refactor

deploy/helm/go-bananas/templates/NOTES.txt

@@ -60,7 +60,7 @@ Authentication is set to "{{ .Values.identity.mode }}". Every request is current
 treated as an administrator. Before exposing this to a network, set:
 
   identity.mode=oidc
-  identity.oidc.issuer=https://auth-dev.urpi.be/realms/<realm>
+  identity.oidc.issuer=https://auth.dev-urpi.be/realms/<realm>
   identity.oidc.clientId=go-bananas
   identity.oidc.existingSecret=<secret-name>
 {{- end }}

deploy/helm/go-bananas/templates/_helpers.tpl

@@ -167,7 +167,7 @@ CrashLoopBackOff to diagnose. Each check names the value to change.
 
 {{- if eq $mode "oidc" -}}
   {{- if not .Values.identity.oidc.issuer -}}
-  {{- fail "identity.oidc.issuer is required when identity.mode is oidc. For the development realm this is https://auth-dev.urpi.be/realms/<realm>." -}}
+  {{- fail "identity.oidc.issuer is required when identity.mode is oidc. For the development realm this is https://auth.dev-urpi.be/realms/<realm>." -}}
   {{- end -}}
   {{- if not (regexMatch "^https?://" .Values.identity.oidc.issuer) -}}
   {{- fail (printf "identity.oidc.issuer %q is not a URL. It must include the scheme." .Values.identity.oidc.issuer) -}}
@@ -253,4 +253,4 @@ The data volume name, whether it is a PVC or an emptyDir.
 {{- else -}}
 {{- printf "%s-data" (include "go-bananas.fullname" .) -}}
 {{- end -}}
-{{- end }}
+{{- end }}

deploy/helm/go-bananas/templates/deployment.yaml

@@ -52,9 +52,6 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
     spec:
-      {{- with .Values.image.pullPolicy }}
-      imagePullPolicy: {{ . }}
-      {{- end }}
       serviceAccountName: {{ include "go-bananas.serviceAccountName" . }}
       automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
       {{- with .Values.serviceAccount.annotations }}
@@ -75,19 +72,20 @@ spec:
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.deployment.terminationGracePeriodSeconds }}
-      {{- if .Values.deployment.lifecycle.preStop.enabled }}
-      # A preStop sleep gives the Service endpoints controller time to remove this
-      # pod from the endpoint list before the process starts refusing connections.
-      # Without it, a rolling update can drop requests that were already routed.
-      lifecycle:
-        preStop:
-          exec:
-            command: ["/bin/sh", "-c", "sleep {{ .Values.deployment.lifecycle.preStop.sleepSeconds }}"]
-      {{- end }}
       containers:
         - name: go-bananas
           image: {{ include "go-bananas.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- if .Values.deployment.lifecycle.preStop.enabled }}
+          # A preStop sleep gives the Service endpoints controller time to remove this
+          # pod from the endpoint list before the process starts refusing connections.
+          # Without it, a rolling update can drop requests that were already routed.
+          # lifecycle is a container field, not a podSpec field.
+          lifecycle:
+            preStop:
+              exec:
+                command: ["/bin/sh", "-c", "sleep {{ .Values.deployment.lifecycle.preStop.sleepSeconds }}"]
+          {{- end }}
           {{- with .Values.deployment.extraArgs }}
           args:
             {{- toYaml . | nindent 12 }}

deploy/helm/go-bananas/values-dev.yaml

@@ -2,7 +2,8 @@
 nameOverride: ""
 fullnameOverride: ""
 
-replicaCount: 1
+deployment:
+  replicaCount: 1
 
 image:
   repository: nexus.urpi.be/docker-hosted/go-bananas
@@ -13,6 +14,16 @@ service:
   type: ClusterIP
   port: 80
 
+# Spelled out here rather than inherited from values.yaml so the development
+# issuer is stated where it is used.
+identity:
+  mode: oidc
+  oidc:
+    issuer: https://auth.dev-urpi.be/realms/urpi
+    clientId: go-bananas
+    existingSecret: go-bananas-auth
+    generateSecret: false
+
 ingress:
   enabled: true
   className: nginx
@@ -20,20 +31,14 @@ ingress:
     cert-manager.io/cluster-issuer: letsencrypt-staging
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
   hosts:
-    - host: bananas-dev.intern-urpi.be
+    - host: bananas.dev-urpi.be
       paths:
         - path: /
           pathType: Prefix
   tls:
     - secretName: go-bananas-tls
       hosts:
-        - bananas-dev.intern-urpi.be
-
-certManager:
-  enabled: true
-  issuerRef:
-    name: letsencrypt-staging
-    kind: ClusterIssuer
+        - bananas.dev-urpi.be
 
 resources:
   limits:

deploy/helm/go-bananas/values-lcl.yaml

@@ -1,5 +1,5 @@
 # Local (LCL) values for go-bananas.
-# Served at https://bananas-lcl.intern-urpi.be by the docker TLS edge.
+# Served at https://bananas.lcl-urpi.be by the docker TLS edge.
 #
 # NOTE: this chart validates values against values.schema.json, which allows
 # only the keys defined there -- no certManager and no replicaCount here
@@ -18,12 +18,12 @@ service:
   port: 80
 
 # Local environment: development unlocks the local authentication bypass, so
-# the deployment works without the shared Keycloak realm at auth-dev.urpi.be
+# the deployment works without the shared Keycloak realm at auth.dev-urpi.be
 # (go-loose does not serve /realms/... endpoints, so the oidc default cannot
 # be pointed at it either).
 config:
   environment: development
-  publicBaseUrl: "https://bananas-lcl.intern-urpi.be"
+  publicBaseUrl: "https://bananas.lcl-urpi.be"
 
 identity:
   mode: dev
@@ -33,14 +33,14 @@ ingress:
   className: traefik
   annotations: {}
   hosts:
-    - host: bananas-lcl.intern-urpi.be
+    - host: bananas.lcl-urpi.be
       paths:
         - path: /
           pathType: Prefix
   tls:
     - secretName: local-dev-cert
       hosts:
-        - bananas-lcl.intern-urpi.be
+        - bananas.lcl-urpi.be
 
 resources:
   limits:

deploy/helm/go-bananas/values-tst.yaml

@@ -2,7 +2,8 @@
 nameOverride: ""
 fullnameOverride: ""
 
-replicaCount: 1
+deployment:
+  replicaCount: 1
 
 image:
   repository: nexus.urpi.be/docker-hosted/go-bananas
@@ -13,6 +14,17 @@ service:
   type: ClusterIP
   port: 80
 
+# Spelled out here rather than inherited from values.yaml, whose default issuer
+# points at the development realm: a missing key would otherwise make the
+# testing release validate tokens against the development identity provider.
+identity:
+  mode: oidc
+  oidc:
+    issuer: https://auth.tst-urpi.be/realms/urpi
+    clientId: go-bananas
+    existingSecret: go-bananas-auth
+    generateSecret: false
+
 ingress:
   enabled: true
   className: nginx
@@ -20,20 +32,14 @@ ingress:
     cert-manager.io/cluster-issuer: letsencrypt-staging
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
   hosts:
-    - host: bananas-tst.intern-urpi.be
+    - host: bananas.tst-urpi.be
       paths:
         - path: /
           pathType: Prefix
   tls:
     - secretName: go-bananas-tls
       hosts:
-        - bananas-tst.intern-urpi.be
-
-certManager:
-  enabled: true
-  issuerRef:
-    name: letsencrypt-staging
-    kind: ClusterIssuer
+        - bananas.tst-urpi.be
 
 resources:
   limits:

deploy/helm/go-bananas/values.yaml

@@ -197,7 +197,7 @@ config:
 # replicaCount: 1, or a filesystem that permits multiple mounts.
 
 persistence:
-  enabled: true
+  enabled: false
   type: persistentVolumeClaim
   accessMode: ReadWriteOnce
   size: 2Gi
@@ -288,7 +288,7 @@ identity:
     # issuer: this string must match the `iss` claim in the ID token exactly,
     # including a trailing slash if the provider emits one. A mismatch here is the
     # single most common cause of "invalid issuer" at the callback.
-    issuer: "https://auth-dev.urpi.be/realms/urpi"
+    issuer: "https://auth.dev-urpi.be/realms/urpi"
 
     # clientId is the client identifier registered with the provider.
     clientId: "go-bananas"