@flowfuse/driver-kubernetes 2.22.1 → 2.22.2-6911c7c-202510201047.0

package/.github/workflows/release-publish.yml

@@ -9,7 +9,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
               with:
                   node-version: 18
             - run: npm ci

package/README.md

@@ -44,6 +44,10 @@ driver:
 - `projectSelector` a list of labels that should be used to select which nodes Project Pods
 should run on
 - `projectLabels` a list of custom labels that should be applied to all resources created for Projects (Pods, Services, Ingresses, PVCs)
+- `projectProbes` optional configuration for liveness, readiness and startup probes for project containers
+- `projectProbes.livenessProbe` custom liveness probe configuration (default not set)
+- `projectProbes.readinessProbe` custom readiness probe configuration (default not set)
+- `projectProbes.startupProbe` custom startup probe configuration (default not set)
 - `cloudProvider` normally not set, but can be `aws` This triggers the adding of
 AWS EKS specific annotation for ALB Ingress. or `openshift` to allow running on OpenShift (Enterprise license only)
 - `privateCA` name of ConfigMap holding PEM CA Cert Bundle (file name `certs.pem`) Optional
@@ -61,6 +65,7 @@ AWS EKS specific annotation for ALB Ingress. or `openshift` to allow running on
 - `storage.storageClassEFSTag` Used instead of `storage.storageClass` when needing to shard across multiple EFS file systems (default not set)
 - `storage.size` Size of the volume to request (default not set)
 - `podSecurityContext` Settings linked to the [security context of the pod](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+- `containerSecurityContext` Settings linked to the [security context of the container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
 - `service.type` Type of service to create for the editor (allowed `ClusterIP` or `NodePort`, default `ClusterIP`)
 
 Expects to pick up K8s credentials from the environment

package/kubernetes.js

@@ -194,6 +194,14 @@ const createDeployment = async (project, options) => {
         this._app.log.info('[k8s] OpenShift, removing PodSecurityContext')
     }
 
+    if (this._app.config.driver.options?.containerSecurityContext) {
+        localPod.spec.containers[0].securityContext = this._app.config.driver.options.containerSecurityContext
+        this._app.log.info(`[k8s] Using custom ContainerSecurityContext ${JSON.stringify(this._app.config.driver.options.containerSecurityContext)}`)
+    } else if (this._app.license.active() && this._cloudProvider === 'openshift') {
+        localPod.spec.containers[0].securityContext = {}
+        this._app.log.info('[k8s] OpenShift, removing ContainerSecurityContext')
+    }
+
     if (stack.memory && stack.cpu) {
         localPod.spec.containers[0].resources.requests.memory = `${stack.memory}Mi`
         // increase limit to give npm more room to run in
@@ -213,6 +221,16 @@ const createDeployment = async (project, options) => {
         }
     }
 
+    if (this._app.config.driver.options?.projectProbes?.livenessProbe) {
+        localPod.spec.containers[0].livenessProbe = this._app.config.driver.options.projectProbes.livenessProbe
+    }
+    if (this._app.config.driver.options?.projectProbes?.readinessProbe) {
+        localPod.spec.containers[0].readinessProbe = this._app.config.driver.options.projectProbes.readinessProbe
+    }
+    if (this._app.config.driver.options?.projectProbes?.startupProbe) {
+        localPod.spec.containers[0].startupProbe = this._app.config.driver.options.projectProbes.startupProbe
+    }
+
     const ha = await project.getSetting('ha')
     if (ha?.replicas > 1) {
         localDeployment.spec.replicas = ha.replicas
@@ -261,8 +279,37 @@ const createIngress = async (project, options) => {
 
     const localIngress = JSON.parse(JSON.stringify(ingressTemplate))
 
+    let addIngressTls = false
+
     if (this._certManagerIssuer) {
         localIngress.metadata.annotations['cert-manager.io/cluster-issuer'] = this._certManagerIssuer
+        addIngressTls = true
+
+        // Add non-cert-manager annotations from projectIngressAnnotations if they exist
+        if (this._projectIngressAnnotations) {
+            Object.keys(this._projectIngressAnnotations).forEach((key) => {
+                if (!key.startsWith('cert-manager.io/')) {
+                    localIngress.metadata.annotations[key] = this._projectIngressAnnotations[key]
+                }
+            })
+        }
+    } else if (this._projectIngressAnnotations) {
+        const hasCertManagerAnnotation = Object.keys(this._projectIngressAnnotations).some(key =>
+            key.startsWith('cert-manager.io/')
+        )
+
+        if (hasCertManagerAnnotation) {
+            addIngressTls = true
+        }
+
+        // Add all annotations from projectIngressAnnotations
+        Object.keys(this._projectIngressAnnotations).forEach((key) => {
+            localIngress.metadata.annotations[key] = this._projectIngressAnnotations[key]
+        })
+    }
+
+    // Add TLS configuration if needed
+    if (addIngressTls) {
         localIngress.spec.tls = [
             {
                 hosts: [
@@ -309,8 +356,37 @@ const createCustomIngress = async (project, hostname, options) => {
     customIngress.spec.rules[0].host = hostname
     customIngress.spec.rules[0].http.paths[0].backend.service.name = `${prefix}${project.safeName}`
 
