From ce3782d786fb3001a1be92af20bb30bf92ca0c16 Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Fri, 22 Aug 2025 16:20:39 -0700 Subject: [PATCH 01/17] chore: Bump version to 1.3.4-rc3 and enhance airgapped support - Updated Chart.yaml to version 1.3.4-rc3. - Added configuration options for CA bundle in values.yaml. - Modified app-env.yaml to conditionally set AWS_CA_BUNDLE based on airgapped settings. - Updated api.deployment.yaml to include volume and volumeMounts for the CA bundle when airgapped is enabled. --- charts/plane-enterprise/README.md | 2 ++ .../templates/config-secrets/app-env.yaml | 4 ++++ .../templates/workloads/api.deployment.yaml | 12 ++++++++++++ charts/plane-enterprise/values.yaml | 8 ++++++++ 4 files changed, 26 insertions(+) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index a1d746d7..1bba466d 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -93,6 +93,8 @@ |---|:---:|:---:|---| | planeVersion | v1.14.0 | Yes | Specifies the version of Plane to be deployed. Copy this from prime.plane.so. | | airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. | +| airgapped.s3CrtFileLocation | "" | No | If specified, overrides the CA that is used to communicate with S3. Specifies the location in the container where the new .crt file lies | +| airgapped.s3SecretName | "" | No | Specifies the secret where to copy the overriding .crt file from for use in overriding s3's native CA | | license.licenseDomain | plane.example.com | Yes | The fully-qualified domain name (FQDN) in the format `sudomain.domain.tld` or `domain.tld` that the license is bound to. It is also attached to your `ingress` host to access Plane. | ### Postgres diff --git a/charts/plane-enterprise/templates/config-secrets/app-env.yaml b/charts/plane-enterprise/templates/config-secrets/app-env.yaml index 413c14e1..cac86d7d 100644 --- a/charts/plane-enterprise/templates/config-secrets/app-env.yaml +++ b/charts/plane-enterprise/templates/config-secrets/app-env.yaml @@ -51,6 +51,10 @@ data: MINIO_ENDPOINT_SSL: {{ .Values.services.minio.env.minio_endpoint_ssl | default false | ternary "1" "0" | quote }} INTAKE_EMAIL_DOMAIN: {{ .Values.env.email_service_envs.smtp_domain | default "" | quote }} + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} + AWS_CA_BUNDLE: {{ .Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt" | quote }} + {{- end }} + SENTRY_DSN: {{ .Values.env.sentry_dsn | default "" | quote}} SENTRY_ENVIRONMENT: {{ .Values.env.sentry_environment | default "" | quote}} DEBUG: "0" diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml index bec8cf11..10a96763 100644 --- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml +++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml @@ -39,6 +39,12 @@ spec: annotations: timestamp: {{ now | quote }} spec: + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} + volumes: + - name: s3-custom-ca + secret: + secretName: {{ .Values.airgapped.s3SecretName }} + {{- end }} containers: - name: {{ .Release.Name }}-api imagePullPolicy: {{ .Values.services.api.pullPolicy | default "Always" }} @@ -52,6 +58,12 @@ spec: limits: memory: {{ .Values.services.api.memoryLimit | default "1000Mi" | quote }} cpu: {{ .Values.services.api.cpuLimit | default "500m" | quote}} + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} + volumeMounts: + - name: s3-custom-ca + mountPath: /s3-custom-ca + readOnly: true + {{- end }} command: - ./bin/docker-entrypoint-api-ee.sh envFrom: diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index c5d72417..a7d7114d 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -12,6 +12,14 @@ license: airgapped: enabled: false + # The boto module used by API does not use the CA bundles in the container, so we need to + # mount the CA bundle into the API pod by passing it in as an environment + # variable. Should be the full path to the CA bundle file, e.g. + # "/s3-custom-ca/s3-custom-ca.crt" + s3CrtFileLocation: "" + # The file referenced by default in this secret is "s3-custom-ca.crt" + # and can be overridden by the s3CrtFileLocation value. + s3SecretName: "" ingress: enabled: true From ce372cb381441c82c89c53894de78cab8878a450 Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Thu, 28 Aug 2025 13:46:54 -0700 Subject: [PATCH 02/17] chore: coderabbit suggestions --- .../templates/workloads/api.deployment.yaml | 3 +++ charts/plane-enterprise/values.yaml | 6 +++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml index 10a96763..0b57c4fb 100644 --- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml +++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml @@ -44,6 +44,9 @@ spec: - name: s3-custom-ca secret: secretName: {{ .Values.airgapped.s3SecretName }} + items: + - key: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }} + path: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }} {{- end }} containers: - name: {{ .Release.Name }}-api diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index a7d7114d..5d7a4100 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -16,9 +16,9 @@ airgapped: # mount the CA bundle into the API pod by passing it in as an environment # variable. Should be the full path to the CA bundle file, e.g. # "/s3-custom-ca/s3-custom-ca.crt" - s3CrtFileLocation: "" - # The file referenced by default in this secret is "s3-custom-ca.crt" - # and can be overridden by the s3CrtFileLocation value. + s3CrtFileLocation: "/s3-custom-ca/s3-custom-ca.crt" + # The Secret must contain a data key whose name matches the filename in s3CrtFileLocation + # (default: "s3-custom-ca.crt"). s3SecretName: "" ingress: From 8a7679e603937ce966d96eafb68f51f296e58192 Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Thu, 28 Aug 2025 13:48:56 -0700 Subject: [PATCH 03/17] chore: README updates --- charts/plane-enterprise/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index 1bba466d..8f26c5bb 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -93,8 +93,8 @@ |---|:---:|:---:|---| | planeVersion | v1.14.0 | Yes | Specifies the version of Plane to be deployed. Copy this from prime.plane.so. | | airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. | -| airgapped.s3CrtFileLocation | "" | No | If specified, overrides the CA that is used to communicate with S3. Specifies the location in the container where the new .crt file lies | -| airgapped.s3SecretName | "" | No | Specifies the secret where to copy the overriding .crt file from for use in overriding s3's native CA | +| airgapped.s3CrtFileLocation | "/s3-custom-ca/s3-custom-ca.crt" | No | If specified, overrides the CA that is used to communicate with S3. Specifies the location in the container where the new .crt file lies | +| airgapped.s3SecretName | "" | No | Specifies the secret where to copy the overriding .crt file from for use in overriding s3's native CA for the s3 client. | | license.licenseDomain | plane.example.com | Yes | The fully-qualified domain name (FQDN) in the format `sudomain.domain.tld` or `domain.tld` that the license is bound to. It is also attached to your `ingress` host to access Plane. | ### Postgres From fed4085da2be6bf7b24055aa0c4ad8a93101c41c Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Thu, 28 Aug 2025 13:59:45 -0700 Subject: [PATCH 04/17] chore: more doc --- charts/plane-enterprise/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index 8f26c5bb..005ecd5e 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -93,8 +93,8 @@ |---|:---:|:---:|---| | planeVersion | v1.14.0 | Yes | Specifies the version of Plane to be deployed. Copy this from prime.plane.so. | | airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. | -| airgapped.s3CrtFileLocation | "/s3-custom-ca/s3-custom-ca.crt" | No | If specified, overrides the CA that is used to communicate with S3. Specifies the location in the container where the new .crt file lies | -| airgapped.s3SecretName | "" | No | Specifies the secret where to copy the overriding .crt file from for use in overriding s3's native CA for the s3 client. | +| airgapped.s3CrtFileLocation | "/s3-custom-ca/s3-custom-ca.crt" | No | Path inside the container to the CA certificate file used for S3 (Boto). Effective when `airgapped.enabled=true` and `airgapped.s3SecretName` is set. | +| airgapped.s3SecretName | "" | No | Name of the Secret that contains the CA certificate (.crt). The Secret must include a data key whose filename matches the basename of `airgapped.s3CrtFileLocation` (default: `s3-custom-ca.crt`). Used to override S3’s CA when `airgapped.enabled=true`. | | license.licenseDomain | plane.example.com | Yes | The fully-qualified domain name (FQDN) in the format `sudomain.domain.tld` or `domain.tld` that the license is bound to. It is also attached to your `ingress` host to access Plane. | ### Postgres From d36af6f2ef95b53080c5014c26740a23419a9564 Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Thu, 28 Aug 2025 15:10:48 -0700 Subject: [PATCH 05/17] feat: use new API variables --- charts/plane-enterprise/templates/config-secrets/app-env.yaml | 1 + charts/plane-enterprise/values.