@leverege/build-tools 2.8.12 → 2.8.13

package/lib/web/service-man/utils/index.js

@@ -1,67 +0,0 @@
-"use strict";
-
-const inquirer = require('inquirer');
-
-const Shell = require('./Shell');
-
-const VersionCheck = require('./VersionCheck');
-/**
- * Clears the screen and optionally homes the cursor.
- */
-
-
-const clear = (home = true) => {
-  // console.log( ( home ? '\x1B[0f' : '' ) + '\x1B[2J' )
-  console.log(`${home ? '\x1B[0f' : ''}\x1B[2J`);
-};
-/**
- * A simple object dumping convenience.
- */
-
-
-const condir = (log, thing) => {
-  console.dir({
-    log,
-    thing
-  }, {
-    depth: 8,
-    colors: true
-  }); // eslint-disable-line
-};
-/**
- * General "yes" to proceed function.
- */
-
-
-const proceed = async (query = 'Do you wish to proceed?') => {
-  await inquirer.prompt([{
-    type: 'confirm',
-    name: 'proceed',
-    message: query,
-    default: true
-  }]).then(answer => {
-    if (!answer.proceed) {
-      process.exit(0);
-    }
-  });
-};
-/**
- * A simple mS sleeper.
- */
-
-
-const sleep = (ms = 0) => {
-  return new Promise(resolve => {
-    setTimeout(resolve, ms);
-  });
-};
-
-module.exports = {
-  clear,
-  condir,
-  proceed,
-  sleep,
-  pause: sleep,
-  Shell,
-  VersionCheck
-};

package/src/helm-starters/baseline/Chart.yaml

@@ -1,4 +0,0 @@
-name: <service-name>
-version: 0.1.0
-apiVersion: v2
-icon: https://raw.githubusercontent.com/kubernetes/kubernetes/master/logo/logo.svg

package/src/helm-starters/baseline/templates/NOTES.txt

@@ -1,52 +0,0 @@
--------------------------------------------------------------------------------
-
-Service: {{ .Chart.Name }}
-
-This service relies on the presence of a Service Account (SA) to define its
-permissions on the clusters that it is deployed to. Verify or create an SA
-with the following name and IAM roles:
-
-   SA name   => {{ .Chart.Name }}
-   IAM roles => pubsub.editor
-                secretmanager.secretAccessor
-
-{{- if .Values.workloadIdentity.disabled }}
-
-Workload Identity is disabled for this service, most likely because this is
-running on a legacy cluster which does not support it. In order for this
-service to function properly a set of JSON keys will need to be generated and
-then stored as a secret using this syntax:
-
-  cat <keyfileName> | kubectl create secret generic {{ .Chart.Name }}-sa-key \
-                                    --from-file=key.json=/dev/stdin
-
-{{- else }}
-
-Workload identity is enabled for this service, therefore the SA must have the
-proper IAM policy bound to it. This can be verified by running:
-
-  $ gcloud iam service-accounts get-iam-policy \
-      --project {{ .Values.service.project_id }} \
-      {{ .Chart.Name }}@{{ .Values.service.project_id }}.iam.gserviceaccount.com
-
-which should return something resembling:
-
-  bindings:
-  - members:
-    - serviceAccount:{{ .Values.service.project_id }}.svc.id.goog[default/<service name>]
-    role: roles/iam.workloadIdentityUser
-  etag: <uuencoded tag>
-  version: 1
-
-If the role of roles/iam.workloadIdentityUser does not appear on the SA then
-run the following command to add it:
-
-  $ gcloud iam service-accounts add-iam-policy-binding \
-      --project {{ .Values.service.project_id }} \
-      --role roles/iam.workloadIdentityUser \
-      --member "serviceAccount:{{ .Values.service.project_id }}.svc.id.goog[default/{{ .Chart.Name }}]" \
-      {{ .Chart.Name }}@{{ .Values.service.project_id }}.iam.gserviceaccount.com
-
-{{- end }}
-
--------------------------------------------------------------------------------

package/src/helm-starters/baseline/templates/configmap.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ .Chart.Name }}-configs
-data:
-  {{- toYaml .Values.config | nindent 2 }}

