Skip to content

Commit c2bb142

Browse files
pengzhoumlpengzhouml
authored
Merge pull request #241 from marklogic/release/1.1.2
Release Kubernetes Helm Chart 1.1.2
2 parents 8756fc9 + 49398f1 commit c2bb142

15 files changed

+210
-48
lines changed

‎README.md

+5-2
Original file line numberDiff line numberDiff line change
@@ -107,11 +107,13 @@ Following table lists all the parameters supported by the latest MarkLogic Helm
107107
| `updateStrategy.type` | Update strategy for MarkLogic pods | `OnDelete` |
108108
| `terminationGracePeriod` | Seconds the MarkLogic Pod terminate gracefully | `120` |
109109
| `clusterDomain` | Domain for the Kubernetes cluster | `cluster.local` |
110+
| `allowLongHostnames` | Allow deployment with hostname over 64 characters | `false` |
111+
| `useLegacyHostnames` | Use the lagecy hostnames that is used before 1.1.0 version. | `false` |
110112
| `group.name` | Group name for joining MarkLogic cluster | `Default` |
111113
| `group.enableXdqpSsl` | SSL encryption for XDQP | `true` |
112114
| `bootstrapHostName` | Host name of MarkLogic bootstrap host (to join a cluster) | `""` |
113115
| `image.repository` | Repository for MarkLogic image | `marklogicdb/marklogic-db` |
114-
| `image.tag` | Image tag for MarkLogic image | `11.1.0-centos-1.1.2` |
116+
| `image.tag` | Image tag for MarkLogic image | `11.2.0-centos-1.1.2` |
115117
| `image.pullPolicy` | Image pull policy for MarkLogic image | `IfNotPresent` |
116118
| `initContainers.configureGroup.image` | Image for configureGroup InitContainer | `curlimages/curl:8.6.0` |
117119
| `initContainers.configureGroup.pullPolicy` | Pull policy for configureGroup InitContainer | `IfNotPresent` |
@@ -213,5 +215,6 @@ Following table lists all the parameters supported by the latest MarkLogic Helm
213215
2. The MarkLogic Docker image must be run in privileged mode. At the moment if the image isn't run as privileged many calls that use sudo during the startup script will fail due to lack of required permissions as the image will not be able to create a user with the required permissions.
214216
3. The latest released version of CentOS 7 has known security vulnerabilities with respect to glib2 CVE-2016-3191, CVE-2015-8385, CVE-2015-8387, CVE-2015-8390, CVE-2015-8394, CVE-2016-3191, glibc CVE-2019-1010022, pcre CVE-2015-8380, CVE-2015-8387, CVE-2015-8390, CVE-2015-8393, CVE-2015-8394, SQLite CVE-2019-5827. These libraries are included in the CentOS base image but, to-date, no fixes have been made available. Even though these libraries may be present in the base image that is used by MarkLogic Server, they are not used by MarkLogic Server itself, hence there is no impact or mitigation required.
215217
4. The latest released version of fluent/fluent-bit:2.2.2 has known security vulnerabilities with respect to libcom-err2 CVE-2022-1304, libgcrypt20 CVE-2021-33560, libgnutls30 CVE-2024-0567, libldap-2.4-2 CVE-2023-2953, libzstd1 CVE-2022-4899, zlib1g CVE-2023-45853. These libraries are included in the Debian base image but, to-date, no fixes have been made available. For libpq5 CVE-2024-0985, we wait for a future upgrade of the fluent-bit image to include the fix. We will provide updates and mitigation strategies as soon as more information becomes available.
216-
5. The latest released version of redhat/ubi9:9.3 has known security vulnerabilities with respect to setuptools GHSA-r9hx-vwmv-q579, we wait for a future upgrade of the redhad ubi image to include the fix.
218+
5. The latest released version of redhat/ubi9:9.3 has known security vulnerabilities with respect to setuptools GHSA-r9hx-vwmv-q579. We wait for a future upgrade of the redhad ubi image to include the fix.
217219
6. The security context “allowPrivilegeEscalation” is set to TRUE by default in values.yaml file and cannot be changed to run the current MarkLogic container. Work is in progress to run MarkLogic container in "rootless" mode.
220+
7. Known Issues and Limitations for the MarkLogic Server Docker image can be viewed using the link: https://github.com/marklogic/marklogic-docker?tab=readme-ov-file#Known-Issues-and-Limitations

‎charts/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ dependencies:
88
version: "1.18.0"
99
name: marklogic
1010
description: MarkLogic Server is a multi-model database that has both NoSQL and trusted enterprise data management capabilities.
11-
appVersion: "11.1.0"
11+
appVersion: "11.2.0"
1212
type: application
1313
keywords:
1414
- marklogic
@@ -17,4 +17,4 @@ keywords:
1717
sources:
1818
- https://github.com/marklogic/marklogic-kubernetes
1919
- https://www.marklogic.com/
20-
version: 1.1.1
20+
version: 1.1.2

‎charts/templates/NOTES.txt

+1-2
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,7 @@ WARNING
1616
FQDN is {{ include "marklogic.fqdn" . }}
1717
{{- if gt (len (include "marklogic.fqdn" .)) 64 }}
1818
WARNING: The hostname is greater than 64 characters
19-
There may be issues with certificates
20-
The certificates may shorten the name or use SANs for hostnames in the certificates
19+
There may be issues with certificates in MarkLogic App Server
2120
{{- end }}
2221

2322
Group {{ .Values.group.name }} is created on the MarkLogic cluster.

‎charts/templates/_helpers.tpl

+95-7
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,84 @@ Expand the name of the chart.
55
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
66
{{- end }}
77

8+
{{/*
9+
newFullname is the name used after 1.1.x release, in an effort to make the release name shorter.
10+
*/}}
11+
{{- define "marklogic.newFullname" -}}
12+
{{- if .Values.fullnameOverride }}
13+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
14+
{{- else }}
15+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
16+
{{- end }}
17+
{{- end }}
18+
19+
20+
{{/*
21+
oldFullname is the name used before 1.1.x release
22+
*/}}
23+
{{- define "marklogic.oldFullname" -}}
24+
{{- if .Values.fullnameOverride }}
25+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
26+
{{- else }}
27+
{{- $name := default .Chart.Name .Values.nameOverride }}
28+
{{- if contains $name .Release.Name }}
29+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
30+
{{- else }}
31+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
32+
{{- end }}
33+
{{- end }}
34+
{{- end }}
35+
36+
{{- define "marklogic.shouldUseNewName" -}}
37+
{{- if .Release.IsInstall -}}
38+
{{- true }}
39+
{{- else }}
40+
{{- if eq .Values.useLegacyHostnames true -}}
41+
{{- false }}
42+
{{- else }}
43+
{{- true }}
44+
{{- end }}
45+
{{- end }}
46+
{{- end }}
47+
48+
{{- define "marklogic.checkUpgradeError" -}}
49+
{{- if and .Release.IsUpgrade (ne .Values.useLegacyHostnames true) -}}
50+
{{- $stsName := trim (include "marklogic.oldFullname" .) -}}
51+
{{- if .Values.fullnameOverride -}}
52+
{{- $stsName := trim .Values.fullnameOverride -}}
53+
{{- end }}
54+
{{- $sts := lookup "apps/v1" "StatefulSet" .Release.Namespace $stsName }}
55+
{{- if $sts }}
56+
{{- $labels := $sts.metadata.labels }}
57+
{{- $chartVersionFull := get $labels "helm.sh/chart" }}
58+
{{- if $chartVersionFull }}
59+
{{- $chartVersionWithDot := trimPrefix "marklogic-" $chartVersionFull }}
60+
{{- $chartVersionString := $chartVersionWithDot | replace "." "" }}
61+
{{- $chartVersionDigit := int $chartVersionString }}
62+
{{- if lt $chartVersionDigit 110 -}}
63+
{{- $errorMessage := printf "A new algorithm for generating hostnames was introduced in version 1.1.0. When upgrading from version %s to version %s, the \"useLegacyHostnames\" setting must be set to true to prevent the StatefulSet from being recreated. Please add the following to the values file and attempt the upgrade again: \n\nuseLegacyHostnames: true\n" $chartVersionWithDot .Chart.Version }}
64+
{{- fail $errorMessage }}
65+
{{- end }}
66+
{{- end }}
67+
{{- end }}
68+
{{- end }}
69+
{{- end }}
70+
71+
{{/*
72+
{{- end }}
73+
{{- end }}
74+
875
{{/*
976
Create a default fully qualified app name.
1077
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11-
The release name will be used as full name
78+
To surrport the upgrade from 1.0.x to 1.1.x, we keep the old name when doing upgrade from 1.0.x.
79+
For the new install, we use the new name, which is the release name.
1280
*/}}
1381
{{- define "marklogic.fullname" -}}
14-
{{- if .Values.fullnameOverride }}
15-
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
82+
{{- if eq (include "marklogic.shouldUseNewName" .) "true" -}}
83+
{{- include "marklogic.newFullname" . }}
1684
{{- else }}
17-
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
85+
{{- include "marklogic.oldFullname" . }}
1886
{{- end }}
1987
{{- end }}
2088

@@ -29,7 +97,27 @@ Create chart name and version as used by the chart label.
2997
Create headless service name for statefulset
3098
*/}}
3199
{{- define "marklogic.headlessServiceName" -}}
32-
{{- include "marklogic.fullname" . }}
100+
{{- if eq (include "marklogic.shouldUseNewName" .) "true" -}}
101+
{{- include "marklogic.newFullname" . }}
102+
{{- else }}
103+
{{- printf "%s-headless" (include "marklogic.oldFullname" .) }}
104+
{{- end }}
105+
{{- end }}
106+
{{/*
107+
{{- end}}
108+
109+
110+
{{/*
111+
Create cluster service name for statefulset
112+
*/}}
113+
{{- define "marklogic.clusterServiceName" -}}
114+
{{- if eq (include "marklogic.shouldUseNewName" .) "true" -}}
115+
{{- include "marklogic.newFullname" . }}-cluster
116+
{{- else }}
117+
{{- include "marklogic.oldFullname" . }}
118+
{{- end }}
119+
{{- end }}
120+
{{/*
33121
{{- end}}
34122

35123

@@ -102,8 +190,8 @@ Validate values file
102190
*/}}
103191
{{- define "marklogic.checkInputError" -}}
104192
{{- $fqdn := include "marklogic.fqdn" . }}
105-
{{- if gt (len $fqdn) 64}}
106-
{{- $errorMessage := printf "%s%s%s" "The FQDN: " $fqdn " is longer than 64. Please use a shorter release name and try again." }}
193+
{{- if and (gt (len $fqdn) 64) (not .Values.allowLongHostnames) }}
194+
{{- $errorMessage := printf "%s%s%s" "The FQDN: " $fqdn " is longer than 64. Please use a shorter release name and try again. MarkLogic App Server does not support turning on SSL with FQDN over 64 characters. If you still want to install with an FQDN longer than 64 characters, you can override this restriction by setting allowLongHostnames: true in your Helm values file." }}
107195
{{- fail $errorMessage }}
108196
{{- end }}
109197
{{- end }}

