ci: use oci

.drone.yml

@@ -5,17 +5,18 @@ name: default
 
 trigger:
   event:
-    - push
+  - push
+  - tag
 
 steps:
-  - name: release
+- name: release
-    image: cr.grachevko.ru/drone/helm:RELEASE.2023-03-01T13-46-55Z
+  image: cr.grachevko.ru/drone/helm:24
-    settings:
+  settings:
-      username:
+    tag: ${DRONE_TAG}
-        from_secret: HELM_REPO_USERNAME
+    username:
-      password:
+      from_secret: HELM_REPO_USERNAME
-        from_secret: HELM_REPO_PASSWORD
+    password:
-    when:
+      from_secret: HELM_REPO_PASSWORD
-      branch:
+  when:
-        - master
+    event:
-        - rc
+    - tag

.github/workflows/main.yaml

@@ -8,15 +8,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+    - uses: actions/checkout@v2
 
-      - name: Install Helm
+    - name: Install Helm
-        run: |
+      run: |
-          curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
+        curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
-          helm plugin install https://github.com/hayorov/helm-gcs
+        helm plugin install https://github.com/hayorov/helm-gcs
-      - name: Lint chart
+    - name: Lint chart
-        run: |
+      run: |
-          helm lint .
+        helm lint .
 
   release:
     needs: lint
@@ -24,22 +24,22 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+    - uses: actions/checkout@v2
 
-      - name: Install Helm
+    - name: Install Helm
-        run: |
+      run: |
-          curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
+        curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
-          helm plugin install https://github.com/hayorov/helm-gcs
+        helm plugin install https://github.com/hayorov/helm-gcs
-      - name: Dump GCloud auth key
+    - name: Dump GCloud auth key
-        run: |
+      run: |
-          cat <<'EOF' > gcloud_auth_key.json
+        cat <<'EOF' > gcloud_auth_key.json
-          ${{ secrets.GCLOUD_AUTH_KEY }}
+        ${{ secrets.GCLOUD_AUTH_KEY }}
-          EOF
+        EOF
-      - name: Release chart
+    - name: Release chart
-        env:
+      env:
-          GOOGLE_APPLICATION_CREDENTIALS: ${{ github.workspace }}/gcloud_auth_key.json
+        GOOGLE_APPLICATION_CREDENTIALS: ${{ github.workspace }}/gcloud_auth_key.json
-        run: |
+      run: |
-          helm repo add hahow gs://hahow-helm-charts
+        helm repo add hahow gs://hahow-helm-charts
-          helm repo update
+        helm repo update
-          PACKAGE_FILE_PATH=$(helm package . | sed 's/^Successfully packaged chart and saved it to: //')
+        PACKAGE_FILE_PATH=$(helm package . | sed 's/^Successfully packaged chart and saved it to: //')
-          helm gcs push $(basename ${PACKAGE_FILE_PATH}) hahow --public
+        helm gcs push $(basename ${PACKAGE_FILE_PATH}) hahow --public

README.md

@@ -19,7 +19,8 @@ dependencies:
     repository: https://harbor.grachevko.ru/chartrepo/helm
 ```
 
-Once you have defined dependencies, you should run the following command to download this chart into your `charts/` directory:
+Once you have defined dependencies, you should run the following command to download this chart into your `charts/`
+directory:
 
 ```shell
 $ helm dep build
@@ -61,13 +62,15 @@ helm.sh/chart: foo-1.2.3-beta.55_1234
 
 ### `common.fullname`
 
-The `common.fullname` template generates a name suitable for the `name:` field in Kubernetes metadata. It is used like this:
+The `common.fullname` template generates a name suitable for the `name:` field in Kubernetes metadata. It is used like
+this:
 
 ```yaml
 name: { { include "common.fullname" . } }
 ```
 
-This prints the value of `{{ .Release.Name }}-{{ .Chart.Name }}` by default, but can be overridden with `.Values. fullnameOverride`:
+This prints the value of `{{ .Release.Name }}-{{ .Chart.Name }}` by default, but can be overridden
+with `.Values. fullnameOverride`:
 
 ```yaml
 fullnameOverride: some-name
@@ -142,7 +145,8 @@ metadata:
   name: release-name-mychart
 ```
 
-Most of the common templates that define a resource type (e.g. `common.configMap` or `common.cronJob`) use this to generate the metadata, which means they inherit the same `labels` and `name` fields.
+Most of the common templates that define a resource type (e.g. `common.configMap` or `common.cronJob`) use this to
+generate the metadata, which means they inherit the same `labels` and `name` fields.
 
