Small tweaks

.gitlab-ci.yml

@@ -0,0 +1,35 @@
+package-helm-chart:
+  stage: build
+  image:
+    name: dtzar/helm-kubectl:3.12.3
+  before_script:
+    - >
+      echo ${CI_REGISTRY_PASSWORD} |
+      helm registry login
+      --username gitlab-ci-token
+      --password-stdin
+      ${CI_REGISTRY}
+  script:
+    - mkdir packages
+    - "CHART_VERSION=$(helm show chart helm-chart | grep '^version:' | sed 's/version: //')"
+    - |
+      if [[ -n "${CI_COMMIT_TAG}" ]]
+      then
+        VERSION=${CI_COMMIT_TAG}
+      else
+        VERSION=${CHART_VERSION}-pre-${CI_COMMIT_REF_SLUG}
+      fi
+    - >
+      helm package helm-chart
+      --destination packages
+      --dependency-update
+      --version="${VERSION}"
+    - |
+      echo $CI_REGISTRY_IMAGE
+      for chart in packages/*.tgz
+      do
+        helm push $chart "oci://${CI_REGISTRY_IMAGE}/helm"
+      done
+  rules:
+    - if: $CI_COMMIT_TAG
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

helm-chart/requirements.lock → helm-chart/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: rabbitmq
   repository: https://charts.bitnami.com/bitnami
-  version: 11.9.3
+  version: 12.1.3
 - name: rabbitmq
   repository: https://charts.bitnami.com/bitnami
-  version: 11.9.3
+  version: 12.1.3
 - name: postgresql
   repository: https://charts.bitnami.com/bitnami
-  version: 11.6.26
-digest: sha256:9f700ddcd4c0ad2f0e36b82c423ad71635e23686869f4c9f886d2a1fdd824886
-generated: "2023-02-19T16:16:56.258862178+01:00"
+  version: 12.10.0
+digest: sha256:7c0fecea0dd720939476b5fb35c83139496652448886c852e18a88af2e68c9ce
+generated: "2023-09-02T23:35:24.214489+02:00"

helm-chart/Chart.yaml

@@ -1,7 +1,7 @@
-apiVersion: v1
+apiVersion: v2
 name: taiga
 appVersion: 6.0.0-latest
-version: 0.0.11
+version: 0.0.12
 description: A flexible project management web application.
 engine: gotpl
 home: https://www.taiga.io/
@@ -16,3 +16,18 @@ keywords:
 - python
 sources:
 - https://github.com/taigaio/taiga-docker
+dependencies:
+- name: rabbitmq
+  version: ^12.1.2
+  repository: https://charts.bitnami.com/bitnami
+  alias: async-rabbitmq
+  condition: rabbitmq.enabled
+- name: rabbitmq
+  version: ^12.1.2
+  repository: https://charts.bitnami.com/bitnami
+  alias: events-rabbitmq
+  condition: rabbitmq.enabled
+- name: postgresql
+  version: ^12.10.0
+  repository: https://charts.bitnami.com/bitnami
+  condition: postgresql.enabled

helm-chart/README.md

@@ -1 +1,19 @@
-Is mandatory to deploy taiga as taiga as chart name becase some names (related to rabbitmq, take a look to `settings/config.py`) cannot be parametrized in docker images.
+# Taiga 6 Helm chart
+
+
+## Known limitations
+
+Is mandatory to deploy taiga as taiga as chart name becase some names (related
+to rabbitmq, take a look to `settings/config.py`) cannot be parametrized in
+docker images.
+
+
+## Volume handling
+
+The chart does by default deploy two `PersistentVolumeClaim` (PVC) resources:
+
+- `tagia-media` - This holds the media files. These files are content of the
+  users, comparable to the content of the database.
+
+- `taiga-static` - This holds static files which are filled by utility
+  `collectstatic` of the Django framework.

helm-chart/templates/back-deployment.yaml

@@ -46,7 +46,7 @@ spec:
           - name: POSTGRES_PASSWORD
             value: "{{ .Values.postgresql.auth.password }}"
           - name: POSTGRES_HOST
-            value: "{{ template "taiga.fullname" . }}-postgresql"
+            value: {{ default (printf "%s-postgresql" (include "taiga.fullname" .)) .Values.postgresql.host | quote }}
           - name: TAIGA_SECRET_KEY
             value: "{{ .Values.secretKey }}"
           {{ if .Values.ingress.enabled }}
@@ -181,7 +181,7 @@ spec:
             value: "False"
           {{ end }}
           {{- if .Values.back.extraVars }}
-          {{- toYaml .Values.back.extraVars | nindent 12 }}
+          {{- toYaml .Values.back.extraVars | nindent 10 }}
           {{- end }}
         ports:
           - name: taiga-back
@@ -215,6 +215,7 @@ spec:
             mountPath: /taiga-back/static
           - name: taiga-media
             mountPath: /taiga-back/media
+
       # https://www.caktusgroup.com/blog/2017/03/14/production-ready-dockerfile-your-python-django-app/
       - name: {{ template "taiga.fullname" . }}-async
         image: {{ template "taiga.async.image" . }}
@@ -226,13 +227,13 @@ spec:
         - /taiga-back/docker/async_entrypoint.sh
         env:
           - name: POSTGRES_DB
-            value: "{{ .Values.postgresql.postgresqlDatabase }}"
+            value: "{{ .Values.postgresql.auth.database }}"
           - name: POSTGRES_USER
-            value: "{{ .Values.postgresql.postgresqlUsername }}"
+            value: "{{ .Values.postgresql.auth.username }}"
           - name: POSTGRES_PASSWORD
-            value: "{{ .Values.postgresql.postgresqlPassword }}"
+            value: "{{ .Values.postgresql.auth.password }}"
           - name: POSTGRES_HOST
-            value: "{{ template "taiga.fullname" . }}-postgresql"
+            value: {{ default (printf "%s-postgresql" (include "taiga.fullname" .)) .Values.postgresql.host | quote }}
           - name: TAIGA_SECRET_KEY
             value: "{{ .Values.secretKey }}"
           {{ if .Values.ingress.enabled }}
@@ -359,7 +360,7 @@ spec:
             value: "False"
           {{ end }}
           {{- if .Values.async.extraVars }}
-          {{- toYaml .Values.async.extraVars | nindent 12 }}
+          {{- toYaml .Values.async.extraVars | nindent 10 }}
           {{- end }}
         volumeMounts:
           - name: taiga-static
@@ -410,14 +411,14 @@ spec:
         - name: taiga-static
           {{- if .Values.persistence.enabled }}
           persistentVolumeClaim:
-            claimName: {{ .Values.persistence.existingClaim | default (include "taiga.fullname" .) }}-static
+            claimName: {{ .Values.persistence.static.existingClaim | default (printf "%s-static" (include "taiga.fullname" .)) }}
           {{- else }}
           emptyDir: {}
           {{- end }}
         - name: taiga-media
           {{- if .Values.persistence.enabled }}
           persistentVolumeClaim:
-            claimName: {{ .Values.persistence.existingClaim | default (include "taiga.fullname" .) }}-media
+            claimName: {{ .Values.persistence.media.existingClaim | default (printf "%s-media" (include "taiga.fullname" .)) }}
           {{- else }}
           emptyDir: {}
           {{- end }}

helm-chart/templates/ingress.yaml

@@ -64,6 +64,13 @@ spec:
               port:
                 name: taiga-protected
           pathType: ImplementationSpecific
+        - path: /static
+          backend:
+            service:
+              name: "{{ template "taiga.fullname" . }}-front"
+              port:
+                name: taiga-front
+          pathType: ImplementationSpecific
         {{- end }}
     {{- end }}
     {{- range .Values.ingress.extraHosts }}
@@ -114,14 +121,21 @@ spec:
               port:
                 name: taiga-protected
           pathType: ImplementationSpecific
+        - path: /static
+          backend:
+            service:
+              name: "{{ template "taiga.fullname" . }}-front"
+              port:
+                name: taiga-front
+          pathType: ImplementationSpecific
         {{- end }}
     {{- end }}
   {{- if or .Values.ingress.tls .Values.ingress.extraTls .Values.ingress.hosts }}
   tls:
     {{- if .Values.ingress.tls }}
     - hosts:
         - {{ .Values.ingress.hostname }}
-      secretName: {{ printf "%s-tls" .Values.ingress.hostname }}
+      secretName: {{ .Values.ingress.secretName }}
     {{- end }}
     {{- if .Values.ingress.extraTls }}
     {{- toYaml .Values.ingress.extraTls | nindent 4 }}

helm-chart/templates/job-createinitialuser.yaml

@@ -27,7 +27,7 @@ spec:
           - name: POSTGRES_PASSWORD
             value: "{{ .Values.postgresql.auth.password }}"
           - name: POSTGRES_HOST
-            value: "{{ template "taiga.fullname" . }}-postgresql"
+            value: {{ default (printf "%s-postgresql" (include "taiga.fullname" .)) .Values.postgresql.host | quote }}
           - name: TAIGA_SECRET_KEY
             value: "{{ .Values.secretKey }}"
       restartPolicy: Never

