-
Notifications
You must be signed in to change notification settings - Fork 18
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #47 from chrisburr/chart-prod-improvements
Improvements for deploying non-demo chart
- Loading branch information
Showing
38 changed files
with
1,054 additions
and
315 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,24 +1,28 @@ | ||
| developer: | ||
| urls: | ||
| diracx: http://{{ hostname }}:8000 | ||
| diracx: https://{{ hostname }}:8000 | ||
| minio: http://{{ hostname }}:32000 | ||
| dex: http://{{ hostname }}:32002 | ||
| demoDir: {{ demo_dir }} | ||
| pythonModulesToInstall: {{ python_modules_to_mount }} | ||
| pythonModulesToEditableInstall: {{ python_modules_to_mount }} | ||
| nodeModuleToInstall: {{ node_module_to_mount }} | ||
|
|
||
| init-cs: | ||
| defaultUsers: | ||
| - vo: diracAdmin | ||
| userGroup: admin | ||
| sub: EgVsb2NhbA | ||
| preferredUsername: admin | ||
| # TODO: Integrate with dex | ||
|
|
||
| diracx: | ||
| hostname: {{ hostname }} | ||
| settings: | ||
| DIRACX_SERVICE_AUTH_ALLOWED_REDIRECTS: '["http://localhost:8000/api/docs/oauth2-redirect", "http://localhost:8000/dashboard/#authentication-callback"]' | ||
| DIRACX_SERVICE_AUTH_ALLOWED_REDIRECTS: '["https://{{ hostname }}:8000/api/docs/oauth2-redirect", "https://{{ hostname }}:8000/#authentication-callback"]' | ||
| DIRACX_SANDBOX_STORE_BUCKET_NAME: demo-sandboxes | ||
| DIRACX_SANDBOX_STORE_S3_CLIENT_KWARGS: '{"endpoint_url": "http://{{ hostname }}:32000", "aws_access_key_id": "console", "aws_secret_access_key": "console123"}' | ||
| DIRACX_SANDBOX_STORE_AUTO_CREATE_BUCKET: "true" | ||
|
|
||
| diracxWeb: | ||
| settings: | ||
| REDIRECT_URI: http://localhost:8000/dashboard/#authentication-callback | ||
| NEXT_PUBLIC_DIRACX_URL: http://{{ hostname }}:8000 | ||
|
|
||
| minio: | ||
| environment: | ||
| MINIO_BROWSER_REDIRECT_URL: http://{{ hostname }}:32001/ | ||
|
|
@@ -32,8 +36,8 @@ dex: | |
| public: true | ||
| name: 'CLI app' | ||
| redirectURIs: | ||
| - 'http://{{ hostname }}:8000/api/auth/device/complete' | ||
| - http://{{ hostname }}:8000/api/auth/authorize/complete | ||
| - 'https://{{ hostname }}:8000/api/auth/device/complete' | ||
| - https://{{ hostname }}:8000/api/auth/authorize/complete | ||
|
|
||
| staticPasswords: | ||
| - email: "[email protected]" | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| apiVersion: v1 | ||
| name: cert-manager-issuer | ||
| version: 0.0.1 | ||
| appVersion: 0.0.1 | ||
| description: Configuration Job to add an Issuer to cert-manager |
12 changes: 12 additions & 0 deletions
12
diracx/charts/cert-manager-issuer/templates/_create_issuer.sh.tpl
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| #!/bin/bash | ||
| set -e ; | ||
|
|
||
| issuer_file=$1 | ||
| namespace={{ .Release.Namespace }} | ||
|
|
||
| echo "Creating the certmanager issuer..." | ||
| set +e ; # The CRD may not exist yet. We need to retry until this passes | ||
| while ! kubectl --namespace=$namespace apply -f ${issuer_file:=issuer.yml}; do | ||
| sleep 1; | ||
| done ; | ||
| set -e ; # reset `e` as active |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| {{/* vim: set filetype=mustache: */}} | ||
| {{/* | ||
| Expand the name of the chart. | ||
| */}} | ||
| {{- define "cert-manager-issuer.name" -}} | ||
| {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Create a default fully qualified app name. | ||
| We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). | ||
| */}} | ||
| {{- define "cert-manager-issuer.fullname" -}} | ||
