    #     command:
-    #       - /app/blocky
-    #       - healthcheck
-
 service:
   main:
+    enabled: true
     ports:
       main:
-        port: 10315
+        enabled: true
-        protocol: HTTP
+        port: 4000
-        targetPort: 80
+        protocol: http
+        targetPort: 4000
   dnstcp:
     enabled: true
     ports:
@@ -99,7 +68,7 @@ service:
       dnsudp:
         enabled: true
         port: 53
-        protocol: UDP
+        protocol: udp
         targetPort: 53
   dot:
     enabled: true
@@ -107,23 +76,15 @@ service:
       dot:
         enabled: true
         port: 853
-        protocol: TCP
+        protocol: tcp
         targetPort: 853
-  http:
-    enabled: true
-    ports:
-      http:
-        enabled: true
-        port: 4000
-        protocol: HTTP
-        targetPort: 4000
   https:
     enabled: true
     ports:
       https:
         enabled: true
         port: 4443
-        protocol: HTTPS
+        protocol: https
         targetPort: 4443
   k8sgateway:
     enabled: true
@@ -131,7 +92,7 @@ service:
       k8sgateway:
         enabled: true
         port: 5353
-        protocol: UDP
+        protocol: udp
         targetPort: 5353
 
 ## TODO Add support for SCALE certificates and certificates secrets here
@@ -280,13 +241,18 @@ hostsFile:
 #   creationAttempts: 3
 #   CreationCooldown: 2
 
+podOptions:
+  automountServiceAccountToken: true
+
 portal:
-  enabled: true
+  open:
+    enabled: false
 
 serviceAccount:
   main:
     # -- Specifies whether a service account should be created
     enabled: true
+    primary: true
 
 # -- Create a ClusterRole and ClusterRoleBinding
 # @default -- See below
@@ -294,7 +260,8 @@ rbac:
   main:
     # -- Enables or disables the ClusterRole and ClusterRoleBinding
     enabled: true
-
+    primary: true
+    clusterWide: true
     # -- Set Rules on the ClusterRole
     rules:
       - apiGroups:
@@ -348,32 +315,53 @@ k8sgateway:
         value: cloudflare-dns.com
 
 metrics:
-  # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
+  main:
-  # @default -- See values.yaml
+    # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
-  enabled: true
+    # @default -- See values.yaml
-  serviceMonitor:
+    enabled: true
-    interval: 1m
+    type: serviceMonitor
-    scrapeTimeout: 30s
+    endpoints:
-    labels: {}
+      - port: main
-  # -- Enable and configure Prometheus Rules for the chart under this key.
+        path: /metrics
-  # @default -- See values.yaml
+
-  prometheusRule:
+    # -- Enable and configure Prometheus Rules for the chart under this key.
-    enabled: false
+    # @default -- See values.yaml
-    labels: {}
+    prometheusRule:
-    # -- Configure additionial rules for the chart under this key.
+      enabled: false
-    # @default -- See prometheusrules.yaml
+      labels: {}
-    rules:
+      # -- Configure additionial rules for the chart under this key.
-      []
+      # @default -- See prometheusrules.yaml
-      # - alert: UnifiPollerAbsent
+      rules:
-      #   annotations:
+        []
-      #     description: Unifi Poller has disappeared from Prometheus service discovery.
+        # - alert: UnifiPollerAbsent
-      #     summary: Unifi Poller is down.
+        #   annotations:
-      #   expr: |
+        #     description: Unifi Poller has disappeared from Prometheus service discovery.
-      #     absent(up{job=~".*unifi-poller.*"} == 1)
+        #     summary: Unifi Poller is down.
-      #   for: 5m
+        #   expr: |
-      #   labels:
+        #     absent(up{job=~".*unifi-poller.*"} == 1)
-      #     severity: critical
+        #   for: 5m
+        #   labels:
+        #     severity: critical
 
 redis:
   enabled: true
-  existingSecret: "rediscreds"
+
+# CANNOT be defined in above yaml section
+queryLog:
+  # optional one of: mysql, postgresql, csv, csv-client. If empty, log to console
+  type: ""
+  # directory (should be mounted as volume in docker) for csv, db connection string for mysql/postgresql
+  # target: /var/log/something
+  # postgresql target: postgres://user:password@db_host_or_ip:5432/db_name
+  # if > 0, deletes log files which are older than ... days
+  logRetentionDays: 0
+  # optional: Max attempts to create specific query log writer, default: 3
+  creationAttempts: 3
+  # optional: Time between the creation attempts, default: 2s
+  creationCooldown: 2s
+
+cnpg:
+  main:
+    enabled: true
+    user: blocky
+    database: blocky

charts/enterprise/cert-manager/Chart.yaml

@@ -10,7 +10,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 11.1.2
+    version: 12.2.7
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -21,7 +21,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/cert-manager
   - https://cert-manager.io/
 type: application
-version: 0.0.7
+version: 1.0.0
 annotations:
   truecharts.org/catagories: |
     - core

charts/enterprise/cert-manager/questions.yaml

@@ -246,7 +246,7 @@ questions:
                         required: true
                         show_if: [["selfSigned", "=", "false"]]
                         default: ""
-                        
+
         - variable: selfSigned
           label: 'SelfSigned Issuer'
           schema:
@@ -270,4 +270,5 @@ questions:
 
 
 # Include{metrics}
+# Include{prometheusRule}
 # Include{documentation}

charts/enterprise/cert-manager/templates/NOTES.txt

@@ -0,0 +1 @@
+{{- include "tc.v1.common.lib.chart.notes" $ -}}

charts/enterprise/cert-manager/templates/_metrics.tpl

@@ -1,5 +1,5 @@
 {{- define "certmanager.metrics" -}}
-{{- if .Values.metrics.enabled }}
+{{- if .Values.customMetrics.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: PodMonitor
 metadata:

charts/enterprise/cert-manager/templates/_wait.tpl

@@ -1,85 +0,0 @@
-{{- define "certmanager.wait" }}
-{{- $fullName := include "tc.common.names.fullname" . }}
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  namespace: {{ .Release.Namespace }}
-  name: {{ $fullName }}-wait
-  annotations:
-    "helm.sh/hook": pre-install, pre-upgrade
-    "helm.sh/hook-weight": "-1"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
-spec:
-  template:
-    spec:
-      serviceAccountName: {{ $fullName }}-wait
-      containers:
-        - name: {{ $fullName }}-wait
-          image: {{ .Values.kubectlImage.repository }}:v1.26.0
-          securityContext:
-            runAsUser: 568
-            runAsGroup: 568
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-          command:
-            - "/bin/sh"
-            - "-c"
-            - |
-              /bin/sh <<'EOF'
-              kubectl wait --namespace metallb-system --for=condition=ready pod --selector=app=metallb --timeout=90s || echo "metallb-system wait failed..."
-              kubectl wait --namespace cert-manager --for=condition=ready pod --selector=app=cert-manager --timeout=90s || echo "cert-manager wait failed..."
-              cmctl check api --wait=2m || echo "cmctl wait failed..."
-              EOF
-          volumeMounts:
-            - name: {{ $fullName }}-manifests-temp
-              mountPath: /tmp
-            - name: {{ $fullName }}-manifests-home
-              mountPath: /home/apps/
-      restartPolicy: Never
-      volumes:
-        - name: {{ $fullName }}-manifests-temp
-          emptyDir: {}
-        - name: {{ $fullName }}-manifests-home
-          emptyDir: {}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ $fullName }}-wait
-  annotations:
-    "helm.sh/hook": pre-install, pre-upgrade
-    "helm.sh/hook-weight": "-2"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
-rules:
-  - apiGroups:  ["*"]
-    resources:  ["*"]
-    verbs:  ["*"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ $fullName }}-wait
-  annotations:
-    "helm.sh/hook": pre-install, pre-upgrade
-    "helm.sh/hook-weight": "-2"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ $fullName }}-wait
-subjects:
-  - kind: ServiceAccount
-    name: {{ $fullName }}-wait
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ $fullName }}-wait
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/hook": pre-install, pre-upgrade
-    "helm.sh/hook-weight": "-2"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
-{{- end }}

charts/enterprise/cert-manager/templates/common.yaml

@@ -1,11 +1,10 @@
 {{/* Make sure all variables are set properly */}}
-{{- include "tc.common.loader.init" . }}
+{{- include "tc.v1.common.loader.init" . }}
 
 {{/* Render the templates */}}
-{{ include "tc.common.loader.apply" . }}
+{{ include "tc.v1.common.loader.apply" . }}
 
 {{- include "certmanager.clusterissuer.acme" . }}
 {{- include "certmanager.clusterissuer.selfsigned" . }}
 {{- include "certmanager.clusterissuer.ca" . }}
 {{- include "certmanager.metrics" . }}
-{{- include "certmanager.wait" . }}

charts/enterprise/cert-manager/values.yaml

@@ -3,8 +3,20 @@ image:
   tag: latest@sha256:93878048bbc350e69bf246556ef3520f343487c7ffc40f0b0655ed8a360cb932
   pullPolicy: IfNotPresent
 
-controller:
+workload:
-  enabled: false
+  main:
+    enabled: false
+    podSpec:
+      containers:
+        main:
+          enabled: false
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+            startup:
+              enabled: false
 
 service:
   main:
@@ -15,14 +27,7 @@ service:
         port: 9999
 
 portal:
-  enabled: false
+  open:
-
-probes:
-  liveness:
-    enabled: false
-  readiness:
-    enabled: false
-  startup:
     enabled: false
 
 clusterIssuer:
@@ -70,5 +75,5 @@ clusterIssuer:
 #     tsigAlgorithm: ""
 #     rfctsigSecret: ""
 
-metrics:
+customMetrics:
   enabled: true

charts/enterprise/grafana/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "9.3.6"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 11.1.2
+    version: 12.2.5
 deprecated: false
 description: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, Elasticsearch, OpenTSDB, Prometheus and InfluxDB.
 home: https://truecharts.org/charts/enterprise/grafana
@@ -25,7 +25,7 @@ sources:
   - https://github.com/bitnami/bitnami-docker-grafana
   - https://grafana.com/
 type: application
-version: 6.0.31
+version: 7.0.0
 annotations:
   truecharts.org/catagories: |
     - metrics

charts/enterprise/grafana/questions.yaml

@@ -118,16 +118,16 @@ questions:
                 schema:
                   type: int
                   default: 568
-        - variable: runAsGroup
+              - variable: runAsGroup
-          label: "runAsGroup"
+                label: "runAsGroup"
-          description: "The groupID this App of the user running the application"
+                description: "The groupID of the user running the application"
-          schema:
+                schema:
-            type: int
+                  type: int
-            default: 568
+                  default: 568
 # Include{securityContextContainer}
 # Include{securityContextAdvanced}
 # Include{securityContextPod}
-             - variable: fsGroup
+              - variable: fsGroup
                 label: "fsGroup"
                 description: "The group that should own ALL storage."
                 schema:
@@ -137,6 +137,7 @@ questions:
 # Include{resources}
 # Include{metrics}
 # Include{prometheusRule}
+# Include{prometheusRule}
 # Include{advanced}
 # Include{addons}
 # Include{codeserver}

charts/enterprise/grafana/templates/NOTES.txt

@@ -0,0 +1 @@
+{{- include "tc.v1.common.lib.chart.notes" $ -}}

charts/enterprise/grafana/templates/common.yaml

@@ -1 +1 @@
-{{ include "tc.common.loader.all" . }}
+{{ include "tc.v1.common.loader.all" . }}

charts/enterprise/grafana/templates/prometheusrules.yaml

@@ -1,18 +0,0 @@
-{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }}
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: {{ include "tc.common.names.fullname" . }}
-  labels:
-    {{- include "tc.common.labels" . | nindent 4 }}
-    {{- with .Values.metrics.prometheusRule.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  groups:
-    - name: {{ include "tc.common.names.fullname" . }}
-      rules:
-        {{- with .Values.metrics.prometheusRule.rules }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
-{{- end }}

charts/enterprise/grafana/templates/servicemonitor.yaml

@@ -1,24 +0,0 @@
-{{- if .Values.metrics.enabled }}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: {{ include "tc.common.names.fullname" . }}
-  labels:
-    {{- include "tc.common.labels" . | nindent 4 }}
-    {{- with .Values.metrics.serviceMonitor.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-spec:
-  selector:
-    matchLabels:
-      {{- include "tc.common.labels.selectorLabels" . | nindent 6 }}
-  endpoints:
-    - port: main
-      {{- with .Values.metrics.serviceMonitor.interval }}
-      interval: {{ . }}
-      {{- end }}
-      {{- with .Values.metrics.serviceMonitor.scrapeTimeout }}
-      scrapeTimeout: {{ . }}
-      {{- end }}
-      path: /metrics
-{{- end }}

charts/enterprise/grafana/values.yaml

@@ -4,40 +4,45 @@ image:
   tag: 9.3.6@sha256:e9d2674578a97b9442af115c6137fa0bc7273984109d7b9ea1ea17e2ceba1129
 
 securityContext:
-  readOnlyRootFilesystem: false
+  container:
+    readOnlyRootFilesystem: false
 
 service:
   main:
     ports:
       main:
-        protocol: HTTP
+        protocol: http
         targetPort: 3000
         port: 10038
 
