7a989ed · typeable/octopod

git.iko.soy/typeable/octopod

Chart fixes (#47)

* helm3 chart: fix security context issue * proper permissions for octopod * add vault annotations capability + small fixes * bump up octopod version + reloader annotation * Template ingress hosts from baseDomain + docs * Added code blocks Co-authored-by: iko <ilyakooo0@gmail.com>

commit7a989ed10bb532ccf3441a821a629495e7a7de3a authorAlex-Sizov <45825279+Alex-Sizov@users.noreply.github.com> dateFri 16 Jul 2021, 13:28 (5 years ago) parentcbcd09f

12 files changed+139−37

compare with master

unifiedsplit

charts/helm3/octopod/Chart.yaml+2−2

@@ -2,8 +2,8 @@ apiVersion: v2

22name: octopod

33description: An opensource self-hosted solution for managing multiple deployments in a Kubernetes cluster.

44type: application

5−version: 0.0.1

6−appVersion: 1.1

5+version: 0.3.0

6+appVersion: 1.2

77keywords:

88 - kubernetes

99 - octopod

charts/helm3/octopod/README.md+18−8

@@ -5,7 +5,11 @@

55[Octopod](https://octopod.site/) is a fully open-source self-hosted solution for managing multiple deployments in a Kubernetes cluster with a user-friendly web interface. Managing deployments does not require any technical expertise.

77## TL;DR

8−TBD (install chart from typeable's chart repository)

8+```console

9+helm repo add typeable https://typeable.github.io/octopod/

10+kubectl create ns octopod-deployment

11+helm install octopod typeable/octopod --set octopod.baseDomain="your-domain.com"

12+```

913

1014## Introduction

1115

@@ -48,8 +52,8 @@ Name for configmap is cofigured in octopod.certsConfigMapName

4852To install the chart with the release name `my-release` from current directory execute:

4953

5054```console

51−$ helm dependency build

52−$ helm -n octopod install my-release .

55+$ helm repo add typeable https://typeable.github.io/octopod/

56+# helm -n octopod install my-release typeable/octopod

5357```

5458

5559The command deploys Octopod on the Kubernetes cluster in the default configuration inside octopod namespace. The [Parameters](#parameters) section lists the parameters that can be configured during installation.

@@ -80,26 +84,30 @@ The following tables lists the configurable parameters of the Octopod chart and

8286| ingress.app.annotations | object | `{}` | Additional ingress annotations for app service |

8690| ingress.powerApp.annotations | object | `{}` | Additional ingress annotations for power-app service |

9094| ingress.ui.annotations | object | `{}` | Additional ingress annotations for ui service |

9296| ingress.ws.annotations | object | `{}` | Additional ingress annotations for ws service |

95101| nodeSelector | object | `{}` | Node selector if you want octopod to use specific nodes onn your cluster |

96102| octopod.archiveRetention | int | `1209600` | |

106+| octopod.env | object | `{}` | key value map for supplying additional environment variables for octopod or your control scripts |

102109| octopod.statusUpdateTimeout | int | `600` | Time to wait before deployment is marked as failed |

110+| octopod.vaultEnv | object | `{}` | key value map for reference kv secrets stored in Hashicorp's Vault |

103111| podAnnotations | object | `{}` | Additional pod annotations |

104112| podSecurityContext | object | `{}` | Additional security context |

@@ -125,6 +133,8 @@ The following tables lists the configurable parameters of the Octopod chart and

