Skip to content

Commit 4dbf359

Browse files
batpadbatpad
committed
actually add the things properly, fix bad previous commit
1 parent 72e565d commit 4dbf359

File tree

6 files changed

+329
-19
lines changed

6 files changed

+329
-19
lines changed

‎helm/Chart.yaml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,6 @@
1-
1+
apiVersion: v2
2+
name: stac-auth-proxy
3+
description: A Helm chart for stac-auth-proxy
4+
type: application
5+
version: 0.1.0
6+
appVersion: "1.0.0"

‎helm/templates/_helpers.tpl‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,49 @@
1-
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "stac-auth-proxy.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
*/}}
11+
{{- define "stac-auth-proxy.fullname" -}}
12+
{{- if .Values.fullnameOverride }}
13+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
14+
{{- else }}
15+
{{- $name := default .Chart.Name .Values.nameOverride }}
16+
{{- if contains $name .Release.Name }}
17+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
18+
{{- else }}
19+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
20+
{{- end }}
21+
{{- end }}
22+
{{- end }}
23+
24+
{{/*
25+
Create chart name and version as used by the chart label.
26+
*/}}
27+
{{- define "stac-auth-proxy.chart" -}}
28+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
29+
{{- end }}
30+
31+
{{/*
32+
Common labels
33+
*/}}
34+
{{- define "stac-auth-proxy.labels" -}}
35+
helm.sh/chart: {{ include "stac-auth-proxy.chart" . }}
36+
{{ include "stac-auth-proxy.selectorLabels" . }}
37+
{{- if .Chart.AppVersion }}
38+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
39+
{{- end }}
40+
app.kubernetes.io/managed-by: {{ .Release.Service }}
41+
{{- end }}
42+
43+
{{/*
44+
Selector labels
45+
*/}}
46+
{{- define "stac-auth-proxy.selectorLabels" -}}
47+
app.kubernetes.io/name: {{ include "stac-auth-proxy.name" . }}
48+
app.kubernetes.io/instance: {{ .Release.Name }}
49+
{{- end }}

‎helm/templates/deployment.yaml‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,42 @@
1-
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "stac-auth-proxy.fullname" . }}
5+
labels:
6+
{{- include "stac-auth-proxy.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "stac-auth-proxy.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
labels:
15+
{{- include "stac-auth-proxy.selectorLabels" . | nindent 8 }}
16+
spec:
17+
securityContext:
18+
{{- toYaml .Values.securityContext | nindent 8 }}
19+
containers:
20+
- name: {{ .Chart.Name }}
21+
securityContext:
22+
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
23+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
24+
imagePullPolicy: {{ .Values.image.pullPolicy }}
25+
ports:
26+
- name: http
27+
containerPort: 8000
28+
protocol: TCP
29+
resources:
30+
{{- toYaml .Values.resources | nindent 12 }}
31+
{{- with .Values.nodeSelector }}
32+
nodeSelector:
33+
{{- toYaml . | nindent 8 }}
34+
{{- end }}
35+
{{- with .Values.affinity }}
36+
affinity:
37+
{{- toYaml . | nindent 8 }}
38+
{{- end }}
39+
{{- with .Values.tolerations }}
40+
tolerations:
41+
{{- toYaml . | nindent 8 }}
42+
{{- end }}

‎helm/templates/ingress.yaml‎

Lines changed: 40 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,40 @@
1-
1+
{{- if .Values.ingress.enabled -}}
2+
{{- $fullName := include "stac-auth-proxy.fullname" . -}}
3+
{{- $svcPort := .Values.service.port -}}
4+
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
5+
{{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
6+
{{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
7+
{{- end }}
8+
{{- end }}
9+
apiVersion: networking.k8s.io/v1
10+
kind: Ingress
11+
metadata:
12+
name: {{ $fullName }}
13+
labels:
14+
{{- include "stac-auth-proxy.labels" . | nindent 4 }}
15+
{{- with .Values.ingress.annotations }}
16+
annotations:
17+
{{- toYaml . | nindent 4 }}
18+
{{- end }}
19+
spec:
20+
ingressClassName: {{ .Values.ingress.className }}
21+
{{- if and .Values.ingress.tls.enabled .Values.ingress.host }}
22+
tls:
23+
- hosts:
24+
- {{ .Values.ingress.host }}
25+
secretName: {{ .Values.ingress.tls.secretName | default (printf "%s-tls" .Values.ingress.host) }}
26+
{{- end }}
27+
rules:
28+
{{- if .Values.ingress.host }}
29+
- host: {{ .Values.ingress.host }}
30+
http:
31+
paths:
32+
- path: /
33+
pathType: Prefix
34+
backend:
35+
service:
36+
name: {{ $fullName }}
37+
port:
38+
number: {{ $svcPort }}
39+
{{- end }}
40+
{{- end }}

