diff --git a/charts/cf-runtime/Chart.yaml b/charts/cf-runtime/Chart.yaml index 45ac11c0..520becf3 100644 --- a/charts/cf-runtime/Chart.yaml +++ b/charts/cf-runtime/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 description: A Helm chart for Codefresh Runner name: cf-runtime -version: 9.0.5 +version: 9.0.6 keywords: - codefresh - runner @@ -18,17 +18,9 @@ annotations: # Supported kinds: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`: artifacthub.io/changes: | - kind: changed - description: 'Update "engine" to 2.1.1' - - kind: changed - description: 'Update "cf-container-logger" to 2.0.1.' - - kind: changed - description: 'Update "cf-debugger" to 1.3.12.' - - kind: changed - description: 'Update "cf-app-proxy" to 0.0.59.' - - kind: changed - description: 'Update "cf-k8s-agent" images to 1.3.26.' + description: 'Update "engine" to 2.1.2' - kind: security - description: 'Fix various security vulnerabilities in multiple runtime components.' + description: 'Fix security vulnerability in engine.' dependencies: - name: cf-common repository: oci://quay.io/codefresh/charts diff --git a/charts/cf-runtime/README.md b/charts/cf-runtime/README.md index 71b6cee5..06b83ef1 100644 --- a/charts/cf-runtime/README.md +++ b/charts/cf-runtime/README.md @@ -1,6 +1,6 @@ ## Codefresh Runner -![Version: 9.0.5](https://img.shields.io/badge/Version-9.0.5-informational?style=flat-square) +![Version: 9.0.6](https://img.shields.io/badge/Version-9.0.6-informational?style=flat-square) Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/installation/codefresh-runner/) to Kubernetes. @@ -1351,7 +1351,7 @@ Install the Helm chart | runtime.dind.userVolumeMounts | object | `{}` | Add extra volume mounts | | runtime.dind.userVolumes | object | `{}` | Add extra volumes | | runtime.dindDaemon | object | See below | DinD pod daemon config | -| runtime.engine | object | `{"affinity":{},"command":["node","dist/server/index.js"],"env":{"CF_TELEMETRY_LOGS_LEVEL":"debug","CF_TELEMETRY_OTEL_ALLOW_HTTP_INSTRUMENTATION":"false","CF_TELEMETRY_OTEL_ENABLE":"true","CF_TELEMETRY_PROMETHEUS_ENABLE":"false","CF_TELEMETRY_PROMETHEUS_ENABLE_PROCESS_METRICS":"false","CF_TELEMETRY_PROMETHEUS_HOST":"0.0.0.0","CF_TELEMETRY_PROMETHEUS_PORT":"9100","CF_TELEMETRY_PYROSCOPE_ENABLE":"false","CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_SCRAPE_TIMEOUT_MS":"0","OTEL_EXPORTER_OTLP_COMPRESSION":"gzip","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4317","OTEL_EXPORTER_OTLP_PROTOCOL":"grpc","OTEL_EXPORTER_PROMETHEUS_HOST":"0.0.0.0","OTEL_EXPORTER_PROMETHEUS_PORT":"9464","OTEL_LOGS_EXPORTER":"none","OTEL_METRICS_EXPORTER":"otlp","OTEL_METRIC_EXPORT_INTERVAL":"10000","OTEL_METRIC_EXPORT_TIMEOUT":"5000","OTEL_SEMCONV_STABILITY_OPT_IN":"http","OTEL_TRACES_EXPORTER":"none","OTEL_TRACES_SAMPLER":"parentbased_always_on","PYROSCOPE_SERVER_ADDRESS":"","TRUSTED_QEMU_IMAGES":"tonistiigi/binfmt"},"image":{"digest":"sha256:34090203ad745bb5264b0220a73917840fb4c3000b38a5d19a8d8a4a0c101c3d","pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"2.1.1"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"resources":{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}},"runtimeImages":{"alpine":{"digest":"sha256:115729ec5cb049ba6359c3ab005ac742012d92bbaa5b8bc1a878f1e8f62c0cb8","registry":"docker.io","repository":"alpine","tag":"edge"},"compose":{"digest":"sha256:a393db5c299ec21c24a9c09e2dd233d30a38a0b7d21eb955d5464572867d3860","registry":"quay.io","repository":"codefresh/compose","tag":"v2.40.3-1.5.8"},"container-logger":{"digest":"sha256:18b5c17eb3325f16e66ae8e602432663b6d4039d495142c11f4bbbde9c8e39f2","registry":"quay.io","repository":"codefresh/cf-container-logger","tag":"2.0.1"},"cosign-image-signer":{"digest":"sha256:316cd24c623a26edc59e0f5d9a3fd6269a1307c74e11cf523efa3a42a5573fb5","registry":"quay.io","repository":"codefresh/cf-cosign-image-signer","tag":"2.5.2-cf.3"},"default-qemu":{"digest":"sha256:30cc9a4d03765acac9be2ed0afc23af1ad018aed2c28ea4be8c2eb9afe03fbd1","registry":"docker.io","repository":"tonistiigi/binfmt","tag":"qemu-v10.0.4"},"docker-builder":{"digest":"sha256:5dc1194960b95b56096bbc97acd5593ceda9a9bc98afcc921dfe87e5fbfc68b3","registry":"quay.io","repository":"codefresh/cf-docker-builder","tag":"1.5.3"},"docker-puller":{"digest":"sha256:09725c496f66cace02b523e1e3be7434519e751b5a1a5927c76cf95fbb0dc7d7","registry":"quay.io","repository":"codefresh/cf-docker-puller","tag":"8.0.24"},"docker-pusher":{"digest":"sha256:5bf734ffea8f3bb9cdafeabbdcff7f26a2db68552cf7a91d48a5eff2699a57a8","registry":"quay.io","repository":"codefresh/cf-docker-pusher","tag":"6.0.23"},"docker-tag-pusher":{"digest":"sha256:2b3564825566b3ca66b5e63f36f1323ad24844a9fbc19f31194e5534d0b7bd36","registry":"quay.io","repository":"codefresh/cf-docker-tag-pusher","tag":"1.3.21"},"fs-ops":{"digest":"sha256:cade5ace4d05528dfd0cbdbb96bd99c6ccae79dfeebe14661a4b7808e2131dc9","registry":"quay.io","repository":"codefresh/fs-ops","tag":"1.2.11"},"gc-builder":{"digest":"sha256:5405a4476420e21d12d4a80b030d8737dcae5262a8b20c0ea018e8db710e9d2c","registry":"quay.io","repository":"codefresh/gcloud-builder","tag":"0.5.6"},"git-cloner":{"digest":"sha256:ce1e922b94bbf1e5bd224468a2ccfe969200661ca2b6f0182b26ee0ad06e1a6d","registry":"quay.io","repository":"codefresh/cf-git-cloner","tag":"10.3.4"},"kube-deploy":{"digest":"sha256:ee9f56c8c5fc73dfd45511fb003dc53f35e0c46a78acdbb62ad386f33913b765","registry":"quay.io","repository":"codefresh/cf-deploy-kubernetes","tag":"17.0.0"},"pipeline-debugger":{"digest":"sha256:f31592c1b9955e49bee62c0cde0ce4d2b0ee3519f0c2e4adb1a08d7babde7164","registry":"quay.io","repository":"codefresh/cf-debugger","tag":"1.3.12"},"template-engine":{"digest":"sha256:37ec7bed4b09e4055c3600a7805f84e37cccf8d849fe0fdd5b29f079de15010c","registry":"quay.io","repository":"codefresh/pikolo","tag":"0.14.8"}},"runtimeImagesRegistry":"","schedulerName":"","serviceAccount":"codefresh-engine","terminationGracePeriodSeconds":180,"tolerations":[],"userEnvVars":[],"workflowLimits":{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_POST_STEPS_GRACE_PERIOD_MINUTES":30,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}}` | Parameters for Engine pod (aka "pipeline" orchestrator). | +| runtime.engine | object | `{"affinity":{},"command":["node","dist/server/index.js"],"env":{"CF_TELEMETRY_LOGS_LEVEL":"debug","CF_TELEMETRY_OTEL_ALLOW_HTTP_INSTRUMENTATION":"false","CF_TELEMETRY_OTEL_ENABLE":"true","CF_TELEMETRY_PROMETHEUS_ENABLE":"false","CF_TELEMETRY_PROMETHEUS_ENABLE_PROCESS_METRICS":"false","CF_TELEMETRY_PROMETHEUS_HOST":"0.0.0.0","CF_TELEMETRY_PROMETHEUS_PORT":"9100","CF_TELEMETRY_PYROSCOPE_ENABLE":"false","CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_SCRAPE_TIMEOUT_MS":"0","OTEL_EXPORTER_OTLP_COMPRESSION":"gzip","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4317","OTEL_EXPORTER_OTLP_PROTOCOL":"grpc","OTEL_EXPORTER_PROMETHEUS_HOST":"0.0.0.0","OTEL_EXPORTER_PROMETHEUS_PORT":"9464","OTEL_LOGS_EXPORTER":"none","OTEL_METRICS_EXPORTER":"otlp","OTEL_METRIC_EXPORT_INTERVAL":"10000","OTEL_METRIC_EXPORT_TIMEOUT":"5000","OTEL_SEMCONV_STABILITY_OPT_IN":"http","OTEL_TRACES_EXPORTER":"none","OTEL_TRACES_SAMPLER":"parentbased_always_on","PYROSCOPE_SERVER_ADDRESS":"","TRUSTED_QEMU_IMAGES":"tonistiigi/binfmt"},"image":{"digest":"sha256:9a2605ff47d632246854f3737f3aae21024c5007ef49d7eee4d0fe7623506cc0","pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"2.1.2"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"resources":{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}},"runtimeImages":{"alpine":{"digest":"sha256:115729ec5cb049ba6359c3ab005ac742012d92bbaa5b8bc1a878f1e8f62c0cb8","registry":"docker.io","repository":"alpine","tag":"edge"},"compose":{"digest":"sha256:a393db5c299ec21c24a9c09e2dd233d30a38a0b7d21eb955d5464572867d3860","registry":"quay.io","repository":"codefresh/compose","tag":"v2.40.3-1.5.8"},"container-logger":{"digest":"sha256:18b5c17eb3325f16e66ae8e602432663b6d4039d495142c11f4bbbde9c8e39f2","registry":"quay.io","repository":"codefresh/cf-container-logger","tag":"2.0.1"},"cosign-image-signer":{"digest":"sha256:316cd24c623a26edc59e0f5d9a3fd6269a1307c74e11cf523efa3a42a5573fb5","registry":"quay.io","repository":"codefresh/cf-cosign-image-signer","tag":"2.5.2-cf.3"},"default-qemu":{"digest":"sha256:30cc9a4d03765acac9be2ed0afc23af1ad018aed2c28ea4be8c2eb9afe03fbd1","registry":"docker.io","repository":"tonistiigi/binfmt","tag":"qemu-v10.0.4"},"docker-builder":{"digest":"sha256:5dc1194960b95b56096bbc97acd5593ceda9a9bc98afcc921dfe87e5fbfc68b3","registry":"quay.io","repository":"codefresh/cf-docker-builder","tag":"1.5.3"},"docker-puller":{"digest":"sha256:09725c496f66cace02b523e1e3be7434519e751b5a1a5927c76cf95fbb0dc7d7","registry":"quay.io","repository":"codefresh/cf-docker-puller","tag":"8.0.24"},"docker-pusher":{"digest":"sha256:5bf734ffea8f3bb9cdafeabbdcff7f26a2db68552cf7a91d48a5eff2699a57a8","registry":"quay.io","repository":"codefresh/cf-docker-pusher","tag":"6.0.23"},"docker-tag-pusher":{"digest":"sha256:2b3564825566b3ca66b5e63f36f1323ad24844a9fbc19f31194e5534d0b7bd36","registry":"quay.io","repository":"codefresh/cf-docker-tag-pusher","tag":"1.3.21"},"fs-ops":{"digest":"sha256:cade5ace4d05528dfd0cbdbb96bd99c6ccae79dfeebe14661a4b7808e2131dc9","registry":"quay.io","repository":"codefresh/fs-ops","tag":"1.2.11"},"gc-builder":{"digest":"sha256:5405a4476420e21d12d4a80b030d8737dcae5262a8b20c0ea018e8db710e9d2c","registry":"quay.io","repository":"codefresh/gcloud-builder","tag":"0.5.6"},"git-cloner":{"digest":"sha256:ce1e922b94bbf1e5bd224468a2ccfe969200661ca2b6f0182b26ee0ad06e1a6d","registry":"quay.io","repository":"codefresh/cf-git-cloner","tag":"10.3.4"},"kube-deploy":{"digest":"sha256:ee9f56c8c5fc73dfd45511fb003dc53f35e0c46a78acdbb62ad386f33913b765","registry":"quay.io","repository":"codefresh/cf-deploy-kubernetes","tag":"17.0.0"},"pipeline-debugger":{"digest":"sha256:f31592c1b9955e49bee62c0cde0ce4d2b0ee3519f0c2e4adb1a08d7babde7164","registry":"quay.io","repository":"codefresh/cf-debugger","tag":"1.3.12"},"template-engine":{"digest":"sha256:37ec7bed4b09e4055c3600a7805f84e37cccf8d849fe0fdd5b29f079de15010c","registry":"quay.io","repository":"codefresh/pikolo","tag":"0.14.8"}},"runtimeImagesRegistry":"","schedulerName":"","serviceAccount":"codefresh-engine","terminationGracePeriodSeconds":180,"tolerations":[],"userEnvVars":[],"workflowLimits":{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_POST_STEPS_GRACE_PERIOD_MINUTES":30,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}}` | Parameters