Mostly working chart, needs LoadBalancer IP per workload...

.gitignore

@@ -1,4 +1,4 @@
 # OSX metadata
 .DS_Store
 ._DS_Store
-.ideas
+.idea

Chart.yaml

@@ -5,4 +5,4 @@ type: application
 version: 0.1.0
 icon: https://upload.wikimedia.org/wikipedia/commons/8/8f/Icons_mumble.svg
 # https://hub.docker.com/r/pvarkiprojekti/mumbleserver/tags (do NOT use "latest")
-appVersion: "20220903-2111"
+appVersion: "20221110-1729"

README.rst

@@ -3,3 +3,19 @@ Helm chart for mumble server
 ============================
 
 Char for deploying https://hub.docker.com/r/pvarkiprojekti/mumbleserver in k8s
+
+Development
+^^^^^^^^^^^
+
+Uses pre-commit, you need some basic dependencies (run in this directory)::
+
+    pip3 install --user pre-commit detect-secrets
+    pre-commit install
+
+As usual using virtualenvs is generally recommended but in this case not strictly mandatory.
+
+Before committing check your work with::
+
+    pre-commit run --all-files ; echo $?
+
+This saves you annoyance of rewriting commit messages when one of the checks fail.

templates/NOTES.txt

@@ -1,22 +1,15 @@
 1. Get the application URL by running these commands:
-{{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
-  {{- end }}
-{{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "mumbleserver.fullname" . }})
+{{- if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[1].nodePort}" services {{ include "mumbleserver.fullname" . }})
   export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
-  echo http://$NODE_IP:$NODE_PORT
+  DNS name should be {{ .Values.mumble.server_domain }}
 {{- else if contains "LoadBalancer" .Values.service.type }}
      NOTE: It may take a few minutes for the LoadBalancer IP to be available.
            You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "mumbleserver.fullname" . }}'
   export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "mumbleserver.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
-  echo http://$SERVICE_IP:{{ .Values.service.port }}
+  DNS name should be {{ .Values.mumble.server_domain }}
 {{- else if contains "ClusterIP" .Values.service.type }}
   export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "mumbleserver.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
-  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[1].containerPort}")
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME {{ .Values.mumble.externalport }}:$CONTAINER_PORT
 {{- end }}

