Skip to content

Commit 2760e6d

Browse files
Sheikah45Brutus5000
Sheikah45
and
Brutus5000
authored
Make changes to support tilt.dev local development (#264)
* add readiness probes to infra * use rabbitmq ping over is_running * add threshold to rabbitmq readiness probe * use startupProbe over readinessProbe * fix rabbitm startup * add password to postgres autoupdate * Escape slash in vhost * Fix hydra secret length * Clean up local secrets and mariadb init * Remove null tlsStoreSecret * Remove geoip license key * Add values-local for traefik * Fix init mariadb jobs and remove script * Add postgres init job * Add rabbitmq init jobs * Add empty traefik object * Fix typo * Fix website oauth client ids * Add mongodb init jobs and clean up init jobs and add nodebb local config * Use postgres variables in init script * Escape passwords and stop on errors in init jobs * Remove $ from .Values access outside of range * Fix postgres startup probing --------- Co-authored-by: Brutus5000 <[email protected]>
1 parent 5be09d4 commit 2760e6d

File tree

25 files changed

+603
-222
lines changed

25 files changed

+603
-222
lines changed

‎apps/faf-api/templates/local-secret.yaml‎

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,37 @@ stringData:
1212
GITHUB_WEBHOOK_SECRET: "banana"
1313
LEAGUE_DATABASE_PASSWORD: "banana"
1414
NODEBB_MASTER_TOKEN: "banana"
15-
PUBLIC.KEY: "banana"
1615
RABBIT_PASSWORD: "banana"
1716
RECAPTCHA_SECRET: "banana"
18-
S3_ACCESS_KEY: "banana"
19-
S3_ENDPOINT: "banana"
20-
S3_SECRET_KEY: "banana"
21-
S3_USER_UPLOAD_BUCKET: "banana"
22-
SECRET.KEY: "banana"
2317
STEAM_API_KEY: "banana"
2418
TESTING_EXE_UPLOAD_KEY: "banana"
19+
PUBLIC.KEY: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNOkn/K0G7d2KHjVsSpGdyE1+TIKKAhYMetsFr7RLPDznc57AsnVnB7nCH0vyfFYPt/6lUODl0ApcAlpubHq+5eEmN6QjGsdMhF3F5s7aeiuEAr9A645ng0qKdKGlbDIuCY9wlloqrVM21Wbs2j/cJArle6AMnk0bZzVE0QB2TemTYSQGWGE5slba9Rj4qYn7id3Bkp7IkPgJOviwkrtxZF/Ye3ZFarqiYWWydCI8bI739VihhDPd9VOJd1/j7GDq2gFpW+6W3Rg9Ln+ObrXVGuwzAszhmlaRSXK3FH83z+gtv2sOc7345BkOkiwp813dkCqD/BlMchxvjvhQeNROJ [email protected]
