Add Helm chart for the expense tracker (app, Postgres, ingress, backups)
- Deployment/Service for the app, StatefulSet/Service for Postgres 17 - Secrets (DB password, session secret, Google client, allowed e-mails) via ExternalSecret from OpenBao - Ingress with a Let's Encrypt certificate, NetworkPolicy for Postgres - Nightly pg_dump CronJob - Optional OpenBao OIDC provider setup script Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
Claude Sonnet 5
@@ -0,0 +1,21 @@
|
||||
{{- define "expense-tracker.labels" -}}
|
||||
app.kubernetes.io/part-of: expense-tracker
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Standard PG* connection variables; the libpq/pg client reads these directly. */}}
|
||||
{{- define "expense-tracker.pgenv" -}}
|
||||
- name: PGHOST
|
||||
value: expense-tracker-postgres
|
||||
- name: PGPORT
|
||||
value: "5432"
|
||||
- name: PGDATABASE
|
||||
value: {{ .Values.postgres.database | quote }}
|
||||
- name: PGUSER
|
||||
value: {{ .Values.postgres.user | quote }}
|
||||
- name: PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: expense-tracker-db
|
||||
key: POSTGRES_PASSWORD
|
||||
{{- end }}
|
||||
@@ -0,0 +1,82 @@
|
||||
{{- if .Values.backup.enabled }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: expense-tracker-backups
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker-backup
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
{{- if .Values.backup.persistence.storageClassName }}
|
||||
storageClassName: {{ .Values.backup.persistence.storageClassName }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.backup.persistence.size }}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: expense-tracker-backup
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker-backup
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
spec:
|
||||
schedule: {{ .Values.backup.schedule | quote }}
|
||||
concurrencyPolicy: Forbid
|
||||
successfulJobsHistoryLimit: 2
|
||||
failedJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker-backup
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
runAsUser: 70
|
||||
runAsGroup: 70
|
||||
fsGroup: 70
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: pg-dump
|
||||
image: {{ .Values.postgres.image | quote }}
|
||||
command:
|
||||
- sh
|
||||
- -ec
|
||||
- |
|
||||
f="/backup/{{ .Values.postgres.database }}-$(date +%Y%m%d-%H%M%S).dump"
|
||||
# Write to a temp name first so a failed dump never looks like a good backup.
|
||||
pg_dump --format=custom --no-owner -f "$f.partial"
|
||||
mv "$f.partial" "$f"
|
||||
echo "wrote $f ($(du -h "$f" | cut -f1))"
|
||||
find /backup -name '*.dump' -mtime +{{ .Values.backup.retentionDays }} -print -delete
|
||||
find /backup -name '*.partial' -mmin +60 -delete
|
||||
ls -lh /backup
|
||||
env:
|
||||
{{- include "expense-tracker.pgenv" . | nindent 16 }}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- name: backups
|
||||
mountPath: /backup
|
||||
volumes:
|
||||
- name: backups
|
||||
persistentVolumeClaim:
|
||||
claimName: expense-tracker-backups
|
||||
{{- end }}
|
||||
@@ -0,0 +1,153 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: expense-tracker
