Feature/helm chart deployment

.github/workflows/ci-release.yml

@@ -49,7 +49,7 @@ jobs:
           docker push "${APP_PACKAGES_URL}:latest"
           docker push "${APP_PACKAGES_URL}:${APP_VERSION}"
         env:
-          APP_PACKAGES_URL: docker.pkg.github.com/${{ github.repository }}/dgca-verifier-service
+          APP_PACKAGES_URL: ghcr.io/worldhealthorganization/tng-key-distribution/tng-key-distribution
           APP_PACKAGES_USERNAME: ${{ github.actor }}
           APP_PACKAGES_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
       - name: assets
@@ -82,8 +82,8 @@ jobs:
           cf target -o ${CF_ORG} -s ${CF_SPACE}
           cf push ${APP_NAME} --docker-image ${APP_IMAGE}:${APP_VERSION} --docker-username ${CF_DOCKER_USERNAME}
         env:
-          APP_NAME: dgca-verifier-service-eu-test
-          APP_IMAGE: docker.pkg.github.com/${{ github.repository }}/dgca-verifier-service
+          APP_NAME: tng-key-distribution-test
+          APP_IMAGE: ghcr.io/worldhealthorganization/tng-key-distribution/tng-key-distribution
           CF_API: ${{ secrets.CF_API }}
           CF_ORG: ${{ secrets.CF_ORG }}
           CF_SPACE: ${{ secrets.CF_SPACE }}

Dockerfile

@@ -1,4 +1,13 @@
-FROM adoptopenjdk:11-jre-hotspot
-COPY ./target/*.jar /app/app.jar
-WORKDIR /app
-ENTRYPOINT [ "sh", "-c", "java $JAVA_OPTS -Djava.security.egd=file:/dev/./urandom -jar ./app.jar" ]
+FROM eclipse-temurin:17-jre
+
+WORKDIR /
+
+COPY [ "./target/tng-key-distribution-latest.jar", "/tng-key-distribution.jar" ]
+
+ENV JAVA_OPTS="$JAVA_OPTS -Xms256M -Xmx1G"
+
+EXPOSE 8080
+
+USER 65534:65534
+
+ENTRYPOINT [ "sh", "-c", "java $JAVA_OPTS -Djava.security.egd=file:/dev/./urandom -jar /tng-key-distribution.jar" ]

docker-compose.yml

@@ -2,47 +2,41 @@ version: '3'
 
 services:
   postgres:
-    image: library/postgres:9.6
-    container_name: tng-key-distribution-postgres
+    image: postgres
     ports:
       - 5432:5432
     environment:
-      POSTGRES_DB: postgres
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: postgres
+      - POSTGRES_PASSWORD=admin  # do not use this for production deployments
+      - PGPASSWORD=admin  # do not use this for production deployments
+      - POSTGRES_USER=postgres
+      - POSTGRES_DB=postgres
     restart: unless-stopped
     networks:
       persistence:
 
-  backend:
+  tng-kds:
     build: .
-    image: eu-digital-green-certificates/dgc-verifier-service
-    container_name: tng-key-distribution
-    ports:
-      - 8080:8080
+    image: ghcr.io/worldhealthorganization/tng-key-distribution/tng-key-distribution:latest
     volumes:
       - ./certs:/ec/prod/app/san/dgc
+      - ./logs:/logs
+    ports:
+      - 8080:8080
     environment:
       - SERVER_PORT=8080
       - SPRING_PROFILES_ACTIVE=cloud
-      - SPRING_DATASOURCE_URL=jdbc:postgresql://dgc-verifier-service-postgres:5432/postgres
+      - SPRING_DATASOURCE_URL=jdbc:postgresql://postgres:5432/postgres
+      - SPRING_DATASOURCE_DRIVERCLASSNAME=org.postgresql.Driver
+      - SPRING_DATASOURCE_JNDI_NAME=false
+      - SPRING_JPA_DATABASEPLATFORM=org.hibernate.dialect.PostgreSQLDialect
       - SPRING_DATASOURCE_USERNAME=postgres
-      - SPRING_DATASOURCE_PASSWORD=postgres
-      - DGC_GATEWAY_CONNECTOR_ENDPOINT=https://dgc-gateway.example.com
-      - DGC_GATEWAY_CONNECTOR_TLSTRUSTSTORE_PATH=file:/ec/prod/app/san/dgc/tls_trust_store.p12
-      - DGC_GATEWAY_CONNECTOR_TLSTRUSTSTORE_PASSWORD=dgcg-p4ssw0rd
-      - DGC_GATEWAY_CONNECTOR_TLSKEYSTORE_ALIAS=1
-      - DGC_GATEWAY_CONNECTOR_TLSKEYSTORE_PATH=file:/ec/prod/app/san/dgc/tls_key_store.p12
-      - DGC_GATEWAY_CONNECTOR_TLSKEYSTORE_PASSWORD=dgcg-p4ssw0rd
-      - DGC_GATEWAY_CONNECTOR_TRUSTANCHOR_ALIAS=ta
-      - DGC_GATEWAY_CONNECTOR_TRUSTANCHOR_PATH=file:/ec/prod/app/san/dgc/trust_anchor.jks
-      - DGC_GATEWAY_CONNECTOR_TRUSTANCHOR_PASSWORD=dgcg-p4ssw0rd
+      - SPRING_DATASOURCE_PASSWORD=admin # do not use this for production deployments
     depends_on:
       - postgres
     networks:
       backend:
       persistence:
 
