From 45cf8398ef08cccc624b019549856be9d7e3bf03 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Fri, 18 Sep 2026 12:46:57 -0700 Subject: [PATCH 01/23] SYS-673 envoy gateway with internal root CA issuer --- .github/workflows/release.yaml | 67 ++++++-- README.md | 2 +- ansible/roles/network/defaults/main.yml | 5 + ansible/roles/network/files/certs | 1 + ansible/roles/network/handlers/main.yml | 3 + ansible/roles/network/tasks/certificates.yml | 8 + ansible/roles/network/tasks/main.yml | 1 + images/mythtv-backend/helm/Chart.yaml | 6 +- images/mythtv-backend/helm/templates/app.yaml | 4 + images/mythtv-backend/helm/values.yaml | 2 + images/squirrelmail/helm/Chart.yaml | 6 +- images/squirrelmail/helm/templates/app.yaml | 6 + images/squirrelmail/helm/values.yaml | 8 +- k8s/Makefile | 33 ++-- k8s/Makefile.helm | 2 + k8s/Makefile.sops | 7 +- k8s/Makefile.vars | 14 +- k8s/Makefile.versions | 5 +- k8s/README.md | 24 ++- k8s/helm/authelia/Chart.yaml | 8 +- k8s/helm/authelia/templates/configmap.yaml | 9 +- k8s/helm/chartlib/Chart.yaml | 2 +- k8s/helm/chartlib/templates/_listener.yaml | 144 +++++++++++++++++ k8s/helm/gitea/Chart.yaml | 8 +- k8s/helm/gitea/templates/app.yaml | 2 + k8s/helm/gitea/values.yaml | 7 +- k8s/helm/grafana/Chart.yaml | 6 +- k8s/helm/grafana/templates/app.yaml | 2 + k8s/helm/grafana/values.yaml | 5 +- k8s/helm/guacamole/Chart.yaml | 6 +- .../subcharts/guacamole-server/Chart.yaml | 2 +- .../guacamole-server/templates/app.yaml | 2 + .../subcharts/guacamole-server/values.yaml | 31 ++-- k8s/helm/infra/.helmignore | 2 + k8s/helm/infra/Chart.yaml | 13 ++ k8s/helm/infra/templates/NOTES.txt | 28 ++++ k8s/helm/infra/templates/cert-manager.yaml | 153 ++++++++++++++++++ k8s/helm/infra/templates/gateway.yaml | 94 +++++++++++ .../infra/templates}/k8s-backup.yaml | 7 +- k8s/helm/infra/templates/limits.yaml | 30 ++++ k8s/helm/infra/templates/listeners.yaml | 18 +++ .../infra/templates}/local-storage.yaml | 2 + .../infra/templates}/prometheus-rbac.yaml | 12 +- .../infra/templates}/rsyslog-ext.yaml | 6 +- .../templates/tests/test-connection.yaml | 17 ++ k8s/helm/infra/values.yaml | 52 ++++++ k8s/helm/jira/Chart.yaml | 6 +- k8s/helm/jira/templates/app.yaml | 2 + k8s/helm/jira/values.yaml | 8 +- k8s/helm/nexus/Chart.yaml | 8 +- k8s/helm/nexus/templates/app.yaml | 4 + k8s/helm/nexus/values.yaml | 26 ++- k8s/helm/splunk/Chart.yaml | 6 +- k8s/helm/splunk/templates/app.yaml | 4 + k8s/helm/splunk/templates/security.yaml | 17 ++ k8s/helm/splunk/values.yaml | 24 ++- k8s/install/cert-manager.yaml | 30 ---- k8s/install/limits.yaml | 26 --- k8s/install/namespace-user.yaml | 21 +++ 59 files changed, 870 insertions(+), 184 deletions(-) create mode 120000 ansible/roles/network/files/certs create mode 100644 ansible/roles/network/tasks/certificates.yml create mode 100644 k8s/helm/chartlib/templates/_listener.yaml create mode 100644 k8s/helm/infra/.helmignore create mode 100644 k8s/helm/infra/Chart.yaml create mode 100644 k8s/helm/infra/templates/NOTES.txt create mode 100644 k8s/helm/infra/templates/cert-manager.yaml create mode 100644 k8s/helm/infra/templates/gateway.yaml rename k8s/{install => helm/infra/templates}/k8s-backup.yaml (87%) create mode 100644 k8s/helm/infra/templates/limits.yaml create mode 100644 k8s/helm/infra/templates/listeners.yaml rename k8s/{install => helm/infra/templates}/local-storage.yaml (82%) rename k8s/{install => helm/infra/templates}/prometheus-rbac.yaml (62%) rename k8s/{install => helm/infra/templates}/rsyslog-ext.yaml (52%) create mode 100644 k8s/helm/infra/templates/tests/test-connection.yaml create mode 100644 k8s/helm/infra/values.yaml create mode 100644 k8s/helm/splunk/templates/security.yaml delete mode 100644 k8s/install/cert-manager.yaml delete mode 100644 k8s/install/limits.yaml diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 74e11bf6..f87b3a08 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,28 +1,65 @@ -name: Release Helm Charts +name: Publish Helm Charts on: push: - # branches: [gh-pages, master] - branches: [gh-pages, master, SYS-570_charts] + branches: [main, SYS-673_envoy_gateway] + paths: + - k8s/helm/**/Chart.yaml + +env: + REGISTRY: ghcr.io + CHART_DIR: k8s/helm jobs: - release: + find-charts: + runs-on: ubuntu-latest + outputs: + matrix: ${{ steps.set-matrix.outputs.matrix }} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 2 + + - name: List Chart.yaml Updates + id: set-matrix + run: | + CHANGED=$(git diff --name-only HEAD^ HEAD | \ + grep "^${CHART_DIR}/.*/Chart.yaml" | \ + awk '{sub(/\/[^/]+$/, ""); print}' | paste -sd , ) + echo "matrix={\"chart\":[$CHANGED]}" >> $GITHUB_OUTPUT + + publish: + needs: find-charts + if: ${{ needs.find-charts.outputs.matrix != '{"chart":[]}' }} runs-on: ubuntu-latest + permissions: + contents: read + packages: write + strategy: + matrix: ${{ fromJson(needs.detect-changes.outputs.matrix) }} steps: - name: Checkout - uses: actions/checkout@v2.3.4 + uses: actions/checkout@v4 with: fetch-depth: 0 - - name: Configure Git - run: | - git config user.name "$GITHUB_ACTOR" - git config user.email "$GITHUB_ACTOR@users.noreply.github.com" + # - name: Configure Git + # run: | + # git config user.name "$GITHUB_ACTOR" + # git config user.email "$GITHUB_ACTOR@users.noreply.github.com" + + - name: Install Helm + uses: azure/setup-helm@v4 - - name: Run chart-releaser - uses: helm/chart-releaser-action@v1.2.1 - env: - CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" + - name: Log in to OCI Registry + uses: docker/login-action@v3 with: - charts_dir: k8s/helm - config: .github/cr.yaml + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Package and Push + run: | + helm package "${{ matrix.chart }}" + helm push "$(echo *.tgz)" oci://ghcr.io/${{ github.repository_owner }}/helm-charts diff --git a/README.md b/README.md index 533cff98..c3d4a159 100644 --- a/README.md +++ b/README.md @@ -34,7 +34,7 @@ The cluster-deployment tools here include helm charts and ansible playbooks to s * Encryption for internal etcd * MFA using [Authelia](https://github.com/clems4ever/authelia) and Google Authenticator * Calico or flannel networking -* ingress-nginx +* Envoy API gateway * Local-volume sync * Garage object storage * Pod security policies diff --git a/ansible/roles/network/defaults/main.yml b/ansible/roles/network/defaults/main.yml index b6b3fdb3..2d8f3c82 100644 --- a/ansible/roles/network/defaults/main.yml +++ b/ansible/roles/network/defaults/main.yml @@ -1,4 +1,9 @@ --- +ca_trust_defaults: + path: /usr/local/share/ca-certificates + certificates: [] +ca_trust: "{{ ca_trust_defaults | combine(ca_trust_override) }}" + kernel_modules: - ip_vs diff --git a/ansible/roles/network/files/certs b/ansible/roles/network/files/certs new file mode 120000 index 00000000..9ac8c04f --- /dev/null +++ b/ansible/roles/network/files/certs @@ -0,0 +1 @@ +../../../../admin/tls/ \ No newline at end of file diff --git a/ansible/roles/network/handlers/main.yml b/ansible/roles/network/handlers/main.yml index e904614a..705b4242 100644 --- a/ansible/roles/network/handlers/main.yml +++ b/ansible/roles/network/handlers/main.yml @@ -13,6 +13,9 @@ name: ssh state: restarted +- name: Update CA certificates + command: update-ca-certificates + - name: Restart tailscaled ansible.builtin.service: enabled: yes diff --git a/ansible/roles/network/tasks/certificates.yml b/ansible/roles/network/tasks/certificates.yml new file mode 100644 index 00000000..2e24aa3b --- /dev/null +++ b/ansible/roles/network/tasks/certificates.yml @@ -0,0 +1,8 @@ +--- +- name: Add trusted root certificate(s) + ansible.builtin.copy: + dest: "{{ ca_trust.path }}/{{ item }}" + mode: 0400 + src: certs/{{ item }} + with_items: "{{ ca_trust.certificates }}" + notify: Update CA certificates diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml index b0355e8a..4cc989f8 100644 --- a/ansible/roles/network/tasks/main.yml +++ b/ansible/roles/network/tasks/main.yml @@ -12,6 +12,7 @@ - import_tasks: tailscale.yml when: network.tailscale.enabled +- import_tasks: certificates.yml - import_tasks: kernel.yml - import_tasks: sshd.yml diff --git a/images/mythtv-backend/helm/Chart.yaml b/images/mythtv-backend/helm/Chart.yaml index 8e4be4ea..9bd07118 100644 --- a/images/mythtv-backend/helm/Chart.yaml +++ b/images/mythtv-backend/helm/Chart.yaml @@ -6,12 +6,12 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/mythtv/mythtv type: application -version: 0.1.23 +version: 0.1.24 appVersion: "36.0-fixes.202608221819.b6ed364d3f" dependencies: - name: chartlib - version: 0.1.8 - repository: https://instantlinux.github.io/docker-tools + version: 0.1.10 + repository: oci://registry-1.docker.io/instantlinux - name: data-sync version: 0.1.3 repository: https://instantlinux.github.io/docker-tools diff --git a/images/mythtv-backend/helm/templates/app.yaml b/images/mythtv-backend/helm/templates/app.yaml index aeeec90a..a32c0217 100644 --- a/images/mythtv-backend/helm/templates/app.yaml +++ b/images/mythtv-backend/helm/templates/app.yaml @@ -1,3 +1,5 @@ +{{- include "chartlib.configmap" . }} +--- {{- include "chartlib.deployment" . }} --- {{- include "chartlib.hpa" . }} @@ -6,6 +8,8 @@ --- {{- include "chartlib.ingresstotp" . }} --- +{{- include "chartlib.listener" . }} +--- {{- include "chartlib.service" . }} --- {{- include "chartlib.serviceaccount" . }} diff --git a/images/mythtv-backend/helm/values.yaml b/images/mythtv-backend/helm/values.yaml index 3644dbd8..10d9eb1e 100644 --- a/images/mythtv-backend/helm/values.yaml +++ b/images/mythtv-backend/helm/values.yaml @@ -89,6 +89,8 @@ authelia: fqdn: authtotp.example.com ip: 10.101.1.5 path: /Myth/LoginUser +gateway: + enabled: true ingress: # This ingress exposes your MythTV schedule and operational controls to # the public Internet. Set up the admin user before enabling. See diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 95b2bf3a..72fef932 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -5,9 +5,9 @@ home: https://github.com/instantlinux/docker-tools sources: - https://github.com/instantlinux/docker-tools type: application -version: 0.1.0 +version: 0.1.1 appVersion: "latest" dependencies: - name: chartlib - version: 0.1.8 - repository: https://instantlinux.github.io/docker-tools + version: 0.1.10 + repository: oci://registry-1.docker.io/instantlinux diff --git a/images/squirrelmail/helm/templates/app.yaml b/images/squirrelmail/helm/templates/app.yaml index 5b83e9c4..a32c0217 100644 --- a/images/squirrelmail/helm/templates/app.yaml +++ b/images/squirrelmail/helm/templates/app.yaml @@ -1,3 +1,5 @@ +{{- include "chartlib.configmap" . }} +--- {{- include "chartlib.deployment" . }} --- {{- include "chartlib.hpa" . }} @@ -6,6 +8,10 @@ --- {{- include "chartlib.ingresstotp" . }} --- +{{- include "chartlib.listener" . }} +--- {{- include "chartlib.service" . }} --- {{- include "chartlib.serviceaccount" . }} +--- +{{- include "chartlib.statefulset" . }} diff --git a/images/squirrelmail/helm/values.yaml b/images/squirrelmail/helm/values.yaml index 9950aaae..ee08370d 100644 --- a/images/squirrelmail/helm/values.yaml +++ b/images/squirrelmail/helm/values.yaml @@ -51,11 +51,5 @@ service: autoscaling: enabled: false -authelia: - fqdn: authtotp.example.com - ip: 10.101.1.5 - path: /src/login.php -ingress: - enabled: true -ingressTOTP: +gateway: enabled: true diff --git a/k8s/Makefile b/k8s/Makefile index 83ea9dc3..1b41b5ef 100644 --- a/k8s/Makefile +++ b/k8s/Makefile @@ -91,15 +91,12 @@ INSTALL_YAML = $(basename $(wildcard install/*.yaml)) \ $(addprefix imports/, $(IMPORTS)) VOLUMES_YAML = $(basename $(wildcard volumes/*.yaml)) -install: install/admin-user cluster_network \ - install/local-storage storage_localdefault imports \ - install_imports namespace_config install/prometheus-rbac \ - install/k8s-backup fluent-bit remote_volumes \ +install: install/admin-user cluster_network imports \ + install_imports namespace_config fluent-bit remote_volumes \ sops data-sync-ssh persistent secrets install/ingress-nginx \ - install/rsyslog-ext install/cert-manager + infra storage_localdefault -namespace_config: install/namespace install/limits install/namespace-user \ - secrets/regcred +namespace_config: install/namespace install/namespace-user secrets/regcred untaint_master: @echo -e '** Allowing workload on master risks admin-cert security compromise **\n' @@ -176,15 +173,33 @@ include Makefile.sops # cert-manager ########## -# Note - need both, to define the CRD and the ClusterIssuer resources +# Note - need both, to define the CRD and the ClusterIssuer resources; define +# an override file for infra helm chart first and then: # make imports/cert-manager -# make install/cert-manager +# make infra imports/cert-manager.yaml: imports/cert-manager-$(VERSION_CERT_MANAGER).yaml ln -s $(notdir $<) $@ imports/cert-manager-$(VERSION_CERT_MANAGER).yaml: curl -sLo $@ https://github.com/cert-manager/cert-manager/releases/download/v$(VERSION_CERT_MANAGER)/cert-manager.yaml +# Run this once after imports/cert-manager +cert-manager-gateway: + kubectl patch deployment cert-manager --context=sudo -n cert-manager --type='json' -p='[ { "op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--enable-gateway-api" }, { "op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--enable-gateway-api-listenerset" }, { "op": "add", "path": "/spec/template/spec/containers/0/args/-", "value": "--feature-gates=ListenerSets=true" } ]' + +########## +# envoy-gateway +########## +imports/envoy-gateway.yaml: imports/envoy-gateway-$(VERSION_ENVOY_GATEWAY).yaml + ln -s $(notdir $<) $@ +imports/envoy-gateway-$(VERSION_ENVOY_GATEWAY).yaml: + curl -sLo $@ https://github.com/envoyproxy/gateway/releases/download/v$(VERSION_ENVOY_GATEWAY)/install.yaml +imports/envoy-gateway:: imports/envoy-gateway.yaml + @echo --$(NOTICE) $@ from server-side-- + @SERVICE_NAME=$(@F) \ + envsubst < $@.yaml | kubectl $(ADMIN_CTX) $(ACTION) \ + --server-side --force-conflicts -f - + ########## # node-local-dns ########## diff --git a/k8s/Makefile.helm b/k8s/Makefile.helm index 6c95a70f..b287e0a6 100644 --- a/k8s/Makefile.helm +++ b/k8s/Makefile.helm @@ -49,3 +49,5 @@ CHARTLOCK = $(addsuffix /Chart.lock, $(addprefix helm/, $(CHARTS))) \ $(addsuffix /Chart.lock, $(addprefix helm/instances/, $(INSTANCES))) $(CHARTLOCK): helm dependency update $(dir $@) + +infra: XARGS=--kube-context=sudo diff --git a/k8s/Makefile.sops b/k8s/Makefile.sops index b43b3447..d44ce115 100644 --- a/k8s/Makefile.sops +++ b/k8s/Makefile.sops @@ -5,6 +5,7 @@ # make gen_sops_gpg - Set up local PGP private key # make secrets/foo.yml - Create a new secret # make secrets/foo - (without .yml) Upload secret to k8s +# K8S_NAMESPACE=other CONTEXT_FLAG=--context=sudo make secrets/foo - Upload to alt namespace # sops secrets/foo.yml - Edit secret # # Note: @@ -13,6 +14,7 @@ .PHONY: sops gen_sops_gpg sops: /usr/local/bin/sops +CONTEXT_FLAG ?= /usr/local/bin/sops: ifeq ($(shell uname -s),Darwin) @@ -55,10 +57,7 @@ SECRETS = $(basename $(wildcard secrets/*.yml secrets/*/*.yml)) secrets: $(SECRETS) $(SECRETS): -sops -d $@.yml | envsubst | \ - kubectl create -n $(K8S_NAMESPACE) -f - - -# TODO does this need sudo? -# kubectl create -n $(K8S_NAMESPACE) --context=sudo -f - + kubectl create -n $(K8S_NAMESPACE) $(CONTEXT_FLAG) -f - secrets/%.yml secrets/*/%yml: @echo Creating secret $(@F) diff --git a/k8s/Makefile.vars b/k8s/Makefile.vars index c572c6d5..b0f329c4 100644 --- a/k8s/Makefile.vars +++ b/k8s/Makefile.vars @@ -6,7 +6,6 @@ export DOMAIN ?= domain.com -export CERT_MGR_EMAIL ?= admin@$(DOMAIN) export CLUSTER_NETWORK ?= flannel export DB_HOST ?= db00.$(DOMAIN) export EDITOR ?= vi @@ -14,10 +13,6 @@ export K8S_NAMESPACE ?= worker export K8S_NODES ?= kube1.$(DOMAIN) kube2.$(DOMAIN) kube3.$(DOMAIN) export K8S_WORKER_COUNT ?= 3 export K8S_VOLUMES_PATH ?= /var/lib/docker/k8s-volumes -export LIMIT_CPU_DEFAULT ?= 500m -export LIMIT_CPU_REQUEST ?= 50m -export LIMIT_MEM_DEFAULT ?= 256Mi -export LIMIT_MEM_REQUEST ?= 64Mi export LOG_NAMESPACE ?= logging export LOG_TO_SPLUNK ?= export MYTHTV_VOL_SIZE ?= 400Gi @@ -31,17 +26,16 @@ export POOL_SIZE_SMALL = 500Mi export TZ ?= UTC # IP addresses - TODO replace static IPs with names, if practical -export K8S_INGRESS_NGINX_IP ?= 10.101.1.2 export AUTHELIA_IP ?= 10.101.1.5 -export MONITOR_EXT_IP ?= 192.168.1.20 -export RSYSLOGD_IP ?= 10.101.1.40 export COREDNS_IP ?= 10.96.0.10 +export K8S_INGRESS_NGINX_IP ?= 10.101.1.2 +export MONITOR_EXT_IP ?= 192.168.1.20 export NODE_LOCAL_DNS_IP ?= 169.254.0.10 +export RSYSLOGD_IP ?= 10.101.1.40 -# Exposed nodePorts - install/ingress-nginx.yaml, install/rsyslog-ext.yaml +# Exposed nodePorts - install/ingress-nginx.yaml export NODEPORT_HTTP ?= 30080 export NODEPORT_HTTPS ?= 30443 -export NODEPORT_SYSLOG ?= 30514 # Ports configured in ingress-nginx.yaml export PORT_DOVECOT_IMAPD ?= 843 diff --git a/k8s/Makefile.versions b/k8s/Makefile.versions index ba9f8467..5f6c9f65 100644 --- a/k8s/Makefile.versions +++ b/k8s/Makefile.versions @@ -1,8 +1,9 @@ # Third-party versions -export VERSION_CERT_MANAGER ?= 1.21.1 +export VERSION_CERT_MANAGER ?= 1.21.2 export VERSION_DEFAULTBACKEND ?= 1.5 +export VERSION_ENVOY_GATEWAY ?= 1.9.1 export VERSION_FLANNEL ?= 0.28.9 -export VERSION_HELM ?= 4.1.0 +export VERSION_HELM ?= 4.3.0 export VERSION_INGRESS_NGINX ?= 1.15.1 export VERSION_METRICS ?= 2.18.0 export VERSION_NODE_LOCAL_DNS ?= 1.36.4 diff --git a/k8s/README.md b/k8s/README.md index 916a42e4..439f53db 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -33,7 +33,7 @@ kubeadm suite: * MFA using [Authelia](https://github.com/clems4ever/authelia) and Google Authenticator * Calico or flannel networking * Fluent Bit for container-log aggregation -* ingress-nginx +* Envoy API gateway * Local-volume sync * Automatic certificate issuing/renewal with Letsencrypt @@ -229,11 +229,25 @@ Look in the k8s/install subdirectory for resources in namespace-user.yaml for ex ### Installation -To configure k8s resources, invoke the following in this directory ([k8s](https://github.com/instantlinux/docker-tools/tree/main/k8s)): +To configure k8s resources, first define a helm override file `infra.yaml` with content like these (define names to suit your environment): +``` +authelia: + namespace: instantlinux +certManager: + email: admin@ci.net + solvers: + dns01: + enabled: true + groupName: acme.ci.net +gateway: + nodeport_http: 30180 + nodeport_https: 30543 +``` +You'll need an account at letsencrypt, and a dns-apikey secret (with user and key) stored in cert-manager namespace. Invoke the following in this directory ([k8s](https://github.com/instantlinux/docker-tools/tree/main/k8s)): ``` make install ``` -This will add flannel networking, an nginx ingress load-balancer, +This will add flannel networking, an Envoy API gateway, helm and sops. Create directories for persistent volumes for each node, and optionally set node-affinity labels: ``` @@ -286,9 +300,9 @@ but gpg is suitable for bare-metal data center setups. ### Certificate Manager Cert-manager installation is part of the above _make install_; to -start the issuer invoke: +start the issuer (part of the `infra` helm chart here) invoke: ``` -CERT_MGR_EMAIL= make install/cert-manager +CERT_MGR_EMAIL= make infra ``` A lot of things have to be functioning before letsencrypt will issue certs: the [Let's Encrypt troubleshooting guide](https://cert-manager.io/docs/troubleshooting/acme/) is super-helpful. diff --git a/k8s/helm/authelia/Chart.yaml b/k8s/helm/authelia/Chart.yaml index 99eabe45..4fa6ae28 100644 --- a/k8s/helm/authelia/Chart.yaml +++ b/k8s/helm/authelia/Chart.yaml @@ -6,12 +6,12 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/authelia/authelia type: application -version: 0.1.12 -appVersion: "4.39.20" +version: 0.1.13 +appVersion: "4.39.25" dependencies: - name: chartlib - version: 0.1.8 - repository: https://instantlinux.github.io/docker-tools + version: 0.1.10 + repository: oci://registry-1.docker.io/instantlinux - name: ldap version: 0.1.0 repository: file://subcharts/ldap diff --git a/k8s/helm/authelia/templates/configmap.yaml b/k8s/helm/authelia/templates/configmap.yaml index 246d24cc..5975f6d8 100644 --- a/k8s/helm/authelia/templates/configmap.yaml +++ b/k8s/helm/authelia/templates/configmap.yaml @@ -57,10 +57,11 @@ data: # Configuration of session cookies session: - expiration: {{ .Values.session.expiration }} - inactivity: {{ .Values.session.inactivity }} - # TODO this is deprecated with little info about how to fix it - domain: {{ .Values.session.domain }} + cookies: + - domain: {{ .Values.domain }} + authelia_url: https://{{ $.Values.tlsHostname }} + expiration: {{ .Values.session.expiration }} + inactivity: {{ .Values.session.inactivity }} redis: host: redis port: 6379 diff --git a/k8s/helm/chartlib/Chart.yaml b/k8s/helm/chartlib/Chart.yaml index e28616a5..075d0e4d 100644 --- a/k8s/helm/chartlib/Chart.yaml +++ b/k8s/helm/chartlib/Chart.yaml @@ -4,4 +4,4 @@ description: Standard templates library sources: - https://github.com/instantlinux/docker-tools type: library -version: 0.1.9 +version: 0.1.10 diff --git a/k8s/helm/chartlib/templates/_listener.yaml b/k8s/helm/chartlib/templates/_listener.yaml new file mode 100644 index 00000000..8e437675 --- /dev/null +++ b/k8s/helm/chartlib/templates/_listener.yaml @@ -0,0 +1,144 @@ +{{- define "chartlib.listener" -}} +{{- if hasKey .Values "gateway" }} +{{- if or .Values.gateway.enabled (not (hasKey .Values "gateway.enabled")) }} +{{- $fullName := include "local.fullname" . -}} +{{- $svcPort := .Values.service.port | default (index .Values.service.ports 0).port -}} +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: ListenerSet +metadata: + name: {{ $fullName }} + labels: + {{- include "local.labels" . | nindent 4 }} + annotations: + {{- if hasKey .Values.gateway "annotations" }} + {{- toYaml .Values.gateway.annotations | nindent 4 }} + {{- else if .Values.gateway.external }} + cert-manager.io/cluster-issuer: letsencrypt-prod + {{- else }} + cert-manager.io/cluster-issuer: internal-ca-issuer + {{- end }} +spec: + parentRef: + group: gateway.networking.k8s.io + kind: Gateway + name: {{ .Values.gateway.name | default "gateway-1" }} + {{- if hasKey .Values.gateway "namespace" }} + namespace: {{ .Values.gateway.namespace }} + {{- end }} + listeners: + {{- if hasKey .Values "tlsHostname" }} + - name: https + hostname: {{ .Values.tlsHostname }} + port: 443 + protocol: HTTPS + tls: + mode: Terminate + certificateRefs: + - name: tls-{{ $fullName }} + - name: http + hostname: {{ .Values.tlsHostname }} + port: 80 + protocol: HTTP + {{- end }} + {{- if hasKey .Values.gateway "listeners" }} + {{- toYaml .Values.gateway.listeners | nindent 2 }} + {{- end }} +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: {{ $fullName }} +spec: + parentRefs: + - kind: ListenerSet + name: {{ $fullName }} + sectionName: https + rules: + {{- if hasKey .Values.gateway "routeRules" }} + {{- toYaml .Values.gateway.routeRules | nindent 2 }} + {{- else }} + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - name: {{ $fullName }} + port: {{ $svcPort }} + {{- end }} +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: {{ $fullName }}-https-redirect +spec: + parentRefs: + - kind: ListenerSet + name: {{ $fullName }} + sectionName: http + rules: + - filters: + - type: RequestRedirect + requestRedirect: + scheme: https + statusCode: 308 +{{- if and (hasKey .Values.gateway "totp") .Values.gateway.totp -}} +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: {{ $fullName }}-authelia +spec: + parentRefs: + - kind: ListenerSet + name: {{ $fullName }} + sectionName: https + rules: + - matches: + - path: + type: PathPrefix + value: {{ .Values.authelia.path }} + backendRefs: + - name: {{ $fullName }} + port: {{ $svcPort }} +--- +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: SecurityPolicy +metadata: + name: {{ $fullName }}-totp +spec: + targetRefs: + - group: gateway.networking.k8s.io + # kind: HTTPRoute + # name: {{ $fullName }}-authelia + kind: Gateway + name: {{ .Values.gateway.name | default "gateway-1" }} + extAuth: + failOpen: false + headersToExtAuth: + - accept + - authorization + - cookie + - location + - proxy-authorization + - x-forwarded-host + - x-forwarded-method + - x-forwarded-proto + - x-forwarded-uri + http: + backendRefs: + - name: {{ .Values.authelia.service | default "authelia" }} + port: {{ .Values.authelia.port | default 80 }} + {{- if hasKey .Values.authelia "namespace" }} + namespace: {{ .Values.authelia.namespace }} + {{- end }} + headersToBackend: + - Remote-Email + - Remote-Groups + - Remote-Name + - Remote-User + path: /api/authz/ext-authz/ +{{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/k8s/helm/gitea/Chart.yaml b/k8s/helm/gitea/Chart.yaml index f2067514..192ea3dc 100644 --- a/k8s/helm/gitea/Chart.yaml +++ b/k8s/helm/gitea/Chart.yaml @@ -6,9 +6,9 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/go-gitea/gitea type: application -version: 0.1.10 -appVersion: 1.26.4-rootless +version: 0.1.11 +appVersion: 1.27.3-rootless dependencies: - name: chartlib - version: 0.1.8 - repository: https://instantlinux.github.io/docker-tools + version: 0.1.10 + repository: oci://registry-1.docker.io/instantlinux diff --git a/k8s/helm/gitea/templates/app.yaml b/k8s/helm/gitea/templates/app.yaml index 5a01911b..a32c0217 100644 --- a/k8s/helm/gitea/templates/app.yaml +++ b/k8s/helm/gitea/templates/app.yaml @@ -8,6 +8,8 @@ --- {{- include "chartlib.ingresstotp" . }} --- +{{- include "chartlib.listener" . }} +--- {{- include "chartlib.service" . }} --- {{- include "chartlib.serviceaccount" . }} diff --git a/k8s/helm/gitea/values.yaml b/k8s/helm/gitea/values.yaml index d07b0745..66892a07 100644 --- a/k8s/helm/gitea/values.yaml +++ b/k8s/helm/gitea/values.yaml @@ -99,11 +99,10 @@ service: autoscaling: enabled: false -authelia: - fqdn: authtotp.example.com - ip: 10.101.1.5 - path: /user/login +gateway: + enabled: true ingress: + enabled: false annotations: cert-manager.io/cluster-issuer: letsencrypt-prod kubernetes.io/ingress.class: nginx diff --git a/k8s/helm/grafana/Chart.yaml b/k8s/helm/grafana/Chart.yaml index 4b592a6d..b3bb6ebe 100644 --- a/k8s/helm/grafana/Chart.yaml +++ b/k8s/helm/grafana/Chart.yaml @@ -6,13 +6,13 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/grafana/grafana type: application -version: 0.1.5 +version: 0.1.6 # Reminder, update subchart tags in values.yaml appVersion: 13.0.6 dependencies: - name: chartlib - version: 0.1.8 - repository: https://instantlinux.github.io/docker-tools + version: 0.1.10 + repository: oci://registry-1.docker.io/instantlinux - name: prometheus version: 0.1.4 repository: file://subcharts/prometheus diff --git a/k8s/helm/grafana/templates/app.yaml b/k8s/helm/grafana/templates/app.yaml index 5a01911b..a32c0217 100644 --- a/k8s/helm/grafana/templates/app.yaml +++ b/k8s/helm/grafana/templates/app.yaml @@ -8,6 +8,8 @@ --- {{- include "chartlib.ingresstotp" . }} --- +{{- include "chartlib.listener" . }} +--- {{- include "chartlib.service" . }} --- {{- include "chartlib.serviceaccount" . }} diff --git a/k8s/helm/grafana/values.yaml b/k8s/helm/grafana/values.yaml index 8363e28e..09640acb 100644 --- a/k8s/helm/grafana/values.yaml +++ b/k8s/helm/grafana/values.yaml @@ -85,13 +85,16 @@ authelia: fqdn: authtotp.example.com ip: 10.101.1.5 path: /login +gateway: + enabled: true ingress: + enabled: false annotations: cert-manager.io/cluster-issuer: letsencrypt-prod kubernetes.io/ingress.class: nginx nginx.ingress.kubernetes.io/enable-access-log: "false" ingressTOTP: - enabled: true + enabled: false # Subchart parameters prometheus: diff --git a/k8s/helm/guacamole/Chart.yaml b/k8s/helm/guacamole/Chart.yaml index dc56b7a8..2bc2fadf 100644 --- a/k8s/helm/guacamole/Chart.yaml +++ b/k8s/helm/guacamole/Chart.yaml @@ -13,10 +13,10 @@ version: 0.1.6 appVersion: "1.6.0" dependencies: - name: chartlib - version: 0.1.8 - repository: https://instantlinux.github.io/docker-tools + version: 0.1.10 + repository: oci://registry-1.docker.io/instantlinux - name: guacamole-server - version: 0.1.5 + version: 0.1.6 repository: file://subcharts/guacamole-server - name: guacd version: 0.1.5 diff --git a/k8s/helm/guacamole/subcharts/guacamole-server/Chart.yaml b/k8s/helm/guacamole/subcharts/guacamole-server/Chart.yaml index f5b332f5..2f04c49b 100644 --- a/k8s/helm/guacamole/subcharts/guacamole-server/Chart.yaml +++ b/k8s/helm/guacamole/subcharts/guacamole-server/Chart.yaml @@ -6,7 +6,7 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/apache/guacamole-server type: application -version: 0.1.5 +version: 0.1.6 appVersion: "1.6.0" dependencies: - name: chartlib diff --git a/k8s/helm/guacamole/subcharts/guacamole-server/templates/app.yaml