feat(patchmon): added initial chart

patchmon/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

patchmon/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: patchmon
+description: A Helm chart to deploy Patchmon on Kubernetes
+
+type: application
+
+version: 1.0.0+up1.4.2
+appVersion: "1.4.2"
+
+maintainers:
+  - name: jklein

patchmon/templates/patchmon-backend.deployment.yaml

@@ -0,0 +1,139 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-backend
+  labels:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-backend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-{{ .Chart.Name }}-backend
+  template:
+    metadata:
+      name: {{ .Release.Name }}-{{ .Chart.Name }}-backend
+      labels:
+        app: {{ .Release.Name }}-{{ .Chart.Name }}-backend
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 1000
+        fsGroupChangePolicy: Always
+      containers:
+        - name: {{ .Release.Name }}-{{ .Chart.Name }}-backend
+          image: "ghcr.io/patchmon/patchmon-backend:{{ .Chart.AppVersion }}"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 3001
+              protocol: TCP
+              name: http
+          env:
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-postgres-secret
+                  key: database-url
+            - name: REDIS_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
+                  key: host
+            - name: REDIS_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
+                  key: port
+            - name: REDIS_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
+                  key: username
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
+                  key: password
+            - name: REDIS_DB
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
+                  key: db
+            - name: ASSETS_DIR
+              value: /app/assets
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-patchmon-secret
+                  key: jwt-secret
+            - name: AI_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-patchmon-secret
+                  key: encryption-key
+            - name: SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-patchmon-secret
+                  key: session-secret
+            - name: OIDC_ENABLED
+              value: "true"
+            - name: OIDC_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
+                  key: issuer-url
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
+                  key: client-id
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
+                  key: client-secret
+            - name: OIDC_REDIRECT_URI
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
+                  key: redirect-uri
+            - name: OIDC_SCOPES
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
+                  key: requested-scopes
+            - name: OIDC_AUTO_CREATE_USERS
+              value: "true"
+            - name: OIDC_DEFAULT_ROLE
+              value: "viewer"
+            - name: OIDC_DISABLE_LOCAL_AUTH
+              value: "true"
+            - name: OIDC_BUTTON_TEXT
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
+                  key: button-text
+            - name: OIDC_SYNC_ROLES
+              value: "true"
+            - name: OIDC_USER_GROUP
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
+                  key: user-group-name
+            - name: OIDC_ADMIN_GROUP
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
+                  key: admin-group-name
+            - name: SERVER_HOST
+              value: "https://{{ .Values.ingress.domain }}"
+            - name: CORS_ORIGIN
+              value: "https://{{ .Values.ingress.domain }}"
+            - name: SERVER_PORT
+              value: "443"
+          # TODO: Add liveness and readiness probes
+          {{- with .Values.patchmon.backend.resources }}
+          resources:
+            {{ toYaml . | nindent 12 }}
+          {{- end }}
+      restartPolicy: Always

patchmon/templates/patchmon-backend.service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-backend-service
+spec:
+  selector:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-backend
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: http
+      name: http
+  type: ClusterIP

patchmon/templates/patchmon-frontend.deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
+  labels:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
+  template:
+    metadata:
+      name: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
+      labels:
+        app: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
+    spec:
+      automountServiceAccountToken: false
+      containers:
+        - name: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
+          image: "ghcr.io/patchmon/patchmon-frontend:{{ .Chart.AppVersion }}"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 3000
+              protocol: TCP
+              name: http
+          {{- with .Values.patchmon.frontend.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          volumeMounts:
+            - name: patchmon-volume
+              mountPath: /usr/share/nginx/html/assets
+              subPath: patchmon-assets
+      restartPolicy: Always
+      volumes:
+        - name: patchmon-volume
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}- {{ .Chart.Name }}-pvc

patchmon/templates/patchmon-frontend.service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-frontend-service
+spec:
+  selector:
+    app: {{ .Release.Name }}-{{ .Chart.Name }}-frontend
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: http
+      name: http
+  type: ClusterIP

patchmon/templates/patchmon.ingress.yaml

@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}}
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
+      http:
+        paths:
+          - backend:
+              service:
+                name: {{ .Release.Name }}-{{ .Chart.Name }}-frontend-service
+                port:
+                  name: http
+            path: /
+            pathType: Prefix
+          - backend:
+              service:
+                name: {{ .Release.Name }}-{{ .Chart.Name }}-backend-service
+                port:
+                  name: http
+            path: /api
+            pathType: Prefix
+  tls:
+    - hosts:
+        - {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
+      secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress

patchmon/templates/patchmon.pvc.yaml

@@ -0,0 +1,13 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ .Release.Name }}- {{ .Chart.Name }}-pvc
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: {{ .Values.patchmon.storage.size }}
+  {{- if .Values.patchmon.storage.storageClass }}
+  storageClassName: {{ .Values.patchmon.storage.class }}
+  {{- end }}

patchmon/templates/patchmon.secret.yaml

@@ -0,0 +1,6 @@
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-patchmon-secret
+spec:
+  itemPath: {{ required "A secret-reference for the Patchmon-Secret must be provided" .Values.secrets.patchmonSecretRef }}

patchmon/templates/postgres.secret.yaml

@@ -0,0 +1,6 @@
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-postgres-secret
+spec:
+  itemPath: {{ required "A secret-reference for the Postgres-Secret must be provided" .Values.secrets.postgresSecretRef }}

patchmon/templates/redis.secret.yaml

@@ -0,0 +1,6 @@
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
+spec:
+  itemPath: {{ required "A secret-reference for the Redis-Secret must be provided" .Values.secrets.redisSecretRef }}

patchmon/values.yaml

@@ -0,0 +1,34 @@
+patchmon:
+  storage:
+    size: 10Gi
+    storageClass: null
+  frontend:
+    resources:
+      requests:
+        cpu: 0.1
+        memory: 128Mi
+        ephemeral-storage: 10Mi
+      limits:
+        cpu: 0.5
+        memory: 265Mi
+        ephemeral-storage: 100Mi
+  backend:
+    resources:
+      requests:
+        cpu: 0.1
+        memory: 512Mi
+        ephemeral-storage: 10Mi
+      limits:
+        cpu: 1
+        memory: 768Mi
+        ephemeral-storage: 100Mi
+
+ingress:
+  clusterIssuer: null
+  domain: null
+
+secrets:
+  redisSecretRef: null
+  postgresSecretRef: null
+  oidcSecretRef: null
+  patchmonSecretRef: null