Skip to content

Commit 03c3cdc

Browse files
stranljipstranljip
committed
current state of things
1 parent 06fdc00 commit 03c3cdc

File tree

7 files changed

+192
-35
lines changed

7 files changed

+192
-35
lines changed

‎helmchart/geohealthcheck/my-values.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
---
2+
image:
3+
repository: 'registry.disy.net/docker-proxy/geopython/geohealthcheck'
4+
additionalCertificates:
5+
intermediate.crt: |
6+
-----BEGIN CERTIFICATE-----
7+
MIIFzDCCA7SgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwejEYMBYGA1UEAwwPSGVp
8+
ZG1hbm4tUm9vdENBMQswCQYDVQQGEwJERTELMAkGA1UECAwCSEgxEDAOBgNVBAcM
9+
B0hhbWJ1cmcxETAPBgNVBAoMCEhlaWRtYW5uMR8wHQYJKoZIhvcNAQkBFhBjYUBo
10+
ZWlkbWFubi5pbmZvMB4XDTI0MTIzMDExMjQzMVoXDTM0MTIyODExMjQzMVowcDEL
11+
MAkGA1UEBhMCREUxCzAJBgNVBAgMAkhIMREwDwYDVQQKDAhIZWlkbWFubjEgMB4G
12+
A1UEAwwXSGVpZG1hbm4tSW50ZXJtZWRpYXRlQ0ExHzAdBgkqhkiG9w0BCQEWEGNh
13+
QGhlaWRtYW5uLmluZm8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDb
14+
QQ4DfXSeZc/XVHfQ6EghPQ12PYShvQk6hgZkhkkmBicb8c9POslSYpkkK/Q8pC+5
15+
XjIFF7yMR5FGxbZEtkIqFu9gHI6Sxm1FJptKhJSiPRy2MHhSjSImyG3GVXG+ZGRh
16+
7P3wbZIqtoK70BrrdkrJTzoWU0qDhYQgCBlCpO88m1e0Qox/6UqnuhGgHcdwJPJS
17+
zqUHqdsTGHxQo2hlHGm5CFTsTe37aUlQ9+627riVqK8ArhUXCCx3j4tyfkPBSxnV
18+
uHyyndfeIMR1J2ofv5oiSTY148Dgkr7YyUFwfgO8H8onPs8SfCDL6hfoAGRHreeH
19+
tC/4hHj9NYhnX3km1PvqMQWHAcPveswFnTpQ/ZaBibaSeC8i+JtT9iKW1V6JQgD7
20+
Fim7nart6JgCytcxg8Cll7nNfqRwlkBNiedSU9i8FEEHy/YFmKj4D15YLluYTZCd
21+
G2SEP2JEDGEqzTbmdxFsLKm59VI9FFTtcKKRgRlIoF7PoHc9brUoRu20MjaGSpZO
22+
CwqLIdQv7yQv7z6ebfKxViCyIpsZESPHbKZ7Zyh9IYNa8BxlAvbEQnkVjBrplDdQ
23+
yWlOJac5j+bCr4VJpIOicd7jek9g2W8TlxzMGjkHFSDMnMPFJS64NduZYdqT/ASp
24+
aNcbzOGpmALIZTXJszBI3400mBEXBe0YoA6LGgUDUQIDAQABo2YwZDAdBgNVHQ4E
25+
FgQUu8smU9eJDo4w+fPXw7942P0aux4wHwYDVR0jBBgwFoAUqQvWT3pd78gQnAhu
26+
