initial commit - adding chart

Soluto · Dec 19, 2018 · f51618a · f51618a
1 parent 5e5c2ee
commit f51618a
Show file tree

Hide file tree

Showing 18 changed files with 511 additions and 0 deletions.
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+description:  An open source, git-ops, zero-trust secrets encryption and decryption solution for Kubernetes applications
+name: kamus
+version: 0.1.0
+keywords:
+  - gitops
+  - secrets
+sources:
+  - https://github.com/Soluto/Kamus
+maintainers:
+  - name: Omer Levi Hevroni
+  - name: Shai Katz
diff --git a/chart/templates/NOTES.txt b/chart/templates/NOTES.txt
@@ -0,0 +1,19 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.hosts }}
+  http://{{ . }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "kamus.name" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get svc -w {{ template "kamus.name" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "kamus.name" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+  echo http://$SERVICE_IP:{{ .Values.service.externalPort }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "kamus.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl port-forward $POD_NAME 8080:{{ .Values.service.internalPort }}
+{{- end }}
diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl
@@ -0,0 +1,15 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "kamus.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "appsettings.secret.json" }}
+{{ printf "{\n\t\"ActiveDirectory\": { " }}
+{{ if .Values.activeDirectory.clientSecret}}
+{{ printf "\t\t\"ClientSecret\": \"%s\" " .Values.activeDirectory.clientSecret }}
+{{- end -}}
+{{ printf "} \n}"}}
+{{- end }}
diff --git a/chart/templates/autoscaling-decryptor.yaml b/chart/templates/autoscaling-decryptor.yaml
@@ -0,0 +1,19 @@
+apiVersion: autoscaling/v1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ template "kamus.name" . }}-decryptor
+  namespace: {{ .Values.team }}
+  labels:
+    app: {{ template "kamus.name" . }}
+    component: decryptor
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1beta1
+    kind: Deployment
+    name: {{ template "kamus.name" . }}-decryptor
+  minReplicas: {{ .Values.autoscale.minReplicas }}
+  maxReplicas: {{ .Values.autoscale.maxReplicas }}
+  targetCPUUtilizationPercentage: {{ .Values.autoscale.targetCPU }}
diff --git a/chart/templates/autoscaling-encryptor.yaml b/chart/templates/autoscaling-encryptor.yaml
@@ -0,0 +1,19 @@
+apiVersion: autoscaling/v1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ template "kamus.name" . }}-encryptor
+  namespace: {{ .Values.team }}
+  labels:
+    app: {{ template "kamus.name" . }}
+    component: encryptor
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1beta1
+    kind: Deployment
+    name: {{ template "kamus.name" . }}-encryptor
+  minReplicas: {{ .Values.autoscale.minReplicas }}
+  maxReplicas: {{ .Values.autoscale.maxReplicas }}
+  targetCPUUtilizationPercentage: {{ .Values.autoscale.targetCPU }}
diff --git a/chart/templates/configmap-decryptor.yaml b/chart/templates/configmap-decryptor.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "kamus.name" . }}-decryptor
+  namespace: {{ .Values.team }}
+data:
+{{- if .Values.config }}
+{{ toYaml .Values.config | trimSuffix "\n" | indent 2 }}
+{{- end }}
diff --git a/chart/templates/configmap-encryptor.yaml b/chart/templates/configmap-encryptor.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "kamus.name" . }}-encryptor
+  namespace: {{ .Values.team }}
+data:
+{{- if .Values.config }}
+{{ toYaml .Values.config | trimSuffix "\n" | indent 2 }}
+{{- end }}
diff --git a/chart/templates/deployment-decryptor.yaml b/chart/templates/deployment-decryptor.yaml
@@ -0,0 +1,65 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: {{ template "kamus.name" . }}-decryptor
+  namespace: {{ .Values.team }}
+  labels:
+    app: {{ template "kamus.name" . }}
+    component: decryptor
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  strategy:
+    rollingUpdate:
+      maxUnavailable: {{ .Values.maxUnavailable }}
+  replicas: {{ .Values.replicaCount }}
+  selector:
+      matchLabels:
+        app: {{ template "kamus.name" . }}
+        release: {{ .Release.Name }}
+        component: decryptor
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  template:
+    metadata:
+      labels:
+        app: {{ template "kamus.name" . }}
+        release: {{ .Release.Name }}
+        component: decryptor
+    spec:
+      serviceAccountName: {{ template "kamus.name" . }}
+      automountServiceAccountToken: true
+      containers:
+        - name: decryptor-api
+          image: {{ .Values.image.repository }}/kamus:decryptor-{{ .Values.image.version }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          volumeMounts:
+            - name: secret-volume
+              mountPath: /app/secrets
+          ports:
+            - containerPort: 9999
+          livenessProbe:
+            httpGet:
+              path: /api/v1/isAlive
+              port: 9999
+          readinessProbe:
+            httpGet:
+              path: /api/v1/isAlive
+              port: 9999
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+          envFrom:
+           - configMapRef:
+              name: {{ template "kamus.name" . }}-decryptor
+        {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+        - name: {{ toYaml .Values.imagePullSecrets }}
+        {{- end }}
+      volumes:
+        - name: secret-volume
+          secret:
+            secretName: {{ template "kamus.name" . }}
+      {{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+      {{- end }}
diff --git a/chart/templates/deployment-encryptor.yaml b/chart/templates/deployment-encryptor.yaml
@@ -0,0 +1,100 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: {{ template "kamus.name" . }}-encryptor
+  namespace: {{ .Values.team }}
+  labels:
+    app: {{ template "kamus.name" . }}
+    component: encryptor
