Skip to content

Commit bdbe915

Browse files
netanelCnetanelC
committed
feat: initial commit
0 parents  commit bdbe915

39 files changed

+1251
-0
lines changed

‎.github/workflows/build-and-push-helm.yaml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Build and Push Helm Chart
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
permissions:
8+
contents: write
9+
packages: write
10+
11+
jobs:
12+
push-helm-package:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout Repository
16+
uses: actions/checkout@v5
17+
18+
- name: Derive domain, chart name and chart version from release
19+
id: chart_metadata
20+
env:
21+
# The release tag that triggered this workflow, e.g. "infra-jenkins-v5.8.63"
22+
TAG_NAME: ${{ github.event.release.tag_name }}
23+
run: |
24+
set -euo pipefail
25+
26+
# Expect tag format: <chart-name>-v<version>
27+
[[ "$TAG_NAME" =~ ^([a-zA-Z0-9._-]+)-v?([0-9][0-9A-Za-z.+-]*)$ ]]
28+
CHART_NAME="${BASH_REMATCH[1]}"
29+
CHART_VERSION="${BASH_REMATCH[2]}"
30+
31+
# Extract domain from Chart.yaml annotations
32+
DOMAIN=$(yq e -r '.annotations.domain' "$CHART_NAME/Chart.yaml")
33+
34+
# Expose values to later steps
35+
{
36+
echo "chart_name=$CHART_NAME"
37+
echo "version=$CHART_VERSION"
38+
echo "domain=$DOMAIN"
39+
} >> "$GITHUB_OUTPUT"
40+
41+
- name: Set up Helm
42+
uses: azure/setup-helm@v4
43+
44+
- name: Push Chart to ACR
45+
uses: appany/[email protected]
46+
with:
47+
name: ${{ steps.chart_metadata.outputs.chart_name }}
48+
repository: helm/${{ steps.chart_metadata.outputs.domain }}
49+
tag: ${{ steps.chart_metadata.outputs.version }}
50+
path: ./${{ steps.chart_metadata.outputs.chart_name }}
51+
registry: ${{ secrets.ACR_URL }}
52+
registry_username: ${{ secrets.ACR_PUSH_USER }}
53+
registry_password: ${{ secrets.ACR_PUSH_TOKEN }}
54+
update_dependencies: 'true' # Defaults to false
55+
56+
- name: Update Helm Package in artifacts.json
57+
uses: MapColonies/shared-workflows/actions/update-artifacts-file@update-artifacts-file-v1
58+
with:
59+
domain: ${{ steps.chart_metadata.outputs.domain }}
60+
type: helm
61+
artifact_name: ${{ steps.chart_metadata.outputs.chart_name }}
62+
artifact_tag: ${{ steps.chart_metadata.outputs.version }}
63+
registry: ${{ secrets.ACR_URL }}
64+
github_token: ${{ secrets.GH_PAT }}

‎.github/workflows/release-please.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: Release shared-workflows
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
jobs:
9+
release-please:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: googleapis/release-please-action@v4

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
*.tgz
2+
node_modules
3+
Chart.lock

‎.release-please-manifest.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{}

‎core-stack/Chart.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: v2
2+
name: infra-core-stack
3+
description: A Helm chart for deploying MinIO, Redis, and PostgreSQL
4+
annotations:
5+
domain: infra
6+
version: 0.1.0
7+
dependencies:
8+
- name: minio
9+
version: 14.7.0
10+
repository: https://charts.bitnami.com/bitnami
11+
condition: minio.enabled
12+
- name: redis
13+
version: 18.5.0
14+
repository: https://charts.bitnami.com/bitnami
15+
condition: redis.enabled
16+
- name: postgresql
17+
version: 13.1.0
18+
repository: https://charts.bitnami.com/bitnami
19+
condition: postgresql.enabled
20+
- name: elasticsearch
21+
version: 21.3.0
22+
repository: https://charts.bitnami.com/bitnami
23+
condition: elasticsearch.enabled

‎core-stack/templates/minio-lb-service.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: minio-lb
5+
labels:
6+
app.kubernetes.io/name: {{ .Release.Name }}
7+
app.kubernetes.io/instance: {{ .Release.Name }}
8+
app.kubernetes.io/managed-by: {{ .Release.Service }}
9+
{{ include "common-labels-and-annotations.serviceLabels" . | nindent 4 }}
10+
annotations:
11+
{{ include "common-labels-and-annotations.serviceAnnotations" . | nindent 4 }}
12+
spec:
13+
type: LoadBalancer
14+
selector:
15+
app.kubernetes.io/name: "minio"
16+
app.kubernetes.io/instance: {{ .Release.Name }}
17+
18+
ports:
19+
- protocol: TCP
20+
port: {{ .Values.minio.service.port }}
21+
targetPort: {{ .Values.minio.service.targetPort }}

