@bluedynamics/cdk8s-plone 0.1.43 → 0.1.45

package/examples/blicca/__snapshots__/main.test.ts.snap

@@ -2,145 +2,22 @@
 
 exports[`Blicca Example Synthesizes correctly 1`] = `
 [
-  {
-    "apiVersion": "networking.k8s.io/v1",
-    "kind": "NetworkPolicy",
-    "metadata": {
-      "labels": {
-        "app.kubernetes.io/component": "primary",
-        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-        "app.kubernetes.io/managed-by": "Helm",
-        "app.kubernetes.io/name": "postgresql",
-        "app.kubernetes.io/part-of": "plone",
-        "app.kubernetes.io/version": "18.1.0",
-        "helm.sh/chart": "postgresql-18.1.10",
-      },
-      "name": "test-chart-db-c80fdf3b-postgresql",
-      "namespace": "plone",
-    },
-    "spec": {
-      "egress": [
-        {},
-      ],
-      "ingress": [
-        {
-          "ports": [
-            {
-              "port": 5432,
-            },
-          ],
-        },
-      ],
-      "podSelector": {
-        "matchLabels": {
-          "app.kubernetes.io/component": "primary",
-          "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-          "app.kubernetes.io/name": "postgresql",
-        },
-      },
-      "policyTypes": [
-        "Ingress",
-        "Egress",
-      ],
-    },
-  },
-  {
-    "apiVersion": "policy/v1",
-    "kind": "PodDisruptionBudget",
-    "metadata": {
-      "labels": {
-        "app.kubernetes.io/component": "primary",
-        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-        "app.kubernetes.io/managed-by": "Helm",
-        "app.kubernetes.io/name": "postgresql",
-        "app.kubernetes.io/part-of": "plone",
-        "app.kubernetes.io/version": "18.1.0",
-        "helm.sh/chart": "postgresql-18.1.10",
-      },
-      "name": "test-chart-db-c80fdf3b-postgresql",
-      "namespace": "plone",
-    },
-    "spec": {
-      "maxUnavailable": 1,
-      "selector": {
-        "matchLabels": {
-          "app.kubernetes.io/component": "primary",
-          "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-          "app.kubernetes.io/name": "postgresql",
-        },
-      },
-    },
-  },
-  {
-    "apiVersion": "v1",
-    "automountServiceAccountToken": false,
-    "kind": "ServiceAccount",
-    "metadata": {
-      "labels": {
-        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-        "app.kubernetes.io/managed-by": "Helm",
-        "app.kubernetes.io/name": "postgresql",
-        "app.kubernetes.io/part-of": "plone",
-        "app.kubernetes.io/version": "18.1.0",
-        "helm.sh/chart": "postgresql-18.1.10",
-      },
-      "name": "test-chart-db-c80fdf3b-postgresql",
-      "namespace": "plone",
-    },
-  },
   {
     "apiVersion": "v1",
-    "data": {
-      "password": "YWRtaW5AcGxvbmU=",
-      "postgres-password": "cFRJd1JURjVoTA==",
-    },
     "kind": "Secret",
     "metadata": {
       "labels": {
-        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-        "app.kubernetes.io/managed-by": "Helm",
-        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/component": "database",
+        "app.kubernetes.io/instance": "postgresql",
+        "app.kubernetes.io/name": "plone-postgresql",
         "app.kubernetes.io/part-of": "plone",
-        "app.kubernetes.io/version": "18.1.0",
-        "helm.sh/chart": "postgresql-18.1.10",
       },
-      "name": "test-chart-db-c80fdf3b-postgresql",
-      "namespace": "plone",
+      "name": "test-chart-db-secret-c8d5f897",
     },
-    "type": "Opaque",
-  },
-  {
-    "apiVersion": "v1",
-    "kind": "Service",
-    "metadata": {
-      "labels": {
-        "app.kubernetes.io/component": "primary",
-        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-        "app.kubernetes.io/managed-by": "Helm",
-        "app.kubernetes.io/name": "postgresql",
-        "app.kubernetes.io/part-of": "plone",
-        "app.kubernetes.io/version": "18.1.0",
-        "helm.sh/chart": "postgresql-18.1.10",
-      },
-      "name": "test-chart-db-c80fdf3b-postgresql-hl",
-      "namespace": "plone",
-    },
-    "spec": {
-      "clusterIP": "None",
-      "ports": [
-        {
-          "name": "tcp-postgresql",
-          "port": 5432,
-          "targetPort": "tcp-postgresql",
-        },
-      ],
-      "publishNotReadyAddresses": true,
-      "selector": {
-        "app.kubernetes.io/component": "primary",
-        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-        "app.kubernetes.io/name": "postgresql",
-      },
-      "type": "ClusterIP",
+    "stringData": {
+      "database": "plone",
+      "password": "admin@plone",
+      "username": "plone",
     },
   },
   {
@@ -148,31 +25,27 @@ exports[`Blicca Example Synthesizes correctly 1`] = `
     "kind": "Service",
     "metadata": {
       "labels": {
-        "app.kubernetes.io/component": "primary",
-        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-        "app.kubernetes.io/managed-by": "Helm",
-        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/component": "database",
+        "app.kubernetes.io/instance": "postgresql",
+        "app.kubernetes.io/name": "plone-postgresql",
         "app.kubernetes.io/part-of": "plone",
-        "app.kubernetes.io/version": "18.1.0",
-        "helm.sh/chart": "postgresql-18.1.10",
       },
-      "name": "test-chart-db-c80fdf3b-postgresql",
-      "namespace": "plone",
+      "name": "test-chart-db-service-c87c80f5",
     },
     "spec": {
       "ports": [
         {
-          "name": "tcp-postgresql",
+          "name": "postgresql",
           "port": 5432,
-          "targetPort": "tcp-postgresql",
+          "targetPort": 5432,
         },
       ],
       "selector": {
-        "app.kubernetes.io/component": "primary",
-        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/component": "database",
+        "app.kubernetes.io/instance": "postgresql",
+        "app.kubernetes.io/name": "plone-postgresql",
+        "app.kubernetes.io/part-of": "plone",
       },
-      "type": "ClusterIP",
     },
   },
   {
@@ -180,271 +53,137 @@ exports[`Blicca Example Synthesizes correctly 1`] = `
     "kind": "StatefulSet",
     "metadata": {
       "labels": {
-        "app.kubernetes.io/component": "primary",
-        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-        "app.kubernetes.io/managed-by": "Helm",
-        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/component": "database",
+        "app.kubernetes.io/instance": "postgresql",
+        "app.kubernetes.io/name": "plone-postgresql",
         "app.kubernetes.io/part-of": "plone",
-        "app.kubernetes.io/version": "18.1.0",
-        "helm.sh/chart": "postgresql-18.1.10",
       },
-      "name": "test-chart-db-c80fdf3b-postgresql",
-      "namespace": "plone",
+      "name": "test-chart-db-c879c687",
     },
     "spec": {
       "replicas": 1,
       "selector": {
         "matchLabels": {
-          "app.kubernetes.io/component": "primary",
-          "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-          "app.kubernetes.io/name": "postgresql",
+          "app.kubernetes.io/component": "database",
+          "app.kubernetes.io/instance": "postgresql",
+          "app.kubernetes.io/name": "plone-postgresql",
+          "app.kubernetes.io/part-of": "plone",
         },
       },
-      "serviceName": "test-chart-db-c80fdf3b-postgresql-hl",
+      "serviceName": "test-chart-db-service-c87c80f5",
       "template": {
         "metadata": {
           "labels": {
-            "app.kubernetes.io/component": "primary",
-            "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-            "app.kubernetes.io/managed-by": "Helm",
-            "app.kubernetes.io/name": "postgresql",
+            "app.kubernetes.io/component": "database",
+            "app.kubernetes.io/instance": "postgresql",
+            "app.kubernetes.io/name": "plone-postgresql",
             "app.kubernetes.io/part-of": "plone",
-            "app.kubernetes.io/version": "18.1.0",
-            "helm.sh/chart": "postgresql-18.1.10",
           },
-          "name": "test-chart-db-c80fdf3b-postgresql",
         },
         "spec": {
-          "affinity": {
-            "podAntiAffinity": {
-              "preferredDuringSchedulingIgnoredDuringExecution": [
-                {
-                  "podAffinityTerm": {
-                    "labelSelector": {
-                      "matchLabels": {
-                        "app.kubernetes.io/component": "primary",
-                        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
-                        "app.kubernetes.io/name": "postgresql",
-                      },
-                    },
-                    "topologyKey": "kubernetes.io/hostname",
-                  },
-                  "weight": 1,
-                },
-              ],
-            },
-          },
-          "automountServiceAccountToken": false,
           "containers": [
             {
               "env": [
-                {
-                  "name": "BITNAMI_DEBUG",
-                  "value": "false",
-                },
-                {
-                  "name": "POSTGRESQL_PORT_NUMBER",
-                  "value": "5432",
-                },
-                {
-                  "name": "POSTGRESQL_VOLUME_DIR",
-                  "value": "/bitnami/postgresql",
-                },
-                {
-                  "name": "OPENSSL_FIPS",
-                  "value": "yes",
-                },
-                {
-                  "name": "PGDATA",
-                  "value": "/bitnami/postgresql/data",
-                },
                 {
                   "name": "POSTGRES_USER",
-                  "value": "plone",
-                },
-                {
-                  "name": "POSTGRES_PASSWORD_FILE",
-                  "value": "/opt/bitnami/postgresql/secrets/password",
-                },
-                {
-                  "name": "POSTGRES_POSTGRES_PASSWORD_FILE",
-                  "value": "/opt/bitnami/postgresql/secrets/postgres-password",
-                },
-                {
-                  "name": "POSTGRES_DATABASE",
-                  "value": "plone",
-                },
-                {
-                  "name": "POSTGRESQL_ENABLE_LDAP",
-                  "value": "no",
-                },
-                {
-                  "name": "POSTGRESQL_ENABLE_TLS",
-                  "value": "no",
-                },
-                {
-                  "name": "POSTGRESQL_LOG_HOSTNAME",
-                  "value": "false",
-                },
-                {
-                  "name": "POSTGRESQL_LOG_CONNECTIONS",
-                  "value": "false",
-                },
-                {
-                  "name": "POSTGRESQL_LOG_DISCONNECTIONS",
-                  "value": "false",
+                  "valueFrom": {
+                    "secretKeyRef": {
+                      "key": "username",
+                      "name": "test-chart-db-secret-c8d5f897",
+                    },
+                  },
                 },
                 {
-                  "name": "POSTGRESQL_PGAUDIT_LOG_CATALOG",
-                  "value": "off",
+                  "name": "POSTGRES_PASSWORD",
+                  "valueFrom": {
+                    "secretKeyRef": {
+                      "key": "password",
+                      "name": "test-chart-db-secret-c8d5f897",
+                    },
+                  },
                 },
                 {
-                  "name": "POSTGRESQL_CLIENT_MIN_MESSAGES",
-                  "value": "error",
+                  "name": "POSTGRES_DB",
+                  "valueFrom": {
+                    "secretKeyRef": {
+                      "key": "database",
+                      "name": "test-chart-db-secret-c8d5f897",
+                    },
+                  },
                 },
                 {
-                  "name": "POSTGRESQL_SHARED_PRELOAD_LIBRARIES",
-                  "value": "pgaudit",
+                  "name": "PGDATA",
+                  "value": "/var/lib/postgresql/data/pgdata",
                 },
               ],
-              "image": "registry-1.docker.io/bitnami/postgresql:latest",
-              "imagePullPolicy": "IfNotPresent",
+              "image": "postgres:18",
               "livenessProbe": {
                 "exec": {
                   "command": [
-                    "/bin/sh",
-                    "-c",
-                    "exec pg_isready -U "plone" -d "dbname=plone" -h 127.0.0.1 -p 5432",
+                    "pg_isready",
+                    "-U",
+                    "plone",
+                    "-d",
+                    "plone",
                   ],
                 },
-                "failureThreshold": 6,
                 "initialDelaySeconds": 30,
-                "periodSeconds": 10,
-                "successThreshold": 1,
+                "periodSeconds": 15,
                 "timeoutSeconds": 5,
               },
               "name": "postgresql",
               "ports": [
                 {
                   "containerPort": 5432,
-                  "name": "tcp-postgresql",
+                  "name": "postgresql",
                 },
               ],
               "readinessProbe": {
                 "exec": {
                   "command": [
-                    "/bin/sh",
-                    "-c",
-                    "-e",
-                    "exec pg_isready -U "plone" -d "dbname=plone" -h 127.0.0.1 -p 5432
