SPS-250 Creates Helm Chart for registration-service

.gitignore

@@ -22,3 +22,6 @@
 # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
 hs_err_pid*
 replay_pid*
+
+# MacOS files
+.DS_Store

backend/registration-service/.drone.yml

@@ -0,0 +1,61 @@
+kind: pipeline
+type: kubernetes
+name: build-test
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+
+  - name: docker
+    image: plugins/docker
+    settings:
+      dockerfile: backend/registration-service/Dockerfile
+      registry: quay.io
+      context: backend/registration-service
+      tags:
+      - latest
+      repo: quay.io/ukhomeofficedigital/dsa-re-registration-service
+      username:
+        from_secret: ROBOT_QUAY_USER
+      password:
+        from_secret: ROBOT_QUAY_PASS
+
+trigger:
+  event:
+  - push
+
+  # - name: debug-versions
+  #   image: quay.io/ukhomeofficedigital/helm:3.15.4-build.1
+  #   commands:
+  #     - kubectl config set-cluster buildstep --server=$SHOWCASE_KUBE_SERVER
+  #     - kubectl config set-credentials $SHOWCASE_KUBE_USER --token=$SHOWCASE_KUBE_TOKEN
+  #     - kubectl config set-context buildstep --cluster=buildstep --user=$SHOWCASE_KUBE_USER --namespace=$SHOWCASE_KUBE_NAMESPACE
+  #     - kubectl config use-context buildstep
+  #     - helm version
+  #     - kubectl --context=buildstep version
+  #     - helm list --kube-context=buildstep
+  #     - helm list --namespace=$SHOWCASE_KUBE_NAMESPACE --kube-apiserver=$SHOWCASE_KUBE_SERVER --kube-token=$SHOWCASE_KUBE_TOKEN
+  #   environment:
+  #     SHOWCASE_KUBE_USER:
+  #       from_secret: KUBE_NAMESPACE_DEV
+  #     SHOWCASE_KUBE_NAMESPACE:
+  #       from_secret: KUBE_NAMESPACE_DEV
+  #     SHOWCASE_KUBE_SERVER:
+  #       from_secret: KUBE_SERVER_NOT_PROD
+  #     SHOWCASE_KUBE_TOKEN:
+  #       from_secret: KUBE_TOKEN_DEV
+
+  # - name: helm-test
+  #   image: quay.io/ukhomeofficedigital/helm:v3.5.4
+  #   commands:
+  #     - helm version
+  #     - kubectl version
+
+  # - name: helm-install
+  #   image: quay.io/ukhomeofficedigital/helm:v3.5.4
+  #   commands:
+  #     - helm version
+  #     - kubectl version
+

backend/registration-service/Dockerfile

@@ -0,0 +1,37 @@
+# Stage 1 - Build Application
+
+# Base image with JDK
+FROM quay.io/ukhomeofficedigital/dsa-re-amazoncorretto:21.0.5-alpine3.20 AS builder
+
+#Set working directory
+WORKDIR /app
+
+# Copy over maven wrapper files
+COPY mvnw .
+COPY mvnw.cmd .
+COPY .mvn ./.mvn
+
+# Ensure mvnw is executable
+RUN chmod +x mvnw
+
+# Copy over pom and application source code
+COPY pom.xml .
+COPY src ./src
+
+# Compile code into jar
+RUN ./mvnw clean install -Dskiptests
+
+# Stage 2 - Run application
+FROM quay.io/ukhomeofficedigital/dsa-re-amazoncorretto:21.0.5-alpine3.20
+
+#Set working directory
+WORKDIR /app
+
+# Copy over jar from stage 1
+COPY --from=builder app/target/registration-service-0.0.1-SNAPSHOT.jar app.jar
+
+# Expose port
+EXPOSE 8080
+
+# Run Springboot app
+ENTRYPOINT [ "java", "-jar", "app.jar" ]

backend/registration-service/pom.xml

@@ -27,7 +27,7 @@
 		<url/>
 	</scm>
 	<properties>
-		<java.version>19</java.version>
+		<java.version>21</java.version>
 	</properties>
 	<dependencies>
 		<dependency>
@@ -38,6 +38,10 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-web</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-actuator</artifactId>
+		</dependency>
 		<dependency>
 		  <groupId>org.postgresql</groupId>
 			<artifactId>postgresql</artifactId>

backend/registration-service/registration-service-chart/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

backend/registration-service/registration-service-chart/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: registration-service
+description: A Helm chart for deploying registration-service to Kubernetes
+type: application
+version: 0.1.0

backend/registration-service/registration-service-chart/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "registration-service.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "registration-service.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "registration-service.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "registration-service.labels" -}}
+helm.sh/chart: {{ include "registration-service.chart" . }}
+{{ include "registration-service.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "registration-service.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "registration-service.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "registration-service.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "registration-service.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

backend/registration-service/registration-service-chart/templates/deployment.yaml

@@ -0,0 +1,134 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "registration-service.fullname" . }}
+  labels:
+    {{- include "registration-service.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "registration-service.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "registration-service.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "registration-service.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+      securityContext:
+        fsGroup: 1000
+        runAsNonRoot: true
+        runAsUser: 1000
+      {{- if((.Values.dynatrace).podRuntimeInjection).enabled }}
+      initContainers:
+        - name: install-oneagent
+          image: {{ (((.Values).dynatrace).podRuntimeInjection).image | default "quay.io/ukhomeofficedigital/alpine:v3.15" | quote }}
+          command:
+            - /bin/sh
+          args:
+            - -c
+            - ARCHIVE=$(mktemp) && time wget --no-check-certificate -O $ARCHIVE "$DT_API_URL/v1/deployment/installer/agent/unix/paas/latest?Api-Token=$DT_PAAS_TOKEN&$DT_ONEAGENT_OPTIONS" && time unzip -o -d /opt/dynatrace/oneagent $ARCHIVE && rm -f $ARCHIVE
+          env:
+            - name: DT_API_URL
+              valueFrom:
+                secretKeyRef:
+                  name: registration-service-dynatrace-oneagent
+                  key: api-url
+            - name: DT_PAAS_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: registration-service-dynatrace-oneagent
+                  key: paas-installer-download-token
+            - name: DT_ONEAGENT_OPTIONS
+              value: flavor=multidistro&include=java
+          volumeMounts:
+            - mountPath: /opt/dynatrace/oneagent
+              name: {{ (((.Values).dynatrace).podRuntimeInjection).volumeName | default "oneagent" }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "quay.io/ukhomeofficedigital/dsa-re-registration-service:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 8080
+          livenessProbe:
+            httpGet:
+              path: /actuator/health/liveness
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /actuator/health/readiness
+              port: http
+            initialDelaySeconds: 60
+            periodSeconds: 30
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          env:
+            - name: JAVA_OPTIONS
+              value: -Dspring.profiles.active={{ .Release.Namespace }}
+            - name: SHOWCASE_SERVICES_DB_ENDPOINT
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.persistenceCredentialsSecretName }}
+                  key: endpoint
+            - name: SHOWCASE_SERVICES_DB_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.persistenceCredentialsSecretName }}
+                  key: port
+            - name: SHOWCASE_SERVICES_DB_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.persistenceCredentialsSecretName }}
+                  key: default_db
+            - name: SHOWCASE_SERVICES_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.persistenceCredentialsSecretName }}
+                  key: username
+            - name: SHOWCASE_SERVICES_DB_PWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.persistenceCredentialsSecretName }}
+                  key: password
+          {{- if((.Values.dynatrace).podRuntimeInjection).enabled }}
+            - name: LD_PRELOAD
+              value: /opt/dynatrace/oneagent/agent/lib64/liboneagentproc.so
+          {{- end -}}
+          {{- if((.Values.dynatrace).podRuntimeInjection).enabled }}
+          volumeMounts:
+            - name: {{ (((.Values).dynatrace).podRuntimeInjection).volumeName | default "oneagent" }}
+              mountPath: /opt/dynatrace/oneagent
+          {{- end -}}
+      {{- if((.Values.dynatrace).podRuntimeInjection).enabled }}
+      volumes:
+        - name: {{ (((.Values).dynatrace).podRuntimeInjection).volumeName | default "oneagent" }}
+          emptyDir: {}
+      {{- end -}}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

backend/registration-service/registration-service-chart/templates/networkpolicy.yaml

@@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "registration-service.fullname" . }}
+  labels:
+    {{- include "registration-service.labels" . | nindent 4 }}
+spec:
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ .Release.Namespace }}
+  egress:
+    - to:
+      {{- range .Values.namespaceToAllowEgress }}
+      - namespaceSelector:
+          matchLabels:
+            name: {{ . }}
+      {{- end }}
+      {{- range .Values.ipBlockToAllowEgress }}
+      - ipBlock:
+          cidr: {{ . }}
+     {{- end }}
+  podSelector:
+    matchLabels:
+      {{- include "registration-service.selectorLabels" . | nindent 6 }}
+  policyTypes:
+  - Ingress
+  - Egress

backend/registration-service/registration-service-chart/templates/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "registration-service.fullname" . }}
+  labels:
+    {{- include "registration-service.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+  selector:
+    {{- include "registration-service.selectorLabels" . | nindent 4 }}