Helm Charts

This repository contains the Helm charts for the invididual components and the umbrella chart for the full stack of components.

The deployed components are:

• GPP-App
• GPP-Burgerportaal
• GPP-Publicatiebank
• Open Zaak

Requirements

The requirements listed here are not included in the charts and you're responsible for provisioning them yourself.

• PostgreSQL database (version 13 or higher, 16 (latest) is recommended)
• An OpenID Connect identity provider for Single Sign On (optional)

Cheat sheet

helm repo add gpp-woo https://GPP-Woo.github.io/charts
helm repo update
helm install \
    -f myvalues.yml \
    my-gpp-woo \
    gpp-woo/gpp-stack

Assuming a values file myvalues.yml was created.

Elastic Search recommendations

GPP-zoeken requires Elastic Search (v8.x, tested with 8.17) to be deployed to function properly. We recommend installing Elastic Search in your cluster using their operator.

To deploy Elasticsearch with Elastic Cloud on Kubernetes (ECK), the cluster wide Custom Resource Definitions (CRDs) need to be present. They can be installed by a cluster administrator with (see the docs for more details):

helm install elastic-operator-crds elastic/eck-operator-crds

Since GPP-zoeken sends binary file content to Elastic Search, the following recommendations apply:

• Deploy at least 3 master nodes
• Ensure you have at least one node with data role.
• Ensure you have at least one node with ingest role, separate from the node(s) with data role. Depending on how frequently documents are uploaded, you may need to play around with the number of nodes.

TLS

You can have TLS enabled for communication between the nodes (transport layer) and TLS enabled for talking to the API (http layer).

If you don't expose Elasticsearch through an ingress, you can connect GPP-zoeken to its internal http endpoint.

Elasticsearch with ECK uses by default self-signed certificates with a custom CA (docs). The CA, the private key and the certificate are stored in secrets in the cluster. These are automatically generated by the eck-elasticsearch subchart.

The root certificate needs to be available to GPP-zoeken via the ELASTICSEARCH_CA_CERTS or the EXTRA_VERIFY_CERTS environment variables. The secret generated by the eck-elasticsearch subchart containing the CA and the certificate is mounted in the container of the GPP-zoeken app, the celery container and the job container (which initialises the indices) under the path /app/certs.