From 679b2e47b31dd87bc796868bd9f7a5763198b91c Mon Sep 17 00:00:00 2001 From: garrettmills Date: Tue, 22 Sep 2026 00:19:52 -0500 Subject: [PATCH] Rework Docker CI config --- .woodpecker.yaml | 24 ++- deploy/{0-namespace.yaml => 00-ns.yaml} | 3 +- deploy/1-deployment.yaml | 217 --------------------- deploy/10-redis.yaml | 32 +++ deploy/20-deploy.yaml | 84 ++++++++ deploy/3-certificate.yaml | 13 -- deploy/{2-service.yaml => 30-service.yaml} | 6 +- deploy/32-listener.yaml | 19 ++ deploy/34-route.yaml | 38 ++++ deploy/4-ingress.yaml | 25 --- deploy/README.md | 29 +-- 11 files changed, 195 insertions(+), 295 deletions(-) rename deploy/{0-namespace.yaml => 00-ns.yaml} (68%) delete mode 100644 deploy/1-deployment.yaml create mode 100644 deploy/10-redis.yaml create mode 100644 deploy/20-deploy.yaml delete mode 100644 deploy/3-certificate.yaml rename deploy/{2-service.yaml => 30-service.yaml} (81%) create mode 100644 deploy/32-listener.yaml create mode 100644 deploy/34-route.yaml delete mode 100644 deploy/4-ingress.yaml diff --git a/.woodpecker.yaml b/.woodpecker.yaml index c689282..dfb4505 100644 --- a/.woodpecker.yaml +++ b/.woodpecker.yaml @@ -5,14 +5,6 @@ when: steps: - name: build-and-push - # Pinned: WOODPECKER_PLUGINS_PRIVILEGED on the server must allow this exact - # image:tag, so a floating tag here would silently break the build. - # - # Deliberately NO `privileged: true` here -- that flag requires repo-level - # "security" trust and is rejected without it. The server-side allowlist - # escalates this step instead, but only while it stays a *plugin*: adding - # `commands`, `entrypoint`, or `environment` to this step silently drops - # the escalation and buildx's inner daemon will fail to start. image: woodpeckerci/plugin-docker-buildx:6.1.1 settings: registry: registry.apps.millslan.net @@ -24,3 +16,19 @@ steps: from_secret: registry_username password: from_secret: registry_password + + - name: deploy + # kubectl minor must stay within +/-1 of the cluster (k0s v1.36.3). + image: alpine/k8s:1.36.1 + environment: + KUBECONFIG_B64: + from_secret: kubeconfig_b64 + commands: + - echo "$KUBECONFIG_B64" | base64 -d > "$CI_WORKSPACE/.kubeconfig" + - chmod 600 "$CI_WORKSPACE/.kubeconfig" + - export KUBECONFIG="$CI_WORKSPACE/.kubeconfig" + - kubectl apply -f deploy/ + - kubectl -n coreid rollout restart deployment/coreid + - kubectl -n coreid rollout status deployment/coreid --timeout=5m + when: + - event: [tag, manual] diff --git a/deploy/0-namespace.yaml b/deploy/00-ns.yaml similarity index 68% rename from deploy/0-namespace.yaml rename to deploy/00-ns.yaml index 6fd67d0..76142e2 100644 --- a/deploy/0-namespace.yaml +++ b/deploy/00-ns.yaml @@ -1,4 +1,5 @@ +--- apiVersion: v1 kind: Namespace metadata: - name: starship + name: coreid diff --git a/deploy/1-deployment.yaml b/deploy/1-deployment.yaml deleted file mode 100644 index 01eb210..0000000 --- a/deploy/1-deployment.yaml +++ /dev/null @@ -1,217 +0,0 @@ ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: coreid-www - namespace: starship -spec: - selector: - matchLabels: - app: coreid - template: - metadata: - name: coreid - labels: - app: coreid - spec: - volumes: - - name: coreid-secrets-vol - secret: - secretName: coreid-secrets - optional: false - containers: - - name: coreid-web - image: ${DOCKER_REGISTRY}/starship/coreid - imagePullPolicy: Always - volumeMounts: - - mountPath: /secrets - readOnly: true - name: coreid-secrets-vol - env: - - name: APP_URL - value: "https://${COREID_DOMAIN}/" - - name: DATABASE_HOST - value: '${COREID_DATABASE_HOST}' - - name: DATABASE_NAME - value: '${COREID_DATABASE_NAME}' - - name: LDAP_BASE_DC - value: '${COREID_LDAP_BASE_DC}' - - name: REDIS_HOST - value: '${COREID_REDIS_HOST}' - - name: SMTP_HOST - value: '${COREID_SMTP_HOST}' - - name: SECRET - valueFrom: - secretKeyRef: - key: SECRET - name: coreid-secrets - optional: false - - name: SMTP_USER - valueFrom: - secretKeyRef: - key: SMTP_USER - name: coreid-secrets - optional: false - - name: SMTP_DEFAULT_SENDER - valueFrom: - secretKeyRef: - key: SMTP_DEFAULT_SENDER - name: coreid-secrets - optional: false - - name: SMTP_PASS - valueFrom: - secretKeyRef: - key: SMTP_PASS - name: coreid-secrets - optional: false - - name: REDIS_PASS - valueFrom: - secretKeyRef: - key: REDIS_PASS - name: coreid-secrets - optional: false - - name: APP_NAME - value: "Starship CoreID" - - name: SERVER_PORT - value: '8000' - - name: DATABASE_PORT - value: '27017' - - name: DATABASE_AUTH - value: 'false' - - name: ENVIRONMENT - value: production - - name: SSL_ENABLE - value: 'false' - - name: LDAP_SERVER_PORT - value: '636' - - name: LDAP_SSL_ENABLE - value: 'true' - - name: LDAP_CERT_PATH - value: '/secrets/X509_CERT' - - name: LDAP_CERT_KEY_PATH - value: '/secrets/X509_KEY' - - name: SAML_CERT_FILE - value: '/secrets/X509_CERT' - - name: SAML_KEY_FILE - value: '/secrets/X509_KEY' - - name: RADIUS_CERT_FILE - value: '/secrets/X509_CERT' - - name: RADIUS_KEY_FILE - value: '/secrets/X509_KEY' - - name: REDIS_PORT - value: '6379' - - name: SMTP_PORT - value: '587' - - name: OPENID_CONNECT_PROXY - value: 'true' - - name: SESSION_MAX_AGE - value: '1209600000' ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: coreid-jobs - namespace: starship -spec: - selector: - matchLabels: - app: coreid-jobs - template: - metadata: - name: coreid - labels: - app: coreid-jobs - spec: - volumes: - - name: coreid-secrets-vol - secret: - secretName: coreid-secrets - optional: false - containers: - - name: coreid-job-worker - image: ${DOCKER_REGISTRY}/starship/coreid - imagePullPolicy: Always - command: ["node", "/app/flitter", "worker", "main"] - volumeMounts: - - mountPath: /secrets - readOnly: true - name: coreid-secrets-vol - env: - - name: APP_URL - value: "https://${COREID_DOMAIN}/" - - name: DATABASE_HOST - value: '${COREID_DATABASE_HOST}' - - name: DATABASE_NAME - value: '${COREID_DATABASE_NAME}' - - name: LDAP_BASE_DC - value: '${COREID_LDAP_BASE_DC}' - - name: REDIS_HOST - value: '${COREID_REDIS_HOST}' - - name: SMTP_HOST - value: '${COREID_SMTP_HOST}' - - name: SECRET - valueFrom: - secretKeyRef: - key: SECRET - name: coreid-secrets - optional: false - - name: SMTP_USER - valueFrom: - secretKeyRef: - key: SMTP_USER - name: coreid-secrets - optional: false - - name: SMTP_DEFAULT_SENDER - valueFrom: - secretKeyRef: - key: SMTP_DEFAULT_SENDER - name: coreid-secrets - optional: false - - name: SMTP_PASS - valueFrom: - secretKeyRef: - key: SMTP_PASS - name: coreid-secrets - optional: false - - name: REDIS_PASS - valueFrom: - secretKeyRef: - key: REDIS_PASS - name: coreid-secrets - optional: false - - name: APP_NAME - value: "Starship CoreID" - - name: SERVER_PORT - value: '8000' - - name: DATABASE_PORT - value: '27017' - - name: DATABASE_AUTH - value: 'false' - - name: ENVIRONMENT - value: production - - name: SSL_ENABLE - value: 'false' - - name: LDAP_SERVER_PORT - value: '636' - - name: LDAP_SSL_ENABLE - value: 'true' - - name: LDAP_CERT_PATH - value: '/secrets/X509_CERT' - - name: LDAP_CERT_KEY_PATH - value: '/secrets/X509_KEY' - - name: SAML_CERT_FILE - value: '/secrets/X509_CERT' - - name: SAML_KEY_FILE - value: '/secrets/X509_KEY' - - name: RADIUS_CERT_FILE - value: '/secrets/X509_CERT' - - name: RADIUS_KEY_FILE - value: '/secrets/X509_KEY' - - name: REDIS_PORT - value: '6379' - - name: SMTP_PORT - value: '587' - - name: OPENID_CONNECT_PROXY - value: 'true' - - name: SESSION_MAX_AGE - value: '1209600000' diff --git a/deploy/10-redis.yaml b/deploy/10-redis.yaml new file mode 100644 index 0000000..9df325b --- /dev/null +++ b/deploy/10-redis.yaml @@ -0,0 +1,32 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: coreid-redis + namespace: coreid +spec: + selector: + matchLabels: + app: coreid-redis + template: + metadata: + name: coreid-redis + labels: + app: coreid-redis + spec: + containers: + - name: coreid-redis + image: redis:8 + +--- +apiVersion: v1 +kind: Service +metadata: + name: coreid-redis + namespace: coreid +spec: + selector: + app: coreid-redis + ports: + - port: 6379 + targetPort: 6379 \ No newline at end of file diff --git a/deploy/20-deploy.yaml b/deploy/20-deploy.yaml new file mode 100644 index 0000000..2107f1e --- /dev/null +++ b/deploy/20-deploy.yaml @@ -0,0 +1,84 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: coreid + namespace: coreid +spec: + strategy: + type: Recreate + selector: + matchLabels: + app: coreid + template: + metadata: + name: coreid + labels: + app: coreid + spec: + volumes: + - name: coreid-secrets-vol + secret: + secretName: coreid-secrets + optional: false + containers: + - name: coreid + image: registry.apps.millslan.net/starship/coreid:latest + imagePullPolicy: Always + volumeMounts: + - name: coreid-secrets-vol + mountPath: /secrets + readOnly: true + env: + - name: APP_URL + value: "https://coreid.garrettmills.dev/" + - name: DATABASE_HOST + value: 'db03.millslan.net' + - name: DATABASE_NAME + value: 'coreid_p1' + - name: LDAP_BASE_DC + value: 'dc=platform,dc=local' + - name: REDIS_HOST + value: coreid-redis.coreid.svc.cluster.local + - name: SECRET + valueFrom: + secretKeyRef: + key: SECRET + name: coreid-secrets + optional: false + - name: APP_NAME + value: "Starship CoreID" + - name: SERVER_PORT + value: '8000' + - name: DATABASE_PORT + value: '27017' + - name: DATABASE_AUTH + value: 'false' + - name: ENVIRONMENT + value: production + - name: SSL_ENABLE + value: 'false' + - name: LDAP_SERVER_PORT + value: '636' + - name: LDAP_SSL_ENABLE + value: 'true' + - name: LDAP_CERT_PATH + value: '/secrets/X509_CERT' + - name: LDAP_CERT_KEY_PATH + value: '/secrets/X509_KEY' + - name: SAML_CERT_FILE + value: '/secrets/X509_CERT' + - name: SAML_KEY_FILE + value: '/secrets/X509_KEY' + - name: RADIUS_CERT_FILE + value: '/secrets/X509_CERT' + - name: RADIUS_KEY_FILE + value: '/secrets/X509_KEY' + - name: REDIS_PORT + value: '6379' + - name: SMTP_PORT + value: '587' + - name: OPENID_CONNECT_PROXY + value: 'true' + - name: SESSION_MAX_AGE + value: '1209600000' diff --git a/deploy/3-certificate.yaml b/deploy/3-certificate.yaml deleted file mode 100644 index 5f7ccc2..0000000 --- a/deploy/3-certificate.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: coreid-tls - namespace: starship -spec: - secretName: coreid-tls-secret - dnsNames: - - ${COREID_DOMAIN} - issuerRef: - name: letsencrypt-ca - kind: ClusterIssuer diff --git a/deploy/2-service.yaml b/deploy/30-service.yaml similarity index 81% rename from deploy/2-service.yaml rename to deploy/30-service.yaml index 5a6d0eb..8330e5f 100644 --- a/deploy/2-service.yaml +++ b/deploy/30-service.yaml @@ -2,8 +2,8 @@ apiVersion: v1 kind: Service metadata: - name: coreid-web - namespace: starship + name: coreid + namespace: coreid spec: selector: app: coreid @@ -15,7 +15,7 @@ apiVersion: v1 kind: Service metadata: name: coreid-ldaps - namespace: starship + namespace: coreid spec: selector: app: coreid diff --git a/deploy/32-listener.yaml b/deploy/32-listener.yaml new file mode 100644 index 0000000..6f5ce53 --- /dev/null +++ b/deploy/32-listener.