initial commit
Some checks failed
ci / go (push) Has been cancelled
ci / admin-ui (push) Has been cancelled
ci / runtime-sdk (push) Has been cancelled
ci / helm (push) Has been cancelled
ci / openapi (push) Has been cancelled
ci / container (push) Has been cancelled
ci / release-config (push) Has been cancelled
ci / shared styling (push) Has been cancelled
ci / security (push) Has been cancelled
ci / all green (push) Has been cancelled
Some checks failed
ci / go (push) Has been cancelled
ci / admin-ui (push) Has been cancelled
ci / runtime-sdk (push) Has been cancelled
ci / helm (push) Has been cancelled
ci / openapi (push) Has been cancelled
ci / container (push) Has been cancelled
ci / release-config (push) Has been cancelled
ci / shared styling (push) Has been cancelled
ci / security (push) Has been cancelled
ci / all green (push) Has been cancelled
This commit is contained in:
Daniel Noulet
commit
951dd8d26b
175 changed files with 50041 additions and 0 deletions
120
deploy/dev/realm-go-bananas.json
Normal file
120
deploy/dev/realm-go-bananas.json
Normal file
|
|
@ -0,0 +1,120 @@
|
|||
{
|
||||
"realm": "go-bananas-dev",
|
||||
"enabled": true,
|
||||
"displayName": "go-bananas (development)",
|
||||
"sslRequired": "none",
|
||||
"registrationAllowed": true,
|
||||
"registrationEmailAsUsername": true,
|
||||
"rememberMe": true,
|
||||
"verifyEmail": false,
|
||||
"loginWithEmailAllowed": true,
|
||||
"duplicateEmailsAllowed": false,
|
||||
"resetPasswordAllowed": true,
|
||||
"editUsernameAllowed": false,
|
||||
"bruteForceProtected": false,
|
||||
"accessTokenLifespan": 300,
|
||||
"ssoSessionIdleTimeout": 1800,
|
||||
"ssoSessionMaxLifespan": 36000,
|
||||
"clients": [
|
||||
{
|
||||
"clientId": "go-bananas",
|
||||
"name": "go-bananas",
|
||||
"description": "The theme service: admin UI and runtime API.",
|
||||
"enabled": true,
|
||||
"protocol": "openid-connect",
|
||||
"publicClient": false,
|
||||
"secret": "go-bananas-dev-secret",
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"redirectUris": [
|
||||
"http://localhost:8080/auth/callback",
|
||||
"http://localhost:5173/auth/callback"
|
||||
],
|
||||
"webOrigins": [
|
||||
"http://localhost:8080",
|
||||
"http://localhost:5173"
|
||||
],
|
||||
"attributes": {
|
||||
"pkce.code.challenge.method": "S256",
|
||||
"post.logout.redirect.uris": "http://localhost:8080/*"
|
||||
},
|
||||
"defaultClientScopes": [
|
||||
"openid",
|
||||
"profile",
|
||||
"email",
|
||||
"groups",
|
||||
"roles"
|
||||
],
|
||||
"optionalClientScopes": [
|
||||
"offline_access"
|
||||
]
|
||||
}
|
||||
],
|
||||
"roles": {
|
||||
"realm": [
|
||||
{ "name": "bananas-admin", "description": "Full administrative access." },
|
||||
{ "name": "bananas-editor", "description": "Create and publish themes." },
|
||||
{ "name": "bananas-viewer", "description": "Read-only access." }
|
||||
]
|
||||
},
|
||||
"groups": [
|
||||
{
|
||||
"name": "bananas-admins",
|
||||
"path": "/bananas-admins",
|
||||
"attributes": { "displayName": "go-bananas administrators" }
|
||||
},
|
||||
{
|
||||
"name": "bananas-editors",
|
||||
"path": "/bananas-editors",
|
||||
"attributes": { "displayName": "go-bananas editors" }
|
||||
},
|
||||
{
|
||||
"name": "bananas-viewers",
|
||||
"path": "/bananas-viewers",
|
||||
"attributes": { "displayName": "go-bananas viewers" }
|
||||
}
|
||||
],
|
||||
"users": [
|
||||
{
|
||||
"username": "admin",
|
||||
"email": "admin@go-bananas.local",
|
||||
"firstName": "Dev",
|
||||
"lastName": "Admin",
|
||||
"emailVerified": true,
|
||||
"enabled": true,
|
||||
"credentials": [
|
||||
{ "type": "password", "value": "admin", "temporary": false }
|
||||
],
|
||||
"groups": ["/bananas-admins"],
|
||||
"realmRoles": ["bananas-admin"]
|
||||
},
|
||||
{
|
||||
"username": "editor",
|
||||
"email": "editor@go-bananas.local",
|
||||
"firstName": "Dev",
|
||||
"lastName": "Editor",
|
||||
"emailVerified": true,
|
||||
"enabled": true,
|
||||
"credentials": [
|
||||
{ "type": "password", "value": "editor", "temporary": false }
|
||||
],
|
||||
"groups": ["/bananas-editors"],
|
||||
"realmRoles": ["bananas-editor"]
|
||||
},
|
||||
{
|
||||
"username": "viewer",
|
||||
"email": "viewer@go-bananas.local",
|
||||
"firstName": "Dev",
|
||||
"lastName": "Viewer",
|
||||
"emailVerified": true,
|
||||
"enabled": true,
|
||||
"credentials": [
|
||||
{ "type": "password", "value": "viewer", "temporary": false }
|
||||
],
|
||||
"groups": ["/bananas-viewers"],
|
||||
"realmRoles": ["bananas-viewer"]
|
||||
}
|
||||
]
|
||||
}
|
||||
90
deploy/dev/values-dev-cluster.yaml
Normal file
90
deploy/dev/values-dev-cluster.yaml
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
# go-bananas on the development cluster.
|
||||
#
|
||||
# Reproduce with:
|
||||
#
|
||||
# helm upgrade --install go-bananas deploy/helm/go-bananas \
|
||||
# --namespace go-insane-dev -f deploy/dev/values-dev-cluster.yaml \
|
||||
# --server-side=false --disable-openapi-validation \
|
||||
# --wait
|
||||
#
|
||||
# Two flags are needed for this cluster specifically, and neither is a chart defect.
|
||||
#
|
||||
# --server-side=false The cluster's OpenAPI validation is incomplete:
|
||||
# it rejects `imagePullPolicy` and `lifecycle` at
|
||||
# `spec.template.spec` as undeclared fields on a
|
||||
# k8s 1.36 API server. A hand-written Deployment
|
||||
# with those two fields fails the same way. Helm 4
|
||||
# uses server-side apply by default, which hits it.
|
||||
# --disable-openapi-validation The same broken schema, on the client side.
|
||||
#
|
||||
# Nothing else in the cluster needs these; they are here so this release is
|
||||
# reproducible rather than "whatever worked when it was deployed".
|
||||
|
||||
image:
|
||||
# The development cluster pulls from a private registry whose certificate is valid
|
||||
# for a different name, so the host and the port have to stay in one piece: putting
|
||||
# the port in `repository` renders an image reference without it, and the kubelet
|
||||
# then resolves the registry over https on port 443.
|
||||
registry: batty1039.startdedicated.net:5000
|
||||
repository: go-bananas
|
||||
# The development registry is tagged `latest` rather than pinned to a version, to
|
||||
# match every other release in this namespace. Consequently the pull policy must be
|
||||
# Always: with IfNotPresent a node keeps serving the image it already has, and a
|
||||
# redeploy silently does nothing.
|
||||
tag: latest
|
||||
pullPolicy: Always
|
||||
|
||||
config:
|
||||
# development, which is what permits the dev identity mode below. The application
|
||||
# refuses both of these outside a development environment, so this pair cannot be
|
||||
# promoted to production by accident.
|
||||
environment: development
|
||||
publicBaseUrl: https://bananas-dev.urpi.be
|
||||
|
||||
identity:
|
||||
# dev, not oidc.
|
||||
#
|
||||
# OIDC is the correct production mode and the chart is wired for it, but it cannot
|
||||
# be used here yet: the cluster's CoreDNS returns NXDOMAIN for public names, so the
|
||||
# issuer is unreachable from inside the cluster and the pod crash-loops in OIDC
|
||||
# discovery. That is a cluster DNS problem, not a chart one, and it also explains why
|
||||
# no certificate in this namespace has been issued.
|
||||
#
|
||||
# To switch, create the secret and set the OIDC values:
|
||||
#
|
||||
# kubectl create secret generic go-bananas-auth -n go-insane-dev \
|
||||
# --from-literal=session-secret="$(openssl rand -base64 48)" \
|
||||
# --from-literal=oidc-client-secret='<from the provider>'
|
||||
#
|
||||
# helm upgrade ... --set identity.mode=oidc \
|
||||
# --set identity.oidc.generateSecret=false \
|
||||
# --set identity.oidc.existingSecret=go-bananas-auth \
|
||||
# --set identity.oidc.issuer=https://auth-dev.urpi.be \
|
||||
# --set identity.oidc.clientId=go-bananas
|
||||
mode: dev
|
||||
oidc:
|
||||
issuer: https://auth-dev.urpi.be
|
||||
clientId: go-bananas
|
||||
existingSecret: go-bananas-auth
|
||||
generateSecret: false
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
hosts:
|
||||
- host: bananas-dev.urpi.be
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: go-bananas-tls
|
||||
hosts:
|
||||
- bananas-dev.urpi.be
|
||||
|
||||
deployment:
|
||||
# One replica. The volume is ReadWriteOnce, so a second replica cannot mount it and
|
||||
# would sit in ImagePullBackOff-equivalent limbo forever. Scaling needs either this
|
||||
# changed to 1 or a ReadWriteMany filesystem.
|
||||
replicaCount: 1
|
||||
Loading…
Add table
Add a link
Reference in a new issue