package/src/helm-starters/baseline/templates/deployment.yaml

@@ -1,97 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Chart.Name }}
-  labels:
-    app: {{ .Chart.Name }}
-    chart/version: {{ .Values.image.tag }}
-    redis-client: {{ .Values.redis.enabled | quote }}
-spec:
-  selector:
-    matchLabels:
-      app: {{ .Chart.Name }}
-  template:
-    metadata:
-      labels:
-        app: {{ .Chart.Name }}
-        chart/version: {{ .Chart.Version }}
-        chart/appVersion: {{ .Values.image.tag }}
-        redis-client: {{ .Values.redis.enabled | quote }}
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
-        prometheus.io/port: "5111"
-        prometheus.io/scrape: "true"
-        configmap.reloader.stakater.com/reload: "default-configs"
-    spec:
-      serviceAccountName: {{ .Chart.Name }}
-      volumes:
-      - name: tmpfs
-        emptyDir: {}
-      {{- if .Values.workloadIdentity.disabled }}
-      - name: google-cloud-key
-        secret:
-          secretName: {{ .Chart.Name }}-sa-key
-      {{- end }}
-      {{- if .Values.service.preemptible }}
-      tolerations:
-      - key: "preemptible"
-        operator: "Equal"
-        value: "true"
-        effect: "NoSchedule"
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - preference:
-              matchExpressions:
-              - key: cloud.google.com/gke-preemptible
-                operator: Exists
-            weight: 100
-      {{- end }}
-      containers:
-      - name: {{ .Chart.Name }}
-        imagePullPolicy: IfNotPresent
-        image: {{ .Values.image.registry }}/{{ .Chart.Name }}:{{ .Values.image.tag }}
-        securityContext:
-          readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFs }}
-          runAsNonRoot: true
-          runAsUser: 1000
-          allowPrivilegeEscalation: false
-        {{ if .Values.probes.enabled }}
-        readinessProbe:
-          httpGet:
-            path: /healthz
-            port: api
-          initialDelaySeconds: 30
-        livenessProbe:
-          httpGet:
-            path: /livenessProbe
-            port: api
-          initialDelaySeconds: 30
-          periodSeconds: 60
-        {{ end }}
-        resources:
-          limits:
-            cpu: "100m"
-            memory: "256Mi"
-#         requests:
-#           cpu: "100m"
-#           memory: "128Mi"
-        ports:
-        - name: api
-          containerPort: {{ .Values.service.port }}
-          protocol: TCP
-        - name: node-metrics
-          containerPort: 5111
-        volumeMounts:
-        - name: tmpfs
-          mountPath: "/tmp"
-        envFrom: 
-        - configMapRef:
-            name: default-configs
-        - configMapRef:
-            name: {{ .Chart.Name }}-configs
-        env:
-        {{- if .Values.workloadIdentity.disabled }}
-        - name: GOOGLE_APPLICATION_CREDENTIALS
-          value: /var/secrets/google/key.json
-        {{- end }}

package/src/helm-starters/baseline/templates/hpa.yaml

@@ -1,12 +0,0 @@
-apiVersion: autoscaling/v1
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ .Chart.Name }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: {{ .Chart.Name }}
-  minReplicas: {{ .Values.horizontalScaler.minReplicas }}
-  maxReplicas: {{ .Values.horizontalScaler.maxReplicas }}
-  targetCPUUtilizationPercentage: {{ .Values.horizontalScaler.maxCPU }}

package/src/helm-starters/baseline/templates/ingress.yaml

@@ -1,17 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ .Chart.Name }}
-  labels:
-    app: {{ .Chart.Name }}
-  annotations:
-#   kubernetes.io/ingress.allow-http: "false"
-    kubernetes.io/ingress.global-static-ip-name: {{ .Chart.Name }}
-spec:
-  tls:
-  - secretName: {{ .Values.ingress.secretName }}
-  defaultBackend:
-    service:
-      name: {{ .Chart.Name }}
-      port:
-        number: {{ .Values.service.port }}

package/src/helm-starters/baseline/templates/pdb.yaml

@@ -1,9 +0,0 @@
-apiVersion: policy/v1beta1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ .Chart.Name }}
-spec:
-  minAvailable: 50%
-  selector:
-    matchLabels:
-      app: app

package/src/helm-starters/baseline/templates/service.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Chart.Name }}
-spec:
-  type: NodePort
-{{- if .Values.loadbalancer.ip }}
-  loadBalancerIP: {{ .Values.loadbalancer.ip }}
-{{- end }}
-  selector:
-    app: {{ .Chart.Name }}
-  ports:
-  - name: {{ .Chart.Name }}
-    protocol: TCP
-    port: {{ .Values.service.port }}
-    targetPort: {{ .Values.service.port }}

package/src/helm-starters/baseline/templates/serviceaccount.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  annotations:
-    iam.gke.io/gcp-service-account: {{ .Chart.Name }}@{{ .Values.service.project_id }}.iam.gserviceaccount.com
-  name: {{ .Chart.Name }}
-  labels:
-    app: {{ .Chart.Name }}
-    chart/version: {{ .Chart.Version }}
-    chart/appVersion: {{ .Values.image.tag }}

package/src/helm-starters/baseline/values.yaml

@@ -1,57 +0,0 @@
-image:
-  tag: v0.1.0
-  registry: gcr.io/leverege-docker-images
-
-# define all config values as quoted strings
-config:
-  # server configs
-  LOG_CONFIG: '{"type":"pino","level":"warn"}'
-
-  # imagine configs
-  logExpressRequests: "false"
-  ALIAS_KEY: "needs-to-be-set"
-  BLUEPRINT_ID: "needs-to-be-set"
-  IMAGINE_URL: "http://api-server:8181"
-  INGESTION_TOPIC: "needs-to-be-set"
-  NETWORK_ID: "needs-to-be-set"
-  SYSTEM_ID: "needs-to-be-set"
-
-# overwhelm will auto inject project_id, host and ingress into service
-service:
-  port: 8383
-  preemptible: true
-
-# can be used to set load balancer to registered static IP
-loadbalancer:
-  ip: nil
-
-# liveness and readiness probe to prove k8s health
-probes:
-  enabled: true
-
-# this tells calico that redis access is needed
-redis:
-  enabled: false
-
-# setting to false will allow pod disk to mount read/write
-# setting this to false should only be done for debugging
-securityContext:
-  readOnlyRootFs: true
-
-horizontalScaler:
-  minReplicas: 2
-  maxReplicas: 3
-  maxCPU: 75
-
-affinity: {}
-
-# typically handled by traefik, but not always
-ingress: {}
-
-nodeSelector: {}
-
-podAnnotations: {}
-
-tolerations: []
-
-workloadIdentity: {}

package/src/helm-starters/deprecated/Chart.yaml

@@ -1,4 +0,0 @@
-name: qmed-qvue-ingestor
-version: 1.4.9
-apiVersion: v2
-icon: https://raw.githubusercontent.com/kubernetes/kubernetes/master/logo/logo.svg

package/src/helm-starters/deprecated/templates/NOTES.txt

@@ -1,52 +0,0 @@
--------------------------------------------------------------------------------
-
-Service: {{ .Chart.Name }}
-
-This service relies on the presence of a Service Account (SA) to define its
-permissions on the clusters that it is deployed to. Verify or create an SA
-with the following name and IAM roles:
-
-   SA name   => {{ .Chart.Name }}
-   IAM roles => pubsub.editor
-                secretmanager.secretAccessor
-
-{{- if .Values.workloadIdentity.disabled }}
-
-Workload Identity is disabled for this service, most likely because this is
-running on a legacy cluster which does not support it. In order for this
-service to function properly a set of JSON keys will need to be generated and
-then stored as a secret using this syntax:
-
-  cat <keyfileName> | kubectl create secret generic {{ .Chart.Name }}-sa-key \
-                                    --from-file=key.json=/dev/stdin
-
-{{- else }}
-
-Workload identity is enabled for this service, therefore the SA must have the
-proper IAM policy bound to it. This can be verified by running:
-
-  $ gcloud iam service-accounts get-iam-policy \
-      --project {{ .Values.config.PROJECT_ID }} \
-      {{ .Chart.Name }}@{{ .Values.config.PROJECT_ID }}.iam.gserviceaccount.com
-
-which should return something resembling:
-
-  bindings:
-  - members:
-    - serviceAccount:{{ .Values.config.PROJECT_ID }}.svc.id.goog[default/<service name>]
-    role: roles/iam.workloadIdentityUser
-  etag: <uuencoded tag>
-  version: 1
-
-If the role of roles/iam.workloadIdentityUser does not appear on the SA then
-run the following command to add it:
-
-  $ gcloud iam service-accounts add-iam-policy-binding \
-      --project {{ .Values.config.PROJECT_ID }} \
-      --role roles/iam.workloadIdentityUser \
-      --member "serviceAccount:{{ .Values.config.PROJECT_ID }}.svc.id.goog[default/{{ .Chart.Name }}]" \
-      {{ .Chart.Name }}@{{ .Values.config.PROJECT_ID }}.iam.gserviceaccount.com
-
-{{- end }}
-
--------------------------------------------------------------------------------