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: ListenerSet +metadata: + name: coreid-ldaps + namespace: coreid +spec: + parentRef: + group: gateway.networking.k8s.io + kind: Gateway + name: internal + namespace: p5x-gateway + listeners: + - name: ldaps + protocol: TCP + port: 636 + allowedRoutes: + namespaces: + from: Same \ No newline at end of file diff --git a/deploy/34-route.yaml b/deploy/34-route.yaml new file mode 100644 index 0000000..a26d10c --- /dev/null +++ b/deploy/34-route.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: gateway.networking.k8s.io/v1alpha2 +kind: TCPRoute +metadata: + name: coreid-ldaps + namespace: coreid +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: ListenerSet + name: coreid-ldaps + sectionName: ldaps + rules: + - backendRefs: + - name: coreid-ldaps + port: 636 + +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: coreid + namespace: coreid + labels: + p5x.garrettmills.dev/dns: 'true' +spec: + parentRefs: + - name: internal + namespace: p5x-gateway +# - name: public +# namespace: p5x-gateway + hostnames: + - coreid.apps.millslan.net +# - coreid.garrettmills.dev + rules: + - backendRefs: + - name: coreid + port: 80 \ No newline at end of file diff --git a/deploy/4-ingress.yaml b/deploy/4-ingress.yaml deleted file mode 100644 index c0b371e..0000000 --- a/deploy/4-ingress.yaml +++ /dev/null @@ -1,25 +0,0 @@ ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: coreid-ingress - namespace: starship - annotations: - nginx.ingress.kubernetes.io/ssl-redirect: 'false' -spec: - tls: - - hosts: - - ${COREID_DOMAIN} - secretName: coreid-tls-secret - ingressClassName: nginx - rules: - - host: ${COREID_DOMAIN} - http: - paths: - - pathType: Prefix - path: '/' - backend: - service: - name: coreid-web - port: - number: 80 diff --git a/deploy/README.md b/deploy/README.md index b13fd63..44f7610 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -1,32 +1,5 @@ -This deployment is parameterized for use with `envsubst(1)`. - -You will need to set up the secret values and environment variables (see below). - -```shell -bash -c 'for f in *.yaml; do envsubst < $f | kubectl apply -f -; done' -``` - -## Supported environment variables - -Set these environment variables in your shell before running the above command to apply the Kubernetes spec. - -- `COREID_DOMAIN` - domain name where CoreID is accessed (e.g. `coreid.mydomain.com`) -- `DOCKER_REGISTRY` - host of the docker registry to pull the image from (e.g. `registry.mydomain.com`) - - this is the same registry that is used by `yarn docker:build` and `yarn docker:push` -- `COREID_DATABASE_HOST` - MongoDB host (e.g. `mongo.mylan.net`) -- `COREID_DATABASE_NAME` - MongoDB database name to use (e.g. `coreid_p1`) -- `COREID_LDAP_BASE_DC` - base DC to use for LDAP tree (e.g. `dc=platform,dc=local`) -- `COREID_REDIS_HOST` - Redis host (e.g. `redis.mylan.net`) -- `COREID_SMTP_HOST` - SMTP server host (e.g. `smtp.mymail.com`) - -## Secret values - -The spec expects there to be a `coreid-secrets` secret in the `starship` namespace with the following values: +The spec expects there to be a `coreid-secrets` secret in the `coreid` namespace with the following values: - `SECRET` - hash seed used by CoreID (e.g. `df8db5a2-429b-4597-a013-18efee2465e0`) -- `SMTP_USER` - username used to log-into SMTP server (e.g. `user@mymail.com`) -- `SMTP_DEFAULT_SENDER` - email to use as FROM address. Usually same as `SMTP_USER` (e.g. `user@mymail.com`) -- `SMTP_PASS` - password for `SMTP_USER` -- `REDIS_PASS` - password for the Redis service - `X509_CERT` - contents of the x509 certificate to be used for SAML/LDAP/RADIUS - `X509_KEY` - contents of the x509 certificate key to be used for SAML/LDAP/RADIUS