helm-chart/templates/media-pvc.yaml

@@ -1,10 +1,12 @@
-{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+{{- if and .Values.persistence.enabled (not .Values.persistence.media.existingClaim) }}
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: {{ template "taiga.fullname" . }}-media
   labels: {{- include "taiga.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
 spec:
   accessModes:
     - {{ .Values.persistence.accessMode | quote }}

helm-chart/templates/static-pvc.yaml

@@ -1,10 +1,12 @@
-{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+{{- if and .Values.persistence.enabled (not .Values.persistence.static.existingClaim) }}
 ---
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: {{ template "taiga.fullname" . }}-static
   labels: {{- include "taiga.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
 spec:
   accessModes:
     - {{ .Values.persistence.accessMode | quote }}

helm-chart/values.yaml

@@ -10,8 +10,10 @@
 
 ## Taiga secret key
 ##
+# TODO: Set to null by default or use random value by default and store in secret
 secretKey: 9%pno@m688el28@2+^y4v^&6wluqk-g#j#d7$dsjtht)o30dn1
 
+# TODO: The email settings seem to be unused, compare smtp below
 ## Email settings
 ##
 email:
@@ -79,11 +81,14 @@ trelloImporter:
 ## Create initial user with credentials admin/123123
 ## ref: https://taigaio.github.io/taiga-doc/dist/setup-production.html
 ##
+# TODO: set to false by default or create with a random password which is stored in a secret
+# or allow to pass in the data for username and secret
 createInitialUser: true
 
 ## Create initial templates
 ## ref: https://taigaio.github.io/taiga-doc/dist/setup-production.html
 ##
+# TODO: This values seems to be unused
 createInitialTemplates: false
 
 back:
@@ -817,6 +822,7 @@ ingress:
   ## You can use the ingress.secrets parameter to create this TLS secret or relay on cert-manager to create it
   ##
   tls: false
+  secretName: ""
 
   ## Ingress annotations done as key:value pairs
   ## For a full list of possible ingress annotations,
@@ -855,7 +861,7 @@ ingress:
   ## - name: taiga.local-tls
   ##   key:
   ##   certificate:
-    
+
 
 ## Pods Service Account
 ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
@@ -873,10 +879,13 @@ serviceAccount:
 ##
 persistence:
   enabled: true
-  ## A manually manage Persistent Volume Claim
-  ## Requires persistence.enable: true
-  ## If defined, PVC must be created manually before volume will be bound
-  # existingClaim:
+
+  ## To use existing PVCs
+  static:
+    existingClaim: ""
+
+  media:
+    existingClaim: ""
 
   ## taiga data Persistent Volume Storage Class
   ## If defined, storageClassName: <storageClass>
@@ -889,7 +898,10 @@ persistence:
   accessMode: ReadWriteOnce
   size: 5Gi
 
-## PostgreSQL chart configuration
+## PostgreSQL / PostgreSQL chart configuration
+##
+## This does configure either the bundled PostgreSQL instance or it does
+## configure the postgresql access details if "enabled" is set to "false".
 ##
 ## https://github.com/helm/charts/blob/master/stable/postgresql/values.yaml
 ##
@@ -900,6 +912,10 @@ postgresql:
   ## Whether to deploy a PostgreSQL server to satisfy the applications database requirements. To use an external database set this to false and configure the externalDatabase parameters
   enabled: true
 
+  ## The hostname of the PostgreSQL instance. Has to be set when not using the
+  ## bundled PostgreSQL instance.
+  host: null
+
   ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#setting-the-root-password-on-first-run
   ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-on-first-run
   ## ref: https://github.com/bitnami/containers/tree/main/bitnami/postgresql#creating-a-database-user-on-first-run
@@ -952,9 +968,11 @@ async-rabbitmq:
 
   ## Create a rabbitmq username
   auth:
+    # TODO: Remove default values for secrets
     username: taiga
     password: taiga
-
+
+    # TODO: Remove default values for secrets
     erlangCookie: h2SNqvsJRJAeSRUlkubZTlkRB0OJgYSu
 
   extraConfiguration: |-
@@ -973,9 +991,11 @@ events-rabbitmq:
 
   ## Create a rabbitmq username
   auth:
+    # TODO: Remove default values for secrets
     username: taiga
     password: taiga
-
+
+    # TODO: Remove default values for secrets
     erlangCookie: h2SNqvsJRJAeSRUlkubZTlkRB0OJgYSu
 
   extraConfiguration: |-