/t5hth1uVn4wEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwDQYJ
27+
KoZIhvcNAQELBQADggIBAJQ+tACyevmB+uheXX1rZa6k0JkWij8oX5mlk+O6sSCu
28+
toZ3iP3MdYuxAMaSOjU1+04ZRqUkn15QQ4gmyyqQ6ojdDqPHfploypNtTMh/HrYr
29+
E/x4zqM0PCx1LUpkbbwe8eL/5CibdMCWsapxRNY6LBgsG6m9pOSIScv0SYRkAfTQ
30+
dM5u67BLV23c7EkVv10WHfqKnOGnkHCaFDPXZXjPfl7KsjxwbNKK4bRQrgu9Wpzg
31+
h0tRmEu1969fjj7AEGoxomiUdTLwcQu9f/OeJmqrlwoaYdq/rtInt+a+fi6HylX8
32+
XHIsr71UsneUu5eOos1lNdzzKjNsMa/pI1vgoKY/83u68/mwjfyL45FIq8Aq8VS/
33+
6uncn6EEqtyElqPxDkfRr3H0DEwXjiwU6No2/Gre1BKvK3/KuF/A8CWDpgSrsYEv
34+
bAjZaQo0uCYydc8NrDykN36K5IVlEaGseLOnXdi8oOAWf/pzMck8EasfIPjVPhU8
35+
Q+biOQC9dejBGxmWxrcpAbl/thes16v5iA7sls5VyLY7dn5P39BPMgRSssPBErAL
36+
v+9x6+IKnNPZV8U4KuOSQZVIZe/fmumO4vKisE+LsIG4S7C3+tgIk9cr+KTITvUT
37+
/CYKPJhWrMKoNUgIBZs1MhbEW1zj7bDb7V3sv/8yTomxobWy4B7NlvWK4dBFDqOJ
38+
-----END CERTIFICATE-----
39+
root.crt: |
40+
-----BEGIN CERTIFICATE-----
41+
MIIF5TCCA82gAwIBAgIUPLeDukjBOWKP3yfOT4X8WFx/qmQwDQYJKoZIhvcNAQEL
42+
BQAwejEYMBYGA1UEAwwPSGVpZG1hbm4tUm9vdENBMQswCQYDVQQGEwJERTELMAkG
43+
A1UECAwCSEgxEDAOBgNVBAcMB0hhbWJ1cmcxETAPBgNVBAoMCEhlaWRtYW5uMR8w
44+
HQYJKoZIhvcNAQkBFhBjYUBoZWlkbWFubi5pbmZvMB4XDTI0MTIzMDExMjA1NVoX
45+
DTQ0MTIyNTExMjA1NVowejEYMBYGA1UEAwwPSGVpZG1hbm4tUm9vdENBMQswCQYD
46+
VQQGEwJERTELMAkGA1UECAwCSEgxEDAOBgNVBAcMB0hhbWJ1cmcxETAPBgNVBAoM
47+
CEhlaWRtYW5uMR8wHQYJKoZIhvcNAQkBFhBjYUBoZWlkbWFubi5pbmZvMIICIjAN
48+
BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5e3IwLY5mdPp2DjFLu1HTVaN6bdz
49+
FP6oBshDHsnIWWRfijO0XMtzuefKKmoMl+o7Tbw9JJsMWBnZdYQ0mrWAc1P9tbkd
50+
2IouNDsGfnb8/92DaR7YtCNZjuF2bJUdt4jsvOXfaPFIEx50M6oICg1UvXGgbD1U
51+
Q8nk7/aCyTSaqbNQuxIQckftMK/t7/M/ZX4srW0Lf0aFgDs50YW1Eer3DfgE8FpM
52+
1z4yp/mZTcrLzvXhKCUo8LsEpNPeTpkshVBjdQReJnEcGIvk5aCPNF43IueM+qDg
53+
eYedsQnWeLz8Sg0SPQ7awcoSDwcOcaKUFqs4YpWbDwoBbvhSc4Uq+d2wgNJgNcJJ
54+
3eZaqqRylw+I3D47is1IHPb0jP5SWi6HKdGHQJwYTKdAqL+6XohnB/DWrHFvvFJa
