Skip to content

Commit 22ba259

Browse files
0xfurai0xfurai
authored
Merge pull request #236 from razorsk8jz/helm-charts
Helm-Charts
2 parents d704729 + 18f1b34 commit 22ba259

15 files changed

+927
-0
lines changed

‎charts/Chart.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: v2
2+
name: peekaping
3+
version: 1.0.0
4+
dependencies:
5+
- name: redis
6+
version: 24.0.0
7+
repository: oci://registry-1.docker.io/bitnamicharts
8+
condition: redis.enabled
9+
10+
- name: postgresql
11+
version: 18.1.13
12+
repository: oci://registry-1.docker.io/bitnamicharts
13+
condition: postgresql.enabled

‎charts/templates/api-deploy.yaml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ .Release.Name }}-api
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
app: {{ .Release.Name }}-api
8+
app.kubernetes.io/instance: {{ .Release.Name }}
9+
app.kubernetes.io/name: {{ .Release.Name }}
10+
app.kubernetes.io/component: api
11+
spec:
12+
replicas: {{ .Values.api.replicaCount }}
13+
14+
strategy:
15+
type: RollingUpdate
16+
rollingUpdate:
17+
maxSurge: 1
18+
maxUnavailable: 0
19+
20+
selector:
21+
matchLabels:
22+
app: {{ .Release.Name }}-api
23+
24+
template:
25+
metadata:
26+
labels:
27+
app: {{ .Release.Name }}-api
28+
app.kubernetes.io/instance: {{ .Release.Name }}
29+
app.kubernetes.io/name: {{ .Release.Name }}
30+
app.kubernetes.io/component: api
31+
annotations:
32+
checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
33+
34+
{{- if .Values.api.apparmor.enabled }}
35+
container.apparmor.security.beta.kubernetes.io/{{ .Release.Name }}-api: runtime/default
36+
{{- end }}
37+
38+
spec:
39+
# Run with a dedicated ServiceAccount (create below)
40+
serviceAccountName: {{ .Release.Name }}-sa
41+
automountServiceAccountToken: false
42+
43+
# Spread replicas across nodes/azs if possible
44+
topologySpreadConstraints:
45+
- maxSkew: 1
46+
topologyKey: kubernetes.io/hostname
47+
whenUnsatisfiable: ScheduleAnyway
48+
labelSelector:
49+
matchLabels:
50+
app: {{ .Release.Name }}-api
51+
52+
securityContext:
53+
runAsNonRoot: true
54+
runAsUser: 10001
55+
runAsGroup: 10001
56+
fsGroup: 10001
57+
seccompProfile:
58+
type: RuntimeDefault
59+
60+
containers:
61+
- name: {{ .Release.Name }}-api
62+
image: {{ .Values.api.image.repository }}:{{ .Values.api.image.tag }}
63+
imagePullPolicy: {{ .Values.api.image.pullPolicy }}
64+
65+
envFrom:
66+
- configMapRef:
67+
name: {{ .Release.Name }}-config
68+
{{- if .Values.config.existingSecret }}
69+
- secretRef:
70+
name: {{ .Values.config.existingSecret }}
71+
{{- end }}
72+
73+
ports:
74+
- containerPort: {{ .Values.api.service.port }}
75+
name: http
76+
77+
# Resource requests/limits to prevent noisy neighbor + OOM loops
78+
resources:
79+
requests:
80+
cpu: {{ .Values.api.resources.requests.cpu }}
81+
memory: {{ .Values.api.resources.requests.memory }}
82+
limits:
83+
cpu: {{ .Values.api.resources.limits.cpu }}
84+
memory: {{ .Values.api.resources.limits.memory }}
85+
86+
securityContext:
87+
allowPrivilegeEscalation: false
88+
readOnlyRootFilesystem: true
89+
runAsNonRoot: true
90+
privileged: false
91+
capabilities:
92+
drop: ["ALL"]
93+
94+
readinessProbe:
95+
httpGet:
96+
path: {{ .Values.api.probes.path }}
97+
port: {{ .Values.api.service.port }}
98+
initialDelaySeconds: {{ .Values.api.probes.readiness.initialDelaySeconds }}
99+
periodSeconds: {{ .Values.api.probes.readiness.periodSeconds }}
100+
timeoutSeconds: {{ .Values.api.probes.readiness.timeoutSeconds }}
101+
failureThreshold: {{ .Values.api.probes.readiness.failureThreshold }}
102+
103+
livenessProbe:
104+
httpGet:
105+
path: {{ .Values.api.probes.path }}
106+
port: {{ .Values.api.service.port }}
107+
initialDelaySeconds: {{ .Values.api.probes.liveness.initialDelaySeconds }}
108+
periodSeconds: {{ .Values.api.probes.liveness.periodSeconds }}
109+
timeoutSeconds: {{ .Values.api.probes.liveness.timeoutSeconds }}
110+
failureThreshold: {{ .Values.api.probes.liveness.failureThreshold }}
111+
112+
startupProbe:
113+
httpGet:
114+
path: {{ .Values.api.probes.path }}
115+
port: {{ .Values.api.service.port }}
116+
failureThreshold: {{ .Values.api.probes.startup.failureThreshold }}
117+
periodSeconds: {{ .Values.api.probes.startup.periodSeconds }}

‎charts/templates/api-service.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: {{ .Release.Name }}-api
5+
namespace: {{ .Release.Namespace }}
6+
spec:
7+
selector:
8+
app: {{ .Release.Name }}-api
9+
ports:
10+
- name: http
11+
port: {{ .Values.api.service.port }}
12+
targetPort: {{ .Values.api.service.port }}

‎charts/templates/config.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: {{ .Release.Name }}-config
5+
namespace: {{ .Release.Namespace }}
6+
data:
7+
{{- range $k, $v := .Values.config.env }}
8+
{{ $k }}: {{ $v | quote }}
9+
{{- end }}

‎charts/templates/gateway.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{- if .Values.istio.gateway.enabled }}
2+
apiVersion: networking.istio.io/v1beta1
3+
kind: Gateway
4+
metadata:
5+
name: {{ .Release.Name }}-gateway
6+
namespace: {{ .Release.Namespace }}
7+
spec:
8+
selector:
9+
istio: {{ .Values.istio.gateway.selector }} # must match labels on istio-ingressgateway pods
10+
servers:
11+
- port:
12+
number: {{ .Values.istio.gateway.port }}
13+
name: {{ .Values.istio.gateway.name }}
14+
protocol: {{ .Values.istio.gateway.protocol }}
15+
hosts:
16+
- {{ .Values.ingress.host }}
17+
{{- end }}

‎charts/templates/ingester-deploy.yaml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ .Release.Name }}-ingester
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
app: {{ .Release.Name }}-ingester
8+
app.kubernetes.io/instance: {{ .Release.Name }}
9+
app.kubernetes.io/name: {{ .Release.Name }}
10+
app.kubernetes.io/component: ingester
11+
spec:
12+
replicas: {{ .Values.ingester.replicaCount }}
13+
14+
strategy:
15+
type: RollingUpdate
16+
rollingUpdate:
17+
maxSurge: 1
18+
maxUnavailable: 0
19+
20+
selector:
21+
matchLabels:
22+
app: {{ .Release.Name }}-ingester
23+
24+
template:
25+
metadata:
26+
labels:
27+
app: {{ .Release.Name }}-ingester
28+
app.kubernetes.io/instance: {{ .Release.Name }}
29+
app.kubernetes.io/name: {{ .Release.Name }}
30+
app.kubernetes.io/component: ingester
31+
annotations:
32+
checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
33+
{{- if .Values.ingester.apparmor.enabled }}
34+
container.apparmor.security.beta.kubernetes.io/{{ .Release.Name }}-ingester: runtime/default
35+
{{- end }}
36+
37+
spec:
38+
serviceAccountName: {{ .Release.Name }}-sa
39+
automountServiceAccountToken: false
40+
41+
# Spread replicas across nodes/azs if possible
42+
topologySpreadConstraints:
43+
- maxSkew: 1
44+
topologyKey: kubernetes.io/hostname
45+
whenUnsatisfiable: ScheduleAnyway
46+
labelSelector:
47+
matchLabels:
48+
app: {{ .Release.Name }}-ingester
49+
50+
securityContext:
51+
runAsNonRoot: true
52+
runAsUser: 10001
53+
runAsGroup: 10001
54+
fsGroup: 10001
55+
seccompProfile:
56+
type: RuntimeDefault
57+
58+
containers:
59+
- name: {{ .Release.Name }}-ingester
60+
image: {{ .Values.ingester.image.repository }}:{{ .Values.ingester.image.tag }}
61+
imagePullPolicy: {{ .Values.ingester.image.pullPolicy }}
62+
63+
envFrom:
64+
- configMapRef:
65+
name: {{ .Release.Name }}-config
66+
{{- if .Values.config.existingSecret }}
67+
- secretRef:
68+
name: {{ .Values.config.existingSecret }}
69+
{{- end }}
70+
71+
# Resource requests/limits to prevent noisy neighbor + OOM loops
72+
resources:
73+
requests:
74+
cpu: {{ .Values.ingester.resources.requests.cpu }}
75+
memory: {{ .Values.ingester.resources.requests.memory }}
76+
limits:
77+
cpu: {{ .Values.ingester.resources.limits.cpu }}
78+
memory: {{ .Values.ingester.resources.limits.memory }}
79+
80+
securityContext:
81+
allowPrivilegeEscalation: false
82+
readOnlyRootFilesystem: true
83+
runAsNonRoot: true
84+
privileged: false
85+
capabilities:
86+
drop: ["ALL"]

‎charts/templates/ingress.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{{ if .Values.ingress.enabled }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: Ingress
4+
metadata:
5+
{{- with .Values.ingress.annotations }}
6+
annotations:
7+
{{ toYaml . | indent 4 }}
8+
{{- end }}
9+
labels:
10+
app: {{ .Release.Name }}-ingress
11+
app.kubernetes.io/instance: {{ .Release.Name }}
12+
app.kubernetes.io/name: {{ .Release.Name }}
13+
app.kubernetes.io/component: ingress
14+
name: {{ .Release.Name }}-ingress
15+
namespace: {{ .Values.ingress.namespace | default .Release.Namespace }}
16+
spec:
17+
ingressClassName: {{ .Values.ingress.ingressClassName }}
18+
rules:
19+
- host: {{ .Values.ingress.host }}
20+
http:
21+
paths:
22+
{{- if not .Values.istio.virtualservice.enabled }}
23+
- path: /api
24+
pathType: Prefix
25+
backend:
26+
service:
27+
name: {{ .Release.Name }}-api
28+
port:
29+
number: {{ .Values.api.service.port }}
30+
- path: /socket.io
31+
pathType: Prefix
32+
backend:
33+
service:
34+
name: {{ .Release.Name }}-api
35+
port:
36+
number: {{ .Values.api.service.port }}
37+
- path: /
38+
pathType: Prefix
39+
backend:
40+
service:
41+
name: {{ .Release.Name }}-web
42+
port:
43+
number: {{ .Values.web.service.port }}
44+
{{- end }}
45+
{{- if .Values.istio.virtualservice.enabled }}
46+
- path: /
47+
pathType: Prefix
48+
backend:
49+
service:
50+
name: {{ .Values.istio.ingress.name }}
51+
port:
52+
number: {{ .Values.istio.ingress.port }}
53+
{{- end }}
54+
tls:
55+
- hosts:
56+
- {{ .Values.ingress.host }}
57+
{{ end }}

‎charts/templates/migrate-job.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: {{ .Release.Name }}-migrate
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
app: migrate
8+
app.kubernetes.io/instance: {{ .Release.Name }}
9+
app.kubernetes.io/name: {{ .Release.Name }}
10+
app.kubernetes.io/component: migrate
11+
spec:
12+
backoffLimit: {{ .Values.migrate.backoffLimit }}
13+
activeDeadlineSeconds: {{ .Values.migrate.activeDeadlineSeconds }}
14+
ttlSecondsAfterFinished: {{ .Values.migrate.ttlSecondsAfterFinished }}
15+
16+
template:
17+
metadata:
18+
labels:
19+
app: migrate
20+
app.kubernetes.io/instance: {{ .Release.Name }}
21+
app.kubernetes.io/name: {{ .Release.Name }}
22+
app.kubernetes.io/component: migrate
23+
annotations:
24+
checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
25+
{{- if .Values.migrate.apparmor.enabled }}
26+
container.apparmor.security.beta.kubernetes.io/{{ .Release.Name }}-migrate: runtime/default
27+
{{- end }}
28+
spec:
29+
restartPolicy: OnFailure
30+
31+
serviceAccountName: {{ .Release.Name }}-sa
32+
automountServiceAccountToken: false
33+
34+
securityContext:
35+
runAsNonRoot: true
36+
runAsUser: 10001
37+
runAsGroup: 10001
38+
fsGroup: 10001
39+
seccompProfile:
40+
type: RuntimeDefault
41+
42+
containers:
43+
- name: {{ .Release.Name }}-migrate
44+
image: {{ .Values.migrate.image.repository }}:{{ .Values.migrate.image.tag }}
45+
imagePullPolicy: {{ .Values.migrate.image.pullPolicy }}
46+
47+
envFrom:
48+
- configMapRef:
49+
name: {{ .Release.Name }}-config
50+
{{- if .Values.config.existingSecret }}
51+
- secretRef:
52+
name: {{ .Values.config.existingSecret }}
53+
{{- end }}
54+
55+
resources:
56+
requests:
57+
cpu: {{ .Values.migrate.resources.requests.cpu }}
58+
memory: {{ .Values.migrate.resources.requests.memory }}
59+
limits:
60+
cpu: {{ .Values.migrate.resources.limits.cpu }}
61+
memory: {{ .Values.migrate.resources.limits.memory }}
62+
63+
securityContext:
64+
allowPrivilegeEscalation: false
65+
readOnlyRootFilesystem: true
66+
runAsNonRoot: true
67+
privileged: false
68+
capabilities:
69+
drop: ["ALL"]

0 commit comments

Comments
 (0)