diff --git a/apps-helm/code-server/.helmignore b/apps-helm/code-server/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/apps-helm/code-server/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/apps-helm/code-server/Chart.yaml b/apps-helm/code-server/Chart.yaml new file mode 100644 index 0000000..01a24f0 --- /dev/null +++ b/apps-helm/code-server/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +name: code-server +description: A Helm chart for coder/code-server + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 3.3.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +appVersion: 4.8.0 diff --git a/apps-helm/code-server/templates/NOTES.txt b/apps-helm/code-server/templates/NOTES.txt new file mode 100644 index 0000000..45c9aed --- /dev/null +++ b/apps-helm/code-server/templates/NOTES.txt @@ -0,0 +1,24 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "code-server.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "code-server.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "code-server.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl port-forward --namespace {{ .Release.Namespace }} service/{{ include "code-server.fullname" . }} 8080:http +{{- end }} + +Administrator credentials: + + Password: echo $(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "code-server.fullname" . }} -o jsonpath="{.data.password}" | base64 --decode) diff --git a/apps-helm/code-server/templates/_helpers.tpl b/apps-helm/code-server/templates/_helpers.tpl new file mode 100644 index 0000000..bb36e8c --- /dev/null +++ b/apps-helm/code-server/templates/_helpers.tpl @@ -0,0 +1,63 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "code-server.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "code-server.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "code-server.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "code-server.labels" -}} +helm.sh/chart: {{ include "code-server.chart" . }} +{{ include "code-server.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "code-server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "code-server.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "code-server.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "code-server.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/apps-helm/code-server/templates/deployment.yaml b/apps-helm/code-server/templates/deployment.yaml new file mode 100644 index 0000000..7892a6a --- /dev/null +++ b/apps-helm/code-server/templates/deployment.yaml @@ -0,0 +1,173 @@ +{{ $secretName := include "code-server.fullname" . }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "code-server.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "code-server.name" . }} + helm.sh/chart: {{ include "code-server.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: {{ include "code-server.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + labels: + app.kubernetes.io/name: {{ include "code-server.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + spec: + imagePullSecrets: {{- toYaml .Values.imagePullSecrets | nindent 8 }} + {{- if .Values.hostnameOverride }} + hostname: {{ .Values.hostnameOverride }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} + {{- if .Values.securityContext.enabled }} + securityContext: + fsGroup: {{ .Values.securityContext.fsGroup }} + {{- end }} + {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }} + initContainers: + - name: init-chmod-data + image: busybox:latest + imagePullPolicy: IfNotPresent + command: + - sh + - -c + - | + chown -R {{ .Values.securityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} /home/coder + securityContext: + runAsUser: {{ .Values.volumePermissions.securityContext.runAsUser }} + volumeMounts: + - name: data + mountPath: /home/coder +{{- if .Values.extraInitContainers }} +{{ tpl .Values.extraInitContainers . | indent 6}} +{{- end }} + {{- end }} + containers: +{{- if .Values.extraContainers }} +{{ tpl .Values.extraContainers . | indent 8}} +{{- end }} + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.securityContext.enabled }} + securityContext: + runAsUser: {{ .Values.securityContext.runAsUser }} + {{- end }} + {{- if .Values.lifecycle.enabled }} + lifecycle: + {{- if .Values.lifecycle.postStart }} + postStart: + {{ toYaml .Values.lifecycle.postStart | nindent 14 }} + {{- end }} + {{- if .Values.lifecycle.preStop }} + preStop: + {{ toYaml .Values.lifecycle.preStop | nindent 14 }} + {{- end }} + {{- end }} + env: + {{- if .Values.extraVars }} +{{ toYaml .Values.extraVars | indent 10 }} + {{- end }} + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.secret.secretName | default $secretName }} + key: {{ .Values.secret.passwordField | default "password" }} + {{- if .Values.extraArgs }} + args: +{{ toYaml .Values.extraArgs | indent 10 }} + {{- end }} + volumeMounts: + - name: data + mountPath: /home/coder + {{- range .Values.extraConfigmapMounts }} + - name: {{ .name }} + mountPath: {{ .mountPath }} + subPath: {{ .subPath | default "" }} + readOnly: {{ .readOnly }} + {{- end }} + {{- range .Values.extraSecretMounts }} + - name: {{ .name }} + mountPath: {{ .mountPath }} + readOnly: {{ .readOnly }} + {{- end }} + {{- range .Values.extraVolumeMounts }} + - name: {{ .name }} + mountPath: {{ .mountPath }} + subPath: {{ .subPath | default "" }} + readOnly: {{ .readOnly }} + {{- end }} + ports: + - name: http + containerPort: 8080 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- tpl . $ | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "code-server.serviceAccountName" . }} + volumes: + - name: data + {{- if .Values.persistence.enabled }} + {{- if not .Values.persistence.hostPath }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim | default (include "code-server.fullname" .) }} + {{- else }} + hostPath: + path: {{ .Values.persistence.hostPath }} + type: Directory + {{- end -}} + {{- else }} + emptyDir: {} + {{- end -}} + {{- range .Values.extraSecretMounts }} + - name: {{ .name }} + secret: + secretName: {{ .secretName }} + defaultMode: {{ .defaultMode }} + {{- end }} + {{- range .Values.extraConfigmapMounts }} + - name: {{ .name }} + configMap: + name: {{ .configMap }} + defaultMode: {{ .defaultMode }} + {{- end }} + {{- range .Values.extraVolumeMounts }} + - name: {{ .name }} + {{- if .existingClaim }} + persistentVolumeClaim: + claimName: {{ .existingClaim }} + {{- else }} + hostPath: + path: {{ .hostPath }} + type: Directory + {{- end }} + {{- end }} diff --git a/apps-helm/code-server/templates/ingress.yaml b/apps-helm/code-server/templates/ingress.yaml new file mode 100644 index 0000000..1da4320 --- /dev/null +++ b/apps-helm/code-server/templates/ingress.yaml @@ -0,0 +1,63 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "code-server.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "code-server.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.ingress.ingressClassName }} + ingressClassName: {{ .Values.ingress.ingressClassName }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion -}} + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ . }} + pathType: Prefix + backend: + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- end }} + {{- end }} + {{- else -}} + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ . }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/apps-helm/code-server/templates/pvc.yaml b/apps-helm/code-server/templates/pvc.yaml new file mode 100644 index 0000000..2f1c874 --- /dev/null +++ b/apps-helm/code-server/templates/pvc.yaml @@ -0,0 +1,29 @@ +{{- if and (and .Values.persistence.enabled (not .Values.persistence.existingClaim)) (not .Values.persistence.hostPath) }} +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ include "code-server.fullname" . }} + namespace: {{ .Release.Namespace }} +{{- with .Values.persistence.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} + labels: + app.kubernetes.io/name: {{ include "code-server.name" . }} + helm.sh/chart: {{ include "code-server.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +spec: + accessModes: + - {{ .Values.persistence.accessMode | quote }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} +{{- if .Values.persistence.storageClass }} +{{- if (eq "-" .Values.persistence.storageClass) }} + storageClassName: "" +{{- else }} + storageClassName: "{{ .Values.persistence.storageClass }}" +{{- end }} +{{- end }} +{{- end }} diff --git a/apps-helm/code-server/templates/secrets.yaml b/apps-helm/code-server/templates/secrets.yaml new file mode 100644 index 0000000..6038cc0 --- /dev/null +++ b/apps-helm/code-server/templates/secrets.yaml @@ -0,0 +1,19 @@ +{{ if or .Values.secret.generate .Values.secret.hardcoded -}} +{{ $secretName := include "code-server.fullname" . }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.secret.secretName | default $secretName }} + labels: + app.kubernetes.io/name: {{ include "code-server.name" . }} + helm.sh/chart: {{ include "code-server.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +type: Opaque +data: + {{ if .Values.secret.hardcoded }} + {{ .Values.secret.passwordField | default "password"}}: "{{ .Values.secret.hardcoded | b64enc }}" + {{ else }} + {{ .Values.secret.passwordField | default "password"}}: "{{ randAlphaNum 24 | b64enc }}" + {{ end }} +{{ end }} diff --git a/apps-helm/code-server/templates/service.yaml b/apps-helm/code-server/templates/service.yaml new file mode 100644 index 0000000..038b6cd --- /dev/null +++ b/apps-helm/code-server/templates/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "code-server.fullname" . }} + labels: + app.kubernetes.io/name: {{ include "code-server.name" . }} + helm.sh/chart: {{ include "code-server.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: {{ include "code-server.