Skip to content

Commit 701a2f9

Browse files
amartingarciaamartingarcia
authored
feat: Powerpipe (#43)
1 parent 3ab5c5e commit 701a2f9

17 files changed

Lines changed: 878 additions & 21 deletions

‎.github/updatecli/helm-appversion.yaml‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,21 +10,19 @@ sources:
1010
pattern: ">=v2.0.0"
1111
conditions: {}
1212
targets:
13-
appVersion:
14-
name: bump appVersion
13+
imageTag:
14+
name: bump steampipe image tag in values.yaml
1515
kind: helmchart
1616
spec:
1717
name: charts/steampipe
18-
file: Chart.yaml
19-
key: $.appVersion
18+
file: values.yaml
19+
key: $.image.tag
2020
sourceid: steampipe
21-
chartVersion:
22-
name: bump chart version
21+
appVersion:
22+
name: bump appVersion in Chart.yaml (informational reference)
2323
kind: helmchart
2424
spec:
2525
name: charts/steampipe
2626
file: Chart.yaml
27-
key: $.version
27+
key: $.appVersion
2828
sourceid: steampipe
29-
transformers:
30-
- trimprefix: "v"

‎.github/updatecli/helm-powerpipe-tag.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
sources:
2+
powerpipe:
3+
kind: githubrelease
4+
spec:
5+
owner: "devops-ia"
6+
repository: "powerpipe"
7+
token: {{ requiredEnv "GITHUB_TOKEN" }}
8+
versionFilter:
9+
kind: semver
10+
pattern: ">=v1.0.0"
11+
conditions: {}
12+
targets:
13+
powerpipeTag:
14+
name: bump powerpipe image tag in values.yaml
15+
kind: helmchart
16+
spec:
17+
name: charts/steampipe
18+
file: values.yaml
19+
key: $.powerpipe.image.tag
20+
sourceid: powerpipe
21+
transformers:
22+
- addprefix: "v"

‎charts/steampipe/Chart.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
apiVersion: v2
22
name: steampipe
3-
description: A Helm chart for Kubernetes to deploy Steampipe
3+
description: A Helm chart for Kubernetes to deploy Steampipe and optionally Powerpipe
44
type: application
55
version: 2.4.1
66
appVersion: v2.4.1
77
home: https://github.com/devops-ia/helm-steampipe
88
sources:
99
- https://github.com/devops-ia/steampipe
10+
- https://github.com/devops-ia/powerpipe
1011
- https://github.com/devops-ia/helm-steampipe
1112
maintainers:
1213
- name: amartingarcia
@@ -15,6 +16,9 @@ maintainers:
1516
email: hello@ialejandro.rocks
1617
keywords:
1718
- steampipe
19+
- powerpipe
1820
- sql
1921
- cloud
2022
- devops
23+
- dashboards
24+
- compliance

‎charts/steampipe/README.md‎

Lines changed: 80 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,57 @@ Steampipe exposes a standard PostgreSQL interface. Point any Postgres datasource
247247
| Password | value of `STEAMPIPE_DATABASE_PASSWORD` |
248248
| SSL Mode | `disable` (within cluster) |
249249

250+
### 7 — Steampipe + Powerpipe full stack
251+
252+
Deploy both Steampipe (data backend) and Powerpipe (dashboard) in a single Helm release:
253+
254+
```yaml
255+
# Steampipe — expose PostgreSQL endpoint
256+
bbdd:
257+
enabled: true
258+
serviceType: ClusterIP
259+
260+
env:
261+
- name: STEAMPIPE_DATABASE_PASSWORD
262+
valueFrom:
263+
secretKeyRef:
264+
name: steampipe-password
265+
key: password
266+
267+
initContainer:
268+
plugins:
269+
- aws
270+
271+
extraVolumes:
272+
- name: aws-credentials
273+
secret:
274+
secretName: aws-credentials
275+
extraVolumeMount:
276+
- name: aws-credentials
277+
mountPath: /home/steampipe/.steampipe/config/aws.spc
278+
subPath: aws.spc
279+
readOnly: true
280+
281+
# Powerpipe — dashboard on port 9033
282+
powerpipe:
283+
enabled: true
284+
# Connection string to Steampipe (use release name + -psql suffix)
285+
database: "postgresql://steampipe:your-stable-password@my-release-steampipe-psql:9193/steampipe"
286+
initContainer:
287+
mods:
288+
- "github.com/turbot/steampipe-mod-aws-compliance"
289+
ingress:
290+
enabled: true
291+
className: nginx
292+
hosts:
293+
- host: powerpipe.example.com
294+
paths:
295+
- path: /
296+
pathType: Prefix
297+
```
298+
299+
Access the Powerpipe dashboard at `http://powerpipe.example.com` once the mods are installed.
300+
250301
---
251302