-probes:
+workload:
-  liveness:
+  main:
-    path: "/api/health"
+    replicas: 2
+    strategy: RollingUpdate
+    podSpec:
+      containers:
+        main:
+          env:
+            GF_SECURITY_ADMIN_USER: "admin"
+            GF_SECURITY_ADMIN_PASSWORD: "testpassword"
+            GF_INSTALL_PLUGINS: ""
+            GF_PATHS_PLUGINS: "/opt/bitnami/grafana/data/plugins"
+            GF_AUTH_LDAP_ENABLED: "false"
+            GF_AUTH_LDAP_CONFIG_FILE: "/opt/bitnami/grafana/conf/ldap.toml"
+            GF_AUTH_LDAP_ALLOW_SIGN_UP: "false"
+            GF_PATHS_PROVISIONING: "/opt/bitnami/grafana/conf/provisioning"
+            GF_PATHS_CONFIG: "/opt/bitnami/grafana/conf/grafana.ini"
+            GF_PATHS_DATA: "/opt/bitnami/grafana/data"
+            GF_PATHS_LOGS: "/opt/bitnami/grafana/logs"
+          probes:
+            liveness:
+              path: "/api/health"
 
-  readiness:
+            readiness:
-    path: "/api/health"
+              path: "/api/health"
 
-  startup:
+            startup:
-    path: "/api/health"
+              path: "/api/health"
-
-secretEnv:
-  GF_SECURITY_ADMIN_USER: "admin"
-  GF_SECURITY_ADMIN_PASSWORD: "testpassword"
-
-env:
-  GF_INSTALL_PLUGINS: ""
-  GF_PATHS_PLUGINS: "/opt/bitnami/grafana/data/plugins"
-  GF_AUTH_LDAP_ENABLED: "false"
-  GF_AUTH_LDAP_CONFIG_FILE: "/opt/bitnami/grafana/conf/ldap.toml"
-  GF_AUTH_LDAP_ALLOW_SIGN_UP: "false"
-  GF_PATHS_PROVISIONING: "/opt/bitnami/grafana/conf/provisioning"
-  GF_PATHS_CONFIG: "/opt/bitnami/grafana/conf/grafana.ini"
-  GF_PATHS_DATA: "/opt/bitnami/grafana/data"
-  GF_PATHS_LOGS: "/opt/bitnami/grafana/logs"
 
 persistence:
   config:
@@ -49,31 +54,33 @@ persistence:
     mountPath: /opt/bitnami/grafana/tmp
 
 metrics:
-  # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
+  main:
-  # @default -- See values.yaml
+    # -- Enable and configure a Prometheus serviceMonitor for the chart under this key.
-  enabled: false
+    # @default -- See values.yaml
-  serviceMonitor:
+    enabled: true
-    interval: 1m
+    type: serviceMonitor
-    scrapeTimeout: 30s
+    endpoints:
-    labels: {}
+      - port: main
-  # -- Enable and configure Prometheus Rules for the chart under this key.
+        path: /metrics
-  # @default -- See values.yaml
+    # -- Enable and configure Prometheus Rules for the chart under this key.
-  prometheusRule:
+    # @default -- See values.yaml
-    enabled: false
+    prometheusRule:
-    labels: {}
+      enabled: false
-    # -- Configure additionial rules for the chart under this key.
+      labels: {}
-    # @default -- See prometheusrules.yaml
+      # -- Configure additionial rules for the chart under this key.
-    rules:
+      # @default -- See prometheusrules.yaml
-      []
+      rules:
-      # - alert: UnifiPollerAbsent
+        []
-      #   annotations:
+        # - alert: UnifiPollerAbsent
-      #     description: Unifi Poller has disappeared from Prometheus service discovery.
+        #   annotations:
-      #     summary: Unifi Poller is down.
+        #     description: Unifi Poller has disappeared from Prometheus service discovery.
-      #   expr: |
+        #     summary: Unifi Poller is down.
-      #     absent(up{job=~".*unifi-poller.*"} == 1)
+        #   expr: |
-      #   for: 5m
+        #     absent(up{job=~".*unifi-poller.*"} == 1)
-      #   labels:
+        #   for: 5m
-      #     severity: critical
+        #   labels:
+        #     severity: critical
 
 portal:
-  enabled: true
+  open:
+    enabled: true

charts/enterprise/metallb/Chart.yaml

@@ -10,7 +10,7 @@ keywords:
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 11.1.2
+    version: 12.2.5
 kubeVersion: ">=1.16.0-0"
 maintainers:
   - email: info@truecharts.org
@@ -22,7 +22,7 @@ sources:
   - https://github.com/metallb/metallb
   - https://metallb.universe.tf
 type: application
-version: 7.0.12
+version: 8.0.0
 annotations:
   truecharts.org/catagories: |
     - core

charts/enterprise/metallb/templates/NOTES.txt

@@ -0,0 +1 @@
+{{- include "tc.v1.common.lib.chart.notes" $ -}}

charts/enterprise/metallb/templates/_wait.tpl

@@ -1,68 +0,0 @@
-{{- define "metallb.wait" }}
-{{- $fullName := include "tc.common.names.fullname" . }}
----
-apiVersion: batch/v1
-kind: Job
-metadata:
-  namespace: {{ .Release.Namespace }}
-  name: {{ $fullName }}-wait
-  annotations:
-    "helm.sh/hook": pre-install, pre-upgrade
-    "helm.sh/hook-weight": "-1"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
-spec:
-  template:
-    spec:
-      serviceAccountName: {{ $fullName }}-wait
-      containers:
-        - name: {{ $fullName }}-wait
-          image: {{ .Values.ubuntuImage.repository }}:{{ .Values.ubuntuImage.tag }}
-          command:
-            - "/bin/sh"
-            - "-c"
-            - |
-              /bin/bash <<'EOF'
-              kubectl wait --namespace metallb-system --for=condition=ready pod --selector=app=metallb --timeout=90s
-              EOF
-      restartPolicy: OnFailure
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ $fullName }}-wait
-  annotations:
-    "helm.sh/hook": pre-install, pre-upgrade
-    "helm.sh/hook-weight": "-2"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
-rules:
-  - apiGroups:  ["*"]
-    resources:  ["pods"]
-    verbs:  ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ $fullName }}-wait
-  annotations:
-    "helm.sh/hook": pre-install, pre-upgrade
-    "helm.sh/hook-weight": "-2"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ $fullName }}-wait
-subjects:
-  - kind: ServiceAccount
-    name: {{ $fullName }}-wait
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ $fullName }}-wait
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/hook": pre-install, pre-upgrade
-    "helm.sh/hook-weight": "-2"
-    "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
-{{- end }}

charts/enterprise/metallb/templates/common.yaml

@@ -1,8 +1,8 @@
 {{/* Make sure all variables are set properly */}}
-{{- include "tc.common.loader.init" . }}
+{{- include "tc.v1.common.loader.init" . }}
 
 {{/* Render the templates */}}
-{{ include "tc.common.loader.apply" . }}
+{{ include "tc.v1.common.loader.apply" . }}
 
 {{- include "metallb.l2adv" . }}
 
@@ -13,5 +13,3 @@
 {{- include "metallb.comm" . }}
 
 {{- include "metallb.pool" . }}
-
-{{- include "metallb.wait" . }}

charts/enterprise/metallb/values.yaml

@@ -3,8 +3,20 @@ image:
   tag: latest@sha256:93878048bbc350e69bf246556ef3520f343487c7ffc40f0b0655ed8a360cb932
   pullPolicy: IfNotPresent
 
-controller:
+workload:
-  enabled: false
+  main:
+    enabled: false
+    podSpec:
+      containers:
+        main:
+          enabled: false
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+            startup:
+              enabled: false
 
 service:
   main:
@@ -14,24 +26,9 @@ service:
         enabled: false
         port: 9999
 
-updateCRD: false
-
 portal:
-  enabled: false
+  open:
-
-probes:
-  liveness:
     enabled: false
-  readiness:
-    enabled: false
-  startup:
-    enabled: false
-
-configmap:
-  config:
-    enabled: true
-    data:
-      placeholderdata: "something"
 
 ipAddressPools: []
 #   - name: example

charts/enterprise/prometheus/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "2.42.0"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 11.1.2
+    version: 12.2.11
   - condition: exporters.enabled,exporters.node-exporter.enabled
     name: node-exporter
     repository: https://charts.bitnami.com/bitnami
@@ -30,7 +30,7 @@ sources:
   - https://github.com/prometheus-community/helm-charts
   - https://github.com/prometheus-operator/kube-prometheus
 type: application
-version: 7.0.60
+version: 8.0.0
 annotations:
   truecharts.org/catagories: |
     - metrics

charts/enterprise/prometheus/templates/NOTES.txt

@@ -0,0 +1 @@
+{{- include "tc.v1.common.lib.chart.notes" $ -}}

charts/enterprise/prometheus/templates/_helpers.tpl

@@ -1,46 +1,46 @@
 {{/* Name suffixed with operator */}}
 {{- define "kube-prometheus.fullname" -}}
-{{- printf "%s" (include "tc.common.names.fullname" . ) -}}
+{{- printf "%s" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
 {{- end }}
 
 {{/* Name suffixed with operator */}}
 {{- define "kube-prometheus.name" -}}
-{{- printf "%s" (include "tc.common.names.fullname" . ) -}}
+{{- printf "%s" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
 {{- end }}
 
 {{/* Name suffixed with operator */}}
 {{- define "kube-prometheus.operator.name" -}}
-{{- printf "%s-operator" (include "tc.common.names.fullname" . ) -}}
+{{- printf "%s-operator" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
 {{- end }}
 
 {{/* Name suffixed with prometheus */}}
 {{- define "kube-prometheus.prometheus.name" -}}
-{{- printf "%s-prometheus" (include "tc.common.names.fullname" . ) -}}
+{{- printf "%s-prometheus" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
 {{- end }}
 
 {{/* Name suffixed with alertmanager */}}
 {{- define "kube-prometheus.alertmanager.name" -}}
-{{- printf "%s-alertmanager" (include "tc.common.names.fullname" . ) -}}
+{{- printf "%s-alertmanager" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
 {{- end }}
 
 {{/* Name suffixed with thanos */}}
 {{- define "kube-prometheus.thanos.name" -}}
-{{- printf "%s-thanos" (include "tc.common.names.fullname" . ) -}}
+{{- printf "%s-thanos" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
 {{- end }}
 
 {{/* Fullname suffixed with operator */}}
 {{- define "kube-prometheus.operator.fullname" -}}
-{{- printf "%s-operator" (include "tc.common.names.fullname" . ) -}}
+{{- printf "%s-operator" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
 {{- end }}
 
 {{/* Fullname suffixed with prometheus */}}
 {{- define "kube-prometheus.prometheus.fullname" -}}
-{{- printf "%s-prometheus" (include "tc.common.names.fullname" . ) -}}
+{{- printf "%s-prometheus" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
 {{- end }}
 
 {{/* Fullname suffixed with alertmanager */}}
 {{- define "kube-prometheus.alertmanager.fullname" -}}
-{{- printf "%s-alertmanager" (include "tc.common.names.fullname" . ) -}}
+{{- printf "%s-alertmanager" (include "tc.v1.common.lib.chart.names.fullname" . ) -}}
 {{- end }}
 
 {{/* Fullname suffixed with thanos */}}
@@ -56,7 +56,10 @@
 Common Labels
 */}}
 {{- define "kube-prometheus.labels" -}}
-{{ include "tc.common.labels" . }}
+  {{- $labels := (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml) -}}
+  {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }}
+    {{- . | nindent 0 }}
+  {{- end }}
 {{- if .Values.global.labels }}
 {{ toYaml .Values.global.labels }}
 {{- end }}
@@ -66,7 +69,10 @@ Common Labels
 Labels for operator
 */}}
 {{- define "kube-prometheus.operator.labels" -}}
-{{ include "tc.common.labels" . }}
+  {{- $labels := (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml) -}}
+  {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }}
+    {{- . | nindent 0 }}
+  {{- end }}
 app.kubernetes.io/component: operator
 {{- end -}}
 
@@ -74,7 +80,10 @@ app.kubernetes.io/component: operator
 Labels for prometheus
 */}}
 {{- define "kube-prometheus.prometheus.labels" -}}
-{{ include "tc.common.labels" . }}
+  {{- $labels := (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml) -}}
+  {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }}
+    {{- . | nindent 0 }}
+  {{- end }}
 app.kubernetes.io/component: prometheus
 {{- end -}}
 
@@ -82,7 +91,10 @@ app.kubernetes.io/component: prometheus
 Labels for alertmanager
 */}}
 {{- define "kube-prometheus.alertmanager.labels" -}}
-{{ include "tc.common.labels" . }}
+  {{- $labels := (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml) -}}
+  {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }}
+    {{- . | nindent 0 }}
+  {{- end }}
 app.kubernetes.io/component: alertmanager
 {{- end -}}
 
@@ -90,7 +102,7 @@ app.kubernetes.io/component: alertmanager
 matchLabels for operator
 */}}
 {{- define "kube-prometheus.operator.matchLabels" -}}
-{{ include "tc.common.labels.selectorLabels" . }}
+{{ include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ )}}
 app.kubernetes.io/component: operator
 {{- end -}}
 
@@ -98,7 +110,7 @@ app.kubernetes.io/component: operator
 matchLabels for prometheus
 */}}
 {{- define "kube-prometheus.prometheus.matchLabels" -}}
-{{ include "tc.common.labels.selectorLabels" . }}
+{{ include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ )}}
 app.kubernetes.io/component: prometheus
 {{- end -}}
 
@@ -106,7 +118,7 @@ app.kubernetes.io/component: prometheus
 matchLabels for alertmanager
 */}}
 {{- define "kube-prometheus.alertmanager.matchLabels" -}}
-{{ include "tc.common.labels.selectorLabels" . }}
+{{ include "tc.v1.common.lib.metadata.selectorLabels" (dict "rootCtx" $ )}}
 app.kubernetes.io/component: alertmanager
 {{- end -}}
 

charts/enterprise/prometheus/templates/alertmanager/_alertmanager.tpl

@@ -27,10 +27,10 @@ spec:
   logLevel: {{ .Values.alertmanager.logLevel }}
   retention: {{ .Values.alertmanager.retention }}
   {{- if .Values.alertmanager.secrets }}
-  secrets: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.secrets "context" $) | nindent 4 }}
+  secrets: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.secrets "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.alertmanager.configMaps }}
-  configMaps: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.configMaps "context" $) | nindent 4 }}
+  configMaps: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.configMaps "context" $) | nindent 4 }}
   {{- end }}
   resources: {{- toYaml .Values.alertmanager.resources | nindent 4 }}
   routePrefix: "{{ .Values.alertmanager.routePrefix }}"
@@ -38,7 +38,7 @@ spec:
   securityContext: {{- omit .Values.alertmanager.podSecurityContext "enabled" | toYaml | nindent 4 }}
   {{- end }}
   {{- if .Values.alertmanager.storageSpec }}
-  storage: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.storageSpec "context" $) | nindent 4 }}
+  storage: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.storageSpec "context" $) | nindent 4 }}
   {{- else }}
   {{- if .Values.alertmanager.persistence.enabled }}
   storage:
@@ -51,48 +51,39 @@ spec:
         resources:
           requests:
             storage: {{ .Values.alertmanager.persistence.size | quote }}
-        {{- include "tc.common.storage.storageClassName" (dict "persistence" .Values.alertmanager.persistence "global" $ ) | nindent 8 }}
+        {{- with (include "tc.v1.common.lib.storage.storageClassName" (dict "persistence" .Values.prometheus.persistence "root" . )) | trim }}
+        storageClassName: {{ . }}
+        {{- end }}
   {{- end }}
   {{- end }}
   {{- if or .Values.alertmanager.podMetadata.labels .Values.alertmanager.podMetadata.annotations (eq .Values.alertmanager.podAntiAffinityPreset "soft") (eq .Values.alertmanager.podAntiAffinityPreset "hard") }}
   podMetadata:
     labels:
     {{- if .Values.alertmanager.podMetadata.labels }}
-    {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.podMetadata.labels "context" $) | nindent 6 }}
+    {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.podMetadata.labels "context" $) | nindent 6 }}
     {{- end }}
     {{- if or (eq .Values.alertmanager.podAntiAffinityPreset "soft") (eq .Values.alertmanager.podAntiAffinityPreset "hard") }}
     {{- include "kube-prometheus.alertmanager.matchLabels" . | nindent 6 }}
     {{- end }}
     {{- if .Values.alertmanager.podMetadata.annotations }}
     annotations:
-    {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.podMetadata.annotations "context" $) | nindent 6 }}
+    {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.podMetadata.annotations "context" $) | nindent 6 }}
     {{- end }}
   {{- end }}
   {{- if .Values.alertmanager.affinity }}
-  affinity: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.affinity "context" $) | nindent 4 }}
+  affinity: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.affinity "context" $) | nindent 4 }}
-  {{- else }}
-  affinity:
-    {{- if not (empty .Values.alertmanager.podAffinityPreset) }}
-    podAffinity: {{- include "tc.common.affinities.pods" (dict "type" .Values.alertmanager.podAffinityPreset "component" "alertmanager" "context" $) | nindent 6 }}
-    {{- end }}
-    {{- if not (empty .Values.alertmanager.podAntiAffinityPreset) }}
-    podAntiAffinity: {{- include "tc.common.affinities.pods" (dict "type" .Values.alertmanager.podAntiAffinityPreset "component" "alertmanager" "context" $) | nindent 6 }}
-    {{- end }}
-    {{- if not (empty .Values.alertmanager.nodeAffinityPreset.values) }}
-    nodeAffinity: {{- include "tc.common.affinities.nodes" (dict "type" .Values.alertmanager.nodeAffinityPreset.type "key" .Values.alertmanager.nodeAffinityPreset.key "values" .Values.alertmanager.nodeAffinityPreset.values) | nindent 6 }}
-    {{- end }}
   {{- end }}
   {{- if .Values.alertmanager.nodeSelector }}
-  nodeSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.nodeSelector "context" $) | nindent 4 }}
+  nodeSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.nodeSelector "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.alertmanager.tolerations }}
-  tolerations: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.tolerations "context" $) | nindent 4 }}
+  tolerations: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.tolerations "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.alertmanager.volumes }}
-  volumes: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.volumes "context" $) | nindent 4 }}
+  volumes: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.volumes "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.alertmanager.volumeMounts }}
-  volumeMounts: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.volumeMounts "context" $) | nindent 4 }}
+  volumeMounts: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.volumeMounts "context" $) | nindent 4 }}
   {{- end }}
 {{- include "kube-prometheus.imagePullSecrets" . | indent 2 }}
   {{- if or .Values.alertmanager.containers .Values.alertmanager.containerSecurityContext.enabled .Values.operator.prometheusConfigReloader.containerSecurityContext.enabled }}
@@ -164,7 +155,7 @@ spec:
       {{- end }}
     {{- end }}
     {{- if .Values.alertmanager.containers }}
-    {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.containers "context" $) | nindent 4 }}
+    {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.containers "context" $) | nindent 4 }}
     {{- end }}
   {{- end }}
   {{- if .Values.alertmanager.priorityClassName }}
@@ -174,10 +165,10 @@ spec:
   additionalPeers: {{ .Values.alertmanager.additionalPeers }}
   {{- end }}
   {{- if .Values.alertmanager.configNamespaceSelector }}
-  alertmanagerConfigNamespaceSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.configNamespaceSelector "context" $) | nindent 4 }}
+  alertmanagerConfigNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.configNamespaceSelector "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.alertmanager.configSelector }}
-  alertmanagerConfigSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.configSelector "context" $) | nindent 4 }}
+  alertmanagerConfigSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.configSelector "context" $) | nindent 4 }}
   {{- end }}
 {{- end }}
 {{- end }}

charts/enterprise/prometheus/templates/alertmanager/serviceaccount.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels: {{- include "kube-prometheus.alertmanager.labels" . | nindent 4 }}
   {{- if index .Values.alertmanager.serviceAccount "annotations" }}
-  annotations: {{- include "tc.common.tplvalues.render" (dict "value" .Values.alertmanager.serviceAccount.annotations "context" $) | nindent 4 }}
+  annotations: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.alertmanager.serviceAccount.annotations "context" $) | nindent 4 }}
   {{- end }}
 {{- include "kube-prometheus.imagePullSecrets" . }}
 {{- end }}

charts/enterprise/prometheus/templates/alertmanager/servicemonitor.yaml

@@ -18,7 +18,7 @@ spec:
       {{- end }}
       path: {{ trimSuffix "/" .Values.alertmanager.routePrefix }}/metrics
       {{- if .Values.alertmanager.serviceMonitor.metricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" ( dict "value" .Values.alertmanager.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.alertmanager.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
       {{- end }}
       {{- if .Values.alertmanager.serviceMonitor.relabelings }}
       relabelings: {{- toYaml .Values.alertmanager.serviceMonitor.relabelings | nindent 8 }}

charts/enterprise/prometheus/templates/common.yaml

@@ -1,5 +1,5 @@
 {{/* Make sure all variables are set properly */}}
-{{- include "tc.common.loader.init" . }}
+{{- include "tc.v1.common.loader.init" . }}
 
 {{- include "prometheus.prometheus.prometheus" . }}
 {{- include "prometheus.prometheus.additionalprometheusrules" . }}
@@ -10,4 +10,4 @@
 
 
 {{/* Render the templates */}}
-{{ include "tc.common.loader.apply" . }}
+{{ include "tc.v1.common.loader.apply" . }}

charts/enterprise/prometheus/templates/exporters/core-dns/servicemonitor.yaml

@@ -21,9 +21,9 @@ spec:
       {{- end }}
       bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
       {{- if .Values.coreDns.serviceMonitor.metricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" (dict "value" .Values.coreDns.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.coreDns.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
       {{- end }}
       {{- if .Values.coreDns.serviceMonitor.relabelings }}
-      relabelings: {{- include "tc.common.tplvalues.render" (dict "value" .Values.coreDns.serviceMonitor.relabelings "context" $) | nindent 6 }}
+      relabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.coreDns.serviceMonitor.relabelings "context" $) | nindent 6 }}
       {{- end }}
 {{- end }}

charts/enterprise/prometheus/templates/exporters/kube-apiserver/servicemonitor.yaml

@@ -27,7 +27,7 @@ spec:
       interval: {{ .Values.kubeApiServer.serviceMonitor.interval }}
       {{- end }}
       {{- if .Values.kubeApiServer.serviceMonitor.metricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" ( dict "value" .Values.kubeApiServer.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubeApiServer.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
       {{- end }}
       {{- if .Values.kubeApiServer.serviceMonitor.relabelings }}
       relabelings: {{- toYaml .Values.kubeApiServer.serviceMonitor.relabelings | nindent 8 }}

charts/enterprise/prometheus/templates/exporters/kube-controller-manager/servicemonitor.yaml

@@ -32,9 +32,9 @@ spec:
         {{- end }}
       {{- end }}
       {{- if .Values.kubeControllerManager.serviceMonitor.metricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" (dict "value" .Values.kubeControllerManager.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.kubeControllerManager.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
       {{- end }}
       {{- if .Values.kubeControllerManager.serviceMonitor.relabelings }}
-      relabelings: {{- include "tc.common.tplvalues.render" (dict "value" .Values.kubeControllerManager.serviceMonitor.relabelings "context" $) | nindent 6 }}
+      relabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.kubeControllerManager.serviceMonitor.relabelings "context" $) | nindent 6 }}
       {{- end }}
 {{- end }}

charts/enterprise/prometheus/templates/exporters/kube-scheduler/servicemonitor.yaml