for Engine pod (aka "pipeline" orchestrator). | | runtime.engine.affinity | object | `{}` | Set affinity | | runtime.engine.command | list | `["node","dist/server/index.js"]` | Set container command. | | runtime.engine.env | object | `{"CF_TELEMETRY_LOGS_LEVEL":"debug","CF_TELEMETRY_OTEL_ALLOW_HTTP_INSTRUMENTATION":"false","CF_TELEMETRY_OTEL_ENABLE":"true","CF_TELEMETRY_PROMETHEUS_ENABLE":"false","CF_TELEMETRY_PROMETHEUS_ENABLE_PROCESS_METRICS":"false","CF_TELEMETRY_PROMETHEUS_HOST":"0.0.0.0","CF_TELEMETRY_PROMETHEUS_PORT":"9100","CF_TELEMETRY_PYROSCOPE_ENABLE":"false","CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_SCRAPE_TIMEOUT_MS":"0","OTEL_EXPORTER_OTLP_COMPRESSION":"gzip","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4317","OTEL_EXPORTER_OTLP_PROTOCOL":"grpc","OTEL_EXPORTER_PROMETHEUS_HOST":"0.0.0.0","OTEL_EXPORTER_PROMETHEUS_PORT":"9464","OTEL_LOGS_EXPORTER":"none","OTEL_METRICS_EXPORTER":"otlp","OTEL_METRIC_EXPORT_INTERVAL":"10000","OTEL_METRIC_EXPORT_TIMEOUT":"5000","OTEL_SEMCONV_STABILITY_OPT_IN":"http","OTEL_TRACES_EXPORTER":"none","OTEL_TRACES_SAMPLER":"parentbased_always_on","PYROSCOPE_SERVER_ADDRESS":"","TRUSTED_QEMU_IMAGES":"tonistiigi/binfmt"}` | Set additional env vars. | @@ -1383,7 +1383,7 @@ Install the Helm chart | runtime.engine.env.OTEL_TRACES_SAMPLER | string | `"parentbased_always_on"` | OTel sampler to be used for traces. Ref: https://opentelemetry.io/docs/specs/otel/configuration/sdk-environment-variables/ | | runtime.engine.env.PYROSCOPE_SERVER_ADDRESS | string | `""` | Pyroscope server address | | runtime.engine.env.TRUSTED_QEMU_IMAGES | string | `"tonistiigi/binfmt"` | Trusted QEMU images used for docker builds - when left blank defaults to .runtime.engine.runtimeImages.DEFAULT_QEMU_IMAGE value | -| runtime.engine.image | object | `{"digest":"sha256:34090203ad745bb5264b0220a73917840fb4c3000b38a5d19a8d8a4a0c101c3d","pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"2.1.1"}` | Set image. | +| runtime.engine.image | object | `{"digest":"sha256:9a2605ff47d632246854f3737f3aae21024c5007ef49d7eee4d0fe7623506cc0","pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"2.1.2"}` | Set image. | | runtime.engine.nodeSelector | object | `{}` | Set node selector. | | runtime.engine.podAnnotations | object | `{}` | Set pod annotations. | | runtime.engine.podLabels | object | `{}` | Set pod labels. | diff --git a/charts/cf-runtime/values.yaml b/charts/cf-runtime/values.yaml index e67786c1..7b6db92a 100644 --- a/charts/cf-runtime/values.yaml +++ b/charts/cf-runtime/values.yaml @@ -505,9 +505,9 @@ runtime: image: registry: quay.io repository: codefresh/engine - tag: 2.1.1 + tag: 2.1.2 pullPolicy: IfNotPresent - digest: sha256:34090203ad745bb5264b0220a73917840fb4c3000b38a5d19a8d8a4a0c101c3d + digest: sha256:9a2605ff47d632246854f3737f3aae21024c5007ef49d7eee4d0fe7623506cc0 # -- Set container command. command: - 'node'