From 55716b912286bb162b66c8ac57d783de3e6330ff Mon Sep 17 00:00:00 2001 From: Fleur Kelpin Date: Fri, 28 Sep 2018 16:48:16 +0200 Subject: [PATCH] refactor: move charts to charts dir --- charts/molgenis-httpd/.helmignore | 21 + charts/molgenis-httpd/Chart.yaml | 8 + charts/molgenis-httpd/README.md | 15 + .../catalogIcon-molgenis-httpd.svg | 1182 +++++++++++ charts/molgenis-httpd/questions.yml | 31 + charts/molgenis-httpd/templates/NOTES.txt | 19 + charts/molgenis-httpd/templates/_helpers.tpl | 32 + .../molgenis-httpd/templates/deployment.yaml | 57 + charts/molgenis-httpd/templates/ingress.yaml | 36 + charts/molgenis-httpd/templates/service.yaml | 18 + charts/molgenis-httpd/values.yaml | 51 + charts/molgenis-jenkins/Chart.yaml | 8 + charts/molgenis-jenkins/README.md | 111 ++ .../catalogIcon-molgenis-jenkins.svg | 1768 +++++++++++++++++ .../charts/jenkins-0.18.0.tgz | Bin 0 -> 15194 bytes charts/molgenis-jenkins/requirements.lock | 6 + charts/molgenis-jenkins/requirements.yaml | 4 + charts/molgenis-jenkins/resources/README.md | 6 + ...nkins-default-tiller-user-rolebinding.yaml | 13 + .../resources/tiller-user-role.yaml | 18 + charts/molgenis-jenkins/templates/config.tpl | 283 +++ .../molgenis-jenkins-dockerhub-secret.yaml | 16 + .../molgenis-jenkins-github-secret.yaml | 16 + .../molgenis-jenkins-gogs-secret.yaml | 16 + .../molgenis-jenkins-registry-secret.yaml | 17 + .../molgenis-pipeline-vault-secret.yaml | 14 + charts/molgenis-jenkins/values.yaml | 608 ++++++ charts/molgenis-nexus/.helmignore | 21 + charts/molgenis-nexus/Chart.yaml | 8 + charts/molgenis-nexus/README.md | 64 + .../catalogIcon-molgenis-nexus.svg | 551 +++++ charts/molgenis-nexus/templates/_helpers.tpl | 32 + .../deployments/nexus-deployment.yaml | 65 + .../deployments/nexusProxy-deployment.yaml | 55 + charts/molgenis-nexus/templates/ingress.yaml | 38 + .../templates/persistence/nexusPVC.yaml | 15 + .../templates/services/nexus-service.yaml | 15 + .../services/nexusProxy-service.yaml | 13 + charts/molgenis-nexus/values.yaml | 65 + charts/molgenis-opencpu/.helmignore | 21 + charts/molgenis-opencpu/Chart.yaml | 8 + charts/molgenis-opencpu/README.md | 38 + .../catalog-molgenis-opencpu.svg | 1 + charts/molgenis-opencpu/questions.yml | 28 + .../molgenis-opencpu/templates/_helpers.tpl | 32 + .../templates/deployment.yaml | 35 + .../molgenis-opencpu/templates/ingress.yaml | 36 + .../molgenis-opencpu/templates/service.yaml | 20 + charts/molgenis-opencpu/values.yaml | 41 + charts/molgenis-vault/.helmignore | 21 + charts/molgenis-vault/Chart.yaml | 6 + charts/molgenis-vault/README.md | 52 + .../catalogIcon-molgenis-vault.svg | 627 ++++++ .../charts/etcd-operator-0.8.0.tgz | Bin 0 -> 7467 bytes .../charts/vault-operator-0.1.1.tgz | Bin 0 -> 11319 bytes charts/molgenis-vault/requirements.lock | 9 + charts/molgenis-vault/requirements.yaml | 7 + charts/molgenis-vault/resources/restore.yaml | 15 + charts/molgenis-vault/resources/vault.yaml | 9 + charts/molgenis-vault/templates/NOTES.txt | 13 + charts/molgenis-vault/templates/_helpers.tpl | 54 + .../molgenis-vault/templates/abs-secret.yaml | 10 + .../templates/backup-configmap.yaml | 18 + .../templates/backup-cronjob.yaml | 30 + .../molgenis-vault/templates/ui-ingress.yaml | 30 + .../molgenis-vault/templates/ui-service.yaml | 23 + .../templates/vault-ui-deployment.yaml | 50 + charts/molgenis-vault/values.yaml | 79 + charts/molgenis/Chart.yaml | 8 + charts/molgenis/README.md | 138 ++ charts/molgenis/catalogIcon-molgenis.svg | 1024 ++++++++++ charts/molgenis/questions.yml | 167 ++ charts/molgenis/templates/NOTES.txt | 19 + charts/molgenis/templates/_helpers.tpl | 32 + charts/molgenis/templates/deployment.yaml | 153 ++ charts/molgenis/templates/ingress.yaml | 38 + .../persistence/elasticsearchPVC.yaml | 19 + .../templates/persistence/molgenisPVC.yaml | 19 + .../templates/persistence/postgresPVC.yaml | 21 + charts/molgenis/templates/service.yaml | 29 + charts/molgenis/values.yaml | 103 + 81 files changed, 8399 insertions(+) create mode 100644 charts/molgenis-httpd/.helmignore create mode 100644 charts/molgenis-httpd/Chart.yaml create mode 100644 charts/molgenis-httpd/README.md create mode 100644 charts/molgenis-httpd/catalogIcon-molgenis-httpd.svg create mode 100644 charts/molgenis-httpd/questions.yml create mode 100644 charts/molgenis-httpd/templates/NOTES.txt create mode 100644 charts/molgenis-httpd/templates/_helpers.tpl create mode 100644 charts/molgenis-httpd/templates/deployment.yaml create mode 100644 charts/molgenis-httpd/templates/ingress.yaml create mode 100644 charts/molgenis-httpd/templates/service.yaml create mode 100644 charts/molgenis-httpd/values.yaml create mode 100755 charts/molgenis-jenkins/Chart.yaml create mode 100644 charts/molgenis-jenkins/README.md create mode 100644 charts/molgenis-jenkins/catalogIcon-molgenis-jenkins.svg create mode 100644 charts/molgenis-jenkins/charts/jenkins-0.18.0.tgz create mode 100644 charts/molgenis-jenkins/requirements.lock create mode 100644 charts/molgenis-jenkins/requirements.yaml create mode 100644 charts/molgenis-jenkins/resources/README.md create mode 100644 charts/molgenis-jenkins/resources/jenkins-default-tiller-user-rolebinding.yaml create mode 100644 charts/molgenis-jenkins/resources/tiller-user-role.yaml create mode 100644 charts/molgenis-jenkins/templates/config.tpl create mode 100644 charts/molgenis-jenkins/templates/molgenis-jenkins-dockerhub-secret.yaml create mode 100644 charts/molgenis-jenkins/templates/molgenis-jenkins-github-secret.yaml create mode 100644 charts/molgenis-jenkins/templates/molgenis-jenkins-gogs-secret.yaml create mode 100644 charts/molgenis-jenkins/templates/molgenis-jenkins-registry-secret.yaml create mode 100644 charts/molgenis-jenkins/templates/molgenis-pipeline-vault-secret.yaml create mode 100644 charts/molgenis-jenkins/values.yaml create mode 100644 charts/molgenis-nexus/.helmignore create mode 100644 charts/molgenis-nexus/Chart.yaml create mode 100644 charts/molgenis-nexus/README.md create mode 100644 charts/molgenis-nexus/catalogIcon-molgenis-nexus.svg create mode 100644 charts/molgenis-nexus/templates/_helpers.tpl create mode 100644 charts/molgenis-nexus/templates/deployments/nexus-deployment.yaml create mode 100644 charts/molgenis-nexus/templates/deployments/nexusProxy-deployment.yaml create mode 100644 charts/molgenis-nexus/templates/ingress.yaml create mode 100644 charts/molgenis-nexus/templates/persistence/nexusPVC.yaml create mode 100644 charts/molgenis-nexus/templates/services/nexus-service.yaml create mode 100644 charts/molgenis-nexus/templates/services/nexusProxy-service.yaml create mode 100644 charts/molgenis-nexus/values.yaml create mode 100644 charts/molgenis-opencpu/.helmignore create mode 100644 charts/molgenis-opencpu/Chart.yaml create mode 100644 charts/molgenis-opencpu/README.md create mode 100644 charts/molgenis-opencpu/catalog-molgenis-opencpu.svg create mode 100644 charts/molgenis-opencpu/questions.yml create mode 100644 charts/molgenis-opencpu/templates/_helpers.tpl create mode 100644 charts/molgenis-opencpu/templates/deployment.yaml create mode 100644 charts/molgenis-opencpu/templates/ingress.yaml create mode 100644 charts/molgenis-opencpu/templates/service.yaml create mode 100644 charts/molgenis-opencpu/values.yaml create mode 100644 charts/molgenis-vault/.helmignore create mode 100644 charts/molgenis-vault/Chart.yaml create mode 100644 charts/molgenis-vault/README.md create mode 100644 charts/molgenis-vault/catalogIcon-molgenis-vault.svg create mode 100644 charts/molgenis-vault/charts/etcd-operator-0.8.0.tgz create mode 100644 charts/molgenis-vault/charts/vault-operator-0.1.1.tgz create mode 100644 charts/molgenis-vault/requirements.lock create mode 100644 charts/molgenis-vault/requirements.yaml create mode 100644 charts/molgenis-vault/resources/restore.yaml create mode 100644 charts/molgenis-vault/resources/vault.yaml create mode 100644 charts/molgenis-vault/templates/NOTES.txt create mode 100644 charts/molgenis-vault/templates/_helpers.tpl create mode 100644 charts/molgenis-vault/templates/abs-secret.yaml create mode 100644 charts/molgenis-vault/templates/backup-configmap.yaml create mode 100644 charts/molgenis-vault/templates/backup-cronjob.yaml create mode 100644 charts/molgenis-vault/templates/ui-ingress.yaml create mode 100644 charts/molgenis-vault/templates/ui-service.yaml create mode 100644 charts/molgenis-vault/templates/vault-ui-deployment.yaml create mode 100644 charts/molgenis-vault/values.yaml create mode 100644 charts/molgenis/Chart.yaml create mode 100644 charts/molgenis/README.md create mode 100644 charts/molgenis/catalogIcon-molgenis.svg create mode 100644 charts/molgenis/questions.yml create mode 100644 charts/molgenis/templates/NOTES.txt create mode 100644 charts/molgenis/templates/_helpers.tpl create mode 100644 charts/molgenis/templates/deployment.yaml create mode 100644 charts/molgenis/templates/ingress.yaml create mode 100644 charts/molgenis/templates/persistence/elasticsearchPVC.yaml create mode 100644 charts/molgenis/templates/persistence/molgenisPVC.yaml create mode 100644 charts/molgenis/templates/persistence/postgresPVC.yaml create mode 100644 charts/molgenis/templates/service.yaml create mode 100644 charts/molgenis/values.yaml diff --git a/charts/molgenis-httpd/.helmignore b/charts/molgenis-httpd/.helmignore new file mode 100644 index 0000000..f0c1319 --- /dev/null +++ b/charts/molgenis-httpd/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/charts/molgenis-httpd/Chart.yaml b/charts/molgenis-httpd/Chart.yaml new file mode 100644 index 0000000..4fe30f7 --- /dev/null +++ b/charts/molgenis-httpd/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +appVersion: "1.0" +description: HTTPD for MOLGENIS +name: molgenis-httpd +version: 0.1.0 +sources: +- https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm.git +icon: https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm/raw/master/molgenis-httpd/catalogIcon-molgenis-httpd.svg \ No newline at end of file diff --git a/charts/molgenis-httpd/README.md b/charts/molgenis-httpd/README.md new file mode 100644 index 0000000..6f7a8df --- /dev/null +++ b/charts/molgenis-httpd/README.md @@ -0,0 +1,15 @@ +# MOLGENIS - HTTPD Helm Chart + +HTTPD (web)server for kubernetes to deploy on a kubernetes cluster with NFS-share + +## Chart Details + +This chart will deploy: + +- 1 HTTPD container + +## Installing the Chart + +etc. + + diff --git a/charts/molgenis-httpd/catalogIcon-molgenis-httpd.svg b/charts/molgenis-httpd/catalogIcon-molgenis-httpd.svg new file mode 100644 index 0000000..c1ef350 --- /dev/null +++ b/charts/molgenis-httpd/catalogIcon-molgenis-httpd.svg @@ -0,0 +1,1182 @@ + + + + diff --git a/charts/molgenis-httpd/questions.yml b/charts/molgenis-httpd/questions.yml new file mode 100644 index 0000000..623c3cf --- /dev/null +++ b/charts/molgenis-httpd/questions.yml @@ -0,0 +1,31 @@ +categories: +- MOLGENIS +questions: +- variable: ingress.hosts[0].name + default: "test.molgenis.org" + description: "Hostname for your stack" + type: hostname + required: true + group: "Services and Load Balancing" + label: Hostname +- variable: httpd.hostname + default: "test.molgenis.org" + description: "Hostname for your services (comma separated, example: [hostname]:[port])" + type: string + required: false + group: "Apache configuration" + label: Hostname +- variable: httpd.proxy + default: "" + description: "Proxy for your services (comma separated, example: [service]:[port]:[path])" + type: string + required: false + group: "Apache configuration" + label: Proxy +- variable: httpd.redirect + default: "" + description: "Redirection urls for your services (comma separated, example: [redirection_url])" + type: string + required: false + group: "Apache configuration" + label: Redirection \ No newline at end of file diff --git a/charts/molgenis-httpd/templates/NOTES.txt b/charts/molgenis-httpd/templates/NOTES.txt new file mode 100644 index 0000000..b486fa5 --- /dev/null +++ b/charts/molgenis-httpd/templates/NOTES.txt @@ -0,0 +1,19 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.ingress.path }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "httpd.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ template "httpd.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "httpd.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "httpd.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl port-forward $POD_NAME 8080:80 +{{- end }} diff --git a/charts/molgenis-httpd/templates/_helpers.tpl b/charts/molgenis-httpd/templates/_helpers.tpl new file mode 100644 index 0000000..6968597 --- /dev/null +++ b/charts/molgenis-httpd/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "httpd.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "httpd.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "httpd.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/charts/molgenis-httpd/templates/deployment.yaml b/charts/molgenis-httpd/templates/deployment.yaml new file mode 100644 index 0000000..a55964a --- /dev/null +++ b/charts/molgenis-httpd/templates/deployment.yaml @@ -0,0 +1,57 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + name: {{ template "httpd.fullname" . }} + labels: + app: {{ template "httpd.name" . }} + chart: {{ template "httpd.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ template "httpd.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "httpd.name" . }} + release: {{ .Release.Name }} + spec: + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: {{ .Values.service.name }} + containerPort: {{ .Values.service.port }} + env: + - name: SERVER_NAME + value: "{{ .Values.httpd.hostname }}" + - name: PROXY_SERVICE + value: "{{ .Values.httpd.proxy }}" + - name: REDIRECT_URL + value: "{{ .Values.httpd.redirect }}" + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: +{{ toYaml .Values.resources | indent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} diff --git a/charts/molgenis-httpd/templates/ingress.yaml b/charts/molgenis-httpd/templates/ingress.yaml new file mode 100644 index 0000000..83a8d70 --- /dev/null +++ b/charts/molgenis-httpd/templates/ingress.yaml @@ -0,0 +1,36 @@ +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: "{{ $.Release.Name }}-ingress" + labels: + app: {{ template "httpd.fullname" $ }} + chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}" + release: "{{ $.Release.Name }}" + heritage: "{{ $.Release.Service }}" + annotations: + {{- if .tls }} + ingress.kubernetes.io/secure-backends: "true" + {{- end }} + {{- range $key, $value := .annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} +spec: + rules: + - host: {{ .name }} + http: + paths: + - path: {{ default "/" .path }} + backend: + serviceName: {{ template "httpd.fullname" $ }} + servicePort: 80 +{{- if .tls }} + tls: + - hosts: + - {{ .name }} + secretName: {{ .tlsSecret }} +{{- end }} +--- +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/molgenis-httpd/templates/service.yaml b/charts/molgenis-httpd/templates/service.yaml new file mode 100644 index 0000000..b3f1374 --- /dev/null +++ b/charts/molgenis-httpd/templates/service.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "httpd.fullname" . }} + labels: + app: {{ template "httpd.name" . }} + chart: {{ template "httpd.