Merge branch 'bugfix' into helm_zero_initialDelaySeconds

rossops · web-flow · commit 43d93a4f58ef · 2025-10-14T08:37:20.000-05:00
diff --git a/.github/workflows/helm-docs-updates.yml b/.github/workflows/helm-docs-updates.yml
@@ -0,0 +1,25 @@
+name: Update HELM docs for Renovate & Dependabot
+
+on:
+  pull_request:
+    branches:
+      - master
+      - dev
+      - bugfix
+      - release/**
+      - hotfix/**
+
+jobs:
+  docs_updates:
+    name: Update documentation
+    runs-on: ubuntu-latest
+    if: startsWith(github.head_ref, 'renovate/') or startsWith(github.head_ref, 'dependabot/')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      
+      - name: Run helm-docs
+        uses: losisin/helm-docs-github-action@a57fae5676e4c55a228ea654a1bcaec8dd3cf5b5 # v1.6.2
+        with:
+          chart-search-root: "helm/defectdojo"
+          git-push: true
diff --git a/.github/workflows/test-helm-chart.yml b/.github/workflows/test-helm-chart.yml
@@ -79,7 +79,7 @@ jobs:
           target_annotation=$(git show "${{ env.ct-branch }}:helm/defectdojo/Chart.yaml" | yq e '.annotations."artifacthub.io/changes"' -)
 
           if [[ "$current_annotation" == "$target_annotation" ]]; then
-            echo "::error file=helm/defectdojo/Chart.yaml::The 'artifacthub.io/changes' annotation has not been updated compared to ${{ env.ct-branch }}"
+            echo "::error file=helm/defectdojo/Chart.yaml::The 'artifacthub.io/changes' annotation has not been updated compared to ${{ env.ct-branch }}. For more, check the hint in 'helm/defectdojo/Chart.yaml'"
             exit 1
           fi
 
