improved helm chart

2026-04-05 09:40:38 +00:00 · 2025-03-23 17:05:04 +01:00
parent 3d4cf1ae34
commit 3c21d77641
9 changed files with 515 additions and 58 deletions
--- a/charts/donetick/templates/configmap.yaml
+++ b/charts/donetick/templates/configmap.yaml
@ -16,41 +16,61 @@ data:
    database:
      type: {{ .Values.config.database.type | default "sqlite" | quote }}
      migration: {{ .Values.config.database.migration }}
-      host: {{ .Values.config.database.host | default "secret" | quote }}
-      port: {{ .Values.config.database.port | default 5432 }}
-      user: {{ .Values.config.database.user | default "secret" | quote }}
-      password: {{ .Values.config.database.password | default "secret" | quote }}
-      name: {{ .Values.config.database.name | default "secret" | quote }}
+      {{- if .Values.config.database.migration_skip }}
+      migration_skip: {{ .Values.config.database.migration_skip }}
+      {{- end }}
+      {{- if .Values.config.database.migration_retry }}
+      migration_retry: {{ .Values.config.database.migration_retry }}
+      {{- end }}
+      {{- if eq .Values.config.database.type "postgres" }}
+      {{- if not .Values.config.database.existingSecret }}
+      host: {{ .Values.config.database.host | quote }}
+      port: {{ .Values.config.database.port }}
+      user: {{ .Values.config.database.user | quote }}
+      password: {{ .Values.config.database.password | quote }}
+      name: {{ .Values.config.database.name | quote }}
+      {{- else }}
+      # Database credentials will be injected via environment variables from Secret
+      {{- end }}
+      {{- end }}
    jwt:
+      {{- if .Values.config.jwt.existingSecret }}
+      # Secret will be injected from Secret
+      {{- else }}
      secret: {{ .Values.config.jwt.secret | quote }}
-      session_time: {{ .Values.config.jwt.session_time | default "168h" | quote }}
-      max_refresh: {{ .Values.config.jwt.max_refresh | default "168h" | quote }}
+      {{- end }}
+      session_time: {{ .Values.config.jwt.session_time | quote }}
+      max_refresh: {{ .Values.config.jwt.max_refresh | quote }}
    server:
-      port: {{ .Values.config.server.port | default 2021 }}
-      read_timeout: {{ .Values.config.server.read_timeout | default "10s" | quote }}
-      write_timeout: {{ .Values.config.server.write_timeout | default "10s" | quote }}
-      rate_period: {{ .Values.config.server.rate_period | default "60s" | quote }}
-      rate_limit: {{ .Values.config.server.rate_limit | default 300 }}
+      port: {{ .Values.config.server.port }}
+      read_timeout: {{ .Values.config.server.read_timeout | quote }}
+      write_timeout: {{ .Values.config.server.write_timeout | quote }}
+      rate_period: {{ .Values.config.server.rate_period | quote }}
+      rate_limit: {{ .Values.config.server.rate_limit }}
      cors_allow_origins:
        {{- range .Values.config.server.cors_allow_origins }}
        - {{ . | quote }}
        {{- end }}
-      serve_frontend: {{ .Values.config.server.serve_frontend | default true }}
+      serve_frontend: {{ .Values.config.server.serve_frontend }}
    scheduler_jobs:
-      due_job: {{ .Values.config.scheduler_jobs.due_job | default "30m" | quote }}
-      overdue_job: {{ .Values.config.scheduler_jobs.overdue_job | default "3h" | quote }}
-      pre_due_job: {{ .Values.config.scheduler_jobs.pre_due_job | default "3h" | quote }}
+      due_job: {{ .Values.config.scheduler_jobs.due_job | quote }}
+      overdue_job: {{ .Values.config.scheduler_jobs.overdue_job | quote }}
+      pre_due_job: {{ .Values.config.scheduler_jobs.pre_due_job | quote }}
    email:
-      host: {{ .Values.config.email.host | quote }}
-      port: {{ .Values.config.email.port | quote }}
-      key: {{ .Values.config.email.key | quote }}
-      email: {{ .Values.config.email.email | quote }}
-      appHost: {{ .Values.config.email.appHost | quote }}
+      host: {{ .Values.config.email.host | default "" | quote }}
