Fix ci

Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: puppetserver
 version: 10.1.1
-appVersion: 8.13.0
+appVersion: 8.14.0
 description: OpenVox automates the delivery and operation of software.
 keywords: ["OpenVox", "OpenVoxserver", "automation", "iac", "infrastructure", "cm", "ci", "cd"]
 home: https://puppet.com/

templates/puppetdb-deployment.yaml

@@ -363,8 +363,8 @@ spec:
             - name: metrics
               containerPort: {{ .Values.metrics.prometheus.puppetdb.port }}
           securityContext:
-            runAsUser: 999
-            runAsGroup: 999
+            runAsUser: 64604
+            runAsGroup: 64604
             runAsNonRoot: true
             allowPrivilegeEscalation: false
             capabilities:

templates/puppetserver-deployment-compilers.yaml

@@ -542,8 +542,8 @@ spec:
               mountPath: /jmx_exporter.yaml
               subPath: jmx_exporter.yaml
           securityContext:
-            runAsUser: 999
-            runAsGroup: 999
+            runAsUser: 64604
+            runAsGroup: 64604
             runAsNonRoot: true
             allowPrivilegeEscalation: false
             capabilities:
@@ -570,7 +570,7 @@ spec:
       {{ toYaml . }}
       {{- end }}
       securityContext:
-        fsGroup: 999   # "puppet" GID
+        fsGroup: 64604   # "puppet" GID
       volumes:
         - name: puppet-code-storage
           persistentVolumeClaim:

templates/puppetserver-deployment-masters.yaml

@@ -138,11 +138,13 @@ spec:
               {{- if .Values.puppetserver.extraInitArgs }}
               {{- .Values.puppetserver.extraInitArgs | nindent 14 }}
               {{- end }}
+              mkdir -p /opt/puppetlabs/server/data/puppetserver/.puppetlabs/etc/puppet
               mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/;
               touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde;
               chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/;
               {{- if eq .Values.puppetserver.persistence.confd.enabled true }}
               cp -rp /etc/puppetlabs/puppetserver/conf.d/* /conf.d/;
+              chown puppet:puppet -R /conf.d/;
               {{- end}}
           securityContext:
             runAsUser: 0
@@ -577,8 +579,8 @@ spec:
               mountPath: /jmx_exporter.yaml
               subPath: jmx_exporter.yaml
           securityContext:
-            runAsUser: 999
-            runAsGroup: 999
+            runAsUser: 64604
+            runAsGroup: 64604
             runAsNonRoot: true
             allowPrivilegeEscalation: false
             capabilities:
@@ -604,7 +606,7 @@ spec:
       {{ toYaml . }}
       {{- end }}
       securityContext:
-        fsGroup: 999   # "puppet" GID
+        fsGroup: 64604   # "puppet" GID
       volumes:
         {{- if (not .Values.puppetserver.compilers.enabled) }}
         - name: puppet-code-storage

templates/puppetserver-statefulset-compilers.yaml

@@ -505,8 +505,8 @@ spec:
               mountPath: /jmx_exporter.yaml
               subPath: jmx_exporter.yaml
           securityContext:
-            runAsUser: 999
-            runAsGroup: 999
+            runAsUser: 64604
+            runAsGroup: 64604
             runAsNonRoot: true
             allowPrivilegeEscalation: false
             capabilities:
@@ -532,7 +532,7 @@ spec:
       {{ toYaml . }}
       {{- end }}
       securityContext:
-        fsGroup: 999   # "puppet" GID
+        fsGroup: 64604   # "puppet" GID
       volumes:
         {{- if .Values.hiera.config }}
         - name: hiera-volume

tests/__snapshot__/jmx-servicemonitor_test.yaml.snap

@@ -8,7 +8,7 @@ manifest should match snapshot:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
         release: kube-prometheus-stack
       name: puppetserver-jmx

tests/__snapshot__/openvoxview-ingress_test.yaml.snap

@@ -8,7 +8,7 @@ should create openvoxview ingress when enabled:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
       name: puppetserver-puppetdb-openvoxview
     spec:

tests/__snapshot__/puppetdb-deployment.openvoxview_test.yaml.snap

@@ -8,7 +8,7 @@ should include openvoxview sidecar when enabled:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
       name: puppetserver-puppetdb
     spec:
@@ -26,7 +26,7 @@ should include openvoxview sidecar when enabled:
             app.kubernetes.io/instance: puppetserver
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: puppetserver
-            app.kubernetes.io/version: 8.13.0
+            app.kubernetes.io/version: 8.14.0
             helm.sh/chart: puppetserver-10.1.1
         spec:
           containers:
@@ -52,7 +52,7 @@ should include openvoxview sidecar when enabled:
                 - name: PUPPETDB_JAVA_ARGS
                   value: ""
               envFrom: null
-              image: ghcr.io/openvoxproject/openvoxdb:8.13.0-main
+              image: ghcr.io/openvoxproject/openvoxdb:8.14.0-main
               imagePullPolicy: IfNotPresent
               name: puppetdb
               ports:
@@ -110,9 +110,9 @@ should include openvoxview sidecar when enabled:
                 capabilities:
                   drop:
                     - all
-                runAsGroup: 999
+                runAsGroup: 64604
                 runAsNonRoot: true
-                runAsUser: 999
+                runAsUser: 64604
               volumeMounts:
                 - mountPath: /opt/puppetlabs/server/data/puppetdb
                   name: puppetdb-storage

tests/__snapshot__/puppetdb-pvc_test.yaml.snap

@@ -9,7 +9,7 @@ manifest should match snapshot:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
       name: puppetserver-puppetdb-claim
     spec:

tests/__snapshot__/puppetdb-service.openvoxview_test.yaml.snap

@@ -8,7 +8,7 @@ should expose openvoxview port when enabled:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
       name: puppetserver-puppetdb
     spec:

tests/__snapshot__/puppetdb-servicemonitor_test.yaml.snap

@@ -8,7 +8,7 @@ manifest should match snapshot:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
         release: kube-prometheus-stack
       name: puppetserver-puppetdb

tests/__snapshot__/puppetdb.networkpolicy_test.yaml.snap

@@ -8,7 +8,7 @@ manifest should match snapshot:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
       name: puppetserver-puppetdb
     spec:

tests/__snapshot__/puppetserver-ca-pvc_test.yaml.snap

@@ -3,13 +3,14 @@ manifest should match snapshot:
     apiVersion: v1
     kind: PersistentVolumeClaim
     metadata:
-      annotations: null
+      annotations:
+        helm.sh/hook: pre-install
       labels:
         app.kubernetes.io/component: puppetserver
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
       name: puppetserver-ca-claim
     spec:

tests/__snapshot__/puppetserver-compilers.deployment_test.yaml.snap

@@ -8,7 +8,7 @@ manifest should match snapshot:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
       name: puppetserver-puppetserver-compiler
     spec:
@@ -30,27 +30,18 @@ manifest should match snapshot:
             app.kubernetes.io/instance: puppetserver
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: puppetserver
-            app.kubernetes.io/version: 8.13.0
+            app.kubernetes.io/version: 8.14.0
             helm.sh/chart: puppetserver-10.1.1
         spec:
           containers:
-            - env:
-                - name: OPENVOXSERVER_PORT
-                  value: "8140"
-                - name: DNS_ALT_NAMES
-                  value: puppet,puppetserver-agents-to-puppet,puppetserver-puppet,,puppetserver-puppet-compilers,
-                - name: OPENVOXDB_SERVER_URLS
-                  value: https://puppetserver-puppetdb:8081
-                - name: CA_ENABLED
-                  value: "false"
-                - name: CA_ALLOW_SUBJECT_ALT_NAMES
-                  value: "true"
-                - name: CA_HOSTNAME
-                  value: puppetserver-puppet
-                - name: CA_PORT
-                  value: "8140"
+            - args:
+                - exec /opt/puppetlabs/bin/puppetserver foreground
+              command:
+                - /bin/bash
+                - -c
+              env: null
               envFrom: null
-              image: ghcr.io/openvoxproject/openvoxserver:8.13.0-main
+              image: ghcr.io/openvoxproject/openvoxserver:8.14.0-main
               imagePullPolicy: IfNotPresent
               livenessProbe:
                 failureThreshold: 3
@@ -75,21 +66,11 @@ manifest should match snapshot:
               securityContext:
                 allowPrivilegeEscalation: false
                 capabilities:
-                  add:
-                    - CAP_CHOWN
-                    - CAP_SETUID
-                    - CAP_SETGID
-                    - CAP_DAC_OVERRIDE
-                    - CAP_AUDIT_WRITE
-                    - CAP_FOWNER
-                    - CHOWN
-                    - SETUID
-                    - SETGID
-                    - DAC_OVERRIDE
-                    - AUDIT_WRITE
-                    - FOWNER
                   drop:
                     - all
+                runAsGroup: 64604
+                runAsNonRoot: true
+                runAsUser: 64604
               startupProbe:
                 failureThreshold: 30
                 periodSeconds: 15
@@ -100,74 +81,22 @@ manifest should match snapshot:
                   name: puppet-code-storage
                 - mountPath: /etc/puppetlabs/puppet/
                   name: puppet-puppet-storage
-                - mountPath: /opt/puppetlabs/server/data/puppetserver/
-                  name: puppet-serverdata-storage
-                - mountPath: /etc/puppetlabs/puppetserver/conf.d/
-                  name: puppet-confd
+                - mountPath: /etc/puppetlabs/puppetserver/
+                  name: puppet-puppetserver
           hostname: puppet
           imagePullSecrets: null
-          initContainers:
-            - args:
-                - mkdir -p /etc/puppetlabs/puppet/eyaml/keys; mkdir -p /etc/puppetlabs/code/environments; mkdir -p /etc/puppetlabs/puppet/manifests; chown -R puppet:puppet /etc/puppetlabs; cp /tmp/puppet/configmap/site.pp /etc/puppetlabs/puppet/manifests/site.pp; chown puppet:puppet /etc/puppetlabs/puppet/manifests/site.pp; mkdir -p /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/; touch /opt/puppetlabs/server/data/puppetserver/dropsonde/bin/dropsonde; chown puppet:puppet -R /opt/puppetlabs/server/data/puppetserver/;
-              command:
-                - sh
-                - -c
-              env: null
-              envFrom: null
-              image: ghcr.io/openvoxproject/openvoxserver:8.13.0-main
-              imagePullPolicy: IfNotPresent
-              name: perms-and-dirs
-              resources:
-                limits:
-                  cpu: 300m
-                  memory: 256Mi
-                requests:
-                  cpu: 200m
-                  memory: 128Mi
-              securityContext:
-                capabilities:
-                  add:
-                    - CAP_CHOWN
-                    - CAP_SETUID
-                    - CAP_SETGID
-                    - CAP_DAC_OVERRIDE
-                    - CAP_AUDIT_WRITE
-                    - CAP_FOWNER
-                    - CHOWN
-                    - SETUID
-                    - SETGID
-                    - DAC_OVERRIDE
-                    - AUDIT_WRITE
-                    - FOWNER
-                  drop:
-                    - all
-                runAsNonRoot: false
-                runAsUser: 0
-              volumeMounts:
-                - mountPath: /etc/puppetlabs/puppet/
-                  name: puppet-puppet-storage
-                - mountPath: /etc/puppetlabs/code/
-                  name: puppet-code-storage
-                - mountPath: /tmp/puppet/configmap/site.pp
-                  name: manifests-volume
-                  subPath: site.pp
-                - mountPath: /opt/puppetlabs/server/data/puppetserver/
-                  name: puppet-serverdata-storage
           securityContext:
-            fsGroup: 999
+            fsGroup: 64604
           volumes:
             - name: puppet-code-storage
               persistentVolumeClaim:
                 claimName: puppetserver-code-claim
             - name: puppet-puppet-storage
               persistentVolumeClaim:
                 claimName: puppetserver-puppet-claim
-            - name: puppet-serverdata-storage
-              persistentVolumeClaim:
-                claimName: puppetserver-serverdata-claim
             - configMap:
                 name: puppetserver-manifests-config
               name: manifests-volume
-            - name: puppet-confd
+            - name: puppet-puppetserver
               persistentVolumeClaim:
-                claimName: puppetserver-confd-claim
+                claimName: puppetserver-puppetserver-claim

tests/__snapshot__/puppetserver-compilers.networkpolicy_test.yaml.snap

@@ -8,7 +8,7 @@ manifest should match snapshot:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
       name: puppetserver-puppetserver-compilers
     spec:

tests/__snapshot__/puppetserver-compilers.pdb_test.yaml.snap

@@ -8,7 +8,7 @@ manifest should match snapshot:
         app.kubernetes.io/instance: puppetserver
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: puppetserver
-        app.kubernetes.io/version: 8.13.0
+        app.kubernetes.io/version: 8.14.0
         helm.sh/chart: puppetserver-10.1.1
       name: puppetserver-compilers
     spec: