Skip to content

Commit b82564d

Browse files
iromlimoabu
iromli
and
moabu
authored
feat(charts): cloudtools integration with Helm charts (#2037)
* feat(charts): cloudtools integration with Helm charts Signed-off-by: iromli <[email protected]> * docs: fix chart version Signed-off-by: iromli <[email protected]> * feat(charts): cloudtools for flex aio Signed-off-by: iromli <[email protected]> * fix: remove invalid reference of janssen-all-in-one in charts Signed-off-by: iromli <[email protected]> * chore(cloud-native): update FLEX and JANS source version Signed-off-by: iromli <[email protected]> --------- Signed-off-by: iromli <[email protected]> Co-authored-by: Mohammad Abudayyeh <[email protected]>
1 parent d220989 commit b82564d

File tree

25 files changed

+690
-33
lines changed

25 files changed

+690
-33
lines changed

‎charts/gluu-all-in-one/README.md

+28-4
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Kubernetes: `>=v1.22.0-0`
3535
| adminPassword | string | `"Test1234#"` | Admin password to log in to the UI. |
3636
| alb.ingress | bool | `false` | switches the service to Nodeport for ALB ingress |
3737
| auth-server | object | `{"appLoggers":{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","authLogLevel":"INFO","authLogTarget":"STDOUT","enableStdoutLogPrefix":"true","httpLogLevel":"INFO","httpLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"authEncKeys":"RSA1_5 RSA-OAEP","authSigKeys":"RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512","cnCustomJavaOptions":"","enabled":true,"ingress":{"authServerAdditionalAnnotations":{},"authServerEnabled":true,"authServerLabels":{},"authServerProtectedRegister":false,"authServerProtectedRegisterAdditionalAnnotations":{},"authServerProtectedRegisterLabels":{},"authServerProtectedToken":false,"authServerProtectedTokenAdditionalAnnotations":{},"authServerProtectedTokenLabels":{},"authzenAdditionalAnnotations":{},"authzenConfigEnabled":true,"authzenConfigLabels":{},"deviceCodeAdditionalAnnotations":{},"deviceCodeEnabled":true,"deviceCodeLabels":{},"firebaseMessagingAdditionalAnnotations":{},"firebaseMessagingEnabled":true,"firebaseMessagingLabels":{},"lockAdditionalAnnotations":{},"lockConfigAdditionalAnnotations":{},"lockConfigEnabled":false,"lockConfigLabels":{},"lockEnabled":false,"lockLabels":{},"openidAdditionalAnnotations":{},"openidConfigEnabled":true,"openidConfigLabels":{},"u2fAdditionalAnnotations":{},"u2fConfigEnabled":true,"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigEnabled":true,"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryEnabled":true,"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerEnabled":true,"webfingerLabels":{}},"lockEnabled":false}` | Parameters used globally across all services helm charts. |
38-
| auth-server-key-rotation | object | `{"additionalAnnotations":{},"additionalLabels":{},"customCommand":[],"customScripts":[],"dnsConfig":{},"dnsPolicy":"","enabled":true,"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"ghcr.io/janssenproject/jans/certmanager","tag":"0.0.0-nightly"},"initKeysLife":48,"keysLife":48,"keysPushDelay":0,"keysPushStrategy":"NEWER","keysStrategy":"NEWER","lifecycle":{},"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Responsible for regenerating auth-keys per x hours |
38+
| auth-server-key-rotation | object | `{"additionalAnnotations":{},"additionalLabels":{},"customCommand":[],"customScripts":[],"dnsConfig":{},"dnsPolicy":"","enabled":true,"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"ghcr.io/janssenproject/jans/cloudtools","tag":"0.0.0-nightly"},"initKeysLife":48,"keysLife":48,"keysPushDelay":0,"keysPushStrategy":"NEWER","keysStrategy":"NEWER","lifecycle":{},"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Responsible for regenerating auth-keys per x hours |
3939
| auth-server-key-rotation.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
4040
| auth-server-key-rotation.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
4141
| auth-server-key-rotation.customCommand | list | `[]` | Add custom job's command. If passed, it will override the default conditional command. |
@@ -45,7 +45,7 @@ Kubernetes: `>=v1.22.0-0`
4545
| auth-server-key-rotation.enabled | bool | `true` | Boolean flag to enable/disable the auth-server-key rotation cronjob. |
4646
| auth-server-key-rotation.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
4747
| auth-server-key-rotation.image.pullSecrets | list | `[]` | Image Pull Secrets |
48-
| auth-server-key-rotation.image.repository | string | `"ghcr.io/janssenproject/jans/certmanager"` | Image to use for deploying. |
48+
| auth-server-key-rotation.image.repository | string | `"ghcr.io/janssenproject/jans/cloudtools"` | Image to use for deploying. |
4949
| auth-server-key-rotation.image.tag | string | `"0.0.0-nightly"` | Image tag to use for deploying. |
5050
| auth-server-key-rotation.initKeysLife | int | `48` | The initial auth server key rotation keys life in hours |
5151
| auth-server-key-rotation.keysLife | int | `48` | Auth server key rotation keys life in hours |
@@ -140,6 +140,30 @@ Kubernetes: `>=v1.22.0-0`
140140
