Helm chart redesign for Quarkus-based runtimes

.github/workflows/helm.yml

@@ -99,7 +99,7 @@ jobs:
         if: steps.list-changed.outputs.changed == 'true'
         run: |
           eval $(minikube -p minikube docker-env)
-          ./gradlew :polaris-quarkus-server:assemble \
+          ./gradlew :polaris-quarkus-server:assemble :polaris-quarkus-admin:assemble \
             -Dquarkus.container-image.build=true \
             -PeclipseLinkDeps=com.h2database:h2:2.3.232
           minikube image ls

helm/polaris/README.md.gotmpl

@@ -49,23 +49,57 @@
 
 ### Optional
 
-When using a custom `persistence.xml`, a Kubernetes Secret must be created for `.persistenceConfigSecret`. Below is a sample command:
+When using a custom `persistence.xml`, a Kubernetes Secret must be created for it. Below is a sample command:
 ```bash
 kubectl create secret generic polaris-secret -n polaris --from-file=persistence.xml
 ```
 
 ### From local directory (for development purposes)
 
-From Polaris repo root:
+The below instructions assume Minikube is running and Helm is installed.
+
+If necessary, load the Docker images into Minikube:
+
+```bash
+eval $(minikube -p minikube docker-env)
+
+./gradlew :polaris-quarkus-server:assemble :polaris-quarkus-admin:assemble \
+    -Dquarkus.container-image.build=true \
+    -Dquarkus.container-image.tag=unstable \
+    -PeclipseLinkDeps=com.h2database:h2:2.3.232
+```
+
+Then create and populate the namespace:
+
+```bash
+kubectl create namespace polaris
+kubectl apply --namespace polaris -f helm/polaris/ci/fixtures/
+```
+
+Finally, install the chart. From Polaris repo root:
+
+```bash
+helm upgrade --install --namespace polaris polaris helm/polaris \
+  --set image.tag=unstable \
+  --set bootstrap.image.tag=unstable \
+  --debug \
+  --values helm/polaris/ci/simple-values.yaml
+```
+
+You can also run `ct` (chart-testing):
 
 ```bash
-$ helm install polaris helm/polaris --namespace polaris --create-namespace
+ct lint --charts helm/polaris
+ct install --helm-extra-set-args "--set=image.tag=unstable --set bootstrap.image.tag=unstable" \
+  --debug \
+  --namespace polaris \
+  --charts ./helm/polaris
 ```
 
 ### Uninstalling the chart
 
 ```bash
-$ helm uninstall --namespace polaris polaris
+helm uninstall --namespace polaris polaris
 ```
 
