dnoulet/go-tell
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

deploy configuration

Browse source
This commit is contained in:
Daniel Noulet 2026-10-03 04:41:31 +02:00
parent 9ba3c47d82
commit dac02c61c3
45 changed files with 1405 additions and 582 deletions
Download patch file Download diff file Expand all files Collapse all files

6
deploy/helm/cms/Chart.yaml
View file

@ -1,6 +0,0 @@
apiVersion: v2
name: cms
description: CMS application
type: application
version: 0.1.0
appVersion: "0.1.0"

12
deploy/helm/cms/templates/NOTES.txt
View file

@ -1,12 +0,0 @@
CMS has been installed in namespace {{ .Release.Namespace }}.
{{- if .Values.ingress.enabled }}
Open the host configured in ingress.hosts.
{{- else if eq .Values.service.type "NodePort" }}
The application is exposed on cluster node port {{ .Values.service.nodePort }}.
Open it through the configured external reverse proxy.
{{- else }}
Run:
kubectl -n {{ .Release.Namespace }} port-forward service/{{ include "cms.fullname" . }} 8080:{{ .Values.service.port }}
Then open http://127.0.0.1:8080.
{{- end }}

33
deploy/helm/cms/templates/_helpers.tpl
View file

@ -1,33 +0,0 @@
{{- define "cms.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- define "cms.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{- define "cms.labels" -}}
helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
app.kubernetes.io/name: {{ include "cms.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{- define "cms.selectorLabels" -}}
app.kubernetes.io/name: {{ include "cms.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{- define "cms.secretName" -}}
{{- printf "%s-secrets" (include "cms.fullname" .) }}
{{- end }}

35
deploy/helm/cms/templates/ingress.yaml
View file

@ -1,35 +0,0 @@
{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ include "cms.fullname" . }}
labels:
{{- include "cms.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- with .Values.ingress.className }}
ingressClassName: {{ . }}
{{- end }}
{{- with .Values.ingress.tls }}
tls:
{{- toYaml . | nindent 4 }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
pathType: {{ .pathType }}
backend:
service:
name: {{ include "cms.fullname" $ }}
port:
number: {{ $.Values.service.port }}
{{- end }}
{{- end }}
{{- end }}

9
deploy/helm/cms/templates/secret.yaml
View file

@ -1,9 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ include "cms.secretName" . }}
labels:
{{- include "cms.labels" . | nindent 4 }}
type: Opaque
stringData:
sso-token: {{ .Values.secrets.ssoToken | quote }}

76
deploy/helm/cms/values.yaml
View file

@ -1,76 +0,0 @@
nameOverride: ""
fullnameOverride: ""
replicaCount: 1
image:
repository: batty1039.startdedicated.net:5000/cms
tag: latest
pullPolicy: IfNotPresent
imagePullSecrets: []
app:
environment: production
allowedOrigins: http://localhost:8080
contentFile: /data/content.json
postgresURL: ""
ssoHeader: X-SSO-Token
ssoCookie: ""
secrets:
ssoToken: ""
service:
type: ClusterIP
port: 80
nodePort: null
ingress:
enabled: false
className: nginx
annotations: {}
hosts:
- host: cms.local
paths:
- path: /
pathType: Prefix
tls: []
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
podAnnotations: {}
podLabels: {}
podSecurityContext:
fsGroup: 10001
fsGroupChangePolicy: OnRootMismatch
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
strategy:
type: Recreate
persistence:
enabled: true
size: 2Gi
accessModes:
- ReadWriteOnce
storageClass: ""
nodeSelector: {}
tolerations: []
affinity: {}

0
deploy/helm/cms/.helmignore → deploy/helm/go-tell/.helmignore
View file

6
deploy/helm/go-tell/Chart.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: v2
name: go-tell
description: Go Tell, a single-host content CMS behind Go Loose
type: application
version: 0.2.0
appVersion: "0.1.0"

