onprem 2.0 mongo mtls (#989)

Author: mikhail-klimko

codefresh/.ci/values/cfapi-roles-hpa.yaml

@@ -38,8 +38,6 @@ global:
 
 cfapi: &cf-api
   enabled: false
-  hpa:
-    enabled: true
 
 cfapi-internal:
   !!merge <<: *cf-api

codefresh/.ci/values/mongodb-mtls.yaml

@@ -0,0 +1,95 @@
+seed:
+  mongoSeedJob:
+    mongodbRootURI: mongodb://root:XT9nmM8dZD@cf-mongodb:27017/?authSource=admin
+
+global:
+  appUrl: ""  # placeholder for ${CF_APP_HOST}
+  firebaseSecret: ""  # placeholder for ${FIREBASE_SECRET}
+
+  mongoURI: "mongodb://cf-mongodb:27017/?ssl=true&authMechanism=MONGODB-X509&authSource=$external"
+  runtimeMongoURI: "mongodb://cf-mongodb:27017/?ssl=true&authMechanism=MONGODB-X509&authSource=$external"
+
+  volumes:
+    mongodb-tls:
+      enabled: true
+      type: secret
+      optional: true
+      nameOverride: cf-codefresh-mongodb-tls
+
+  volumeMounts:
+    mongodb-tls:
+      path:
+      - mountPath: /etc/ssl/mongodb/ca.pem
+        subPath: ca.pem
+  env:
+    MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
+    RUNTIME_MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
+    RUNTIME_MONGO_TLS: "true"
+    RUNTIME_MONGO_TLS_VALIDATE: "false"
+    MONGO_MTLS_VALIDATE: "false"
+
+ingress:
+  enabled: true
+  tls:
+    enabled: false
+    cert: ""  # placeholder for ${WEB_TLS_CERT}
+    key: "" # placeholder for ${WEB_TLS_KEY}
+
+mongodb:
+  initdbScripts:
+    my_init_script.sh: |
+      #!/bin/bash
+
+      set -eou xtrace
+
+      export MONGODB_ROOT_URI=mongodb://root:XT9nmM8dZD@127.0.0.1/?authSource=admin
+      MONGODB_DATABASES=(
+        "archive"
+        "audit"
+        "charts-manager"
+        "cluster-providers"
+        "codefresh"
+        "context-manager"
+        "gitops-dashboard-manager"
+        "k8s-monitor"
+        "pipeline-manager"
+        "platform-analytics"
+        "read-models"
+        "runtime-environment-manager"
+      )
+