20+
SECRET.KEY: |-
21+
-----BEGIN RSA PRIVATE KEY-----
22+
MIIEpgIBAAKCAQEAzTpJ/ytBu3dih41bEqRnchNfkyCigIWDHrbBa+0Szw853Oew
23+
LJ1Zwe5wh9L8nxWD7f+pVDg5dAKXAJabmx6vuXhJjekIxrHTIRdxebO2norhAK/Q
24+
OuOZ4NKinShpWwyLgmPcJZaKq1TNtVm7No/3CQK5XugDJ5NG2c1RNEAdk3pk2EkB
25+
lhhObJW2vUY+KmJ+4ndwZKeyJD4CTr4sJK7cWRf2Ht2RWq6omFlsnQiPGyO9/VYo
26+
YQz3fVTiXdf4+xg6toBaVvult0YPS5/jm611RrsMwLM4ZpWkUlytxR/N8/oLb9rD
27+
nO9+OQZDpIsKfNd3ZAqg/wZTHIcb474UHjUTiQIDAQABAoIBAQCMuO1IZNbbvs72
28+
97x9GfI8zH/6mKQU0HfKNbKHWLZO+LfKe6vXy8ViLydGWywRwWUHawkm0K7El4oH
29+
Qz5LrUz9NjfpcOMtq32D8VlEBDCyobQLDoMP/kTjXktWzAECB6YZsHOh6ooHVU0A
30+
jxjKHwlbSlzlcN3I4znv2tNVqqkdF9Gbg7wUmN9n0qpj+7kDtkixJy3jm9YLxKCS
31+
pNZ1UUjGKtVgl/1871slNUtANHj/xCnkYrOncrIXf472pEeSxBU5JlI4fILcyTtG
32+
B9btuYBk7Z239TWDEZTqIyst0QGteNRsjE+gkB9WV1ra9JPPWDiBYye4qqaIs3al
33+
jd3lkMApAoGBAP+i1aJ/c8XV18eTMYLmQZRnkjrkxyQMhJ/x+6tow6p6A16lDwHh
34+
tRoyQk0XdTpQegu+YtdBXSRk6zNzE2njWEVOMK4/Zqt5a1yMSE/8MMQVler1ChdF
35+
PWhZCPb+CfKm1RHXpFMsmBZx+7MumLQwjCtZfQl8YMt34gfVcXRSZ50DAoGBAM2F
36+
FVrTTUVaGv6zjdO7K+5eUj0VRR2nGId5nIWqouQryJaizeBZfWatjDYVbl0qHFy2
37+
QnHA+3UEsVWOkJG90rZcP4UWcDy86e5T/3FR2Xfy3kW10Gfe6hrjjbjYflleD5Qg
38+
uZ9ovk/TZjTjvMWisNBSW1FILz9SMLWHoCFPGOmDAoGBANKRb4X1lAiOt7n13d+k
39+
CLrUgVgvoHVqNkiFi7dKiXnAHUx1i6ISKBoW8hQMUYyiQ5Wu0j3a4n0a/74WeRRM
40+
pyYXXPP613hBgJTwHJR9+DFcUmwCQbifWRC93iuNX+ZXU8Tpqrq0TeaXJywWIsSy
41+
BJOkl+EbaaPP8Qhg4Z5eTmi/AoGBAMzSDyA/acjuLe0cwQH8jaG3+rnJkuIkf3u0
42+
pVtJXaGMSRJnGkq2pRVJbG0SGrVanH2BXuLDc1eB38HmnQnCZlc7xEo8vIqrs2/D
43+
4tXqvpKeRwquUg7Sx/kYQ0uu5uzloxz7KENIPjKL+lZHiQBmTVSwXzW4fO3cWZLw
44+
oZPQooFFAoGBAMVvhsOmlpwyyS9s/CVIMirvLQEuEIIS5fMcnmCmu8P49ZZ7YSVf
45+
2OJOSGj+lWkEMf2qOW7kYl303GrESeJ36KmLbDthnH+p6RSq5NzN5CAucffA0tsa
46+
keX0a6YHVu9doUPhUFJdbgg8FIL1FVEJROQckMAiDcYg2mFXmtaVTjqX
47+
-----END RSA PRIVATE KEY-----
2548
{{- end}}

