Skip to content

Commit f8e2900

Browse files
Mathieu BenoitNimJay
Mathieu Benoit
and
NimJay
authored
Online Boutique's Helm chart (#1353)
* Create initial Helm chart * currency and email * Complete Helm chart for Online Boutique * cat helm-template.yaml * Add warning about Helm being in experimental mode * Use 2022 for Apache license headers * Link to values.yaml in helm-chart/README.md * Fix issue with bool in env var * Fix issue with bool in env var (take 2/2) * Review naming convention + add externalRedisTlsOrigination * Fix CI issues * Fix CI issue with Sidecar * Add seccompProfile for more security, disable by default * Helm chart push in release process * More elegant and consistent way to automate the Helm chart package/push * Update NOTES.txt * Update NOTES.txt * Update NOTES.txt Co-authored-by: Nim Jayawardena <nimjay@google.com>
1 parent ee72e8d commit f8e2900

23 files changed

+2993
-34
lines changed

β€Ž.github/workflows/helm-chart-ci.yaml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: helm-chart-ci
16+
on:
17+
push:
18+
branches:
19+
- main
20+
paths:
21+
- 'helm-chart/**'
22+
- '.github/workflows/helm-chart-ci.yaml'
23+
pull_request:
24+
paths:
25+
- 'helm-chart/**'
26+
- '.github/workflows/helm-chart-ci.yaml'
27+
jobs:
28+
helm-chart-ci:
29+
runs-on: ubuntu-22.04
30+
steps:
31+
- uses: actions/checkout@v3
32+
- name: helm lint
33+
run: |
34+
cd helm-chart/
35+
helm lint
36+
- name: helm template default
37+
run: |
38+
cd helm-chart/
39+
helm template . > helm-template.yaml
40+
cat helm-template.yaml
41+
- name: kustomize build default
42+
run: |
43+
cd helm-chart/
44+
kustomize create --resources helm-template.yaml
45+
kustomize build .
46+
- name: helm template advanced
47+
run: |
48+
cd helm-chart/
49+
helm template . \
50+
--set images.repository=us-docker.pkg.dev/my-project/containers/onlineboutique \
51+
--set frontend.externalService=false \
52+
--set redis.create=false \
53+
--set cartservice.database.type=spanner \
54+
--set cartservice.database.connectionString=projects/my-project/instances/onlineboutique/databases/carts \
55+
--set serviceAccounts.create=true \
56+
--set authorizationPolicies.create=true \
57+
--set networkPolicies.create=true \
58+
--set sidecars.create=true \
59+
--set frontend.virtualService.create=true \
60+
--set 'serviceAccounts.annotations.iam\.gke\.io/gcp-service-account=spanner-db-user@my-project.iam.gserviceaccount.com' \
61+
--set serviceAccounts.annotationsOnlyForCartservice=true \
62+
-n onlineboutique \
63+
> helm-template.yaml
64+
cat helm-template.yaml
65+
- name: kustomize build advanced
66+
run: |
67+
cd helm-chart/
68+
kustomize build .

β€Žhack/make-helm-chart.sh

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2019 Google LLC
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# Packages and pushes Online Boutique's Helm chart in public Artifact Registry.
18+
19+
set -euo pipefail
20+
SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
21+
22+
log() { echo "$1" >&2; }
23+
24+
TAG="${TAG:?TAG env variable must be specified}"
25+
HELM_CHART_REPO="us-docker.pkg.dev/online-boutique-ci/charts"
26+
27+
cd helm-chart
28+
sed -i "s/^appVersion:.*/appVersion: \"${TAG}\"/" Chart.yaml
29+
sed -i "s/^version:.*/version: ${TAG:1}/" Chart.yaml
30+
helm package .
31+
helm push onlineboutique-$TAG.tgz oci://$HELM_CHART_REPO
32+
33+
log "Successfully built and pushed the Helm chart."

