Skip to content

Commit 0165ded

Browse files
kiblikkiblik
committed
feat(HELM): Use Postgres from CloudPirates
Signed-off-by: kiblik <[email protected]>
1 parent 0ace59c commit 0165ded

15 files changed

+139
-207
lines changed

‎helm/defectdojo/Chart.lock‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
dependencies:
2-
- name: postgresql
3-
repository: oci://us-docker.pkg.dev/os-public-container-registry/defectdojo
4-
version: 16.7.27
2+
- name: postgres
3+
repository: oci://registry-1.docker.io/cloudpirates
4+
version: 0.13.3
55
- name: valkey
66
repository: oci://registry-1.docker.io/cloudpirates
7-
version: 0.10.2
8-
digest: sha256:65773fc2a992a5688995a98ed396ca54de12b88fd7b124459a39961801ae62f3
9-
generated: "2025-11-25T20:48:39.324383+01:00"
7+
version: 0.10.3
8+
digest: sha256:7a3415b78a329b5d7ffaa860d774d9a6050cf3ad25bb217f37e32de30c0e2cce
9+
generated: "2025-12-11T22:37:23.132676+01:00"

‎helm/defectdojo/Chart.yaml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ maintainers:
99
email: [email protected]
1010
url: https://github.com/DefectDojo/django-DefectDojo
1111
dependencies:
12-
- name: postgresql
13-
version: ~16.7.0
14-
repository: "oci://us-docker.pkg.dev/os-public-container-registry/defectdojo"
15-
condition: postgresql.enabled
12+
- name: postgres
13+
version: 0.13.3
14+
repository: "oci://registry-1.docker.io/cloudpirates"
15+
condition: postgres.enabled
1616
- name: valkey
1717
version: ~0.10.0
1818
repository: "oci://registry-1.docker.io/cloudpirates"
@@ -34,4 +34,6 @@ dependencies:
3434
# description: Critical bug
3535
annotations:
3636
artifacthub.io/prerelease: "true"
37-
artifacthub.io/changes: ""
37+
artifacthub.io/changes: |
38+
- kind: changed
39+
description: PostgreSQL from Bitnami replaced with CloudPirates

