Skip to content

Commit 6c5ecf6

Browse files
ybelMekktommytroen
ybelMekk
and
tommytroen
committed
feat: feature yml, helm charts
* added config use envs * workflow for deploy to fasit Co-authored-by: Tommy Trøen <[email protected]>
1 parent 805be71 commit 6c5ecf6

File tree

21 files changed

+446
-18
lines changed

21 files changed

+446
-18
lines changed

‎.github/workflows/main.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Build and deploy
2+
on:
3+
push:
4+
branches:
5+
- main
6+
paths-ignore:
7+
- '*.md'
8+
- 'LICENSE.md'
9+
env:
10+
NAME: v13s
11+
FEATURE_REPOSITORY: oci://europe-north1-docker.pkg.dev/nais-io/nais/feature
12+
13+
jobs:
14+
go_version:
15+
outputs:
16+
go_version: ${{ steps.go_version.outputs.GO_VERSION }}
17+
runs-on: ubuntu-22.04
18+
steps:
19+
- uses: actions/checkout@v4
20+
- name: Find Go version
21+
id: go_version
22+
run: |
23+
echo "GO_VERSION=$(grep golang .tool-versions | awk '{print $2}')" >> $GITHUB_OUTPUT
24+
tests:
25+
if: github.ref == 'refs/heads/main'
26+
runs-on: ubuntu-24.04
27+
needs: go_version
28+
steps:
29+
- uses: actions/checkout@v4
30+
- uses: actions/setup-go@v5
31+
with:
32+
go-version: ${{ needs.go_version.outputs.go_version }}
33+
cache-dependency-path: ./go.sum
34+
35+
# - name: Check for vulnerable dependencies and static code
36+
# run: make check
37+
38+
- name: Run tests
39+
run: make test
40+
41+
build_and_push:
42+
outputs:
43+
version: ${{ steps.build-push-sign.outputs.version }}
44+
needs:
45+
- tests
46+
permissions:
47+
contents: "read"
48+
id-token: "write"
49+
name: build and push
50+
runs-on: ubuntu-24.04
51+
steps:
52+
- uses: actions/checkout@v4
53+
54+
- name: Build push v13s image
55+
uses: nais/platform-build-push-sign@main
56+
id: build-push-sign
57+
with:
58+
name: ${{ env.NAME }}
59+
google_service_account: gh-${{ env.NAME }}
60+
workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
61+
push: true
62+
63+
- name: Update values.yaml
64+
run: |-
65+
yq e '.image.tag = "${{ steps.build-push-sign.outputs.version }}"' -i ./charts/values.yaml
66+
67+
- uses: azure/setup-helm@v4
68+
name: "Setup Helm"
69+
with:
70+
version: "v3.15.1"
71+
72+
- name: Build Chart
73+
run: |-
74+
yq e '.version = "${{ steps.build-push-sign.outputs.version }}"' -i charts/Chart.yaml
75+
helm package charts
76+
77+
- name: Push Chart
78+
run: |-
79+
helm push ${{ env.NAME }}*.tgz ${{ env.FEATURE_REPOSITORY }}
80+
81+
rollout:
82+
needs:
83+
- build_and_push
84+
runs-on: fasit-deploy
85+
permissions:
86+
id-token: write
87+
steps:
88+
- uses: nais/fasit-deploy@v2
89+
with:
90+
chart: ${{ env.FEATURE_REPOSITORY }}/${{ env.NAME }}
91+
version: ${{ needs.build_and_push.outputs.version }}

‎.tool-versions‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@ golang 1.23.5
22
protoc-gen-go-grpc 1.5.1
33
protoc-gen-go 1.36.3
44
protoc 29.3
5+
helm 3.15.1

‎Dockerfile‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
FROM cgr.dev/chainguard/go:latest AS builder
2+
ENV GOOS=linux
3+
ENV CGO_ENABLED=0
4+
ENV GO111MODULE=on
5+
RUN go version
6+
COPY . /src
7+
WORKDIR /src
8+
RUN go mod download
9+
RUN go build -a -installsuffix cgo -o /bin/api cmd/api/main.go
10+
11+
FROM cgr.dev/chainguard/static:latest
12+
WORKDIR /app
13+
COPY --from=builder /bin/api /api
14+
ENTRYPOINT ["/api"]

‎charts/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/Chart.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v2
2+
name: v13s
3+
icon: https://slsa.dev/images/slsa-dancing-goose-logo.svg
4+
sources:
5+
- https://github.com/nais/v13s/tree/main/charts
6+
description: v13s is an api for vulnerabilities data across multiple sources
7+
type: application
8+
version: 0.1.0

‎charts/Feature.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
environmentKinds:
2+
- management
3+
values:
4+
5+
image.tag:
6+
displayName: Image tag
7+
config:
8+
type: string
9+
10+
dependencytrack.apikey:
11+
displayName: dependencytrack API key
12+
config:
13+
type: string
14+
required: true
15+
16+
dependencytrack.url:
17+
displayName: dependencytrack URL
18+
computed:
19+
template: "http://dependencytrack-backend:8080"
20+
config:
21+
type: string
22+
23+
database.instance:
24+
displayName: Cloud SQL instance name
25+
description: The name of the Cloud SQL instance
26+
computed:
27+
template: |
28+
{{ .Env.v13s_db_instance | quote }}
29+
30+
database.name:
31+
displayName: Database name
32+
description: The name of the database
33+
computed:
34+
template: |
35+
{{ .Env.v13s_db_name | quote }}
36+
37+
database.user:
38+
displayName: Database username
39+
description: The username for the database
40+
computed:
41+
template: |
42+
{{ .Env.v13s_db_user | quote }}
43+
44+
database.password:
45+
displayName: Database password
46+
description: The password for the database
47+
computed:
48+
template: |
49+
{{ .Env.v13s_db_password | quote }}
50+
51+
serviceAccountEmail:
52+
displayName: Google service account email
53+
computed:
54+
template:
55+
{{.Env.v13s_serviceaccount_email | quote}}

