Skip to content

Commit 39b98d9

Browse files
AlanShermanAlanSherman
committed
feat: add Docker build workflows and Helm chart for deployment
- Add GitHub Actions workflows for Docker image builds: - docker-build-main.yml: builds on pushes to main branch - docker-build-tag.yml: builds on tag creation for releases - Add complete Helm chart for Kubernetes deployment: - Chart.yaml with metadata and version info - Comprehensive values.yaml with environment configuration - Template files for all Kubernetes resources: - Deployment with configurable replicas and environment variables - Service with ClusterIP type and port configuration - Ingress with TLS support and path-based routing - ServiceAccount with RBAC configuration - Helper templates for consistent naming and labeling - Configure environment variables for Auth0, Supabase, and PCC services - Set up proper resource limits and health checks - Include comprehensive README with deployment instructions This enables containerized deployment to Kubernetes environments with proper CI/CD integration for automated image builds. Signed-off-by: Alan Sherman <asherman@linuxfoundation.org>
1 parent 90e782c commit 39b98d9

File tree

10 files changed

+617
-0
lines changed

10 files changed

+617
-0
lines changed

‎.github/workflows/docker-build-main.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Copyright The Linux Foundation and each contributor to LFX.
2+
# SPDX-License-Identifier: MIT
3+
4+
name: Docker Build - Main Branch
5+
6+
on:
7+
push:
8+
branches:
9+
- main
10+
workflow_dispatch:
11+
12+
permissions:
13+
contents: read
14+
15+
env:
16+
REGISTRY: ghcr.io
17+
IMAGE_NAME: ${{ github.repository }}
18+
19+
jobs:
20+
build-and-push:
21+
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
24+
packages: write
25+
id-token: write
26+
27+
steps:
28+
- name: Checkout repository
29+
uses: actions/checkout@v4
30+
31+
- name: Set up Docker Buildx
32+
uses: docker/setup-buildx-action@v3
33+
34+
- name: Log in to Container Registry
35+
uses: docker/login-action@v3
36+
with:
37+
registry: ${{ env.REGISTRY }}
38+
username: ${{ github.actor }}
39+
password: ${{ secrets.GITHUB_TOKEN }}
40+
41+
- name: Extract metadata
42+
id: meta
43+
uses: docker/metadata-action@v5
44+
with:
45+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
46+
tags: |
47+
type=raw,value=development
48+
49+
- name: Build and push Docker image
50+
uses: docker/build-push-action@v5
51+
with:
52+
context: .
53+
push: true
54+
tags: ${{ steps.meta.outputs.tags }}
55+
labels: ${{ steps.meta.outputs.labels }}
56+
platforms: linux/amd64,linux/arm64
57+
cache-from: type=gha
58+
cache-to: type=gha,mode=max
59+
build-args: |
60+
BUILD_ENV=production

‎.github/workflows/docker-build-tag.yml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
# Copyright The Linux Foundation and each contributor to LFX.
2+
# SPDX-License-Identifier: MIT
3+
4+
name: Docker Build - Release
5+
6+
on:
7+
push:
8+
tags:
9+
- v*
10+
11+
permissions:
12+
contents: read
13+
14+
env:
15+
REGISTRY: ghcr.io
16+
IMAGE_NAME: ${{ github.repository }}
17+
COSIGN_VERSION: v2.5.3
18+
HELM_VERSION: v3.18.4
19+
20+
jobs:
21+
build-and-push:
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
packages: write
26+
id-token: write
27+
outputs:
28+
app_version: ${{ steps.prepare.outputs.app_version }}
29+
chart_name: ${{ steps.prepare.outputs.chart_name }}
30+
chart_version: ${{ steps.prepare.outputs.chart_version }}
31+
32+
steps:
33+
- name: Checkout repository
34+
uses: actions/checkout@v4
35+
36+
- name: Prepare versions and chart name
37+
id: prepare
38+
run: |
39+
set -euo pipefail
40+
APP_VERSION=$(echo ${{ github.ref_name }} | sed 's/v//g')
41+
CHART_NAME="$(yq '.name' charts/*/Chart.yaml)"
42+
CHART_VERSION="$(yq '.version' charts/*/Chart.yaml)"
43+
{
44+
echo "app_version=$APP_VERSION"
45+
echo "chart_name=$CHART_NAME"
46+
echo "chart_version=$CHART_VERSION"
47+
} >> "$GITHUB_OUTPUT"
48+
49+
- name: Set up Docker Buildx
50+
uses: docker/setup-buildx-action@v3
51+
52+
- name: Log in to Container Registry
53+
uses: docker/login-action@v3
54+
with:
55+
registry: ${{ env.REGISTRY }}
56+
username: ${{ github.actor }}
57+
password: ${{ secrets.GITHUB_TOKEN }}
58+
59+
- name: Extract metadata
60+
id: meta
61+
uses: docker/metadata-action@v5
62+
with:
63+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
64+
tags: |
65+
type=semver,pattern={{version}}
66+
type=semver,pattern={{major}}.{{minor}}
67+
68+
- name: Build and push Docker image
69+
uses: docker/build-push-action@v5
70+
with:
71+
context: .
72+
push: true
73+
tags: ${{ steps.meta.outputs.tags }}
74+
labels: ${{ steps.meta.outputs.labels }}
75+
platforms: linux/amd64,linux/arm64
76+
cache-from: type=gha
77+
cache-to: type=gha,mode=max
78+
build-args: |
79+
BUILD_ENV=production
80+
81+
release-helm-chart:
82+
needs: build-and-push
83+
runs-on: ubuntu-latest
84+
permissions:
85+
contents: write
86+
packages: write
87+
id-token: write
88+
outputs:
89+
digest: ${{ steps.publish-ghcr.outputs.digest }}
90+
image_name: ${{ steps.publish-ghcr.outputs.image_name }}
91+
steps:
92+
- name: Checkout repository
93+
uses: actions/checkout@v4
94+
95+
- name: Publish Chart to GHCR
96+
id: publish-ghcr
97+
uses: linuxfoundation/lfx-public-workflows/.github/actions/helm-chart-oci-publisher@c465d6571fa0b8be9d551d902955164ea04a00af # main
98+
with:
99+
name: ${{ needs.build-and-push.outputs.chart_name }}
100+
repository: ${{ github.repository }}/chart
101+
chart_version: ${{ needs.build-and-push.outputs.chart_version }}
102+
app_version: ${{ needs.build-and-push.outputs.app_version }}
103+
registry: ghcr.io
104+
registry_username: ${{ github.actor }}
105+
registry_password: ${{ secrets.GITHUB_TOKEN }}
106+
107+
- name: Install Cosign
108+
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
109+
with:
110+
cosign-release: "${{ env.COSIGN_VERSION }}"
111+
112+
- name: Login to GitHub
113+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
114+
with:
115+
registry: ghcr.io
116+
username: ${{ github.actor }}
117+
password: ${{ secrets.GITHUB_TOKEN }}
118+
119+
- name: Sign the Helm chart in GHCR
120+
env:
121+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
122+
run: |
123+
set -euo pipefail
124+
cosign sign --yes '${{ steps.publish-ghcr.outputs.image_name }}@${{ steps.publish-ghcr.outputs.digest }}'
125+
126+
create-ghcr-helm-provenance:
127+
needs:
128+
- release-helm-chart
129+
permissions:
130+
actions: read
131+
id-token: write
132+
packages: write
133+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
134+
with:
135+
image: ${{ needs.release-helm-chart.outputs.image_name }}
136+
digest: ${{ needs.release-helm-chart.outputs.digest }}
137+
registry-username: ${{ github.actor }}
138+
secrets:
139+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎charts/lfx-v2-pcc-ui/Chart.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Copyright The Linux Foundation and each contributor to LFX.
2+
# SPDX-License-Identifier: MIT
3+
4+
apiVersion: v2
5+
name: lfx-v2-pcc-ui
6+
description: A Helm chart for LFX Project Control Center UI - Angular SSR application with Express backend
7+
type: application
8+
version: 0.1.0
9+
appVersion: "latest"
10+
keywords:
11+
- lfx
12+
- project-control-center
13+
- ui
14+
home: https://github.com/linuxfoundation/lfx-v2-pcc-ui
15+
sources:
16+
- https://github.com/linuxfoundation/lfx-v2-pcc-ui

‎charts/lfx-v2-pcc-ui/README.md‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# LFX V2 PCC UI Helm Chart
2+
3+
This Helm chart deploys the LFX V2 PCC UI application, which is an Angular SSR application with Express backend for the LFX Project Control Center.
4+
5+
## Configuration
6+
7+
### Required Configuration
8+
9+
The following values must be configured before deployment:
10+
11+
```yaml
12+
environment:
13+
PCC_BASE_URL:
14+
value: ''
15+
PCC_AUTH0_CLIENT_ID:
16+
value: ''
17+
PCC_AUTH0_CLIENT_SECRET:
18+
value: ''
19+
SUPABASE_URL:
20+
value: ''
21+
POSTGRES_API_KEY:
22+
value: ''
23+
```
24+
25+
These can also be set from a secret
26+
27+
```yaml
28+
POSTGRES_API_KEY:
29+
value: ''
30+
valueFrom:
31+
secretKeyRef:
32+
name: pcc-env-secrets
33+
key: api_key
34+
```
35+
36+
### Global Parameters
37+
38+
| Parameter | Description | Default |
39+
| ------------------------- | ----------------------------------- | ------- |
40+
| `global.imageRegistry` | Global Docker image registry | `""` |
41+
| `global.imagePullSecrets` | Global Docker registry secret names | `[]` |
42+
43+
### Application Parameters
44+
45+
| Parameter | Description | Default |
46+
| ------------------- | ------------------ | --------------------------------------- |
47+
| `replicaCount` | Number of replicas | `1` |
48+
| `image.registry` | Image registry | `""` |
49+
| `image.repository` | Image repository | `ghcr.io/linuxfoundation/lfx-v2-pcc-ui` |
50+
| `image.tag` | Image tag | `"latest"` |
51+
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
52+
| `image.pullSecrets` | Image pull secrets | `[]` |
53+
54+
### Environment Variables
55+
56+
| Parameter | Description | Required | Default |
57+
| ------------------------------- | ------------------- | -------- | ----------------------------------------- |
58+
| `environment.ENV` | Environment name | Yes | `"production"` |
59+
| `environment.QUERY_SERVICE_URL` | Query service URL | No | `"http://localhost:8080/query/resources"` |
60+
| `environment.NODE_ENV` | Node.js environment | No | `"production"` |
61+
| `environment.PORT` | Application port | No | `"4000"` |
62+
63+
### Service Parameters
64+
65+
| Parameter | Description | Default |
66+
| --------------------- | ------------------- | ----------- |
67+
| `service.type` | Service type | `ClusterIP` |
68+
| `service.port` | Service port | `80` |
69+
| `service.targetPort` | Target port | `4000` |
70+
| `service.annotations` | Service annotations | `{}` |
71+
72+
### Ingress Parameters
73+
74+
| Parameter | Description | Default |
75+
| --------------------- | --------------------------- | ------- |
76+
| `ingress.enabled` | Enable ingress | `false` |
77+
| `ingress.className` | Ingress class name | `""` |
78+
| `ingress.annotations` | Ingress annotations | `{}` |
79+
| `ingress.hosts` | Ingress hosts configuration | `[]` |
80+
| `ingress.tls` | Ingress TLS configuration | `[]` |