| certManager.certificate.issuerName | string | `""` | |
141141
| certManager.certificate.tlsSecretName | string | `"tls-certificate"` | |
142142
| city | string | `"Austin"` | City. Used for certificate creation. |
143+
| cleanup | object | `{"additionalAnnotations":{},"additionalLabels":{},"customCommand":[],"customScripts":[],"dnsConfig":{},"dnsPolicy":"","enabled":true,"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"ghcr.io/janssenproject/jans/cloudtools","tag":"0.0.0-nightly"},"interval":60,"lifecycle":{},"limit":1000,"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Cleanup expired entries in persistence |
144+
| cleanup.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
145+
| cleanup.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
146+
| cleanup.customCommand | list | `[]` | Add custom job's command. If passed, it will override the default conditional command. |
147+
| cleanup.customScripts | list | `[]` | Add custom scripts that have been mounted to run before the entrypoint. - /tmp/custom.sh - /tmp/custom2.sh |
148+
| cleanup.dnsConfig | object | `{}` | Add custom dns config |
149+
| cleanup.dnsPolicy | string | `""` | Add custom dns policy |
150+
| cleanup.enabled | bool | `true` | Boolean flag to enable/disable the cleanup cronjob chart. |
151+
| cleanup.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
152+
| cleanup.image.pullSecrets | list | `[]` | Image Pull Secrets |
153+
| cleanup.image.repository | string | `"ghcr.io/janssenproject/jans/cloudtools"` | Image to use for deploying. |
154+
| cleanup.image.tag | string | `"0.0.0-nightly"` | Image tag to use for deploying. |
155+
| cleanup.interval | int | `60` | Interval of running the cleanup process (in minutes) |
156+
| cleanup.limit | int | `1000` | Max. numbers of entries to cleanup |
157+
| cleanup.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. |
158+
| cleanup.resources.limits.cpu | string | `"300m"` | CPU limit. |
159+
| cleanup.resources.limits.memory | string | `"300Mi"` | Memory limit. |
160+
| cleanup.resources.requests.cpu | string | `"300m"` | CPU request. |
161+
| cleanup.resources.requests.memory | string | `"300Mi"` | Memory request. |
162+
| cleanup.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service |
163+
| cleanup.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 |
164+
| cleanup.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 |
165+
| cleanup.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers |
166+
| cleanup.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod |
143167
| cnAwsConfigFile | string | `"/etc/jans/conf/aws_config_file"` | |
144168
| cnAwsSecretsReplicaRegionsFile | string | `"/etc/jans/conf/aws_secrets_replica_regions"` | |
145169
| cnAwsSharedCredentialsFile | string | `"/etc/jans/conf/aws_shared_credential_file"` | |
@@ -292,7 +316,7 @@ Kubernetes: `>=v1.22.0-0`
292316
| istio.ingress | bool | `false` | Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available. |
293317
| istio.namespace | string | `"istio-system"` | The namespace istio is deployed in. The is normally istio-system. |
294318
| istio.tlsSecretName | string | `"tls-certificate"` | |
295-
| kc-scheduler | object | `{"additionalAnnotations":{},"additionalLabels":{},"customCommand":[],"customScripts":[],"dnsConfig":{},"dnsPolicy":"","enabled":false,"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"ghcr.io/janssenproject/jans/kc-scheduler","tag":"0.0.0-nightly"},"interval":10,"lifecycle":{},"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Responsible for synchronizing Keycloak SAML clients |
319+
| kc-scheduler | object | `{"additionalAnnotations":{},"additionalLabels":{},"customCommand":[],"customScripts":[],"dnsConfig":{},"dnsPolicy":"","enabled":false,"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"ghcr.io/janssenproject/jans/cloudtools","tag":"0.0.0-nightly"},"interval":10,"lifecycle":{},"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Responsible for synchronizing Keycloak SAML clients |
296320
| kc-scheduler.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} |
297321
| kc-scheduler.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} |
298322
| kc-scheduler.customCommand | list | `[]` | Add custom job's command. If passed, it will override the default conditional command. |
@@ -302,7 +326,7 @@ Kubernetes: `>=v1.22.0-0`
302326
| kc-scheduler.enabled | bool | `false` | Boolean flag to enable/disable the kc-scheduler cronjob chart. |
303327
| kc-scheduler.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. |
304328
| kc-scheduler.image.pullSecrets | list | `[]` | Image Pull Secrets |
305-
| kc-scheduler.image.repository | string | `"ghcr.io/janssenproject/jans/kc-scheduler"` | Image to use for deploying. |
329+
| kc-scheduler.image.repository | string | `"ghcr.io/janssenproject/jans/cloudtools"` | Image to use for deploying. |
306330
| kc-scheduler.image.tag | string | `"0.0.0-nightly"` | Image tag to use for deploying. |
307331
| kc-scheduler.interval | int | `10` | Interval of running the scheduler (in minutes) |
308332
| kc-scheduler.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. |