‎apps/faf-icebreaker/templates/local-secret.yaml‎

Lines changed: 39 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,46 @@ stringData:
1010
DB_PASSWORD: "banana"
1111
GEOIPUPDATE_ACCOUNT_ID: "banana"
1212
GEOIPUPDATE_LICENSE_KEY: "banana"
13-
JWT_PRIVATE_KEY_PATH: "banana"
14-
JWT_PUBLIC_KEY_PATH: "banana"
1513
RABBITMQ_PASSWORD: "banana"
1614
XIRSYS_IDENT: "banana"
1715
XIRSYS_SECRET: "banana"
16+
JWT_PRIVATE_KEY_PATH: |-
17+
-----BEGIN PRIVATE KEY-----
18+
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDXsCsl9W0vnW2k
19+
5GaNOVoZ6LPFYu60Y1Cd4ERRXvt8KzKTm2HHZeLKd77OLeIHR4RvJ2Q76SFwfDBM
20+
35F5eEx1mjPua2ljxbObsgz/bA9yBwO1RugpNOe+GoGUhPyZvmmZwqRnnQsT/SHV
21+
ZvRq7ej6k+KkJf09IIOxfWrGUj8SajW3iEpkuKdNpjp1dRnJdZAZ8mV1LgnwHCAf
22+
osL3t3+PElBSxnRQNW9iYVwB9wQAWK+aivx5warhuCeyKVtDaR0x96bOUTaKL4i/
23+
Uihn0CElGt5ZA907wHa6/N4Z8ssXjY+/vizYB2VYxuAG/MVkkbwWUUTGjzEEX6Ww
24+
h5icvVm1AgMBAAECggEAAZYYGyVc8ja0MbxETNGZKgueFtuNaeI5G5AksHyEWPtw
25+
WcmQxIipTFfpHVcVDHyoKrEdeZtTVaJ0MHyMc1pBJbRGoYBEvCkeEw0SL2a6Dlqi
26+
2lh1KKhs8+b6AP+hY/gUir71upVbGYCJGSqyrX6mcgFYb2CgJizxCwMjH+ZG9Hm0
27+
CkGeh4g0VDOWmx4uCChXSyoaPzD4yTJts/EOpSD61KqS+cNcnRD8PVUxwwSH+4DY
28+
ZSuaAUC/kFvD4qQq2lY/eia2CQi2R1Ff2TCxcbNZ34yW8IR1UBdrOPo3orQK5vSf
29+
iT5++MYJmTZJ8/QxY5M1nZqiyJEjTvaBQNGv8abKWQKBgQDxd/5lJkc13x8jPFJm
30+
EnmPvxrJaYk3MLW3dtxz1HtjHDQAvCmjXy7Ss13WhLJv9nHJDtQlSRr+l+7eNPTP
31+
QtiwDsqv9COfbPbvH2qcNJuNoINQ2YSKYvR0j+QlMz2dHroWEyXL4oyOfXAJ3ZrU
32+
lyWn/a2BD3uiJAj4p8YzJgfgnwKBgQDkqwGC6AMLPbVmhCMnUd+cxFMkYymdi8R4
33+
ZXMkjJiMLAOt8tkp8T0nqxC/zMfD0jnPKw1R9MP7XlM/tonLeAM/P8GUMwJnTCTc
34+
PvP1JxkvMG3do+7y9AbLyJsNZDkbYj1wLzvZYUrXQV/HKU4balDj3QVI6yr+W6ha
35+
idlsMDYBKwKBgBeuF9GdlmAvGGOhN8dwymERcbQM2HsEGN38FxR44vzOOD9WNJMj
36+
83iQRISUENewCGqaPK3HZJFRHwjFkrh8qrlhSflFbPTmf7TllNPqyNJzykz0d+4G
37+
VEjWD56iTsmIyOD/UbaT6grTPFiLVfLBO90koI5GkW5OMF8KPQKpGR6rAoGAU5NQ
38+
1RiZbDVcpKBs/MUG1pRG0wjPP/7Ci0KBB/2/D5RSr/QPfS3nrSTv1ToyVRbz/Az/
39+
LFIqgyghgyrjSBOQFEDoLpNKMJj66+iyX4qvwLiRny14eyHHjhm+2fEkkiagz+zj
40+
kfrmULBbIj6thoWgFPhGIzWYnCjB6n1xkwI36ssCgYACiZNHvqld4Om2IChCjIV6
41+
UPNLUDOvr7V1qsEy+y0dp2RQH9Es121n/v30GYfsUUYmH35CQYR0aOEqU17Qm2V7
42+
1auC1ZD9UeE9dy2LpW635uYf16D5FejAcmxyf/MRSBBnvFauGdS2vZ7Pf05u9Zpw
43+
i8UgZE7+lTYKv7+4ujmgHw==
44+
-----END PRIVATE KEY-----
45+
JWT_PUBLIC_KEY_PATH: |-
46+
-----BEGIN PUBLIC KEY-----
47+
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA17ArJfVtL51tpORmjTla
48+
GeizxWLutGNQneBEUV77fCsyk5thx2Xiyne+zi3iB0eEbydkO+khcHwwTN+ReXhM
49+
dZoz7mtpY8Wzm7IM/2wPcgcDtUboKTTnvhqBlIT8mb5pmcKkZ50LE/0h1Wb0au3o
50+
+pPipCX9PSCDsX1qxlI/Emo1t4hKZLinTaY6dXUZyXWQGfJldS4J8BwgH6LC97d/
51+
jxJQUsZ0UDVvYmFcAfcEAFivmor8ecGq4bgnsilbQ2kdMfemzlE2ii+Iv1IoZ9Ah
52+
JRreWQPdO8B2uvzeGfLLF42Pv74s2AdlWMbgBvzFZJG8FlFExo8xBF+lsIeYnL1Z
53+
tQIDAQAB
54+
-----END PUBLIC KEY-----
1855
{{- end}}

‎apps/faf-lobby-server/templates/local-secret.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,5 @@ metadata:
66
type: Opaque
77
stringData:
88
DB_PASSWORD: "banana"
9-
GEO_IP_LICENSE_KEY: "banana"
109
MQ_PASSWORD: "banana"
1110
{{- end}}

