feat(helm): Introducing Helm Charts for templating

Using templates should reduce the amount of duplicated config

.gitignore

@@ -32,4 +32,6 @@ override.tf.json
 .idea
 certs/
 **/secrets/*
-!secrets/kustomization.yaml
+!secrets/kustomization.yaml
+
+helm/example

apps/test.yaml

@@ -0,0 +1,36 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: test
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: applications
+  source:
+    path: helm/application
+    repoURL: https://github.com/vehagn/homelab
+    targetRevision: HEAD
+    helm:
+      values: |
+        name: test
+        namespace: test
+        image: 
+          name: containous/whoami
+        service:
+          containerPort: 80
+        auth:
+          enabled: true
+          host: auth-test
+          whitelist:
+            - [email protected]
+            - [email protected]
+  destination:
+    namespace: test
+    name: in-cluster
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true

apps/test2.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: test2
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: applications
+  source:
+    path: helm/application
+    repoURL: https://github.com/vehagn/homelab
+    targetRevision: HEAD
+    helm:
+      values: |
+        name: test2
+        namespace: test
+        image: 
+          name: containous/whoami
+        service:
+          containerPort: 80
+        auth:
+          enabled: true
+          create: false
+  destination:
+    namespace: test
+    name: in-cluster
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true

helm/application/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/application/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: application
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

helm/application/templates/application/deployment.yaml

@@ -0,0 +1,25 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.name }}
+  namespace: {{ .Values.namespace }}
+spec:
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      app: {{ .Values.name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Values.name }}
+    spec:
+      containers:
+        - name: {{ .Values.name }}
+          image: {{ .Values.image.name }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}

helm/application/templates/application/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.name }}
+  namespace: {{ .Values.namespace }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+  selector:
+    app: {{ .Values.name }}

helm/application/templates/ingress-route.yaml

@@ -0,0 +1,31 @@
+{{- if .Values.ingressRoute.enabled }}
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ .Values.name }}
+  namespace: {{ .Values.namespace }}
+  labels:
+    app: traefik
+spec:
+  entryPoints:
+    - websecure
+  tls:
+    certResolver: letsencrypt
+  routes:
+    - match: Host(`{{ .Values.name }}.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: {{ .Values.name }}
+          port: 80
+    {{- if .Values.auth.enabled }}
+      middlewares:
+        - name: traefik-forward-auth
+    - match: Host(`{{ .Values.auth.host }}.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: traefik-forward-auth
+          port: {{ .Values.auth.port }}
+      middlewares:
+        - name: traefik-forward-auth
+    {{- end }}
+{{- end }}

helm/application/templates/traefik-forward-auth/config-map.yaml

@@ -0,0 +1,24 @@
+{{- if and .Values.auth.create .Values.auth.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: traefik-forward-auth
+  namespace: {{ .Values.namespace }}
+  labels:
+    app: traefik-forward-auth
+data:
+  traefik-forward-auth.ini: |-
+    cookie-name = "{{ .Values.auth.cookieName }}"
+    log-level = "{{ .Values.auth.logLevel }}"
+    cookie-domain = "{{ .Values.auth.cookieDomain }}"
+    auth-host = "{{ .Values.auth.host}}.{{ .Values.auth.cookieDomain }}"
+    {{- range .Values.auth.domains }}
+    domain = "{{ . }}"
+    {{- end }}
+    {{- range .Values.auth.whitelist }}
+    whitelist = {{ . }}
+    {{- end }}
+    {{- with .Values.auth.extraConfig -}}
+    {{ . | nindent 4 }}
+    {{- end }}
+{{- end }}

helm/application/templates/traefik-forward-auth/deployment.yaml

@@ -0,0 +1,57 @@
+{{- if and .Values.auth.create .Values.auth.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik-forward-auth
+  namespace: {{ .Values.namespace }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik-forward-auth
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: traefik-forward-auth
+    spec:
+      terminationGracePeriodSeconds: 60
+      containers:
+        - image: thomseddon/traefik-forward-auth:2
+          imagePullPolicy: Always
+          name: traefik-forward-auth
+          ports:
+            - name: auth
+              containerPort: 4181
+              protocol: TCP
+          env:
+            - name: CONFIG
+              value: "/config"
+            - name: PROVIDERS_GOOGLE_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: traefik-forward-auth-secrets
+                  key: google-client-id
+            - name: PROVIDERS_GOOGLE_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: traefik-forward-auth-secrets
+                  key: google-client-secret
+            - name: SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: traefik-forward-auth-secrets
+                  key: secret
+          volumeMounts:
+            - name: config
+              mountPath: /config
+              subPath: traefik-forward-auth.ini
+      volumes:
+        - name: config
+          configMap:
+            name: traefik-forward-auth
+        - name: traefik-forward-auth-secrets
+          secret:
+            secretName: traefik-forward-auth-secrets
+{{- end }}

helm/application/templates/traefik-forward-auth/middleware.yaml

@@ -0,0 +1,13 @@
+{{- if and .Values.auth.create .Values.auth.enabled }}
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: traefik-forward-auth
+  namespace: {{ .Values.namespace }}
+spec:
+  forwardAuth:
+    address: "http://traefik-forward-auth.{{ .Values.namespace }}.svc.cluster.local:{{ .Values.auth.port }}"
+    authResponseHeaders:
+      - X-Forwarded-User
+    trustForwardHeader: true
+  {{- end }}

helm/application/templates/traefik-forward-auth/service.yaml

@@ -0,0 +1,15 @@
+{{- if and .Values.auth.create .Values.auth.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik-forward-auth
+  namespace: {{ .Values.namespace }}
+spec:
+  type: ClusterIP
+  selector:
+    app: traefik-forward-auth
+  ports:
+    - name: auth
+      port: {{ .Values.auth.port }}
+      targetPort: auth
+  {{- end }}

helm/application/values.yaml

@@ -0,0 +1,40 @@
+name: name
+namespace: namespace
+
+image:
+  name: image
+  tag: latest
+  pullPolicy: Always
+
+replicas: 1
+
+service:
+  type: ClusterIP
+  port: 80
+  containerPort: 8080
+
+ingressRoute:
+  enabled: true
+
+resources: { }
+#  limits:
+#    cpu: 100m
+#    memory: 128Mi
+#  requests:
+#    cpu: 100m
+#    memory: 128Mi
+
+auth:
+  # Enable authentication with traefik-forward-auth
+  enabled: true
+  # Create traefik-forward-auth deployment
+  # Set to "false" to reuse a different deployment in the same namespace
+  create: true
+  port: 4181
+  cookieName: _forward_auth
+  cookieDomain: stonegarden.dev
+  host: auth
+  domains: {}
+  whitelist: {}
+  logLevel: error
+  extraConfig: {}

infra/argocd/applications.yaml

@@ -19,6 +19,11 @@ spec:
       server: '*'
     - namespace: 'whoami'
       server: '*'
+    - namespace: 'test'
+      server: '*'
+  clusterResourceWhitelist:
+    - group: '*'
+      kind: '*'
 ---
 apiVersion: argoproj.io/v1alpha1
 kind: Application

secrets/kustomization.yaml

@@ -5,5 +5,6 @@ resources:
   - arr.yaml
   - dashboard.yaml
   - hubble.yaml
+  - test.yaml
   - traefik-system.yaml
   - whoami.yaml