package/src/helm-starters/deprecated/templates/configmap.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ .Chart.Name }}-configs
-  labels:
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    app: "{{ .Chart.Name }}"
-    heritage: "{{ .Release.Service }}"
-    release: "{{ .Release.Name }}"
-data:
-  {{- toYaml .Values.config | nindent 2 }}

package/src/helm-starters/deprecated/templates/deployment.yaml

@@ -1,103 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ .Chart.Name }}
-  labels:
-    redis-client: "true"
-    app: {{ .Chart.Name }}
-    chart/version: {{ .Chart.Version }}
-    chart/appVersion: {{ .Values.image.VERSION }}
-spec:
-  selector:
-    matchLabels:
-      app: {{ .Chart.Name }}
-  template:
-    metadata:
-      labels:
-        app: {{ .Chart.Name }}
-        chart/version: {{ .Chart.Version }}
-        chart/appVersion: {{ .Values.image.VERSION }}
-        redis-client: "true"
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
-        prometheus.io/port: "5111"
-        prometheus.io/scrape: "true"
-        configmap.reloader.stakater.com/reload: "default-configs"
-        iam.roles: |
-          "pubsub.editor"
-          "secretManager.secretAccessor"
-    spec:
-      serviceAccountName: {{ .Chart.Name }}
-      volumes:
-      - name: tmpfs
-        emptyDir: {}
-      {{- if .Values.workloadIdentity.disabled }}
-      - name: google-cloud-key
-        secret:
-          secretName: {{ .Chart.Name }}-sa-key
-      {{- end }}
-      {{- if .Values.preemptible.enabled }}
-      tolerations:
-      - key: "preemptible"
-        operator: "Equal"
-        value: "true"
-        effect: "NoSchedule"
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - preference:
-              matchExpressions:
-              - key: cloud.google.com/gke-preemptible
-                operator: Exists
-            weight: 100
-      {{- end }}
-      containers:
-      - name: {{ .Chart.Name }}
-        imagePullPolicy: IfNotPresent
-        image: gcr.io/leverege-docker-images/{{ .Chart.Name }}:{{ .Values.image.VERSION }}
-        securityContext:
-          readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFs }}
-          runAsNonRoot: true
-          runAsUser: 1000
-          allowPrivilegeEscalation: false
-        {{- if .Values.probes }}{{ if .Values.probes.enabled }}
-        readinessProbe:
-          httpGet:
-            path: /healthz
-            port: api
-          initialDelaySeconds: 10
-        livenessProbe:
-          httpGet:
-            path: /livenessProbe
-            port: api
-          initialDelaySeconds: 15
-          periodSeconds: 60
-        {{- end }}{{ end }}
-        resources:
-          limits:
-            cpu: "100m"
-            memory: "256Mi"
-#         requests:
-#           cpu: "100m"
-#           memory: "128Mi"
-        ports:
-        {{- if .Values.config.port }}
-        - name: api
-          containerPort: {{ .Values.config.port }}
-          protocol: TCP
-        {{- end }}
-        - name: node-metrics
-          containerPort: 5111
-        volumeMounts:
-        - name: tmpfs
-          mountPath: "/tmp"
-        envFrom: 
-        - configMapRef:
-            name: default-configs
-        - configMapRef:
-            name: {{ .Chart.Name }}-configs
-        env:
-        {{- if .Values.workloadIdentity.disabled }}
-        - name: GOOGLE_APPLICATION_CREDENTIALS
-          value: /var/secrets/google/key.json
-        {{- end }}

package/src/helm-starters/deprecated/templates/hpa.yaml

@@ -1,12 +0,0 @@
-apiVersion: autoscaling/v1
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ .Chart.Name }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: {{ .Chart.Name }}
-  minReplicas: {{ .Values.horizontalScaler.minReplicas }}
-  maxReplicas: {{ .Values.horizontalScaler.maxReplicas }}
-  targetCPUUtilizationPercentage: {{ .Values.horizontalScaler.maxCPU }}

