From 0090d6f97a455ff3849061d9fd84d94cf24d9866 Mon Sep 17 00:00:00 2001 From: eding Date: Wed, 16 Sep 2026 20:03:37 +0200 Subject: [PATCH] feat: add protected secret delivery values --- charts/maidn-e2e-secret/Chart.yaml | 4 ++ .../templates/deployment.yaml | 48 +++++++++++++++++++ .../forgejo-registry-credentials.yaml | 20 ++++++++ .../maidn-e2e-secret/templates/httproute.yaml | 17 +++++++ .../maidn-e2e-secret/templates/service.yaml | 12 +++++ charts/maidn-e2e-secret/values.yaml | 16 +++++++ preview/values.yaml | 1 + production/values.yaml | 2 + staging/values.yaml | 2 + 9 files changed, 122 insertions(+) create mode 100644 charts/maidn-e2e-secret/Chart.yaml create mode 100644 charts/maidn-e2e-secret/templates/deployment.yaml create mode 100644 charts/maidn-e2e-secret/templates/forgejo-registry-credentials.yaml create mode 100644 charts/maidn-e2e-secret/templates/httproute.yaml create mode 100644 charts/maidn-e2e-secret/templates/service.yaml create mode 100644 charts/maidn-e2e-secret/values.yaml create mode 100644 preview/values.yaml create mode 100644 production/values.yaml create mode 100644 staging/values.yaml diff --git a/charts/maidn-e2e-secret/Chart.yaml b/charts/maidn-e2e-secret/Chart.yaml new file mode 100644 index 0000000..a35a7d2 --- /dev/null +++ b/charts/maidn-e2e-secret/Chart.yaml @@ -0,0 +1,4 @@ +apiVersion: v2 +name: maidn-e2e-secret +description: Maidn E2E secret runtime fixture +version: 0.1.0 diff --git a/charts/maidn-e2e-secret/templates/deployment.yaml b/charts/maidn-e2e-secret/templates/deployment.yaml new file mode 100644 index 0000000..c127d92 --- /dev/null +++ b/charts/maidn-e2e-secret/templates/deployment.yaml @@ -0,0 +1,48 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Chart.Name }} + labels: + app: {{ .Chart.Name }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ .Chart.Name }} + template: + metadata: + labels: + app: {{ .Chart.Name }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- range . }} + - name: {{ . | quote }} + {{- end }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 8080 + {{- if or (eq .Release.Namespace "staging") (eq .Release.Namespace "production") }} + env: + - name: E2E_SECRET + valueFrom: + secretKeyRef: + name: {{ printf "%s-runtime-%s" .Chart.Name .Release.Namespace }} + key: {{ .Values.runtimeSecret.key | quote }} + - name: DATABASE_URL + valueFrom: + secretKeyRef: + name: {{ printf "%s-postgres-app" .Release.Namespace }} + key: uri + - name: MAIDN_RUNTIME_REQUIRED + value: "true" + {{- end }} + readinessProbe: + httpGet: + path: / + port: http diff --git a/charts/maidn-e2e-secret/templates/forgejo-registry-credentials.yaml b/charts/maidn-e2e-secret/templates/forgejo-registry-credentials.yaml new file mode 100644 index 0000000..6b1bf2b --- /dev/null +++ b/charts/maidn-e2e-secret/templates/forgejo-registry-credentials.yaml @@ -0,0 +1,20 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: forgejo-registry-credentials +spec: + secretStoreRef: + kind: ClusterSecretStore + name: openbao + target: + name: forgejo-registry-credentials + creationPolicy: Owner + template: + type: kubernetes.io/dockerconfigjson + data: + .dockerconfigjson: "{{ `{{ .dockerconfigjson }}` }}" + data: + - secretKey: dockerconfigjson + remoteRef: + key: cicd/forgejo-registry + property: dockerconfigjson diff --git a/charts/maidn-e2e-secret/templates/httproute.yaml b/charts/maidn-e2e-secret/templates/httproute.yaml new file mode 100644 index 0000000..bc586e8 --- /dev/null +++ b/charts/maidn-e2e-secret/templates/httproute.yaml @@ -0,0 +1,17 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: {{ .Chart.Name }} +spec: + parentRefs: + - name: {{ .Values.gateway.name }} + namespace: {{ .Values.gateway.namespace }} + sectionName: http + {{- with .Values.gateway.hostname }} + hostnames: + - {{ . | quote }} + {{- end }} + rules: + - backendRefs: + - name: {{ .Chart.Name }} + port: 8080 diff --git a/charts/maidn-e2e-secret/templates/service.yaml b/charts/maidn-e2e-secret/templates/service.yaml new file mode 100644 index 0000000..ccfd114 --- /dev/null +++ b/charts/maidn-e2e-secret/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Chart.Name }} +spec: + type: ClusterIP + selector: + app: {{ .Chart.Name }} + ports: + - name: http + port: 8080 + targetPort: http diff --git a/charts/maidn-e2e-secret/values.yaml b/charts/maidn-e2e-secret/values.yaml new file mode 100644 index 0000000..83276be --- /dev/null +++ b/charts/maidn-e2e-secret/values.yaml @@ -0,0 +1,16 @@ +replicaCount: 1 + +image: + repository: "" + tag: dev + pullPolicy: IfNotPresent +imagePullSecrets: + - forgejo-registry-credentials + +runtimeSecret: + key: e2e-secret + +gateway: + name: public + namespace: gateway-system + hostname: "" diff --git a/preview/values.yaml b/preview/values.yaml new file mode 100644 index 0000000..ebf6be8 --- /dev/null +++ b/preview/values.yaml @@ -0,0 +1 @@ +replicaCount: 1 diff --git a/production/values.yaml b/production/values.yaml new file mode 100644 index 0000000..698cc7a --- /dev/null +++ b/production/values.yaml @@ -0,0 +1,2 @@ +gateway: + hostname: maidn-e2e-secret.dev02.nid3.com diff --git a/staging/values.yaml b/staging/values.yaml new file mode 100644 index 0000000..d905be7 --- /dev/null +++ b/staging/values.yaml @@ -0,0 +1,2 @@ +gateway: + hostname: maidn-e2e-secret-staging.dev02.nid3.com