‎apps/faf-website/templates/local-secret.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ metadata:
55
name: {{ .Chart.Name }}
66
type: Opaque
77
stringData:
8-
OAUTH_CLIENT_ID: "banana"
8+
OAUTH_CLIENT_ID: "c5613672-0ee5-4956-8b03-c7951ef25640"
99
OAUTH_CLIENT_SECRET: "banana"
10-
OAUTH_M2M_CLIENT_ID: "banana"
10+
OAUTH_M2M_CLIENT_ID: "b9f62a18-faae-43cc-a9b7-e15613e00273"
1111
OAUTH_M2M_CLIENT_SECRET: "banana"
1212
RECAPTCHA_SITE_KEY: "banana"
1313
SESSION_SECRET_KEY: "banana"

‎apps/nodebb/templates/local-secret.yaml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,26 @@ type: Opaque
77
stringData:
88
MONGO_NODEBB_PASSWORD: "banana"
99
OAUTH_SECRET: "banana"
10-
config.json: "banana" # TODO: Fix this
10+
"config.json": |
11+
{
12+
"url": "https://forum.localhost",
13+
"secret": "banana",
14+
"database": "mongo",
15+
"port": 4567,
16+
"mongo": {
17+
"host": "mongodb.faf-infra.svc",
18+
"port": "27017",
19+
"username": "nodebb",
20+
"password": "banana",
21+
"database": "nodebb"
22+
},
23+
"oauth": {
24+
"authorizationURL": "http://ory-hydra:4444/oauth2/auth",
25+
"tokenURL": "http://ory-hydra:4444/oauth2/token",
26+
"fafApiProfileURL": "http://faf-api:8010/me",
27+
"id": "97853a31-d7fc-424b-a4c2-f8cd053d10d2",
28+
"secret": "banana",
29+
"scope": "public_profile lobby"
30+
}
31+
}
1132
{{- end}}

‎apps/ory-hydra/templates/local-secret.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,5 @@ stringData:
99
DB_PASSWORD: "banana"
1010
DSN: "postgres://hydra:banana@postgres:5432/ory-hydra"
1111
FAF_QAI_SECRET: "banana"
12-
SECRETS_SYSTEM: "banana"
12+
SECRETS_SYSTEM: "bananabananabananabanana"
1313
{{- end}}

‎apps/rabbitmq/templates/config.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,6 @@ metadata:
77
data:
88
ADMIN_USER: "faf-admin"
99
"enabled_plugins": "[rabbitmq_management,rabbitmq_prometheus]."
10+
"rabbitmq_conf": |-
11+
default_user = $(ADMIN_USER)
12+
default_pass = $(ADMIN_PASSWORD)

‎apps/rabbitmq/templates/init-rabbitmq-with-user.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# =======================================
2+
# Jesus, what the fuck is happening here?
3+
# =======================================
4+
#
5+
# 1. Create a service account
6+
# 2. Permit it to read configmaps and secrets in the faf-apps namespace
7+
# 3. Iterate over the databasesAndUsers list and create a job for each database
8+
# a) initContainer: Load the configmap and secret into environment variables. This must happen via k8s api, as we can't directly reference cm/secrets cross-namespace.
9+
# b) actual container: Load the env from file and create the database and user
10+
11+
{{- $wave := 1 }}
12+
{{- range .Values.users }}
13+
---
14+
apiVersion: batch/v1
15+
kind: Job
16+
metadata:
17+
name: rabbitmq-sync-user-{{ $wave }}
18+
labels:
19+
app: rabbitmq-sync-user
20+
argocd.argoproj.io/instance: rabbitmq
21+
annotations:
22+
argocd.argoproj.io/hook: PostSync
23+
argocd.argoproj.io/hook-delete-policy: HookSucceeded
24+
argocd.argoproj.io/sync-wave: '{{ $wave }}'
25+
spec:
26+
backoffLimit: 1
27+
template:
28+
spec:
29+
serviceAccountName: init-apps
30+
volumes:
31+
- name: config # We will store the apps config for database, username and password here
32+
emptyDir: {}
33+
initContainers:
34+
- name: load-config
35+
image: alpine/kubectl
36+
command: ["/bin/sh", "-c"]
37+
args:
38+
- |
39+
set -e
40+
41+
mkdir -p /config
42+
43+
echo -n "SYNC_USERNAME=" >> /config/env
44+
kubectl get cm {{ .configMapRef }} \
45+
-n faf-apps \
46+
-o jsonpath='{.data.{{ .usernameKey }}}' >> /config/env
47+
echo >> /config/env
48+
49+
echo -n "SYNC_PASSWORD=" >> /config/env
50+
kubectl get secret {{ .secretRef }} \
51+
-n faf-apps \
52+
-o jsonpath='{.data.{{ .passwordKey }}}' \
53+
| base64 -d >> /config/env
54+
echo >> /config/env
55+
volumeMounts:
56+
- name: config
57+
mountPath: /config
58+
containers:
59+
- name: rabbitmq-sync-db-user
60+
image: {{ $.Values.image.repository }}:{{ $.Values.image.tag }}
61+
imagePullPolicy: Always
62+
envFrom:
63+
- secretRef:
64+
name: rabbitmq
65+
- configMapRef:
66+
name: rabbitmq
67+
command: ["/bin/sh", "-c"]
68+
args:
69+
- |
70+
set -a
71+
. /config/env
72+
set +a
73+
74+
vhost="/faf-core"
75+
76+
rabbitmq_admin_exec() {
77+
rabbitmqadmin --format=bash --host=rabbitmq-0.rabbitmq.faf-apps.svc.cluster.local --username=$ADMIN_USER --password=$ADMIN_PASSWORD "$@"
78+
}
79+
80+
if rabbitmq_admin_exec list vhosts | grep -q "$vhost"; then
81+
echo "$vhost vhost already exists"
82+
else
83+
rabbitmq_admin_exec declare vhost name="$vhost"
84+
fi
85+
86+
if rabbitmq_admin_exec list users | grep -q "$SYNC_USERNAME"; then
87+
echo "$SYNC_USERNAME user alerady exists"
88+
else
89+
rabbitmq_admin_exec declare user name="$SYNC_USERNAME" password="$SYNC_PASSWORD" tags=""
90+
fi
91+
92+
rabbitmq_admin_exec declare permission vhost="$vhost" user="$SYNC_USERNAME" configure=".*" read=".*" write=".*"
93+
94+
volumeMounts:
95+
- name: config
96+
mountPath: /config
97+
restartPolicy: Never
98+
{{- $wave = add $wave 1 }}
99+
{{- end }}

‎apps/rabbitmq/templates/statefulset.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,26 @@ spec:
3030
- containerPort: 15692
3131
name: prometheus
3232
protocol: TCP
33+
startupProbe:
34+
exec:
35+
command: ["rabbitmq-diagnostics", "-q", "ping"]
36+
initialDelaySeconds: 15
37+
timeoutSeconds: 15
38+
periodSeconds: 5
39+
envFrom:
40+
- secretRef:
41+
name: rabbitmq
42+
- configMapRef:
43+
name: rabbitmq
3344
volumeMounts:
3445
- name: rabbitmq-pvc
3546
mountPath: /var/lib/rabbitmq
3647
- name: config
3748
mountPath: /etc/rabbitmq/enabled_plugins
3849
subPath: enabled_plugins
50+
- name: config
51+
mountPath: /etc/rabbitmq/rabbitmq.conf
52+
subPath: rabbitmq_conf
3953
restartPolicy: Always
4054
volumes:
4155
- name: config

‎apps/rabbitmq/values.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,28 @@
1+
image:
2+
repository: rabbitmq
3+
tag: 3.13.7-management-alpine
4+
15
infisical-secret:
26
name: rabbitmq
7+
8+
users:
9+
- configMapRef: faf-lobby-server
10+
secretRef: faf-lobby-server
11+
usernameKey: MQ_USER
12+
passwordKey: MQ_PASSWORD
13+
- configMapRef: faf-api
14+
secretRef: faf-api
15+
usernameKey: RABBIT_USERNAME
16+
passwordKey: RABBIT_PASSWORD
17+
- configMapRef: faf-league-service
18+
secretRef: faf-league-service
19+
usernameKey: MQ_USER
20+
passwordKey: MQ_PASSWORD
21+
- configMapRef: debezium
22+
secretRef: debezium
23+
usernameKey: RABBITMQ_USER
24+
passwordKey: RABBITMQ_PASSWORD
25+
- configMapRef: faf-icebreaker
26+
secretRef: faf-icebreaker
27+
usernameKey: RABBITMQ_USER
28+
passwordKey: RABBITMQ_PASSWORD

0 commit comments

Comments
 (0)