Charts CI

```
Updated:
  jenkins/jenkins:
    - 5.2.1
  kong/kong:
    - 2.39.0
```

charts/jenkins/jenkins/CHANGELOG.md

@@ -12,6 +12,10 @@ Use the following links to reference issues, PRs, and commits prior to v2.6.0.
 The changelog until v1.5.7 was auto-generated based on git commits.
 Those entries include a reference to the git commit to be able to get more details.
 
+## 5.2.1
+
+Update `jenkins/jenkins` to version `2.452.2-jdk17`
+
 ## 5.2.0
 
 Add `agent.inheritYamlMergeStrategy` to allow configuring this setting on the default agent pod template.

charts/jenkins/jenkins/Chart.yaml

@@ -1,10 +1,10 @@
 annotations:
   artifacthub.io/category: integration-delivery
   artifacthub.io/changes: |
-    - Add `agent.inheritYamlMergeStrategy` to allow configuring this setting on the default agent pod template.
+    - Update `jenkins/jenkins` to version `2.452.2-jdk17`
   artifacthub.io/images: |
     - name: jenkins
-      image: docker.io/jenkins/jenkins:2.452.1-jdk17
+      image: docker.io/jenkins/jenkins:2.452.2-jdk17
     - name: k8s-sidecar
       image: docker.io/kiwigrid/k8s-sidecar:1.27.4
     - name: inbound-agent
@@ -22,7 +22,7 @@ annotations:
   catalog.cattle.io/kube-version: '>=1.14-0'
   catalog.cattle.io/release-name: jenkins
 apiVersion: v2
-appVersion: 2.452.1
+appVersion: 2.452.2
 description: 'Jenkins - Build great things at any scale! As the leading open source
   automation server, Jenkins provides over 1800 plugins to support building, deploying
   and automating any project. '
@@ -50,4 +50,4 @@ sources:
 - https://github.com/maorfr/kube-tasks
 - https://github.com/jenkinsci/configuration-as-code-plugin
 type: application
-version: 5.2.0
+version: 5.2.1

charts/kong/kong/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 2.39.0
+
+### Changes
+
+* Updated handling of `session_conf_secret` to accommodate Kong 3.6.
+  It can now be omitted [when using OIDC](https://docs.konghq.com/gateway/3.6.x/kong-manager/auth/oidc/migrate/).
+  [#1033](https://github.com/Kong/charts/pull/1033)
+* Setting a Service's `servicePort` to 0 now disables that port on the Service,
+  for use when the external Service and container listens should differ, such
+  as when terminating TLS at a LoadBalancer.
+  [#1021](https://github.com/Kong/charts/pull/1021)
+* Added an `ingressController.admissionWebhook.filterSecrets` option. When
+  enabled, the webhook will only validate Secrets that have one of the
+  recognized KIC labels:
+
+  * `konghq.com/credential: <"key-auth", "jwt", etc. credential types>`
+  * `konghq.com/validate: <"plugin", "custom">`
+
+  Earlier versions checked all Secrets and did not require labels, interfering
+  with non-KIC labels. Requires KIC 3.0+.
+  [#1061](https://github.com/Kong/charts/pull/1061)
+* Add RBAC policy rules for Custom Entities
+  [#1081](https://github.com/Kong/charts/pull/1081)
+* Bumped default `kong/kubernetes-ingress-controller` image tag to 3.2.
+  [#1085](https://github.com/Kong/charts/pull/1085)
+
 ## 2.38.0
 
 ### Changes

charts/kong/kong/Chart.yaml

@@ -18,4 +18,4 @@ maintainers:
 name: kong
 sources:
 - https://github.com/Kong/charts/tree/main/charts/kong
-version: 2.38.0
+version: 2.39.0

charts/kong/kong/README.md

@@ -751,6 +751,7 @@ section of `values.yaml` file:
 | watchNamespaces                            | List of namespaces to watch. Watches all namespaces if empty                                                                                             | []                                 |
 | admissionWebhook.enabled                   | Whether to enable the validating admission webhook                                                                                                       | true                               |
 | admissionWebhook.failurePolicy             | How unrecognized errors from the admission endpoint are handled (Ignore or Fail)                                                                         | Ignore                             |
+| admissionWebhook.filterSecrets             | Limit the webhook to only Secrets with the appropriate KIC validation labels.                                                                            | false                              |
 | admissionWebhook.port                      | The port the ingress controller will listen on for admission webhooks                                                                                    | 8080                               |
 | admissionWebhook.address                   | The address the ingress controller will listen on for admission webhooks, if not 0.0.0.0                                                                 |                                    |
 | admissionWebhook.annotations               | Annotations for the Validation Webhook Configuration                                                                                                     |                                    |

charts/kong/kong/ci/.chartsnap.yaml

@@ -24,3 +24,5 @@ dynamicFields:
     name: chartsnap-kong-validations
     jsonPath:
       - /webhooks/0/clientConfig/caBundle
+      - /webhooks/1/clientConfig/caBundle
+      - /webhooks/2/clientConfig/caBundle