 {{ template "chart.valuesSection" . }}

helm/polaris/ci/fixtures/token-broker.yaml

@@ -0,0 +1,59 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: polaris-token-broker
+type: Opaque
+stringData:
+  private.pem: |-
+    -----BEGIN PRIVATE KEY-----
+    MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDiae5jQnQ+Dt8Optpa4fLNuUfI
+    37Sy29JPfn22CkGNo54SJi8NtR38Q958Bx9B+30IZPm3KtZGPC38Tm78/C508h7/Bd0jO7S3/UuQ
+    rYlg9H8gC59j14fE5cKEiKCvHrNK35Act9LrfhwEoGBs7G+90KD3SBIWzoc4vS8AB/ey09kRN3+M
+    dQ/DuRrafRgEx8ecq0x4KPggrmvworVVm1ya+H2JNKUQ+uQugmwxeRDE1GuJrgNnn4+ajueEnGdc
+    ohgz067AgZExzoyRlujJXBuL6JRtOSbEYVpNV1laVdA8UJ2b5I1PiNnVvx1m4gFi/Cela479EO6t
+    +AC+a1ez+MxTAgMBAAECggEAA1QiXJQ4CEeIsPrz/90NiEe+je34Bp8jtuZ5q6j38MCkjMjB7VYp
+    1DEdPr6OD5bGbk6puy8mik7NMEXo7NA6UJ7UpNQtvZxdmkzfhQeAGwxNKCfzlnCvPs5P70ng7uIp
+    KaMix8FOGQc4GztOX5uUQvqjuy70kSBFLajeXYZAdoEOu+E3QDaCUqiJlK3cRAJhg39Br+XfOHDp
+    cBdhlbxqQKZHWqDR010XUNoQpMHXWTu/e779Xze9uAvmYw98YGtCW8JB5AqjnqAmCZFaktKYw5Z3
+    IHZCA9hTVngk0WTanuIeTlB2bbl0df+87xHfim2yDuXEkTfAOCug/Qpf+pEhfQKBgQD9M14a1MQ2
+    Omf9f7X401Ig32e2YfX6sW73THB8Lupz9MCBZxNFCZlzVl55bL2o2vOROEeaneGdboqASW+1ph6e
+    QbdipiYAfHsG/mvkysqH/plo8QT69GUlzs2yt5zdmFjvkwaZmRmbB6Gjg2sSHKBt3YjTPbdmpuKV
+    oLvpmaslvQKBgQDk6r+4CGTZwfKYcrTNqJYPdOwfaVjSCulm0wHRw3PvJEi5Eb5qNaJbNICLl5FD
+    wkOAg33CZ+9h9FJnPd2IbBUBUGcNL5sGNZZNMH16LuFlRYKGgYxjlOjktOC5OXXa7iqkwMqf1dFf
+    GYU/wHGXYamUKOlinA9rFmbQCUNJL6mzTwKBgQC5Ky/O/3rfDaevRA6YgjK1x6vZPZreU5SLVmOM
+    7eKYGo4OFIuLGZIXPzqoIlYxfq5RrY7wDDZLI+Q2HX6MoYgSxIyQoGF6SY7PdpEBKS0kd5VJobm6
+    rbCrDapw4MbfZ+LiketpuQV40wPqyNkszbKlpjXCBohxkepy8rF6DN+VIQKBgFYHFnedx/DB316F
+    NQdYxNQYN6hyWavN5/r5b2SaVFZZx26tiWa2s0YdS/WpxzC0r9N7FubZUm/4doNQD5H2NEqjIacl
+    7dd+ifaGM5GYTqJVZgEQbGb8Di3s/8r8Ghtlh+cUgNFidGWN3LKhqs6eKDGC0np5dZ3j9E1YPc4i
+    OF8nAoGAYeFjfXBXKQhQXItTlL5NMd+yNvMGJDOvNYOn90acZrDld8GvqHI9A1kQf2IuYfA8Yfxg
+    O2lpCWjiPAsAC3W5BMhfkzjxpikW6YLpXXx7wpDzNAUBAuhEHlmFSMOoa4CIBnN2+6Zw8PSsKnrI
+    49N28pje/ZyABaY7SYP3fcJY17o=
+    -----END PRIVATE KEY-----
+  public.pem: |-
+    -----BEGIN PUBLIC KEY-----
+    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4mnuY0J0Pg7fDqbaWuHyzblHyN+0stvS
+    T359tgpBjaOeEiYvDbUd/EPefAcfQft9CGT5tyrWRjwt/E5u/PwudPIe/wXdIzu0t/1LkK2JYPR/
+    IAufY9eHxOXChIigrx6zSt+QHLfS634cBKBgbOxvvdCg90gSFs6HOL0vAAf3stPZETd/jHUPw7ka
+    2n0YBMfHnKtMeCj4IK5r8KK1VZtcmvh9iTSlEPrkLoJsMXkQxNRria4DZ5+Pmo7nhJxnXKIYM9Ou
+    wIGRMc6MkZboyVwbi+iUbTkmxGFaTVdZWlXQPFCdm+SNT4jZ1b8dZuIBYvwnpWuO/RDurfgAvmtX
+    s/jMUwIDAQAB
+    -----END PUBLIC KEY-----

helm/polaris/ci/persistence-values.yaml

@@ -20,10 +20,31 @@
 image:
   pullPolicy: Never
 
-persistenceConfigSecret: polaris-persistence
+authentication:
+  tokenBroker:
+    secret:
+      name: polaris-token-broker
 