| {{- $name := default .Chart.Name .Values.nameOverride -}} | ||
| {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Create a default fully qualified job name. | ||
| Due to the job only being allowed to run once, we add the chart revision so helm | ||
| upgrades don't cause errors trying to create the already ran job. | ||
| Due to the helm delete not cleaning up these jobs, we add a random value to | ||
| reduce collision | ||
| */}} | ||
| {{- define "cert-manager-issuer.jobname" -}} | ||
| {{- $name := printf "%s-issuer" .Release.Name | trunc 55 | trimSuffix "-" -}} | ||
| {{- printf "%s-%d" $name .Release.Revision | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
| {{/* | ||
| Returns the http01 solver's ingress class field. Takes the IngressClass as paramter. | ||
| If the IngressClass is "none", the field is not set. | ||
| See: https://cert-manager.io/docs/configuration/acme/http01/#class | ||
| */}} | ||
| {{- define "cert-manager-issuer.http01.ingress.class.field" -}} | ||
| {{- $ingressClass := . | default "" -}} | ||
| {{- if ne "none" $ingressClass -}} | ||
| class: {{ $ingressClass }} | ||
| {{- end -}} | ||
| {{- end -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| {{- if .Values.acme.enabled }} | ||
| {{- $ingressCfg := dict "global" $.Values.global.ingress "local" .ingress "context" $ -}} | ||
| {{- $ingressClassName := include "ingress.class.name" $ingressCfg -}} | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Issuer | ||
| metadata: | ||
| name: {{ .Release.Name }}-issuer | ||
| namespace: {{ $.Release.Namespace }} | ||
| spec: | ||
| acme: | ||
| # The ACME server URL | ||
| server: {{ .Values.acme.server | quote }} | ||
| # Email address used for ACME registration | ||
| email: {{ required "You must provide an email to associate with your TLS certificates. Please set certmanager-issuer.email" .Values.acme.email | quote }} | ||
| # Name of a secret used to store the ACME account private key | ||
| privateKeySecretRef: | ||
| name: {{ .Release.Name }}-acme-key | ||
| # Enable the HTTP-01 challenge provider | ||
| solvers: | ||
| - selector: {} | ||
| http01: | ||
| ingress: | ||
| {{ include "cert-manager-issuer.http01.ingress.class.field" $ingressClassName -}} | ||
| {{- end }} | ||
| --- | ||
| {{- if index .Values "self-signed" "enabled" }} | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Issuer | ||
| metadata: | ||
| name: selfsigned-issuer | ||
| spec: | ||
| selfSigned: {} | ||
| --- | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Certificate | ||
| metadata: | ||
| name: diracx-selfsigned-ca | ||
| spec: | ||
| isCA: true | ||
| commonName: diracx-selfsigned-ca | ||
| secretName: root-secret | ||
| privateKey: | ||
| algorithm: ECDSA | ||
| size: 256 | ||
| issuerRef: | ||
| name: selfsigned-issuer | ||
| kind: Issuer | ||
| group: cert-manager.io | ||
| --- | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Issuer | ||
| metadata: | ||
| name: diracx-ca-issuer | ||
| spec: | ||
| ca: | ||
| secretName: root-secret | ||
| {{- end }} |
10 changes: 10 additions & 0 deletions
10
diracx/charts/cert-manager-issuer/templates/cert-manager.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: {{ template "diracx.fullname" . }}-certmanager | ||
| namespace: {{ $.Release.Namespace }} | ||
| data: | ||
| create-issuer: | | ||
| {{ include (print $.Template.BasePath "/_create_issuer.sh.tpl") . | indent 4 }} | ||
| issuer.yml: | | ||
| {{ include (print $.Template.BasePath "/_issuer.yaml") . | indent 4 }} |
Oops, something went wrong.