‎charts/lfx-v2-pcc-ui/templates/_helpers.tpl‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# Copyright The Linux Foundation and each contributor to LFX.
2+
# SPDX-License-Identifier: MIT
3+
4+
{{/*
5+
Expand the name of the chart.
6+
*/}}
7+
{{- define "lfx-v2-pcc-ui.name" -}}
8+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
9+
{{- end }}
10+
11+
{{/*
12+
Create a default fully qualified app name.
13+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
14+
If release name contains chart name it will be used as a full name.
15+
*/}}
16+
{{- define "lfx-v2-pcc-ui.fullname" -}}
17+
{{- if .Values.fullnameOverride }}
18+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
19+
{{- else }}
20+
{{- $name := default .Chart.Name .Values.nameOverride }}
21+
{{- if contains $name .Release.Name }}
22+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
23+
{{- else }}
24+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
25+
{{- end }}
26+
{{- end }}
27+
{{- end }}
28+
29+
{{/*
30+
Create chart name and version as used by the chart label.
31+
*/}}
32+
{{- define "lfx-v2-pcc-ui.chart" -}}
33+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
34+
{{- end }}
35+
36+
{{/*
37+
Common labels
38+
*/}}
39+
{{- define "lfx-v2-pcc-ui.labels" -}}
40+
helm.sh/chart: {{ include "lfx-v2-pcc-ui.chart" . }}
41+
{{ include "lfx-v2-pcc-ui.selectorLabels" . }}
42+
{{- if .Chart.AppVersion }}
43+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
44+
{{- end }}
45+
app.kubernetes.io/managed-by: {{ .Release.Service }}
46+
{{- with .Values.labels }}
47+
{{ toYaml . }}
48+
{{- end }}
49+
{{- end }}
50+
51+
{{/*
52+
Selector labels
53+
*/}}
54+
{{- define "lfx-v2-pcc-ui.selectorLabels" -}}
55+
app.kubernetes.io/name: {{ include "lfx-v2-pcc-ui.name" . }}
56+
app.kubernetes.io/instance: {{ .Release.Name }}
57+
{{- end }}
58+
59+
{{/*
60+
Create the name of the service account to use
61+
*/}}
62+
{{- define "lfx-v2-pcc-ui.serviceAccountName" -}}
63+
{{- if .Values.serviceAccount.create }}
64+
{{- default (include "lfx-v2-pcc-ui.fullname" .) .Values.serviceAccount.name }}
65+
{{- else }}
66+
{{- default "default" .Values.serviceAccount.name }}
67+
{{- end }}
68+
{{- end }}
69+
70+
{{/*
71+
Create the image name with tag
72+
*/}}
73+
{{- define "lfx-v2-pcc-ui.image" -}}
74+
{{- $tag := .Values.image.tag | default .Chart.AppVersion }}
75+
{{- printf "%s:%s" .Values.image.repository $tag }}
76+
{{- end }}
77+
78+
{{/*
79+
Common annotations
80+
*/}}
81+
{{- define "lfx-v2-pcc-ui.annotations" -}}
82+
{{- with .Values.annotations }}
83+
{{ toYaml . }}
84+
{{- end }}
85+
{{- end }}
86+
87+
{{/*
88+
Pod annotations
89+
*/}}
90+
{{- define "lfx-v2-pcc-ui.podAnnotations" -}}
91+
{{- with .Values.podAnnotations }}
92+
{{ toYaml . }}
93+
{{- end }}
94+
{{- with .Values.annotations }}
95+
{{ toYaml . }}
96+
{{- end }}
97+
{{- end }}

0 commit comments

Comments
 (0)