+      port: {{ .Values.config.email.port | default "" | quote }}
+      key: {{ .Values.config.email.key | default "" | quote }}
+      email: {{ .Values.config.email.email | default "" | quote }}
+      appHost: {{ .Values.config.email.appHost | default "" | quote }}
    oauth2:
-      client_id: {{ .Values.config.oauth2.client_id | quote }}
-      client_secret: {{ .Values.config.oauth2.client_secret | quote }}
-      auth_url: {{ .Values.config.oauth2.auth_url | quote }}
-      token_url: {{ .Values.config.oauth2.token_url | quote }}
-      user_info_url: {{ .Values.config.oauth2.user_info_url | quote }}
-      redirect_url: {{ .Values.config.oauth2.redirect_url | quote }}
-      name: {{ .Values.config.oauth2.name | quote }}
+      {{- if .Values.config.oauth2.existingSecret }}
+      # Client ID and Secret will be injected from Secret
+      {{- else }}
+      client_id: {{ .Values.config.oauth2.client_id | default "" | quote }}
+      client_secret: {{ .Values.config.oauth2.client_secret | default "" | quote }}
+      {{- end }}
+      auth_url: {{ .Values.config.oauth2.auth_url | default "" | quote }}
+      token_url: {{ .Values.config.oauth2.token_url | default "" | quote }}
+      user_info_url: {{ .Values.config.oauth2.user_info_url | default "" | quote }}
+      redirect_url: {{ .Values.config.oauth2.redirect_url | default "" | quote }}
+      name: {{ .Values.config.oauth2.name | default "" | quote }}
--- a/charts/donetick/templates/deployment.yaml
+++ b/charts/donetick/templates/deployment.yaml
@ -4,35 +4,144 @@ metadata:
  name: {{ include "donetick.fullname" . }}
  labels:
    {{- include "donetick.labels" . | nindent 4 }}
+  annotations:
+    checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+    checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
 spec:
  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
  selector:
    matchLabels:
      {{- include "donetick.selectorLabels" . | nindent 6 }}
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
  template:
    metadata:
      labels:
        {{- include "donetick.selectorLabels" . | nindent 8 }}
+      annotations:
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command: ["/donetick"]
+          {{- if .Values.startupArgs }}
+          args:
+            {{- range .Values.startupArgs }}
+            - {{ . | quote }}
+            {{- end }}
+          {{- end }}
          ports:
            - name: http
-              containerPort: 2021
+              containerPort: {{ .Values.config.server.port }}
              protocol: TCP
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
+            successThreshold: {{ .Values.probes.liveness.successThreshold }}
+          {{- end }}
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: http
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
+            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
+            successThreshold: {{ .Values.probes.readiness.successThreshold }}
+          {{- end }}
          env:
          {{- range .Values.env }}
            - name: {{ .name }}
              value: {{ .value | quote }}
          {{- end }}
+          {{- if or .Values.config.jwt.existingSecret .Values.config.oauth2.existingSecret .Values.config.database.existingSecret }}
+            # Secret-based environment variables
+            {{- if .Values.config.jwt.existingSecret }}
+            - name: DT_JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.jwt.existingSecret }}
+                  key: {{ .Values.config.jwt.secretKey }}
+            {{- end }}
+            {{- if .Values.config.oauth2.existingSecret }}
+            - name: DT_OAUTH2_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.oauth2.existingSecret }}
+                  key: {{ .Values.config.oauth2.clientIdKey }}
+            - name: DT_OAUTH2_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.oauth2.existingSecret }}
+                  key: {{ .Values.config.oauth2.clientSecretKey }}
+            {{- end }}
+            {{- if and .Values.config.database.existingSecret (eq .Values.config.database.type "postgres") }}
+            - name: DT_DB_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.database.existingSecret }}
+                  key: {{ .Values.config.database.hostKey }}
+            - name: DT_DB_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.database.existingSecret }}
+                  key: {{ .Values.config.database.portKey }}
+            - name: DT_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.database.existingSecret }}
+                  key: {{ .Values.config.database.userKey }}
+            - name: DT_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.database.existingSecret }}
+                  key: {{ .Values.config.database.passwordKey }}
+            - name: DT_DB_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.config.database.existingSecret }}
+                  key: {{ .Values.config.database.nameKey }}
+            {{- end }}
+          {{- end }}
+          {{- with .Values.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
          volumeMounts:
            - name: config
-              mountPath: /config          
+              mountPath: /config
+              readOnly: true
            - name: data
              mountPath: /donetick-data
+            {{- if not .Values.containerSecurityContext.readOnlyRootFilesystem }}
+            - name: tmp
+              mountPath: /tmp
+            {{- end }}
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      volumes:
@ -41,4 +150,23 @@ spec:
            name: {{ include "donetick.fullname" . }}-configmap
        - name: data
          persistentVolumeClaim:
-            claimName: {{ include "donetick.fullname" . }}-data
+            claimName: {{ include "donetick.fullname" . }}-data
+        {{- if not .Values.containerSecurityContext.readOnlyRootFilesystem }}
+        - name: tmp
+          emptyDir: {}
+        {{- end }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
--- a/charts/donetick/templates/ingress.yaml
+++ b/charts/donetick/templates/ingress.yaml
@ -20,6 +20,9 @@ spec:
        {{- range .hosts }}
        - {{ . | quote }}
        {{- end }}
+      {{- if .secretName }}
+      secretName: {{ .secretName }}
+      {{- end }}
    {{- end }}
  {{- end }}
  rules:
--- a/charts/donetick/templates/pvc.yaml
+++ b/charts/donetick/templates/pvc.yaml
@ -5,6 +5,10 @@ metadata:
  name: {{ include "donetick.fullname" . }}-data
  labels:
    {{- include "donetick.labels" . | nindent 4 }}
+  {{- with .Values.persistence.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
  accessModes:
    - {{ .Values.persistence.accessMode | quote }}
--- a/charts/donetick/templates/secret.yaml
+++ b/charts/donetick/templates/secret.yaml
@ -0,0 +1,22 @@
+{{- if or (not .Values.config.jwt.existingSecret) (and (not .Values.config.oauth2.existingSecret) (or .Values.config.oauth2.client_id .Values.config.oauth2.client_secret)) (and (eq .Values.config.database.type "postgres") (not .Values.config.database.existingSecret)) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "donetick.fullname" . }}-secrets
+  labels:
+    {{- include "donetick.labels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- if not .Values.config.jwt.existingSecret }}
+  {{ .Values.config.jwt.secretKey }}: {{ .Values.config.jwt.secret | b64enc }}
+  {{- end }}
+  {{- if and (eq .Values.config.database.type "postgres") (not .Values.config.database.existingSecret) }}
+  {{ .Values.config.database.passwordKey }}: {{ .Values.config.database.password | b64enc }}
+  {{- end }}
+  {{- if and (not .Values.config.oauth2.existingSecret) .Values.config.oauth2.client_id }}
+  {{ .Values.config.oauth2.clientIdKey }}: {{ .Values.config.oauth2.client_id | b64enc }}
+  {{- end }}
+  {{- if and (not .Values.config.oauth2.existingSecret) .Values.config.oauth2.client_secret }}
+  {{ .Values.config.oauth2.clientSecretKey }}: {{ .Values.config.oauth2.client_secret | b64enc }}
+  {{- end }}
+{{- end }}