templates/deployment.yaml

@@ -30,34 +30,61 @@ spec:
       volumes:
         - name: letsencrypt-data
         - name: murmur-data
+      initContainers:
+        - name: fill-volumes
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          volumeMounts:
+            - name: letsencrypt-data
+              mountPath: /tgt/le
+            - name: murmur-data
+              mountPath: /tgt/murmurdata
+          command:
+            - /bin/bash
+            - -c
+            - >
+              cp -a /etc/letsencrypt/./ /tgt/le/ &&
+              cp -a /murmurdata/./ /tgt/murmurdata/ &&
+              ls -R /tgt/le /tgt/murmurdata
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           env:
-          # TODO: Remove this when we are production ready
-          - name: "CERTBOT_EXTRA_ARGS"
-            value: "--test-cert"
-          - name: "SERVER_DOMAIN"
-            value: {{ required "A valid .Values.mumble.server_domain entry required!" .Values.mumble.server_domain }}
-          - name: "CERTBOT_EMAIL"
-            value: {{ required "A valid .Values.mumble.certbot_email entry required!" .Values.mumble.certbot_email }}
-          - name: "SERVER_PASSWORD"
-            valueFrom:
-              secretKeyRef:
-                key: server_password
-                name: {{ .Release.Name }}-auth
-          - name: "SUPERUSER_PASSWORD"
-            valueFrom:
-              secretKeyRef:
-                key: superuser_password
-                name: {{ .Release.Name }}-auth
+            # TODO: Remove this when we are production ready
+            - name: "CERTBOT_EXTRA_ARGS"
+              value: "--test-cert"
+            {{- if .Values.mumble.disable_tls }}
+            - name: "NO_TLS"
+              value: "1"
+            {{- end }}
+            {{- if or .Values.use_certmanager .Values.mumble.disable_tls }}
+            - name: "NO_CERTBOT"
+              value: "1"
+            {{- end }}
+            - name: "SERVER_DOMAIN"
+              value: {{ required "A valid .Values.mumble.server_domain entry required!" .Values.mumble.server_domain }}
+            - name: "CERTBOT_EMAIL"
+              value: {{ required "A valid .Values.mumble.certbot_email entry required!" .Values.mumble.certbot_email }}
+            - name: "SERVER_USERS"
+              value: {{ required "A valid .Values.mumble.users entry required!" .Values.mumble.users }}
+            - name: "SERVER_PASSWORD"
+              valueFrom:
+                secretKeyRef:
+                  key: server_password
+                  name: {{ .Release.Name }}-auth
+            - name: "SUPERUSER_PASSWORD"
+              valueFrom:
+                secretKeyRef:
+                  key: superuser_password
+                  name: {{ .Release.Name }}-auth
           ports:
+            {{- if and (not .Values.use_certmanager) (not .Values.mumble.disable_tls) }}
             - name: http
               containerPort: 80
               protocol: TCP
+            {{- end }}
             - name: mumble-tcp
               containerPort: 64738
               protocol: TCP
@@ -69,9 +96,17 @@ spec:
               command:
                 - pgrep
                 - murmurd
+            initialDelaySeconds: 15
+            periodSeconds: 10
           readinessProbe:
-            tcpSocket:
-              port: mumble-tcp
+            exec:
+              command:
+                - /bin/bash
+                - -c
+                - >
+                  pgrep certbot || pgrep murmurd
+            initialDelaySeconds: 1
+            periodSeconds: 1
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:

templates/service.yaml

@@ -4,13 +4,17 @@ metadata:
   name: {{ include "mumbleserver.fullname" . }}
   labels:
     {{- include "mumbleserver.labels" . | nindent 4 }}
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: {{ required "A valid .Values.mumble.server_domain entry required!" .Values.mumble.server_domain }}
 spec:
   type: {{ .Values.service.type }}
   ports:
+    {{- if and (not .Values.use_certmanager) (not .Values.mumble.disable_tls) }}
     - port: 80
       targetPort: http
       protocol: TCP
       name: http
+    {{- end }}
     - port: 64738
       targetPort: mumble-tcp
       protocol: TCP

templates/tests/test-connection.yaml

@@ -8,8 +8,9 @@ metadata:
     "helm.sh/hook": test
 spec:
   containers:
-    - name: wget
-      image: busybox
-      command: ['wget']
-      args: ['{{ include "mumbleserver.fullname" . }}:{{ .Values.service.port }}']
+    - name: mumble-ping
+      image: pvarkiprojekti/mumbleping:20220909-1026
+      env:
+        - name: "SERVER_DOMAIN"
+          value: {{ required "A valid .Values.mumble.server_domain entry required!" .Values.mumble.server_domain }}
   restartPolicy: Never

values.yaml

@@ -37,30 +37,19 @@ securityContext: {}
   # runAsUser: 1000
 
 service:
-  type: ClusterIP
+  type: LoadBalancer
 
 mumble:
   server_domain: ""
   server_password: ""
-  certbot_email: ""
   superuser_password: ""
-
-
-ingress:
-  enabled: false
-  className: ""
-  annotations: {}
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  hosts:
-    - host: chart-example.local
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
+  externalport: 64738
+  certbot_email: "benjam.gronmark_arkiproj@hotmail.com"
+  # You can set this to false if you have added cert-manaer support or have handled DNS before certbot tries to do stuff
+  disable_tls: true
+  users: 100
+# TODO: Add actual certmanager support before setting this to true
+use_certmanager: false
 
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious