Skip to content

Commit 2d8e5be

Browse files
github-actions[bot]github-actions[bot]
committed
chore: sync from governance-studio-infrastructure @ baf1c74
Updated: charts docs/auth0 docs/entra docs/keycloak govctl Source: eqtylab/governance-studio-infrastructure@baf1c74
1 parent 07fc6bf commit 2d8e5be

31 files changed

Lines changed: 1361 additions & 8 deletions

‎charts/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ This repository contains Helm charts for deploying the EQTY Lab Governance Platf
99
| [auth-service](auth-service/) | Subchart | Go-based authentication and authorization service |
1010
| [auth0-bootstrap](auth0-bootstrap/) | Utility | Auth0 application, API, and user configuration job |
1111
| [entra-bootstrap](entra-bootstrap/) | Utility | Microsoft Entra ID app registration configuration job |
12+
| [eqty-pdfgen](eqty-pdfgen/) | Subchart | PDF and ZIP rendering service for governance manifests |
1213
| [governance-ops](governance-ops/) | Ops | Operational monitoring (dashboards, alerts, endpoint probes) |
1314
| [governance-platform](governance-platform/) | Umbrella | Complete platform deployment (recommended) |
1415
| [governance-service](governance-service/) | Subchart | Go-based backend API and workflow engine |
@@ -25,6 +26,7 @@ charts/
2526
├── auth-service/ # Authentication subchart
2627
├── auth0-bootstrap/ # Auth0 configuration utility
2728
├── entra-bootstrap/ # Entra ID configuration utility
29+
├── eqty-pdfgen/ # Manifest PDF rendering subchart
2830
├── governance-ops/ # Operational monitoring (dashboards, alerts)
2931
├── governance-platform/ # Umbrella chart (deploy this for full platform)
3032
│ ├── Chart.yaml # Dependencies on all subcharts
@@ -318,6 +320,7 @@ The umbrella chart (`governance-platform`) version is incremented when:
318320
| [auth-service/README.md](auth-service/README.md) | Authentication service configuration |
319321
| [auth0-bootstrap/README.md](auth0-bootstrap/README.md) | Auth0 application/API/user setup |
320322
| [entra-bootstrap/README.md](entra-bootstrap/README.md) | Entra ID app registration setup |
323+
| [eqty-pdfgen/README.md](eqty-pdfgen/README.md) | PDF generation service configuration |
321324
| [governance-ops/README.md](governance-ops/README.md) | Operational monitoring setup |
322325
| [governance-platform/README.md](governance-platform/README.md) | Complete platform deployment guide |
323326
| [governance-service/README.md](governance-service/README.md) | Backend API configuration |

‎charts/eqty-pdfgen/.helmignore‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*~
18+
# Various IDEs
19+
.project
20+
.idea/
21+
*.tmproj
22+
.vscode/

‎charts/eqty-pdfgen/Chart.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v2
2+
name: eqty-pdfgen
3+
description: Render EQTY governance manifests into PDF and ZIP bundles.
4+
type: application
5+
version: 0.2.0
6+
appVersion: "0.2.0"
7+
home: https://github.com/eqtylab/governance-studio-infrastructure
8+
sources:
9+
- https://github.com/eqtylab/governance-studio-infrastructure/tree/main/charts/eqty-pdfgen
10+
maintainers:
11+
- name: EQTY Lab
12+
email: support@eqtylab.io

‎charts/eqty-pdfgen/README.md‎

Lines changed: 316 additions & 0 deletions
Large diffs are not rendered by default.

‎charts/eqty-pdfgen/examples/values.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# EQTY PDFGen Configuration Example
2+
# Minimal configuration for deploying the EQTY PDF generation service
3+
# For all available values, see the chart's values.yaml and README.md
4+
#
5+
# Usage:
6+
# Set these values under the `eqty-pdfgen:` key in your umbrella values file
7+
8+
# EQTY PDFGen is disabled by default in the umbrella chart; enable it per environment
9+
enabled: true
10+
11+
image:
12+
tag: ""
13+
pullPolicy: Always
14+
15+
# EQTY PDFGen is intentionally cluster-internal and does not render an Ingress.
16+
# It is reached over the internal ClusterIP service by other platform services.
17+
service:
18+
type: ClusterIP
19+
port: 8080
20+
21+
resources:
22+
requests:
23+
cpu: 100m
24+
memory: 256Mi
25+
limits:
26+
cpu: 500m
27+
memory: 512Mi
28+
29+
# Signing config is optional — the signing URL is auto-generated from the release
30+
# name, and signing only happens when a request carries an authorization bearer
31+
# token. Uncomment to override the auto-generated defaults.
32+
# config:
33+
# # Override only if Auth Service is exposed under a different internal address
34+
# signingUrl: "http://my-auth-service:8080/api/v1/protected/sign-pdf"
35+
# # RFC 3161 timestamp authority used during PDF signing
36+
# timestampUrl: "http://timestamp.digicert.com"

‎charts/eqty-pdfgen/templates/NOTES.txt‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{{- if .Values.enabled }}
2+
EQTY PDFGen has been deployed!
3+
4+
Service URL (internal): http://{{ include "eqty-pdfgen.fullname" . }}:{{ .Values.service.port }}
5+
6+
This chart exposes an internal ClusterIP service only and does not render an
7+
Ingress. To reach it from outside the cluster, use port-forwarding:
8+
kubectl port-forward svc/{{ include "eqty-pdfgen.fullname" . }} 8080:{{ .Values.service.port }} -n {{ .Release.Namespace }}
9+
Then visit: http://localhost:8080/docs
10+
11+
Configuration:
12+
Image: {{ include "eqty-pdfgen.image" . }}
13+
Signing URL: {{ include "eqty-pdfgen.signingUrl" . }}
14+
Timestamp Authority: {{ .Values.config.timestampUrl }}
15+
16+
To check the status:
17+
kubectl get pods -l app.kubernetes.io/name={{ include "eqty-pdfgen.name" . }} -n {{ .Release.Namespace }}
18+
19+
To view logs:
20+
kubectl logs -f deployment/{{ include "eqty-pdfgen.fullname" . }} -n {{ .Release.Namespace }}
21+
22+
To check health:
23+
kubectl exec -it deployment/{{ include "eqty-pdfgen.fullname" . }} -n {{ .Release.Namespace }} -- curl -s localhost:{{ .Values.service.port }}/health/ready
24+
25+
To render a manifest:
26+
POST http://{{ include "eqty-pdfgen.fullname" . }}:{{ .Values.service.port }}/manifest (ZIP bundle)
27+
POST http://{{ include "eqty-pdfgen.fullname" . }}:{{ .Values.service.port }}/manifest?format=pdf (plain PDF)
28+
29+
Note: PDF signing is delegated to Auth Service and only happens when a request
30+
carries an authorization bearer token. The default signing URL above points at
31+
the co-deployed Auth Service; override config.signingUrl if it is exposed under
32+
a different internal address.
33+
{{- end }}
34+
</content>

‎charts/eqty-pdfgen/templates/_helpers.tpl‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "eqty-pdfgen.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
6+
{{- end -}}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
*/}}
11+
{{- define "eqty-pdfgen.fullname" -}}
12+
{{- if .Values.fullnameOverride -}}
13+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
14+
{{- else -}}
15+
{{- printf "%s-%s" .Release.Name (include "eqty-pdfgen.name" .) | trunc 63 | trimSuffix "-" -}}
16+
{{- end -}}
17+
{{- end -}}
18+
19+
{{/*
20+
Create chart name and version as used by the chart label.
21+
*/}}
22+
{{- define "eqty-pdfgen.chart" -}}
23+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
24+
{{- end -}}
25+
26+
{{/*
27+
Common labels.
28+
*/}}
29+
{{- define "eqty-pdfgen.labels" -}}
30+
helm.sh/chart: {{ include "eqty-pdfgen.chart" . }}
31+
{{ include "eqty-pdfgen.selectorLabels" . }}
32+
{{- if .Chart.AppVersion }}
33+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
34+
{{- end }}
35+
app.kubernetes.io/managed-by: {{ .Release.Service }}
36+
{{- end -}}
37+
38+
{{/*
39+
Selector labels.
40+
*/}}
41+
{{- define "eqty-pdfgen.selectorLabels" -}}
42+
app.kubernetes.io/name: {{ include "eqty-pdfgen.name" . }}
43+
app.kubernetes.io/instance: {{ .Release.Name }}
44+
{{- end -}}
45+
46+
{{/*
47+
Resolve the image repository, honoring customer registry mirror overrides.
48+
*/}}
49+
{{- define "eqty-pdfgen.imageRepository" -}}
50+
{{- $repository := .Values.image.repository -}}
51+
{{- $registryOverride := default "" ((.Values.global).imageRegistryOverride) -}}
52+
{{- $prefixOverride := default "" ((.Values.global).imageRepositoryPrefixOverride) -}}
53+
{{- if $prefixOverride -}}
54+
{{- printf "%s/%s" (trimSuffix "/" $prefixOverride) (base $repository) -}}
55+
{{- else if $registryOverride -}}
56+
{{- $parts := splitList "/" $repository -}}
57+
{{- printf "%s/%s" (trimSuffix "/" $registryOverride) (join "/" (slice $parts 1)) -}}
58+
{{- else -}}
59+
{{- $repository -}}
60+
{{- end -}}
61+
{{- end -}}
62+
63+
{{/*
64+
Resolve the full image reference.
65+
*/}}
66+
{{- define "eqty-pdfgen.image" -}}
67+
{{- printf "%s:%s" (include "eqty-pdfgen.imageRepository" .) (.Values.image.tag | default .Chart.AppVersion) -}}
68+
{{- end -}}
69+
70+
{{/*
71+
Resolve the render tmp mount path from config.tmpDir.
72+
*/}}
73+
{{- define "eqty-pdfgen.renderTmpPath" -}}
74+
{{- $tmpDir := .Values.config.tmpDir | default "tmp" -}}
75+
{{- if hasPrefix "/" $tmpDir -}}
76+
{{- $tmpDir -}}
77+
{{- else -}}
78+
{{- printf "/opt/app-root/src/%s" $tmpDir -}}
79+
{{- end -}}
80+
{{- end -}}
81+
82+
{{/*
83+
Default signing URL for platform installs.
84+
*/}}
85+
{{- define "eqty-pdfgen.signingUrl" -}}
86+
{{- .Values.config.signingUrl | default (printf "http://%s-auth-service:8080/api/v1/protected/sign-pdf" .Release.Name) -}}
87+
{{- end -}}

‎charts/eqty-pdfgen/templates/deployment.yaml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
{{- if .Values.enabled }}
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: {{ include "eqty-pdfgen.fullname" . }}
6+
labels:
7+
{{- include "eqty-pdfgen.labels" . | nindent 4 }}
8+
spec:
9+
{{- if not .Values.autoscaling.enabled }}
10+
replicas: {{ .Values.replicaCount }}
11+
{{- end }}
12+
selector:
13+
matchLabels:
14+
{{- include "eqty-pdfgen.selectorLabels" . | nindent 6 }}
15+
template:
16+
metadata:
17+
labels:
18+
{{- include "eqty-pdfgen.selectorLabels" . | nindent 8 }}
19+
{{- with .Values.podLabels }}
20+
{{- toYaml . | nindent 8 }}
21+
{{- end }}
22+
{{- with .Values.podAnnotations }}
23+
annotations:
24+
{{- toYaml . | nindent 8 }}
25+
{{- end }}
26+
spec:
27+
{{- if and .Values.global (((.Values.global).secrets).imageRegistry).secretName }}
28+
imagePullSecrets:
29+
- name: {{ ((.Values.global).secrets).imageRegistry.secretName }}
30+
{{- else if .Values.imagePullSecrets }}
31+
imagePullSecrets:
32+
{{- toYaml .Values.imagePullSecrets | nindent 8 }}
33+
{{- end }}
34+
{{- if or .Values.serviceAccount.create .Values.serviceAccount.name }}
35+
serviceAccountName: {{ .Values.serviceAccount.name | default (include "eqty-pdfgen.fullname" .) }}
36+
automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
37+
{{- end }}
38+
{{- with .Values.podSecurityContext }}
39+
securityContext:
40+
{{- toYaml . | nindent 8 }}
41+
{{- end }}
42+
{{- with .Values.nodeSelector }}
43+
nodeSelector:
44+
{{- toYaml . | nindent 8 }}
45+
{{- end }}
46+
{{- with .Values.affinity }}
47+
affinity:
48+
{{- toYaml . | nindent 8 }}
49+
{{- end }}
50+
{{- with .Values.tolerations }}
51+
tolerations:
52+
{{- toYaml . | nindent 8 }}
53+
{{- end }}
54+
containers:
55+
- name: {{ .Chart.Name }}
56+
{{- with .Values.securityContext }}
57+
securityContext:
58+
{{- toYaml . | nindent 12 }}
59+
{{- end }}
60+
image: {{ include "eqty-pdfgen.image" . | quote }}
61+
imagePullPolicy: {{ .Values.image.pullPolicy | default ((.Values.global).imagePullPolicy | default "IfNotPresent") }}
62+
env:
63+
- name: HOST
64+
value: {{ .Values.config.host | quote }}
65+
- name: PORT
66+
value: {{ (.Values.config.port | default .Values.service.port) | quote }}
67+
- name: PDFGEN_TMP_DIR
68+
value: {{ .Values.config.tmpDir | quote }}
69+
- name: TYPST_FONT_PATHS
70+
value: {{ .Values.config.typstFontPaths | quote }}
71+
- name: TYPST_PACKAGE_CACHE_PATH
72+
value: {{ .Values.config.typstPackageCachePath | quote }}
73+
- name: EQTY_TIMESTAMP_URL
74+
value: {{ .Values.config.timestampUrl | quote }}
75+
- name: EQTY_SIGNING_URL
76+
value: {{ include "eqty-pdfgen.signingUrl" . | quote }}
77+
{{- with .Values.extraEnvVars }}
78+
{{- toYaml . | nindent 12 }}
79+
{{- end }}
80+
{{- if or .Values.extraEnvVarsSecret .Values.extraEnvVarsConfigMap }}
81+
envFrom:
82+
{{- if .Values.extraEnvVarsSecret }}
83+
- secretRef:
84+
name: {{ .Values.extraEnvVarsSecret | quote }}
85+
{{- end }}
86+
{{- if .Values.extraEnvVarsConfigMap }}
87+
- configMapRef:
88+
name: {{ .Values.extraEnvVarsConfigMap | quote }}
89+
{{- end }}
90+
{{- end }}
91+
ports:
92+
- name: http
93+
containerPort: {{ .Values.config.port | default .Values.service.port }}
94+
protocol: TCP
95+
{{- with .Values.startupProbe }}
96+
startupProbe:
97+
{{- toYaml . | nindent 12 }}
98+
{{- end }}
99+
{{- with .Values.livenessProbe }}
100+
livenessProbe:
101+
{{- toYaml . | nindent 12 }}
102+
{{- end }}
103+
{{- with .Values.readinessProbe }}
104+
readinessProbe:
105+
{{- toYaml . | nindent 12 }}
106+
{{- end }}
107+
{{- with .Values.resources }}
108+
resources:
109+
{{- toYaml . | nindent 12 }}
110+
{{- end }}
111+
volumeMounts:
112+
- name: render-tmp
113+
mountPath: {{ include "eqty-pdfgen.renderTmpPath" . }}
114+
- name: os-tmp
115+
mountPath: /tmp
116+
volumes:
117+
- name: render-tmp
118+
emptyDir: {}
119+
- name: os-tmp
120+
emptyDir: {}
121+
{{- end }}