‎charts/gluu-all-in-one/templates/cronjobs.yaml

+104-2
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ spec:
8686
resources:
8787
{{- toYaml (index .Values "auth-server-key-rotation" "resources") | nindent 16 }}
8888
{{- end }}
89-
args: ["patch", "auth", "--opts", "interval:{{ index .Values "auth-server-key-rotation" "keysLife" }}", "--opts", "key-strategy:{{ index .Values "auth-server-key-rotation" "keysStrategy" }}", "--opts", "privkey-push-delay:{{ index .Values "auth-server-key-rotation" "keysPushDelay" }}", "--opts", "privkey-push-strategy:{{ index .Values "auth-server-key-rotation" "keysPushStrategy" }}"]
89+
args: ["certmanager", "patch", "auth", "--opts", "interval:{{ index .Values "auth-server-key-rotation" "keysLife" }}", "--opts", "key-strategy:{{ index .Values "auth-server-key-rotation" "keysStrategy" }}", "--opts", "privkey-push-delay:{{ index .Values "auth-server-key-rotation" "keysPushDelay" }}", "--opts", "privkey-push-strategy:{{ index .Values "auth-server-key-rotation" "keysPushStrategy" }}"]
9090
volumes:
9191
{{- with (index .Values "auth-server-key-rotation" "volumes") }}
9292
{{- toYaml . | nindent 12 }}
@@ -148,7 +148,7 @@ spec:
148148
{{- toYaml . | replace "- " "" | nindent 20}}
149149
{{- end }}
150150
/app/bin/entrypoint.sh
151-
{{- end}}
151+
{{- end}}
152152
{{- end}}
153153
image: "{{ index .Values "kc-scheduler" "image" "repository" }}:{{ index .Values "kc-scheduler" "image" "tag" }}"
154154
env:
@@ -181,6 +181,7 @@ spec:
181181
resources:
182182
{{- toYaml (index .Values "kc-scheduler" "resources") | nindent 16 }}
183183
{{- end }}
184+
args: ["kc-sync"]
184185
volumes:
185186
{{- with (index .Values "kc-scheduler" "volumes") }}
186187
{{- toYaml . | nindent 12 }}
@@ -196,3 +197,104 @@ spec:
196197
- {{ .Values.fqdn }}
197198
{{- end }}
198199
{{- end }}
200+
201+
---
202+
203+
{{ if .Values.cleanup.enabled -}}
204+
kind: CronJob
205+
apiVersion: batch/v1
206+
metadata:
207+
name: {{ include "flex-all-in-one.fullname" . }}-cleanup
208+
namespace: {{ .Release.Namespace }}
209+
labels:
210+
app: {{ .Release.Name }}-{{ include "flex-all-in-one.name" . }}-cleanup
211+
{{ include "flex-all-in-one.labels" . | indent 4 }}
212+
{{- if (index .Values "cleanup" "additionalLabels") }}
213+
{{ toYaml (index .Values "cleanup" "additionalLabels") | indent 4 }}
214+
{{- end }}
215+
{{- if (index .Values "cleanup" "additionalAnnotations") }}
216+
annotations:
217+
{{ toYaml (index .Values "cleanup" "additionalAnnotations") | indent 4 }}
218+
{{- end }}
219+
spec:
220+
schedule: "@every {{ index .Values "cleanup" "interval" }}m"
221+
concurrencyPolicy: Forbid
222+
jobTemplate:
223+
spec:
224+
template:
225+
metadata:
226+
annotations:
227+
sidecar.istio.io/inject: "false"
228+
spec:
229+
{{- with (index .Values "cleanup" "image" "pullSecrets") }}
230+
imagePullSecrets:
231+
{{- toYaml . | nindent 8 }}
232+
{{- end }}
233+
dnsPolicy: {{ index .Values "cleanup" "dnsPolicy" | quote }}
234+
{{- with (index .Values "cleanup" "dnsConfig") }}
235+
dnsConfig:
236+
{{ toYaml . | indent 12 }}
237+
{{- end }}
238+
containers:
239+
- name: {{ include "flex-all-in-one.name" . }}-cleanup
240+
{{- if or (index .Values "cleanup" "customScripts") (index .Values "cleanup" "customCommand") }}
241+
command:
242+
{{- if index .Values "cleanup" "customCommand" }}
243+
{{- toYaml (index .Values "cleanup" "customCommand") | nindent 18 }}
244+
{{- else }}
245+
- /bin/sh
246+
- -c
247+
- |
248+
{{- with (index .Values "cleanup" "customScripts") }}
249+
{{- toYaml . | replace "- " "" | nindent 20}}
250+
{{- end }}
251+
/app/bin/entrypoint.sh
252+
{{- end}}
253+
{{- end}}
254+
image: "{{ index .Values "cleanup" "image" "repository" }}:{{ index .Values "cleanup" "image" "tag" }}"
255+
env:
256+
{{- include "flex-all-in-one.usr-envs" . | indent 16 }}
257+
{{- include "flex-all-in-one.usr-secret-envs" . | indent 16 }}
258+
imagePullPolicy: {{ index .Values "cleanup" "image" "pullPolicy" }}
259+
lifecycle:
260+
{{- toYaml (index .Values "cleanup" "lifecycle") | nindent 16 }}
261+
volumeMounts:
262+
{{- with (index .Values "cleanup" "volumeMounts") }}
263+
{{- toYaml . | nindent 16 }}
264+
{{- end }}
265+
{{- with (include "flex-all-in-one.config.schema" . | fromYaml).volumeMounts }}
266+
{{- toYaml . | nindent 16 }}
267+
{{- end }}
268+
envFrom:
269+
- configMapRef:
270+
name: {{ .Release.Name }}-config-cm
271+
{{ if .Values.usrEnvs.secret }}
272+
- secretRef:
273+
name: {{ .Release.Name }}-global-user-custom-envs
274+
{{- end }}
275+
{{ if .Values.usrEnvs.normal }}
276+
- configMapRef:
277+
name: {{ .Release.Name }}-global-user-custom-envs
278+
{{- end }}
279+
{{- if .Values.testEnviroment }}
280+
resources: {}
281+
{{- else }}
282+
resources:
283+
{{- toYaml (index .Values "cleanup" "resources") | nindent 16 }}
284+
{{- end }}
285+
args: ["cleanup", "--limit", "{{ .Values.cleanup.limit }}"]
286+
volumes:
287+
{{- with (index .Values "cleanup" "volumes") }}
288+
{{- toYaml . | nindent 12 }}
289+
{{- end }}
290+
{{- with (include "flex-all-in-one.config.schema" . | fromYaml).volumes }}
291+
{{- toYaml . | nindent 12 }}
292+
{{- end }}
293+
restartPolicy: Never
294+
{{- if not .Values.isFqdnRegistered }}
295+
hostAliases:
296+
- ip: {{ .Values.lbIp }}
297+
hostnames:
298+
- {{ .Values.fqdn }}
299+
{{- end }}
300+
{{- end }}

