@catladder/cli 0.0.0-next-1cd29c1f → 0.0.0-next-52feb889

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/app.jobs.yml

@@ -0,0 +1,70 @@
+
+{{ $jobs := .Values.jobs }}
+{{ if $jobs }}
+{{ $context := . }}
+{{ range $key, $job := $jobs -}}
+
+{{- $name := (kindIs "map" $jobs) | ternary $key $job.name -}}
+{{- $defaultIndex := (kindIs "map" $jobs) | ternary 0 $key -}}
+
+apiVersion: batch/v1
+kind: Job
+
+metadata:
+  name: {{ include "fullname" $context | trunc 24 }}-{{ $name | trunc 35 }}
+  namespace: {{ $context.Release.Namespace }}
+  labels:
+    app: {{ $context.Release.Name }}
+    app.kubernetes.io/managed-by: {{$context.Release.Service | quote }}
+    app.kubernetes.io/instance: {{$context.Release.Name | quote }}
+    helm.sh/chart: "{{$context.Chart.Name}}-{{$context.Chart.Version}}"
+  annotations:
+    # This is what defines this resource as a hook. Without this line, the
+    # job is considered part of the release.
+    "helm.sh/hook": "{{- default "post-install,post-upgrade" $job.hook -}}"
+    "helm.sh/hook-weight": "{{- default $defaultIndex $job.hookWeight -}}"
+    "helm.sh/hook-delete-policy": "{{- default "hook-succeeded,before-hook-creation" $job.hookDeletePolicy -}}"
+spec:
+  template:
+    spec:
+      {{- if $context.Values.image.pullSecret }}
+      imagePullSecrets:
+        - name: {{ $context.Values.image.pullSecret }}
+      {{- end }}
+      restartPolicy: Never
+      
+      containers:
+      - name: {{ $name }}-job
+        {{include "env" $context | nindent 8}}
+        {{if $job.image -}}
+        image: "{{ $job.image }}"
+        {{else}}
+        image: "{{ template "appImage" $context}}"
+        {{end}}
+        imagePullPolicy: {{ $context.Values.image.pullPolicy }}
+        # see https://github.com/kubernetes/kubernetes/issues/25908#issuecomment-308569672
+        command:  ["/bin/sh", "-c"]
+        args: 
+          - |
+            trap "touch /tmp/pod/main-terminated" EXIT
+            {{$job.command}}
+        volumeMounts:
+        - mountPath: /tmp/pod
+          name: tmp-pod
+        resources:
+{{ toYaml $context.Values.jobDefaults.resources | indent 10 }}
+
+      {{if $context.Values.cloudsql.enabled}}
+      - {{- include "cloudSqlContainer" $context | nindent 8 }}
+      {{- end }} 
+      volumes:
+        - name: tmp-pod
+          emptyDir: {}
+      {{if $context.Values.cloudsql.enabled}}
+        - {{- include "cloudSqlCredentialsVolume" $context | nindent 10 }}
+      {{- end }} 
+
+    
+---
+{{- end }}
+{{- end }}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/app.service.yaml

@@ -0,0 +1,31 @@
+{{- if .Values.application.enabled -}}
+{{- $context := . }}
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: {{ template "fullname" . }}-app
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  name: {{ template "fullname" . }}-app
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.externalPort }}
+      targetPort: {{ .Values.service.internalPort }}
+      protocol: TCP
+      name: {{ template "fullname" . }}-service
+    {{- range $ports := .Values.service.additionalPorts }}
+    - port: {{ required ".Values.service.additionalPorts.port is required" $ports.port }}
+      targetPort: {{ $ports.targetPort | default $ports.port }}
+      protocol: {{ $ports.protocol | default "TCP" }}
+      name: {{ template "fullname" $context }}-{{ required ".Values.service.additionalPorts.nameSuffix is required" $ports.nameSuffix }}-service
+    {{- end }}
+  selector:
+    app: {{ template "fullname" . }}-app
+    release: {{ .Release.Name }}
+  sessionAffinity: None
+  type: NodePort
+{{- end -}}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/app.volumes.yml

