From 831b98b8ab40fe3efce4e6bf83b822d01a98e1bb Mon Sep 17 00:00:00 2001 From: jan-niklasml <182075087+jan-niklasml@users.noreply.github.com> Date: Fri, 21 Feb 2025 12:17:52 +0100 Subject: [PATCH 1/5] Script to update image tag in values.yaml --- update_image_version_in_values_yaml.py | 45 ++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 update_image_version_in_values_yaml.py diff --git a/update_image_version_in_values_yaml.py b/update_image_version_in_values_yaml.py new file mode 100644 index 0000000..d311a1e --- /dev/null +++ b/update_image_version_in_values_yaml.py @@ -0,0 +1,45 @@ +from packaging.version import Version +import ruamel.yaml +import argparse + +def increment_version(version): + v = Version(version) + return f"{v.major}.{v.minor}.{v.micro + 1}" + +parser = argparse.ArgumentParser(description='Upgrade Versions in values.yaml') +parser.add_argument('--pathToValuesYaml', help='Path to values.yaml') +parser.add_argument('--imageTag', help='New Image-Tag') +parser.add_argument('--pathToImageTagField', help='Path to Image-Tag Field in values.yaml file') +parser.add_argument('--pathToChart', help='Path to updated Chart.yaml') +args = parser.parse_args() + +yaml = ruamel.yaml.YAML() +yaml.preserve_quotes = True +yaml.indent(offset=2, sequence=4) +yaml.width = 100 + +# Load values.yaml file +with open(args.pathToValuesYaml, "r") as file: + values_yaml_data = yaml.load(file) + +# Update Image-Tag in values.yaml +keys = args.pathToImageTagField.split('.') +current_value = values_yaml_data +for key in keys[:-1]: + current_value = current_value.setdefault(key, {}) +current_value[keys[-1]] = args.imageTag + +# Write data to values.yaml +with open(args.pathToValuesYaml, "w") as file: + yaml.dump(values_yaml_data, file) + +# Load Chart.yaml +with open(args.pathToChart, "r") as file: + chart_file_data = yaml.load(file) + +# Update Chart version +chart_file_data["version"] = increment_version(chart_file_data["version"]) + +# Write data to Chart.yaml file +with open(args.pathToChart, "w") as file: + yaml.dump(chart_file_data, file) From 0b1e2182fcd73cd35d148dd8e716fb0bf8ad1322 Mon Sep 17 00:00:00 2001 From: Jan-Niklas <182075087+jan-niklasml@users.noreply.github.com> Date: Fri, 21 Feb 2025 12:30:27 +0100 Subject: [PATCH 2/5] values files for testing --- charts/sps-sample/charts/backend/values.yaml | 130 ++++++++++++++++++ charts/sps-sample/charts/frontend/values.yaml | 115 ++++++++++++++++ charts/sps-sample/values.yaml | 128 +++++++++++++++++ 3 files changed, 373 insertions(+) create mode 100644 charts/sps-sample/charts/backend/values.yaml create mode 100644 charts/sps-sample/charts/frontend/values.yaml create mode 100644 charts/sps-sample/values.yaml diff --git a/charts/sps-sample/charts/backend/values.yaml b/charts/sps-sample/charts/backend/values.yaml new file mode 100644 index 0000000..c4bb287 --- /dev/null +++ b/charts/sps-sample/charts/backend/values.yaml @@ -0,0 +1,130 @@ +global: + backend: + name: backend +# Default values for backend. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: ghcr.io/it-at-m/refarch/refarch-backend + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "latest" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Automatically mount a ServiceAccount's API credentials? + automount: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} +podLabels: {} + +podSecurityContext: + {} + # fsGroup: 2000 + +securityContext: + # Security-Settings recommended from https://github.com/Checkmarx/kics + capabilities: + drop: + - ALL + # readOnlyRootFilesystem: true + runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 8080 + +ingress: + enabled: false + className: "" + annotations: + {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +startupProbe: + httpGet: + path: /actuator/health + port: http + initialDelaySeconds: 60 +livenessProbe: + httpGet: + path: /actuator/health/liveness + port: http +readinessProbe: + httpGet: + path: /actuator/health/readiness + port: http + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +# Additional volumes on the output Deployment definition. +volumes: [] +# - name: foo +# secret: +# secretName: mysecret +# optional: false + +# Additional volumeMounts on the output Deployment definition. +volumeMounts: [] +# - name: foo +# mountPath: "/etc/foo" +# readOnly: true +# Additional env on the output Deployment definition. +env: [] +nodeSelector: {} + +tolerations: [] + +affinity: {} + +extraInitContainers: {} + +lifecycle: + preStop: + exec: + command: + - sh + - -c + - sleep 10 \ No newline at end of file diff --git a/charts/sps-sample/charts/frontend/values.yaml b/charts/sps-sample/charts/frontend/values.yaml new file mode 100644 index 0000000..9582296 --- /dev/null +++ b/charts/sps-sample/charts/frontend/values.yaml @@ -0,0 +1,115 @@ +global: + frontend: + name: frontend + +# Default values for frontend. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: nginx + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Automatically mount a ServiceAccount's API credentials? + automount: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} +podLabels: {} + +podSecurityContext: + {} + # fsGroup: 2000 + +securityContext: + # Security-Settings recommended from https://github.com/Checkmarx/kics + capabilities: + drop: + - ALL + # readOnlyRootFilesystem: true + runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 8080 + +ingress: + enabled: false + className: "" + annotations: + {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +livenessProbe: + httpGet: + path: / + port: http +readinessProbe: + httpGet: + path: / + port: http + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +# Additional volumes on the output Deployment definition. +volumes: [] +# - name: foo +# secret: +# secretName: mysecret +# optional: false + +# Additional volumeMounts on the output Deployment definition. +volumeMounts: [] +# - name: foo +# mountPath: "/etc/foo" +# readOnly: true + +nodeSelector: {} + +tolerations: [] + +affinity: {} \ No newline at end of file diff --git a/charts/sps-sample/values.yaml b/charts/sps-sample/values.yaml new file mode 100644 index 0000000..7459ace --- /dev/null +++ b/charts/sps-sample/values.yaml @@ -0,0 +1,128 @@ +global: + backend: + name: backend + frontend: + name: frontend + + +refarch-gateway: + envAppend: + ### Here you see the avaiable config for the apigateway + ### https://github.com/it-at-m/refarch/tree/main/refarch-gateway#configuration + - name: SPRING_PROFILES_ACTIVE + value: no-security # hazelcast-k8s + # - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTID + # valueFrom: + # secretKeyRef: + # key: sps-sample-dev + # name: sso-client-id + # - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_CLIENTSECRET + # valueFrom: + # secretKeyRef: + # key: sps-sample-dev + # name: sso-client-secret + # - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_PROVIDER + # value: 'sso' + # - name: SPRING_SECURITY_OAUTH2_RESOURCESERVER_JWT_ISSUERURI + # value: https://sso.muenchen.de/auth/realms/muenchen.de + # - name: SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_SSO_ISSUERURI + # value: '${spring.security.oauth2.resourceserver.jwt.issuer-uri}' + # - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_SSO_SCOPE + # value: 'profile, openid' + # - name: ALLOWED_ORIGINS_PUBLIC + # value: 'https://*.muenchen.de' + # - name: ALLOWED_ORIGINS_CLIENTS + # value: 'https://*.muenchen.de' + # - name: INFO_APPSWITCHER_URL + # value: 'https://appswitcher.muenchen.de/' + + - name: SPRING_CLOUD_GATEWAY_ROUTES_0_ID + value: backend + - name: SPRING_CLOUD_GATEWAY_ROUTES_0_URI + value: "http://{{ include \"backend.fullname\" . }}:8080/" + - name: SPRING_CLOUD_GATEWAY_ROUTES_0_PREDICATES_0 + value: Path=/api/beispielprojekt-backend-service/** + - name: SPRING_CLOUD_GATEWAY_ROUTES_0_FILTERS_0 + value: RewritePath=/api/beispielprojekt-backend-service/(?.*), /$\{urlsegments} + - name: SPRING_CLOUD_GATEWAY_ROUTES_0_FILTERS_1 + value: RemoveResponseHeader=WWW-Authenticate + + - name: SPRING_CLOUD_GATEWAY_ROUTES_1_ID + value: frontend + - name: SPRING_CLOUD_GATEWAY_ROUTES_1_URI + value: "http://{{ include \"frontend.fullname\" . }}:8080/" + - name: SPRING_CLOUD_GATEWAY_ROUTES_1_PREDICATES_0 + value: Path=/** + - name: SPRING_CLOUD_GATEWAY_ROUTES_1_FILTERS_0 + value: RewritePath=/(?.*), /$\{urlsegments} + - name: SPRING_CLOUD_GATEWAY_ROUTES_1_FILTERS_1 + value: RemoveResponseHeader=WWW-Authenticate + +## This ingress config is spezific to openshift. +## If you have plain kubernetes, you will need to change the annotations, className. + + ingress: + enabled: false + # annotations: + # route.openshift.io/termination: "edge" + # className: openshift-default + # hosts: + # - host: beispiel.muenchen.de + # paths: + # - path: / + # pathType: "ImplementationSpecific" + # backend: + # serviceName: '{{ include "refarch-gateway.fullname" . }}' + # servicePort: 8080 + +## Truststore +## If you have custome certificates you can add them in secret as truststore. +## The secret you can inject on the right position, so you can override the default truststore. + + # volumeMounts: + # - mountPath: /etc/pki/ca-trust/extracted/java + # name: cacerts-lhm + # readOnly: true + # volumes: + # - name: cacerts-lhm + # secret: + # defaultMode: 420 + # secretName: cacerts-lhm + # items: + # - key: cacerts-lhm + # path: cacerts +frontend: + image: + repository: ghcr.io/it-at-m/sps/sps-frontend + tag: "latest" + +backend: + image: + repository: ghcr.io/it-at-m/sps/sps-backend + tag: "latest" + env: + - name: GC_MAX_METASPACE_SIZE + value: "200" + - name: TZ + value: Europe/Berlin + - name: SPRING_PROFILES_ACTIVE + value: no-security # dev + # - name: REALM + # value: beispielprojekt + +## Truststore +## If you have custome certificates you can add them in secret as truststore. +## The secret you can inject on the right position, so you can override the default truststore. + + # volumeMounts: + # - mountPath: /etc/pki/ca-trust/extracted/java + # name: cacerts-lhm + # readOnly: true + # volumes: + # - name: cacerts-lhm + # secret: + # defaultMode: 420 + # secretName: cacerts-lhm + # items: + # - key: cacerts-lhm + # path: cacerts \ No newline at end of file From 3d02b0d71f7e950e007dee86eeebed74a5ff8b3a Mon Sep 17 00:00:00 2001 From: jan-niklasml <182075087+jan-niklasml@users.noreply.github.com> Date: Fri, 21 Feb 2025 12:55:12 +0100 Subject: [PATCH 3/5] Workflow to run python script --- .github/workflows/updateValues.yml | 65 ++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 .github/workflows/updateValues.yml diff --git a/.github/workflows/updateValues.yml b/.github/workflows/updateValues.yml new file mode 100644 index 0000000..ce2f500 --- /dev/null +++ b/.github/workflows/updateValues.yml @@ -0,0 +1,65 @@ +name: Update Image-Tag in values.yaml + +on: + workflow_dispatch: + inputs: + path-to-values-yaml: + description: "Path to values.yaml" + required: true + image-tag: + description: "New