β€Žhack/make-release.sh

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,14 @@ git pull
5050
# update yaml
5151
"${SCRIPTDIR}"/make-release-artifacts.sh
5252

53+
# build and push images
54+
"${SCRIPTDIR}"/make-helm-chart.sh
55+
5356
# create git release / push to new branch
5457
git checkout -b "release/${TAG}"
5558
git add "${SCRIPTDIR}/../release/"
5659
git add "${SCRIPTDIR}/../kustomize/base/"
60+
git add "${SCRIPTDIR}/../helm-chart/"
5761
git commit --allow-empty -m "Release $TAG"
5862
log "Pushing k8s manifests to release/${TAG}..."
5963
git tag "$TAG"

β€Žhelm-chart/Chart.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: onlineboutique
3+
description: A Helm chart for Kubernetes for Online Boutique
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.4.2
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "v0.4.2"

β€Žhelm-chart/README.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Helm chart for Online Boutique
2+
3+
If you'd like to deploy Online Boutique via its Helm chart, you could leverage the following instructions.
4+
5+
**Warning:** Online Boutique's Helm chart is currently experimental. If you have feedback or run into issues, let us know inside [GitHub Issue #1319](https://github.com/GoogleCloudPlatform/microservices-demo/issues/1319) or by creating a [new GitHub Issue](https://github.com/GoogleCloudPlatform/microservices-demo/issues/new/choose).
6+
7+
Deploy the default setup of Online Boutique:
8+
```sh
9+
helm install onlineboutique oci://us-docker.pkg.dev/online-boutique-ci/charts/onlineboutique
10+
```
11+
12+
Deploy advanced scenario of Online Boutique:
13+
```sh
14+
helm install onlineboutique oci://us-docker.pkg.dev/online-boutique-ci/charts/onlineboutique \
15+
--set images.repository=us-docker.pkg.dev/my-project/containers/onlineboutique \
16+
--set frontend.externalService=false \
17+
--set redis.create=false \
18+
--set cartservice.database.type=spanner \
19+
--set cartservice.database.connectionString=projects/my-project/instances/onlineboutique/databases/carts \
20+
--set serviceAccounts.create=true \
21+
--set authorizationPolicies.create=true \
22+
--set networkPolicies.create=true \
23+
--set sidecars.create=true \
24+
--set frontend.virtualService.create=true \
25+
--set 'serviceAccounts.annotations.iam\.gke\.io/gcp-service-account=spanner-db-user@my-project.iam.gserviceaccount.com' \
26+
--set serviceAccounts.annotationsOnlyForCartservice=true \
27+
-n onlineboutique
28+
```
29+
30+
For the full list of configurations, see [values.yaml](./values.yaml).

β€Žhelm-chart/templates/NOTES.txt

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if and .Values.frontend.create .Values.frontend.externalService }}
2+
Note: It may take a few minutes for the LoadBalancer IP to be available.
3+
4+
Watch the status of the frontend IP address with:
5+
kubectl get --namespace {{ .Release.Namespace }} svc -w {{ .Values.frontend.name }}-external
6+
7+
Get the external IP address of the frontend:
8+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ .Values.frontend.name }}-external --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
9+
echo http://$SERVICE_IP
10+
{{- end }}
11+
{{- if .Values.frontend.virtualService.create }}
12+
13+
{{- end }}

