@leverege/build-tools 2.80.1 → 2.82.0

package/src/helm-charts/cnpg-operator/helmdn.plugin

@@ -9,7 +9,7 @@ OPERATOR_SHUTDOWN
 
 yesToContinue "to delete the CNPG Operator"
 
-OPVER="1.24.0"
+OPVER="1.26.0"
 
 clearlyWarn DO_NOT_CLEAR
 

package/src/helm-charts/cnpg-operator/helmup.bootstrap

@@ -0,0 +1,201 @@
+#!/bin/bash
+#
+# lifted from helmup.sh
+#
+function installCnpgOperatorEnvironment() {
+  # See => https://github.com/cloudnative-pg/charts
+
+  gcloud config set project $GCP_PROJECT_ID
+
+  # create an SA in the cnpg namespace for the operands to bind to
+  CNPG_NAMESPACE="cnpg-operands"
+  CNPG_SVC_ACCT="$CNPG_NAMESPACE-sa"
+  CNPG_SVC_EMAIL="$CNPG_SVC_ACCT@$GCP_PROJECT_ID.iam.gserviceaccount.com"
+
+  # We used to delete the SA when we were doing clean installs but that bit
+  # me in the ass the time I moved the operator dir out of the way to run
+  # helmwhat to populate with latest operator version. The result? The SA
+  # was deleted and recreated and the existing system lost the ability to
+  # write to GCS which resulted in WAL failures. The deletion / recreation
+  # logic was only useful in the early days of creating / deleting for
+  # initial development.
+  #
+  # Synopsis: deleting an SA from an actual non-test system is BAD NEWS
+  #           and if it happens then you will need to rebind the SA to
+  #           workload identity by hand.
+  #
+  # kubectl delete serviceaccounts -n $CNPG_NAMESPACE $CNPG_SVC_ACCT &> $DEVNULL
+  # gcloud --quiet iam service-accounts delete $CNPG_SVC_EMAIL  --project $GCP_PROJECT_ID&> $DEVNULL
+  kubectl describe serviceaccounts -n $CNPG_NAMESPACE $CNPG_SVC_ACCT &> $DEVNULL
+  if [ $? -eq 0 ];
+  then
+    cat<<SKIP_CNPG_SA_CREATION
+
+  $YELO_WARN The CNPG SA $CNPG_SVC_ACCT already exists
+
+  Deleting the SA for the purposes of upgrading the operator is going to
+  wreck someone's day (probably yours) if the desire is to simply upgrade
+  in place. To force a clean reinstall, delete both the k8s and gcp SA for
+  CNPG and try again. (see comments in helmup for more info)
+
+SKIP_CNPG_SA_CREATION
+    return
+  fi
+
+  # Create the operands namespace and annotate to allow redis access
+  createNamespaceIfNeeded $CNPG_NAMESPACE
+
+  # Create GCP SA and bind policies
+  printf "\nCreating the gcloud `color g $CNPG_SVC_ACCT` service account (SA)\n"
+  gcloud iam service-accounts create $CNPG_SVC_ACCT \
+    --project "$GCP_PROJECT_ID" \
+    --description "CNPG Operands SA" \
+    --display-name "CNPG Operands SA" &> $DEVNULL
+  warnOnError $? "the GCP SA `color y $CNPG_SVC_ACCT` may already exist"
+
+  CNPG_OPS_ROLE="cnpg.operands"
+  printf "\nCreating the `color g $CNPG_OPS_ROLE` IAM role\n"
+  ## Attach roles
+  ROLE_PERMISSIONS=(
+    iam.serviceAccounts.actAs
+    iam.serviceAccounts.get
