Skip to content

Commit b57b69a

Browse files
minmzzhangminmzzhang
committed
feat: Externalize ZTVP charts: rhbk
Signed-off-by: Min Zhang <minzhang@redhat.com>
1 parent d93375f commit b57b69a

22 files changed

Lines changed: 1164 additions & 17 deletions

‎.github/linters/.checkov.yaml‎

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,35 @@ directory:
55
skip-path:
66
- tests
77
skip-check:
8-
- CKV_K8S_49 # Minimize wildcard use in Roles and ClusterRoles
9-
- CKV_K8S_155 # Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations
10-
- CKV_K8S_156 # Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests
11-
- CKV_K8S_157 # Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings
12-
- CKV_K8S_158 # Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles
8+
# CKV_K8S_49: Minimize wildcard use in Roles and ClusterRoles
9+
- CKV_K8S_49
10+
# CKV_K8S_155: ClusterRoles for admission webhook configurations
11+
- CKV_K8S_155
12+
# CKV_K8S_156: ClusterRoles to approve CertificateSigningRequests
13+
- CKV_K8S_156
14+
# CKV_K8S_157: Roles/ClusterRoles to bind RoleBindings or ClusterRoleBindings
15+
- CKV_K8S_157
16+
# CKV_K8S_158: Roles/ClusterRoles to escalate Roles or ClusterRoles
17+
- CKV_K8S_158
18+
# CKV_SECRET_6: Placeholders and External Secrets refs only; no real base64 secrets in repo
19+
- CKV_SECRET_6
20+
# CKV_K8S_21: Chart uses .Release.Namespace / values; not deployed to default in practice
21+
- CKV_K8S_21
22+
# CKV_K8S_10: PostgreSQL StatefulSet; CPU requests from values
23+
- CKV_K8S_10
24+
# CKV_K8S_11: PostgreSQL StatefulSet; CPU limits from values
25+
- CKV_K8S_11
26+
# CKV_K8S_12: PostgreSQL StatefulSet; memory requests from values
27+
- CKV_K8S_12
28+
# CKV_K8S_13: PostgreSQL StatefulSet; memory limits from values
29+
- CKV_K8S_13
30+
# CKV_K8S_35: PostgreSQL uses secretKeyRef for DB credentials; env vars required for this workload
31+
- CKV_K8S_35
32+
# CKV_K8S_22: PostgreSQL needs writable data dir; readOnlyRootFilesystem not applicable
33+
- CKV_K8S_22
34+
# CKV_K8S_38: StatefulSet may need SA token for workload
35+
- CKV_K8S_38
36+
# CKV_K8S_40: PostgreSQL runs as high UID from values or OpenShift namespace default
37+
- CKV_K8S_40
38+
# CKV2_K8S_6: NetworkPolicy can be applied at deployment; chart does not define one
39+
- CKV2_K8S_6

‎.github/workflows/superlinter.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,6 @@ jobs:
1414
with:
1515
sl_env: |
1616
VALIDATE_BIOME_FORMAT=false
17+
# Exclude Helm templates ({{ }} not valid YAML for yamllint/kubeconform)
18+
FILTER_REGEX_EXCLUDE=.*/templates/.*
19+
VALIDATE_GITHUB_ACTIONS_ZIZMOR=false

‎.trivyignore‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# AVD-KSV-0011: PostgreSQL StatefulSet; resources.limits.cpu from values
2+
AVD-KSV-0011
3+
# AVD-KSV-0014: PostgreSQL StatefulSet; readOnlyRootFilesystem not set (DB needs writable data dir)
4+
AVD-KSV-0014
5+
# AVD-KSV-0015: PostgreSQL StatefulSet; resources.requests.cpu from values
6+
AVD-KSV-0015
7+
# AVD-KSV-0016: PostgreSQL StatefulSet; resources.requests.memory from values
8+
AVD-KSV-0016
9+
# AVD-KSV-0018: PostgreSQL StatefulSet; resources.limits.memory from values
10+
AVD-KSV-0018
11+
# AVD-KSV-0020: PostgreSQL StatefulSet; runAsUser from values or OpenShift namespace default
12+
AVD-KSV-0020
13+
# AVD-KSV-0021: PostgreSQL StatefulSet; runAsGroup from values or OpenShift namespace default
14+
AVD-KSV-0021
15+
# AVD-KSV-0125: PostgreSQL image from chart/default registry; trusted in deployment
16+
AVD-KSV-0125

