Skip to content

Commit 9128ea8

Browse files
NissesSenapdecyjphr
NissesSenap
and
decyjphr
authored
Create official helm chart for safe-settings (#580)
* initial helm chart * whitespaces * release helm chart * set port 3000 * env not envFrom * can we use readiness probe? * add service annotation --------- Co-authored-by: Yadhav Jayaraman <[email protected]>
1 parent 90ae0ae commit 9128ea8

14 files changed

+576
-6
lines changed

‎.github/workflows/create-release.yml

+25-6
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
name: Create a release
22
on:
3-
workflow_dispatch:
3+
workflow_dispatch:
44
# push:
55
# branches:
66
# - main-enterprise
77

8-
9-
108
env:
119
REGISTRY: ghcr.io
1210
IMAGE_NAME: ${{ github.repository }}
@@ -23,7 +21,7 @@ jobs:
2321
uses: actions/setup-node@v3
2422
with:
2523
node-version: 16.x
26-
cache: 'npm'
24+
cache: "npm"
2725
- run: npm install
2826
- name: Set up Docker Buildx
2927
uses: docker/setup-buildx-action@v3
@@ -39,7 +37,7 @@ jobs:
3937
context: .
4038
file: ./Dockerfile
4139
load: true
42-
tags: |
40+
tags: |
4341
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main-enterprise
4442
- name: Inspect the Docker Image
4543
run: |
@@ -50,7 +48,7 @@ jobs:
5048
docker run --env APP_ID=${{ secrets.APP_ID }} --env PRIVATE_KEY=${{ secrets.PRIVATE_KEY }} --env WEBHOOK_SECRET=${{ secrets.WEBHOOK_SECRET }} -d -p 3000:3000 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main-enterprise
5149
sleep 10
5250
curl http://localhost:3000
53-
- name: Tag a final release
51+
- name: Tag a final release
5452
id: finalrelease
5553
uses: actionsdesk/[email protected]
5654
with:
@@ -68,6 +66,27 @@ jobs:
6866
provenance: false
6967
sbom: false
7068

69+
helm:
70+
runs-on: ubuntu-latest
71+
steps:
72+
- name: Clone repo
73+
uses: actions/checkout@v4
74+
75+
- name: Prepare
76+
run: |
77+
# OCI standard enforces lower-case paths
78+
GHCR_REPO=$(echo "ghcr.io/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
79+
HELM_REPO=$(echo "oci://ghcr.io/${{ github.repository_owner }}/helm-charts" | tr '[:upper:]' '[:lower:]')
80+
echo "GHCR_REPO=$GHCR_REPO" >> $GITHUB_ENV
81+
echo "HELM_REPO=$HELM_REPO" >> $GITHUB_ENV
82+
83+
- name: Publish Helm charts
84+
run: |
85+
cd helm
86+
helm registry login -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }} ghcr.io
87+
helm package --app-version ${{ github.ref_name }} --version ${{ github.ref_name }} safe-settings
88+
helm push safe-settings-${{ github.ref_name }}.tgz ${{ env.HELM_REPO }}
89+
7190
#trigger-deployment:
7291
# needs: build
7392
# runs-on: ubuntu-latest

‎helm/safe-settings/.helmignore

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎helm/safe-settings/Chart.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: safe-settings
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "2.1.2"