+    iam.serviceAccounts.getAccessToken
+    iam.serviceAccounts.getOpenIdToken
+    iam.serviceAccounts.implicitDelegation
+    iam.serviceAccounts.list
+    iam.serviceAccounts.signBlob
+    iam.serviceAccounts.signJwt
+    resourcemanager.projects.get
+    storage.buckets.create
+    storage.buckets.get
+    storage.buckets.getIamPolicy
+    storage.buckets.list
+    storage.buckets.update
+    storage.objects.create
+    storage.objects.delete
+    storage.objects.get
+    storage.objects.getIamPolicy
+    storage.objects.list
+  )
+  gcloud iam roles create $CNPG_OPS_ROLE \
+    --project $GCP_PROJECT_ID \
+    --title "CNPG Operands" \
+    --description "CNPG Operands" \
+    --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  if [ $? -ne 0 ];
+  then
+    # assume error is that role exists so try updating instead
+    printf "\nUpdating the permissions on the `color g $CNPG_OPS_ROLE` IAM role\n"
+    gcloud iam roles update $CNPG_OPS_ROLE \
+      --project $GCP_PROJECT_ID \
+      --title "CNPG Operands" \
+      --permissions "$(IFS=","; echo "${ROLE_PERMISSIONS[*]}")" &> $DEVNULL
+  fi
+  warnOnError $? "Failed to add roles to $CNPG_OPS_ROLE - perhaps they already exist?"
+
+  printf "\nBinding IAM role to the SA `color g $CNPG_SVC_EMAIL`\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --member="serviceAccount:$CNPG_SVC_EMAIL" \
+    --role "roles/storage.admin" &> $DEVNULL
+#   --role projects/$GCP_PROJECT_ID/roles/$CNPG_OPS_ROLE &> $DEVNULL
+#   --role "roles/storage.admin" &> $DEVNULL
+  warnOnError $? "gcloud problem binding IAM policy"
+
+  printf "\nBinding IAM the Token Creator role to the SA `color g $CNPG_SVC_EMAIL`\n"
+  gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
+    --member="serviceAccount:$CNPG_SVC_EMAIL" \
+    --role="roles/iam.serviceAccountTokenCreator"
+
+  # workload binding will be performed by each cnpg operand on startup
+
+  BARMAN_BUCKET="gs://$GCP_PROJECT_ID-barman"
+  gsutil ls -p $GCP_PROJECT_ID -b $BARMAN_BUCKET &> $DEVNULL
+  if [ "$?" -eq 0 ];
+  then
+    printf "\nBarman bucket `color g "$BARMAN_BUCKET"` already exists - skipping recreation\n"
+  else
+    printf "\nCreating a bucket for barman backups: `color g $BARMAN_BUCKET`\n"
+    gsutil mb -l $GCE_REGION $BARMAN_BUCKET &> $DEVNULL
+    gsutil iam ch serviceAccount:$CNPG_SVC_EMAIL:objectAdmin $BARMAN_BUCKET
+    gsutil ubla set on $BARMAN_BUCKET # uniform bucket access
+  fi
+
+  # define the snapshot storage class
+  printf "\nApplying the CNPG VolumeSnapshotClass `color g cnpg-snapshotclass` definition\n"
+  cat<<EOSNAPSC | kubectl apply -f -
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+  name: cnpg-snapshotclass
+driver: pd.csi.storage.gke.io
+deletionPolicy: Retain
+EOSNAPSC
+
+  sleep 2 # hold up processing for a moment to allow IAM mods to propagate
+}
+
+# this function is a little convoluted in the way it attempts to install the
+# scripts and yaml necessary for the CNPG cleanup activities - the idea is to
+# be able to update the scripts without touching anything else since the target
+# directory is the cnpg-operator setup
+function installCnpgCleanupCronjob() {
+  CNPG_OPERATOR_DIR="cnpg-operator"
+  if [ ! -d "$CNPG_OPERATOR_DIR" ];
+  then
+    cat<<CNPG_OPERATOR_MISSING
+  `color r "The cnpg-operator must be installed before proceeding"`
+
+CNPG_OPERATOR_MISSING
+    exit 1
+  fi
+
+  # create the destination bucket for k8s cronjob scripts
+  BUCKET_SUFFIX="k8s-cronjobs"
+  makeUniformBucketWithCors $BUCKET_SUFFIX
+
+  CNPG_CLEANUP_CRONJOB_OVH="cnpg-cleanup-cronjob.yaml.ovh"
+  CNPG_CLEANUP_CRONJOB="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_CRONJOB_OVH"
+  CNPG_CLEANUP_SCRIPT_BASH="cnpg-cleanup-script.sh"
+  CNPG_CLEANUP_SCRIPT="$CNPG_OPERATOR_DIR/$CNPG_CLEANUP_SCRIPT_BASH"
+  if [ ! -f "$CNPG_CLEANUP_SCRIPT" ];
+  then
+    cat<<CNPG_FETCH_CLEANUP_CRONJOB_YAML
+  `color y "Missing $CNPG_CLEANUP_SCRIPT_BASH - updating local cron setup scripts"`
+
+CNPG_FETCH_CLEANUP_CRONJOB_YAML
+    CNPG_OP_ROOT="$(build-tools --reporoot)/src/helm-charts/cnpg-operator"
+    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_CRONJOB_OVH $CNPG_CLEANUP_CRONJOB
+    cp $CNPG_OP_ROOT/$CNPG_CLEANUP_SCRIPT_BASH $CNPG_CLEANUP_SCRIPT
+  fi
+
+  # copy / update the script in the bucket referenced in the cronjob
+  printf "\ngsutil cp $CNPG_CLEANUP_SCRIPT gs://$GCP_PROJECT_ID-$BUCKET_SUFFIX\n"
+  gsutil cp $CNPG_CLEANUP_SCRIPT gs://$GCP_PROJECT_ID-$BUCKET_SUFFIX
+
+  local CNPG_NAMESPACE="cnpg-operands"
+  local CNPG_CLEANUP_SA="cnpg-cleanup-sa"
+
+  gcloud iam service-accounts create "$CNPG_CLEANUP_SA" \
+    --project="$GCP_PROJECT_ID" \
+    --description="Used for cronjob cleanup with Workload Identity" \
+    --display-name="CNPG Cleanup SA" &> $DEVNULL
+    warnOnError $? "the GCP SA $CNPG_CLEANUP_SA may already exist"
+
+  gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
+    --project="$GCP_PROJECT_ID" \
+    --member="serviceAccount:$CNPG_CLEANUP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
+    --role="roles/storage.objectViewer"
+
+  bindWorkloadIdentity "$CNPG_CLEANUP_SA" "$CNPG_NAMESPACE"
+
+  CNPG_CLEANUP_CRONJOB_YAML="$CNPG_OPERATOR_DIR/$(basename $CNPG_CLEANUP_CRONJOB_OVH .ovh)"
+  overwhelm -g # allow ovh -> yaml to occur
+  cat<<CNPG_CLEANUP_CRONJOB_APPLY
+  `color g "Creating cronjob =>"``color y " kubectl apply -f $CNPG_CLEANUP_CRONJOB_YAML"`
+
+CNPG_CLEANUP_CRONJOB_APPLY
+  kubectl apply -f $CNPG_CLEANUP_CRONJOB_YAML
+}
+# Run it!
+installCnpgOperatorEnvironment
+installCnpgCleanupCronjob