+    let addCustomIngressTls = false
+
     if (this._customHostname?.certManagerIssuer) {
         customIngress.metadata.annotations['cert-manager.io/cluster-issuer'] = this._customHostname.certManagerIssuer
+        addCustomIngressTls = true
+
+        // Add non-cert-manager annotations from projectIngressAnnotations if they exist
+        if (this._customHostname?.ingressAnnotations) {
+            Object.keys(this._customHostname?.ingressAnnotations).forEach((key) => {
+                if (!key.startsWith('cert-manager.io/')) {
+                    customIngress.metadata.annotations[key] = this._customHostname?.ingressAnnotations[key]
+                }
+            })
+        }
+    } else if (this._customHostname?.ingressAnnotations) {
+        const hasCertManagerAnnotation = Object.keys(this._customHostname?.ingressAnnotations).some(key =>
+            key.startsWith('cert-manager.io/')
+        )
+
+        if (hasCertManagerAnnotation) {
+            addCustomIngressTls = true
+        }
+
+        // Add all annotations from projectIngressAnnotations
+        Object.keys(this._customHostname?.ingressAnnotations).forEach((key) => {
+            customIngress.metadata.annotations[key] = this._customHostname?.ingressAnnotations[key]
+        })
+    }
+
+    // Add TLS configuration if needed
+    if (addCustomIngressTls) {
         customIngress.spec.tls = [
             {
                 hosts: [
@@ -628,6 +704,7 @@ module.exports = {
         this._k8sDelay = this._app.config.driver.options?.k8sDelay || 1000
         this._k8sRetries = this._app.config.driver.options?.k8sRetries || 10
         this._certManagerIssuer = this._app.config.driver.options?.certManagerIssuer
+        this._projectIngressAnnotations = this._app.config.driver.options?.projectIngressAnnotations
         this._logPassthrough = this._app.config.driver.options?.logPassthrough || false
         this._cloudProvider = this._app.config.driver.options?.cloudProvider
         if (this._app.config.driver.options?.customHostname?.enabled) {
@@ -777,8 +854,8 @@ module.exports = {
                     },
                     container: {
                         label: 'Container Location',
-                        // taken from https://stackoverflow.com/a/62964157
-                        validate: '^(([a-z0-9]|[a-z0-9][a-z0-9\\-]*[a-z0-9])\\.)*([a-z0-9]|[a-z0-9][a-z0-9\\-]*[a-z0-9])(:[0-9]+\\/)?(?:[0-9a-z-]+[/@])(?:([0-9a-z-]+))[/@]?(?:([0-9a-z-]+))?(?::[a-z0-9\\.-]+)?$',
+                        // taken from https://stackoverflow.com/a/74073589
+                        validate: '^((?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?/)?[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?)(?::([\\w][\\w.-]{0,127}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}))?$',
                         invalidMessage: 'Invalid value - must be a Docker image',
                         description: 'Container image location, can include a tag'
                     }
@@ -828,6 +905,17 @@ module.exports = {
             } catch (err) {
                 this._app.log.error(`[k8s] Instance ${project.id} - error deleting tls secret: ${err.toString()} ${err.stack}`)
             }
+        } else if (this._projectIngressAnnotations) {
+            const hasCertManagerAnnotation = Object.keys(this._projectIngressAnnotations).some(key =>
+                key.startsWith('cert-manager.io/')
+            )
+            if (hasCertManagerAnnotation) {
+                try {
+                    await this._k8sApi.deleteNamespacedSecret({ name: project.safeName, namespace: this._namespace })
+                } catch (err) {
+                    this._app.log.error(`[k8s] Instance ${project.id} - error deleting tls secret: ${err.toString()} ${err.stack}`)
+                }
+            }
         }
 
         if (this._customHostname?.enabled) {
@@ -959,6 +1047,17 @@ module.exports = {
             } catch (err) {
                 this._app.log.error(`[k8s] Instance ${project.id} - error deleting tls secret: ${err.toString()}`)
             }
+        } else if (this._projectIngressAnnotations) {
+            const hasCertManagerAnnotation = Object.keys(this._projectIngressAnnotations).some(key =>
+                key.startsWith('cert-manager.io/')
+            )
+            if (hasCertManagerAnnotation) {
+                try {
+                    await this._k8sApi.deleteNamespacedSecret({ name: project.safeName, namespace: this._namespace })
+                } catch (err) {
+                    this._app.log.error(`[k8s] Instance ${project.id} - error deleting tls secret: ${err.toString()}`)
+                }
+            }
         }
         if (this._customHostname?.enabled) {
             try {
@@ -966,7 +1065,7 @@ module.exports = {
             } catch (err) {
                 this._app.log.error(`[k8s] Instance ${project.id} - error deleting custom ingress: ${err.toString()}`)
             }
-            if (this._customHostname?.certManagerIssuer) {
+            if (this._customHostname?.certManagerIssuer || this._customHostname?.certManagerAnnotations) {
                 try {
                     await this._k8sApi.deleteNamespacedSecret({ name: `${project.safeName}-custom`, namespace: this._namespace })
                 } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@flowfuse/driver-kubernetes",
-    "version": "2.22.1",
+    "version": "2.22.2-6911c7c-202510201047.0",
     "description": "Kubernetes driver for FlowFuse",
     "main": "kubernetes.js",
     "scripts": {