From 72fe6f8408988a53ff320eb911507df45ae9c971 Mon Sep 17 00:00:00 2001 From: jklein Date: Wed, 8 Apr 2026 15:05:10 +0200 Subject: [PATCH] feat(rallly): added initial chart --- rallly/.helmignore | 23 ++++ rallly/Chart.yaml | 11 ++ rallly/templates/database.secret.yaml | 6 + rallly/templates/oidc.secret.yaml | 6 + rallly/templates/rallly.deployment.yaml | 144 ++++++++++++++++++++++++ rallly/templates/rallly.ingress.yaml | 23 ++++ rallly/templates/rallly.secret.yaml | 6 + rallly/templates/rallly.service.yaml | 13 +++ rallly/templates/smtp.secret.yaml | 8 ++ rallly/values.yaml | 47 ++++++++ 10 files changed, 287 insertions(+) create mode 100644 rallly/.helmignore create mode 100644 rallly/Chart.yaml create mode 100644 rallly/templates/database.secret.yaml create mode 100644 rallly/templates/oidc.secret.yaml create mode 100644 rallly/templates/rallly.deployment.yaml create mode 100644 rallly/templates/rallly.ingress.yaml create mode 100644 rallly/templates/rallly.secret.yaml create mode 100644 rallly/templates/rallly.service.yaml create mode 100644 rallly/templates/smtp.secret.yaml create mode 100644 rallly/values.yaml diff --git a/rallly/.helmignore b/rallly/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/rallly/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/rallly/Chart.yaml b/rallly/Chart.yaml new file mode 100644 index 0000000..28a2cae --- /dev/null +++ b/rallly/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: rallly +description: A Helm chart to deploy Rallly on Kubernetes + +type: application + +version: 1.0.0+up4.8.1 +appVersion: "4.8.1" + +maintainers: + - name: jklein \ No newline at end of file diff --git a/rallly/templates/database.secret.yaml b/rallly/templates/database.secret.yaml new file mode 100644 index 0000000..05eb042 --- /dev/null +++ b/rallly/templates/database.secret.yaml @@ -0,0 +1,6 @@ +apiVersion: onepassword.com/v1 +kind: OnePasswordItem +metadata: + name: {{ .Release.Name }}-{{ .Chart.Name }}-database-secret +spec: + itemPath: {{ required "You must provide a databseSecret Reference" .Values.secrets.databaseSecretRef }} diff --git a/rallly/templates/oidc.secret.yaml b/rallly/templates/oidc.secret.yaml new file mode 100644 index 0000000..c905d7d --- /dev/null +++ b/rallly/templates/oidc.secret.yaml @@ -0,0 +1,6 @@ +apiVersion: onepassword.com/v1 +kind: OnePasswordItem +metadata: + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret +spec: + itemPath: {{ required "You must provide a oidcSecret Reference" .Values.secrets.oidcSecretRef }} diff --git a/rallly/templates/rallly.deployment.yaml b/rallly/templates/rallly.deployment.yaml new file mode 100644 index 0000000..1dd4c48 --- /dev/null +++ b/rallly/templates/rallly.deployment.yaml @@ -0,0 +1,144 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }}-{{ .Chart.Name }} + labels: + app: {{ .Release.Name }}-{{ .Chart.Name }} +spec: + replicas: 1 + selector: + matchLabels: + app: {{ .Release.Name }}-{{ .Chart.Name }} + template: + metadata: + name: {{ .Release.Name }}-{{ .Chart.Name }} + labels: + app: {{ .Release.Name }}-{{ .Chart.Name }} + spec: + automountServiceAccountToken: false + securityContext: + runAsNonRoot: true + runAsUser: 20000 + runAsGroup: 1000 + fsGroup: 1000 + fsGroupChangePolicy: Always + containers: + - name: {{ .Release.Name }}-{{ .Chart.Name }} + image: "lukevella/rallly:{{ .Chart.AppVersion }}" + imagePullPolicy: IfNotPresent + env: + - name: NEXT_PUBLIC_BASE_URL + value: "https://{{ .Values.ingress.domain }}" + - name: SECRET_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-secret + key: secret-key + - name: SUPPORT_EMAIL + value: "{{ .Values.rallly.supportEmail }}" + {{- if .Values.rallly.smtp.enabled }} + - name: NOREPLY_EMAIL + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret + key: no-reply-email + - name: NOREPLY_EMAIL_NAME + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret + key: no-reply-email-name + - name: SMTP_HOST + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret + key: host + - name: SMTP_PORT + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret + key: port + - name: SMTP_SECURE + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret + key: secure + - name: SMTP_USER + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret + key: user + - name: SMTP_PWD + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret + key: password + - name: SMTP_REJECT_UNAUTHORIZED + value: "{{ .Values.rallly.smtp.rejectUnauthorized }}" + - name: SMTP_TLS_SERVERNAME + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret + key: tls-servername + {{- end }} + - name: EMAIL_LOGIN_ENABLED + value: "false" + - name: REGISTRATION_ENABLED + value: "false" + - name: OIDC_NAME + value: "{{ .Values.rallly.oidc.name }}" + - name: OIDC_NAME_CLAIM_PATH + value: "{{ .Values.rallly.oidc.nameClaimPath }}" + - name: OIDC_EMAIL_CLAIM_PATH + value: "{{ .Values.rallly.oidc.emailClaimPath }}" + - name: OIDC_PICTURE_CLAIM_PATH + value: "{{ .Values.rallly.oidc.pictureClaimPath }}" + - name: OIDC_DISCOVERY_URL + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret + key: discovery-url + - name: OIDC_CLIENT_ID + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret + key: client-id + - name: OIDC_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret + key: client-secret + - name: ALLOWED_EMAILS + value: "{{ .Values.rallly.allowedEmails }}" + - name: INITIAL_ADMIN_EMAIL + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-secret + key: initial-admin-email + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-{{ .Chart.Name }}-database-secret + key: database-url + # TODO: Add Storage Configuration + ports: + - containerPort: 3000 + protocol: TCP + name: http + livenessProbe: + {{ toYaml .Values.rallly.livenessProbe | nindent 12}} + readinessProbe: + {{ toYaml .Values.rallly.readinessProbe | nindent 12}} + startupProbe: + {{ toYaml .Values.rallly.startupProbe | nindent 12}} + resources: + {{ toYaml .Values.rallly.resources | nindent 12 }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + add: + - + restartPolicy: Always diff --git a/rallly/templates/rallly.ingress.yaml b/rallly/templates/rallly.ingress.yaml new file mode 100644 index 0000000..b4c33cc --- /dev/null +++ b/rallly/templates/rallly.ingress.yaml @@ -0,0 +1,23 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress + annotations: + cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}} +spec: + ingressClassName: nginx + rules: + - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }} + http: + paths: + - backend: + service: + name: {{ .Release.Name }}-{{ .Chart.Name }}-service + port: + name: http + path: / + pathType: Prefix + tls: + - hosts: + - {{ required "A Domain/Host must be provided" .Values.ingress.domain }} + secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress diff --git a/rallly/templates/rallly.secret.yaml b/rallly/templates/rallly.secret.yaml new file mode 100644 index 0000000..973173b --- /dev/null +++ b/rallly/templates/rallly.secret.yaml @@ -0,0 +1,6 @@ +apiVersion: onepassword.com/v1 +kind: OnePasswordItem +metadata: + name: {{ .Release.Name }}-{{ .Chart.Name }}-secret +spec: + itemPath: {{ required "You must provide a rallySecret Reference" .Values.secrets.ralllySecretRef }} diff --git a/rallly/templates/rallly.service.yaml b/rallly/templates/rallly.service.yaml new file mode 100644 index 0000000..dc281be --- /dev/null +++ b/rallly/templates/rallly.service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }}-{{ .Chart.Name }}-service +spec: + selector: + app: {{ .Release.Name }}-{{ .Chart.Name }} + ports: + - protocol: TCP + port: 80 + targetPort: http + name: http + type: ClusterIP diff --git a/rallly/templates/smtp.secret.yaml b/rallly/templates/smtp.secret.yaml new file mode 100644 index 0000000..3cac13d --- /dev/null +++ b/rallly/templates/smtp.secret.yaml @@ -0,0 +1,8 @@ +{{- if .Values.rallly.smtp.enabled }} +apiVersion: onepassword.com/v1 +kind: OnePasswordItem +metadata: + name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret +spec: + itemPath: {{ required "You must provide a smtpSecret Reference" .Values.secrets.smtpSecretRef }} +{{- end }} \ No newline at end of file diff --git a/rallly/values.yaml b/rallly/values.yaml new file mode 100644 index 0000000..4405539 --- /dev/null +++ b/rallly/values.yaml @@ -0,0 +1,47 @@ +secrets: + ralllySecretRef: null + oidcSecretRef: null + databaseSecretRef: null + smtpSecretRef: null + +rallly: + smtp: + enabled: false + allowedEmails: '*' + resources: + requests: + cpu: 0.1 + memory: 512Mi + ephemeral-storage: 100Mi + limits: + cpu: 1 + memory: 768Mi + ephemeral-storage: 250Mi + livenessProbe: + httpGet: + path: / + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: / + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + startupProbe: + httpGet: + path: / + port: http + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + +ingress: + clusterIssuer: null + domain: null \ No newline at end of file