252303
## Environment Variables Reference
@@ -446,7 +497,7 @@ env:
446497

447498
| Change | Migration action |
448499
|--------|-----------------|
449-
| `powerpipe.*` removed | Powerpipe is now a separate Helm chart. Remove `powerpipe.*` from values. |
500+
| `powerpipe.*` removed in v4.0.0, re-added in v4.1.0+ | If upgrading from v3.x to v4.0.0, remove `powerpipe.*`. From v4.1.0+ you can use `powerpipe.enabled: true`. |
450501
| `oauth2Proxy.*` / `oauth2-proxy` sub-chart removed | Manage authentication externally. Remove `oauth2Proxy.*` from values. |
451502
| `extraConfig.*` removed | Use `extraVolumes` + `extraVolumeMount` with standard Kubernetes Secrets/ConfigMaps instead. |
452503
| `dashboard.*` removed | Already removed in v2. If still present, remove. |
@@ -550,6 +601,34 @@ helm show values steampipe/steampipe
550601
| podAnnotations | object | `{}` | Pod annotations |
551602
| podLabels | object | `{}` | Pod labels |
552603
| podSecurityContext | object | `{"fsGroup":9193,"runAsGroup":0,"runAsUser":9193}` | Privilege and access control settings for a Pod or Container Steampipe runs as UID=9193, GID=0 (root group for OpenShift compatibility) |
604+
| powerpipe | object | `{"affinity":{},"database":"","deploymentAnnotations":{},"enabled":false,"env":[],"envFrom":[],"extraContainers":[],"extraVolumeMount":[],"extraVolumes":[],"image":{"pullPolicy":"IfNotPresent","repository":"ghcr.io/devops-ia/powerpipe","tag":"v1.5.1"},"ingress":{"annotations":{},"className":"","enabled":false,"hosts":[{"host":"powerpipe.local","paths":[{"path":"/","pathType":"ImplementationSpecific"}]}],"tls":[]},"initContainer":{"extraInitVolumeMount":[],"image":{"pullPolicy":"IfNotPresent"},"mods":[],"resources":{},"securityContext":{"runAsNonRoot":true,"runAsUser":9193}},"livenessProbe":{},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"podSecurityContext":{"fsGroup":9193,"runAsGroup":0,"runAsUser":9193},"readinessProbe":{},"replicaCount":1,"resources":{},"securityContext":{"runAsNonRoot":true,"runAsUser":9193},"service":{"annotations":{},"port":9033,"type":"ClusterIP"},"startupProbe":{},"tolerations":[],"topologySpreadConstraints":[]}` | Powerpipe configuration (optional component) Powerpipe provides dashboards and compliance benchmarks that connect to Steampipe as their database. Requires Steampipe to be running with bbdd.enabled=true to accept connections. Ref: https://powerpipe.io/docs |
605+
| powerpipe.affinity | object | `{}` | Affinity for pod assignment |
606+
| powerpipe.database | string | `""` | Powerpipe database connection string (required) Must point to a running Steampipe PostgreSQL endpoint. Example: "postgresql://steampipe:<password>@<release-name>-steampipe-psql:9193/steampipe" If set, POWERPIPE_DATABASE is injected automatically as an env var. If empty, set it yourself via env/envFrom using a Kubernetes Secret. |
607+
| powerpipe.deploymentAnnotations | object | `{}` | Deployment annotations |
608+
| powerpipe.enabled | bool | `false` | Enable Powerpipe deployment |
609+
| powerpipe.env | list | `[]` | Environment variables for the Powerpipe container Ref: https://powerpipe.io/docs/reference/env-vars/overview |
610+
| powerpipe.envFrom | list | `[]` | Variables from file |
611+
| powerpipe.extraContainers | list | `[]` | Extra containers to add to the Powerpipe pod |
612+
| powerpipe.extraVolumeMount | list | `[]` | Mount extra volumes |
613+
| powerpipe.extraVolumes | list | `[]` | Reference volumes |
614+
| powerpipe.image | object | `{"pullPolicy":"IfNotPresent","repository":"ghcr.io/devops-ia/powerpipe","tag":"v1.5.1"}` | Image registry |
615+
| powerpipe.ingress | object | `{"annotations":{},"className":"","enabled":false,"hosts":[{"host":"powerpipe.local","paths":[{"path":"/","pathType":"ImplementationSpecific"}]}],"tls":[]}` | Ingress configuration for the Powerpipe dashboard Unlike Steampipe, Powerpipe exposes HTTP — a standard Kubernetes Ingress works here. |
616+
| powerpipe.initContainer | object | `{"extraInitVolumeMount":[],"image":{"pullPolicy":"IfNotPresent"},"mods":[],"resources":{},"securityContext":{"runAsNonRoot":true,"runAsUser":9193}}` | Configure initContainer for Powerpipe mods The init container installs Powerpipe mods before the main container starts. It uses the same image (repository + tag) as the main Powerpipe container. Ref: https://hub.steampipe.io/mods |
617+
| powerpipe.initContainer.mods | list | `[]` | Powerpipe mods to install Example: "github.com/turbot/steampipe-mod-aws-compliance" |
618+
| powerpipe.initContainer.resources | object | `{}` | The resources limits and requested |
619+
| powerpipe.livenessProbe | object | `{}` | Configure liveness probe |
620+
| powerpipe.nodeSelector | object | `{}` | Node labels for pod assignment |
621+
| powerpipe.podAnnotations | object | `{}` | Pod annotations |
622+
| powerpipe.podLabels | object | `{}` | Pod labels |
623+
| powerpipe.podSecurityContext | object | `{"fsGroup":9193,"runAsGroup":0,"runAsUser":9193}` | Privilege and access control settings for the Powerpipe pod Powerpipe uses UID=9193, GID=0 (same as Steampipe, OpenShift compatible) |
624+
| powerpipe.readinessProbe | object | `{}` | Configure readinessProbe |
625+
| powerpipe.replicaCount | int | `1` | Number of replicas |
626+
| powerpipe.resources | object | `{}` | The resources limits and requested |
627+
| powerpipe.securityContext | object | `{"runAsNonRoot":true,"runAsUser":9193}` | Privilege and access control settings for the Powerpipe container |
628+
| powerpipe.service | object | `{"annotations":{},"port":9033,"type":"ClusterIP"}` | Service configuration for the Powerpipe dashboard Powerpipe exposes an HTTP dashboard (not TCP/PostgreSQL), so standard Ingress works fine. |
629+
| powerpipe.startupProbe | object | `{}` | Configure startupProbe |
630+
| powerpipe.tolerations | list | `[]` | Tolerations for pod assignment |
631+
| powerpipe.topologySpreadConstraints | list | `[]` | Topology spread constraints for pod assignment |
553632
| readinessProbe | object | `{}` | Configure readinessProbe Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ |
554633
| replicaCount | int | `1` | Number of replicas |
555634
| resources | object | `{}` | The resources limits and requested |

