[mariadb-ingress] Uplift Mariadb-ingress to 0.42.0

- Uplifts the image to nginx 0.42.0 to address CVEs
- Updates nginx.tmpl accordingly for nginx 0.42.0
- Adds CLusterRole and labels needed for nginx 0.42.0
- Updates release notes for mariadb

Change-Id: Ie4e2a66873bc130c547ff8f30d8e1b2ee9a62186

mariadb/Chart.yaml

@@ -15,7 +15,7 @@ apiVersion: v1
 appVersion: v10.2.31
 description: OpenStack-Helm MariaDB
 name: mariadb
-version: 0.1.8
+version: 0.1.9
 home: https://mariadb.com/kb/en/
 icon: http://badges.mariadb.org/mariadb-badge-180x60.png
 sources:

mariadb/templates/bin/_mariadb-ingress-controller.sh.tpl

@@ -18,10 +18,9 @@ set -ex
 COMMAND="${@:-start}"
 
 function start () {
-  find /tmp/ -maxdepth 1 -writable | grep -v "^/tmp/$" | xargs -L1 -r rm -rfv
+  find /tmp -maxdepth 1 \! -path /tmp -perm /222 -exec rm -rfv {} \;
   exec /usr/bin/dumb-init \
       /nginx-ingress-controller \
-      --force-namespace-isolation \
       --watch-namespace ${POD_NAMESPACE} \
       --election-id=${RELEASE_NAME} \
       --ingress-class=${INGRESS_CLASS} \

mariadb/templates/deployment-ingress.yaml

@@ -21,6 +21,82 @@ limitations under the License.
 {{ tuple $envAll "ingress" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ $serviceAccountName }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - endpoints
+      - nodes
+      - pods
+      - secrets
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+  - apiGroups:
+      - "extensions"
+      - "networking.k8s.io"
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "extensions"
+      - "networking.k8s.io"
+    resources:
+      - ingresses/status
+    verbs:
+      - update
+  - apiGroups:
+      - "networking.k8s.io"
+    resources:
+      - ingressclasses
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $serviceAccountName }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ $serviceAccountName }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ $serviceAccountName }}
+    namespace: {{ $envAll.Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ $serviceAccountName }}
@@ -123,6 +199,13 @@ metadata:
     {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
   labels:
 {{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
+    app.kubernetes.io/instance: {{ $serviceAccountName }}
+    app.kubernetes.io/name: "mariadb"
+    app.kubernetes.io/component: "ingress"
+    app.kubernetes.io/managed-by: {{ $envAll.Release.Service }}
+{{- if $envAll.Chart.AppVersion }}
+    app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }}
+{{- end }}
 spec:
   replicas: {{ .Values.pod.replicas.ingress }}
   selector:
@@ -133,6 +216,13 @@ spec:
     metadata:
       labels:
 {{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
+        app.kubernetes.io/instance: {{ $serviceAccountName }}
+        app.kubernetes.io/name: "mariadb"
+        app.kubernetes.io/component: "ingress"
+        app.kubernetes.io/managed-by: {{ $envAll.Release.Service }}
+{{- if $envAll.Chart.AppVersion }}
+        app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }}
+{{- end }}
       annotations:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}

mariadb/values.yaml

@@ -21,7 +21,7 @@ release_group: null
 images:
   tags:
     mariadb: docker.io/openstackhelm/mariadb:latest-ubuntu_xenial
-    ingress: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.9.0
+    ingress: k8s.gcr.io/ingress-nginx/controller:v0.42.0
     error_pages: k8s.gcr.io/defaultbackend:1.4
     prometheus_create_mysql_user: docker.io/mariadb:10.2.31
     prometheus_mysql_exporter: docker.io/prom/mysqld-exporter:v0.11.0

releasenotes/notes/mariadb.yaml

@@ -9,4 +9,5 @@ mariadb:
   - 0.1.6 Change Issuer to ClusterIssuer
   - 0.1.7 Revert - Change Issuer to ClusterIssuer
   - 0.1.8 Change Issuer to ClusterIssuer with logic in place to support cert-manager versioning
+  - 0.1.9 Uplift Mariadb-ingress to 0.42.0
 ...