‎charts/gluu-all-in-one/values.yaml

+65-2
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@ auth-server-key-rotation:
310310
# -- Image pullPolicy to use for deploying.
311311
pullPolicy: IfNotPresent
312312
# -- Image to use for deploying.
313-
repository: ghcr.io/janssenproject/jans/certmanager
313+
repository: ghcr.io/janssenproject/jans/cloudtools
314314
# -- Image tag to use for deploying.
315315
tag: 0.0.0-nightly
316316
# -- Image Pull Secrets
@@ -809,7 +809,7 @@ kc-scheduler:
809809
# -- Image pullPolicy to use for deploying.
810810
pullPolicy: IfNotPresent
811811
# -- Image to use for deploying.
812-
repository: ghcr.io/janssenproject/jans/kc-scheduler
812+
repository: ghcr.io/janssenproject/jans/cloudtools
813813
# -- Image tag to use for deploying.
814814
tag: 0.0.0-nightly
815815
# -- Image Pull Secrets
@@ -851,3 +851,66 @@ kc-scheduler:
851851
customCommand: []
852852
# -- Boolean flag to enable/disable the kc-scheduler cronjob chart.
853853
enabled: false
854+
855+
# -- Cleanup expired entries in persistence
856+
cleanup:
857+
# -- Add custom normal and secret envs to the service
858+
usrEnvs:
859+
# -- Add custom normal envs to the service
860+
# variable1: value1
861+
normal: {}
862+
# -- Add custom secret envs to the service
863+
# variable1: value1
864+
secret: {}
865+
# -- Add custom dns policy
866+
dnsPolicy: ""
867+
# -- Add custom dns config
868+
dnsConfig: {}
869+
image:
870+
# -- Image pullPolicy to use for deploying.
871+
pullPolicy: IfNotPresent
872+
# -- Image to use for deploying.
873+
repository: ghcr.io/janssenproject/jans/cloudtools
874+
# -- Image tag to use for deploying.
875+
tag: 0.0.0-nightly
876+
# -- Image Pull Secrets
877+
pullSecrets: [ ]
878+
# -- Resource specs.
879+
resources:
880+
limits:
881+
# -- CPU limit.
882+
cpu: 300m
883+
# -- Memory limit.
884+
memory: 300Mi
885+
requests:
886+
# -- CPU request.
887+
cpu: 300m
888+
# -- Memory request.
889+
memory: 300Mi
890+
# -- Interval of running the cleanup process (in minutes)
891+
interval: 60
892+
# -- Max. numbers of entries to cleanup
893+
limit: 1000
894+
# -- Configure any additional volumes that need to be attached to the pod
895+
volumes: []
896+
# -- Configure any additional volumesMounts that need to be attached to the containers
897+
volumeMounts: []
898+
# Actions on lifecycle events such as postStart and preStop
899+
# Example
900+
# lifecycle:
901+
# postStart:
902+
# exec:
903+
# command: ["sh", "-c", "mkdir /opt/jans/jetty/jans-auth/custom/static/stylesheet/"]
904+
lifecycle: {}
905+
# -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"}
906+
additionalLabels: { }
907+
# -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"}
908+
additionalAnnotations: {}
909+
# -- Add custom scripts that have been mounted to run before the entrypoint.
910+
# - /tmp/custom.sh
911+
# - /tmp/custom2.sh
912+
customScripts: []
913+
# -- Add custom job's command. If passed, it will override the default conditional command.
914+
customCommand: []
915+
# -- Boolean flag to enable/disable the cleanup cronjob chart.
916+
enabled: true

0 commit comments

Comments
 (0)