chore: testing build

2026-10-10 18:58:32 +02:00 · 2026-10-10 18:58:32 +02:00 · 8942383ff9
commit 8942383ff9
parent d3ee64282d
13 changed files with 353 additions and 44 deletions
--- a/deploy/helm/go-loose/Chart.yaml
+++ b/deploy/helm/go-loose/Chart.yaml
@ -2,7 +2,7 @@ apiVersion: v2
 name: go-loose
 description: Authentication and authorization service for urpi platform. Provides OIDC, session management, and tenant isolation.
 type: application
-version: 1.0.0
+version: 1.1.0
 appVersion: "1.0.0"
 kubeVersion: ">=1.28.0-0"
 dependencies:
--- a/deploy/helm/go-loose/README.md
+++ b/deploy/helm/go-loose/README.md
@ -0,0 +1,81 @@
+# Go Loose Helm chart
+
+This is the canonical Go Loose chart. The central deploy script and the Go Loose
+CI workflow both use this directory.
+
+## Environment profiles
+
+Use one profile file per environment:
+
+| Environment | Namespace | Profile | Ingress class | TLS issuer |
+|---|---|---|---|---|
+| `dev` | `go-insane-dev` | `values-dev.yaml` | nginx | `letsencrypt-staging` |
+| `tst` | `go-insane-tst` | `values-tst.yaml` | nginx | `letsencrypt-staging` |
+| `prd` | `go-insane-prd` | `values-prd.yaml` | nginx | `letsencrypt-prod` |
+| `lcl` | `go-insane-lcl` | `values-lcl.yaml` | Traefik | local TLS |
+
+The namespace is supplied by Helm's release namespace; it is not hard-coded in
+the chart templates.
+
+## Runtime Secret contract
+
+Before a release, the target namespace must contain `go-loose-runtime` with:
+
+| Key | Used for |
+|---|---|
+| `postgresql-password` | PostgreSQL application user's password |
+| `postgres-password` | PostgreSQL administrator password |
+| `database-url` | `GO_LOOSE_DATABASE_URL` |
+| `session-secret` | `GO_LOOSE_SESSION_SECRET` |
+
+The chart reads these values using Kubernetes `secretKeyRef` and the PostgreSQL
+subchart's `existingSecret` support. Runtime credentials are not stored in chart
+values or Helm release configuration.
+
+To provision/update the secret from protected files without printing its values:
+
+```bash
+/home/dnoulet/go/ops/scripts/apply-go-loose-secret.sh \
+  <dev|tst|prd|lcl> \
+  /secure/path/postgresql-password \
+  /secure/path/database-url \
+  /secure/path/session-secret \
+  [kubeconfig]
+```
+
+The input files should contain only the required value (no trailing newline).
+The helper creates the environment namespace if it is not present, then applies
+the Secret. It does not print secret values.
+
+The PRD CI deployment script maintains the same secret contract automatically.
+Do not commit the input files or put their contents in a Helm values file.
+
+## Tenant wildcard ingress
+
+Go Guess signs in through tenant-specific hosts such as
+`nmbs.auth.dev-urpi.be` and `nmbs.auth.urpi.be`. The chart therefore
+creates a second ingress for `*.auth-<env>...` and requires a separate TLS Secret
+named `go-loose-wildcard-tls` in the same namespace. The central deploy script
+and PRD CI check for this Secret before installing the release.
+
+Provision it from a trusted wildcard certificate and private key:
+
+```bash
+kubectl --kubeconfig <kubeconfig> --namespace go-insane-<env> create secret tls \
+  go-loose-wildcard-tls --cert=/secure/path/wildcard.crt \
+  --key=/secure/path/wildcard.key
+```
+
+The PRD `letsencrypt-prod` issuer documented for the apex ingress uses HTTP-01;
+HTTP-01 cannot issue wildcard certificates. Obtain this certificate through
+DNS-01 or the approved certificate authority, then provision the Secret. Do not
+put the private key in the chart, repository, or Helm release values.
+
+## Validation
+
+```bash
+helm lint . -f values-dev.yaml
+helm lint . -f values-tst.yaml
+helm lint . -f values-prd.yaml
+helm lint . -f values-lcl.yaml
+```
--- a/deploy/helm/go-loose/templates/deployment.yaml
+++ b/deploy/helm/go-loose/templates/deployment.yaml
@ -40,14 +40,20 @@ spec:
              containerPort: {{ .Values.service.targetPort }}
              protocol: TCP
          env:
+            - name: GO_LOOSE_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.runtimeSecret.name }}
+                  key: {{ .Values.runtimeSecret.keys.databaseURL }}
+            - name: GO_LOOSE_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.runtimeSecret.name }}
+                  key: {{ .Values.runtimeSecret.keys.sessionSecret }}
            {{- range $key, $value := .Values.env }}
            - name: {{ $key }}
              value: {{ $value | quote }}
            {{- end }}
-            {{- range $key, $value := .Values.envSecrets }}
-            - name: {{ $key }}
-              value: {{ $value | quote }}
-            {{- end }}
          livenessProbe:
            {{- toYaml .Values.livenessProbe | nindent 12 }}
          readinessProbe:
@ -65,4 +71,4 @@ spec:
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- end }}
--- a/deploy/helm/go-loose/templates/secret.yaml
+++ b/deploy/helm/go-loose/templates/secret.yaml
@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "go-loose.fullname" . }}-env
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "go-loose.labels" . | nindent 4 }}
-type: Opaque
-stringData:
-  {{- range $key, $value := .Values.envSecrets }}
-  {{ $key }}: {{ $value | quote }}
-  {{- end }}
--- a/deploy/helm/go-loose/templates/wildcard-ingress.yaml
+++ b/deploy/helm/go-loose/templates/wildcard-ingress.yaml
@ -0,0 +1,30 @@
+{{- if .Values.wildcardIngress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "go-loose.fullname" . }}-wildcard
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "go-loose.labels" . | nindent 4 }}
+  {{- with .Values.wildcardIngress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: {{ .Values.wildcardIngress.className }}
+  tls:
+    - secretName: {{ .Values.wildcardIngress.tlsSecretName }}
+      hosts:
+        - {{ .Values.wildcardIngress.host | quote }}
+  rules:
+    - host: {{ .Values.wildcardIngress.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "go-loose.fullname" . }}
+                port:
+                  number: {{ .Values.service.port }}
+{{- end }}
--- a/deploy/helm/go-loose/values-dev.yaml
+++ b/deploy/helm/go-loose/values-dev.yaml
@ -0,0 +1,46 @@
+replicaCount: 1
+
+image:
+  repository: nexus.urpi.be/docker-hosted/go-loose
+  tag: latest
+  pullPolicy: Always
+
+imagePullSecrets:
+  - name: nexus-registry
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  hosts:
+    - host: auth.dev-urpi.be
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: go-loose-dev-tls
+      hosts:
+        - auth.dev-urpi.be
+
+wildcardIngress:
+  enabled: true
+  className: nginx
+  host: "*.auth.dev-urpi.be"
+  tlsSecretName: go-loose-wildcard-tls
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+
+postgresql:
+  primary:
+    persistence:
+      enabled: true
+      size: 5Gi
+
+env:
+  GO_LOOSE_BASE_URL: https://auth.dev-urpi.be
+  GO_LOOSE_AUTH_DOMAIN: auth.dev-urpi.be
+  GO_LOOSE_OIDC_REDIRECT_URL: https://auth.dev-urpi.be/auth/callback
+  GO_LOOSE_DEV_LOGIN: "true"
+  GO_LOOSE_LOCAL_LOGIN: "true"
--- a/deploy/helm/go-loose/values-lcl.yaml
+++ b/deploy/helm/go-loose/values-lcl.yaml
@ -0,0 +1,65 @@
+replicaCount: 1
+imagePullSecrets: []
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    cert-manager.io/cluster-issuer: urpi-private-ca
+  hosts:
+    # Apex only. The tenant hosts are served by wildcardIngress below, so that
+    # each host family keeps its own certificate: go-loose-lcl-tls covers the
+    # apex, go-loose-wildcard-tls covers *.auth.lcl-urpi.be.
+    - host: auth.lcl-urpi.be
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: go-loose-lcl-tls
+      hosts:
+        - auth.lcl-urpi.be
+
+# Serves every <tenant>.auth.lcl-urpi.be. Adding a tenant is then a row in the
+# database only: no Helm upgrade, no new certificate, no per-host rule.
+wildcardIngress:
+  enabled: true
+  className: traefik
+  host: "*.auth.lcl-urpi.be"
+  tlsSecretName: go-loose-wildcard-tls
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+
+certManager:
+  enabled: true
+  issuerRef:
+    name: urpi-private-ca
+    kind: ClusterIssuer
+
+postgresql:
+  enabled: true
+  image:
+    # Bitnami removed its versioned tags from Docker Hub; only :latest remains
+    # for bitnami/postgresql. The tag pinned in values.yaml (16.4.0) now 404s
+    # and leaves the StatefulSet in ImagePullBackOff.
+    tag: "latest"
+  auth:
+    database: goloose
+    username: goloose
+    password: "goloose"
+    existingSecret: go-loose-runtime
+    secretKeys:
+      adminPasswordKey: postgres-password
+      userPasswordKey: postgresql-password
+  primary:
+    persistence:
+      enabled: false
+      size: 5Gi
+
+env:
+  GO_LOOSE_ADDR: ":8080"
+  GO_LOOSE_BASE_URL: "https://lcl-urpi.be"
+  GO_LOOSE_AUTH_DOMAIN: "auth.lcl-urpi.be"
+  GO_LOOSE_OIDC_REDIRECT_URL: "https://lcl-urpi.be/auth/callback"
+  GO_LOOSE_DEV_LOGIN: "true"
+  GO_LOOSE_LOCAL_LOGIN: "true"
+  GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS: "true"
--- a/deploy/helm/go-loose/values-prd.yaml
+++ b/deploy/helm/go-loose/values-prd.yaml
@ -5,7 +5,7 @@ imagePullSecrets:
  - name: nexus-registry

 image:
-  repository: nexus-registry.urpi.be/docker-hosted/go-loose
+  repository: nexus.urpi.be/docker-hosted/go-loose
  tag: "0.0.1"
  pullPolicy: Always

@ -16,9 +16,10 @@ service:

 ingress:
  enabled: true
-  className: traefik
+  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
 #    nginx.ingress.kubernetes.io/ssl-redirect: "true"
 #    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
  hosts:
@ -31,6 +32,14 @@ ingress:
      hosts:
        - auth.urpi.be

+wildcardIngress:
+  enabled: true
+  className: nginx
+  host: "*.auth.urpi.be"
+  tlsSecretName: go-loose-wildcard-tls
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+
 certManager:
  enabled: true
  issuerRef:
@ -69,13 +78,9 @@ env:
  GO_LOOSE_AUTH_DOMAIN: "auth.urpi.be"
  GO_LOOSE_OIDC_REDIRECT_URL: "https://auth.urpi.be/auth/callback"
  GO_LOOSE_DEV_LOGIN: "false"
-  GO_LOOSE_LOCAL_LOGIN: "true"
+  GO_LOOSE_LOCAL_LOGIN: "false"
  GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS: "true"

-envSecrets:
-  GO_LOOSE_DATABASE_URL: "postgres://goloose:changeme@go-loose-postgresql:5432/goloose?sslmode=disable"
-  GO_LOOSE_SESSION_SECRET: "changeme-generate-secure-random"
-
 livenessProbe:
  httpGet:
    path: /healthz
@ -92,4 +97,4 @@ readinessProbe:
  initialDelaySeconds: 10
  periodSeconds: 10
  timeoutSeconds: 3
-  failureThreshold: 3
+  failureThreshold: 3
--- a/deploy/helm/go-loose/values-tst.yaml
+++ b/deploy/helm/go-loose/values-tst.yaml
@ -0,0 +1,46 @@
+replicaCount: 1
+
+image:
+  repository: nexus.urpi.be/docker-hosted/go-loose
+  tag: latest
+  pullPolicy: Always
+
+imagePullSecrets:
+  - name: nexus-registry
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  hosts:
+    - host: auth.tst-urpi.be
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: go-loose-tst-tls
+      hosts:
+        - auth.tst-urpi.be
+
+wildcardIngress:
+  enabled: true
+  className: nginx
+  host: "*.auth.tst-urpi.be"
+  tlsSecretName: go-loose-wildcard-tls
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+
+postgresql:
+  primary:
+    persistence:
+      enabled: true
+      size: 5Gi
+
+env:
+  GO_LOOSE_BASE_URL: https://auth.tst-urpi.be
+  GO_LOOSE_AUTH_DOMAIN: auth.tst-urpi.be
+  GO_LOOSE_OIDC_REDIRECT_URL: https://auth.tst-urpi.be/auth/callback
+  GO_LOOSE_DEV_LOGIN: "false"
+  GO_LOOSE_LOCAL_LOGIN: "false"
--- a/deploy/helm/go-loose/values.yaml
+++ b/deploy/helm/go-loose/values.yaml
@ -54,6 +54,13 @@ ingress:
      hosts:
        - auth.urpi.be

+wildcardIngress:
+  enabled: false
+  className: nginx
+  host: "*.auth.urpi.be"
+  tlsSecretName: go-loose-wildcard-tls
+  annotations: {}
+
 certManager:
  enabled: true
  issuerRef:
@ -74,12 +81,24 @@ autoscaling:
  maxReplicas: 3
  targetCPUUtilizationPercentage: 80

+runtimeSecret:
+  name: go-loose-runtime
+  keys:
+    databaseURL: database-url
+    sessionSecret: session-secret
+
 postgresql:
  enabled: true
+  image:
+    tag: "16.4.0"
  auth:
    database: goloose
    username: goloose
-    password: changeme
+    password: "goloose"
+    existingSecret: go-loose-runtime
+    secretKeys:
+      adminPasswordKey: postgres-password
+      userPasswordKey: postgresql-password
  primary:
    persistence:
      enabled: true
@ -98,13 +117,9 @@ env:
  GO_LOOSE_AUTH_DOMAIN: "auth.urpi.be"
  GO_LOOSE_OIDC_REDIRECT_URL: "https://auth.urpi.be/auth/callback"
  GO_LOOSE_DEV_LOGIN: "false"
-  GO_LOOSE_LOCAL_LOGIN: "true"
+  GO_LOOSE_LOCAL_LOGIN: "false"
  GO_LOOSE_ALLOW_PRIVATE_CONTRACT_URLS: "true"

-envSecrets:
-  GO_LOOSE_DATABASE_URL: ""
-  GO_LOOSE_SESSION_SECRET: ""
-
 livenessProbe:
  httpGet:
    path: /healthz
@ -125,4 +140,4 @@ readinessProbe:

 nodeSelector: {}
 tolerations: []
-affinity: {}
+affinity: {}