‎helm/safe-settings/README.md

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# safe-settings
2+
3+
A Helm chart for Kubernetes
4+
5+
## Values
6+
7+
| Key | Type | Default | Description |
8+
|-----|------|---------|-------------|
9+
| affinity | object | `{}` | |
10+
| autoscaling.enabled | bool | `false` | |
11+
| autoscaling.maxReplicas | int | `10` | |
12+
| autoscaling.minReplicas | int | `2` | |
13+
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
14+
| deploymentConfig.configvalidators[0].error | string | `"`Admin cannot be assigned to collaborators`\n"` | |
15+
| deploymentConfig.configvalidators[0].plugin | string | `"collaborators"` | |
16+
| deploymentConfig.configvalidators[0].script | string | `"console.log(`baseConfig ${JSON.stringify(baseconfig)}`)\nreturn baseconfig.permission != 'admin'\n"` | |
17+
| deploymentConfig.overridevalidators[0].error | string | `"`Branch protection required_approving_review_count cannot be overidden to a lower value`\n"` | |
18+
| deploymentConfig.overridevalidators[0].plugin | string | `"branches"` | |
19+
| deploymentConfig.overridevalidators[0].script | string | `"console.log(`baseConfig ${JSON.stringify(baseconfig)}`)\nconsole.log(`overrideConfig ${JSON.stringify(overrideconfig)}`)\nif (baseconfig.protection.required_pull_request_reviews.required_approving_review_count && overrideconfig.protection.required_pull_request_reviews.required_approving_review_count ) {\n return overrideconfig.protection.required_pull_request_reviews.required_approving_review_count >= baseconfig.protection.required_pull_request_reviews.required_approving_review_count\n}\nreturn true\n"` | |
20+
| deploymentConfig.overridevalidators[1].error | string | `"Some error\n"` | |
21+
| deploymentConfig.overridevalidators[1].plugin | string | `"labels"` | |
22+
| deploymentConfig.overridevalidators[1].script | string | `"return true\n"` | |
23+
| deploymentConfig.restrictedRepos.exclude[0] | string | `"^admin$"` | |
24+
| deploymentConfig.restrictedRepos.exclude[1] | string | `"^\\.github$"` | |
25+
| deploymentConfig.restrictedRepos.exclude[2] | string | `"^safe-settings$"` | |
26+
| deploymentConfig.restrictedRepos.exclude[3] | string | `".*-test"` | |
27+
| deploymentConfig.restrictedRepos.include[0] | string | `"^test$"` | |
28+
| env | list | `[]` | |
29+
| envFrom | list | `[]` | |
30+
| extraObjects | list | `[]` | Add dynamic manifests via values. Example: extraObjects: - kind: ConfigMap apiVersion: v1 metadata: name: extra-cm-{{ .Release.Name }} data: | extra.yml: "does-my-install-need-extra-info: true" |
31+
| fullnameOverride | string | `""` | |
32+
| image.pullPolicy | string | `"IfNotPresent"` | |
33+
| image.repository | string | `"ghcr.io/github/safe-settings"` | |
34+
| image.tag | string | `""` | |
35+
| imagePullSecrets | list | `[]` | |
36+
| ingress.annotations | object | `{}` | |
37+
| ingress.className | string | `""` | |
38+
| ingress.enabled | bool | `false` | |
39+
| ingress.hosts[0].host | string | `"chart-example.local"` | |
40+
| ingress.hosts[0].paths[0].path | string | `"/"` | |
41+
| ingress.hosts[0].paths[0].pathType | string | `"ImplementationSpecific"` | |
42+
| ingress.tls | list | `[]` | |
43+
| nameOverride | string | `""` | |
44+
| nodeSelector | object | `{}` | |
45+
| podAnnotations | object | `{}` | |
46+
| podSecurityContext | object | `{}` | |
47+
| replicaCount | int | `2` | |
48+
| resources | object | `{}` | |
49+
| securityContext.allowPrivilegeEscalation | bool | `false` | |
50+
| securityContext.capabilities.drop[0] | string | `"ALL"` | |
51+
| securityContext.privileged | bool | `false` | |
52+
| securityContext.readOnlyRootFilesystem | bool | `true` | |
53+
| securityContext.runAsNonRoot | bool | `true` | |
54+
| securityContext.runAsUser | int | `1000` | |
55+
| service.port | int | `80` | |
56+
| service.type | string | `"ClusterIP"` | |
57+
| serviceAccount.annotations | object | `{}` | |
58+
| serviceAccount.automountServiceAccountToken | bool | `false` | |
59+
| serviceAccount.create | bool | `true` | |
60+
| serviceAccount.name | string | `""` | |
61+
| tolerations | list | `[]` | |
62+
| volumeMounts | list | `[]` | |
63+
| volumes | list | `[]` | |
64+

‎helm/safe-settings/templates/NOTES.txt

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
1. Get the application URL by running these commands:
2+
{{- if .Values.ingress.enabled }}
3+
{{- range $host := .Values.ingress.hosts }}
4+
{{- range .paths }}
5+
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
6+
{{- end }}
7+
{{- end }}
8+
{{- else if contains "NodePort" .Values.service.type }}
9+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "safe-settings.fullname" . }})
10+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
11+
echo http://$NODE_IP:$NODE_PORT
12+
{{- else if contains "LoadBalancer" .Values.service.type }}
13+
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
14+
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "safe-settings.fullname" . }}'
15+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "safe-settings.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
16+
echo http://$SERVICE_IP:{{ .Values.service.port }}
17+
{{- else if contains "ClusterIP" .Values.service.type }}
18+
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "safe-settings.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
19+
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
20+
echo "Visit http://127.0.0.1:8080 to use your application"
21+
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
22+
{{- end }}