‎helm/defectdojo/README.md‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -310,9 +310,9 @@ helm install \
310310
--set valkey.architecture=replication \
311311
--set valkey.replicaCount=3 \
312312
--set django.ingress.secretName="minikube-tls" \
313-
--set postgresql.enabled=true \
314-
--set postgresql.replication.enabled=true \
315-
--set postgresql.replication.slaveReplicas=3 \
313+
--set postgres.enabled=true \
314+
--set postgres.replication.enabled=true \
315+
--set postgres.replication.slaveReplicas=3 \
316316
--set createSecret=true \
317317
--set createValkeySecret=true \
318318
--set createPostgresqlSecret=true
@@ -435,8 +435,6 @@ postgresql:
435435
database: defectdojo # your database name
436436
secretKeys:
437437
adminPasswordKey: password # the name of the field containing the password value
438-
userPasswordKey: password # the name of the field containing the password value
439-
replicationPasswordKey: password # the name of the field containing the password value
440438
existingSecret: defectdojo-postgresql-specific # the secret containing your database password
441439
442440
extraEnv:
@@ -525,8 +523,8 @@ A Helm chart for Kubernetes to install DefectDojo
525523
526524
| Repository | Name | Version |
527525
|------------|------|---------|
526+
| oci://registry-1.docker.io/cloudpirates | postgres | 0.13.3 |
528527
| oci://registry-1.docker.io/cloudpirates | valkey | ~0.10.0 |
529-
| oci://us-docker.pkg.dev/os-public-container-registry/defectdojo | postgresql | ~16.7.0 |
530528
531529
## Values
532530
@@ -740,14 +738,12 @@ A Helm chart for Kubernetes to install DefectDojo
740738
| networkPolicy.ingress | list | `[]` | For more detailed configuration with ports and peers. It will ignore ingressExtend ``` ingress: - from: - podSelector: matchLabels: app.kubernetes.io/instance: defectdojo - podSelector: matchLabels: app.kubernetes.io/instance: defectdojo-prometheus ports: - protocol: TCP port: 8443 ``` |
741739
| networkPolicy.ingressExtend | list | `[]` | if additional labels need to be allowed (e.g. prometheus scraper) ``` ingressExtend: - podSelector: matchLabels: app.kubernetes.io/instance: defectdojo-prometheus ``` |
742740
| podLabels | object | `{}` | Additional labels to add to the pods: ``` podLabels: key: value ``` |
743-
| postgresServer | string | `nil` | To use an external PostgreSQL instance (like CloudSQL), set `postgresql.enabled` to false, set items in `postgresql.auth` part for authentication, and set the address here: |
744-
| postgresql | object | `{"architecture":"standalone","auth":{"database":"defectdojo","existingSecret":"defectdojo-postgresql-specific","password":"","secretKeys":{"adminPasswordKey":"postgresql-postgres-password","replicationPasswordKey":"postgresql-replication-password","userPasswordKey":"postgresql-password"},"username":"defectdojo"},"enabled":true,"primary":{"affinity":{},"containerSecurityContext":{"enabled":true,"runAsUser":1001},"name":"primary","nodeSelector":{},"persistence":{"enabled":true},"podSecurityContext":{"enabled":true,"fsGroup":1001},"service":{"ports":{"postgresql":5432}}},"shmVolume":{"chmod":{"enabled":false}},"volumePermissions":{"containerSecurityContext":{"runAsUser":1001},"enabled":false}}` | For more advance options check the bitnami chart documentation: https://github.com/bitnami/charts/tree/main/bitnami/postgresql |
745-
| postgresql.enabled | bool | `true` | To use an external instance, switch enabled to `false` and set the address in `postgresServer` below |
746-
| postgresql.primary.containerSecurityContext.enabled | bool | `true` | Default is true for K8s. Enabled needs to false for OpenShift restricted SCC and true for anyuid SCC |
747-
| postgresql.primary.containerSecurityContext.runAsUser | int | `1001` | runAsUser specification below is not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully. |
748-
| postgresql.primary.podSecurityContext.enabled | bool | `true` | Default is true for K8s. Enabled needs to false for OpenShift restricted SCC and true for anyuid SCC |
749-
| postgresql.primary.podSecurityContext.fsGroup | int | `1001` | fsGroup specification below is not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully. |
750-
| postgresql.volumePermissions.containerSecurityContext | object | `{"runAsUser":1001}` | if using restricted SCC set runAsUser: "auto" and if running under anyuid SCC - runAsUser needs to match the line above |
741+
| postgres | object | `{"affinity":{},"auth":{"database":"defectdojo","existingSecret":"defectdojo-postgresql-specific","password":"","secretKeys":{"adminPasswordKey":"postgresql-postgres-password"},"username":"defectdojo"},"containerSecurityContext":{"runAsUser":1001},"enabled":true,"nodeSelector":{},"persistence":{"containerSecurityContext":{"runAsUser":1001},"enabled":false},"podSecurityContext":{"fsGroup":1001},"service":{"port":5432},"shmVolume":{"chmod":{"enabled":false}}}` | For more advance options check the bitnami chart documentation: https://artifacthub.io/packages/helm/cloudpirates-postgres/postgres |
742+
| postgres.containerSecurityContext.runAsUser | int | `1001` | runAsUser specification below is not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully. |
743+
| postgres.enabled | bool | `true` | To use an external instance, switch enabled to `false` and set the address in `postgresServer` below |
744+
| postgres.persistence.containerSecurityContext | object | `{"runAsUser":1001}` | if using restricted SCC set runAsUser: "auto" and if running under anyuid SCC - runAsUser needs to match the line above |
745+
| postgres.podSecurityContext.fsGroup | int | `1001` | fsGroup specification below is not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully. |
746+
| postgresServer | string | `nil` | To use an external PostgreSQL instance (like CloudSQL), set `postgres.enabled` to false, set items in `postgres.auth` part for authentication, and set the address here: |
751747
| redisParams | string | `""` | Parameters attached to the redis connection string, defaults to "ssl_cert_reqs=optional" if `redisScheme` is `rediss` |
752748
| redisPort | int | `6379` | Define the protocol to use with the external Redis instance |
753749
| redisScheme | string | `"redis"` | Define the protocol to use with the external Redis instance |

