Skip to content

Commit 889de27

Browse files
wolf31o2wolf31o2
authored
Merge pull request #12 from ApplauseOSS/feat/helm-chart
feat: helm chart
2 parents 6808e55 + e197634 commit 889de27

7 files changed

Lines changed: 281 additions & 0 deletions

File tree

‎.github/workflows/publish-helm-chart.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: publish-helm-chart
2+
3+
on:
4+
push:
5+
branches: ['master']
6+
tags:
7+
- '*'
8+
paths:
9+
- 'helm/**'
10+
11+
concurrency: ${{ github.ref }}
12+
13+
jobs:
14+
build-and-push-helm-chart:
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
packages: write
19+
steps:
20+
- uses: actions/checkout@v4
21+
- name: Install Helm
22+
uses: azure/setup-helm@v4.2.0
23+
- name: Package and upload chart
24+
shell: bash
25+
env:
26+
REGISTRY: "ghcr.io"
27+
REPOSITORY: "${{ github.repository }}"
28+
TOKEN: "${{ secrets.GITHUB_TOKEN }}"
29+
USER: "${{ github.repository_owner }}"
30+
run: |
31+
rm -rf dist
32+
mkdir dist
33+
helm package helm/ -d dist/
34+
echo "${TOKEN}" | helm registry login "${REGISTRY}/${REPOSITORY,,}" -u "${USER}" --password-stdin
35+
for file in dist/*; do
36+
helm push "$file" "oci://${REGISTRY}/${REPOSITORY,,}/charts"
37+
done

‎helm/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎helm/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
appVersion: "1.0"
3+
description: Deploy self-registering SDM gateway
4+
name: strongdm-gateway
5+
version: 1.0.0

‎helm/templates/admin-token-secret.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: {{ .Chart.Name }}-admin-token
5+
stringData:
6+
token: {{ .Values.sdm.admin.token }}

‎helm/templates/eip-attach-configmap.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# configmap for eip-attach init container
2+
{{- if .Values.sdm.gateway.eip.enabled }}
3+
apiVersion: v1
4+
kind: ConfigMap
5+
metadata:
6+
name: eip-attach-script
7+
labels:
8+
app: eip-attach-script
9+
data:
10+
eip-attach.sh: |-
11+
#!/bin/bash
12+
METADATA_TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
13+
AZ=$(curl -s -H "X-aws-ec2-metadata-token: $METADATA_TOKEN" http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r .availabilityZone)
14+
INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $METADATA_TOKEN" http://169.254.169.254/latest/meta-data/instance-id)
15+
INTERFACE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $METADATA_TOKEN" "http://169.254.169.254/latest/meta-data/network/interfaces/macs/$(</sys/class/net/eth0/address)/interface-id")
16+
REGION=$(curl -s -H "X-aws-ec2-metadata-token: $METADATA_TOKEN" http://169.254.169.254/latest/dynamic/instance-identity/document | jq -r .region)
17+
# start EIP attachment loop
18+
while [[ $(aws ec2 describe-addresses --region ${REGION} --filters Name=instance-id,Values=${INSTANCE_ID} --query 'Addresses[0].InstanceId' --output text) != ${INSTANCE_ID} ]]; do
19+
EIP_ALLOCATION_ID=$(aws ec2 describe-addresses --region ${REGION} --filters Name=tag:{{ .Values.sdm.gateway.eip.tag }},Values={{ .Values.sdm.gateway.eip.value }} Name=tag:az,Values=${AZ} --query 'Addresses[*].AllocationId | [0]' --output text)
20+
aws ec2 associate-address --region ${REGION} --allocation-id ${EIP_ALLOCATION_ID} --network-interface-id ${INTERFACE_ID} --allow-reassociation
21+
done
22+
# We have our EIP, let's write out the address to disk
23+
EIP_ADDR=$(aws ec2 describe-addresses --region ${REGION} --filters Name=tag:{{ .Values.sdm.gateway.eip.tag }},Values={{ .Values.sdm.gateway.eip.value }} Name=tag:az,Values=${AZ} --query 'Addresses[0].PublicIp' --output text)
24+
echo "export SDM_RELAY_ADDR=${EIP_ADDR}" > /config/public-ipv4
25+
{{- end }}

