udpate to dapr 1.16.0 (#352)

lburgazzoli · web-flow · commit 5aab0ac541cd · 2025-09-19T12:42:12.000+01:00
Signed-off-by: Luca Burgazzoli &lt;lburgazzoli@gmail.com&gt;
diff --git a/.github/workflows/e2e-olm.yml b/.github/workflows/e2e-olm.yml
@@ -59,9 +59,10 @@ jobs:
           - "1.28.15"
           - "1.29.14"
           - "1.30.13"
-          - "1.31.9"
-          - "1.32.5"
-          - "1.33.1"
+          - "1.31.12"
+          - "1.32.8"
+          - "1.33.4"
+          - "1.34.0"
     steps:
       - name: "Checkout"
         uses: actions/checkout@v5
diff --git a/.github/workflows/e2e-operator.yml b/.github/workflows/e2e-operator.yml
@@ -39,9 +39,10 @@ jobs:
           - "1.28.15"
           - "1.29.14"
           - "1.30.13"
-          - "1.31.9"
-          - "1.32.5"
-          - "1.33.1"
+          - "1.31.12"
+          - "1.32.8"
+          - "1.33.4"
+          - "1.34.0"
     steps:
       - name: "Checkout"
         uses: actions/checkout@v5
diff --git a/Makefile b/Makefile
@@ -24,7 +24,7 @@ LOCALBIN := $(PROJECT_PATH)/bin
 
 HELM_CHART_REPO ?= https://dapr.github.io/helm-charts
 HELM_CHART ?= dapr
-HELM_CHART_VERSION ?= 1.15.10
+HELM_CHART_VERSION ?= 1.16.0
 HELM_CHART_URL ?= https://raw.githubusercontent.com/dapr/helm-charts/master/dapr-$(HELM_CHART_VERSION).tgz
 
 OPENSHIFT_VERSIONS ?= v4.12
diff --git a/helm-charts/dapr/Chart.yaml b/helm-charts/dapr/Chart.yaml
@@ -1,5 +1,28 @@
-apiVersion: v1
-appVersion: 1.15.10
+apiVersion: v2
+appVersion: 1.16.0
+dependencies:
+- name: dapr_rbac
+  repository: file://dapr_rbac
+  version: 1.16.0
+- name: dapr_operator
+  repository: file://dapr_operator
+  version: 1.16.0
+- name: dapr_placement
+  repository: file://dapr_placement
+  version: 1.16.0
+- name: dapr_sidecar_injector
+  repository: file://dapr_sidecar_injector
+  version: 1.16.0
+- name: dapr_sentry
+  repository: file://dapr_sentry
+  version: 1.16.0
+- name: dapr_scheduler
+  repository: file://dapr_scheduler
+  version: 1.16.0
+- name: dapr_config
+  repository: file://dapr_config
+  version: 1.16.0
 description: A Helm chart for Dapr on Kubernetes
+icon: https://dapr.io/images/dapr.svg
 name: dapr
-version: 1.15.10
+version: 1.16.0
diff --git a/helm-charts/dapr/README.md b/helm-charts/dapr/README.md
@@ -119,7 +119,7 @@ The Helm chart has the follow configuration options that can be supplied:
 | `global.rbac.namespaced`                      | Removes cluster wide permissions where applicable                                                                                                                                                       | `false` |
 | `global.argoRolloutServiceReconciler.enabled` | Enable the service reconciler for Dapr-enabled Argo Rollouts                                                                                                                                            | `false`                 |
 | `global.priorityClassName`                    | Adds `priorityClassName` to Dapr pods                                                                                                                                                                   | `""`                    |
-| `global.scheduler.enabled`                   | Enables the Dapr Scheduler building block. When "false", the Dapr Scheduler service is not installed, and attempting to schedule jobs in Dapr will fail. | `true` |
+| `global.scheduler.enabled`                    | Enables the Dapr Scheduler service, which enables the following building blocks: Jobs API, and for both Actors and Workflows APIs to scale. When "false", the Dapr Scheduler service is not installed, and attempting to schedule jobs in Dapr will fail. Additionally, actors and workflows will be limited in scale. | `true` |
 
 ### Dapr Operator options:
 | Parameter                                  | Description                                                                                                                                                                                   | Default     |
@@ -157,6 +157,7 @@ The Helm chart has the follow configuration options that can be supplied:
 | `dapr_placement.minActorApiLevel`                  | Sets the `min-api-level` flag, which enforces a minimum value for the Actor API level in the cluster. | `0` |
 | `dapr_placement.scaleZero` | If true, the StatefulSet is deployed with a zero scale, regardless of the values of `global.ha.enabled` or `dapr_placement.ha` | `false` |
 | `dapr_placement.runAsNonRoot`                  | Boolean value for `securityContext.runAsNonRoot`. Does not apply unless `forceInMemoryLog` is set to `true`. You may have to set this to `false` when running in Minikube | `true`                 |
+| `dapr_placement.fsGroup` | Integer value for `fsGroup`. Useful for adding the Placement process to the file system group that can write to the mounted database volume. | `65532`
 | `dapr_placement.resources`                     | Value of `resources` attribute. Can be used to set memory/cpu resources/limits. See the section "Resource configuration" above. Defaults to empty                         | `{}`                    |
 | `dapr_placement.debug.enabled`                 | Boolean value for enabling debug mode                                                                                                                                     | `{}`                    |
 | `dapr_placement.metadataEnabled`               | Boolean value for enabling placement tables metadata HTTP API                                                                                                             | `false`                 |
@@ -199,6 +200,7 @@ The Helm chart has the follow configuration options that can be supplied:
 | `dapr_scheduler.etcdBackendBatchLimit`        | Maximum operations before committing the backend transaction                                                                                                                                                                                                                                                                                         | `5000`                                       |
 | `dapr_scheduler.etcdBackendBatchInterval`     | Maximum time before committing the backend transaction                                                                                                                                                                                                                                                                                               | `50ms`                                         |
 | `dapr_scheduler.etcdDefragThresholdMB`        | Minimum number of megabytes needed to be freed for etcd to consider running defrag during bootstrap. Needs to be set to non-zero value to take effect                                                                                                                                                                                                | `100`                                      |
+| `dapr_scheduler.etcdInitialElectionTickAdvance` | Whether to fast-forward initial election ticks on boot for faster election. When it is true, then local member fast-forwards election ticks to speed up “initial” leader election trigger. This benefits the case of larger election ticks. Disabling this would slow down initial bootstrap process for cross datacenter deployments. Make your own tradeoffs by configuring this flag at the cost of slow initial bootstrap.| `false`                                      |
 | `dapr_scheduler.etcdMetrics`                  | Level of detail for exported metrics, specify ’extensive’ to include histogram metrics                                                                                                                                                                                                                                                               | `basic`                                    |
 
 
diff --git a/helm-charts/dapr/charts/dapr_config/Chart.yaml b/helm-charts/dapr/charts/dapr_config/Chart.yaml
@@ -1,5 +1,5 @@
-apiVersion: v1
+apiVersion: v2
 appVersion: "1.0"
 description: A Helm chart for Dapr configuration
 name: dapr_config
-version: 1.15.10
+version: 1.16.0
diff --git a/helm-charts/dapr/charts/dapr_operator/Chart.yaml b/helm-charts/dapr/charts/dapr_operator/Chart.yaml
@@ -1,5 +1,5 @@
-apiVersion: v1
+apiVersion: v2
 appVersion: "1.0"
 description: A Helm chart for Dapr Kubernetes Operator
 name: dapr_operator
-version: 1.15.10
+version: 1.16.0
diff --git a/helm-charts/dapr/charts/dapr_placement/Chart.yaml b/helm-charts/dapr/charts/dapr_placement/Chart.yaml
@@ -1,5 +1,5 @@
-apiVersion: v1
+apiVersion: v2
 appVersion: "1.0"
 description: A Helm chart for Dapr Kubernetes placement
 name: dapr_placement
-version: 1.15.10
+version: 1.16.0
diff --git a/helm-charts/dapr/charts/dapr_placement/templates/dapr_placement_statefulset.yaml b/helm-charts/dapr/charts/dapr_placement/templates/dapr_placement_statefulset.yaml
@@ -43,6 +43,8 @@ spec:
 {{ toYaml . | indent 8 }}
 {{- end }}
     spec:
+      securityContext:
+        fsGroup: {{ .Values.fsGroup }}
       containers:
       - name: dapr-placement-server
         livenessProbe:
@@ -131,9 +133,9 @@ spec:
   {{- if eq .Values.cluster.forceInMemoryLog false }}
         - "--raft-logstore-path"
     {{- if eq .Values.global.daprControlPlaneOs "windows" }}
-        - "{{ .Values.cluster.logStoreWinPath }}\\cluster-v2-$(PLACEMENT_ID)"
+        - "{{ .Values.cluster.logStoreWinPath }}\\cluster-v2-nonroot-$(PLACEMENT_ID)"
     {{- else }}
-        - "{{ .Values.cluster.logStorePath }}/cluster-v2-$(PLACEMENT_ID)"
+        - "{{ .Values.cluster.logStorePath }}/cluster-v2-nonroot-$(PLACEMENT_ID)"
     {{- end }}
   {{- end }}
 {{- end }}
@@ -165,12 +167,8 @@ spec:
         - "--mode=kubernetes"
 {{- if eq .Values.global.daprControlPlaneOs "linux" }}
         securityContext:
-{{- if eq .Values.cluster.forceInMemoryLog true }}
           runAsNonRoot: {{ .Values.runAsNonRoot }}
           allowPrivilegeEscalation: false
-{{- else }}
-          runAsUser: 0
-{{- end }}
   {{- if eq .Values.debug.enabled true }}
           capabilities:
             add: ["SYS_PTRACE"]
diff --git a/helm-charts/dapr/charts/dapr_placement/values.yaml b/helm-charts/dapr/charts/dapr_placement/values.yaml
@@ -57,6 +57,8 @@ debug:
   initialDelaySeconds: 30000
 
 runAsNonRoot: true
+fsGroup: 65532
+
 resources: {}
 
 extraEnvVars: {}
diff --git a/helm-charts/dapr/charts/dapr_rbac/Chart.yaml b/helm-charts/dapr/charts/dapr_rbac/Chart.yaml
@@ -1,5 +1,5 @@
-apiVersion: v1
+apiVersion: v2
 appVersion: "1.0"
 description: A Helm chart for Dapr Kubernetes RBAC components
 name: dapr_rbac
-version: 1.15.10
+version: 1.16.0
diff --git a/helm-charts/dapr/charts/dapr_rbac/templates/injector.yaml b/helm-charts/dapr/charts/dapr_rbac/templates/injector.yaml
@@ -3,6 +3,10 @@ kind: ServiceAccount
 metadata:
   name: dapr-injector
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.serviceAccount.injector.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   labels:
     {{- range $key, $value := .Values.global.k8sLabels }}
     {{ $key }}: {{ tpl $value $ }}
diff --git a/helm-charts/dapr/charts/dapr_rbac/templates/operator.yaml b/helm-charts/dapr/charts/dapr_rbac/templates/operator.yaml
@@ -3,6 +3,10 @@ kind: ServiceAccount
 metadata:
   name: dapr-operator
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.serviceAccount.operator.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   labels:
     {{- range $key, $value := .Values.global.k8sLabels }}
     {{ $key }}: {{ tpl $value $ }}
diff --git a/helm-charts/dapr/charts/dapr_rbac/templates/placement.yaml b/helm-charts/dapr/charts/dapr_rbac/templates/placement.yaml
@@ -4,6 +4,10 @@ kind: ServiceAccount
 metadata:
   name: dapr-placement
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.serviceAccount.placement.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   labels:
     {{- range $key, $value := .Values.global.k8sLabels }}
     {{ $key }}: {{ tpl $value $ }}