@@ -32,9 +32,9 @@ spec:
         {{- end}}
       {{- end}}
       {{- if .Values.kubeScheduler.serviceMonitor.metricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" (dict "value" .Values.kubeScheduler.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.kubeScheduler.serviceMonitor.metricRelabelings "context" $) | nindent 6 }}
       {{- end }}
       {{- if .Values.kubeScheduler.serviceMonitor.relabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" (dict "value" .Values.kubeScheduler.serviceMonitor.relabelings "context" $) | nindent 6 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.kubeScheduler.serviceMonitor.relabelings "context" $) | nindent 6 }}
       {{- end }}
 {{- end }}

charts/enterprise/prometheus/templates/exporters/kubelet/servicemonitor.yaml

@@ -28,7 +28,7 @@ spec:
       interval: {{ .Values.kubelet.serviceMonitor.interval }}
       {{- end }}
       {{- if .Values.kubelet.serviceMonitor.metricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
       {{- end }}
       {{- if .Values.kubelet.serviceMonitor.relabelings }}
       relabelings: {{- toYaml .Values.kubelet.serviceMonitor.relabelings | nindent 8 }}
@@ -46,7 +46,7 @@ spec:
       interval: {{ .Values.kubelet.serviceMonitor.interval }}
       {{- end }}
       {{- if .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings "context" $) | nindent 8 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings "context" $) | nindent 8 }}
       {{- end }}
       {{- if .Values.kubelet.serviceMonitor.cAdvisorRelabelings }}
       relabelings: {{- toYaml .Values.kubelet.serviceMonitor.cAdvisorRelabelings | nindent 8 }}
@@ -61,7 +61,7 @@ spec:
       interval: {{ .Values.kubelet.serviceMonitor.interval }}
       {{- end }}
       {{- if .Values.kubelet.serviceMonitor.metricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
       {{- end }}
       {{- if .Values.kubelet.serviceMonitor.relabelings }}
       relabelings: {{- toYaml .Values.kubelet.serviceMonitor.relabelings | nindent 8 }}
@@ -76,7 +76,7 @@ spec:
       interval: {{ .Values.kubelet.serviceMonitor.interval }}
       {{- end }}
       {{- if .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings "context" $) | nindent 8 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.kubelet.serviceMonitor.cAdvisorMetricRelabelings "context" $) | nindent 8 }}
       {{- end }}
       {{- if .Values.kubelet.serviceMonitor.cAdvisorRelabelings }}
       relabelings: {{- toYaml .Values.kubelet.serviceMonitor.cAdvisorRelabelings | nindent 8 }}

charts/enterprise/prometheus/templates/prometheus/_additionalScrapeJobs.tpl

@@ -8,6 +8,6 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels: {{- include "kube-prometheus.prometheus.labels" . | nindent 4 }}
 data:
-  scrape-jobs.yaml: {{ include "tc.common.tplvalues.render" ( dict "value" .Values.prometheus.additionalScrapeConfigs.internal.jobList "context" $ ) | b64enc | quote }}
+  scrape-jobs.yaml: {{ include "tc.v1.common.tplvalues.render" ( dict "value" .Values.prometheus.additionalScrapeConfigs.internal.jobList "context" $ ) | b64enc | quote }}
 {{- end }}
 {{- end }}

charts/enterprise/prometheus/templates/prometheus/_prometheus.tpl

@@ -11,24 +11,24 @@ spec:
   replicas: {{ .Values.prometheus.replicaCount }}
   serviceAccountName: {{ template "kube-prometheus.prometheus.serviceAccountName" . }}
   {{- if .Values.prometheus.serviceMonitorSelector }}
-  serviceMonitorSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.serviceMonitorSelector "context" $) | nindent 4 }}
+  serviceMonitorSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.serviceMonitorSelector "context" $) | nindent 4 }}
   {{- else }}
   serviceMonitorSelector: {}
   {{- end }}
   {{- if .Values.prometheus.podMonitorSelector }}
-  podMonitorSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.podMonitorSelector "context" $) | nindent 4 }}
+  podMonitorSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.podMonitorSelector "context" $) | nindent 4 }}
   {{- else }}
   podMonitorSelector: {}
   {{- end }}
   {{- if .Values.prometheus.probeSelector }}
-  probeSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.probeSelector "context" $) | nindent 4 }}
+  probeSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.probeSelector "context" $) | nindent 4 }}
   {{- else }}
   probeSelector: {}
   {{- end }}
   alerting:
     alertmanagers:
     {{- if .Values.prometheus.alertingEndpoints }}
-    {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.alertingEndpoints "context" $) | nindent 6 }}
+    {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.alertingEndpoints "context" $) | nindent 6 }}
     {{- else if .Values.alertmanager.enabled }}
       - namespace: {{ .Release.Namespace }}
         name: {{ template "kube-prometheus.alertmanager.fullname" . }}
@@ -41,7 +41,7 @@ spec:
   image: {{ template "kube-prometheus.prometheus.image" . }}
   {{- end }}
   {{- if .Values.prometheus.externalLabels }}
-  externalLabels: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.externalLabels "context" $) | nindent 4 }}
+  externalLabels: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.externalLabels "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.prometheusExternalLabelNameClear }}
   prometheusExternalLabelName: ""
@@ -93,47 +93,47 @@ spec:
   portName: "{{ .Values.prometheus.portName }}"
   routePrefix: "{{ .Values.prometheus.routePrefix }}"
   {{- if .Values.prometheus.secrets }}
-  secrets: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.secrets "context" $) | nindent 4 }}
+  secrets: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.secrets "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.configMaps }}
-  configMaps: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.configMaps "context" $) | nindent 4 }}
+  configMaps: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.configMaps "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.serviceMonitorNamespaceSelector }}
-  serviceMonitorNamespaceSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.serviceMonitorNamespaceSelector "context" $) | nindent 4 }}
+  serviceMonitorNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.serviceMonitorNamespaceSelector "context" $) | nindent 4 }}
   {{- else }}
   serviceMonitorNamespaceSelector: {}
   {{- end }}
   {{- if .Values.prometheus.podMonitorNamespaceSelector }}
-  podMonitorNamespaceSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.podMonitorNamespaceSelector "context" $) | nindent 4 }}
+  podMonitorNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.podMonitorNamespaceSelector "context" $) | nindent 4 }}
   {{- else }}
   podMonitorNamespaceSelector: {}
   {{- end }}
   {{- if .Values.prometheus.probeNamespaceSelector }}
-  probeNamespaceSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.probeNamespaceSelector "context" $) | nindent 4 }}
+  probeNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.probeNamespaceSelector "context" $) | nindent 4 }}
   {{- else }}
   probeNamespaceSelector: {}
   {{- end }}
   {{- if .Values.prometheus.remoteRead }}
-  remoteRead: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.remoteRead "context" $) | nindent 4 }}
+  remoteRead: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.remoteRead "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.remoteWrite }}
-  remoteWrite: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.remoteWrite "context" $) | nindent 4 }}
+  remoteWrite: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.remoteWrite "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.podSecurityContext.enabled }}
   securityContext: {{- omit .Values.prometheus.podSecurityContext "enabled" | toYaml | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.ruleNamespaceSelector }}
-  ruleNamespaceSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.ruleNamespaceSelector "context" $) | nindent 4 }}
+  ruleNamespaceSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.ruleNamespaceSelector "context" $) | nindent 4 }}
   {{- else }}
   ruleNamespaceSelector: {}
   {{- end }}
   {{- if .Values.prometheus.ruleSelector }}
-  ruleSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.ruleSelector "context" $) | nindent 4 }}
+  ruleSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.ruleSelector "context" $) | nindent 4 }}
   {{- else }}
   ruleSelector: {}
   {{- end }}
   {{- if .Values.prometheus.storageSpec }}
-  storage: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.storageSpec "context" $) | nindent 4 }}
+  storage: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.storageSpec "context" $) | nindent 4 }}
   {{- else if .Values.prometheus.persistence.enabled }}
   storage:
     volumeClaimTemplate:
@@ -145,50 +145,41 @@ spec:
         resources:
           requests:
             storage: {{ .Values.prometheus.persistence.size | quote }}
-        {{- include "tc.common.storage.storageClassName" (dict "persistence" .Values.prometheus.persistence "global" $ ) | nindent 8 }}
+        {{- with (include "tc.v1.common.lib.storage.storageClassName" (dict "persistence" .Values.prometheus.persistence "root" . )) | trim }}
+        storageClassName: {{ . }}
+        {{- end }}
   {{- end }}
   {{- if or .Values.prometheus.podMetadata.labels .Values.prometheus.podMetadata.annotations (eq .Values.prometheus.podAntiAffinityPreset "soft") (eq .Values.prometheus.podAntiAffinityPreset "hard") }}
   podMetadata:
     labels:
     {{- if .Values.prometheus.podMetadata.labels }}
-    {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.podMetadata.labels "context" $) | nindent 6 }}
+    {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.podMetadata.labels "context" $) | nindent 6 }}
     {{- end }}
     {{- if or (eq .Values.prometheus.podAntiAffinityPreset "soft") (eq .Values.prometheus.podAntiAffinityPreset "hard") }}
     {{- include "kube-prometheus.prometheus.matchLabels" . | nindent 6 }}
     {{- end }}
     {{- if .Values.prometheus.podMetadata.annotations }}
     annotations:
-    {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.podMetadata.annotations "context" $) | nindent 6 }}
+    {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.podMetadata.annotations "context" $) | nindent 6 }}
     {{- end }}
   {{- end }}
   {{- if .Values.prometheus.querySpec }}
-  query: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.querySpec "context" $) | nindent 4 }}
+  query: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.querySpec "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.affinity }}
-  affinity: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.affinity "context" $) | nindent 4 }}
+  affinity: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.affinity "context" $) | nindent 4 }}
-  {{- else }}
-  affinity:
-    {{- if not (empty .Values.prometheus.podAffinityPreset) }}
-    podAffinity: {{- include "tc.common.affinities.pods" (dict "type" .Values.prometheus.podAffinityPreset "component" "prometheus" "context" $) | nindent 6 }}
-    {{- end }}
-    {{- if not (empty .Values.prometheus.podAntiAffinityPreset) }}
-    podAntiAffinity: {{- include "tc.common.affinities.pods" (dict "type" .Values.prometheus.podAntiAffinityPreset "component" "prometheus" "context" $) | nindent 6 }}
-    {{- end }}
-    {{- if not (empty .Values.prometheus.nodeAffinityPreset.values) }}
-    nodeAffinity: {{- include "tc.common.affinities.nodes" (dict "type" .Values.prometheus.nodeAffinityPreset.type "key" .Values.prometheus.nodeAffinityPreset.key "values" .Values.prometheus.nodeAffinityPreset.values) | nindent 6 }}
-    {{- end }}
   {{- end }}
   {{- if .Values.prometheus.nodeSelector }}
-  nodeSelector: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.nodeSelector "context" $) | nindent 4 }}
+  nodeSelector: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.nodeSelector "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.tolerations }}
-  tolerations: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.tolerations "context" $) | nindent 4 }}
+  tolerations: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.tolerations "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.volumes }}
-  volumes: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.volumes "context" $) | nindent 4 }}
+  volumes: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.volumes "context" $) | nindent 4 }}
   {{- end }}
   {{- if .Values.prometheus.volumeMounts }}
-  volumeMounts: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.volumeMounts "context" $) | nindent 4 }}
+  volumeMounts: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.volumeMounts "context" $) | nindent 4 }}
   {{- end }}
   {{- if or .Values.prometheus.additionalScrapeConfigs.enabled .Values.prometheus.additionalScrapeConfigsExternal.enabled }}
   additionalScrapeConfigs:
@@ -252,7 +243,7 @@ spec:
           subPath: prometheus-db
           {{- end }}
         {{- if .Values.prometheus.thanos.extraVolumeMounts }}
-        {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.thanos.extraVolumeMounts "context" $) | nindent 8 }}
+        {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.thanos.extraVolumeMounts "context" $) | nindent 8 }}
         {{- end }}
       {{- if .Values.prometheus.thanos.containerSecurityContext.enabled }}
       # yamllint disable rule:indentation
@@ -351,7 +342,7 @@ spec:
       {{- end }}
     {{- end }}
     {{- if .Values.prometheus.containers }}
-    {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.containers "context" $) | nindent 4 }}
+    {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.containers "context" $) | nindent 4 }}
     {{- end }}
   {{- end }}
   {{- if .Values.prometheus.priorityClassName }}