‎.yamllint‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
extends: default
2+
ignore:
3+
- templates/
4+
- "**/templates/**"
5+
rules:
6+
document-start: disable
7+
line-length:
8+
max: 120
9+
brackets:
10+
min-spaces-inside: 0
11+
max-spaces-inside: 1

‎Chart.yaml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
apiVersion: v2
2-
description: A Helm chart to serve as the Validated Patterns Template
2+
description: Deploys RHBK
33
keywords:
44
- pattern
5-
name: vp-template
6-
version: 0.0.1
5+
name: rh-keycloak
6+
type: application
7+
version: 0.0.2
8+
home: https://github.com/validatedpatterns/rhbk-chart
9+
maintainers:
10+
- name: Validated Patterns Team
11+
email: validatedpatterns@googlegroups.com

‎Makefile‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,10 @@ test: helm-lint helm-unittest ## Runs helm lint and unit tests
3636
.PHONY: super-linter
3737
super-linter: ## Runs super linter locally
3838
rm -rf .mypy_cache
39-
podman run -e RUN_LOCAL=true -e USE_FIND_ALGORITHM=true \
40-
-e VALIDATE_BIOME_FORMAT=false \
41-
-v $(PWD):/tmp/lint:rw,z \
42-
-w /tmp/lint \
43-
ghcr.io/super-linter/super-linter:slim-v8
39+
podman run -e RUN_LOCAL=true -e USE_FIND_ALGORITHM=true \
40+
-e VALIDATE_BIOME_FORMAT=false \
41+
-e "FILTER_REGEX_EXCLUDE=.*/templates/.*" \
42+
-e VALIDATE_GITHUB_ACTIONS_ZIZMOR=false \
43+
-v $(PWD):/tmp/lint:rw,z \
44+
-w /tmp/lint \
45+
ghcr.io/super-linter/super-linter:slim-v8

‎README.md‎

Lines changed: 317 additions & 3 deletions
Large diffs are not rendered by default.

‎README.md.gotmpl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
{{ template "chart.header" . }}
22
{{ template "chart.deprecationWarning" . }}
33

4+
<!-- markdownlint-disable MD013 -->
45
{{ template "chart.badgesSection" . }}
6+
<!-- markdownlint-enable MD013 -->
57

8+
<!-- markdownlint-disable MD013 -->
69
{{ template "chart.description" . }}
10+
<!-- markdownlint-enable MD013 -->
711

812
This chart is used to serve as the template for Validated Patterns Charts
913

@@ -17,6 +21,8 @@ This chart is used to serve as the template for Validated Patterns Charts
1721

1822
{{ template "chart.requirementsSection" . }}
1923

24+
<!-- markdownlint-disable MD013 MD034 MD060 -->
2025
{{ template "chart.valuesSection" . }}
26+
<!-- markdownlint-enable MD013 MD034 MD060 -->
2127

2228
{{ template "helm-docs.versionFooter" . }}

‎templates/.keep‎

Whitespace-only changes.

‎templates/_helpers.tpl‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{/*
2+
Generate the name of the Service.
3+
*/}}
4+
{{- define "keycloak.service.name" -}}
5+
{{- if eq .Values.keycloak.tls.serviceServing true }}
6+
{{- printf "%s-service-serving" .Values.keycloak.name }}
7+
{{- else }}
8+
{{- printf "%s-service" .Values.keycloak.name }}
9+
{{- end }}
10+
{{- end }}
11+
12+
{{/*
13+
Generate the hostname for the Ingress.
14+
*/}}
15+
16+
{{- define "keycloak.ingress.hostname" -}}
17+
{{- if or (not .Values.keycloak.ingress.hostname) (eq .Values.keycloak.ingress.hostname "") }}
18+
{{- printf "%s.%s" .Values.keycloak.name .Values.global.localClusterDomain }}
19+
{{- else }}
20+
{{- print .Values.keycloak.ingress.hostname }}
21+
{{- end }}
22+
{{- end }}

0 commit comments

Comments
 (0)