Helm-Charts to make dbiam-server deployable

.github/workflows/image-to-ghcr.yml

@@ -0,0 +1,111 @@
+name: Image to GHCR
+
+on:
+  push:
+    branches-ignore:
+      - dependabot/**
+
+permissions:
+  contents: read
+
+jobs:
+  branch_meta:
+    runs-on: ubuntu-latest
+    outputs:
+      branch: ${{ steps.extract_branch_meta.outputs.branch }}
+      sha: ${{ steps.extract_branch_meta.outputs.sha }}
+    steps:
+      - name: Extract branch meta
+        shell: bash
+        id: extract_branch_meta
+        run: |
+          echo "lowercase_repo=${GITHUB_REPOSITORY,,}" >> $GITHUB_OUTPUT
+          if [ "${{ github.event_name }}" == 'pull_request' ]; then
+            echo "branch=${{ github.event.pull_request.head.ref }}" >> $GITHUB_OUTPUT
+            echo "sha=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
+          else
+            echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
+            echo "sha=${{ github.sha }}" >> $GITHUB_OUTPUT
+          fi
+
+  build_and_push:
+    runs-on: ubuntu-latest
+    needs:
+      - branch_meta
+    permissions:
+      packages: write
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Login to registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Lowercase REPO name
+        run: |
+          echo "LOWERCASE_REPO=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
+
+      - name: Docker meta Service Name
+        id: docker_meta_img
+        uses: docker/metadata-action@v4
+        with:
+          images: ghcr.io/${{ env.LOWERCASE_REPO }}
+          tags: |
+            type=ref,event=branch,enable=false,priority=600
+            type=sha,enable=true,priority=600,prefix=
+
+      - name: Test existence of Image
+        run: |
+          echo "IMAGE_EXISTS=$(docker manifest inspect ghcr.io/${{ env.LOWERCASE_REPO }}/${{needs.branch_meta.outputs.branch}}:${{ needs.branch_meta.outputs.sha }} > /dev/null && echo 1 || echo 0)" >> $GITHUB_ENV
+
+      - name: Set up Docker Buildx
+        if: ${{ env.IMAGE_EXISTS == 0 }}
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build and push ${{ github.repository }}
+        if: ${{ env.IMAGE_EXISTS == 0 }}
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          push: true
+          # temporarily change this to latest to make deployment 
+          # tags: ghcr.io/${{ env.LOWERCASE_REPO }}:${{ needs.branch_meta.outputs.sha }}
+          tags: ghcr.io/${{ env.LOWERCASE_REPO }}/${{needs.branch_meta.outputs.branch}}:latest
+          labels: ${{ steps.docker_meta_img.outputs.labels }}
+
+  # trivy-vulnerability-scanning:
+  #   needs:
+  #     - build_and_push
+  #     - branch_meta
+  #   runs-on: ubuntu-latest
+  #   permissions:
+  #     actions: read
+  #     contents: read
+  #     security-events: write
+  #   steps:
+  #     - name: Lowercase REPO name
+  #       run: |
+  #         echo "LOWERCASE_REPO=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
+
+  #     - name: Run trivy vulnerability scanner
+  #       uses: aquasecurity/trivy-action@9ab158e8597f3b310480b9a69402b419bc03dbd5
+  #       with:
+  #         # image-ref: 'ghcr.io/${{ env.LOWERCASE_REPO }}:${{ needs.branch_meta.outputs.sha }}'
+            # image-ref: 'ghcr.io/${{ env.LOWERCASE_REPO }}:latest'
+  #         format: 'sarif'
+  #         output: 'trivy-results.sarif'
+  #         severity: 'CRITICAL,HIGH'
+  #         ignore-unfixed: true
+
+  #     - name: Upload trivy results
+  #       if: ${{ always() }}
+  #       uses: github/codeql-action/upload-sarif@v2
+  #       with:
+  #         sarif_file: 'trivy-results.sarif'

Dockerfile

@@ -0,0 +1,26 @@
+ARG BASE_IMAGE=node:20.5.1-alpine3.17
+FROM $BASE_IMAGE as deployment
+
+WORKDIR /app
+
+COPY tsconfig*.json ./
+COPY package*.json ./
+
+RUN npm ci
+
+COPY src/ src/
+
+RUN npm run build
+
+FROM $BASE_IMAGE
+ENV NODE_ENV=prod
+
+WORKDIR /app
+COPY package*.json ./
+COPY config/ ./config/
+
+RUN npm ci --omit-dev
+
+COPY --from=deployment /app/dist/ ./dist/
+
+CMD [ "node", "dist/src/server/main.js" ]

charts/dbildungs-iam/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: dbildungs-iam
+version: 0.1.0
+
+description: dBildungs-IAM
+type: application

charts/dbildungs-iam/templates/dbildungs-iam-deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-deployment
+  labels:
+    app.kubernetes.io/name: dbildungs-iam
+spec:
+  selector:
+    matchLabels:
+      layer: dbildungs-iam-backend
+  replicas: {{.Values.dbildungsIamReplications}}
+  template:
+    metadata:
+      name: dbildungs-iam
+      labels:
+        layer: dbildungs-iam-backend
+    spec:
+      containers:
+        - name: dbildungs-iam
+          image: {{.Values.dbildungsIamContainer}}
+          imagePullPolicy: Always
+          ports:
+             - name: web
+               containerPort: 8080
+          env:
+            - name: NODE_ENV
+              value: {{.Values.environment}}
+            - name: DEPLOY_STAGE
+              value: {{.Values.environment}}
+          volumeMounts:
+            - mountPath: /app/config/
+              name: config
+              readOnly: true
+          resources:
+            limits:
+              cpu: {{.Values.dbildungsIamCpuMax}}
+              memory: {{.Values.dbildungsIamMemMax}}
+          livenessProbe:
+            initialDelaySeconds: 10
+            httpGet:
+              port: 8080
+              scheme: 'HTTP'
+              path: '/health'
+          readinessProbe:
+            initialDelaySeconds: 10
+            httpGet:
+              port: 8080
+              scheme: 'HTTP'
+              path: '/health'
+      restartPolicy: Always
+      volumes:
+        - name: config
+          secret:
+            secretName: {{.Values.secrets.name | default (print .Release.Name "-secret")}}
+

charts/dbildungs-iam/templates/dbildungs-iam-ingress.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{.Release.Name}}-backend
+  labels:
+    app.kubernetes.io/name: dbildungs-iam
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: {{.Values.backendHostname}}
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: dbiam
+                port:
+                  number: 80
+          - path: /docs
+            pathType: Prefix
+            backend:
+              service:
+                name: dbiam
+                port:
+                  number: 80

charts/dbildungs-iam/templates/dbildungs-iam-service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: dbiam
+  labels:
+    app.kubernetes.io/name: dbildungs-iam
+spec:
+  selector:
+    layer: dbildungs-iam-backend
+  ports:
+    - protocol: TCP
+      name: web
+      port: {{.Values.dbildungsIamExternalPort}}
+      targetPort: web
+  type: ClusterIP
+

charts/dbildungs-iam/templates/dbildungs-iam-servicemonitor.yaml

@@ -0,0 +1,14 @@
+{{if .Values.enableServiceMonitor}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{.Release.Name}}-servicemonitor
+spec:
+  namespaceSelector:
+    any: true
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: dbildungs-iam
+  endpoints:
+    - port: web
+  {{end}}

charts/dbildungs-iam/values.yaml

@@ -0,0 +1,23 @@
+dbildungsIamContainer: "ghcr.io/dbildungsplattform/dbildungs-iam-server/feature/helm-integration:latest"
+
+dbildungsIamExternalPort: 80
+dbildungsIamCpuMax: 2
+dbildungsIamMemMax: 4G
+dbildungsIamReplications: 1
+environment: prod
+
+backendHostname: helm.dev.spsh.dbildungsplattform.de
+
+configfile:
+  secrets: 'config/secrets.json'
+  dev: 'config/config.dev.json'
+  test: 'config/config.test.json'
+  prod: 'config/config.prod.json'
+  local: 'config/config.local.json'
+
+# Configuration of necessary secrets
+# Name of the secrets to inject
+secrets:
+  name: spsh-config
+# If we're running inside an environment with a Prometheus-Operator installed we configure a service monitor
+enableServiceMonitor: false

charts/keycloak-dev/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: dbildungs-iam-keycloak-dev
+version: 0.1.0
+
+description: dBildungs-IAM Keycloak for local deployment
+type: application

charts/keycloak-dev/templates/dbildungs-iam-deployment-keycloak.yaml

@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-keycloak-deployment
+  labels:
+    app.kubernetes.io/name: dbildungs-iam
+spec:
+  selector:
+    matchLabels:
+      layer: dbildungs-iam-keycloak
+  replicas: 1
+  template:
+    metadata:
+      name: dbildungs-iam-keycloak
+      labels:
+        layer: dbildungs-iam-keycloak
+    spec:
+      containers:
+        - name: dbildungs-iam-keycloak
+          image: quay.io/keycloak/keycloak:22.0.3
+          args:
+            - start-dev
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: web
+              containerPort: 8080
+          env:
+            - name: KEYCLOAK_ADMIN
+              value: admin
+            - name: KEYCLOAK_ADMIN_PASSWORD
+              value: admin
+      restartPolicy: Always
+

charts/keycloak-dev/templates/dbildungs-iam-service-keycloak.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak
+  labels:
+    app.kubernetes.io/name: dbildungs-iam
+spec:
+  selector:
+    layer: dbildungs-iam-keycloak
+  ports:
+    - protocol: TCP
+      name: web
+      port: {{.Values.dbildungsIamExternalPort}}80
+      targetPort: web
+  type: ClusterIP
+