Skip to content

Commit

Permalink
feat(cryostat3): deploy Cryostat 3.0 (#124)
Browse files Browse the repository at this point in the history
Co-authored-by: Atif Ali <[email protected]>
Co-authored-by: Thuan Vo <[email protected]>
  • Loading branch information
3 people authored Jun 6, 2024
1 parent 68a9bcf commit 60a39a2
Show file tree
Hide file tree
Showing 27 changed files with 1,083 additions and 420 deletions.
38 changes: 23 additions & 15 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -27,21 +27,22 @@ on:

env:
TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
TEST_NAMESPACE: helm-test

jobs:
lint-chart:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Helm
uses: azure/setup-helm@v3
uses: azure/setup-helm@v4
with:
version: v3.11.2
- uses: actions/setup-python@v4
version: v3.14.4
- uses: actions/setup-python@v5
with:
python-version: '3.9'
python-version: '3.x'
check-latest: true
- name: Set up chart-testing
uses: helm/[email protected]
Expand All @@ -53,23 +54,30 @@ jobs:
- name: Fail if safe-to-test label NOT applied
if: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'safe-to-test') }}
run: exit 1
- uses: actions/checkout@v2
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up Helm
uses: azure/setup-helm@v3
uses: azure/setup-helm@v4
with:
version: v3.11.2
- uses: actions/setup-python@v4
version: v3.14.4
- uses: actions/setup-python@v5
with:
python-version: '3.9'
python-version: '3.x'
check-latest: true
- uses: helm/[email protected]
- name: Set up Kind cluster
run: kind create cluster -n ci-${{ github.run_id }}
uses: helm/kind-action@v1
with:
cluster_name: ci-${{ github.run_id }}
- name: Install and test chart
run: |
kubectl create ns helm-test
ct install --target-branch ${TARGET_BRANCH} --upgrade --namespace=helm-test --config ct.yaml
- name: Clean up Kind cluster
run: kind delete cluster -n ci-${{ github.run_id }}
# FIXME: Remove when chart-testing fixes the issue https://github.com/helm/chart-testing/issues/525
HELM_LOCATION="$(which helm)"
sudo mv $HELM_LOCATION "$(dirname $HELM_LOCATION)/.helm"
cat <(echo '#!/usr/bin/env bash') <(echo 'exec .helm "${@//--reuse-values/--reset-then-reuse-values}"') | sudo tee $HELM_LOCATION
sudo chmod +x $HELM_LOCATION
kubectl create ns $TEST_NAMESPACE
ct install --target-branch ${TARGET_BRANCH} --upgrade --namespace=$TEST_NAMESPACE --config ct.yaml --debug
2 changes: 1 addition & 1 deletion charts/cryostat/Chart.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ version: "0.5.0-dev"

kubeVersion: ">= 1.19.0-0"

appVersion: "2.5.0-dev"
appVersion: "3.0.0-dev"

home: "https://cryostat.io"

Expand Down
162 changes: 106 additions & 56 deletions charts/cryostat/README.md

Large diffs are not rendered by default.

1 change: 0 additions & 1 deletion charts/cryostat/ci/minimal-deploy-values.yaml

This file was deleted.

1 change: 0 additions & 1 deletion charts/cryostat/ci/non-minimal-deploy-values.yaml

This file was deleted.

