Skip to content

Commit b5eb61a

Browse files
jansenfullerjansenfuller
authored
Adding health probes, resource requests and fixing container permissions (#210)
* Adding health probes and fixing container permissions * Bump version * Cleanup * No ServiceAccount anymore * No ServiceAccount anymore * Update pull secrets * Fixing yaml issue * Fixed resource requests and limits * Bumping version
1 parent 240af34 commit b5eb61a

12 files changed

Lines changed: 172 additions & 87 deletions

File tree

‎.github/workflows/helm-test.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,6 @@ jobs:
4949
grep -q 'kind: Deployment' /tmp/helm-sqlite.yaml
5050
grep -q 'kind: Service' /tmp/helm-sqlite.yaml
5151
grep -q 'kind: Ingress' /tmp/helm-sqlite.yaml
52-
grep -q 'kind: ServiceAccount' /tmp/helm-sqlite.yaml
5352
5453
# Verify SQLite-specific rendering
5554
grep -q 'emptyDir' /tmp/helm-sqlite.yaml
@@ -82,7 +81,6 @@ jobs:
8281
grep -q 'kind: Deployment' /tmp/helm-postgres.yaml
8382
grep -q 'kind: Service' /tmp/helm-postgres.yaml
8483
grep -q 'kind: Secret' /tmp/helm-postgres.yaml
85-
grep -q 'kind: ServiceAccount' /tmp/helm-postgres.yaml
8684
8785
# Verify PostgreSQL-specific rendering
8886
grep -q 'kind: HTTPRoute' /tmp/helm-postgres.yaml

‎helm/taskchampion-sync-server/.helmignore‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Patterns to ignore when building the Helm chart
22
.git
3-
.gitignore
4-
*.md
53
examples/
4+
.DS_Store
5+
*.tgz

‎helm/taskchampion-sync-server/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: taskchampion-sync-server
33
description: A Helm chart for deploying TaskChampion Sync Server on Kubernetes
44
type: application
5-
version: 0.1.2
5+
version: 0.2.0
66
appVersion: "0.7.0"
77
keywords:
88
- taskchampion

‎helm/taskchampion-sync-server/examples/postgres-values.yaml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,17 +10,20 @@ postgres:
1010
clientIdSecret: "taskchampion-client-ids"
1111

1212
env:
13-
RUST_LOG: debug
14-
LISTEN: "0.0.0.0:8080"
15-
CREATE_CLIENTS: "false"
13+
- name: RUST_LOG
14+
value: debug
15+
- name: LISTEN
16+
value: "0.0.0.0:8080"
17+
- name: CREATE_CLIENTS
18+
value: "false"
1619

1720
replicas:
1821
enabled: true
1922
count: 3
2023

2124
image:
2225
pullSecrets:
23-
- my-registry-secret
26+
- name: my-registry-secret
2427

2528
httpRoute:
2629
enabled: true

‎helm/taskchampion-sync-server/examples/sqlite-values.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,12 @@ postgres:
1212
clientIdSecret: "taskchampion-client-ids"
1313

1414
env:
15-
RUST_LOG: info
16-
LISTEN: "0.0.0.0:8080"
17-
CREATE_CLIENTS: "false"
15+
- name: RUST_LOG
16+
value: info
17+
- name: LISTEN
18+
value: "0.0.0.0:8080"
19+
- name: CREATE_CLIENTS
20+
value: "false"
1821

1922
ingress:
2023
enabled: true

‎helm/taskchampion-sync-server/templates/NOTES.txt‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
Thank you for installing {{ .Chart.Name }} — version {{ .Chart.Version }} (app: {{ .Chart.AppVersion }}).
2+
3+
## Storage Backend
4+
5+
{{- if eq .Values.sqlite.enabled true }}
6+
**SQLite** — Data is stored at `{{ .Values.sqlite.dataDir }}`.
7+
{{- if .Values.sqlite.persistence.enabled }}
8+
PersistentVolumeClaim: `{{ include "taskchampion-sync-server.fullname" . }}-pvc`
9+
{{- else if .Values.sqlite.existingPV }}
10+
Using existing PVC: `{{ .Values.sqlite.existingPV }}`
11+
{{- else }}
12+
Using an emptyDir volume (ephemeral — data is lost on pod restart).
13+
Set `sqlite.persistence.enabled=true` for persistent storage.
14+
{{- end }}
15+
{{- end }}
16+
17+
{{- if eq .Values.postgres.enabled true }}
18+
**PostgreSQL** — Connection URI stored in Secret `{{ include "taskchampion-sync-server.postgres-secret-name" . }}`.
19+
Host: {{ .Values.postgres.host }}:{{ .Values.postgres.port }}
20+
Database: {{ .Values.postgres.database }}
21+
{{- end }}
22+
23+
## Verify the Deployment
24+
25+
kubectl get pods -l {{ include "taskchampion-sync-server.selectorLabels" . | replace ": " "=" | replace "\n" "," | trimSuffix "," }}
26+
27+
## Check Pod Logs
28+
29+
kubectl logs -l {{ include "taskchampion-sync-server.selectorLabels" . | replace ": " "=" | replace "\n" "," | trimSuffix "," }}
30+
31+
## Test the API
32+
33+
kubectl port-forward svc/{{ include "taskchampion-sync-server.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }}
34+
curl http://localhost:{{ .Values.service.port }}/
35+
36+
## View Connection Secret (PostgreSQL only)
37+
38+
{{- if eq .Values.postgres.enabled true }}
39+
kubectl get secret {{ include "taskchampion-sync-server.postgres-secret-name" . }} -o jsonpath="{.data.connection}" | base64 -d
40+
{{- end }}
41+
42+
## Configuration
43+
44+
For full configuration options, see:
45+
46+
https://github.com/GothenburgBitFactory/taskchampion-sync-server

