You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/content/en/open_source/upgrading/2.54.md
+41-1Lines changed: 41 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: 'Upgrading to DefectDojo Version 2.54.x'
3
3
toc_hide: true
4
4
weight: -20251201
5
-
description: Removal of django-auditlog and exclusive use of django-pghistory for audit logging & Dropped support for DD_PARSER_EXCLUDE
5
+
description: "Removal of django-auditlog and exclusive use of django-pghistory for audit logging & Helm chart: Postgresql from Bitnami was replaces with CloudPirates & Dropped support for DD_PARSER_EXCLUDE"
6
6
---
7
7
8
8
## Breaking Change: Removal of django-auditlog
@@ -39,6 +39,46 @@ The switch to `django-pghistory` provides several advantages:
39
39
40
40
The backfill migration is not mandatory to succeed. If it fails for some reason, the only side effect will be that the first auditlog diff will contain all fields of an object instead just the changed fields.
41
41
42
+
## Breaking Change: Helm chart - Postgresql from Bitnami was replaces with CloudPirates
- rest of `postgresql.primary...` is not used anymore
59
+
60
+
TODO - finish this
61
+
62
+
The whole subchart is based on [`cloudpirates-postgres`](https://artifacthub.io/packages/helm/cloudpirates-postgres/postgres), so all additional values can be found there.
63
+
64
+
If an external Postgres instance is being used, set the parameter `postgres.enabled` to `False`. The parameter `postgresServer` remains available and function as before.
65
+
66
+
##### How to migrate to Valkey
67
+
68
+
0. As always, perform a backup of your instance
69
+
1. If you would like to be 100% sure that you do not miss any async event (triggered deduplication, email notification, ...) it is recommended to perform the following substeps (if your system is not in production and/or you are willing to miss some notifications or postpone deduplication to a later time, feel free to skip these substeps)
70
+
0. Perform the following steps with your previous version of HELM chart (not with the upgraded one - you might lose your data)
71
+
1. Downscale all producers of async tasks:
72
+
- Set `django.replicas` to 0 (if you used HPA, adjust it based on your needs)
73
+
- Set `celery.beat.replicas` to 0 (if you used HPA, adjust it based on your needs)
74
+
- Do not change `celery.worker.replicas` (they are responsible for processing your async tasks)
75
+
2. Wait until the processing queue is empty (choose one of the following methods):
76
+
-``kubectl exec statefulset/defectdojo-redis-master -c redis -- redis-cli -a `kubectl get secret defectdojo-redis-specific -o go-template='{{index .data "redis-password" | base64decode}}'` llen celery`` -- should output 0 (if your HELM chart used a different name, adjust the command based on your environment)
77
+
-`kubectl logs deployment/defectdojo-celery-worker -c celery --all-pods=true --follow` -- should stop outputting new task logs
78
+
2. Replace values based on the _Renamed values_ part, update the chart version, and set the number of replicas back. Be aware that Valkey is using a password from the new location, and if you use `createRedisSecret`/`createValkeySecret` password will be regenerated. If you stored this password somewhere else, it will not be valid anymore.
79
+
3. Enjoy DefectDojo
80
+
81
+
42
82
## Dropped support for DD_PARSER_EXCLUDE
43
83
44
84
To simplify the management of the DefectDojo application, parser exclusions are no longer controlled via the environment variable DD_PARSER_EXCLUDE or application settings. This variable is now unsupported.
| createValkeySecret | bool | `false` | create valkey secret in defectdojo chart, outside of valkey chart |
606
604
| dbMigrationChecker.containerSecurityContext | object | `{}` | Container security context for the DB migration checker. |
@@ -740,14 +738,12 @@ A Helm chart for Kubernetes to install DefectDojo
740
738
| networkPolicy.ingress | list | `[]` | For more detailed configuration with ports and peers. It will ignore ingressExtend ``` ingress: - from: - podSelector: matchLabels: app.kubernetes.io/instance: defectdojo - podSelector: matchLabels: app.kubernetes.io/instance: defectdojo-prometheus ports: - protocol: TCP port: 8443 ``` |
741
739
| networkPolicy.ingressExtend | list | `[]` | if additional labels need to be allowed (e.g. prometheus scraper) ``` ingressExtend: - podSelector: matchLabels: app.kubernetes.io/instance: defectdojo-prometheus ``` |
742
740
| podLabels | object | `{}` | Additional labels to add to the pods: ``` podLabels: key: value ``` |
743
-
| postgresServer | string | `nil` | To use an external PostgreSQL instance (like CloudSQL), set `postgresql.enabled` to false, set items in `postgresql.auth` part for authentication, and set the address here: |
744
-
| postgresql | object | `{"architecture":"standalone","auth":{"database":"defectdojo","existingSecret":"defectdojo-postgresql-specific","password":"","secretKeys":{"adminPasswordKey":"postgresql-postgres-password","replicationPasswordKey":"postgresql-replication-password","userPasswordKey":"postgresql-password"},"username":"defectdojo"},"enabled":true,"primary":{"affinity":{},"containerSecurityContext":{"enabled":true,"runAsUser":1001},"name":"primary","nodeSelector":{},"persistence":{"enabled":true},"podSecurityContext":{"enabled":true,"fsGroup":1001},"service":{"ports":{"postgresql":5432}}},"shmVolume":{"chmod":{"enabled":false}},"volumePermissions":{"containerSecurityContext":{"runAsUser":1001},"enabled":false}}` | For more advance options check the bitnami chart documentation: https://github.com/bitnami/charts/tree/main/bitnami/postgresql |
745
-
| postgresql.enabled | bool | `true` | To use an external instance, switch enabled to `false` and set the address in `postgresServer` below |
746
-
| postgresql.primary.containerSecurityContext.enabled | bool | `true` | Default is true for K8s. Enabled needs to false for OpenShift restricted SCC and true for anyuid SCC |
747
-
| postgresql.primary.containerSecurityContext.runAsUser | int | `1001` | runAsUser specification below is not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully. |
748
-
| postgresql.primary.podSecurityContext.enabled | bool | `true` | Default is true for K8s. Enabled needs to false for OpenShift restricted SCC and true for anyuid SCC |
749
-
| postgresql.primary.podSecurityContext.fsGroup | int | `1001` | fsGroup specification below is not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully. |
750
-
| postgresql.volumePermissions.containerSecurityContext | object | `{"runAsUser":1001}` | if using restricted SCC set runAsUser: "auto" and if running under anyuid SCC - runAsUser needs to match the line above |
741
+
| postgres | object | `{"affinity":{},"auth":{"database":"defectdojo","existingSecret":"defectdojo-postgres-specific","password":"","secretKeys":{"adminPasswordKey":"postgres-password"},"username":"defectdojo"},"containerSecurityContext":{"runAsUser":1001},"enabled":true,"nodeSelector":{},"persistence":{"containerSecurityContext":{"runAsUser":1001},"enabled":false},"podSecurityContext":{"fsGroup":1001},"service":{"port":5432},"shmVolume":{"chmod":{"enabled":false}}}` | For more advance options check the bitnami chart documentation: https://artifacthub.io/packages/helm/cloudpirates-postgres/postgres |
742
+
| postgres.containerSecurityContext.runAsUser | int | `1001` | runAsUser specification below is not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully. |
743
+
| postgres.enabled | bool | `true` | To use an external instance, switch enabled to `false` and set the address in `postgresServer` below |
744
+
| postgres.persistence.containerSecurityContext | object | `{"runAsUser":1001}` | if using restricted SCC set runAsUser: "auto" and if running under anyuid SCC - runAsUser needs to match the line above |
745
+
| postgres.podSecurityContext.fsGroup | int | `1001` | fsGroup specification below is not applied if enabled=false. enabled=false is the required setting for OpenShift "restricted SCC" to work successfully. |
746
+
| postgresServer | string | `nil` | To use an external PostgreSQL instance (like CloudSQL), set `postgres.enabled` to false, set items in `postgres.auth` part for authentication, and set the address here: |
751
747
| redisParams | string | `""` | Parameters attached to the redis connection string, defaults to "ssl_cert_reqs=optional" if `redisScheme` is `rediss` |
752
748
| redisPort | int | `6379` | Define the protocol to use with the external Redis instance |
753
749
| redisScheme | string | `"redis"` | Define the protocol to use with the external Redis instance |
0 commit comments