charts/kong/kong/ci/__snapshots__/admin-api-service-clusterip-values.snap

@@ -1,6 +1,115 @@
-[admin-api-service-clusterip-values]
+apiVersion: v1
-SnapShot = """
+kind: ServiceAccount
-- object:
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+  namespace: default
+---
+apiVersion: v1
+data:
+  kong.yml: |
+    _format_version: "1.1"
+    services:
+    - name: example.com
+      url: http://example.com
+      routes:
+      - name: example
+        paths:
+        - "/example"
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-custom-dbless-config
+  namespace: default
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-admin
+  namespace: default
+spec:
+  ports:
+    - name: kong-admin-tls
+      port: 8444
+      protocol: TCP
+      targetPort: 8444
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-manager
+  namespace: default
+spec:
+  ports:
+    - name: kong-manager
+      port: 8002
+      protocol: TCP
+      targetPort: 8002
+    - name: kong-manager-tls
+      port: 8445
+      protocol: TCP
+      targetPort: 8445
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: NodePort
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    enable-metrics: "true"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-proxy
+  namespace: default
+spec:
+  ports:
+    - name: kong-proxy
+      port: 80
+      protocol: TCP
+      targetPort: 8000
+    - name: kong-proxy-tls
+      port: 443
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: LoadBalancer
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -9,8 +118,8 @@ SnapShot = """
     app.kubernetes.io/instance: chartsnap
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
+    app.kubernetes.io/version: "3.6"
-            helm.sh/chart: kong-2.38.0
+    helm.sh/chart: kong-2.39.0
   name: chartsnap-kong
   namespace: default
 spec:
@@ -26,16 +135,16 @@ SnapShot = """
         checksum/dbless.config: 626be043e4a43b0d55af934d06216254abe132b29af82450379439ecd927219a
         kuma.io/gateway: enabled
         kuma.io/service-account-token-volume: chartsnap-kong-token
-                    traffic.sidecar.istio.io/includeInboundPorts: \"\"
+        traffic.sidecar.istio.io/includeInboundPorts: ""
       labels:
         app: chartsnap-kong
         app.kubernetes.io/component: app
         app.kubernetes.io/instance: chartsnap
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.6\"
+        app.kubernetes.io/version: "3.6"
-                    helm.sh/chart: kong-2.38.0
+        helm.sh/chart: kong-2.39.0
-                    version: \"3.6\"
+        version: "3.6"
     spec:
       automountServiceAccountToken: false
       containers:
@@ -51,15 +160,15 @@ SnapShot = """
             - name: KONG_ADMIN_LISTEN
               value: 0.0.0.0:8444 http2 ssl, [::]:8444 http2 ssl
             - name: KONG_CLUSTER_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_DATABASE
-                          value: \"off\"
+              value: "off"
             - name: KONG_DECLARATIVE_CONFIG
               value: /kong_dbless/kong.yml
             - name: KONG_LUA_PACKAGE_PATH
               value: /opt/?.lua;/opt/?/init.lua;;
             - name: KONG_NGINX_WORKER_PROCESSES
-                          value: \"2\"
+              value: "2"
             - name: KONG_PORTAL_API_ACCESS_LOG
               value: /dev/stdout
             - name: KONG_PORTAL_API_ERROR_LOG
@@ -81,15 +190,15 @@ SnapShot = """
             - name: KONG_ROUTER_FLAVOR
               value: traditional
             - name: KONG_STATUS_ACCESS_LOG
-                          value: \"off\"
+              value: "off"
             - name: KONG_STATUS_ERROR_LOG
               value: /dev/stderr
             - name: KONG_STATUS_LISTEN
               value: 0.0.0.0:8100, [::]:8100
             - name: KONG_STREAM_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_NGINX_DAEMON
-                          value: \"off\"
+              value: "off"
           image: kong:3.6
           imagePullPolicy: IfNotPresent
           lifecycle:
@@ -168,15 +277,15 @@ SnapShot = """
             - name: KONG_ADMIN_LISTEN
               value: 0.0.0.0:8444 http2 ssl, [::]:8444 http2 ssl
             - name: KONG_CLUSTER_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_DATABASE
-                          value: \"off\"
+              value: "off"
             - name: KONG_DECLARATIVE_CONFIG
               value: /kong_dbless/kong.yml
             - name: KONG_LUA_PACKAGE_PATH
               value: /opt/?.lua;/opt/?/init.lua;;
             - name: KONG_NGINX_WORKER_PROCESSES
-                          value: \"2\"
+              value: "2"
             - name: KONG_PORTAL_API_ACCESS_LOG
               value: /dev/stdout
             - name: KONG_PORTAL_API_ERROR_LOG
@@ -198,13 +307,13 @@ SnapShot = """
             - name: KONG_ROUTER_FLAVOR
               value: traditional
             - name: KONG_STATUS_ACCESS_LOG
-                          value: \"off\"
+              value: "off"
             - name: KONG_STATUS_ERROR_LOG
               value: /dev/stderr
             - name: KONG_STATUS_LISTEN
               value: 0.0.0.0:8100, [::]:8100
             - name: KONG_STREAM_LISTEN
-                          value: \"off\"
+              value: "off"
           image: kong:3.6
           imagePullPolicy: IfNotPresent
           name: clear-stale-pid
@@ -256,116 +365,3 @@ SnapShot = """
         - configMap:
             name: chartsnap-kong-custom-dbless-config
           name: kong-custom-dbless-config-volume
-- object:
-    apiVersion: v1
-    data:
-        kong.yml: |
-            _format_version: \"1.1\"
-            services:
-            - name: example.com
-              url: http://example.com
-              routes:
-              - name: example
-                paths:
-                - \"/example\"
-    kind: ConfigMap
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-custom-dbless-config
-        namespace: default
-- object:
-    apiVersion: v1
-    kind: Service
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-admin
-        namespace: default
-    spec:
-        ports:
-            - name: kong-admin-tls
-              port: 8444
-              protocol: TCP
-              targetPort: 8444
-        selector:
-            app.kubernetes.io/component: app
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/name: kong
-        type: ClusterIP
-- object:
-    apiVersion: v1
-    kind: Service
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-manager
-        namespace: default
-    spec:
-        ports:
-            - name: kong-manager
-              port: 8002
-              protocol: TCP
-              targetPort: 8002
-            - name: kong-manager-tls
-              port: 8445
-              protocol: TCP
-              targetPort: 8445
-        selector:
-            app.kubernetes.io/component: app
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/name: kong
-        type: NodePort
-- object:
-    apiVersion: v1
-    kind: Service
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-proxy
-        namespace: default
-    spec:
-        ports:
-            - name: kong-proxy
-              port: 80
-              protocol: TCP
-              targetPort: 8000
-            - name: kong-proxy-tls
-              port: 443
-              protocol: TCP
-              targetPort: 8443
-        selector:
-            app.kubernetes.io/component: app
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/name: kong
-        type: LoadBalancer
-- object:
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong
-        namespace: default
-"""