‎helm/safe-settings/templates/_helpers.tpl

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "safe-settings.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "safe-settings.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "safe-settings.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "safe-settings.labels" -}}
37+
helm.sh/chart: {{ include "safe-settings.chart" . }}
38+
{{ include "safe-settings.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "safe-settings.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "safe-settings.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "safe-settings.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "safe-settings.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎helm/safe-settings/templates/deployment-config.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{{- $fullName := include "safe-settings.fullname" . -}}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ $fullName }}-deployment-config
6+
data:
7+
deployment-settings.yml: |
8+
{{ .Values.deploymentConfig | toYaml | nindent 4 }}

‎helm/safe-settings/templates/deployment.yaml

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "safe-settings.fullname" . }}
5+
labels:
6+
{{- include "safe-settings.labels" . | nindent 4 }}
7+
spec:
8+
{{- if not .Values.autoscaling.enabled }}
9+
replicas: {{ .Values.replicaCount }}
10+
{{- end }}
11+
selector:
12+
matchLabels:
13+
{{- include "safe-settings.selectorLabels" . | nindent 6 }}
14+
template:
15+
metadata:
16+
{{- with .Values.podAnnotations }}
17+
annotations:
18+
{{- toYaml . | nindent 8 }}
19+
{{- end }}
20+
labels:
21+
{{- include "safe-settings.selectorLabels" . | nindent 8 }}
22+
spec:
23+
{{- with .Values.imagePullSecrets }}
24+
imagePullSecrets:
25+
{{- toYaml . | nindent 8 }}
26+
{{- end }}
27+
serviceAccountName: {{ include "safe-settings.serviceAccountName" . }}
28+
securityContext:
29+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
30+
containers:
31+
- name: {{ .Chart.Name }}
32+
securityContext:
33+
{{- toYaml .Values.securityContext | nindent 12 }}
34+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
35+
imagePullPolicy: {{ .Values.image.pullPolicy }}
36+
{{- with .Values.envFrom }}
37+
envFrom:
38+
{{- toYaml . | nindent 10 }}
39+
{{- end }}
40+
{{- with .Values.env }}
41+
env:
42+
{{- toYaml . | nindent 10 }}
43+
{{- end }}
44+
ports:
45+
- name: http
46+
containerPort: {{ .Values.service.port }}
47+
protocol: TCP
48+
resources:
49+
{{- toYaml .Values.resources | nindent 12 }}
50+
volumeMounts:
51+
- name: config-volume
52+
mountPath: /opt/safe-settings/deployment-settings.yml
53+
subPath: deployment-settings.yml
54+
- name: tmp-dir
55+
mountPath: /home/node/.npm/
56+
{{- with .Values.volumeMounts }}
57+
{{- toYaml . | nindent 10 }}
58+
{{- end }}
59+
volumes:
60+
- name: config-volume
61+
configMap:
62+
name: {{ include "safe-settings.fullname" . }}-deployment-config
63+
- name: tmp-dir
64+
emptyDir: {}
65+
{{- with .Values.volumes }}
66+
{{- toYaml . | nindent 8 }}
67+
{{- end }}
68+
{{- with .Values.nodeSelector }}
69+
nodeSelector:
70+
{{- toYaml . | nindent 8 }}
71+
{{- end }}
72+
{{- with .Values.affinity }}
73+
affinity:
74+
{{- toYaml . | nindent 8 }}
75+
{{- end }}
76+
{{- with .Values.tolerations }}
77+
tolerations:
78+
{{- toYaml . | nindent 8 }}
79+
{{- end }}

‎helm/safe-settings/templates/extra-manifests.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{{ range .Values.extraObjects }}
2+
---
3+
{{ tpl (toYaml .) $ }}
4+
{{ end }}

‎helm/safe-settings/templates/hpa.yaml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{{- if .Values.autoscaling.enabled }}
2+
apiVersion: autoscaling/v2
3+
kind: HorizontalPodAutoscaler
4+
metadata:
5+
name: {{ include "safe-settings.fullname" . }}
6+
labels:
7+
{{- include "safe-settings.labels" . | nindent 4 }}
8+
spec:
9+
scaleTargetRef:
10+
apiVersion: apps/v1
11+
kind: Deployment
12+
name: {{ include "safe-settings.fullname" . }}
13+
minReplicas: {{ .Values.autoscaling.minReplicas }}
14+
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
15+
metrics:
16+
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
17+
- type: Resource
18+
resource:
19+
name: cpu
20+
target:
21+
type: Utilization
22+
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
23+
{{- end }}
24+
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
25+
- type: Resource
26+
resource:
27+
name: memory
28+
target:
29+
type: Utilization
30+
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
31+
{{- end }}
32+
{{- end }}

0 commit comments

Comments
 (0)