diff --git a/helm-charts/dapr/charts/dapr_rbac/templates/scheduler.yaml b/helm-charts/dapr/charts/dapr_rbac/templates/scheduler.yaml
@@ -4,6 +4,10 @@ kind: ServiceAccount
 metadata:
   name: dapr-scheduler
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.serviceAccount.scheduler.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   labels:
     {{- range $key, $value := .Values.global.k8sLabels }}
     {{ $key }}: {{ tpl $value $ }}
diff --git a/helm-charts/dapr/charts/dapr_rbac/templates/sentry.yaml b/helm-charts/dapr/charts/dapr_rbac/templates/sentry.yaml
@@ -3,6 +3,10 @@ kind: ServiceAccount
 metadata:
   name: dapr-sentry
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.serviceAccount.sentry.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   labels:
     {{- range $key, $value := .Values.global.k8sLabels }}
     {{ $key }}: {{ tpl $value $ }}
diff --git a/helm-charts/dapr/charts/dapr_rbac/values.yaml b/helm-charts/dapr/charts/dapr_rbac/values.yaml
@@ -2,3 +2,14 @@ secretReader:
   enabled: true
   namespace: default
 component: rbac
+serviceAccount:
+  injector:
+    annotations: {}
+  operator:
+    annotations: {}
+  placement:
+    annotations: {}
+  scheduler:
+    annotations: {}
+  sentry:
+    annotations: {}
diff --git a/helm-charts/dapr/charts/dapr_scheduler/Chart.yaml b/helm-charts/dapr/charts/dapr_scheduler/Chart.yaml
@@ -1,5 +1,5 @@
-apiVersion: v1
+apiVersion: v2
 appVersion: "1.0"
 description: A Helm chart for Dapr Scheduler
 name: dapr_scheduler
-version: 1.15.10
+version: 1.16.0
diff --git a/helm-charts/dapr/charts/dapr_scheduler/templates/dapr_scheduler_statefulset.yaml b/helm-charts/dapr/charts/dapr_scheduler/templates/dapr_scheduler_statefulset.yaml
@@ -1,3 +1,4 @@
+{{- if (eq .Values.global.scheduler.enabled true) }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -27,7 +28,9 @@ spec:
       name: dapr-scheduler-data-dir
     spec:
       accessModes: [ "ReadWriteOnce" ]
+      {{- if .Values.cluster.storageClassName }}
       storageClassName: {{ .Values.cluster.storageClassName }}
+      {{- end }}
       resources:
         requests:
           storage: {{ .Values.cluster.storageSize }}
@@ -138,7 +141,21 @@ spec:
         - "--id"
         - "$(SCHEDULER_ID)"
         - "--etcd-initial-cluster"
-        - "dapr-scheduler-server-0=https://dapr-scheduler-server-0.dapr-scheduler-server.{{ .Release.Namespace }}.svc:2380,dapr-scheduler-server-1=https://dapr-scheduler-server-1.dapr-scheduler-server.{{ .Release.Namespace }}.svc:2380,dapr-scheduler-server-2=https://dapr-scheduler-server-2.dapr-scheduler-server.{{ .Release.Namespace }}.svc:2380"
+        - "dapr-scheduler-server-0=https://dapr-scheduler-server-0.dapr-scheduler-server.{{ .Release.Namespace }}.svc{{ .Values.global.dnsSuffix }}:2380,dapr-scheduler-server-1=https://dapr-scheduler-server-1.dapr-scheduler-server.{{ .Release.Namespace }}.svc{{ .Values.global.dnsSuffix }}:2380,dapr-scheduler-server-2=https://dapr-scheduler-server-2.dapr-scheduler-server.{{ .Release.Namespace }}.svc{{ .Values.global.dnsSuffix }}:2380"
+        - "--etcd-embed"
+        - "{{ .Values.etcdEmbed }}"
+{{- if gt (len .Values.etcdClientEndpoints) 0 }}
+        - "--etcd-client-endpoints"
+        - "{{ join "," .Values.etcdClientEndpoints }}"
+{{- end }}
+{{- if  .Values.etcdClientUsername}}
+        - "--etcd-client-username"
+        - "{{ .Values.etcdClientUsername }}"
+{{- end }}
+{{- if  .Values.etcdClientPassword}}
+        - "--etcd-client-password"
+        - "{{ .Values.etcdClientPassword }}"
+{{- end }}
         - "--log-level"
         - {{ .Values.logLevel }}
 {{- if eq .Values.global.logAsJson true }}
@@ -163,6 +180,7 @@ spec:
         - "--etcd-backend-batch-limit={{ .Values.etcdBackendBatchLimit }}"
         - "--etcd-backend-batch-interval={{ .Values.etcdBackendBatchInterval }}"
         - "--etcd-experimental-bootstrap-defrag-threshold-megabytes={{ .Values.etcdDefragThresholdMB }}"
+        - "--etcd-initial-election-tick-advance={{ .Values.etcdInitialElectionTickAdvance }}"
         - "--etcd-metrics={{ .Values.etcdMetrics }}"
         - "--tls-enabled"
         - "--trust-domain={{ .Values.global.mtls.controlPlaneTrustDomain }}"
@@ -269,3 +287,4 @@ spec:
       priorityClassName:
 {{ toYaml .Values.global.priorityClassName | indent 8 }}
 {{- end }}
+{{- end }}
diff --git a/helm-charts/dapr/charts/dapr_scheduler/values.yaml b/helm-charts/dapr/charts/dapr_scheduler/values.yaml
@@ -40,8 +40,14 @@ etcdMaxWals: 10
 etcdBackendBatchLimit: 5000
 etcdBackendBatchInterval: 50ms
 etcdDefragThresholdMB: 100
+etcdInitialElectionTickAdvance: false
 etcdMetrics: "basic"
 
+etcdEmbed: true
+etcdClientEndpoints: []
+etcdClientUsername: ""
+etcdClientPassword: ""
+
 livenessProbe:
   initialDelaySeconds: 10
   periodSeconds: 3
diff --git a/helm-charts/dapr/charts/dapr_sentry/Chart.yaml b/helm-charts/dapr/charts/dapr_sentry/Chart.yaml
@@ -1,5 +1,5 @@
-apiVersion: v1
+apiVersion: v2
 appVersion: "1.0"
 description: A Helm chart for Dapr Sentry
 name: dapr_sentry
-version: 1.15.10
+version: 1.16.0
diff --git a/helm-charts/dapr/charts/dapr_sentry/templates/dapr_sentry_deployment.yaml b/helm-charts/dapr/charts/dapr_sentry/templates/dapr_sentry_deployment.yaml
@@ -137,6 +137,11 @@ spec:
         - name: debug
           containerPort: {{ .Values.debug.port }}
           protocol: TCP
+{{- end }}
+{{- if .Values.oidc.enabled }}
+        - name: oidc
+          containerPort: 9080
+          protocol: TCP
 {{- end }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
@@ -165,7 +170,7 @@ spec:
         - "--"
 {{- end }}
         - "--mode"
-        - "kubernetes"
+        - "{{ .Values.mode }}"
         - "--log-level"
         - {{ .Values.logLevel }}
 {{- if eq .Values.global.logAsJson true }}
@@ -188,6 +193,47 @@ spec:
         - "--issuer-key-filename"
         - "{{ .key }}"
 {{- end }}
+{{- if .Values.jwt.enabled }}
+        - "--jwt-enabled=true"
+{{- if .Values.jwt.keyFilename }}
+        - "--jwt-key-filename={{ .Values.jwt.keyFilename }}"
+{{- end }}
+{{- if .Values.jwt.jwksFilename }}
+        - "--jwks-filename={{ .Values.jwt.jwksFilename }}"
+{{- end }}
+{{- if .Values.jwt.issuer }}
+        - "--jwt-issuer={{ .Values.jwt.issuer }}"
+{{- end }}
+{{- if .Values.jwt.signingAlgorithm }}
+        - "--jwt-signing-algorithm={{ .Values.jwt.signingAlgorithm }}"
+{{- end }}
+{{- if .Values.jwt.keyID }}
+        - "--jwt-key-id={{ .Values.jwt.keyID }}"
+{{- end }}
+{{- end }}
+{{- if .Values.oidc.enabled }}
+        - "--oidc-enabled=true"
+        - "--oidc-server-listen-address=0.0.0.0"
+{{- if .Values.oidc.jwksURI }}
+        - "--oidc-jwks-uri={{ .Values.oidc.jwksURI }}"
+{{- end }}
+{{- if .Values.oidc.pathPrefix }}
+        - "--oidc-path-prefix={{ .Values.oidc.pathPrefix }}"
+{{- end }}
+{{- if .Values.oidc.allowedHosts }}
+        - "--oidc-allowed-hosts={{ join "," .Values.oidc.allowedHosts }}"
+{{- end }}
+{{- if .Values.oidc.tls.certFile }}
+        - "--oidc-server-tls-cert-file={{ .Values.oidc.tls.certFile }}"
+{{- end }}
+{{- if .Values.oidc.tls.keyFile }}
+        - "--oidc-server-tls-key-file={{ .Values.oidc.tls.keyFile }}"
+{{- end }}
+{{- if .Values.oidc.tls.enabled }}
+        - "--oidc-server-tls-enabled={{ .Values.oidc.tls.enabled }}"
+{{- end }}
+{{- end }}
+
       serviceAccountName: dapr-sentry
       volumes:
         - name: credentials
diff --git a/helm-charts/dapr/charts/dapr_sentry/templates/dapr_sentry_service.yaml b/helm-charts/dapr/charts/dapr_sentry/templates/dapr_sentry_service.yaml
@@ -33,3 +33,9 @@ spec:
     targetPort: {{ .Values.global.prometheus.port }}
     protocol: TCP
 {{- end}}
+{{- if .Values.oidc.enabled }}
+  - name: oidc
+    port: {{ .Values.oidc.server.port }}
+    targetPort: 9080
+    protocol: TCP
+{{- end }}
diff --git a/helm-charts/dapr/charts/dapr_sentry/values.yaml b/helm-charts/dapr/charts/dapr_sentry/values.yaml
diff --git a/helm-charts/dapr/charts/dapr_sidecar_injector/Chart.yaml b/helm-charts/dapr/charts/dapr_sidecar_injector/Chart.yaml
diff --git a/helm-charts/dapr/crds/configuration.yaml b/helm-charts/dapr/crds/configuration.yaml
diff --git a/helm-charts/dapr/values.yaml b/helm-charts/dapr/values.yaml