‎helm/defectdojo/README.md.gotmpl‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -310,9 +310,9 @@ helm install \
310310
--set valkey.architecture=replication \
311311
--set valkey.replicaCount=3 \
312312
--set django.ingress.secretName="minikube-tls" \
313-
--set postgresql.enabled=true \
314-
--set postgresql.replication.enabled=true \
315-
--set postgresql.replication.slaveReplicas=3 \
313+
--set postgres.enabled=true \
314+
--set postgres.replication.enabled=true \
315+
--set postgres.replication.slaveReplicas=3 \
316316
--set createSecret=true \
317317
--set createValkeySecret=true \
318318
--set createPostgresqlSecret=true
@@ -435,8 +435,6 @@ postgresql:
435435
database: defectdojo # your database name
436436
secretKeys:
437437
adminPasswordKey: password # the name of the field containing the password value
438-
userPasswordKey: password # the name of the field containing the password value
439-
replicationPasswordKey: password # the name of the field containing the password value
440438
existingSecret: defectdojo-postgresql-specific # the secret containing your database password
441439

442440
extraEnv:

‎helm/defectdojo/templates/_helpers.tpl‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,9 @@
4545
{{- /*
4646
Determine the hostname to use for PostgreSQL/Redis.
4747
*/}}
48-
{{- define "postgresql.hostname" -}}
49-
{{- if .Values.postgresql.enabled -}}
50-
{{- if eq .Values.postgresql.architecture "replication" -}}
51-
{{- printf "%s-%s-%s" .Release.Name "postgresql" .Values.postgresql.primary.name | trunc 63 | trimSuffix "-" -}}
52-
{{- else -}}
53-
{{- printf "%s-%s" .Release.Name "postgresql" | trunc 63 | trimSuffix "-" -}}
54-
{{- end -}}
48+
{{- define "postgres.hostname" -}}
49+
{{- if .Values.postgres.enabled -}}
50+
{{- printf "%s-%s" .Release.Name "postgres" | trunc 63 | trimSuffix "-" -}}
5551
{{- else -}}
5652
{{- .Values.postgresServer | default "127.0.0.1" | quote -}}
5753
{{- end -}}
@@ -233,8 +229,8 @@ Inspired by Bitnami Common Chart v2.31.7
233229
- name: DD_DATABASE_PASSWORD
234230
valueFrom:
235231
secretKeyRef:
236-
name: {{ .Values.postgresql.auth.existingSecret | default "defectdojo-postgresql-specific" }}
237-
key: {{ .Values.postgresql.auth.secretKeys.userPasswordKey | default "postgresql-password" }}
232+
name: {{ .Values.postgres.auth.existingSecret | default "defectdojo-postgresql-specific" }}
233+
key: {{ .Values.postgres.auth.secretKeys.adminPasswordKey | default "postgresql-password" }}
238234
{{- with .Values.extraEnv }}
239235
{{- toYaml . | nindent 2 }}
240236
{{- end }}
@@ -274,7 +270,7 @@ Inspired by Bitnami Common Chart v2.31.7
274270
command: ["/cloud_sql_proxy"]
275271
args:
276272
- "-verbose={{ .Values.cloudsql.verbose }}"
277-
- "-instances={{ .Values.cloudsql.instance }}=tcp:{{ .Values.postgresql.primary.service.ports.postgresql }}"
273+
- "-instances={{ .Values.cloudsql.instance }}=tcp:{{ .Values.postgres.primary.service.ports.postgresql }}"
278274
{{- if .Values.cloudsql.enable_iam_login }}
279275
- "-enable_iam_login"
280276
{{- end }}

‎helm/defectdojo/templates/celery-beat-deployment.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,8 @@ spec:
149149
- name: DD_DATABASE_PASSWORD
150150
valueFrom:
151151
secretKeyRef:
152-
name: {{ .Values.postgresql.auth.existingSecret | default "defectdojo-postgresql-specific" }}
153-
key: {{ .Values.postgresql.auth.secretKeys.userPasswordKey | default "postgresql-password" }}
152+
name: {{ .Values.postgres.auth.existingSecret | default "defectdojo-postgresql-specific" }}
153+
key: {{ .Values.postgres.auth.secretKeys.adminPasswordKey | default "postgresql-password" }}
154154
- name: DD_SECRET_KEY
155155
valueFrom:
156156
secretKeyRef:

‎helm/defectdojo/templates/celery-worker-deployment.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,8 +144,8 @@ spec:
144144
- name: DD_DATABASE_PASSWORD
145145
valueFrom:
146146
secretKeyRef:
147-
name: {{ .Values.postgresql.auth.existingSecret | default "defectdojo-postgresql-specific" }}
148-
key: {{ .Values.postgresql.auth.secretKeys.userPasswordKey | default "postgresql-password" }}
147+
name: {{ .Values.postgres.auth.existingSecret | default "defectdojo-postgresql-specific" }}
148+
key: {{ .Values.postgres.auth.secretKeys.adminPasswordKey | default "postgresql-password" }}
149149
- name: DD_SECRET_KEY
150150
valueFrom:
151151
secretKeyRef:

‎helm/defectdojo/templates/configmap.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,10 @@ data:
4040
DD_CELERY_WORKER_CONCURRENCY: '{{ if eq .Values.celery.worker.appSettings.poolType "prefork" }}{{ .Values.celery.worker.appSettings.concurrency | default "8" }}{{ end }}'
4141
DD_CELERY_WORKER_PREFETCH_MULTIPLIER: '{{ if eq .Values.celery.worker.appSettings.poolType "prefork" }}{{ .Values.celery.worker.appSettings.prefetchMultiplier | default "128" }}{{ end }}'
4242
DD_DATABASE_ENGINE: django.db.backends.postgresql
43-
DD_DATABASE_HOST: {{ template "postgresql.hostname" . }}
44-
DD_DATABASE_PORT: '{{ .Values.postgresql.primary.service.ports.postgresql }}'
45-
DD_DATABASE_USER: {{ .Values.postgresql.auth.username }}
46-
DD_DATABASE_NAME: {{ .Values.postgresql.auth.database }}
43+
DD_DATABASE_HOST: {{ template "postgres.hostname" . }}
44+
DD_DATABASE_PORT: '{{ .Values.postgres.service.port }}'
45+
DD_DATABASE_USER: {{ .Values.postgres.auth.username }}
46+
DD_DATABASE_NAME: {{ .Values.postgres.auth.database }}
4747
DD_INITIALIZE: '{{ .Values.initializer.run }}'
4848
DD_UWSGI_ENDPOINT: /run/defectdojo/uwsgi.sock
4949
DD_UWSGI_HOST: localhost

‎helm/defectdojo/templates/django-deployment.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -208,8 +208,8 @@ spec:
208208
- name: DD_DATABASE_PASSWORD
209209
valueFrom:
210210
secretKeyRef:
211-
name: {{ .Values.postgresql.auth.existingSecret | default "defectdojo-postgresql-specific" }}
212-
key: {{ .Values.postgresql.auth.secretKeys.userPasswordKey | default "postgresql-password" }}
211+
name: {{ .Values.postgres.auth.existingSecret | default "defectdojo-postgresql-specific" }}
212+
key: {{ .Values.postgres.auth.secretKeys.adminPasswordKey | default "postgresql-password" }}
213213
- name: DD_SECRET_KEY
214214
valueFrom:
215215
secretKeyRef:

‎helm/defectdojo/templates/initializer-job.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -153,8 +153,8 @@ spec:
153153
- name: DD_DATABASE_PASSWORD
154154
valueFrom:
155155
secretKeyRef:
156-
name: {{ .Values.postgresql.auth.existingSecret }}
157-
key: {{ .Values.postgresql.auth.secretKeys.userPasswordKey }}
156+
name: {{ .Values.postgres.auth.existingSecret }}
157+
key: {{ .Values.postgres.auth.secretKeys.adminPasswordKey }}
158158
{{- with .Values.initializer.extraEnv }}
159159
{{- toYaml . | nindent 8 }}
160160
{{- end }}

0 commit comments

Comments
 (0)