Image-Tag" + required: true + path-to-image-tag-field-in-file: + description: "Path/Keys to Image-Tag Field in values.yaml file" + required: true + path-to-chart-yaml: + description: "Path to Chart.yaml" + required: true +permissions: + contents: write + pull-requests: write +env: + GH_TOKEN: ${{ github.token }} + REPO_URL: "https://github.com/${{ github.repository }}" + PATH_TO_VALUES_FILE: ${{ inputs.path-to-values-yaml }} + IMAGE_TAG: ${{ inputs.image-tag }} + PATH_TO_IMAGE_TAG: ${{ inputs.path-to-image-tag-field-in-file }} + PATH_TO_CHART: ${{ inputs.path-to-chart-yaml }} + +jobs: + update-versions: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v2 + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.10' + - name: Install Python Packages + run: | + python -m pip install --upgrade pip + pip install -r requirements.txt + - name: Run Python script + run: python update_image_version_in_values_yaml.py --pathToValuesYaml $PATH_TO_VALUES_FILE --imageTag $IMAGE_TAG --pathToImageTagField $PATH_TO_IMAGE_TAG --pathToChart $PATH_TO_CHART + - name: Commit Files and create Pull-Request + run: | + git config --global user.name 'Your Name' + git config --global user.email 'your-username@users.noreply.github.com' + if [ -n "$(git status --porcelain)" ]; then + NEW_BRANCH="update-$PATH_TO_VALUES_FILE-$IMAGE_TAG" + PR_TITLE="Update Image-Tag in $PATH_TO_VALUES_FILE to $IMAGE_TAG" + PR_BODY="This PR updates the Image-Tag in [$PATH_TO_VALUES_FILE]($REPO_URL/blob/$NEW_BRANCH/$PATH_TO_VALUES_FILE) to `$IMAGE_TAG`" + git fetch --all + git commit -am "Update Image-Tag in $PATH_TO_VALUES_FILE to $IMAGE_TAG" + if git show-ref --verify --quiet refs/remotes/origin/$NEW_BRANCH; then + git checkout $NEW_BRANCH + git pull + else + git checkout -b $NEW_BRANCH + fi + git push --set-upstream origin $NEW_BRANCH + gh pr create --base main --head $NEW_BRANCH --title "$PR_TITLE" --body "$PR_BODY" + else + echo "No changes to commit" + fi From e4a24edbfa2d4499769d803f32da365a3cf14d94 Mon Sep 17 00:00:00 2001 From: jan-niklasml <182075087+jan-niklasml@users.noreply.github.com> Date: Fri, 21 Feb 2025 12:58:06 +0100 Subject: [PATCH 4/5] Rename updateValues.yml to updateImageTag.yml --- .github/workflows/{updateValues.yml => updateImageTag.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{updateValues.yml => updateImageTag.yml} (100%) diff --git a/.github/workflows/updateValues.yml b/.github/workflows/updateImageTag.yml similarity index 100% rename from .github/workflows/updateValues.yml rename to .github/workflows/updateImageTag.yml From 7a391598125cb1c8449c0cc68d2af8a42a2db3a8 Mon Sep 17 00:00:00 2001 From: jan-niklasml <182075087+jan-niklasml@users.noreply.github.com> Date: Fri, 21 Feb 2025 13:04:10 +0100 Subject: [PATCH 5/5] Update updateImageTag.yml --- .github/workflows/updateImageTag.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/updateImageTag.yml b/.github/workflows/updateImageTag.yml index ce2f500..d821cd5 100644 --- a/.github/workflows/updateImageTag.yml +++ b/.github/workflows/updateImageTag.yml @@ -49,7 +49,7 @@ jobs: if [ -n "$(git status --porcelain)" ]; then NEW_BRANCH="update-$PATH_TO_VALUES_FILE-$IMAGE_TAG" PR_TITLE="Update Image-Tag in $PATH_TO_VALUES_FILE to $IMAGE_TAG" - PR_BODY="This PR updates the Image-Tag in [$PATH_TO_VALUES_FILE]($REPO_URL/blob/$NEW_BRANCH/$PATH_TO_VALUES_FILE) to `$IMAGE_TAG`" + PR_BODY="This PR updates the Image-Tag in [$PATH_TO_VALUES_FILE]($REPO_URL/blob/$NEW_BRANCH/$PATH_TO_VALUES_FILE) to $IMAGE_TAG" git fetch --all git commit -am "Update Image-Tag in $PATH_TO_VALUES_FILE to $IMAGE_TAG" if git show-ref --verify --quiet refs/remotes/origin/$NEW_BRANCH; then