Skip to content

Commit fac96a4

Browse files
eddymoultoneddymoulton
authored
Update Kubernetes monitor to 0.19.1 (#481)
1 parent e1b84a4 commit fac96a4

13 files changed

+216
-92
lines changed

‎.changeset/chilly-months-think.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
"kubernetes-agent": minor
3+
---
4+
5+
Update Kubernetes monitor to 0.19.1 and allow reading Octopus server certificates from an existing secret
6+
- Adds explicit namespaces to Kubernetes monitor resources
7+
- Allows using custom CA certificates to register Kubernetes monitors with Octopus Server

‎.gitignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,6 @@ node_modules
77

88
.DS_STORE
99

10-
*.orig
10+
*.orig
11+
12+
.debug/

‎charts/kubernetes-agent/Chart.lock‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
dependencies:
22
- name: kubernetes-monitor-chart
33
repository: oci://docker.io/octopusdeploy
4-
version: 0.18.0
5-
digest: sha256:945bc862d499601aee4c49af11002d9177b7d9d43d0dfce088c46a08d2cec4b9
6-
generated: "2025-07-14T11:18:12.700755+10:00"
4+
version: 0.19.1
5+
digest: sha256:756b9bf018d9beb1f810217d94ea1cf999275efa97188b683e8943217acdaa11
6+
generated: "2025-09-24T08:47:16.975634+10:00"

‎charts/kubernetes-agent/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ maintainers:
1010
url: "https://octopus.com"
1111
dependencies:
1212
- name: kubernetes-monitor-chart
13-
version: "0.18.0"
13+
version: "0.19.1"
1414
repository: "oci://docker.io/octopusdeploy"
1515
condition: kubernetesMonitor.enabled
1616
alias: kubernetesMonitor

‎charts/kubernetes-agent/README.md‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ The Kubernetes agent is optionally installed alongside the Kubernetes agent, [re
6767
| agent.serverApiKey | string | `""` | An Octopus Server API key used to authenticate with the target Octopus Server |
6868
| agent.serverApiKeySecretName | string | `""` | The name of an existing Secret that contains a base64-encoded Octopus Server API Key. Value must be set in `data.api-key` in secret. |
6969
| agent.serverCertificate | string | `""` | The base64-encoded public key of the self-signed x509 certificate or root CA certificate used by the target Octopus Server. Must be in the PEM/CER format. See [documentation](https://octopus.com/docs/kubernetes/targets/kubernetes-agent#trusting-custominternal-octopus-server-certificates) for more information. |
70+
| agent.serverCertificateSecretName | string | `""` | The name of a secret containing the base64-encoded public key of the self-signed x509 certificate or root CA certificate used by the target Octopus Server. Must be in the PEM/CER format. Value must be set in `data.octopus-server-certificate.pem` in secret. |
7071
| agent.serverCommsAddress | string | `""` | The polling communication URL of the target Octopus Server |
7172
| agent.serverCommsAddresses | list | `[]` | The polling communication URLs of the target Octopus Servers when running in High Availability (HA) |
7273
| agent.serverSubscriptionId | string | `""` | The subscription ID that is used to by the agent to identify itself with Octopus Server |
@@ -75,7 +76,7 @@ The Kubernetes agent is optionally installed alongside the Kubernetes agent, [re
7576
| agent.serviceAccount.name | string | Generates a name based on `agent.name` | The name of the service account for the agent pod |
7677
| agent.space | string | `"Default"` | The Space to register the agent in |
7778
| agent.tolerations | list | `[]` | The tolerations to apply to the agent pod |
78-
| agent.upgrade | object | `{"dockerAuth":{"password":"","registry":"","username":""}}` | Credentials used during agent-upgrade tasks. To be populated if encountering rate-limiting failures. |
79+
| agent.upgrade | object | `{"dockerAuth":{"password":"","registry":"","username":""}}` | Credentials used during agent-upgrade tasks. To be populated if encountering rate-limiting failures. |
7980
| agent.username | string | `""` | The username of the user used to authenticate with the target Octopus Server |
8081
| agent.usernamePasswordSecretName | string | `""` | The name of an existing Secret that contains a base64-encoded username and password for an Octopus Server user. Values must be set in `data.username` and `data.password` in secret. |
8182

@@ -115,6 +116,14 @@ The Kubernetes agent is optionally installed alongside the Kubernetes agent, [re
115116
| autoUpgrader.selfNamespaceRoleRules | list | `[{"apiGroups":["*"],"resources":["*"],"verbs":["*"]}]` | Rules for managing the agent in its own namespace when using namespace-scoped roles |
116117
| autoUpgrader.targetNamespaceRoleRules | list | `[{"apiGroups":["rbac.authorization.k8s.io"],"resources":["roles","rolebindings"],"verbs":["create","update","patch","get","list","watch","delete"]},{"apiGroups":["rbac.authorization.k8s.io"],"resources":["roles"],"verbs":["escalate"]}]` | Rules for managing script pod roles in target namespaces when using namespace-scoped roles |
117118

119+
### Globals
120+
121+
| Key | Type | Default | Description |
122+
|-----|------|---------|-------------|
123+
| global.serverApiUrl | string | `""` | This is overridden by agent.serverUrl if both are set |
124+
| global.serverCertificate | string | `""` | This is overridden by agent.serverCertificate if both are set |
125+
| global.serverCertificateSecretName | string | `""` | This is overridden by agent.serverCertificateSecretName if both are set |
126+
118127
### Persistence
119128

120129
| Key | Type | Default | Description |

‎charts/kubernetes-agent/kubernetes-monitor.md‎

Lines changed: 25 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
1-
## Kubernetes monitor
1+
## Kubernetes Monitor
22

3-
The Kubernetes monitor is component installed alongside the Kubernetes agent that enables functionality used for [Kubernetes Live Object Status](https://octopus.com/docs/kubernetes/live-object-status).
4-
5-
The helm chart is hosted on [Docker Hub](https://hub.docker.com/r/octopusdeploy/kubernetes-monitor-chart), where you can pull it using Helm.
6-
7-
The source for this Helm chart is not yet published openly, check back soon for updates here.
3+
The helm chart is hosted on [Docker Hub](https://hub.docker.com/r/octopusdeploy/kubernetes-monitor), where you can pull it using Helm.
84

95
## Versions
106

@@ -18,28 +14,40 @@ The Kubernetes Monitor Helm chart follows [Semantic Versioning](https://semver.o
1814

1915
## Values
2016

17+
### Globals
18+
19+
| Key | Type | Default | Description |
20+
| ---------------------------------- | ------ | ------- | ------------------------------------------------------------------------------ |
21+
| global.serverApiUrl | string | `""` | This is overridden by registration.serverApiUrl if both are set |
22+
| global.serverCertificate | string | `""` | This is overridden by registration.serverCertificate if both are set |
23+
| global.serverCertificateSecretName | string | `""` | This is overridden by registration.serverCertificateSecretName if both are set |
24+
2125
### Monitor
2226

2327
| Key | Type | Default | Description |
2428
| --------------------------- | ------ | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
2529
| monitor.authenticationToken | string | `""` | If setting up the agent without automatic registration, this is the authentication token. If you provide this, you must also provide the installation ID. If you provide this, the monitor will not attempt to register with the server. |
30+
| monitor.customCaCertificate | string | `""` | A base64 encoded string of the custom CA certificate to use to verify the Octopus Deploy server |
2631
| monitor.installationId | string | `""` | If setting up the agent without automatic registration, this is the installation id. If you provide this, you must also provide the authentication token. If you provide this, the monitor will not attempt to register with the server. |
2732
| monitor.serverGrpcUrl | string | `""` | The gRPC url (including the port) of the Octopus Deploy server to communicate with |
2833
| monitor.serverThumbprint | string | `""` | The thumbprint of the Octopus Deploy server the monitor is communicating with. This should only be used if you wish to pin the certificate. |
2934

3035
### Registration
3136

32-
| Key | Type | Default | Description |
33-
| -------------------------------------------------------- | ------ | ---------- | ------------------------------------------------------------------------------- |
34-
| registration.machineName | string | `""` | The machine name of the agent this monitor is responsible for |
35-
| registration.register | bool | `true` | Automatically register the monitor with the Octopus Deploy server |
36-
| registration.secretStoreType | string | `"secret"` | The type of secret store to use when saving configuration |
37-
| registration.serverAccessToken | string | `""` | The access token to authenticate to Octopus Deploy to register with |
38-
| registration.serviceAccount.annotations | object | `{}` | Additional annotations for the service account |
39-
| registration.serviceAccount.automountServiceAccountToken | bool | `true` | Auto-mount service account token |
40-
| registration.serviceAccount.create | bool | `true` | Specifies whether a service account should be created for the registration hook |
41-
| registration.serviceAccount.name | string | `""` | Custom service account name |
42-
| registration.spaceId | string | `""` | The space id that the monitor is registering with |
37+
| Key | Type | Default | Description |
38+
| -------------------------------------------------------- | ------ | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
39+
| registration.configurationStoreType | string | `"kubernetes"` | Can be "kubernetes" or "file" |
40+
| registration.machineName | string | `""` | The machine name of the agent this monitor is responsible for |
41+
| registration.register | bool | `true` | Automatically register the monitor with the Octopus Deploy server |
42+
| registration.serverAccessToken | string | `""` | The access token to authenticate to Octopus Deploy to register with. Can be a bearer token or an API token. |
43+
| registration.serverApiUrl | string | `""` | The API URL of Octopus Deploy for registration |
44+
| registration.serverCertificate | string | `""` | The base64-encoded public key of the self-signed x509 certificate or root CA certificate used by the target Octopus Server. Must be in the PEM/CER format. |
45+
| registration.serverCertificateSecretName | string | `""` | The name of a secret containing the base64-encoded public key of the self-signed x509 certificate or root CA certificate used by the target Octopus Server. Must be in the PEM/CER format. Value must be set in `data.octopus-server-certificate.pem` in secret. |
46+
| registration.serviceAccount.annotations | object | `{}` | Additional annotations for the service account |
47+
| registration.serviceAccount.automountServiceAccountToken | bool | `true` | Auto-mount service account token |
48+
| registration.serviceAccount.create | bool | `true` | Specifies whether a service account should be created for the registration hook |
49+
| registration.serviceAccount.name | string | `""` | Custom service account name |
50+
| registration.spaceId | string | `""` | The space id that the monitor is registering with |
4351

4452
### Other Values
4553

@@ -58,7 +66,6 @@ The Kubernetes Monitor Helm chart follows [Semantic Versioning](https://semver.o
5866
| podAnnotations | object | `{}` | Annotations to be added to kubernetes monitor pods |
5967
| podLabels | object | `{}` | Labels to be added to kubernetes monitor pods |
6068
| podSecurityContext | object | `{}` | Security context for kubernetes monitor pods |
61-
| registration.serverApiUrl | string | `""` | The API URL of Octopus Deploy for registration |
6269
| resources | string | `nil` | Resources to allocate for the kubernetes monitor pod |
6370
| securityContext | object | `{}` | Security context for kubernetes monitor containers |
6471
| serviceAccount.annotations | object | `{}` | Additional annotations for the service account |

‎charts/kubernetes-agent/templates/_helpers.tpl‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,3 +272,36 @@ Create the name of the service account to use for Tentacle Preinstallation
272272
{{- define "kubernetes-agent.preinstall.serviceAccountName" -}}
273273
{{- .Values.agent.preinstall.serviceAccount.name | default (printf "%s-pre" (include "kubernetes-agent.serviceAccountName" .)) }}
274274
{{- end }}
275+
276+
{{/*
277+
The server CA certificate - the global is used unless overridden by the value in values.yaml
278+
*/}}
279+
{{- define "kubernetes-agent.serverCertificate.certificate" -}}
280+
{{- if .Values.agent.serverCertificate }}
281+
{{- .Values.agent.serverCertificate }}
282+
{{- else if .Values.global.serverCertificate }}
283+
{{- .Values.global.serverCertificate }}
284+
{{- end }}
285+
{{- end }}
286+
287+
{{/*
288+
The name of the secret to store the certificate data of the Octopus Server API
289+
*/}}
290+
{{- define "kubernetes-agent.serverCertificate.secretName" -}}
291+
{{- if .Values.agent.serverCertificateSecretName }}
292+
{{- .Values.agent.serverCertificateSecretName }}
293+
{{- else if .Values.global.serverCertificateSecretName }}
294+
{{- .Values.global.serverCertificateSecretName }}
295+
{{- end }}
296+
{{- end }}
297+
298+
{{/*
299+
The server API url - the global is used unless overridden by the value in values.yaml
300+
*/}}
301+
{{- define "kubernetes-agent.serverApiUrl" -}}
302+
{{- if .Values.agent.serverUrl }}
303+
{{- .Values.agent.serverUrl }}
304+
{{- else if .Values.global.serverApiUrl }}
305+
{{- .Values.global.serverApiUrl }}
306+
{{- end }}
307+
{{- end }}

0 commit comments

Comments
 (0)