-[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
-",
+                    "pg_isready",
+                    "-U",
+                    "plone",
+                    "-d",
+                    "plone",
                   ],
                 },
-                "failureThreshold": 6,
-                "initialDelaySeconds": 5,
+                "initialDelaySeconds": 10,
                 "periodSeconds": 10,
-                "successThreshold": 1,
                 "timeoutSeconds": 5,
               },
               "resources": {
                 "limits": {
-                  "cpu": "150m",
-                  "ephemeral-storage": "2Gi",
-                  "memory": "192Mi",
+                  "cpu": "1",
+                  "memory": "1Gi",
                 },
                 "requests": {
                   "cpu": "100m",
-                  "ephemeral-storage": "50Mi",
-                  "memory": "128Mi",
-                },
-              },
-              "securityContext": {
-                "allowPrivilegeEscalation": false,
-                "capabilities": {
-                  "drop": [
-                    "ALL",
-                  ],
-                },
-                "privileged": false,
-                "readOnlyRootFilesystem": true,
-                "runAsGroup": 1001,
-                "runAsNonRoot": true,
-                "runAsUser": 1001,
-                "seLinuxOptions": {},
-                "seccompProfile": {
-                  "type": "RuntimeDefault",
+                  "memory": "256Mi",
                 },
               },
               "volumeMounts": [
                 {
-                  "mountPath": "/tmp",
-                  "name": "empty-dir",
-                  "subPath": "tmp-dir",
-                },
-                {
-                  "mountPath": "/opt/bitnami/postgresql/conf",
-                  "name": "empty-dir",
-                  "subPath": "app-conf-dir",
-                },
-                {
-                  "mountPath": "/opt/bitnami/postgresql/tmp",
-                  "name": "empty-dir",
-                  "subPath": "app-tmp-dir",
-                },
-                {
-                  "mountPath": "/opt/bitnami/postgresql/secrets/",
-                  "name": "postgresql-password",
-                },
-                {
-                  "mountPath": "/dev/shm",
-                  "name": "dshm",
-                },
-                {
-                  "mountPath": "/bitnami/postgresql",
+                  "mountPath": "/var/lib/postgresql/data",
                   "name": "data",
                 },
               ],
             },
           ],
-          "hostIPC": false,
-          "hostNetwork": false,
           "securityContext": {
-            "fsGroup": 1001,
-            "fsGroupChangePolicy": "Always",
-            "supplementalGroups": [],
-            "sysctls": [],
+            "fsGroup": 999,
           },
-          "serviceAccountName": "test-chart-db-c80fdf3b-postgresql",
-          "volumes": [
-            {
-              "emptyDir": {},
-              "name": "empty-dir",
-            },
-            {
-              "name": "postgresql-password",
-              "secret": {
-                "secretName": "test-chart-db-c80fdf3b-postgresql",
-              },
-            },
-            {
-              "emptyDir": {
-                "medium": "Memory",
-              },
-              "name": "dshm",
-            },
-          ],
         },
       },
-      "updateStrategy": {
-        "rollingUpdate": {},
-        "type": "RollingUpdate",
-      },
       "volumeClaimTemplates": [
         {
-          "apiVersion": "v1",
-          "kind": "PersistentVolumeClaim",
           "metadata": {
+            "labels": {
+              "app.kubernetes.io/component": "database",
+              "app.kubernetes.io/instance": "postgresql",
+              "app.kubernetes.io/name": "plone-postgresql",
+              "app.kubernetes.io/part-of": "plone",
+            },
             "name": "data",
           },
           "spec": {
@@ -453,7 +192,7 @@ exports[`Blicca Example Synthesizes correctly 1`] = `
             ],
             "resources": {
               "requests": {
-                "storage": "8Gi",
+                "storage": "10Gi",
               },
             },
           },
@@ -495,14 +234,19 @@ exports[`Blicca Example Synthesizes correctly 1`] = `
               "env": [
                 {
                   "name": "SECRET_POSTGRESQL_USERNAME",
-                  "value": "plone",
+                  "valueFrom": {
+                    "secretKeyRef": {
+                      "key": "username",
+                      "name": "test-chart-db-secret-c8d5f897",
+                    },
+                  },
                 },
                 {
                   "name": "SECRET_POSTGRESQL_PASSWORD",
                   "valueFrom": {
                     "secretKeyRef": {
                       "key": "password",
-                      "name": "test-chart-db-c80fdf3b-postgresql",
+                      "name": "test-chart-db-secret-c8d5f897",
                     },
                   },
                 },
@@ -528,7 +272,7 @@ exports[`Blicca Example Synthesizes correctly 1`] = `
                 },
                 {
                   "name": "INSTANCE_db_relstorage_postgresql_dsn",
-                  "value": "host='test-chart-db-c80fdf3b-postgresql' dbname='plone' user='$(SECRET_POSTGRESQL_USERNAME)' password='$(SECRET_POSTGRESQL_PASSWORD)'",
+                  "value": "host='test-chart-db-service-c87c80f5' dbname='plone' user='$(SECRET_POSTGRESQL_USERNAME)' password='$(SECRET_POSTGRESQL_PASSWORD)'",
                 },
                 {
                   "name": "INSTANCE_db_relstorage_cache_local_mb",
@@ -584,6 +328,7 @@ exports[`Blicca Example Synthesizes correctly 1`] = `
           "app": "test-chart-plone-backend-c8848738",
         },
       },
+      "unhealthyPodEvictionPolicy": "AlwaysAllow",
     },
   },
   {
@@ -651,7 +396,7 @@ exports[`Blicca Example Synthesizes correctly 1`] = `
   {
     "apiVersion": "v1",
     "data": {
-      "secret": "YXBpdEw5TUdsZVFieHlrMjVkdWtjWlVCdkJVY1N0ZTQ=",
+      "secret": "<redacted-for-snapshot>",
     },
     "kind": "Secret",
     "metadata": {
@@ -893,6 +638,53 @@ sub vcl_deliver {
       "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
     },
   },
+  {
+    "apiVersion": "rbac.authorization.k8s.io/v1",
+    "kind": "Role",
+    "metadata": {
+      "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+    },
+    "rules": [
+      {
+        "apiGroups": [
+          "",
+        ],
+        "resources": [
+          "endpoints",
+          "pods",
+        ],
+        "verbs": [
+          "watch",
+          "get",
+        ],
+      },
+    ],
+  },
+  {
+    "apiVersion": "rbac.authorization.k8s.io/v1",
+    "kind": "RoleBinding",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "kube-httpcache",
+        "app.kubernetes.io/version": "v0.9.1",
+        "helm.sh/chart": "kube-httpcache-0.9.1",
+      },
+      "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+    },
+    "roleRef": {
+      "apiGroup": "rbac.authorization.k8s.io",
+      "kind": "Role",
+      "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+    },
+    "subjects": [
+      {
+        "kind": "ServiceAccount",
+        "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+      },
+    ],
+  },
   {
     "apiVersion": "v1",
     "kind": "Service",
@@ -973,13 +765,14 @@ sub vcl_deliver {
                 "-frontend-watch=false",
                 "-frontend-namespace=$(NAMESPACE)",
                 "-frontend-service=test-chart-httpcache-c89dd29d-kube-httpcache",
-                "-backend-watch=false",
+                "-backend-watch",
                 "-backend-namespace=$(NAMESPACE)",
-                "-backend-service=backend-service",
+                "-backend-service=test-chart-plone-backend-service-c81ad65d",
                 "-varnish-secret-file=/etc/varnish/k8s-secret/secret",
                 "-varnish-vcl-template=/etc/varnish/tmpl/default.vcl.tmpl",
                 "-varnish-storage=malloc,128M",
                 "-varnish-vcl-template-poll",
+                "-backend-portname=backend-http",
               ],
               "env": [
                 {

package/examples/blicca/main.test.ts

@@ -6,6 +6,13 @@ describe('Blicca Example', () => {
     const app = Testing.app();
     const chart = new BliccaChart(app, 'test-chart');
     const results = Testing.synth(chart);
+    // kube-httpcache generates a random Varnish admin secret on each synth.
+    // Redact it so the snapshot stays deterministic.
+    for (const obj of results) {
+      if (obj.kind === 'Secret' && obj.data && typeof obj.data.secret === 'string') {
+        obj.data.secret = '<redacted-for-snapshot>';
+      }
+    }
     expect(results).toMatchSnapshot();
   });
 });