Skip to content

Commit 60c255b

Browse files
fzingarettifzingaretti
committed
update chart defaults and routing behavior for Contour plus Knative
1 parent db4fe14 commit 60c255b

19 files changed

Lines changed: 602 additions & 13 deletions

‎README.md‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@
33
This repository contains a Helm chart for deploying the FastAPI-based APEx Dispatch
44
API on Knative Serving using `serving.knative.dev/v1` `Service` resources.
55

6+
Optionally, the chart can also expose the Knative service through Contour using a
7+
`projectcontour.io/v1` `HTTPProxy` resource.
8+
69
The chart is intended for development and testing deployments of the APEx Dispatch
710
API in Knative-enabled Kubernetes environments.
811

@@ -70,10 +73,18 @@ helm install apex-dispatch-api oci://ghcr.io/esa-apex/helm/apex-dispatch-api --v
7073

7174
## Important values
7275

73-
- `serviceAccountName`: Kubernetes service account used by the Knative revision pod
76+
- `serviceAccount.create`: create a dedicated Kubernetes service account
77+
- `serviceAccount.existingName`: existing Kubernetes service account used when `create=false`
78+
- `serviceAccount.name`: service account name used when `create=true`
7479
- `image.repository`, `image.tag`: container image to run
7580
- `knative.minScale`, `knative.maxScale`: Knative autoscaling bounds
81+
- `contour.enabled`: enable/disable the Contour `HTTPProxy` resource
82+
- `contour.virtualhost.fqdn`: public hostname used by `HTTPProxy`
83+
- `contour.virtualhost.tls.enabled`: enable/disable TLS termination on `HTTPProxy`
84+
- `contour.virtualhost.tls.secretName`: TLS secret used by `HTTPProxy` when TLS is enabled
7685
- `secrets.create`: create the app secret from Helm values or reference an existing one
86+
- `externalSecret.enabled`: manage app secrets through External Secrets Operator
87+
- `migration.enabled`: run `alembic upgrade head` as a Helm hook Job
7788
- `probes.enabled`: enable `/health` probes if your runtime dependencies are ready at startup
7889

7990
See [`docs/reference/index.md`](docs/reference/index.md) for the detailed values and
@@ -87,6 +98,7 @@ exist and contain:
8798
- `KEYCLOAK_CLIENT_ID`
8899
- `KEYCLOAK_CLIENT_SECRET`
89100
- `BACKENDS`
101+
- `DATABASE_URL`
90102

91103
## Documentation
92104

‎charts/templates/_helpers.tpl‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,3 +47,22 @@ Selector labels.
4747
app.kubernetes.io/name: {{ include "apex-dispatch-api.name" . }}
4848
app.kubernetes.io/instance: {{ .Release.Name }}
4949
{{- end }}
50+
51+
{{/*
52+
Resolve the service account name.
53+
*/}}
54+
{{- define "apex-dispatch-api.serviceAccountName" -}}
55+
{{- if .Values.serviceAccount.create }}
56+
{{- if .Values.serviceAccount.name }}
57+
{{- .Values.serviceAccount.name -}}
58+
{{- else -}}
59+
{{- include "apex-dispatch-api.fullname" . -}}
60+
{{- end -}}
61+
{{- else -}}
62+
{{- if .Values.serviceAccount.existingName }}
63+
{{- .Values.serviceAccount.existingName -}}
64+
{{- else -}}
65+
{{- "" -}}
66+
{{- end -}}
67+
{{- end -}}
68+
{{- end }}

‎charts/templates/externalsecret.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{{- if .Values.externalSecret.enabled }}
2+
apiVersion: external-secrets.io/v1beta1
3+
kind: ExternalSecret
4+
metadata:
5+
name: {{ default (include "apex-dispatch-api.fullname" .) .Values.externalSecret.name }}
6+
labels:
7+
{{- include "apex-dispatch-api.labels" . | nindent 4 }}
8+
spec:
9+
refreshInterval: {{ .Values.externalSecret.refreshInterval | quote }}
10+
secretStoreRef:
11+
kind: {{ .Values.externalSecret.secretStoreRef.kind }}
12+
name: {{ required "externalSecret.secretStoreRef.name is required when externalSecret.enabled=true" .Values.externalSecret.secretStoreRef.name }}
13+
target:
14+
name: {{ default .Values.secrets.name .Values.externalSecret.target.name }}
15+
creationPolicy: {{ .Values.externalSecret.target.creationPolicy }}
16+
deletionPolicy: {{ .Values.externalSecret.target.deletionPolicy }}
17+
data:
18+
- secretKey: KEYCLOAK_CLIENT_ID
19+
remoteRef:
20+
key: {{ required "externalSecret.data.keycloakClientId.key is required when externalSecret.enabled=true" .Values.externalSecret.data.keycloakClientId.key }}
21+
{{- with .Values.externalSecret.data.keycloakClientId.property }}
22+
property: {{ . }}
23+
{{- end }}
24+
- secretKey: KEYCLOAK_CLIENT_SECRET
25+
remoteRef:
26+
key: {{ required "externalSecret.data.keycloakClientSecret.key is required when externalSecret.enabled=true" .Values.externalSecret.data.keycloakClientSecret.key }}
27+
{{- with .Values.externalSecret.data.keycloakClientSecret.property }}
28+
property: {{ . }}
29+
{{- end }}
30+
- secretKey: BACKENDS
31+
remoteRef:
32+
key: {{ required "externalSecret.data.backends.key is required when externalSecret.enabled=true" .Values.externalSecret.data.backends.key }}
33+
{{- with .Values.externalSecret.data.backends.property }}
34+
property: {{ . }}
35+
{{- end }}
36+
- secretKey: DATABASE_URL
37+
remoteRef:
38+
key: {{ required "externalSecret.data.databaseUrl.key is required when externalSecret.enabled=true" .Values.externalSecret.data.databaseUrl.key }}
39+
{{- with .Values.externalSecret.data.databaseUrl.property }}
40+
property: {{ . }}
41+
{{- end }}
42+
{{- end }}

‎charts/templates/httpproxy.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{{- if .Values.contour.enabled }}
2+
apiVersion: projectcontour.io/v1
3+
kind: HTTPProxy
4+
metadata:
5+
name: {{ default (include "apex-dispatch-api.fullname" .) .Values.contour.name }}
6+
labels:
7+
{{- include "apex-dispatch-api.labels" . | nindent 4 }}
8+
{{- with .Values.contour.labels }}
9+
{{- toYaml . | nindent 4 }}
10+
{{- end }}
11+
{{- with .Values.contour.annotations }}
12+
annotations:
13+
{{- toYaml . | nindent 4 }}
14+
{{- end }}
15+
spec:
16+
virtualhost:
17+
fqdn: {{ required "contour.virtualhost.fqdn is required when contour.enabled=true" .Values.contour.virtualhost.fqdn | quote }}
18+
{{- if .Values.contour.virtualhost.tls.enabled }}
19+
tls:
20+
secretName: {{ required "contour.virtualhost.tls.secretName is required when contour.virtualhost.tls.enabled=true" .Values.contour.virtualhost.tls.secretName | quote }}
21+
{{- with .Values.contour.virtualhost.tls.minimumProtocolVersion }}
22+
minimumProtocolVersion: {{ . | quote }}
23+
{{- end }}
24+
{{- end }}
25+
{{- with .Values.contour.virtualhost.corsPolicy }}
26+
corsPolicy:
27+
{{- toYaml . | nindent 6 }}
28+
{{- end }}
29+
{{- with .Values.contour.virtualhost.authorization }}
30+
authorization:
31+
{{- toYaml . | nindent 6 }}
32+
{{- end }}
33+
{{- if .Values.contour.routes }}
34+
routes:
35+
{{- tpl (toYaml .Values.contour.routes) . | nindent 4 }}
36+
{{- else }}
37+
routes:
38+
- conditions:
39+
- prefix: /
40+
requestHeadersPolicy:
41+
set:
42+
- name: Host
43+
value: {{ printf "%s.%s.svc.cluster.local" (include "apex-dispatch-api.fullname" .) .Release.Namespace | quote }}
44+
services:
45+
- name: {{ include "apex-dispatch-api.fullname" . }}
46+
port: 80
47+
{{- end }}
48+
{{- end }}

‎charts/templates/migration-job.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{{- if .Values.migration.enabled }}
2+
apiVersion: batch/v1
3+
kind: Job
4+
metadata:
5+
name: {{ default (printf "%s-migrate" (include "apex-dispatch-api.fullname" .)) .Values.migration.name }}
6+
labels:
7+
{{- include "apex-dispatch-api.labels" . | nindent 4 }}
8+
{{- with .Values.migration.labels }}
9+
{{- toYaml . | nindent 4 }}
10+
{{- end }}
11+
annotations:
12+
"helm.sh/hook": post-install,post-upgrade
13+
"helm.sh/hook-weight": "5"
14+
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
15+
{{- with .Values.migration.annotations }}
16+
{{- toYaml . | nindent 4 }}
17+
{{- end }}
18+
spec:
19+
backoffLimit: {{ .Values.migration.backoffLimit }}
20+
{{- if gt (int .Values.migration.activeDeadlineSeconds) 0 }}
21+
activeDeadlineSeconds: {{ .Values.migration.activeDeadlineSeconds }}
22+
{{- end }}
23+
template:
24+
metadata:
25+
labels:
26+
{{- include "apex-dispatch-api.selectorLabels" . | nindent 8 }}
27+
spec:
28+
{{- $serviceAccountName := include "apex-dispatch-api.serviceAccountName" . }}
29+
restartPolicy: Never
30+
{{- with .Values.image.pullSecrets }}
31+
imagePullSecrets:
32+
{{- toYaml . | nindent 8 }}
33+
{{- end }}
34+
{{- if $serviceAccountName }}
35+
serviceAccountName: {{ $serviceAccountName }}
36+
{{- end }}
37+
containers:
38+
- name: migrate
39+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
40+
imagePullPolicy: {{ .Values.image.pullPolicy }}
41+
command:
42+
{{- toYaml .Values.migration.command | nindent 12 }}
43+
{{- with .Values.migration.args }}
44+
args:
45+
{{- toYaml . | nindent 12 }}
46+
{{- end }}
47+
env:
48+
- name: DATABASE_URL
49+
valueFrom:
50+
secretKeyRef:
51+
name: {{ .Values.secrets.name }}
52+
key: DATABASE_URL
53+
optional: {{ not .Values.secrets.create }}
54+
{{- with .Values.migration.extraEnv }}
55+
{{- toYaml . | nindent 12 }}
56+
{{- end }}
57+
{{- with .Values.resources }}
58+
resources:
59+
{{- toYaml . | nindent 12 }}
60+
{{- end }}
61+
{{- end }}

‎charts/templates/secret.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.secrets.create }}
1+
{{- if and .Values.secrets.create (not .Values.externalSecret.enabled) }}
22
apiVersion: v1
33
kind: Secret
44
metadata:
@@ -10,4 +10,5 @@ stringData:
1010
KEYCLOAK_CLIENT_ID: {{ .Values.secrets.keycloakClientId | quote }}
1111
KEYCLOAK_CLIENT_SECRET: {{ .Values.secrets.keycloakClientSecret | quote }}
1212
BACKENDS: {{ .Values.secrets.backends | quote }}
13+
DATABASE_URL: {{ .Values.secrets.databaseUrl | quote }}
1314
{{- end }}

‎charts/templates/service.yaml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,15 @@ spec:
2626
{{- toYaml . | nindent 8 }}
2727
{{- end }}
2828
spec:
29+
{{- $serviceAccountName := include "apex-dispatch-api.serviceAccountName" . }}
2930
containerConcurrency: {{ .Values.knative.containerConcurrency }}
3031
timeoutSeconds: {{ .Values.knative.timeoutSeconds }}
3132
{{- with .Values.image.pullSecrets }}
3233
imagePullSecrets:
3334
{{- toYaml . | nindent 8 }}
3435
{{- end }}
35-
{{- if .Values.serviceAccountName }}
36-
serviceAccountName: {{ .Values.serviceAccountName }}
36+
{{- if $serviceAccountName }}
37+
serviceAccountName: {{ $serviceAccountName }}
3738
{{- end }}
3839
containers:
3940
- name: {{ include "apex-dispatch-api.name" . }}
@@ -67,6 +68,12 @@ spec:
6768
name: {{ .Values.secrets.name }}
6869
key: BACKENDS
6970
optional: {{ not .Values.secrets.create }}
71+
- name: DATABASE_URL
72+
valueFrom:
73+
secretKeyRef:
74+
name: {{ .Values.secrets.name }}
75+
key: DATABASE_URL
76+
optional: {{ not .Values.secrets.create }}
7077
{{- with .Values.extraEnv }}
7178
{{- toYaml . | nindent 12 }}
7279
{{- end }}

‎charts/templates/serviceaccount.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- if .Values.serviceAccount.create }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "apex-dispatch-api.serviceAccountName" . }}
6+
labels:
7+
{{- include "apex-dispatch-api.labels" . | nindent 4 }}
8+
{{- with .Values.serviceAccount.labels }}
9+
{{- toYaml . | nindent 4 }}
10+
{{- end }}
11+
{{- with .Values.serviceAccount.annotations }}
12+
annotations:
13+
{{- toYaml . | nindent 4 }}
14+
{{- end }}
15+
{{- end }}

‎charts/tests/configmap_test.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ tests:
1717
- equal:
1818
path: data.APP_ENV
1919
value: development
20+
- equal:
21+
path: data.APP_DESCRIPTION
22+
value: APEx Dispatch Service API to run jobs and upscaling tasks
2023
- equal:
2124
path: data.KEYCLOAK_HOST
2225
value: auth.dev.apex.esa.int

‎charts/tests/externalsecret_test.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
suite: external secret template
2+
release:
3+
name: apex-dispatch-api
4+
templates:
5+
- templates/externalsecret.yaml
6+
tests:
7+
- it: does not render an external secret by default
8+
asserts:
9+
- hasDocuments:
10+
count: 0
11+
12+
- it: renders an external secret when enabled
13+
set:
14+
secrets:
15+
name: dispatch-secrets
16+
externalSecret:
17+
enabled: true
18+
name: dispatch-api-external-secret
19+
secretStoreRef:
20+
kind: ClusterSecretStore
21+
name: team-vault
22+
data:
23+
keycloakClientId:
24+
key: apex/dispatch
25+
property: keycloak_client_id
26+
keycloakClientSecret:
27+
key: apex/dispatch
28+
property: keycloak_client_secret
29+
backends:
30+
key: apex/dispatch
31+
property: backends
32+
databaseUrl:
33+
key: apex/dispatch
34+
property: database_url
35+
asserts:
36+
- hasDocuments:
37+
count: 1
38+
- isKind:
39+
of: ExternalSecret
40+
- equal:
41+
path: metadata.name
42+
value: dispatch-api-external-secret
43+
- equal:
44+
path: spec.secretStoreRef.name
45+
value: team-vault
46+
- equal:
47+
path: spec.target.name
48+
value: dispatch-secrets
49+
- equal:
50+
path: spec.data[3].secretKey
51+
value: DATABASE_URL
52+
- equal:
53+
path: spec.data[3].remoteRef.property
54+
value: database_url

0 commit comments

Comments
 (0)