diff --git a/helm/defectdojo/Chart.yaml b/helm/defectdojo/Chart.yaml
@@ -18,7 +18,24 @@ dependencies:
     repository: "oci://us-docker.pkg.dev/os-public-container-registry/defectdojo"
     condition: redis.enabled
 annotations:
+  # For correct syntax, check https://artifacthub.io/docs/topics/annotations/helm/
+  # This is example for "artifacthub.io/changes"
+  # artifacthub.io/changes: |
+  #   - kind: added
+  #     description: Cool feature
+  #   - kind: fixed
+  #     description: Minor bug
+  #   - kind: changed
+  #     description: Broken feature
+  #   - kind: removed
+  #     description: Old bug
+  #   - kind: deprecated
+  #     description: Not-needed feature
+  #   - kind: security
+  #     description: Critical bug
   artifacthub.io/prerelease: "true"
   artifacthub.io/changes: |
     - kind: fixed
       description: Drop initialDelaySeconds if eq. zero
+    - kind: added
+      description: Add support for automountServiceAccountToken
diff --git a/helm/defectdojo/README.md b/helm/defectdojo/README.md
@@ -528,6 +528,7 @@ A Helm chart for Kubernetes to install DefectDojo
 | celery.annotations | object | `{}` |  |
 | celery.beat.affinity | object | `{}` |  |
 | celery.beat.annotations | object | `{}` |  |
+| celery.beat.automountServiceAccountToken | bool | `false` |  |
 | celery.beat.extraEnv | list | `[]` |  |
 | celery.beat.extraInitContainers | list | `[]` |  |
 | celery.beat.extraVolumeMounts | list | `[]` |  |
@@ -548,6 +549,7 @@ A Helm chart for Kubernetes to install DefectDojo
 | celery.worker.affinity | object | `{}` |  |
 | celery.worker.annotations | object | `{}` |  |
 | celery.worker.appSettings.poolType | string | `"solo"` |  |
+| celery.worker.automountServiceAccountToken | bool | `false` |  |
 | celery.worker.extraEnv | list | `[]` |  |
 | celery.worker.extraInitContainers | list | `[]` |  |
 | celery.worker.extraVolumeMounts | list | `[]` |  |
@@ -582,6 +584,7 @@ A Helm chart for Kubernetes to install DefectDojo
 | disableHooks | bool | `false` |  |
 | django.affinity | object | `{}` |  |
 | django.annotations | object | `{}` |  |
+| django.automountServiceAccountToken | bool | `false` |  |
 | django.extraInitContainers | list | `[]` |  |
 | django.extraVolumes | list | `[]` |  |
 | django.ingress.activateTLS | bool | `true` |  |
@@ -656,6 +659,7 @@ A Helm chart for Kubernetes to install DefectDojo
 | imagePullSecrets | string | `nil` |  |
 | initializer.affinity | object | `{}` |  |
 | initializer.annotations | object | `{}` |  |
+| initializer.automountServiceAccountToken | bool | `false` |  |
 | initializer.extraEnv | list | `[]` |  |
 | initializer.extraVolumeMounts | list | `[]` |  |
 | initializer.extraVolumes | list | `[]` |  |
@@ -722,6 +726,7 @@ A Helm chart for Kubernetes to install DefectDojo
 | serviceAccount.create | bool | `true` |  |
 | serviceAccount.labels | object | `{}` |  |
 | tag | string | `"latest"` |  |
+| tests.unitTests.automountServiceAccountToken | bool | `false` |  |
 | tests.unitTests.resources.limits.cpu | string | `"500m"` |  |
 | tests.unitTests.resources.limits.memory | string | `"512Mi"` |  |
 | tests.unitTests.resources.requests.cpu | string | `"100m"` |  |
diff --git a/helm/defectdojo/templates/celery-beat-deployment.yaml b/helm/defectdojo/templates/celery-beat-deployment.yaml
@@ -52,6 +52,7 @@ spec:
       {{- end }}
     spec:
       serviceAccountName: {{ include "defectdojo.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.celery.beat.automountServiceAccountToken }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
       - name: {{ . }}
diff --git a/helm/defectdojo/templates/celery-worker-deployment.yaml b/helm/defectdojo/templates/celery-worker-deployment.yaml
@@ -52,6 +52,7 @@ spec:
       {{- end }}
     spec:
       serviceAccountName: {{ include "defectdojo.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.celery.worker.automountServiceAccountToken }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
       - name: {{ . }}
diff --git a/helm/defectdojo/templates/django-deployment.yaml b/helm/defectdojo/templates/django-deployment.yaml
@@ -59,6 +59,7 @@ spec:
       {{- end }}
     spec:
       serviceAccountName: {{ include "defectdojo.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.django.automountServiceAccountToken }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
       - name: {{ quote . }}
diff --git a/helm/defectdojo/templates/initializer-job.yaml b/helm/defectdojo/templates/initializer-job.yaml
@@ -39,6 +39,7 @@ spec:
       {{- end }}
     spec:
       serviceAccountName: {{ include "defectdojo.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.initializer.automountServiceAccountToken }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
       - name: {{ . }}
diff --git a/helm/defectdojo/templates/tests/unit-tests.yaml b/helm/defectdojo/templates/tests/unit-tests.yaml
@@ -12,6 +12,7 @@ metadata:
     helm.sh/hook: test-success
 spec:
   serviceAccountName: {{ include "defectdojo.serviceAccountName" . }}
+  automountServiceAccountToken: {{ .Values.tests.unitTests.automountServiceAccountToken }}
   {{- with .Values.imagePullSecrets }}
   imagePullSecrets:
     - name: {{ . }}
diff --git a/helm/defectdojo/values.schema.json b/helm/defectdojo/values.schema.json
@@ -49,6 +49,9 @@
                         "annotations": {
                             "type": "object"
                         },
+                        "automountServiceAccountToken": {
+                            "type": "boolean"
+                        },
                         "extraEnv": {
                             "type": "array"
                         },
@@ -134,6 +137,9 @@
                                 }
                             }
                         },
+                        "automountServiceAccountToken": {
+                            "type": "boolean"
+                        },
                         "extraEnv": {
                             "type": "array"
                         },
@@ -288,6 +294,9 @@
                 "annotations": {
                     "type": "object"
                 },
+                "automountServiceAccountToken": {
+                    "type": "boolean"
+                },
                 "extraInitContainers": {
                     "type": "array"
                 },
@@ -616,6 +625,9 @@
                 "annotations": {
                     "type": "object"
                 },
+                "automountServiceAccountToken": {
+                    "type": "boolean"
+                },
                 "extraEnv": {
                     "type": "array"
                 },
@@ -968,6 +980,9 @@
                 "unitTests": {
                     "type": "object",
                     "properties": {
+                        "automountServiceAccountToken": {
+                            "type": "boolean"
+                        },
                         "resources": {
                             "type": "object",
                             "properties": {
diff --git a/helm/defectdojo/values.yaml b/helm/defectdojo/values.yaml
@@ -114,6 +114,7 @@ dbMigrationChecker:
 
 tests:
   unitTests:
+    automountServiceAccountToken: false
     resources:
       requests:
         cpu: 100m
@@ -153,6 +154,7 @@ celery:
   # Common annotations to worker and beat deployments and pods.
   annotations: {}
   beat:
+    automountServiceAccountToken: false
     # Annotations for the Celery beat deployment.
     annotations: {}
     affinity: {}
@@ -192,6 +194,7 @@ celery:
     startupProbe: {}
     tolerations: []
   worker:
+    automountServiceAccountToken: false
     # Annotations for the Celery worker deployment.
     annotations: {}
     affinity: {}
@@ -241,6 +244,7 @@ celery:
       # prefetchMultiplier: 128
 
 django:
+  automountServiceAccountToken: false
   annotations: {}
   service:
     annotations: {}
@@ -364,6 +368,7 @@ django:
 
 initializer:
   run: true
+  automountServiceAccountToken: false
   jobAnnotations: {}
   annotations: {}
   labels: {}