+      mongosh "$MONGODB_ROOT_URI" --eval 'db.getSiblingDB("\$external").runCommand( { createUser: "CN=cfuser,O=Internet Widgits Pty Ltd,ST=Some-State,C=AU", roles: [ { role: "readWrite", db: "test" }, { role: "userAdminAnyDatabase", db: "admin" }, { role: "readWrite", db: "codefresh" }, { role: "readWrite", db: "pipeline-manager" }, { role: "readWrite", db: "runtime-environment-manager" }, { role: "readWrite", db: "context-manager" }, { role: "readWrite", db: "cluster-providers" }, { role: "readWrite", db: "charts-manager" }, { role: "readWrite", db: "k8s-monitor" }, { role: "readWrite", db: "read-models" }, { role: "readWrite", db: "audit" } ], writeConcern: { w: "majority" , wtimeout: 5000 } } )'
+
+      for MONGODB_DATABASE in ${MONGODB_DATABASES[@]}; do
+        mongosh ${MONGODB_ROOT_URI} --eval "db.getSiblingDB('${MONGODB_DATABASE}').createCollection('test')"
+      done
+
+      mongoimport --uri ${MONGODB_ROOT_URI} --db codefresh --collection idps --type json --legacy --file /usr/share/extras/idps.json
+      mongoimport --uri ${MONGODB_ROOT_URI} --db codefresh --collection accounts --type json --legacy --file /usr/share/extras/accounts.json
+      mongoimport --uri ${MONGODB_ROOT_URI} --db codefresh --collection users --type json --legacy --file /usr/share/extras/users.json
+
+  extraVolumeMounts:
+    - name: extras
+      mountPath: /usr/share/extras
+      readOnly: true
+
+  extraVolumes:
+    - name: extras
+      configMap:
+        name: cf-codefresh-mongo-seed
+
+  tls:
+    enabled: true
+    autoGenerated: false
+    caCert: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGVENDQWYyZ0F3SUJBZ0lRZWVySXdOWkNpdyt1alRPdHZ2TEZLREFOQmdrcWhraUc5dzBCQVFzRkFEQVYKTVJNd0VRWURWUVFERXdwdGVVMXZibWR2TFdOaE1CNFhEVEl5TVRFd01qRTRNRFl6TWxvWERUTXlNVEF6TURFNApNRFl6TWxvd0ZURVRNQkVHQTFVRUF4TUtiWGxOYjI1bmJ5MWpZVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFECmdnRVBBRENDQVFvQ2dnRUJBTGxpV3dIVDQ5OWE0MzgrUWZjcExTNThVT2FsV3ArVXhkWVYwQjZkVTlFejlQSW4KTncydXZqNWtjN3RtU08xUk5ReEJRVjZpOHNBWHdQcTM1WlZYdTQ2OHhURkdHMXZBTWhrTkQ1OTJWd3JFNElCSgpTMm9XNEV6UWJPR3Fsd2ZBanNMZ1VlRjdBbHRuUEVNMjBSQ3hpMzhPNGY0VHZNZHpQamhIa2NNU2NMaHNhYjRlCjYrbVA0MFJBcEdLc2hwV2YwbnoyMXErWU83Zm4wNjVYd3dvUVBvL1BZa0FLdWNHZk1xRjltYXRCYWdUMlVwT0cKSFlRa2pzRW1zSmxEdkhsV1RBdzU2eFl4UU9UbUVWU2hkYzlKRDNmWEZEVkd6L1NVYkZXQTVualBLL0QvbXdpawppM0RaL0h6SUVEbXBJUElxRERsTGdIL3F6b3Jlb0NKMjB1YnlCb1VDQXdFQUFhTmhNRjh3RGdZRFZSMFBBUUgvCkJBUURBZ0trTUIwR0ExVWRKUVFXTUJRR0NDc0dBUVVGQndNQkJnZ3JCZ0VGQlFjREFqQVBCZ05WSFJNQkFmOEUKQlRBREFRSC9NQjBHQTFVZERnUVdCQlFXTWg5RDRiVkljRWQ2dVBOZ1RqWGpMWUpoSmpBTkJna3Foa2lHOXcwQgpBUXNGQUFPQ0FRRUFSUTBaV3F0dUlLWHNHTTJ4TW1Za0VJTHprckJySktiWXhIOFlCUEJFTjZZT09la0o2Q1FhCjQzZitmaHJlQ2o4NFdwSzdwckNEcjJYTmlHNHJlYjBrU2dYdmpyZUVBTzU0Q1FzelJwR0xUVjROMTBjTDdHUVoKaXd6OElGMXppTld4WXVXK29aSFRBQ2NMRkJkUnFFZWNSWUJXTU0vaDhZcldoWTRIaXlIMHp4UkRsOGNpU2ZOMApoa2lURzZQd0V0S29ZRWUwZ21OWXhkWFNzZ2FMZFlUMjNiMGJsMlB3OUdZdkJlWmFpZlZTbllDYmhmTDNPVkQxCjV6YnBXNHhmMEJyM0VGbStrUHh0SGxVR2FsUXdFb3NSVy9kWEpFWFVQTHNGb2xPRDRiR0xvblE4Z2VHcFVYVzQKR3prV0g5QTFXUlE4bWIxd0ZDTkZNVjgvUWxKams3MEJFUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0="
+    caKey: "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBdVdKYkFkUGozMXJqZno1Qjl5a3RMbnhRNXFWYW41VEYxaFhRSHAxVDBUUDA4aWMzCkRhNitQbVJ6dTJaSTdWRTFERUZCWHFMeXdCZkErcmZsbFZlN2pyekZNVVliVzhBeUdRMFBuM1pYQ3NUZ2dFbEwKYWhiZ1ROQnM0YXFYQjhDT3d1QlI0WHNDVzJjOFF6YlJFTEdMZnc3aC9oTzh4M00rT0VlUnd4Snd1R3hwdmg3cgo2WS9qUkVDa1lxeUdsWi9TZlBiV3I1Zzd0K2ZUcmxmRENoQStqODlpUUFxNXdaOHlvWDJacTBGcUJQWlNrNFlkCmhDU093U2F3bVVPOGVWWk1ERG5yRmpGQTVPWVJWS0YxejBrUGQ5Y1VOVWJQOUpSc1ZZRG1lTThyOFArYkNLU0wKY05uOGZNZ1FPYWtnOGlvTU9VdUFmK3JPaXQ2Z0luYlM1dklHaFFJREFRQUJBb0lCQUNIQ3JxNHJoMkVpclRGOApCZ2xiMzFXSzREVFF3aXN6cmIrcUkwZWdBU2FsSHFPR3pyallMTjh4N2YyZnlBSW4rdEFyaGhzVTg3NVYxUmdUCnEyVENJRzhESTZvd2lVVHhRRzVkZVkzaHdFSSt6bCt1ZVdSdG5CV0JFNE1aVFAzbGJGcEMvY1poWDNHRDRHNmgKS2Z1dlNhY3U3NnNVcnhsbmZGcEZkbDhmR1pZTUlOOUNZWHArWWVJZzRuYW5ZSFJsbk1LM05QSjIzZUVHdkpjeQpLdUZWNndIUzFlWmg1M0J0aWRlY3czcmFzZFhJWmMzdFJidlFid3lDbjZ5dVlING0vUXJzMVFUckp2dzdyWU1sCkxyZGxlZm5uWk9XNFNVc3dINkVCWmF3RC9FTFc4eFNORVhudUkzUFp0di9oRVVZd3RKOVdMbk0rRitzc21ldm8KaHVGMUI5VUNnWUVBMFBHSmc2U3N6dHlKNkhyM0tTaEhyN3h5eVVPOVJTK0N3LzBSV2cranJ3SGFlRGRIalpvKwpaYXhxWVdoRUR0aUZieWpJdWR2MFF1aUZhMHVObDUvMGl3YXR2Tm81RitNZWV3WGt1T0YraWE3RFdFODk0a2ZECkVqYXJYWUk3ZkpnTkdxVmthWUw1cGdGcmxpUDhkZDFkK0VlTWV4dmJadTdwYUZzaXBaZWs1NE1DZ1lFQTR5S0cKdzAyMHJTTGRwdlYyQmE2WG4zbFRXUW0wMFlOaVFuY0YrVjJXNm95RjREK2liRUppTUdUZzRESzZLVllNVElpNQpmaVV4WHlib0Fkd1hvTlpqMmhPWmhmMVZSa3g1WGIrOVorbDV3ZFlBMGR4RmV1ajBDakpmd3p1UTNuOUxZOWxlCnJSSi91SklkbHhKWkx2Z0RLZzdRZ2NuNkJCN2Y1Ujlwa1JKaTgxY0NnWUJYZ2xITnlOSjNjUFp4WDg3VWRnSlEKSCtVVFZrT1hEbWIrSHFkOXlMOE5OUUdEQitQMzhubmZxMjZDaldDenR3dHJtdkUycG1DUEJVT2J4SER3NkJWTApoT2lQQi9hUmdwWHBnSFppMkU1ZTY4cjAyWHRab2lTWkpEeHhWWElFcE1vWU50enZNK1BMR3gwc0xMWTN4eGJzClBVc2c1SEhua25nL05LdzJIbVQ2Y1FLQmdEaW9lQzFueU5ZWGlHc0pkL05hNWYrbDZDQ2h4elVzTE9xZmZpSUMKTW84M2xuMmw0Z0pYWE43dGl4cmlESVliTE40NmpPcm1wRFkwSWxPMGIwQnp1bHkvM3VBSm5hZjNrNTdMSVpnMgpLV1VzMk8rQW51UldEK29yUHJBWXY3NkF5bkdSMjRnWXdUdHRWMnhENjNOSDhxSWZKK3Y0VWlHTkFoVEpqUy9mCkFrZnBBb0dBQ0pRS0lOU0hZOWN2RGZseWNWNmRCcndGS0hRb3oyZGg5Z0EvSjBGazYyc0VrNDY1SUtINm96VDQKQTlSZi8yMHBLZG40dmRnTktJQ3R1cUNKN1JIMC82bVRZWXUwSEJTWHo1elZIdWczTHpFbGxOdVB4MnRhc0x0MgpjdElsVkVrdk96L1hCa3BMVUE2TDlaR01Ha2tyeUJoNEdXd2FCajBHeldUQ2JMUGZ3N3c9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0t"
+    mode: allowTLS
+
+secrets:
+  mongodb-tls:
+    enabled: true
+    data:
+      ca.pem: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM4akNDQWRvQ0ZDcUpqc3pFSVNVSDhUSU9hV1RmS0JxeVhFT01NQTBHQ1NxR1NJYjNEUUVCQ3dVQU1CVXgKRXpBUkJnTlZCQU1UQ20xNVRXOXVaMjh0WTJFd0hoY05Nakl4TVRBeU1UZ3hNVE0yV2hjTk1qUXdNekUyTVRneApNVE0yV2pCV01Rc3dDUVlEVlFRR0V3SkJWVEVUTUJFR0ExVUVDQXdLVTI5dFpTMVRkR0YwWlRFaE1COEdBMVVFCkNnd1lTVzUwWlhKdVpYUWdWMmxrWjJsMGN5QlFkSGtnVEhSa01ROHdEUVlEVlFRRERBWmpablZ6WlhJd2dnRWkKTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFERlk5T2E4bG5JMmtPaHBXZStScENQQ1BqSgpVbUFEUjUrUnVPRHpaSG5sdUsrd3ByTXkwcFB6RTJTblJXcHlXRHZNaVV6RGFhNUl6dWIySGZSVFNuRVgyTUliCnNkZkY1UGFJTmhnd0RiTFJRUEhXcE5Da1dCRFQvN0tiUnN0dmZVc0k0TllYenFnLys0U05qQWxDdi9rY0NRVUMKekhZc2NUZitta3JpYVNzOWZIemxWYWZWRWY5cUFWSGFlakhDWnd2NkoxTjAzS08yRjM0dmRXS1JPUEZVM00xaQpVWklSYTZoN0FQbGxmZmt1S0doS0t2R3hDRzJENFlLSGJ1WG0zeXBpYjk1QTUrUFA0MUJWeWc2ZnlpRWhXazNSCllSWGoybWZWd1JLeWYyQTE4L2pqS1NQVG1Eck51andTTnZ0cWp2WWdrV01LN2JrdHAxcHV5RVVNZlQyTkFnTUIKQUFFd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFFSGlOczZjZnl2UjNqODQzSEFKamE4Q2xKalJFdlZ1TXBIUAp4Y1RuQzdaOEF2Z3dOVDFFczd1OTFhVExicThSeDBiblRPYTJzZU9nb2VKM0lyd0pTOVFTeEtOQWpha3lnY2Q5ClBzM2tURXZFTVNBVTlRRU83cXNTNjh1aFdRMXRXM29KaktObVVnVDA5QzBEcVpZWTlrV3BQZzJENmIrUm1FWDgKUmYyUncrRGpLRXlHYkpRenJtRmNYMVlDcUV0MkpMR1RiZkM4NHpnb25YTS90d201cFlXL3JpSTVBd2lNWXB6ZApWR1p0d0lpSi9ZVWNrZWkrNlpscDczZHpiMUw0RHEzVjY5Y29VejVBZHhpVlRBRHlCcW1wM1VQbnZadTBsOCtuClM5Y3dZbkdaOTZLM3ZwQzZHTk5GY1QrbXdiZ25qK2JMaHVVTDMrck52R3BSclpKei9lQT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQotLS0tLUJFR0lOIFJTQSBQUklWQVRFIEtFWS0tLS0tCk1JSUVvd0lCQUFLQ0FRRUF4V1BUbXZKWnlOcERvYVZudmthUWp3ajR5VkpnQTBlZmtiamc4MlI1NWJpdnNLYXoKTXRLVDh4TmtwMFZxY2xnN3pJbE13Mm11U003bTloMzBVMHB4RjlqQ0c3SFh4ZVQyaURZWU1BMnkwVUR4MXFUUQpwRmdRMC8reW0wYkxiMzFMQ09EV0Y4Nm9QL3VFall3SlFyLzVIQWtGQXN4MkxIRTMvcHBLNG1rclBYeDg1VlduCjFSSC9hZ0ZSMm5veHdtY0wraWRUZE55anRoZCtMM1Zpa1RqeFZOek5ZbEdTRVd1b2V3RDVaWDM1TGlob1NpcngKc1FodGcrR0NoMjdsNXQ4cVltL2VRT2ZqeitOUVZjb09uOG9oSVZwTjBXRVY0OXBuMWNFU3NuOWdOZlA0NHlragowNWc2emJvOEVqYjdhbzcySUpGakN1MjVMYWRhYnNoRkRIMDlqUUlEQVFBQkFvSUJBR0piOFNqSDFRZXFBNE44Ckdhc09IS0M1MXNiekhsYmtETmFmYXJDK0E2UCtHTVlNKzBTNisvQm5YSU9ocW41YUMwcExySTIvanBKSFQzMmEKeFpIdmlWVlp0TGY2TWN3eDRNdFZNVTVZdFI5aW5sL1g5d085d256eGNIM0JsRVAxQ2p2ZFZiRzlUOGU2UEg0UQpKdGsxTWh2UFBzajdPM08vNHlnaW1HZ2tBZUQ3MUM3WUQ1RzAraC9jeTllYVRUUURUMFJ4ZEQ3dkE0d2g2MHhOCmgybTQxK0NyUFArTnNqM2FRNUNET09laUgyMk9UVmdEVllEb1RoUi9rRFdtNmg3eU55bEowMjM2SVk3WU5taEoKUzNWQURieXpJT0xhUWtBSWJmNVZBZ2JvRzZMaFhvN3hGdkQ3eHFKWENlRVlWOEZRV0UweEZJMkhKMFloaDhLNApSdXB3Q3AwQ2dZRUE3Q2t6bDZwRmgrNk1md3VHcnR0ZUY4UWVxQ1BuYXhWRmNpU2prZzMxd0swWTNyRXQ0UHM2CnJ5RkI2anVxVjBtNkE2M3FrdjdGcVdvNE9sM1U2aTB6aUpQMjJmMWFPWEtqdzRwYjl0bnRhRFBvOHV0dW5tQVAKaW4xWGUyR2s3S2p2emhrcjF0a0FtUXJBQUxiZEFEbi9GQjI1UWdOdmFSTytTbjZveUg4eGZ5TUNnWUVBMWZqVQpOZFBzQ1RJalpzcDdXUllreDhmL3prQjZhU3FlbkpPMjM3ZnlYVjJEVDFGWk8rMStxK1VHUkJRQXBzOVdwRGJICkJHMS9oTThyWlpTdW1BMkRxdTlobElFSDIwR3lIYVFLaC9JTUEvY0I2eGNHdk9OZVl6ajhWZHBCVmE4anYwd20KNFVVS3dsMEVkOHQreVdnVDB6THREN0UrR3RFaVY5UDIvaXBEODQ4Q2dZQVJQd2tIZ0dYSGdZSTlIT2hmQ0tJYwpkalFPNzJCTkQ2YWNxVlJRckRoUU05UG5IMlZNVXN4OFVaOXdyWjdJOVJkaWdXYnFDVFVDSkVHcThZTkUvcndPCnMwK0pwOWpZN1NoTWRXUTE2TUJQcGNyVFFxSTNhcWgzNHFOcTNUeWdFODQvYk5Nb3czd3BzUUZJakJJam5CaW0KclcwRUJ5QXh1a0ZoUzFLa0liWEpwUUtCZ0QrWTJNSXkvZW54ekJIbVJ1bEFxcWZ5cXZhTHRaYUNnMmc0ZzFkVgpYaVVnQVVKWEJIWEtiaWI3U0hSOW1YLzdDbDUrcFlLTVpTVjlTZ0hFUW15UlA3eFRzQ1lxZjhKTWNYdGI0WUZzCmtPT3d6QklxNHViTGthZGVMYW42MkFaMnF1SlY2UXgxcisvN0k3UFRlUmkxNVlhVmtWNWpxUGpoaGhxaXRydnUKcGduREFvR0JBTDlrUTdqV3FPTnB2Q2RtZFMwK0Voam5zcU1ta21ycWxhdEZjM2F2b0Jod3EyR0kxbWRNVDFmYwpHYjZIdlNsMWdDeG0vVGszMGpiZHI2eTJmWHl4UTdXc1FxWGNQRTZHYUFuWFE0d1l0ckZuY3BxTGR4Z0IzMmZmCkZEQ3p2bjRJZjBKUHAxdXNuZUpDclVpanlsTWhpcnBWSWdGUXY0cHdWV0g1T3JSeFVDS3cKLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K"
+
+argo-platform:
+  enabled: false

