initial commit

charts/api/templates/_helpers.tpl

@@ -0,0 +1,41 @@
+{{/*
+Full name.
+Used for naming resources like Deployments and Services.
+*/}}
+{{- define "go-places.fullname" -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Labels.
+Used to mark resources for selection.
+*/}}
+{{- define "go-places.labels" -}}
+helm.sh/chart: {{ include "go-places.chart" . }}
+{{ include "go-places.selectorLabels" . }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels.
+Used by a Service to find the pods it should route traffic to.
+*/}}
+{{- define "go-places.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "go-places.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Name template helper.
+*/}}
+{{- define "go-places.name" -}}
+{{- default .Chart.Name .Values.nameOverride -}}
+{{- end -}}
+
+{{/*
+Chart name helper.
+*/}}
+{{- define "go-places.chart" -}}
+{{- printf "%s-%s-%s" .Chart.Name .Chart.Version .Chart.AppVersion | replace "+" "_" -}}
+{{- end -}}

charts/api/templates/deployment.yaml

@@ -0,0 +1,99 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "go-places.fullname" . }}
+  labels:
+    {{- include "go-places.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  {{- if .Values.persistence.enabled }}
+  # Recreate, not RollingUpdate: the volume is ReadWriteOnce and SQLite allows a
+  # single writer, so the old pod must be gone before the new one mounts the
+  # claim and opens the database.
+  strategy:
+    type: Recreate
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "go-places.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "go-places.selectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        # The image runs as uid 10001. fsGroup makes the mounted volume group
+        # writable by that user, which is what allows the non-root process to
+        # create the database file and the media directory.
+        {{- if .Values.persistence.enabled }}
+        fsGroup: {{ .Values.securityContext.fsGroup }}
+        {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            # These names must match the variables read by
+            # internal/config.Load(). Unrecognised names are ignored, so a typo
+            # here would silently leave the service on its defaults.
+            - name: ADDR
+              value: ":8080"
+            - name: DATABASE_URL
+              value: {{ .Values.apiConfig.databaseURL | quote }}
+            - name: MEDIA_DIR
+              value: {{ .Values.apiConfig.mediaDir | quote }}
+            - name: PUBLIC_BASE_URL
+              value: {{ .Values.apiConfig.publicBaseURL | quote }}
+            # "jwt" verifies the HS256 tokens go-loose issues. The secret is
+            # referenced rather than inlined so it can come from a Secret.
+            - name: AUTH_MODE
+              value: {{ .Values.apiConfig.authMode | quote }}
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.apiConfig.jwtSecretName | quote }}
+                  key: {{ .Values.apiConfig.jwtSecretKey | quote }}
+                  optional: true
+            - name: JWT_AUDIENCE
+              value: {{ .Values.apiConfig.jwtAudience | quote }}
+            - name: ANALYZER_MODE
+              value: {{ .Values.apiConfig.analyzerMode | quote }}
+            - name: ANALYZER_URL
+              value: {{ .Values.apiConfig.analyzerUrl | quote }}
+            - name: LOG_FORMAT
+              value: {{ .Values.apiConfig.logFormat | quote }}
+            {{- if .Values.apiConfig.amqpUrl }}
+            # Event publishing is off unless a broker URL is given; without it
+            # the service logs events instead.
+            - name: AMQP_URL
+              value: {{ .Values.apiConfig.amqpUrl | quote }}
+            {{- end }}
+            - name: EVENTS_EXCHANGE
+              value: {{ .Values.apiConfig.eventsExchange | quote }}
+          {{- with .Values.probes.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.probes.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ .Values.persistence.mountPath | quote }}
+      volumes:
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.existingClaim | default (printf "%s-data" (include "go-places.fullname" .)) }}
+          {{- else }}
+          # Without persistence the service still runs, but the database and every
+          # uploaded picture are lost whenever the pod is replaced.
+          emptyDir: {}
+          {{- end }}

charts/api/templates/pvc.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "go-places.fullname" . }}-data
+  labels:
+    {{- include "go-places.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    {{- toYaml .Values.persistence.accessModes | nindent 4 }}
+  {{- if .Values.persistence.storageClass }}
+  # An empty storageClassName would ask for dynamic provisioning from *no*
+  # class, which leaves the claim Pending, so the field is only emitted when a
+  # class is actually named.
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- end }}

charts/api/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "go-places.fullname" . }}
+  labels:
+    {{- include "go-places.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }} # Should be ClusterIP for internal communication
+  ports:
+    - port: {{ .Values.service.port }} # Port the Service exposes internally
+      targetPort: http # TargetPort should match the containerPort in deployment.yaml
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "go-places.selectorLabels" . | nindent 4 }}