charts/enterprise/prometheus/templates/prometheus/_servicemonitor.tpl

@@ -20,7 +20,7 @@ spec:
       {{- end }}
       path: {{ trimSuffix "/" .Values.prometheus.routePrefix }}/metrics
       {{- if .Values.prometheus.serviceMonitor.metricRelabelings }}
-      metricRelabelings: {{- include "tc.common.tplvalues.render" ( dict "value" .Values.prometheus.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
+      metricRelabelings: {{- include "tc.v1.common.tplvalues.render" ( dict "value" .Values.prometheus.serviceMonitor.metricRelabelings "context" $) | nindent 8 }}
       {{- end }}
       {{- if .Values.prometheus.serviceMonitor.relabelings }}
       relabelings: {{- toYaml .Values.prometheus.serviceMonitor.relabelings | nindent 8 }}

charts/enterprise/prometheus/templates/prometheus/serviceaccount.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels: {{- include "kube-prometheus.prometheus.labels" . | nindent 4 }}
   {{- if index .Values.prometheus.serviceAccount "annotations" }}
-  annotations: {{- include "tc.common.tplvalues.render" (dict "value" .Values.prometheus.serviceAccount.annotations "context" $) | nindent 4 }}
+  annotations: {{- include "tc.v1.common.tplvalues.render" (dict "value" .Values.prometheus.serviceAccount.annotations "context" $) | nindent 4 }}
   {{- end }}
 {{- include "kube-prometheus.imagePullSecrets" . }}
 {{- end }}

charts/enterprise/prometheus/values.yaml

@@ -12,23 +12,34 @@ alertmanagerImage:
 
 global:
   labels: {}
-
+workload:
-controller:
+  main:
-  enabled: false
+    enabled: false
+    podSpec:
+      containers:
+        main:
+          enabled: false
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+            startup:
+              enabled: false
 
 service:
   main:
-    selector:
+    selectorLabels:
       app.kubernetes.io/name: prometheus
       prometheus: '{{ template "kube-prometheus.prometheus.fullname" . }}'
     ports:
       main:
         port: 10086
         targetPort: 9090
-        protocol: HTTP
+        protocol: http
   alertmanager:
     enabled: true
-    selector:
+    selectorLabels:
       app.kubernetes.io/name: alertmanager
       alertmanager: '{{ template "kube-prometheus.alertmanager.fullname" . }}'
     ports:
@@ -36,10 +47,10 @@ service:
         enabled: true
         port: 10087
         targetPort: 9093
-        protocol: HTTP
+        protocol: http
   thanos:
     enabled: true
-    selector:
+    selectorLabels:
       app.kubernetes.io/name: prometheus
       prometheus: '{{ template "kube-prometheus.prometheus.fullname" . }}'
     ports:
@@ -47,7 +58,7 @@ service:
         enabled: true
         port: 10901
         targetPort: 10901
-        protocol: HTTP
+        protocol: http
 
 ingress:
   main:
@@ -67,10 +78,14 @@ env:
       name: prometheus-operator-config
       key: prometheus-config-reloader
 
-# -- Whether Role Based Access Control objects like roles and rolebindings should be created
+podOptions:
+  automountServiceAccountToken: true
+
 rbac:
   main:
     enabled: true
+    primary: true
+    clusterWide: true
     rules:
       - apiGroups:
           - apiextensions.k8s.io
@@ -168,6 +183,7 @@ rbac:
 serviceAccount:
   main:
     enabled: true
+    primary: true
 
 securityContext:
   readOnlyRootFilesystem: false
@@ -812,7 +828,7 @@ prometheus:
       ##   - name: http
       ##     port: 10902
       ##     targetPort: http
-      ##     protocol: TCP
+      ##     protocol: tcp
       ##
       extraPorts: []
   ## @param prometheus.portName Port name used for the pods and governing service. This defaults to web
@@ -1361,4 +1377,5 @@ kubeProxy:
   enabled: false
 
 portal:
-  enabled: true
+  open:
+    enabled: true

charts/enterprise/traefik/Chart.yaml

@@ -3,7 +3,7 @@ appVersion: "2.9.8"
 dependencies:
   - name: common
     repository: https://library-charts.truecharts.org
-    version: 11.1.2
+    version: 12.2.7
 deprecated: false
 description: Traefik is a flexible reverse proxy and Ingress Provider.
 home: https://truecharts.org/charts/enterprise/traefik
@@ -24,7 +24,7 @@ sources:
   - https://github.com/traefik/traefik-helm-chart
   - https://traefik.io/
 type: application
-version: 16.0.16
+version: 17.0.0
 annotations:
   truecharts.org/catagories: |
     - network

charts/enterprise/traefik/questions.yaml

@@ -378,16 +378,16 @@ questions:
                 schema:
                   type: int
                   default: 568
-        - variable: runAsGroup
+              - variable: runAsGroup
-          label: "runAsGroup"
+                label: "runAsGroup"
-          description: "The groupID this App of the user running the application"
+                description: "The groupID of the user running the application"
-          schema:
+                schema:
-            type: int
+                  type: int
-            default: 568
+                  default: 568
 # Include{securityContextContainer}
 # Include{securityContextAdvanced}
 # Include{securityContextPod}
-             - variable: fsGroup
+              - variable: fsGroup
                 label: "fsGroup"
                 description: "The group that should own ALL storage."
                 schema:

charts/enterprise/traefik/templates/NOTES.txt

@@ -0,0 +1 @@
+{{- include "tc.v1.common.lib.chart.notes" $ -}}

charts/enterprise/traefik/templates/_args.tpl

@@ -16,8 +16,8 @@ args:
   {{- end }}
   {{- range $name, $config := $ports }}
   {{- if $config }}
-  {{- if or ( eq $config.protocol "HTTP" ) ( eq $config.protocol "HTTPS" ) ( eq $config.protocol "TCP" ) }}
+  {{- if or ( eq $config.protocol "http" ) ( eq $config.protocol "https" ) ( eq $config.protocol "tcp" ) }}
-  {{- $_ := set $config "protocol" "TCP" }}
+  {{- $_ := set $config "protocol" "tcp" }}
   {{- end }}
   - "--entryPoints.{{$name}}.address=:{{ $config.port }}/{{ default "tcp" $config.protocol | lower }}"
   {{- end }}
@@ -98,8 +98,8 @@ args:
   - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https"
   {{- end }}
   {{- end }}
-  {{- if or ( $config.tls ) ( eq $config.protocol "HTTPS" ) }}
+  {{- if or ( $config.tls ) ( eq $config.protocol "https" ) }}
-  {{- if or ( $config.tls.enabled ) ( eq $config.protocol "HTTPS" ) }}
+  {{- if or ( $config.tls.enabled ) ( eq $config.protocol "https" ) }}
   - "--entrypoints.{{ $entrypoint }}.http.tls=true"
   {{- if $config.tls.options }}
   - "--entrypoints.{{ $entrypoint }}.http.tls.options={{ $config.tls.options }}"

charts/enterprise/traefik/templates/_helpers.tpl

@@ -5,7 +5,7 @@ service generated.
 Users can provide an override for an explicit service they want bound via `.Values.providers.kubernetesIngress.publishedService.pathOverride`
 */}}
 {{- define "providers.kubernetesIngress.publishedServicePath" -}}
-{{- $fullName := include "tc.common.names.fullname" . -}}
+{{- $fullName := include "tc.v1.common.lib.chart.names.fullname" . -}}
 {{- $defServiceName := printf "%s/%s-tcp" .Release.Namespace $fullName -}}
 {{- $servicePath := default $defServiceName .Values.providers.kubernetesIngress.publishedService.pathOverride }}
 {{- print $servicePath | trimSuffix "-" -}}

charts/enterprise/traefik/templates/_ingressroute.tpl

@@ -1,17 +1,26 @@
 {{/* Define the ingressRoute */}}
 {{- define "traefik.ingressRoute" -}}
 {{ if .Values.ingressRoute.dashboard.enabled }}
+
+{{- $ingressRouteLabels := .Values.ingressRoute.dashboard.labels -}}
+{{- $ingressRouteAnnotations := .Values.ingressRoute.dashboard.annotations -}}
+
 ---
 apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
-  name: {{ include "tc.common.names.fullname" . }}-dashboard
+  name: {{ include "tc.v1.common.lib.chart.names.fullname" . }}-dashboard
-  annotations:
+  {{- $labels := (mustMerge ($ingressRouteLabels | default dict) (include "tc.v1.common.lib.metadata.allLabels" $ | fromYaml)) -}}
-  {{- with .Values.ingressRoute.dashboard.annotations }}
+  {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "labels" $labels) | trim) }}
-  {{- toYaml . | nindent 4 }}
-  {{- end }}
   labels:
-    {{- include "tc.common.labels" . | nindent 4 }}
+    {{- . | nindent 4 }}
+  {{- end }}
+  {{- $annotations := (mustMerge ($ingressRouteAnnotations | default dict) (include "tc.v1.common.lib.metadata.allAnnotations" $ | fromYaml)) -}}
+  {{- with (include "tc.v1.common.lib.metadata.render" (dict "rootCtx" $ "annotations" $annotations) | trim) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+
 spec:
   entryPoints:
     - main

charts/enterprise/traefik/templates/common.yaml

@@ -1,18 +1,11 @@
 {{/* Make sure all variables are set properly */}}
-{{- include "tc.common.loader.init" . }}
+{{- include "tc.v1.common.loader.init" . }}
 
-{{- if .Values.metrics }}
-{{- if .Values.metrics.prometheus }}
-{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "true" -}}
-{{- $_ := set .Values.podAnnotations "prometheus.io/path" "/metrics" -}}
-{{- $_ := set .Values.podAnnotations "prometheus.io/port" "9180" -}}
-{{- end }}
-{{- end }}
 
 {{- $newArgs :=  (include "traefik.args" . | fromYaml) }}
 {{- $_ := set .Values "newArgs" $newArgs -}}
-{{- $mergedargs := concat .Values.args .Values.newArgs.args }}
+{{- $mergedargs := concat $.Values.workload.main.podSpec.containers.main.args .Values.newArgs.args }}
-{{- $_ := set .Values "args" $mergedargs -}}
+{{- $_ := set $.Values.workload.main.podSpec.containers.main "args" $mergedargs -}}
 
 {{- include "traefik.portalhook" . }}
 {{- include "traefik.tlsOptions" . }}
@@ -21,4 +14,4 @@
 
 
 {{/* Render the templates */}}
-{{ include "tc.common.loader.apply" . }}
+{{ include "tc.v1.common.loader.apply" . }}

charts/enterprise/traefik/values.yaml

@@ -4,6 +4,50 @@ image:
   tag: 2.9.8@sha256:4a2d3dda380990d825532e661b42457fc9871061dbc22b310468616378214a2e
   pullPolicy: IfNotPresent
 
+workload:
+  main:
+    replicas: 2
+    strategy: RollingUpdate
+    podSpec:
+      containers:
+        main:
+          args: []
+          probes:
+            # -- Liveness probe configuration
+            # @default -- See below
+            liveness:
+              # -- sets the probe type when not using a custom probe
+              # @default -- "TCP"
+              type: tcp
+              # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
+              # @default -- "/"
+              # path: "/ping"
+
+            # -- Redainess probe configuration
+            # @default -- See below
+            readiness:
+              # -- sets the probe type when not using a custom probe
+              # @default -- "TCP"
+              type: tcp
+              # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
+              # @default -- "/"
+              # path: "/ping"
+
+            # -- Startup probe configuration
+            # @default -- See below
+            startup:
+              # -- sets the probe type when not using a custom probe
+              # @default -- "TCP"
+              type: tcp
+              # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
+              # @default -- "/"
+              # path: "/ping"
+
+# -- Options for all pods
+# Can be overruled per pod
+podOptions:
+  automountServiceAccountToken: true
+
 # -- Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x
 ingressClass:
   # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12
@@ -20,12 +64,6 @@ ingressRoute:
     annotations: {}
     # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels)
     labels: {}
-
-podAnnotations:
-  prometheus.io/scrape: "true"
-  prometheus.io/path: "/metrics"
-  prometheus.io/port: "9180"
-
 #
 # -- Configure providers
 providers:
@@ -140,7 +178,7 @@ service:
       main:
         port: 9000
         targetPort: 9000
-        protocol: HTTP
+        protocol: http
         # -- Forwarded Headers should never be enabled on Main entrypoint
         forwardedHeaders:
           enabled: false
@@ -154,7 +192,7 @@ service:
       web:
         enabled: true
         port: 9080
-        protocol: HTTP
+        protocol: http
         redirectTo: websecure
         # Options: Empty, 0 (ingore), or positive int
         # redirectPort:
@@ -175,7 +213,7 @@ service:
       websecure:
         enabled: true
         port: 9443
-        protocol: HTTPS
+        protocol: https
         # -- Configure (Forwarded Headers)[https://doc.traefik.io/traefik/routing/entrypoints/#forwarded-headers] Support
         forwardedHeaders:
           enabled: false
@@ -193,7 +231,7 @@ service:
   #      tcpexample:
   #        enabled: true
   #        targetPort: 9443
-  #        protocol: TCP
+  #        protocol: tcp
   #        tls:
   #          enabled: false
   #          # this is the name of a TLSOption definition
@@ -212,51 +250,22 @@ service:
         enabled: true
         port: 9180
         targetPort: 9180
-        protocol: HTTP
+        protocol: http
         # -- Forwarded Headers should never be enabled on Metrics entrypoint
         forwardedHeaders:
           enabled: false
         # -- Proxy Protocol should never be enabled on Metrics entrypoint
         proxyProtocol:
           enabled: false
-  udp:
+  # udp:
-    enabled: false
+  #   enabled: false
-
-# probes:
-#   # -- Liveness probe configuration
-#   # @default -- See below
-#   liveness:
-#     # -- sets the probe type when not using a custom probe
-#     # @default -- "TCP"
-#     type: HTTP
-#     # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
-#     # @default -- "/"
-#     path: "/ping"
-
-#   # -- Redainess probe configuration
-#   # @default -- See below
-#   readiness:
-#     # -- sets the probe type when not using a custom probe
-#     # @default -- "TCP"
-#     type: HTTP
-#     # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
-#     # @default -- "/"
-#     path: "/ping"
-
-#   # -- Startup probe configuration
-#   # @default -- See below
-#   startup:
-#     # -- sets the probe type when not using a custom probe
-#     # @default -- "TCP"
-#     type: HTTP
-#     # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used
-#     # @default -- "/"
-#     path: "/ping"
 
 # -- Whether Role Based Access Control objects like roles and rolebindings should be created
 rbac:
   main:
     enabled: true
+    primary: true
+    clusterWide: true
     rules:
       - apiGroups:
           - ""
@@ -306,6 +315,7 @@ rbac:
 serviceAccount:
   main:
     enabled: true
+    primary: true
 
 # -- SCALE Middleware Handlers
 middlewares:
@@ -404,4 +414,5 @@ persistence:
     type: emptyDir
 
 portal:
-  enabled: true
+  open:
+    enabled: true

charts/enterprise/vaultwarden/.helmignore

@@ -0,0 +1,30 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# OWNERS file for Kubernetes
+OWNERS
+# helm-docs templates
+*.gotmpl
+# docs folder
+/docs
+# icon
+icon.png

charts/enterprise/vaultwarden/Chart.yaml

@@ -0,0 +1,34 @@
+apiVersion: v2
+appVersion: "1.27.0"
+dependencies:
+  - name: common
+    repository: https://library-charts.truecharts.org
+    version: 12.2.9
+deprecated: false
+description: Unofficial Bitwarden compatible server written in Rust
+home: https://truecharts.org/charts/stable/vaultwarden
+icon: https://truecharts.org/img/hotlink-ok/chart-icons/vaultwarden.png
+keywords:
+  - bitwarden
+  - bitwardenrs
+  - bitwarden_rs
+  - vaultwarden
+  - password
+  - rust
+kubeVersion: ">=1.16.0-0"
+maintainers:
+  - email: info@truecharts.org
+    name: TrueCharts
+    url: https://truecharts.org
+name: vaultwarden
+sources:
+  - https://github.com/truecharts/charts/tree/master/charts/stable/vaultwarden
+  - https://hub.docker.com/r/vaultwarden/server
+  - https://github.com/dani-garcia/vaultwarden
+type: application
+version: 20.0.0
+annotations:
+  truecharts.org/catagories: |
+    - security
+  truecharts.org/SCALE-support: "true"
+  truecharts.org/grade: U

charts/enterprise/vaultwarden/LICENSE

@@ -0,0 +1,106 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             The TrueCharts Project, it's owner and it's contributors
+Licensed Work:        The TrueCharts "Cert-Manager" Helm Chart
+Additional Use Grant: You may use the licensed work in production, as long
+                      as it is directly sourced from a TrueCharts provided
+                      official repository, catalog or source. You may also make private
+                      modification to the directly sourced licenced work,
+                      when used in production.
+
+                      The following cases are, due to their nature, also
+                      defined as 'production use' and explicitly prohibited:
+                      - Bundling, including or displaying the licensed work
+                      with(in) another work intended for production use,
+                      with the apparent intend of facilitating and/or
+                      promoting production use by third parties in
+                      violation of this license.
+
+Change Date:          2050-01-01
+
+Change License:       3-clause BSD license
+
+For information about alternative licensing arrangements for the Software,
+please contact: legal@truecharts.org
+
+Notice
+
+The Business Source License (this document, or the “License”) is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
+“Business Source License” is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN “AS IS” BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark “Business Source License”,
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the “Business
+Source License” name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where “compatible” means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text “None”.
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

charts/enterprise/vaultwarden/README.md

@@ -0,0 +1,27 @@
+# README
+
+## General Info
+
+TrueCharts can be installed as both *normal* Helm Charts or as Apps on TrueNAS SCALE.
+However only installations using the TrueNAS SCALE Apps system are supported.
+
+For more information about this App, please check the docs on the TrueCharts [website](https://truecharts.org/charts/stable/)
+
+**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/charts/issues/new/choose)**
+
+
+## Support
+
+- Please check our [quick-start guides for TrueNAS SCALE](https://truecharts.org/manual/SCALE%20Apps/Important-MUST-READ).
+- See the [Website](https://truecharts.org)
+- Check our [Discord](https://discord.gg/tVsPTHWTtr)
+- Open a [issue](https://github.com/truecharts/charts/issues/new/choose)
+
+---
+
+## Sponsor TrueCharts
+
+TrueCharts can only exist due to the incredible effort of our staff.
+Please consider making a [donation](https://truecharts.org/sponsor) or contributing back to the project any way you can!
+
+*All Rights Reserved - The TrueCharts Project*

charts/enterprise/vaultwarden/ci/ingress-values.yaml

@@ -0,0 +1,7 @@
+# -- Configure the ingresses for the chart here.
+# Additional ingresses can be added by adding a dictionary key similar to the 'main' ingress.
+# @default -- See below
+ingress:
+  main:
+    # -- Enables or disables the ingress
+    enabled: true

charts/enterprise/vaultwarden/questions.yaml

@@ -0,0 +1,410 @@
+# Include{groups}
+portals:
+  open:
+# Include{portalLink}
+  admin:
+# Include{portalLink}
+    path: "/admin/"
+questions:
+# Include{global}
+# Include{workload}
+# Include{workloadDeployment}
+# Include{replicas1}
+# Include{podSpec}
+# Include{containerMain}
+# Include{containerBasic}
+# Include{containerAdvanced}
+# Include{containerConfig}
+  - variable: vaultwarden
+    label: ""
+    group: "App Configuration"
+    schema:
+      additional_attrs: true
+      type: dict
+      attrs:
+        - variable: yubico
+          label: "Yubico OTP authentication"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+              - variable: enabled
+                label: "Enable Yubico OTP authentication"
+                description: "Please refer to the manual at: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-Yubikey-OTP-authentication"
+                schema:
+                  type: boolean
+                  default: false
+                  show_subquestions_if: true
+                  subquestions:
+                    - variable: server
+                      label: "Yubico server"
+                      description: "Defaults to YubiCloud"
+                      schema:
+                        type: string
+                        default: ""
+                    - variable: clientId
+                      label: "Yubico ID"
+                      schema:
+                        type: string
+                        default: ""
+                    - variable: secretKey
+                      label: "Yubico Secret Key"
+                      schema:
+                        type: string
+                        default: ""
+        - variable: admin
+          label: "Admin Portal"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+              - variable: enabled
+                label: "Enable Admin Portal"
+                schema:
+                  type: boolean
+                  default: false
+                  show_subquestions_if: true
+                  subquestions:
+                    - variable: disableAdminToken
+                      label: "Make Accessible Without Password/Token"
+                      schema:
+                        type: boolean
+                        default: false
+                    - variable: token
+                      label: "Admin Portal Password/Token"
+                      description: "Will be automatically generated if not defined"
+                      schema:
+                        type: string
+                        default: ""
+        - variable: icons
+          label: "Icon Download Settings"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+              - variable: disableDownload
+                label: "Disable Icon Download"
+                description: "Disables download of external icons. Setting to true will still serve icons from cache (/data/icon_cache)"
+                schema:
+                  type: boolean
+                  default: false
+              - variable: cache
+                label: "Cache time-to-live"
+                description: "Cache time-to-live for icons fetched. 0 means no purging"
+                schema:
+                  type: int
+                  default: 2592000
+              - variable: token
+                label: "Failed Downloads Cache time-to-live"
+                description: "Cache time-to-live for icons that were not available. 0 means no purging."
+                schema:
+                  type: int
+                  default: 2592000
+        - variable: log
+          label: "Logging"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+              - variable: level
+                label: "Log level"
+                schema:
+                  type: string
+                  default: "info"
+                  required: true
+                  enum:
+                    - value: "trace"
+                      description: "trace"
+                    - value: "debug"
+                      description: "debug"
+                    - value: "info"
+                      description: "info"
+                    - value: "warn"
+                      description: "warn"
+                    - value: "error"
+                      description: "error"
+                    - value: "off"
+                      description: "off"
+              - variable: file
+                label: "Log-File Location"
+                schema:
+                  type: string
+                  default: ""
+        - variable: smtp
+          label: "SMTP Settings (Email)"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+              - variable: enabled
+                label: "Enable SMTP Support"
+                schema:
+                  type: boolean
+                  default: false
+                  show_subquestions_if: true
+                  subquestions:
+                    - variable: host
+                      label: "SMTP hostname"
+                      schema:
+                        type: string
+                        required: true
+                        default: ""
+                    - variable: from
+                      label: "SMTP sender e-mail address"
+                      schema:
+                        type: string
+                        required: true
+                        default: ""
+                    - variable: fromName
+                      label: "SMTP sender name"
+                      schema:
+                        type: string
+                        required: true
+                        default: ""
+                    - variable: user
+                      label: "SMTP username"
+                      schema:
+                        type: string
+                        required: true
+                        default: ""
+                    - variable: password
+                      label: "SMTP password"
+                      description: "Required is user is specified, ignored if no user provided"
+                      schema:
+                        type: string
+                        default: ""
+                    - variable: ssl
+                      label: "Enable SSL connection"
+                      schema:
+                        type: boolean
+                        default: true
+                    - variable: port
+                      label: "SMTP port"
+                      description: "Usually: 25 without SSL, 587 with SSL"
+                      schema:
+                        type: int
+                        default: 587
+                    - variable: authMechanism
+                      label: "SMTP Authentication Mechanisms"
+                      description: "Comma-separated options: Plain, Login and Xoauth2"
+                      schema:
+                        type: string
+                        default: "Plain"
+                    - variable: heloName
+                      label: "SMTP HELO - Hostname"
+                      description: "Hostname to be sent for SMTP HELO. Defaults to pod name"
+                      schema:
+                        type: string
+                        default: ""
+                    - variable: timeout
+                      label: "SMTP timeout"
+                      schema:
+                        type: int
+                        default: 15
+                    - variable: invalidHostname
+                      label: "Accept Invalid Hostname"
+                      description: "Accept SSL session if certificate is valid but hostname doesn't match. DANGEROUS, vulnerable to men-in-the-middle attacks!"
+                      schema:
+                        type: boolean
+                        default: false
+                    - variable: invalidCertificate
+                      label: "Accept Invalid Certificate"
+                      description: "Accept invalid certificates. DANGEROUS, vulnerable to men-in-the-middle attacks!"
+                      schema:
+                        type: boolean
+                        default: false
+        - variable: allowSignups
+          label: "Allow Signup"
+          description: "Allow any user to sign-up: https://github.com/dani-garcia/vaultwarden/wiki/Disable-registration-of-new-users"
+          schema:
+            type: boolean
+            default: true
+        - variable: allowInvitation
+          label: "Always allow Invitation"
+          description: "Allow invited users to sign-up even feature is disabled: https://github.com/dani-garcia/vaultwarden/wiki/Disable-invitations"
+          schema:
+            type: boolean
+            default: true
+        - variable: defaultInviteName
+          label: "Default Invite Organisation Name"
+          description: "Default organization name in invitation e-mails that are not coming from a specific organization."
+          schema:
+            type: string
+            default: ""
+        - variable: showPasswordHint
+          label: "Show password hints"
+          description: "https://github.com/dani-garcia/vaultwarden/wiki/Password-hint-display"
+          schema:
+            type: boolean
+            default: true
+        - variable: signupwhitelistenable
+          label: "Enable Signup Whitelist"
+          description: "allowSignups is ignored if set"
+          schema:
+            type: boolean
+            default: false
+            show_subquestions_if: true
+            subquestions:
+              - variable: signupDomains
+                label: "Signup Whitelist Domains"
+                schema:
+                  type: list
+                  default: []
+                  items:
+                    - variable: domain
+                      label: "Domain"
+                      schema:
+                        type: string
+                        default: ""
+        - variable: verifySignup
+          label: "Verifiy Signup"
+          description: "Verify e-mail before login is enabled. SMTP must be enabled"
+          schema:
+            type: boolean
+            default: false
+        - variable: requireEmail
+          label: "Block Login if email fails"
+          description: "When a user logs in an email is required to be sent. If sending the email fails the login attempt will fail. SMTP must be enabled"
+          schema:
+            type: boolean
+            default: false
+        - variable: emailAttempts
+          label: "Email token reset attempts"
+          description: "Maximum attempts before an email token is reset and a new email will need to be sent"
+          schema:
+            type: int
+            default: 3
+        - variable: emailTokenExpiration
+          label: "Email token validity in seconds"
+          schema:
+            type: int
+            default: 600
+        - variable: enableWebVault
+          label: "Enable Webvault"
+          description: "Enable Web Vault (static content). https://github.com/dani-garcia/vaultwarden/wiki/Disabling-or-overriding-the-Vault-interface-hosting"
+          schema:
+            type: boolean
+            default: true
+        - variable: orgCreationUsers
+          label: "Limit Organisation Creation to (users)"
+          description: "Restrict creation of orgs. Options are: 'all', 'none' or a comma-separated list of users."
+          schema:
+            type: string
+            default: "all"
+        - variable: attachmentLimitOrg
+          label: "Limit Attachment Disk Usage per Organisation"
+          schema:
+            type: string
+            default: ""
+        - variable: attachmentLimitUser
+          label: "Limit Attachment Disk Usage per User"
+          schema:
+            type: string
+            default: ""
+        - variable: hibpApiKey
+          label: "HaveIBeenPwned API Key"
+          description: "Can be purchased at https://haveibeenpwned.com/API/Key"
+          schema:
+            type: string
+            default: ""
+# Include{serviceRoot}
+        - variable: main
+          label: "Main Service"
+          description: "The Primary service on which the healthcheck runs, often the webUI"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{serviceSelectorLoadBalancer}
+# Include{serviceSelectorExtras}
+                    - variable: main
+                      label: "Main Service Port Configuration"
+                      schema:
+                        additional_attrs: true
+                        type: dict
+                        attrs:
+                          - variable: port
+                            label: "Port"
+                            description: "This port exposes the container port on the service"
+                            schema:
+                              type: int
+                              default: 10102
+                              required: true
+        - variable: ws
+          label: "WebSocket Service"
+          description: "WebSocket Service"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{serviceSelectorLoadBalancer}
+# Include{serviceSelectorExtras}
+                    - variable: ws
+                      label: "WebSocket Service Port Configuration"
+                      schema:
+                        additional_attrs: true
+                        type: dict
+                        attrs:
+                          - variable: port
+                            label: "Port"
+                            description: "This port exposes the container port on the service"
+                            schema:
+                              type: int
+                              default: 3012
+                              required: true
+# Include{serviceExpertRoot}
+            default: false
+# Include{serviceExpert}
+# Include{serviceList}
+# Include{persistenceRoot}
+        - variable: data
+          label: "App Config Storage"
+          description: "Stores the Application Configuration."
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{persistenceBasic}
+# Include{persistenceList}
+# Include{ingressRoot}
+        - variable: main
+          label: "Main Ingress"
+          schema:
+            additional_attrs: true
+            type: dict
+            attrs:
+# Include{ingressDefault}
+# Include{ingressTLS}
+# Include{ingressTraefik}
+# Include{ingressList}
+# Include{securityContextRoot}
+              - variable: runAsUser
+                label: "runAsUser"
+                description: "The UserID of the user running the application"
+                schema:
+                  type: int
+                  default: 568
+              - variable: runAsGroup
+                label: "runAsGroup"
+                description: "The groupID of the user running the application"
+                schema:
+                  type: int
+                  default: 568
+# Include{securityContextContainer}
+# Include{securityContextAdvanced}
+# Include{securityContextPod}
+              - variable: fsGroup
+                label: "fsGroup"
+                description: "The group that should own ALL storage."
+                schema:
+                  type: int
+                  default: 568
+# Include{resources}
+# Include{advanced}
+# Include{postgresql}
+# Include{postgresqlBasics}
+# Include{addons}
+# Include{codeserver}
+# Include{vpn}
+# Include{netshoot}
+# Include{documentation}

charts/enterprise/vaultwarden/templates/NOTES.txt

@@ -0,0 +1 @@
+{{- include "tc.v1.common.lib.chart.notes" $ -}}

charts/enterprise/vaultwarden/templates/_configmap.tpl

@@ -0,0 +1,112 @@
+{{/* Define the configmap */}}
+{{- define "vaultwarden.configmap" -}}
+enabled: true
+data:
+  ROCKET_PORT: "8080"
+  SIGNUPS_ALLOWED: {{ .Values.vaultwarden.allowSignups | quote }}
+  {{- if .Values.vaultwarden.signupDomains }}
+  SIGNUPS_DOMAINS_WHITELIST: {{ join "," .Values.vaultwarden.signupDomains | quote }}
+  {{- end }}
+  {{- if and (eq .Values.vaultwarden.verifySignup true) (eq .Values.vaultwarden.smtp.enabled false) }}{{ required "Signup verification requires SMTP to be enabled" nil}}{{end}}
+  SIGNUPS_VERIFY: {{ .Values.vaultwarden.verifySignup | quote }}
+  {{- if and (eq .Values.vaultwarden.requireEmail true) (eq .Values.vaultwarden.smtp.enabled false) }}{{ required "Requiring emails for login depends on SMTP" nil}}{{end}}
+  REQUIRE_DEVICE_EMAIL: {{ .Values.vaultwarden.requireEmail | quote }}
+  {{- if .Values.vaultwarden.emailAttempts }}
+  EMAIL_ATTEMPTS_LIMIT: {{ .Values.vaultwarden.emailAttempts | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.emailTokenExpiration }}
+  EMAIL_EXPIRATION_TIME: {{ .Values.vaultwarden.emailTokenExpiration | quote }}
+  {{- end }}
+  INVITATIONS_ALLOWED: {{ .Values.vaultwarden.allowInvitation | quote }}
+  {{- if .Values.vaultwarden.defaultInviteName }}
+  INVITATION_ORG_NAME: {{ .Values.vaultwarden.defaultInviteName | quote }}
+  {{- end }}
+  SHOW_PASSWORD_HINT: {{ .Values.vaultwarden.showPasswordHint | quote }}
+  WEBSOCKET_ENABLED: {{ .Values.vaultwarden.enableWebsockets | quote }}
+  WEB_VAULT_ENABLED: {{ .Values.vaultwarden.enableWebVault | quote }}
+  ORG_CREATION_USERS: {{ .Values.vaultwarden.orgCreationUsers | quote }}
+  {{- if .Values.vaultwarden.attachmentLimitOrg }}
+  ORG_ATTACHMENT_LIMIT: {{ .Values.vaultwarden.attachmentLimitOrg | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.attachmentLimitUser }}
+  USER_ATTACHMENT_LIMIT: {{ .Values.vaultwarden.attachmentLimitUser | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.hibpApiKey }}
+  HIBP_API_KEY: {{ .Values.vaultwarden.hibpApiKey | quote }}
+  {{- end }}
+  {{- include "vaultwarden.dbTypeValid" . }}
+  {{- if .Values.database.retries }}
+  DB_CONNECTION_RETRIES: {{ .Values.database.retries | quote }}
+  {{- end }}
+  {{- if .Values.database.maxConnections }}
+  DATABASE_MAX_CONNS: {{ .Values.database.maxConnections | quote }}
+  {{- end }}
+  {{- if eq .Values.vaultwarden.smtp.enabled true }}
+  SMTP_HOST: {{ required "SMTP host is required to enable SMTP" .Values.vaultwarden.smtp.host | quote }}
+  SMTP_FROM: {{ required "SMTP sender address ('from') is required to enable SMTP" .Values.vaultwarden.smtp.from | quote }}
+  {{- if .Values.vaultwarden.smtp.fromName }}
+  SMTP_FROM_NAME: {{ .Values.vaultwarden.smtp.fromName | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.smtp.ssl }}
+  SMTP_SSL: {{ .Values.vaultwarden.smtp.ssl | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.smtp.port }}
+  SMTP_PORT: {{ .Values.vaultwarden.smtp.port | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.smtp.authMechanism }}
+  SMTP_AUTH_MECHANISM: {{ .Values.vaultwarden.smtp.authMechanism | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.smtp.heloName }}
+  HELO_NAME: {{ .Values.vaultwarden.smtp.heloName | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.smtp.timeout }}
+  SMTP_TIMEOUT: {{ .Values.vaultwarden.smtp.timeout | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.smtp.invalidHostname }}
+  SMTP_ACCEPT_INVALID_HOSTNAMES: {{ .Values.vaultwarden.smtp.invalidHostname | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.smtp.invalidCertificate }}
+  SMTP_ACCEPT_INVALID_CERTS: {{ .Values.vaultwarden.smtp.invalidCertificate | quote }}
+  {{- end }}
+  {{- end }}
+  {{- if .Values.vaultwarden.log.file }}
+  LOG_FILE: {{ .Values.vaultwarden.log.file | quote }}
+  {{- end }}
+  {{- if or .Values.vaultwarden.log.level .Values.vaultwarden.log.timeFormat }}
+  EXTENDED_LOGGING: "true"
+  {{- end }}
+  {{- if .Values.vaultwarden.log.level }}
+  {{- include "vaultwarden.logLevelValid" . }}
+  LOG_LEVEL: {{ .Values.vaultwarden.log.level | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.log.timeFormat }}
+  LOG_TIMESTAMP_FORMAT: {{ .Values.vaultwarden.log.timeFormat | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.icons.disableDownload }}
+  DISABLE_ICON_DOWNLOAD: {{ .Values.vaultwarden.icons.disableDownload | quote }}
+  {{- if and (not .Values.vaultwarden.icons.cache) (eq .Values.vaultwarden.icons.disableDownload "true") }}
+  ICON_CACHE_TTL: "0"
+  {{- end }}
+  {{- end }}
+  {{- if .Values.vaultwarden.icons.cache }}
+  ICON_CACHE_TTL: {{ .Values.vaultwarden.icons.cache | quote }}
+  {{- end }}
+  {{- if .Values.vaultwarden.icons.cacheFailed }}
+  ICON_CACHE_NEGTTL: {{ .Values.vaultwarden.icons.cacheFailed | quote }}
+  {{- end }}
+  {{- if eq .Values.vaultwarden.admin.enabled true }}
+  {{- if eq .Values.vaultwarden.admin.disableAdminToken true }}
+  DISABLE_ADMIN_TOKEN: "true"
+  {{- end }}
+  {{- end }}
+  {{- if eq .Values.vaultwarden.yubico.enabled true }}
+  {{- if .Values.vaultwarden.yubico.server }}
+  YUBICO_SERVER: {{ .Values.vaultwarden.yubico.server | quote }}
+  {{- end }}
+  {{- end }}
+  {{- if eq .Values.database.type "sqlite" }}
+  ENABLE_DB_WAL: {{ .Values.database.wal | quote }}
+  {{- else }}
+  ENABLE_DB_WAL: "false"
+  {{- end }}
+{{- end -}}