‎core-stack/values.yaml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
global:
2+
3+
minio:
4+
enabled: true
5+
auth:
6+
rootUser: minio
7+
rootPassword: minio123
8+
persistence:
9+
size: 10Gi
10+
resources:
11+
limits:
12+
cpu: 1
13+
memory: 2Gi
14+
requests:
15+
cpu: 500m
16+
memory: 1Gi
17+
service:
18+
port: 9001
19+
targetPort: 9001
20+
commonLabels:
21+
mapcolonies.io/environment: "production"
22+
mapcolonies.io/component: "infrastructure"
23+
mapcolonies.io/part-of: "core-stack"
24+
mapcolonies.io/owner: "infra"
25+
26+
redis:
27+
enabled: true
28+
metrics:
29+
enabled: true
30+
containerSecurityContext:
31+
enabled: false
32+
runAsUser: 1000870000
33+
architecture: standalone
34+
auth:
35+
enabled: true
36+
password: password
37+
commonConfiguration: |-
38+
# Enable AOF https:redis.io/topics/persistence#append-only-file
39+
appendonly no
40+
protected-mode no
41+
# Disable RDB https, AOF persistence already enabled.
42+
save ""
43+
debug: false
44+
image:
45+
registry: docker.io
46+
repository: bitnami/redis
47+
tag: 7.2.1
48+
commonLabels:
49+
mapcolonies.io/environment: "production"
50+
mapcolonies.io/component: "infrastructure"
51+
mapcolonies.io/part-of: "core-stack"
52+
mapcolonies.io/owner: "infra"
53+
master:
54+
configuration: |
55+
maxmemory 5gb
56+
maxmemory-policy allkeys-lfu
57+
containerSecurityContext:
58+
enabled: false
59+
runAsUser: 1000870000
60+
count: 1
61+
disableCommands:
62+
- FLUSHALL
63+
kind: StatefulSet
64+
persistence:
65+
accessModes:
66+
- ReadWriteOnce
67+
enabled: false
68+
size: 1Gi
69+
podLabels:
70+
app: redis
71+
role: master
72+
podSecurityContext:
73+
enabled: false
74+
fsGroup: 1000870000
75+
resources:
76+
limits:
77+
cpu: 0.5
78+
memory: 5.5Gi
79+
requests:
80+
cpu: 0.125
81+
memory: 5.5Gi
82+
pullPolicy: Always
83+
serviceAccount:
84+
create: false
85+
86+
elasticsearch:
87+
enabled: true
88+
image:
89+
tag: 8.16.1-debian-12-r1
90+
91+
commonLabels:
92+
mapcolonies.io/environment: "production"
93+
mapcolonies.io/component: "infrastructure"
94+
mapcolonies.io/part-of: "core-stack"
95+
mapcolonies.io/owner: "infra"
96+
97+
master:
98+
containerSecurityContext:
99+
enabled: false
100+
podSecurityContext:
101+
enabled: false
102+
103+
coordinating:
104+
containerSecurityContext:
105+
enabled: false
106+
podSecurityContext:
107+
enabled: false
108+
109+
data:
110+
containerSecurityContext:
111+
enabled: false
112+
podSecurityContext:
113+
enabled: false
114+
115+
ingest:
116+
containerSecurityContext:
117+
enabled: false
118+
podSecurityContext:
119+
enabled: false
120+
121+
extraEnvVars:
122+
- name: ELASTIC_USERNAME
123+
value: elastic
124+
- name: ELASTIC_PASSWORD
125+
value: adminpassword
126+
127+
sysctlImage:
128+
enabled: false

‎gatekeeper-constraints/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v2
2+
name: gatekeeper-constraints
3+
description: Deploy Gatekeeper ConstraintTemplates and Constraints
4+
type: application
5+
version: 0.1.0

‎gatekeeper-constraints/README.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# gatekeeper-constraints
2+
3+
Helm chart for Gatekeeper rules that make sure Pods have the right **labels** and **annotations**.
4+
5+
## ⚙️ What it does
6+
7+
- ✅ Checks Pods for required labels and annotations
8+
- ⚠️ Runs in **WARN (audit-only)** mode by default (shows violations, doesn’t block deploys)
9+
- 🔧 Fully configurable in `values.yaml`
10+
11+
## 🛠️ Checks
12+
Fully configurable in `values.yaml`
13+
14+
**Annotations**
15+
- `prometheus.io/path`
16+
- `prometheus.io/port`
17+
- `prometheus.io/scrape`
18+
19+
**Labels**
20+
- `app.kubernetes.io/name`
21+
- `app.kubernetes.io/instance`
22+
- `app.kubernetes.io/version`
23+
- `app.kubernetes.io/managed-by`
24+
- `mapcolonies.io/part-of`
25+
- `mapcolonies.io/owner`
26+
- `mapcolonies.io/environment`
27+
- `mapcolonies.io/component`
28+
29+
## 🔍 See Violations
30+
31+
- In the **OCP console** → open the `Constraint` resource under the `CustomResourceDefinitions` tab.
32+
- Or via CLI:
33+
```bash
34+
kubectl get K8sRequiredLabels.require-pod-labels -o yaml
35+
kubectl get K8sRequiredAnnotations.require-pod-annotations -o yaml
36+
```

‎gatekeeper-constraints/templates/constraint-k8srequiredannotations.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if .Values.constraints.k8sRequiredAnnotations.enabled }}
2+
apiVersion: constraints.gatekeeper.sh/v1beta1
3+
kind: K8sRequiredAnnotations
4+
metadata:
5+
name: require-pod-annotations
6+
spec:
7+
enforcementAction: {{ .Values.constraints.k8sRequiredAnnotations.enforcementAction | quote }}
8+
match:
9+
kinds:
10+
- apiGroups: [""]
11+
kinds: ["Pod"]
12+
{{- if .Values.namespaces }}
13+
namespaces:
14+
{{ toYaml .Values.namespaces | nindent 6 }}
15+
{{- end }}
16+
parameters:
17+
annotations:
18+
{{- with .Values.constraints.k8sRequiredAnnotations.annotations }}
19+
{{ toYaml . | nindent 6 }}
20+
{{- end }}
21+
{{- end }}

0 commit comments

Comments
 (0)