b/k8s/helm/guacamole/subcharts/guacamole-server/templates/app.yaml index 5a01911b..a32c0217 100644 --- a/k8s/helm/guacamole/subcharts/guacamole-server/templates/app.yaml +++ b/k8s/helm/guacamole/subcharts/guacamole-server/templates/app.yaml @@ -8,6 +8,8 @@ --- {{- include "chartlib.ingresstotp" . }} --- +{{- include "chartlib.listener" . }} +--- {{- include "chartlib.service" . }} --- {{- include "chartlib.serviceaccount" . }} diff --git a/k8s/helm/guacamole/subcharts/guacamole-server/values.yaml b/k8s/helm/guacamole/subcharts/guacamole-server/values.yaml index aed5ddc6..e354b69f 100644 --- a/k8s/helm/guacamole/subcharts/guacamole-server/values.yaml +++ b/k8s/helm/guacamole/subcharts/guacamole-server/values.yaml @@ -23,13 +23,24 @@ service: type: ClusterIP autoscaling: enabled: false -ingress: - annotations: - cert-manager.io/cluster-issuer: letsencrypt-prod - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/app-root: /guacamole - nginx.ingress.kubernetes.io/proxy-buffering: "off" - nginx.ingress.kubernetes.io/enable-access-log: "false" - nginx.ingress.kubernetes.io/configuration-snippet: | - proxy_set_header Connection $http_connection; - proxy_set_header Upgrade $http_upgrade; +gateway: + enabled: true + routeRules: + - backendRefs: + - name: guacamole-guacamole-server + port: 80 + matches: + - path: + type: PathPrefix + value: / + - filters: + - requestRedirect: + path: + replaceFullPath: /guacamole + type: ReplaceFullPath + statusCode: 302 + type: RequestRedirect + matches: + - path: + type: Exact + value: / diff --git a/k8s/helm/infra/.helmignore b/k8s/helm/infra/.helmignore new file mode 100644 index 00000000..839de881 --- /dev/null +++ b/k8s/helm/infra/.helmignore @@ -0,0 +1,2 @@ +*~ +.git diff --git a/k8s/helm/infra/Chart.yaml b/k8s/helm/infra/Chart.yaml new file mode 100644 index 00000000..bff29269 --- /dev/null +++ b/k8s/helm/infra/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +name: infra +description: Miscellaneous K8S infra resource definitions +home: https://github.com/instantlinux/docker-tools +sources: +- https://github.com/instantlinux/docker-tools +type: application +version: 0.1.0 +appVersion: "0.1.0" +dependencies: +- name: chartlib + version: 0.1.8 + repository: https://instantlinux.github.io/docker-tools diff --git a/k8s/helm/infra/templates/NOTES.txt b/k8s/helm/infra/templates/NOTES.txt new file mode 100644 index 00000000..62ea3f4b --- /dev/null +++ b/k8s/helm/infra/templates/NOTES.txt @@ -0,0 +1,28 @@ +{{- if hasKey .Values "service" }} +{{- if or .Values.service.enabled (not (hasKey .Values.service "enabled")) }} +1. Get the application URL by running these commands: +{{- if hasKey .Values "ingress" }} +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "local.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "local.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "local.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "local.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/k8s/helm/infra/templates/cert-manager.yaml b/k8s/helm/infra/templates/cert-manager.yaml new file mode 100644 index 00000000..0e910866 --- /dev/null +++ b/k8s/helm/infra/templates/cert-manager.yaml @@ -0,0 +1,153 @@ +{{- if hasKey .Values "staging" }} +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: {{ .Values.certManager.issuer.staging }} + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: {{ .Values.certManager.email }} + privateKeySecretRef: + name: {{ .Values.certManager.issuer.staging }} + solvers: + {{- range .Values.certManager.solvers }} + {{- if hasKey . "enabled" | ternary .enabled true }} + {{- if eq .solver "dns01" }} + - selector: + dnsZones: {{ .dnsZones }} + dns01: + {{- if hasKey . "webhook" | ternary .webhook true }} + webhook: + groupName: {{ .groupName }} + solverName: lexicon +# TODO resync with prod + config: + provider: {{ .provider }} + userPassword: false + # authUsernameSecretRef: + usernameRef: + name: {{ .apiKey }} + key: user + passwordRef: + name: {{ .apiKey }} + key: user + apiKeyRef: + name: {{ .apiKey }} + key: key + {{- else }} + {{ .provider }}: + email: {{ .email }} + apiKeySecretRef: + name: {{ .apiKey }} + key: api-key + {{- end }} + {{- else if eq .solver "http01" }} + - http01: + ingress: + class: nginx + {{- end }} + {{- end }} + {{- end }} +{{- end }} +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: {{ .Values.certManager.issuer.prod }} + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: {{ .Values.certManager.email }} + privateKeySecretRef: + name: {{ .Values.certManager.issuer.prod }} + solvers: + {{- range .Values.certManager.solvers }} + {{- if hasKey . "enabled" | ternary .enabled true }} + {{- if eq .solver "dns01" }} + - selector: + dnsZones: {{ .dnsZones }} + dns01: + {{- if hasKey . "webhook" | ternary .webhook true }} + webhook: + groupName: {{ .groupName }} + solverName: lexicon + config: + provider: {{ .provider }} + usePassword: true + # authUsernameSecretRef: + # apiSecretRef: + # name: {{ .apiKey }} + # key: user + # passwordRef: + # name: {{ .apiKey }} + # key: user + # apiKeyRef: + # name: {{ .apiKey }} + # key: key + usernameRef: + name: {{ .apiKey }} + key: auth_username + apiKeyRef: + name: {{ .apiKey }} + key: auth_usertoken + {{- else }} + {{ .provider }}: + email: {{ .email }} + apiKeySecretRef: + name: {{ .apiKey }} + key: api-key + {{- end }} + {{- else if eq .solver "http01" }} + - http01: + ingress: + class: nginx + {{- end }} + {{- end }} + {{- end }} +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: internal-root-ca-issuer + namespace: cert-manager + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + selfSigned: {} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: internal-root-ca + namespace: cert-manager + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + isCA: true + commonName: internal-root-ca + duration: {{ .Values.certManager.internalCA.rootCert.duration }} + issuerRef: + name: internal-root-ca-issuer + kind: Issuer + privateKey: + algorithm: ECDSA + size: 256 + renewBefore: {{ .Values.certManager.internalCA.rootCert.renewBefore }} + secretName: internal-root-cert + subject: + {{- toYaml .Values.certManager.internalCA.subject | nindent 4 }} +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: internal-ca-issuer + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + ca: + secretName: internal-root-cert diff --git a/k8s/helm/infra/templates/gateway.yaml b/k8s/helm/infra/templates/gateway.yaml new file mode 100644 index 00000000..98ea98f1 --- /dev/null +++ b/k8s/helm/infra/templates/gateway.yaml @@ -0,0 +1,94 @@ +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: GatewayClass +metadata: + name: envoy-class + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + controllerName: gateway.envoyproxy.io/gatewayclass-controller + parametersRef: + group: gateway.envoyproxy.io + kind: EnvoyProxy + name: {{ .Values.gateway.config }} + namespace: {{ .Values.gateway.crdNamespace }} +--- +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: EnvoyProxy +metadata: + name: {{ .Values.gateway.config }} + namespace: {{ .Values.gateway.crdNamespace }} + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + provider: + type: Kubernetes + kubernetes: + envoyService: + type: NodePort + patch: + type: StrategicMerge + value: + spec: + ports: + - name: http + port: 80 + protocol: TCP + nodePort: {{ .Values.gateway.nodeport_http }} + - name: https + port: 443 + protocol: TCP + nodePort: {{ .Values.gateway.nodeport_https }} +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: {{ .Values.gateway.name }} + namespace: {{ .Values.namespace }} + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + gatewayClassName: envoy-class + allowedListeners: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: {{ .Values.namespace }} + listeners: + listeners: + # Custom port mappings for local services - dovecot, git, postfix + # Other services are defined as ListenerSets in their helm charts + {{- if hasKey .Values.gateway "listeners" }} + {{- range .Values.gateway.listeners }} + - name: {{ .name }} + protocol: TCP + port: {{ .port }} + allowedRoutes: + kinds: + - kind: TCPRoute + {{- end }} + {{- else }} + - name: dummy + protocol: HTTP + port: 80 + {{- end }} +{{- if ne .Values.namespace .Values.authelia.namespace }} +--- +apiVersion: gateway.networking.k8s.io/v1beta1 +kind: ReferenceGrant +metadata: + name: envoy-authelia-integration + namespace: {{ .Values.authelia.namespace }} + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + from: + - group: gateway.envoyproxy.io + kind: SecurityPolicy + namespace: {{ .Values.infra.namespace }} + to: + - group: "" + kind: Service + name: {{ .Values.authelia.service | default "authelia" }} +{{- end }} diff --git a/k8s/install/k8s-backup.yaml b/k8s/helm/infra/templates/k8s-backup.yaml similarity index 87% rename from k8s/install/k8s-backup.yaml rename to k8s/helm/infra/templates/k8s-backup.yaml index 79c5e748..b35f5636 100644 --- a/k8s/install/k8s-backup.yaml +++ b/k8s/helm/infra/templates/k8s-backup.yaml @@ -5,8 +5,7 @@ metadata: name: backup namespace: kube-system spec: - # 4:10am PST is 12:10pm UTC - k8s cron only supports UTC - schedule: "10 12 * * *" + schedule: {{ .Values.k8sBackup.schedule }} jobTemplate: spec: template: @@ -14,7 +13,7 @@ spec: containers: - name: backup # Same image as in /etc/kubernetes/manifests/etcd.yaml - image: registry.k8s.io/etcd:$VERSION_ETCD + image: registry.k8s.io/etcd:{{ .Values.k8sBackup.etcdVersion }} command: ["/bin/sh"] args: ["-c", "etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key