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.service.type }} + ports: + - name: {{ .Values.service.name }} + port: {{ .Values.service.port }} + + selector: + app: {{ template "httpd.name" . }} + release: {{ .Release.Name }} diff --git a/charts/molgenis-httpd/values.yaml b/charts/molgenis-httpd/values.yaml new file mode 100644 index 0000000..04fffb6 --- /dev/null +++ b/charts/molgenis-httpd/values.yaml @@ -0,0 +1,51 @@ +# Default values for jenkins. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: registry.webhosting.rug.nl/molgenis/httpd + tag: lts + pullPolicy: Always + +service: + name: httpd + type: ClusterIP + port: 80 + +httpd: + proxy: httpd:80:/ + redirect: redirect.molgenis.local + hostname: test.molgenis.local + +ingress: + enabled: true + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + path: / + hosts: + - name: test.molgenis.org + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +nodeSelector: {} + +tolerations: [] + +affinity: {} \ No newline at end of file diff --git a/charts/molgenis-jenkins/Chart.yaml b/charts/molgenis-jenkins/Chart.yaml new file mode 100755 index 0000000..855c692 --- /dev/null +++ b/charts/molgenis-jenkins/Chart.yaml @@ -0,0 +1,8 @@ +name: molgenis-jenkins +home: https://jenkins.io/ +version: 0.7.1 +appVersion: 2.121 +description: Molgenis installation for the jenkins chart. +sources: +- https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm.git +icon: https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm/raw/master/molgenis-jenkins/catalogIcon-molgenis-jenkins.svg diff --git a/charts/molgenis-jenkins/README.md b/charts/molgenis-jenkins/README.md new file mode 100644 index 0000000..48c0a53 --- /dev/null +++ b/charts/molgenis-jenkins/README.md @@ -0,0 +1,111 @@ +# Molgenis Jenkins Helm Chart + +Jenkins master and slave cluster utilizing the Jenkins Kubernetes plugin. +Wraps [the kuberenetes jenkins chart](https://github.com/kubernetes/charts/tree/master/stable/jenkins), see documentation there! + +## Chart Details + +This chart will do the following: + +* 1 x Jenkins Master with port 8080 exposed on an external ClusterIP +* All using Kubernetes Deployments + +## Installing the Chart + +Usually, you'll be deploying this to the molgenis cluster. +In the [Rancher Catalog](https://rancher.molgenis.org:7443/g/catalog), add the latest version of this repository. +In the [molgenis cluster management page](https://rancher.molgenis.org:7443/p/c-mhkqb:project-2pf45/apps), choose the +catalog, pick the molgenis-jenkins app from the catalog and deploy it. + +## Configuration + +When deploying, you can paste values into the Rancher Answers to override the defaults in this chart. +Array values can be added as {value, value, value}. +``` +jenkins.Master.HostName=jenkins.molgenis.org +jenkins.Master.AdminPassword=pa$$word +jenkins.Persistence.Enabled=false +jenkins.Master.InstallPlugins={kubernetes:1.8.4, workflow-aggregator:2.5, workflow-job:2.21, credentials-binding:1.16, git:3.9.1, blueocean:1.6.2, github-oauth:0.29} +jenkins.Master.Security.UseGitHub=false +## if UseGitHub=true +jenkins.Master.Security.GitHub.ClientID=id +jenkins.Master.Security.GitHub.ClientSecret=S3cr3t +## end UseGitHub=true +PipelineSecrets.Env.PGPPassphrase=literal:S3cr3t +``` + +You can use [all configuration values of the jenkins subchart](https://github.com/kubernetes/charts/tree/master/stable/jenkins). +> Because we use jenkins as a sub-chart, you should prefix all value keys with `jenkins`! + +### GitHub Authentication delegation +You need to setup a MOLGENIS - Jenkins GitHub OAuth App. You can do this by accessing this url: [add new OAuth app](https://github.com/settings/applications/new). + +### Secrets + + When deployed, the chart creates a couple of kubernetes secrets that get used by jenkins. + + You can override the values at deploy time but otherwise also configure them + [in Rancher](https://rancher.molgenis.org:7443/p/c-mhkqb:project-2pf45/secrets) or through kubectl. + +#### Vault + +The vault secret gets mounted in the vault pod so pipeline scripts can retrieve secrets from the vault. + +| Parameter | Description | Default | +| ------------------------- | ------------------------------------------ | ---------------------------------------------- | +| `secret.vault.token` | Token to log into the hashicorp vault | `xxxx` | +| `secret.vault.addr` | Address of the vault | `https:vault-operator.vault-operator.svc:8200` | +| `secret.vault.skipVerify` | Skip verification of the https connection | `1` | + +#### GitHub + +Token used by Jenkins to authenticate on GitHub. + +| Parameter | Description | Default | +| --------------------- | ------------------------ | ------------------ | +| `secret.gitHub.user` | username for the account | `molgenis-jenkins` | +| `secret.gitHub.token` | token for the account | `xxxx` | + +#### Gogs + +Token used by Jenkins to authenticate on the [RuG Webhosting Gogs](https://git.webhosting.rug.nl). + +| Parameter | Description | Default | +| ------------------- | ------------------------ | --------- | +| `secret.gogs.user` | username for the account | `p281392` | +| `secret.gogs.token` | token for the account | `xxxx` | + +#### Legacy: + +##### Docker Hub + +Account used in pipeline builds to push docker images to `hub.docker.com`. +> They should read `secret/gcc/account/dockerhub` from vault instead! + +| Parameter | Description | Default | +| --------------------------- | ------------------------ | --------------- | +| `secret.dockerHub.user` | username for the account | `molgenisci` | +| `secret.dockerHub.password` | password for the account | `xxxx` | + +##### Registry + +Account used in pipeline builds to push docker images to `registry.molgenis.org`. +> They should read `secret/ops/account/nexus` from vault instead! + +| Parameter | Description | Default | +| --------------------------- | ------------------------ | --------- | +| `secret.dockerHub.user` | username for the account | `admin` | +| `secret.dockerHub.password` | password for the account | `xxxx` | + +## Command line use +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. +For example, + +```bash +$ helm install --name jenkins -f values.yaml molgenis-jenkins +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + diff --git a/charts/molgenis-jenkins/catalogIcon-molgenis-jenkins.svg b/charts/molgenis-jenkins/catalogIcon-molgenis-jenkins.svg new file mode 100644 index 0000000..1227303 --- /dev/null +++ b/charts/molgenis-jenkins/catalogIcon-molgenis-jenkins.svg @@ -0,0 +1,1768 @@ + + + + diff --git a/charts/molgenis-jenkins/charts/jenkins-0.18.0.tgz b/charts/molgenis-jenkins/charts/jenkins-0.18.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..148c447ab2cd7c40c860274560f5d629aabd4507 GIT binary patch literal 15194 zcmV-gJEg=QiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ%cH20zFuH&1DQe_=U*a5-vXt1#XdLfxJ5IN|eLJ?3o>@J! zB8Y?}#3aE6KsoBf-`Wo`KhM+6lbnSc30`z@VyCCiG54O1MFNFF0Vq@zstO-)azzr} z*`FXL{27X)|GM*Mb8~a^#nzVkcXM;I`fsA}VAxB9Dq?;fqbW|jA>ue}0i=w6z=7a^I9%f>lK&z$B!VF}1Kkzw zwJ4gr=Ok$h}-s%0h zyZ!9X&pHtuQ$J0{tr(F+Ad+Cl`z;S}j7Zdn2nCY}B|e_wgwy1&F$oyubR_(M#w~yZ zNxWn!f?qx>>P^Ww!ki%f*Dx|U-MZ0KSfc7`TcAFi}`dz_@_ac|XBXiW&Ds8X2e-QopqZqb!Qb?^?%*3(Wd0fD@N{da-)n0yvD( z826!V*N6GHZ9iS2aUa@|DBhf9QFKNl63qJ0-ixl$jJI2B#kUI_Ff0m24X{t+lqNV4 zMLPxo3G^+;7dXfm5wkuBmf;q_50r}&EUqcLBFVT9BNTD@elLtk@|I)P2PFS&0j%kl zXNdD_%ECVEgnFRW$S{<{&0Wz!(caVTePCtC(OQ2@y*C zP}?g!$v7Tmk(wpgANy(#d!I7;akj2tA0|ZX+u{eww6ER*cxK8K<;@4sv#<|s`KjOO zbpPD*yW21Q?dN{C|E$}4sgb@Hpchy`Op;EFKEec}6egHqAR|aHmPEKFVxk-S5lzu) zDtI5--rr)r)$PUL{Vo0||Io00)Dy`RD!qHl$Qi>U^05zXcS6gdki>_ShQQ67Q`E*E z1w4r}F62@k$VoVmXq{)t9+%S%D1$frdq%SqBop9Rtm~{W0VTWWZB0C?ZR8ft%rNI_ zJ}??Zs;)ula+czL9j@lCwh*8sp+cz&yr{ZYyzIlL8?$1#{^$>}K)&o5OR(H42<@P2 z?nxQk8=9uPAquW=5_&14f(A4)GQ91YVjcm*NMJZLonSbiEQBX~LbE88RMD%e+@YK% znwcoB>uwW%pbPjB4N#=YSeo}?N9YNIKc*20h=^tz5KJiLa(ywmlEgK}2|SZxg7>WV zV*7==27k&s4M${(6N$A{ea`%_iN}WFZ zd9zZY+HxPZD@81fH;6=7CvqgFE`0&?iQL_L|LCyTve(>^Hq#!&EX8V5lPpGJ1WMNlx*#RBUD6T}4X5ZOQ8={|ejti;^LwVf*41B#*QvM>`U;kp6i*oLUELd2~GqFkif5s39_^v=aEzV$K${0HIO$f z2LK}Q$f zQ*9X*e^Gi>2!HJuiwO-48vX}P6aPm}lZz;0DQ5eToWlX6h;e)=C8`f-iu?#AWB)?P zA!rw%5`4V`PP;U+rt3;PHkK|k%Ep2gE*)kfbjP^qkq4ix_?j}32zV@)MlyzRM29HK zDGL!9GQJ7yidM zdaPLDkGbBo2Kz;Uzr|I}%5$o()S^^nbA2@va{4I#Ybf?uSCSGXVK@+!%{CNVql5?w zdUXO$0ya}j2d?nUOg)Kvr9J4Z5!64}Uv8lA~bwpz5rg#)K29mBkS6r8M*s8sg5H{4d9mn!0xiSS}yIJ(Pr=(;ZI=@7@R_kulkK z+4Bq2yb%U2i_+%J84as4gW^s~Y}dQbUP|(#3j9&vME=P;)2?i~G6C)NZL#mq!gB&FJr+s+vyQxf5^#K}(VmCQ%I zMpMvI`_Y0rYw&lPL5yZ_jS{7@1QRJv<~p#X8C*|DgcUE7>;Zw?U6nbY1)wc-k_v{d z#ZukZnl6V4y*2`PN<*$J91JV-PY7tFwWDI67-l32A)s*@$tk2jol(w-RO_^LwQri; zfD_3_HsCZds*PR(=U8$bHN#bbyr%(5Bv+N&u55Bjqb#<@vKh^CD#SEPgwY@fFDz!- zASl&C$$DogR=w#%&cQd}AWp^XHDMb{-#tTOvH>R}z9I42FdL2~kCCM%Do6-MhDrlP z5+S*9r71?tZleKZ4D*yK@lJ`-pq8G&QZn{gstLdFB&t}Po|fD?f??dz8)k>Ipc5mK zbfj?Ap={g_5u7%AA*dJG*~U@59)AWxyxcRLNGwI0v7`$JZvdo$LaPU#1U>6@!+yJKCR_jbMKdEH}xQRWit-+oYL^7rD zXo)0*ypn)-s*7s#*^dy3b)9po06F0O2H1xqGXcX5ID5Ab)+(qCEMd{|5RWLcQxvSZ zYe=&s)OL=KM6E}KL%*e=+kH4h0yW@#At;jqmXd+%_;CGMebocBYbc3>LfdOM zRcg04j9D?%)&maVEJ3jp-mS1il5q}AstO7Ncp@jdk$TpFGTTs+MbQQ%wAL8#6bC>| zU*zNx#!4g?i36=@88aW?$vEu+OfruDpx{bL zjB8qKbkOKaGDz~*H_g2uz?>h`5cidN=w~U?oF>WuaY25=eR%mjsVP z>J8Jb|9nIKcT26GY1iN0P&U=abxGv$8~`s&jU+$7@vmMgNn@(&ERk}jLMlR(K0$TZ?Pc?`pV%#l`lGG3`u)IAnC5By_sp+j4c78lz?^2coJlc;Y36; zz(hQ2 zBq2PJe}1RCBO5XHCg<(C0cC#vM3S)IQ0&1yVew-($Ko*cu0KgyBY17H+>x1`ar{|Zi$|JMVkW|PmWfo=H=D%$I z(@zX4H*LGC@Kwfey@K1}Sp_p?t@tARh`_NzjSD0)?xQf2nm$(V%#WM4LLit>JG74s z8vRE(tvV4MlcZIQYiSJ1=Pk>|L9)|6915kZ3Uq}5!3baH$9DF#$At=qXT}_friesR zIPr}t47oaZjYOc0Rl2)U#&IUsg4M7UZ`Wc z?owj40BoORU%e4!*HUqLWIGMZAS`b}kAxar_s`ZdACBZu6~^6s2OBXO0~a`juC~ce zl%oXGTF2tuu+>ry7*f?GiFS)qibj&JK+FDV;wS7stgR!6Xcqc~i*JY1C{xOq zHC%W!@p40shm$c$aBUN7(B7*%)7o7>1|k6bymx+bc=CPUH6j4vR*w$<^rt^5zNM@I z5#?A597@|)z6nx8EkVp5cOy+{D4`0>Vv-=CjQ{f=7vf#^+MQgLQIL9`M-)KS%L}f!_$u1MmkSh2Om?rNvhRuk49DGSj&|2>@h{Y z{`K1Tim%FYH28HXAmq)0@!}0{v`25HX4zS(Dn*oa>;s{4R@Zla<*pM zkep`*zh)>RBZ5OfX{s>yTR&qBU6mKI4cQA0LmVK+Qyi@Ot-}#8Ev#uExrnGwvei2xax=L)8b@5}2w4;vZ0C};V6B!S z&R$gYde6(uEwB>Fr7&TCJW}ZQU#&i>4xTwBG?bD|Ti{xHdus%ZQKJ37xc9$!y8=zO zdz*PS@9)OJan7rZF;xQukfpWyQjssqK3Ar+EHCLbL0o%pL)-Df%6C;=(1S-jjfjwg zqW(~hLhX97f--HZM46ghSa(`3I$8eZ{{4INu!rZ%pZflUVJ6P?3b(v z?rLb+3H?%yyQM7zl!*ytn7%}%FO(Lz(cMO=eY z70ypjFJB*?-*ohsola3ApM8j3W$7CevB@eF)?fVt9-tJ5$K|q4KR$$4?rI_UnqQ*f zcc=b0<&z<>6+1R&!KK3BUx6v(*H(w#j?Mw<@J8Z$H;!=UT8=FHIA>t+Ewt zha?lshV}05o zIi>rvT2%SR?p7__aC751Oj469_f#}z2$ipO=SP6g@PU#9+R#>9RX0{6g5#=H{b(d? z<*2FD9uf#>D_`Zd_BgBzpsk{%{YO`LwgHcHd}04p1!dPqtO<^WWcF%}gRkABZ*Ddm z16FfA**4tVy!!OXA~3(`d!;>K+e+R;#arifQMbO+Sxi4g-nSf$@v*x%mfu!~#JCyh zwPQ%BR2E50?I2d8ruC3)z;@+TWnlPVFq2#>E5tH-9N`Sg{Gyg6;qvs51ninv#lk=iLgz^QNJ~8k}3FKqv)1==>KE5hB7cLBZ9`*Lg9n zk%^?iQ@Ifh8AeyyPq7YL`=|2_b)T+V!vh)+F)b{@<%q=OD=48O7pio~fi7+NYiVHGuT#K<-h>5C zrteS_UxqK@%?AoxGcN_b=+fy`nmAH@S^GvBJ#Q>CBykU(n86 z{iicu3bCu8Q~Thgtmw?y^D9wQ4RR4Fm-reX=!}My_U21L&0U3X@kdc^5 z{hz-QYQ*X+k~o#`VIFE+AHLKHrLu;GReP4w&}X)?wMeupZQP1b#nddHrxd^(`+)OW z=T&^mqTPmA&0J3}N|owfk@Pa+?=T~ynU#OaFRLaD#RYdA*3sZ*wmPrYQ%uABDo(%i z!Sbu?aM|eN%>xLZ_trvvn`bs>b=7vwfN+iZ;z3N>*nFb!);_ zR{FgtdPneeiKO&8sT#c7MG(@fw(ob;|Ciai-ahxDsKJ6eB9XwXIN~uJwfeeV<^Rrb zhRenEtI`z6_p+*$UUgCS?~&Q>W=DjJ@<1*k$4;k2yq%Ph7%^pE*FAM#m@xXO#NYn--sI_7tMz2_%AwdT!tZRE|3z0DiZ z{>AwlzndHszf6EQRQdbj|fi0;n^ETV^!POm*#$M zqM_5Prtfp4tsR{Z=48&-ger^fg%qQ?Ab~wKtiNx$(|E41P|CievC|oEka_pTC&%Sn zKl$NMC122AyMFIQyEuQgm3JbU1fsIy!WSh>hjk z>@U`i-au|#wz`*#7CfrxwZZ`arD-&KZ`^?RB=1&y6%qzs3Z0Cz4xb>FA2)Ou9(7E@ ztIl6kX%(T=R&BRocUc`J)OdoLSg4%adsifiJbq0?F!{?I`c$$#*?tA7PGw-4Gac#_ z?oH*-6B^^cEUH);?Jumo8s}^RULD~e1^7^tQ5=t+PYT6J++AN5vqK+Dl=%AB}}Y(?=-HHqPu ztdV-&!Uc_69{qF)6JMd-AL%e37Inh`9Rf+<(UXXm+x$R>eElyFQnQ&Y7(-dK^XLN| znxYLo$crqh?l4OQDWnOm_GksYp*8{K)F?bg%p_5ps#PF914-nN!t+YdEP%7xO_kMH zUXzQ?9CYhdmta-;GvAUveX_aAp-oMkiCH-BW0V>vK=BMueFDIv$PJ_FP09X?L z*WG%yU5o#F@eu#_O&+tZQ4%f;C4b@u2$TxA+1zyCkd6u{lDKIHGM#d+5fv0yM09+e*8p=2$K7*&@YwS zsK`~euEmEZDii3^hS%2}zxX7-R;O-_tyXjpE=;R-;wn2|WJ;?>+D2@ zUE`ca5lO~6BT}BWuEx1yB!bD2L)<%IW@bE16V8y!Cn~je%f0>967EUTfb6MnNwH4?1&MtuY2sB4Dx&eX<PtGiY=U*+9i8BU{zvtxyu+eBVwK5TtTdz@d$P&{7gSN(z$ z_aLiMG%4MuT`RCEWIYrMVK)@H{h8;j@haUdw*a}hTUZ}To^aM zKh0(CsxR*G>}|3CK!=M_ZzynAcsILz+_nd{PlW!0~+e8i(D#Im5XS*x*OGo9_!oaota<;<;T5ud+#q#PmkW8o?RZE zo?KK0+Fnq<*qzbbe_N)R(})S}Jw3Zz0KZ|`*WDyNFI9iOs*hkpX~+epRopR~x^T;Z zFZx^_(WYL%VKnYnKGa}8cCFJ+aGjDWHlk4v-aE0brWGV`il9rn=|vo_d4(+sNns&i>;y+Yn>yW+@qOI6l2 zi`%EH)Glx^(H9XmH{4LJ*7U6f@UK&xU8Tj|=6Cyczf7%OsxUq1+_&x1gUcz?Oh zy*LKpHtP4{#rS(E=ZkU6FKb=E6P>Jyitg2K0Nt<)E^Kkdv!X=|riyfxJ=_-IMQyE!ZkdNv5iBu*uN!L@){3~z;}hQe zrCqtIxUn&B!SZXUU!{q&uP<1K4f%l6CVy&|mVtax8|%5g+D>x0Cwcrt1M$}@lcJJu zW&z0>?j)(&;;PfGngps}q2dCwUIFSM)Z-SYn!UyNvuci;*~`@;K5S|?TxkvOR$PV zl1evVm{^L$#NlW|6kOpXEbrIKDd6M_OsKrbP0+m8m+s13F_DCbR-wBr-b`=rj}{H_ z|G#G`|4+1ANvclGzHAp*#{ajsD)E24?z7(W2mb#po(d;0PDJ{Q)D=TDM=yPzw=D5BSJjfWjM`(%-sF8C9=heHbpN3BB$8H;)Ti>YB?n7I!3|pgaW0zJum}<

r5@r^M1eS)zI}@&8{^tsoP%TWY)SnvVW_1!lnHG4gvs|@c&--MK%8WMQ`(g|9_L` z*71M$86oWk2HYYpWW}%$CmKMl!*VP@b4W-Dw5~O0uUHU7_;qoEcNHqQD4CgITs4mb zH)hcBVEFWDQ9$7BV*qWb_4V~tBL8ghhJe3CVSTq7%OZMbe*aXHiWp1Ca70n~9g0vA zVAh_if4QYD^gR~p7}>0Gn_KcnHQqI5>oM3G`GLrJ(7r4w|L#jpjR zA)?nRM5tZe?39o^!BOnz~t&%dx-d?UHtTd z;>Ty_JW+s$3%|WJ2xvM3316waltvuf>B+t3ONj|IOaki|YOF&$|!$|2KIS`*qyMeec?p!=48=ww!O0y@&Jsdw%NcUxg=s z%k|&wJ?~Z5|Fi9f{4d|+Ss3E3mfj=hR2urPV3D(sTB9!0PykUTCX|uibb9Tpm)s|` zBNYbxYepCjp}hxF6p^ruM*#`??(-MV zdk_5oTRbbpzs@-%lJn$F5`z6f(&*{~fzuTIn&Fo1b7Nq$y65N2gx+ezo5OOO3=!qZ zpJBND94A5fT+0cYS_ryilk09SfR;4knb}-GO*pEgJWUV_qt@>|y&s+>PZR%FGu}gb zC%=P@V442E)$La8|633I|JywGEdN(s3aogzitPP|5V!y6VrqT;t8)e?@!;3Dv2^`! zZdLDp*nY9~u>QZrb1xP?eGXvj>GO~LHn+dZuh724Di#S$asYUHs3Pvw`5zfZxDB7| zSxd$u@H~bEo5Ay!_D?Uw5t>P%X0^-w7Q4iMSpoxv;UC&6Y1h9$!BI@c31#@s+gQH; zSJ!{<#e@I%w|Um!3<-gmzP?RQ0Jxsu1cn)jLUmsq3a-!?bHBBwGhpy6RUT%*Cpd~= z9MPe6jU~x=L+-0ckSSL2F3x+DgsnA5@K~qUc%t(>;SjEgn82UbeK<{`8PG)4lqf-p z8AK$(e#?J-@%}h=Qvug%OD`Z$0(-b=rFB57AZYsW0NR_4NO=*5Dmtgk~HLUmx(6pECLZ2cqSZ z5TlMR$LNPYA|J5p|McgRgY%2~X=B;??{+sU>%Y6zd$9k1lgC{3%#*E7I4)39j#q0n1v**3)`tNOSJ$qRH z-{M)z1@Iqm6oXQgTP^!e$AIW8RuP(F2=p-#WP(KGHz^&63C=978b{m~lBw?ljTp%Sk0B zn6O;&nrfv>w!2oLcrABEdM zj`XRy7tX{lI~t*U3Ec)(OP`Bh1vgo~j39?HZr&#|qty(* z8Nd_D9K^{8-0whm@o~M3n{(q!bB8}eg-dMJ$z*O$WYL5!;Kd(d<5P)2FLT zaMMTi72Hm!P_El|j$0lc)v!pfUh+Kl3a;?18QA?T1n0ndP;K-r$1p^k1o^!u&A17c z%~|MQhg*JD+CVq;4KgkTh8XLZI(vY-4*E{05D*7s2b+v!@%(h2aODCn@mD9dD|DcS zn>}kDG~s5k(YR&mGM8K7b&isd#(HzV9dd@dDm)IPTsJ6?Q@;U)A;X-jE8UfFD2ozx z2^VEmu|vr|iHaosvNhu3mggjG7}O%8EQ%r;7<<>b$*QUZpCb|z!Pn)meah3V!Y7qs zb!#);$g`*RwziMS%?3oOf-Tb9+$mOWE^ZFIT4ysNiw!pKipN!O%R5&u zRp6$ytRa@HB2;5qq_s0qDR+jVi(5U2dXVF0Pjj6JwWcl%KHc0M;TmweoTb%iV7FC` zpO~f1{PQymTut+9v24KYjI!#cU&c+T!gFww8uEQ?t2PR}Nxqc0B{W=s*!_x1ZYuIR ze^Wd}qG(gut1Tf2Q+?+8gXh0*i5I%$brZJLK(O;p0+m9zlXP(K81oB7E{<;T* z_b<-h_{J)<&$4)U$a#jD%~CWdmaQC8Yp;^EKotj~%HOdTu?mJ~jDDO+%?t@NB$3j8 z3OPl7R9P^PAo}ZlqIh&T2WpPc{?Q@ODQ3WMOqKgbx!6D@tiA`_=4HZ=#8T(xxhcesj_9F2=q~TZdyJ(D;2x9jm%u@(kRrOrZ@ql zSj>i&&yW8GT%Z!0xlemU#s!UYU!{_*MC$wq0#%}LXR3AK-saos6tina1lDbra689o zgaT_VhwF}mAWdLMskm3%8uF#)8^8JXy9vWiPSKjcX>q$ex~N>$QpW9)uVuJBHfh#1M*L1lSmJMVILC@x82A5nd;}lp(9AhrEp~5XT25eJ-WRI# z&0J!ke7MXJpIQr7Ieq(GzuWUS)w$^?qSqc8j~N~#L0P}&Z-FxfY`mkavJGP*`p^77 z``x1I2RiKc{NA%cd7RaB-%}1HC~C%c%qX4CV3Z{$w<9YU~?l}0i8t7Eq3>~H73w4<7Q-GWki?6qoZ=-)8Z~K|IWmK2Hc9wsgCAYM#M?3S^@?G zDTpTW1Mf_`Lo87D%P~~AxsfMx4m9`GsY7maGVw{ucH%@Yn;>sB>NS6qThp_^4b{oz z;CBAq-ahP|9m2GMUPZCNR}-rdHxrmWk8Z|iN0!nD!GeNh@$z2>H{;vmt$L2MI&Mzj zedUZvj+hD{hbIGP^t8FWKB|ND&yBBdiCf9RL>Vbsiycf>^em~=Xmm1J>@IS92avfn z^cd(I!