‎helm/taskchampion-sync-server/templates/_helpers.tpl‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ taskchampion-sync-server helpers
2323
helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
2424
app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
2525
app.kubernetes.io/instance: {{ .Release.Name }}
26+
app.kubernetes.io/component: server
2627
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
2728
app.kubernetes.io/managed-by: {{ .Release.Service }}
2829
{{- end }}
@@ -32,13 +33,6 @@ app.kubernetes.io/name: {{ include "taskchampion-sync-server.name" . }}
3233
app.kubernetes.io/instance: {{ .Release.Name }}
3334
{{- end }}
3435

35-
{{- define "taskchampion-sync-server.serviceAccountName" -}}
36-
{{- if .Values.serviceAccount.create }}
37-
{{- default (include "taskchampion-sync-server.fullname" .) .Values.serviceAccount.name }}
38-
{{- else }}
39-
{{- default "default" .Values.serviceAccount.name }}
40-
{{- end }}
41-
{{- end }}
4236

4337
{{- define "taskchampion-sync-server.postgres-connection" -}}
4438
{{- $host := .Values.postgres.host -}}

‎helm/taskchampion-sync-server/templates/deployment.yaml‎

Lines changed: 34 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@ spec:
1818
labels:
1919
{{- include "taskchampion-sync-server.selectorLabels" . | nindent 8 }}
2020
spec:
21-
{{- if .Values.serviceAccount.create }}
22-
serviceAccountName: {{ include "taskchampion-sync-server.fullname" . }}
23-
{{- else if .Values.serviceAccount.name }}
24-
serviceAccountName: {{ .Values.serviceAccount.name }}
21+
22+
{{- with .Values.image.pullSecrets }}
23+
imagePullSecrets:
24+
{{- toYaml . | nindent 8 }}
2525
{{- end }}
2626
securityContext:
2727
{{- toYaml .Values.securityContext | nindent 8 }}
@@ -32,6 +32,8 @@ spec:
3232
imagePullPolicy: {{ .Values.postgres.initContainer.imagePullPolicy }}
3333
securityContext:
3434
allowPrivilegeEscalation: false
35+
runAsNonRoot: true
36+
runAsUser: 999
3537
env:
3638
- name: PGURI
3739
valueFrom:
@@ -90,11 +92,18 @@ spec:
9092
imagePullPolicy: {{ .Values.image.pullPolicy }}
9193
securityContext:
9294
allowPrivilegeEscalation: false
95+
runAsNonRoot: true
96+
runAsUser: 1092
97+
readOnlyRootFilesystem: true
98+
{{- if eq .Values.postgres.enabled true }}
99+
command:
100+
- /bin/taskchampion-sync-server-postgres
101+
{{- else }}
102+
command:
103+
- /bin/taskchampion-sync-server
104+
{{- end }}
93105
env:
94-
{{- range $name, $value := .Values.env }}
95-
- name: {{ $name }}
96-
value: {{ $value | quote }}
97-
{{- end }}
106+
{{- toYaml .Values.env | nindent 12 }}
98107
{{- if .Values.clientIdSecret }}
99108
- name: CLIENT_ID
100109
valueFrom:
@@ -117,9 +126,24 @@ spec:
117126
- name: http
118127
containerPort: {{ .Values.service.targetPort }}
119128
protocol: TCP
120-
{{- with .Values.resources }}
129+
livenessProbe:
130+
httpGet:
131+
path: /
132+
port: http
133+
initialDelaySeconds: 5
134+
periodSeconds: 10
135+
readinessProbe:
136+
httpGet:
137+
path: /
138+
port: http
139+
initialDelaySeconds: 5
140+
periodSeconds: 10
141+
{{- if eq .Values.postgres.enabled true }}
142+
resources:
143+
{{- toYaml .Values.postgres.resources | nindent 12 }}
144+
{{- else }}
121145
resources:
122-
{{- toYaml . | nindent 12 }}
146+
{{- toYaml .Values.sqlite.resources | nindent 12 }}
123147
{{- end }}
124148
{{- if eq .Values.sqlite.enabled true }}
125149
volumeMounts:

‎helm/taskchampion-sync-server/templates/ingress.yaml‎

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,41 @@ spec:
1818
{{- toYaml .Values.ingress.tls | nindent 4 }}
1919
{{- end }}
2020
rules:
21+
{{- $svcName := include "taskchampion-sync-server.fullname" . -}}
22+
{{- $svcPort := $.Values.service.port -}}
2123
{{- range .Values.ingress.hosts }}
24+
{{- if kindIs "string" . }}
2225
- host: {{ . | quote }}
2326
http:
2427
paths:
2528
- path: /
2629
pathType: Prefix
2730
backend:
2831
service:
29-
name: {{ include "taskchampion-sync-server.fullname" $ }}
32+
name: {{ $svcName }}
3033
port:
31-
number: {{ $.Values.service.port }}
34+
number: {{ $svcPort }}
35+
{{- else }}
36+
- host: {{ .host | quote }}
37+
http:
38+
paths:
39+
{{- range .paths }}
40+
- path: {{ .path | default "/" | quote }}
41+
pathType: {{ .pathType | default "Prefix" }}
42+
backend:
43+
service:
44+
name: {{ $svcName }}
45+
port:
46+
number: {{ $svcPort }}
47+
{{- else }}
48+
- path: /
49+
pathType: Prefix
50+
backend:
51+
service:
52+
name: {{ $svcName }}
53+
port:
54+
number: {{ $svcPort }}
55+
{{- end }}
56+
{{- end }}
3257
{{- end }}
3358
{{- end }}

‎helm/taskchampion-sync-server/templates/serviceaccount.yaml‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

0 commit comments

Comments
 (0)