Zipline chart: ingress standard, secret ref structure (conventions batch 3)

Repo-standard flexible ingress (required clusterIssuer instead of the
hardcoded letsencrypt-issuer, domain moved from config.domain to
ingress.domain, className value, annotations merge, standard TLS secret
name), secrets.<name>SecretRef structure, core secret renamed to the
standard -secret name, additive tpl-rendered env block, documented PVC
naming exception. Major bump 4.1.2+up4.7.0 -> 5.0.0+up4.7.0.

ci/zipline/fixtures.yaml

@@ -10,7 +10,7 @@ stringData:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: ci-zipline-core-secret
+  name: ci-zipline-secret
 stringData:
   server-secret: zipline-ci-core-secret-0123456789abcdef0123456789abcdef0123456789
 ---

ci/zipline/test-values.yaml

@@ -1,9 +1,11 @@
 config:
   storage: 1Gi
   storageClass: local-path
+ingress:
   domain: zipline.ci.local
-  # The OnePasswordItem CRs only need non-null item paths; the actual
+  clusterIssuer: ci-issuer
-  # Kubernetes Secrets come from ci/zipline/fixtures.yaml.
+# The OnePasswordItem CRs only need non-null item paths; the actual
-  secretRef:
+# Kubernetes Secrets come from ci/zipline/fixtures.yaml.
-    db: op://ci/zipline-db
+secrets:
-    zipline: op://ci/zipline-core
+  databaseSecretRef: op://ci/zipline-db
+  ziplineSecretRef: op://ci/zipline-core

zipline/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 4.1.2+up4.7.0
+version: 5.0.0+up4.7.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

zipline/templates/db-connection.secret.yaml

@@ -3,4 +3,4 @@ kind: OnePasswordItem
 metadata:
   name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
 spec:
-  itemPath: {{ required "A secret-reference for the DB-Secret must be provided" .Values.config.secretRef.db }}
+  itemPath: {{ required "You must provide a databaseSecret Reference" .Values.secrets.databaseSecretRef }}

zipline/templates/zipline.ingress.yaml

@@ -3,13 +3,16 @@ kind: Ingress
 metadata:
   name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
   annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-issuer
+    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
     nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.config.maxUploadFileSize }}
     nginx.org/client-max-body-size: {{ .Values.config.maxUploadFileSize }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
-  ingressClassName: nginx
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
-    - host: {{ required "A Domain/Host must be provided" .Values.config.domain }}
+    - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
       http:
         paths:
           - backend:
@@ -21,5 +24,5 @@ spec:
             pathType: Prefix
   tls:
     - hosts:
-        - {{ required "A Domain/Host must be provided" .Values.config.domain }}
+        - {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
-      secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-{{ .Values.config.domain }}-ingress
+      secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress

zipline/templates/zipline.pvc.yaml

@@ -1,6 +1,8 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
+  # Documented exception from the "-<kind>" naming scheme (issue #32): renaming
+  # a PVC would provision a new, empty volume, so the historic "-vc" name stays.
   name: {{ .Release.Name }}-{{ .Chart.Name }}-vc
 spec:
   accessModes:

zipline/templates/zipline.secret.yaml

@@ -1,6 +1,6 @@
 apiVersion: onepassword.com/v1
 kind: OnePasswordItem
 metadata:
-  name: {{ .Release.Name }}-{{ .Chart.Name }}-core-secret
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
 spec:
-  itemPath: {{ required "A secret-reference for the DB-Secret must be provided" .Values.config.secretRef.zipline }}
+  itemPath: {{ required "You must provide a ziplineSecret Reference" .Values.secrets.ziplineSecretRef }}

zipline/templates/zipline.sfs.yaml

@@ -27,14 +27,34 @@ spec:
                   name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
                   key: connection-url
             - name: CORE_DEFAULT_DOMAIN
-              value: "{{ .Values.config.domain }}"
+              value: "{{ .Values.ingress.domain }}"
             - name: CORE_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-{{ .Chart.Name }}-core-secret
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
                   key: server-secret
             - name: UPLOADER_ADMIN_LIMIT
               value: 500mb
+            {{- range $value := .Values.zipline.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name | quote }}
+              value: {{ tpl $value.value $ | quote }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           resources:
             {{- include "zipline.resources" .Values.zipline.resources | nindent 12 }}
           ports:

zipline/values.yaml

@@ -4,14 +4,15 @@
 # Services stay in place; scaleDown: false brings the workloads back up.
 scaleDown: false
 
+secrets:
+  databaseSecretRef: null
+  ziplineSecretRef: null
+
 config:
   storage: 50Gi
   storageClass: longhorn
-  secretRef:
-    db: null
-    zipline: null
-  domain: null
   maxUploadFileSize: 30m
+
 zipline:
   # Replica count for this workload; 0 is allowed and scales it down.
   # The chart-global scaleDown flag takes precedence.
@@ -68,3 +69,15 @@ zipline:
       cpu: 0.1
       memory: 265Mi
       ephemeralStorage: 100Mi
+  # Extra environment variables, appended to the ones the chart always sets.
+  # Rendered through tpl; value, secretKeyRef and configMapKeyRef forms are
+  # supported (see template-chart).
+  env: []
+
+ingress:
+  clusterIssuer: null
+  domain: null
+  className: nginx
+  # Extra annotations for the Ingress; merged with the cert-manager
+  # cluster-issuer and upload-size annotations the chart always sets.
+  annotations: {}