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
# Stakater Reloader: rolling restart when ESO refreshes a secret from OpenBao
|
||||
# (env vars are only read at container start). Harmless if Reloader is not installed.
|
||||
secret.reloader.stakater.com/reload: "expense-tracker-app,expense-tracker-db"
|
||||
spec:
|
||||
replicas: {{ .Values.app.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
spec:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: app
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 5174
|
||||
env:
|
||||
- name: PORT
|
||||
value: "5174"
|
||||
- name: PUBLIC_URL
|
||||
value: {{ .Values.app.publicUrl | quote }}
|
||||
{{- include "expense-tracker.pgenv" . | nindent 12 }}
|
||||
- name: SESSION_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: expense-tracker-app
|
||||
key: SESSION_SECRET
|
||||
- name: ALLOWED_EMAILS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: expense-tracker-app
|
||||
key: ALLOWED_EMAILS
|
||||
{{- if .Values.auth.google.enabled }}
|
||||
- name: GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: expense-tracker-app
|
||||
key: GOOGLE_CLIENT_ID
|
||||
- name: GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: expense-tracker-app
|
||||
key: GOOGLE_CLIENT_SECRET
|
||||
{{- end }}
|
||||
{{- if .Values.auth.openbao.enabled }}
|
||||
- name: OPENBAO_ISSUER
|
||||
value: {{ .Values.auth.openbao.issuer | quote }}
|
||||
- name: OPENBAO_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: expense-tracker-app
|
||||
key: OPENBAO_CLIENT_ID
|
||||
- name: OPENBAO_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: expense-tracker-app
|
||||
key: OPENBAO_CLIENT_SECRET
|
||||
# OpenBao's certificate is self-signed (cert-manager), so trust its CA.
|
||||
- name: NODE_EXTRA_CA_CERTS
|
||||
value: /etc/openbao-ca/openbao-ca.crt
|
||||
{{- end }}
|
||||
# The server starts listening only after Postgres answered and migrations ran.
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
port: http
|
||||
periodSeconds: 3
|
||||
failureThreshold: 40
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
port: http
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
resources:
|
||||
{{- toYaml .Values.app.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
{{- if .Values.auth.openbao.enabled }}
|
||||
- name: openbao-ca
|
||||
mountPath: /etc/openbao-ca
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
{{- if .Values.auth.openbao.enabled }}
|
||||
- name: openbao-ca
|
||||
secret:
|
||||
secretName: expense-tracker-app
|
||||
items:
|
||||
- key: openbao-ca.crt
|
||||
path: openbao-ca.crt
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: expense-tracker
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
@@ -0,0 +1,74 @@
|
||||
# Both Secrets are created by External Secrets Operator from OpenBao (KV v2).
|
||||
# If a referenced key is missing in OpenBao the ExternalSecret reports an error and the
|
||||
# Secret is not created - so pods wait in CreateContainerConfigError until it exists.
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: expense-tracker-db
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
spec:
|
||||
refreshInterval: {{ .Values.externalSecret.refreshInterval }}
|
||||
secretStoreRef:
|
||||
kind: {{ .Values.externalSecret.storeKind }}
|
||||
name: {{ .Values.externalSecret.storeName }}
|
||||
target:
|
||||
name: expense-tracker-db
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: POSTGRES_PASSWORD
|
||||
remoteRef:
|
||||
key: {{ .Values.externalSecret.db.remoteKey }}
|
||||
property: {{ .Values.externalSecret.db.properties.password }}
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: expense-tracker-app
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
spec:
|
||||
refreshInterval: {{ .Values.externalSecret.refreshInterval }}
|
||||
secretStoreRef:
|
||||
kind: {{ .Values.externalSecret.storeKind }}
|
||||
name: {{ .Values.externalSecret.storeName }}
|
||||
target:
|
||||
name: expense-tracker-app
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: SESSION_SECRET
|
||||
remoteRef:
|
||||
key: {{ .Values.externalSecret.app.remoteKey }}
|
||||
property: {{ .Values.externalSecret.app.properties.sessionSecret }}
|
||||
- secretKey: ALLOWED_EMAILS
|
||||
remoteRef:
|
||||
key: {{ .Values.externalSecret.app.remoteKey }}
|
||||
property: {{ .Values.externalSecret.app.properties.allowedEmails }}
|
||||
{{- if .Values.auth.google.enabled }}
|
||||
- secretKey: GOOGLE_CLIENT_ID
|
||||
remoteRef:
|
||||
key: {{ .Values.externalSecret.app.remoteKey }}
|
||||
property: {{ .Values.externalSecret.app.properties.googleClientId }}
|
||||
- secretKey: GOOGLE_CLIENT_SECRET
|
||||
remoteRef:
|
||||
key: {{ .Values.externalSecret.app.remoteKey }}
|
||||
property: {{ .Values.externalSecret.app.properties.googleClientSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.auth.openbao.enabled }}
|
||||
- secretKey: OPENBAO_CLIENT_ID
|
||||
remoteRef:
|
||||
key: {{ .Values.externalSecret.app.remoteKey }}
|
||||
property: {{ .Values.externalSecret.app.properties.openbaoClientId }}
|
||||
- secretKey: OPENBAO_CLIENT_SECRET
|
||||
remoteRef:
|
||||
key: {{ .Values.externalSecret.app.remoteKey }}
|
||||
property: {{ .Values.externalSecret.app.properties.openbaoClientSecret }}
|
||||
- secretKey: openbao-ca.crt
|
||||
remoteRef:
|
||||
key: {{ .Values.externalSecret.app.remoteKey }}
|
||||
property: {{ .Values.externalSecret.app.properties.openbaoCaCert }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,33 @@
|
||||
{{- if .Values.ingress.enabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: expense-tracker
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }}
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.ingress.proxyBodySize | quote }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
tls:
|
||||
- hosts:
|
||||
- {{ .Values.ingress.host }}
|
||||
secretName: {{ .Values.ingress.tlsSecretName }}
|
||||
rules:
|
||||
- host: {{ .Values.ingress.host }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: expense-tracker
|
||||
port:
|
||||
name: http
|
||||
{{- end }}
|
||||
@@ -0,0 +1,9 @@
|
||||
{{- if .Values.namespace.create }}
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
# Postgres accepts connections only from the app and the backup job of this release.
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: expense-tracker-postgres
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker-postgres
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: expense-tracker-postgres
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: expense-tracker
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: expense-tracker-backup
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5432
|
||||
{{- end }}
|
||||
@@ -0,0 +1,118 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: expense-tracker-postgres
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker-postgres
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: expense-tracker-postgres
|
||||
ports:
|
||||
- name: postgres
|
||||
port: 5432
|
||||
targetPort: postgres
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: expense-tracker-postgres
|
||||
namespace: {{ .Values.namespace.name }}
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker-postgres
|
||||
{{- include "expense-tracker.labels" . | nindent 4 }}
|
||||
spec:
|
||||
serviceName: expense-tracker-postgres
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: expense-tracker-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: expense-tracker-postgres
|
||||
spec:
|
||||
securityContext:
|
||||
# uid/gid of the `postgres` user in the alpine image
|
||||
runAsUser: 70
|
||||
runAsGroup: 70
|
||||
fsGroup: 70
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: postgres
|
||||
image: {{ .Values.postgres.image | quote }}
|
||||
ports:
|
||||
- name: postgres
|
||||
containerPort: 5432
|
||||
env:
|
||||
- name: POSTGRES_DB
|
||||
value: {{ .Values.postgres.database | quote }}
|
||||
- name: POSTGRES_USER
|
||||
value: {{ .Values.postgres.user | quote }}
|
||||
# Only used when the data directory is first initialised; changing it later in
|
||||
# OpenBao does NOT change the database user's password (see README).
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: expense-tracker-db
|
||||
key: POSTGRES_PASSWORD
|
||||
# A sub-directory, because the volume root may contain lost+found.
|
||||
- name: PGDATA
|
||||
value: /var/lib/postgresql/data/pgdata
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["sh", "-c", "pg_isready -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
livenessProbe:
|
||||
exec:
|
||||
command: ["sh", "-c", "pg_isready -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 20
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 6
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
resources:
|
||||
{{- toYaml .Values.postgres.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
# Unix socket dir + scratch space (the image writes there as the postgres user)
|
||||
- name: run
|
||||
mountPath: /var/run/postgresql
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
volumes:
|
||||
- name: run
|
||||
emptyDir: {}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
{{- if .Values.postgres.persistence.storageClassName }}
|
||||
storageClassName: {{ .Values.postgres.persistence.storageClassName }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.postgres.persistence.size }}
|
||||
Reference in New Issue
Block a user