-polarisServerConfig:
-  metaStoreManager:
-    type: eclipse-link
-    persistence-unit: polaris
-    conf-file: /eclipselink-config/conf.jar!/persistence.xml
+logging:
+  file:
+    enabled: true
+    json: true
+    storage:
+      size: 50Mi
+
+persistence:
+  type: eclipse-link
+  eclipseLink:
+    secret:
+      name: polaris-persistence
+
+bootstrap:
+  enabled: true
+  realms:
+    - "POLARIS"
+    - "POLARIS2"
+  credentials:
+    - POLARIS,root,secret
+    - POLARIS2,root,secret
+  image:
+    pullPolicy: Never

helm/polaris/templates/_helpers.tpl

@@ -42,6 +42,29 @@
 {{- end }}
 {{- end }}
 
+{{/*
+  Create a default fully qualified app name, with a custom suffix. Useful when the name will
+  have a suffix appended to it, such as for the management service name.
+*/}}
+{{- define "polaris.fullnameWithSuffix" -}}
+{{- $global := index . 0 }}
+{{- $suffix := index . 1 }}
+{{- if not (hasPrefix "-" $suffix) }}
+{{- $suffix = printf "-%s" $suffix }}
+{{- end }}
+{{- $length := int (sub 63 (len $suffix)) }}
+{{- if $global.Values.fullnameOverride }}
+{{- $global.Values.fullnameOverride | trunc $length }}{{ $suffix }}
+{{- else }}
+{{- $name := default $global.Chart.Name $global.Values.nameOverride }}
+{{- if contains $name $global.Release.Name }}
+{{- $global.Release.Name | trunc $length }}{{ $suffix }}
+{{- else }}
+{{- printf "%s-%s" $global.Release.Name $name | trunc $length }}{{ $suffix }}
+{{- end }}
+{{- end }}
+{{- end }}
+
 {{/*
   Create chart name and version as used by the chart label.
 */}}
@@ -79,3 +102,198 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Merges the advanced configuration into the destination map.
+*/}}
+{{- define "polaris.mergeAdvancedConfig" -}}
+{{- $advConfig := index . 0 -}}
+{{- $prefix := index . 1 -}}
+{{- $dest := index . 2 -}}
+{{- range $key, $val := $advConfig -}}
+{{- $name := ternary $key (print $prefix "." $key) (eq $prefix "") -}}
+{{- if kindOf $val | eq "map" -}}
+{{- list $val $name $dest | include "polaris.mergeAdvancedConfig" -}}
+{{- else -}}
+{{- $_ := set $dest $name $val -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Prints the configuration option to the destination configmap entry. See confimap.yaml.
+Any nil values will be printed as empty config options; otherwise, the value will be evaluated
+as a template against the global context, then printed. Furthermore, if the value contains
+line breaks, they will be escaped and a multi-line option will be printed.
+*/}}
+{{- define "polaris.appendConfigOption" -}}
+{{- $key := index . 0 -}}
+{{- $value := index . 1 -}}
+{{- $global := index . 2 -}}
+{{- $valAsString := "" -}}
+{{- if ne $value nil -}}
+{{- $valAsString = tpl (toString $value) $global -}}
+{{- if contains "\r\n" $valAsString -}}
+{{- $valAsString = $valAsString | nindent 4 | replace "\r\n" "\\\r\n" -}}
+{{- else if contains "\n" $valAsString -}}
+{{- $valAsString = $valAsString | nindent 4 | replace "\n" "\\\n" -}}
+{{- end -}}
+{{- end -}}
+{{ print $key "=" $valAsString }}
+{{- end -}}
+
+{{/*
+Convert a dict into a string formed by a comma-separated list of key-value pairs: key1=value1,key2=value2, ...