package/src/helm-charts/cnpg-operator/helmup.plugin

@@ -2,7 +2,7 @@
 #
 # See => https://cloudnative-pg.io/documentation/current/installation_upgrade/
 #
-OPVER="1.26.0" # 05/23/2025
+OPVER="1.26.1" # 07/29/2025
 
 createNamespaceIfNeeded cnpg-system
 

package/src/helm-charts/cnpg-operator/operand.bootstrap

@@ -0,0 +1,41 @@
+#!/bin/bash
+#
+# Lifted from helmup.sh
+#
+# This function is used to randomly generate the postgresql database passwords
+# for the postgres and imagine users in a cnpg operator configuration. Since
+# the resultant passwords will live in the cnpg-operands namespace they will
+# be mirrored to the default namespace via the reflector service. Lastly, the
+# service account will have workload identity bound to it in the cnpg-operands
+# namespace.
+function initializeCnpgOperand() {
+  local CNPG_SERVICE="$1"
+  local CNPG_NAMESPACE="cnpg-operands"
+  local CNPG_SVC_ACCT="$CNPG_NAMESPACE-sa"
+  local IMAGINE_PW_NAME="$CNPG_SERVICE-imagine-pw"
+  local POSTGRES_PW_NAME="$CNPG_SERVICE-postgres-pw"
+
+# TODO: we use postgres root password for access - that is bad - fix it?
+# printf "\nCreating imagine db password for `color g $CNPG_SERVICE`\n"
+# kubectl create secret generic -n $CNPG_NAMESPACE "$IMAGINE_PW_NAME" \
+#       --from-literal=username="imagine" \
+#       --from-literal=password="$(generatePassword)" &> $DEVNULL
+# warnOnError $? "the `color y $IMAGINE_PW_NAME` secret may already exist"
+
+# # reflect the secret to default namespace
+# reflectSecretIntoNamespaces $IMAGINE_PW_NAME $CNPG_NAMESPACE "default"
+
+  printf "\nCreating postgres db password for `color g $CNPG_SERVICE`\n"
+  kubectl create secret generic -n $CNPG_NAMESPACE "$POSTGRES_PW_NAME" \
+        --from-literal=username="postgres" \
+        --from-literal=password="$(generatePassword)" &> $DEVNULL
+  warnOnError $? "the `color y $POSTGRES_PW_NAME` secret may already exist"
+
+  # reflect the secret to default namespace
+  reflectSecretIntoNamespaces $POSTGRES_PW_NAME $CNPG_NAMESPACE "default"
+
+  printf "\nBinding `color g $CNPG_SERVICE` to the `color y "$CNPG_SVC_ACCT"` SA\n"
+  bindWorkloadIdentity $CNPG_SVC_ACCT $CNPG_NAMESPACE $CNPG_SERVICE
+}
+# Run It!
+initializeCnpgOperand "$SERVICE" # $SERVICE from helmup.sh

package/src/helm-charts/elasticsearch8/elasticsearch-local-dev.yaml

@@ -8,7 +8,16 @@
 # for each of the 4 ES node types in the cluster. See prd-recovr-auto for an
 # example of a big beefy system.
 #
+# Moves us away from bitnami hosted charts/images
+#
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/elasticsearch
+# tag: 8.18.0
+
 global:
+  security:
+    allowInsecureImages: true
   storageClass: "ssd"
 
 fullnameOverride: "elasticsearch8"

package/src/helm-charts/elasticsearch8/elasticsearch-local-prd.yaml

@@ -8,7 +8,16 @@
 # for each of the 4 ES node types in the cluster. See prd-recovr-auto for an
 # example of a big beefy system.
 #
+# Moves us away from bitnami hosted charts/images
+#
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/elasticsearch
+# tag: 8.18.0
+
 global:
+  security:
+    allowInsecureImages: true
   storageClass: "ssd"
 
 fullnameOverride: "elasticsearch8"

package/src/helm-charts/elasticsearch8/helmup.plugin

@@ -2,11 +2,11 @@
 #
 showInstalling "Elastic Search 8"
 
+OCI_CHART="oci://us-docker.pkg.dev/leverege-registry/bitnami-mirror/charts/elasticsearch"
+
 # *** WARNING TO FUTURE SELF *** v22 of the chart is ES v9!!!
 [ -z "$ELASTIC_CHART_VERSION" ] && ELASTIC_CHART_VERSION="21.6.3"
 
-OCI_CHART="oci://registry-1.docker.io/bitnamicharts/elasticsearch"
-
 LOCAL_ES_VALUES="elasticsearch8/elasticsearch-local-dev.yaml"
 #LOCAL_ES_VALUES="elasticsearch8/elasticsearch-local-prd.yaml"
 [ ! -f "$LOCAL_ES_VALUES" ] && exitOnError 1 "Missing the local ES config file => `color y $LOCAL_ES_VALUES`"
@@ -14,4 +14,4 @@ LOCAL_ES_VALUES="elasticsearch8/elasticsearch-local-dev.yaml"
 helm upgrade --install elasticsearch8 $OCI_CHART \
              --namespace elastic --create-namespace \
              --values $LOCAL_ES_VALUES \
-             --version $ELASTIC_CHART_VERSION $HELM_WHAT
+             --version $ELASTIC_CHART_VERSION $HELM_WHAT

package/src/helm-charts/pgbouncer/helmup.bootstrap

@@ -0,0 +1,24 @@
+#!/bin/bash
+
+function setupPgbouncerSecret() {
+  # pgbouncer uses a k8s secret for the user access list which is in the form
+  # of => "user" "password" - this function will create the pgbouncer secret
+  # if it does not exist by pulling the password from the PG_PASSWORD secret
+  # managed by the Google Secret Manager service.
+  USERLIST_SECRET='pgbouncer-userlist-secret'
+  kubectl get secret $USERLIST_SECRET &> $DEVNULL
+  [[ $? -eq 0 ]] && return # already exists - bail
+
+  cat<<PGB_SECRET
+
+  `color y "Creatng $USERLIST_SECRET k8s secret from secret manager PG_PASSWORD secret..."`
+
+PGB_SECRET
+  DECODED_PSQL_PASSWORD=$(gcloud secrets versions access latest --secret=PG_PASSWORD --project $GCP_PROJECT_ID)
+  exitOnError $? "Failed to fetch PG_PASSWORD from the secret manager"
+
+  kubectl create secret generic $USERLIST_SECRET --from-literal=userlist.txt="\"postgres\" \"$DECODED_PSQL_PASSWORD\""
+  exitOnError $? "Failed to create the $USERLIST_SECRET k8s secret"
+}
+
+setupPgbouncerSecret

package/src/helm-charts/postgres/README.md

@@ -0,0 +1,6 @@
+## Legacy PostgreSQL 11
+
+This configuration was temporarily resurrected for supporting the bitnami
+migrations. There are still quite a few legacy deployments using this
+ancient psql approach. We use this config to point the servers at the Leverege
+artifact registry for the mirrored bitnami images.

package/src/helm-charts/postgres/helmdn.plugin

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+echo 'NO!'

package/src/helm-charts/postgres/helmup.plugin

@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+showInstalling "PostgreSQL Database (legacy)"
+
+errorIfMissingSecret authz-postgres
+
+OCI_CHART="oci://us-docker.pkg.dev/leverege-registry/bitnami-mirror/charts/postgresql"
+
+[ -z "$PSQL_CHART_VERSION" ] && PSQL_CHART_VERSION="10.16.2"
+
+helm upgrade --install postgres $OCI_CHART          \
+             --values  postgres/postgres-local.yaml \
+             --version $PSQL_CHART_VERSION $HELM_WHAT
+
+#
+# legacy
+#helm upgrade --install postgres bitnami/postgresql  \
+#             --values  postgres/postgres-local.yaml \
+#             --version 10 $HELM_WHAT
+#
+#removeHelmRepo bitnami

package/src/helm-charts/postgres/postgres-local.yaml

@@ -0,0 +1,51 @@
+# Moves us away from bitnami hosted charts/images
+#
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/postgresql
+# tag: 11.14.0-debian-10-r28
+
+postgresqlExtendedConf:
+  maxWorkerProcesses: 4
+  maxParallelWorkers: 4
+  maxConnections: 500
+  shared_buffers: 1GB
+  effectiveCacheSize: 4GB
+  maintenanceWorkMem: 1GB
+  workMem: 10MB
+
+persistence:
+  storageClass: "ssd"
+# size: 16Gi # default 8Gi
+
+resources:
+  requests:
+    memory: 1Gi
+    cpu: 750m
+
+postgresqlDatabase: authz
+existingSecret: authz-postgres
+
+metrics:
+  enabled: true
+  image:
+    registry: us-docker.pkg.dev
+    repository: leverege-registry/bitnami-mirror/images/postgres-exporter
+#   tag: 0.10.0-debian-10-r172
+
+master:
+  tolerations:
+  - key: "database"
+    operator: "Equal"
+    value: "true"
+    effect: "NoSchedule"
+
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: target-env
+            operator: In
+            values:
+            - database

