Rework Docker CI config

.woodpecker.yaml

@@ -5,14 +5,6 @@ when:
 
 steps:
   - name: build-and-push
-    # Pinned: WOODPECKER_PLUGINS_PRIVILEGED on the server must allow this exact
-    # image:tag, so a floating tag here would silently break the build.
-    #
-    # Deliberately NO `privileged: true` here -- that flag requires repo-level
-    # "security" trust and is rejected without it. The server-side allowlist
-    # escalates this step instead, but only while it stays a *plugin*: adding
-    # `commands`, `entrypoint`, or `environment` to this step silently drops
-    # the escalation and buildx's inner daemon will fail to start.
     image: woodpeckerci/plugin-docker-buildx:6.1.1
     settings:
       registry: registry.apps.millslan.net
@@ -24,3 +16,19 @@ steps:
         from_secret: registry_username
       password:
         from_secret: registry_password
+
+  - name: deploy
+    # kubectl minor must stay within +/-1 of the cluster (k0s v1.36.3).
+    image: alpine/k8s:1.36.1
+    environment:
+      KUBECONFIG_B64:
+        from_secret: kubeconfig_b64
+    commands:
+      - echo "$KUBECONFIG_B64" | base64 -d > "$CI_WORKSPACE/.kubeconfig"
+      - chmod 600 "$CI_WORKSPACE/.kubeconfig"
+      - export KUBECONFIG="$CI_WORKSPACE/.kubeconfig"
+      - kubectl apply -f deploy/
+      - kubectl -n coreid rollout restart deployment/coreid
+      - kubectl -n coreid rollout status deployment/coreid --timeout=5m
+    when:
+      - event: [tag, manual]

deploy/00-ns.yaml

@@ -1,4 +1,5 @@
+---
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: starship
+  name: coreid

deploy/1-deployment.yaml

@@ -1,217 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coreid-www
-  namespace: starship
-spec:
-  selector:
-    matchLabels:
-      app: coreid
-  template:
-    metadata:
-      name: coreid
-      labels:
-        app: coreid
-    spec:
-      volumes:
-        - name: coreid-secrets-vol
-          secret:
-            secretName: coreid-secrets
-            optional: false
-      containers:
-        - name: coreid-web
-          image: ${DOCKER_REGISTRY}/starship/coreid
-          imagePullPolicy: Always
-          volumeMounts:
-            - mountPath: /secrets
-              readOnly: true
-              name: coreid-secrets-vol
-          env:
-            - name: APP_URL
-              value: "https://${COREID_DOMAIN}/"
-            - name: DATABASE_HOST
-              value: '${COREID_DATABASE_HOST}'
-            - name: DATABASE_NAME
-              value: '${COREID_DATABASE_NAME}'
-            - name: LDAP_BASE_DC
-              value: '${COREID_LDAP_BASE_DC}'
-            - name: REDIS_HOST
-              value: '${COREID_REDIS_HOST}'
-            - name: SMTP_HOST
-              value: '${COREID_SMTP_HOST}'
-            - name: SECRET
-              valueFrom:
-                secretKeyRef:
-                  key: SECRET
-                  name: coreid-secrets
-                  optional: false
-            - name: SMTP_USER
-              valueFrom:
-                secretKeyRef:
-                  key: SMTP_USER
-                  name: coreid-secrets
-                  optional: false
-            - name: SMTP_DEFAULT_SENDER
-              valueFrom:
-                secretKeyRef:
-                  key: SMTP_DEFAULT_SENDER
-                  name: coreid-secrets
-                  optional: false
-            - name: SMTP_PASS
-              valueFrom:
-                secretKeyRef:
-                  key: SMTP_PASS
-                  name: coreid-secrets
-                  optional: false
-            - name: REDIS_PASS
-              valueFrom:
-                secretKeyRef:
-                  key: REDIS_PASS
-                  name: coreid-secrets
-                  optional: false
-            - name: APP_NAME
-              value: "Starship CoreID"
-            - name: SERVER_PORT
-              value: '8000'
-            - name: DATABASE_PORT
-              value: '27017'
-            - name: DATABASE_AUTH
-              value: 'false'
-            - name: ENVIRONMENT
-              value: production
-            - name: SSL_ENABLE
-              value: 'false'
-            - name: LDAP_SERVER_PORT
-              value: '636'
-            - name: LDAP_SSL_ENABLE
-              value: 'true'
-            - name: LDAP_CERT_PATH
-              value: '/secrets/X509_CERT'
-            - name: LDAP_CERT_KEY_PATH
-              value: '/secrets/X509_KEY'
-            - name: SAML_CERT_FILE
-              value: '/secrets/X509_CERT'
-            - name: SAML_KEY_FILE
-              value: '/secrets/X509_KEY'
-            - name: RADIUS_CERT_FILE
-              value: '/secrets/X509_CERT'
-            - name: RADIUS_KEY_FILE
-              value: '/secrets/X509_KEY'
-            - name: REDIS_PORT
-              value: '6379'
-            - name: SMTP_PORT
-              value: '587'
-            - name: OPENID_CONNECT_PROXY
-              value: 'true'
-            - name: SESSION_MAX_AGE
-              value: '1209600000'
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coreid-jobs
-  namespace: starship
-spec:
-  selector:
-    matchLabels:
-      app: coreid-jobs
-  template:
-    metadata:
-      name: coreid
-      labels:
-        app: coreid-jobs
-    spec:
-      volumes:
-        - name: coreid-secrets-vol
-          secret:
-            secretName: coreid-secrets
-            optional: false
-      containers:
-        - name: coreid-job-worker
-          image: ${DOCKER_REGISTRY}/starship/coreid
-          imagePullPolicy: Always
-          command: ["node", "/app/flitter", "worker", "main"]
-          volumeMounts:
-            - mountPath: /secrets
-              readOnly: true
-              name: coreid-secrets-vol
-          env:
-            - name: APP_URL
-              value: "https://${COREID_DOMAIN}/"
-            - name: DATABASE_HOST
-              value: '${COREID_DATABASE_HOST}'
-            - name: DATABASE_NAME
-              value: '${COREID_DATABASE_NAME}'
-            - name: LDAP_BASE_DC
-              value: '${COREID_LDAP_BASE_DC}'
-            - name: REDIS_HOST
-              value: '${COREID_REDIS_HOST}'
-            - name: SMTP_HOST
-              value: '${COREID_SMTP_HOST}'
-            - name: SECRET
-              valueFrom:
-                secretKeyRef:
-                  key: SECRET
-                  name: coreid-secrets
-                  optional: false
-            - name: SMTP_USER
-              valueFrom:
-                secretKeyRef:
-                  key: SMTP_USER
-                  name: coreid-secrets
-                  optional: false
-            - name: SMTP_DEFAULT_SENDER
-              valueFrom:
-                secretKeyRef:
-                  key: SMTP_DEFAULT_SENDER
-                  name: coreid-secrets
-                  optional: false
-            - name: SMTP_PASS
-              valueFrom:
-                secretKeyRef:
-                  key: SMTP_PASS
-                  name: coreid-secrets
-                  optional: false
-            - name: REDIS_PASS
-              valueFrom:
-                secretKeyRef:
-                  key: REDIS_PASS
-                  name: coreid-secrets
-                  optional: false
-            - name: APP_NAME
-              value: "Starship CoreID"
-            - name: SERVER_PORT
-              value: '8000'
-            - name: DATABASE_PORT
-              value: '27017'
-            - name: DATABASE_AUTH
-              value: 'false'
-            - name: ENVIRONMENT
-              value: production
-            - name: SSL_ENABLE
-              value: 'false'
-            - name: LDAP_SERVER_PORT
-              value: '636'
-            - name: LDAP_SSL_ENABLE
-              value: 'true'
-            - name: LDAP_CERT_PATH
-              value: '/secrets/X509_CERT'
-            - name: LDAP_CERT_KEY_PATH
-              value: '/secrets/X509_KEY'
-            - name: SAML_CERT_FILE
-              value: '/secrets/X509_CERT'
-            - name: SAML_KEY_FILE
-              value: '/secrets/X509_KEY'
-            - name: RADIUS_CERT_FILE
-              value: '/secrets/X509_CERT'
-            - name: RADIUS_KEY_FILE
-              value: '/secrets/X509_KEY'
-            - name: REDIS_PORT
-              value: '6379'
-            - name: SMTP_PORT
-              value: '587'
-            - name: OPENID_CONNECT_PROXY
-              value: 'true'
-            - name: SESSION_MAX_AGE
-              value: '1209600000'

deploy/10-redis.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coreid-redis
+  namespace: coreid
+spec:
+  selector:
+    matchLabels:
+      app: coreid-redis
+  template:
+    metadata:
+      name: coreid-redis
+      labels:
+        app: coreid-redis
+    spec:
+      containers:
+        - name: coreid-redis
+          image: redis:8
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: coreid-redis
+  namespace: coreid
+spec:
+  selector:
+    app: coreid-redis
+  ports:
+    - port: 6379
+      targetPort: 6379

deploy/20-deploy.yaml

@@ -0,0 +1,84 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coreid
+  namespace: coreid
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: coreid
+  template:
+    metadata:
+      name: coreid
+      labels:
+        app: coreid
+    spec:
+      volumes:
+        - name: coreid-secrets-vol
+          secret:
+            secretName: coreid-secrets
+            optional: false
+      containers:
+        - name: coreid
+          image: registry.apps.millslan.net/starship/coreid:latest
+          imagePullPolicy: Always
+          volumeMounts:
+            - name: coreid-secrets-vol
+              mountPath: /secrets
+              readOnly: true
+          env:
+            - name: APP_URL
+              value: "https://coreid.garrettmills.dev/"
+            - name: DATABASE_HOST
+              value: 'db03.millslan.net'
+            - name: DATABASE_NAME
+              value: 'coreid_p1'
+            - name: LDAP_BASE_DC
+              value: 'dc=platform,dc=local'
+            - name: REDIS_HOST
+              value: coreid-redis.coreid.svc.cluster.local
+            - name: SECRET
+              valueFrom:
+                secretKeyRef:
+                  key: SECRET
+                  name: coreid-secrets
+                  optional: false
+            - name: APP_NAME
+              value: "Starship CoreID"
+            - name: SERVER_PORT
+              value: '8000'
+            - name: DATABASE_PORT
+              value: '27017'
+            - name: DATABASE_AUTH
+              value: 'false'
+            - name: ENVIRONMENT
+              value: production
+            - name: SSL_ENABLE
+              value: 'false'
+            - name: LDAP_SERVER_PORT
+              value: '636'
+            - name: LDAP_SSL_ENABLE
+              value: 'true'
+            - name: LDAP_CERT_PATH
+              value: '/secrets/X509_CERT'
+            - name: LDAP_CERT_KEY_PATH
+              value: '/secrets/X509_KEY'
+            - name: SAML_CERT_FILE
+              value: '/secrets/X509_CERT'
+            - name: SAML_KEY_FILE
+              value: '/secrets/X509_KEY'
+            - name: RADIUS_CERT_FILE
+              value: '/secrets/X509_CERT'
+            - name: RADIUS_KEY_FILE
+              value: '/secrets/X509_KEY'
+            - name: REDIS_PORT
+              value: '6379'
+            - name: SMTP_PORT
+              value: '587'
+            - name: OPENID_CONNECT_PROXY
+              value: 'true'
+            - name: SESSION_MAX_AGE
+              value: '1209600000'

deploy/3-certificate.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: coreid-tls
-  namespace: starship
-spec:
-  secretName: coreid-tls-secret
-  dnsNames:
-    - ${COREID_DOMAIN}
-  issuerRef:
-    name: letsencrypt-ca
-    kind: ClusterIssuer

deploy/30-service.yaml

@@ -2,8 +2,8 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: coreid-web
+  name: coreid
-  namespace: starship
+  namespace: coreid
 spec:
   selector:
     app: coreid
@@ -15,7 +15,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: coreid-ldaps
-  namespace: starship
+  namespace: coreid
 spec:
   selector:
     app: coreid

deploy/32-listener.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: ListenerSet
+metadata:
+  name: coreid-ldaps
+  namespace: coreid
+spec:
+  parentRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: internal
+    namespace: p5x-gateway
+  listeners:
+    - name: ldaps
+      protocol: TCP
+      port: 636
+      allowedRoutes:
+        namespaces:
+          from: Same

deploy/34-route.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+  name: coreid-ldaps
+  namespace: coreid
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: ListenerSet
+      name: coreid-ldaps
+      sectionName: ldaps
+  rules:
+    - backendRefs:
+        - name: coreid-ldaps
+          port: 636
+
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: coreid
+  namespace: coreid
+  labels:
+    p5x.garrettmills.dev/dns: 'true'
+spec:
+  parentRefs:
+    - name: internal
+      namespace: p5x-gateway
+#    - name: public
+#      namespace: p5x-gateway
+  hostnames:
+    - coreid.apps.millslan.net
+#    - coreid.garrettmills.dev
+  rules:
+    - backendRefs:
+        - name: coreid
+          port: 80

deploy/4-ingress.yaml

@@ -1,25 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: coreid-ingress
-  namespace: starship
-  annotations:
-    nginx.ingress.kubernetes.io/ssl-redirect: 'false'
-spec:
-  tls:
-    - hosts:
-        - ${COREID_DOMAIN}
-      secretName: coreid-tls-secret
-  ingressClassName: nginx
-  rules:
-    - host: ${COREID_DOMAIN}
-      http:
-        paths:
-          - pathType: Prefix
-            path: '/'
-            backend:
-              service:
-                name: coreid-web
-                port:
-                  number: 80

deploy/README.md

@@ -1,32 +1,5 @@
-This deployment is parameterized for use with `envsubst(1)`.
+The spec expects there to be a `coreid-secrets` secret in the `coreid` namespace with the following values:
-
-You will need to set up the secret values and environment variables (see below).
-
-```shell
-bash -c 'for f in *.yaml; do envsubst < $f | kubectl apply -f -; done'
-```
-
-## Supported environment variables
-
-Set these environment variables in your shell before running the above command to apply the Kubernetes spec.
-
-- `COREID_DOMAIN` - domain name where CoreID is accessed (e.g. `coreid.mydomain.com`)
-- `DOCKER_REGISTRY` - host of the docker registry to pull the image from (e.g. `registry.mydomain.com`)
-  - this is the same registry that is used by `yarn docker:build` and `yarn docker:push`
-- `COREID_DATABASE_HOST` - MongoDB host (e.g. `mongo.mylan.net`)
-- `COREID_DATABASE_NAME` - MongoDB database name to use (e.g. `coreid_p1`)
-- `COREID_LDAP_BASE_DC` - base DC to use for LDAP tree (e.g. `dc=platform,dc=local`)
-- `COREID_REDIS_HOST` - Redis host (e.g. `redis.mylan.net`)
-- `COREID_SMTP_HOST` - SMTP server host (e.g. `smtp.mymail.com`)
-
-## Secret values
-
-The spec expects there to be a `coreid-secrets` secret in the `starship` namespace with the following values:
 
 - `SECRET` - hash seed used by CoreID (e.g. `df8db5a2-429b-4597-a013-18efee2465e0`)
-- `SMTP_USER` - username used to log-into SMTP server (e.g. `user@mymail.com`)
-- `SMTP_DEFAULT_SENDER` - email to use as FROM address. Usually same as `SMTP_USER` (e.g. `user@mymail.com`)
-- `SMTP_PASS` - password for `SMTP_USER`
-- `REDIS_PASS` - password for the Redis service
 - `X509_CERT` - contents of the x509 certificate to be used for SAML/LDAP/RADIUS
 - `X509_KEY` - contents of the x509 certificate key to be used for SAML/LDAP/RADIUS