‎charts/steampipe/README.md.gotmpl‎

Lines changed: 52 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,57 @@ Steampipe exposes a standard PostgreSQL interface. Point any Postgres datasource
244244
| Password | value of `STEAMPIPE_DATABASE_PASSWORD` |
245245
| SSL Mode | `disable` (within cluster) |
246246

247+
### 7 — Steampipe + Powerpipe full stack
248+
249+
Deploy both Steampipe (data backend) and Powerpipe (dashboard) in a single Helm release:
250+
251+
```yaml
252+
# Steampipe — expose PostgreSQL endpoint
253+
bbdd:
254+
enabled: true
255+
serviceType: ClusterIP
256+
257+
env:
258+
- name: STEAMPIPE_DATABASE_PASSWORD
259+
valueFrom:
260+
secretKeyRef:
261+
name: steampipe-password
262+
key: password
263+
264+
initContainer:
265+
plugins:
266+
- aws
267+
268+
extraVolumes:
269+
- name: aws-credentials
270+
secret:
271+
secretName: aws-credentials
272+
extraVolumeMount:
273+
- name: aws-credentials
274+
mountPath: /home/steampipe/.steampipe/config/aws.spc
275+
subPath: aws.spc
276+
readOnly: true
277+
278+
# Powerpipe — dashboard on port 9033
279+
powerpipe:
280+
enabled: true
281+
# Connection string to Steampipe (use release name + -psql suffix)
282+
database: "postgresql://steampipe:your-stable-password@my-release-steampipe-psql:9193/steampipe"
283+
initContainer:
284+
mods:
285+
- "github.com/turbot/steampipe-mod-aws-compliance"
286+
ingress:
287+
enabled: true
288+
className: nginx
289+
hosts:
290+
- host: powerpipe.example.com
291+
paths:
292+
- path: /
293+
pathType: Prefix
294+
```
295+
296+
Access the Powerpipe dashboard at `http://powerpipe.example.com` once the mods are installed.
297+
247298
---
248299

249300
## Environment Variables Reference
@@ -443,7 +494,7 @@ env:
443494

444495
| Change | Migration action |
445496
|--------|-----------------|
446-
| `powerpipe.*` removed | Powerpipe is now a separate Helm chart. Remove `powerpipe.*` from values. |
497+
| `powerpipe.*` removed in v4.0.0, re-added in v4.1.0+ | If upgrading from v3.x to v4.0.0, remove `powerpipe.*`. From v4.1.0+ you can use `powerpipe.enabled: true`. |
447498
| `oauth2Proxy.*` / `oauth2-proxy` sub-chart removed | Manage authentication externally. Remove `oauth2Proxy.*` from values. |
448499
| `extraConfig.*` removed | Use `extraVolumes` + `extraVolumeMount` with standard Kubernetes Secrets/ConfigMaps instead. |
449500
| `dashboard.*` removed | Already removed in v2. If still present, remove. |