@@ -0,0 +1,20 @@
+
+{{ $context := . }}
+{{- range $key, $volume := .Values.application.volumes }}
+     
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ template "fullname" $context }}-{{$volume.name}}
+  labels:
+    app: {{ $context.Release.Name }}
+  namespace: {{ $context.Release.Namespace }}
+spec:  
+  resources: 
+    requests:
+      storage: {{ default "10Gi" $volume.size }}
+  accessModes:
+    - ReadWriteOnce
+---
+{{- end }}
+

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/app.worker.deployment.yml

@@ -0,0 +1,104 @@
+{{- if .Values.application.worker.enabled -}}
+
+{{ $context := . }}
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+  name: {{ template "fullname" $context }}-worker
+  labels:
+    app: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: {{ template "fullname" $context }}-worker
+      release: {{ .Release.Name }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: {{ template "fullname" $context }}-worker
+        release: {{ .Release.Name }}
+    spec:
+      {{- if .Values.image.pullSecret }}
+      imagePullSecrets:
+        - name: {{ .Values.image.pullSecret }}
+      {{- end }}
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      tolerations: 
+        {{- if  and  .Values.global.ENV_SHORT (eq .Values.global.ENV_SHORT "review")}}
+          - key: "stage"
+            operator: "Equal"
+            value: "review"
+            effect: "NoSchedule"
+        {{- end }}
+        {{- if .Values.application.worker.useExclusivePool }}
+          - key: "ch-panter-sla"
+            operator: "Equal"
+            value: "1"
+            effect: "NoSchedule"
+        {{- end }}
+      containers:
+      - name: {{ template "fullname" $context }}-worker
+        image: "{{ template "appImage" .}}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        command:  ["/bin/sh", "-c"]
+        args: 
+          - |
+            trap "touch /tmp/pod/main-terminated" EXIT
+            {{join " " (default .Values.application.command .Values.application.worker.command)}}
+        
+        {{include "env" $context | nindent 8}}
+          - name: BACKGROUND_JOBS_ENABLED
+            value: "true"
+          - name: IS_WORKER
+            value: "true"
+       
+        {{if .Values.application.worker.livenessProbe}}
+        livenessProbe:
+          httpGet:
+{{ toYaml .Values.application.livenessProbe.httpGet | indent 12 }}
+          initialDelaySeconds: 10
+          timeoutSeconds: 10
+          periodSeconds:  30
+          failureThreshold: 100 # dont kill worker pod too early when cpu intensive stuff is done
+        {{- end }}
+        ports:
+        - containerPort: 8080
+          protocol: TCP
+        resources:
+{{ toYaml .Values.application.worker.resources | indent 10 }}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts: 
+        {{- range $key, $volume := .Values.application.volumes }}
+          - mountPath: {{$volume.mountPath}}
+            name: {{ template "fullname" $context }}-{{$volume.name}}
+        {{- end }}
+      {{if .Values.cloudsql.enabled}}
+      - {{- include "cloudSqlContainer" $context | nindent 8 }}
+      {{- end }} 
+      volumes:
+        - name: tmp-pod
+          emptyDir: {}
+      {{- range $key, $volume := .Values.application.volumes }}
+        - name: {{ template "fullname" $context }}-{{$volume.name}}
+          persistentVolumeClaim:
+            claimName: {{ template "fullname" $context }}-{{$volume.name}}
+      {{- end }}
+      {{if .Values.cloudsql.enabled}}
+        - {{- include "cloudSqlCredentialsVolume" $context | nindent 10 }}
+      {{- end }} 
+{{- end -}}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/app.worker.service.yaml

@@ -0,0 +1,34 @@
+
+{{- if .Values.application.worker.enabled -}}
+{{- if .Values.application.worker.service.enabled -}}
+{{- $context := . }}
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: {{ template "fullname" . }}-worker
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  name: {{ template "fullname" . }}-worker
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: {{ .Values.application.worker.service.type }}
+  ports:
+    - port: {{ .Values.application.worker.service.externalPort }}
+      targetPort: {{ .Values.application.worker.service.internalPort }}
+      protocol: TCP
+      name: {{ template "fullname" . }}-worker-service
+    {{- range $ports := .Values.application.worker.service.additionalPorts }}
+    - port: {{ required ".Values.application.worker.service.additionalPorts.port is required" $ports.port }}
+      targetPort: {{ $ports.targetPort | default $ports.port }}
+      protocol: {{ $ports.protocol | default "TCP" }}
+      name: {{ template "fullname" $context }}-{{ required ".Values.application.worker.service.additionalPorts.nameSuffix is required" $ports.nameSuffix }}-service
+    {{- end }}
+  selector:
+    app: {{ template "fullname" . }}-worker
+    release: {{ .Release.Name }}
+  sessionAffinity: None
+  type: NodePort
+{{- end -}}
+{{- end -}}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/mailhog.ingress.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.mailhog.enabled -}}
+#{{ $host := (default "mailhog.{{ template 'host' . }}" .Values.mailhog.host ) | quote }}
+{{ $host := default (printf "mailhog.%s" (include "host" .)) .Values.mailhog.host  }}
+
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Values.mailhog.fullnameOverride  }} # unfortunatly due to history reasons we override the release name
+  labels:
+    app: {{ template "name" . }}
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+spec:
+  rules:
+  - host: {{ $host }}
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ .Values.mailhog.fullnameOverride  }} # unfortunatly due to history reasons we override the release name
+            port:
+              number: 8025
+  tls:
+  - hosts:
+    - {{ $host }}
+    secretName: {{ $host | trunc 59 | trimSuffix "." }}-tls
+
+{{- end -}}
+
+
+

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/maintenance.deployment.yml

@@ -0,0 +1,45 @@
+{{- if (.Values.maintenance) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+  name: {{ template "fullname" . }}-maintenance
+  labels:
+    app: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ template "fullname" . }}-maintenance
+      release: {{ .Release.Name }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: {{ template "fullname" . }}-maintenance
+        release: {{ .Release.Name }}
+    spec:
+      {{- if .Values.image.pullSecret }}
+      imagePullSecrets:
+        - name: {{ .Values.image.pullSecret }}
+      {{- end }}
+      containers:
+      - image: {{ .Values.maintenance.image }}
+        imagePullPolicy: Always
+        name: {{ template "fullname" . }}-maintenance
+        resources: {}
+        securityContext:
+          privileged: false
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+{{- end }}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/maintenance.service.yml

@@ -0,0 +1,24 @@
+{{- if (.Values.maintenance) }}
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+  name: {{ template "fullname" . }}-maintenance
+  labels:
+    app: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 80
+    name: {{ template "fullname" . }}-maintenance-service
+  selector:
+    app: {{ template "fullname" . }}-maintenance
+    release: {{ .Release.Name }}
+  sessionAffinity: None
+  type: ClusterIP
+status:
+  loadBalancer: {}
+
+{{- end }}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/mongodb.backup.cronjob.yml

@@ -0,0 +1,120 @@
+{{- if and (.Values.mongodb.enabled) (.Values.mongodb.backup.enabled) }}
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+  labels:
+    app: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  
+spec:
+  schedule: {{.Values.mongodb.backup.schedule }}
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName:  {{ template "fullname" . }}-mongodb-backup
+          restartPolicy: OnFailure
+          containers:
+            - name: backup-cron
+            
+              env:
+                - name: M_RELEASE_NAME
+                  value: {{ template "fullname" . }}-mongodb
+                - name: MONGODB_ROOT_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: {{ template "fullname" $ }}-app-secrets
+                      key: MONGODB_ROOT_PASSWORD
+                - name: VSC_NAME
+                  value: {{ .Values.mongodb.backup.volumeSnapshotClass }}
+              image: {{ .Values.mongodb.backup.image }}
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/bash
+                - -i
+                - -c
+                - |
+                    set -e
+                    echo alias M_CMD=\'mongo admin --host {{ .Values.mongodb.backup.hostToBackup }} {{- if .Values.mongodb.auth.enabled }} --authenticationDatabase admin -u root -p "\"${MONGODB_ROOT_PASSWORD}\"" {{- end }} --quiet --eval\' >> ~/.bashrc
+                    source ~/.bashrc
+                    echo -e "[+] Check if it is a Primary node to make it stepDown\n"
+                    if [[ `M_CMD " db.runCommand( { isMaster: 1 } )['ismaster']"` != "false" ]]
+                    then
+                      echo -e "[+] Stepping Down\n"
+                      M_CMD "rs.stepDown()"
+                    fi
+                    echo -e "[+] Send Slave to Freeze\n"
+                    M_CMD "rs.freeze(99999999999)"
+                    export E_TIME=$(date +%s)
+                    echo -e "[+] Creating snapshot object\n"
+                    cat <<EOF | kubectl apply -f -
+                    apiVersion: snapshot.storage.k8s.io/v1beta1
+                    kind: VolumeSnapshot
+                    metadata:
+                      name: snapshot-${M_RELEASE_NAME}-${E_TIME}
+                    spec:
+                      volumeSnapshotClassName: ${VSC_NAME}
+                      source:
+                        persistentVolumeClaimName:  {{ .Values.mongodb.backup.pvcToBackup }}
+                    EOF
+                    echo -e "[+] Waiting for snapshot to finish\n"
+                    while : ; do
+                      result=$(kubectl get volumesnapshot   -o custom-columns='READY:.status.readyToUse' --field-selector metadata.name=snapshot-${M_RELEASE_NAME}-${E_TIME} | grep -v READY)
+                      [[ "${result}" == "true" ]] && break
+                      echo "[-] still waiting for snapshot to be ready .. "
+                      sleep 1
+                    done
+                    echo -e "[+] Snapshot finished, unfreeze Slave\n"
+                    M_CMD "rs.freeze(0)"
+                    echo -e "[+] Snapshotting finished successfully\n"
+                    kubectl get volumesnapshots --no-headers --output=custom-columns="NAME:metadata.name,CREATED:status.creationTime" | while read name creation; do
+                      if [[ "${name}" =~ ^snapshot-$M_RELEASE_NAME-[0-9]*$ ]] && [[ "${creation}" < "$(date --date "now 90 days ago" +%F)" ]]; then
+                        echo "[+] Removing expired snapshot ${name} created on ${creation}"
+                        kubectl delete volumesnapshot "${name}"
+                      fi
+                    done
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "snapshot.storage.k8s.io/v1beta1"
+      - "snapshot.storage.k8s.io"
+    resources:
+      - "volumesnapshots"
+    verbs:
+      - "*"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+roleRef:
+  kind: Role
+  name: {{ template "fullname" . }}-mongodb-backup
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "fullname" . }}-mongodb-backup
+
+
+{{- end }}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/values.yaml

@@ -0,0 +1,154 @@
+# Default values for manulstack helm chart.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+global:
+  componentName: web
+  ENV_SHORT: dev
+  BUILD_ID:
+image:
+  repository:
+  name:
+  pullPolicy: Always
+  pullSecret: gitlab-registry
+
+service:
+  type: ClusterIP
+  externalPort: 80
+  internalPort: 8080
+  additionalPorts: []
+
+env:
+  public:
+    NODE_ENV: production
+    TZ: Europe/Zurich
+  secret: {}
+
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/affinity: cookie
+    nginx.ingress.kubernetes.io/affinity-mode: persistent
+    nginx.ingress.kubernetes.io/session-cookie-hash: sha1
+    nginx.ingress.kubernetes.io/session-cookie-name: route
+    nginx.ingress.kubernetes.io/session-cookie-path: /
+  tls: []
+
+jobDefaults:
+  resources:
+    limits:
+      cpu: 1000m
+    requests:
+      cpu: 50m
+      memory: 350Mi
+
+application:
+  enabled: true
+  replicas: 1
+  hostCanonical:
+  command:
+  # these requests are usually overridden by the gitlab include and values
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 600Mi
+    requests:
+      cpu: 50m
+      memory: 150Mi
+  updateStrategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+
+  worker:
+    enabled: false
+    useExclusivePool: false
+    service:
+      enabled: false
+      type: ClusterIP
+      externalPort: 80
+      internalPort: 8080
+      additionalPorts: []
+    livenessProbe: true
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 1000Mi
+      requests:
+        cpu: 50m
+        memory: 350Mi
+  startupProbe:
+    httpGet:
+      path: /__health
+      port: 8080
+      httpHeaders:
+        - name: X-PAN-HEALTHCHECK
+          value: startup
+    failureThreshold: 60
+    timeoutSeconds: 3
+    periodSeconds: 5
+  livenessProbe:
+    httpGet:
+      path: /__health
+      port: 8080
+      httpHeaders:
+        - name: X-PAN-HEALTHCHECK
+          value: liveness
+    periodSeconds: 5
+    timeoutSeconds: 10
+  readinessProbe:
+    httpGet:
+      path: /__health
+      port: 8080
+      httpHeaders:
+        - name: X-PAN-HEALTHCHECK
+          value: readiness
+    failureThreshold: 3
+    timeoutSeconds: 3
+    periodSeconds: 5
+    successThreshold: 1
+
+gitlab:
+  visualReviewEnabled: false
+  app:
+  env:
+  projectPath:
+  mergeRequestId:
+  projectId:
+
+## features
+
+mongodb:
+  enabled: false
+  dbName: app
+  backup:
+    enabled: false
+  # see https://github.com/bitnami/charts/issues/10264#issuecomment-1181574288
+  livenessProbe:
+    enabled: false
+  customLivenessProbe:
+    exec:
+      command:
+        - sh
+        - -c
+        - mongo --port $MONGODB_PORT_NUMBER --eval "db.adminCommand('ping')"
+  readinessProbe:
+    enabled: false
+  customReadinessProbe:
+    exec:
+      command:
+        - sh
+        - -c
+        - mongo --port $MONGODB_PORT_NUMBER --eval 'db.isMaster().ismaster || db.isMaster().secondary' | grep -q 'true'
+
+secretsFromOtherComponent: {}
+mapServiceUrlToEnv: {}
+cloudsql:
+  enabled: false
+
+mailhog:
+  enabled: false
+  useOauth: true

package/dist/bundles/runner-images/kubernetes/scripts/kubernetesCreateSecret

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+
+echo "KUBE_NAMESPACE: '$KUBE_NAMESPACE', KUBE_DOCKER_IMAGE_PULL_SECRET: '$KUBE_DOCKER_IMAGE_PULL_SECRET'"
+kubectl create secret -n "$KUBE_NAMESPACE" \
+    docker-registry $KUBE_DOCKER_IMAGE_PULL_SECRET \
+    --docker-server="$DOCKER_REGISTRY" \
+    --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \
+    --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \
+    --docker-email="$GITLAB_USER_EMAIL" \
+    -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f -

package/dist/bundles/runner-images/kubernetes/scripts/kubernetesDelete

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+
+echo "Delete $RELEASE_NAME"
+helm uninstall "$RELEASE_NAME" --namespace "$KUBE_NAMESPACE"