charts/enterprise/vaultwarden/templates/_secrets.tpl

@@ -0,0 +1,32 @@
+{{/* Define the secrets */}}
+{{- define "vaultwarden.secrets" -}}
+
+{{- $adminToken := "" }}
+{{- if eq .Values.vaultwarden.admin.enabled true }}
+{{- $adminToken = .Values.vaultwarden.admin.token | default (randAlphaNum 48) | b64enc | quote }}
+{{- end -}}
+
+{{- $smtpUser := "" }}
+{{- if and (eq .Values.vaultwarden.smtp.enabled true ) (.Values.vaultwarden.smtp.user) }}
+{{- $smtpUser = .Values.vaultwarden.smtp.user | b64enc | quote }}
+{{- end -}}
+
+{{- $yubicoClientId := "" }}
+{{- if eq .Values.vaultwarden.yubico.enabled true }}
+{{- $yubicoClientId = required "Yubico Client ID required" .Values.vaultwarden.yubico.clientId | toString | b64enc | quote }}
+{{- end -}}
+enabled: true
+data:
+  placeholder: placeholdervalue
+  {{- if ne $adminToken "" }}
+  ADMIN_TOKEN: {{ $adminToken }}
+  {{- end }}
+  {{- if ne $smtpUser "" }}
+  SMTP_USERNAME: {{ $smtpUser }}
+  SMTP_PASSWORD: {{ required "Must specify SMTP password" .Values.vaultwarden.smtp.password | b64enc | quote }}
+  {{- end }}
+  {{- if ne $yubicoClientId "" }}
+  YUBICO_CLIENT_ID: {{ $yubicoClientId }}
+  YUBICO_SECRET_KEY: {{ required "Yubico Secret Key required" .Values.vaultwarden.yubico.secretKey | b64enc | quote }}
+  {{- end }}
+{{- end -}}

charts/enterprise/vaultwarden/templates/_validate.tpl

@@ -0,0 +1,17 @@
+{{/*
+Ensure valid DB type is select, defaults to SQLite
+*/}}
+{{- define "vaultwarden.dbTypeValid" -}}
+{{- if not (or (eq .Values.database.type "postgresql") (eq .Values.database.type "mysql") (eq .Values.database.type "sqlite")) }}
+{{- required "Invalid database type" nil }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Ensure log type is valid
+*/}}
+{{- define "vaultwarden.logLevelValid" -}}
+{{- if not (or (eq .Values.vaultwarden.log.level "trace") (eq .Values.vaultwarden.log.level "debug") (eq .Values.vaultwarden.log.level "info") (eq .Values.vaultwarden.log.level "warn") (eq .Values.vaultwarden.log.level "error") (eq .Values.vaultwarden.log.level "off")) }}
+{{- required "Invalid log level" nil }}
+{{- end }}
+{{- end }}

charts/enterprise/vaultwarden/templates/common.yaml

@@ -0,0 +1,45 @@
+{{/* Make sure all variables are set properly */}}
+{{- include "tc.v1.common.loader.init" . }}
+
+
+{{/* Render configmap for vaultwarden */}}
+{{- $configmapFile := include "vaultwarden.configmap" . | fromYaml -}}
+{{- if $configmapFile -}}
+  {{- $_ := set .Values.configmap "vaultwardenconfig" $configmapFile -}}
+{{- end -}}
+
+{{/* Render secrets for vaultwarden */}}
+{{- $secret := include "vaultwarden.secrets" . | fromYaml -}}
+{{- if $secret -}}
+  {{- $_ := set .Values.secret "vaultwardensecret" $secret -}}
+{{- end -}}
+
+{{/* Define path for websocket */}}
+{{- define "vaultwarden.websocket" -}}
+{{- $fullname := include "tc.v1.common.lib.chart.names.fullname" . -}}
+path: "/notifications/hub"
+# -- Ignored if not kubeVersion >= 1.14-0
+pathType: Prefix
+service:
+  # -- Overrides the service name reference for this path
+  name: {{ printf "%s-ws" $fullname }}
+  port: {{ .Values.service.ws.ports.ws.port }}
+{{- end -}}
+
+{{/* inject websocket path to all main ingress hosts*/}}
+{{- define "vaultwarden.websocketinjector" -}}
+{{- $path := list (include "vaultwarden.websocket" . | fromYaml) -}}
+{{- if .Values.ingress.main.enabled }}
+{{- range .Values.ingress.main.hosts }}
+{{- $newpaths := list }}
+{{- $newpaths := concat .paths $path }}
+{{- $_ := set . "paths" ( deepCopy $newpaths ) -}}
+{{- end }}
+{{- end }}
+{{- end -}}
+
+{{/* inject websocket paths in ingress */}}
+{{- include "vaultwarden.websocketinjector" . }}
+
+{{/* Render the templates */}}
+{{ include "tc.v1.common.loader.apply" . }}

charts/enterprise/vaultwarden/values.yaml

@@ -0,0 +1,164 @@
+image:
+  repository: tccr.io/truecharts/vaultwarden
+  pullPolicy: IfNotPresent
+  tag: 1.27.0@sha256:e80b8a6a8b05928d9703eda1c7ebd2c8f1c0b9deed1734ce31c2ec6d70aed323
+
+service:
+  main:
+    ports:
+      main:
+        port: 10102
+        targetPort: 8080
+  ws:
+    enabled: true
+    ports:
+      ws:
+        enabled: true
+        port: 3012
+        targetPort: 3012
+
+workload:
+  main:
+    podSpec:
+      containers:
+        main:
+          env:
+            DOMAIN: "https://{{ if .Values.ingress }}{{ if .Values.ingress.main.enabled }}{{ ( index .Values.ingress.main.hosts 0 ).host }}{{ else }}placeholder.com{{ end }}{{ else }}placeholder.com{{ end }}"
+            DATABASE_URL:
+              secretKeyRef:
+                name: cnpg-main-urls
+                key: std
+
+          envFrom:
+            - configMapRef:
+                name: vaultwardenconfig
+            - secretRef:
+                name: vaultwardensecret
+
+database:
+  # -- Database type,
+  # must be one of: 'sqlite', 'mysql' or 'postgresql'.
+  type: postgresql
+  # -- Enable DB Write-Ahead-Log for SQLite,
+  # disabled for other databases. https://github.com/dani-garcia/bitwarden_rs/wiki/Running-without-WAL-enabled
+  wal: true
+  ## URL for external databases (mysql://user:pass@host:port or postgresql://user:pass@host:port).
+  # url: ""
+  ## Set the size of the database connection pool.
+  # maxConnections: 10
+  ## Connection retries during startup, 0 for infinite. 1 second between retries.
+  # retries: 15
+
+# Set Bitwarden_rs application variables
+vaultwarden:
+  # -- Allow any user to sign-up
+  # see: https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-registration-of-new-users
+  allowSignups: true
+  ## Whitelist domains allowed to sign-up. 'allowSignups' is ignored if set.
+  # signupDomains:
+  #  - domain.tld
+  # -- Verify e-mail before login is enabled.
+  # SMTP must be enabled.
+  verifySignup: false
+  # When a user logs in an email is required to be sent. If sending the email fails the login attempt will fail. SMTP must be enabled.
+  requireEmail: false
+  ## Maximum attempts before an email token is reset and a new email will need to be sent.
+  # emailAttempts: 3
+  ## Email token validity in seconds.
+  # emailTokenExpiration: 600
+  # Allow invited users to sign-up even feature is disabled: https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-invitations
+  allowInvitation: true
+  # Show password hints: https://github.com/dani-garcia/bitwarden_rs/wiki/Password-hint-display
+  ## Default organization name in invitation e-mails that are not coming from a specific organization.
+  # defaultInviteName: ""
+  showPasswordHint: true
+  # Enable Websockets for notification. https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-WebSocket-notifications
+  # Redirect HTTP path "/notifications/hub" to port 3012. Ingress/IngressRoute controllers are automatically configured.
+  enableWebsockets: true
+  # Enable Web Vault (static content). https://github.com/dani-garcia/bitwarden_rs/wiki/Disabling-or-overriding-the-Vault-interface-hosting
+  enableWebVault: true
+  # Restrict creation of orgs. Options are: 'all', 'none' or a comma-separated list of users.
+  orgCreationUsers: all
+  ## Limit attachment disk usage per organization.
+  # attachmentLimitOrg:
+  ## Limit attachment disk usage per user.
+  # attachmentLimitUser:
+  ## HaveIBeenPwned API Key. Can be purchased at https://haveibeenpwned.com/API/Key.
+  # hibpApiKey:
+
+  admin:
+    # Enable admin portal.
+    enabled: false
+    # Disabling the admin token will make the admin portal accessible to anyone, use carefully: https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-admin-token
+    disableAdminToken: false
+    ## Token for admin login, will be generated if not defined. https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-admin-page
+    # token:
+
+  # Enable SMTP. https://github.com/dani-garcia/bitwarden_rs/wiki/SMTP-configuration
+  smtp:
+    enabled: false
+    # SMTP hostname, required if SMTP is enabled.
+    host: ""
+    # SMTP sender e-mail address, required if SMTP is enabled.
+    from: ""
+    ## SMTP sender name, defaults to 'Bitwarden_RS'.
+    # fromName: ""
+    ## Enable SSL connection.
+    # ssl: true
+    ## SMTP port. Defaults to 25 without SSL, 587 with SSL.
+    # port: 587
+    ## SMTP Authentication Mechanisms. Comma-separated options: 'Plain', 'Login' and 'Xoauth2'. Defaults to 'Plain'.
+    # authMechanism: Plain
+    ## Hostname to be sent for SMTP HELO. Defaults to pod name.
+    # heloName: ""
+    ## SMTP timeout.
+    # timeout: 15
+    ## Accept SSL session if certificate is valid but hostname doesn't match. DANGEROUS, vulnerable to men-in-the-middle attacks!
+    # invalidHostname: false
+    ## Accept invalid certificates. DANGEROUS, vulnerable to men-in-the-middle attacks!
+    # invalidCertificate: false
+    ## SMTP username.
+    # user: ""
+    ## SMTP password. Required is user is specified, ignored if no user provided.
+    # password: ""
+
+  ## Enable Yubico OTP authentication. https://github.com/dani-garcia/bitwarden_rs/wiki/Enabling-Yubikey-OTP-authentication
+  yubico:
+    enabled: false
+    ## Yubico server. Defaults to YubiCloud.
+    # server:
+    ## Yubico ID and Secret Key.
+    # clientId:
+    # secretKey:
+
+  ## Logging options. https://github.com/dani-garcia/bitwarden_rs/wiki/Logging
+  log:
+    # Log to file.
+    file: ""
+    # Log level. Options are "trace", "debug", "info", "warn", "error" or "off".
+    level: "trace"
+    ## Log timestamp format. See https://docs.rs/chrono/0.4.15/chrono/format/strftime/index.html. Defaults to time in milliseconds.
+    # timeFormat: ""
+
+  icons:
+    # Disables download of external icons. Setting to true will still serve icons from cache (/data/icon_cache). TTL will default to zero.
+    disableDownload: false
+    ## Cache time-to-live for icons fetched. 0 means no purging.
+    # cache: 2592000
+    ## Cache time-to-live for icons that were not available. 0 means no purging.
+    # cacheFailed: 259200
+
+persistence:
+  data:
+    enabled: true
+    mountPath: "/data"
+
+cnpg:
+  main:
+    enabled: true
+    user: vaultwarden
+    database: vaultwarden
+
+portal:
+  open:
+    enabled: true

templates/questions/metrics/prometheusRule.yaml

@@ -1,14 +1,14 @@
-              - variable: prometheusRule
+                    - variable: prometheusRule
-                label: PrometheusRule
+                      label: PrometheusRule
-                description: Enable and configure Prometheus Rules for the App.
+                      description: Enable and configure Prometheus Rules for the App.
-                schema:
-                  additional_attrs: true
-                  type: dict
-                  attrs:
-                    - variable: enabled
-                      label: Enabled
-                      description: Enable Prometheus Metrics
                       schema:
-                        type: boolean
+                        additional_attrs: true
-                        default: false
+                        type: dict
-                    # TODO: Rule List section
+                        attrs:
+                          - variable: enabled
+                            label: Enabled
+                            description: Enable Prometheus Metrics
+                            schema:
+                              type: boolean
+                              default: false
+                          # TODO: Rule List section