‎charts/templates/_helpers.tpl‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "v13s.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{- define "dependencytrack.name" -}}
9+
{{- default "dependencytrack" }}
10+
{{- end }}
11+
12+
{{/*
13+
{{- end }}
14+
15+
{{/*
16+
Create a default fully qualified app name.
17+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
18+
If release name contains chart name it will be used as a full name.
19+
*/}}
20+
{{- define "v13s.fullname" -}}
21+
{{- if .Values.fullnameOverride }}
22+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
23+
{{- else }}
24+
{{- $name := default .Chart.Name .Values.nameOverride }}
25+
{{- if contains $name .Release.Name }}
26+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
27+
{{- else }}
28+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
29+
{{- end }}
30+
{{- end }}
31+
{{- end }}
32+
33+
{{/*
34+
Create chart name and version as used by the chart label.
35+
*/}}
36+
{{- define "v13s.chart" -}}
37+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
38+
{{- end }}
39+
40+
{{/*
41+
Common labels
42+
*/}}
43+
{{- define "v13s.labels" -}}
44+
helm.sh/chart: {{ include "v13s.chart" . }}
45+
{{ include "v13s.selectorLabels" . }}
46+
{{- if .Chart.AppVersion }}
47+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
48+
{{- end }}
49+
app.kubernetes.io/managed-by: {{ .Release.Service }}
50+
{{- end }}
51+
{{- define "dependencytrack.selectorLabels" -}}
52+
app.kubernetes.io/name: {{ include "dependencytrack.name" . }}
53+
app.kubernetes.io/instance: {{ include "dependencytrack.name" . }}-backend
54+
{{- end }}
55+
56+
{{/*
57+
Selector labels
58+
*/}}
59+
{{- define "v13s.selectorLabels" -}}
60+
app.kubernetes.io/name: {{ include "v13s.name" . }}
61+
app.kubernetes.io/instance: {{ .Release.Name }}
62+
{{- end }}

‎charts/templates/deployment.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "v13s.fullname" . }}
5+
labels:
6+
{{- include "v13s.labels" . | nindent 4 }}
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
{{- include "v13s.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
labels:
15+
{{- include "v13s.selectorLabels" . | nindent 8 }}
16+
annotations:
17+
kubectl.kubernetes.io/default-container: {{ .Chart.Name }}
18+
spec:
19+
serviceAccountName: {{ include "v13s.name" . }}
20+
securityContext:
21+
seccompProfile:
22+
type: RuntimeDefault
23+
runAsUser: 1000
24+
runAsGroup: 1000
25+
fsGroup: 1000
26+
containers:
27+
- name: {{ .Chart.Name }}
28+
image: "{{ .Values.image.repository }}/{{ .Values.image.name }}:{{ .Values.image.tag }}"
29+
imagePullPolicy: Always
30+
envFrom:
31+
- secretRef:
32+
name: {{ include "v13s.fullname" . }}
33+
securityContext:
34+
runAsNonRoot: true
35+
runAsUser: 1000
36+
runAsGroup: 1000
37+
allowPrivilegeEscalation: false
38+
readOnlyRootFilesystem: true
39+
capabilities:
40+
drop:
41+
- ALL
42+
ports:
43+
- name: grpc
44+
containerPort: 50051
45+
protocol: TCP
46+
- name: http-metrics
47+
containerPort: 8000
48+
protocol: TCP
49+
resources:
50+
{{- toYaml .Values.resources | nindent 12 }}
51+
- name: cloud-sql-proxy
52+
image: {{ .Values.image.cloudsql_proxy }}
53+
command:
54+
- "/cloud_sql_proxy"
55+
- "-log_debug_stdout"
56+
- "-instances={{ .Values.database.instance }}=tcp:5432"
57+
securityContext:
58+
runAsNonRoot: true
59+
runAsUser: 1000
60+
runAsGroup: 1000
61+
allowPrivilegeEscalation: false
62+
readOnlyRootFilesystem: true
63+
capabilities:
64+
drop:
65+
- ALL
66+
resources:
67+
requests:
68+
memory: "256Mi"
69+
cpu: "0.22"

‎charts/templates/netpol.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: NetworkPolicy
3+
metadata:
4+
name: {{ include "v13s.fullname" . }}
5+
spec:
6+
egress:
7+
- ports:
8+
- port: 443
9+
protocol: TCP
10+
- port: 80
11+
protocol: TCP
12+
- to:
13+
- namespaceSelector: { }
14+
podSelector:
15+
matchLabels:
16+
k8s-app: kube-dns
17+
- to:
18+
- podSelector:
19+
matchLabels:
20+
{{- include "dependencytrack.selectorLabels" . | nindent 14 }}
21+
podSelector:
22+
matchLabels:
23+
app.kubernetes.io/instance: {{ .Release.Name }}
24+
policyTypes:
25+
- Egress
26+
---

‎charts/templates/sa.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: {{ include "v13s.name" . }}
5+
labels:
6+
{{- include "v13s.labels" . | nindent 4 }}
7+
annotations:
8+
iam.gke.io/gcp-service-account: {{ .Values.serviceAccountEmail }}

0 commit comments

Comments
 (0)