codefresh/.helmignore

@@ -8,4 +8,7 @@ bak/*
 *.bak
 
 # helm unittests
-tests
+tests
+
+# ci
+.ci/*

codefresh/Chart.lock

@@ -1,7 +1,7 @@
 dependencies:
 - name: cf-common
   repository: https://chartmuseum.codefresh.io/cf-common
-  version: 0.7.0
+  version: 0.8.1
 - name: internal-gateway
   repository: https://chartmuseum.codefresh.io/internal-gateway
   version: 0.1.1
@@ -34,7 +34,7 @@ dependencies:
   version: 4.6.1
 - name: cluster-providers
   repository: https://chartmuseum.codefresh.io/cluster-providers
-  version: 1.14.4
+  version: 1.15.0
 - name: kube-integration
   repository: https://chartmuseum.codefresh.io/kube-integration
   version: 1.29.6
@@ -55,7 +55,7 @@ dependencies:
   version: 3.126.3
 - name: gitops-dashboard-manager
   repository: https://chartmuseum.codefresh.io/gitops-dashboard-manager
-  version: 1.13.4
+  version: 1.13.5
 - name: cfapi
   repository: https://chartmuseum.codefresh.io/cfapi
   version: 21.222.17
@@ -112,7 +112,7 @@ dependencies:
   version: 14.88.45
 - name: k8s-monitor
   repository: https://chartmuseum.codefresh.io/k8s-monitor
-  version: 4.10.1
+  version: 4.10.2
 - name: runtime-environment-manager
   repository: https://chartmuseum.codefresh.io/runtime-environment-manager
   version: 3.25.2
@@ -124,13 +124,13 @@ dependencies:
   version: 0.10.3
 - name: hermes
   repository: https://chartmuseum.codefresh.io/hermes
-  version: 0.20.0
+  version: 0.20.1
 - name: nomios
   repository: https://chartmuseum.codefresh.io/nomios
-  version: 0.10.2
+  version: 0.10.3
 - name: cronus
   repository: https://chartmuseum.codefresh.io/cronus
-  version: 0.7.2
+  version: 0.7.3
 - name: cf-platform-analytics
   repository: https://chartmuseum.codefresh.io/cf-platform-analytics
   version: 0.45.8
@@ -139,12 +139,12 @@ dependencies:
   version: 0.45.8
 - name: argo-platform
   repository: https://chartmuseum.codefresh.io/argo-platform
-  version: 1.2257.0
+  version: 1.2258.0
 - name: argo-hub-platform
   repository: https://chartmuseum.codefresh.io/argo-hub-platform
   version: 0.1.1
 - name: codefresh-tunnel-server
   repository: https://chartmuseum.codefresh.io/codefresh-tunnel-server
   version: 0.1.12
-digest: sha256:bca923f93e37198c404f70ee1d86a128bd4c2fee86e429ad7310be4cb0f46061
-generated: "2023-05-19T00:05:18.655905368+03:00"
+digest: sha256:d86f9c468ccb49fa90dcd74dd70cbf6333671038ca9490dad1540a8076c4a51a
+generated: "2023-05-19T22:30:12.602319405+03:00"

