Skip to content

Commit fe6fbd3

Browse files
eduardofragadependabot[bot]leandrosouzaclaude
authored
gh-pages (#167)
* fix: render podSecurityContext and securityContext in all workload templates Move security contexts from global scope to per-component values (glpi.*, mariadb.*, redis.*) and wire them into every template. - glpi: podSecurityContext (fsGroup: 82) and securityContext (runAsUser: 82, non-root, drop ALL) rendered on php-fpm, nginx, all 5 init jobs, cronjob - mariadb/redis: podSecurityContext and securityContext stubbed as {} (no-op by default, can be overridden) Fixes #153 * fix: gate Namespace creation behind flag Remove the implicit Namespace creation via which breaks namespace-scoped RBAC deployments (e.g., FluxCD multi-tenancy). - Add (default: false) to explicitly opt in - now only controls resource scoping - Namespace template uses helper for consistent behavior Closes #154 * fix: add role: primary selector to mariadb-headless service The headless service selector previously matched all pods in the release (nginx, php-fpm) because glpi.selectorLabels is applied chart-wide. This caused ~75% of connection attempts from GLPI to mariadb-headless to time out as DNS round-robined across non-MariaDB endpoints. Fixed by adding 'role: primary' to the selector, consistent with the ClusterIP mariadb service which already does this. Closes #155 * fix(chart): add Helm hooks and ordering to init Jobs, add wait-for-mariadb initContainers - Add helm.sh/hook annotations with hook-weights to all 6 jobs - db-install: post-install only (weight 10) - db-upgrade: post-upgrade only (weight 10) - verify-dir: post-install,post-upgrade (weight 5) - mariadb-timezone: post-install,post-upgrade (weight 7) - db-configure: post-install,post-upgrade (weight 20) - cache-configure: post-install,post-upgrade (weight 30) - Add hook-delete-policy: before-hook-creation,hook-succeeded to all jobs - Add wait-for-mariadb initContainers (busybox nc) to db-install, db-upgrade, db-configure, and mariadb-timezone - Fixes dbUpgrade running on fresh installs (db-upgrade is post-upgrade only) Closes #156 * docs: sync documentation with current codebase (v11.0.7) * fix(chart): major Helm chart fixes for v11.0.7-1 - Fix CronJob YAML indentation preventing deployment - Fix Ingress backend service name to match nginx service - StatefulSet: volumeClaimTemplates for multi-replica, requiredDuringScheduling - Add app.kubernetes.io/component labels consistently across templates - Add ServiceAccount template, imagePullSecrets, scheduling values - Add external database support via externalDatabase config - Add security contexts + resource limits to init containers - Redis: add liveness/readiness probes and non-root security context - MariaDB/Redis: non-root security contexts by default - Fix GLPI_DOC_DIR pointing to /var/www/html instead of var dir - Remove deprecated annotations and status subresource fields - Add terminationGracePeriodSeconds(120s) to MariaDB StatefulSet * fix(ci): publish job condition was skipping on release events * chore(chart): trigger chart release for v11.0.7-1 * fix(chart): move terminationGracePeriodSeconds to pod spec * docs: sync documentation with current codebase (v11.0.7) * fix(chart): major Helm chart fixes for v11.0.7-1 - Fix CronJob YAML indentation preventing deployment - Fix Ingress backend service name to match nginx service - StatefulSet: volumeClaimTemplates for multi-replica, requiredDuringScheduling - Add app.kubernetes.io/component labels consistently across templates - Add ServiceAccount template, imagePullSecrets, scheduling values - Add external database support via externalDatabase config - Add security contexts + resource limits to init containers - Redis: add liveness/readiness probes and non-root security context - MariaDB/Redis: non-root security contexts by default - Fix GLPI_DOC_DIR pointing to /var/www/html instead of var dir - Remove deprecated annotations and status subresource fields - Add terminationGracePeriodSeconds(120s) to MariaDB StatefulSet * fix(ci): publish job condition was skipping on release events * chore(chart): trigger chart release for v11.0.7-1 * fix(chart): move terminationGracePeriodSeconds to pod spec * chore(chart): bump chart version to 11.0.7-2 * chore(chart): bump version back to 11.0.7 (recreate with fixes) * docs: update README files with current versions and config * chore: bump version from 11.0.7 to 11.0.8 Update all version references across Dockerfiles, docker-compose configs, Helm chart, and documentation to GLPI 11.0.8. * chore(deps): bump actions/checkout from 6 to 7 (#164) Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(helm): fix mariadb.enabled=false causing configmap and job failures (#166) * fix(helm): fix mariadb.enabled=false causing configmap and job failures When mariadb.enabled is set to false (external database), two problems occurred: - mariadb-glpi-config ConfigMap was not created, causing initContainers in glpi-job.yaml to fail with a missing ConfigMap reference - MARIADB_PORT in glpi-configmap.yaml always referenced mariadb.service.port regardless of which database was in use Fixes: - mariadb-configmap.yaml now always renders, with conditional values for internal or external database host/port - glpi-configmap.yaml MARIADB_HOST and MARIADB_PORT are now both inside the if/else block - Added externalDatabase.port field to values.yaml (default: 3306) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix(helm): use glpi-config in job initContainers instead of mariadb-glpi-config The initContainers that wait for the database were referencing mariadb-glpi-config, which only exists when mariadb.enabled=true. Changed to reference glpi-config, which always exists and already contains the correct MARIADB_HOST and MARIADB_PORT for both internal MariaDB and external database scenarios. mariadb-configmap.yaml is reverted to only render when mariadb.enabled=true, keeping it scoped to the internal MariaDB setup. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Leandro Souza <lsouzarj@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 31c555c commit fe6fbd3

32 files changed

Lines changed: 1183 additions & 503 deletions

‎.github/workflows/docker-hub.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
runs-on: "ubuntu-latest"
1818
steps:
1919
- name: "Checkout"
20-
uses: "actions/checkout@v6"
20+
uses: "actions/checkout@v7"
2121
- name: "Update repository description"
2222
uses: "peter-evans/dockerhub-description@v5"
2323
with:

‎.github/workflows/docker-publish-base.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- name: Checkout repository
17-
uses: actions/checkout@v6
17+
uses: actions/checkout@v7
1818
- uses: hadolint/hadolint-action@v3.3.0
1919
with:
2020
dockerfile: ./docker/php/Dockerfile.base
@@ -30,7 +30,7 @@ jobs:
3030

3131
steps:
3232
- name: Checkout repository
33-
uses: actions/checkout@v6
33+
uses: actions/checkout@v7
3434

3535
- name: Set up QEMU
3636
uses: docker/setup-qemu-action@v4

‎.github/workflows/docker-publish-nginx.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
runs-on: ubuntu-latest
2525
steps:
2626
- name: Checkout repository
27-
uses: actions/checkout@v6
27+
uses: actions/checkout@v7
2828
- uses: hadolint/hadolint-action@v3.3.0
2929
with:
3030
dockerfile: ./docker/nginx/Dockerfile
@@ -41,7 +41,7 @@ jobs:
4141

4242
steps:
4343
- name: Checkout repository
44-
uses: actions/checkout@v6
44+
uses: actions/checkout@v7
4545

4646
- name: Set up QEMU
4747
uses: docker/setup-qemu-action@v4

‎.github/workflows/docker-publish-php-fpm.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Checkout repository
28-
uses: actions/checkout@v6
28+
uses: actions/checkout@v7
2929
- uses: hadolint/hadolint-action@v3.3.0
3030
with:
3131
dockerfile: ./docker/php/Dockerfile
@@ -41,7 +41,7 @@ jobs:
4141

4242
steps:
4343
- name: Checkout repository
44-
uses: actions/checkout@v6
44+
uses: actions/checkout@v7
4545

4646
- name: Set up QEMU
4747
uses: docker/setup-qemu-action@v4

‎.github/workflows/helm-publish.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
runs-on: ubuntu-latest
2626
steps:
2727
- name: Check out repository code
28-
uses: actions/checkout@v6
28+
uses: actions/checkout@v7
2929

3030
- name: Install Helm
3131
uses: azure/setup-helm@v5
@@ -38,7 +38,7 @@ jobs:
3838
needs: lint
3939
steps:
4040
- name: Check out repository code
41-
uses: actions/checkout@v6
41+
uses: actions/checkout@v7
4242

4343
- name: Install Helm
4444
uses: azure/setup-helm@v5
@@ -68,10 +68,10 @@ jobs:
6868
publish:
6969
runs-on: ubuntu-latest
7070
needs: package
71-
if: github.event.inputs.publish == 'true'
71+
if: ${{ github.event_name == 'release' || github.event.inputs.publish == 'true' }}
7272
steps:
7373
- name: Check out repository code with full history
74-
uses: actions/checkout@v6
74+
uses: actions/checkout@v7
7575
with:
7676
fetch-depth: 0
7777

‎.gitignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,6 @@
22

33

44
.env
5-
*/.env
5+
*/.env
6+
values-custom.yaml
7+
*/values-custom.yaml

‎AGENTS.md‎

Lines changed: 32 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,12 @@
22

33
## Overview
44

5-
This repository contains Docker configurations for deploying GLPI (an IT asset management system). The project consists of:
5+
This repository contains Docker and Kubernetes configurations for deploying GLPI (an IT asset management system). The project consists of:
66
- PHP-FPM base image (`docker/php/Dockerfile.base`)
77
- PHP-FPM application image (`docker/php/Dockerfile`)
88
- Nginx reverse proxy (`docker/nginx/Dockerfile`)
99
- Docker Compose configurations for development and production
10+
- Helm chart for Kubernetes deployment (`kubernetes/glpi/`)
1011

1112
## Build Commands
1213

@@ -19,8 +20,8 @@ docker-compose -f docker-compose-build.yml build
1920

2021
# Build specific image
2122
docker build -t eftechcombr/glpi:base -f docker/php/Dockerfile.base docker/php/
22-
docker build -t eftechcombr/glpi:php-fpm-11.0.6 -f docker/php/Dockerfile docker/php/
23-
docker build -t eftechcombr/glpi:nginx-11.0.6 -f docker/nginx/Dockerfile docker/nginx/
23+
docker build -t eftechcombr/glpi:php-fpm-11.0.8 -f docker/php/Dockerfile docker/php/
24+
docker build -t eftechcombr/glpi:nginx-11.0.8 -f docker/nginx/Dockerfile docker/nginx/
2425
```
2526

2627
### Run Containers
@@ -51,15 +52,17 @@ docker build --check docker/php/
5152
docker build --check docker/nginx/
5253

5354
# Scan for secrets (via hadolint --secret)
54-
hadolint --secret支气管 docker/php/Dockerfile.base
55+
hadolint --secret docker/php/Dockerfile.base
5556
```
5657

58+
DeepSource is also configured for automated linting via `.deepsource.toml` (docker, secrets, and shell analyzers).
59+
5760
## Code Style Guidelines
5861

