From ab9a95baaec1d726374e4d6f253598d828cb8f37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Marchand?=
 <frederic.marchand@kudelskisecurity.com>
Date: Thu, 4 Jan 2024 10:59:06 +0100
Subject: [PATCH 1/2] Add better control on annotations and labels
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Frédéric Marchand <frederic.marchand@kudelskisecurity.com>
---
 charts/self-host/templates/admin.yaml         |  15 ++-
 charts/self-host/templates/api.yaml           |  15 ++-
 charts/self-host/templates/attachments.yaml   |  15 ++-
 charts/self-host/templates/events.yaml        |  15 ++-
 charts/self-host/templates/helpers.tpl        |  29 +++++
 charts/self-host/templates/icons.yaml         |  15 ++-
 charts/self-host/templates/identity.yaml      |  15 ++-
 charts/self-host/templates/ingress.yaml       |   2 +
 charts/self-host/templates/mssql.yaml         |  16 +++
 charts/self-host/templates/notifications.yaml |  15 ++-
 .../self-host/templates/post-delete-hook.yaml |  17 +++
 .../post-install-db-migrator-job.yaml         |  17 +++
 .../templates/post-install-raw-manifests.yaml |   1 +
 .../pre-install-db-migrator-job.yaml          |  23 +++-
 .../self-host/templates/pre-install-job.yaml  |  17 +++
 .../templates/pre-install-raw-manifests.yaml  |   1 +
 .../templates/pre-install-secret-sql.yaml     |  17 +++
 charts/self-host/templates/scim.yaml          |  15 ++-
 charts/self-host/templates/sso.yaml           |  15 ++-
 charts/self-host/templates/web.yaml           |  15 ++-
 charts/self-host/values.yaml                  | 111 ++++++++++++++++++
 21 files changed, 388 insertions(+), 13 deletions(-)

diff --git a/charts/self-host/templates/admin.yaml b/charts/self-host/templates/admin.yaml
index 7061e27d..a7c5594a 100644
--- a/charts/self-host/templates/admin.yaml
+++ b/charts/self-host/templates/admin.yaml
@@ -10,6 +10,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.admin.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.admin.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -23,7 +28,15 @@ spec:
       labels:
         app.kubernetes.io/component: admin
         app: {{ template "bitwarden.admin" . }}
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.admin.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.admin.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.admin.podServiceAccount }}
       serviceAccount: "{{ .Values.component.admin.podServiceAccount }}"
diff --git a/charts/self-host/templates/api.yaml b/charts/self-host/templates/api.yaml
index 56e182e6..132cf20e 100644
--- a/charts/self-host/templates/api.yaml
+++ b/charts/self-host/templates/api.yaml
@@ -10,6 +10,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.api.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.api.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -23,7 +28,15 @@ spec:
       labels:
         app: {{ template "bitwarden.api" . }}
         app.kubernetes.io/component: api
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.api.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.api.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.api.podServiceAccount }}
       serviceAccount: "{{ .Values.component.api.podServiceAccount }}"
diff --git a/charts/self-host/templates/attachments.yaml b/charts/self-host/templates/attachments.yaml
index 18ddb31e..396d5010 100644
--- a/charts/self-host/templates/attachments.yaml
+++ b/charts/self-host/templates/attachments.yaml
@@ -10,6 +10,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.attachments.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.attachments.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -23,7 +28,15 @@ spec:
       labels:
         app: {{ template "bitwarden.attachments" . }}
         app.kubernetes.io/component: attachments
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.attachments.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.attachments.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.attachments.podServiceAccount }}
       serviceAccount: "{{ .Values.component.attachments.podServiceAccount }}"
diff --git a/charts/self-host/templates/events.yaml b/charts/self-host/templates/events.yaml
index e046e577..c49a9b56 100644
--- a/charts/self-host/templates/events.yaml
+++ b/charts/self-host/templates/events.yaml
@@ -10,6 +10,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.events.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.events.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -23,7 +28,15 @@ spec:
       labels:
         app: {{ template "bitwarden.events" . }}
         app.kubernetes.io/component: events
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.events.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.events.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.events.podServiceAccount }}
       serviceAccount: "{{ .Values.component.events.podServiceAccount }}"
diff --git a/charts/self-host/templates/helpers.tpl b/charts/self-host/templates/helpers.tpl
index 8e537cbb..284a0473 100644
--- a/charts/self-host/templates/helpers.tpl
+++ b/charts/self-host/templates/helpers.tpl
@@ -56,6 +56,35 @@ helm.sh/chart: {{ template "bitwarden.chart" . }}
 {{- end -}}
 {{- end -}}
 
+{{/*
+Generate common pod labels
+*/}}
+{{- define "bitwarden.podLabels" -}}
+{{ include "bitwarden.labels" . }}
+{{- if .Values.general.podLabels }}
+{{ toYaml .Values.general.podLabels }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Generate basic annotations
+*/}}
+{{- define "bitwarden.annotations" -}}
+{{- if .Values.general.annotations }}
+{{ toYaml .Values.general.annotations }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Generate common pod annotations
+*/}}
+{{- define "bitwarden.podAnnotations" -}}
+{{ include "bitwarden.annotations" . }}
+{{- if .Values.general.podAnnotations }}
+{{ toYaml .Values.general.podAnnotations }}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Generate basic labels
 */}}
diff --git a/charts/self-host/templates/icons.yaml b/charts/self-host/templates/icons.yaml
index 8224a9a7..29ec98f8 100644
--- a/charts/self-host/templates/icons.yaml
+++ b/charts/self-host/templates/icons.yaml
@@ -10,6 +10,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.icons.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.icons.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -23,7 +28,15 @@ spec:
       labels:
         app: {{ template "bitwarden.icons" . }}
         app.kubernetes.io/component: icons
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.icons.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.icons.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.icons.podServiceAccount }}
       serviceAccount: "{{ .Values.component.icons.podServiceAccount }}"
diff --git a/charts/self-host/templates/identity.yaml b/charts/self-host/templates/identity.yaml
index 5af419f8..e0e15775 100644
--- a/charts/self-host/templates/identity.yaml
+++ b/charts/self-host/templates/identity.yaml
@@ -10,6 +10,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.identity.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.identity.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -23,7 +28,15 @@ spec:
       labels:
         app: {{ template "bitwarden.identity" . }}
         app.kubernetes.io/component: identity
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.identity.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.identity.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.identity.podServiceAccount }}
       serviceAccount: "{{ .Values.component.identity.podServiceAccount }}"
diff --git a/charts/self-host/templates/ingress.yaml b/charts/self-host/templates/ingress.yaml
index dec7f97d..96b9f471 100644
--- a/charts/self-host/templates/ingress.yaml
+++ b/charts/self-host/templates/ingress.yaml
@@ -18,6 +18,8 @@ metadata:
 {{- with .Values.general.ingress.labels }}
 {{ toYaml . | indent 4 }}
 {{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
 spec:
   ingressClassName: {{.Values.general.ingress.className}}
   rules:
diff --git a/charts/self-host/templates/mssql.yaml b/charts/self-host/templates/mssql.yaml
index f027fa42..24be4055 100644
--- a/charts/self-host/templates/mssql.yaml
+++ b/charts/self-host/templates/mssql.yaml
@@ -11,6 +11,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.database.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.database.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   serviceName: {{ template "bitwarden.mssql" . }}
@@ -28,6 +33,17 @@ spec:
 {{ include "bitwarden.labels" . | indent 8 }}
 {{- with .Values.database.labels }}
 {{ toYaml . | indent 8 }}
+{{- end }}
+{{- with .Values.database.podLabels }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+      annotations:
+{{ include "bitwarden.annotations" . | indent 8 }}
+{{- with .Values.database.annotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- with .Values.database.podAnnotations }}
+{{ toYaml . | indent 8 }}
 {{- end }}
     spec:
     {{- if .Values.database.podServiceAccount }}
diff --git a/charts/self-host/templates/notifications.yaml b/charts/self-host/templates/notifications.yaml
index dbbaca13..e61ae641 100644
--- a/charts/self-host/templates/notifications.yaml
+++ b/charts/self-host/templates/notifications.yaml
@@ -10,6 +10,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.notifications.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.notifications.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -23,7 +28,15 @@ spec:
       labels:
         app: {{ template "bitwarden.notifications" . }}
         app.kubernetes.io/component: notifications
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.notifications.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.notifications.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.notifications.podServiceAccount }}
       serviceAccount: "{{ .Values.component.notifications.podServiceAccount }}"
diff --git a/charts/self-host/templates/post-delete-hook.yaml b/charts/self-host/templates/post-delete-hook.yaml
index b077872b..234b6d9b 100644
--- a/charts/self-host/templates/post-delete-hook.yaml
+++ b/charts/self-host/templates/post-delete-hook.yaml
@@ -5,16 +5,33 @@ metadata:
   name: "{{ .Release.Name }}-cleanup"
   labels:
     app.kubernetes.io/component: post-delete-hook
+{{ include "bitwarden.labels" . | indent 4 }}
+{{- with .Values.job.cleanup.labels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
   annotations:
     "helm.sh/hook": post-delete
     "helm.sh/hook-weight": "0"
     "helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.job.cleanup.annotations }}
+{{ toYaml . | indent 4 }}
+{{- end }}
 spec:
   template:
     metadata:
       name: "{{ .Release.Name }}-cleanup"
       labels:
         app.kubernetes.io/component: post-delete-hook
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.job.cleanup.podLabels }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.job.cleanup.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.serviceAccount.name }}
       serviceAccountName: "{{ .Values.serviceAccount.name }}"
diff --git a/charts/self-host/templates/post-install-db-migrator-job.yaml b/charts/self-host/templates/post-install-db-migrator-job.yaml
index 0da586ef..bd3a4a49 100644
--- a/charts/self-host/templates/post-install-db-migrator-job.yaml
+++ b/charts/self-host/templates/post-install-db-migrator-job.yaml
@@ -5,16 +5,33 @@ metadata:
   name: "{{ .Release.Name }}-migrator"
   labels:
     app.kubernetes.io/component: post-install-db-migrator-job
+{{ include "bitwarden.labels" . | indent 4 }}
+{{- with .Values.job.db.labels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
   annotations:
     "helm.sh/hook": post-install,post-upgrade
     "helm.sh/hook-weight": "0"
     "helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.job.db.annotations }}
+{{ toYaml . | indent 4 }}
+{{- end }}
 spec:
   template:
     metadata:
       name: "{{ .Release.Name }}-migrator"
       labels:
         app.kubernetes.io/component: post-install-db-migrator-job
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.job.db.podLabels }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.job.db.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
       {{- if .Values.serviceAccount.name }}
       serviceAccountName: "{{ .Values.serviceAccount.name }}"
diff --git a/charts/self-host/templates/post-install-raw-manifests.yaml b/charts/self-host/templates/post-install-raw-manifests.yaml
index bb496ba4..5fa65248 100644
--- a/charts/self-host/templates/post-install-raw-manifests.yaml
+++ b/charts/self-host/templates/post-install-raw-manifests.yaml
@@ -1,5 +1,6 @@
 {{- range .Values.rawManifests.postInstall }}
 {{- $manifest := include "bitwarden.labels" $ | fromYaml | dict "labels" | dict "metadata" | mergeOverwrite . }}
+{{- $manifest := include "bitwarden.annotations" $ | fromYaml | dict "annotations" | dict "metadata" | mergeOverwrite . }}
 {{- $manifest := include "bitwarden.rawPostInstallAnnotations" $ | fromYaml | dict "annotations" | mergeOverwrite $manifest }}
 {{- toYaml $manifest }}
 ---
diff --git a/charts/self-host/templates/pre-install-db-migrator-job.yaml b/charts/self-host/templates/pre-install-db-migrator-job.yaml
index 415fded5..867219e8 100644
--- a/charts/self-host/templates/pre-install-db-migrator-job.yaml
+++ b/charts/self-host/templates/pre-install-db-migrator-job.yaml
@@ -5,20 +5,37 @@ metadata:
   name: "{{ .Release.Name }}-db-pre-upgrade"
   labels:
     app.kubernetes.io/component: pre-install-db-migrator-job
+{{ include "bitwarden.labels" . | indent 4 }}
+{{- with .Values.job.db.labels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
   annotations:
-    {{- if .Values.database.enabled }}
+{{- if .Values.database.enabled }}
     "helm.sh/hook": pre-upgrade
-    {{- else }}
+{{- else }}
     "helm.sh/hook": pre-install,pre-upgrade
-    {{- end }}
+{{- end }}
     "helm.sh/hook-weight": "4"
     "helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.job.db.annotations }}
+{{ toYaml . | indent 4 }}
+{{- end }}
 spec:
   template:
     metadata:
       name: "{{ .Release.Name }}-db-pre-upgrade"
       labels:
         app.kubernetes.io/component: pre-install-db-migrator-job
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.job.db.podLabels }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.job.db.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
