Skip to content

Commit 2f2f581

Browse files
fghanmifghanmi
authored
Merge pull request #38 from securesign/add/console-deployment
[SECURESIGN-2870] Add Kustomize-based deployment resources for console stack for Tech Preview
2 parents e7ade06 + ce4bfe6 commit 2f2f581

13 files changed

+475
-3
lines changed

‎.env‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
11
CONSOLE_IMAGE=quay.io/securesign/rhtas-console@sha256:75966d60ed709af33efd48c53b96ea7b2fcd4608f90ccc56885bf224e34b55f5
22
CONSOLE_UI_IMAGE=quay.io/securesign/rhtas-console-ui@sha256:c0b0b2d76548c05efadb2425baf93609cf6c40180f170cb531fbb7689a91db31
3-
CONSOLE_DB_IMAGE=mariadb:lts-ubi
4-
3+
CONSOLE_DB_IMAGE=registry.redhat.io/rhel9/mariadb-105@sha256:050dd5a7a32395b73b8680570e967e55050b152727412fdd73a25d8816e62d53

‎README.md‎

Lines changed: 73 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,4 +92,76 @@ Make sure the `ubi.repo` file has all repositories enabled `enabled = 1` and the
9292

9393
```
9494
rpm-lockfile-prototype --image $BASE_IMAGE rpms.in.yaml
95-
```
95+
```
96+
97+
## Deployment
98+
99+
The `deployment/` directory contains Kubernetes manifests organized into a `base/` directory and an `overlays/dev/` directory for deploying the RHTAS Console (UI, backend, and database) using [Kustomize](https://kustomize.io/). The `base/` directory includes:
100+
101+
- `console-backend-deploy.yaml`: Deployment configuration for the console backend.
102+
- `console-backend-service.yaml`: Service definition for the backend.
103+
- `console-db-statefulset.yaml`: StatefulSet configuration for the console database.
104+
- `console-db-secret.yaml`: Secrets for database credentials.
105+
- `console-db-service.yaml`: Service definition for the database.
106+
- `console-serviceaccounts.yaml`: Service accounts for the console components.
107+
- `console-ui-deploy.yaml`: Deployment configuration for the console UI.
108+
- `console-ui-route.yaml`: Route configuration for the UI.
109+
- `console-ui-service.yaml`: Service definition for the UI.
110+
- `kustomization.yaml`: Kustomize configuration to orchestrate the deployment.
111+
112+
The `overlays/dev/` directory contains a `kustomization.yaml` for environment-specific customizations.
113+
114+
### Prerequisites
115+
116+
- A running OpenShift cluster.
117+
- `oc` CLI installed.
118+
- A running RHTAS instance to retrieve the TUF route URL.
119+
120+
### Deployment Steps
121+
122+
1. **Set TUF_REPO_URL using a ConfigMap**:
123+
124+
Before deploying, you need to retrieve the TUF repository URL from your running RHTAS instance. This value should be stored in a ConfigMap that the console backend can consume.
125+
126+
* Retrieve the TUF route URL from your running RHTAS instance:
127+
```bash
128+
oc get tuf -o jsonpath='{.items[0].status.url}'
129+
```
130+
131+
* Create a ConfigMap with the retrieved URL:
132+
```bash
133+
oc create configmap tuf-repo-config \
134+
--from-literal=TUF_REPO_URL=<output-from-above-command> \
135+
-n trusted-artifact-signer
136+
```
137+
138+
2. **Apply the Deployment**:
139+
140+
Ensure that an RHTAS instance is properly deployed and running in the `trusted-artifact-signer` namespace.
141+
142+
Deploy the console using Kustomize:
143+
144+
```bash
145+
oc apply -k deployment/overlays/dev/
146+
```
147+
148+
4. **Verify the Deployment**:
149+
150+
Check the status of the deployed resources:
151+
152+
```bash
153+
oc get pods,services,routes -n trusted-artifact-signer
154+
```
155+
156+
You can access the console via a browser using the UI route:
157+
```bash
158+
