diff --git a/.github/ct/chart-schema.yaml b/.github/ct/chart-schema.yaml new file mode 100644 index 00000000000..7b3fb0a3fe4 --- /dev/null +++ b/.github/ct/chart-schema.yaml @@ -0,0 +1,23 @@ +name: str() +home: str() +version: str() +apiVersion: str() +appVersion: any(str(), num(), required=False) +type: str() +dependencies: any(required=False) +description: str() +keywords: list(str(), required=False) +sources: list(str(), required=False) +maintainers: list(include('maintainer'), required=False) +icon: str(required=False) +engine: str(required=False) +condition: str(required=False) +tags: str(required=False) +deprecated: bool(required=False) +kubeVersion: str(required=False) +annotations: map(str(), str(), required=False) +--- +maintainer: + name: str() + email: str(required=False) + url: str(required=False) diff --git a/.github/ct/ct.yaml b/.github/ct/ct.yaml new file mode 100644 index 00000000000..ff1135d5a7c --- /dev/null +++ b/.github/ct/ct.yaml @@ -0,0 +1,17 @@ +debug: true +remote: origin +lint-conf: .github/ct/lintconf.yaml +chart-yaml-schema: .github/ct/chart-schema.yaml +validate-maintainers: false +validate-chart-schema: true +validate-yaml: true +check-version-increment: true +chart-dirs: + - charts +helm-extra-args: --timeout 300s +upgrade: true +skip-missing-values: true +release-label: release +chart-repos: + - bitnami=https://charts.bitnami.com/bitnami +release-name-template: "helm-v{{ .Version }}" diff --git a/.github/ct/lintconf.yaml b/.github/ct/lintconf.yaml new file mode 100644 index 00000000000..8e64eb2caf1 --- /dev/null +++ b/.github/ct/lintconf.yaml @@ -0,0 +1,40 @@ +--- +rules: + braces: + min-spaces-inside: 0 + max-spaces-inside: 0 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: -1 + brackets: + min-spaces-inside: 0 + max-spaces-inside: 0 + min-spaces-inside-empty: -1 + max-spaces-inside-empty: -1 + colons: + max-spaces-before: 0 + max-spaces-after: 1 + commas: + max-spaces-before: 0 + min-spaces-after: 1 + max-spaces-after: 1 + comments: + require-starting-space: true + min-spaces-from-content: 1 + document-end: disable + document-start: disable + empty-lines: + max: 2 + max-start: 0 + max-end: 0 + hyphens: + max-spaces-after: 1 + indentation: + spaces: consistent + indent-sequences: whatever + check-multi-line-strings: false + key-duplicates: enable + line-length: disable + new-line-at-end-of-file: enable + trailing-spaces: enable + truthy: + level: warning diff --git a/.github/workflows/chart-release.yaml b/.github/workflows/chart-release.yaml new file mode 100644 index 00000000000..7e122f54a19 --- /dev/null +++ b/.github/workflows/chart-release.yaml @@ -0,0 +1,35 @@ +name: Release Charts + +on: + push: + branches: + - master + paths: + - "charts/**" + +jobs: + release: + runs-on: ubuntu-20.04 + steps: + - name: Checkout + uses: actions/checkout@v2 + with: + fetch-depth: 0 + - name: Configure Git + run: | + git config user.name "$GITHUB_ACTOR" + git config user.email "$GITHUB_ACTOR@users.noreply.github.com" + - name: Install Helm + uses: azure/setup-helm@v1 + with: + version: v3.4.0 + - name: Add bitnami repo + run: helm repo add bitnami https://charts.bitnami.com/bitnami + - name: Update dependencies + run: find charts/ ! -path charts/ -maxdepth 1 -type d -exec helm dependency update {} \; + - name: Run chart-releaser + uses: helm/chart-releaser-action@v1.2.0 + with: + config: .github/ct/ct.yaml + env: + CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/chart-test.yaml b/.github/workflows/chart-test.yaml new file mode 100644 index 00000000000..31d86959b3a --- /dev/null +++ b/.github/workflows/chart-test.yaml @@ -0,0 +1,55 @@ +name: Lint and Test Charts + +on: + pull_request: + branches: + - master + paths: + - "charts/**" + +jobs: + lint: + runs-on: ubuntu-20.04 + container: ghcr.io/chgl/kube-powertools:latest + steps: + - name: Checkout + uses: actions/checkout@v2 + with: + fetch-depth: 0 + - name: Update dependencies + run: find charts/ ! -path charts/ -maxdepth 1 -type d -exec helm dependency update {} \; + - name: Run chart-testing (lint) + run: ct lint --config .github/ct/ct.yaml + - name: Run Powerlint + run: chart-powerlint.sh + + test: + runs-on: ubuntu-20.04 + needs: + - lint + steps: + - name: Checkout + uses: actions/checkout@v2 + with: + fetch-depth: 0 + - name: Set up Helm + uses: azure/setup-helm@v1 + with: + version: v3.5.2 + - uses: actions/setup-python@v2 + with: + python-version: 3.9 + - name: Set up chart-testing + uses: helm/chart-testing-action@v2.0.1 + - name: Run chart-testing (list-changed) + id: list-changed + run: | + changed=$(ct list-changed) + if [[ -n "$changed" ]]; then + echo "::set-output name=changed::true" + fi + - name: Create k8s Kind Cluster + uses: helm/kind-action@v1.1.0 + if: steps.list-changed.outputs.changed == 'true' + - name: Run chart-testing (install) + run: ct install --config .github/ct/ct.yaml diff --git a/.gitignore b/.gitignore index 18c430daa1d..0d7500894a8 100644 --- a/.gitignore +++ b/.gitignore @@ -157,4 +157,7 @@ Icon .AppleDesktop Network Trash Folder Temporary Items -.apdisk \ No newline at end of file +.apdisk + +# Helm Chart dependencies +**/charts/*.tgz diff --git a/charts/README.md b/charts/README.md new file mode 100644 index 00000000000..22e6ed8ed70 --- /dev/null +++ b/charts/README.md @@ -0,0 +1,41 @@ +# Charts + +> A collection of Helm charts + +```sh +helm repo add hapifhir https://hapifhir.github.io/charts +helm repo update +``` + +## Development + +1. Make changes to the charts + +1. Mount the folder in the [kube-powertools](https://github.com/chgl/kube-powertools) container to easily run linters and checks + + ```sh + docker run --rm -it -v $PWD:/usr/src/app ghcr.io/chgl/kube-powertools:latest + ``` + +1. Run chart-testing and the `chart-powerlint.sh` script to lint the chart + + ```sh + ct lint --config .github/ct/ct.yaml && chart-powerlint.sh + ``` + +1. (Optional) View the results of the [polaris audit check](https://github.com/FairwindsOps/polaris) in your browser + + ```sh + $ docker run --rm -it -p 9090:8080 -v $PWD:/usr/src/app ghcr.io/chgl/kube-powertools:latest + bash-5.0: helm template charts/fhir-server/ | polaris dashboard --audit-path - + ``` + + You can now open your browser at and see the results and recommendations. + +1. Run `generate-docs.sh` to auto-generate an updated README + + ```sh + generate-docs.sh + ``` + +1. Bump the version in the changed Chart.yaml according to SemVer (The `ct lint` step above will complain if you forget to update the version.) diff --git a/charts/hapi-fhir-jpaserver/.helmignore b/charts/hapi-fhir-jpaserver/.helmignore new file mode 100644 index 00000000000..0e8a0eb36f4 --- /dev/null +++ b/charts/hapi-fhir-jpaserver/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/hapi-fhir-jpaserver/Chart.lock b/charts/hapi-fhir-jpaserver/Chart.lock new file mode 100644 index 00000000000..3229d8b83ab --- /dev/null +++ b/charts/hapi-fhir-jpaserver/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: postgresql + repository: https://charts.bitnami.com/bitnami + version: 10.3.16 +digest: sha256:a45816f0855c6d4b1d66384ac36db99e0378f24663d02791006f815ff9d49245 +generated: "2021-04-09T15:11:17.790703505Z" diff --git a/charts/hapi-fhir-jpaserver/Chart.yaml b/charts/hapi-fhir-jpaserver/Chart.yaml new file mode 100644 index 00000000000..486f828266f --- /dev/null +++ b/charts/hapi-fhir-jpaserver/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +name: hapi-fhir-jpaserver +description: A Helm chart for deploying the HAPI FHIR JPA server starter on Kubernetes. +type: application +home: https://github.com/hapifhir/hapi-fhir-jpaserver-starter +sources: + - https://github.com/hapifhir/hapi-fhir-jpaserver-starter +dependencies: + - name: postgresql + version: 10.3.16 + repository: https://charts.bitnami.com/bitnami + condition: postgresql.enabled +version: 0.2.0 diff --git a/charts/hapi-fhir-jpaserver/README.md b/charts/hapi-fhir-jpaserver/README.md new file mode 100644 index 00000000000..a23e0701496 --- /dev/null +++ b/charts/hapi-fhir-jpaserver/README.md @@ -0,0 +1,101 @@ +# hapi-fhir-jpaserver + +[HAPI FHIR JPA Server](https://github.com/hapifhir/hapi-fhir-jpaserver-starter) - Helm chart for deploying the HAPI FHIR JPA starter server + +## TL;DR; + +```console +$ helm repo add hapifhir https://hapifhir.github.io/hapi-fhir-jpaserver-starter +$ helm repo update +$ helm install hapi-fhir-jpaserver hapifhir/hapi-fhir-jpaserver -n fhir +``` + +## Introduction + +This chart deploys the HAPI FHIR JPA starter server. on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Kubernetes v1.18+ +- Helm v3 + +## Installing the Chart + +To install the chart with the release name `hapi-fhir-jpaserver`: + +```console +$ helm install hapi-fhir-jpaserver hapifhir/hapi-fhir-jpaserver -n fhir +``` + +The command deploys the HAPI FHIR JPA starter server. on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the `hapi-fhir-jpaserver`: + +```console +$ helm delete hapi-fhir-jpaserver -n fhir +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following table lists the configurable parameters of the `hapi-fhir-jpaserver` chart and their default values. + +| Parameter | Description | Default | +| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | +| replicaCount | | `1` | +| imagePullSecrets | image pull secrets | `[]` | +| nameOverride | | `""` | +| fullnameOverride | | `""` | +| deploymentAnnotations | annotations applied to the server deployment | `{}` | +| podAnnotations | annotations applied to the server pod | `{}` | +| podSecurityContext | PodSecurityContext applied to the pod | `{}` | +| service.type | | `ClusterIP | +| | | # service port` | +| service.port | | `8080` | +| ingress.enabled | | `false | +| | | # provide any additional annotations which may be required. Evaluated as a template.` | +| ingress.annotations | | `{}` | +| ingress.tls | | `[]` | +| resources | resource requests and limits | `{}` | +| nodeSelector | choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after 'resources:'. limits: cpu: 100m memory: 128Mi requests: cpu: 100m memory: 128Mi node labels for pods assignment see: | `{}` | +| tolerations | tolerations for pods assignment see: | `[]` | +| affinity | affinity for pods assignment see: | `{}` | +| postgresql.enabled | if set to `false`, the values under `webApi.db` are used | `true | +| | | # update the default Postgres version to 13.2` | +| postgresql.image | | `{"tag":"13.2.0"}` | +| postgresql.postgresqlDatabase | see: | `"fhir"` | +| postgresql.existingSecret | The secret has to contain the keys `postgresql-password` which is the password for `postgresqlUsername` when it is different of `postgres`, `postgresql-postgres-password` which will override `postgresqlPassword`, `postgresql-replication-password` which will override `replication.password` and `postgresql-ldap-password` which will be sed to authenticate on LDAP. The value is evaluated as a template. | `""` | +| postgresql.replication.enabled | | `false | +| | | # number of read replicas` | +| postgresql.replication.readReplicas | | `2` | +| postgresql.replication.synchronousCommit | | `"on"` | +| postgresql.replication.numSynchronousReplicas | | `1` | +| postgresql.metrics.enabled | | `false` | +| postgresql.metrics.serviceMonitor.enabled | | `false | +| | | # the labels used for Prometheus autodiscover, e.g. could be `release: prometheus`` | +| postgresql.metrics.serviceMonitor.additionalLabels | | `{}` | +| externalDatabase.host | | `localhost | +| | | # non-root Username for FHIR Database` | +| externalDatabase.user | | `fhir` | +| externalDatabase.password | | `""` | +| externalDatabase.existingSecret | | `""` | +| externalDatabase.database | | `fhir` | +| externalDatabase.port | | `5432` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example: + +```console +$ helm install hapi-fhir-jpaserver hapifhir/hapi-fhir-jpaserver -n fhir --set replicaCount=1 +``` + +Alternatively, a YAML file that specifies the values for the parameters can be provided while +installing the chart. For example: + +```console +$ helm install hapi-fhir-jpaserver hapifhir/hapi-fhir-jpaserver -n fhir --values values.yaml +``` diff --git a/charts/hapi-fhir-jpaserver/doc.yaml b/charts/hapi-fhir-jpaserver/doc.yaml new file mode 100644 index 00000000000..5a85b4a7297 --- /dev/null +++ b/charts/hapi-fhir-jpaserver/doc.yaml @@ -0,0 +1,19 @@ +project: + name: HAPI FHIR JPA Server + shortName: hapi-fhir-jpaserver + url: https://github.com/hapifhir/hapi-fhir-jpaserver-starter + description: Helm chart for deploying the HAPI FHIR JPA starter server + app: the HAPI FHIR JPA starter server. +repository: + url: https://hapifhir.github.io/hapi-fhir-jpaserver-starter + name: hapifhir +chart: + name: hapi-fhir-jpaserver + values: "-- generate from values file --" + valuesExample: "-- generate from values file --" +prerequisites: + - "Kubernetes v1.18+" + - "Helm v3" +release: + name: hapi-fhir-jpaserver + namespace: fhir diff --git a/charts/hapi-fhir-jpaserver/templates/NOTES.txt b/charts/hapi-fhir-jpaserver/templates/NOTES.txt new file mode 100644 index 00000000000..87fa7d4d9df --- /dev/null +++ b/charts/hapi-fhir-jpaserver/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "hapi-fhir-jpaserver.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "hapi-fhir-jpaserver.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "hapi-fhir-jpaserver.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "hapi-fhir-jpaserver.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/charts/hapi-fhir-jpaserver/templates/_helpers.tpl b/charts/hapi-fhir-jpaserver/templates/_helpers.tpl new file mode 100644 index 00000000000..d5e1c7a92e5 --- /dev/null +++ b/charts/hapi-fhir-jpaserver/templates/_helpers.tpl @@ -0,0 +1,115 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "hapi-fhir-jpaserver.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "hapi-fhir-jpaserver.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "hapi-fhir-jpaserver.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "hapi-fhir-jpaserver.labels" -}} +helm.sh/chart: {{ include "hapi-fhir-jpaserver.chart" . }} +{{ include "hapi-fhir-jpaserver.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "hapi-fhir-jpaserver.selectorLabels" -}} +app.kubernetes.io/name: {{ include "hapi-fhir-jpaserver.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create a default fully qualified postgresql name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "hapi-fhir-jpaserver.postgresql.fullname" -}} +{{- $name := default "postgresql" .Values.postgresql.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Get the Postgresql credentials secret. +*/}} +{{- define "hapi-fhir-jpaserver.postgresql.secretName" -}} +{{- if and (.Values.postgresql.enabled) (not .Values.postgresql.existingSecret) -}} + {{- printf "%s" (include "hapi-fhir-jpaserver.postgresql.fullname" .) -}} +{{- else if and (.Values.postgresql.enabled) (.Values.postgresql.existingSecret) -}} + {{- printf "%s" .Values.postgresql.existingSecret -}} +{{- else }} + {{- if .Values.externalDatabase.existingSecret -}} + {{- printf "%s" .Values.externalDatabase.existingSecret -}} + {{- else -}} + {{ printf "%s-%s" .Release.Name "externaldb" }} + {{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Add environment variables to configure database values +*/}} +{{- define "hapi-fhir-jpaserver.database.host" -}} +{{- ternary (include "hapi-fhir-jpaserver.postgresql.fullname" .) .Values.externalDatabase.host .Values.postgresql.enabled -}} +{{- end -}} + +{{/* +Add environment variables to configure database values +*/}} +{{- define "hapi-fhir-jpaserver.database.user" -}} +{{- ternary .Values.postgresql.postgresqlUsername .Values.externalDatabase.user .Values.postgresql.enabled | quote -}} +{{- end -}} + +{{/* +Add environment variables to configure database values +*/}} +{{- define "hapi-fhir-jpaserver.database.name" -}} +{{- ternary .Values.postgresql.postgresqlDatabase .Values.externalDatabase.database .Values.postgresql.enabled -}} +{{- end -}} + +{{/* +Add environment variables to configure database values +*/}} +{{- define "hapi-fhir-jpaserver.database.port" -}} +{{- ternary "5432" .Values.externalDatabase.port .Values.postgresql.enabled -}} +{{- end -}} + +{{/* +Create the JDBC URL from the host, port and database name. +*/}} +{{- define "hapi-fhir-jpaserver.database.jdbcUrl" -}} +{{- $host := (include "hapi-fhir-jpaserver.database.host" .) -}} +{{- $port := (include "hapi-fhir-jpaserver.database.port" .) -}} +{{- $name := (include "hapi-fhir-jpaserver.database.name" .) -}} +{{ printf "jdbc:postgresql://%s:%d/%s" $host (int $port) $name }} +{{- end -}} diff --git a/charts/hapi-fhir-jpaserver/templates/deployment.yaml b/charts/hapi-fhir-jpaserver/templates/deployment.yaml new file mode 100644 index 00000000000..24ba02f286f --- /dev/null +++ b/charts/hapi-fhir-jpaserver/templates/deployment.yaml @@ -0,0 +1,124 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "hapi-fhir-jpaserver.fullname" . }} + labels: + {{- include "hapi-fhir-jpaserver.labels" . | nindent 4 }} + {{- with .Values.deploymentAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + {{- include "hapi-fhir-jpaserver.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "hapi-fhir-jpaserver.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- if .Values.postgresql.enabled }} + initContainers: + - name: wait-for-db + image: busybox:1.32 + imagePullPolicy: IfNotPresent + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 11111 + runAsGroup: 11111 + command: ["sh", "-c", "while ! nc -z {{ .Release.Name }}-postgresql 5432 -w 5; do echo $(date) waiting for database; sleep 5; done;"] + {{- end }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 8080 + protocol: TCP + readinessProbe: + httpGet: + path: / + port: http + {{- with .Values.readinessProbe }} + initialDelaySeconds: {{ .initialDelaySeconds }} + periodSeconds: {{ .periodSeconds }} + timeoutSeconds: {{ .timeoutSeconds }} + successThreshold: {{ .successThreshold }} + failureThreshold: {{ .failureThreshold }} + {{- end }} + startupProbe: + httpGet: + path: /fhir/Patient?_count=1 + port: http + {{- with .Values.startupProbe }} + initialDelaySeconds: {{ .initialDelaySeconds }} + periodSeconds: {{ .periodSeconds }} + timeoutSeconds: {{ .timeoutSeconds }} + successThreshold: {{ .successThreshold }} + failureThreshold: {{ .failureThreshold }} + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + env: + - name: SPRING_DATASOURCE_URL + value: {{ include "hapi-fhir-jpaserver.database.jdbcUrl" $ }} + - name: SPRING_DATASOURCE_USERNAME + value: {{ include "hapi-fhir-jpaserver.database.user" $ }} + - name: SPRING_DATASOURCE_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "hapi-fhir-jpaserver.postgresql.secretName" . }} + key: postgresql-password + - name: SPRING_DATASOURCE_DRIVERCLASSNAME + value: org.postgresql.Driver + - name: SPRING_JPA_PROPERTIES_HIBERNATE_DIALECT + value: org.hibernate.dialect.PostgreSQL10Dialect + - name: HAPI_FHIR_USE_APACHE_ADDRESS_STRATEGY + value: "true" + - name: SPRING_JPA_DATABASE_PLATFORM + value: org.hibernate.dialect.PostgreSQLDialect + {{- if .Values.extraEnv }} + {{ toYaml .Values.extraEnv | nindent 12 }} + {{- end }} + volumeMounts: + - mountPath: /tmp + name: tmp-volume + - mountPath: /app/target + name: lucenefiles-volume + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - name: tmp-volume + emptyDir: {} + - name: lucenefiles-volume + emptyDir: {} diff --git a/charts/hapi-fhir-jpaserver/templates/externaldb-secret.yaml b/charts/hapi-fhir-jpaserver/templates/externaldb-secret.yaml new file mode 100644 index 00000000000..408383a29f1 --- /dev/null +++ b/charts/hapi-fhir-jpaserver/templates/externaldb-secret.yaml @@ -0,0 +1,11 @@ +{{- if and (not .Values.postgresql.enabled) (not .Values.externalDatabase.existingSecret) (not .Values.postgresql.existingSecret)}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-%s" .Release.Name "externaldb" }} + labels: + {{- include "hapi-fhir-jpaserver.labels" . | nindent 4 }} +type: Opaque +data: + postgresql-password: {{ .Values.externalDatabase.password | b64enc | quote }} +{{- end }} diff --git a/charts/hapi-fhir-jpaserver/templates/ingress.yaml b/charts/hapi-fhir-jpaserver/templates/ingress.yaml new file mode 100644 index 00000000000..df4862b9ef4 --- /dev/null +++ b/charts/hapi-fhir-jpaserver/templates/ingress.yaml @@ -0,0 +1,54 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "hapi-fhir-jpaserver.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }} +apiVersion: networking.k8s.io/v1beta1 +{{ else }} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "hapi-fhir-jpaserver.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: +{{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} +{{- end }} + rules: + {{- range .Values.ingress.hosts }} + {{- $pathType := .pathType }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ . }} + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + pathType: {{ $pathType | default "ImplementationSpecific" }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{ else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/hapi-fhir-jpaserver/templates/service.yaml b/charts/hapi-fhir-jpaserver/templates/service.yaml new file mode 100644 index 00000000000..90a05a291e8 --- /dev/null +++ b/charts/hapi-fhir-jpaserver/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "hapi-fhir-jpaserver.fullname" . }} + labels: + {{- include "hapi-fhir-jpaserver.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "hapi-fhir-jpaserver.selectorLabels" . | nindent 4 }} diff --git a/charts/hapi-fhir-jpaserver/templates/tests/test-connection.yaml b/charts/hapi-fhir-jpaserver/templates/tests/test-connection.yaml new file mode 100644 index 00000000000..ba5895667ca --- /dev/null +++ b/charts/hapi-fhir-jpaserver/templates/tests/test-connection.yaml @@ -0,0 +1,37 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "hapi-fhir-jpaserver.fullname" . }}-test-connection" + labels: + {{- include "hapi-fhir-jpaserver.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + restartPolicy: Never + containers: + - name: wget + image: busybox:1 + imagePullPolicy: Always + command: ['wget', '-O', '-'] + args: ['http://{{ include "hapi-fhir-jpaserver.fullname" . }}:{{ .Values.service.port }}/fhir/Patient?