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/apps-helm/code-server/templates/serviceaccount.yaml b/apps-helm/code-server/templates/serviceaccount.yaml new file mode 100644 index 0000000..df9e1e3 --- /dev/null +++ b/apps-helm/code-server/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if or .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/name: {{ include "code-server.name" . }} + helm.sh/chart: {{ include "code-server.chart" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + name: {{ template "code-server.serviceAccountName" . }} +{{- end -}} diff --git a/apps-helm/code-server/values.yaml b/apps-helm/code-server/values.yaml new file mode 100644 index 0000000..4aa558c --- /dev/null +++ b/apps-helm/code-server/values.yaml @@ -0,0 +1,204 @@ +# Default values for code-server. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: codercom/code-server + tag: '4.8.0' + pullPolicy: Always + +secret: + generate: true + #hardcoded: hunter2 + #secretName: changeSecretName + #passwordField: password + +# Specifies one or more secrets to be used when pulling images from a +# private container repository +# https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry +imagePullSecrets: [] +# - name: registry-creds + +nameOverride: "" +fullnameOverride: "" +hostnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +priorityClassName: "" + +service: + type: ClusterIP + port: 8080 + +ingress: + enabled: false + #annotations: + # kubernetes.io/tls-acme: "true" + #hosts: + # - host: code-server.example.loc + # paths: + # - / + ingressClassName: "" + #tls: + # - secretName: code-server + # hosts: + # - code-server.example.loc + +# Optional additional arguments +extraArgs: [] + # These are the arguments normally passed to code-server; run + # code-server --help for a list of available options. + # + # Each argument and parameter must have its own entry; if you use + # --param value on the command line, then enter it here as: + # + # - --param + # - value + # + # If you receive an error like "Unknown option --param value", it may be + # because both the parameter and value are specified as a single argument, + # rather than two separate arguments (e.g. "- --param value" on a line). + +# Optional additional environment variables +extraVars: [] +# - name: DISABLE_TELEMETRY +# value: true +# - name: DOCKER_HOST +# value: "tcp://localhost:2375" + +## +## Init containers parameters: +## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup +## +volumePermissions: + enabled: true + securityContext: + runAsUser: 0 + +## Pod Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +## +securityContext: + enabled: true + fsGroup: 1000 + runAsUser: 1000 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 1000Mi + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +## Persist data to a persistent volume +persistence: + enabled: true + ## code-server data Persistent Volume Storage Class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is + ## set, choosing the default provisioner. (gp2 on AWS, standard on + ## GKE, AWS & OpenStack) + ## + # storageClass: "-" + accessMode: ReadWriteOnce + size: 10Gi + annotations: {} + # existingClaim: "" + # hostPath: /data + +lifecycle: + enabled: false + # postStart: + # exec: + # command: + # - /bin/bash + # - -c + # - curl -s -L SOME_SCRIPT | bash + +## Enable an Specify container in extraContainers. +## This is meant to allow adding code-server dependencies, like docker-dind. +extraContainers: | +# If docker-dind is used, DOCKER_HOST env is mandatory to set in "extraVars" +#- name: docker-dind +# image: docker:19.03-dind +# imagePullPolicy: IfNotPresent +# resources: +# requests: +# cpu: 250m +# memory: 256M +# securityContext: +# privileged: true +# procMount: Default +# env: +# - name: DOCKER_TLS_CERTDIR +# value: "" +# - name: DOCKER_DRIVER +# value: "overlay2" + +extraInitContainers: | +# - name: customization +# image: {{ .Values.image.repository }}:{{ .Values.image.tag }} +# imagePullPolicy: IfNotPresent +# env: +# - name: SERVICE_URL +# value: https://open-vsx.org/vscode/gallery +# - name: ITEM_URL +# value: https://open-vsx.org/vscode/item +# command: +# - sh +# - -c +# - | +# code-server --install-extension ms-python.python +# code-server --install-extension golang.Go +# volumeMounts: +# - name: data +# mountPath: /home/coder + +## Additional code-server secret mounts +extraSecretMounts: [] + # - name: secret-files + # mountPath: /etc/secrets + # secretName: code-server-secret-files + # readOnly: true + +## Additional code-server volume mounts +extraVolumeMounts: [] + # - name: extra-volume + # mountPath: /mnt/volume + # readOnly: true + # existingClaim: volume-claim + # hostPath: "" + +extraConfigmapMounts: [] + # - name: certs-configmap + # mountPath: /etc/code-server/ssl/ + # subPath: certificates.crt # (optional) + # configMap: certs-configmap + # readOnly: true