‎helm/values.schema.yaml‎

Lines changed: 148 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,152 @@
1-
image:
2-
type: object
3-
properties:
4-
repository:
5-
type: string
6-
description: "Docker image repository"
7-
default: "ghcr.io/developmentseed/stac-auth-proxy"
8-
pullPolicy:
9-
type: string
10-
enum: ["IfNotPresent", "Always", "Never"]
11-
description: "Kubernetes image pull policy"
12-
tag:
1+
"$schema": "https://json-schema.org/draft-07/schema#"
2+
type: object
3+
properties:
4+
replicaCount:
5+
type: integer
6+
minimum: 1
7+
description: "Number of replicas for the deployment"
8+
9+
image:
10+
type: object
11+
properties:
12+
repository:
13+
type: string
14+
description: "Docker image repository"
15+
default: "ghcr.io/developmentseed/stac-auth-proxy"
16+
pullPolicy:
17+
type: string
18+
enum: ["IfNotPresent", "Always", "Never"]
19+
description: "Kubernetes image pull policy"
20+
tag:
21+
type: string
22+
description: "Docker image tag"
23+
default: "latest"
24+
25+
service:
26+
type: object
27+
required: ["type", "port"]
28+
properties:
29+
type:
30+
type: string
31+
enum: ["ClusterIP", "NodePort", "LoadBalancer"]
32+
description: "Kubernetes service type"
33+
port:
34+
type: integer
35+
minimum: 1
36+
maximum: 65535
37+
description: "Service port number"
38+
39+
ingress:
40+
type: object
41+
properties:
42+
enabled:
43+
type: boolean
44+
description: "Enable ingress resource"
45+
className:
46+
type: string
47+
description: "Ingress class name (e.g., nginx)"
48+
annotations:
49+
type: object
50+
additionalProperties:
51+
type: string
52+
description: "Annotations for the ingress resource"
53+
host:
54+
type: string
55+
description: "Hostname for the ingress"
56+
tls:
57+
type: object
58+
properties:
59+
enabled:
60+
type: boolean
61+
description: "Enable TLS configuration"
62+
secretName:
63+
type: string
64+
description: "Name of the TLS secret (optional, will be auto-generated if empty)"
65+
required: ["enabled"]
66+
67+
resources:
68+
type: object
69+
properties:
70+
limits:
71+
type: object
72+
properties:
73+
cpu:
74+
type: string
75+
pattern: "^[0-9]+m?$|^[0-9]+\\.[0-9]+$"
76+
description: "CPU limit (e.g., 500m, 1.5)"
77+
memory:
78+
type: string
79+
pattern: "^[0-9]+(Ki|Mi|Gi|Ti|Pi|Ei|[kMGTPE]i?)?$"
80+
description: "Memory limit (e.g., 512Mi, 1Gi)"
81+
requests:
82+
type: object
83+
properties:
84+
cpu:
85+
type: string
86+
pattern: "^[0-9]+m?$|^[0-9]+\\.[0-9]+$"
87+
description: "CPU request (e.g., 200m, 0.5)"
88+
memory:
89+
type: string
90+
pattern: "^[0-9]+(Ki|Mi|Gi|Ti|Pi|Ei|[kMGTPE]i?)?$"
91+
description: "Memory request (e.g., 256Mi, 1Gi)"
92+
93+
securityContext:
94+
type: object
95+
properties:
96+
runAsNonRoot:
97+
type: boolean
98+
description: "Requires the container to run without root privileges"
99+
runAsUser:
100+
type: integer
101+
description: "The UID to run the entrypoint of the container process"
102+
runAsGroup:
103+
type: integer
104+
description: "The GID to run the entrypoint of the container process"
105+
description: "Pod-level security context"
106+
107+
containerSecurityContext:
108+
type: object
109+
properties:
110+
allowPrivilegeEscalation:
111+
type: boolean
112+
description: "Controls whether a process can gain more privileges than its parent process"
113+
capabilities:
114+
type: object
115+
properties:
116+
drop:
117+
type: array
118+
items:
119+
type: string
120+
description: "List of capabilities to drop"
121+
description: "Container-level security context"
122+
123+
nodeSelector:
124+
type: object
125+
additionalProperties:
13126
type: string
14-
description: "Docker image tag"
15-
default: "latest"
127+
description: "Node labels for pod assignment"
128+
129+
tolerations:
130+
type: array
131+
items:
132+
type: object
133+
properties:
134+
key:
135+
type: string
136+
operator:
137+
type: string
138+
enum: ["Exists", "Equal"]
139+
value:
140+
type: string
141+
effect:
142+
type: string
143+
enum: ["NoSchedule", "PreferNoSchedule", "NoExecute"]
144+
description: "Pod tolerations"
145+
146+
affinity:
147+
type: object
148+
additionalProperties: true
149+
description: "Pod affinity rules"
16150

17151
required:
18152
- service

‎helm/values.yaml‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,47 @@
1+
# Default values for stac-auth-proxy
2+
3+
replicaCount: 1
4+
15
image:
26
repository: ghcr.io/developmentseed/stac-auth-proxy
37
pullPolicy: IfNotPresent
4-
tag: "latest"
8+
tag: "latest"
9+
10+
service:
11+
type: ClusterIP
12+
port: 8000
13+
14+
ingress:
15+
enabled: true
16+
className: "nginx"
17+
annotations:
18+
cert-manager.io/cluster-issuer: "letsencrypt-prod"
19+
host: "stac-proxy.example.com" # This should be overridden in production
20+
tls:
21+
enabled: true
22+
secretName: "" # If empty, will be auto-generated as "{host}-tls"
23+
24+
resources:
25+
limits:
26+
cpu: 500m
27+
memory: 512Mi
28+
requests:
29+
cpu: 200m
30+
memory: 256Mi
31+
32+
# Pod-level security context
33+
securityContext:
34+
runAsNonRoot: true
35+
runAsUser: 1000
36+
runAsGroup: 1000
37+
38+
# Container-level security context
39+
containerSecurityContext:
40+
allowPrivilegeEscalation: false
41+
capabilities:
42+
drop:
43+
- ALL
44+
45+
nodeSelector: {}
46+
tolerations: []
47+
affinity: {}

0 commit comments

Comments
 (0)