refactor
This commit is contained in:
Daniel Noulet
parent
d0ea6e9eec
commit
2967f1a5af
31 changed files with 469 additions and 165 deletions
|
|
@ -21,12 +21,8 @@
|
|||
# reproducible rather than "whatever worked when it was deployed".
|
||||
|
||||
image:
|
||||
# The development cluster pulls from a private registry whose certificate is valid
|
||||
# for a different name, so the host and the port have to stay in one piece: putting
|
||||
# the port in `repository` renders an image reference without it, and the kubelet
|
||||
# then resolves the registry over https on port 443.
|
||||
registry: batty1039.startdedicated.net:5000
|
||||
repository: go-bananas
|
||||
registry: nexus.urpi.be
|
||||
repository: docker-hosted/go-bananas
|
||||
# The development registry is tagged `latest` rather than pinned to a version, to
|
||||
# match every other release in this namespace. Consequently the pull policy must be
|
||||
# Always: with IfNotPresent a node keeps serving the image it already has, and a
|
||||
|
|
@ -39,7 +35,7 @@ config:
|
|||
# refuses both of these outside a development environment, so this pair cannot be
|
||||
# promoted to production by accident.
|
||||
environment: development
|
||||
publicBaseUrl: https://bananas-dev.urpi.be
|
||||
publicBaseUrl: https://bananas.dev-urpi.be
|
||||
|
||||
identity:
|
||||
# dev, not oidc.
|
||||
|
|
@ -59,11 +55,11 @@ identity:
|
|||
# helm upgrade ... --set identity.mode=oidc \
|
||||
# --set identity.oidc.generateSecret=false \
|
||||
# --set identity.oidc.existingSecret=go-bananas-auth \
|
||||
# --set identity.oidc.issuer=https://auth-dev.urpi.be \
|
||||
# --set identity.oidc.issuer=https://auth.dev-urpi.be \
|
||||
# --set identity.oidc.clientId=go-bananas
|
||||
mode: dev
|
||||
oidc:
|
||||
issuer: https://auth-dev.urpi.be
|
||||
issuer: https://auth.dev-urpi.be
|
||||
clientId: go-bananas
|
||||
existingSecret: go-bananas-auth
|
||||
generateSecret: false
|
||||
|
|
@ -74,17 +70,17 @@ ingress:
|
|||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
hosts:
|
||||
- host: bananas-dev.urpi.be
|
||||
- host: bananas.dev-urpi.be
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: go-bananas-tls
|
||||
hosts:
|
||||
- bananas-dev.urpi.be
|
||||
- bananas.dev-urpi.be
|
||||
|
||||
deployment:
|
||||
# One replica. The volume is ReadWriteOnce, so a second replica cannot mount it and
|
||||
# would sit in ImagePullBackOff-equivalent limbo forever. Scaling needs either this
|
||||
# changed to 1 or a ReadWriteMany filesystem.
|
||||
replicaCount: 1
|
||||
replicaCount: 1
|
||||
|
|
|
|||
|
|
@ -60,7 +60,7 @@ Authentication is set to "{{ .Values.identity.mode }}". Every request is current
|
|||
treated as an administrator. Before exposing this to a network, set:
|
||||
|
||||
identity.mode=oidc
|
||||
identity.oidc.issuer=https://auth-dev.urpi.be/realms/<realm>
|
||||
identity.oidc.issuer=https://auth.dev-urpi.be/realms/<realm>
|
||||
identity.oidc.clientId=go-bananas
|
||||
identity.oidc.existingSecret=<secret-name>
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -167,7 +167,7 @@ CrashLoopBackOff to diagnose. Each check names the value to change.
|
|||
|
||||
{{- if eq $mode "oidc" -}}
|
||||
{{- if not .Values.identity.oidc.issuer -}}
|
||||
{{- fail "identity.oidc.issuer is required when identity.mode is oidc. For the development realm this is https://auth-dev.urpi.be/realms/<realm>." -}}
|
||||
{{- fail "identity.oidc.issuer is required when identity.mode is oidc. For the development realm this is https://auth.dev-urpi.be/realms/<realm>." -}}
|
||||
{{- end -}}
|
||||
{{- if not (regexMatch "^https?://" .Values.identity.oidc.issuer) -}}
|
||||
{{- fail (printf "identity.oidc.issuer %q is not a URL. It must include the scheme." .Values.identity.oidc.issuer) -}}
|
||||
|
|
@ -253,4 +253,4 @@ The data volume name, whether it is a PVC or an emptyDir.
|
|||
{{- else -}}
|
||||
{{- printf "%s-data" (include "go-bananas.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -52,9 +52,6 @@ spec:
|
|||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.image.pullPolicy }}
|
||||
imagePullPolicy: {{ . }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "go-bananas.serviceAccountName" . }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
|
|
@ -75,19 +72,20 @@ spec:
|
|||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
|
||||
{{- if .Values.deployment.lifecycle.preStop.enabled }}
|
||||
# A preStop sleep gives the Service endpoints controller time to remove this
|
||||
# pod from the endpoint list before the process starts refusing connections.
|
||||
# Without it, a rolling update can drop requests that were already routed.
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["/bin/sh", "-c", "sleep {{ .Values.deployment.lifecycle.preStop.sleepSeconds }}"]
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: go-bananas
|
||||
image: {{ include "go-bananas.image" . }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
{{- if .Values.deployment.lifecycle.preStop.enabled }}
|
||||
# A preStop sleep gives the Service endpoints controller time to remove this
|
||||
# pod from the endpoint list before the process starts refusing connections.
|
||||
# Without it, a rolling update can drop requests that were already routed.
|
||||
# lifecycle is a container field, not a podSpec field.
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["/bin/sh", "-c", "sleep {{ .Values.deployment.lifecycle.preStop.sleepSeconds }}"]
|
||||
{{- end }}
|
||||
{{- with .Values.deployment.extraArgs }}
|
||||
args:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,8 @@
|
|||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
replicaCount: 1
|
||||
deployment:
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
repository: nexus.urpi.be/docker-hosted/go-bananas
|
||||
|
|
@ -13,6 +14,16 @@ service:
|
|||
type: ClusterIP
|
||||
port: 80
|
||||
|
||||
# Spelled out here rather than inherited from values.yaml so the development
|
||||
# issuer is stated where it is used.
|
||||
identity:
|
||||
mode: oidc
|
||||
oidc:
|
||||
issuer: https://auth.dev-urpi.be/realms/urpi
|
||||
clientId: go-bananas
|
||||
existingSecret: go-bananas-auth
|
||||
generateSecret: false
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
|
|
@ -20,20 +31,14 @@ ingress:
|
|||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
hosts:
|
||||
- host: bananas-dev.intern-urpi.be
|
||||
- host: bananas.dev-urpi.be
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: go-bananas-tls
|
||||
hosts:
|
||||
- bananas-dev.intern-urpi.be
|
||||
|
||||
certManager:
|
||||
enabled: true
|
||||
issuerRef:
|
||||
name: letsencrypt-staging
|
||||
kind: ClusterIssuer
|
||||
- bananas.dev-urpi.be
|
||||
|
||||
resources:
|
||||
limits:
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
# Local (LCL) values for go-bananas.
|
||||
# Served at https://bananas-lcl.intern-urpi.be by the docker TLS edge.
|
||||
# Served at https://bananas.lcl-urpi.be by the docker TLS edge.
|
||||
#
|
||||
# NOTE: this chart validates values against values.schema.json, which allows
|
||||
# only the keys defined there -- no certManager and no replicaCount here
|
||||
|
|
@ -18,12 +18,12 @@ service:
|
|||
port: 80
|
||||
|
||||
# Local environment: development unlocks the local authentication bypass, so
|
||||
# the deployment works without the shared Keycloak realm at auth-dev.urpi.be
|
||||
# the deployment works without the shared Keycloak realm at auth.dev-urpi.be
|
||||
# (go-loose does not serve /realms/... endpoints, so the oidc default cannot
|
||||
# be pointed at it either).
|
||||
config:
|
||||
environment: development
|
||||
publicBaseUrl: "https://bananas-lcl.intern-urpi.be"
|
||||
publicBaseUrl: "https://bananas.lcl-urpi.be"
|
||||
|
||||
identity:
|
||||
mode: dev
|
||||
|
|
@ -33,14 +33,14 @@ ingress:
|
|||
className: traefik
|
||||
annotations: {}
|
||||
hosts:
|
||||
- host: bananas-lcl.intern-urpi.be
|
||||
- host: bananas.lcl-urpi.be
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: local-dev-cert
|
||||
hosts:
|
||||
- bananas-lcl.intern-urpi.be
|
||||
- bananas.lcl-urpi.be
|
||||
|
||||
resources:
|
||||
limits:
|
||||
|
|
|
|||
|
|
@ -2,7 +2,8 @@
|
|||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
replicaCount: 1
|
||||
deployment:
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
repository: nexus.urpi.be/docker-hosted/go-bananas
|
||||
|
|
@ -13,6 +14,17 @@ service:
|
|||
type: ClusterIP
|
||||
port: 80
|
||||
|
||||
# Spelled out here rather than inherited from values.yaml, whose default issuer
|
||||
# points at the development realm: a missing key would otherwise make the
|
||||
# testing release validate tokens against the development identity provider.
|
||||
identity:
|
||||
mode: oidc
|
||||
oidc:
|
||||
issuer: https://auth.tst-urpi.be/realms/urpi
|
||||
clientId: go-bananas
|
||||
existingSecret: go-bananas-auth
|
||||
generateSecret: false
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
|
|
@ -20,20 +32,14 @@ ingress:
|
|||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
hosts:
|
||||
- host: bananas-tst.intern-urpi.be
|
||||
- host: bananas.tst-urpi.be
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: go-bananas-tls
|
||||
hosts:
|
||||
- bananas-tst.intern-urpi.be
|
||||
|
||||
certManager:
|
||||
enabled: true
|
||||
issuerRef:
|
||||
name: letsencrypt-staging
|
||||
kind: ClusterIssuer
|
||||
- bananas.tst-urpi.be
|
||||
|
||||
resources:
|
||||
limits:
|
||||
|
|
|
|||
|
|
@ -197,7 +197,7 @@ config:
|
|||
# replicaCount: 1, or a filesystem that permits multiple mounts.
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
enabled: false
|
||||
type: persistentVolumeClaim
|
||||
accessMode: ReadWriteOnce
|
||||
size: 2Gi
|
||||
|
|
@ -288,7 +288,7 @@ identity:
|
|||
# issuer: this string must match the `iss` claim in the ID token exactly,
|
||||
# including a trailing slash if the provider emits one. A mismatch here is the
|
||||
# single most common cause of "invalid issuer" at the callback.
|
||||
issuer: "https://auth-dev.urpi.be/realms/urpi"
|
||||
issuer: "https://auth.dev-urpi.be/realms/urpi"
|
||||
|
||||
# clientId is the client identifier registered with the provider.
|
||||
clientId: "go-bananas"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue