@leverege/build-tools 2.8.7 → 2.8.9

package/lib/server/overwhelm.js

@@ -284,10 +284,10 @@ ahoy.forEach(dir => {
     const valuesAll = YAML.load(valuesOut);
     const valuesSvc = {
       service: {
-        PROJECT_ID: 'OVH:<PROJECT_ID>',
-        PROJECT_NAME: 'OVH:<PROJECT_NAME>',
-        HOST: 'OVH:<HOST>',
-        INGRESS: 'OVH:<INGRESS>'
+        project_id: 'OVH:<PROJECT_ID>',
+        project_name: 'OVH:<PROJECT_NAME>',
+        host: 'OVH:<HOST>',
+        ingress: 'OVH:<INGRESS>'
       }
     };
     const valuesMerged = YAML.dump(deepmerge(valuesSvc, valuesAll), {

package/lib/server/unleash.js

@@ -13,7 +13,7 @@ const getCurrentBranchName = async () => {
 };
 
 const isProtected = async () => {
-  const protectedBranches = ['master', 'development', ...process.argv.slice(2)];
+  const protectedBranches = ['main', 'master', 'development', ...process.argv.slice(2)];
   const theBranch = await getCurrentBranchName();
   return protectedBranches.includes(theBranch);
 };

package/lib/web/overwhelm.js

@@ -284,10 +284,10 @@ ahoy.forEach(dir => {
     const valuesAll = YAML.load(valuesOut);
     const valuesSvc = {
       service: {
-        PROJECT_ID: 'OVH:<PROJECT_ID>',
-        PROJECT_NAME: 'OVH:<PROJECT_NAME>',
-        HOST: 'OVH:<HOST>',
-        INGRESS: 'OVH:<INGRESS>'
+        project_id: 'OVH:<PROJECT_ID>',
+        project_name: 'OVH:<PROJECT_NAME>',
+        host: 'OVH:<HOST>',
+        ingress: 'OVH:<INGRESS>'
       }
     };
     const valuesMerged = YAML.dump(deepmerge(valuesSvc, valuesAll), {

package/lib/web/unleash.js

@@ -13,7 +13,7 @@ const getCurrentBranchName = async () => {
 };
 
 const isProtected = async () => {
-  const protectedBranches = ['master', 'development', ...process.argv.slice(2)];
+  const protectedBranches = ['main', 'master', 'development', ...process.argv.slice(2)];
   const theBranch = await getCurrentBranchName();
   return protectedBranches.includes(theBranch);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.8.7",
+  "version": "2.8.9",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "scripts": {
@@ -64,21 +64,21 @@
     "inquirer": "^8.2.0",
     "js-yaml": "^4.1.0",
     "ncp": "^2.0.0",
-    "npm-check-updates": "^12.0.2",
+    "npm-check-updates": "^12.0.5",
     "npm-registry-fetch": "^11.0.0",
     "open": "^8.4.0",
     "ora": "^5.4.1",
     "parse-gitignore": "^1.0.1",
     "readline-sync": "^1.4.10",
     "semver": "^7.3.5",
-    "simple-git": "^2.47.0"
+    "simple-git": "^2.48.0"
   },
   "devDependencies": {
     "@babel/cli": "^7.16.0",
-    "@babel/core": "^7.16.0",
-    "@babel/node": "^7.16.0",
+    "@babel/core": "^7.16.5",
+    "@babel/node": "^7.16.5",
     "@leverege/babel-preset-leverege-node": "^2.0.0",
     "@leverege/eslint-config-leverege": "^3.0.1",
-    "npm": "^8.1.4"
+    "npm": "^8.3.0"
   }
 }

package/src/helm-starters/chart/Chart.yaml

@@ -0,0 +1,4 @@
+name: qmed-qvue-ingestor
+version: 1.4.9
+apiVersion: v2
+icon: https://raw.githubusercontent.com/kubernetes/kubernetes/master/logo/logo.svg