codefresh/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 description: Helm Chart for Codefresh On-Prem
 name: codefresh
-version: 2.0.0-alpha.11
+version: 2.0.0-alpha.12
 keywords:
 - codefresh
 home: https://codefresh.io/
@@ -16,16 +16,18 @@ annotations:
   artifacthub.io/alternativeName: "codefresh-onprem"
   artifacthub.io/prerelease: "true"
   artifacthub.io/changes: |
+    - kind: added
+      description: Added MongoDB MTLS test case in CI
     - kind: changed
-      description: Bump cf-api, pipeline-manager, builder, etc
+      description: Changed replicas number for broadcaster and hermes
     - kind: changed
-      description: Bump runtime images: container-logger
-    - kind: fixed
-      description: Fixed mongo-seed job template
+      description: Bump cluster-providers, argo-platform, etc
+    - kind: changed
+      description: Updated mongo seed job script and job template
 dependencies:
 - name: cf-common
   repository: https://chartmuseum.codefresh.io/cf-common
-  version: 0.7.0
+  version: 0.8.1
 - name: internal-gateway
   repository: https://chartmuseum.codefresh.io/internal-gateway
   version: "0.1.1"

codefresh/README.md

@@ -1,6 +1,6 @@
 ## Codefresh On-Premises
 
-![Version: 2.0.0-alpha.11](https://img.shields.io/badge/Version-2.0.0--alpha.11-informational?style=flat-square) ![AppVersion: 2.0.0](https://img.shields.io/badge/AppVersion-2.0.0-informational?style=flat-square)
+![Version: 2.0.0-alpha.12](https://img.shields.io/badge/Version-2.0.0--alpha.12-informational?style=flat-square) ![AppVersion: 2.0.0](https://img.shields.io/badge/AppVersion-2.0.0-informational?style=flat-square)
 
 ## Table of Content
 
@@ -186,15 +186,15 @@ global:
       # existingName: my-mongodb-tls
       optional: true
 
-  container:
-    volumeMounts:
-      mongodb-tls:
-        path:
-        - mountPath: /etc/ssl/mongodb/ca.pem
-          subPath: ca.pem
+  volumeMounts:
+    mongodb-tls:
+      path:
+      - mountPath: /etc/ssl/mongodb/ca.pem
+        subPath: ca.pem
 