 networks:
-  backend:
   persistence:
+  backend:

k8s/helm/tngkds/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

k8s/helm/tngkds/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: tngkds
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

k8s/helm/tngkds/charts/tngkds-backend/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

k8s/helm/tngkds/charts/tngkds-backend/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: tngkds-backend
+description: A Helm chart for TNG Key Distribution Service
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

k8s/helm/tngkds/charts/tngkds-backend/templates/_helpers.tpl

@@ -0,0 +1,46 @@
+{{/*
+Template labels
+*/}}
+{{- define "tngkds-backend.templateLabels" -}}
+  app: {{ template "tngkds-backend.fullname" . }}
+{{- end -}}
+
+{{- define "tngkds-backend.selectorLabels" -}}
+  app: {{ template "tngkds-backend.fullname" . }}
+{{- end -}}
+
+{{- define "tngkds-backend.labels" -}}
+  app: {{ template "tngkds-backend.fullname" . }}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "tngkds-backend.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "tngkds-backend.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "tngkds-backend.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}

k8s/helm/tngkds/charts/tngkds-backend/templates/configmap.yml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "tngkds-backend.fullname" . }}-cfg
+data:
+  host: "{{ .Values.configMap.data.host }}"
+  dbname: "{{ .Values.configMap.data.dbName }}"

k8s/helm/tngkds/charts/tngkds-backend/templates/deployment.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "tngkds-backend.fullname" . }}
+  labels:
+    {{- include "tngkds-backend.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "tngkds-backend.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      labels:
+        {{- include "tngkds-backend.labels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+          {{ range .Values.service.ports }}
+            - name: {{ .name }}
+              containerPort: {{ .port }}
+              protocol: {{ .protocol }}
+          {{ end }}
+          env:
+            - name: SERVER_PORT
+              value: "{{ .Values.server.port }}"
+            - name: SPRING_PROFILES_ACTIVE
+              value: {{ .Values.spring.profile }}
+            - name: SPRING_DATASOURCE_URL
+              value: "jdbc:postgresql://{{ .Values.psql.serviceName }}.{{ .Release.Namespace }}.{{ .Values.psql.cluster }}:{{ .Values.psql.port }}/{{ .Values.psql.dbName }}"
+            - name: SPRING_DATASOURCE_DRIVERCLASSNAME
+              value: "org.postgresql.Driver"
+            - name: SPRING_DATASOURCE_JNDI_NAME
+              value: "false"
+            - name: SPRING_JPA_DATABASEPLATFORM
+              value: "org.hibernate.dialect.PostgreSQLDialect"
+            - name: SPRING_DATASOURCE_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "tngkds-backend.fullname" . }}-secret
+                  key: pgUser
+            - name: SPRING_DATASOURCE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "tngkds-backend.fullname" . }}-secret
+                  key: pgPassword
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

k8s/helm/tngkds/charts/tngkds-backend/templates/secrets.yml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "tngkds-backend.fullname" . }}-secret
+stringData:
+  pgUser: "postgres"
+  pgPassword: "postgres"

k8s/helm/tngkds/charts/tngkds-backend/templates/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "tngkds-backend.fullname" . }}-service
+  labels:
+    {{- include "tngkds-backend.labels" . | nindent 4 }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+  {{ range .Values.service.ports }}
+    - port: {{ .port }}
+      targetPort: {{ .targetPort | int}}
+      nodePort: {{ .nodePort }}
+      protocol: {{ .protocol }}
+      name: {{ .name }}
+  {{ end }}
+  selector:
+    {{- include "tngkds-backend.selectorLabels" . | nindent 4 }}