_count=1'] + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsUser: 22222 + runAsNonRoot: true + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 100m + memory: 128Mi + livenessProbe: + exec: + command: ["true"] + readinessProbe: + exec: + command: ["true"] diff --git a/charts/hapi-fhir-jpaserver/values.yaml b/charts/hapi-fhir-jpaserver/values.yaml new file mode 100644 index 00000000000..11f0a2a8441 --- /dev/null +++ b/charts/hapi-fhir-jpaserver/values.yaml @@ -0,0 +1,159 @@ +# Default values for hapi-fhir-jpaserver. +# This is a YAML-formatted file. + +# number of replicas +replicaCount: 1 + +image: # +doc-gen:ignore + registry: ghcr.io + repository: chgl/hapifhir/hapi-fhir-jpaserver-starter + tag: v5.3.0-distroless + pullPolicy: IfNotPresent + +# image pull secrets +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +# annotations applied to the server deployment +deploymentAnnotations: {} + +# annotations applied to the server pod +podAnnotations: {} + +# PodSecurityContext applied to the pod +podSecurityContext: + {} + # fsGroup: 2000 + +# ContainerSecurityContext applied to the container +securityContext: # +doc-gen:ignore + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 65532 + +service: + # type of service to expose the server + type: ClusterIP + # service port + port: 8080 + +ingress: + # whether to create an Ingress to expose the FHIR server web interface + enabled: false + # provide any additional annotations which may be required. Evaluated as a template. + annotations: + {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: fhir-server.127.0.0.1.xip.io + pathType: ImplementationSpecific + paths: ["/"] + # ingress TLS config + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +# resource requests and limits +resources: + {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +# node labels for pods assignment +# see: +nodeSelector: {} + +# tolerations for pods assignment +# see: +tolerations: [] + +# affinity for pods assignment +# see: +affinity: {} + +# see for details +postgresql: + # enable an included PostgreSQL DB. + # if set to `false`, the values under `webApi.db` are used + enabled: true + # update the default Postgres version to 13.2 + image: # +doc-gen:break + tag: 13.2.0 + # name of the database to create + # see: + postgresqlDatabase: "fhir" + # Name of existing secret to use for PostgreSQL passwords. + # The secret has to contain the keys `postgresql-password` + # which is the password for `postgresqlUsername` when it is + # different of `postgres`, `postgresql-postgres-password` which + # will override `postgresqlPassword`, `postgresql-replication-password` + # which will override `replication.password` and `postgresql-ldap-password` + # which will be sed to authenticate on LDAP. The value is evaluated as a template. + existingSecret: "" + replication: + # should be true for production use + enabled: false + # number of read replicas + readReplicas: 2 + # set synchronous commit mode: on, off, remote_apply, remote_write and local + synchronousCommit: "on" + # from the number of `readReplicas` defined above, set the number of those that will have synchronous replication + numSynchronousReplicas: 1 + metrics: + # should also be true for production use + enabled: false + serviceMonitor: + # create a Prometheus Operator ServiceMonitor resource + enabled: false + # the labels used for Prometheus autodiscover, e.g. could be `release: prometheus` + additionalLabels: {} + containerSecurityContext: # +doc-gen:ignore + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + +# readiness probe +readinessProbe: # +doc-gen:ignore + failureThreshold: 5 + initialDelaySeconds: 30 + periodSeconds: 20 + successThreshold: 1 + timeoutSeconds: 20 +# startup probe +startupProbe: # +doc-gen:ignore + failureThreshold: 10 + initialDelaySeconds: 60 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 30 + +# only used if `postgresql.enabeld=false` +externalDatabase: + # Database host + host: localhost + # non-root Username for FHIR Database + user: fhir + # Database password + password: "" + # Name of an existing secret resource containing the DB password in a 'postgresql-password' key + existingSecret: "" + # Database name + database: fhir + # Database port number + port: 5432