}_@TEQ_MTV?Zjt@~u8f*4CIjt(G}u9^w&YSi6ER&`F$@v{Ghht5YQpKEqy` z;v~#TZng`PH(NJdq23(M?6lOtTMOn|U-=)BDD{lZiH4UpUSzI0#A&I?%i^=1H%r_r zDt&TXEhIL|rEXAbsdD^ZZfV}Rf4QYOa#XdYig!l2rFm`{l|J?S?FM_M)6y9uQxf5^ zJ5;u%H2>yIy?HGyoqJ7ZvbQ>owJp_-WP6({oype9m=jrzp2@maJ7o`vvGLeT)s~Sw zAx&H4=T_??#Q_=30Ha`1_}>|)L%Gxjo+qcp6`s9P=kdR6 z4nz+BdV(2-1mh5g+Obn2(^4?|)uetpRe?#-0F|rYawnXbdxc!}u1A(7`2~da8j6aS z6KsQlaA?nOWz!rG!+jVO#<>j`9GDz{^6wugS8d6^Pexq+b4Ek?kKuei9LPzm4n6aD zBLpECjWCnsmGhX6$}Xo!2u6mPzI?dgrABN)aVtxt3~3pz0(N#_Haq7G%_PQbMza(<7ayYd|?>%hk+Y1TTJ|u#|6~?LN+(;lm0i&ElSoqa%I19ww;Y~PPCG2@ekYOjTdhMO+jhCU zV!Occ6f;Kz&|CJP;mXy4LT^yNp?cu#vc`wrDFiyAd5NC0f}&GbY?e5{FIQ>mCA3u6 za3f}6Id;xt4XZ@?q&$1K-yqo6VY>HW4&XDKX`v)v^BSszHc$4d!Q4{;?8h{;N|szK z5`wuaD5fE<%5&!!g+DVQ@M#iQeZYlzL4GUsL&4oMq))d)jJseQOR<{jU^S@>#>^`Zn065IJunWGc2fcRIZ~ zd$<4oWbgQ3ZeUI2Y_iq*d4dyT6->q;_wQ@Dq?KOo2K?k9OUnH=#8S1!Nif^cB7W^y zv`_>bUL;u$bt5b6#$_^pe2k-9M)xJ#Qk$^UpstObSAA5N7Naa{m5=81u}#VMFQ6$= z$L&(hsP7MQSgg{J_x&+M6NJ!T1d~Px)ho<1f6T9 z0>-4-Rzs&ev>iU7G@wC|KE=>aq|rd`DoPDzXxr)cURQY^qqJ=k`t0nVo?ITBTwc8Y;o$sWw@9;-ub=bp z_V!z?!;w^^l&e#g(gaW*p{N#%GRqoaNXe6G4%)6XM*9tx%Sx`TT8T)5)>F%GicP3E zP*ZGLDl(&t00l~lxBAO|;X0>hw%@yJ*R!+wxNv#%Qz;J<6KtnpkTD>{Xk{lJpA)yH{N`;Cf z(4wT}Joyoq+SLemh1>{>9E#DLb10g283|#qIq+Mr^?J|!vl&L5CS0o%Xa?6vTR2!5 zF;qs)m#T@#5+ramD=|nr7eX3b<%Uwrhl&^~=XhNqS%jb!=ysL+oj&n)ShKd8NI5ZM zDdm!o7gB4Rd<%Qf>K!KUo;qFv6=%&Ay90Mx_vw48J4=T%6Z}dZGDH;HIH1!1S>0+7AWgI zvB9tox?Hd<5ON_K>h+Ci>sz?k^xH2DT-}N_GeKbH2$QvME<)dGK^?&^<74yP>NWu z>2<;d!zljFWVo?amzJ9c@@={bz*?ySoM2=;#;io6fF?o4!wgz7gUn8_wg#^oI2avOSgtDXxBmUF|L5QT z`k#OQ>wn;VKHIvj&j9f6fBnmRDVT0!@!tI63a8gJ;2_WyPPDkZ(AcZDbV>A~weY@H zuOyG|x8CPQFD-=V9ksN%Z>SyimD(PCI22JIUZxyi42P% z#~m?TG!RghQYJ-7?O9HQlBl%YGRh(?cZmfdh=NLW5pZLSAJ2k`5?tgUy;n^PHh@zt zA&CiA3X_s3LVBG<6e;DjRhSu!zEYC&Onb7O;y~)hLewzi&bQzn-yOq~+&>Ua(P=99 zVBL|Iiru!_!SZEPMK|o#Pjc(-LtB36cRJla_x$emOMm;h-|au^_FlGY)%jP{PiSLh zS?E6uXG`Ti?COoido7Fm3eFFdi&t*7T8T5t#48EQ`NEf1=GEGgVf^0tcpjdI=izyH UzSZ;p1^@v6|8ZX4QvfId0NByAO8@`> literal 0 HcmV?d00001 diff --git a/charts/molgenis-jenkins/requirements.lock b/charts/molgenis-jenkins/requirements.lock new file mode 100644 index 0000000..b56a000 --- /dev/null +++ b/charts/molgenis-jenkins/requirements.lock @@ -0,0 +1,6 @@ +dependencies: +- name: jenkins + repository: https://kubernetes-charts.storage.googleapis.com/ + version: 0.18.0 +digest: sha256:39f694515489598fa545c9a5a4f1347749e8f2a8d7fae6ccae3e2acae1564685 +generated: 2018-09-27T11:00:15.795416984+02:00 diff --git a/charts/molgenis-jenkins/requirements.yaml b/charts/molgenis-jenkins/requirements.yaml new file mode 100644 index 0000000..b9331d0 --- /dev/null +++ b/charts/molgenis-jenkins/requirements.yaml @@ -0,0 +1,4 @@ +dependencies: + - name: jenkins + version: ^0.16 + repository: https://kubernetes-charts.storage.googleapis.com/ \ No newline at end of file diff --git a/charts/molgenis-jenkins/resources/README.md b/charts/molgenis-jenkins/resources/README.md new file mode 100644 index 0000000..67bf687 --- /dev/null +++ b/charts/molgenis-jenkins/resources/README.md @@ -0,0 +1,6 @@ +To be able to run helm inside a jenkins pod, you'll need to +* create a role in the namespace where tiller is installed +* bind that role to the user that jenkins pods run as + +This directory contains yaml for these resources. +See also https://github.com/helm/helm/blob/master/docs/rbac.md \ No newline at end of file diff --git a/charts/molgenis-jenkins/resources/jenkins-default-tiller-user-rolebinding.yaml b/charts/molgenis-jenkins/resources/jenkins-default-tiller-user-rolebinding.yaml new file mode 100644 index 0000000..04aa1f7 --- /dev/null +++ b/charts/molgenis-jenkins/resources/jenkins-default-tiller-user-rolebinding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: tiller-jenkins-binding + namespace: kube-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: tiller-user +subjects: +- kind: ServiceAccount + name: default + namespace: molgenis-jenkins \ No newline at end of file diff --git a/charts/molgenis-jenkins/resources/tiller-user-role.yaml b/charts/molgenis-jenkins/resources/tiller-user-role.yaml new file mode 100644 index 0000000..5555442 --- /dev/null +++ b/charts/molgenis-jenkins/resources/tiller-user-role.yaml @@ -0,0 +1,18 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + name: tiller-user + namespace: kube-system +rules: +- apiGroups: + - "" + resources: + - pods/portforward + verbs: + - create +- apiGroups: + - "" + resources: + - pods + verbs: + - list \ No newline at end of file diff --git a/charts/molgenis-jenkins/templates/config.tpl b/charts/molgenis-jenkins/templates/config.tpl new file mode 100644 index 0000000..d899427 --- /dev/null +++ b/charts/molgenis-jenkins/templates/config.tpl @@ -0,0 +1,283 @@ +{{- define "override_config_map" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "jenkins.fullname" . }} +data: + config.xml: |- + + + + {{ .Values.Master.ImageTag }} + 0 + NORMAL + {{ .Values.Master.UseSecurity }} + + true + +{{- if .Values.Master.Security.UseGitHub }} + + https://github.com + https://api.github.com + {{ .Values.Master.Security.GitHub.ClientID }} + {{ .Values.Master.Security.GitHub.ClientSecret }} + read:org,user:email + +{{- else }} + +{{- end }} + false + + ${JENKINS_HOME}/workspace/${ITEM_FULLNAME} + ${ITEM_ROOTDIR}/builds + + + dev + + + + + kubernetes + +{{- range $podName, $pod := .Values.Pods }} + + {{ $pod.InheritFrom | default "" }} + {{ $podName }} + 2147483647 + 0 + + + {{- $local := dict "first" true }} + {{- range $key, $value := .NodeSelector }} + {{- if not $local.first }},{{- end }} + {{- $key }}={{ $value }} + {{- $_ := set $local "first" false }} + {{- end }} + {{ .NodeUsageMode }} + +{{- range $index, $volume := .volumes }} + +{{- range $key, $value := $volume }}{{- if not (eq $key "type") }} + <{{ $key }}>{{ $value }} +{{- end }}{{- end }} + +{{- end }} + + +{{- range $containerName, $container := .Containers }} + + {{ $containerName }} + {{ .Image }}:{{ .ImageTag | default "latest" }} + +{{- range $index, $envVar := .Ports }} + + {{ .name }} + {{ .containerPort }} + {{ .hostPort }} + +{{- end }} + +{{- if .Privileged }} + true +{{- else }} + false +{{- end }} +{{- if .AlwaysPullImage }} + true +{{- else }} + false +{{- end }} + {{ .WorkingDir | default "" }} + {{ .Command | default "" }} + {{ .Args | default "" }} +{{- if .TTY }} + true +{{- else }} + false +{{- end }} + +{{- range $index, $envVar := .EnvVars }} + +{{- range $key, $value := $envVar }}{{- if not (eq $key "type") }} + <{{ $key }}>{{ $value }} +{{- end }}{{- end }} + +{{- end }} + +{{- if .resources }} +{{- if .resources.requests }} + {{ .resources.requests.cpu | default "" }} + {{ .resources.requests.memory | default "" }} +{{- end }} +{{- if .resources.limits }} + {{ .resources.limits.cpu | default "" }} + {{ .resources.limits.memory | default "" }} +{{- end }} +{{- end }} + +{{- end }} + + + + JENKINS_URL + http://{{ template "jenkins.fullname" $ }}:{{$.Values.Master.ServicePort}}{{ default "" $.Values.Master.JenkinsUriPrefix }} + +{{- range $index, $envVar := .EnvVars }} + +{{- range $key, $value := $envVar }}{{- if not (eq $key "type") }} + <{{ $key }}>{{ $value }} +{{- end }}{{- end }} + +{{- end }} + + +{{- if .ImagePullSecret }} + + + {{ .ImagePullSecret }} + + +{{- else }} + +{{- end }} + + +{{- end }} + + https://kubernetes.default + false + {{ .Release.Namespace }} + http://{{ template "jenkins.fullname" . }}:{{.Values.Master.ServicePort}}{{ default "" .Values.Master.JenkinsUriPrefix }} + {{ template "jenkins.fullname" . }}-agent:50000 + 50 + 5 + 0 + 0 + + + 5 + 0 + + + + all + false + false + + +{{- range $viewName, $view := .Values.Master.Views }} + + + {{ $viewName }} + false + false + + + +{{- range $index, $job := $view }} + {{ $job }} +{{- end }} + + + + + + + + + + + + + false + +{{- end }} + + {{ .Values.Master.DefaultView }} + 50000 + +{{- range .Values.Master.DisabledAgentProtocols }} + {{ . }} +{{- end }} + + +{{- if .Values.Master.CSRF.DefaultCrumbIssuer.Enabled }} + +{{- if .Values.Master.CSRF.DefaultCrumbIssuer.ProxyCompatability }} + true +{{- end }} + +{{- end }} + + + true + +{{- if .Values.Master.ScriptApproval }} + scriptapproval.xml: |- + + + + +{{- range $key, $val := .Values.Master.ScriptApproval }} + {{ $val }} +{{- end }} + + + + + + + +{{- end }} + jenkins.CLI.xml: |- + + +{{- if .Values.Master.CLI }} + true +{{- else }} + false +{{- end }} + + apply_config.sh: |- + mkdir -p /usr/share/jenkins/ref/secrets/; + echo "false" > /usr/share/jenkins/ref/secrets/slave-to-master-security-kill-switch; + cp -n /var/jenkins_config/config.xml /var/jenkins_home; + cp -n /var/jenkins_config/jenkins.CLI.xml /var/jenkins_home; +{{- if .Values.Master.InstallPlugins }} + # Install missing plugins + cp /var/jenkins_config/plugins.txt /var/jenkins_home; + rm -rf /usr/share/jenkins/ref/plugins/*.lock + /usr/local/bin/install-plugins.sh `echo $(cat /var/jenkins_home/plugins.txt)`; + # Copy plugins to shared volume + cp -n /usr/share/jenkins/ref/plugins/* /var/jenkins_plugins; +{{- end }} +{{- if .Values.Master.ScriptApproval }} + cp -n /var/jenkins_config/scriptapproval.xml /var/jenkins_home/scriptApproval.xml; +{{- end }} +{{- if .Values.Master.InitScripts }} + mkdir -p /var/jenkins_home/init.groovy.d/; + cp -n /var/jenkins_config/*.groovy /var/jenkins_home/init.groovy.d/ +{{- end }} +{{- if .Values.Master.CredentialsXmlSecret }} + cp -n /var/jenkins_credentials/credentials.xml /var/jenkins_home; +{{- end }} +{{- if .Values.Master.SecretsFilesSecret }} + cp -n /var/jenkins_secrets/* /usr/share/jenkins/ref/secrets; +{{- end }} +{{- if .Values.Master.Jobs }} + for job in $(ls /var/jenkins_jobs); do + mkdir -p /var/jenkins_home/jobs/$job + cp -n /var/jenkins_jobs/$job /var/jenkins_home/jobs/$job/config.xml + done +{{- end }} +{{- range $key, $val := .Values.Master.InitScripts }} + init{{ $key }}.groovy: |- +{{ $val | indent 4 }} +{{- end }} + plugins.txt: |- +{{- if .Values.Master.InstallPlugins }} +{{- range $index, $val := .Values.Master.InstallPlugins }} +{{ $val | indent 4 }} +{{- end }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/molgenis-jenkins/templates/molgenis-jenkins-dockerhub-secret.yaml b/charts/molgenis-jenkins/templates/molgenis-jenkins-dockerhub-secret.yaml new file mode 100644 index 0000000..5c35b46 --- /dev/null +++ b/charts/molgenis-jenkins/templates/molgenis-jenkins-dockerhub-secret.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Secret +metadata: +# this is the jenkins id. + name: "molgenis-jenkins-dockerhub-secret" + labels: +# so we know what type it is. + "jenkins.io/credentials-type": "usernamePassword" + annotations: { +# description - can not be a label as spaces are not allowed + "jenkins.io/credentials-description" : "(deprecated by vault) Account used in pipeline builds to push docker images to Docker Hub (hub.docker.com)" + } +type: Opaque +data: + username: {{ .Values.secret.registry.user | b64enc | quote }} + password: {{ .Values.secret.registry.password | b64enc | quote }} \ No newline at end of file diff --git a/charts/molgenis-jenkins/templates/molgenis-jenkins-github-secret.yaml b/charts/molgenis-jenkins/templates/molgenis-jenkins-github-secret.yaml new file mode 100644 index 0000000..dc2b8df --- /dev/null +++ b/charts/molgenis-jenkins/templates/molgenis-jenkins-github-secret.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Secret +metadata: +# this is the jenkins id. + name: "molgenis-jenkins-github-secret" + labels: +# so we know what type it is. + "jenkins.io/credentials-type": "usernamePassword" + annotations: { +# description - can not be a label as spaces are not allowed + "jenkins.io/credentials-description" : "Oauth token for the {{.Values.secret.gitHub.user}} GitHub user" + } +type: Opaque +data: + username: {{ .Values.secret.gitHub.user | b64enc | quote }} + password: {{ .Values.secret.gitHub.token | b64enc | quote }} \ No newline at end of file diff --git a/charts/molgenis-jenkins/templates/molgenis-jenkins-gogs-secret.yaml b/charts/molgenis-jenkins/templates/molgenis-jenkins-gogs-secret.yaml new file mode 100644 index 0000000..ff6ae17 --- /dev/null +++ b/charts/molgenis-jenkins/templates/molgenis-jenkins-gogs-secret.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Secret +metadata: +# this is the jenkins id. + name: "molgenis-jenkins-gogs-secret" + labels: +# so we know what type it is. + "jenkins.io/credentials-type": "usernamePassword" + annotations: { +# description - can not be a label as spaces are not allowed + "jenkins.io/credentials-description" : "Account used to authenticate against RuG Webhosting Gogs." + } +type: Opaque +data: + username: {{ .Values.secret.gogs.user | b64enc | quote }} + password: {{ .Values.secret.gogs.token | b64enc | quote }} \ No newline at end of file diff --git a/charts/molgenis-jenkins/templates/molgenis-jenkins-registry-secret.yaml b/charts/molgenis-jenkins/templates/molgenis-jenkins-registry-secret.yaml new file mode 100644 index 0000000..b853055 --- /dev/null +++ b/charts/molgenis-jenkins/templates/molgenis-jenkins-registry-secret.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +kind: Secret +metadata: + name: molgenis-jenkins-registry-secret + labels: + app: {{ template "jenkins.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + annotations: { +# description - can not be a label as spaces are not allowed + "jenkins.io/credentials-description" : "(deprecated by vault) Account used in pipeline builds to push docker images to registry.molgenis.org." + } +type: Opaque +data: + username: {{ .Values.secret.registry.user | b64enc | quote }} + password: {{ .Values.secret.registry.password | b64enc | quote }} \ No newline at end of file diff --git a/charts/molgenis-jenkins/templates/molgenis-pipeline-vault-secret.yaml b/charts/molgenis-jenkins/templates/molgenis-pipeline-vault-secret.yaml new file mode 100644 index 0000000..da4598b --- /dev/null +++ b/charts/molgenis-jenkins/templates/molgenis-pipeline-vault-secret.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Secret +metadata: + name: molgenis-pipeline-vault-secret + labels: + app: {{ template "jenkins.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +type: Opaque +data: + token: {{ .Values.secret.vault.token | b64enc | quote }} + addr: {{ .Values.secret.vault.addr | b64enc | quote }} + skipVerify: {{ .Values.secret.vault.skipVerify | b64enc | quote }} \ No newline at end of file diff --git a/charts/molgenis-jenkins/values.yaml b/charts/molgenis-jenkins/values.yaml new file mode 100644 index 0000000..9816fee --- /dev/null +++ b/charts/molgenis-jenkins/values.yaml @@ -0,0 +1,608 @@ +jenkins: + Master: + HostName: jenkins.molgenis.org + ServiceType: ClusterIP + InstallPlugins: + - kubernetes:1.12.6 + - workflow-aggregator:2.5 + - workflow-job:2.25 + - credentials-binding:1.16 + - git:3.9.1 + - github-branch-source:2.3.6 + - kubernetes-credentials-provider:0.10 + - blueocean:1.8.3 + - github-oauth:0.29 + - gogs-webhook:1.0.14 + - github-scm-trait-commit-skip:0.1.1 + Security: + UseGitHub: false + GitHub: + ClientID: "" + ClienSecret: "" + DefaultView: dev + Views: + dev: + - molgenis + ops: + - molgenis-ops-docker-httpd + - molgenis-ops-docker-maven + - molgenis-ops-docker-node + - molgenis-ops-tools + - molgenis-ops-tomcat + Jobs: |- + molgenis: |- + + + + + + + + + + + .