56 changes: 17 additions & 39 deletions charts/cryostat/templates/NOTES.txt
Original file line number Diff line number Diff line change
@@ -1,61 +1,39 @@
{{- $envVars := list }}
{{- $portForwards := list }}
{{- $listNum := 1 }}
{{- if not (and .Values.core.ingress.enabled .Values.grafana.ingress.enabled) }}
{{- if not .Values.core.ingress.enabled }}
{{ $listNum }}. Tell Cryostat how to serve external traffic:
{{- $listNum = add1 $listNum }}
```
{{- if .Values.core.route.enabled }}
export ROUTE_HOST=$(oc get route -n {{ .Release.Namespace }} {{ include "cryostat.fullname" . }} -o jsonpath="{.status.ingress[0].host}")
{{- $envVars = list "CRYOSTAT_WEB_HOST=$ROUTE_HOST" }}
{{- $envVars = list ( tpl "STORAGE_EXT_URL={{ ternary \"https\" \"http\" .Values.core.route.tls.enabled }}://$ROUTE_HOST/storage/" . ) }}
{{- $envVars = append $envVars ( tpl "GRAFANA_DASHBOARD_EXT_URL={{ ternary \"https\" \"http\" .Values.core.route.tls.enabled}}://$ROUTE_HOST/grafana/" . ) }}
{{- else if .Values.core.ingress.enabled }}
{{- /* Do nothing */}}
{{- else if contains "NodePort" .Values.core.service.type }}
export NODE_IP=$(kubectl get nodes -n {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
export NODE_PORT=$(kubectl get -n {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "cryostat.fullname" . }})
{{- $envVars = list "CRYOSTAT_WEB_HOST=$NODE_IP" "CRYOSTAT_EXT_WEB_PORT=$NODE_PORT" }}
{{- $envVars = list "QUARKUS_HTTP_HOST=$NODE_IP" }}
{{- $envVars = append $envVars ( tpl "STORAGE_EXT_URL=http://$NODE_IP:$NODE_PORT/storage/" . ) }}
{{- $envVars = append $envVars ( tpl "GRAFANA_DASHBOARD_EXT_URL=http://$NODE_IP:$NODE_PORT/grafana/" . ) }}
{{- else if contains "LoadBalancer" .Values.core.service.type }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get -n {{ .Release.Namespace }} -w svc/{{ include "cryostat.fullname" . }} svc/{{ include "cryostat.fullname" . }}-grafana'
You can watch the status by running 'kubectl get -n {{ .Release.Namespace }} -w svc/{{ include "cryostat.fullname" . }}'
export SERVICE_IP=$(kubectl get svc -n {{ .Release.Namespace }} {{ include "cryostat.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
{{- $envVars = list "CRYOSTAT_WEB_HOST=$SERVICE_IP" (printf "CRYOSTAT_EXT_WEB_PORT=%v" .Values.core.service.httpPort) }}
{{- $envVars = list "QUARKUS_HTTP_HOST=$SERVICE_IP" }}
{{- $envVars = append $envVars ( tpl "STORAGE_EXT_URL=http://$SERVICE_IP:{{ .Values.core.service.httpPort }}/storage/" . ) }}
{{- $envVars = append $envVars ( tpl "GRAFANA_DASHBOARD_EXT_URL=http://$SERVICE_IP:{{ .Values.core.service.httpPort }}/grafana/" . ) }}
{{- else if contains "ClusterIP" .Values.core.service.type }}
export POD_NAME=$(kubectl get pods -n {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "cryostat.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod -n {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
{{- $envVars = list "CRYOSTAT_WEB_HOST=127.0.0.1" "CRYOSTAT_EXT_WEB_PORT=8080" }}
export CRYOSTAT_WEB_HOST=localhost
{{- $envVars = list "QUARKUS_HTTP_HOST=$CRYOSTAT_WEB_HOST" }}
{{- $envVars = append $envVars ( tpl "STORAGE_EXT_URL=http://$CRYOSTAT_WEB_HOST:8080/storage/" . ) }}
{{- $envVars = append $envVars ( tpl "GRAFANA_DASHBOARD_EXT_URL=http://$CRYOSTAT_WEB_HOST:8080/grafana/" . ) }}
{{- $portForwards = prepend $portForwards "8080:$CONTAINER_PORT" }}
{{- end }}

{{- if not .Values.minimal }}
{{- if .Values.grafana.route.enabled }}
export GRAFANA_ROUTE_HOST=$(oc get route -n {{ .Release.Namespace }} {{ include "cryostat.fullname" . }}-grafana -o jsonpath="{.status.ingress[0].host}")
{{- $envVars = append $envVars ( tpl "GRAFANA_DASHBOARD_URL=http{{ if .Values.grafana.route.tls.enabled }}s{{ end }}://$GRAFANA_ROUTE_HOST" . ) }}
{{- else if .Values.grafana.ingress.enabled }}
{{- /* Do nothing */}}
{{- else if contains "NodePort" .Values.grafana.service.type }}
{{- if not (contains "NodePort" .Values.core.service.type) }}
export NODE_IP=$(kubectl get nodes -n {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
{{- end }}
export GRAFANA_NODE_PORT=$(kubectl get -n {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "cryostat.fullname" . }}-grafana)
{{- $envVars = append $envVars "GRAFANA_DASHBOARD_URL=http://$NODE_IP:$GRAFANA_NODE_PORT"}}
{{- else if contains "LoadBalancer" .Values.grafana.service.type }}
{{- if not (contains "LoadBalancer" .Values.core.service.type) }}
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status of by running 'kubectl get -n {{ .Release.Namespace }} -w svc/{{ include "cryostat.fullname" . }} svc/{{ include "cryostat.fullname" . }}-grafana'
{{- end }}
export GRAFANA_SERVICE_IP=$(kubectl get svc -n {{ .Release.Namespace }} {{ include "cryostat.fullname" . }}-grafana --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
{{- $envVars = append $envVars (printf "GRAFANA_DASHBOARD_URL=http://$GRAFANA_SERVICE_IP:%v" .Values.grafana.service.port) }}
{{- else if contains "ClusterIP" .Values.grafana.service.type }}
{{- if not (contains "ClusterIP" .Values.core.service.type) }}
export POD_NAME=$(kubectl get pods -n {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "cryostat.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" --sort-by=.metadata.creationTimestamp -o jsonpath="{.items[-1:].metadata.name}")
{{- end }}
export GRAFANA_CONTAINER_PORT=$(kubectl get pod -n {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[1].ports[0].containerPort}")
{{- $envVars = concat $envVars ( list "GRAFANA_DASHBOARD_URL=http://127.0.0.1:$GRAFANA_CONTAINER_PORT" "GRAFANA_DASHBOARD_EXT_URL=http://127.0.0.1:8081" )}}
{{- $portForwards = append $portForwards "8081:$GRAFANA_CONTAINER_PORT" }}
{{- end }}
{{- end }}


{{- if not (empty $envVars) }}
kubectl -n {{ .Release.Namespace }} set env deploy --containers={{ .Chart.Name }} {{ include "cryostat.fullname" . }} {{ join " " $envVars }}
{{- end }}
Expand All @@ -76,18 +54,18 @@
{{ $listNum }}. {{ "Visit the " }}{{ .Chart.Name | camelcase }}{{ " application at: " }}
```
{{- if .Values.core.route.enabled }}
echo http{{ if $.Values.core.route.tls.enabled }}s{{ end }}://$ROUTE_HOST
echo {{ ternary "https" "http" .Values.core.route.tls.enabled }}://$ROUTE_HOST
{{- else if .Values.core.ingress.enabled -}}
{{- range $host := .Values.core.ingress.hosts -}}
{{- range .paths -}}
http{{ if $.Values.core.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
{{ ternary "https" "http" .Values.core.ingress.tls }}://{{ $host.host }}{{ .path }}
{{- end }}
{{- end }}
{{- else if contains "NodePort" .Values.core.service.type }}
echo http://$NODE_IP:$NODE_PORT
{{- else if contains "LoadBalancer" .Values.core.service.type }}
echo http://$SERVICE_IP:{{ .Values.core.service.httpPort }}
{{- else if contains "ClusterIP" .Values.core.service.type }}
http://127.0.0.1:8080
http://localhost:8080
{{- end }}
```
80 changes: 74 additions & 6 deletions charts/cryostat/templates/_helpers.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -62,19 +62,87 @@ Create the name of the service account to use
{{- end }}

{{/*
Get or generate a default password for credentials database
Get or generate a default connection key for credentials database
*/}}
{{- define "cryostat.databasePassword" -}}
{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-jmx-credentials-db" .Release.Name)) -}}
{{- define "cryostat.databaseConnectionKey" -}}
{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-db-connection-key" .Release.Name)) -}}
{{- if $secret -}}
{{/*
Use current password. Do not regenerate
Use current key. Do not regenerate
*/}}
{{- $secret.data.CRYOSTAT_JMX_CREDENTIALS_DB_PASSWORD -}}