β€Žhelm-chart/templates/adservice.yaml

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.adService.create }}
16+
{{- if .Values.serviceAccounts.create }}
17+
apiVersion: v1
18+
kind: ServiceAccount
19+
metadata:
20+
name: {{ .Values.adService.name }}
21+
namespace: {{.Release.Namespace}}
22+
{{- if not .Values.serviceAccounts.annotationsOnlyForCartservice }}
23+
{{- with .Values.serviceAccounts.annotations }}
24+
annotations:
25+
{{- toYaml . | nindent 4 }}
26+
{{- end }}
27+
{{- end }}
28+
---
29+
{{- end }}
30+
apiVersion: apps/v1
31+
kind: Deployment
32+
metadata:
33+
name: {{ .Values.adService.name }}
34+
namespace: {{ .Release.Namespace }}
35+
spec:
36+
selector:
37+
matchLabels:
38+
app: {{ .Values.adService.name }}
39+
template:
40+
metadata:
41+
labels:
42+
app: {{ .Values.adService.name }}
43+
spec:
44+
{{- if .Values.serviceAccounts.create }}
45+
serviceAccountName: {{ .Values.adService.name }}
46+
{{- else }}
47+
serviceAccountName: default
48+
{{- end }}
49+
terminationGracePeriodSeconds: 5
50+
securityContext:
51+
fsGroup: 1000
52+
runAsGroup: 1000
53+
runAsNonRoot: true
54+
runAsUser: 1000
55+
{{- if .Values.seccompProfile.enable }}
56+
seccompProfile:
57+
type: {{ .Values.seccompProfile.type }}
58+
{{- end }}
59+
containers:
60+
- name: server
61+
securityContext:
62+
allowPrivilegeEscalation: false
63+
capabilities:
64+
drop:
65+
- all
66+
privileged: false
67+
readOnlyRootFilesystem: true
68+
image: {{ .Values.images.repository }}/{{ .Values.adService.name }}:{{ .Values.images.tag | default .Chart.AppVersion }}{{ .Values.images.tagSuffix }}
69+
ports:
70+
- containerPort: 9555
71+
env:
72+
- name: PORT
73+
value: "9555"
74+
resources:
75+
requests:
76+
cpu: 200m
77+
memory: 180Mi
78+
limits:
79+
cpu: 300m
80+
memory: 300Mi
81+
readinessProbe:
82+
initialDelaySeconds: 20
83+
periodSeconds: 15
84+
{{- if .Values.nativeGrpcHealthCheck }}
85+
grpc:
86+
port: 9555
87+
{{- else }}
88+
exec:
89+
command: ["/bin/grpc_health_probe", "-addr=:9555"]
90+
{{- end }}
91+
livenessProbe:
92+
initialDelaySeconds: 20
93+
periodSeconds: 15
94+
{{- if .Values.nativeGrpcHealthCheck }}
95+
grpc:
96+
port: 9555
97+
{{- else }}
98+
exec:
99+
command: ["/bin/grpc_health_probe", "-addr=:9555"]
100+
{{- end }}
101+
---
102+
apiVersion: v1
103+
kind: Service
104+
metadata:
105+
name: {{ .Values.adService.name }}
106+
namespace: {{ .Release.Namespace }}
107+
spec:
108+
type: ClusterIP
109+
selector:
110+
app: {{ .Values.adService.name }}
111+
ports:
112+
- name: grpc
113+
port: 9555
114+
targetPort: 9555
115+
{{- if .Values.networkPolicies.create }}
116+
---
117+
apiVersion: networking.k8s.io/v1
118+
kind: NetworkPolicy
119+
metadata:
120+
name: {{ .Values.adService.name }}
121+
namespace: {{ .Release.Namespace }}
122+
spec:
123+
podSelector:
124+
matchLabels:
125+
app: {{ .Values.adService.name }}
126+
policyTypes:
127+
- Ingress
128+
- Egress
129+
ingress:
130+
- from:
131+
- podSelector:
132+
matchLabels:
133+
app: {{ .Values.frontend.name }}
134+
ports:
135+
- port: 9555
136+
protocol: TCP
137+
egress:
138+
- {}
139+
{{- end }}
140+
{{- if .Values.sidecars.create }}
141+
---
142+
apiVersion: networking.istio.io/v1beta1
143+
kind: Sidecar
144+
metadata:
145+
name: {{ .Values.adService.name }}
146+
namespace: {{ .Release.Namespace }}
147+
spec:
148+
workloadSelector:
149+
labels:
150+
app: {{ .Values.adService.name }}
151+
egress:
152+
- hosts:
153+
- istio-system/*
154+
{{- end }}
155+
{{- if .Values.authorizationPolicies.create }}
156+
---
157+
apiVersion: security.istio.io/v1beta1
158+
kind: AuthorizationPolicy
159+
metadata:
160+
name: {{ .Values.adService.name }}
161+
namespace: {{ .Release.Namespace }}
162+
spec:
163+
selector:
164+
matchLabels:
165+
app: {{ .Values.adService.name }}
166+
rules:
167+
- from:
168+
- source:
169+
principals:
170+
{{- if .Values.serviceAccounts.create }}
171+
- cluster.local/ns/{{ .Release.Namespace }}/sa/{{ .Values.frontend.name }}
172+
{{- else }}
173+
- cluster.local/ns/{{ .Release.Namespace }}/sa/default
174+
{{- end }}
175+
to:
176+
- operation:
177+
paths:
178+
- /hipstershop.AdService/GetAds
179+
methods:
180+
- POST
181+
ports:
182+
- "9555"
183+
{{- end }}
184+
{{- end }}

0 commit comments

Comments
 (0)