snapshot save /backup/etcd-snapshot-$(printf '%(%y-%m-%d_%T)T').db"] env: @@ -40,4 +39,4 @@ spec: path: /etc/kubernetes/pki/etcd type: Directory - name: backup - hostPath: { path: /var/backup/k8s } + hostPath: { path: {{ .Values.k8sBackup.destPath }} } diff --git a/k8s/helm/infra/templates/limits.yaml b/k8s/helm/infra/templates/limits.yaml new file mode 100644 index 00000000..762918ef --- /dev/null +++ b/k8s/helm/infra/templates/limits.yaml @@ -0,0 +1,30 @@ +--- +apiVersion: v1 +kind: LimitRange +metadata: + name: mem-limit-range + namespace: {{ .Values.namespace }} + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + limits: + - default: + memory: {{ .Values.limits.mem.default }} + defaultRequest: + memory: {{ .Values.limits.mem.request }} + type: Container +--- +apiVersion: v1 +kind: LimitRange +metadata: + name: cpu-limit-range + namespace: {{ .Values.namespace }} + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + limits: + - default: + cpu: {{ .Values.limits.cpu.default }} + defaultRequest: + cpu: {{ .Values.limits.cpu.request }} + type: Container diff --git a/k8s/helm/infra/templates/listeners.yaml b/k8s/helm/infra/templates/listeners.yaml new file mode 100644 index 00000000..14a33aad --- /dev/null +++ b/k8s/helm/infra/templates/listeners.yaml @@ -0,0 +1,18 @@ +{{- if hasKey .Values.gateway "listeners" }} +{{- range .Values.gateway.listeners }} +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: TCPRoute +metadata: + name: {{ .name }} + namespace: {{ $.Values.namespace }} +spec: + parentRefs: + - name: {{ $.Values.gateway.name }} + sectionName: {{ .name }} + rules: + - backendRefs: + - name: {{ .service }} + port: {{ .port }} +{{- end }} +{{- end }} diff --git a/k8s/install/local-storage.yaml b/k8s/helm/infra/templates/local-storage.yaml similarity index 82% rename from k8s/install/local-storage.yaml rename to k8s/helm/infra/templates/local-storage.yaml index b2050966..c239d2ac 100644 --- a/k8s/install/local-storage.yaml +++ b/k8s/helm/infra/templates/local-storage.yaml @@ -5,6 +5,8 @@ metadata: annotations: storageclass.kubernetes.io/is-default-class: "true" name: local-storage + labels: + {{- include "local.labels" . | nindent 4 }} allowVolumeExpansion: false provisioner: kubernetes.io/no-provisioner volumeBindingMode: WaitForFirstConsumer diff --git a/k8s/install/prometheus-rbac.yaml b/k8s/helm/infra/templates/prometheus-rbac.yaml similarity index 62% rename from k8s/install/prometheus-rbac.yaml rename to k8s/helm/infra/templates/prometheus-rbac.yaml index c02e37fc..6844d14f 100644 --- a/k8s/install/prometheus-rbac.yaml +++ b/k8s/helm/infra/templates/prometheus-rbac.yaml @@ -2,20 +2,24 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: $K8S_NAMESPACE:prometheus-scraper-binding + name: {{ .Values.namespace }}:prometheus-scraper-binding + labels: + {{- include "local.labels" . | nindent 4 }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: $K8S_NAMESPACE:prometheus-scraper + name: {{ .Values.namespace }}:prometheus-scraper subjects: - kind: ServiceAccount name: grafana-prometheus - namespace: $K8S_NAMESPACE + namespace: {{ .Values.namespace }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: $K8S_NAMESPACE:prometheus-scraper + name: {{ .Values.namespace }}:prometheus-scraper + labels: + {{- include "local.labels" . | nindent 4 }} rules: - apiGroups: [""] resources: diff --git a/k8s/install/rsyslog-ext.yaml b/k8s/helm/infra/templates/rsyslog-ext.yaml similarity index 52% rename from k8s/install/rsyslog-ext.yaml rename to k8s/helm/infra/templates/rsyslog-ext.yaml index 501c01eb..3988c9ac 100644 --- a/k8s/install/rsyslog-ext.yaml +++ b/k8s/helm/infra/templates/rsyslog-ext.yaml @@ -4,11 +4,13 @@ apiVersion: v1 kind: Service metadata: name: rsyslogd-external - namespace: $K8S_NAMESPACE + namespace: {{ .Values.namespace }} + labels: + {{- include "local.labels" . | nindent 4 }} spec: type: NodePort ports: - - { port: 514, nodePort: $NODEPORT_SYSLOG, targetPort: 514, name: rsyslogd } + - { port: 514, nodePort: {{ .Values.rsyslogExt.nodePort }}, targetPort: 514, name: rsyslogd } selector: app.kubernetes.io/name: rsyslogd sessionAffinity: ClientIP diff --git a/k8s/helm/infra/templates/tests/test-connection.yaml b/k8s/helm/infra/templates/tests/test-connection.yaml new file mode 100644 index 00000000..ae159a4f --- /dev/null +++ b/k8s/helm/infra/templates/tests/test-connection.yaml @@ -0,0 +1,17 @@ +{{- if hasKey .Values "service" }} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "local.fullname" . }}-test-connection" + labels: + {{- include "local.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['{{ include "local.fullname" . }}:{{ .Values.service.port }}'] + restartPolicy: Never +{{- end }} diff --git a/k8s/helm/infra/values.yaml b/k8s/helm/infra/values.yaml new file mode 100644 index 00000000..786b06b2 --- /dev/null +++ b/k8s/helm/infra/values.yaml @@ -0,0 +1,52 @@ +# Default values for infra. +namespace: default +certManager: + email: admin@example.com + issuer: + prod: letsencrypt-prod + staging: letsencrypt-staging + internalCA: + rootCert: + duration: 43800h + renewBefore: 2160h + commonName: Internal Root + subject: + countries: [ US ] + localities: [ San Francisco ] + organizations: [ Example Inc ] + organizationalUnits: [ ] + provinces: [ California ] + solvers: + - solver: http01 + enabled: true +gateway: + config: envoy-config + name: gateway-1 + crdNamespace: envoy-gateway-system + listeners: [] +k8sBackup: + destPath: /var/backup/k8s + etcdVersion: 3.5.15-0 + # 4:10am PST is 12:10pm UTC - k8s cron only supports UTC + schedule: "10 12 * * *" +limits: + cpu: + default: 500m + request: 50m + mem: + default: 256Mi + request: 64Mi +rsyslogExt: + nodePort: 30514 +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + enabled: true + name: example-privileged +service: + clusterIP: 10.101.1.19 + ports: [ port: 2379 ] + type: ClusterIP +autoscaling: + enabled: false diff --git a/k8s/helm/jira/Chart.yaml b/k8s/helm/jira/Chart.yaml index 0a81d2fd..89490a72 100644 --- a/k8s/helm/jira/Chart.yaml +++ b/k8s/helm/jira/Chart.yaml @@ -6,12 +6,12 @@ sources: - https://github.com/instantlinux/docker-tools - https://hub.docker.com/r/atlassian/jira-core type: application -version: 0.1.6 +version: 0.1.7 appVersion: "9.12.1" dependencies: - name: chartlib - version: 0.1.8 - repository: https://instantlinux.github.io/docker-tools + version: 0.1.10 + repository: oci://registry-1.docker.io/instantlinux - name: mariadb version: 0.1.0 repository: file://subcharts/mariadb diff --git a/k8s/helm/jira/templates/app.yaml b/k8s/helm/jira/templates/app.yaml index 5a01911b..a32c0217 100644 --- a/k8s/helm/jira/templates/app.yaml +++ b/k8s/helm/jira/templates/app.yaml @@ -8,6 +8,8 @@ --- {{- include "chartlib.ingresstotp" . }} --- +{{- include "chartlib.listener" . }} +--- {{- include "chartlib.service" . }} --- {{- include "chartlib.serviceaccount" . }} diff --git a/k8s/helm/jira/values.yaml b/k8s/helm/jira/values.yaml index 8b000d26..cc34a42d 100644 --- a/k8s/helm/jira/values.yaml +++ b/k8s/helm/jira/values.yaml @@ -75,13 +75,9 @@ authelia: fqdn: authtotp.example.com ip: 10.101.1.5 path: /login.jsp -ingress: - annotations: - cert-manager.io/cluster-issuer: letsencrypt-prod - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/enable-access-log: "false" -ingressTOTP: +gateway: enabled: true + totp: false mariadb: enabled: false diff --git a/k8s/helm/nexus/Chart.yaml b/k8s/helm/nexus/Chart.yaml index 452ed805..065cab43 100644 --- a/k8s/helm/nexus/Chart.yaml +++ b/k8s/helm/nexus/Chart.yaml @@ -5,12 +5,12 @@ home: https://github.com/instantlinux/docker-tools sources: - https://github.com/instantlinux/docker-tools type: application -version: 0.1.14 -appVersion: "3.93.2" +version: 0.1.16 +appVersion: "3.96.1" dependencies: - name: chartlib - version: 0.1.8 - repository: https://instantlinux.github.io/docker-tools + version: 0.1.10 + repository: oci://registry-1.docker.io/instantlinux - name: postgres version: 0.1.0 repository: file://subcharts/postgres diff --git a/k8s/helm/nexus/templates/app.yaml b/k8s/helm/nexus/templates/app.yaml index b925dd1f..a32c0217 100644 --- a/k8s/helm/nexus/templates/app.yaml +++ b/k8s/helm/nexus/templates/app.yaml @@ -8,6 +8,10 @@ --- {{- include "chartlib.ingresstotp" . }} --- +{{- include "chartlib.listener" . }} +--- {{- include "chartlib.service" . }} --- {{- include "chartlib.serviceaccount" . }} +--- +{{- include "chartlib.statefulset" . }} diff --git a/k8s/helm/nexus/values.yaml b/k8s/helm/nexus/values.yaml index 21cef42d..4516bc3e 100644 --- a/k8s/helm/nexus/values.yaml +++ b/k8s/helm/nexus/values.yaml @@ -2,6 +2,7 @@ autheliaIP: 10.0.10.10 domain: example.com +tlsHostname: nexus.example.com deployment: # Notes: # port 1234 provides an h2 console, if configured @@ -63,8 +64,31 @@ service: - { port: 80, targetPort: 8081, name: nexus } - { port: 5001, targetPort: 5000, name: registry } -ingress: +gateway: enabled: true + routeRules: + - backendRefs: + - group: "" + kind: Service + name: nexus + port: 80 + weight: 1 + matches: + - path: + type: PathPrefix + value: / + - backendRefs: + - group: "" + kind: Service + name: nexus + port: 5001 + weight: 1 + matches: + - path: + type: PathPrefix + value: /v2/ +ingress: + enabled: false className: "" annotations: kubernetes.io/ingress.class: nginx diff --git a/k8s/helm/splunk/Chart.yaml b/k8s/helm/splunk/Chart.yaml index 83e8d5e9..e8b2ed8f 100644 --- a/k8s/helm/splunk/Chart.yaml +++ b/k8s/helm/splunk/Chart.yaml @@ -15,9 +15,9 @@ sources: - https://github.com/instantlinux/docker-tools - https://hub.docker.com/r/splunk/splunk type: application -version: 0.1.18 +version: 0.1.19 appVersion: "10.4.1" dependencies: - name: chartlib - version: 0.1.8 - repository: https://instantlinux.github.io/docker-tools + version: 0.1.10 + repository: oci://registry-1.docker.io/instantlinux diff --git a/k8s/helm/splunk/templates/app.yaml b/k8s/helm/splunk/templates/app.yaml index aeeec90a..a32c0217 100644 --- a/k8s/helm/splunk/templates/app.yaml +++ b/k8s/helm/splunk/templates/app.yaml @@ -1,3 +1,5 @@ +{{- include "chartlib.configmap" . }} +--- {{- include "chartlib.deployment" . }} --- {{- include "chartlib.hpa" . }} @@ -6,6 +8,8 @@ --- {{- include "chartlib.ingresstotp" . }} --- +{{- include "chartlib.listener" . }} +--- {{- include "chartlib.service" . }} --- {{- include "chartlib.serviceaccount" . }} diff --git a/k8s/helm/splunk/templates/security.yaml b/k8s/helm/splunk/templates/security.yaml new file mode 100644 index 00000000..3aa3cd52 --- /dev/null +++ b/k8s/helm/splunk/templates/security.yaml @@ -0,0 +1,17 @@ +{{- $fullName := include "local.fullname" . -}} +--- +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: SecurityPolicy +metadata: + name: {{ $fullName }} + labels: + {{- include "local.labels" . | nindent 4 }} +spec: + targetRefs: + - group: gateway.networking.k8s.io + kind: HTTPRoute + name: {{ $fullName }} + basicAuth: + users: + name: splunk-auth + diff --git a/k8s/helm/splunk/values.yaml b/k8s/helm/splunk/values.yaml index 9fb56fc8..4d60ec14 100644 --- a/k8s/helm/splunk/values.yaml +++ b/k8s/helm/splunk/values.yaml @@ -79,11 +79,21 @@ authelia: fqdn: authtotp.example.com ip: 10.101.1.5 path: /en-US/account/login -ingress: - annotations: - cert-manager.io/cluster-issuer: letsencrypt-prod - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/auth-type: basic - nginx.ingress.kubernetes.io/auth-secret: splunk-auth -ingressTOTP: +gateway: enabled: true + totp: false + routeRules: + - backendRefs: + - group: "" + kind: Service + name: splunk + port: 80 + weight: 1 + matches: + - path: + type: PathPrefix + value: / + sessionPersistence: + absoluteTimeout: 30m + type: Header + sessionName: Authorization diff --git a/k8s/install/cert-manager.yaml b/k8s/install/cert-manager.yaml deleted file mode 100644 index 255d3805..00000000 --- a/k8s/install/cert-manager.yaml +++ /dev/null @@ -1,30 +0,0 @@ ---- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-staging -spec: - acme: - server: https://acme-staging-v02.api.letsencrypt.org/directory - email: $CERT_MGR_EMAIL - privateKeySecretRef: - name: letsencrypt-staging - solvers: - - http01: - ingress: - class: nginx ---- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-prod -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - email: $CERT_MGR_EMAIL - privateKeySecretRef: - name: letsencrypt-prod - solvers: - - http01: - ingress: - class: nginx diff --git a/k8s/install/limits.yaml b/k8s/install/limits.yaml deleted file mode 100644 index 89e6d21f..00000000 --- a/k8s/install/limits.yaml +++ /dev/null @@ -1,26 +0,0 @@ ---- -apiVersion: v1 -kind: LimitRange -metadata: - name: mem-limit-range - namespace: $K8S_NAMESPACE -spec: - limits: - - default: - memory: $LIMIT_MEM_DEFAULT - defaultRequest: - memory: $LIMIT_MEM_REQUEST - type: Container ---- -apiVersion: v1 -kind: LimitRange -metadata: - name: cpu-limit-range - namespace: $K8S_NAMESPACE -spec: - limits: - - default: - cpu: $LIMIT_CPU_DEFAULT - defaultRequest: - cpu: $LIMIT_CPU_REQUEST - type: Container diff --git a/k8s/install/namespace-user.yaml b/k8s/install/namespace-user.yaml index 30eb96ed..c966334f 100644 --- a/k8s/install/namespace-user.yaml +++ b/k8s/install/namespace-user.yaml @@ -58,11 +58,32 @@ rules: - apiGroups: [cert-manager.io] resources: - certificates + - certificaterequests + verbs: [get, list] +- apiGroups: [acme.cert-manager.io] + resources: + - challenges + - orders verbs: [get, list] - apiGroups: [networking.k8s.io] resources: - ingresses verbs: ["*"] +- apiGroups: [gateway.envoyproxy.io] + resources: + - securitypolicies + verbs: ["*"] +- apiGroups: [gateway.networking.k8s.io] + resources: + - gateways + - httproutes + - listenersets + - tcproutes + verbs: ["*"] +- apiGroups: [gateway.networking.k8s.io] + resources: + - gatewayclasses + verbs: [get, list, watch] - apiGroups: [rbac.authorization.k8s.io] resources: - rolebindings From 6516523a72b05c191b8924a838110069c733f833 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Fri, 18 Sep 2026 13:25:03 -0700 Subject: [PATCH 02/23] SYS-673 envoy gateway wip --- k8s/helm/infra/templates/cert-manager.yaml | 69 +--------------------- k8s/helm/infra/templates/gateway.yaml | 5 +- k8s/helm/infra/values.yaml | 3 +- 3 files changed, 7 insertions(+), 70 deletions(-) diff --git a/k8s/helm/infra/templates/cert-manager.yaml b/k8s/helm/infra/templates/cert-manager.yaml index 0e910866..3ef84c83 100644 --- a/k8s/helm/infra/templates/cert-manager.yaml +++ b/k8s/helm/infra/templates/cert-manager.yaml @@ -1,4 +1,4 @@ -{{- if hasKey .Values "staging" }} +{{- if hasKey .Values.certManager.issuer "staging" }} --- apiVersion: cert-manager.io/v1 kind: ClusterIssuer @@ -15,36 +15,7 @@ spec: solvers: {{- range .Values.certManager.solvers }} {{- if hasKey . "enabled" | ternary .enabled true }} - {{- if eq .solver "dns01" }} - - selector: - dnsZones: {{ .dnsZones }} - dns01: - {{- if hasKey . "webhook" | ternary .webhook true }} - webhook: - groupName: {{ .groupName }} - solverName: lexicon -# TODO resync with prod - config: - provider: {{ .provider }} - userPassword: false - # authUsernameSecretRef: - usernameRef: - name: {{ .apiKey }} - key: user - passwordRef: - name: {{ .apiKey }} - key: user - apiKeyRef: - name: {{ .apiKey }} - key: key - {{- else }} - {{ .provider }}: - email: {{ .email }} - apiKeySecretRef: - name: {{ .apiKey }} - key: api-key - {{- end }} - {{- else if eq .solver "http01" }} + {{- if eq .solver "http01" }} - http01: ingress: class: nginx @@ -68,41 +39,7 @@ spec: solvers: {{- range .Values.certManager.solvers }} {{- if hasKey . "enabled" | ternary .enabled true }} - {{- if eq .solver "dns01" }} - - selector: - dnsZones: {{ .dnsZones }} - dns01: - {{- if hasKey . "webhook" | ternary .webhook true }} - webhook: - groupName: {{ .groupName }} - solverName: lexicon - config: - provider: {{ .provider }} - usePassword: true - # authUsernameSecretRef: - # apiSecretRef: - # name: {{ .apiKey }} - # key: user - # passwordRef: - # name: {{ .apiKey }} - # key: user - # apiKeyRef: - # name: {{ .apiKey }} - # key: key - usernameRef: - name: {{ .apiKey }} - key: auth_username - apiKeyRef: - name: {{ .apiKey }} - key: auth_usertoken - {{- else }} - {{ .provider }}: - email: {{ .email }} - apiKeySecretRef: - name: {{ .apiKey }} - key: api-key - {{- end }} - {{- else if eq .solver "http01" }} + {{- if eq .solver "http01" }} - http01: ingress: class: nginx diff --git a/k8s/helm/infra/templates/gateway.yaml b/k8s/helm/infra/templates/gateway.yaml index 98ea98f1..3ff3f699 100644 --- a/k8s/helm/infra/templates/gateway.yaml +++ b/k8s/helm/infra/templates/gateway.yaml @@ -56,9 +56,8 @@ spec: matchLabels: kubernetes.io/metadata.name: {{ .Values.namespace }} listeners: - listeners: - # Custom port mappings for local services - dovecot, git, postfix - # Other services are defined as ListenerSets in their helm charts + # at least one dummy listener is needed; here we also add support for + # TCP listeners; all http listeners are defined with ListenerSets {{- if hasKey .Values.gateway "listeners" }} {{- range .Values.gateway.listeners }} - name: {{ .name }} diff --git a/k8s/helm/infra/values.yaml b/k8s/helm/infra/values.yaml index 786b06b2..d6a34463 100644 --- a/k8s/helm/infra/values.yaml +++ b/k8s/helm/infra/values.yaml @@ -4,7 +4,8 @@ certManager: email: admin@example.com issuer: prod: letsencrypt-prod - staging: letsencrypt-staging + # Add this override for testing + # staging: letsencrypt-staging internalCA: rootCert: duration: 43800h From 00b7f36e967f6537d097324af5eea9d1b0b18944 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Fri, 18 Sep 2026 14:12:53 -0700 Subject: [PATCH 03/23] SYS-673 envoy gateway wip --- .github/workflows/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index f87b3a08..44a2910b 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -3,8 +3,8 @@ name: Publish Helm Charts on: push: branches: [main, SYS-673_envoy_gateway] - paths: - - k8s/helm/**/Chart.yaml + paths: + - k8s/helm/**/Chart.yaml env: REGISTRY: ghcr.io From 275eac8d8c02c3776cd6dc799a82819fd169a612 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 14:27:41 -0700 Subject: [PATCH 04/23] SYS-673 envoy gateway wip --- .github/workflows/release.yaml | 8 ++++---- images/squirrelmail/helm/Chart.yaml | 1 + 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 44a2910b..a437d85d 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,15 +1,15 @@ name: Publish Helm Charts +env: + REGISTRY: ghcr.io + CHART_DIR: k8s/helm + on: push: branches: [main, SYS-673_envoy_gateway] paths: - k8s/helm/**/Chart.yaml -env: - REGISTRY: ghcr.io - CHART_DIR: k8s/helm - jobs: find-charts: runs-on: ubuntu-latest diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 72fef932..10a609f1 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,3 +11,4 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux + From 2294f028a8be532d4e9c08cd9c215288a24878d5 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 14:51:52 -0700 Subject: [PATCH 05/23] SYS-673 envoy gateway wip --- .github/workflows/release.yaml | 4 ++-- images/squirrelmail/helm/Chart.yaml | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index a437d85d..03a1d100 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -7,8 +7,8 @@ env: on: push: branches: [main, SYS-673_envoy_gateway] - paths: - - k8s/helm/**/Chart.yaml +# paths: +# - k8s/helm/**/Chart.yaml jobs: find-charts: diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 10a609f1..72fef932 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,4 +11,3 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux - From 1bc79759c8af09647b2f08b4979d5447ad3e0078 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 15:02:33 -0700 Subject: [PATCH 06/23] SYS-673 envoy gateway wip --- .github/workflows/release.yaml | 7 ++++--- images/squirrelmail/helm/Chart.yaml | 1 + 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 03a1d100..135b458e 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -7,8 +7,9 @@ env: on: push: branches: [main, SYS-673_envoy_gateway] -# paths: -# - k8s/helm/**/Chart.yaml + paths: + - k8s/helm/**/Chart.yaml + - images/**/helm/Chart.yaml jobs: find-charts: @@ -25,7 +26,7 @@ jobs: id: set-matrix run: | CHANGED=$(git diff --name-only HEAD^ HEAD | \ - grep "^${CHART_DIR}/.