‎helm/templates/gateway-deployment.yaml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
{{- if .Values.sdm.gateway.enabled }}
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: {{ .Chart.Name }}
6+
labels:
7+
app: sdm-gateway
8+
spec:
9+
replicas: {{ .Values.sdm.gateway.replicas }}
10+
selector:
11+
matchLabels:
12+
app: sdm-gateway
13+
{{- if .Values.sdm.gateway.strategy }}
14+
strategy:
15+
{{ toYaml .Values.sdm.gateway.strategy | indent 4 }}
16+
{{- end }}
17+
template:
18+
metadata:
19+
annotations:
20+
cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
21+
{{- if .Values.sdm.gateway.podAnnotations }}
22+
{{ toYaml .Values.sdm.gateway.podAnnotations | indent 8 }}
23+
{{- end }}
24+
labels:
25+
app: sdm-gateway
26+
spec:
27+
{{- if .Values.sdm.gateway.affinity }}
28+
affinity:
29+
{{ toYaml .Values.sdm.gateway.affinity | indent 8 }}
30+
{{- end }}
31+
hostNetwork: {{ .Values.sdm.gateway.hostNetwork }}
32+
{{- if .Values.sdm.gateway.nodeSelector }}
33+
nodeSelector:
34+
{{ toYaml .Values.sdm.gateway.nodeSelector | indent 8 }}
35+
{{- end }}
36+
{{- if or .Values.sdm.gateway.eip.enabled .Values.sdm.gateway.initContainers }}
37+
initContainers:
38+
{{- if .Values.sdm.gateway.eip.enabled }}
39+
- name: eip-attach
40+
image: {{ .Values.sdm.gateway.eip.image }}
41+
imagePullPolicy: IfNotPresent
42+
command:
43+
- /bin/bash
44+
- /usr/local/bin/eip-attach.sh
45+
volumeMounts:
46+
- name: eip-attach-script
47+
mountPath: /usr/local/bin/eip-attach.sh
48+
subPath: eip-attach.sh
49+
- name: config-dir
50+
mountPath: /config
51+
{{- end }}
52+
{{- if .Values.sdm.gateway.initContainers }}
53+
{{ toYaml .Values.sdm.gateway.initContainers | indent 8 }}
54+
{{- end }}
55+
{{- end }}
56+
containers:
57+
- name: sdm-gateway
58+
image: {{ .Values.sdm.gateway.image }}
59+
imagePullPolicy: Always
60+
{{- if .Values.sdm.gateway.eip.enabled }}
61+
command:
62+
- /bin/bash
63+
- -c
64+
- >-
65+
source /config/public-ipv4 &&
66+
/docker-entrypoint.sh
67+
{{- end }}
68+
env:
69+
- name: SDM_ORCHESTRATOR_PROBES
70+
value: ":9090"
71+
- name: SDM_ADMIN_TOKEN
72+
valueFrom:
73+
secretKeyRef:
74+
name: {{ .Chart.Name }}-admin-token
75+
key: token
76+
- name: SDM_RELAY_PORT
77+
value: "{{ .Values.sdm.gateway.port }}"
78+
- name: SDM_RELAY_TOKEN_FILE
79+
value: /config/token.txt
80+
- name: SDM_RELAY_NAME
81+
valueFrom:
82+
fieldRef:
83+
fieldPath: metadata.name
84+
livenessProbe:
85+
httpGet:
86+
path: /liveness
87+
port: 9090
88+
initialDelaySeconds: 5
89+
periodSeconds: 10
90+
ports:
91+
- name: proxy
92+
containerPort: {{ .Values.sdm.gateway.port }}
93+
resources: {{ toYaml .Values.sdm.gateway.resources | nindent 10 }}
94+
volumeMounts:
95+
- name: config-dir
96+
mountPath: /config
97+
{{- if .Values.sdm.logExporter.enabled }}
98+
- name: log-dir
99+
mountPath: /home/sdmuser/logs
100+
{{- end }}
101+
{{- if .Values.sdm.logExporter.enabled }}
102+
- name: log-exporter
103+
image: {{ .Values.sdm.logExporter.image }}
104+
imagePullPolicy: Always
105+
env:
106+
- name: LOG_EXPORT_CONTAINER_INPUT
107+
value: file-json
108+
- name: LOG_FILE_PATH
109+
value: '/var/log/sdm/*.log'
110+
- name: LOG_EXPORT_CONTAINER_OUTPUT
111+
value: sumologic
112+
- name: SUMOLOGIC_ENDPOINT
113+
value: {{ .Values.sdm.logExporter.sumoLogic.endpoint }}
114+
- name: SUMOLOGIC_SOURCE_CATEGORY
115+
value: {{ .Values.sdm.logExporter.sumoLogic.sourceCategory }}
116+
resources: {{ toYaml .Values.sdm.logExporter.resources | nindent 10 }}
117+
volumeMounts:
118+
- name: log-dir
119+
mountPath: /var/log/sdm
120+
{{- end }}
121+
{{- if .Values.sdm.gateway.tolerations }}
122+
tolerations:
123+
{{ toYaml .Values.sdm.gateway.tolerations | indent 8 }}
124+
{{- end }}
125+
volumes:
126+
- name: config-dir
127+
emptyDir: {}
128+
{{- if .Values.sdm.logExporter.enabled }}
129+
- name: log-dir
130+
emptyDir: {}
131+
{{- end }}
132+
{{- if .Values.sdm.gateway.eip.enabled }}
133+
- name: eip-attach-script
134+
configMap:
135+
name: eip-attach-script
136+
{{- end }}
137+
{{- end }}

‎helm/values.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Default values for sdm-gateway
2+
3+
sdm:
4+
admin:
5+
# This value should be a base64-encoded SDM admin token with at least "relay:create" permissions
6+
token: CHANGEME
7+
gateway:
8+
enabled: true
9+
image: applause/strongdm-gateway:1.2.2
10+
port: 5000
11+
replicas: 3
12+
eip:
13+
enabled: true
14+
image: amazon/aws-cli:2.15.62
15+
tag: ec2_instance
16+
value: dev_gateway
17+
affinity:
18+
nodeAffinity:
19+
requiredDuringSchedulingIgnoredDuringExecution:
20+
nodeSelectorTerms:
21+
- matchExpressions:
22+
- key: subnet
23+
operator: In
24+
values:
25+
- public
26+
hostNetwork: true
27+
nodeSelector:
28+
sdm: "true"
29+
resources:
30+
requests:
31+
cpu: 500m
32+
memory: 64Mi
33+
limits:
34+
cpu: 3
35+
memory: 1Gi
36+
# the number of pods is equal to number of nodes and we can't fit two pods on same node
37+
strategy:
38+
rollingUpdate:
39+
maxSurge: 0
40+
logExporter:
41+
enabled: true
42+
image: applause/strongdm-log-export:1.0.43.2
43+
sumoLogic:
44+
# This value is the endpoint URL from sumologic
45+
endpoint: ENDPOINT
46+
# This value is the category in sumologic for this data
47+
sourceCategory: CATEGORY
48+
resources: {}

0 commit comments

Comments
 (0)