feat: HELM, Workflow, CHEFs, Keycloak

.github/workflows/pr-open.yml

@@ -53,7 +53,7 @@ jobs:
       packages: write
     strategy:
       matrix:
-        package: [migrations, backend, frontend]
+        package: [workflows, frontend] # frontend is backend/frontend combined into single deployment.
     timeout-minutes: 10
     steps:
       - uses: bcgov-nr/action-builder-ghcr@v2.0.0
@@ -74,4 +74,4 @@ jobs:
       autoscaling: false
       tag: ${{ github.event.number }}
       release: ${{ github.event.number }}
-      triggers: ('backend/' 'frontend/' 'migrations/' 'charts/')
+      triggers: ('backend/' 'workflows/' 'charts/')

.gitignore

@@ -112,6 +112,7 @@ test-report.xml
 .volumes
 .idea
 *.iml
+!frontend/app/bin
 **/bin
 **/build
 **/dist

backend/package.json

@@ -1,5 +1,6 @@
 {
-  "author": "BC Government Forestry Suite of Applications Starter Template",
+  "name": "nr-data-access-api",
+  "author": "NRIDS Architecture and Devops",
   "license": "Apache-2.0",
   "main": "index.js",
   "scripts": {

charts/nr-data-access/Chart.yaml

@@ -25,26 +25,25 @@ version: 0.1.0
 appVersion: "1.16.0"
 
 dependencies:
-  - name: component
-    condition: backend.enabled
-    version: 0.2.0
-    repository: https://bcgov.github.io/helm-service
-    alias: backend
 
   - name: component
     condition: frontend.enabled
-    version: 0.2.0
+    version: 0.2.2
     repository: https://bcgov.github.io/helm-service
     alias: frontend
 
-  - name: postgresql
-    condition: bitnami-pg.enabled
-    version: 13.2.16
-    repository: https://charts.bitnami.com/bitnami
-    alias: bitnami-pg
-
   - name: component
-    condition: backup.enabled
-    version: 0.2.0
+    condition: workflows.enabled
+    version: 0.2.2
     repository: https://bcgov.github.io/helm-service
-    alias: backup
+    alias: workflows
+
+  - name: keycloak
+    version: 17.3.4
+    repository: https://charts.bitnami.com/bitnami
+    condition: keycloak.enabled
+
+  - name: crunchy-postgres
+    version: 0.5.1
+    condition: crunchy.enabled
+    alias: crunchy

charts/nr-data-access/charts/crunchy-postgres/Chart.yaml

@@ -0,0 +1,26 @@
+apiVersion: v2
+name: crunchy-postgres
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.5.1
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+
+# Crunchy Postgres Operator version
+appVersion: "5.0.4"

charts/nr-data-access/charts/crunchy-postgres/templates/Postgres.yaml

@@ -0,0 +1,164 @@
+apiVersion: postgres-operator.crunchydata.com/v1beta1
+kind: PostgresCluster
+metadata:
+  name: {{ template "crunchy-postgres.fullname" . }}
+  labels: {{ include "crunchy-postgres.labels" . | nindent 4 }}
+spec:
+  metadata:
+    labels: {{ include "crunchy-postgres.labels" . | nindent 6 }}
+  {{ if .Values.crunchyImage }}
+  image: {{ .Values.crunchyImage }}
+  {{ end }}
+  imagePullPolicy: {{.Values.imagePullPolicy}}
+  postgresVersion: {{ .Values.postgresVersion }}
+  {{ if .Values.postGISVersion }}
+  postGISVersion: {{ .Values.postGISVersion | quote }}
+  {{ end }}
+  postgresVersion: {{ .Values.postgresVersion }}
+
+  {{ if .Values.pgmonitor.enabled }}
+
+  monitoring:
+    pgmonitor:
+      # this stuff is for the "exporter" container in the "postgres-cluster-ha" set of pods
+      exporter:
+        {{ if .Values.pgmonitor.exporter.image}}
+        image: {{ .Values.pgmonitor.exporter.image}}
+        {{ end }}
+        resources:
+          requests:
+            cpu: {{ .Values.pgmonitor.exporter.requests.cpu }}
+            memory: {{ .Values.pgmonitor.exporter.requests.memory }}
+          limits:
+            cpu: {{ .Values.pgmonitor.exporter.limits.cpu }}
+            memory: {{ .Values.pgmonitor.exporter.limits.memory }}
+
+  {{ end }}
+
+  instances:
+    - name: {{ .Values.instances.name }}
+      replicas: {{ .Values.instances.replicas }}
+      resources:
+        requests:
+          cpu: {{ .Values.instances.requests.cpu }}
+          memory: {{ .Values.instances.requests.memory }}
+        limits:
+          cpu: {{ .Values.instances.limits.cpu }}
+          memory: {{ .Values.instances.limits.memory }}
+      sidecars:
+        replicaCertCopy:
+          resources:
+            requests:
+              cpu: {{ .Values.instances.replicaCertCopy.requests.cpu }}
+              memory: {{ .Values.instances.replicaCertCopy.requests.memory }}
+            limits:
+              cpu: {{ .Values.instances.replicaCertCopy.limits.cpu }}
+              memory: {{ .Values.instances.replicaCertCopy.limits.memory }}
+      dataVolumeClaimSpec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: {{ .Values.instances.dataVolumeClaimSpec.storage }}
+        storageClassName: {{ .Values.instances.dataVolumeClaimSpec.storageClassName }}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 1
+              podAffinityTerm:
+                topologyKey: kubernetes.io/hostname
+                labelSelector:
+                  matchLabels:
+                    postgres-operator.crunchydata.com/cluster:
+                      {{ template "crunchy-postgres.fullname" . }}
+                    postgres-operator.crunchydata.com/instance-set: {{ .Values.instances.name }}-ha
+
+
+
+  users:
+    {{- toYaml .Values.users | nindent 4 }}
+
+
+  backups:
+    pgbackrest:
+      {{ if .Values.pgBackRest.image }}
+      image: {{ .Values.pgBackRest.image }}
+      {{ end }}
+      global:
+        repo1-retention-full: {{ .Values.pgBackRest.retention | quote }}
+        repo1-retention-full-type: {{ .Values.pgBackRest.retentionFullType }}
+      repos:
+        - name: repo1
+          schedules:
+            full: {{ .Values.pgBackRest.repos.schedules.full }}
+            incremental: {{ .Values.pgBackRest.repos.schedules.incremental }}
+          volume:
+            volumeClaimSpec:
+              accessModes:
+                - {{ .Values.pgBackRest.repos.volume.accessModes }}
+              resources:
+                requests:
+                  storage: {{ .Values.pgBackRest.repos.volume.storage }}
+              storageClassName: {{ .Values.pgBackRest.repos.volume.storageClassName }}
+
+      # this stuff is for the "pgbackrest" container (the only non-init container) in the "postgres-crunchy-repo-host" pod
+      repoHost:
+        resources:
+          requests:
+            cpu: {{ .Values.pgBackRest.repoHost.requests.cpu }}
+            memory: {{ .Values.pgBackRest.repoHost.requests.memory }}
+          limits:
+            cpu: {{ .Values.pgBackRest.repoHost.limits.cpu }}
+            memory: {{ .Values.pgBackRest.repoHost.limits.memory }}
+      sidecars:
+        # this stuff is for the "pgbackrest" container in the "postgres-crunchy-ha" set of pods
+        pgbackrest:
+          resources:
+            requests:
+              cpu: {{ .Values.pgBackRest.sidecars.requests.cpu }}
+              memory: {{ .Values.pgBackRest.sidecars.requests.memory }}
+            limits:
+              cpu: {{ .Values.pgBackRest.sidecars.limits.cpu }}
+              memory: {{ .Values.pgBackRest.sidecars.limits.memory }}
+
+  patroni:
+    dynamicConfiguration:
+      postgresql:
+        pg_hba:
+          - {{ .Values.patroni.postgresql.pg_hba}}
+        parameters:
+          shared_buffers: {{ .Values.patroni.postgresql.parameters.shared_buffers }}
+          wal_buffers: {{ .Values.patroni.postgresql.parameters.wal_buffers }}
+          min_wal_size: {{ .Values.patroni.postgresql.parameters.min_wal_size }}
+          max_wal_size: {{ .Values.patroni.postgresql.parameters.max_wal_size }}
+          max_slot_wal_keep_size:  {{ .Values.patroni.postgresql.parameters.max_slot_wal_keep_size }}
+
+  proxy:
+    pgBouncer:
+      config:
+        global:
+          client_tls_sslmode: disable
+      {{ if .Values.proxy.pgBouncer.image }}
+      image: {{ .Values.proxy.pgBouncer.image }}
+      {{ end }}
+      replicas: {{ .Values.proxy.pgBouncer.replicas }}
+      # these resources are for the "pgbouncer" container in the "postgres-crunchy-ha-pgbouncer" set of pods
+      # there is a sidecar in these pods which are not mentioned here, but the requests/limits are teeny weeny by default so no worries there.
+      resources:
+        requests:
+          cpu: {{ .Values.proxy.pgBouncer.requests.cpu }}
+          memory: {{ .Values.proxy.pgBouncer.requests.memory }}
+        limits:
+          cpu: {{ .Values.proxy.pgBouncer.limits.cpu }}
+          memory: {{ .Values.proxy.pgBouncer.limits.memory }}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 1
+              podAffinityTerm:
+                topologyKey: kubernetes.io/hostname
+                labelSelector:
+                  matchLabels:
+                    postgres-operator.crunchydata.com/cluster:
+                      {{ .Values.instances.name }}
+                    postgres-operator.crunchydata.com/role: pgbouncer

charts/nr-data-access/charts/crunchy-postgres/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "crunchy-postgres.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "crunchy-postgres.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "crunchy-postgres.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "crunchy-postgres.labels" -}}
+helm.sh/chart: {{ include "crunchy-postgres.chart" . }}
+{{ include "crunchy-postgres.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "crunchy-postgres.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "crunchy-postgres.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "crunchy-postgres.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "crunchy-postgres.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/nr-data-access/templates/secret.yaml

@@ -13,12 +13,13 @@ metadata:
   name: {{ .Release.Name }}
   labels: {{- include "selectorLabels" . | nindent 4 }}
 data:
-  databasePassword: {{ $databasePassword | b64enc | quote }}
-  postgres-password: {{ $databasePassword | b64enc | quote }}
-  password: {{ $databasePassword | b64enc | quote }}
-  databaseUser: {{  $databaseUser | b64enc | quote }}
-  databaseName: {{  $databaseName | b64enc | quote }}
-  databaseURL: {{ $databaseURL | b64enc | quote }}
-  databaseJDBCURL: {{ $databaseJDBCURL | b64enc | quote }}
-  databaseJDBCURLNoCreds: {{ $databaseJDBCURLNoCreds | b64enc | quote }}
+  SERVER_KC_CLIENTID: {{ .Values.global.secrets.SERVER_KC_CLIENTID | b64enc | quote }}
+  SERVER_KC_CLIENTSECRET: {{ .Values.global.secrets.SERVER_KC_CLIENTSECRET | b64enc | quote }}
+  SC_CS_CHES_CLIENT_ID: {{ .Values.global.secrets.SC_CS_CHES_CLIENT_ID | b64enc | quote }}
+  SC_CS_CHES_CLIENT_SECRET: {{ .Values.global.secrets.SC_CS_CHES_CLIENT_SECRET | b64enc | quote }}
+  SC_CS_CDOGS_CLIENT_ID: {{ .Values.global.secrets.SC_CS_CDOGS_CLIENT_ID | b64enc | quote }}
+  SC_CS_CDOGS_CLIENT_SECRET: {{ .Values.global.secrets.SC_CS_CDOGS_CLIENT_SECRET | b64enc | quote }}
+  FILES_OBJECTSTORAGE_ACCESSKEYID: {{ .Values.global.secrets.FILES_OBJECTSTORAGE_ACCESSKEYID | b64enc | quote }}
+  FILES_OBJECTSTORAGE_SECRETACCESSKEY: {{ .Values.global.secrets.FILES_OBJECTSTORAGE_SECRETACCESSKEY | b64enc | quote }}
+  APITOKEN: {{ .Values.global.secrets.APITOKEN | b64enc | quote }}
 {{- end }}