Переделка CI/CD
This commit is contained in:
@@ -1,53 +1,49 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: "{{ .Chart.Name }}"
|
||||
stand: "{{ .Values.stand }}"
|
||||
name: "{{ .Chart.Name }}"
|
||||
app: '{{ .Chart.Name }}'
|
||||
stand: '{{ .Values.stand }}'
|
||||
name: '{{ .Chart.Name }}'
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: "{{ .Chart.Name }}"
|
||||
stand: "{{ .Values.stand }}"
|
||||
app: '{{ .Chart.Name }}'
|
||||
stand: '{{ .Values.stand }}'
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: "{{ .Chart.Name }}"
|
||||
stand: "{{ .Values.stand }}"
|
||||
app: '{{ .Chart.Name }}'
|
||||
stand: '{{ .Values.stand }}'
|
||||
contragentCode: 'WZ01112'
|
||||
billingObject: 'None'
|
||||
spec:
|
||||
{{- if .Values.vault.enabled }}
|
||||
serviceAccountName: "{{ .Values.vault.serviceAccountName }}"
|
||||
{{- if .Values.vault.enable }}
|
||||
serviceAccountName: '{{ .Values.serviceAccountRole }}'
|
||||
{{- end }}
|
||||
containers:
|
||||
# Основное приложение
|
||||
- name: app
|
||||
image: "{{ .Values.mainContainer.image.repository }}:{{ .Values.mainContainer.image.tag }}"
|
||||
- image: '{{ .Values.deployment.image.repository }}:{{.Values.deployment.image.tag }}'
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: app
|
||||
ports:
|
||||
- containerPort: {{ .Values.mainContainer.containerPort }}
|
||||
protocol: TCP
|
||||
resources:
|
||||
{{- toYaml .Values.mainContainer.resources | nindent 12 }}
|
||||
- containerPort: {{ .Values.deployment.containerPort }}
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 2
|
||||
{{- toYaml .Values.mainContainer.readinessProbe | nindent 12 }}
|
||||
{{- toYaml (omit .Values.deployment.readinessProbe "httpGet") | nindent 12 }}
|
||||
httpGet:
|
||||
{{- toYaml .Values.deployment.readinessProbe.httpGet | nindent 14 }}
|
||||
port: {{ .Values.deployment.containerPort }}
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
{{- toYaml .Values.mainContainer.livenessProbe | nindent 12 }}
|
||||
{{- if .Values.vault.enabled }}
|
||||
{{- toYaml (omit .Values.deployment.livenessProbe "tcpSocket") | nindent 12 }}
|
||||
tcpSocket:
|
||||
port: {{ .Values.deployment.containerPort }}
|
||||
|
||||
resources:
|
||||
{{- toYaml .Values.deployment.resources | nindent 12 }}
|
||||
{{- if .Values.vault.enable }}
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: "{{ .Values.vault.target.name }}"
|
||||
- secretRef:
|
||||
name: '{{ .Chart.Name }}-secrets'
|
||||
{{- end }}
|
||||
|
||||
@@ -2,15 +2,15 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: "{{ .Chart.Name }}"
|
||||
name: '{{ .Chart.Name }}'
|
||||
labels:
|
||||
app: "{{ .Chart.Name }}"
|
||||
stand: "{{ .Values.stand }}"
|
||||
app: '{{ .Chart.Name }}'
|
||||
stand: '{{ .Values.stand }}'
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.mainContainer.containerPort }}
|
||||
targetPort: {{ .Values.mainContainer.containerPort }}
|
||||
protocol: TCP
|
||||
- port: {{ .Values.deployment.containerPort }}
|
||||
targetPort: {{ .Values.deployment.containerPort }}
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: "{{ .Chart.Name }}"
|
||||
stand: "{{ .Values.stand }}"
|
||||
app: '{{ .Chart.Name }}'
|
||||
stand: '{{ .Values.stand }}'
|
||||
|
||||
@@ -1,20 +1,23 @@
|
||||
{{- if .Values.vault.enabled }}
|
||||
{{- if .Values.vault.enable }}
|
||||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: "{{ .Chart.Name }}"
|
||||
name: '{{ .Chart.Name }}'
|
||||
labels:
|
||||
app: '{{ .Chart.Name }}'
|
||||
spec:
|
||||
refreshInterval: "60s"
|
||||
refreshInterval: '60s'
|
||||
secretStoreRef:
|
||||
name: "{{ .Values.vault.secretStore }}"
|
||||
name: '{{ .Values.vault.secretStore }}' # имя SecretStore
|
||||
kind: SecretStore
|
||||
target:
|
||||
name: "{{ .Values.vault.target.name }}"
|
||||
name: '{{ .Chart.Name }}-secrets' # имя будущего секрета kubernetes
|
||||
data:
|
||||
{{- range .Values.vault.data }}
|
||||
- secretKey: {{ .secretKey }}