       {{- if .Values.serviceAccount.name }}
       serviceAccountName: "{{ .Values.serviceAccount.name }}"
diff --git a/charts/self-host/templates/pre-install-job.yaml b/charts/self-host/templates/pre-install-job.yaml
index 455560af..a7d1f9d0 100644
--- a/charts/self-host/templates/pre-install-job.yaml
+++ b/charts/self-host/templates/pre-install-job.yaml
@@ -12,16 +12,33 @@ metadata:
   name: "{{ .Release.Name }}-setup"
   labels:
     app.kubernetes.io/component: pre-install-hook
+{{ include "bitwarden.labels" . | indent 4 }}
+{{- with .Values.job.setup.labels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
   annotations:
     "helm.sh/hook": pre-install
     "helm.sh/hook-weight": "2"
     "helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.job.setup.annotations }}
+{{ toYaml . | indent 4 }}
+{{- end }}
 spec:
   template:
     metadata:
       name: "{{ .Release.Name }}-setup"
       labels:
         app.kubernetes.io/component: pre-install-hook
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.job.setup.podLabels }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.job.setup.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.serviceAccount.name }}
       serviceAccountName: "{{ .Values.serviceAccount.name }}"
diff --git a/charts/self-host/templates/pre-install-raw-manifests.yaml b/charts/self-host/templates/pre-install-raw-manifests.yaml
index d6fda199..5d4bb0f5 100644
--- a/charts/self-host/templates/pre-install-raw-manifests.yaml
+++ b/charts/self-host/templates/pre-install-raw-manifests.yaml
@@ -1,5 +1,6 @@
 {{- range .Values.rawManifests.preInstall }}
 {{- $manifest := include "bitwarden.labels" $ | fromYaml | dict "labels" | dict "metadata" | mergeOverwrite . }}
+{{- $manifest := include "bitwarden.annotations" $ | fromYaml | dict "annotations" | dict "metadata" | mergeOverwrite . }}
 {{- $manifest := include "bitwarden.rawPreInstallAnnotations" $ | fromYaml | dict "annotations" | mergeOverwrite $manifest }}
 {{- toYaml $manifest }}
 ---
diff --git a/charts/self-host/templates/pre-install-secret-sql.yaml b/charts/self-host/templates/pre-install-secret-sql.yaml
index 6513207f..75423d05 100644
--- a/charts/self-host/templates/pre-install-secret-sql.yaml
+++ b/charts/self-host/templates/pre-install-secret-sql.yaml
@@ -8,16 +8,33 @@ metadata:
   name: "{{ .Release.Name }}-secret-sql"
   labels:
     app.kubernetes.io/component: pre-install-hook
+{{ include "bitwarden.labels" . | indent 4 }}
+{{- with .Values.job.secret.labels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
   annotations:
     "helm.sh/hook": pre-install
     "helm.sh/hook-weight": "3"
     "helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.job.secret.annotations }}
+{{ toYaml . | indent 4 }}
+{{- end }}
 spec:
   template:
     metadata:
       name: "{{ .Release.Name }}-secret-sql"
       labels:
         app.kubernetes.io/component: pre-install-hook
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.job.secret.podLabels }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.job.secret.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.serviceAccount.name }}
       serviceAccountName: "{{ .Values.serviceAccount.name }}"
diff --git a/charts/self-host/templates/scim.yaml b/charts/self-host/templates/scim.yaml
index 6e07159f..c36590e4 100644
--- a/charts/self-host/templates/scim.yaml
+++ b/charts/self-host/templates/scim.yaml
@@ -11,6 +11,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.scim.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.scim.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -24,7 +29,15 @@ spec:
       labels:
         app: {{ template "bitwarden.scim" . }}
         app.kubernetes.io/component: scim
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.scim.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.scim.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.scim.podServiceAccount }}
       serviceAccount: "{{ .Values.component.scim.podServiceAccount }}"
diff --git a/charts/self-host/templates/sso.yaml b/charts/self-host/templates/sso.yaml
index 5e0c6749..578f662c 100644
--- a/charts/self-host/templates/sso.yaml
+++ b/charts/self-host/templates/sso.yaml
@@ -10,6 +10,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.sso.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.sso.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -23,7 +28,15 @@ spec:
       labels:
         app: {{ template "bitwarden.sso" . }}
         app.kubernetes.io/component: sso
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.sso.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.sso.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.sso.podServiceAccount }}
       serviceAccount: "{{ .Values.component.sso.podServiceAccount }}"
diff --git a/charts/self-host/templates/web.yaml b/charts/self-host/templates/web.yaml
index 5e72b17a..1872ee33 100644
--- a/charts/self-host/templates/web.yaml
+++ b/charts/self-host/templates/web.yaml
@@ -10,6 +10,11 @@ metadata:
 {{ include "bitwarden.labels" . | indent 4 }}
 {{- with .Values.component.web.labels }}
 {{ toYaml . | indent 4 }}
+{{- end }}
+  annotations:
+{{- include "bitwarden.annotations" . | indent 4 }}
+{{- with .Values.component.web.annotations }}
+{{ toYaml . | indent 4 }}
 {{- end }}
 spec:
   replicas: 1
@@ -23,7 +28,15 @@ spec:
       labels:
         app: {{ template "bitwarden.web" . }}
         app.kubernetes.io/component: web
-{{ include "bitwarden.labels" . | indent 8 }}
+{{ include "bitwarden.podLabels" . | indent 8 }}
+{{- with .Values.component.web.podLabels }}
+{{ toYaml . | indent 4 }}
+{{- end }}
+      annotations:
+{{- include "bitwarden.podAnnotations" . | indent 8 }}
+{{- with .Values.component.web.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
     spec:
     {{- if .Values.component.web.podServiceAccount }}
       serviceAccount: "{{ .Values.component.web.podServiceAccount }}"
diff --git a/charts/self-host/values.yaml b/charts/self-host/values.yaml
index b07db641..be784685 100644
--- a/charts/self-host/values.yaml
+++ b/charts/self-host/values.yaml
@@ -74,6 +74,12 @@ general:
     smtpSsl: "false"
   # Custom labels to add throughout the installation
   labels: {}
+  # Custom annotations to add throughout the installation
+  annotations: {}
+  # Additional default pod labels
+  podLabels: {}
+  # Additional default pod annotations
+  podAnnotations: {}
   # Specifies the access mode for persistent volume claims.  This should not be changed in most cases, and the allowable
   # values are only ReadWriteMany and ReadWriteOnce.  Please read https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes
   # to better understand these options before changing this value.
@@ -93,12 +99,57 @@ secrets:
   # Secrets can either be created via 'kubectl create secrets' or by using a secret provider class.  If using the latter, specify the name here
   secretProviderClass:
 
+# Settings for individual jobs
+job:
+  db:
+    # Additional job labels
+    labels: {}
+    # Additional job annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
+  setup:
+    # Additional job labels
+    labels: {}
+    # Additional job annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
+  cleanup:
+    # Additional job labels
+    labels: {}
+    # Additional job annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
+  secret:
+    # Additional job labels
+    labels: {}
+    # Additional job annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
+
 # Settings for individual service containers
 component:
   # The Admin component
   admin:
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/admin
@@ -119,6 +170,12 @@ component:
   api:
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/api
@@ -139,6 +196,12 @@ component:
   attachments:
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/attachments
@@ -159,6 +222,12 @@ component:
   events:
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/events
@@ -179,6 +248,12 @@ component:
   icons:
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/icons
@@ -199,6 +274,12 @@ component:
   identity:
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/identity
@@ -219,6 +300,12 @@ component:
   notifications:
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/notifications
@@ -241,6 +328,12 @@ component:
     enabled: false
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/scim
@@ -261,6 +354,12 @@ component:
   sso:
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/sso
@@ -281,6 +380,12 @@ component:
   web:
     # Additional deployment labels
     labels: {}
+    # Additional deployment annotations
+    annotations: {}
+    # Additional pod labels
+    podLabels: {}
+    # Additional pod annotations
+    podAnnotations: {}
     # Image name, tag, and pull policy
     image:
       name: bitwarden/web
@@ -345,6 +450,12 @@ database:
   enabled: true
   # Labels to add to the MSSQL deployment
   labels: {}
+  # Annotations to add to the MSSQL deployment
+  annotations: {}
+  # Additional labels to the MSSQL pod
+  podLabels: {}
+  # Additional annotations to the MSSQL pod
+  podAnnotations: {}
   # Image name, tag, and pull policy
   image:
     name: mcr.microsoft.com/mssql/server

From df079491c39773a0326a21eeb04bf9d1e0dfe69e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Marchand?=
 <frederic.marchand@kudelskisecurity.com>
Date: Tue, 23 Apr 2024 08:42:55 +0200
Subject: [PATCH 2/2] Fix wrong indentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Frédéric Marchand <frederic.marchand@kudelskisecurity.com>
---
 charts/self-host/templates/admin.yaml         | 2 +-
 charts/self-host/templates/api.yaml           | 2 +-
 charts/self-host/templates/attachments.yaml   | 2 +-
 charts/self-host/templates/events.yaml        | 2 +-
 charts/self-host/templates/icons.yaml         | 2 +-
 charts/self-host/templates/identity.yaml      | 2 +-
 charts/self-host/templates/notifications.yaml | 2 +-
 charts/self-host/templates/scim.yaml          | 2 +-
 charts/self-host/templates/sso.yaml           | 2 +-
 charts/self-host/templates/web.yaml           | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/charts/self-host/templates/admin.yaml b/charts/self-host/templates/admin.yaml
index 78a5879d..d40b385c 100644
--- a/charts/self-host/templates/admin.yaml
+++ b/charts/self-host/templates/admin.yaml
@@ -30,7 +30,7 @@ spec:
         app: {{ template "bitwarden.admin" . }}
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.admin.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}
diff --git a/charts/self-host/templates/api.yaml b/charts/self-host/templates/api.yaml
index cfc931a7..61587148 100644
--- a/charts/self-host/templates/api.yaml
+++ b/charts/self-host/templates/api.yaml
@@ -30,7 +30,7 @@ spec:
         app.kubernetes.io/component: api
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.api.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}
diff --git a/charts/self-host/templates/attachments.yaml b/charts/self-host/templates/attachments.yaml
index d7fa9995..4778e49b 100644
--- a/charts/self-host/templates/attachments.yaml
+++ b/charts/self-host/templates/attachments.yaml
@@ -30,7 +30,7 @@ spec:
         app.kubernetes.io/component: attachments
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.attachments.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}
diff --git a/charts/self-host/templates/events.yaml b/charts/self-host/templates/events.yaml
index 02929516..b44add6d 100644
--- a/charts/self-host/templates/events.yaml
+++ b/charts/self-host/templates/events.yaml
@@ -30,7 +30,7 @@ spec:
         app.kubernetes.io/component: events
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.events.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}
diff --git a/charts/self-host/templates/icons.yaml b/charts/self-host/templates/icons.yaml
index a0d539de..11e80b98 100644
--- a/charts/self-host/templates/icons.yaml
+++ b/charts/self-host/templates/icons.yaml
@@ -30,7 +30,7 @@ spec:
         app.kubernetes.io/component: icons
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.icons.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}
diff --git a/charts/self-host/templates/identity.yaml b/charts/self-host/templates/identity.yaml
index 7f6d0514..ecf17ee4 100644
--- a/charts/self-host/templates/identity.yaml
+++ b/charts/self-host/templates/identity.yaml
@@ -30,7 +30,7 @@ spec:
         app.kubernetes.io/component: identity
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.identity.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}
diff --git a/charts/self-host/templates/notifications.yaml b/charts/self-host/templates/notifications.yaml
index 3bd38f97..9d082a0b 100644
--- a/charts/self-host/templates/notifications.yaml
+++ b/charts/self-host/templates/notifications.yaml
@@ -30,7 +30,7 @@ spec:
         app.kubernetes.io/component: notifications
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.notifications.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}
diff --git a/charts/self-host/templates/scim.yaml b/charts/self-host/templates/scim.yaml
index 5106ac4f..41039c39 100644
--- a/charts/self-host/templates/scim.yaml
+++ b/charts/self-host/templates/scim.yaml
@@ -31,7 +31,7 @@ spec:
         app.kubernetes.io/component: scim
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.scim.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}
diff --git a/charts/self-host/templates/sso.yaml b/charts/self-host/templates/sso.yaml
index 497068ab..3f9581e1 100644
--- a/charts/self-host/templates/sso.yaml
+++ b/charts/self-host/templates/sso.yaml
@@ -30,7 +30,7 @@ spec:
         app.kubernetes.io/component: sso
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.sso.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}
diff --git a/charts/self-host/templates/web.yaml b/charts/self-host/templates/web.yaml
index c90a13fb..d7a426e6 100644
--- a/charts/self-host/templates/web.yaml
+++ b/charts/self-host/templates/web.yaml
@@ -30,7 +30,7 @@ spec:
         app.kubernetes.io/component: web
 {{ include "bitwarden.podLabels" . | indent 8 }}
 {{- with .Values.component.web.podLabels }}
-{{ toYaml . | indent 4 }}
+{{ toYaml . | indent 8 }}
 {{- end }}
       annotations:
 {{- include "bitwarden.podAnnotations" . | indent 8 }}