feat(volumes): add volume management

README.md

@@ -19,6 +19,7 @@ This repository contains a Helm chart to deploy docker images built with [Franke
 - **Jobs/Hooks**: Run migrations or one-off tasks using Helm hooks.
 - **Monitoring**: Integrated `PodMonitor` for Prometheus (requires Prometheus Operator).
 - **Scheduling**: Support for `nodeSelector`, `affinity`, and `tolerations` for all pods.
+- **Volume Management**: Mount any Kubernetes volume (Secrets, ConfigMaps, PVCs) into all pods.
 
 ## Examples
 
@@ -31,6 +32,7 @@ Some configuration examples are available in the [examples/](examples/) director
 - [Jobs](examples/07-jobs.yaml)
 - [High Availability](examples/08-high-availability.yaml)
 - [Production Setup](examples/02-production.yaml)
+- [Secrets & Volume Mounts](examples/11-secrets-volumes.yaml)
 
 ## Installation
 

charts/frankenphp/templates/crons.yaml

@@ -37,6 +37,12 @@ spec:
               env:
                 {{- toYaml . | nindent 16 }}
               {{- end }}
+              {{- if or $.Values.volumeMounts }}
+              volumeMounts:
+                {{- with $.Values.volumeMounts }}
+                {{- toYaml . | nindent 16 }}
+                {{- end }}
+              {{- end }}
           {{- with $.Values.nodeSelector }}
           nodeSelector:
             {{- toYaml . | nindent 12 }}
@@ -49,4 +55,8 @@ spec:
           tolerations:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with $.Values.volumes }}
+          volumes:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
 {{- end }}

charts/frankenphp/templates/deployment.yaml

@@ -48,6 +48,7 @@ spec:
           env:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if or .Values.caddyfile .Values.php.ini .Values.volumeMounts }}
           volumeMounts:
           {{- if .Values.caddyfile }}
             - name: caddyfile
@@ -58,6 +59,10 @@ spec:
               mountPath: /usr/local/etc/php/conf.d/99-custom.ini
               subPath: php.ini
           {{- end }}
+          {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -70,6 +75,7 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if or .Values.caddyfile .Values.php.ini .Values.volumes }}
       volumes:
       {{- if .Values.caddyfile }}
         - name: caddyfile # To access this volume, this name must be used inside volumeMounts of the container
@@ -84,4 +90,8 @@ spec:
           configMap:
             name: {{ .Release.Name }}-php-ini
       {{- end }}
+      {{- with .Values.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- end }}
 {{- end }}

charts/frankenphp/templates/jobs.yaml

@@ -43,11 +43,16 @@ spec:
           {{- end }}
           resources:
             {{- toYaml ($job.resources | default $context.Values.resources) | nindent 12 }}
-          {{- if $context.Values.php.ini }}
+          {{- if or $context.Values.php.ini $context.Values.volumeMounts }}
           volumeMounts:
+            {{- if $context.Values.php.ini }}
             - name: php-ini
               mountPath: /usr/local/etc/php/conf.d/99-custom.ini
               subPath: php.ini
+            {{- end }}
+            {{- with $context.Values.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           {{- end }}
       {{- with $context.Values.nodeSelector }}
       nodeSelector:
@@ -61,10 +66,15 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if $context.Values.php.ini }}
+      {{- if or $context.Values.php.ini $context.Values.volumes }}
       volumes:
+        {{- if $context.Values.php.ini }}
         - name: php-ini
           configMap:
             name: {{ $context.Release.Name }}-php-ini
+        {{- end }}
+        {{- with $context.Values.volumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- end }}
 {{- end }}

charts/frankenphp/templates/worker.yaml

@@ -45,11 +45,16 @@ spec:
             - {{ .command | quote }}
           resources:
             {{- toYaml $.Values.resources | nindent 12 }}
-          {{- if $.Values.php.ini }}
+          {{- if or $.Values.php.ini $.Values.volumeMounts }}
           volumeMounts:
+            {{- if $.Values.php.ini }}
             - name: php-ini
               mountPath: /usr/local/etc/php/conf.d/99-custom.ini
               subPath: php.ini
+            {{- end }}
+            {{- with $.Values.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           {{- end }}
       {{- with $.Values.nodeSelector }}
       nodeSelector:
@@ -63,10 +68,15 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if $.Values.php.ini }}
+      {{- if or $.Values.php.ini $.Values.volumes }}
       volumes:
+        {{- if $.Values.php.ini }}
         - name: php-ini
           configMap:
             name: {{ $.Release.Name }}-php-ini
+        {{- end }}
+        {{- with $.Values.volumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       {{- end }}
 {{- end }}