55+
6GLaExk+CYTZcmQh6cY6p3HvhEG5pmkNPLyoHxBwtpU/bLeeZ99J469mTtPACxPM
56+
srxpCSmmMxopmBvYokzWIxg5etwshb/YDzeWP3UIipaiCftN1dhhKLjMNMtv2/7p
57+
vsDNY/2Kqs+4pZUQP0UsJHvVo3sskkDbyO8kjSxkM8gvNL4FO1v14ihlYFqQyPE4
58+
iPAvAcIeAsJXl8A0rYmL5xz0XTjA9FDt6f4Duu9vmbHJBr7wIuUBcIDWLtYC4k2+
59+
9JFpz/wF6qSR1w8CAwEAAaNjMGEwHQYDVR0OBBYEFKkL1k96Xe/IEJwIbv7eYbYd
60+
blZ+MB8GA1UdIwQYMBaAFKkL1k96Xe/IEJwIbv7eYbYdblZ+MA8GA1UdEwEB/wQF
61+
MAMBAf8wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4ICAQCDC5IcejVj
62+
K3n7/YNmVZ0JSNSmOwLbOFxBIrI7DuW/suqUTuGVMkcndCsK4iOsI2rs97Z7397N
63+
Gnmz/EyfjDx/9R+QvEcgFpgT9mhFt+kDcUWZ52l0DqBmqUVqPHgc5um+FjNNrxfT
64+
OI6ZPPE5QWRPU6duUGmOMIN1m0stj/j03bfP5ovFamqStceV6NL9LlVXj1gaSt+y
65+
jtVddZiqDMoW/7XEe2nDQsEK4iMww3JaWf/ZZ6ufp8EU26McBuDwuzEqAyNpQARf
66+
p73Qr0yCzs3qzpkTp5ze2pODAECC4DzQUNxv7bktOvGAhfryIGemLbm7f2EfuZOg
67+
tUvrhTggqb4qLPqvEaA7clVUG3MpWEeewmLOHn/KA46BogEJy3LonJDJlsMJR9Q1
68+
74qFdNmZtOJrH63j7re54MR6RHIYGSHUUofSGSwwUsXToyLTVc1XLU6MPjiN+5Ul
69+
ocQETLAV51oSzoKPCcTWJv+E7XeVb7EPJU8rhZHzdxuGTcRG+ocj9p9h34JZUfKP
70+
xby4V9Tk61eHATs7fqs/GDwme/Oyd5Bxi2SEjm13c8ftD/R1qn6NKwNwU4m/Qj5u
71+
cwwCeaMVOEIFnRRVAoarZaC6cvYRg+P4uC+EkBYCJT4PcSPVuMpMTBmEybNSzynN
72+
JgeVtaEOfwvvFzswuGlIUvmO4B96AFXymQ==
73+
-----END CERTIFICATE-----
74+
resources:
75+
limits:
76+
cpu: '500m'
77+
memory: '1Gi'
78+
requests:
79+
cpu: '500m'
80+
memory: '1Gi'
81+
initContainer:
82+
repository: 'registry.disy.net/docker-proxy/library/ubuntu'
83+
resources:
84+
limits:
85+
cpu: '500m'
86+
memory: '1Gi'
87+
requests:
88+
cpu: '500m'
89+
memory: '1Gi'
90+
91+
ingress:
92+
enabled: true
93+
hosts:
94+
- host: 'geohealthcheck.whale-test2.disy.io'
95+
paths:
96+
- path: '/'
97+
pathType: 'ImplementationSpecific'
98+
tls:
99+
- secretName: 'tls-cluster'
100+
hosts:
101+
- 'geohealthcheck.whale-test2.disy.io'

‎helmchart/geohealthcheck/templates/cm-secrets-variables.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,8 @@ metadata:
77
{{- include "geohealthcheck.labels" . | nindent 4 }}
88
type: 'Opaque'
99
data:
10-
SECRET_KEY: {{ .Values.geohealthcheck.auth.secret | squote }}
11-
GHC_SMTP_PASSWORD: {{ .Values.geohealthcheck.smtpPassword | squote }}
10+
SECRET_KEY: {{ .Values.geohealthcheck.auth.secret | b64enc | squote }}
11+
{{- if .Values.geohealthcheck.smtpPassword }}
12+
GHC_SMTP_PASSWORD: {{ .Values.geohealthcheck.smtpPassword | b64enc | squote }}
13+
{{- end }}
14+
SQLALCHEMY_DATABASE_URI: {{ .Values.geohealthcheck.databaseUri | b64enc | squote }}

‎helmchart/geohealthcheck/templates/deployment.yaml‎

Lines changed: 28 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,15 @@ spec:
3030
{{- toYaml .Values.podSecurityContext | nindent 8 }}
3131
initContainers:
3232
- name: update-ca-certificates
33-
image: '{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}'
34-
command: ['sh', '-c', 'cp /custom-ca/* /usr/local/share/ca-certificates/ && update-ca-certificates']
33+
image: '{{ .Values.initContainer.repository }}:{{ .Values.initContainer.tag }}'
34+
command: ['sh', '-c', 'apt-get update && apt-get install -y ca-certificates && update-ca-certificates']
35+
resources:
36+
{{- toYaml .Values.initContainer.resources | nindent 12 }}
3537
volumeMounts:
36-
- name: custom-ca-cert
37-
mountPath: /custom-ca
38+
- name: 'custom-ca-cert'
39+
mountPath: '/usr/local/share/ca-certificates'
40+
- name: 'ca-bundle'
41+
mountPath: '/etc/ssl/certs'
3842
containers:
3943
- name: {{ .Chart.Name | squote }}
4044
securityContext:
@@ -51,17 +55,33 @@ spec:
5155
{{- toYaml .Values.readinessProbe | nindent 12 }}
5256
resources:
5357
{{- toYaml .Values.resources | nindent 12 }}
58+
envFrom:
59+
- secretRef:
60+
name: {{ printf "%s-secrets" (include "geohealthcheck.fullname" .) | squote }}
61+
{{- range .Values.geohealthcheck.additionalEnvSecrets }}
62+
- secretRef:
63+
name: {{ . | squote }}
64+
{{- end }}
65+
- configMapRef:
66+
name: {{ printf "%s-variables" (include "geohealthcheck.fullname" .) | squote }}
67+
{{- range .Values.geohealthcheck.additionalConfigMaps }}
68+
- configMapRef:
69+
name: {{ . | squote }}
70+
{{- end }}
5471
volumeMounts:
55-
# TODO: loop through certs
56-
- name: custom-ca-cert
57-
mountPath: /etc/ssl/certs/my-ca.crt
72+
- name: 'custom-ca-cert'
73+
mountPath: '/usr/local/share/ca-certificates'
74+
- name: 'ca-bundle'
75+
mountPath: '/etc/ssl/certs'
5876
{{- with .Values.volumeMounts }}
5977
{{- toYaml . | nindent 12 }}
6078
{{- end }}
6179
volumes:
6280
- name: custom-ca-cert
6381
configMap:
64-
name: custom-ca-cert
82+
name: {{ printf "%s-certificates" (include "geohealthcheck.fullname" .) | squote }}
83+
- name: ca-bundle
84+
emptyDir: {}
6585
{{- with .Values.volumes }}
6686
{{- toYaml . | nindent 8 }}
6787
{{- end }}
@@ -84,16 +104,3 @@ spec:
84104
value: {{ $value | squote }}
85105
{{- end }}
86106
{{- end }}
87-
envFrom:
88-
- secretRef:
89-
name: {{ printf "%s-secrets" (include "geohealthcheck.fullname" .) | squote }}
90-
{{- range .Values.geohealthcheck.additionalEnvSecrets }}
91-
- secretRef:
92-
name: {{ . | squote }}
93-
{{- end }}
94-
- configMapRef:
95-
name: {{ printf "%s-variables" (include "geohealthcheck.fullname" .) | squote }}
96-
{{- range .Values.geohealthcheck.additionalConfigMaps }}
97-
- configMapRef:
98-
name: {{ . | squote }}
99-
{{- end }}