* + + + + + + + + false + + + + + + + true + -1 + -1 + + + + H H * * * + 86400000 + + + false + + + molgenis + molgenis-jenkins-github-secret + + + 1 + + + 1 + + + 1 + + + + + + ** + + + + + MOLGENIS Jenkins + molgenis+ci@gmail.com + + + + + + + + Jenkinsfile + + + + + molgenis-ops-docker-httpd: |- + + + + HTTPD server that can be used for redirection and proxieing + molgenis-ops-docker-httpd + + + + + + + + + + + + false + + + + + + + true + -1 + -1 + + + false + + + + + a756941d-6c9d-4492-bcf9-327041764be6 + https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-httpd.git + molgenis-jenkins-gogs-secret + + + + + ** + + + + + MOLGENIS Jenkins + molgenis+ci@gmail.com + + + + + + + + + + + + + + Jenkinsfile + + + molgenis-ops-docker-node: |- + + + + NodeJS build container with Curl + molgenis-ops-docker-node + + + + + + + + + + + + false + + + + + + + true + -1 + -1 + + + false + + + + + a756941d-6c9d-4492-bcf9-327041764be6 + https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-node.git + molgenis-jenkins-gogs-secret + + + + + ** + + + + + MOLGENIS Jenkins + molgenis+ci@gmail.com + + + + + + + + + + + + + + Jenkinsfile + + + molgenis-ops-docker-maven: |- + + + + MAVEN build container with RPMbuild and Curl + molgenis-ops-docker-maven + + + + + + + + + + + + false + + + + + + + true + -1 + -1 + + + false + + + + + 4702479a-6988-4a85-b4b7-e77fa2d05ffa + https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-maven.git + molgenis-jenkins-gogs-secret + + + + + ** + + + + + MOLGENIS Jenkins + molgenis+ci@gmail.com + + + + + + + + + + + + + + Jenkinsfile + + + molgenis-ops-tomcat: |- + + + + MOLGENIS tomcat package to manage tomcat version on CentOS + molgenis-ops-tomcat + + + + + + + + + + + + false + + + + + + + true + -1 + -1 + + + false + + + + + 4702479a-6988-4a85-b4b7-e77fa2d05ffa + https://git.webhosting.rug.nl/molgenis/molgenis-ops-tomcat.git + molgenis-jenkins-gogs-secret + + + + + ** + + + + + MOLGENIS Jenkins + molgenis+ci@gmail.com + + + + + + + + + + + + + + Jenkinsfile + + + molgenis-ops-tools: |- + + + + MOLGENIS operations tools-package to configure firewall, apache, sudoers, etc. + molgenis-ops-tools + + + + + + + + + + + + false + + + + + + + true + -1 + -1 + + + false + + + + + 4702479a-6988-4a85-b4b7-e77fa2d05ffa + https://git.webhosting.rug.nl/molgenis/molgenis-ops-tools.git + molgenis-jenkins-gogs-secret + + + + + ** + + + + + MOLGENIS Jenkins + molgenis+ci@gmail.com + + + + + + + + + + + + + + Jenkinsfile + + + # Kubernetes secret that contains a 'credentials.xml' for Jenkins + # CredentialsXmlSecret: jenkins-credentials + # Kubernetes secret that contains files to be put in the Jenkins 'secrets' directory, + # useful to manage encryption keys used for credentials.xml for instance (such as + # master.key and hudson.util.Secret) + # SecretsFilesSecret: jenkins-secrets + CustomConfigMap: true + rbac: + install: true + Pods: + molgenis: + Label: molgenis + NodeUsageMode: NORMAL + volumes: + - type: HostPath + hostPath: "/var/run/docker.sock" + mountPath: "/var/run/docker.sock" + Containers: + maven: + Image: "registry.webhosting.rug.nl/molgenis/maven" + ImageTag: lts + AlwaysPullImage: true + Command: cat + WorkingDir: /home/jenkins + TTY: true + resources: + requests: + cpu: "1" + memory: "4Gi" + EnvVars: + - type: KeyValue + key: MAVEN_OPTS + value: "-Duser.home=/home/jenkins" + - type: KeyValue + key: MAVEN_CONFIG + value: "/home/jenkins/.m2" + alpine: + Image: "spotify/alpine" + Command: cat + WorkingDir: /home/jenkins + TTY: true + vault: + Image: "vault" + Command: cat + WorkingDir: /home/jenkins + TTY: true + EnvVars: + - type: Secret + key: VAULT_TOKEN + secretName: molgenis-pipeline-vault-secret + secretKey: token + - type: Secret + key: VAULT_SKIP_VERIFY + secretName: molgenis-pipeline-vault-secret + secretKey: skipVerify + - type: Secret + key: VAULT_ADDR + secretName: molgenis-pipeline-vault-secret + secretKey: addr + helm: + Image: "lachlanevenson/k8s-helm" + ImageTag: "v2.10.0" + Command: cat + WorkingDir: /home/jenkins + TTY: true + NodeSelector: {} + node: + Label: node-carbon + NodeUsageMode: EXCLUSIVE + Containers: + node: + Image: "registry.webhosting.rug.nl/molgenis/node" + ImageTag: lts + AlwaysPullImage: true + Command: cat + WorkingDir: /home/jenkins + TTY: true + vault: + Image: "vault" + Command: cat + WorkingDir: /home/jenkins + TTY: true + EnvVars: + - type: Secret + key: VAULT_TOKEN + secretName: molgenis-pipeline-vault-secret + secretKey: token + - type: Secret + key: VAULT_SKIP_VERIFY + secretName: molgenis-pipeline-vault-secret + secretKey: skipVerify + - type: Secret + key: VAULT_ADDR + secretName: molgenis-pipeline-vault-secret + secretKey: addr + NodeSelector: {} + molgenis-it: + InheritFrom: molgenis + Label: molgenis-it + NodeUsageMode: EXCLUSIVE + Containers: + elasticsearch: + Image: docker.elastic.co/elasticsearch/elasticsearch + ImageTag: 5.5.3 + resources: + requests: + cpu: "100m" + memory: "1Gi" + limits: + cpu: "1" + memory: "1500Mi" + EnvVars: + - type: KeyValue + key: ES_JAVA_OPTS + value: "-Xms512m -Xmx512m" + - type: KeyValue + key: cluster.name + value: molgenis + - type: KeyValue + key: bootstrap.memory_lock + value: "true" + - type: KeyValue + key: xpack.security.enabled + value: "false" + - type: KeyValue + key: discovery.type + value: single-node + postgres: + Image: postgres + ImageTag: 9.6-alpine + resources: + requests: + cpu: "100m" + memory: "250Mi" + limits: + cpu: "1" + memory: "250Mi" + EnvVars: + - type: KeyValue + key: POSTGRES_USER + value: molgenis + - type: KeyValue + key: POSTGRES_PASSWORD + value: molgenis + - type: KeyValue + key: POSTGRES_DB + value: molgenis + opencpu: + Image: molgenis/opencpu + AlwaysPullImage: true + resources: + requests: + cpu: "100m" + memory: "256Mi" + limits: + cpu: "1" + memory: "512Mi" + NodeSelector: {} + +#secret contains configuration for the kubernetes secrets that jenkins can access +secret: + # vault configures the vault secret + vault: + token: xxxx + addr: "https://vault-operator.vault-operator.svc:8200" + skipVerify: "1" + # githubToken contains access token for jenkins bot account on github.com + gitHub: + user: "molgenis-jenkins" + token: xxxx + # gogs contains access token for jenkins bot account on RuG GoGs + gogs: + user: p281392 + token: xxxx + # registry contains credentials for registry.molgenis.org + registry: + user: admin + password: xxxx + # dockerHubPassword contains password for hub.docker.com + dockerHub: + user: molgenisci + password: xxxx \ No newline at end of file diff --git a/charts/molgenis-nexus/.helmignore b/charts/molgenis-nexus/.helmignore new file mode 100644 index 0000000..f0c1319 --- /dev/null +++ b/charts/molgenis-nexus/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/charts/molgenis-nexus/Chart.yaml b/charts/molgenis-nexus/Chart.yaml new file mode 100644 index 0000000..0ced74d --- /dev/null +++ b/charts/molgenis-nexus/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +appVersion: "1.0" +description: Nexus stack for MOLGENIS +name: molgenis-nexus +version: 0.4.2 +sources: +- https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm.git +icon: https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm/raw/master/molgenis-nexus/catalogIcon-molgenis-nexus.svg \ No newline at end of file diff --git a/charts/molgenis-nexus/README.md b/charts/molgenis-nexus/README.md new file mode 100644 index 0000000..b6bda27 --- /dev/null +++ b/charts/molgenis-nexus/README.md @@ -0,0 +1,64 @@ +# MOLGENIS - NEXUS Helm Chart + +NEXUS repository for kubernetes to deploy on a kubernetes cluster with NFS-share + +## Chart Details + +This chart will deploy: + +- 1 NEXUS-nfs initialization container + + We need this container to avoid permission issues on the NEXUS docker +- 1 NEXUS container +- 1 MOLGENIS-httpd container (to proxy the registry and docker to one domain) + +## Backup restore +There are two steps in restoring the NEXUS. + +- Database +- Blobstore + +### Restore the database +Go to the commandline: + +```bash +kubectl get pv +``` + +```bash +| NAME | CAPACITY | ACCESS | MODES | RECLAIM | POLICY | STATUS | CLAIM | STORAGECLASS | REASON | AGE | +| ---- | -------- | ------ | ----- | ------- | ------ | ------ | ----- | ------------ | ------ | --- | +| pvc-45988f55-900f-11e8-a0b4-005056a51744 | 30G | RWX | | Retain | Bound | molgenis-nexus/molgenis-nfs-claim | nfs-provisioner-retain | | | 33d | +| pvc-3984723d-220f-14e8-a98a-skjhf88823kk | 30G | RWO | | Delete | Bound | molgenis-test/molgenis-nfs-claim | nfs-provisioner | | | 33d | +``` + +The persistent volume is the one in the molgenis-nexus namespace. + +Go to the NFS-provisioner to the path of the persistent volume: + +```bash +ls -t --full-time | head -7 | xargs cp ../restore-from-backup/ +``` + +### Restore the blobstore +You can copy the directory ```blobs``` to the target persistent volume ```/ blobs```. + +You can now bring the NEXUS back up. + +## Installing the Chart + +You can test in install the chart by executing: + +```helm lint .``` + +To test if your helm chart-syntax is right and: + +```helm install . --dry-run --debug``` + +To test if your hem chart works and: + +```helm install .``` + +To deploy it on the cluster. + + diff --git a/charts/molgenis-nexus/catalogIcon-molgenis-nexus.svg b/charts/molgenis-nexus/catalogIcon-molgenis-nexus.svg new file mode 100644 index 0000000..9c7d611 --- /dev/null +++ b/charts/molgenis-nexus/catalogIcon-molgenis-nexus.svg @@ -0,0 +1,551 @@ + + + + diff --git a/charts/molgenis-nexus/templates/_helpers.tpl b/charts/molgenis-nexus/templates/_helpers.tpl new file mode 100644 index 0000000..9f9800c --- /dev/null +++ b/charts/molgenis-nexus/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "nexus.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "nexus.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "nexus.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/charts/molgenis-nexus/templates/deployments/nexus-deployment.yaml b/charts/molgenis-nexus/templates/deployments/nexus-deployment.yaml new file mode 100644 index 0000000..c381aae --- /dev/null +++ b/charts/molgenis-nexus/templates/deployments/nexus-deployment.yaml @@ -0,0 +1,65 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + creationTimestamp: null + name: {{ .Values.nexus.name }} + labels: + app: {{ .Values.nexus.name }} + environment: {{ .Values.environment }} +spec: + replicas: {{ .Values.replicaCount }} + strategy: + type: {{ .Values.nexus.strategy.type }} + selector: + matchLabels: + app: {{ .Values.nexus.selector }} + template: + metadata: + labels: + app: {{ .Values.nexus.name }} + creationTimestamp: null + spec: + restartPolicy: {{ .Values.nexus.restartPolicy }} + initContainers: + - name: nexus-nfs + image: busybox + command: ["sh", "-c", "chown -R 200:200 /nexus-data"] + volumeMounts: + - name: molgenis-nexus-nfs + mountPath: "/nexus-data" + containers: + - name: {{ .Values.nexus.name }} + image: "{{ .Values.nexus.image.repository }}:{{ .Values.nexus.image.tag }}" + imagePullPolicy: {{ .Values.nexus.image.pullPolicy }} + ports: + - containerPort: {{ .Values.nexus.port.ui }} + - containerPort: {{ .Values.nexus.port.docker }} + volumeMounts: + - name: molgenis-nexus-nfs + mountPath: /nexus-data + livenessProbe: + httpGet: + path: / + port: {{ .Values.nexus.port.ui }} + initialDelaySeconds: 120 + periodSeconds: 20 + failureThreshold: 15 + successThreshold: 1 + readinessProbe: + httpGet: + path: / + port: {{ .Values.nexus.port.ui }} + initialDelaySeconds: 120 + periodSeconds: 20 + failureThreshold: 15 + successThreshold: 1 + + volumes: + - name: molgenis-nexus-nfs + persistentVolumeClaim: + claimName: {{ .Values.persistence.claim }} + + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} \ No newline at end of file diff --git a/charts/molgenis-nexus/templates/deployments/nexusProxy-deployment.yaml b/charts/molgenis-nexus/templates/deployments/nexusProxy-deployment.yaml new file mode 100644 index 0000000..2ccc400 --- /dev/null +++ b/charts/molgenis-nexus/templates/deployments/nexusProxy-deployment.yaml @@ -0,0 +1,55 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + creationTimestamp: null + name: {{ .Values.nexusProxy.name }} + labels: + app: {{ .Values.nexusProxy.name }} + environment: {{ .Values.environment }} +spec: + replicas: {{ .Values.replicaCount }} + strategy: + type: {{ .Values.nexusProxy.strategy.type }} + selector: + matchLabels: + app: {{ .Values.nexusProxy.selector }} + template: + metadata: + labels: + app: {{ .Values.nexusProxy.name }} + creationTimestamp: null + spec: + restartPolicy: {{ .Values.nexusProxy.restartPolicy }} + containers: + - name: {{ .Values.nexusProxy.name }} + image: "{{ .Values.nexusProxy.image.repository }}:{{ .Values.nexusProxy.image.tag }}" + imagePullPolicy: {{ .Values.nexusProxy.image.pullPolicy }} + env: + - name: PROXY_SERVICE + value: "{{ .Values.nexus.name }}:{{ .Values.nexus.port.ui }},{{ .Values.nexus.name }}:{{ .Values.nexus.port.docker }}:{{ .Values.nexus.path.dockerV2 }}" + - name: SERVER_NAME + value: {{ .Values.nexusProxy.hostname }} + ports: + - containerPort: {{ .Values.nexusProxy.port }} + resources: {} + livenessProbe: + httpGet: + path: / + port: {{ .Values.nexusProxy.port }} + initialDelaySeconds: 1500 + periodSeconds: 20 + failureThreshold: 5 + successThreshold: 1 + readinessProbe: + httpGet: + path: / + port: {{ .Values.nexusProxy.port }} + initialDelaySeconds: 150 + periodSeconds: 20 + failureThreshold: 15 + successThreshold: 1 + + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} \ No newline at end of file diff --git a/charts/molgenis-nexus/templates/ingress.yaml b/charts/molgenis-nexus/templates/ingress.yaml new file mode 100644 index 0000000..50a4252 --- /dev/null +++ b/charts/molgenis-nexus/templates/ingress.yaml @@ -0,0 +1,38 @@ +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: "{{ $.Release.Name }}-ingress" + labels: + app: {{ $.Values.nexusProxy.name }} + chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}" + release: "{{ $.Release.Name }}" + heritage: "{{ $.Release.Service }}" + annotations: + kubernetes.io/ingress.class: "nginx" + nginx.ingress.kubernetes.io/proxy-body-size: "0" + {{- if .tls }} + ingress.kubernetes.io/secure-backends: "true" + {{- end }} + {{- range $key, $value := .annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} +spec: + rules: + - host: {{ .name }} + http: + paths: + - path: {{ default "/" .path }} + backend: + serviceName: {{ $.Values.nexusProxy.name }} + servicePort: {{ $.Values.nexusProxy.port }} +{{- if .tls }} + tls: + - hosts: + - {{ .name }} + secretName: {{ .tlsSecret }} +{{- end }} +--- +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/molgenis-nexus/templates/persistence/nexusPVC.yaml b/charts/molgenis-nexus/templates/persistence/nexusPVC.yaml new file mode 100644 index 0000000..2e2466f --- /dev/null +++ b/charts/molgenis-nexus/templates/persistence/nexusPVC.yaml @@ -0,0 +1,15 @@ +{{- if .Values.persistence.enabled -}} +apiVersion: extensions/v1beta1 +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ .Values.persistence.claim }} + annotations: + volume.beta.kubernetes.io/storage-class: "nfs-provisioner-retain" +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: {{ .Values.persistence.size }} +{{- end }} \ No newline at end of file diff --git a/charts/molgenis-nexus/templates/services/nexus-service.yaml b/charts/molgenis-nexus/templates/services/nexus-service.yaml new file mode 100644 index 0000000..dbb9371 --- /dev/null +++ b/charts/molgenis-nexus/templates/services/nexus-service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Values.nexus.name }} + labels: + app: {{ .Values.nexus.name }} +spec: + type: {{ .Values.nexus.service.type }} + ports: + - name: ui + port: {{ .Values.nexus.port.ui }} + - name: docker + port: {{ .Values.nexus.port.docker }} + selector: + app: {{ .Values.nexus.selector }} diff --git a/charts/molgenis-nexus/templates/services/nexusProxy-service.yaml b/charts/molgenis-nexus/templates/services/nexusProxy-service.yaml new file mode 100644 index 0000000..281ee81 --- /dev/null +++ b/charts/molgenis-nexus/templates/services/nexusProxy-service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Values.nexusProxy.name }} + labels: + app: {{ .Values.nexusProxy.name }} +spec: + type: {{ .Values.nexusProxy.service.type }} + ports: + - name: {{ .Values.nexusProxy.name }} + port: {{ .Values.nexusProxy.port }} + selector: + app: {{ .Values.nexusProxy.selector }} diff --git a/charts/molgenis-nexus/values.yaml b/charts/molgenis-nexus/values.yaml new file mode 100644 index 0000000..3203fa7 --- /dev/null +++ b/charts/molgenis-nexus/values.yaml @@ -0,0 +1,65 @@ +# Default values for nexus. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +environment: production + +nexus: + name: nexus + strategy: + type: Recreate + selector: nexus + restartPolicy: Always + image: + repository: molgenis/nexus3 + tag: latest + pullPolicy: Always + port: + docker: 5000 + ui: 8081 + path: + dockerV2: v2 + service: + type: ClusterIP + +nexusProxy: + name: nexus-proxy + hostname: registry.molgenis.org + strategy: + type: Recreate + selector: nexus-proxy + restartPolicy: Always + image: + repository: molgenis/httpd + tag: latest + pullPolicy: Always + port: 80 + service: + type: LoadBalancer + + +ingress: + enabled: true + annotations: {} + path: / + hosts: + - name: registry.molgenis.org + tls: [] + +persistence: + enabled: true + claim: molgenis-nexus + size: 500Gi + + +resources: {} + +nodeSelector: { + deployPod: "true" +} + +tolerations: [] + +affinity: {} diff --git a/charts/molgenis-opencpu/.helmignore b/charts/molgenis-opencpu/.helmignore new file mode 100644 index 0000000..f0c1319 --- /dev/null +++ b/charts/molgenis-opencpu/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/charts/molgenis-opencpu/Chart.yaml b/charts/molgenis-opencpu/Chart.yaml new file mode 100644 index 0000000..0ffe477 --- /dev/null +++ b/charts/molgenis-opencpu/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +appVersion: "1.0" +description: Opencpu stack for MOLGENIS +name: molgenis-opencpu +version: 0.1.1 +sources: +- https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm.git +icon: https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm/raw/master/molgenis-opencpu/catalogIcon-molgenis-opencpu.svg \ No newline at end of file diff --git a/charts/molgenis-opencpu/README.md b/charts/molgenis-opencpu/README.md new file mode 100644 index 0000000..e871170 --- /dev/null +++ b/charts/molgenis-opencpu/README.md @@ -0,0 +1,38 @@ +# MOLGENIS - OpenCPU Helm Chart + +NEXUS repository for kubernetes to deploy on a kubernetes cluster with NFS-share + +## Containers + +This chart will deploy the following containers: + +- OpenCPU +- MOLGENIS-httpd (to proxy the registry and docker to one domain) + +## Provisioning +You can choose for the OpenCPU image from which repository you want to pull. Experimental builds are pushed to registry.molgenis.org and the stable builds to hub.docker.com. +You need to fill out 2 properties to determine which repository you are going to use. + +- ```opencpu.image.repository``` +- ```opencpu.image.tag``` + +You can do this in the questions in Rancher or in the ```values.yaml```. + + + +## Development +You can test in install the chart by executing: + +```helm lint .``` + +To test if your helm chart-syntax is right and: + +```helm install . --dry-run --debug``` + +To test if your hem chart works and: + +```helm install .``` + +To deploy it on the cluster. + + diff --git a/charts/molgenis-opencpu/catalog-molgenis-opencpu.svg b/charts/molgenis-opencpu/catalog-molgenis-opencpu.svg new file mode 100644 index 0000000..fc9ca38 --- /dev/null +++ b/charts/molgenis-opencpu/catalog-molgenis-opencpu.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/charts/molgenis-opencpu/questions.yml b/charts/molgenis-opencpu/questions.yml new file mode 100644 index 0000000..79f3462 --- /dev/null +++ b/charts/molgenis-opencpu/questions.yml @@ -0,0 +1,28 @@ + +categories: +- MOLGENIS +questions: +- variable: ingress.enabled + label: Enable ingress + default: false + description: "Enable ingress" + type: boolean + required: true + group: "Load balancing" +- variable: opencpu.image.repository + label: Registry + default: "registry.hub.docker.com" + description: "Select a registry to pull from" + type: enum + options: + - "registry.hub.docker.com" + - "registry.molgenis.org" + required: true + group: "Provisioning" +- variable: opencpu.image.tag + label: Version + default: "" + description: "Select a OpenCPU version (check the registry.molgenis.org or hub.docker.com for released tags)" + type: string + required: true + group: "Provisioning" \ No newline at end of file diff --git a/charts/molgenis-opencpu/templates/_helpers.tpl b/charts/molgenis-opencpu/templates/_helpers.tpl new file mode 100644 index 0000000..a410c46 --- /dev/null +++ b/charts/molgenis-opencpu/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "opencpu.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "opencpu.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "opencpu.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/charts/molgenis-opencpu/templates/deployment.yaml b/charts/molgenis-opencpu/templates/deployment.yaml new file mode 100644 index 0000000..ddb57c7 --- /dev/null +++ b/charts/molgenis-opencpu/templates/deployment.yaml @@ -0,0 +1,35 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + {{- with .Values.ingress.annotations }} + annotations: +{{ toYaml . | indent 4 }} + {{- end }} + name: {{ template "opencpu.fullname" . }} + labels: + app: {{ template "opencpu.name" . }} + chart: {{ template "opencpu.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ template "opencpu.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "opencpu.name" . }} + release: {{ .Release.Name }} + spec: + containers: + {{- with .Values.opencpu }} + - name: {{ .name }} + image: "{{ .image.repository }}/{{ .image.name }}:{{ .image.tag }}" + imagePullPolicy: {{ .image.pullPolicy }} + ports: + - containerPort: {{ .service.port }} + {{- end }} + + diff --git a/charts/molgenis-opencpu/templates/ingress.yaml b/charts/molgenis-opencpu/templates/ingress.yaml new file mode 100644 index 0000000..d218231 --- /dev/null +++ b/charts/molgenis-opencpu/templates/ingress.yaml @@ -0,0 +1,36 @@ +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: "{{ $.Release.Name }}-ingress" + labels: + app: {{ $.Values.opencpu.name }} + chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}" + release: "{{ $.Release.Name }}" + heritage: "{{ $.Release.Service }}" + annotations: + {{- if .tls }} + ingress.kubernetes.io/secure-backends: "true" + {{- end }} + {{- range $key, $value := .annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} +spec: + rules: + - host: {{ .name }} + http: + paths: + - path: {{ default "/" .path }} + backend: + serviceName: {{ $.Values.opencpu.service.name }} + servicePort: {{ $.Values.opencpu.service.port }} +{{- if .tls }} + tls: + - hosts: + - {{ .name }} + secretName: {{ .tlsSecret }} +{{- end }} +--- +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/molgenis-opencpu/templates/service.yaml b/charts/molgenis-opencpu/templates/service.yaml new file mode 100644 index 0000000..4b1cf1e --- /dev/null +++ b/charts/molgenis-opencpu/templates/service.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Values.opencpu.service.name }} + labels: + app: {{ .Values.opencpu.service.name }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.opencpu.service.type }} + loadBalancerSourceRanges: + {{- range $index, $rule := .Values.opencpu.service.firewall }} + - {{ $rule }} + {{- end }} + ports: + - name: {{ .Values.opencpu.service.name }} + port: {{ .Values.opencpu.service.port }} + selector: + app: {{ template "opencpu.name" . }} + release: {{ .Release.Name }} diff --git a/charts/molgenis-opencpu/values.yaml b/charts/molgenis-opencpu/values.yaml new file mode 100644 index 0000000..c21be14 --- /dev/null +++ b/charts/molgenis-opencpu/values.yaml @@ -0,0 +1,41 @@ +# Default values for nexus. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +environment: production + +opencpu: + name: opencpu + strategy: + type: Recreate + restartPolicy: Always + image: + repository: registry.hub.docker.com + name: molgenis/opencpu + tag: stable + pullPolicy: Always + service: + name: opencpu + type: LoadBalancer + port: 8004 + firewall: + - 145.100.224.1/24 + +ingress: + enabled: false + annotations: { + kubernetes.io/ingress.class: "nginx", + nginx.ingress.kubernetes.io/proxy-body-size: "0" + } + path: / + hosts: + - name: opencpu.molgenis.org + tls: [] + +nodeSelector: {} + +tolerations: [] + +affinity: {} diff --git a/charts/molgenis-vault/.helmignore b/charts/molgenis-vault/.helmignore new file mode 100644 index 0000000..f0c1319 --- /dev/null +++ b/charts/molgenis-vault/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/charts/molgenis-vault/Chart.yaml b/charts/molgenis-vault/Chart.yaml new file mode 100644 index 0000000..f6b75e4 --- /dev/null +++ b/charts/molgenis-vault/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +appVersion: "1.0" +description: MOLGENIS vault +name: molgenis-vault +version: 0.1.1 +icon: https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm/raw/master/molgenis-vault/catalogIcon-molgenis-vault.svg diff --git a/charts/molgenis-vault/README.md b/charts/molgenis-vault/README.md new file mode 100644 index 0000000..5ebac64 --- /dev/null +++ b/charts/molgenis-vault/README.md @@ -0,0 +1,52 @@ +# MOLGENIS Vault helm chart + +This chart creates a vault operator, but NO vault. +The vault operator defines a new custom resource named `vault` that you can use to create vaults. + +After launching the operator, create the molgenis vault manually: +`kubectl create -f resources/vault.yaml` + +That creates a new vault with two vault pods. + +See https://github.com/coreos/vault-operator/blob/master/doc/user/vault.md + +## Parameters + +### Azure cloud credentials +Define credentials for backup to the Azure Blob Store. +See [etcd-operator documentation](https://github.com/coreos/etcd-operator/blob/master/doc/user/abs_backup.md). + +| Parameter | Description | Default | +| --------------- | ----------------------------- | ------------------ | +| `abs.account` | name of storage account | `fdlkops` | +| `abs.accessKey` | access key of storage account | `xxxx` | +| `abs.cloud` | name of cloud environment | `AzurePublicCloud` | + +### Backup job +Define the schedule of the backup job + +| Parameter | Description | Default | +| -------------------- | ---------------------------- | ------------- | +| `backupJob.enable` | Enable backup cronjob | `true` | +| `backupJob.schedule` | cron schedule for the backup | `0 12 * * 1` | + +### UI + +Parameter | Description | Default +--------- | ----------- | ------- +`ui.replicaCount` | desired number of Vault UI pod | `1` +`ui.image.repository` | Vault UI container image repository | `djenriquez/vault-ui` +`ui.image.tag` | Vault UI container image tag | `latest` +`ui.resources` | Vault UI pod resource requests & limits | `{}` +`ui.nodeSelector` | node labels for Vault UI pod assignment | `{}` +`ui.ingress.enabled` | If true, Vault UI Ingress will be created | `true` +`ui.ingress.annotations` | Vault UI Ingress annotations | `{}` +`ui.ingress.host` | Vault UI Ingress hostname | `vault.molgenis.org` +`ui.ingress.tls` | Vault UI Ingress TLS configuration (YAML) | `[]` +`ui.vault.url` | Vault UI default vault url | `https://vault.vault-operator:8200` +`ui.vault.auth` | Vault UI login method | `GITHUB` +`ui.service.name` | Vault UI service name | `vault-ui` +`ui.service.type` | type of ui service to create | `ClusterIP` +`ui.service.externalPort` | Vault UI service target port | `8000` +`ui.service.internalPort` | Vault UI container port | `8000` +`ui.service.nodePort` | Port to be used as the service NodePort (ignored if `server.service.type` is not `NodePort`) | `0` \ No newline at end of file diff --git a/charts/molgenis-vault/catalogIcon-molgenis-vault.svg b/charts/molgenis-vault/catalogIcon-molgenis-vault.svg new file mode 100644 index 0000000..61d68a3 --- /dev/null +++ b/charts/molgenis-vault/catalogIcon-molgenis-vault.svg @@ -0,0 +1,627 @@ + +image/svg+xml \ No newline at end of file diff --git a/charts/molgenis-vault/charts/etcd-operator-0.8.0.tgz b/charts/molgenis-vault/charts/etcd-operator-0.8.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..f2c2bc10796cc25aedd91d88492a3ff2efbd7504 GIT binary patch literal 7467 zcmV+`9n|6Dc zVQyr3R8em|NM&qo0PKDLbKAI*=lhv|ML#)Lo8(MNvf?D8dw%sC+q;+Ad~w;{nVXv0 zvLUi1Vhj-+0+ge~xxal207;P)DN$cyCo@7#O)L^<;wud=`O^KS2D@5SF>n>^H}SV$86t<%|*PPuVE zNFpKq86!b?(1%IaB4L>Q>^MI;2bPDzjc6$KqZ1zC$4e+E4g6nZV{nz`z>r7qpYZ^r z03`~`=VR=HFJ&nD?e>UDKOQ(PAGci|As6ie9gDiEiZpjb?i^Dh78toakQm5v;r5sa ziBX&JQA*C|5&g^qNto?&#v>;TM%I|nKoS~YB>I*OI3|?!70-c-&SyH{Ox)6c8N#X# z3m_nhca!DwtPCTr&q(ku4{0%{dO`7ZZHVpAZ(K*tP*!JpQ|#gM&_K{J-cNzTA!fhe&&H zibE1J38wG$5H2W%W9`9}PX$l`1b#h!|IQxrXiTI;4~CSX%5aJ&$c_yi)Z2#~;o0S!DFjD!^ph}*XS z+z5%pKFBCW3!rGd1}I5alfA@fLR|#nx;ze~9&d)?osZJTNU>*Vf%I`~2~*(MLoaM;+cw+D<5QbX-=x2^1X`;M?%=|?;s z`E4VynZk{|IWexq>o;IE>7f#@rG878wf2(U65z%{^0CTiEc!kKT!K>k2>*y_q~yA% z1_-!3W*)=>;l@{fH61Tt+sOd^N6tw96Kq>407S@;2)x!m9LIqhYftO@Ovz`p>yaps z4QF}+JTT+aWwB~Ks5&Fd@O^=qBT5zUOuF8Q$$D~e+J_-w0<*Vobl+9HxG;jsy|MNR zI%yRYH1m{2AEyK!GU}2OJuaYY0njlSp&23(hFnm|qiG-hh{@EUyxLc)%#w`yFfpNy z`W?oMopVOrX&;W+9hnN#zcT>LMx&@im8X~fO}{QJ=iG^+Db;;Lo@o7?tS@cND|MZ zDhFX|M2wX(kZ2TZQvf3lK1TR|;Epn;47H3%AXKM&N-1t^`xd81TGMV+6UK%nIwNNv zNI=+BQdeZ7GO6G=8i^SLCp;L^Q5-3M06r2XeQm+d)~7E7@gpE$=Y6GO+kd{S|!U`9AqV1 z{GE?A)gF^i*%dOvt7(XRxa^r{J@Zce^(J<2QKrAiow!6dG7oA7>|bG=T6?MQGOAH_ zWJTR5JHLllj*v&HnxB69>8A};B~uF(*dmx{7WfcaA(4Iy#<7qvz&^D8A$s;eYmRoa z|7`z5<*+4B$BBx6|JlmOp)=}3OE*pgBoscEN%{7q+xAS5+s02sMJTq;mpI&Z&pB|q zo$F39b+1(>$JCbAqj=b9a#@p2Ad$*b_ct9#G+K8{ zZza9XsdHAkMxTv)xO#Uva}axQ_3jc}?K@Q#$wX@5h@@`X?_(SfOiL1-K#USaFs)J# zY{^8HLrrl?dCa3+E}qRia=BbaF_1~FM9f*7s8p*g>UsTIEACcguamJNoUykj{Rq)E zEf;CG*>_a>c4`XjB%V(6Jmj7c(cT^$2a=NEP`Tgff}zo9aJXus5la1siE;GEFof)o zd$t-O?Y*=x$S zGhQbdkG_1#^=q;KBtqgMsH~}UKV(l;raQ|zaLkN68W$O%BAJ{kpY$Z- zCyE2G?Pv@(1>2T#3bu{G`#_4!jK{M#Pn%VhpWbiO~MuL{w0a)WbB+0%(H?(G+Kj53{NwVCDXR zFqSan90nxXDqW@OL(VOLkN;@_JauKn>{B%hz)w^@vjD6Y4txyFT*3l4@zK52@-Hq6 zF|I>o{G{fEaQ^Z1=*iQn@kGK<4Wn!=wN>2U7{-h#K3m{4A5k`sr4o?J`z$w(6;JTw z{Nrh!&QTp5V>plrOie|xg~r~X=U4!5huUP_=@nu|Z!x!gOM=qu2W6_OPO=82a;wP` z&;W8v$jin1od|eC5hsTFvHk7$mg?faYadyNk#Jlnb%2fb^Rcn_8H;{>CKdI8Uw*RX2Om95B%T{mZh*6X{42)5>(x4oGGJMRU zLgZ}(30^Y)>vj*irTO2h!_MJu{`U~6G@Pqf;4?g*(r(+ftvv2lk66bek_=Q-F$2-J z4I=lTW!=)i>qF~Iy55@v$uLGqRGHac{QUaS0uv5;@R}{k1pT1`qCT{~d?^G+U%%S3 zCkfB+^{atWkT7ggZ=p^AA0sNs$grG6Qz_&)$&>&x`*RCiCIblqF7>8y!hXv~Hg<&H z_Bp?8^`RAVA?;+(qBWnzHi%a{)Q|#I!0c++`laqR%7d1b!d{Zazz?aY7p&Dn_}yHuB!