@flowfuse/driver-kubernetes 2.22.2-212a69c-202510161205.0 → 2.22.2-6911c7c-202510201047.0

package/.github/workflows/release-publish.yml

@@ -9,7 +9,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-            - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+            - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
               with:
                   node-version: 18
             - run: npm ci

package/README.md

@@ -65,6 +65,7 @@ AWS EKS specific annotation for ALB Ingress. or `openshift` to allow running on
 - `storage.storageClassEFSTag` Used instead of `storage.storageClass` when needing to shard across multiple EFS file systems (default not set)
 - `storage.size` Size of the volume to request (default not set)
 - `podSecurityContext` Settings linked to the [security context of the pod](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
+- `containerSecurityContext` Settings linked to the [security context of the container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
 - `service.type` Type of service to create for the editor (allowed `ClusterIP` or `NodePort`, default `ClusterIP`)
 
 Expects to pick up K8s credentials from the environment

package/kubernetes.js

@@ -194,6 +194,14 @@ const createDeployment = async (project, options) => {
         this._app.log.info('[k8s] OpenShift, removing PodSecurityContext')
     }
 
+    if (this._app.config.driver.options?.containerSecurityContext) {
+        localPod.spec.containers[0].securityContext = this._app.config.driver.options.containerSecurityContext
+        this._app.log.info(`[k8s] Using custom ContainerSecurityContext ${JSON.stringify(this._app.config.driver.options.containerSecurityContext)}`)
+    } else if (this._app.license.active() && this._cloudProvider === 'openshift') {
+        localPod.spec.containers[0].securityContext = {}
+        this._app.log.info('[k8s] OpenShift, removing ContainerSecurityContext')
+    }
+
     if (stack.memory && stack.cpu) {
         localPod.spec.containers[0].resources.requests.memory = `${stack.memory}Mi`
         // increase limit to give npm more room to run in
@@ -271,8 +279,37 @@ const createIngress = async (project, options) => {
 
     const localIngress = JSON.parse(JSON.stringify(ingressTemplate))
 
+    let addIngressTls = false
+
     if (this._certManagerIssuer) {
         localIngress.metadata.annotations['cert-manager.io/cluster-issuer'] = this._certManagerIssuer
+        addIngressTls = true
+
+        // Add non-cert-manager annotations from projectIngressAnnotations if they exist
+        if (this._projectIngressAnnotations) {
+            Object.keys(this._projectIngressAnnotations).forEach((key) => {
+                if (!key.startsWith('cert-manager.io/')) {
+                    localIngress.metadata.annotations[key] = this._projectIngressAnnotations[key]
+                }
+            })
+        }
+    } else if (this._projectIngressAnnotations) {
+        const hasCertManagerAnnotation = Object.keys(this._projectIngressAnnotations).some(key =>
+            key.startsWith('cert-manager.io/')
+        )
+
+        if (hasCertManagerAnnotation) {
+            addIngressTls = true
+        }
+
+        // Add all annotations from projectIngressAnnotations
+        Object.keys(this._projectIngressAnnotations).forEach((key) => {
+            localIngress.metadata.annotations[key] = this._projectIngressAnnotations[key]
+        })
+    }
+
+    // Add TLS configuration if needed
+    if (addIngressTls) {
         localIngress.spec.tls = [
             {
                 hosts: [
@@ -319,8 +356,37 @@ const createCustomIngress = async (project, hostname, options) => {
     customIngress.spec.rules[0].host = hostname
     customIngress.spec.rules[0].http.paths[0].backend.service.name = `${prefix}${project.safeName}`
 
+    let addCustomIngressTls = false
+
     if (this._customHostname?.certManagerIssuer) {
         customIngress.metadata.annotations['cert-manager.io/cluster-issuer'] = this._customHostname.certManagerIssuer
+        addCustomIngressTls = true
+
+        // Add non-cert-manager annotations from projectIngressAnnotations if they exist
+        if (this._customHostname?.ingressAnnotations) {
+            Object.keys(this._customHostname?.ingressAnnotations).forEach((key) => {
+                if (!key.startsWith('cert-manager.io/')) {
+                    customIngress.metadata.annotations[key] = this._customHostname?.ingressAnnotations[key]
+                }
+            })
+        }
+    } else if (this._customHostname?.ingressAnnotations) {
+        const hasCertManagerAnnotation = Object.keys(this._customHostname?.ingressAnnotations).some(key =>
+            key.startsWith('cert-manager.io/')
+        )
+
+        if (hasCertManagerAnnotation) {
+            addCustomIngressTls = true
+        }
+
+        // Add all annotations from projectIngressAnnotations
+        Object.keys(this._customHostname?.ingressAnnotations).forEach((key) => {
+            customIngress.metadata.annotations[key] = this._customHostname?.ingressAnnotations[key]
+        })
+    }
+
+    // Add TLS configuration if needed
+    if (addCustomIngressTls) {
         customIngress.spec.tls = [
             {
                 hosts: [
@@ -638,6 +704,7 @@ module.exports = {
         this._k8sDelay = this._app.config.driver.options?.k8sDelay || 1000
         this._k8sRetries = this._app.config.driver.options?.k8sRetries || 10
         this._certManagerIssuer = this._app.config.driver.options?.certManagerIssuer
+        this._projectIngressAnnotations = this._app.config.driver.options?.projectIngressAnnotations
         this._logPassthrough = this._app.config.driver.options?.logPassthrough || false
         this._cloudProvider = this._app.config.driver.options?.cloudProvider
         if (this._app.config.driver.options?.customHostname?.enabled) {
@@ -838,6 +905,17 @@ module.exports = {
             } catch (err) {
                 this._app.log.error(`[k8s] Instance ${project.id} - error deleting tls secret: ${err.toString()} ${err.stack}`)
             }
+        } else if (this._projectIngressAnnotations) {
+            const hasCertManagerAnnotation = Object.keys(this._projectIngressAnnotations).some(key =>
+                key.startsWith('cert-manager.io/')
+            )
+            if (hasCertManagerAnnotation) {
+                try {
+                    await this._k8sApi.deleteNamespacedSecret({ name: project.safeName, namespace: this._namespace })
+                } catch (err) {
+                    this._app.log.error(`[k8s] Instance ${project.id} - error deleting tls secret: ${err.toString()} ${err.stack}`)
+                }
+            }
         }
 
         if (this._customHostname?.enabled) {
@@ -969,6 +1047,17 @@ module.exports = {
             } catch (err) {
                 this._app.log.error(`[k8s] Instance ${project.id} - error deleting tls secret: ${err.toString()}`)
             }
+        } else if (this._projectIngressAnnotations) {
+            const hasCertManagerAnnotation = Object.keys(this._projectIngressAnnotations).some(key =>
+                key.startsWith('cert-manager.io/')
+            )
+            if (hasCertManagerAnnotation) {
+                try {
+                    await this._k8sApi.deleteNamespacedSecret({ name: project.safeName, namespace: this._namespace })
+                } catch (err) {
+                    this._app.log.error(`[k8s] Instance ${project.id} - error deleting tls secret: ${err.toString()}`)
+                }
+            }
         }
         if (this._customHostname?.enabled) {
             try {
@@ -976,7 +1065,7 @@ module.exports = {
             } catch (err) {
                 this._app.log.error(`[k8s] Instance ${project.id} - error deleting custom ingress: ${err.toString()}`)
             }
-            if (this._customHostname?.certManagerIssuer) {
+            if (this._customHostname?.certManagerIssuer || this._customHostname?.certManagerAnnotations) {
                 try {
                     await this._k8sApi.deleteNamespacedSecret({ name: `${project.safeName}-custom`, namespace: this._namespace })
                 } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@flowfuse/driver-kubernetes",
-    "version": "2.22.2-212a69c-202510161205.0",
+    "version": "2.22.2-6911c7c-202510201047.0",
     "description": "Kubernetes driver for FlowFuse",
     "main": "kubernetes.js",
     "scripts": {