From 9d22b3b92106fed596d5fb8676a31b9a391cf258 Mon Sep 17 00:00:00 2001 From: jklein Date: Sat, 22 Aug 2026 19:27:14 +0200 Subject: [PATCH] urlaubsverwaltung chart: naming scheme, configurable probes, flexible ingress - Rename all resources from --uv- to the repo standard -- (deployment, service, ingress, both OnePasswordItem secrets); drop the uv infix. No PVCs in this chart, so no storage migration is needed. - TLS secret renamed to the standard tls---ingress (was tls---ingress). - Probes lifted into values (urlaubsverwaltung.livenessProbe/ readinessProbe/startupProbe); defaults are exactly the previously hardcoded, issue-#9-calibrated settings. - Repo-standard flexible ingress: ingress.className (default nginx), ingress.annotations merged with the cert-manager annotation, ingress.enabled flag; domain/clusterIssuer stay required. - Additive urlaubsverwaltung.env block rendered through tpl with value/secretKeyRef/configMapKeyRef forms. - CI fixtures updated to the new secret names. Major bump 4.1.2+up6.7.0 -> 5.0.0+up6.7.0 (resource renames). --- ci/urlaubsverwaltung/fixtures.yaml | 6 +- urlaubsverwaltung/Chart.yaml | 2 +- .../urlaubsverwaltung-db.secret.yaml | 2 +- .../urlaubsverwaltung-oidc.secret.yaml | 2 +- .../urlaubsverwaltung.deployment.yaml | 77 ++++++++++--------- .../templates/urlaubsverwaltung.ingress.yaml | 15 ++-- .../templates/urlaubsverwaltung.service.yaml | 4 +- urlaubsverwaltung/values.yaml | 34 ++++++++ 8 files changed, 91 insertions(+), 51 deletions(-) diff --git a/ci/urlaubsverwaltung/fixtures.yaml b/ci/urlaubsverwaltung/fixtures.yaml index ef58745..8a6b2b4 100644 --- a/ci/urlaubsverwaltung/fixtures.yaml +++ b/ci/urlaubsverwaltung/fixtures.yaml @@ -1,11 +1,11 @@ # Fixtures for the urlaubsverwaltung install-test: throwaway postgres, a dex # OIDC provider (Spring performs OIDC discovery against the issuer at boot) # and the secrets the 1Password operator would otherwise materialize. -# Note: this chart names secrets --..., release name is ci. +# Note: secrets are named --..., release name is ci. apiVersion: v1 kind: Secret metadata: - name: urlaubsverwaltung-ci-uv-db-secret + name: ci-urlaubsverwaltung-db-secret stringData: jdbc-url: jdbc:postgresql://postgres:5432/urlaubsverwaltung username: ci @@ -14,7 +14,7 @@ stringData: apiVersion: v1 kind: Secret metadata: - name: urlaubsverwaltung-ci-uv-oidc-secret + name: ci-urlaubsverwaltung-oidc-secret stringData: client-id: ci-client client-secret: ci-client-secret diff --git a/urlaubsverwaltung/Chart.yaml b/urlaubsverwaltung/Chart.yaml index f04ed31..6220576 100644 --- a/urlaubsverwaltung/Chart.yaml +++ b/urlaubsverwaltung/Chart.yaml @@ -4,5 +4,5 @@ description: A Helm chart to deploy urlaubsverwaltung on Kubernetes icon: https://raw.githubusercontent.com/urlaubsverwaltung/urlaubsverwaltung/main/src/main/resources/static/favicons/apple-touch-icon.png type: application -version: 4.1.2+up6.7.0 +version: 5.0.0+up6.7.0 appVersion: 6.7.0 diff --git a/urlaubsverwaltung/templates/urlaubsverwaltung-db.secret.yaml b/urlaubsverwaltung/templates/urlaubsverwaltung-db.secret.yaml index 0a38889..811154b 100644 --- a/urlaubsverwaltung/templates/urlaubsverwaltung-db.secret.yaml +++ b/urlaubsverwaltung/templates/urlaubsverwaltung-db.secret.yaml @@ -1,6 +1,6 @@ apiVersion: onepassword.com/v1 kind: OnePasswordItem metadata: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-db-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret spec: itemPath: {{ .Values.secrets.databaseSecretRef }} diff --git a/urlaubsverwaltung/templates/urlaubsverwaltung-oidc.secret.yaml b/urlaubsverwaltung/templates/urlaubsverwaltung-oidc.secret.yaml index 75ab132..d19c0e2 100644 --- a/urlaubsverwaltung/templates/urlaubsverwaltung-oidc.secret.yaml +++ b/urlaubsverwaltung/templates/urlaubsverwaltung-oidc.secret.yaml @@ -1,6 +1,6 @@ apiVersion: onepassword.com/v1 kind: OnePasswordItem metadata: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret spec: itemPath: {{ .Values.secrets.oidcSecretRef }} diff --git a/urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml b/urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml index 3935eeb..2860486 100644 --- a/urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml +++ b/urlaubsverwaltung/templates/urlaubsverwaltung.deployment.yaml @@ -1,25 +1,25 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment + name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment labels: - app: {{ .Chart.Name }}-{{ .Release.Name }} + app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment spec: replicas: {{ include "urlaubsverwaltung.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.urlaubsverwaltung.replicas) }} selector: matchLabels: - app: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment + app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment template: metadata: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment + name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment labels: - app: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment + app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment spec: automountServiceAccountToken: false securityContext: {{- toYaml .Values.urlaubsverwaltung.securityContext.pod | nindent 8 }} containers: - - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-container + - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment image: "urlaubsverwaltung/urlaubsverwaltung:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent securityContext: @@ -38,17 +38,17 @@ spec: - name: SPRING_DATASOURCE_URL valueFrom: secretKeyRef: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-db-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret key: jdbc-url - name: SPRING_DATASOURCE_USERNAME valueFrom: secretKeyRef: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-db-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret key: username - name: SPRING_DATASOURCE_PASSWORD valueFrom: secretKeyRef: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-db-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret key: password # Mail - name: UV_MAIL_FROM @@ -72,17 +72,17 @@ spec: - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-ID valueFrom: secretKeyRef: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret key: client-id - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-SECRET valueFrom: secretKeyRef: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret key: client-secret - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_CLIENT-NAME valueFrom: secretKeyRef: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret key: issuer-name - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_PROVIDER value: default @@ -93,49 +93,50 @@ spec: - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_DEFAULT_REDIRECT-URI valueFrom: secretKeyRef: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret key: redirect-uri - name: SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_DEFAULT_ISSUER-URI valueFrom: secretKeyRef: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret key: issuer-uri - name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUER-URI valueFrom: secretKeyRef: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-oidc-secret + name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret key: jwt-issuer-uri - name: UV_SECURITY_OIDC_CLAIM-MAPPERS_GROUP-CLAIM_ENABLED value: "true" - name: UV_SECURITY_OIDC_CLAIM-MAPPERS_GROUP-CLAIM_CLAIM-NAME value: "groups" + {{- range $value := .Values.urlaubsverwaltung.env }} + {{- if $value.value }} + - name: {{ $value.name | quote }} + value: {{ tpl $value.value $ | quote }} + {{- else if $value.valueFrom }} + {{- if $value.valueFrom.secretKeyRef }} + - name: {{ $value.name }} + valueFrom: + secretKeyRef: + name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }} + key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }} + {{- else if $value.valueFrom.configMapKeyRef }} + - name: {{ $value.name }} + valueFrom: + configMapKeyRef: + name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }} + key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }} + {{- end }} + {{- end }} + {{- end }} resources: {{- include "urlaubsverwaltung.resources" .Values.urlaubsverwaltung.resources | nindent 12 }} - readinessProbe: - httpGet: - port: 8080 - path: /actuator/health/readiness - periodSeconds: 5 - failureThreshold: 3 - successThreshold: 1 - timeoutSeconds: 5 livenessProbe: - httpGet: - port: 8080 - path: /actuator/health/liveness - periodSeconds: 10 - failureThreshold: 3 - successThreshold: 1 - timeoutSeconds: 5 - # The startup probe gates liveness/readiness. Spring Boot startup - # (JVM + Liquibase migrations) gets a budget of 10s * 30 = 300s. + {{- toYaml .Values.urlaubsverwaltung.livenessProbe | nindent 12 }} + readinessProbe: + {{- toYaml .Values.urlaubsverwaltung.readinessProbe | nindent 12 }} startupProbe: - httpGet: - port: 8080 - path: /actuator/health/liveness - periodSeconds: 10 - failureThreshold: 30 - timeoutSeconds: 5 + {{- toYaml .Values.urlaubsverwaltung.startupProbe | nindent 12 }} volumes: - name: tmp emptyDir: {} diff --git a/urlaubsverwaltung/templates/urlaubsverwaltung.ingress.yaml b/urlaubsverwaltung/templates/urlaubsverwaltung.ingress.yaml index 46cf386..a9387ff 100644 --- a/urlaubsverwaltung/templates/urlaubsverwaltung.ingress.yaml +++ b/urlaubsverwaltung/templates/urlaubsverwaltung.ingress.yaml @@ -1,18 +1,22 @@ +{{- if .Values.ingress.enabled }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-ingress + name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress annotations: - cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}} + cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }} + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: - ingressClassName: nginx + ingressClassName: {{ .Values.ingress.className }} rules: - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }} http: paths: - backend: service: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-service + name: {{ .Release.Name }}-{{ .Chart.Name }}-service port: name: http path: / @@ -20,4 +24,5 @@ spec: tls: - hosts: - {{ required "A Domain/Host must be provided" .Values.ingress.domain }} - secretName: tls-{{ .Chart.Name }}-{{ .Release.Name }}-ingress + secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress +{{- end }} diff --git a/urlaubsverwaltung/templates/urlaubsverwaltung.service.yaml b/urlaubsverwaltung/templates/urlaubsverwaltung.service.yaml index 37d1d75..4c42512 100644 --- a/urlaubsverwaltung/templates/urlaubsverwaltung.service.yaml +++ b/urlaubsverwaltung/templates/urlaubsverwaltung.service.yaml @@ -1,10 +1,10 @@ apiVersion: v1 kind: Service metadata: - name: {{ .Chart.Name }}-{{ .Release.Name }}-uv-service + name: {{ .Release.Name }}-{{ .Chart.Name }}-service spec: selector: - app: {{ .Chart.Name }}-{{ .Release.Name }}-uv-deployment + app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment ports: - protocol: TCP port: 80 diff --git a/urlaubsverwaltung/values.yaml b/urlaubsverwaltung/values.yaml index 4623cb7..76a5cc4 100644 --- a/urlaubsverwaltung/values.yaml +++ b/urlaubsverwaltung/values.yaml @@ -9,8 +9,13 @@ secrets: oidcSecretRef: null ingress: + enabled: true clusterIssuer: "letsencrypt-issuer" domain: null + className: nginx + # Extra annotations for the Ingress; merged with the cert-manager + # cluster-issuer annotation the chart always sets. + annotations: {} urlaubsverwaltung: # Replica count for this workload; 0 is allowed and scales it down. @@ -31,6 +36,35 @@ urlaubsverwaltung: capabilities: drop: - ALL + livenessProbe: + httpGet: + port: 8080 + path: /actuator/health/liveness + periodSeconds: 10 + failureThreshold: 3 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + httpGet: + port: 8080 + path: /actuator/health/readiness + periodSeconds: 5 + failureThreshold: 3 + successThreshold: 1 + timeoutSeconds: 5 + # The startup probe gates liveness/readiness. Spring Boot startup + # (JVM + Liquibase migrations) gets a budget of 10s * 30 = 300s. + startupProbe: + httpGet: + port: 8080 + path: /actuator/health/liveness + periodSeconds: 10 + failureThreshold: 30 + timeoutSeconds: 5 + # Extra environment variables, appended to the ones the chart always sets. + # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef + # forms are supported. + env: [] resources: # Limits are optional: memory and ephemeral-storage limits default to # limitFactor x the request, an explicitly set limit always wins, and a