221
deploy/helm/go-tell/README.md Normal file
View file

@ -0,0 +1,221 @@
# Go Tell Helm chart
This chart deploys Go Tell as one image: a Go binary that serves the API and
embeds the React frontend, with a persistent volume for the content file. It
publishes a single HTTPS host, `https://tell.dev`, behind ingress-nginx with a
certificate from cert-manager.
## 1. What the chart creates
| Resource | Name | Purpose |
|---|---|---|
| Deployment | `go-tell` | CMS binary, API and web UI in one container |
| Service | `go-tell` | Cluster-internal service, ingress backend |
| Ingress | `go-tell` | One rule and one TLS SAN for `tell.dev` |
| Issuer | `go-tell-selfsigned` | cert-manager self-signed issuer |
| Certificate | `go-tell-ca` | Chart CA that signs the leaf certificate |
| Certificate | `go-tell` | Leaf certificate for `tell.dev` |
| PersistentVolumeClaim | `go-tell` | Content file storage, `emptyDir` when disabled |
| Secret | `go-tell-secrets` | Go Loose client credentials and the proxy token |
There are no tenants and no per-tenant hosts: one release, one host, one
content file.
## 2. Prerequisites
- A Kubernetes cluster reachable through `KUBECONFIG`, by default
`~/.kube/config`.
- A `StorageClass` when `persistence.enabled` is `true`.
- ingress-nginx with the `nginx` ingress class: `make ingress-nginx-install`.
- cert-manager when `ingress.tls.enabled` is `true`: `make cert-manager-install`.
- Cluster nodes trusting `batty1039.startdedicated.net:5000` as an insecure
registry, or an HTTPS registry.
Run everything the chart depends on in one step:
```bash
make cluster-prepare
```
## 3. Deploy
```bash
make helm-lint
make helm-deploy-development
```
The development profile runs the demo profile on NodePort `30010` with
ephemeral content and Go Loose disabled, which is what `make frontend` talks to.
Production runs the persisted content file with browser sign-in:
```bash
export GO_LOOSE_CLIENT_ID=...
export GO_LOOSE_CLIENT_SECRET=...
make helm-deploy-production
```
Credentials are never written into a values file. They reach the release
secret through `--set`, or through the `GO_LOOSE_CLIENT_ID` and
`GO_LOOSE_CLIENT_SECRET` secrets of the deploy workflow. The chart refuses to
render when `goLoose.enabled` is true and either of them is missing, because a
release without credentials would have no way to sign anybody in.
After a successful install the release notes list the URL and the command that
exports the CA certificate. With the local platform, prefer
`docs/KUBERNETES-DEPLOYMENTS.md` in the infrastructure repository, which covers
`/etc/hosts` entries and CA trust for the whole platform.
## 4. The single host
`host` is the only host the release serves:
```yaml
host: tell.dev
```
The chart derives, without any extra configuration:
- One ingress rule for that host.
- One certificate SAN for that host, so a single secret covers the release.
- `GO_LOOSE_APP_DOMAIN`, which the API turns into the redirect URI
`https://tell.dev/api/auth/callback`.
That redirect URI has to be registered on the Go Loose application together with
the client id and secret. `goLoose.tenant` names the Go Loose tenant that owns
the login, which decides where the browser is sent first:
```
https://tell.dev/api/auth/login
-> https://tell.auth.dev/connect/authorize
-> https://tell.dev/api/auth/callback
```
## 5. Values
### Top level
| Key | Default | Description |
|---|---|---|
| `nameOverride` | `""` | Overrides the chart name in resource names and labels |
| `fullnameOverride` | `""` | Replaces the generated resource name prefix |
| `host` | `tell.dev` | Public host of the CMS |
| `replicaCount` | `1` | CMS replicas, the content file is shared through the volume |
| `imagePullSecrets` | `[]` | Pull secrets added to the pod |
| `nodeSelector`, `tolerations`, `affinity` | empty | Scheduling of the deployment |
### image and app
| Key | Default | Description |
|---|---|---|
| `image.repository` | `batty1039.startdedicated.net:5000/go-tell` | CMS image |
| `image.tag` | `latest` | CMS image tag |
| `image.pullPolicy` | `IfNotPresent` | CMS pull policy |
| `app.profile` | `production` | `CMS_PROFILE`, `demo` enables the in-memory seed and the sudo terminal |
| `app.allowedOrigins` | `https://tell.dev` | `CMS_ALLOWED_ORIGINS` |
| `app.contentFile` | `/data/content.json` | `CMS_CONTENT_FILE`, ignored when persistence is disabled |
| `app.postgresURL` | `""` | `CMS_POSTGRES_URL`, reserved for the PostgreSQL adapter |
| `app.ssoHeader` | `X-SSO-Token` | `CMS_SSO_HEADER`, empty disables the proxy identity |
| `app.ssoCookie` | `""` | `CMS_SSO_COOKIE`, cookie carrying the same value |
| `app.resources` | `100m`/`128Mi` to `500m`/`512Mi` | Requests and limits |
| `app.podAnnotations`, `app.podLabels` | `{}` | Extra pod metadata |
### goLoose
| Key | Default | Description |
|---|---|---|
| `goLoose.enabled` | `true` | Injects the Go Loose environment into the pod |
| `goLoose.tenant` | `tell` | Go Loose tenant that owns the login, one DNS label |
| `goLoose.authDomain` | `auth.dev` | Identity domain shared by every Go Loose tenant |
| `goLoose.appDomain` | `tell.dev` | Public host, which determines the redirect URI |
| `goLoose.clientID` | `""` | Client id of the Go Loose application, required when enabled |
| `goLoose.clientSecret` | `""` | Client secret of the Go Loose application, required when enabled |
| `goLoose.ca.existingSecret` | `""` | Secret holding the CA bundle of an internally signed identity domain |
| `goLoose.ca.key` | `ca.crt` | Key projected from that secret |
| `goLoose.ca.mountPath` | `/certs/local-ca.crt` | `GO_LOOSE_CA_FILE` target |
| `secrets.ssoToken` | `""` | Shared secret the proxy header value must match |
The CA bundle is only mounted when `goLoose.ca.existingSecret` is set. A
publicly signed identity domain therefore needs no extra configuration, while an
internally signed one, such as the local platform, has to publish its
certificate first:
```bash
kubectl -n go-tell-production create secret generic local-ca --from-file=ca.crt=certs/local-ca.crt
```
### ingress and certManager
| Key | Default | Description |
|---|---|---|
| `ingress.enabled` | `true` | Creates the ingress |
| `ingress.className` | `nginx` | Ingress class of the controller |
| `ingress.annotations` | TLS redirect | Controller annotations |
| `ingress.path` | `/` | Path routed to the service |
| `ingress.pathType` | `Prefix` | Path type of that route |
| `ingress.tls.enabled` | `true` | Terminates TLS on the controller |
| `ingress.tls.secretName` | `""` | Defaults to `<fullname>-tls` |
| `ingress.tls.existingSecret` | `""` | Uses a certificate managed outside the chart |
| `certManager.enabled` | `true` | Chart creates the certificates |
| `certManager.issuerRef` | `{}` | Uses an existing issuer instead of the chart CA |
| `certManager.duration` | `8760h` | Certificate lifetime |
| `certManager.renewBefore` | `720h` | Renewal window |
| `certManager.caSecretName` | `""` | Defaults to `<fullname>-ca` |
Four certificate objects are created: a self-signed `Issuer`, a CA
`Certificate` stored in `caSecretName`, an `Issuer` that serves that CA, and the
leaf `Certificate` stored in the ingress TLS secret for `host`. Set
`certManager.issuerRef` to sign with a cluster issuer instead:
```yaml
certManager:
issuerRef:
name: internal-acme
kind: ClusterIssuer
group: cert-manager.io
```
Set `ingress.tls.existingSecret` to use a certificate the chart does not own,
and `certManager.enabled: false` to stop emitting cert-manager objects.
### Storage and pod security
| Key | Default | Description |
|---|---|---|
| `persistence.enabled` | `true` | Persistent volume for the content file |
| `persistence.size` | `2Gi` | Volume size |
| `persistence.accessModes` | `[ReadWriteOnce]` | Volume access modes |
| `persistence.storageClass` | `""` | Storage class, the cluster default when empty |
| `podSecurityContext` | `fsGroup: 10001` | Pod security context, gives the volume to the image user |
| `securityContext` | non-root `10001`, read-only root filesystem | Container security context |
| `strategy.type` | `Recreate` | The old pod releases the volume before the new one starts |
The image runs as its own `go-tell` user (uid `10001`) and declares no
`HOME`, so `readOnlyRootFilesystem` needs the writable `/tmp` mount the chart
adds.
## 6. Upgrade and remove
```bash
make helm-deploy-production
helm -n go-tell-production history go-tell
helm -n go-tell-production rollback go-tell 1
make helm-down-production
```
Keep the Go Loose credentials outside the cluster: uninstalling removes the
release secret, and Go Loose shows a new secret only once.
## 7. Verify
```bash
kubectl -n go-tell-production get ingress go-tell
kubectl -n go-tell-production get certificate
kubectl -n go-tell-production rollout status deployment/go-tell
curl --resolve tell.dev:443:127.0.0.1 --cacert go-tell-ca.crt https://tell.dev/health
curl -I --cacert go-tell-ca.crt https://tell.dev/api/auth/login
```
The login request must answer `302` towards
`https://tell.auth.dev/connect/authorize`; a `404` means the release has no Go
Loose credentials. The test pod installed by `helm test` checks the health
endpoint from inside the cluster.

35
deploy/helm/go-tell/templates/NOTES.txt Normal file
View file

@ -0,0 +1,35 @@
Go Tell is installed in namespace {{ .Release.Namespace }}.
{{- if .Values.ingress.enabled }}
Open https://{{ .Values.host }}/.
{{- if .Values.goLoose.enabled }}
Signing in goes through Go Loose:
1. https://{{ .Values.goLoose.tenant }}.{{ .Values.goLoose.authDomain }}/connect/authorize redirects to
https://{{ .Values.goLoose.appDomain }}/api/auth/callback.
2. That redirect URI has to be registered on the Go Loose application, next
to client id {{ .Values.goLoose.clientID }}.
{{- end }}
{{- if .Values.ingress.tls.enabled }}
{{- if .Values.certManager.enabled }}
{{- if not .Values.certManager.issuerRef }}
The certificate is issued by the self-signed chain in this release. Export the
root once so the browser trusts it:
kubectl -n {{ .Release.Namespace }} get secret {{ include "go-tell.certManagerCASecretName" . }} \
-o jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt
{{- end }}
{{- end }}
{{- end }}
{{- else if eq .Values.service.type "NodePort" }}
The application is exposed on cluster node port {{ .Values.service.nodePort }}.
Open it through the configured external reverse proxy.
{{- else }}
Run:
kubectl -n {{ .Release.Namespace }} port-forward service/{{ include "go-tell.fullname" . }} 8080:{{ .Values.service.port }}
Then open http://127.0.0.1:8080.
{{- end }}

77
deploy/helm/go-tell/templates/_helpers.tpl Normal file
View file

@ -0,0 +1,77 @@
{{- define "go-tell.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- define "go-tell.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{- define "go-tell.labels" -}}
helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
app.kubernetes.io/name: {{ include "go-tell.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{- define "go-tell.selectorLabels" -}}
app.kubernetes.io/name: {{ include "go-tell.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{- define "go-tell.secretName" -}}
{{- printf "%s-secrets" (include "go-tell.fullname" .) }}
{{- end }}
{{- define "go-tell.certManagerCASecretName" -}}
{{- default (printf "%s-ca" (include "go-tell.fullname" .)) .Values.certManager.caSecretName }}
{{- end }}
{{- define "go-tell.tlsSecretName" -}}
{{- default (printf "%s-tls" (include "go-tell.fullname" .)) .Values.ingress.tls.secretName }}
{{- end }}
{{- define "go-tell.certManagerIssuerRef" -}}
{{- if kindIs "map" .Values.certManager.issuerRef }}
name: {{ required "certManager.issuerRef.name is required when certManager.issuerRef is set" .Values.certManager.issuerRef.name }}
kind: {{ default "Issuer" .Values.certManager.issuerRef.kind }}
group: {{ default "cert-manager.io" .Values.certManager.issuerRef.group }}
{{- else }}
name: {{ .Values.certManager.issuerRef }}
kind: Issuer
group: cert-manager.io
{{- end }}
{{- end }}
{{/*
CA bundle used to verify the identity domain. Mounted only when the operator
points goLoose.ca.existingSecret at a certificate, so a publicly signed identity
domain needs no extra configuration.
*/}}
{{- define "go-tell.caVolume" -}}
{{- if and .Values.goLoose.enabled .Values.goLoose.ca.existingSecret }}
- name: go-loose-ca
secret:
secretName: {{ .Values.goLoose.ca.existingSecret }}
items:
- key: {{ .Values.goLoose.ca.key }}
path: {{ base .Values.goLoose.ca.mountPath }}
{{- end }}
{{- end }}
{{- define "go-tell.caVolumeMount" -}}
{{- if and .Values.goLoose.enabled .Values.goLoose.ca.existingSecret }}
- name: go-loose-ca
mountPath: {{ dir .Values.goLoose.ca.mountPath }}
readOnly: true
{{- end }}
{{- end }}

42
deploy/helm/cms/templates/app-deployment.yaml → deploy/helm/go-tell/templates/app-deployment.yaml
View file

@ -1,16 +1,16 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "cms.fullname" . }}
name: {{ include "go-tell.fullname" . }}
labels:
{{- include "cms.labels" . | nindent 4 }}
{{- include "go-tell.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.replicaCount }}
strategy:
type: {{ .Values.strategy.type }}
selector:
matchLabels:
{{- include "cms.selectorLabels" . | nindent 6 }}
{{- include "go-tell.selectorLabels" . | nindent 6 }}
app.kubernetes.io/component: application
template:
metadata:
@ -20,7 +20,7 @@ spec:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "cms.selectorLabels" . | nindent 8 }}
{{- include "go-tell.selectorLabels" . | nindent 8 }}
app.kubernetes.io/component: application
{{- with .Values.podLabels }}
{{- toYaml . | nindent 8 }}
@ -34,14 +34,14 @@ spec:
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: cms
- name: go-tell
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
env:
- name: CMS_PROFILE
value: {{ .Values.app.environment | quote }}
value: {{ .Values.app.profile | quote }}
- name: CMS_ALLOWED_ORIGINS
value: {{ .Values.app.allowedOrigins | quote }}
- name: CMS_CONTENT_FILE
@ -55,8 +55,30 @@ spec:
- name: CMS_SSO_TOKEN
valueFrom:
secretKeyRef:
name: {{ include "cms.secretName" . }}
name: {{ include "go-tell.secretName" . }}
key: sso-token
{{- if .Values.goLoose.enabled }}
- name: GO_LOOSE_TENANT
value: {{ .Values.goLoose.tenant | quote }}
- name: GO_LOOSE_AUTH_DOMAIN
value: {{ .Values.goLoose.authDomain | quote }}
- name: GO_LOOSE_APP_DOMAIN
value: {{ .Values.goLoose.appDomain | quote }}
- name: GO_LOOSE_CLIENT_ID
valueFrom:
secretKeyRef:
name: {{ include "go-tell.secretName" . }}
key: go-loose-client-id
- name: GO_LOOSE_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: {{ include "go-tell.secretName" . }}
key: go-loose-client-secret
{{- if .Values.goLoose.ca.existingSecret }}
- name: GO_LOOSE_CA_FILE
value: {{ .Values.goLoose.ca.mountPath | quote }}
{{- end }}
{{- end }}
ports:
- name: http
containerPort: 8080
@ -86,14 +108,16 @@ spec:
- name: content
mountPath: /data
{{- end }}
{{- include "go-tell.caVolumeMount" . | nindent 12 }}
volumes:
- name: temporary-files
emptyDir: {}
{{- if .Values.persistence.enabled }}
- name: content
persistentVolumeClaim:
claimName: {{ include "cms.fullname" . }}
claimName: {{ include "go-tell.fullname" . }}
{{- end }}
{{- include "go-tell.caVolume" . | nindent 8 }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
@ -105,4 +129,4 @@ spec:
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}

6
deploy/helm/cms/templates/app-service.yaml → deploy/helm/go-tell/templates/app-service.yaml
View file

@ -1,13 +1,13 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "cms.fullname" . }}
name: {{ include "go-tell.fullname" . }}
labels:
{{- include "cms.labels" . | nindent 4 }}
{{- include "go-tell.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
selector:
{{- include "cms.selectorLabels" . | nindent 4 }}
{{- include "go-tell.selectorLabels" . | nindent 4 }}
app.kubernetes.io/component: application
ports:
- name: http

74
deploy/helm/go-tell/templates/certificate.yaml Normal file
View file

@ -0,0 +1,74 @@
{{- if and .Values.ingress.enabled .Values.ingress.tls.enabled .Values.certManager.enabled (not .Values.ingress.tls.existingSecret) }}
{{- $fullname := include "go-tell.fullname" . }}
{{- $caSecret := include "go-tell.certManagerCASecretName" . }}
{{- $tlsSecret := include "go-tell.tlsSecretName" . }}
{{- if not .Values.certManager.issuerRef }}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ $fullname }}-selfsigned
labels:
{{- include "go-tell.labels" . | nindent 4 }}
app.kubernetes.io/component: certificate
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ $fullname }}-ca
labels:
{{- include "go-tell.labels" . | nindent 4 }}
app.kubernetes.io/component: certificate
spec:
secretName: {{ $caSecret }}
commonName: {{ printf "%s-ca" $fullname }}
duration: {{ .Values.certManager.duration }}
renewBefore: {{ .Values.certManager.renewBefore }}
privateKey:
algorithm: ECDSA
size: 256
issuerRef:
name: {{ $fullname }}-selfsigned
kind: Issuer
group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ $fullname }}-ca
labels:
{{- include "go-tell.labels" . | nindent 4 }}
app.kubernetes.io/component: certificate
spec:
ca:
secretName: {{ $caSecret }}
---
{{- end }}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ $fullname }}
labels:
{{- include "go-tell.labels" . | nindent 4 }}
app.kubernetes.io/component: certificate
spec:
secretName: {{ $tlsSecret }}
duration: {{ .Values.certManager.duration }}
renewBefore: {{ .Values.certManager.renewBefore }}
privateKey:
algorithm: ECDSA
size: 256
usages:
- server auth
dnsNames:
- {{ .Values.host | quote }}
issuerRef:
{{- if .Values.certManager.issuerRef }}
{{- include "go-tell.certManagerIssuerRef" . | nindent 4 }}
{{- else }}
name: {{ $fullname }}-ca
kind: Issuer
group: cert-manager.io
{{- end }}
{{- end }}

33
deploy/helm/go-tell/templates/ingress.yaml Normal file
View file

@ -0,0 +1,33 @@
{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ include "go-tell.fullname" . }}
labels:
{{- include "go-tell.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- with .Values.ingress.className }}
ingressClassName: {{ . }}
{{- end }}
{{- if .Values.ingress.tls.enabled }}
tls:
- hosts:
- {{ .Values.host | quote }}
secretName: {{ .Values.ingress.tls.existingSecret | default (include "go-tell.tlsSecretName" .) }}
{{- end }}
rules:
- host: {{ .Values.host | quote }}
http:
paths:
- path: {{ .Values.ingress.path }}
pathType: {{ .Values.ingress.pathType }}
backend:
service:
name: {{ include "go-tell.fullname" . }}
port:
number: {{ .Values.service.port }}
{{- end }}

4
deploy/helm/cms/templates/persistent-volume-claim.yaml → deploy/helm/go-tell/templates/persistent-volume-claim.yaml
View file

@ -2,9 +2,9 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ include "cms.fullname" . }}
name: {{ include "go-tell.fullname" . }}
labels:
{{- include "cms.labels" . | nindent 4 }}
{{- include "go-tell.labels" . | nindent 4 }}
spec:
accessModes:
{{- toYaml .Values.persistence.accessModes | nindent 4 }}

20
deploy/helm/go-tell/templates/secret.yaml Normal file
View file

@ -0,0 +1,20 @@
{{- $name := include "go-tell.secretName" . -}}
{{- if and .Values.goLoose.enabled (not .Values.goLoose.clientID) }}
{{- fail "goLoose.clientID is required when goLoose.enabled is true" }}
{{- end }}
{{- if and .Values.goLoose.enabled (not .Values.goLoose.clientSecret) }}
{{- fail "goLoose.clientSecret is required when goLoose.enabled is true" }}
{{- end }}
apiVersion: v1
kind: Secret
metadata:
name: {{ $name }}
labels:
{{- include "go-tell.labels" . | nindent 4 }}
type: Opaque
data:
sso-token: {{ .Values.secrets.ssoToken | b64enc | quote }}
{{- if .Values.goLoose.enabled }}
go-loose-client-id: {{ .Values.goLoose.clientID | b64enc | quote }}
go-loose-client-secret: {{ .Values.goLoose.clientSecret | b64enc | quote }}
{{- end }}

6
deploy/helm/cms/templates/tests/test-connection.yaml → deploy/helm/go-tell/templates/tests/test-connection.yaml
View file

@ -1,9 +1,9 @@
apiVersion: v1
kind: Pod
metadata:
name: "{{ include "cms.fullname" . }}-test-connection"
name: "{{ include "go-tell.fullname" . }}-test-connection"
labels:
{{- include "cms.labels" . | nindent 4 }}
{{- include "go-tell.labels" . | nindent 4 }}
annotations:
helm.sh/hook: test
helm.sh/hook-delete-policy: before-hook-creation
@ -17,4 +17,4 @@ spec:
- wget
args:
- -qO-
- "http://{{ include "cms.fullname" . }}:{{ .Values.service.port }}/health"
- "http://{{ include "go-tell.fullname" . }}:{{ .Values.service.port }}/health"

8
deploy/helm/cms/values-development.yaml → deploy/helm/go-tell/values-development.yaml
View file

@ -1,12 +1,14 @@
image:
tag: latest
pullPolicy: Always
app:
environment: demo
profile: demo
allowedOrigins: http://localhost:30010
contentFile: ""
goLoose:
enabled: false
service:
type: NodePort
nodePort: 30010
@ -23,4 +25,4 @@ resources:
memory: 384Mi
persistence:
enabled: false
enabled: false

13
deploy/helm/cms/values-production.yaml → deploy/helm/go-tell/values-production.yaml
View file

@ -1,18 +1,13 @@
image:
tag: latest
pullPolicy: IfNotPresent
app:
environment: demo
allowedOrigins: https://cms.urpi.be
profile: production
allowedOrigins: https://tell.dev
contentFile: /data/content.json
service:
type: NodePort
nodePort: 31373
ingress:
enabled: false
type: ClusterIP
resources:
requests:
@ -24,4 +19,4 @@ resources:
persistence:
enabled: true
size: 5Gi
size: 5Gi

116
deploy/helm/go-tell/values.yaml Normal file
View file

@ -0,0 +1,116 @@
nameOverride: ""
fullnameOverride: ""
# Public host of the CMS. There is one release, one host, and no tenant
# routing: every visitor reaches the same content and the same editor.
host: tell.dev
replicaCount: 1
image:
repository: batty1039.startdedicated.net:5000/go-tell
tag: latest
pullPolicy: IfNotPresent
imagePullSecrets: []
app:
# Demo keeps content in memory and offers the sudo terminal. Production serves
# the persisted file and requires an authenticated editor.
profile: production
allowedOrigins: https://tell.dev
contentFile: /data/content.json
postgresURL: ""
# Single-sign-on proxy identity, kept as a fallback when Go Loose is not
# configured. An empty header disables it.
ssoHeader: X-SSO-Token
ssoCookie: ""
goLoose:
enabled: true
# Go Loose tenant that owns the login, the shared identity domain, and the
# public host of the CMS. Together they produce the base URL
# https://<tenant>.<authDomain> and the redirect URI
# https://<appDomain>/api/auth/callback that has to be registered in Go Loose.
tenant: tell
authDomain: auth.dev
appDomain: tell.dev
ca:
# Mount an internal CA bundle and point GO_LOOSE_CA_FILE at it when the
# identity domain is signed by a private authority.
existingSecret: ""
key: ca.crt
mountPath: /certs/local-ca.crt
clientID: ""
clientSecret: ""
secrets:
# Shared secret the identity-aware proxy must present in the SSO header. Empty
# accepts any non-empty forwarded value.
ssoToken: ""
service:
type: ClusterIP
port: 80
nodePort: null
ingress:
enabled: true
className: nginx
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
path: /
pathType: Prefix
tls:
enabled: true
# Use a certificate you already manage instead of the chart-issued one.
existingSecret: ""
# Defaults to <fullname>-tls when empty and certManager.enabled is true.
secretName: ""
certManager:
# Requires cert-manager in the cluster: make cert-manager-install.
enabled: true
# Reuse an existing cert-manager issuer instead of creating a self-signed one.
issuerRef: {}
duration: 8760h
renewBefore: 720h
caSecretName: ""
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
podAnnotations: {}
podLabels: {}
podSecurityContext:
fsGroup: 10001
fsGroupChangePolicy: OnRootMismatch
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
strategy:
type: Recreate
persistence:
enabled: true
size: 2Gi
accessModes:
- ReadWriteOnce
storageClass: ""
nodeSelector: {}
tolerations: []
affinity: {}

51
deploy/nginx/README.md
View file

@ -1,51 +0,0 @@
# Dedicated-server reverse proxy
Production exposes the CMS application through Kubernetes NodePort `31373`.
## DNS
In one.com, create an `A` record for `cms.urpi.be` pointing to the dedicated
server's public IPv4 address. Add an `AAAA` record only when the server and its
firewall are configured for public IPv6. Wait for:
```bash
dig +short cms.urpi.be
```
to return the dedicated server address before requesting a certificate.
## Nginx and Certbot
The included virtual host assumes Nginx runs on the Kubernetes node and can
reach the NodePort at `127.0.0.1:31373`.
```bash
sudo install -m 0644 deploy/nginx/cms.urpi.be.conf \
/etc/nginx/sites-available/cms.urpi.be.conf
sudo ln -s /etc/nginx/sites-available/cms.urpi.be.conf \
/etc/nginx/sites-enabled/cms.urpi.be.conf
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d cms.urpi.be
sudo certbot renew --dry-run
```
Certbot adds the HTTPS listener, certificate paths, and HTTP-to-HTTPS redirect
to this virtual host. Allow inbound TCP ports `80` and `443`. Do not expose
NodePort `31373` to the public internet. If Nginx is not on a Kubernetes node, replace
`127.0.0.1` in `proxy_pass` with a private cluster-node address and allow
`31373` only from the Nginx server.
## Deploy and verify
Deploy the production profile:
```bash
make helm-deploy-production
kubectl -n cms-production get pods
kubectl -n cms-production get service cms
curl --fail http://127.0.0.1:31373/health
curl --fail https://cms.urpi.be/health
```
The `cms` service should show `80:31373/TCP`.

21
deploy/nginx/cms.urpi.be.conf
View file

@ -1,21 +0,0 @@
server {
listen 80;
listen [::]:80;
server_name cms.urpi.be;
client_max_body_size 10m;
location / {
proxy_pass http://127.0.0.1:31373;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Connection "";
proxy_buffering off;
proxy_request_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
}

188
deploy/rancher/local-path.yaml
View file

@ -1,188 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
name: local-path-storage
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: local-path-provisioner-service-account
namespace: local-path-storage
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: local-path-provisioner-role
namespace: local-path-storage
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "watch", "create", "patch", "update", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: local-path-provisioner-role
rules:
- apiGroups: [""]
resources: ["nodes", "persistentvolumeclaims", "configmaps", "pods", "pods/log"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["persistentvolumes"]
verbs: ["get", "list", "watch", "create", "patch", "update", "delete"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]
- apiGroups: ["storage.k8s.io"]
resources: ["storageclasses"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: local-path-provisioner-bind
namespace: local-path-storage
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: local-path-provisioner-role
subjects:
- kind: ServiceAccount
name: local-path-provisioner-service-account
namespace: local-path-storage
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: local-path-provisioner-bind
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: local-path-provisioner-role
subjects:
- kind: ServiceAccount
name: local-path-provisioner-service-account
namespace: local-path-storage
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: local-path-provisioner
namespace: local-path-storage
spec:
replicas: 1
selector:
matchLabels:
app: local-path-provisioner
template:
metadata:
labels:
app: local-path-provisioner
spec:
serviceAccountName: local-path-provisioner-service-account
containers:
- name: local-path-provisioner
image: docker.io/rancher/local-path-provisioner:v0.0.37
imagePullPolicy: IfNotPresent
command:
- local-path-provisioner
- --debug
- start
- --config
- /etc/config/config.json
ports:
- name: health
containerPort: 8080
protocol: TCP
startupProbe:
httpGet:
path: /health
port: health
initialDelaySeconds: 5
periodSeconds: 5
failureThreshold: 12
livenessProbe:
httpGet:
path: /health
port: health
initialDelaySeconds: 10
periodSeconds: 10
readinessProbe:
httpGet:
path: /ready
port: health
initialDelaySeconds: 5
periodSeconds: 5
volumeMounts:
- name: config-volume
mountPath: /etc/config/
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: CONFIG_MOUNT_PATH
value: /etc/config/
- name: HEALTH_PORT
value: "8080"
volumes:
- name: config-volume
configMap:
name: local-path-config
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: local-path
annotations:
storageclass.kubernetes.io/is-default-class: "true"
provisioner: rancher.io/local-path
volumeBindingMode: WaitForFirstConsumer
reclaimPolicy: Retain
---
kind: ConfigMap
apiVersion: v1
metadata:
name: local-path-config
namespace: local-path-storage
data:
config.json: |-
{
"nodePathMap":[
{
"node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
"paths":["/var/lib/rancher/k3s/storage"]
}
]
}
setup: |-
#!/bin/sh
set -eu
mkdir -m 0777 -p "$VOL_DIR"
teardown: |-
#!/bin/sh
set -eu
rm -rf "$VOL_DIR"
helperPod.yaml: |-
apiVersion: v1
kind: Pod
metadata:
name: helper-pod
spec:
priorityClassName: system-node-critical
tolerations:
- key: node.kubernetes.io/disk-pressure
operator: Exists
effect: NoSchedule
containers:
- name: helper-pod
image: docker.io/library/busybox
imagePullPolicy: IfNotPresent

9
deploy/rancher/registries.yaml
View file

@ -1,9 +0,0 @@
mirrors:
"batty1039.startdedicated.net:5000":
endpoint:
- "http://batty1039.startdedicated.net:5000"
configs:
"batty1039.startdedicated.net:5000":
tls:
insecure_skip_verify: true