*/Chart.yaml" | \ + egrep "^(${CHART_DIR}/.*|images/.*/helm)/Chart.yaml" | \ awk '{sub(/\/[^/]+$/, ""); print}' | paste -sd , ) echo "matrix={\"chart\":[$CHANGED]}" >> $GITHUB_OUTPUT diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 72fef932..10a609f1 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,3 +11,4 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux + From 508e2c93f0143441a453e1c279d5a84045bd35d4 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 15:05:53 -0700 Subject: [PATCH 07/23] SYS-673 envoy gateway wip --- .github/workflows/release.yaml | 2 +- images/squirrelmail/helm/Chart.yaml | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 135b458e..52eb3abf 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -28,7 +28,7 @@ jobs: CHANGED=$(git diff --name-only HEAD^ HEAD | \ egrep "^(${CHART_DIR}/.*|images/.*/helm)/Chart.yaml" | \ awk '{sub(/\/[^/]+$/, ""); print}' | paste -sd , ) - echo "matrix={\"chart\":[$CHANGED]}" >> $GITHUB_OUTPUT + echo "matrix={\"chart\":[\"$CHANGED"\]}" >> $GITHUB_OUTPUT publish: needs: find-charts diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 10a609f1..72fef932 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,4 +11,3 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux - From 5b6a8b03d76262bb3242c0d357c6c402af609111 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 15:06:42 -0700 Subject: [PATCH 08/23] SYS-673 envoy gateway wip --- .github/workflows/release.yaml | 2 +- images/squirrelmail/helm/Chart.yaml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 52eb3abf..efde415f 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -28,7 +28,7 @@ jobs: CHANGED=$(git diff --name-only HEAD^ HEAD | \ egrep "^(${CHART_DIR}/.*|images/.*/helm)/Chart.yaml" | \ awk '{sub(/\/[^/]+$/, ""); print}' | paste -sd , ) - echo "matrix={\"chart\":[\"$CHANGED"\]}" >> $GITHUB_OUTPUT + echo "matrix={\"chart\":[\"$CHANGED\"]}" >> $GITHUB_OUTPUT publish: needs: find-charts diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 72fef932..10a609f1 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,3 +11,4 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux + From 02ceb14c6d6251c237ae88f1ff2ede70c4dae3f7 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 15:16:29 -0700 Subject: [PATCH 09/23] SYS-673 envoy gateway wip --- .github/workflows/release.yaml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index efde415f..a2951f21 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -26,19 +26,21 @@ jobs: id: set-matrix run: | CHANGED=$(git diff --name-only HEAD^ HEAD | \ - egrep "^(${CHART_DIR}/.*|images/.*/helm)/Chart.yaml" | \ - awk '{sub(/\/[^/]+$/, ""); print}' | paste -sd , ) - echo "matrix={\"chart\":[\"$CHANGED\"]}" >> $GITHUB_OUTPUT + grep -E "^(${CHART_DIR}/.*|images/.*/helm)/Chart.yaml" | \ + awk '{sub(/\/[^/]+$/, ""); print}' | \ + jq -R . | jq -s -c .) + echo "matrix={\"chart\":$CHANGED}" >> $GITHUB_OUTPUT publish: needs: find-charts - if: ${{ needs.find-charts.outputs.matrix != '{"chart":[]}' }} + if: ${{ needs.find-charts.outputs.matrix != '{"chart":[]}' && \ + needs.find-charts.outputs.matrix != '' }} runs-on: ubuntu-latest permissions: contents: read packages: write strategy: - matrix: ${{ fromJson(needs.detect-changes.outputs.matrix) }} + matrix: ${{ fromJson(needs.find-charts.outputs.matrix) }} steps: - name: Checkout uses: actions/checkout@v4 From b6d2d41f4160182063769aee2cf9c0edbefeabaf Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 15:17:14 -0700 Subject: [PATCH 10/23] SYS-673 envoy gateway wip --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index a2951f21..461f52d9 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -33,7 +33,7 @@ jobs: publish: needs: find-charts - if: ${{ needs.find-charts.outputs.matrix != '{"chart":[]}' && \ + if: ${{ needs.find-charts.outputs.matrix != '{"chart":[]}' && needs.find-charts.outputs.matrix != '' }} runs-on: ubuntu-latest permissions: From 40fadc971f212ba7be1366c4a5e82eeaf8182e4f Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 15:17:26 -0700 Subject: [PATCH 11/23] SYS-673 envoy gateway wip --- images/squirrelmail/helm/Chart.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 10a609f1..72fef932 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,4 +11,3 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux - From df5658c4a922961f2e4d96533d79d7645453cc13 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 15:20:35 -0700 Subject: [PATCH 12/23] SYS-673 envoy gateway wip --- .github/workflows/release.yaml | 1 + images/squirrelmail/helm/Chart.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 461f52d9..de7c264e 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -64,5 +64,6 @@ jobs: - name: Package and Push run: | + helm dependency update "${{ matrix.chart }}" helm package "${{ matrix.chart }}" helm push "$(echo *.tgz)" oci://ghcr.io/${{ github.repository_owner }}/helm-charts diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 72fef932..10a609f1 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,3 +11,4 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux + From 321bb6f34ce9ebe97e8bf33d22562fe8e1ba447b Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 21:45:01 -0700 Subject: [PATCH 13/23] SYS-673 wip --- .github/workflows/release.yaml | 25 +++++++++++++++---------- images/squirrelmail/helm/Chart.yaml | 1 - 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index de7c264e..12c8c24a 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,12 +1,14 @@ name: Publish Helm Charts env: - REGISTRY: ghcr.io + DOCKER_REGISTRY: registry-1.docker.io + DOCKER_USER: instantlinux + GITHUB_REGISTRY: ghcr.io CHART_DIR: k8s/helm on: push: - branches: [main, SYS-673_envoy_gateway] + branches: [main] paths: - k8s/helm/**/Chart.yaml - images/**/helm/Chart.yaml @@ -47,23 +49,26 @@ jobs: with: fetch-depth: 0 - # - name: Configure Git - # run: | - # git config user.name "$GITHUB_ACTOR" - # git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - - name: Install Helm uses: azure/setup-helm@v4 - - name: Log in to OCI Registry + - name: Log in to github OCI Registry uses: docker/login-action@v3 with: - registry: ${{ env.REGISTRY }} + registry: ${{ env.GITHUB_REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} + - name: Log in to docker hub OCI Registry + uses: docker/login-action@v3 + with: + registry: ${{ env.DOCKER_REGISTRY }} + username: ${{ env.DOCKER_USER }} + password: ${{ secrets.DOCKER_TOKEN }} + - name: Package and Push run: | helm dependency update "${{ matrix.chart }}" helm package "${{ matrix.chart }}" - helm push "$(echo *.tgz)" oci://ghcr.io/${{ github.repository_owner }}/helm-charts + helm push "$(echo *.tgz)" oci://${{ env.GITHUB_REGISTRY }}/${{ github.repository_owner }}/charts + helm push "$(echo *.tgz)" oci://${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_USER }} diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 10a609f1..72fef932 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,4 +11,3 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux - From 683224c9001274c3387543fb4c66dcb957eac5f9 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 21:47:00 -0700 Subject: [PATCH 14/23] SYS-673 wip --- .github/workflows/release.yaml | 2 +- images/squirrelmail/helm/Chart.yaml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 12c8c24a..9a38f30a 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -8,7 +8,7 @@ env: on: push: - branches: [main] + branches: [main, SYS-673_envoy_gateway] paths: - k8s/helm/**/Chart.yaml - images/**/helm/Chart.yaml diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 72fef932..10a609f1 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,3 +11,4 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux + From 4331cb3cbc39208b29cc081869654ad36b2d846a Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 21:48:33 -0700 Subject: [PATCH 15/23] SYS-673 wip --- .github/workflows/release.yaml | 2 +- images/squirrelmail/helm/Chart.yaml | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 9a38f30a..e573849a 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -70,5 +70,5 @@ jobs: run: | helm dependency update "${{ matrix.chart }}" helm package "${{ matrix.chart }}" - helm push "$(echo *.tgz)" oci://${{ env.GITHUB_REGISTRY }}/${{ github.repository_owner }}/charts helm push "$(echo *.tgz)" oci://${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_USER }} + helm push "$(echo *.tgz)" oci://${{ env.GITHUB_REGISTRY }}/${{ github.repository_owner }}/charts diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 10a609f1..72fef932 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,4 +11,3 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux - From c5d5134abd3729935d866c666a6084382c656958 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 22:35:50 -0700 Subject: [PATCH 16/23] SYS-673 wip --- .github/workflows/release.yaml | 3 ++- images/squirrelmail/helm/Chart.yaml | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index e573849a..cbb48138 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -70,5 +70,6 @@ jobs: run: | helm dependency update "${{ matrix.chart }}" helm package "${{ matrix.chart }}" - helm push "$(echo *.tgz)" oci://${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_USER }} + NAME=$(grep ^name: ${{ matrix.chart }}/Chart.yaml | cut -d ' ' -f 2 + helm push "$(echo *.tgz)" oci://${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_USER }}/$NAME helm push "$(echo *.tgz)" oci://${{ env.GITHUB_REGISTRY }}/${{ github.repository_owner }}/charts diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 72fef932..10a609f1 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,3 +11,4 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux + From 7101e73d9140c1ed30148087fe93892b5d80d3c5 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 22:38:00 -0700 Subject: [PATCH 17/23] SYS-673 wip --- .github/workflows/release.yaml | 2 +- images/squirrelmail/helm/Chart.yaml | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index cbb48138..341ed140 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -70,6 +70,6 @@ jobs: run: | helm dependency update "${{ matrix.chart }}" helm package "${{ matrix.chart }}" - NAME=$(grep ^name: ${{ matrix.chart }}/Chart.yaml | cut -d ' ' -f 2 + NAME=$(grep ^name: ${{ matrix.chart }}/Chart.yaml | cut -d ' ' -f 2) helm push "$(echo *.tgz)" oci://${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_USER }}/$NAME helm push "$(echo *.tgz)" oci://${{ env.GITHUB_REGISTRY }}/${{ github.repository_owner }}/charts diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 10a609f1..72fef932 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,4 +11,3 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux - From 9f7f58588ac3108582dc444aaf243022720898c1 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 22:45:18 -0700 Subject: [PATCH 18/23] SYS-673 wip --- .github/workflows/release.yaml | 3 +-- images/squirrelmail/helm/Chart.yaml | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 341ed140..e573849a 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -70,6 +70,5 @@ jobs: run: | helm dependency update "${{ matrix.chart }}" helm package "${{ matrix.chart }}" - NAME=$(grep ^name: ${{ matrix.chart }}/Chart.yaml | cut -d ' ' -f 2) - helm push "$(echo *.tgz)" oci://${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_USER }}/$NAME + helm push "$(echo *.tgz)" oci://${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_USER }} helm push "$(echo *.tgz)" oci://${{ env.GITHUB_REGISTRY }}/${{ github.repository_owner }}/charts diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 72fef932..10a609f1 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,3 +11,4 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux + From 948d1d14dc5ee16b1bced31f2c5ab8f0e324153d Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 22:50:08 -0700 Subject: [PATCH 19/23] SYS-673 wip --- images/data-sync/helm/Chart.yaml | 1 + images/squirrelmail/helm/Chart.yaml | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/images/data-sync/helm/Chart.yaml b/images/data-sync/helm/Chart.yaml index 1cface8f..e84e85df 100644 --- a/images/data-sync/helm/Chart.yaml +++ b/images/data-sync/helm/Chart.yaml @@ -11,3 +11,4 @@ dependencies: - name: chartlib version: 0.1.8 repository: https://instantlinux.github.io/docker-tools + diff --git a/images/squirrelmail/helm/Chart.yaml b/images/squirrelmail/helm/Chart.yaml index 10a609f1..72fef932 100644 --- a/images/squirrelmail/helm/Chart.yaml +++ b/images/squirrelmail/helm/Chart.yaml @@ -11,4 +11,3 @@ dependencies: - name: chartlib version: 0.1.10 repository: oci://registry-1.docker.io/instantlinux - From 940345506dc7e5461023c02abaeaa2bfb5db65bb Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 23:05:11 -0700 Subject: [PATCH 20/23] SYS-673 wip --- .github/workflows/release.yaml | 29 +++++++++++++++++++---------- images/data-sync/helm/Chart.yaml | 1 - 2 files changed, 19 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index e573849a..6046b3e8 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -42,6 +42,7 @@ jobs: contents: read packages: write strategy: + fail-fast: false matrix: ${{ fromJson(needs.find-charts.outputs.matrix) }} steps: - name: Checkout @@ -53,18 +54,26 @@ jobs: uses: azure/setup-helm@v4 - name: Log in to github OCI Registry - uses: docker/login-action@v3 - with: - registry: ${{ env.GITHUB_REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + run: | + echo "${{ secrets.GITHUB_TOKEN }}" | \ + helm registry login ${{ env.GITHUB_REGISTRY }} \ + --username ${{ github.actor }} --password-stdin + # uses: docker/login-action@v3 + # with: + # registry: ${{ env.GITHUB_REGISTRY }} + # username: ${{ github.actor }} + # password: ${{ secrets.GITHUB_TOKEN }} - name: Log in to docker hub OCI Registry - uses: docker/login-action@v3 - with: - registry: ${{ env.DOCKER_REGISTRY }} - username: ${{ env.DOCKER_USER }} - password: ${{ secrets.DOCKER_TOKEN }} + run: | + echo "${{ secrets.DOCKER_TOKEN }}" | \ + helm registry login ${{ env.DOCKER_REGISTRY }} \ + --username ${{ env.DOCKER_USER }} --password-stdin + # uses: docker/login-action@v3 + # with: + # registry: ${{ env.DOCKER_REGISTRY }} + # username: ${{ env.DOCKER_USER }} + # password: ${{ secrets.DOCKER_TOKEN }} - name: Package and Push run: | diff --git a/images/data-sync/helm/Chart.yaml b/images/data-sync/helm/Chart.yaml index e84e85df..1cface8f 100644 --- a/images/data-sync/helm/Chart.yaml +++ b/images/data-sync/helm/Chart.yaml @@ -11,4 +11,3 @@ dependencies: - name: chartlib version: 0.1.8 repository: https://instantlinux.github.io/docker-tools - From fe5da41e17a804924b6dd29450db670b71c109e5 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 23:08:47 -0700 Subject: [PATCH 21/23] SYS-673 wip --- images/data-sync/helm/Chart.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/images/data-sync/helm/Chart.yaml b/images/data-sync/helm/Chart.yaml index 1cface8f..e84e85df 100644 --- a/images/data-sync/helm/Chart.yaml +++ b/images/data-sync/helm/Chart.yaml @@ -11,3 +11,4 @@ dependencies: - name: chartlib version: 0.1.8 repository: https://instantlinux.github.io/docker-tools + From af192408529f731ce50f85ee9e6072ad410ec04e Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 23:11:20 -0700 Subject: [PATCH 22/23] SYS-673 wip --- .github/workflows/release.yaml | 8 ++------ images/data-sync/helm/Chart.yaml | 1 - 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6046b3e8..bdf0b44b 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -55,9 +55,7 @@ jobs: - name: Log in to github OCI Registry run: | - echo "${{ secrets.GITHUB_TOKEN }}" | \ - helm registry login ${{ env.GITHUB_REGISTRY }} \ - --username ${{ github.actor }} --password-stdin + echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ${{ env.GITHUB_REGISTRY }} --username ${{ github.actor }} --password-stdin # uses: docker/login-action@v3 # with: # registry: ${{ env.GITHUB_REGISTRY }} @@ -66,9 +64,7 @@ jobs: - name: Log in to docker hub OCI Registry run: | - echo "${{ secrets.DOCKER_TOKEN }}" | \ - helm registry login ${{ env.DOCKER_REGISTRY }} \ - --username ${{ env.DOCKER_USER }} --password-stdin + echo "${{ secrets.DOCKER_TOKEN }}" | helm registry login ${{ env.DOCKER_REGISTRY }} --username ${{ env.DOCKER_USER }} --password-stdin # uses: docker/login-action@v3 # with: # registry: ${{ env.DOCKER_REGISTRY }} diff --git a/images/data-sync/helm/Chart.yaml b/images/data-sync/helm/Chart.yaml index e84e85df..1cface8f 100644 --- a/images/data-sync/helm/Chart.yaml +++ b/images/data-sync/helm/Chart.yaml @@ -11,4 +11,3 @@ dependencies: - name: chartlib version: 0.1.8 repository: https://instantlinux.github.io/docker-tools - From 2aa7520168f9a8ebf880a5401264c7d443a3d486 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Sat, 19 Sep 2026 23:20:48 -0700 Subject: [PATCH 23/23] SYS-673 wip --- .github/workflows/release.yaml | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index bdf0b44b..57ccc3ef 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -8,7 +8,7 @@ env: on: push: - branches: [main, SYS-673_envoy_gateway] + branches: [main] paths: - k8s/helm/**/Chart.yaml - images/**/helm/Chart.yaml @@ -56,20 +56,10 @@ jobs: - name: Log in to github OCI Registry run: | echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ${{ env.GITHUB_REGISTRY }} --username ${{ github.actor }} --password-stdin - # uses: docker/login-action@v3 - # with: - # registry: ${{ env.GITHUB_REGISTRY }} - # username: ${{ github.actor }} - # password: ${{ secrets.GITHUB_TOKEN }} - name: Log in to docker hub OCI Registry run: | echo "${{ secrets.DOCKER_TOKEN }}" | helm registry login ${{ env.DOCKER_REGISTRY }} --username ${{ env.DOCKER_USER }} --password-stdin - # uses: docker/login-action@v3 - # with: - # registry: ${{ env.DOCKER_REGISTRY }} - # username: ${{ env.DOCKER_USER }} - # password: ${{ secrets.DOCKER_TOKEN }} - name: Package and Push run: |