oc get route console-ui -o jsonpath='https://{.spec.host}{"\n"}'
159+
```
160+
161+
5. **Deletion**:
162+
163+
To delete the deployed resources:
164+
165+
```bash
166+
oc delete -k deployment/overlays/dev/
167+
```

‎deployment/base/console-backend-deploy.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: console-backend
5+
labels:
6+
app.kubernetes.io/name: securesign-sample
7+
app.kubernetes.io/instance: securesign-sample
8+
app.kubernetes.io/part-of: trusted-artifact-signer
9+
app.kubernetes.io/component: console-backend
10+
spec:
11+
replicas: 1
12+
selector:
13+
matchLabels:
14+
app.kubernetes.io/name: securesign-sample
15+
app.kubernetes.io/instance: securesign-sample
16+
app.kubernetes.io/part-of: trusted-artifact-signer
17+
app.kubernetes.io/component: console-backend
18+
strategy:
19+
type: Recreate
20+
template:
21+
metadata:
22+
labels:
23+
app.kubernetes.io/name: securesign-sample
24+
app.kubernetes.io/instance: securesign-sample
25+
app.kubernetes.io/part-of: trusted-artifact-signer
26+
app.kubernetes.io/component: console-backend
27+
spec:
28+
serviceAccountName: console-backend
29+
initContainers:
30+
- name: wait-for-console-db
31+
image: default/console-db-image
32+
command:
33+
- /bin/sh
34+
- -c
35+
- |
36+
until mysqladmin ping -hconsole-db --silent; do
37+
echo 'Waiting for the console database to be ready...'
38+
sleep 5
39+
done
40+
containers:
41+
- name: console-backend
42+
image: default/console-image
43+
imagePullPolicy: IfNotPresent
44+
env:
45+
- name: TUF_REPO_URL
46+
valueFrom:
47+
configMapKeyRef:
48+
name: tuf-repo-config
49+
key: TUF_REPO_URL
50+
- name: DB_DSN
51+
valueFrom:
52+
secretKeyRef:
53+
name: console-db-connection
54+
key: dsn
55+
- name: MYSQL_USER
56+
valueFrom:
57+
secretKeyRef:
58+
name: console-db-connection
59+
key: mysql-user
60+
- name: MYSQL_PASSWORD
61+
valueFrom:
62+
secretKeyRef:
63+
name: console-db-connection
64+
key: mysql-password
65+
- name: SSL_CERT_DIR
66+
value: /var/run/configs/tas/ca-trust:/var/run/secrets/kubernetes.io/serviceaccount
67+
ports:
68+
- containerPort: 8080
69+
name: http
70+
protocol: TCP
71+
livenessProbe:
72+
failureThreshold: 3
73+
httpGet:
74+
path: /healthz
75+
port: 8080
76+
scheme: HTTP
77+
initialDelaySeconds: 20
78+
periodSeconds: 10
79+
successThreshold: 1
80+
timeoutSeconds: 5
81+
readinessProbe:
82+
failureThreshold: 3
83+
httpGet:
84+
path: /healthz
85+
port: 8080
86+
scheme: HTTP
87+
initialDelaySeconds: 10
88+
periodSeconds: 10
89+
successThreshold: 1
90+
timeoutSeconds: 5

‎deployment/base/console-backend-service.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: console-backend
5+
labels:
6+
app.kubernetes.io/name: securesign-sample
7+
app.kubernetes.io/instance: securesign-sample
8+
app.kubernetes.io/part-of: trusted-artifact-signer
9+
app.kubernetes.io/component: console-backend
10+
spec:
11+
type: ClusterIP
12+
selector:
13+
app.kubernetes.io/name: securesign-sample
14+
app.kubernetes.io/instance: securesign-sample
15+
app.kubernetes.io/part-of: trusted-artifact-signer
16+
app.kubernetes.io/component: console-backend
17+
ports:
18+
- name: http
19+
port: 8080
20+
targetPort: http

‎deployment/base/console-db-secret.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: console-db-connection
5+
labels:
6+
app.kubernetes.io/name: securesign-sample
7+
app.kubernetes.io/instance: securesign-sample
8+
app.kubernetes.io/part-of: trusted-artifact-signer
9+
app.kubernetes.io/component: console-db
10+
type: Opaque
11+
stringData:
12+
mysql-user: mysql
13+
mysql-password: mysqlpassword
14+
mysql-database: tuf_trust
15+
mysql-root-password: rootpw
