From 48cb5c01ded24cd82f5b66c47395ecb4f1204554 Mon Sep 17 00:00:00 2001 From: jklein Date: Sat, 22 Aug 2026 19:01:04 +0200 Subject: [PATCH] Zipline chart: ingress standard, secret ref structure (conventions batch 3) Repo-standard flexible ingress (required clusterIssuer instead of the hardcoded letsencrypt-issuer, domain moved from config.domain to ingress.domain, className value, annotations merge, standard TLS secret name), secrets.SecretRef structure, core secret renamed to the standard -secret name, additive tpl-rendered env block, documented PVC naming exception. Major bump 4.1.2+up4.7.0 -> 5.0.0+up4.7.0. --- ci/zipline/fixtures.yaml | 2 +- ci/zipline/test-values.yaml | 12 ++++++----- zipline/Chart.yaml | 2 +- zipline/templates/db-connection.secret.yaml | 2 +- zipline/templates/zipline.ingress.yaml | 13 ++++++----- zipline/templates/zipline.pvc.yaml | 2 ++ zipline/templates/zipline.secret.yaml | 4 ++-- zipline/templates/zipline.sfs.yaml | 24 +++++++++++++++++++-- zipline/values.yaml | 21 ++++++++++++++---- 9 files changed, 61 insertions(+), 21 deletions(-) diff --git a/ci/zipline/fixtures.yaml b/ci/zipline/fixtures.yaml index 1ec5ddb..a88d70b 100644 --- a/ci/zipline/fixtures.yaml +++ b/ci/zipline/fixtures.yaml @@ -10,7 +10,7 @@ stringData: apiVersion: v1 kind: Secret metadata: - name: ci-zipline-core-secret + name: ci-zipline-secret stringData: server-secret: zipline-ci-core-secret-0123456789abcdef0123456789abcdef0123456789 --- diff --git a/ci/zipline/test-values.yaml b/ci/zipline/test-values.yaml index 08f06d7..6663f62 100644 --- a/ci/zipline/test-values.yaml +++ b/ci/zipline/test-values.yaml @@ -1,9 +1,11 @@ config: storage: 1Gi storageClass: local-path +ingress: domain: zipline.ci.local - # The OnePasswordItem CRs only need non-null item paths; the actual - # Kubernetes Secrets come from ci/zipline/fixtures.yaml. - secretRef: - db: op://ci/zipline-db - zipline: op://ci/zipline-core + clusterIssuer: ci-issuer +# The OnePasswordItem CRs only need non-null item paths; the actual +# Kubernetes Secrets come from ci/zipline/fixtures.yaml. +secrets: + databaseSecretRef: op://ci/zipline-db + ziplineSecretRef: op://ci/zipline-core diff --git a/zipline/Chart.yaml b/zipline/Chart.yaml index 21e9571..cc392d0 100644 --- a/zipline/Chart.yaml +++ b/zipline/Chart.yaml @@ -16,7 +16,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 4.1.2+up4.7.0 +version: 5.0.0+up4.7.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to diff --git a/zipline/templates/db-connection.secret.yaml b/zipline/templates/db-connection.secret.yaml index 5348221..2389f2a 100644 --- a/zipline/templates/db-connection.secret.yaml +++ b/zipline/templates/db-connection.secret.yaml @@ -3,4 +3,4 @@ kind: OnePasswordItem metadata: name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret spec: - itemPath: {{ required "A secret-reference for the DB-Secret must be provided" .Values.config.secretRef.db }} + itemPath: {{ required "You must provide a databaseSecret Reference" .Values.secrets.databaseSecretRef }} diff --git a/zipline/templates/zipline.ingress.yaml b/zipline/templates/zipline.ingress.yaml index 8e24c99..46a7bd2 100644 --- a/zipline/templates/zipline.ingress.yaml +++ b/zipline/templates/zipline.ingress.yaml @@ -3,13 +3,16 @@ kind: Ingress metadata: name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress annotations: - cert-manager.io/cluster-issuer: letsencrypt-issuer + cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }} nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.config.maxUploadFileSize }} nginx.org/client-max-body-size: {{ .Values.config.maxUploadFileSize }} + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: - ingressClassName: nginx + ingressClassName: {{ .Values.ingress.className }} rules: - - host: {{ required "A Domain/Host must be provided" .Values.config.domain }} + - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }} http: paths: - backend: @@ -21,5 +24,5 @@ spec: pathType: Prefix tls: - hosts: - - {{ required "A Domain/Host must be provided" .Values.config.domain }} - secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-{{ .Values.config.domain }}-ingress \ No newline at end of file + - {{ required "A Domain/Host must be provided" .Values.ingress.domain }} + secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress diff --git a/zipline/templates/zipline.pvc.yaml b/zipline/templates/zipline.pvc.yaml index a93a076..33f2f60 100644 --- a/zipline/templates/zipline.pvc.yaml +++ b/zipline/templates/zipline.pvc.yaml @@ -1,6 +1,8 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: + # Documented exception from the "-" naming scheme (issue #32): renaming + # a PVC would provision a new, empty volume, so the historic "-vc" name stays. name: {{ .Release.Name }}-{{ .Chart.Name }}-vc spec: accessModes: diff --git a/zipline/templates/zipline.secret.yaml b/zipline/templates/zipline.secret.yaml index ed33632..e35eec6 100644 --- a/zipline/templates/zipline.secret.yaml +++ b/zipline/templates/zipline.secret.yaml @@ -1,6 +1,6 @@ apiVersion: onepassword.com/v1 kind: OnePasswordItem metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-core-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-secret spec: - itemPath: {{ required "A secret-reference for the DB-Secret must be provided" .Values.config.secretRef.zipline }} + itemPath: {{ required "You must provide a ziplineSecret Reference" .Values.secrets.ziplineSecretRef }} diff --git a/zipline/templates/zipline.sfs.yaml b/zipline/templates/zipline.sfs.yaml index 0b4be75..065e68f 100644 --- a/zipline/templates/zipline.sfs.yaml +++ b/zipline/templates/zipline.sfs.yaml @@ -27,14 +27,34 @@ spec: name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret key: connection-url - name: CORE_DEFAULT_DOMAIN - value: "{{ .Values.config.domain }}" + value: "{{ .Values.ingress.domain }}" - name: CORE_SECRET valueFrom: secretKeyRef: - name: {{ .Release.Name }}-{{ .Chart.Name }}-core-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-secret key: server-secret - name: UPLOADER_ADMIN_LIMIT value: 500mb + {{- range $value := .Values.zipline.env }} + {{- if $value.value }} + - name: {{ $value.name | quote }} + value: {{ tpl $value.value $ | quote }} + {{- else if $value.valueFrom }} + {{- if $value.valueFrom.secretKeyRef }} + - name: {{ $value.name }} + valueFrom: + secretKeyRef: + name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }} + key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }} + {{- else if $value.valueFrom.configMapKeyRef }} + - name: {{ $value.name }} + valueFrom: + configMapKeyRef: + name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }} + key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }} + {{- end }} + {{- end }} + {{- end }} resources: {{- include "zipline.resources" .Values.zipline.resources | nindent 12 }} ports: diff --git a/zipline/values.yaml b/zipline/values.yaml index 81a5caa..fc78bdf 100644 --- a/zipline/values.yaml +++ b/zipline/values.yaml @@ -4,14 +4,15 @@ # Services stay in place; scaleDown: false brings the workloads back up. scaleDown: false +secrets: + databaseSecretRef: null + ziplineSecretRef: null + config: storage: 50Gi storageClass: longhorn - secretRef: - db: null - zipline: null - domain: null maxUploadFileSize: 30m + zipline: # Replica count for this workload; 0 is allowed and scales it down. # The chart-global scaleDown flag takes precedence. @@ -68,3 +69,15 @@ zipline: cpu: 0.1 memory: 265Mi ephemeralStorage: 100Mi + # Extra environment variables, appended to the ones the chart always sets. + # Rendered through tpl; value, secretKeyRef and configMapKeyRef forms are + # supported (see template-chart). + env: [] + +ingress: + clusterIssuer: null + domain: null + className: nginx + # Extra annotations for the Ingress; merged with the cert-manager + # cluster-issuer and upload-size annotations the chart always sets. + annotations: {}