+*/}}
+{{- define "polaris.dictToString" -}}
+{{- $list := list -}}
+{{- range $k, $v := . -}}
+{{- $list = append $list (printf "%s=%s" $k $v) -}}
+{{- end -}}
+{{ join "," $list }}
+{{- end -}}
+
+{{/*
+Prints the config volume definition for deployments and jobs.
+*/}}
+{{- define "polaris.configVolume" -}}
+- name: config-volume
+  projected:
+    sources:
+      - configMap:
+          name: {{ include "polaris.fullname" . }}
+          items:
+            - key: application.properties
+              path: application.properties
+      {{- if .Values.authentication.tokenBroker.secret.name }}
+      - secret:
+          name: {{ tpl .Values.authentication.tokenBroker.secret.name . }}
+          items:
+          {{- if eq .Values.authentication.tokenBroker.type "rsa-key-pair" }}
+          - key: {{ tpl .Values.authentication.tokenBroker.secret.publicKey . }}
+            path: public.pem
+          - key: {{ tpl .Values.authentication.tokenBroker.secret.privateKey . }}
+            path: private.pem
+          {{- end }}
+          {{- if eq .Values.authentication.tokenBroker.type "symmetric-key" }}
+          - key: {{ tpl .Values.authentication.tokenBroker.secret.secretKey . }}
+            path: symmetric.key
+          {{- end }}
+      {{- end }}
+      {{- if and ( eq .Values.persistence.type "eclipse-link" ) .Values.persistence.eclipseLink.secret.name }}
+      - secret:
+          name: {{ tpl .Values.persistence.eclipseLink.secret.name . }}
+          items:
+            - key: {{ tpl .Values.persistence.eclipseLink.secret.key . }}
+              path: persistence.xml
+      {{- end }}
+{{- end -}}
+
+{{/*
+Converts a Kubernetes quantity to a number (int64 if possible or float64 otherwise).
+It handles raw numbers as well as quantities with suffixes
+like m, k, M, G, T, P, E, ki, Mi, Gi, Ti, Pi, Ei.
+It also handles scientific notation.
+Quantities should be positive, so negative values, zero, or any unparseable number
+will result in a failure.
+https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/quantity/
+*/}}
+{{- define "polaris.quantity" -}}
+{{- $quantity := . -}}
+{{- $n := $quantity | float64 -}}
+{{- if kindIs "string" $quantity -}}
+{{- if hasSuffix "m" $quantity -}}
+{{- $n = divf (trimSuffix "m" $quantity | float64) 1000.0 -}}
+{{- else if hasSuffix "k" $quantity -}}
+{{- $n = trimSuffix "k" $quantity | int64 | mul 1000 -}}
+{{- else if hasSuffix "M" $quantity -}}
+{{- $n = trimSuffix "M" $quantity | int64 | mul 1000000 -}}
+{{- else if hasSuffix "G" $quantity -}}
+{{- $n = trimSuffix "G" $quantity | int64 | mul 1000000000 -}}
+{{- else if hasSuffix "T" $quantity -}}
+{{- $n = trimSuffix "T" $quantity | int64 | mul 1000000000000 -}}
+{{- else if hasSuffix "P" $quantity -}}
+{{- $n = trimSuffix "P" $quantity | int64 | mul 1000000000000000 -}}
+{{- else if hasSuffix "E" $quantity -}}
+{{- $n = trimSuffix "E" $quantity | int64 | mul 1000000000000000000 -}}
+{{- else if hasSuffix "ki" $quantity -}}
+{{- $n = trimSuffix "ki" $quantity | int64 | mul 1024 -}}
+{{- else if hasSuffix "Mi" $quantity -}}
