unicef / magasin-drill Goto Github PK

This is the expected structure of a helm chart (https://helm.sh/docs/topics/charts/#the-chart-file-structure)

wordpress/
  Chart.yaml          # A YAML file containing information about the chart
  LICENSE             # OPTIONAL: A plain text file containing the license for the chart
  README.md           # OPTIONAL: A human-readable README file
  values.yaml         # The default configuration values for this chart
  values.schema.json  # OPTIONAL: A JSON Schema for imposing a structure on the values.yaml file
  charts/             # A directory containing any charts upon which this chart depends.
  crds/               # Custom Resource Definitions
  templates/          # A directory of templates that, when combined with values,
                      # will generate valid Kubernetes manifest files.
  templates/NOTES.txt # OPTIONAL: A plain text file containing short usage notes

However, LICENSE and README.md are in the root of the repository, not on the root of the helm chart (ie. charts/drill/)

An option is to crate a symbolic link.

Currently the images that drill has are not multi-platform.

https://docs.docker.com/build/building/multi-platform/

Ensure that the signatures for the files are correct.

Currently the zookeper helm chart resides within the charts/ folder of the drill helm chart. This folder is used to keep the dependencies, however, it should be possible to install zookeeper independently.

In the templates the .ReleaseName is not used. however it is a good practice

https://v2.helm.sh/docs/chart_best_practices/

Currently the communication between drill and zookeeper is performed without encryption.
To enhance the security it would be better to be able to setup SSL certificates upon installation.

In the helm chart there is no way to set environment variables for the zookeeper chart

The docker images run the servers (zookeeper and drill) using root account.
If one of the instances gets compromised the attacker would have full control of the container, allowing him, for example to install new tools.
To prevent this servers can be run with non-privileged accounts.

Create the helm repo using github pages and github actions so that the chart can be installed running something like:

helm repo add drill https://<url>
helm install my-drill drill/drill

Currently the zookeeper image cannot be customized.
There should be a way to inject in the image the /opt/zookeeper/zoo.cfg configuration.

While testing new versions of the images pushing to the registry may not be something wanted.
Build scripts push the images unless if during development the push commands are commented. This may lead to errors.
To prevent it, add an option in the script that allows to push to the registry. By default it should not push

At the moment of the original project was deployed there was not an official image of zookeeper.

https://github.com/31z4/zookeeper-docker/

That image generation is more secure as it checks the signatures.

Tasks required:

1. Update the helm chart
2. Remove the docker image generation files
3. Update this project documentation (see below folders)

For the documentation. These are the standard folders used.

ENV ZOO_CONF_DIR=/conf
ZOO_DATA_DIR=/data
ZOO_DATA_LOG_DIR=/datalog
ZOO_LOG_DIR=/logs \

Steps:

Run command

 ./build.sh -r merlos -v 3.9.2 -p

It throws the error:

PROJECT=zookeeper
VERSION=3.9.2
REGISTRT=merlos
TAG=3.9.2
PUSH=true
+ docker buildx inspect magasin-builder
+ echo 'magasin-builder buildx instance already exists.'
magasin-builder buildx instance already exists.
+ [[ true == true ]]
+ echo 'Pushing to registry merlos...'
Pushing to registry merlos...
+ docker buildx build --builder=magasin-builder --platform linux/amd64,linux/arm64 --build-arg VERSION=3.9.2 -t merlos/zookeeper:3.9.2 --push .
[+] Building 0.0s (0/0)                                                                                               docker-container:magasin-builder
ERROR: Cannot connect to the Docker daemon at unix:///Users/user/.docker/run/docker.sock. Is the docker daemon running?
+ echo Done
Done
./build.sh: line 107: syntax error near unexpected token `fi'
./build.sh: line 107: `fi'

Currently, the documentation does not state that there is a helm repo. This is on purpose as the idea is to use the unicef/magasin repo.
This has dependency on when that repo is published.

Currently, the versions that the docker images are using are based on CentOS 7.0 (inherit from original project)

However:

• This OS is old version that is not longer maintained.
• Not aligned with team GNU/Linux distribution of preference (debian).

In each subfolder of the docker folders, there is a build script (./build.sh) that receives two arguments

1. the docker hub repo name (username),
2. and the drill/zookeper version to download.

For instance

./docker/drill/build.sh merlos 1.21.1

It generates the corresponding image tagged as 1.21.1, however you may have more than one image with that version. So there should be a way to add some postfix to the tag of the image generated.

Generally the chart will be updated whenever there is a new version of drill or zookeeper images.
Currently the app version only mentions drill.

Change the version of the chart from 1.21.1 to 1.21.1-3.9.1 where the first one is drill and the second one is zookeeper's version.