Skip to content

Commit 28a3574

Browse files
marcellmuellermarcellmueller
authored
Merge pull request #15 from bcgov/setup-crunchy-chart
crunchy chart initial setup
2 parents 328d6f8 + c965f8c commit 28a3574

31 files changed

+1917
-0
lines changed

‎.bin/install-gitleaks-linux-x64.sh

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/usr/bin/env bash
2+
set -xeuo pipefail;
3+
4+
version="8.16.0";
5+
releases_api="https://api.github.com/repositories/119190187/releases/tags/v${version}";
6+
releases_json="$(curl -s ${releases_api})";
7+
8+
case "$OSTYPE" in
9+
darwin*) arch="darwin_x64" ;; # arm detection? I give up
10+
linux*) arch="linux_x64" ;;
11+
solaris*) echo "Error: Solaris is not supported"; exit 1; ;;
12+
bsd*) echo "Error: BSD is not supported"; exit 1; ;;
13+
msys*) echo "Error: Windows is not supported"; exit 1; ;;
14+
cygwin*) echo "Error: Windows is still not supported"; exit 1; ;;
15+
*) echo "Error: unknown: $OSTYPE – definitely not supported"; exit 1; ;;
16+
esac
17+
18+
# download the specified release
19+
download_url=$(echo "${releases_json}" | jq -r ".assets[] | select(.name | contains(\"${arch}\")) | .browser_download_url");
20+
wget "${download_url}";
21+
22+
# validate checksum
23+
download_url=$(echo "${releases_json}" | jq -r ".assets[] | select(.name | contains(\"checksums\")) | .browser_download_url");
24+
wget "${download_url}";
25+
sed -i.bak -n "/${arch}/p" gitleaks_${version}_checksums.txt
26+
shasum -a 256 "gitleaks_${version}_checksums.txt" --check;
27+
28+
# extract to current working directory
29+
tar -zxvf "gitleaks_${version}_${arch}.tar.gz" gitleaks;
30+
31+
# check version
32+
if [[ "$(./gitleaks version)" != "${version}" ]]; then
33+
echo "Somehow we installed the wrong version...";
34+
exit 1;
35+
fi
36+
37+
# cleanup
38+
rm gitleaks_*;
39+
40+
exit 0;

‎.github/actions/deploy/action.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Deploy to OpenShift
2+
description: "Login and deploy to OpenShift"
3+
4+
inputs:
5+
openshift_server_url:
6+
description: "URL of the OpenShift server"
7+
required: true
8+
openshift_token:
9+
description: "Unique login token for OpenShift"
10+
required: true
11+
openshift_namespace:
12+
description: "The namespace being deployed to"
13+
required: true
14+
openshift_route:
15+
description: "Domain where the application can be accessed"
16+
required: true
17+
18+
runs:
19+
using: composite
20+
steps:
21+
- name: Authenticate, set context and run deploy script
22+
uses: redhat-actions/oc-login@v1
23+
with:
24+
openshift_server_url: ${{ inputs.openshift_server_url }}
25+
openshift_token: ${{ inputs.openshift_token }}
26+
openshift_namespace: ${{ inputs.openshift_namespace }}
27+
openshift_route: ${{ inputs.openshift_route }}
28+
29+
insecure_skip_tls_verify: true
30+
- run: |
31+
cd operations/deployment/crunchy-postgres
32+
helm dep up
33+
helm upgrade --install --atomic "$@" crunchy-postgres . --timeout=8m0s -n ${{ inputs.openshift_namespace }} \
34+
--set networking.route.host=${{ inputs.openshift_route }} \
35+
--values values-repo.yaml
36+
37+
shell: bash

‎.github/workflows/deploy-chart.yaml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Deploy to OpenShift namespaces
2+
name: deploy-chart
3+
4+
on:
5+
workflow_call:
6+
secrets:
7+
OPENSHIFT_SERVER: { required: true }
8+
OPENSHIFT_TOKEN: { required: true }
9+
OPENSHIFT_NAMESPACE: { required: true }
10+
OPENSHIFT_ROUTE: { required: true }
11+
NAMESPACE_PREFIX: { required: true }
12+
13+
env:
14+
TAG: sha-${{ github.sha }}
15+
16+
jobs:
17+
deploy-tools:
18+
uses: ./.github/workflows/deploy-tools.yaml
19+
secrets:
20+
OPENSHIFT_SERVER: ${{ secrets.OPENSHIFT_SERVER }}
21+
OPENSHIFT_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
22+
NAMESPACE_PREFIX: ${{ secrets.NAMESPACE_PREFIX }}
23+
24+
deploy-to-openshift-development:
25+
runs-on: ubuntu-latest
26+
environment:
27+
name: development
28+
url: "dev"
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@v2
32+
- name: Deploy
33+
uses: ./.github/actions/deploy
34+
with:
35+
openshift_server_url: ${{ secrets.OPENSHIFT_SERVER }}
36+
openshift_token: ${{ secrets.OPENSHIFT_TOKEN }}
37+
openshift_route: ${{ secrets.OPENSHIFT_ROUTE }}
38+
openshift_namespace: ${{ secrets.OPENSHIFT_NAMESPACE }}
39+
40+
deploy-to-openshift-test:
41+
needs: [deploy-to-openshift-development]
42+
runs-on: ubuntu-latest
43+
environment:
44+
name: test
45+
url: "test"
46+
steps:
47+
- name: Checkout
48+
uses: actions/checkout@v2
49+
- name: Deploy
50+
uses: ./.github/actions/deploy
51+
with:
52+
openshift_server_url: ${{ secrets.OPENSHIFT_SERVER }}
53+
openshift_token: ${{ secrets.OPENSHIFT_TOKEN }}
54+
openshift_route: ${{ secrets.OPENSHIFT_ROUTE }}
55+
openshift_namespace: ${{ secrets.OPENSHIFT_NAMESPACE }}
56+
57+
deploy-to-openshift-production:
58+
needs: [deploy-to-openshift-test]
59+
runs-on: ubuntu-latest
60+
environment:
61+
name: production
62+
url: "prod"
63+
steps:
64+
- name: Checkout
65+
uses: actions/checkout@v2
66+
- name: Deploy
67+
uses: ./.github/actions/deploy
68+
with:
69+
openshift_server_url: ${{ secrets.OPENSHIFT_SERVER }}
70+
openshift_token: ${{ secrets.OPENSHIFT_TOKEN }}
71+
openshift_route: ${{ secrets.OPENSHIFT_ROUTE }}
72+
openshift_namespace: ${{ secrets.OPENSHIFT_NAMESPACE }}

‎.github/workflows/deploy-tools.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: deploy tools chart
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
OPENSHIFT_SERVER: { required: true }
7+
OPENSHIFT_TOKEN: { required: true }
8+
NAMESPACE_PREFIX: { required: true }
9+
10+
jobs:
11+
deploy-to-openshift-tools:
12+
runs-on: ubuntu-latest
13+
environment:
14+
name: tools
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v2
18+
- name: Authenticate, set context and run deploy script
19+
uses: redhat-actions/oc-login@v1
20+
with:
21+
openshift_server_url: ${{ secrets.OPENSHIFT_SERVER }}
22+
openshift_token: ${{ secrets.OPENSHIFT_TOKEN }}
23+
insecure_skip_tls_verify: true
24+
- run: |
25+
helm upgrade crunchy-postgres-tools operations/deployment/tools --install --atomic -n ${{ secrets.NAMESPACE_PREFIX }}-tools

‎.github/workflows/main.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Main workflow, orchestrating and triggering other workflows
2+
name: main
3+
4+
on:
5+
workflow_call:
6+
push:
7+
branches: [main]
8+
pull_request:
9+
branches: [main]
10+
11+
jobs:
12+
test:
13+
uses: ./.github/workflows/test.yaml
14+
secrets: inherit
15+
16+
deploy:
17+
# if: github.event.ref == 'refs/heads/main'
18+
needs: [test]
19+
uses: ./.github/workflows/deploy-chart.yaml
20+
secrets:
21+
OPENSHIFT_SERVER: ${{ secrets.OPENSHIFT_SERVER }}
22+
OPENSHIFT_TOKEN: ${{ secrets.OPENSHIFT_TOKEN }}
23+
OPENSHIFT_NAMESPACE: ${{ secrets.OPENSHIFT_NAMESPACE }}
24+
OPENSHIFT_ROUTE: ${{ secrets.OPENSHIFT_ROUTE }}
25+
NAMESPACE_PREFIX: ${{ secrets.NAMESPACE_PREFIX }}

‎.github/workflows/test.yaml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Tests
2+
name: test code
3+
4+
on:
5+
workflow_call:
6+
7+
jobs:
8+
gitleaks:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v3
12+
- run: ./.bin/install-gitleaks-linux-x64.sh
13+
- run: ./gitleaks detect --exit-code 0 --report-format sarif --report-path "gitleaks.sarif"
14+
- uses: github/codeql-action/upload-sarif@v2
15+
with:
16+
sarif_file: "gitleaks.sarif"
17+
18+
lint-tools-chart:
19+
runs-on: ubuntu-latest
20+
environment:
21+
name: tools
22+
steps:
23+
- name: Checkout
24+
uses: actions/checkout@v2
25+
- name: Authenticate to OpenShift Linter namespace
26+
uses: redhat-actions/oc-login@v1
27+
with:
28+
openshift_server_url: ${{ secrets.OPENSHIFT_SERVER }}
29+
openshift_token: ${{ secrets.OPENSHIFT_LINTER_TOKEN }}
30+
insecure_skip_tls_verify: true
31+
- run: |
32+
set -euo pipefail; \
33+
helm dep up ./operations/deployment/tools; \
34+
helm template -f ./operations/deployment/tools/values.yaml crunchy-postgres ./operations/deployment/tools --validate;
35+
36+
lint-crunchy-postgres-chart:
37+
runs-on: ubuntu-latest
38+
environment:
39+
name: tools
40+
steps:
41+
- name: Checkout
42+
uses: actions/checkout@v2
43+
- name: Authenticate to OpenShift Linter namespace
44+
uses: redhat-actions/oc-login@v1
45+
with:
46+
openshift_server_url: ${{ secrets.OPENSHIFT_SERVER }}
47+
openshift_token: ${{ secrets.OPENSHIFT_LINTER_TOKEN }}
48+
insecure_skip_tls_verify: true
49+
- run: |
50+
set -euo pipefail; \
51+
helm dep up ./operations/deployment/crunchy-postgres; \
52+
helm template -f ./operations/deployment/crunchy-postgres/values.yaml crunchy-postgres ./operations/deployment/crunchy-postgres --validate;

‎.prettierignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
operations/**/templates/**/*.yaml

‎operations/deployment/DEPLOYMENT_TEMPLATES_HERE

Whitespace-only changes.

‎operations/deployment/crunchy-postgres/.helmignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎operations/deployment/crunchy-postgres/Chart.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: crunchy-postgres
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "5.0.0"

0 commit comments

Comments
 (0)