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  strategy:
+    rollingUpdate:
+      maxUnavailable: {{ .Values.maxUnavailable }}
+  replicas: {{ .Values.replicaCount }}
+  selector:
+      matchLabels:
+        app: {{ template "kamus.name" . }}
+        component: encryptor
+        release: {{ .Release.Name }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+  template:
+    metadata:
+      labels:
+        app: {{ template "kamus.name" . }}
+        component: encryptor
+        release: {{ .Release.Name }}
+    spec:
+      serviceAccountName: {{ template "kamus.name" . }}
+      automountServiceAccountToken: false
+      containers:
+        - name: encryptor-api
+          image: {{ .Values.image.repository }}/kamus:decryptor-{{ .Values.image.version }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          volumeMounts:
+            - name: secret-volume
+              mountPath: /app/secrets
+          ports:
+            - containerPort: 9999
+          livenessProbe:
+            httpGet:
+              path: /api/v1/isAlive
+              port: 9999
+          readinessProbe:
+            httpGet:
+              path: /api/v1/isAlive
+              port: 9999
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+          envFrom:
+           - configMapRef:
+              name: {{ template "kamus.name" . }}-encryptor
+        {{- if .Values.useAirbag }}
+        - name: "airbag"
+          image: "soluto/airbag:0.0.8"
+          ports:
+            - containerPort: {{ .Values.airbag.airbagPort }}
+          env:
+            - name: BACKEND_HOST_NAME
+              value: {{ .Values.airbag.backendHostName | quote }}
+            - name: BACKEND_SERVICE_PORT
+              value: "9999"
+            - name: UNAUTHENTICATED_ROUTES
+              value: '/api/v1/isAlive,/metrics'
+            - name: COLLECT_METRICS
+              value: {{ .Values.airbag.collectMetrics | quote }}
+            - name: ASPNETCORE_URLS
+              value: {{ print "http://+:" .Values.airbag.airbagPort }}
+            {{- if .Values.airbag.authority }}
+            - name: AUTHORITY
+              value: {{ .Values.airbag.authority | quote }}
+            - name: AUDIENCE
+              value: {{ .Values.airbag.audience | quote }}
+            - name: ISSUER
+              value: {{ .Values.airbag.issuer | quote }}  
+            {{- end }}  
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.service.isAlivePath }}
+              port: {{ .Values.service.internalPort }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.service.isAlivePath }}
+              port: {{ .Values.service.internalPort }}
+          resources:
+{{ toYaml .Values.airbag.resources | indent 12 }}
+        {{- end }}
+        {{- if .Values.imagePullSecrets }}
+      imagePullSecrets:
+        - name: {{ toYaml .Values.imagePullSecrets }}
+        {{- end }}
+      volumes:
+        - name: secret-volume
+          secret:
+            secretName: {{ template "kamus.name" . }}
+      {{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+      {{- end }}
diff --git a/chart/templates/ingress.yaml b/chart/templates/ingress.yaml
@@ -0,0 +1,40 @@
+{{- if .Values.ingress.enabled -}}
+{{- $serviceName := include "kamus.name" . -}}
+{{- $servicePort := .Values.service.externalPort -}}
+{{- $servicePath := .Values.ingress.path | default "/" -}}
+{{- $tlsSecretName := .Values.ingress.tls.secretName -}}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: {{ template "kamus.name" . }}
+  namespace: {{ .Values.team }}
+  labels:
+    app: {{ template "kamus.name" . }}
+    component: encryptor
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- if .Values.ingress.annotations }}
+  annotations:
+{{ toYaml .Values.ingress.annotations | indent 4 }}
+{{- end }}
+spec:
+  rules:
+    {{- range $host := .Values.ingress.hosts }}
+    - host: {{ $host }}
+      http:
+        paths:
+          - path: {{ $servicePath }}
+            backend:
+              serviceName: {{ $serviceName }}
+              servicePort: {{ $servicePort }}
+    {{- end }}
+
+  tls:
+    - hosts:
+    {{- range $host := .Values.ingress.hosts }}
+      - {{ $host }}
+    {{- end }}
+
+      secretName: {{ $tlsSecretName }}
+{{- end -}}
diff --git a/chart/templates/role.yaml b/chart/templates/role.yaml
@@ -0,0 +1,9 @@
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  namespace: {{ .Values.team }}
+  name: {{ template "kamus.name" . }}
+rules:
+- apiGroups: ["authentication.k8s.io"]
+  resources: ["tokenreviews"]
+  verbs: ["create"]
diff --git a/chart/templates/rolebinding.yaml b/chart/templates/rolebinding.yaml
@@ -0,0 +1,13 @@
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ template "kamus.name" . }}
+  namespace: {{ .Values.team }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "kamus.name" . }} 
+  namespace: {{ .Values.team }}
+roleRef:
+  kind: Role 
+  name: {{ template "kamus.name" . }}
+  apiGroup: rbac.authorization.k8s.io
diff --git a/chart/templates/secret.yaml b/chart/templates/secret.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  namespace: {{ .Values.team }}
+  name: {{ include "kamus.name" . }}
+type: Opaque
+data:
+  appsettings.secret.json: {{ include "appsettings.secret.json"  . | b64enc}}
diff --git a/chart/templates/service-decryptor.yaml b/chart/templates/service-decryptor.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "kamus.name" . }}-decryptor
+  namespace: {{ .Values.team }}
+{{- if .Values.service.annotations }}
+  annotations:
+{{ toYaml .Values.service.annotations | indent 4 }}
+{{- end }}
+  labels:
+    app: {{ template "kamus.name" . }}
+    component: decryptor
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: 80
+      targetPort: 9999
+      protocol: TCP
+      name: {{ .Values.service.name }}
+  selector:
+    app: {{ template "kamus.name" . }}
+    component: decryptor
+    release: {{ .Release.Name }}