package/src/helm-starters/deprecated/templates/ingress.yaml

@@ -1,17 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ .Chart.Name }}
-  labels:
-    app: {{ .Chart.Name }}
-  annotations:
-#   kubernetes.io/ingress.allow-http: "false"
-    kubernetes.io/ingress.global-static-ip-name: {{ .Chart.Name }}
-spec:
-  tls:
-  - secretName: {{ .Values.ingress.secretName }}
-  defaultBackend:
-    service:
-      name: {{ .Chart.Name }}
-      port:
-        number: {{ .Values.config.port }}

package/src/helm-starters/deprecated/templates/pdb.yaml

@@ -1,9 +0,0 @@
-apiVersion: policy/v1beta1
-kind: PodDisruptionBudget
-metadata:
-  name: {{ .Chart.Name }}
-spec:
-  minAvailable: 75%
-  selector:
-    matchLabels:
-      app: app

package/src/helm-starters/deprecated/templates/service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ .Chart.Name }}
-spec:
-  type: NodePort
-  selector:
-    app: {{ .Chart.Name }}
-  ports:
-  - name: {{ .Chart.Name }}
-    protocol: TCP
-    port: {{ .Values.config.port }}
-    targetPort: {{ .Values.config.port }}

package/src/helm-starters/deprecated/templates/serviceaccount.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  annotations:
-    iam.gke.io/gcp-service-account: {{ .Chart.Name }}@{{ .Values.config.PROJECT_ID }}.iam.gserviceaccount.com
-  name: {{ .Chart.Name }}
-  labels:
-    app: {{ .Chart.Name }}
-    chart/version: {{ .Chart.Version }}
-    chart/appVersion: {{ .Values.image.VERSION }}

package/src/helm-starters/deprecated/values.yaml

@@ -1,44 +0,0 @@
-image:
-  VERSION: v0.4.4
-
-config:
-  LOG_CONFIG: '{"type":"pino","level":"warn"}'
-  BLUEPRINT_ID: needs-to-be-set
-  NETWORK_ID: needs-to-be-set
-  SYSTEM_ID: needs-to-be-set
-  IMAGINE_URL: needs-to-be-set
-  ALIAS_KEY: needs-to-be-set
-  INGESTION_TOPIC: needs-to-be-set
-  port: 8383
-  logExpressRequests: false
-
-ingress:
-  domain: leverege.net
-  secretName: leverege-net-ssl-2034
-
-preemptible:
-  enabled: true
-
-probes:
-  enabled: true
-
-redisClient:
-  label: true
-
-securityContext:
-  readOnlyRootFs: true
-
-horizontalScaler:
-  minReplicas: 1
-  maxReplicas: 3
-  maxCPU: 75
-
-affinity: {}
-
-nodeSelector: {}
-
-podAnnotations: {}
-
-tolerations: []
-
-workloadIdentity: {}

package/src/sa-tools/imp-sa

@@ -1,26 +0,0 @@
-#!/bin/bash
-
-IMPERSONATE='gcloud config set auth/impersonate_service_account'
-impersonate() {
- sa=$1
- echo "Impersonating $sa"
- $IMPERSONATE $sa
-}
-
-case $1 in
-  terraform)
-    impersonate terraformer@leverege-dev-john.iam.gserviceaccount.com
-    ;;
-  gke)
-    impersonate k8s@project.iam.gserviceaccount.com
-    ;;
-  admin)
-    impersonate admin@other-project.iam.gserviceaccount.com
-    ;;
-  clear)
-    gcloud config unset auth/impersonate_service_account
-    ;;
-  *)
-    echo "Usage: Updates impersonated service account"
-    echo "  imp-sa [gke|admin|clear]"
-esac

package/src/sa-tools/roles/baseline/leveregeBigQueryReader.json

@@ -1,10 +0,0 @@
-{
-  "description": "Leverege BQ data accessor",
-  "includedPermissions": [
-    "bigquery.jobs.create",
-    "bigquery.tables.create",
-    "bigquery.tables.getData"
-  ],
-  "stage": "BETA",
-  "title": "Leverege Big Query Reader"
-}