‎charts/templates/configmap-haproxy.yaml

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
{{- if .Values.haproxy.enabled }}
22
{{- $replicas := int .Values.replicaCount }}
33
{{- $releaseName := include "marklogic.fullname" . }}
4+
{{- $headlessServiceName := include "marklogic.headlessServiceName" . }}
45
{{- $namespace := .Release.Namespace }}
56
{{- $clusterDomain := .Values.clusterDomain }}
67
{{- $haproxyTlsEnabled := .Values.haproxy.tls.enabled }}
@@ -75,12 +76,12 @@ data:
7576
{{ $portType := upper (printf "%s" $v.type) }}
7677
7778
{{- if eq $portType "TCP" -}}
78-
listen odbc
79+
listen marklogic-TCP-{{$portNumber}}
7980
bind :{{ $portNumber }}
8081
mode tcp
8182
balance leastconn
8283
{{- range $i := until $replicas }}
83-
server {{ printf "ml-%s-%s-%v" $releaseName $portNumber $i }} {{ $releaseName }}-{{ $i }}.{{ $releaseName }}.{{ $namespace }}.svc.{{ $clusterDomain }}:{{ $portNumber }} check resolvers dns init-addr none
84+
server {{ printf "ml-%s-%s-%v" $releaseName $portNumber $i }} {{ $releaseName }}-{{ $i }}.{{ $headlessServiceName }}.{{ $namespace }}.svc.{{ $clusterDomain }}:{{ $portNumber }} check resolvers dns init-addr none
8485
{{- end }}
8586
{{- else if eq $portType "HTTP" }}
8687
@@ -107,9 +108,9 @@ data:
107108
default-server check
108109
{{- range $i := until $replicas }}
109110
{{- if $appServerTlsEnabled }}
110-
server {{ printf "ml-%s-%s-%v" $releaseName $portNumber $i }} {{ $releaseName }}-{{ $i }}.{{ $releaseName }}.{{ $namespace }}.svc.{{ $clusterDomain }}:{{ $portNumber }} resolvers dns init-addr none cookie {{ $releaseName }}-{{ $portNumber }}-{{ $i }} ssl verify none
111+
server {{ printf "ml-%s-%s-%v" $releaseName $portNumber $i }} {{ $releaseName }}-{{ $i }}.{{ $headlessServiceName }}.{{ $namespace }}.svc.{{ $clusterDomain }}:{{ $portNumber }} resolvers dns init-addr none cookie {{ $releaseName }}-{{ $portNumber }}-{{ $i }} ssl verify none
111112
{{- else }}
112-
server {{ printf "ml-%s-%s-%v" $releaseName $portNumber $i }} {{ $releaseName }}-{{ $i }}.{{ $releaseName }}.{{ $namespace }}.svc.{{ $clusterDomain }}:{{ $portNumber }} resolvers dns init-addr none cookie {{ $releaseName }}-{{ $portNumber }}-{{ $i }}
113+
server {{ printf "ml-%s-%s-%v" $releaseName $portNumber $i }} {{ $releaseName }}-{{ $i }}.{{ $headlessServiceName }}.{{ $namespace }}.svc.{{ $clusterDomain }}:{{ $portNumber }} resolvers dns init-addr none cookie {{ $releaseName }}-{{ $portNumber }}-{{ $i }}
113114
{{- end }}
114115
{{- end }}
115116
{{- end }}

‎charts/templates/configmap-scripts.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v1
22
kind: ConfigMap
33
metadata:
4-
name: {{ .Release.Name }}-scripts
4+
name: {{ include "marklogic.fullname" . }}-scripts
55
data:
66
liveness-probe.sh: |
77
#!/bin/bash

‎charts/templates/service.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v1
22
kind: Service
33
metadata:
4-
name: {{ include "marklogic.fullname" . }}-cluster
4+
name: {{ include "marklogic.clusterServiceName" . }}
55
namespace: {{ .Values.namespace}}
66
labels:
77
{{- include "marklogic.labels" . | nindent 4 }}

