Add helm chart

helm/cmsch/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/cmsch/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: cmsch
+type: application
+
+version: 1.0.0

helm/cmsch/templates/cmsch-config.yml

@@ -0,0 +1,59 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+  name: {{ .Release.Name }}-config
+data:
+  FRONTEND_URL: "https://{{ .Values.frontendHost }}"
+  ALLOWED_ORIGIN_PATTERNS: {{ .Values.allowedOriginPatterns | quote }}
+  BACKEND_URL: "https://{{ .Values.apiHost }}/"
+  SYSADMINS: {{ .Values.superusers.pekIds | quote }}
+  GOOGLE_ADMIN_ADDRESSES: {{ .Values.superusers.googleEmails | quote }}
+
+  LOAD_APP: {{ .Values.load.app | quote }}
+  LOAD_LOGIN: {{ .Values.load.login | quote }}
+  LOAD_PROFILE: {{ .Values.load.profile | quote }}
+  LOAD_IMPRESSUM: {{ .Values.load.impressum | quote }}
+  LOAD_PROTO: {{ .Values.load.proto | quote }}
+  LOAD_ERRORLOG: {{ .Values.load.errorlog | quote }}
+  LOAD_ACCESS_KEYS: {{ .Values.load.access_keys | quote }}
+  LOAD_ADMISSION: {{ .Values.load.admission | quote }}
+  LOAD_BMEJEGY: {{ .Values.load.bmejegy | quote }}
+  LOAD_CHALLANGE: {{ .Values.load.challange | quote }}
+  LOAD_COMMUNITIES: {{ .Values.load.communities | quote }}
+  LOAD_CONFERENCE: {{ .Values.load.conference | quote }}
+  LOAD_COUNTDOWN: {{ .Values.load.countdown | quote }}
+  LOAD_DEBT: {{ .Values.load.debt | quote }}
+  LOAD_EMAIL: {{ .Values.load.email | quote }}
+  LOAD_FORM: {{ .Values.load.form | quote }}
+  LOAD_GROUPSELECTION: {{ .Values.load.groupselection | quote }}
+  LOAD_HOME: {{ .Values.load.home | quote }}
+  LOAD_LEADERBOARD: {{ .Values.load.leaderboard | quote }}
+  LOAD_LOCATION: {{ .Values.load.location | quote }}
+  LOAD_MESSAGING: {{ .Values.load.messaging | quote }}
+  LOAD_NEWS: {{ .Values.load.news | quote }}
+  LOAD_QRFIGHT: {{ .Values.load.qrfight | quote }}
+  LOAD_RACE: {{ .Values.load.race | quote }}
+  LOAD_RIDDLE: {{ .Values.load.riddle | quote }}
+  LOAD_STATIC_PAGE: {{ .Values.load.static_page | quote }}
+  LOAD_TASK: {{ .Values.load.task | quote }}
+  LOAD_TEAM: {{ .Values.load.team | quote }}
+  LOAD_TOKEN: {{ .Values.load.token | quote }}
+  LOAD_EVENT: {{ .Values.load.event | quote }}
+  LOAD_PUSHNOTIFICATION: {{ .Values.load.pushnotification | quote }}
+  LOAD_SHEETS: {{ .Values.load.sheets | quote }}
+
+  OWNER_TOKEN: {{ .Values.owner.token | quote }}
+  OWNER_TASK: {{ .Values.owner.task | quote }}
+  OWNER_RIDDLE: {{ .Values.owner.riddle | quote }}
+  OWNER_FORM: {{ .Values.owner.form | quote }}
+  OWNER_CHALLENGE: {{ .Values.owner.challenge | quote }}
+  OWNER_RACE: {{ .Values.owner.race | quote }}
+
+  MS_MASTER_ROLE: {{ .Values.riddle.masterRole | quote }}
+  RIDDLE_MICROSERVICE: {{ .Values.riddle.microservice | quote }}
+  MANAGEMENT_TOKEN: {{ .Values.riddle.managementToken | quote }}
+  MS_NODE_NAME: {{ .Values.riddle.msNodeName | quote }}
+  METRICS_NAME: {{ .Release.Name | quote }}
+  SWAGGER_ENABLED: {{ .Values.swaggerEnabled | quote }}

helm/cmsch/templates/cmsch-deployment.yml

@@ -0,0 +1,92 @@
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Release.Name }}
+        kir-dev-spring-monitored: enabled
+      annotations:
+        prometheus.io/path: /actuator/prometheus
+        prometheus.io/port: "80"
+        prometheus.io/scrape: "true"
+    spec:
+      imagePullSecrets:
+        - name: {{ .Values.imagePullSecretName }}
+      volumes:
+        - name: {{ .Release.Name }}-pv
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-pv
+      containers:
+        - name: {{ .Release.Name }}
+          image: {{ .Values.apiImage }}
+          ports:
+            - name: web
+              containerPort: 80
+              protocol: TCP
+          envFrom:
+            - secretRef:
+                name: {{ .Release.Name }}-secrets
+            - configMapRef:
+                name: {{ .Release.Name }}-config
+            {{ if .Values.postgres.enabled }}
+            - secretRef:
+                name: {{ .Release.Name }}-postgres-secrets
+            - configMapRef:
+                name: {{ .Release.Name }}-postgres-config
+            {{ end }}
+          env:
+            {{ if .Values.postgres.enabled }}
+            - name: POSTGRES_PW
+              value: "$(POSTGRES_PASSWORD)"
+            - name: POSTGRES_IP
+              value: "$({{ .Release.Name | upper | replace "-" "_" }}_POSTGRES_SERVICE_HOST):$({{ .Release.Name | upper | replace "-" "_" }}_POSTGRES_SERVICE_PORT)"
+            {{ end }}
+            - name: CMSCH_SPRING_PROFILES
+              value: {{ .Values.springProfiles }}
+            - name: PORT
+              value: '80'
+          resources:
+            {{ if or (.Values.resources.limits.cpu) (.Values.resources.limits.memory) }}
+            limits:
+              {{ if .Values.resources.limits.cpu }}
+              cpu: {{ .Values.resources.limits.cpu }}
+              {{ end }}
+              {{ if .Values.resources.limits.memory }}
+              memory: {{ .Values.resources.limits.memory }}
+              {{ end }}
+            {{ end }}
+            requests:
+              cpu: {{ .Values.resources.requests.cpu }}
+              memory: {{ .Values.resources.requests.memory }}
+          volumeMounts:
+            - name: {{ .Release.Name }}-pv
+              mountPath: /pv
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: {{ .Values.imagePullPolicy }}
+          livenessProbe:
+            httpGet:
+              path: /actuator/health/liveness
+              port: 80
+            initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
+            failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      dnsPolicy: ClusterFirst
+      securityContext: { }
+      schedulerName: default-scheduler
+  strategy:
+    type: {{ .Values.deploymentStrategy }}
+  revisionHistoryLimit: 10
+  progressDeadlineSeconds: 600

helm/cmsch/templates/cmsch-ingress.yml

@@ -0,0 +1,36 @@
+kind: Ingress
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+  annotations:
+    cert-manager.io/cluster-issuer: le-http01
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: 'true'
+    nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.ingress.maxBodySize }}
+spec:
+  tls:
+    - hosts:
+        - {{ .Values.apiHost }}
+      secretName: {{ .Release.Name }}-cert
+  rules:
+    - host: {{ .Values.apiHost }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}
+                port:
+                  number: 80
+          {{ if .Values.blockActuatorEndpoints }}
+          - path: /actuator/
+            pathType: Prefix
+            backend:
+              service:
+                name: default-backend
+                port:
+                  number: 80
+          {{ end }}

helm/cmsch/templates/cmsch-postgres-config.yml

@@ -0,0 +1,12 @@
+{{ if .Values.postgres.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/component: postgres
+  name: {{ .Release.Name }}-postgres-config
+data:
+  POSTGRES_DB: {{ .Values.postgres.db | quote }}
+  POSTGRES_DDL: {{ .Values.postgres.ddl | quote }}
+{{end}}

helm/cmsch/templates/cmsch-postgres-deployment.yml

@@ -0,0 +1,57 @@
+{{ if .Values.postgres.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/component: postgres
+  name: {{ .Release.Name }}-postgres
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ .Release.Name }}
+      app.kubernetes.io/component: postgres
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ .Release.Name }}
+        app.kubernetes.io/component: postgres
+    spec:
+      containers:
+        - image: "postgres:{{ .Values.postgres.tagName }}"
+          name: {{ .Release.Name }}-postgres
+          resources:
+            {{ if or (.Values.postgres.resources.limits.cpu) (.Values.postgres.resources.limits.memory) }}
+            limits:
+              {{ if .Values.postgres.resources.limits.cpu }}
+              cpu: {{ .Values.postgres.resources.limits.cpu }}
+              {{ end }}
+              {{ if .Values.postgres.resources.limits.memory }}
+              memory: {{ .Values.postgres.resources.limits.memory }}
+              {{ end }}
+            {{ end }}
+            requests:
+              cpu: {{ .Values.postgres.resources.requests.cpu }}
+              memory: {{ .Values.postgres.resources.requests.memory }}
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: {{ .Release.Name }}-postgres
+              mountPath: /var/lib/postgresql/data
+          envFrom:
+            - secretRef:
+                name: {{ .Release.Name }}-postgres-secrets
+            - configMapRef:
+                name: {{ .Release.Name }}-postgres-config
+      restartPolicy: Always
+      volumes:
+        - name: {{ .Release.Name }}-postgres
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-postgres
+        - name: {{ .Release.Name }}-postgres-secrets
+          secret:
+            secretName: {{ .Release.Name }}-postgres-secrets
+{{end}}

helm/cmsch/templates/cmsch-postgres-pvc.yml

@@ -0,0 +1,19 @@
+{{ if .Values.postgres.enabled }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ .Release.Name }}-postgres
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/component: postgres
+  finalizers:
+    - kubernetes.io/pvc-protection
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 3Gi
+{{ end }}

helm/cmsch/templates/cmsch-postgres-secrets.yml

@@ -0,0 +1,13 @@
+{{ if .Values.postgres.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/component: postgres
+  name: {{ .Release.Name }}-postgres-secrets
+type: Opaque
+data:
+  POSTGRES_USER: {{ .Values.postgres.secret.user | b64enc }}
+  POSTGRES_PASSWORD: {{ .Values.postgres.secret.password | b64enc }}
+{{ end }}

helm/cmsch/templates/cmsch-postgres-service.yml

@@ -0,0 +1,16 @@
+{{ if .Values.postgres.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-postgres
+spec:
+  selector:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/component: postgres
+  ports:
+    - protocol: TCP
+      port: 5432
+  type: ClusterIP
+  ipFamilies:
+    - IPv4
+{{ end }}

helm/cmsch/templates/cmsch-pvc.yml

@@ -0,0 +1,16 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ .Release.Name }}-pv
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+  finalizers:
+    - kubernetes.io/pvc-protection
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.resources.requests.storage }}
+  storageClassName: local-path
+  volumeMode: Filesystem

helm/cmsch/templates/cmsch-secrets.yml

@@ -0,0 +1,17 @@
+kind: Secret
+apiVersion: v1
+metadata:
+  name: {{ .Release.Name }}-secrets
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+data:
+  JWT_SECRET: {{ .Values.secret.jwtSecret | b64enc }}
+  PROFILE_SALT: {{ .Values.secret.profileSalt | b64enc }}
+  AUTHSCH_CLIENT_ID: {{ .Values.secret.authschClientId | b64enc }}
+  AUTHSCH_CLIENT_KEY: {{ .Values.secret.authschClientKey | b64enc }}
+  BMEJEGY_USERNAME: {{ .Values.secret.bmejegyUsername | b64enc }}
+  BMEJEGY_PASSWORD: {{ .Values.secret.bmejegyPassword | b64enc }}
+  GOOGLE_CLIENT_ID: {{ .Values.secret.googleClientId | b64enc }}
+  GOOGLE_CLIENT_KEY: {{ .Values.secret.googleClientKey | b64enc }}
+  FIREBASE_SERVICE_ACCOUNT_KEY: {{ .Values.secret.firebaseServiceAccountKey | b64enc }}
+type: Opaque

helm/cmsch/templates/cmsch-service.yml

@@ -0,0 +1,19 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+spec:
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+  selector:
+    app.kubernetes.io/name: {{ .Release.Name }}
+  type: ClusterIP
+  sessionAffinity: None
+  ipFamilies:
+    - IPv4
+  ipFamilyPolicy: SingleStack
+  internalTrafficPolicy: Cluster