package/src/helm-starters/chart/templates/NOTES.txt

@@ -0,0 +1,52 @@
+-------------------------------------------------------------------------------
+
+Service: {{ .Chart.Name }}
+
+This service relies on the presence of a Service Account (SA) to define its
+permissions on the clusters that it is deployed to. Verify or create an SA
+with the following name and IAM roles:
+
+   SA name   => {{ .Chart.Name }}
+   IAM roles => pubsub.editor
+                secretmanager.secretAccessor
+
+{{- if .Values.workloadIdentity.disabled }}
+
+Workload Identity is disabled for this service, most likely because this is
+running on a legacy cluster which does not support it. In order for this
+service to function properly a set of JSON keys will need to be generated and
+then stored as a secret using this syntax:
+
+  cat <keyfileName> | kubectl create secret generic {{ .Chart.Name }}-sa-key \
+                                    --from-file=key.json=/dev/stdin
+
+{{- else }}
+
+Workload identity is enabled for this service, therefore the SA must have the
+proper IAM policy bound to it. This can be verified by running:
+
+  $ gcloud iam service-accounts get-iam-policy \
+      --project {{ .Values.config.PROJECT_ID }} \
+      {{ .Chart.Name }}@{{ .Values.config.PROJECT_ID }}.iam.gserviceaccount.com
+
+which should return something resembling:
+
+  bindings:
+  - members:
+    - serviceAccount:{{ .Values.config.PROJECT_ID }}.svc.id.goog[default/<service name>]
+    role: roles/iam.workloadIdentityUser
+  etag: <uuencoded tag>
+  version: 1
+
+If the role of roles/iam.workloadIdentityUser does not appear on the SA then
+run the following command to add it:
+
+  $ gcloud iam service-accounts add-iam-policy-binding \
+      --project {{ .Values.config.PROJECT_ID }} \
+      --role roles/iam.workloadIdentityUser \
+      --member "serviceAccount:{{ .Values.config.PROJECT_ID }}.svc.id.goog[default/{{ .Chart.Name }}]" \
+      {{ .Chart.Name }}@{{ .Values.config.PROJECT_ID }}.iam.gserviceaccount.com
+
+{{- end }}
+
+-------------------------------------------------------------------------------

package/src/helm-starters/chart/templates/configmap.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Chart.Name }}-configs
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    app: "{{ .Chart.Name }}"
+    heritage: "{{ .Release.Service }}"
+    release: "{{ .Release.Name }}"
+data:
+  {{- toYaml .Values.config | nindent 2 }}

package/src/helm-starters/chart/templates/deployment.yaml

@@ -0,0 +1,103 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Chart.Name }}
+  labels:
+    redis-client: "true"
+    app: {{ .Chart.Name }}
+    chart/version: {{ .Chart.Version }}
+    chart/appVersion: {{ .Values.image.VERSION }}
+spec:
+  selector:
+    matchLabels:
+      app: {{ .Chart.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Chart.Name }}
+        chart/version: {{ .Chart.Version }}
+        chart/appVersion: {{ .Values.image.VERSION }}
+        redis-client: "true"
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        prometheus.io/port: "5111"
+        prometheus.io/scrape: "true"
+        configmap.reloader.stakater.com/reload: "default-configs"
+        iam.roles: |
+          "pubsub.editor"
+          "secretManager.secretAccessor"
+    spec:
+      serviceAccountName: {{ .Chart.Name }}
+      volumes:
+      - name: tmpfs
+        emptyDir: {}
+      {{- if .Values.workloadIdentity.disabled }}
+      - name: google-cloud-key
+        secret:
+          secretName: {{ .Chart.Name }}-sa-key
+      {{- end }}
+      {{- if .Values.preemptible.enabled }}
+      tolerations:
+      - key: "preemptible"
+        operator: "Equal"
+        value: "true"
+        effect: "NoSchedule"
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - preference:
+              matchExpressions:
+              - key: cloud.google.com/gke-preemptible
+                operator: Exists
+            weight: 100
+      {{- end }}
+      containers:
+      - name: {{ .Chart.Name }}
+        imagePullPolicy: IfNotPresent
+        image: gcr.io/leverege-docker-images/{{ .Chart.Name }}:{{ .Values.image.VERSION }}
+        securityContext:
+          readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFs }}
+          runAsNonRoot: true
+          runAsUser: 1000
+          allowPrivilegeEscalation: false
+        {{- if .Values.probes }}{{ if .Values.probes.enabled }}
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: api
+          initialDelaySeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /livenessProbe
+            port: api
+          initialDelaySeconds: 15
+          periodSeconds: 60
+        {{- end }}{{ end }}
+        resources:
+          limits:
+            cpu: "100m"
+            memory: "256Mi"
+#         requests:
+#           cpu: "100m"
+#           memory: "128Mi"
+        ports:
+        {{- if .Values.config.port }}
+        - name: api
+          containerPort: {{ .Values.config.port }}
+          protocol: TCP
+        {{- end }}
+        - name: node-metrics
+          containerPort: 5111
+        volumeMounts:
+        - name: tmpfs
+          mountPath: "/tmp"
+        envFrom: 
+        - configMapRef:
+            name: default-configs
+        - configMapRef:
+            name: {{ .Chart.Name }}-configs
+        env:
+        {{- if .Values.workloadIdentity.disabled }}
+        - name: GOOGLE_APPLICATION_CREDENTIALS
+          value: /var/secrets/google/key.json
+        {{- end }}

package/src/helm-starters/chart/templates/hpa.yaml

@@ -0,0 +1,12 @@
+apiVersion: autoscaling/v1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ .Chart.Name }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ .Chart.Name }}
+  minReplicas: {{ .Values.horizontalScaler.minReplicas }}
+  maxReplicas: {{ .Values.horizontalScaler.maxReplicas }}
+  targetCPUUtilizationPercentage: {{ .Values.horizontalScaler.maxCPU }}

package/src/helm-starters/chart/templates/ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Chart.Name }}
+  labels:
+    app: {{ .Chart.Name }}
+  annotations:
+#   kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: {{ .Chart.Name }}
+spec:
+  tls:
+  - secretName: {{ .Values.ingress.secretName }}
+  defaultBackend:
+    service:
+      name: {{ .Chart.Name }}
+      port:
+        number: {{ .Values.config.port }}

package/src/helm-starters/chart/templates/pdb.yaml

@@ -0,0 +1,9 @@
+apiVersion: policy/v1beta1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ .Chart.Name }}
+spec:
+  minAvailable: 75%
+  selector:
+    matchLabels:
+      app: app

package/src/helm-starters/chart/templates/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Chart.Name }}
+spec:
+  type: NodePort
+  selector:
+    app: {{ .Chart.Name }}
+  ports:
+  - name: {{ .Chart.Name }}
+    protocol: TCP
+    port: {{ .Values.config.port }}
+    targetPort: {{ .Values.config.port }}

package/src/helm-starters/chart/templates/serviceaccount.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    iam.gke.io/gcp-service-account: {{ .Chart.Name }}@{{ .Values.config.PROJECT_ID }}.iam.gserviceaccount.com
+  name: {{ .Chart.Name }}
+  labels:
+    app: {{ .Chart.Name }}
+    chart/version: {{ .Chart.Version }}
+    chart/appVersion: {{ .Values.image.VERSION }}

package/src/helm-starters/chart/values.yaml

@@ -0,0 +1,44 @@
+image:
+  VERSION: v0.4.4
+
+config:
+  LOG_CONFIG: '{"type":"pino","level":"warn"}'
+  BLUEPRINT_ID: needs-to-be-set
+  NETWORK_ID: needs-to-be-set
+  SYSTEM_ID: needs-to-be-set
+  IMAGINE_URL: needs-to-be-set
+  ALIAS_KEY: needs-to-be-set
+  INGESTION_TOPIC: needs-to-be-set
+  port: 8383
+  logExpressRequests: false
+
+ingress:
+  domain: leverege.net
+  secretName: leverege-net-ssl-2034
+
+preemptible:
+  enabled: true
+
+probes:
+  enabled: true
+
+redisClient:
+  label: true
+
+securityContext:
+  readOnlyRootFs: true
+
+horizontalScaler:
+  minReplicas: 1
+  maxReplicas: 3
+  maxCPU: 75
+
+affinity: {}
+
+nodeSelector: {}
+
+podAnnotations: {}
+
+tolerations: []
+
+workloadIdentity: {}

package/src/helmup

@@ -33,6 +33,7 @@ SYSTEM=(
   monitoring
   preemptible-killer
   reloader
+  cert-manager
   traefik
   velero
 )
@@ -303,9 +304,34 @@ NEED_TRAEFIK_SECRET
       --from-literal=dns-token=$TOKEN
   fi
 
+  TRAEFIK_HA_YAML="traefik/traefik-ha-values.yaml"
+  if [ ! -f "$TRAEFIK_HA_YAML" ];
+  then
+    cat<<TRAEFIK_CFG>>"$TRAEFIK_HA_YAML"
+additionalArguments:
+  - "--accesslog=true"
+  - "--accesslog.format=json"
+  - "--log.level=WARN"
+  - "--metrics.prometheus=true"
+  - "--metrics.prometheus.entryPoint=metrics"
+  - "--entryPoints.metrics.address=:8082"
+  - "--api.dashboard=true"
+
+deployment:
+  replicas: 3
+  podAnnotations:
+    prometheus.io/port: '8082'
+    prometheus.io/scrape: 'true'
+
+#service:
+#  spec:
+#   loadBalancerIP: xx.xx.xx.xx
+TRAEFIK_CFG
+  fi
+
   helm upgrade --install traefik traefik/traefik \
     --namespace traefik \
-    --values traefik/traefik-values.yaml
+    --values $TRAEFIK_HA_YAML
 }
 
 function installVelero() {

package/src/overwhelm.js

@@ -239,10 +239,10 @@ ahoy.forEach( ( dir ) => {
     const valuesAll = YAML.load( valuesOut )
     const valuesSvc = {
       service : {
-        PROJECT_ID : 'OVH:<PROJECT_ID>',
-        PROJECT_NAME : 'OVH:<PROJECT_NAME>',
-        HOST : 'OVH:<HOST>',
-        INGRESS : 'OVH:<INGRESS>',
+        project_id : 'OVH:<PROJECT_ID>',
+        project_name : 'OVH:<PROJECT_NAME>',
+        host : 'OVH:<HOST>',
+        ingress : 'OVH:<INGRESS>',
       }
     }
     const valuesMerged = YAML.dump( deepmerge( valuesSvc, valuesAll ), { quotingType : '"' } )

package/src/sa-tools/roles/LeveregePubSubAccess.json

@@ -0,0 +1,13 @@
+{
+  "title": "Leverege Pub/Sub Access (rw)",
+  "description": "Read/Write access to the Pub/Sub messaging service",
+  "includedPermissions": [
+    "pubsub.subscriptions.consume",
+    "pubsub.subscriptions.create",
+    "pubsub.topics.attachSubscription",
+    "pubsub.topics.create",
+    "pubsub.topics.list",
+    "pubsub.topics.publish"
+  ],
+  "stage": "BETA"
+}

package/src/sa-tools/roles/LeveregeSecretManagerAccess.json

@@ -0,0 +1,8 @@
+{
+  "title": "Leverege Secret Manager Access (ro)",
+  "description": "Read only access to the Secrets in Secrets Manager",
+  "includedPermissions": [
+    "secretmanager.versions.access"
+  ],
+  "stage": "BETA"
+}

package/src/unleash.js

@@ -12,7 +12,7 @@ const getCurrentBranchName = async () => {
 }
 
 const isProtected = async () => {
-  const protectedBranches = [ 'master', 'development', ...process.argv.slice( 2 ) ]
+  const protectedBranches = [ 'main', 'master', 'development', ...process.argv.slice( 2 ) ]
   const theBranch = await getCurrentBranchName()
   return protectedBranches.includes( theBranch )
 }