feat: helm chart для fission-console (без хардкодов, параметризован)

2026-05-04 12:17:09 +04:00
parent e128bdc28f
commit 796a938aa3
8 changed files with 287 additions and 0 deletions
@@ -0,0 +1,14 @@
+apiVersion: v2
+name: fission-console
+description: Fission Console — web UI and API gateway for Fission serverless platform
+type: application
+version: 0.1.0
+appVersion: "v1.3.56"
+keywords:
+  - fission
+  - serverless
+  - kubernetes
+  - console
+home: https://gitea.services.ngcloud.ru/Nail/fission
+maintainers:
+  - name: naeel
@@ -0,0 +1,9 @@
+Fission Console успешно установлен!
+
+Адрес: https://{{ .Values.ingress.host }}
+
+Для проверки:
+  kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/name=fission-console
+
+Логи:
+  kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/name=fission-console
@@ -0,0 +1,25 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "fission-console.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "fission-console.labels" -}}
+helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+app.kubernetes.io/name: fission-console
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "fission-console.selectorLabels" -}}
+app.kubernetes.io/name: fission-console
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
@@ -0,0 +1,61 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fission-console
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fission-console.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "fission-console.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "fission-console.selectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: fission-console
+      containers:
+        - name: console
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: {{ .Values.service.port }}
+          env:
+            - name: FISSION_NAMESPACE
+              value: {{ .Values.fission.namespace | quote }}
+            - name: FISSION_ROUTER_URL
+              value: {{ .Values.fission.routerUrl | quote }}
+            - name: PORT
+              value: {{ .Values.service.port | quote }}
+            - name: FISSION_HTTP_TIMEOUT
+              value: {{ .Values.fission.httpTimeout | quote }}
+            - name: FISSION_INVOKE_TIMEOUT
+              value: {{ .Values.fission.invokeTimeout | quote }}
+            - name: FISSION_AUTH_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.auth.secretName }}
+                  key: {{ .Values.auth.usernameKey }}
+            - name: FISSION_AUTH_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.auth.secretName }}
+                  key: {{ .Values.auth.passwordKey }}
+            - name: FISSION_STORAGESVC_URL
+              value: {{ .Values.fission.storagesvcUrl | quote }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.probes.liveness.path }}
+              port: {{ .Values.service.port }}
+            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.probes.readiness.path }}
+              port: {{ .Values.service.port }}
+            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
+            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
@@ -0,0 +1,37 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: fission-console
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fission-console.labels" . | nindent 4 }}
+  annotations:
+    {{- range $key, $value := .Values.ingress.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+    {{- if .Values.ingress.tls.certManager.enabled }}
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.tls.certManager.clusterIssuer | quote }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className | quote }}
+  rules:
+    - host: {{ .Values.ingress.host | quote }}
+      http:
+        paths:
+          {{- range .Values.ingress.paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: fission-console
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host | quote }}
+      secretName: {{ .Values.ingress.tls.secretName | quote }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,41 @@
+{{- if .Values.rbac.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: fission-console
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fission-console.labels" . | nindent 4 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ .Release.Namespace }}-fission-console
+  labels:
+    {{- include "fission-console.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "update", "patch"]
+  - apiGroups: ["fission.io"]
+    resources: ["environments", "packages", "functions", "httptriggers", "timetriggers"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ .Release.Namespace }}-fission-console
+  labels:
+    {{- include "fission-console.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: fission-console
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ .Release.Namespace }}-fission-console
+  apiGroup: rbac.authorization.k8s.io
+{{- end }}
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: fission-console
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "fission-console.labels" . | nindent 4 }}
+spec:
+  selector:
+    {{- include "fission-console.selectorLabels" . | nindent 4 }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.port }}
+      protocol: TCP
@@ -0,0 +1,86 @@
+# ─────────────────────────────────────────────
+#  Fission Console — values.yaml
+#  Все секреты и домен задаются при установке:
+#  helm install ... --set ingress.host=... --set auth.username=... --set auth.password=...
+# ─────────────────────────────────────────────
+
+# Образ консоли
+image:
+  repository: naeel/fission-console
+  tag: "v1.3.56"
+  pullPolicy: Always
+
+# Количество реплик
+replicaCount: 1
+
+# Namespace, в котором работает Fission (не namespace самой консоли)
+fission:
+  namespace: "default"
+  routerUrl: "http://router.fission.svc.cluster.local"
+  storagesvcUrl: "http://storagesvc.fission.svc.cluster.local"
+  httpTimeout: "30s"
+  invokeTimeout: "60s"
+
+# Порт контейнера
+service:
+  port: 8090
+
+# Аутентификация (секрет router в кластере)
+# Значения передаются через --set или отдельный values-secrets.yaml (не коммитить!)
+auth:
+  # Имя Kubernetes Secret, из которого берутся username/password
+  secretName: "router"
+  usernameKey: "username"
+  passwordKey: "password"
+
+# Ingress
+ingress:
+  enabled: true
+  className: "nginx"
+  host: ""           # ОБЯЗАТЕЛЬНО указать: --set ingress.host=fission.mycompany.ru
+  tls:
+    enabled: true
+    certManager:
+      enabled: true
+      clusterIssuer: "letsencrypt-prod"
+    secretName: "fission-console-tls"  # имя TLS-секрета (cert-manager создаст сам)
+  annotations:
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+  # Пути, проксируемые через Ingress
+  # По умолчанию: /, /fn, /console, /cron, /default
+  # Переопределять не нужно в большинстве случаев
+  paths:
+    - path: /
+      pathType: Exact
+    - path: /fn
+      pathType: Prefix
+    - path: /console
+      pathType: Prefix
+    - path: /cron
+      pathType: Prefix
+    - path: /default
+      pathType: Prefix
+
+# Ресурсы контейнера
+resources:
+  requests:
+    cpu: 20m
+    memory: 32Mi
+  limits:
+    cpu: 200m
+    memory: 128Mi
+
+# Liveness/Readiness пробы
+probes:
+  liveness:
+    path: /health
+    initialDelaySeconds: 5
+    periodSeconds: 20
+  readiness:
+    path: /health
+    initialDelaySeconds: 3
+    periodSeconds: 10
+
+# RBAC
+rbac:
+  create: true