16+
mysql-port: "3306"
17+
dsn: "mysql:mysqlpassword@tcp(console-db:3306)/tuf_trust"

‎deployment/base/console-db-service.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: console-db
5+
labels:
6+
app.kubernetes.io/name: securesign-sample
7+
app.kubernetes.io/instance: securesign-sample
8+
app.kubernetes.io/part-of: trusted-artifact-signer
9+
app.kubernetes.io/component: console-db
10+
spec:
11+
type: ClusterIP
12+
selector:
13+
app.kubernetes.io/name: securesign-sample
14+
app.kubernetes.io/instance: securesign-sample
15+
app.kubernetes.io/part-of: trusted-artifact-signer
16+
app.kubernetes.io/component: console-db
17+
ports:
18+
- name: mysql
19+
port: 3306
20+
targetPort: mysql

‎deployment/base/console-db-statefulset.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
name: console-db
5+
labels:
6+
app.kubernetes.io/name: securesign-sample
7+
app.kubernetes.io/instance: securesign-sample
8+
app.kubernetes.io/part-of: trusted-artifact-signer
9+
app.kubernetes.io/component: console-db
10+
spec:
11+
replicas: 1
12+
selector:
13+
matchLabels:
14+
app.kubernetes.io/name: securesign-sample
15+
app.kubernetes.io/instance: securesign-sample
16+
app.kubernetes.io/part-of: trusted-artifact-signer
17+
app.kubernetes.io/component: console-db
18+
strategy:
19+
type: Recreate
20+
template:
21+
metadata:
22+
labels:
23+
app.kubernetes.io/name: securesign-sample
24+
app.kubernetes.io/instance: securesign-sample
25+
app.kubernetes.io/part-of: trusted-artifact-signer
26+
app.kubernetes.io/component: console-db
27+
spec:
28+
serviceAccountName: console-db
29+
containers:
30+
- name: console-db
31+
image: default/console-db-image
32+
imagePullPolicy: IfNotPresent
33+
command: ["run-mysqld"]
34+
env:
35+
- name: MYSQL_USER
36+
valueFrom:
37+
secretKeyRef:
38+
name: console-db-connection
39+
key: mysql-user
40+
- name: MYSQL_PASSWORD
41+
valueFrom:
42+
secretKeyRef:
43+
name: console-db-connection
44+
key: mysql-password
45+
- name: MYSQL_DATABASE
46+
valueFrom:
47+
secretKeyRef:
48+
name: console-db-connection
49+
key: mysql-database
50+
- name: MYSQL_ROOT_PASSWORD
51+
valueFrom:
52+
secretKeyRef:
53+
name: console-db-connection
54+
key: mysql-root-password
55+
- name: MYSQL_PORT
56+
valueFrom:
57+
secretKeyRef:
58+
name: console-db-connection
59+
key: mysql-port
60+
ports:
61+
- containerPort: 3306
62+
name: mysql
63+
livenessProbe:
64+
exec:
65+
command:
66+
- bash
67+
- -c
68+
- mariadb-admin -u ${MYSQL_USER} -p${MYSQL_PASSWORD} ping
69+
failureThreshold: 3
70+
initialDelaySeconds: 30
71+
periodSeconds: 10
72+
successThreshold: 1
73+
timeoutSeconds: 1
74+
readinessProbe:
75+
exec:
76+
command:
77+
- bash
78+
- -c
79+
- mariadb -u ${MYSQL_USER} -p${MYSQL_PASSWORD} -e "SELECT 1;"
80+
failureThreshold: 3
81+
initialDelaySeconds: 10
82+
periodSeconds: 10
83+
successThreshold: 1
84+
timeoutSeconds: 1
85+
volumeMounts:
86+
- mountPath: /var/lib/mysql
87+
name: storage
88+
volumeClaimTemplates:
89+
- metadata:
90+
name: storage
91+
labels:
92+
app.kubernetes.io/name: securesign-sample
93+
app.kubernetes.io/instance: securesign-sample
94+
app.kubernetes.io/part-of: trusted-artifact-signer
95+
app.kubernetes.io/component: console-db
96+
spec:
97+
accessModes:
98+
- ReadWriteOnce
99+
resources:
100+
requests:
101+
storage: 1Gi

‎deployment/base/console-serviceaccounts.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: console-db
5+
---
6+
apiVersion: v1
7+
kind: ServiceAccount
8+
metadata:
9+
name: console-backend
10+
---
11+
apiVersion: v1
12+
kind: ServiceAccount
13+
metadata:
14+
name: console-ui

0 commit comments

Comments
 (0)