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/charts/plane-enterprise/templates/config-secrets/app-env.yaml b/charts/plane-enterprise/templates/config-secrets/app-env.yaml index cac86d7d..ee07a454 100644 --- a/charts/plane-enterprise/templates/config-secrets/app-env.yaml +++ b/charts/plane-enterprise/templates/config-secrets/app-env.yaml @@ -49,6 +49,7 @@ data: API_KEY_RATE_LIMIT: {{ .Values.env.api_key_rate_limit | default "60/minute" | quote }} MINIO_ENDPOINT_SSL: {{ .Values.services.minio.env.minio_endpoint_ssl | default false | ternary "1" "0" | quote }} + USE_STORAGE_PROXY: {{ .Values.services.minio.use_storage_proxy | default false | ternary "1" "0" | quote }} INTAKE_EMAIL_DOMAIN: {{ .Values.env.email_service_envs.smtp_domain | default "" | quote }} {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index 5d7a4100..f0ddfb60 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -76,6 +76,7 @@ services: root_user: admin root_password: password assign_cluster_ip: false + use_storage_proxy: false env: minio_endpoint_ssl: false From 52d61392bf159417f639cabba10f4095f2d1ce82 Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Fri, 29 Aug 2025 11:07:52 -0700 Subject: [PATCH 06/17] feat: basing on top of dev --- charts/plane-enterprise/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/plane-enterprise/Chart.yaml b/charts/plane-enterprise/Chart.yaml index af12904f..dc7664d2 100644 --- a/charts/plane-enterprise/Chart.yaml +++ b/charts/plane-enterprise/Chart.yaml @@ -6,7 +6,7 @@ description: Meet Plane. An Enterprise software development tool to manage issue type: application version: 1.4.0 -appVersion: "1.14.0" +appVersion: "v1.14.0-rc6" home: https://plane.so/ icon: https://plane.so/favicon/favicon-32x32.png From b7164c0a728a5abd652e355540be65a2b26271dc Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Wed, 3 Sep 2025 22:02:42 -0700 Subject: [PATCH 07/17] feat: enhance airgapped support in API deployment - Added init container to install custom CA certificates when airgapped is enabled. - Updated volume and volumeMounts to include shared directory for CA certificates. - Set environment variables for SSL certificate paths in the API container. --- .../templates/workloads/api.deployment.yaml | 66 +++++++++++++++++-- 1 file changed, 62 insertions(+), 4 deletions(-) diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml index 0b57c4fb..128aded5 100644 --- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml +++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml @@ -39,8 +39,8 @@ spec: annotations: timestamp: {{ now | quote }} spec: - {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} volumes: + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} - name: s3-custom-ca secret: secretName: {{ .Values.airgapped.s3SecretName }} @@ -48,6 +48,55 @@ spec: - key: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }} path: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }} {{- end }} + - name: ca-certificates + emptyDir: {} + initContainers: + - name: install-ca-certs + image: ubuntu:22.04 + command: + - /bin/bash + - -c + - | + set -e + echo "Installing custom CA certificates..." + + # Install ca-certificates package and create directories + apt-get update && apt-get install -y ca-certificates + mkdir -p /shared-certs + + # Copy existing system CA certificates to shared directory + if [ -d /etc/ssl/certs ]; then + cp -r /etc/ssl/certs/* /shared-certs/ 2>/dev/null || true + fi + + # Ensure ca-certificates directory exists + mkdir -p /usr/local/share/ca-certificates + + # Install custom S3 CA if available + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} + S3_CERT_FILE="{{ (.Values.airgapped.s3CrtFileLocation | default "s3-custom-ca.crt") | base }}" + if [ -f "/s3-custom-ca/$S3_CERT_FILE" ]; then + echo "Installing S3 custom CA certificate..." + cp "/s3-custom-ca/$S3_CERT_FILE" /usr/local/share/ca-certificates/s3-custom-ca.crt + cp "/s3-custom-ca/$S3_CERT_FILE" /shared-certs/s3-custom-ca.crt + fi + {{- end }} + + # Update CA certificates + update-ca-certificates + + # Copy updated system certificates to shared volume + cp -r /etc/ssl/certs/* /shared-certs/ 2>/dev/null || true + + echo "CA certificates installed successfully" + volumeMounts: + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} + - name: s3-custom-ca + mountPath: /s3-custom-ca + readOnly: true + {{- end }} + - name: ca-certificates + mountPath: /shared-certs containers: - name: {{ .Release.Name }}-api imagePullPolicy: {{ .Values.services.api.pullPolicy | default "Always" }} @@ -61,11 +110,20 @@ spec: limits: memory: {{ .Values.services.api.memoryLimit | default "1000Mi" | quote }} cpu: {{ .Values.services.api.cpuLimit | default "500m" | quote}} - {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} volumeMounts: - - name: s3-custom-ca - mountPath: /s3-custom-ca + - name: ca-certificates + mountPath: /etc/ssl/certs readOnly: true + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} + env: + - name: SSL_CERT_FILE + value: "/etc/ssl/certs/ca-certificates.crt" + - name: SSL_CERT_DIR + value: "/etc/ssl/certs" + - name: REQUESTS_CA_BUNDLE + value: "/etc/ssl/certs/ca-certificates.crt" + - name: CURL_CA_BUNDLE + value: "/etc/ssl/certs/ca-certificates.crt" {{- end }} command: - ./bin/docker-entrypoint-api-ee.sh From 64d4c78a018b8d61ef9504a069e9c9b01ac62016 Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Thu, 4 Sep 2025 16:43:24 -0700 Subject: [PATCH 08/17] feat: doc updates, changing from initContainer which wont work for airgapped --- charts/plane-enterprise/README.md | 4 +- .../templates/workloads/api.deployment.yaml | 82 +++++++------------ 2 files changed, 31 insertions(+), 55 deletions(-) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index 005ecd5e..fe84a8f3 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -93,8 +93,8 @@ |---|:---:|:---:|---| | planeVersion | v1.14.0 | Yes | Specifies the version of Plane to be deployed. Copy this from prime.plane.so. | | airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. | -| airgapped.s3CrtFileLocation | "/s3-custom-ca/s3-custom-ca.crt" | No | Path inside the container to the CA certificate file used for S3 (Boto). Effective when `airgapped.enabled=true` and `airgapped.s3SecretName` is set. | -| airgapped.s3SecretName | "" | No | Name of the Secret that contains the CA certificate (.crt). The Secret must include a data key whose filename matches the basename of `airgapped.s3CrtFileLocation` (default: `s3-custom-ca.crt`). Used to override S3’s CA when `airgapped.enabled=true`. | +| airgapped.s3CrtFileLocation | "/s3-custom-ca/s3-custom-ca.crt" | No | Path inside the container to the CA certificate file used for S3 (Boto). Effective when `airgapped.enabled=true` and `airgapped.s3SecretName` is set. This certificate is used to connect to S3 solely and will disregard other Amazon CAs. | +| airgapped.s3SecretName | "" | No | Name of the Secret that contains the CA certificate (.crt). The Secret must include a data key whose filename matches the basename of `airgapped.s3CrtFileLocation` (default: `s3-custom-ca.crt`). Used to override S3’s CA when `airgapped.enabled=true`. Applying this secret looks like: `kubectl -n plane create secret generic plane-s3-ca \ --from-file=s3-custom-ca.crt=/path/to/your/ca.crt` | | license.licenseDomain | plane.example.com | Yes | The fully-qualified domain name (FQDN) in the format `sudomain.domain.tld` or `domain.tld` that the license is bound to. It is also attached to your `ingress` host to access Plane. | ### Postgres diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml index 128aded5..14a72b2f 100644 --- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml +++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml @@ -48,55 +48,6 @@ spec: - key: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }} path: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }} {{- end }} - - name: ca-certificates - emptyDir: {} - initContainers: - - name: install-ca-certs - image: ubuntu:22.04 - command: - - /bin/bash - - -c - - | - set -e - echo "Installing custom CA certificates..." - - # Install ca-certificates package and create directories - apt-get update && apt-get install -y ca-certificates - mkdir -p /shared-certs - - # Copy existing system CA certificates to shared directory - if [ -d /etc/ssl/certs ]; then - cp -r /etc/ssl/certs/* /shared-certs/ 2>/dev/null || true - fi - - # Ensure ca-certificates directory exists - mkdir -p /usr/local/share/ca-certificates - - # Install custom S3 CA if available - {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} - S3_CERT_FILE="{{ (.Values.airgapped.s3CrtFileLocation | default "s3-custom-ca.crt") | base }}" - if [ -f "/s3-custom-ca/$S3_CERT_FILE" ]; then - echo "Installing S3 custom CA certificate..." - cp "/s3-custom-ca/$S3_CERT_FILE" /usr/local/share/ca-certificates/s3-custom-ca.crt - cp "/s3-custom-ca/$S3_CERT_FILE" /shared-certs/s3-custom-ca.crt - fi - {{- end }} - - # Update CA certificates - update-ca-certificates - - # Copy updated system certificates to shared volume - cp -r /etc/ssl/certs/* /shared-certs/ 2>/dev/null || true - - echo "CA certificates installed successfully" - volumeMounts: - {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} - - name: s3-custom-ca - mountPath: /s3-custom-ca - readOnly: true - {{- end }} - - name: ca-certificates - mountPath: /shared-certs containers: - name: {{ .Release.Name }}-api imagePullPolicy: {{ .Values.services.api.pullPolicy | default "Always" }} @@ -110,11 +61,11 @@ spec: limits: memory: {{ .Values.services.api.memoryLimit | default "1000Mi" | quote }} cpu: {{ .Values.services.api.cpuLimit | default "500m" | quote}} + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} volumeMounts: - - name: ca-certificates - mountPath: /etc/ssl/certs + - name: s3-custom-ca + mountPath: /s3-custom-ca readOnly: true - {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} env: - name: SSL_CERT_FILE value: "/etc/ssl/certs/ca-certificates.crt" @@ -126,7 +77,32 @@ spec: value: "/etc/ssl/certs/ca-certificates.crt" {{- end }} command: - - ./bin/docker-entrypoint-api-ee.sh + - /bin/bash + - -c + - | + set -e + + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} + echo "Installing custom CA certificates..." + + # Ensure ca-certificates directory exists + mkdir -p /usr/local/share/ca-certificates + + # Install custom S3 CA if available + S3_CERT_FILE="{{ (.Values.airgapped.s3CrtFileLocation | default "s3-custom-ca.crt") | base }}" + if [ -f "/s3-custom-ca/$S3_CERT_FILE" ]; then + echo "Installing S3 custom CA certificate..." + cp "/s3-custom-ca/$S3_CERT_FILE" /usr/local/share/ca-certificates/s3-custom-ca.crt + # Update CA certificates + update-ca-certificates + echo "CA certificates installed successfully" + else + echo "No custom S3 CA certificate found, skipping..." + fi + {{- end }} + + # Start the API + exec ./bin/docker-entrypoint-api-ee.sh envFrom: - configMapRef: name: {{ .Release.Name }}-app-vars From 0a884e37f16f0c6fe7695313abcfca0a1bb1088b Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Thu, 4 Sep 2025 16:55:33 -0700 Subject: [PATCH 09/17] chore: bumping version --- charts/plane-enterprise/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/plane-enterprise/Chart.yaml b/charts/plane-enterprise/Chart.yaml index dc7664d2..4cc93d87 100644 --- a/charts/plane-enterprise/Chart.yaml +++ b/charts/plane-enterprise/Chart.yaml @@ -6,7 +6,7 @@ description: Meet Plane. An Enterprise software development tool to manage issue type: application version: 1.4.0 -appVersion: "v1.14.0-rc6" +appVersion: "v1.14.1" home: https://plane.so/ icon: https://plane.so/favicon/favicon-32x32.png From a31934cb1c851acbf9a583e9d0b9679ccc0604d4 Mon Sep 17 00:00:00 2001 From: Akshat Jain Date: Mon, 8 Sep 2025 16:11:18 +0530 Subject: [PATCH 10/17] [INFRA-236] Plane-EE: Update Plane version to v1.14.1 in configuration files (#156) --- charts/plane-enterprise/Chart.yaml | 4 ++-- charts/plane-enterprise/README.md | 6 +++--- charts/plane-enterprise/questions.yml | 2 +- charts/plane-enterprise/values.yaml | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/charts/plane-enterprise/Chart.yaml b/charts/plane-enterprise/Chart.yaml index af12904f..0f3126a8 100644 --- a/charts/plane-enterprise/Chart.yaml +++ b/charts/plane-enterprise/Chart.yaml @@ -5,8 +5,8 @@ description: Meet Plane. An Enterprise software development tool to manage issue type: application -version: 1.4.0 -appVersion: "1.14.0" +version: 1.4.1 +appVersion: "1.14.1" home: https://plane.so/ icon: https://plane.so/favicon/favicon-32x32.png diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index a1d746d7..27a79bae 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -11,7 +11,7 @@ Copy the format of constants below, paste it on Terminal to start setting environment variables, set values for each variable, and hit ENTER or RETURN. ```bash - PLANE_VERSION=v1.14.0 # or the last released version + PLANE_VERSION=v1.14.1 # or the last released version DOMAIN_NAME= ``` @@ -65,7 +65,7 @@ ``` Make sure you set the minimum required values as below. - - `planeVersion: v1.14.0 ` + - `planeVersion: v1.14.1 ` - `license.licenseDomain: ` - `ingress.enabled: ` - `ingress.ingressClass: ` @@ -91,7 +91,7 @@ | Setting | Default | Required | Description | |---|:---:|:---:|---| -| planeVersion | v1.14.0 | Yes | Specifies the version of Plane to be deployed. Copy this from prime.plane.so. | +| planeVersion | v1.14.1 | Yes | Specifies the version of Plane to be deployed. Copy this from prime.plane.so. | | airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. | | license.licenseDomain | plane.example.com | Yes | The fully-qualified domain name (FQDN) in the format `sudomain.domain.tld` or `domain.tld` that the license is bound to. It is also attached to your `ingress` host to access Plane. | diff --git a/charts/plane-enterprise/questions.yml b/charts/plane-enterprise/questions.yml index a840759f..169b4b13 100644 --- a/charts/plane-enterprise/questions.yml +++ b/charts/plane-enterprise/questions.yml @@ -20,7 +20,7 @@ questions: - variable: planeVersion label: Plane Version (Docker Image Tag) type: string - default: v1.14.0 + default: v1.14.1 required: true group: "Docker Registry" subquestions: diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index c5d72417..c087a570 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -1,4 +1,4 @@ -planeVersion: v1.14.0 +planeVersion: v1.14.1 dockerRegistry: enabled: false From ee44a31bb09d2381121b5f99e332191504cdebda Mon Sep 17 00:00:00 2001 From: Manish Gupta Date: Tue, 9 Sep 2025 11:20:50 +0530 Subject: [PATCH 11/17] feat: enhance airgapped configuration and documentation - Added new air-gapped settings in README for better clarity. - Updated values.yaml to reflect changes in airgapped secret handling. - Modified app-env.yaml to use the new s3SecretKey for CA bundle configuration. - Adjusted api.deployment.yaml to ensure correct mounting of the custom CA certificate based on the new configuration. --- charts/plane-enterprise/README.md | 12 +++++++++--- .../templates/config-secrets/app-env.yaml | 11 ++++++----- .../templates/workloads/api.deployment.yaml | 10 +++++----- charts/plane-enterprise/values.yaml | 10 +++++----- 4 files changed, 25 insertions(+), 18 