{{- $secret.data.CONNECTION_KEY -}}
{{- else -}}
{{/*
Generate new password
Generate new key
*/}}
{{- (randAlphaNum 32) | b64enc | quote -}}
{{- end -}}
{{- end -}}

{{/*
Get or generate a default encryption key for credentials database
*/}}
{{- define "cryostat.databaseEncryptionKey" -}}
{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-db-encryption-key" .Release.Name)) -}}
{{- if $secret -}}
{{/*
Use current key. Do not regenerate
*/}}
{{- $secret.data.ENCRYPTION_KEY -}}
{{- else -}}
{{/*
Generate new key
*/}}
{{- (randAlphaNum 32) | b64enc | quote -}}
{{- end -}}
{{- end -}}

{{/*
Get or generate a default secret key for object storage
*/}}
{{- define "cryostat.objectStorageSecretKey" -}}
{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-storage-secret-key" .Release.Name)) -}}
{{- if $secret -}}
{{/*
Use current secret. Do not regenerate
*/}}
{{- $secret.data.SECRET_KEY -}}
{{- else -}}
{{/*
Generate new secret
*/}}
{{- (randAlphaNum 32) | b64enc | quote -}}
{{- end -}}
{{- end -}}

{{/*
Generate or retrieve a default value for cookieSecret.
*/}}
{{- define "cryostat.cookieSecret" -}}
{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-cookie-secret" .Release.Name)) -}}
{{- if $secret -}}
{{/*
Use the current secret. Do not regenerate.
*/}}
{{- $secret.data.COOKIE_SECRET | b64dec | quote -}}
{{- else -}}
{{/*
Generate a new secret.
*/}}
{{- $newSecret := randAlphaNum 24 | b64enc -}}
{{- $newSecret | quote -}}
{{- end }}
{{- end }}

{{/*
Get sanitized list or defaults (if not disabled) as comma-separated list
*/}}
{{- define "cryostat.commaSepList" -}}
{{- $l := index . 0 -}}
{{- $default := index . 1 -}}
{{- $disableDefaults := index . 2 -}}
{{- if and (not $l) (not $disableDefaults) -}}
{{- $l = list $default -}}
{{- end -}}
{{- join "," (default list $l | compact | uniq) | quote -}}
{{- end -}}
29 changes: 29 additions & 0 deletions charts/cryostat/templates/alpha_config.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Release.Name }}-alpha-config
data:
alpha_config.yaml: |-
server:
BindAddress: http://0.0.0.0:4180
upstreamConfig:
proxyRawPath: true
upstreams:
- id: cryostat
path: /
uri: http://localhost:8181
- id: grafana
path: /grafana/
uri: http://localhost:3000
- id: storage
path: ^/storage/(.*)$
rewriteTarget: /$1
uri: http://localhost:8333
passHostHeader: false
proxyWebSockets: false
providers:
- id: dummy
name: Unused - Sign In Below
clientId: CLIENT_ID
clientSecret: CLIENT_SECRET
provider: google
16 changes: 16 additions & 0 deletions charts/cryostat/templates/clusterrolebinding.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{{- if and (.Values.rbac.create) (.Values.authentication.openshift.enabled) -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "cryostat.fullname" . }}
labels:
{{- include "cryostat.labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ .Values.authentication.openshift.clusterRole.name }}
subjects:
- kind: ServiceAccount
name: {{ include "cryostat.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end }}
7 changes: 7 additions & 0 deletions charts/cryostat/templates/db_connection_key_secret.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
apiVersion: v1
kind: Secret
metadata:
name: {{ .Release.Name }}-db-connection-key
type: Opaque
data:
CONNECTION_KEY: {{ include "cryostat.databaseConnectionKey" . }}
9 changes: 9 additions & 0 deletions charts/cryostat/templates/db_encryption_key_secret.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
{{- if empty .Values.core.databaseSecretName -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ .Release.Name }}-db-encryption-key
type: Opaque
data:
ENCRYPTION_KEY: {{ include "cryostat.databaseEncryptionKey" . }}
{{- end -}}
Loading

0 comments on commit 60a39a2

Please sign in to comment.