 ### `common.name`
 

starter/templates/deployment.yaml

@@ -24,47 +24,52 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.image.pullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
-        - name: {{ .Chart.Name }}
+      - name: {{ .Chart.Name }}
-          securityContext:
+        securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+        image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
-          envFrom:
+        envFrom:
-            - configMapRef:
+          {{- if .Values.existingConfigmap }}
-                name: {{ include "common.fullname" . }}
+        - configMapRef:
-          {{- if .Values.extraEnvVarsSecret }}
+            name: {{ .Values.existingConfigmap }}
-            - secretRef:
-                name: {{ .Values.extraEnvVarsSecret }}
           {{- else }}
-            - secretRef:
+        - configMapRef:
-                name: {{ include "common.fullname" . }}
+            name: {{ include "common.fullname" . }}
           {{- end }}
-          ports:
+          {{- if .Values.existingSecret }}
-            - name: http
+        - secretRef:
-              containerPort: 5678
+            name: {{ .Values.existingSecret }}
-              protocol: TCP
+          {{- else }}
-          livenessProbe:
+        - secretRef:
-            httpGet:
+            name: {{ include "common.fullname" . }}
-              path: /healthz
+          {{- end }}
-              port: http
+          {{- if .Values.extraEnvVarsSecret }}
-          readinessProbe:
+        - secretRef:
-            httpGet:
+            name: {{ .Values.extraEnvVarsSecret }}
-              path: /healthz
+          {{- end }}
-              port: http
+        ports:
-          startupProbe:
+        - name: http
-            httpGet:
+          containerPort: 5678
-              path: /healthz
+          protocol: TCP
-              port: http
+        livenessProbe:
-            failureThreshold: 30
+          httpGet:
-            periodSeconds: 10
+            path: /healthz
-          resources:
+            port: http
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+        startupProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          failureThreshold: 30
+          periodSeconds: 10
+        resources:
             {{- toYaml .Values.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
       nodeSelector:

starter/templates/ingress.yaml

@@ -16,26 +16,26 @@ spec:
   {{- if .Values.ingress.tls }}
   tls:
     {{- range .Values.ingress.tls }}
-    - hosts:
+  - hosts:
         {{- range .hosts }}
-        - {{ . | quote }}
+    - {{ . | quote }}
         {{- end }}
-      secretName: {{ .secretName }}
+    secretName: {{ .secretName }}
     {{- end }}
   {{- end }}
   rules:
     {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
+  - host: {{ .host | quote }}
-      http:
+    http:
-        paths:
+      paths:
           {{- range .paths }}
-          - path: {{ .path }}
+      - path: {{ .path }}
-            pathType: {{ default "ImplementationSpecific" .pathType }}
+        pathType: {{ default "ImplementationSpecific" .pathType }}
-            backend:
+        backend:
-              service:
+          service:
-                name: {{ $fullName }}
+            name: {{ $fullName }}
-                port:
+            port:
-                  number: {{ $svcPort }}
+              number: {{ $svcPort }}
           {{- end }}
     {{- end }}
 {{- end }}

starter/templates/service.yaml

@@ -7,9 +7,9 @@ metadata:
 spec:
   type: {{ .Values.service.type }}
   ports:
-    - port: {{ .Values.service.port }}
+  - port: {{ .Values.service.port }}
-      targetPort: http
+    targetPort: http
-      protocol: TCP
+    protocol: TCP
-      name: http
+    name: http
   selector:
     {{- include "common.selectorLabels" . | nindent 4 }}

starter/templates/tests/test-connection.yaml

@@ -8,8 +8,8 @@ metadata:
     "helm.sh/hook": test-success
 spec:
   containers:
-    - name: wget
+  - name: wget
-      image: busybox
+    image: busybox
-      command: ['wget']
+    command: ['wget']
-      args: ['{{ include "common.fullname" . }}:{{ .Values.service.port }}']
+    args: ['{{ include "common.fullname" . }}:{{ .Values.service.port }}']
   restartPolicy: Never

starter/values.yaml

@@ -12,9 +12,9 @@ extraEnvVarsSecret:
 replicaCount: 1
 
 image:
+  registry: docker.io
   repository: nginx
   pullPolicy: IfNotPresent
-  pullSecrets: []
   # Overrides the image tag whose default is the chart appVersion.
   tag: ""
 
@@ -50,6 +50,11 @@ service:
 
 ingress:
   enabled: false
+  ## @param ingress.ingressClassName IngressClass that will be used to implement the Ingress (Kubernetes 1.18+)
+  ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster.
+  ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
+  ##
+  ingressClassName: ""
   annotations: {}
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"

templates/_secrets.tpl

@@ -87,7 +87,7 @@ The order in which this function returns a secret password:
 {{- $password := "" }}
 {{- $subchart := "" }}
 {{- $chartName := default "" .chartName }}
-{{- $passwordLength := default 10 .length }}
+{{- $passwordLength := default 32 .length }}
 {{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }}
 {{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }}
 {{- $secretData := (lookup "v1" "Secret" (include "common.namespace" .context) .secret).data }}
@@ -115,6 +115,8 @@ The order in which this function returns a secret password:
     {{- $password = randAscii $passwordLength }}
     {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }}
     {{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }}
+  {{- else if .hex }}
+    {{- $password = include "common.secrets.randHex" $passwordLength | b64enc | quote }}
   {{- else }}
     {{- $password = randAlphaNum $passwordLength | b64enc | quote }}
   {{- end }}
@@ -122,6 +124,23 @@ The order in which this function returns a secret password:
 {{- printf "%s" $password -}}
 {{- end -}}
 
+{{- /*
+    Returns given number of random Hex characters.
+    - randNumeric 4 | atoi generates a random number in [0, 10^4)
+      This is a range evenly divisble by 16, but even if off by one,
+      that last partial interval offsetting randomness is only 1 part in 625.
+    - mod N 16 maps to the range 0-15
+    - printf "%x" represents a single number 0-15 as a single hex character
+*/}}
+{{- define "common.secrets.randHex" -}}
+    {{- $result := "" }}
+    {{- range $i := until . }}
+        {{- $rand_hex_char := mod (randNumeric 4 | atoi) 16 | printf "%x" }}
+        {{- $result = print $result $rand_hex_char }}
+    {{- end }}
+    {{- $result }}
+{{- end }}
+
 {{/*
 Reuses the value from an existing secret, otherwise sets its value to a default value.