deletions(-) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index 5d3a9ff5..ff6e728d 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -92,11 +92,17 @@ | Setting | Default | Required | Description | |---|:---:|:---:|---| | planeVersion | v1.14.1 | Yes | Specifies the version of Plane to be deployed. Copy this from prime.plane.so. | -| airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. | -| airgapped.s3CrtFileLocation | "/s3-custom-ca/s3-custom-ca.crt" | No | Path inside the container to the CA certificate file used for S3 (Boto). Effective when `airgapped.enabled=true` and `airgapped.s3SecretName` is set. This certificate is used to connect to S3 solely and will disregard other Amazon CAs. | -| airgapped.s3SecretName | "" | No | Name of the Secret that contains the CA certificate (.crt). The Secret must include a data key whose filename matches the basename of `airgapped.s3CrtFileLocation` (default: `s3-custom-ca.crt`). Used to override S3’s CA when `airgapped.enabled=true`. Applying this secret looks like: `kubectl -n plane create secret generic plane-s3-ca \ --from-file=s3-custom-ca.crt=/path/to/your/ca.crt` | | license.licenseDomain | plane.example.com | Yes | The fully-qualified domain name (FQDN) in the format `sudomain.domain.tld` or `domain.tld` that the license is bound to. It is also attached to your `ingress` host to access Plane. | + +### Air-gapped Settings + +| Setting | Default | Required | Description | +|---|:---:|:---:|---| +| airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. | +| airgapped.s3SecretName | "s3-custom-ca" | No | Name of the Secret that contains the CA certificate (.crt). The Secret must include a data key whose filename matches the basename of `airgapped.s3SecretKey` (default: `s3-custom-ca.crt`). Used to override S3’s CA when `airgapped.enabled=true`. Applying this secret looks like: `kubectl -n plane create secret generic plane-s3-ca \ --from-file=s3-custom-ca.crt=/path/to/your/ca.crt` | +| airgapped.s3SecretKey | "s3-custom-ca.crt" | No | Key name of the secret to load the Custom Root CA from `airgapped.s3SecretName` | + ### Postgres | Setting | Default | Required | Description | diff --git a/charts/plane-enterprise/templates/config-secrets/app-env.yaml b/charts/plane-enterprise/templates/config-secrets/app-env.yaml index ee07a454..f4874719 100644 --- a/charts/plane-enterprise/templates/config-secrets/app-env.yaml +++ b/charts/plane-enterprise/templates/config-secrets/app-env.yaml @@ -31,6 +31,11 @@ stringData: {{- else }} AMQP_URL: "" {{ end }} + + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName .Values.airgapped.s3SecretKey }} + AWS_CA_BUNDLE: "/s3-custom-ca/{{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }}" + {{- end }} + {{- end }} --- @@ -49,13 +54,9 @@ data: API_KEY_RATE_LIMIT: {{ .Values.env.api_key_rate_limit | default "60/minute" | quote }} MINIO_ENDPOINT_SSL: {{ .Values.services.minio.env.minio_endpoint_ssl | default false | ternary "1" "0" | quote }} - USE_STORAGE_PROXY: {{ .Values.services.minio.use_storage_proxy | default false | ternary "1" "0" | quote }} + USE_STORAGE_PROXY: {{ .Values.env.use_storage_proxy | default false | ternary "1" "0" | quote }} INTAKE_EMAIL_DOMAIN: {{ .Values.env.email_service_envs.smtp_domain | default "" | quote }} - {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} - AWS_CA_BUNDLE: {{ .Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt" | quote }} - {{- end }} - SENTRY_DSN: {{ .Values.env.sentry_dsn | default "" | quote}} SENTRY_ENVIRONMENT: {{ .Values.env.sentry_environment | default "" | quote}} DEBUG: "0" diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml index 14a72b2f..af6cbcf4 100644 --- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml +++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml @@ -40,13 +40,13 @@ spec: timestamp: {{ now | quote }} spec: volumes: - {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName .Values.airgapped.s3SecretKey }} - name: s3-custom-ca secret: secretName: {{ .Values.airgapped.s3SecretName }} items: - - key: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }} - path: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }} + - key: "/s3-custom-ca/{{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }}" + path: "/s3-custom-ca/{{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }}" {{- end }} containers: - name: {{ .Release.Name }}-api @@ -89,10 +89,10 @@ spec: mkdir -p /usr/local/share/ca-certificates # Install custom S3 CA if available - S3_CERT_FILE="{{ (.Values.airgapped.s3CrtFileLocation | default "s3-custom-ca.crt") | base }}" + S3_CERT_FILE="{{ (.Values.airgapped.s3SecretKey | default "s3-custom-ca.crt") | base }}" if [ -f "/s3-custom-ca/$S3_CERT_FILE" ]; then echo "Installing S3 custom CA certificate..." - cp "/s3-custom-ca/$S3_CERT_FILE" /usr/local/share/ca-certificates/s3-custom-ca.crt + cp "/s3-custom-ca/$S3_CERT_FILE" "/usr/local/share/ca-certificates/$S3_CERT_FILE" # Update CA certificates update-ca-certificates echo "CA certificates installed successfully" diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index 12379177..54c8a2da 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -15,11 +15,10 @@ airgapped: # The boto module used by API does not use the CA bundles in the container, so we need to # mount the CA bundle into the API pod by passing it in as an environment # variable. Should be the full path to the CA bundle file, e.g. - # "/s3-custom-ca/s3-custom-ca.crt" - s3CrtFileLocation: "/s3-custom-ca/s3-custom-ca.crt" - # The Secret must contain a data key whose name matches the filename in s3CrtFileLocation + # + s3SecretName: "s3-custom-ca" # (default: "s3-custom-ca.crt"). - s3SecretName: "" + s3SecretKey: "s3-custom-ca.crt" ingress: enabled: true @@ -76,7 +75,6 @@ services: root_user: admin root_password: password assign_cluster_ip: false - use_storage_proxy: false env: minio_endpoint_ssl: false @@ -253,6 +251,8 @@ env: aws_region: '' aws_s3_endpoint_url: '' + use_storage_proxy: false + secret_key: "60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5" api_key_rate_limit: "60/minute" From 7a9fb302c30defd0ec5398a26a2268a034aa6316 Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Tue, 9 Sep 2025 14:20:00 -0700 Subject: [PATCH 12/17] fix: empty volume configuration for airgapped deployment --- charts/plane-enterprise/templates/workloads/api.deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml index af6cbcf4..9da98c6f 100644 --- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml +++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml @@ -39,8 +39,8 @@ spec: annotations: timestamp: {{ now | quote }} spec: - volumes: {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName .Values.airgapped.s3SecretKey }} + volumes: - name: s3-custom-ca secret: secretName: {{ .Values.airgapped.s3SecretName }} From 4a72ffbb349c2438214bdad2a17288372aabbe3c Mon Sep 17 00:00:00 2001 From: Thomas Taylor Date: Tue, 9 Sep 2025 18:26:25 -0700 Subject: [PATCH 13/17] fix: streamline s3SecretKey handling in api.deployment.yaml --- .../plane-enterprise/templates/workloads/api.deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml index 9da98c6f..b679aee6 100644 --- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml +++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml @@ -45,8 +45,8 @@ spec: secret: secretName: {{ .Values.airgapped.s3SecretName }} items: - - key: "/s3-custom-ca/{{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }}" - path: "/s3-custom-ca/{{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }}" + - key: {{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }} + path: {{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }} {{- end }} containers: - name: {{ .Release.Name }}-api From 701a46e5cc8e1f5ef8db691790a03de0273b1a8b Mon Sep 17 00:00:00 2001 From: akshat5302 Date: Wed, 10 Sep 2025 11:45:58 +0530 Subject: [PATCH 14/17] feat: add airgapped configuration options and update documentation - Introduced new airgapped settings in questions.yml for enabling airgapped mode. - Updated README to reflect changes in airgapped configuration, including default values for s3SecretName and s3SecretKey. - Modified app-env.yaml and api.deployment.yaml to utilize the new s3SecretKey directly for CA bundle and secret handling. --- charts/plane-enterprise/README.md | 4 ++-- charts/plane-enterprise/questions.yml | 16 ++++++++++++++++ .../templates/config-secrets/app-env.yaml | 2 +- .../templates/workloads/api.deployment.yaml | 6 +++--- 4 files changed, 22 insertions(+), 6 deletions(-) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index ff6e728d..138fff6a 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -100,8 +100,8 @@ | Setting | Default | Required | Description | |---|:---:|:---:|---| | airgapped.enabled | false | No | Specifies the airgapped mode the Plane API runs in. | -| airgapped.s3SecretName | "s3-custom-ca" | No | Name of the Secret that contains the CA certificate (.crt). The Secret must include a data key whose filename matches the basename of `airgapped.s3SecretKey` (default: `s3-custom-ca.crt`). Used to override S3’s CA when `airgapped.enabled=true`. Applying this secret looks like: `kubectl -n plane create secret generic plane-s3-ca \ --from-file=s3-custom-ca.crt=/path/to/your/ca.crt` | -| airgapped.s3SecretKey | "s3-custom-ca.crt" | No | Key name of the secret to load the Custom Root CA from `airgapped.s3SecretName` | +| airgapped.s3SecretName | "" | No | Name of the Secret that contains the CA certificate (.crt). The Secret must include a data key whose filename matches the basename of `airgapped.s3SecretKey`. Used to override S3’s CA when `airgapped.enabled=true`. Applying this secret looks like: `kubectl -n plane create secret generic plane-s3-ca \ --from-file=s3-custom-ca.crt=/path/to/your/ca.crt` | +| airgapped.s3SecretKey | "" | No | Key name of the secret to load the Custom Root CA from `airgapped.s3SecretName` | ### Postgres diff --git a/charts/plane-enterprise/questions.yml b/charts/plane-enterprise/questions.yml index 169b4b13..fc724743 100644 --- a/charts/plane-enterprise/questions.yml +++ b/charts/plane-enterprise/questions.yml @@ -80,6 +80,22 @@ questions: type: string required: true +- variable: airgapped.enabled + label: "Airgapped Enabled" + type: boolean + default: false + group: "License Setup" + show_subquestion_if: true + subquestions: + - variable: airgapped.s3SecretName + label: "S3 Secret Name" + type: string + default: "" + - variable: airgapped.s3SecretKey + label: "S3 Secret Key" + type: string + default: "" + - variable: services.web.pullPolicy label: "Web Pull Policy" type: enum diff --git a/charts/plane-enterprise/templates/config-secrets/app-env.yaml b/charts/plane-enterprise/templates/config-secrets/app-env.yaml index f4874719..0d8d1137 100644 --- a/charts/plane-enterprise/templates/config-secrets/app-env.yaml +++ b/charts/plane-enterprise/templates/config-secrets/app-env.yaml @@ -33,7 +33,7 @@ stringData: {{ end }} {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName .Values.airgapped.s3SecretKey }} - AWS_CA_BUNDLE: "/s3-custom-ca/{{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }}" + AWS_CA_BUNDLE: "/s3-custom-ca/{{ .Values.airgapped.s3SecretKey }}" {{- end }} {{- end }} diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml index b679aee6..8000cf3f 100644 --- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml +++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml @@ -45,8 +45,8 @@ spec: secret: secretName: {{ .Values.airgapped.s3SecretName }} items: - - key: {{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }} - path: {{ .Values.airgapped.s3SecretKey | default "s3-custom-ca.crt" }} + - key: {{ .Values.airgapped.s3SecretKey }} + path: {{ .Values.airgapped.s3SecretKey }} {{- end }} containers: - name: {{ .Release.Name }}-api @@ -89,7 +89,7 @@ spec: mkdir -p /usr/local/share/ca-certificates # Install custom S3 CA if available - S3_CERT_FILE="{{ (.Values.airgapped.s3SecretKey | default "s3-custom-ca.crt") | base }}" + S3_CERT_FILE="{{ .Values.airgapped.s3SecretKey }}" if [ -f "/s3-custom-ca/$S3_CERT_FILE" ]; then echo "Installing S3 custom CA certificate..." cp "/s3-custom-ca/$S3_CERT_FILE" "/usr/local/share/ca-certificates/$S3_CERT_FILE" From 640329ba1f1459882145b7e3521c2a9841e59ac3 Mon Sep 17 00:00:00 2001 From: akshat5302 Date: Wed, 10 Sep 2025 11:53:05 +0530 Subject: [PATCH 15/17] fix: reset s3SecretName and s3SecretKey to empty in values.yaml for airgapped configuration --- charts/plane-enterprise/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index 54c8a2da..803876a0 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -16,9 +16,9 @@ airgapped: # mount the CA bundle into the API pod by passing it in as an environment # variable. Should be the full path to the CA bundle file, e.g. # - s3SecretName: "s3-custom-ca" + s3SecretName: "" # (default: "s3-custom-ca.crt"). - s3SecretKey: "s3-custom-ca.crt" + s3SecretKey: "" ingress: enabled: true From 3c8aabed7a1100ca51ef351b7ee937913f070a5f Mon Sep 17 00:00:00 2001 From: akshat5302 Date: Wed, 10 Sep 2025 11:53:55 +0530 Subject: [PATCH 16/17] fix: remove default comment for s3SecretName in values.yaml to clarify airgapped configuration --- charts/plane-enterprise/values.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index 803876a0..77305761 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -17,7 +17,6 @@ airgapped: # variable. Should be the full path to the CA bundle file, e.g. # s3SecretName: "" - # (default: "s3-custom-ca.crt"). s3SecretKey: "" ingress: From 3b2c05135b0dc7c708180e8717e7452353114037 Mon Sep 17 00:00:00 2001 From: akshat5302 Date: Wed, 10 Sep 2025 11:57:44 +0530 Subject: [PATCH 17/17] fix: update api.deployment.yaml to include s3SecretKey in airgapped configuration check --- charts/plane-enterprise/templates/workloads/api.deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/plane-enterprise/templates/workloads/api.deployment.yaml b/charts/plane-enterprise/templates/workloads/api.deployment.yaml index 8000cf3f..50cee39e 100644 --- a/charts/plane-enterprise/templates/workloads/api.deployment.yaml +++ b/charts/plane-enterprise/templates/workloads/api.deployment.yaml @@ -61,7 +61,7 @@ spec: limits: memory: {{ .Values.services.api.memoryLimit | default "1000Mi" | quote }} cpu: {{ .Values.services.api.cpuLimit | default "500m" | quote}} - {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }} + {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName .Values.airgapped.s3SecretKey }} volumeMounts: - name: s3-custom-ca mountPath: /s3-custom-ca