+{{- $n = trimSuffix "Mi" $quantity | int64 | mul 1048576 -}}
+{{- else if hasSuffix "Gi" $quantity -}}
+{{- $n = trimSuffix "Gi" $quantity | int64 | mul 1073741824 -}}
+{{- else if hasSuffix "Ti" $quantity -}}
+{{- $n = trimSuffix "Ti" $quantity | int64 | mul 1099511627776 -}}
+{{- else if hasSuffix "Pi" $quantity -}}
+{{- $n = trimSuffix "Pi" $quantity | int64 | mul 1125899906842624 -}}
+{{- else if hasSuffix "Ei" $quantity -}}
+{{- $n = trimSuffix "Ei" $quantity | int64 | mul 1152921504606846976 -}}
+{{- end -}}
+{{- end -}}
+{{- if le ($n | float64) 0.0 -}}
+{{- fail (print "invalid quantity: " $quantity) -}}
+{{- end -}}
+{{- if kindIs "float64" $n -}}
+{{- printf "%f" $n -}}
+{{- else -}}
+{{- printf "%v" $n -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Prints the ports section of the container spec. Also validates all port names and numbers to ensure
+that they are consistent and that there are no overlaps.
+*/}}
+{{- define "polaris.containerPorts" -}}
+ports:
+{{- $ports := dict -}}
+
+{{- /* Main service ports */ -}}
+{{- range $i, $port := .Values.service.ports -}}
+{{- if hasKey $ports $port.name -}}
+{{- fail (printf "service.ports[%d]: port name already taken: %v" $i $port.name) -}}
+{{- end -}}
+{{- $portNumber := coalesce $port.targetPort $port.port -}}
+{{- if has $portNumber (values $ports) -}}
+{{- fail (printf "service.ports[%d]: port number already taken: %v" $i $portNumber) -}}
+{{- end -}}
+{{- $_ := set $ports $port.name $portNumber }}
+- name: {{ $port.name }}
+  containerPort: {{ coalesce $port.targetPort $port.port }}
+  protocol: {{ $port.protocol | default "TCP" }}
+{{- end -}}
+
+{{- /* Management service ports */ -}}
+{{- range $i, $port := .Values.managementService.ports -}}
+{{- if hasKey $ports $port.name -}}
+{{- fail (printf "managementService.ports[%d]: port name already taken: %v" $i $port.name) -}}
+{{- end -}}
+{{- $portNumber := coalesce $port.targetPort $port.port -}}
+{{- if has $portNumber (values $ports) -}}
+{{- fail (printf "managementService.ports[%d]: port number already taken: %v" $i $portNumber) -}}
+{{- end -}}
+{{- $_ := set $ports $port.name $portNumber }}
+- name: {{ $port.name }}
+  containerPort: {{ coalesce $port.targetPort $port.port }}
+  protocol: {{ $port.protocol | default "TCP" }}
+{{- end -}}
+
+{{- /* Extra service ports */ -}}
+{{- range $i, $svc := .Values.extraServices -}}
+{{- range $j, $port := $svc.ports -}}
+{{- $portNumber := coalesce $port.targetPort $port.port -}}
+{{- if hasKey $ports $port.name -}}
+{{- if ne $portNumber (get $ports $port.name) -}}
+{{- fail (printf "extraServices[%d].ports[%d]: wrong port number for port %s, expected %v, got %v" $i $j $port.name (get $ports $port.name) $portNumber) -}}
+{{- end -}}
+{{- else if has $portNumber (values $ports) -}}
+{{- fail (printf "extraServices[%d].ports[%d]: port number already taken: %v" $i $j $portNumber) -}}
+{{- end -}}
+{{- $_ := set $ports $port.name $portNumber }}
+- name: {{ $port.name }}
+  containerPort: {{ coalesce $port.targetPort $port.port }}
+  protocol: {{ $port.protocol | default "TCP" }}
+{{- end -}}
+{{- end -}}
+
+{{- end -}}