   env:
     MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
+    RUNTIME_MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
     RUNTIME_MONGO_TLS: "true"
     # Set these var to 'false' if self-signed certificate is used to avoid x509 errors
     RUNTIME_MONGO_TLS_VALIDATE: "false"
@@ -1036,7 +1036,7 @@ The bare minimal workload footprint for the new services (without HPA or PDB) is
 | global.imageRegistry | string | `""` | Global Docker image registry |
 | global.kubeIntegrationPort | int | `9000` | Default kube-integration service port. |
 | global.kubeIntegrationService | string | `"kube-integration"` | Default kube-integration service name. |
-| global.mongoURI | string | `"mongodb://cfuser:mTiXcU2wafr9@cf-mongodb:27017"` | Default Internal MongoDB URI (from bitnami/mongodb subchart).. Change if you use external MongoDB. See "External MongoDB" example below. Will be used by ALL services to communicate with MongoDB. Ref: https://www.mongodb.com/docs/manual/reference/connection-string/ Note! `defaultauthdb` is omitted here on purpose (i.e. mongodb://.../[defaultauthdb]). Mongo seed job will create and add `cfuser` (useraname and password are taken from `.Values.global.mongoURI`) with "ReadWrite" permissions to all of the required databases |
+| global.mongoURI | string | `"mongodb://cfuser:mTiXcU2wafr9@cf-mongodb:27017"` | Default Internal MongoDB URI (from bitnami/mongodb subchart).. Change if you use external MongoDB. See "External MongoDB" example below. Will be used by ALL services to communicate with MongoDB. Ref: https://www.mongodb.com/docs/manual/reference/connection-string/ Note! `defaultauthdb` is omitted here on purpose (i.e. mongodb://.../[defaultauthdb]). Mongo seed job will create and add `cfuser` (username and password are taken from `.Values.global.mongoURI`) with "ReadWrite" permissions to all of the required databases |
 | global.mongodbDatabase | string | `"codefresh"` | Default MongoDB database name. Don't change! |
 | global.mongodbRootPassword | string | `""` | DEPRECATED - Use `.Values.seed.mongoSeedJob` instead. |
 | global.mongodbRootUser | string | `""` | DEPRECATED - Use `.Values.seed.mongoSeedJob` instead. |
@@ -1116,7 +1116,7 @@ The bare minimal workload footprint for the new services (without HPA or PDB) is
 | seed.enabled | bool | `true` | Enable all seed jobs |
 | seed.mongoSeedJob | object | See below | Mongo Seed Job. Required at first install. Seeds the required data (default idp/user/account), creates cfuser and required databases. |
 | seed.mongoSeedJob.mongodbRootPassword | string | `"XT9nmM8dZD"` | Root password (required ONLY for seed job!). |
-| seed.mongoSeedJob.mongodbRootUser | string | `"root"` | Root user (required ONLY for seed job!) |
+| seed.mongoSeedJob.mongodbRootUser | string | `"root"` | Root user (required ONLY for seed job!). |
 | seed.postgresSeedJob | object | See below | Postgres Seed Job. Required at first install. Creates required user and databases. |
 | seed.postgresSeedJob.postgresPassword | optional | `""` | Password for "postgres" admin user (required ONLY for seed job!) |
 | seed.postgresSeedJob.postgresUser | optional | `""` | "postgres" admin user (required ONLY for seed job!) Must be a privileged user allowed to create databases and grant roles. If omitted, username and password from `.Values.global.postgresUser/postgresPassword` will be taken. |

codefresh/README.md.gotmpl

@@ -188,15 +188,15 @@ global:
       # existingName: my-mongodb-tls
       optional: true
 
-  container:
-    volumeMounts:
-      mongodb-tls:
-        path:
-        - mountPath: /etc/ssl/mongodb/ca.pem
-          subPath: ca.pem
+  volumeMounts:
+    mongodb-tls:
+      path:
+      - mountPath: /etc/ssl/mongodb/ca.pem
+        subPath: ca.pem
 
   env:
     MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
+    RUNTIME_MTLS_CERT_PATH: /etc/ssl/mongodb/ca.pem
     RUNTIME_MONGO_TLS: "true"
     # Set these var to 'false' if self-signed certificate is used to avoid x509 errors
     RUNTIME_MONGO_TLS_VALIDATE: "false"

codefresh/files/assets/accounts.json

@@ -0,0 +1,37 @@
+{
+  "_id": ObjectId("59009117c102763beda7ce71"),
+  "badgeToken": "eyJhbGciOiJIUzI1NiJ9.NTkwMDkxMTdjMTAyNzYzYmVkYTdjZTcx.B0HOUL6HlpTRNr_e95pVucSRMRzP2cobe5kIoMtrDSc",
+  "createdAt": ISODate("2017-04-26T12:22:48.001+0000"),
+  "updatedAt": ISODate("2017-04-26T12:27:13.720+0000"),
+  "name": "admin-cf",
+  "runtimeEnvironment": "codefresh",
+  "canUsePrivateRepos": true,
+  "dedicatedInfrastructure": false,
+  "cfcrRepositoryPath": "admin-cf",
+  "build": {
+    "nodes": NumberInt(0),
+    "parallel": NumberInt(1),
+    "strategy": "account"
+  },
+  "integrations": {
+    "stash": {
+      "active": false
+    },
+    "registries": []
+  },
+  "notifications": [
+    {
+      "type": "pr",
+      "events": [
+        "build-success"
+      ]
+    }
+  ],
+  "repoPermission": "public",
+  "environment": NumberInt(1),
+  "admins": [
+      ObjectId("59009221c102763beda7cf04")
+  ],
+  "localUserPasswordIDPEnabled": true,
+  "__v": NumberInt(0)
+}