From a18b2ec77bd679efa794e16b08fc35a1bf14ac35 Mon Sep 17 00:00:00 2001 From: Josh Kodroff Date: Wed, 12 Sep 2018 12:11:27 -0400 Subject: [PATCH] Add helm chart (#267) --- .gitignore | 1 + helm/atlantis/.helmignore | 21 ++ helm/atlantis/Chart.yaml | 11 + helm/atlantis/templates/NOTES.txt | 19 ++ helm/atlantis/templates/_helpers.tpl | 32 +++ helm/atlantis/templates/ingress.yaml | 29 +++ .../templates/secret-service-account.yaml | 16 ++ helm/atlantis/templates/secret-webhook.yaml | 24 +++ helm/atlantis/templates/service.yaml | 19 ++ helm/atlantis/templates/statefulset.yaml | 190 ++++++++++++++++++ helm/atlantis/values.yaml | 130 ++++++++++++ 11 files changed, 492 insertions(+) create mode 100644 helm/atlantis/.helmignore create mode 100644 helm/atlantis/Chart.yaml create mode 100644 helm/atlantis/templates/NOTES.txt create mode 100644 helm/atlantis/templates/_helpers.tpl create mode 100644 helm/atlantis/templates/ingress.yaml create mode 100644 helm/atlantis/templates/secret-service-account.yaml create mode 100644 helm/atlantis/templates/secret-webhook.yaml create mode 100644 helm/atlantis/templates/service.yaml create mode 100644 helm/atlantis/templates/statefulset.yaml create mode 100644 helm/atlantis/values.yaml diff --git a/.gitignore b/.gitignore index 596795d94..14349d26b 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ output .terraform/ node_modules/ **/.vuepress/dist +helm/test-values.yaml \ No newline at end of file diff --git a/helm/atlantis/.helmignore b/helm/atlantis/.helmignore new file mode 100644 index 000000000..f0c131944 --- /dev/null +++ b/helm/atlantis/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/helm/atlantis/Chart.yaml b/helm/atlantis/Chart.yaml new file mode 100644 index 000000000..18c94fdd2 --- /dev/null +++ b/helm/atlantis/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +appVersion: "v0.4.5" +description: A Helm chart for Atlantis https://www.runatlantis.io +name: atlantis +version: 0.1.0 +keywords: +- terraform +home: https://www.runatlantis.io +icon: https://www.runatlantis.io/hero.png +sources: +- https://github.com/runatlantis/atlantis diff --git a/helm/atlantis/templates/NOTES.txt b/helm/atlantis/templates/NOTES.txt new file mode 100644 index 000000000..db70bbb17 --- /dev/null +++ b/helm/atlantis/templates/NOTES.txt @@ -0,0 +1,19 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.ingress.path }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "atlantis.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ template "atlantis.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "atlantis.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "atlantis.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl port-forward $POD_NAME 8080:80 +{{- end }} diff --git a/helm/atlantis/templates/_helpers.tpl b/helm/atlantis/templates/_helpers.tpl new file mode 100644 index 000000000..8b2a8b4e5 --- /dev/null +++ b/helm/atlantis/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "atlantis.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "atlantis.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "atlantis.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/helm/atlantis/templates/ingress.yaml b/helm/atlantis/templates/ingress.yaml new file mode 100644 index 000000000..b2c73969a --- /dev/null +++ b/helm/atlantis/templates/ingress.yaml @@ -0,0 +1,29 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "atlantis.fullname" . -}} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- with .Values.ingress.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +spec: +{{- if .Values.ingress.tls }} + tls: +{{ toYaml .Values.ingress.tls | indent 4 }} +{{- end }} + rules: + - host: {{ .Values.ingress.host }} + http: + paths: + - path: {{ .Values.ingress.path }} + backend: + serviceName: {{ $fullName }} + servicePort: 4141 +{{- end }} diff --git a/helm/atlantis/templates/secret-service-account.yaml b/helm/atlantis/templates/secret-service-account.yaml new file mode 100644 index 000000000..5a9fddb94 --- /dev/null +++ b/helm/atlantis/templates/secret-service-account.yaml @@ -0,0 +1,16 @@ +{{- $all := . -}} +{{ range $name, $secret := .Values.serviceAccountSecrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $name }} + labels: + app: {{ $name }} + chart: {{ template "atlantis.chart" $all }} + component: service-account-secret + heritage: {{ $all.Release.Service }} + release: {{ $all.Release.Name }} +data: + service-account.json: {{ $secret }} +--- +{{ end }} \ No newline at end of file diff --git a/helm/atlantis/templates/secret-webhook.yaml b/helm/atlantis/templates/secret-webhook.yaml new file mode 100644 index 000000000..2b965b8ee --- /dev/null +++ b/helm/atlantis/templates/secret-webhook.