‎helmchart/geohealthcheck/templates/ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ spec:
3838
service:
3939
name: {{ include "geohealthcheck.fullname" $ }}
4040
port:
41-
number: {{ $.Values.service.port }}
41+
name: 'http'
4242
{{- end }}
4343
{{- end }}
4444
{{- end }}

‎helmchart/geohealthcheck/templates/networkpolicies.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
{{- if .Values.networkPolicy.enabled }}
3+
apiVersion: networking.k8s.io/v1
4+
kind: NetworkPolicy
5+
metadata:
6+
name: {{ include "geohealthcheck.fullname" . }}
7+
labels:
8+
{{- include "geohealthcheck.labels" . | nindent 4 }}
9+
spec:
10+
podSelector:
11+
matchLabels:
12+
{{- include "geohealthcheck.labels" . | nindent 6 }}
13+
policyTypes:
14+
- 'Ingress'
15+
- Egress
16+
ingress:
17+
- from:
18+
- namespaceSelector: {}
19+
ports:
20+
- protocol: 'TCP'
21+
port: {{ include "geohealthcheck.containerPort" . }}
22+
- from:
23+
- ipBlock:
24+
cidr: 0.0.0.0/0
25+
ports:
26+
- protocol: 'TCP'
27+
port: {{ include "geohealthcheck.containerPort" . }}
28+
egress:
29+
- to:
30+
- namespaceSelector: {}
31+
ports:
32+
- port: 53
33+
protocol: 'UDP'
34+
{{- if .Values.networkPolicy.egressEnabled }}
35+
- to:
36+
- ipBlock:
37+
cidr: 0.0.0.0/0
38+
{{- end }}
39+
{{- end }}

‎helmchart/geohealthcheck/templates/serviceaccount.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ metadata:
1010
annotations:
1111
{{- toYaml . | nindent 4 }}
1212
{{- end }}
13-
automountServiceAccountToken: {{ .Values.serviceAccount.automount | squote }}
13+
automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
1414
{{- end }}

‎helmchart/geohealthcheck/values.yaml‎

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,12 @@ securityContext: {}
5151
# runAsNonRoot: true
5252
# runAsUser: 1000
5353

54+
initContainer:
55+
resources: {}
56+
repository: 'library/ubuntu'
57+
pullPolicy: 'IfNotPresent'
58+
tag: 'jammy'
59+
5460
geohealthcheck:
5561
# -- additional env variables
5662
# additionalEnv:
@@ -67,6 +73,11 @@ geohealthcheck:
6773
# - 'foo'
6874
# - 'bar'
6975
additionalEnvSecrets: []
76+
# -- database connection string for SQL-Alchemy
77+
# valid examples are:
78+
# SQLite: 'sqlite:///data.db'
79+
# PostgreSQL: 'postgresql+psycopg2://scott:tiger@localhost:5432/mydatabase'
80+
databaseUri: 'sqlite:///data.db'
7081
auth:
7182
# -- secret key to set when enabling authentication
7283
secret: 'changeme'
@@ -141,16 +152,8 @@ service:
141152
# https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
142153
type: 'ClusterIP'
143154

144-
additionalCertificates:
145-
cert1.crt: |
146-
-----BEGIN CERTIFICATE-----
147-
MIID... (your certificate content here)
148-
-----END CERTIFICATE-----
149-
cert2.crt: |
150-
-----BEGIN CERTIFICATE-----
151-
MIID... (your certificate content here)
152-
-----END CERTIFICATE-----
153-
155+
additionalCertificates: {}
156+
154157
# This block is for setting up the ingress for more information can be found
155158
# here: https://kubernetes.io/docs/concepts/services-networking/ingress/
156159
ingress:
@@ -216,3 +219,7 @@ nodeSelector: {}
216219
tolerations: []
217220

218221
affinity: {}
222+
223+
networkPolicy:
224+
enabled: true
225+
egressEnabled: true

0 commit comments

Comments
 (0)