charts/kong/kong/ci/__snapshots__/custom-entities-rbac-3.2-values.snap

@@ -0,0 +1,975 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+  namespace: default
+---
+apiVersion: v1
+data:
+  tls.crt: '###DYNAMIC_FIELD###'
+  tls.key: '###DYNAMIC_FIELD###'
+kind: Secret
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-validation-webhook-ca-keypair
+  namespace: default
+type: kubernetes.io/tls
+---
+apiVersion: v1
+data:
+  tls.crt: '###DYNAMIC_FIELD###'
+  tls.key: '###DYNAMIC_FIELD###'
+kind: Secret
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-validation-webhook-keypair
+  namespace: default
+type: kubernetes.io/tls
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+rules:
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongcustomentities
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongcustomentities/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongupstreampolicies
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongupstreampolicies/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongconsumergroups
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongconsumergroups/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - services/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - ingressclassparameterses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongconsumers
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongconsumers/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongingresses/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongplugins
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongplugins/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - tcpingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - tcpingresses/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - udpingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - udpingresses/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingresses/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - discovery.k8s.io
+    resources:
+      - endpointslices
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - konglicenses
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - konglicenses/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongvaults
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongvaults/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongclusterplugins
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - configuration.konghq.com
+    resources:
+      - kongclusterplugins/status
+    verbs:
+      - get
+      - patch
+      - update
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - networking.k8s.io
+    resources:
+      - ingressclasses
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: chartsnap-kong
+subjects:
+  - kind: ServiceAccount
+    name: chartsnap-kong
+    namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+  namespace: default
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+      - pods
+      - secrets
+      - namespaces
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resourceNames:
+      - kong-ingress-controller-leader-kong-kong
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - update
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - create
+  - apiGroups:
+      - ""
+      - coordination.k8s.io
+    resources:
+      - configmaps
+      - leases
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - events
+    verbs:
+      - create
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: chartsnap-kong
+subjects:
+  - kind: ServiceAccount
+    name: chartsnap-kong
+    namespace: default
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-validation-webhook
+  namespace: default
+spec:
+  ports:
+    - name: webhook
+      port: 443
+      protocol: TCP
+      targetPort: webhook
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-manager
+  namespace: default
+spec:
+  ports:
+    - name: kong-manager
+      port: 8002
+      protocol: TCP
+      targetPort: 8002
+    - name: kong-manager-tls
+      port: 8445
+      protocol: TCP
+      targetPort: 8445
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: NodePort
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    enable-metrics: "true"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-proxy
+  namespace: default
+spec:
+  ports:
+    - name: kong-proxy
+      port: 80
+      protocol: TCP
+      targetPort: 8000
+    - name: kong-proxy-tls
+      port: 443
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: LoadBalancer
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: app
+      app.kubernetes.io/instance: chartsnap
+      app.kubernetes.io/name: kong
+  template:
+    metadata:
+      annotations:
+        kuma.io/gateway: enabled
+        kuma.io/service-account-token-volume: chartsnap-kong-token
+        traffic.sidecar.istio.io/includeInboundPorts: ""
+      labels:
+        app: chartsnap-kong
+        app.kubernetes.io/component: app
+        app.kubernetes.io/instance: chartsnap
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: kong
+        app.kubernetes.io/version: "3.6"
+        helm.sh/chart: kong-2.39.0
+        version: "3.6"
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - args: null
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+            - name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN
+              value: 0.0.0.0:8080
+            - name: CONTROLLER_ANONYMOUS_REPORTS
+              value: "false"
+            - name: CONTROLLER_ELECTION_ID
+              value: kong-ingress-controller-leader-kong
+            - name: CONTROLLER_INGRESS_CLASS
+              value: kong
+            - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
+              value: "true"
+            - name: CONTROLLER_KONG_ADMIN_URL
+              value: https://localhost:8444
+            - name: CONTROLLER_PUBLISH_SERVICE
+              value: default/chartsnap-kong-proxy
+          image: kong/nightly-ingress-controller:2024-06-09
+          imagePullPolicy: IfNotPresent
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /healthz
+              port: 10254
+              scheme: HTTP
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          name: ingress-controller
+          ports:
+            - containerPort: 8080
+              name: webhook
+              protocol: TCP
+            - containerPort: 10255
+              name: cmetrics
+              protocol: TCP
+            - containerPort: 10254
+              name: cstatus
+              protocol: TCP
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /readyz
+              port: 10254
+              scheme: HTTP
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources: {}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - mountPath: /admission-webhook
+              name: webhook-cert
+              readOnly: true
+            - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+              name: chartsnap-kong-token
+              readOnly: true
+        - env:
+            - name: KONG_ADMIN_ACCESS_LOG
+              value: /dev/stdout
+            - name: KONG_ADMIN_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_ADMIN_GUI_ACCESS_LOG
+              value: /dev/stdout
+            - name: KONG_ADMIN_GUI_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_ADMIN_LISTEN
+              value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
+            - name: KONG_ANONYMOUS_REPORTS
+              value: "off"
+            - name: KONG_CLUSTER_LISTEN
+              value: "off"
+            - name: KONG_DATABASE
+              value: "off"
+            - name: KONG_KIC
+              value: "on"
+            - name: KONG_LUA_PACKAGE_PATH
+              value: /opt/?.lua;/opt/?/init.lua;;
+            - name: KONG_NGINX_WORKER_PROCESSES
+              value: "2"
+            - name: KONG_PORTAL_API_ACCESS_LOG
+              value: /dev/stdout
+            - name: KONG_PORTAL_API_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_PORT_MAPS
+              value: 80:8000, 443:8443
+            - name: KONG_PREFIX
+              value: /kong_prefix/
+            - name: KONG_PROXY_ACCESS_LOG
+              value: /dev/stdout
+            - name: KONG_PROXY_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_PROXY_LISTEN
+              value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
+            - name: KONG_PROXY_STREAM_ACCESS_LOG
+              value: /dev/stdout basic
+            - name: KONG_PROXY_STREAM_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_ROUTER_FLAVOR
+              value: traditional
+            - name: KONG_STATUS_ACCESS_LOG
+              value: "off"
+            - name: KONG_STATUS_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_STATUS_LISTEN
+              value: 0.0.0.0:8100, [::]:8100
+            - name: KONG_STREAM_LISTEN
+              value: "off"
+            - name: KONG_NGINX_DAEMON
+              value: "off"
+          image: kong:3.6
+          imagePullPolicy: IfNotPresent
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - kong
+                  - quit
+                  - --wait=15
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /status
+              port: status
+              scheme: HTTP
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          name: proxy
+          ports:
+            - containerPort: 8000
+              name: proxy
+              protocol: TCP
+            - containerPort: 8443
+              name: proxy-tls
+              protocol: TCP
+            - containerPort: 8100
+              name: status
+              protocol: TCP
+          readinessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /status
+              port: status
+              scheme: HTTP
+            initialDelaySeconds: 1
+            periodSeconds: 1
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources: {}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - mountPath: /kong_prefix/
+              name: chartsnap-kong-prefix-dir
+            - mountPath: /tmp
+              name: chartsnap-kong-tmp
+      initContainers:
+        - command:
+            - rm
+            - -vrf
+            - $KONG_PREFIX/pids
+          env:
+            - name: KONG_ADMIN_ACCESS_LOG
+              value: /dev/stdout
+            - name: KONG_ADMIN_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_ADMIN_GUI_ACCESS_LOG
+              value: /dev/stdout
+            - name: KONG_ADMIN_GUI_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_ADMIN_LISTEN
+              value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
+            - name: KONG_ANONYMOUS_REPORTS
+              value: "off"
+            - name: KONG_CLUSTER_LISTEN
+              value: "off"
+            - name: KONG_DATABASE
+              value: "off"
+            - name: KONG_KIC
+              value: "on"
+            - name: KONG_LUA_PACKAGE_PATH
+              value: /opt/?.lua;/opt/?/init.lua;;
+            - name: KONG_NGINX_WORKER_PROCESSES
+              value: "2"
+            - name: KONG_PORTAL_API_ACCESS_LOG
+              value: /dev/stdout
+            - name: KONG_PORTAL_API_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_PORT_MAPS
+              value: 80:8000, 443:8443
+            - name: KONG_PREFIX
+              value: /kong_prefix/
+            - name: KONG_PROXY_ACCESS_LOG
+              value: /dev/stdout
+            - name: KONG_PROXY_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_PROXY_LISTEN
+              value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
+            - name: KONG_PROXY_STREAM_ACCESS_LOG
+              value: /dev/stdout basic
+            - name: KONG_PROXY_STREAM_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_ROUTER_FLAVOR
+              value: traditional
+            - name: KONG_STATUS_ACCESS_LOG
+              value: "off"
+            - name: KONG_STATUS_ERROR_LOG
+              value: /dev/stderr
+            - name: KONG_STATUS_LISTEN
+              value: 0.0.0.0:8100, [::]:8100
+            - name: KONG_STREAM_LISTEN
+              value: "off"
+          image: kong:3.6
+          imagePullPolicy: IfNotPresent
+          name: clear-stale-pid
+          resources: {}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+          volumeMounts:
+            - mountPath: /kong_prefix/
+              name: chartsnap-kong-prefix-dir
+            - mountPath: /tmp
+              name: chartsnap-kong-tmp
+      securityContext: {}
+      serviceAccountName: chartsnap-kong
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - emptyDir:
+            sizeLimit: 256Mi
+          name: chartsnap-kong-prefix-dir
+        - emptyDir:
+            sizeLimit: 1Gi
+          name: chartsnap-kong-tmp
+        - name: chartsnap-kong-token
+          projected:
+            sources:
+              - serviceAccountToken:
+                  expirationSeconds: 3607
+                  path: token
+              - configMap:
+                  items:
+                    - key: ca.crt
+                      path: ca.crt
+                  name: kube-root-ca.crt
+              - downwardAPI:
+                  items:
+                    - fieldRef:
+                        apiVersion: v1
+                        fieldPath: metadata.namespace
+                      path: namespace
+        - name: webhook-cert
+          secret:
+            secretName: chartsnap-kong-validation-webhook-keypair
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-validations
+  namespace: default
+webhooks:
+  - admissionReviewVersions:
+      - v1
+    clientConfig:
+      caBundle: '###DYNAMIC_FIELD###'
+      service:
+        name: chartsnap-kong-validation-webhook
+        namespace: default
+    failurePolicy: Ignore
+    matchPolicy: Equivalent
+    name: secrets.credentials.validation.ingress-controller.konghq.com
+    objectSelector:
+      matchExpressions:
+        - key: konghq.com/credential
+          operator: Exists
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - secrets
+    sideEffects: None
+  - admissionReviewVersions:
+      - v1
+    clientConfig:
+      caBundle: '###DYNAMIC_FIELD###'
+      service:
+        name: chartsnap-kong-validation-webhook
+        namespace: default
+    failurePolicy: Ignore
+    matchPolicy: Equivalent
+    name: secrets.plugins.validation.ingress-controller.konghq.com
+    objectSelector:
+      matchExpressions:
+        - key: owner
+          operator: NotIn
+          values:
+            - helm
+    rules:
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - secrets
+    sideEffects: None
+  - admissionReviewVersions:
+      - v1beta1
+    clientConfig:
+      caBundle: '###DYNAMIC_FIELD###'
+      service:
+        name: chartsnap-kong-validation-webhook
+        namespace: default
+    failurePolicy: Ignore
+    name: validations.kong.konghq.com
+    objectSelector:
+      matchExpressions:
+        - key: owner
+          operator: NotIn
+          values:
+            - helm
+    rules:
+      - apiGroups:
+          - configuration.konghq.com
+        apiVersions:
+          - '*'
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - kongconsumers
+          - kongplugins
+          - kongclusterplugins
+          - kongingresses
+      - apiGroups:
+          - ""
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - services
+      - apiGroups:
+          - networking.k8s.io
+        apiVersions:
+          - v1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - ingresses
+      - apiGroups:
+          - gateway.networking.k8s.io
+        apiVersions:
+          - v1alpha2
+          - v1beta1
+          - v1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - gateways
+          - httproutes
+    sideEffects: None

charts/kong/kong/ci/__snapshots__/test-enterprise-version-3.4.0.0-values.snap

@@ -1,6 +1,70 @@
-['test-enterprise-version-3.4.0.0-values']
+apiVersion: v1
-SnapShot = """
+kind: ServiceAccount
-- object:
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+  namespace: default
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-manager
+  namespace: default
+spec:
+  ports:
+    - name: kong-manager
+      port: 8002
+      protocol: TCP
+      targetPort: 8002
+    - name: kong-manager-tls
+      port: 8445
+      protocol: TCP
+      targetPort: 8445
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: NodePort
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    enable-metrics: "true"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-proxy
+  namespace: default
+spec:
+  ports:
+    - name: kong-proxy
+      port: 80
+      protocol: TCP
+      targetPort: 8000
+    - name: kong-proxy-tls
+      port: 443
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: LoadBalancer
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -9,8 +73,8 @@ SnapShot = """
     app.kubernetes.io/instance: chartsnap
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
+    app.kubernetes.io/version: "3.6"
-            helm.sh/chart: kong-2.38.0
+    helm.sh/chart: kong-2.39.0
   name: chartsnap-kong
   namespace: default
 spec:
@@ -25,16 +89,16 @@ SnapShot = """
       annotations:
         kuma.io/gateway: enabled
         kuma.io/service-account-token-volume: chartsnap-kong-token
-                    traffic.sidecar.istio.io/includeInboundPorts: \"\"
+        traffic.sidecar.istio.io/includeInboundPorts: ""
       labels:
         app: chartsnap-kong
         app.kubernetes.io/component: app
         app.kubernetes.io/instance: chartsnap
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.6\"
+        app.kubernetes.io/version: "3.6"
-                    helm.sh/chart: kong-2.38.0
+        helm.sh/chart: kong-2.39.0
-                    version: \"3.6\"
+        version: "3.6"
     spec:
       automountServiceAccountToken: false
       containers:
@@ -50,13 +114,13 @@ SnapShot = """
             - name: KONG_ADMIN_LISTEN
               value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
             - name: KONG_CLUSTER_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_DATABASE
-                          value: \"off\"
+              value: "off"
             - name: KONG_LUA_PACKAGE_PATH
               value: /opt/?.lua;/opt/?/init.lua;;
             - name: KONG_NGINX_WORKER_PROCESSES
-                          value: \"2\"
+              value: "2"
             - name: KONG_PORTAL_API_ACCESS_LOG
               value: /dev/stdout
             - name: KONG_PORTAL_API_ERROR_LOG
@@ -78,15 +142,15 @@ SnapShot = """
             - name: KONG_ROUTER_FLAVOR
               value: traditional
             - name: KONG_STATUS_ACCESS_LOG
-                          value: \"off\"
+              value: "off"
             - name: KONG_STATUS_ERROR_LOG
               value: /dev/stderr
             - name: KONG_STATUS_LISTEN
               value: 0.0.0.0:8100, [::]:8100
             - name: KONG_STREAM_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_NGINX_DAEMON
-                          value: \"off\"
+              value: "off"
           image: kong/kong-gateway:3.4.0.0
           imagePullPolicy: IfNotPresent
           lifecycle:
@@ -160,13 +224,13 @@ SnapShot = """
             - name: KONG_ADMIN_LISTEN
               value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
             - name: KONG_CLUSTER_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_DATABASE
-                          value: \"off\"
+              value: "off"
             - name: KONG_LUA_PACKAGE_PATH
               value: /opt/?.lua;/opt/?/init.lua;;
             - name: KONG_NGINX_WORKER_PROCESSES
-                          value: \"2\"
+              value: "2"
             - name: KONG_PORTAL_API_ACCESS_LOG
               value: /dev/stdout
             - name: KONG_PORTAL_API_ERROR_LOG
@@ -188,13 +252,13 @@ SnapShot = """
             - name: KONG_ROUTER_FLAVOR
               value: traditional
             - name: KONG_STATUS_ACCESS_LOG
-                          value: \"off\"
+              value: "off"
             - name: KONG_STATUS_ERROR_LOG
               value: /dev/stderr
             - name: KONG_STATUS_LISTEN
               value: 0.0.0.0:8100, [::]:8100
             - name: KONG_STREAM_LISTEN
-                          value: \"off\"
+              value: "off"
           image: kong/kong-gateway:3.4.0.0
           imagePullPolicy: IfNotPresent
           name: clear-stale-pid
@@ -241,71 +305,3 @@ SnapShot = """
                         apiVersion: v1
                         fieldPath: metadata.namespace
                       path: namespace
-- object:
-    apiVersion: v1
-    kind: Service
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-manager
-        namespace: default
-    spec:
-        ports:
-            - name: kong-manager
-              port: 8002
-              protocol: TCP
-              targetPort: 8002
-            - name: kong-manager-tls
-              port: 8445
-              protocol: TCP
-              targetPort: 8445
-        selector:
-            app.kubernetes.io/component: app
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/name: kong
-        type: NodePort
-- object:
-    apiVersion: v1
-    kind: Service
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-proxy
-        namespace: default
-    spec:
-        ports:
-            - name: kong-proxy
-              port: 80
-              protocol: TCP
-              targetPort: 8000
-            - name: kong-proxy-tls
-              port: 443
-              protocol: TCP
-              targetPort: 8443
-        selector:
-            app.kubernetes.io/component: app
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/name: kong
-        type: LoadBalancer
-- object:
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong
-        namespace: default
-"""

charts/kong/kong/ci/__snapshots__/test3-values.snap

@@ -1,6 +1,92 @@
-[test3-values]
+apiVersion: v1
-SnapShot = """
+kind: ServiceAccount
-- object:
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+  namespace: default
+---
+apiVersion: v1
+data:
+  kong.yml: |
+    _format_version: "1.1"
+    services:
+      - name: example.com
+        url: http://example.com
+        routes:
+        - name: example
+          paths:
+          - "/example"
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-custom-dbless-config
+  namespace: default
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-manager
+  namespace: default
+spec:
+  ports:
+    - name: kong-manager
+      port: 8002
+      protocol: TCP
+      targetPort: 8002
+    - name: kong-manager-tls
+      port: 8445
+      protocol: TCP
+      targetPort: 8445
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: NodePort
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    enable-metrics: "true"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-proxy
+  namespace: default
+spec:
+  ports:
+    - name: kong-proxy
+      port: 80
+      protocol: TCP
+      targetPort: 8000
+    - name: kong-proxy-tls
+      port: 443
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: LoadBalancer
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -9,8 +95,8 @@ SnapShot = """
     app.kubernetes.io/instance: chartsnap
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
+    app.kubernetes.io/version: "3.6"
-            helm.sh/chart: kong-2.38.0
+    helm.sh/chart: kong-2.39.0
   name: chartsnap-kong
   namespace: default
 spec:
@@ -26,16 +112,16 @@ SnapShot = """
         checksum/dbless.config: 95c0309e6b27de23d64edae3a3602472635243f133fba88af3034ed4d5703d4a
         kuma.io/gateway: enabled
         kuma.io/service-account-token-volume: chartsnap-kong-token
-                    traffic.sidecar.istio.io/includeInboundPorts: \"\"
+        traffic.sidecar.istio.io/includeInboundPorts: ""
       labels:
         app: chartsnap-kong
         app.kubernetes.io/component: app
         app.kubernetes.io/instance: chartsnap
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.6\"
+        app.kubernetes.io/version: "3.6"
-                    helm.sh/chart: kong-2.38.0
+        helm.sh/chart: kong-2.39.0
-                    version: \"3.6\"
+        version: "3.6"
     spec:
       automountServiceAccountToken: false
       containers:
@@ -51,17 +137,17 @@ SnapShot = """
             - name: KONG_ADMIN_LISTEN
               value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
             - name: KONG_ANONYMOUS_REPORTS
-                          value: \"off\"
+              value: "off"
             - name: KONG_CLUSTER_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_DATABASE
-                          value: \"off\"
+              value: "off"
             - name: KONG_DECLARATIVE_CONFIG
               value: /kong_dbless/kong.yml
             - name: KONG_LUA_PACKAGE_PATH
               value: /opt/?.lua;/opt/?/init.lua;;
             - name: KONG_NGINX_WORKER_PROCESSES
-                          value: \"2\"
+              value: "2"
             - name: KONG_PORTAL_API_ACCESS_LOG
               value: /dev/stdout
             - name: KONG_PORTAL_API_ERROR_LOG
@@ -83,15 +169,15 @@ SnapShot = """
             - name: KONG_ROUTER_FLAVOR
               value: traditional
             - name: KONG_STATUS_ACCESS_LOG
-                          value: \"off\"
+              value: "off"
             - name: KONG_STATUS_ERROR_LOG
               value: /dev/stderr
             - name: KONG_STATUS_LISTEN
               value: 0.0.0.0:8100, [::]:8100
             - name: KONG_STREAM_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_NGINX_DAEMON
-                          value: \"off\"
+              value: "off"
           image: kong:3.6
           imagePullPolicy: IfNotPresent
           lifecycle:
@@ -169,17 +255,17 @@ SnapShot = """
             - name: KONG_ADMIN_LISTEN
               value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
             - name: KONG_ANONYMOUS_REPORTS
-                          value: \"off\"
+              value: "off"
             - name: KONG_CLUSTER_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_DATABASE
-                          value: \"off\"
+              value: "off"
             - name: KONG_DECLARATIVE_CONFIG
               value: /kong_dbless/kong.yml
             - name: KONG_LUA_PACKAGE_PATH
               value: /opt/?.lua;/opt/?/init.lua;;
             - name: KONG_NGINX_WORKER_PROCESSES
-                          value: \"2\"
+              value: "2"
             - name: KONG_PORTAL_API_ACCESS_LOG
               value: /dev/stdout
             - name: KONG_PORTAL_API_ERROR_LOG
@@ -201,13 +287,13 @@ SnapShot = """
             - name: KONG_ROUTER_FLAVOR
               value: traditional
             - name: KONG_STATUS_ACCESS_LOG
-                          value: \"off\"
+              value: "off"
             - name: KONG_STATUS_ERROR_LOG
               value: /dev/stderr
             - name: KONG_STATUS_LISTEN
               value: 0.0.0.0:8100, [::]:8100
             - name: KONG_STREAM_LISTEN
-                          value: \"off\"
+              value: "off"
           image: kong:3.6
           imagePullPolicy: IfNotPresent
           name: clear-stale-pid
@@ -232,7 +318,7 @@ SnapShot = """
         - command:
             - /bin/sh
             - -c
-                        - \"true\"
+            - "true"
           image: bash:latest
           name: bash
           resources:
@@ -277,93 +363,3 @@ SnapShot = """
           name: kong-custom-dbless-config-volume
         - emptyDir: {}
           name: tmpdir
-- object:
-    apiVersion: v1
-    data:
-        kong.yml: |
-            _format_version: \"1.1\"
-            services:
-              - name: example.com
-                url: http://example.com
-                routes:
-                - name: example
-                  paths:
-                  - \"/example\"
-    kind: ConfigMap
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-custom-dbless-config
-        namespace: default
-- object:
-    apiVersion: v1
-    kind: Service
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-manager
-        namespace: default
-    spec:
-        ports:
-            - name: kong-manager
-              port: 8002
-              protocol: TCP
-              targetPort: 8002
-            - name: kong-manager-tls
-              port: 8445
-              protocol: TCP
-              targetPort: 8445
-        selector:
-            app.kubernetes.io/component: app
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/name: kong
-        type: NodePort
-- object:
-    apiVersion: v1
-    kind: Service
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-proxy
-        namespace: default
-    spec:
-        ports:
-            - name: kong-proxy
-              port: 80
-              protocol: TCP
-              targetPort: 8000
-            - name: kong-proxy-tls
-              port: 443
-              protocol: TCP
-              targetPort: 8443
-        selector:
-            app.kubernetes.io/component: app
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/name: kong
-        type: LoadBalancer
-- object:
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong
-        namespace: default
-"""

charts/kong/kong/ci/__snapshots__/test4-values.snap

@@ -1,6 +1,100 @@
-[test4-values]
+apiVersion: v1
-SnapShot = """
+kind: ServiceAccount
-- object:
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong
+  namespace: default
+---
+apiVersion: v1
+data:
+  kong.yml: |
+    _format_version: "1.1"
+    services:
+      - name: example.com
+        url: http://example.com
+        routes:
+        - name: example
+          paths:
+          - "/example"
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-custom-dbless-config
+  namespace: default
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-manager
+  namespace: default
+spec:
+  ports:
+    - name: kong-manager
+      port: 8002
+      protocol: TCP
+      targetPort: 8002
+    - name: kong-manager-tls
+      port: 8445
+      protocol: TCP
+      targetPort: 8445
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: NodePort
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: kong
+    app.kubernetes.io/version: "3.6"
+    enable-metrics: "true"
+    helm.sh/chart: kong-2.39.0
+  name: chartsnap-kong-proxy
+  namespace: default
+spec:
+  ports:
+    - name: kong-proxy
+      port: 80
+      protocol: TCP
+      targetPort: 8000
+    - name: kong-proxy-tls
+      port: 443
+      protocol: TCP
+      targetPort: 8443
+    - name: stream-9000
+      port: 9000
+      protocol: TCP
+      targetPort: 9000
+    - name: stream-9001
+      port: 9001
+      protocol: TCP
+      targetPort: 9001
+  selector:
+    app.kubernetes.io/component: app
+    app.kubernetes.io/instance: chartsnap
+    app.kubernetes.io/name: kong
+  type: LoadBalancer
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -9,8 +103,8 @@ SnapShot = """
     app.kubernetes.io/instance: chartsnap
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
+    app.kubernetes.io/version: "3.6"
-            helm.sh/chart: kong-2.38.0
+    helm.sh/chart: kong-2.39.0
   name: chartsnap-kong
   namespace: default
 spec:
@@ -26,16 +120,16 @@ SnapShot = """
         checksum/dbless.config: 95c0309e6b27de23d64edae3a3602472635243f133fba88af3034ed4d5703d4a
         kuma.io/gateway: enabled
         kuma.io/service-account-token-volume: chartsnap-kong-token
-                    traffic.sidecar.istio.io/includeInboundPorts: \"\"
+        traffic.sidecar.istio.io/includeInboundPorts: ""
       labels:
         app: chartsnap-kong
         app.kubernetes.io/component: app
         app.kubernetes.io/instance: chartsnap
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.6\"
+        app.kubernetes.io/version: "3.6"
-                    helm.sh/chart: kong-2.38.0
+        helm.sh/chart: kong-2.39.0
-                    version: \"3.6\"
+        version: "3.6"
     spec:
       automountServiceAccountToken: false
       containers:
@@ -51,17 +145,17 @@ SnapShot = """
             - name: KONG_ADMIN_LISTEN
               value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
             - name: KONG_ANONYMOUS_REPORTS
-                          value: \"off\"
+              value: "off"
             - name: KONG_CLUSTER_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_DATABASE
-                          value: \"off\"
+              value: "off"
             - name: KONG_DECLARATIVE_CONFIG
               value: /kong_dbless/kong.yml
             - name: KONG_LUA_PACKAGE_PATH
               value: /opt/?.lua;/opt/?/init.lua;;
             - name: KONG_NGINX_WORKER_PROCESSES
-                          value: \"2\"
+              value: "2"
             - name: KONG_PORTAL_API_ACCESS_LOG
               value: /dev/stdout
             - name: KONG_PORTAL_API_ERROR_LOG
@@ -83,7 +177,7 @@ SnapShot = """
             - name: KONG_ROUTER_FLAVOR
               value: traditional
             - name: KONG_STATUS_ACCESS_LOG
-                          value: \"off\"
+              value: "off"
             - name: KONG_STATUS_ERROR_LOG
               value: /dev/stderr
             - name: KONG_STATUS_LISTEN
@@ -91,7 +185,7 @@ SnapShot = """
             - name: KONG_STREAM_LISTEN
               value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
             - name: KONG_NGINX_DAEMON
-                          value: \"off\"
+              value: "off"
           image: kong:3.6
           imagePullPolicy: IfNotPresent
           lifecycle:
@@ -173,17 +267,17 @@ SnapShot = """
             - name: KONG_ADMIN_LISTEN
               value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
             - name: KONG_ANONYMOUS_REPORTS
-                          value: \"off\"
+              value: "off"
             - name: KONG_CLUSTER_LISTEN
-                          value: \"off\"
+              value: "off"
             - name: KONG_DATABASE
-                          value: \"off\"
+              value: "off"
             - name: KONG_DECLARATIVE_CONFIG
               value: /kong_dbless/kong.yml
             - name: KONG_LUA_PACKAGE_PATH
               value: /opt/?.lua;/opt/?/init.lua;;
             - name: KONG_NGINX_WORKER_PROCESSES
-                          value: \"2\"
+              value: "2"
             - name: KONG_PORTAL_API_ACCESS_LOG
               value: /dev/stdout
             - name: KONG_PORTAL_API_ERROR_LOG
@@ -205,7 +299,7 @@ SnapShot = """
             - name: KONG_ROUTER_FLAVOR
               value: traditional
             - name: KONG_STATUS_ACCESS_LOG
-                          value: \"off\"
+              value: "off"
             - name: KONG_STATUS_ERROR_LOG
               value: /dev/stderr
             - name: KONG_STATUS_LISTEN
@@ -263,7 +357,7 @@ SnapShot = """
         - configMap:
             name: chartsnap-kong-custom-dbless-config
           name: kong-custom-dbless-config-volume
-- object:
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -271,8 +365,8 @@ SnapShot = """
     app.kubernetes.io/instance: chartsnap
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
+    app.kubernetes.io/version: "3.6"
-            helm.sh/chart: kong-2.38.0
+    helm.sh/chart: kong-2.39.0
   name: chartsnap-kong-proxy
   namespace: default
 spec:
@@ -286,101 +380,3 @@ SnapShot = """
                   number: 443
             path: /
             pathType: ImplementationSpecific
-- object:
-    apiVersion: v1
-    data:
-        kong.yml: |
-            _format_version: \"1.1\"
-            services:
-              - name: example.com
-                url: http://example.com
-                routes:
-                - name: example
-                  paths:
-                  - \"/example\"
-    kind: ConfigMap
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-custom-dbless-config
-        namespace: default
-- object:
-    apiVersion: v1
-    kind: Service
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-manager
-        namespace: default
-    spec:
-        ports:
-            - name: kong-manager
-              port: 8002
-              protocol: TCP
-              targetPort: 8002
-            - name: kong-manager-tls
-              port: 8445
-              protocol: TCP
-              targetPort: 8445
-        selector:
-            app.kubernetes.io/component: app
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/name: kong
-        type: NodePort
-- object:
-    apiVersion: v1
-    kind: Service
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            enable-metrics: \"true\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong-proxy
-        namespace: default
-    spec:
-        ports:
-            - name: kong-proxy
-              port: 80
-              protocol: TCP
-              targetPort: 8000
-            - name: kong-proxy-tls
-              port: 443
-              protocol: TCP
-              targetPort: 8443
-            - name: stream-9000
-              port: 9000
-              protocol: TCP
-              targetPort: 9000
-            - name: stream-9001
-              port: 9001
-              protocol: TCP
-              targetPort: 9001
-        selector:
-            app.kubernetes.io/component: app
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/name: kong
-        type: LoadBalancer
-- object:
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-        labels:
-            app.kubernetes.io/instance: chartsnap
-            app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.6\"
-            helm.sh/chart: kong-2.38.0
-        name: chartsnap-kong
-        namespace: default
-"""

charts/kong/kong/ci/custom-entities-rbac-3.2-values.yaml

@@ -0,0 +1,19 @@
+env:
+  anonymous_reports: "off"
+
+ingressController:
+  env:
+    anonymous_reports: "false"
+  image:
+    repository: kong/nightly-ingress-controller
+    tag: "2024-06-09"
+    # Unreleased yet so use the nightly and the effective semver
+    effectiveSemver: "3.2"
+
+readinessProbe:
+  httpGet:
+    path: "/status"
+    port: status
+    scheme: HTTP
+  initialDelaySeconds: 1
+  periodSeconds: 1

charts/kong/kong/ci/test2-values.yaml

@@ -9,6 +9,7 @@ ingressController:
   admissionWebhook:
     enabled: true
     timeoutSeconds: 5
+    filterSecrets: true
   env:
     anonymous_reports: "false"
   envFrom:

charts/kong/kong/templates/_helpers.tpl

@@ -210,6 +210,7 @@ spec:
   ports:
   {{- if .http }}
   {{- if .http.enabled }}
+  {{- if ne ( .http.servicePort | toString ) "0" }}
   - name: kong-{{ .serviceName }}
     port: {{ .http.servicePort }}
     targetPort: {{ .http.containerPort }}
@@ -222,6 +223,7 @@ spec:
     protocol: TCP
   {{- end }}
   {{- end }}
+  {{- end }}
   {{- if .tls.enabled }}
   - name: kong-{{ .serviceName }}-tls
     port: {{ .tls.servicePort }}
@@ -329,8 +331,10 @@ Parameters: takes a service (e.g. .Values.proxy) as its argument and returns KON
   {{- $portMaps := list -}}
 
   {{- if .http.enabled -}}
+  {{- if ne (.http.servicePort | toString ) "0" -}}
         {{- $portMaps = append $portMaps (printf "%d:%d" (int64 .http.servicePort) (int64 .http.containerPort)) -}}
   {{- end -}}
+  {{- end -}}
 
   {{- if .tls.enabled -}}
         {{- $portMaps = append $portMaps (printf "%d:%d" (int64 .tls.servicePort) (int64 .tls.containerPort)) -}}
@@ -1115,9 +1119,11 @@ the template that it itself is using form the above sections.
       {{- $_ := set $autoEnv "KONG_ADMIN_GUI_AUTH_CONF" $guiAuthConf -}}
     {{- end }}
 
+    {{- if .Values.enterprise.rbac.session_conf_secret }}
       {{- $guiSessionConf := include "secretkeyref" (dict "name" .Values.enterprise.rbac.session_conf_secret "key" "admin_gui_session_conf") -}}
       {{- $_ := set $autoEnv "KONG_ADMIN_GUI_SESSION_CONF" $guiSessionConf -}}
     {{- end }}
+  {{- end }}
 
   {{- if .Values.enterprise.smtp.enabled }}
     {{- $_ := set $autoEnv "KONG_SMTP_MOCK" "off" -}}
@@ -1284,6 +1290,24 @@ role sets used in the charts. Updating these requires separating out cluster
 resource roles into their separate templates.
 */}}
 {{- define "kong.kubernetesRBACRules" -}}
+{{- if (semverCompare ">= 3.2.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
+- apiGroups:
+  - configuration.konghq.com
+  resources:
+  - kongcustomentities
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - configuration.konghq.com
+  resources:
+  - kongcustomentities/status
+  verbs:
+  - get
+  - patch
+  - update
+{{- end }}
 {{- if and (semverCompare ">= 3.1.0" (include "kong.effectiveVersion" .Values.ingressController.image))
            (contains (print .Values.ingressController.env.feature_gates) "KongServiceFacade=true") }}
 - apiGroups:

charts/kong/kong/templates/admission-webhook.yaml

@@ -41,6 +41,91 @@ metadata:
   {{- end }}
   {{- end }}
 webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    {{- if not .Values.ingressController.admissionWebhook.certificate.provided }}
+    caBundle: {{ b64enc $caCert }}
+    {{- else }}
+    {{- if .Values.ingressController.admissionWebhook.certificate.caBundle }}
+    caBundle: {{ b64enc .Values.ingressController.admissionWebhook.certificate.caBundle }}
+    {{- end }}
+    {{- end }}
+    service:
+      name: {{ template "kong.service.validationWebhook" . }}
+      namespace: {{ template "kong.namespace" . }}
+  failurePolicy: {{ .Values.ingressController.admissionWebhook.failurePolicy }}
+  matchPolicy: Equivalent
+  name: secrets.credentials.validation.ingress-controller.konghq.com
+  {{- with .Values.ingressController.admissionWebhook.namespaceSelector }}
+  namespaceSelector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.ingressController.admissionWebhook.timeoutSeconds }}
+  timeoutSeconds: {{ . }}
+  {{- end }}
+  objectSelector:
+    matchExpressions:
+    - key: "konghq.com/credential"
+      operator: "Exists"
+  rules:
+  - apiGroups:
+    - ""
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - secrets
+  sideEffects: None
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    {{- if not .Values.ingressController.admissionWebhook.certificate.provided }}
+    caBundle: {{ b64enc $caCert }}
+    {{- else }}
+    {{- if .Values.ingressController.admissionWebhook.certificate.caBundle }}
+    caBundle: {{ b64enc .Values.ingressController.admissionWebhook.certificate.caBundle }}
+    {{- end }}
+    {{- end }}
+    service:
+      name: {{ template "kong.service.validationWebhook" . }}
+      namespace: {{ template "kong.namespace" . }}
+  failurePolicy: {{ .Values.ingressController.admissionWebhook.failurePolicy }}
+  matchPolicy: Equivalent
+  name: secrets.plugins.validation.ingress-controller.konghq.com
+  {{- with .Values.ingressController.admissionWebhook.namespaceSelector }}
+  namespaceSelector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.ingressController.admissionWebhook.timeoutSeconds }}
+  timeoutSeconds: {{ . }}
+  {{- end }}
+  {{- if .Values.ingressController.admissionWebhook.filterSecrets }}
+  objectSelector:
+    matchExpressions:
+    - key: "konghq.com/validate"
+      operator: "Exists"
+  {{- else }}
+  objectSelector:
+    matchExpressions:
+    - key: owner
+      operator: NotIn
+      values:
+      - helm
+  {{- end }}
+  rules:
+  - apiGroups:
+    - ""
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - secrets
+  sideEffects: None
 - name: validations.kong.konghq.com
   {{- with .Values.ingressController.admissionWebhook.namespaceSelector }}
   namespaceSelector:
@@ -75,18 +160,15 @@ webhooks:
 {{- if (semverCompare ">= 2.8.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
     - kongingresses
 {{- end }}
+{{- if (semverCompare ">= 3.0.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
   - apiGroups:
     - ''
     apiVersions:
     - 'v1'
     operations:
-{{- if (semverCompare ">= 2.12.1" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
     - CREATE
-{{- end }}
     - UPDATE
     resources:
-    - secrets
-{{- if (semverCompare ">= 3.0.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
     - services
 {{- end }}
 {{- if (semverCompare ">= 2.12.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}

charts/kong/kong/values.yaml

@@ -297,6 +297,9 @@ proxy:
   http:
     # Enable plaintext HTTP listen for the proxy
     enabled: true
+    # Set the servicePort: 0 to skip exposing in the service but still
+    # let the port open in container to allow https to http mapping for
+    # tls terminated at LB.
     servicePort: 80
     containerPort: 8000
     # Set a nodePort which is available if service type is NodePort
@@ -529,7 +532,7 @@ ingressController:
   enabled: true
   image:
     repository: kong/kubernetes-ingress-controller
-    tag: "3.1"
+    tag: "3.2"
     # Optionally set a semantic version for version-gated features. This can normally
     # be left unset. You only need to set this if your tag is not a semver string,
     # such as when you are using a "next" tag. Set this to the effective semantic
@@ -579,6 +582,7 @@ ingressController:
 
   admissionWebhook:
     enabled: true
+    filterSecrets: false
     failurePolicy: Ignore
     port: 8080
     certificate:
@@ -1028,7 +1032,9 @@ enterprise:
     # If RBAC is enabled, this Secret must contain an admin_gui_session_conf key
     # The key value must be a secret configuration, following the example at
     # https://docs.konghq.com/enterprise/latest/kong-manager/authentication/sessions
-    session_conf_secret: kong-session-config
+    # If using 3.6+ and OIDC, session configuration is instead handled in the auth configuration,
+    # and this field can be left empty.
+    session_conf_secret: ""  # CHANGEME
     # If admin_gui_auth is not set to basic-auth, provide a secret name which
     # has an admin_gui_auth_conf key containing the plugin config JSON
     admin_gui_auth_conf_secret: CHANGEME-admin-gui-auth-conf-secret

index.yaml

@@ -12894,6 +12894,63 @@ entries:
     - assets/intel/intel-device-plugins-sgx-0.26.1.tgz
     version: 0.26.1
   jenkins:
+  - annotations:
+      artifacthub.io/category: integration-delivery
+      artifacthub.io/changes: |
+        - Update `jenkins/jenkins` to version `2.452.2-jdk17`
+      artifacthub.io/images: |
+        - name: jenkins
+          image: docker.io/jenkins/jenkins:2.452.2-jdk17
+        - name: k8s-sidecar
+          image: docker.io/kiwigrid/k8s-sidecar:1.27.4
+        - name: inbound-agent
+          image: jenkins/inbound-agent:3248.v65ecb_254c298-1
+      artifacthub.io/license: Apache-2.0
+      artifacthub.io/links: |
+        - name: Chart Source
+          url: https://github.com/jenkinsci/helm-charts/tree/main/charts/jenkins
+        - name: Jenkins
+          url: https://www.jenkins.io/
+        - name: support
+          url: https://github.com/jenkinsci/helm-charts/issues
+      catalog.cattle.io/certified: partner
+      catalog.cattle.io/display-name: Jenkins
+      catalog.cattle.io/kube-version: '>=1.14-0'
+      catalog.cattle.io/release-name: jenkins
+    apiVersion: v2
+    appVersion: 2.452.2
+    created: "2024-06-13T00:55:41.447429009Z"
+    description: 'Jenkins - Build great things at any scale! As the leading open source
+      automation server, Jenkins provides over 1800 plugins to support building, deploying
+      and automating any project. '
+    digest: 07ea04b20c75e1e6eb78cdd2a33adb7175f5fb845951fc91e4a5a19f28790150
+    home: https://www.jenkins.io/
+    icon: https://get.jenkins.io/art/jenkins-logo/logo.svg
+    keywords:
+    - jenkins
+    - ci
+    - devops
+    maintainers:
+    - email: maor.friedman@redhat.com
+      name: maorfr
+    - email: mail@torstenwalter.de
+      name: torstenwalter
+    - email: garridomota@gmail.com
+      name: mogaal
+    - email: wmcdona89@gmail.com
+      name: wmcdona89
+    - email: timjacomb1@gmail.com
+      name: timja
+    name: jenkins
+    sources:
+    - https://github.com/jenkinsci/jenkins
+    - https://github.com/jenkinsci/docker-inbound-agent
+    - https://github.com/maorfr/kube-tasks
+    - https://github.com/jenkinsci/configuration-as-code-plugin
+    type: application
+    urls:
+    - assets/jenkins/jenkins-5.2.1.tgz
+    version: 5.2.1
   - annotations:
       artifacthub.io/category: integration-delivery
       artifacthub.io/changes: |
@@ -16780,6 +16837,31 @@ entries:
     - assets/clastix/kamaji-console-0.0.3.tgz
     version: 0.0.3
   kong:
+  - annotations:
+      catalog.cattle.io/certified: partner
+      catalog.cattle.io/display-name: Kong Gateway
+      catalog.cattle.io/release-name: kong
+    apiVersion: v2
+    appVersion: "3.6"
+    created: "2024-06-13T00:55:42.391314087Z"
+    dependencies:
+    - condition: postgresql.enabled
+      name: postgresql
+      repository: file://./charts/postgresql
+      version: 11.9.13
+    description: The Cloud-Native Ingress and API-management
+    digest: 2227de5b83bafbecfa969cd6e52d48a6151722c8c6ca2cb3622a6706cb89b4d4
+    home: https://konghq.com/
+    icon: https://s3.amazonaws.com/downloads.kong/universe/assets/icon-kong-inc-large.png
+    maintainers:
+    - email: team-k8s@konghq.com
+      name: team-k8s-bot
+    name: kong
+    sources:
+    - https://github.com/Kong/charts/tree/main/charts/kong
+    urls:
+    - assets/kong/kong-2.39.0.tgz
+    version: 2.39.0
   - annotations:
       catalog.cattle.io/certified: partner
       catalog.cattle.io/display-name: Kong Gateway