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "atlantis.name" . }}-webhook + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + {{- if .Values.github }} + github_token: {{ required "github.token is required if github configuration is specified." .Values.github.token | b64enc }} + github_secret: {{ required "github.secret is required if github configuration is specified." .Values.github.secret | b64enc }} + {{- end}} + {{- if .Values.gitlab }} + gitlab_token: {{ required "gitlab.token is required if gitlab configuration is specified." .Values.gitlab.token | b64enc }} + gitlab_secret: {{ required "gitlab.secret is required if gitlab configuration is specified." .Values.gitlab.secret | b64enc }} + {{- end}} + {{- if .Values.bitbucket }} + bitbucket_token: {{ required "bitbucket.token is required if bitbucket configuration is specified." .Values.bitbucket.token | b64enc }} + {{- if .Values.bitbucket.base_url }} + bitbucket_secret: {{ required "bitbucket.secret is required if bitbucket.baseurl is specified." .Values.bitbucket.secret | b64enc }} + {{- end}} + {{- end }} diff --git a/helm/atlantis/templates/service.yaml b/helm/atlantis/templates/service.yaml new file mode 100644 index 000000000..7324265eb --- /dev/null +++ b/helm/atlantis/templates/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "atlantis.fullname" . }} + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: 4141 + protocol: TCP + name: atlantis + selector: + app: {{ template "atlantis.name" . }} + release: {{ .Release.Name }} diff --git a/helm/atlantis/templates/statefulset.yaml b/helm/atlantis/templates/statefulset.yaml new file mode 100644 index 000000000..07dad290b --- /dev/null +++ b/helm/atlantis/templates/statefulset.yaml @@ -0,0 +1,190 @@ +apiVersion: apps/v1beta2 +kind: StatefulSet +metadata: + name: {{ template "atlantis.fullname" . }} + labels: + app: {{ template "atlantis.name" . }} + chart: {{ template "atlantis.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ template "atlantis.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "atlantis.name" . }} + release: {{ .Release.Name }} + spec: + volumes: + {{- range $name, $_ := .Values.serviceAccountSecrets }} + - name: {{ $name }}-volume + secret: + secretName: {{ $name }} + {{- end }} + {{- if .Values.gitconfig }} + - name: gitconfig-volume + secret: + secretName: {{ template "atlantis.name" . }}-gitconfig + {{- end }} + {{- if .Values.aws }} + - name: aws-volume + secret: + secretName: {{ template "atlantis.name" . }}-aws + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.gitconfig }} + lifecycle: + postStart: + exec: + command: ["/bin/sh", "-c", "cp /etc/secret-gitconfig/gitconfig /home/atlantis/.gitconfig && chown atlantis /home/atlantis/.gitconfig"] + {{- end}} + cmd: atlantis + args: + - server + {{- if .Values.allowRepoConfig }} + - --allow-repo-config + {{- end }} + ports: + - name: atlantis + containerPort: 4141 + env: + - name: ATLANTIS_DATA_DIR + value: /atlantis-data + - name: ATLANTIS_REPO_WHITELIST + value: {{ .Values.orgWhitelist }} + - name: ATLANTIS_PORT + value: "4141" + {{- if .Values.atlantisUrl }} + - name: ATLANTIS_ATLANTIS_URL + value: {{ .Values.atlantisUrl }} + {{- else if .Values.ingress.enabled }} + - name: ATLANTIS_ATLANTIS_URL + value: http://{{ .Values.ingress.host }} + {{- end }} + {{- if .Values.github }} + - name: ATLANTIS_GH_USER + value: {{ required "github.user is required if github configuration is specified." .Values.github.user }} + - name: ATLANTIS_GH_TOKEN + valueFrom: + secretKeyRef: + name: {{ template "atlantis.name" . }}-webhook + key: github_token + - name: ATLANTIS_GH_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: {{ template "atlantis.name" . }}-webhook + key: github_secret + {{- if .Values.github.hostname }} + - name: ATLANTIS_GH_HOSTNAME + value: {{ .Values.github.hostname }} + {{- end }} + {{- end}} + {{- if .Values.gitlab }} + - name: ATLANTIS_GITLAB_USER + value: {{ required "gitlab.user is required if gitlab configuration is specified." .Values.gitlab.user }} + - name: ATLANTIS_GITLAB_TOKEN + valueFrom: + secretKeyRef: + name: {{ template "atlantis.name" . }}-webhook + key: gitlab_token + - name: ATLANTIS_GITLAB_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: {{ template "atlantis.name" . }}-webhook + key: gitlab_secret + {{- if .Values.gitlab.hostname }} + - name: ATLANTIS_GITLAB_HOSTNAME + value: {{ .Values.gitlab.hostname }} + {{- end }} + {{- end}} + {{- if .Values.bitbucket }} + - name: ATLANTIS_BITBUCKET_USER + value: {{ required "bitbucket.user is required if bitbucket configuration is specified." .Values.bitbucket.user }} + - name: ATLANTIS_BITBUCKET_TOKEN + valueFrom: + secretKeyRef: + name: {{ template "atlantis.name" . }}-webhook + key: bitbucket_token + {{- if .Values.bitbucket.base_url }} + - name: ATLANTIS_BITBUCKET_BASE_URL + value: {{ .Values.bitbucket.base_url }} + - name: ATLANTIS_BITBUCKET_WEBHOOK_SECRET + valueFrom: + secretKeyRef: + name: {{ template "atlantis.name" . }}-webhook + key: bitbucket_secret + {{- end }} + {{- end }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: + httpGet: + path: /healthz + port: 4141 + scheme: {{ .Values.livenessProbe.scheme }} + initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: + httpGet: + path: /healthz + port: 4141 + scheme: {{ .Values.readinessProbe.scheme }} + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + {{- end }} + volumeMounts: + - name: atlantis-data + mountPath: /atlantis-data + {{- range $name, $_ := .Values.serviceAccountSecrets }} + - name: {{ $name }}-volume + readOnly: true + mountPath: /etc/{{ $name }} + {{- end }} + {{- if .Values.gitconfig}} + - name: gitconfig-volume + readonly: true + mountPath: /etc/secret-gitconfig + {{- end }} + {{- if .Values.aws}} + - name: aws-volume + readonly: true + mountPath: /home/atlantis/.aws + {{- end }} + resources: +{{ toYaml .Values.resources | indent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} + volumeClaimTemplates: + - metadata: + name: atlantis-data + spec: + accessModes: ["ReadWriteOnce"] # Volume should not be shared by multiple nodes. + resources: + requests: + # The biggest thing Atlantis stores is the Git repo when it checks it out. + # It deletes the repo after the pull request is merged. + storage: 5Gi \ No newline at end of file diff --git a/helm/atlantis/values.yaml b/helm/atlantis/values.yaml new file mode 100644 index 000000000..42feecb83 --- /dev/null +++ b/helm/atlantis/values.yaml @@ -0,0 +1,130 @@ +## -------------------------- ## +# Values to override for your instance. +## -------------------------- ## + +## An option to override the atlantis url, +## if not using an ingress, set it to the external IP. +# atlantisUrl: http://10.0.0.0 + +# Replace this with your own repo whitelist: +orgWhitelist: github.com/yourorg/* + +# If using GitHub, specify like the following: +# github: +# user: foo +# token: bar +# secret: baz +# GitHub Enterprise only: +# hostname: github.your.org +# (The chart will perform the base64 encoding for you.) + +# If using GitLab, specify like the following: +# gitlab: +# user: foo +# token: bar +# secret: baz +# GitLab Enterprise only: +# hostname: gitlab.your.org +# (The chart will perform the base64 encoding for you.) + +# If using Bitbucket, specify like the following: +# bitbucket: +# user: jkodroff +# token: 7EKP4yWUpLRBJh2pW2t3 +# Bitbucket Server only: +# secret: mysecret +# base_url: https://bitbucket.2ndwatch.com + + +# When referencing Terraform modules in private repositories, it may be helpful +# (necessary?) to use redirection in a .gitconfig like so: +# gitconfig: + # [url "https://YOUR_GH_TOKEN@github.com"] + # insteadOf = https://github.com + # [url "https://YOUR_GH_TOKEN@github.com"] + # insteadOf = ssh://git@github.com + # [url "https://oauth2:YOUR_GITLAB_TOKEN@gitlab.com"] + # insteadOf = https://gitlab.com + # [url "https://oauth2:YOUR_GITLAB_TOKEN@gitlab.com"] + # insteadOf = ssh://git@gitlab.com +# Source: https://stackoverflow.com/questions/42148841/github-clone-with-oauth-access-token + +# To specify AWS credentials to be mapped to ~/.aws: +# aws: +# credentials: | +# [default] +# aws_access_key_id=YOUR_ACCESS_KEY_ID +# aws_secret_access_key=YOUR_SECRET_ACCESS_KEY +# region=us-east-1 +# config: | +# [profile a_role_to_assume] +# role_arn = arn:aws:iam::123456789:role/service-role/roleToAssume +# source_profile = default + +## To be used for mounting credential files (when using google provider). +serviceAccountSecrets: + # credentials: + # credentials-staging: + + +## -------------------------- ## +# Default values for atlantis (override as needed). +## -------------------------- ## + +image: + repository: runatlantis/atlantis + tag: v0.4.5 + pullPolicy: IfNotPresent + +## enable using atlantis.yaml file +allowRepoConfig: false + +# We only need to check every 60s since Atlantis is not a high-throughput service. +livenessProbe: + enabled: true + periodSeconds: 60 + initialDelaySeconds: 5 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + scheme: HTTP +readinessProbe: + enabled: true + periodSeconds: 60 + initialDelaySeconds: 30 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 5 + scheme: HTTP + +service: + type: NodePort + port: 80 + +ingress: + enabled: true + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + path: / + host: chart-example.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + requests: + memory: 1Gi + cpu: 100m + limits: + memory: 1Gi + cpu: 100m + +replicaCount: 1 + +nodeSelector: {} + +tolerations: [] + +affinity: {}