5962
### Dockerfiles
6063

6164
#### General Rules
62-
- Use specific version tags for base images (e.g., `php:8.4.14-fpm-alpine3.22`, not `php:latest`)
65+
- Use specific version tags for base images (e.g., `php:8.4.19-fpm-alpine3.22`, not `php:latest`)
6366
- Pin package versions in Alpine (e.g., `icu-dev=76.1-r1`)
6467
- Always clean up build dependencies with `apk del .build-deps`
6568
- Remove `docker-php-source delete` after installing extensions
@@ -83,16 +86,16 @@ docker-php-ext-install intl mysqli gd exif bz2 zip ldap opcache bcmath
8386
```
8487

8588
#### Redis Extension
86-
Install via PECL with version pinning:
89+
Install via PECL (version pinning recommended for reproducible builds):
8790
```dockerfile
88-
pecl install redis-6.2.0
91+
pecl install redis
8992
docker-php-ext-enable redis
9093
```
9194

9295
### Docker Compose
9396

9497
#### Version Tagging
95-
- Always use explicit version tags (e.g., `11.0.6`, not `latest`)
98+
- Always use explicit version tags (e.g., `11.0.8`, not `latest`)
9699
- Keep all service image tags synchronized
97100
- Use semantic versioning
98101

@@ -162,11 +165,11 @@ trap 'echo "Error on line $LINENO"' ERR
162165
### Images
163166
- Lowercase: `eftechcombr/glpi`
164167
- Use kebab-case: `php-fpm`, `nginx`
165-
- Version format: `11.0.6`
168+
- Version format: `11.0.8`
166169

167170
### Services (docker-compose)
168171
- Lowercase with hyphens: `mariadb`, `glpi-db-install`
169-
- Descriptive: `glpi-db-configure`, `glpi-cache-configure`
172+
- Descriptive: `glpi-db-configure`, `glpi-cache-configure`, `glpi-verify-dir`, `glpi-db-upgrade`, `mariadb-timezone`
170173

171174
### Environment Variables
172175
- Uppercase with underscores: `MARIADB_HOST`, `GLPI_VERSION`
@@ -177,7 +180,7 @@ trap 'echo "Error on line $LINENO"' ERR
177180
When upgrading GLPI or PHP versions:
178181

179182
1. Update `docker/php/Dockerfile.base`:
180-
- PHP version (e.g., `8.4.13` → `8.4.14`)
183+
- PHP version (e.g., `8.4.13` → `8.4.19`)
181184
- Alpine version if needed
182185
- All pinned package versions (verify they exist in Alpine)
183186

@@ -187,23 +190,32 @@ When upgrading GLPI or PHP versions:
187190
3. Update `docker/.env`:
188191
- `VERSION="11.0.x"`
189192

190-
4. Update `docker/docker-compose.yml`:
193+
4. Update `docker/.env.example`:
194+
- `VERSION="11.0.x"`
195+
196+
5. Update `docker/docker-compose.yml`:
191197
- All image tags
192198

193-
5. Update `docker/docker-compose-build.yml`:
199+
6. Update `docker/docker-compose-build.yml`:
194200
- All image tags
195201

196-
6. Update `docker/nginx/Dockerfile`:
202+
7. Update `docker/nginx/Dockerfile`:
197203
- Base image tag
198204

199-
7. Verify with hadolint:
205+
8. Update `kubernetes/glpi/Chart.yaml`:
206+
- `version:` and `appVersion:` fields
207+
208+
9. Update `kubernetes/glpi/values.yaml`:
209+
- `glpi.version`, `glpi.phpfpm.image.tag`, `glpi.nginx.image.tag`
210+
211+
10. Verify with hadolint:
200212
```bash
201213
hadolint docker/php/Dockerfile.base
202214
hadolint docker/php/Dockerfile
203215
hadolint docker/nginx/Dockerfile
204216
```
205217

206-
8. Test build locally:
218+
11. Test build locally:
207219
```bash
208220
cd docker
209221
docker-compose -f docker-compose-build.yml build base
@@ -215,10 +227,10 @@ Current pinned versions in `Dockerfile.base` (Alpine 3.22):
215227

216228
| Package | Version |
217229
|---------|---------|
218-
| php base | 8.4.14-fpm-alpine3.22 |
230+
| php base | 8.4.19-fpm-alpine3.22 |
219231
| icu-dev | 76.1-r1 |
220-
| zlib-dev | 1.3.1-r2 |
221-
| libpng-dev | 1.6.55-r0 |
232+
| zlib-dev | 1.3.2-r0 |
233+
| libpng-dev | 1.6.57-r0 |
222234
| bzip2-dev | 1.0.8-r6 |
223235
| libzip-dev | 1.11.4-r0 |
224236
| openldap-dev | 2.6.8-r0 |
@@ -228,7 +240,7 @@ Current pinned versions in `Dockerfile.base` (Alpine 3.22):
228240
| file | 5.46-r2 |
229241
| g++ | 14.2.0-r6 |
230242
| gcc | 14.2.0-r6 |
231-
| musl-dev | 1.2.5-r10 |
243+
| musl-dev | 1.2.5-r12 |
232244
| make | 4.4.1-r3 |
233245
| pkgconf | 2.4.3-r0 |
234246
| re2c | 4.2-r0 |

‎README.md‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ Manifest files for building and deploying **GLPI** using containers with Docker
88
## Supported Containers
99

1010
- [x] PHP-FPM: `php:8.4.19-fpm-alpine3.22`
11-
- [x] Nginx: `nginxinc/nginx-unprivileged:1.29.1-alpine3.22-slim`
12-
- [x] GLPI PHP: `eftechcombr/glpi:php-fpm-11.0.6`
13-
- [x] GLPI Nginx: `eftechcombr/glpi:nginx-11.0.6`
11+
- [x] Nginx: `nginxinc/nginx-unprivileged:1.27.5-alpine3.21-slim`
12+
- [x] GLPI PHP: `eftechcombr/glpi:php-fpm-11.0.8`
1413

14+
- [x] GLPI Nginx: `eftechcombr/glpi:nginx-11.0.8`
1515
## Quick Start
1616

1717
### Using Helm (Kubernetes)
@@ -21,7 +21,7 @@ Manifest files for building and deploying **GLPI** using containers with Docker
2121
Add the GLPI Helm chart repository:
2222

2323
```sh
24-
helm repo add glpi https://eftechcombr.github.io/glpi/
24+
helm repo add eftechcombr https://eftechcombr.github.io/glpi/
2525
helm repo update
2626
```
2727

@@ -31,25 +31,25 @@ helm repo update
3131
Install GLPI using Helm:
3232

3333
```sh
34-
helm install my-glpi glpi/glpi
34+
helm install my-glpi eftechcombr/glpi
3535
```
3636

3737
Or with custom values:
3838

3939
```sh
40-
helm install my-glpi glpi/glpi -f custom-values.yaml
40+
helm install my-glpi eftechcombr/glpi -f custom-values.yaml
4141
```
4242

4343
#### Searching for Available Versions
4444

4545
```sh
46-
helm search repo glpi --versions
46+
helm search repo eftechcombr --versions
4747
```
4848

4949
#### Upgrading the Chart
5050

5151
```sh
52-
helm upgrade my-glpi glpi/glpi
52+
helm upgrade my-glpi eftechcombr/glpi
5353
```
5454

5555
#### Uninstalling the Chart
@@ -64,7 +64,14 @@ helm uninstall my-glpi
6464
2. Set up environment variables:
6565
```sh
6666
cp docker/.env.example docker/.env
67+
# Edit docker/.env with your desired configuration
6768
```
69+
3. Start the containers:
70+
```sh
71+
cd docker
72+
docker compose up -d
73+
```
74+
GLPI will be accessible at http://localhost:8080
6875

6976
## Credentials
7077

@@ -75,15 +82,18 @@ cp docker/.env.example docker/.env
7582

7683
### docker-compose
7784

78-
./docker/_env ---> please rename to /docker/.env
85+
./docker/.env.example ---> copy to ./docker/.env and customize
86+
87+
See ./docker/.env for available environment variables including:
88+
- MARIADB_HOST, MARIADB_PORT, MARIADB_DATABASE, MARIADB_USER, MARIADB_PASSWORD
89+
- GLPI_LANG, VERSION, CACHE_DSN
90+
- GLPI_VAR_DIR, GLPI_CONFIG_DIR, GLPI_MARKETPLACE_DIR and other directory paths
7991

8092

8193
### kubernetes
8294

83-
./kubernetes/glpi-configmap.yaml
84-
./kubernetes/glpi-secrets.yaml
85-
./kubernetes/mariadb-configmap.yaml
86-
./kubernetes/mariadb-secret.yaml
95+
See ./kubernetes/glpi/values.yaml for all configurable Helm chart parameters,
96+
including GLPI, MariaDB, Redis, Ingress, and external database settings.
8797

8898

8999

‎docker/.env.example‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
GLPI_LANG="en_US"
2-
VERSION="11.0.5"
2+
VERSION="11.0.8"
33
GLPI_MARKETPLACE_DIR=/var/www/html/marketplace
44
GLPI_VAR_DIR=/var/lib/glpi
55
GLPI_DOC_DIR=/var/lib/glpi

0 commit comments

Comments
 (0)