‎charts/steampipe/ci/values-powerpipe.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# -- CI values: Powerpipe enabled with mods
2+
powerpipe:
3+
enabled: true
4+
database: "postgresql://steampipe:test@release-name-steampipe-psql:9193/steampipe"
5+
initContainer:
6+
mods:
7+
- "github.com/turbot/steampipe-mod-kubernetes-compliance"
8+
9+
bbdd:
10+
enabled: true

‎charts/steampipe/templates/NOTES.txt‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,33 @@ The Steampipe endpoint is exposed at:
3636
{{- end }}
3737

3838
{{- end }}
39+
40+
{{- if .Values.powerpipe.enabled }}
41+
42+
─────────────────────────────────────────
43+
Powerpipe dashboard is also deployed.
44+
45+
{{- if .Values.powerpipe.ingress.enabled }}
46+
47+
Access the dashboard at:
48+
{{- range $host := .Values.powerpipe.ingress.hosts }}
49+
{{- range .paths }}
50+
http{{ if $.Values.powerpipe.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
51+
{{- end }}
52+
{{- end }}
53+
54+
{{- else }}
55+
56+
Access the dashboard via port-forward:
57+
kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "steampipe.powerpipe.fullname" . }} 9033:9033
58+
open http://localhost:9033
59+
60+
{{- end }}
61+
62+
{{- if not .Values.powerpipe.database }}
63+
⚠ POWERPIPE_DATABASE is not set. Powerpipe will not be able to query data.
64+
Set powerpipe.database to your Steampipe connection string, for example:
65+
postgresql://steampipe:<password>@{{ include "steampipe.fullname" . }}-psql:9193/steampipe
66+
{{- end }}
67+
68+
{{- end }}

‎charts/steampipe/templates/_helpers.tpl‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,3 +61,30 @@ Create the name of the service account to use
6161
{{- end }}
6262
{{- end }}
6363

64+
{{/*
65+
Fully qualified name for Powerpipe resources.
66+
*/}}
67+
{{- define "steampipe.powerpipe.fullname" -}}
68+
{{- printf "%s-powerpipe" (include "steampipe.fullname" .) | trunc 63 | trimSuffix "-" }}
69+
{{- end }}
70+
71+
{{/*
72+
Selector labels for Powerpipe resources.
73+
*/}}
74+
{{- define "steampipe.powerpipe.selectorLabels" -}}
75+
app.kubernetes.io/name: {{ include "steampipe.name" . }}-powerpipe
76+
app.kubernetes.io/instance: {{ .Release.Name }}
77+
{{- end }}
78+
79+
{{/*
80+
Labels for Powerpipe resources (includes chart + version metadata).
81+
*/}}
82+
{{- define "steampipe.powerpipe.labels" -}}
83+
helm.sh/chart: {{ include "steampipe.chart" . }}
84+
{{ include "steampipe.powerpipe.selectorLabels" . }}
85+
{{- if .Values.powerpipe.image.tag }}
86+
app.kubernetes.io/version: {{ .Values.powerpipe.image.tag | quote }}
87+
{{- end }}
88+
app.kubernetes.io/managed-by: {{ .Release.Service }}
89+
{{- end }}
90+

‎charts/steampipe/templates/deployment.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ spec:
2828
{{- if .Values.initContainer.plugins }}
2929
initContainers:
3030
- name: init
31-
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
31+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
3232
imagePullPolicy: {{ .Values.initContainer.image.pullPolicy }}
3333
securityContext:
3434
{{- toYaml .Values.initContainer.securityContext | nindent 12 }}
@@ -56,7 +56,7 @@ spec:
5656
- name: {{ .Chart.Name }}
5757
securityContext:
5858
{{- toYaml .Values.securityContext | nindent 12 }}
59-
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
59+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
6060
imagePullPolicy: {{ .Values.image.pullPolicy }}
6161
{{- if .Values.command }}
6262
command:

‎charts/steampipe/templates/powerpipe-configmap-mods.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{- if and .Values.powerpipe.enabled .Values.powerpipe.initContainer.mods }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "steampipe.powerpipe.fullname" . }}-scripts
6+
labels:
7+
{{- include "steampipe.powerpipe.labels" . | nindent 4 }}
8+
data:
9+
init.sh: |-
10+
set -e
11+
{{- with .Values.powerpipe.initContainer.mods }}
12+
echo "Powerpipe - Install Mods"
13+
{{- range $key, $value := . }}
14+
powerpipe mod install {{ $value }}
15+
{{- end }}
16+
{{- end }}
17+
{{- end }}

0 commit comments

Comments
 (0)