charts/frankenphp/tests/volumes_test.yaml

@@ -0,0 +1,226 @@
+suite: Volume Management
+templates:
+  - deployment.yaml
+  - worker.yaml
+  - crons.yaml
+  - jobs.yaml
+
+tests:
+  # --- Deployment ---
+
+  - it: should mount extra volume in Deployment
+    template: deployment.yaml
+    set:
+      volumes:
+        - name: symfony-decrypt-key
+          secret:
+            secretName: symfony-secrets
+      volumeMounts:
+        - name: symfony-decrypt-key
+          mountPath: /app/config/secrets/prod/prod.decrypt.private.php
+          subPath: prod.decrypt.private.php
+          readOnly: true
+    asserts:
+      - equal:
+          path: spec.template.spec.volumes[0].name
+          value: symfony-decrypt-key
+      - equal:
+          path: spec.template.spec.volumes[0].secret.secretName
+          value: symfony-secrets
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].name
+          value: symfony-decrypt-key
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].mountPath
+          value: /app/config/secrets/prod/prod.decrypt.private.php
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].readOnly
+          value: true
+
+  - it: should not add volumes section when volumes is empty in Deployment
+    template: deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.volumes
+
+  - it: should append extra volumeMount after php-ini in Deployment
+    template: deployment.yaml
+    set:
+      php:
+        ini: "memory_limit = 512M"
+      volumes:
+        - name: my-secret
+          secret:
+            secretName: my-secret
+      volumeMounts:
+        - name: my-secret
+          mountPath: /app/secret
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].name
+          value: php-ini
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[1].name
+          value: my-secret
+      - equal:
+          path: spec.template.spec.volumes[0].name
+          value: php-ini
+      - equal:
+          path: spec.template.spec.volumes[1].name
+          value: my-secret
+
+  # --- Worker ---
+
+  - it: should mount extra volume in Worker
+    template: worker.yaml
+    set:
+      consumers:
+        - name: queue
+          command: "php bin/console messenger:consume"
+      volumes:
+        - name: symfony-decrypt-key
+          secret:
+            secretName: symfony-secrets
+      volumeMounts:
+        - name: symfony-decrypt-key
+          mountPath: /app/config/secrets/prod/prod.decrypt.private.php
+          subPath: prod.decrypt.private.php
+          readOnly: true
+    asserts:
+      - equal:
+          path: spec.template.spec.volumes[0].name
+          value: symfony-decrypt-key
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].name
+          value: symfony-decrypt-key
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].mountPath
+          value: /app/config/secrets/prod/prod.decrypt.private.php
+
+  - it: should append extra volumeMount after php-ini in Worker
+    template: worker.yaml
+    set:
+      consumers:
+        - name: queue
+          command: "php bin/console messenger:consume"
+      php:
+        ini: "memory_limit = 512M"
+      volumes:
+        - name: my-secret
+          secret:
+            secretName: my-secret
+      volumeMounts:
+        - name: my-secret
+          mountPath: /app/secret
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].name
+          value: php-ini
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[1].name
+          value: my-secret
+      - equal:
+          path: spec.template.spec.volumes[0].name
+          value: php-ini
+      - equal:
+          path: spec.template.spec.volumes[1].name
+          value: my-secret
+
+  # --- CronJob ---
+
+  - it: should mount extra volume in CronJob
+    template: crons.yaml
+    set:
+      crons:
+        - name: my-cron
+          command: "php bin/console app:run"
+          schedule: "*/5 * * * *"
+      volumes:
+        - name: symfony-decrypt-key
+          secret:
+            secretName: symfony-secrets
+      volumeMounts:
+        - name: symfony-decrypt-key
+          mountPath: /app/config/secrets/prod/prod.decrypt.private.php
+          subPath: prod.decrypt.private.php
+          readOnly: true
+    asserts:
+      - equal:
+          path: spec.jobTemplate.spec.template.spec.volumes[0].name
+          value: symfony-decrypt-key
+      - equal:
+          path: spec.jobTemplate.spec.template.spec.containers[0].volumeMounts[0].name
+          value: symfony-decrypt-key
+      - equal:
+          path: spec.jobTemplate.spec.template.spec.containers[0].volumeMounts[0].mountPath
+          value: /app/config/secrets/prod/prod.decrypt.private.php
+
+  - it: should not add volumes in CronJob when volumes is empty
+    template: crons.yaml
+    set:
+      crons:
+        - name: my-cron
+          command: "php bin/console app:run"
+          schedule: "*/5 * * * *"
+    asserts:
+      - notExists:
+          path: spec.jobTemplate.spec.template.spec.volumes
+      - notExists:
+          path: spec.jobTemplate.spec.template.spec.containers[0].volumeMounts
+
+  # --- Job ---
+
+  - it: should mount extra volume in Job
+    template: jobs.yaml
+    set:
+      jobs:
+        - name: migrate
+          command: "php bin/console doctrine:migrations:migrate"
+      volumes:
+        - name: symfony-decrypt-key
+          secret:
+            secretName: symfony-secrets
+      volumeMounts:
+        - name: symfony-decrypt-key
+          mountPath: /app/config/secrets/prod/prod.decrypt.private.php
+          subPath: prod.decrypt.private.php
+          readOnly: true
+    asserts:
+      - equal:
+          path: spec.template.spec.volumes[0].name
+          value: symfony-decrypt-key
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].name
+          value: symfony-decrypt-key
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].mountPath
+          value: /app/config/secrets/prod/prod.decrypt.private.php
+
+  - it: should append extra volumeMount after php-ini in Job
+    template: jobs.yaml
+    set:
+      jobs:
+        - name: migrate
+          command: "php bin/console doctrine:migrations:migrate"
+      php:
+        ini: "memory_limit = 512M"
+      volumes:
+        - name: my-secret
+          secret:
+            secretName: my-secret
+      volumeMounts:
+        - name: my-secret
+          mountPath: /app/secret
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].name
+          value: php-ini
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[1].name
+          value: my-secret
+      - equal:
+          path: spec.template.spec.volumes[0].name
+          value: php-ini
+      - equal:
+          path: spec.template.spec.volumes[1].name
+          value: my-secret

charts/frankenphp/values.schema.json

@@ -338,6 +338,20 @@
             "items": {
                 "type": "object"
             }
+        },
+        "volumes": {
+            "type": "array",
+            "description": "Extra volumes to add to all pods",
+            "items": {
+                "type": "object"
+            }
+        },
+        "volumeMounts": {
+            "type": "array",
+            "description": "Extra volume mounts to add to all containers",
+            "items": {
+                "type": "object"
+            }
         }
     }
 }