feat: upgrade geoserver to 3.0.1 (MAPCO-9312) by roicohen326 · Pull Request #6 · MapColonies/geoserver

roicohen326 · 2026-09-22T14:40:30Z

Question	Answer
Bug fix	✖
New feature	✔
Breaking change	✖
Deprecations	✖
Documentation	✖
Tests added	✖
Chore	✖

Related issues: #MAPCO-9312

Further information:

Merge after ci: add release-please workflow #7 and ci: add build and push workflow #8.

NivGreenstein · 2026-09-22T16:48:24Z

@roicohen326 , Thank you for the PR🚀!
Please deploy it at a non-prod environment and check that everything is still valid.
Until then, mark this pr as draft.
If the image introduce breaking changes, change the PR's title to feat!:
Update Repo's helm if needed.
Don't forget to deploy it with Metrics and Telemetry enabled.
Once done, contact me.

Also, make sure to remove AI comments

Upgrades the kartoza base image from 2.27.1--v2025.07.17 to 3.0.1--v2026.09.04, which addresses CVE-2026-76904 (critical, unauthenticated PostGIS SQL injection via GeoTools). BREAKING CHANGE: GeoServer 3.0 moves to Java 21 and Tomcat 11 (Jakarta EE). The data_dir migration is one-way -- once 3.0.1 rewrites the catalog, 2.27 may not be able to read it back. Back up the data dir before deploying. kartoza restructured their entrypoint scripts in 3.0: functions.sh was split into scripts/lib/*.sh and entrypoint.sh is now a thin orchestrator. The single line this image used to patch out did three things, and in 3.0.1 those three live in three places: chmod o+rw CERT_DIR -> lib/utils.sh, own line (sed) gwc_file_perms -> geo_data_file_perms, guarded (env vars) find ... chmod 400 -> lib/utils.sh, own line (sed) All three fail with EPERM under OpenShift's arbitrary UID and abort the entrypoint (set -e), so all three still need to be disabled. The sed is also given grep pre/post assertions. sed exits 0 when it matches nothing, so the previous form would silently no-op on a restructured upstream and produce an image that builds green and only fails at runtime.

… helm to 3.0.1 (MAPCO-9312)

roicohen326 · 2026-09-24T15:24:52Z

@roicohen326 , Thank you for the PR🚀! Please deploy it at a non-prod environment and check that everything is still valid. Until then, mark this pr as draft. If the image introduce breaking changes, change the PR's title to feat!: Update Repo's helm if needed. Don't forget to deploy it with Metrics and Telemetry enabled. Once done, contact me.

Also, make sure to remove AI comments

Hi Niv, thanks for the review. Going through your points:
Non-prod deployment: Deployed to raster-dev as pp-geoserver. We ran basic edge cases: WFS queries from the catalog and viewing polygon parts. We found no breaking changes between 2.26.0 and 3.0.1, so I changed the PR to a regular feat:. The pod starts under OpenShift's arbitrary UID with no permission errors.

Image tag: Follows the existing scheme, v2.1.0-3.0.1 (package.json bumped to 2.1.0). The image is already built and pushed to ACR.
Repo helm: Updated the image tag in helm/values.yaml to geoserver-os:v2.1.0-3.0.1.

Metrics: the pod's scrape annotation points at port 9117, and nothing listens there. I port-forwarded the pp-geoserver nginx exporter and confirmed /metrics on 9113 serves data, so that part of the pipeline works.
Traces: working.
Let me know if you'd like anything else checked before I move it out of draft.

NivGreenstein · 2026-09-24T16:20:02Z

@roicohen326 , Thank you for the PR🚀! Please deploy it at a non-prod environment and check that everything is still valid. Until then, mark this pr as draft. If the image introduce breaking changes, change the PR's title to feat!: Update Repo's helm if needed. Don't forget to deploy it with Metrics and Telemetry enabled. Once done, contact me.

Also, make sure to remove AI comments

Hi Niv, thanks for the review. Going through your points:

Non-prod deployment: Deployed to raster-dev as pp-geoserver. We ran basic edge cases: WFS queries from the catalog and viewing polygon parts. We found no breaking changes between 2.26.0 and 3.0.1, so I changed the PR to a regular feat:. The pod starts under OpenShift's arbitrary UID with no permission errors.

Image tag: Follows the existing scheme, v2.1.0-3.0.1 (package.json bumped to 2.1.0). The image is already built and pushed to ACR.

Repo helm: Updated the image tag in helm/values.yaml to geoserver-os:v2.1.0-3.0.1.

Metrics: the pod's scrape annotation points at port 9117, and nothing listens there. I port-forwarded the pp-geoserver nginx exporter and confirmed /metrics on 9113 serves data, so that part of the pipeline works.

Traces: working.

Let me know if you'd like anything else checked before I move it out of draft.

Did you check PostgreSQL SSL connection with certificates?

Also, if you locally built and pushed v2.1.0-3.0.1 to our ACR, this is VERY wrong and should never do such a thing. We have release-please workflow and docker build and push workflow that handles release and build. Please delete it ASAP. Thanks.

If the PR is ready for my review, please mark it back from draft pr.
And change the title if needed

roicohen326 · 2026-10-01T07:57:31Z

@roicohen326 , Thank you for the PR🚀! Please deploy it at a non-prod environment and check that everything is still valid. Until then, mark this pr as draft. If the image introduce breaking changes, change the PR's title to feat!: Update Repo's helm if needed. Don't forget to deploy it with Metrics and Telemetry enabled. Once done, contact me.

Also, make sure to remove AI comments

Hi Niv, thanks for the review. Going through your points:
Non-prod deployment: Deployed to raster-dev as pp-geoserver. We ran basic edge cases: WFS queries from the catalog and viewing polygon parts. We found no breaking changes between 2.26.0 and 3.0.1, so I changed the PR to a regular feat:. The pod starts under OpenShift's arbitrary UID with no permission errors.
Image tag: Follows the existing scheme, v2.1.0-3.0.1 (package.json bumped to 2.1.0). The image is already built and pushed to ACR.
Repo helm: Updated the image tag in helm/values.yaml to geoserver-os:v2.1.0-3.0.1.

Metrics: the pod's scrape annotation points at port 9117, and nothing listens there. I port-forwarded the pp-geoserver nginx exporter and confirmed /metrics on 9113 serves data, so that part of the pipeline works.

Traces: working.

Let me know if you'd like anything else checked before I move it out of draft.

Did you check PostgreSQL SSL connection with certificates?

Also, if you locally built and pushed v2.1.0-3.0.1 to our ACR, this is VERY wrong and should never do such a thing. We have release-please workflow and docker build and push workflow that handles release and build. Please delete it ASAP. Thanks.

If the PR is ready for my review, please mark it back from draft pr. And change the title if needed

Thanks Niv, and sorry: my previous comment was inaccurate on a few points.
Correcting:

ACR: v2.1.0-3.0.1 was not pushed.
I did build locally and push test images, only to validate on raster-dev .
The local build and push for raster was coordinated with Shlomi.

Versioning: reverted my manual package.json bump; the version is left to the release.

PostgreSQL SSL: not checked yet. Our raster-dev deployment doesn't use certificate auth, and cert-start.sh is unchanged in this PR. I'll verify it against a Postgres that requires client certificates and update here.

Title: changed to feat: (no breaking changes found).

syncush · 2026-10-01T08:49:06Z

@roicohen326 you will need to make sure you keep the ACR nice and neat, clean up after you are done testing.
@ronenkapelian our PG cert is expired; you will need to invoke new one to let Roi test it over SSL connection.

NivGreenstein · 2026-10-01T08:56:04Z

@roicohen326

Make sure that if you push to ACR (to test on our Dev env), you push it with rc* postfix tag.

Also, I noticed we don't have a release-please workflow on this repository. Are you keen to submit the release-please workflow in a separate PR?

roicohen326 · 2026-10-01T13:36:23Z

@roicohen326

Make sure that if you push to ACR (to test on our Dev env), you push it with rc* postfix tag.

Also, I noticed we don't have a release-please workflow on this repository. Are you keen to submit the release-please workflow in a separate PR?

Sure , no probelm .

roicohen326 · 2026-10-08T14:07:40Z

@NivGreenstein the release-please workflow is up in #7. It starts from 2.0.0, since every environment already runs geoserver-os:v2.0.0-2.26.0, so this PR will release as 2.1.0 and produce the image v2.1.0-3.0.1. I updated the repo helm tag and the PR description to match.

One question:

The repo doesn't have a build-and-push workflow yet, so a release will create a tag but no image. Should I add one in a separate PR?

Still open:

PG SSL with client certs: waiting for the new certificate from @ronenkapelian. I'll test and update here.
ACR: noted. Any future test images will use an rc tag. I'll delete my test tags once the SSL test is done, because raster-dev is still running one of them.

roicohen326 · 2026-10-22T08:32:17Z

@NivGreenstein PG SSL with client certs: tested and works on 3.0.1.

syncush · 2026-10-25T07:57:53Z

  logScraping: true

 image:
-  geoserverRepository: geoserver-os


@NivGreenstein if it is a common image why should we nest it under vector ?

Historically, Geoserver was Vector's domain. We may change it to common.
We may also change repo's owner from Vector team

NivGreenstein · 2026-10-25T08:08:59Z

-  geoserverRepository: geoserver-os
-  geoserverTag: "v1.0.0-2.19.1"
+  geoserverRepository: vector/geoserver-os
+  geoserverTag: "v2.1.0-3.0.1"


It should be v1.0.0

NivGreenstein · 2026-10-25T08:10:15Z

@@ -24,7 +27,14 @@ RUN chmod -R g=u ${CATALINA_HOME} /opt /usr/local/tomcat /settings /etc/certs \
    /scripts /tmp/ /home /community_plugins/ \
    ${GEOSERVER_HOME} /usr/share/fonts/


@syncush, Mayble let's contribute this part to Kartoza/docker-geoserver ?

NivGreenstein · 2026-10-25T08:11:11Z

 try {
 	const packageVersion = await require('./package.json').version;
-	const imageName = `${IMAGE_REPO}:v${packageVersion}-${GEOSERVER_VERSION}`;
+	const imageName = `${IMAGE_REPO}:v${packageVersion}-${GEOSERVER_VERSION.split('--')[0]}`;


roicohen326 requested a review from a team as a code owner September 22, 2026 14:40

roicohen326 force-pushed the feat/mapco-9312-geoserver-3.0.1 branch from c3a9556 to b306b2d Compare September 23, 2026 10:35

roicohen326 changed the title ~~feat: upgrade geoserver to 3.0.1 (MAPCO-9312)~~ feat!: upgrade geoserver to 3.0.1 (MAPCO-9312) Sep 23, 2026

roicohen326 marked this pull request as draft September 23, 2026 10:36

roicohen326 closed this Sep 24, 2026

roicohen326 reopened this Sep 24, 2026

roicohen326 mentioned this pull request Sep 24, 2026

feat(raster-serving): upgrade pp-geoserver to geoserver 3.0.1 (MAPCO-9312) MapColonies/helm-charts-new#155

Open

chore: bump to v3.0.0, drop kartoza build date from image tag, update…

710c555

… helm to 3.0.1 (MAPCO-9312)

chore: revert helm chart version and appVersion (MAPCO-9312)

7678ff8

roicohen326 changed the title ~~feat!: upgrade geoserver to 3.0.1 (MAPCO-9312)~~ feat: upgrade geoserver to 3.0.1 (MAPCO-9312) Oct 1, 2026

chore: revert manual package.json version bump (MAPCO-9312)

fa52103

roicohen326 mentioned this pull request Oct 7, 2026

ci: add release-please workflow #7

Open

chore: align helm image tag with release-please version (MAPCO-9312)

df8c4c7

roicohen326 marked this pull request as ready for review October 8, 2026 13:54

roicohen326 mentioned this pull request Oct 19, 2026

ci: add build and push workflow #8

Open

fix: point chart at vector/geoserver-os (MAPCO-9312)

39293a1

syncush reviewed Oct 25, 2026

View reviewed changes

NivGreenstein requested changes Oct 25, 2026

View reviewed changes

		@@ -24,7 +27,14 @@ RUN chmod -R g=u ${CATALINA_HOME} /opt /usr/local/tomcat /settings /etc/certs \
		/scripts /tmp/ /home /community_plugins/ \
		${GEOSERVER_HOME} /usr/share/fonts/

Conversation

roicohen326 commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NivGreenstein commented Sep 22, 2026

Uh oh!

roicohen326 commented Sep 24, 2026

Uh oh!

NivGreenstein commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

roicohen326 commented Oct 1, 2026

Uh oh!

syncush commented Oct 1, 2026

Uh oh!

NivGreenstein commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

roicohen326 commented Oct 1, 2026

Uh oh!

roicohen326 commented Oct 8, 2026

Uh oh!

roicohen326 commented Oct 22, 2026

Uh oh!

syncush Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

NivGreenstein Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

NivGreenstein Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

NivGreenstein Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

NivGreenstein Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

roicohen326 commented Sep 22, 2026 •

edited

Loading

NivGreenstein commented Sep 24, 2026 •

edited

Loading

NivGreenstein commented Oct 1, 2026 •

edited

Loading