|
||||
{{- range .Values.vault.secrets }}
|
||||
- secretKey: {{ . }}
|
||||
remoteRef:
|
||||
key: "{{ .remoteRef.key }}"
|
||||
property: "{{ .remoteRef.property }}"
|
||||
{{- end }}
|
||||
key: "deck/kubernetes/{{ $.Values.stand }}/{{ $.Chart.Name }}"
|
||||
property: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+33
-79
@@ -1,88 +1,42 @@
|
||||
#
|
||||
# Данный конфигурационный файл не является конечным исполнением
|
||||
# Параметры подставлены исключительно для тестов и могут быть измененены в соответствии с Pipeline
|
||||
#
|
||||
# Пример для DEV сборки
|
||||
stand: dev
|
||||
|
||||
stand: {{ stand }}
|
||||
|
||||
mainContainer:
|
||||
###### Репозиторий
|
||||
deployment:
|
||||
image:
|
||||
repository: "{{ registryUrl }}/{{ imageName }}"
|
||||
tag: {{ version }}
|
||||
containerPort: {{ appPort }}
|
||||
###### Ресурсы
|
||||
repository: drn.tst.nubes.ru/deck-auth-api-test
|
||||
tag: $VERSION
|
||||
containerPort: 8080
|
||||
resources:
|
||||
requests:
|
||||
cpu: "500m"
|
||||
memory: "1024Mi"
|
||||
requests: # Начальные запросы
|
||||
cpu: "500m"
|
||||
memory: "256Mi"
|
||||
limits:
|
||||
cpu: "1000m"
|
||||
memory: "1024Mi"
|
||||
###### Пробы контейнера
|
||||
cpu: "2" # Максимальные лимиты
|
||||
memory: "1024Mi"
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: {{ appPort }}
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
httpGet:
|
||||
path: /api/v1
|
||||
port: {{ appPort }}
|
||||
path: /api/v1/health
|
||||
scheme: HTTP
|
||||
|
||||
# Для Vault есть условие
|
||||
# Предварительно в Namespace должен быть создан SecretStore
|
||||
#
|
||||
# Читать: https://confluence.ad.nubes.ru/pages/viewpage.action?pageId=58626585
|
||||
# (Вариант 2. Используя external-operator)
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 15
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
|
||||
vault:
|
||||
secretStore: "{{ namespace }}"
|
||||
enabled: true
|
||||
serviceAccountName: "{{ namespace }}-sa"
|
||||
target:
|
||||
name: "{{ appName }}-envs"
|
||||
data:
|
||||
- secretKey: LUCEE_EXTENSIONS
|
||||
remoteRef:
|
||||
key: "deck/kubernetes/{{ stand}}/{{ appName }}"
|
||||
property: LUCEE_EXTENSIONS
|
||||
|
||||
- secretKey: ORCHESTRATOR_AUTH
|
||||
remoteRef:
|
||||
key: "deck/kubernetes/{{ stand}}/{{ appName }}"
|
||||
property: ORCHESTRATOR_AUTH
|
||||
|
||||
- secretKey: cfconfig_datasources_cmdb_database
|
||||
remoteRef:
|
||||
key: "deck/kubernetes/{{ stand}}/{{ appName }}"
|
||||
property: cfconfig_datasources_cmdb_database
|
||||
|
||||
- secretKey: cfconfig_datasources_cmdb_dbdriver
|
||||
remoteRef:
|
||||
key: "deck/kubernetes/{{ stand}}/{{ appName }}"
|
||||
property: cfconfig_datasources_cmdb_dbdriver
|
||||
|
||||
- secretKey: cfconfig_datasources_cmdb_host
|
||||
remoteRef:
|
||||
key: "deck/kubernetes/{{ stand}}/{{ appName }}"
|
||||
property: cfconfig_datasources_cmdb_host
|
||||
|
||||
- secretKey: cfconfig_datasources_cmdb_name
|
||||
remoteRef:
|
||||
key: "deck/kubernetes/{{ stand}}/{{ appName }}"
|
||||
property: cfconfig_datasources_cmdb_name
|
||||
|
||||
- secretKey: cfconfig_datasources_cmdb_password
|
||||
remoteRef:
|
||||
key: "deck/kubernetes/{{ stand}}/{{ appName }}"
|
||||
property: cfconfig_datasources_cmdb_password
|
||||
|
||||
- secretKey: cfconfig_datasources_cmdb_port
|
||||
remoteRef:
|
||||
key: "deck/kubernetes/{{ stand}}/{{ appName }}"
|
||||
property: cfconfig_datasources_cmdb_port
|
||||
|
||||
- secretKey: cfconfig_datasources_cmdb_username
|
||||
remoteRef:
|
||||
key: "deck/kubernetes/{{ stand}}/{{ appName }}"
|
||||
property: cfconfig_datasources_cmdb_username
|
||||
enable: true
|
||||
secretStore: deck-test
|
||||
secrets:
|
||||
- VITE_BACKEND_HOST
|
||||
- VITE_AUTH_HOST
|
||||
- VITE_KEYCLOAK_CLIENT_ID
|
||||
- VITE_KEYCLOAK_REALM
|
||||
- VITE_KEYCLOAK_REDIRECT_URI
|
||||
- VITE_KEYCLOAK_URL
|
||||
- VITE_KEYCLOAK_CLIENT_SECRET
|
||||
|
||||
Reference in New Issue
Block a user