package/src/helm-charts/prom-operator/helmup.bootstrap

@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# This function came from the helmup.sh script and is used to install the
+# stackdriver exporter in the prometheus or monitoring (legacy) namespace.
+# This function only needs to execute once, at initial setup / configuration.
+function installStackdriverExporterEnvironment() {
+  showInstalling "Stackdriver Exporter Service Account Binding"
+
+  # Add necessary helm repositories - note that stable is deprecated
+  addHelmRepo prometheus-community https://prometheus-community.github.io/helm-charts
+
+  local SDEXP_NS=${1:-prometheus}
+  local SDEXP_SA="stackdriver-exporter"
+  local SDEXP_EM="$SDEXP_SA@$GCP_PROJECT_ID.iam.gserviceaccount.com"
+
+  createNamespaceIfNeeded $SDEXP_NS
+
+  # guarantee any previous remnants of the exporter are gone
+  printf "\n*** Removing the previous $SDEXP_SA installation...\n"
+  helm uninstall -n $SDEXP_NS $SDEXP_SA                 &> $DEVNULL
+  kubectl delete serviceaccounts -n $SDEXP_NS $SDEXP_SA &> $DEVNULL
+  printf "!!! Skipping deletion of the gcloud SA $SDEXP_EM\n"
+# gcloud --quiet iam service-accounts delete $SDEXP_EM  &> $DEVNULL
+
+  # NOTE: The k8s SA != GCP SA - the former is created by the helm chart
+  # that installs the stackdriver-exporter, the latter is handled here in
+  # order to provide the proper IAM permissions to the exporter.
+
+  # Create GCP SA and bind policies
+  printf "\n*** Creating GCP SA with $SDEXP_NS/viewer ***\n"
+  gcloud iam service-accounts create $SDEXP_SA \
+    --project "$GCP_PROJECT_ID" \
+    --display-name "Prometheus Stackdriver Exporter" &> $DEVNULL
+  warnOnError $? "the GCP SA $SDEXP_SA may already exist"
+
+  printf "\n*** Binding IAM role of $SDEXP_NS viewer to $SDEXP_SA in $GCP_PROJECT_ID\n"
+  gcloud projects add-iam-policy-binding "$GCP_PROJECT_ID" \
+    --role "roles/monitoring.viewer" \
+    --member "serviceAccount:$SDEXP_EM" &> $DEVNULL
+  sleep 2 # give the IAM binding a chance to complete before moving on
+
+  bindWorkloadIdentity $SDEXP_SA $SDEXP_NS
+
+  removeHelmRepo prometheus-community
+}
+
+installStackdriverExporterEnvironment

package/src/helm-charts/prom-operator/rules/traefik-rules.yaml

@@ -31,8 +31,8 @@ spec:
 #               VALUE = {{ $value }}
 #               LABELS = {{ $labels }}
         - alert: TraefikHighHttp5xxErrorRateService
-          expr: sum(rate(traefik_service_requests_total{code=~"5.*"}[3m])) by (service) / sum(rate(traefik_service_requests_total[3m])) by (service) * 100 > 5
-          for: 1m
+          expr: sum(rate(traefik_service_requests_total{code=~"5.*"}[5m])) by (service) / sum(rate(traefik_service_requests_total[5m])) by (service) * 100 > 5
+          for: 5m # awesome was => 1m
           labels:
             severity: critical
           annotations:

package/src/helm-charts/prom-operator/stackdriver-exporter.yaml.ovh

@@ -34,7 +34,8 @@ stackdriver:
 serviceMonitor:
   enabled: true
   namespace: prometheus
-  interval: "30s"
+  interval: "60s"        # Align with Stackdriver's 60s data resolution
+# honorTimestamps: false # Avoid duplicate timestamp conflicts (eliminates dup timestamps?)
   relabelings:
     # Legacy labelmap used to preserve compatibility with pre-operator Grafana dashboards
     # Can be removed once legacy Prometheus stack is deprecated

package/src/helm-charts/redis/helmup.plugin

@@ -2,10 +2,10 @@
 
 showInstalling "Redis"
 