‎charts/templates/statefulset.yaml

+11-6
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
{{- include "marklogic.checkUpgradeError" . -}}
12
{{- include "marklogic.checkInputError" . }}
23
apiVersion: apps/v1
34
kind: StatefulSet
@@ -315,8 +316,12 @@ spec:
315316
# Begin Group Configuration
316317
if [[ $POD_NAME == *-0 ]] && [[ $MARKLOGIC_CLUSTER_TYPE == "bootstrap" ]]; then
317318
[ -f /var/opt/MarkLogic/group_cfg ] && current_group_cfg=$(cat /var/opt/MarkLogic/group_cfg)
318-
if [ "${MARKLOGIC_GROUP}:${XDQP_SSL_ENABLED}:${MARKLOGIC_JOIN_TLS_ENABLED}" = "${current_group_cfg}" ]; then
319-
log "Info: [poststart] Group config has not changed, complete group configuration"
319+
colon_count=$(echo "$current_group_cfg" | awk -F':' '{print NF-1}')
320+
if [ "$colon_count" -eq 2 ]; then
321+
current_group_cfg="${current_group_cfg%:*}"
322+
fi
323+
if [ "${MARKLOGIC_GROUP}:${XDQP_SSL_ENABLED}" = "${current_group_cfg}" ]; then
324+
log "Info: [poststart] Group config has not changed, skip group configuration"
320325
else
321326
log "Info: [poststart] Begin group configuration."
322327
while [ ! -f /var/opt/MarkLogic/ready ]; do
@@ -339,9 +344,9 @@ spec:
339344
restart_check ${TIMESTAMP}
340345
fi
341346
if [[ $MARKLOGIC_IMAGE_TYPE == "rootless" ]]; then
342-
sh -c 'echo -n '"${MARKLOGIC_GROUP}:${XDQP_SSL_ENABLED}:${MARKLOGIC_JOIN_TLS_ENABLED}"' > /var/opt/MarkLogic/group_cfg'
347+
sh -c 'echo -n '"${MARKLOGIC_GROUP}:${XDQP_SSL_ENABLED}"' > /var/opt/MarkLogic/group_cfg'
343348
else
344-
sudo sh -c 'echo -n '"${MARKLOGIC_GROUP}:${XDQP_SSL_ENABLED}:${MARKLOGIC_JOIN_TLS_ENABLED}"' > /var/opt/MarkLogic/group_cfg'
349+
sudo sh -c 'echo -n '"${MARKLOGIC_GROUP}:${XDQP_SSL_ENABLED}"' > /var/opt/MarkLogic/group_cfg'
345350
fi
346351
log "Info: [poststart] ${GROUP_CFG} saved"
347352
else
@@ -359,7 +364,7 @@ spec:
359364
https_error_message="You have attempted to access an HTTPS server using HTTP."
360365
resp=$(curl -s http://localhost:8001)
361366
if [[ "$resp" == *"$https_error_message"* ]]; then
362-
log "Info: [poststart] MarkLogic server has already configured HTTPS"
367+
log "Info: [poststart] MarkLogic server has already configured HTTPS"
363368
exit 0
364369
else
365370
log "Info: [poststart] MARKLOGIC_JOIN_TLS_ENABLED is set to true, configuring SSL"
@@ -659,7 +664,7 @@ spec:
659664
secretName: {{ include "marklogic.authSecretNameToMount" . }}
660665
- name: scripts
661666
configMap:
662-
name: {{ .Release.Name }}-scripts
667+
name: {{ include "marklogic.fullname" . }}-scripts
663668
defaultMode: 0755
664669
{{- if .Values.logCollection.enabled }}
665670
- name: {{ include "marklogic.fullname" . }}-fb-config-map

‎charts/values.yaml

+12-1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,17 @@ terminationGracePeriod: 120
1515
## Kubernetes cluster domain name
1616
clusterDomain: cluster.local
1717

18+
## Allow deployment with hostname over 64 characters
19+
## This is not remmended as it may cause issues when turning on TLS on MarkLogic Server
20+
## Because MarkLogic Server only supports using CN as hostname in the certificate
21+
## There is a limit of 64 characters for CN in the certificate
22+
allowLongHostnames: false
23+
24+
## This flag facilitates upgrading from version 1.0.x of the chart while retaining the use of legacy hostnames.
25+
## When upgrading from version 1.0.x to any version above 1.1.0, this flag must be set to true.
26+
## It should remain true for all future upgrades. For new installations, this flag should be set to false.
27+
useLegacyHostnames: false
28+
1829
## Group related settings
1930
group:
2031
## the group name of the current Marklogic Helm Deployment
@@ -28,7 +39,7 @@ bootstrapHostName: ""
2839
## Marklogic image parameters
2940
image:
3041
repository: marklogicdb/marklogic-db
31-
tag: 11.1.0-centos-1.1.2
42+
tag: 11.2.0-centos-1.1.2
3243
pullPolicy: IfNotPresent
3344

3445
## Init container image parameters

‎makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ prepare:
7070
.PHONY: lint
7171
lint:
7272
@echo "> Linting helm charts....."
73-
helm lint --with-subcharts charts/ $(if $(saveOutput),> helm-lint-output.txt,)
73+
helm lint --set allowLongHostnames=true --with-subcharts charts/ $(if $(saveOutput),> helm-lint-output.txt,)
7474

7575
@echo "> Linting all tests....."
7676
golangci-lint run --timeout=5m $(if $(saveOutput),> test-lint-output.txt,)

0 commit comments

Comments
 (0)