128138

129139

130140Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,

charts/helm3/octopod/templates/_helpers.tpl+32

@@ -92,3 +92,35 @@ ws

9292{{- define "postgresqlSecretName" -}}

9393{{ .Release.Name }}-postgresql

9494{{- end }}

95+

96+{{- define "wsIngressHost" -}}

97+{{- if .Values.ingress.ws.host -}}

98+{{ .Values.ingress.ws.host }}

99+{{- else -}}

100+octopod-ws.{{ .Values.octopod.baseDomain }}

101+{{- end }}

102+{{- end }}

103+

104+{{- define "uiIngressHost" -}}

105+{{- if .Values.ingress.ui.host -}}

106+{{ .Values.ingress.ui.host }}

107+{{- else -}}

108+octopod.{{ .Values.octopod.baseDomain }}

109+{{- end }}

110+{{- end }}

111+

112+{{- define "powerAppIngressHost" -}}

113+{{- if .Values.ingress.powerApp.host -}}

114+{{ .Values.ingress.powerApp.host }}

115+{{- else -}}

116+octopod-powerapp.{{ .Values.octopod.baseDomain }}

117+{{- end }}

118+{{- end }}

119+

120+{{- define "appIngressHost" -}}

121+{{- if .Values.ingress.app.host -}}

122+{{ .Values.ingress.app.host }}

123+{{- else -}}

124+octopod-app.{{ .Values.octopod.baseDomain }}

125+{{- end }}

126+{{- end }}

charts/helm3/octopod/templates/deployment.yaml+52−5

@@ -4,6 +4,8 @@ metadata:

44 name: {{ include "octopod.fullname" . }}

55 labels:

66 {{- include "octopod.labels" . | nindent 4 }}

7+ annotations:

8+ reloader.stakater.com/auto: "true"

79spec:

810 replicas: {{ .Values.replicaCount }}

911 selector:

@@ -11,10 +13,27 @@ spec:

1113 {{- include "octopod.selectorLabels" . | nindent 6 }}

1214 template:

1315 metadata:

14− {{- with .Values.podAnnotations }}

1516 annotations:

16− {{- toYaml . | nindent 8 }}

17− {{- end }}

17+ {{- with .Values.podAnnotations }}

18+ {{- toYaml . | nindent 8 }}

19+ {{- end }}

20+ {{- if .Values.vault.enabled }}

21+ vault.hashicorp.com/agent-inject: 'true'

22+ vault.hashicorp.com/agent-init-first: 'true'

23+ vault.hashicorp.com/auth-path: 'auth/{{ .Values.vault.clusterName }}'

24+ vault.hashicorp.com/role: {{ .Values.vault.clusterName | quote}}

25+ {{- range $kv_store, $secret := .Values.octopod.vaultEnv }}

26+ {{- range $secret_name, $secret_values := $secret }}

27+ vault.hashicorp.com/agent-inject-secret-{{ $secret_name }}: '{{ $kv_store }}/{{ $secret_name }}'

28+ vault.hashicorp.com/agent-inject-template-{{ $secret_name }}: |

29+ {{ "{{" }} with secret "{{ $kv_store }}/{{ $secret_name }}" {{ "-}}" }}

30+ {{- range $secret_values }}

31+ export {{ .name }}="{{ "{{" }} .Data.data.{{ .key }} {{ "}}" }}"

32+ {{- end }}

33+ {{ "{{-" }} end {{ "}}" }}

34+ {{- end }}

35+ {{- end }}

36+ {{- end }}

1837 labels:

1938 {{- include "octopod.selectorLabels" . | nindent 8 }}

2039 spec:

@@ -38,16 +57,25 @@ spec:

3857 mountPath: /copy

3958

4059 - name: run-init

41− image: typeable/octopod:1.1

60+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"

4261 command:

4362 - sh

4463 - -c

45− - '/utils/init'

64+ - |

65+ {{- if .Values.vault.enabled }}

66+ for i in /vault/secrets/*;do source $i;done

67+ {{- end }}

68+ /utils/init

69+ envFrom:

70+ - configMapRef:

71+ name: {{ include "octopod.fullname" . }}

4672 volumeMounts:

4773 - name: home

4874 mountPath: /home/octopod

4975 - name: control-scripts

5076 mountPath: {{ include "controlScriptsPath" . }}

77+ securityContext:

78+ {{- toYaml .Values.securityContext | nindent 12 }}

5179 - name: copy-www

5280 image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"

5381 command:

@@ -69,6 +97,22 @@ spec:

6997 protocol: TCP

7098 - containerPort: 4000

7199 protocol: TCP

100+ {{- if .Values.vault.enabled }}

101+ command:

102+ - "sh"

103+ - "-ec"

104+ - |

105+ for i in /vault/secrets/*;do source $i;done

106+ exec /app/octopod-exe \

107+ --port {{ .Values.service.ports.powerApp | quote }} \

108+ --ui-port {{ .Values.service.ports.app | quote }} \

109+ --ws-port {{ .Values.service.ports.ws | quote }} \

110+ --db host="'{{ include "postgresqlHost" . }}' port=5432 user='{{ .Values.postgresql.postgresqlUsername }}' password=$(PG_PASS)" \

111+ --db-pool-size "10" \

112+ --tls-cert-path /tls/server_cert.pem \

113+ --tls-key-path /tls/server_key.pem \

114+ --tls-store-path /tls_store \

115+ {{- else }}

72116 args:

73117 - --port

74118 - {{ .Values.service.ports.powerApp | quote }}

@@ -86,6 +130,7 @@ spec:

86130 - /tls/server_key.pem

87131 - --tls-store-path

88132 - /tls_store

133+ {{- end }}

89134 envFrom:

90135 - configMapRef:

91136 name: {{ include "octopod.fullname" . }}

@@ -122,6 +167,8 @@ spec:

122167 periodSeconds: 5

123168 resources:

124169 {{- toYaml .Values.resources | nindent 12 }}

170+ securityContext:

171+ {{- toYaml .Values.securityContext | nindent 12 }}

125172 - name: nginx

126173 image: nginx:1.17.5

127174 volumeMounts:

charts/helm3/octopod/templates/ingress-app.yaml+2−2

@@ -33,11 +33,11 @@ spec:

3333 {{- if .Values.ingress.tls.enabled }}

3434 tls:

3535 - hosts:

36− - {{ .Values.ingress.app.host }}

36+ - {{ include "appIngressHost" . }}

3737 secretName: {{ $fullName }}-app-tls

3838 {{- end }}

3939 rules:

40− - host: {{ .Values.ingress.app.host | quote }}

40+ - host: {{ include "appIngressHost" . }}

4141 http:

4242 paths:

4343 - path: /

charts/helm3/octopod/templates/ingress-powerapp.yaml+2−3

@@ -1,6 +1,5 @@

11{{- if .Values.ingress.enabled -}}

22{{- $fullName := include "octopod.fullname" . -}}

3−{{- $svcPort := .Values.service.port -}}

43{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}

54apiVersion: networking.k8s.io/v1beta1

65{{- else -}}

@@ -26,11 +25,11 @@ spec:

2625 {{- if .Values.ingress.tls }}

2726 tls:

2827 - hosts:

29− - {{ .Values.ingress.powerApp.host }}

28+ - {{ include "powerAppIngressHost" . }}

3029 secretName: {{ $fullName }}-powerapp-tls

3130 {{- end }}

3231 rules:

33− - host: {{ .Values.ingress.powerApp.host | quote }}

32+ - host: {{ include "powerAppIngressHost" . }}

3433 http:

3534 paths:

3635 - path: /

charts/helm3/octopod/templates/ingress-ui.yaml+2−2

@@ -27,11 +27,11 @@ spec:

2727 {{- if .Values.ingress.tls.enabled }}

2828 tls:

2929 - hosts:

30− - {{ .Values.ingress.ui.host }}

30+ - {{ include "uiIngressHost" . }}

3131 secretName: {{ $fullName }}-ui-tls

3232 {{- end }}

3333 rules:

34− - host: {{ .Values.ingress.ui.host | quote }}

34+ - host: {{ include "uiIngressHost" . }}

3535 http:

3636 paths:

3737 - path: /

charts/helm3/octopod/templates/ingress-ws.yaml+3−3

@@ -27,15 +27,15 @@ spec:

2727 {{- if .Values.ingress.tls.enabled }}

2828 tls:

2929 - hosts:

30− - {{ .Values.ingress.ws.host }}

30+ - {{ include "wsIngressHost" . }}

3131 secretName: {{ $fullName }}-ws-tls

3232 {{- end }}

3333 rules:

34− - host: {{ .Values.ingress.ws.host | quote }}

34+ - host: {{ include "wsIngressHost" . }}

3535 http:

3636 paths:

3737 - path: /

3838 backend:

3939 serviceName: {{ $fullName }}

4040 servicePort: {{ .Values.service.ports.ws }}

41−{{- end }}

41+{{- end }}

charts/helm3/octopod/templates/nginx-configmap.yaml+9−2

@@ -13,15 +13,22 @@ data:

1313 root /www;

1414 index index.html;

1515 error_page 404 =200 /index.html;

16+ gzip on;

17+ gzip_disable msie6;

18+ gzip_buffers 32 4k;

19+ gzip_comp_level 3;

20+ gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/rss+xml text/javascript image/svg+xml application/vnd.ms-f ontobject application/x-font-ttf font/opentype;

1621 }

1722 config.json: |

1823 {

1924 "app_url": "{{ printf "%s://%s" (include "httpScheme" .) .Values.ingress.app.host}}",

2025 "ws_url": "{{ printf "%s://%s" (include "wsScheme" .) .Values.ingress.ws.host}}",

2126 "app_auth": "Basic {{ printf "octopod:%s" $octopodAppAuthPassword | b64enc }}",

22−

27+ {{- if .Values.kubernetesDashboard.enabled }}

28+ "kubernetes_dashboard_url_template": "{{ .Values.kubernetesDashboard.url }}/#/search?namespace={{ .Values.octopod.deploymentNamespace }}&q="

29+ {{- else }}

2330 "kubernetes_dashboard_url_template": null

24−

31+ {{- end }}

2532 }

2633---

2734apiVersion: v1

charts/helm3/octopod/templates/octopod-configmap.yaml+3

@@ -18,3 +18,6 @@ data:

1818 ARCHIVE_CHECKING_COMMAND: {{ printf "%s/archive_check" (include "controlScriptsPath" .) | quote }}

1919 TAG_CHECKING_COMMAND: {{ printf "%s/tag_check" (include "controlScriptsPath" .) | quote }}

2020 INFO_COMMAND: {{ printf "%s/info" (include "controlScriptsPath" .) | quote }}

21+ {{- range $name, $value := .Values.octopod.env }}

22+ {{ $name }}: {{ $value | quote }}

23+ {{- end }}

charts/helm3/octopod/templates/rbac.yaml+6−6

@@ -6,12 +6,12 @@ metadata:

66 labels:

77 {{- include "octopod.labels" . | nindent 4 }}

88rules:

9− - apiGroups: [""]

10− resources: ["pods/portforward"]

11− verbs: ["create"]

12− - apiGroups: [""]

13− resources: ["pods"]

14− verbs: ["list", "get"]

9+- apiGroups:

10+ - '*'

11+ resources:

12+ - '*'

13+ verbs:

14+ - '*'

1515---

1616apiVersion: rbac.authorization.k8s.io/v1

1717kind: ClusterRoleBinding

charts/helm3/octopod/values.yaml+8−4

@@ -53,16 +53,12 @@ ingress:

5353 enabled: true

5454 clusterIssuer: letsencrypt

5555 powerApp:

56− host: octopod-powerapp.example.com

5756 annotations: {}

5857 ui:

59− host: octopod.example.com

6058 annotations: {}

6159 app:

62− host: octopod-app.example.com

6360 annotations: {}

6461 ws:

65− host: octopod-ws.example.com

6662 annotations: {}

6763

6864resources:

@@ -88,6 +84,8 @@ octopod:

8884 archiveRetention: 1209600

8985 migrations:

9086 enabled: true

87+ env: {}

88+ vaultEnv: {}

9189controlScripts:

9290 image:

9391 repository: typeable/octopod-helm-example

@@ -102,3 +100,9 @@ postgresql:

102100 enabled: true

103101 postgresqlUsername: octopod

104102 postgresqlDatabase: octopod

103+vault:

104+ enabled: false

105+ clusterName: ""

106+kubernetesDashboard:

107+ enabled: false

108+ url: ""