-OCI_CHART="oci://registry-1.docker.io/bitnamicharts/redis"
+OCI_CHART="oci://us-docker.pkg.dev/leverege-registry/bitnami-mirror/charts/redis"
 
 [ -z "$REDIS_CHART_VERSION" ] && REDIS_CHART_VERSION="20.13.4"
 
-helm upgrade --install redis $OCI_CHART       \
+helm upgrade --install redis $OCI_CHART        \
              --values  redis/values-local.yaml \
              --version $REDIS_CHART_VERSION $HELM_WHAT

package/src/helm-charts/redis/values-local.yaml

@@ -1,4 +1,14 @@
+#
+# Moves us away from bitnami hosted charts/images
+#
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/redis
+# tag: 7.4.3-debian-12-r0
+
 global:
+  security: # this allows us to use local images
+    allowInsecureImages: true
   storageClass: ssd
 
 auth:
@@ -70,6 +80,10 @@ networkPolicy:
 
 metrics:
   enabled: true
+  image:
+    registry: us-docker.pkg.dev
+    repository: leverege-registry/bitnami-mirror/images/redis-exporter
+#   tag: 1.74.0-debian-12-r2
   serviceMonitor:
     enabled: true # set to true for prometheus operator
     namespace: "prometheus"

package/src/helm-charts/traefik/helmup.plugin

@@ -17,7 +17,7 @@ TRAEFIK_NAMESPACE="traefik"
 
 addHelmRepo traefik https://helm.traefik.io/traefik
 
-[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="36"
+[ -z "$TRAEFIK_CHART_VERSION" ] && TRAEFIK_CHART_VERSION="37"
 helm upgrade --install traefik traefik/traefik \
              --namespace $TRAEFIK_NAMESPACE --create-namespace \
              --values  traefik/values.yaml \

package/src/helm-charts/traefik/values-local.yaml

@@ -28,7 +28,7 @@ resources:
 metrics:
   prometheus:
     serviceMonitor:
-      enabled: true
+      enabled: false # initially disabled until prometheus operator is installed
       interval: 30s
       namespace: prometheus
 

package/src/helm-charts/valkey/helmup.plugin

@@ -2,10 +2,10 @@
 
 showInstalling "Valkey"
 
-OCI_CHART="oci://registry-1.docker.io/bitnamicharts/valkey"
+OCI_CHART="oci://us-docker.pkg.dev/leverege-registry/bitnami-mirror/charts/valkey"
 
-[ -z "$VALKEY_CHART_VERSION" ] && VALKEY_CHART_VERSION="2.2.4"
+[ -z "$VALKEY_CHART_VERSION" ] && VALKEY_CHART_VERSION="3.0.22"
 
-helm upgrade --install valkey $OCI_CHART       \
+helm upgrade --install valkey $OCI_CHART        \
              --values  valkey/valkey-local.yaml \
              --version $VALKEY_CHART_VERSION $HELM_WHAT

package/src/helm-charts/valkey/valkey-local.yaml

@@ -1,5 +1,11 @@
+image:
+  registry: us-docker.pkg.dev
+  repository: leverege-registry/bitnami-mirror/images/valkey
+# tag: 8.1.3-devian-12-r1
 
 global:
+  security:
+    allowInsecureImages: true
   storageClass: "ssd"
 
 architecture: replication
@@ -11,7 +17,7 @@ auth:
 primary:
   replicaCount: 1
 
-  resourcesPreset: "nano"
+  resourcesPreset: "small"
   resources:
     requests:
       cpu: 250m
@@ -77,6 +83,10 @@ sentinel:
 
 metrics:
   enabled: true
+  image:
+    registry: us-docker.pkg.dev
+    repository: leverege-registry/bitnami-mirror/images/redis-exporter
+#   tag: 1.74.0-debian-12-r2
   serviceMonitor:
     enabled: true
     namespace: "prometheus"