‎charts/eqty-pdfgen/templates/hpa.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{{- if and .Values.enabled .Values.autoscaling.enabled }}
2+
apiVersion: autoscaling/v2
3+
kind: HorizontalPodAutoscaler
4+
metadata:
5+
name: {{ include "eqty-pdfgen.fullname" . }}
6+
labels:
7+
{{- include "eqty-pdfgen.labels" . | nindent 4 }}
8+
spec:
9+
scaleTargetRef:
10+
apiVersion: apps/v1
11+
kind: Deployment
12+
name: {{ include "eqty-pdfgen.fullname" . }}
13+
minReplicas: {{ .Values.autoscaling.minReplicas }}
14+
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
15+
metrics:
16+
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
17+
- type: Resource
18+
resource:
19+
name: cpu
20+
target:
21+
type: Utilization
22+
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
23+
{{- end }}
24+
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
25+
- type: Resource
26+
resource:
27+
name: memory
28+
target:
29+
type: Utilization
30+
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
31+
{{- end }}
32+
{{- end }}

‎charts/eqty-pdfgen/templates/networkpolicy.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if and .Values.enabled .Values.networkPolicy.enabled }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: NetworkPolicy
4+
metadata:
5+
name: {{ include "eqty-pdfgen.fullname" . }}
6+
labels:
7+
{{- include "eqty-pdfgen.labels" . | nindent 4 }}
8+
spec:
9+
podSelector:
10+
matchLabels:
11+
{{- include "eqty-pdfgen.selectorLabels" . | nindent 6 }}
12+
policyTypes:
13+
- Ingress
14+
- Egress
15+
{{- with .Values.networkPolicy.ingress }}
16+
ingress:
17+
{{- toYaml . | nindent 4 }}
18+
{{- end }}
19+
{{- with .Values.networkPolicy.egress }}
20+
egress:
21+
{{- toYaml . | nindent 4 }}
22+
{{- end }}
23+
{{- end }}

0 commit comments

Comments
 (0)