*#GoRy09E^hIWF=Z|oD6+5dwVFN^m7VE6sk zL#6!2Y&r=X5H}6g(r3BP2uj8vbqU7CC#K|rGkjyTq~I$wX%b8Qk(Rbl&h2Xr7Ri|; zlPN2uD)^qg#kX@4A|CvXuGHUu8Sxea&J~1F70oA{W;-bJOk`UqYS>@kux~!O`HzUl z;eyVz0Oqt|0k3sEmWIx|U7K&1n%e&y@L}btz!LlaqSGtI{|5)1o&A59REqzX+xfgX zCt)bkC_ixkrx}6o+Gv0C5I>E(MG9^-pmZW#|6Q(0jTxL1OoK^A0?rqOfWH*V=K=ht zRLV%gajp{qHt0wVV=c6Nv$ij7eID`;Fz*02bemcs`RuE5^TeJBXwmLUt`!DXZj`#Z zgwEm2K9em@%+P8L5cs(1TU=7vEDEDjZbaY(`6i!4F5 z=o7|ynL-XG-lVw6Tcj`#MSnbwN-nQFK68llS)B!(`tk*m0+DQ?EKNOFee z`-0ri$USVpPM*X& z^aakwn}7+enq9y}TT?&aD()j}_L=XPYecDD8osiRoLeLo8-I4h8LsIBmf8QqgA)G#pu1cD zeV|kto%y}L3Nyd%{@wg`P?H$%PqdX6#mt=Jm~NkG=FRF^mD?j+2ZNG`W_yE}T0|$j*JeyDtAiAB<5dJwo}zuADTr|7!t1 zlC(7bFXR6X4tg(pJNy3-X$|~G9(%q$^hbISBD9WSLKyXG{Rsv#nr8X`-r5v6@+WdL z8z4q@P?5i6T5A6{0e&QDiT!_h(0Ng^|DD5EyY-(3Nel2FRd#;6=#M{><=qhPv3;ON z;nUu2!92Et?|1}Y$5s#>D>kD7*-_||CAf}?ysMx(DvGa$=~w~GQK)MN<#>1~M`^6D z2AilUygrQMVYsPSSI){6PGZguz{wS^II7tsU&`=5W(NhEqz_z852`M{(FfAL?!4~g z9#@|5T-U@Rs})6yGAkVs-Hd9XP?28waOq|Qi=~Pb=MScCMzdV5NOk^L>tkGXL+qoZtUD?CkD;dXTgn|F!(=lyw#lHo<;9 zBIxS}M|;huy78Z$z_E=3AeQa_yzCv$;lFyj^}h#6jqqQyYnwL5ekHVu*snb}4j_jN zn;p0-)bP;guk_vs!;<&th_RY8&VFpJ@=WE$ zFoANBB}jql?5ltUswq_C1wtO>H-PP#6wdXw)dI5m7Lf+fgSm@FmqQTBRqap+Yoid- z+Ahy7etvs$c71$$dQq-!vA!lMzDP$CRcLLFeV8|Bs{sz`%dd}scqpFAU+(*3`~^7>D&`)YUp&x54p`+tp&bYFA+u*ojq zD#6+hJBRq@yMn8Z|8KDW-|dw5{|>r`z1{a;50W;U|Ch(_;sYJ(XF@;h_)O=R*`&yZ zFyfNCob}=AQNSbI zVjaukzr$`B|M8-;v;Pm1_TZdIiBTXxaxh&FcRmI%h$-`EFoKY{w`7FEvG(A~rvgMA zYI_I5N5){p_`ob{(qOc&j0=%;f*RkPdrkt++JgW`dgcaC!w84;6M6>g@%LvAd<@tW zc%VxvmLSyEF$d^a>d#rLt+(9-Q#;msyz(=%Z?VZ?t& zS6UABkhD#{i2wd0+RNhj|M<&?vy01Z*RgE;cYCG#AG!xGU+m_850Xe2Mtq`Iux((( z^(nsYS+qsGnmdk@79mQrLS1&+~NkB%ZAqJLpeSP}&^5os|+xKS| z{p)M^#itC-1*>|72tE-oKn&mx8M7q{iQaz2J)}>SXA3A>uSdJfO9Ei zL_(3>*`IN$WI!0>cS1K~HWvpzEL`vZR3z1W91f{V34>Ga#wsT<6=u)VhI#q-FywLI zt=ceM;dzAm;1xk73d^$d_u_V)7ysJ?b8k=*I6i+XAo)tpvf=vrG9Ha|FRAW4|5@=i zp=uhBQ5sUJo>5JY0}mrMRnaF6h7l1mid`8;sDjiqZ+iHZk+(*`ssgIKUL~-sD-H=X zc6L+w3|gGbf(^R(W<0f%2RD7oy1BU-5aC--K+T9UDnhE}6a@pettre1sM1P-KX8fH z*L`?9gei~p1?x9%0d4Bt01r~?`#_~ZIs0US5OBcZ5MAk5Z!~6C6G_%v6WvJ%lhOOD z^9vZqLc#!3n&?4t8*$3+K8WO=VjgN`pdtzTJ@Dd4Nig4Ju@8e-f=kqpfmooY`X~-Z z5%JWNKnef90$L~jIDOSNKxF+oFYBC^&x<`NQPxe~3lWa_1O=phoYO~_k3$|{ zAO)QLzmv1`E1h9>x)_+_#gaCJ9+5N{S?M2{MAN-D(=`E?>PgHpT}`?G2B=EKs<={M zNg3SS#shRE0}_U8dILiqSy$&5+Q68(k3fXqZZn?SREQWw`{1X;7YCI?Gncof*fZ-F z9^C?o^dL8#Y%Z!!jR3AX_V*$b^fTHdu=8ffn1qwO9XFjbhMT4Ztb4Fm zO|V9pZIIF2-sFJ5Hw}f78p`Z6uZuUwC*`Y%_aWj;jafB*Il}}_E@otIWE3~7GnMU4 z2{pXD^u1w@gf#sC0d6K;!a|>P?+vJ}+kl6ARjO&`BDeLQ)_ox3Qv2`WL+-Zc^5xDm zBjsaY+C?+(TjI7b$ZSDYW_!_z@MXrg%=X;11gmqua6hxe{+79)-&9+P{krcfYiZmk zXw1yEX3i?Jv5hKUYdqH91yDn1p4(()ZY5^7z->uGswvHLn-qHp*)}<*{iaw=a&0_G zj&#kGw_o_~ZaKF@!bEd+7jTuH5Va%BMPIVpGs?uPJFX8r>-I1wSpW6bMv(}fLod1`Buj*Z_BJUyh8deTB z-A-q`qIXz$gjTg|-y2xzW(+HC4_?2gn^>?M)^veQ;2tKJ5jCea?zg}!5rU2ay>_;M z+b>^NF$(kC=0N5PVz6V+(`Tj=maSTlXryQ2qIuqtT!u9&P ztGHe6A0E{^EV-q#DysRop<_t7UBf%n-4eP$Z)>@2=onIN*YFOtSCZEGhXvd=bPOrC zYj}r6*H%^%dQ|VQCoC~+%7bR88-lM!A`!wPG550~b(8vn6C?I3axkNw;} zkTwgKy_r!caC_O?)ZQ9ydyeS6iQQYQuwwUM-T)00Ba(xeDC8J!RQU>wF6EZoiA#OW zMa4`fT@IP8JttRUq{EH|BOrG|SzZqVNeP?taa&<_d7$v9VM6`&#~j~FJ@f3{i^Cp>DHu<)b6 z>S@^{h6&3)L9CGNBZdi8rz$C5782>#*o1Q;{lx7Kj1SJaFzGk*!Rz_5I&Nz{?_)aN zMW2J#ncK&6ybHbquL~0%(eaiKtXsZ{THMB2bMZEFya}BKd!=P=1^v7-xB9ra^|)Or z6rbmI(qvD##BI7Kybia{fzw@mJ+$teyqZyFxZNN`fQ{Cg=MLvv)ZQ9yR|ydkZYL`V zw}#u<$rh`~c9jqTHdu?)#&mn=N$3uN#Xx%9L#YgEUabjk7L+%L>K98AafRH4B zJgo|DH`H6j?JT@CXO7IpB&pYh;_e zTwl7|mTksuQM#FIH)D7^vTYEJ2UXE{p4A4y_&V{ebs3_oVgJPSXJAi=MLNT}v2B48 zZgF~~F`d8dXMg_pO%{ZMDioIh0z{& zMVokI8ng>1qP7*c?Pt1qmTec_*<Dc zVQyr3R8em|NM&qo0PMYMbK5wwKYU)ZYQICTG^aMnF{zs`iJtY=I<|Ko*XH7~y)$Pj zHDyC2Bw|bgTmqEi#6F+>UjTR)DN&L~PG*D`i3|db#;wr+e(0W}$P*?DaEJs8JI5{x zg>{d7@4ucdbi3W|!QP(wzuWDW|L^Yi`{{2L-`nl(_Wlc=kcIjXae>1B>UP(qQ?A^1 z5>P;X#33h)4q@6eP!OblcCDWE#&9sVLlOuTb<9Hi@e+!I2L6BS`C!YD17jA#zoHQi zDHfO;F7xpaTp~tnXxY5Y6ncuNlh#Bt`2^qweg(S)Oz(PLy!YI1qDwB)2OKcVf zrjNo~EC`*LcX(tX&avQ~QHZG1`B9R*{t<_Q*vNawChYnjk>?#VkA>FT-skh0cTNYV@0iT zt*7}0?-`rz|I+-QA}_-Hi3Pxd`9J9QX6AqYU~fDBHxb%xIKg8%2tfC}n!>`xKzua8 z)uTMbfk$j~%pxj=&@)uhp#c!$fN>&Nct3>yMCjfktY**y2sBA#3_uWh-Z}G#eLsY= z@dqZ(L(DN1hS6@r8RY_bUdrgj+oNL$nTI(b>cEIlhtLT(!V$717j}q|z(WvWgcX5H z98QUi0ok@>Sxse~_s+$_#UTh5=aNGU%+V_{$zAxU^CyBwLsw{@-Y=0CJbC0 z;{Olsi08owg9s7j9unA*b-XdnTYP`0diqB8v@a=QYhvvHqR6`!#O84&W8z2QMAuHH zJZ5xECQ*n+9tIa9Pq<*a*uLd}CWufj)X?dK7&-S}08=Mmgvv-H%Bu$c959Z#A=46y zIX@5CNR1*)C4FZIW8`t!+Jq88kavPTbbpC$Mjbwct{gTvB+N;pdNNKBAG1hgkp=*d zY#Vca<%XEM%yV??7!fZDaV~aXcw~yd8D>#$tFEwBkHHj$MAm~th||%)O;9y|tY5~W{oh`rv0UC`kzPpWu?aV{eES@*P{8@elj{#h?@teZcp;^@Ej*ZD0ReM3n5NRX0%T+O z`W37TtQG_7LmK<|2&M-u6aA~Y;3rq&Taz+Cr z+{4yaiwNxVPu*WE9}DClffS*~)=O1^gk4!B_#vrBp6QuF5~ja*u~j?&uU+f~IOLWH z*4+v&nE(B~{cdUg@9%Es|7OD1ubo#gCH_!qgD@r@7WV-@^kuWyE*`?G&f}vYQyHh9 z1G(9dqCn1zRKrw9hDMyul&T`3braXj5~;16r4Jm{w6%WJhYvF4$0-g&;$V1?iVC%1 zf1rL6|1uhn$!BPp88J*9^;@%ftoLy!En^&c-o4z8dSpzn11Jbo1uWwytf{N?LY5&b z!(oJN6mblk`8ao+rK>$A*mF3b5bMpJ)}@6@IJ_9$t0p=5a4FMD-I@p3erXwJV~E9- zCSo&n@WkU|GZjZfx@(KLaKX6ge(f;3fEOp zZ6@Lx>c&)eRWUss?-4HkHS_Hq;X;28yeLFosb%#i?y^vc(4-7gr;5K4I*B|K7PHE4 z+-3nDLb|DOWaKov6GUF%%KnGV%*SomXsDI{*$L^|%fJHpzt_#a#q$54w?Ej*|4oFV z{113%+KVOqNjd;B(Vj~7d6G7#Yk|_BV%ff|XkS6HFBI&JeT=%F&q)_-O#W!fgq>a??88v=>c~xqEuJm{> zs8AU?#>|FYet(nWS6?eYE7wsf%F3>!;qh@e^I4z?JU+IHbk1|P(K9)+tLl9D@oj0= z=w|uSTx!#>E8c*og8dlo*x~brU^h_{Qo0l{xBB_`k>CC-yEuliXB8l=fbS;fy!XlB`d+S;<<)lSIvsc}G&f&0HF@10(yN& z4}46xBf`y2Eps@GtcU_SBVR^F^L3tNj=z}_5*SBDJq32GNjZlY$%yA+B+cnRx3ano zPabObe^t%$#B)C_YrMyZB9%VUZ~kaITHo>4&lsm~;9 zd&x+SA!Yxr(o5Tw;rkDB<^L0104g!%Hnv9!+#l0TZ@4rV%}89T1z&>NM^{cf{en>BuQy|5f?b*X@thwW`DV+)@PmEd*F&v$r>3g-=VglyqmdUYh zrq2!ZUx6IBTwp4u%!_=<6Y=AOQ=FvI;Bg-X2|YW+q6yNk{&Z{K==ZlM&LImcl-Bi>*3{D?xr zA`WLKr`)iDkjcHiVG#$Tj!qY{U%#h$pM=u<|M=5~(~HX|E@RRB@9yoF=Kr9(w|)P; zk${3AWYgFHLT20`#8ZOrW}=^)+iiI2P@4Z2r$;C6Pc7eh$};B9|K4t|Uw;2L7;N?b z&4hNfO&7!XRE+rLMez6kA!Gw!Aj4-Bfhds{}m<#Oe zRJ~P{N{b+#2X+*OmYsl$O$mE)%H z`uzq*SSoQu+t9#{X6@s6Ol*QYIAOLj9ibo38)hm7Nccg;dUBqa?XJ$sjV}Q>n_8tSxU?;AP(U zh-^d2fI^=c#uZCiH1~c-DYEjHoGJ~U7a6+%nukjR5iWSn zYDa8mB|stavA`iuUR#w~R*$~;Z6*oR$4ap=C&PGv^MnR84G(aVS^jFAtCEc7rfCM_ z0nB9stdQp^$S7`aWr5q?a;+q}ErWO$Qh1n|9SNFPV|$wx4mWcRSk3T}<5r+a(~2(S zR-j2UZj~ji#_gNqHp4To-?ow#1R5MYm)j%n4&C#{t)#|nb~V{7-$S|}DZL}aPNGp1 z-m328Oo_=~i8-+xw{kIRK6Eo~vjg+RxgRuhC?M%0;hW^~)kFLUuK^EICNxf*a$9-q zKaapeGU*Xed^hv_H&NG0!=;Mb723Aq$?bd!59)PW-CO143Quc2suu`POh%QsEp2c( znpRh4t1ZtpkO}Wq!ZjI| z-1cAlWH||zN8mPH%b0`X%Oy2TE0{%`lL?)-AV0v(*T-cRGsSK0eMeIXb~Mk}U*p1; z=hnCkuq`+27};*7fkMO+75qkP@2NS#Pdn+)Uv5$+mC?cc=HSMHe<J`sY zJ1R$3+9wnPQQOQg*=c9@KI#Z2j3`YipYCJ|bxzDGp@5k2n#SP)CLsl%kCsqEzjYTtbcYukev!hP0wLA z?;yt~v{L{&btJc)ms#CRv+&*YnS&2iha~%R$qBfEt%p||ofp@_nG*<$0d+`Vg)%_Ho<2z%^K?LYN+Q3$P0 z4$lk9o`>3z>Vc6yi$Ebx*TAfF3*-pVh9NaYhs_xQ3r2n2L4lm;Id$()TWyR7ep~MT z=|nQG7etL^OA(29ct3ldkc?4Y59r zlS291ZxzkIYM1A}(Ab8hLh1f5-YF~n((;&n`xIp?y8j>Sm+imr?e(_ze;Wz<@(5F# zXb`g&=|xk}MZ4~^s*|ZNRICIXJYj6&VH6O(pyXG9uJzjL8V;FYE{4Ee)Zg15?(V-C zI|s-<*zJw*X!p(DzO%dkW)JnoXxG`_dp#I;$FF<#uJiiMcr<>!D@V-1*m-?08ryxm zJ2uj_d3_f=l@1RVgCQg$m}*0M1Zy-Rh-3%6|FTSLu|Z@QGLiUtiB6;?k4(Ohtm9yuf_}g zu(ngEMf3k)a8Sno_qw~=`M-%U*Z891+K%&8Was zlrtyr4UbI{a_UruQGq$8X8s3lF8V6x2z+WO+PfyB?x{ zcQ7fYlphFwJ;;*&iZHj?2!)o7J@4-m8C%GLJp3!7PRLHVZB!{;R#H>9geYftj_wYbSuB^iqd+Pv!7wk<*qL?z$FuMv0(ynB9@` zymN=VTj7Q*nz$X^V%dQ6ompQqtMK|8up0MJiPvgpKt?<6Ee^J_nwyDWSOC17p(pAYzCeR+d0-rk1tL#ze@V+Th(_JA1-u5<-Qp0!k9G5{)lSNBMJ`a z3T}nwIH4=kDSIp`I-=7cmGUFsqK~!;pKk4$JLaOkRJ>x=ISQk+;!;WuL~{}m2X`oQ zu>>5=J{l$qrTQi0;Y##3`E9p5jvLhpDePm3S>@am6M}e8p8;Y@6}!HOEO?wVSqT zM{RYk+NzzkRT>riHdt#XZ`^o*ZDZDpS8kG(WbrpX*D@od@d?A#eSn8>InZ%~)IjOr zZDikO=KRndzf>>%hxHTok1$V-cCvQqp;6(nEjKpGi{Iu4hc>g=d-LYan>B_?IxM7O zi$QC%z{b!DkZ@bzM_j-N525u}J}^gW9vK&fl5#I`NHkC%&dLRl0b=?F_8G)$3k&i=lU|%!ugHl5&(8%I!#=@lKj=&jj3K z$NL(kSi~AjX;>!@NdP$cg0(15x6!Iw21||W+;C2F*NkVqJY2oI%od0?T)n%D9{|WC zA~Ax%1rj7Rx$I+qgu~1{X@GGU4+LE+8DR>KrztdCrjSNQZ~#R=qQf zzNL5Mp%CV;( zPR>7`eYmOZ^$N4~7sD7>a7G0Vk)3OAOB?lys$;+nI{UQ{h5fD27s|^!N)-F zB?>->i^oFB1##a0aHZ>E4`!SS7cV%9HYgj;C^JTP%d{_z3LnDF+y@uE4fd>34fD>J z6VLnVgxDjuICp%DXleI@Q!@dn-vhza<_QSRzcN_dyx&Lzui3=ksQ<<14$J9(t2u>U zp#Sad?UnFf{r+BeYyWp6;kWbuToeI+Z1>L#8fVsX^Xk5o3+{kx{T%0)>W}$8TDHYY zRVrWQHt+W0t;9;ad|$m^ZmQ=S1W(ZPrMk^rlQ$m+r7MU(z(AO3tmhjEPuuwAm7=I! zHgy?Z6qT!a46g_CG;$_htIgK>5}#AxleiggN`H}i`f?YQgi=i>K|_(YT4&7zP&Mza zdhuG{YjaC}l74Gm!m>SAmLf}b-HZ@gt?%X{*qV3V9FbVxd-KbFlI~lgh}r&oZdJcB zEVuuQCzU>G2%UzI;061?-i-av{@`G1|93N?G@YwY;8Q$bl_!8!ouiYEM&$O>hvcWi zcHYKFh6R2C7K!j#9|5t=|JIC)U^9z}c}^Yv&iWOYvx%`9djf#P{sa)EOeFpnW%`zj zJ>TMP$7SrcHH22cxG>{8i`HxsQzKqYZEQXR4wooxk&!^cT4u)2ix~wn+o}h*$N+ENnGw3 zK}i@SOM;g1u_#&IV`SdzZ_((9EZ|#SEq=RYVl|hNjdx-r#ZUBZp8AJZ zXiFq)_g$_^jTxM2mur8l`s->oa;n@H9AtkSPL~@ukH<8wq=li zfY}9b&1Dm`<%;xGxsEZj2AX%flBGS6ExzA@9~9sOhKF^9=HUGK@=R!%a&k*5@c4Kre`->) zaybPd$$;rJ&z$az_dj2se>}PVaPqZ&S#@#G7Q-X^RwQq3F-YQEAC5&(9np zJu9<-Q(t^QQXrBZl)TP!kQ=!384}FH`h7ueYUCmtu#+b-mz%B1{YMMy>Hp1~1TWD4 zyZgIk|Gx+Q{`UNTBcbB_XNBw7)wT~S`Vd}LQ~O@G5ScLk4f}t&`JcxaH@^T}bpAUS zlD(t0%z?@z?fFeE#SPXsqgR<_Zcqx^gHI7rj#EwUzu(0nxxZ0 z+o{L2v$|$JL%^I&!Q9oQltx%SdHVcWr@VT1xu^i)@yY^b_1CQe+bAq2|H~JDX2?9e za1mG}|M&W3{Qute{C7j4G&}Qme-&bW)%&~I>!2n&-tXutFN{2G$1%A+Q_Snrv#MpY zY~4hsjAtEBBeV{h{T<`exEAiCIBV-wYqn$*5d2wSs=Tsf7k8ynwLXwUD#V~N@zJD& zR%@1Cz#PqOtgpwcCyxnrn$&@&_Md5ci1=~BDb}eL*DjbbCS>Mb@2<)}SB5c4xhGhB zw2zR{n1ytbqT>W6z%s{gL`;Y#qTAdBmw*PcRkXeVYEy zt#yGTzoTVl4aCS6D)NU6E6V?7z>hdAkpKJr?rvHC@9u8Te>M{4;6JM5{L`X8eovBj zO}xj`13d~)d!GvC@g(?;X8?9Q38G`kYE&RQ3VpHw*HMvn8B|9__T?}gOMp2FWo@Ax zn}>3g=K6B5iJHu-!#Fm>O~tu#ny+AqIW>Tj%UofqSqE2$;GdbHU>%gf)x=PB@ryD@ z`?~wOn~Scr@LX5LBC8cyi)~gi5#5YxAybiF*|>Bwg2h}#inE5Po6#)iD^i^`Yu$`$ zIbV4MsW(fF##GVrc-5e)vQ7R>qpHO0Qw^&U*(VrRC5lfouu4RqYGjqjHW*qp2(O~m zm6ZTz^(2;sn-wUn0ye89u!Wj^`(efXe>31$92V^VyZf{Ee+PS8|4$nUi}7EJZKteq zc(4xk>lr~`-#OZAHY_*)6T2MC8Gu-H|Fb_R<3D%%-R=3`MnWU}SLU{9ee73EtBCz- z!x4oXGAuK=%jNV?=&!_YMC?QV*%4zkHqO3p)X$B<&kbQqved3iQuQ>41 zET=%Uxf%88m!UUE%R$lh=jgsQV6^4oX#15~ZaI6|#M(34(pXLYFNXtIB>(&Sy|Vp> zLGNHI|2GjWiaIUVc=8#ohL>fR3W*m(!h9H!S+M*Cv zMj<4nU7lY2cy@exeROhiQ7&%&c#VhnyfGRNh1UAmhgpHP9N?fn|LO>cP4QHIy;JUo zm97@&Qd#zPu}o~03&wdgws(x{g*Em6M)!aV@BjA7?>`Q9cenn3HWC)!|1~n{zT*C2 zom;?Vl(p}65AmDd3O>#JU+ezA*PXfl+wXR_@4q$@*4zJ==kI)j4)r^s?{ix7!ix27C~~$+)9*htk^h#9J)cY{ z3-L;2EYkn>dS&_F9c<hTZVOVd3`Bmn$d=1=KGAokH?qbkdPbJgouv%SF>+eqc34c{hLI% zlaBl+`IAp+CnKbdC@9~T+<0a2yTEv5jnJ*}$`XEHy!t<*4L_ogu!zIi$tgFiAY{K{ zTNoB`FzV=ZA^Y`vl$TBB|Hq#`oL*e6UdE#N-y4+tKlBcIz3u*QBLM|L$foK9+XN5U zF2Sz{hAFi$YU3}43CP30BI<Q?>~wPI&XLC^9YRIOoX940VhT4# z2B-TDSNPsbxFmkyk@3AMBY_wiHlt%QiS$9PI)L&KMH8&R1cq^aeR6hr{O;)N{prQ< z`Wk+6iHEg=RW(S#MI1&LQ@F#PX9~;(c6KWKj7o(?5YGcU3PVhVcMpWZ2n%Ex$2tn) z1s%9RBH}U&nj+$%k%!@vi$k0>z=Q}l8mR`*ZBd*oFD=7px8W>q7FjpLxXQR5F($YO zQNUB5{VAui4Up%tJFcpc?ZttO3-0}2@VJ~W#w?=F zvK3PWo`+Z&Ug1PwZWw0XFK*A;{U5E&y~P5-(fJvN_?4Vt!u9oKG?}PglHGa!qvUN$ zUoe?pdT9tl!uLw5f9gj3(4~fC!CpcF`0AWq`+HYzxbHt1!EYNPONJkDX*P>2ZH` zegS^O1&nY)6FU%lBTm@e0UrA)W`PkCtt9MsF@c-S|l9j<+$#gF_ThEHKG!s9^pdEv{dNJ z=m3St#{!4E+C#LSud&&0>OE*sTdx5R4>DKN#6@oFpVoaqeyRQs@FC~zx$N9I z6H+dwx?Ut*eM{UHCYj06(rnMO2w!IWiP@fUK(IXbbMG@t>_0L0v)5-!v0wMTvX;g} zjK)l5Yr0saGPY6SE6vAxUjQ|PX1R?|=9Xgi3AindkZMY^+{W29(Y8&@wBHnqiQUGd z*raPZc!z~|cZ<0lBab&{cMi9yQ|Vb^8Mm~KVV!$(+-6T8XQ(ycHqQMUa9gwkF|%q^ z6(bpf^j25xU6v2!bz~vev)ty9$935s;6vn(q`(?y^D4nL%gtcCA9}&4cMm=B!=Ij?e$C;j8KvtH^u6oQ8$N zO|RSams}m@n$W6l+xHq)x*o%l+y3kKWE}~X!K3CzJUW<>6(_3~R_7I97{RGpp8 z;r8p}GD2aN+Z@Pzjt+L@ILc-^^3qca6i(DmoHs9gC2lKxPtK?D0B=h=*GlU{jk;c6 zb``ga*N10a9Ts@$tkP;euDLKI+^(=X)OiV=Gj40SZMZNb+^(=X)Vd_CTOa0d+i+n> zxLsj&nCG^#lF+lR4hy_wR<-Rjt_~$`d4O$8>e6U}ukM2iY4!k@`m>z>5yxtQ$U!`I za`!+=EL;vUp-|xVa(_9ccj_mT7L+P!V9Qv*sD&eDmsC!|gIELd@-S zsm870HnVK8OxrG_BEVW_%`-L$=eO;tN~U(ZYz$ZLE*q9t=61#Vr<^rJiwh)(Ep>zu z4y^#=u(YB*CCD z9=9w-E|gV;2He^nk&A94ZgtvKxDA+NAu7nxSUC)>n`J+_Sh%sCn9ALNIUKmlBG1u4 zNJJq|tAg7#$F1ZxQ*X7+kr|!5N*T}d+_dnOZ*=BzTh_^Il<{R5Uj0U=n%l&BN~v{q z+r}SPZ{4SE+mzd4>!xkH9>Y)5whgp#TBVKWS#6+>t@~2KI!ACp)Yg z)8tsdExtcgn9ff->CazoQY9P&gPS}i`No2O$a;K6e&FGHwDt@z8+3W8#&S6AN@b!F z)~%t&N1nhTRqq+S`yD{=^U?cvdP^u=B$SOYGA3A~TQx9MHL`*lXZY3_Kdm6|4tC(q zB_1|PuxW*NU88Ps@i9F19{JUPbzQS|TOrnrxA!ToHjk0_yaIGS#BytdsgpoDs}Y=* z0)0EO&OV_Sh(f-H*$yCiIjR8YVMNo-b_yBRRkj)B%)`bHkU^-48LQ+R9$*sUK$#uY zwfUJvfIQBCV(iEPqgIXr;oJyh8o7-E60hDCT;g)_1TC$)(`9#(s@BKglWc+vJ)P~z zr5f!pn|F}o6WS?QMD0j!J1LT05~AO{HHsvT7hhs_@V3x<8olMFe}bNJ;$ zr6MFFzYWJOq7%u!V!=n0jHM*c;KN3FVpP;_f~hPodBQAHwPGl6D@RIIS?cDk1YO+v ttt%bpJQQJscS^wM!-Naf8qfXyY#X*=8=f!xzW@LL|Nn1fx}g9<0RZrYVj=(l literal 0 HcmV?d00001 diff --git a/charts/molgenis-vault/requirements.lock b/charts/molgenis-vault/requirements.lock new file mode 100644 index 0000000..c8a680a --- /dev/null +++ b/charts/molgenis-vault/requirements.lock @@ -0,0 +1,9 @@ +dependencies: +- name: vault-operator + repository: https://kubernetes-charts.storage.googleapis.com/ + version: 0.1.1 +- name: etcd-operator + repository: https://kubernetes-charts.storage.googleapis.com/ + version: 0.8.0 +digest: sha256:47aa645df7dfce9760905800321599de05995ae50090735d45310936dbaa46de +generated: 2018-09-06T18:59:39.861922543+02:00 diff --git a/charts/molgenis-vault/requirements.yaml b/charts/molgenis-vault/requirements.yaml new file mode 100644 index 0000000..63b31d4 --- /dev/null +++ b/charts/molgenis-vault/requirements.yaml @@ -0,0 +1,7 @@ +dependencies: + - name: vault-operator + version: ^0.1.1 + repository: https://kubernetes-charts.storage.googleapis.com/ + - name: etcd-operator + version: ^0.8.0 + repository: https://kubernetes-charts.storage.googleapis.com/ \ No newline at end of file diff --git a/charts/molgenis-vault/resources/restore.yaml b/charts/molgenis-vault/resources/restore.yaml new file mode 100644 index 0000000..c7db422 --- /dev/null +++ b/charts/molgenis-vault/resources/restore.yaml @@ -0,0 +1,15 @@ +# Use kubectl create -f restore.yaml to manually execute a restore of the vault +apiVersion: "etcd.database.coreos.com/v1beta2" +kind: "EtcdRestore" +metadata: + # The restore CR name must be the same as spec.etcdCluster.name + name: vault-etcd + namespace: vault-operator +spec: + etcdCluster: + # The namespace is the same as this EtcdRestore CR + name: vault-etcd + backupStorageType: ABS + abs: + path: vault/backup- + absSecret: abs \ No newline at end of file diff --git a/charts/molgenis-vault/resources/vault.yaml b/charts/molgenis-vault/resources/vault.yaml new file mode 100644 index 0000000..fa1c83b --- /dev/null +++ b/charts/molgenis-vault/resources/vault.yaml @@ -0,0 +1,9 @@ +# Use kubectl create -f vault.yaml to manually create a vault +apiVersion: "vault.security.coreos.com/v1alpha1" +kind: "VaultService" +metadata: + name: "vault" + namespace: "vault-operator" +spec: + nodes: 2 + version: "0.9.1-0" \ No newline at end of file diff --git a/charts/molgenis-vault/templates/NOTES.txt b/charts/molgenis-vault/templates/NOTES.txt new file mode 100644 index 0000000..5df45af --- /dev/null +++ b/charts/molgenis-vault/templates/NOTES.txt @@ -0,0 +1,13 @@ +Vault operator created + +Next steps: + +* Manually create a vault using resources/vault.yaml +* Manually restore a backup using resources/backup.yaml +* Unseal the vault pods + +{{ if .Values.backupJob.enable }} +!! Make sure to check if the backups succeed !! +{{ else }} +!!!!!! NO BACKUPS CONFIGURED !!!!!! +{{ end }} \ No newline at end of file diff --git a/charts/molgenis-vault/templates/_helpers.tpl b/charts/molgenis-vault/templates/_helpers.tpl new file mode 100644 index 0000000..5c51ec7 --- /dev/null +++ b/charts/molgenis-vault/templates/_helpers.tpl @@ -0,0 +1,54 @@ +{{/* +Define vault ui fullname +*/}} +{{- define "vault.ui.fullname" -}} +{{- printf "%s-ui" .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Define vault service url for the ui +*/}} +{{- define "vault.service.url" -}} +{{- printf "https://%s:8200" .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* See https://github.com/helm/helm/issues/4535 */}} +{{- define "call-nested" }} +{{- $dot := index . 0 }} +{{- $subchart := index . 1 }} +{{- $template := index . 2 }} +{{- include $template (dict "Chart" (dict "Name" $subchart) "Values" (index $dot.Values $subchart) "Release" $dot.Release "Capabilities" $dot.Capabilities) }} +{{- end }} + +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "molgenis-vault.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "molgenis-vault.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "molgenis-vault.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/charts/molgenis-vault/templates/abs-secret.yaml b/charts/molgenis-vault/templates/abs-secret.yaml new file mode 100644 index 0000000..5f31f41 --- /dev/null +++ b/charts/molgenis-vault/templates/abs-secret.yaml @@ -0,0 +1,10 @@ +# Secret to access microsoft azure blob store +apiVersion: v1 +kind: Secret +metadata: + name: abs +type: Opaque +stringData: + storage-account: {{ .Values.abs.account }} + storage-key: {{ .Values.abs.accessKey }} + cloud: {{ .Values.abs.cloud }} \ No newline at end of file diff --git a/charts/molgenis-vault/templates/backup-configmap.yaml b/charts/molgenis-vault/templates/backup-configmap.yaml new file mode 100644 index 0000000..8eb22d4 --- /dev/null +++ b/charts/molgenis-vault/templates/backup-configmap.yaml @@ -0,0 +1,18 @@ +# configmap to use as a template by the backup cronjob to create etcdbackup instances +apiVersion: v1 +kind: ConfigMap +metadata: + name: backup-config +data: + backup_cr.yaml: | + apiVersion: "etcd.database.coreos.com/v1beta2" + kind: "EtcdBackup" + metadata: + generateName: vault-backup- + spec: + etcdEndpoints: ["https://vault-etcd-client:2379"] + storageType: ABS + clientTLSSecret: vault-etcd-client-tls + abs: + path: vault/backup. + absSecret: abs \ No newline at end of file diff --git a/charts/molgenis-vault/templates/backup-cronjob.yaml b/charts/molgenis-vault/templates/backup-cronjob.yaml new file mode 100644 index 0000000..e5687fc --- /dev/null +++ b/charts/molgenis-vault/templates/backup-cronjob.yaml @@ -0,0 +1,30 @@ +{{- if .Values.backupJob.enable }} +# cronjob that creates etcdbackups using the etcd backup serviceaccount +apiVersion: batch/v1beta1 +kind: CronJob +metadata: + name: etcd-backup +spec: + schedule: {{ .Values.backupJob.schedule | quote }} + jobTemplate: + spec: + template: + spec: + serviceAccountName: {{ include "call-nested" (list . "etcd-operator" "etcd-operator.serviceAccountName") }} + containers: + - name: etcd-backup + image: lachlanevenson/k8s-kubectl + command: + - /bin/sh + - "-ec" + - | + sed -e "s||$(date '+%Y-%m-%d_%H:%M:%S')|g" /var/etcd_backup/backup_cr.yaml | kubectl create -f - + volumeMounts: + - name: backup-config + mountPath: /var/etcd_backup + restartPolicy: OnFailure + volumes: + - name: backup-config + configMap: + name: backup-config +{{- end }} \ No newline at end of file diff --git a/charts/molgenis-vault/templates/ui-ingress.yaml b/charts/molgenis-vault/templates/ui-ingress.yaml new file mode 100644 index 0000000..d8d8e1f --- /dev/null +++ b/charts/molgenis-vault/templates/ui-ingress.yaml @@ -0,0 +1,30 @@ +{{- if .Values.ui.ingress.enabled -}} +{{- $serviceName := include "vault.ui.fullname" . -}} +{{- $servicePort := .Values.ui.service.externalPort -}} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: {{ template "vault.ui.fullname" . }} + labels: + app: {{ template "molgenis-vault.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + {{- range $key, $value := .Values.ui.ingress.annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} +spec: + rules: + - host: {{ .Values.ui.ingress.host }} + http: + paths: + - path: + backend: + serviceName: {{ $serviceName }} + servicePort: {{ $servicePort }} + {{- if .Values.ui.ingress.tls }} + tls: +{{ toYaml .Values.ui.ingress.tls | indent 4 }} + {{- end -}} +{{- end -}} \ No newline at end of file diff --git a/charts/molgenis-vault/templates/ui-service.yaml b/charts/molgenis-vault/templates/ui-service.yaml new file mode 100644 index 0000000..0e26d65 --- /dev/null +++ b/charts/molgenis-vault/templates/ui-service.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "vault.ui.fullname" . }} + labels: + app: {{ template "vault-operator.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.ui.service.type }} + ports: + - port: {{ .Values.ui.service.externalPort }} + targetPort: {{ .Values.ui.service.internalPort }} + protocol: TCP + name: {{ .Values.ui.service.name }} + {{- if .Values.ui.service.nodePort }} + nodePort: {{ .Values.ui.service.nodePort }} + {{- end }} + selector: + app: {{ template "vault-operator.name" . }} + release: {{ .Release.Name }} + component: {{ .Values.ui.name }} \ No newline at end of file diff --git a/charts/molgenis-vault/templates/vault-ui-deployment.yaml b/charts/molgenis-vault/templates/vault-ui-deployment.yaml new file mode 100644 index 0000000..d13a154 --- /dev/null +++ b/charts/molgenis-vault/templates/vault-ui-deployment.yaml @@ -0,0 +1,50 @@ +apiVersion: apps/v1beta1 +kind: Deployment +metadata: + name: {{ template "vault.ui.fullname" . }} + labels: + app: {{ template "vault-operator.name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + component: {{ .Values.ui.name }} +spec: + replicas: {{ .Values.ui.replicaCount }} + template: + metadata: + labels: + app: {{ template "vault-operator.name" . }} + release: {{ .Release.Name }} + component: {{ .Values.ui.name }} + spec: + containers: + - name: {{ .Values.ui.name }} + image: "{{ .Values.ui.image.repository }}:{{ .Values.ui.image.tag }}" + imagePullPolicy: {{ .Values.imagePullPolicy }} + env: + - name: VAULT_URL_DEFAULT + {{- if .Values.ui.vault.url }} + value: {{ .Values.ui.vault.url }} + {{ else }} + value: {{ template "vault.service.url" . }} + {{- end }} + - name: VAULT_AUTH_DEFAULT + value: {{ .Values.ui.vault.auth }} + - name: NODE_TLS_REJECT_UNAUTHORIZED + value: '0' + ports: + - containerPort: {{ .Values.ui.service.internalPort }} + livenessProbe: + httpGet: + path: / + port: {{ .Values.ui.service.internalPort }} + readinessProbe: + httpGet: + path: / + port: {{ .Values.ui.service.internalPort }} + resources: +{{ toYaml .Values.ui.resources | indent 12 }} + {{- if .Values.ui.nodeSelector }} + nodeSelector: +{{ toYaml .Values.ui.nodeSelector | indent 8 }} + {{- end }} \ No newline at end of file diff --git a/charts/molgenis-vault/values.yaml b/charts/molgenis-vault/values.yaml new file mode 100644 index 0000000..aaca8f3 --- /dev/null +++ b/charts/molgenis-vault/values.yaml @@ -0,0 +1,79 @@ +# Default values for molgenis-vault. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +# abs gives details of the credentials to reach the azure backup storage +abs: + # account is the name of the Storage account + account: fdlkops + # access key for the Storage account + accessKey: xxxx + # default cloud + cloud: AzurePublicCloud + +# backupjob describes the backup cronjob +backupJob: + # enable enables the backup job + enable: true + # schedule gives the cron schedule for the backup job + schedule: "0 12 * * 1" + +### +# All of the config variables related to setting up the etcd-operator +# If you want more information about the variables exposed, please visit: +# https://github.com/kubernetes/charts/tree/master/stable/etcd-operator#configuration +### +etcd-operator: + deployments: + etcdOperator: true + backupOperator: true + restoreOperator: true + serviceAccount: + etcdOperatorServiceAccount: + create: true + backupOperatorServiceAccount: + create: true + restoreOperatorServiceAccount: + create: true + etcdOperator: + image: + tag: v0.9.2 + backupOperator: + image: + tag: v0.9.2 + restoreOperator: + image: + tag: v0.9.2 + +ui: + name: "vault-ui" + replicaCount: 1 + image: + repository: djenriquez/vault-ui + tag: latest + service: + name: vault-ui + type: ClusterIP + externalPort: 8000 + internalPort: 8000 + # nodePort: 32001 + ingress: + enabled: true + # Used to create Ingress record (should used with service.type: ClusterIP). + host: vault.molgenis.org + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + #requests: + # cpu: 100m + # memory: 128Mi + nodeSelector: {} + vault: + auth: GITHUB + url: https://vault.vault-operator:8200 \ No newline at end of file diff --git a/charts/molgenis/Chart.yaml b/charts/molgenis/Chart.yaml new file mode 100644 index 0000000..cde7e05 --- /dev/null +++ b/charts/molgenis/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +appVersion: "1.0" +description: MOLGENIS - helm stack (in BETA) +name: molgenis +version: 0.4.3 +sources: +- https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm.git +icon: https://git.webhosting.rug.nl/molgenis/molgenis-ops-docker-helm/raw/master/molgenis/catalogIcon-molgenis.svg \ No newline at end of file diff --git a/charts/molgenis/README.md b/charts/molgenis/README.md new file mode 100644 index 0000000..b45a03d --- /dev/null +++ b/charts/molgenis/README.md @@ -0,0 +1,138 @@ +# MOLGENIS +This chart is used for acceptance and production use cases. + +## Containers +This chart spins up a MOLGENIS instance with HTTPD. The created containers are: + +- MOLGENIS +- ElasticSearch +- PostgreSQL **(optional)** + +## Provisioning +You can choose from which registry you want to pull. There are 2 registries: +- https://registry.molgenis.org +- https://hub.docker.com + +The registry.molgenis.org contains the bleeding edge versions (PR's and master merges). The hub.docker.com contains the released artifacts (MOLGENIS releases and release candidates). + +The three properties you need to specify are: +- ```molgenis.image.repository``` +- ```molgenis.image.name``` +- ```molgenis.image.tag``` + +Besides determining which image you want to pull, you also have to set an administrator password. You can do this by specifying the following property. +- ```molgenis.adminPassword``` + +### Firewall +Is defined at service level you can specify this attribute in the values: + +- ```molgenis.firewall.enabled``` default 'false' + +If set to 'true' the following options are available. One of the options below has to be set. + +- ```molgenis.firewall.umcg.enabled``` default 'false' +- ```molgenis.firewall.cluster.enabled``` default 'false' + +UMCG = only available within the UMCG. +Cluster = only available within the GCC cluster environment. + +## Services +When you start MOLGENIS you need: +- an elasticsearch instance (5.5.6) +- an postgres instance (9.6) + +You can attach additional services like: +- an opencpu instance + +### Elasticsearch +You can configure elasticsearch by giving in the cluster location. + +To configure the transport address you can address the node communication channel but also the native JAVA API. Which MOLGENIS uses to communicate with Elasticsearch. +From Elasticsearch version 6 and further the JAVA API is not supported anymore. At this moment you can only use Elastic instance till major version 5. +- ```molgenis.services.elasticsearch.transportAddresses: localhost:9300``` + +To configure the index on a Elasticsearch cluster you can specify the clusterName property. +- ```molgenis.services.elasticsearch.clusterName: molgenis``` + +### Postgres +You can specify the location of the postgres instance by specify the following property: +- ```molgenis.services.postgres.host: localhost``` + +You can specify the schema by filling out this property: +- ```molgenis.services.postgres.scheme: molgenis``` + +You can specify credentials for the database scheme by specifying the following properties: +- ```molgenis.services.postgres.user: molgenis``` +- ```molgenis.services.postgres.password: molgenis``` + +To test you can use the **PostgreSQL**-helm chart of Kubernetes and specify these answers: + +```bash +# answers for postgresql chart +postgresUser=molgenis +postgresPassword=molgenis +postgresDatabase=molgenis +persistence.enabled=false +``` + +### OpenCPU +You can specify the location of the OpenCPU cluster by specifying this property: +- ```molgenis.services.opencpu.host: localhost``` + +You can test OpenCPU settings using the **OpenCPU**-helm chart of MOLGENIS. + +## Resources +You can specify resources by resource type. There are 2 resource types. +- memory of container +- maximum heap space JVM + +Specify memory usage of container: +- ```molgenis.resources.limits.memory``` + +Specify memory usage for Java JVM: +- ```molgenis.javaOpts.maxHeapSpace``` + +Select the resources you need dependant on the customer you need to serve. + +## Persistence +You can enable persistence on your MOLGENIS stack by specifying the following property. + +- ```persistence.enabled``` default 'true' + +You can also choose to retain the volume of the NFS. +- ```persistence.retain``` default 'false' + +The size and claim name can be specified per service. There are now two services that can be persist. + +- MOLGENIS +- ElasticSearch +- PostgreSQL **(optional)** + +MOLGENIS persistent properties. +- ```molgenis.persistence.claim``` +- ```molgenis.persistence.size``` + +ElasticSearch persistent properties. +- ```elasticsearch.persistence.claim``` +- ```elasticsearch.persistence.size``` + +PostgreSQL persistent properties. +- ```postgres.persistence.claim``` +- ```postgres.persistence.size``` + +### Resolve you persistent volume +You do not know which volume is attached to your MOLGENIS instance. You can resolve this by executing: + +``` +kubectl get pv +``` + +You can now view the persistent volume claims and the attached volumes. + +| NAME | CAPACITY | ACCESS | MODES | RECLAIM | POLICY | STATUS | CLAIM | STORAGECLASS | REASON | AGE | +| ---- | -------- | ------ | ----- | ------- | ------ | ------ | ----- | ------------ | ------ | --- | +| pvc-45988f55-900f-11e8-a0b4-005056a51744 | 30G | RWX | | Retain | Bound | molgenis-solverd/molgenis-nfs-claim | nfs-provisioner-retain | | | 33d | +| pvc-3984723d-220f-14e8-a98a-skjhf88823kk | 30G | RWO | | Delete | Bound | molgenis-test/molgenis-nfs-claim | nfs-provisioner | | | 33d | + +You see the ```molgenis-test/molgenis-nfs-claim``` is bound to the volume: ```pvc-3984723d-220f-14e8-a98a-skjhf88823kk```. +When you want to view the data in the this volume you can go to the nfs-provisioning pod and execute the shell. Go to the directory ```export``` and lookup the directory ```pvc-3984723d-220f-14e8-a98a-skjhf88823kk```. \ No newline at end of file diff --git a/charts/molgenis/catalogIcon-molgenis.svg b/charts/molgenis/catalogIcon-molgenis.svg new file mode 100644 index 0000000..f5e6b5d --- /dev/null +++ b/charts/molgenis/catalogIcon-molgenis.svg @@ -0,0 +1,1024 @@ + + + + diff --git a/charts/molgenis/questions.yml b/charts/molgenis/questions.yml new file mode 100644 index 0000000..f62f9a7 --- /dev/null +++ b/charts/molgenis/questions.yml @@ -0,0 +1,167 @@ + +categories: +- MOLGENIS +questions: +- variable: ingress.hosts[0].name + label: Hostname + default: "test.molgenis.org" + description: "Hostname for your stack" + type: hostname + required: true + group: "Load balancing" +- variable: molgenis.image.repository + label: Registry + default: "registry.hub.docker.com" + description: "Select a registry to pull from" + type: enum + options: + - "registry.hub.docker.com" + - "registry.molgenis.org" + required: true + group: "Provisioning" +- variable: molgenis.image.tag + label: Version + default: "" + description: "Select a MOLGENIS version (check the registry.molgenis.org or hub.docker.com for released tags)" + type: string + required: true + group: "Provisioning" +- variable: molgenis.adminPassword + label: Administrator password + default: "" + description: "Enter an administrator password" + type: password + required: true + group: "Provisioning" +- variable: service.firewall.enabled + label: Firewall enabled + default: false + description: "Firewall enabled (can be cluster or UMCG scoped)" + type: boolean + required: true + group: "Provisioning" + show_subquestion_if: true + subquestions: + - variable: service.firewall.kind + default: "umcg" + description: "Firewall kind. This can be 'umcg' or 'cluster' environment" + type: enum + required: true + options: + - umcg + - cluster + label: Firewall kind +- variable: molgenis.services.opencpu.host + label: OpenCPU cluster + default: "localhost" + description: "Specify the OpenCPU cluster" + type: string + required: true + group: "Services" +- variable: molgenis.services.postgres.embedded + label: Postgres embedded + default: false + description: "Do you want an embedded postgres" + type: boolean + required: true + group: "Services" + show_subquestion_if: false + subquestions: + - variable: molgenis.services.postgres.host + label: Postgres cluster location + default: "" + description: "Set the location of the postgres cluster. This can be localhost when the postgres is enabled else you need to specify a cluster location if you do not want a embedded postgres instance)" + type: string + required: true + group: "Services" + - variable: molgenis.services.postgres.scheme + label: Database scheme + default: "molgenis" + description: "Set the database scheme" + type: string + required: true + group: "Services" + - variable: molgenis.services.postgres.user + label: Database username + default: "molgenis" + description: "Set user of the database scheme" + type: string + required: true + group: "Services" + - variable: molgenis.services.postgres.password + label: Database password + default: "molgenis" + description: "Set the password of the database scheme" + type: string + required: true + group: "Services" +- variable: molgenis.resources.limits.memory + label: Container memory limit + default: 1250Mi + description: "Memory limit for this MOLGENIS container" + type: enum + options: + - "1250Mi" + - "2500Mi" + required: true + group: "Resources" +- variable: molgenis.resources.requests.memory + label: Container memory reservation + default: 1250Mi + description: "Memory reservation for this MOLGENIS container (must fit in the selected memory limit for the container)" + type: enum + options: + - "1250Mi" + - "2500Mi" + required: true + group: "Resources" +- variable: molgenis.javaOpts.maxHeapSpace + label: Maximum heap space (JVM) + default: "1g" + description: "Maximum heap space MOLGENIS container JVM. Please not this should fit in your container memory limit" + type: enum + options: + - "1g" + - "2g" + group: "Resources" +- variable: persistence.enabled + default: true + description: "Do you want to use persistence" + type: boolean + required: true + group: "Persistence" + label: Persistence + show_subquestion_if: true + subquestions: + - variable: persistence.retain + default: false + description: "Do you want to retain the persistent volume" + type: boolean + label: Retain volume + - variable: molgenis.persistence.size + default: "5Gi" + description: "Size of MOLGENIS filestore (PostgreSQL and ElasticSearch excluded)" + type: enum + options: + - "5Gi" + - "10Gi" + - "20Gi" + label: Size MOLGENIS filestore + - variable: elasticsearch.persistence.size + default: "5Gi" + description: "Size of ElasticSearch data (directory that is persist: /usr/share/elasticsearch/data)" + type: enum + options: + - "5Gi" + - "10Gi" + - "50Gi" + label: Size for ElasticSearch data + - variable: postgres.persistence.size + default: "5Gi" + description: "Size of PostgreSQL data (directory that is persist: /var/lib/postgresql/data/pgdata)" + type: enum + options: + - "5Gi" + - "10Gi" + - "50Gi" + label: Size for PostgreSQL data \ No newline at end of file diff --git a/charts/molgenis/templates/NOTES.txt b/charts/molgenis/templates/NOTES.txt new file mode 100644 index 0000000..b5a4d24 --- /dev/null +++ b/charts/molgenis/templates/NOTES.txt @@ -0,0 +1,19 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.ingress.path }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "molgenis.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ template "molgenis.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "molgenis.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "molgenis.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl port-forward $POD_NAME 8080:80 +{{- end }} diff --git a/charts/molgenis/templates/_helpers.tpl b/charts/molgenis/templates/_helpers.tpl new file mode 100644 index 0000000..e7cf3ea --- /dev/null +++ b/charts/molgenis/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "molgenis.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "molgenis.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "molgenis.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/charts/molgenis/templates/deployment.yaml b/charts/molgenis/templates/deployment.yaml new file mode 100644 index 0000000..948f986 --- /dev/null +++ b/charts/molgenis/templates/deployment.yaml @@ -0,0 +1,153 @@ +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + {{- with .Values.ingress.annotations }} + annotations: +{{ toYaml . | indent 4 }} + {{- end }} + name: {{ template "molgenis.fullname" . }} + labels: + app: {{ template "molgenis.name" . }} + chart: {{ template "molgenis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ template "molgenis.name" . }} + release: {{ .Release.Name }} + strategy: + type: Recreate + template: + metadata: + labels: + app: {{ template "molgenis.name" . }} + release: {{ .Release.Name }} + spec: + containers: + - name: molgenis + {{- with .Values.molgenis }} + image: {{ .image.repository }}/{{ .image.name }}:{{ .image.tag }} + imagePullPolicy: {{ .image.pullPolicy }} + env: + - name: molgenis.home + value: /home/molgenis + - name: opencpu.uri.host + value: {{ .services.opencpu.host }} + - name: elasticsearch.transport.addresses + value: {{ .services.elasticsearch.transportAddresses }} + - name: elasticsearch.cluster.name + value: {{ .services.elasticsearch.clusterName }} + - name: db_uri + value: jdbc:postgresql://{{ .services.postgres.host }}/{{ .services.postgres.scheme }} + - name: db_user + value: {{ .services.postgres.user }} + - name: db_password + value: {{ .services.postgres.password }} + - name: admin.password + value: {{ .adminPassword }} + - name: CATALINA_OPTS + value: "-Xmx{{ .javaOpts.maxHeapSpace }} -XX:+UseConcMarkSweepGC -XX:+CMSClassUnloadingEnabled" + ports: + - containerPort: 8080 + {{- if $.Values.persistence.enabled }} + volumeMounts: + - name: molgenis-nfs + mountPath: /home/molgenis + {{- end }} + livenessProbe: + httpGet: + path: / + port: 8080 + initialDelaySeconds: 60 + periodSeconds: 5 + failureThreshold: 25 + successThreshold: 1 + readinessProbe: + httpGet: + path: /api/v2/version + port: 8080 + initialDelaySeconds: 120 + periodSeconds: 30 + failureThreshold: 3 + successThreshold: 1 + resources: +{{ toYaml .resources | indent 12 }} + {{- end }} + + - name: elasticsearch + {{- with .Values.elasticsearch }} + image: "{{ .image.repository }}:{{ .image.tag }}" + imagePullPolicy: {{ .image.pullPolicy }} + env: + - name: cluster.name + value: {{ .clusterName }} + - name: bootstrap.memory_lock + value: "true" + - name: ES_JAVA_OPTS + value: "{{ .javaOpts }}" + - name: xpack.security.enabled + value: "false" + - name: discovery.type + value: single-node + ports: + - containerPort: 9200 + - containerPort: 9300 + {{- if $.Values.persistence.enabled }} + volumeMounts: + - name: elasticsearch-nfs + mountPath: /usr/share/elasticsearch/data + {{- end }} + resources: +{{ toYaml .resources | indent 12 }} + {{- end }} + + - name: postgres + {{- with .Values.postgres }} + image: "{{ .image.repository }}:{{ .image.tag }}" + imagePullPolicy: {{ .image.pullPolicy }} + env: + - name: POSTGRES_USER + value: {{ $.Values.molgenis.services.postgres.user }} + - name: POSTGRES_PASSWORD + value: {{ $.Values.molgenis.services.postgres.password }} + - name: POSTGRES_DB + value: {{ $.Values.molgenis.services.postgres.scheme }} + ports: + - containerPort: 5432 + resources: +{{ toYaml .resources | indent 12 }} + {{- if $.Values.persistence.enabled }} + volumeMounts: + - name: postgres-nfs + mountPath: /var/lib/postgresql/data + {{- end }} + {{- end }} + + +{{- if .Values.persistence.enabled }} + volumes: + - name: molgenis-nfs + persistentVolumeClaim: + claimName: {{ .Values.molgenis.persistence.claim }} + - name: elasticsearch-nfs + persistentVolumeClaim: + claimName: {{ .Values.elasticsearch.persistence.claim }} + - name: postgres-nfs + persistentVolumeClaim: + claimName: {{ .Values.postgres.persistence.claim }} +{{- end }} + + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} diff --git a/charts/molgenis/templates/ingress.yaml b/charts/molgenis/templates/ingress.yaml new file mode 100644 index 0000000..2434a42 --- /dev/null +++ b/charts/molgenis/templates/ingress.yaml @@ -0,0 +1,38 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "molgenis.fullname" . -}} +{{- $ingressPath := .Values.ingress.path -}} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: "{{ $.Release.Name }}-ingress" + labels: + app: {{ template "molgenis.name" . }} + chart: {{ template "molgenis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- with .Values.ingress.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +spec: +{{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} +{{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .name }} + http: + paths: + - path: {{ $ingressPath }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $.Values.service.port }} + {{- end }} +{{- end }} diff --git a/charts/molgenis/templates/persistence/elasticsearchPVC.yaml b/charts/molgenis/templates/persistence/elasticsearchPVC.yaml new file mode 100644 index 0000000..6c8bef7 --- /dev/null +++ b/charts/molgenis/templates/persistence/elasticsearchPVC.yaml @@ -0,0 +1,19 @@ +{{- if .Values.persistence.enabled -}} +apiVersion: extensions/v1beta1 +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ .Values.elasticsearch.persistence.claim }} + annotations: + {{- if .Values.persistence.retain }} + volume.beta.kubernetes.io/storage-class: "nfs-provisioner-retain" + {{- else }} + volume.beta.kubernetes.io/storage-class: "nfs-provisioner" + {{- end }} +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: {{ .Values.elasticsearch.persistence.size }} +{{- end }} \ No newline at end of file diff --git a/charts/molgenis/templates/persistence/molgenisPVC.yaml b/charts/molgenis/templates/persistence/molgenisPVC.yaml new file mode 100644 index 0000000..6ec2f93 --- /dev/null +++ b/charts/molgenis/templates/persistence/molgenisPVC.yaml @@ -0,0 +1,19 @@ +{{- if .Values.persistence.enabled -}} +apiVersion: extensions/v1beta1 +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ .Values.molgenis.persistence.claim }} + annotations: + {{- if .Values.persistence.retain }} + volume.beta.kubernetes.io/storage-class: "nfs-provisioner-retain" + {{- else }} + volume.beta.kubernetes.io/storage-class: "nfs-provisioner" + {{- end }} +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: {{ .Values.molgenis.persistence.size }} +{{- end }} \ No newline at end of file diff --git a/charts/molgenis/templates/persistence/postgresPVC.yaml b/charts/molgenis/templates/persistence/postgresPVC.yaml new file mode 100644 index 0000000..4e0cfcc --- /dev/null +++ b/charts/molgenis/templates/persistence/postgresPVC.yaml @@ -0,0 +1,21 @@ +{{- if .Values.molgenis.services.postgres.embedded }} +{{- if .Values.persistence.enabled }} +apiVersion: extensions/v1beta1 +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ .Values.postgres.persistence.claim }} + annotations: + {{- if .Values.persistence.retain }} + volume.beta.kubernetes.io/storage-class: "nfs-provisioner-retain" + {{- else }} + volume.beta.kubernetes.io/storage-class: "nfs-provisioner" + {{- end }} +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: {{ .Values.postgres.persistence.size }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/molgenis/templates/service.yaml b/charts/molgenis/templates/service.yaml new file mode 100644 index 0000000..f9b9d85 --- /dev/null +++ b/charts/molgenis/templates/service.yaml @@ -0,0 +1,29 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "molgenis.fullname" . }} + labels: + app: {{ template "molgenis.name" . }} + chart: {{ template "molgenis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.service.type }} +{{- if .Values.service.firewall.enabled }} + loadBalancerSourceRanges: +{{- if .Values.service.firewall.kind eq "umcg" }} + {{- range $index, $rule := .Values.service.firewall.umcg.rules }} + - {{ $rule }} + {{- end }} +{{- else }} + {{- range $index, $rule := .Values.service.firewall.cluster.rules }} + - {{ $rule }} + {{- end }} +{{- end }} +{{- end }} + ports: + - name: molgenis + port: {{ .Values.service.port }} + selector: + app: {{ template "molgenis.name" . }} + release: {{ .Release.Name }} diff --git a/charts/molgenis/values.yaml b/charts/molgenis/values.yaml new file mode 100644 index 0000000..c9fa30c --- /dev/null +++ b/charts/molgenis/values.yaml @@ -0,0 +1,103 @@ +# Default values for molgenis. + +replicaCount: 1 + +service: + type: LoadBalancer + firewall: + enabled: false + kind: "umcg" + umcg: + rules: + - 127.0.0.1/32 + cluster: + rules: + - 127.0.0.1/32 + port: 8080 + +ingress: + enabled: true + annotations: + nginx.ingress.kubernetes.io/proxy-body-size: "0" + path: / + hosts: + - name: test.molgenis.org + tls: [] + +molgenis: + image: + repository: registry.hub.docker.com + name: molgenis/molgenis-app + tag: stable + pullPolicy: Always + adminPassword: + javaOpts: + maxHeapSpace: "1g" + resources: + limits: + cpu: 1 + memory: 1250Mi + requests: + cpu: 200m + memory: 1250Mi + persistence: + claim: molgenis-nfs-claim + size: 5Gi + services: + opencpu: + host: localhost + elasticsearch: + transportAddresses: localhost:9300 + clusterName: molgenis + postgres: + embedded: false + host: localhost + scheme: molgenis + user: molgenis + password: molgenis + +elasticsearch: + image: + repository: docker.elastic.co/elasticsearch/elasticsearch + tag: 5.5.3 + pullPolicy: IfNotPresent + javaOpts: "-Xms1g -Xmx1g" + clusterName: molgenis + resources: + limits: + cpu: 2 + memory: 3Gi + requests: + cpu: 100m + memory: 1Gi + persistence: + claim: elasticsearch-nfs-claim + size: 5Gi + +postgres: + image: + repository: postgres + tag: 9.6-alpine + pullPolicy: IfNotPresent + resources: + limits: + cpu: 1 + memory: 250Mi + requests: + cpu: 100m + memory: 250Mi + persistence: + claim: postgres-nfs-claim + size: 5Gi + +persistence: + enabled: true + retain: false + +nodeSelector: { + deployPod: "true" +} + +tolerations: [] + +affinity: {}