maykinmedia / charts Goto Github PK

title

Only set envvars when defined in values.yaml

E.g.

  {{- if .Values.extraVerifyCerts }}
  EXTRA_VERIFY_CERTS: {{ .Values.extraVerifyCerts | toString | quote }}
  {{- end }}

The following values in the values.yaml are missing:
persistence:
mediaMountSubpath: openinwoner/media
privateMediaMountSubpath: openinwoner/private_media

In openarchiefbeheer, setting these fields in the values.yaml:

livenessProbe: {}
readinessProbe: {}

results in

charts/charts/openarchiefbeheer$ helm lint .
==> Linting .
[INFO] Chart.yaml: icon is recommended
[ERROR] templates/deployment.yaml: unable to parse YAML: error converting YAML to JSON: yaml: line 56: did not find expected key

Error: 1 chart(s) linted, 1 chart(s) failed

While setting the probes to:

livenessProbe:
  initialDelaySeconds: 60
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 6
  successThreshold: 1

readinessProbe:
  initialDelaySeconds: 30
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 6
  successThreshold: 1

Results in a chart without errors when running helm lint.

We need to find a way to disable the probes without breaking the chart.

Setting the DISABLE_2FA environment variable for the components that support this setting should be supported in the helm charts of those components (like open-zaak) with something like settings.disable_2fa=true.

There are now 2 (3 if you count ingress) places to configure max upload:

Application:

settings.maxFileUpload

nginx:

nginx.config.clientMaxBodySize

This is confusing, the default values are also not the same.

Change nginx config to opt in.

In de repo's van Objects en Object types staan ook Helm charts, maar zijn al ouder. Welke kunnen we het beste gebruiken voor installatie bij SSC Enschede op Azure AKS?

(overigens fijn dat jullie Helm charts maken voor al deze componenten)

Not all charts need these vars:

{{/*
Worker labels
*/}}
{{- define "<name>.workerLabels" -}}
{{ include "<name>.commonLabels" . }}
{{ include "<name>.workerSelectorLabels" . }}
{{- end }}

{{/*
Worker selector labels
*/}}
{{- define "<name>.workerSelectorLabels" -}}
app.kubernetes.io/name: {{ include "<name>.workerName" . }}
{{- end }}

We should check from which charts it can be removed.

Add support for deploying openinwoner on Google Cloud Platform (GCP). A GKE ingress results in a GCP loadbalancer wich requires a backend config Kubernetes resource.

When you go to for example: https://openzaaktypebeheer.test.opengem.nl/

You will end up at https://openzaaktypebeheer.test.opengem.nl/login
When you refresh you get a 404, because /login is not found.

A dirty fix that works and could be added to the chart configmap add to nginx config:

      location ~ ^/login {
        return 301 https://openzaaktypebeheer.test.opengem.nl;

@SilviaAmAm Something that should be fixed in the application or maybe have a better location in nginx where this /login should go?

e.g. extra volume mounts, extra verify certs, etc.

 default.conf: |
    # Rate limiting configuration - allow 1 request per second. 10m can track about 80000 clients.
    limit_req_zone $binary_remote_addr zone={{ include "openforms.fullname" . }}.{{ .Release.Namespace }}_discover:10m rate=1r/s;

Make it opt in, you might want to configure this at the infrastructure level (ingress / loadbalancer / etc).

Add a value: .Values.global.configuration.enabled to globally enable or disable configuration for all charts.
Configuration in a particular chart should only take place when both .Values.global.configuration.enabled and .Values.configuration.enabled are true.

When a PR is made, check that helm lint succeeds. Otherwise block merging.