diff --git a/.gitea/workflows/release-chart.yaml b/.gitea/workflows/release-chart.yaml index 062fb42..7c018a3 100644 --- a/.gitea/workflows/release-chart.yaml +++ b/.gitea/workflows/release-chart.yaml @@ -1,13 +1,24 @@ name: Release chart -# Triggered by `git tag chart/vX.Y.Z && git push --tags`, independently of -# image releases — see docs/versioning.md. Never bumps the image: Chart.yaml's -# committed appVersion (last set by release-image.yaml) is what gets packaged, -# so a chart-only release always pins the last released image, never `latest`. +# Triggered by publishing a Gitea Release whose tag matches `chart/vX.Y.Z` +# (create the tag + release together via the Gitea UI's "New Release" page, +# or `git tag chart/vX.Y.Z && git push --tags` followed by turning that tag +# into a Release) — independently of image releases (release-image.yaml), see +# docs/versioning.md. +# +# Ticking "This is a pre-release" on that Gitea Release bakes +# `artifacthub.io/prerelease: "true"` into the packaged Chart.yaml (never +# committed back — see the "Set ArtifactHub prerelease annotation" step +# below), so ArtifactHub lists that specific chart version as a pre-release. +# +# This job also matches the `release: published` event fired by +# release-image.yaml's own auto-created Gitea Release for `image/v*` tags — +# the `if:` guard below skips anything whose tag isn't `chart/v*`. # # Chart version is pure SemVer, deliberately WITHOUT the `+up` build # metadata bookstack-chart uses: Helm rewrites `+` to `_` on OCI push (and # back on pull), which breaks listing in some third-party tooling (e.g. -# Rancher). The aptly version lives in appVersion instead. +# Rancher). The aptly version lives in appVersion instead. A SemVer +# pre-release suffix (`chart/v0.2.0-rc.1`) works fine and is unaffected. # # The chart is pushed under f.weber/charts/aptly, NOT f.weber/aptly: Gitea's # package registry stores both container images and Helm OCI charts as @@ -15,9 +26,8 @@ name: Release chart # the container image of the same name makes the package listing/type # ambiguous. A distinct `charts/` path keeps the two package kinds apart. on: - push: - tags: - - 'chart/v*' + release: + types: [published] concurrency: group: release-chart @@ -25,15 +35,16 @@ concurrency: jobs: release: + if: startsWith(gitea.event.release.tag_name, 'chart/v') runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v4 - - name: Parse chart version from tag + - name: Parse chart version from the release's tag id: version - run: echo "version=${GITEA_REF_NAME#chart/v}" >> "$GITEA_OUTPUT" + run: echo "version=${TAG_NAME#chart/v}" >> "$GITEA_OUTPUT" env: - GITEA_REF_NAME: ${{ gitea.ref_name }} + TAG_NAME: ${{ gitea.event.release.tag_name }} - uses: azure/setup-helm@v4.3.0 with: @@ -54,6 +65,11 @@ jobs: exit 1 fi + - name: Set ArtifactHub prerelease annotation (packaged copy only, never committed) + if: gitea.event.release.prerelease + run: | + yq -i '.annotations["artifacthub.io/prerelease"] = "true"' charts/aptly/Chart.yaml + - name: Import GPG signing key uses: crazy-max/ghaction-import-gpg@v6 with: @@ -88,11 +104,12 @@ jobs: --username "${{ secrets.REGISTRY_USER }}" --password-stdin helm push "aptly-${{ steps.version.outputs.version }}.tgz" oci://git.morlana.online/f.weber/charts - - name: Create Gitea release with chart artifacts + - name: Attach chart artifacts to the Gitea release uses: softprops/action-gh-release@v2 with: - tag_name: ${{ gitea.ref_name }} + tag_name: ${{ gitea.event.release.tag_name }} name: "aptly chart ${{ steps.version.outputs.version }}" + prerelease: ${{ gitea.event.release.prerelease }} body: | `helm pull oci://git.morlana.online/f.weber/charts/aptly --version ${{ steps.version.outputs.version }}` files: | diff --git a/charts/aptly/Chart.yaml b/charts/aptly/Chart.yaml index c0d94c7..7602665 100644 --- a/charts/aptly/Chart.yaml +++ b/charts/aptly/Chart.yaml @@ -5,7 +5,7 @@ description: >- an nginx read/auth sidecar, a fully aptly-native values API, and declarative repo/mirror/publish state reconciled via a Helm hook. type: application -version: 0.1.0 +version: 0.2.0 appVersion: "1.6.3-1" home: https://git.morlana.online/f.weber/aptly-containerized sources: @@ -20,7 +20,7 @@ keywords: maintainers: - name: Florian Weber email: f.weber@flweber.me -icon: https://www.aptly.info/img/aptly_medium.png +icon: https://www.aptly.info/img/logo.png annotations: artifacthub.io/license: MIT artifacthub.io/links: | @@ -31,3 +31,12 @@ annotations: artifacthub.io/signKey: | fingerprint: FC35C0FAA26605C4C21C7BBFBF43884145E5AA94 url: https://git.morlana.online/f.weber/aptly-containerized/raw/branch/main/pubkeys/chart-signing.asc + artifacthub.io/changes: | + - kind: added + description: Configurable ServiceAccount (serviceAccount.create/name/annotations/automountServiceAccountToken), defaulting to a dedicated ServiceAccount per release. + - kind: added + description: Configurable internal container ports (ports.aptly/nginx/metrics). + - kind: fixed + description: nginx and aptly no longer both listen on port 8080 inside the same pod, which made nginx fail to start with "address already in use". nginx now defaults to 8081 internally; external service.port is unchanged. + - kind: changed + description: Chart releases are now triggered by publishing a Gitea Release (instead of a bare tag push), so pre-releases can be flagged for ArtifactHub. diff --git a/charts/aptly/README.md b/charts/aptly/README.md index 56ac8f5..5c448c6 100644 --- a/charts/aptly/README.md +++ b/charts/aptly/README.md @@ -311,6 +311,15 @@ plain, supported operation. | `persistence.size` | `20Gi` | immutable once installed unless using `existingClaim` | | `persistence.annotations` | `{}` | | +### ServiceAccount + +| Key | Default | Description | +|---|---|---| +| `serviceAccount.create` | `true` | creates a dedicated `ServiceAccount` for this release | +| `serviceAccount.name` | `""` | `create: true` → defaults to the release's fullname; `create: false` → set this to bind an existing `ServiceAccount`, or leave `""` to use the namespace's `default` one | +| `serviceAccount.annotations` | `{}` | e.g. for IRSA/Workload Identity | +| `serviceAccount.automountServiceAccountToken` | `true` | | + ### Workload | Key | Default | Description | @@ -330,8 +339,11 @@ plain, supported operation. | Key | Default | Description | |---|---|---| | `service.type` | `ClusterIP` | | -| `service.port` | `8080` | | +| `service.port` | `8080` | external port — unaffected by `ports.*` below, which are internal-only | | `service.annotations` | `{}` | | +| `ports.aptly` | `8080` | container port aptly itself listens on (loopback-only unless `proxy.enabled: false`) | +| `ports.nginx` | `8081` | container port nginx listens on for repo + API traffic; must differ from `ports.aptly` — they're two containers sharing one pod network namespace, and a clash makes nginx fail to start with "address already in use" | +| `ports.metrics` | `9090` | container port nginx listens on for the `/api/metrics` passthrough, when `metrics.service.enabled` | | `ingress.enabled` | `false` | | | `ingress.mode` | `single` | `single` \| `split` — see [docs/security.md](https://git.morlana.online/f.weber/aptly-containerized/src/branch/main/docs/security.md) | | `ingress.className` | `""` | | diff --git a/charts/aptly/templates/NOTES.txt b/charts/aptly/templates/NOTES.txt index 88598a0..3bd2102 100644 --- a/charts/aptly/templates/NOTES.txt +++ b/charts/aptly/templates/NOTES.txt @@ -15,7 +15,7 @@ aptly ({{ .Chart.AppVersion }}, chart {{ .Chart.Version }}) is deploying as {{ $ --- Check it's up ------------------------------------------------------- kubectl exec -n {{ .Release.Namespace }} {{ $fullname }}-0 -c aptly -- \ - curl -fsS http://127.0.0.1:8080/api/ready + curl -fsS http://127.0.0.1:{{ .Values.ports.aptly }}/api/ready kubectl logs -n {{ .Release.Namespace }} job/{{ $fullname }}-reconcile # (only present right after install/upgrade in `hook` mode) diff --git a/charts/aptly/templates/_helpers.tpl b/charts/aptly/templates/_helpers.tpl index 24f7fd9..5bee977 100644 --- a/charts/aptly/templates/_helpers.tpl +++ b/charts/aptly/templates/_helpers.tpl @@ -73,6 +73,19 @@ confirms it's intended. {{- end -}} {{- end -}} +{{/* +Resolves to the ServiceAccount name the pod should bind to: a generated or +overridden name when serviceAccount.create is true, the explicit override +when false, or "" (falls back to the namespace's "default" SA) otherwise. +*/}} +{{- define "aptly.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} +{{- default (include "aptly.fullname" .) .Values.serviceAccount.name -}} +{{- else -}} +{{- .Values.serviceAccount.name -}} +{{- end -}} +{{- end -}} + {{- define "aptly.imagePullSecrets" -}} {{- $secrets := concat (.Values.global.imagePullSecrets | default list) (.Values.image.pullSecrets | default list) -}} {{- if $secrets }} @@ -94,7 +107,7 @@ templates/statefulset.yaml (the aptly config) and templates/ingress.yaml {{- end -}} {{- define "aptly.apiListen" -}} -{{- if .Values.proxy.enabled -}}127.0.0.1:8080{{- else -}}0.0.0.0:8080{{- end -}} +{{- if .Values.proxy.enabled -}}127.0.0.1:{{ .Values.ports.aptly }}{{- else -}}0.0.0.0:{{ .Values.ports.aptly }}{{- end -}} {{- end -}} {{/* @@ -163,7 +176,7 @@ compose/config/nginx.*.conf for the same constraint hit empirically). {{- $sec := include "aptly.security" . | fromJson -}} {{- $p := .Values.proxy -}} server { - listen 8080; + listen {{ .Values.ports.nginx }}; server_name _; client_max_body_size {{ $p.maxUploadSize }}; absolute_redirect off; @@ -176,8 +189,8 @@ server { {{- end }} location = /healthz { access_log off; return 200 "ok\n"; } - location = /api/ready { access_log off; proxy_pass http://127.0.0.1:8080; } - location = /api/healthy { access_log off; proxy_pass http://127.0.0.1:8080; } + location = /api/ready { access_log off; proxy_pass http://127.0.0.1:{{ .Values.ports.aptly }}; } + location = /api/healthy { access_log off; proxy_pass http://127.0.0.1:{{ .Values.ports.aptly }}; } {{- if $sec.w }} location /api/ { @@ -200,7 +213,7 @@ server { {{- else }} auth_basic off; {{- end }} - proxy_pass http://127.0.0.1:8080; + proxy_pass http://127.0.0.1:{{ .Values.ports.aptly }}; proxy_http_version 1.1; proxy_set_header Host $host; proxy_request_buffering off; @@ -254,9 +267,9 @@ server { # Separate, unauthenticated listener so scraping never needs the write-path # credentials and a ServiceMonitor never needs a basicAuth secret. server { - listen 9090; + listen {{ .Values.ports.metrics }}; server_name _; - location = /api/metrics { proxy_pass http://127.0.0.1:8080; } + location = /api/metrics { proxy_pass http://127.0.0.1:{{ .Values.ports.aptly }}; } location / { return 404; } } {{- end }} diff --git a/charts/aptly/templates/job-reconcile.yaml b/charts/aptly/templates/job-reconcile.yaml index 2ce8601..28ccd99 100644 --- a/charts/aptly/templates/job-reconcile.yaml +++ b/charts/aptly/templates/job-reconcile.yaml @@ -39,6 +39,10 @@ spec: spec: restartPolicy: Never {{- include "aptly.imagePullSecrets" . | nindent 6 }} + {{- with include "aptly.serviceAccountName" . }} + serviceAccountName: {{ . }} + {{- end }} + automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: diff --git a/charts/aptly/templates/networkpolicy.yaml b/charts/aptly/templates/networkpolicy.yaml index a4c9baf..31f43eb 100644 --- a/charts/aptly/templates/networkpolicy.yaml +++ b/charts/aptly/templates/networkpolicy.yaml @@ -15,7 +15,7 @@ spec: ingress: {{- if .Values.networkPolicy.allowedNamespaces }} # Restricted to these namespaces (plus this one). NOTE: this applies to - # the whole nginx:8080 endpoint — read and write share one port, so this + # the whole nginx endpoint — read and write share one port, so this # cannot itself express "reads are public, writes are cluster-only" any # more precisely than security.write.allowCIDRs can (see the warning # rendered into nginx.conf for that). Use it to fence the Service off diff --git a/charts/aptly/templates/serviceaccount.yaml b/charts/aptly/templates/serviceaccount.yaml new file mode 100644 index 0000000..f7b6e50 --- /dev/null +++ b/charts/aptly/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "aptly.serviceAccountName" . }} + labels: + {{- include "aptly.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end -}} diff --git a/charts/aptly/templates/statefulset.yaml b/charts/aptly/templates/statefulset.yaml index d085f24..e17534e 100644 --- a/charts/aptly/templates/statefulset.yaml +++ b/charts/aptly/templates/statefulset.yaml @@ -41,6 +41,10 @@ spec: {{- end }} spec: {{- include "aptly.imagePullSecrets" . | nindent 6 }} + {{- with include "aptly.serviceAccountName" . }} + serviceAccountName: {{ . }} + {{- end }} + automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} terminationGracePeriodSeconds: {{ .Values.workload.terminationGracePeriodSeconds }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} @@ -165,7 +169,7 @@ spec: {{- end }} ports: - name: aptly - containerPort: 8080 + containerPort: {{ .Values.ports.aptly }} volumeMounts: - name: data mountPath: /var/lib/aptly @@ -199,10 +203,10 @@ spec: {{- toYaml .Values.nginx.securityContext | nindent 12 }} ports: - name: http - containerPort: 8080 + containerPort: {{ .Values.ports.nginx }} {{- if .Values.metrics.service.enabled }} - name: metrics - containerPort: 9090 + containerPort: {{ .Values.ports.metrics }} {{- end }} volumeMounts: - name: data diff --git a/charts/aptly/values.schema.json b/charts/aptly/values.schema.json index 62d574a..b09b2ef 100644 --- a/charts/aptly/values.schema.json +++ b/charts/aptly/values.schema.json @@ -226,6 +226,15 @@ "publishEndpointName": { "type": "string" } } }, + "ports": { + "type": "object", + "additionalProperties": false, + "properties": { + "aptly": { "type": "integer" }, + "nginx": { "type": "integer" }, + "metrics": { "type": "integer" } + } + }, "persistence": { "type": "object", "additionalProperties": false, @@ -255,6 +264,16 @@ "podLabels": { "type": "object" } } }, + "serviceAccount": { + "type": "object", + "additionalProperties": false, + "properties": { + "create": { "type": "boolean" }, + "name": { "type": "string" }, + "annotations": { "type": "object" }, + "automountServiceAccountToken": { "type": "boolean" } + } + }, "podSecurityContext": { "type": "object" }, "containerSecurityContext": { "type": "object" }, "resources": { "type": "object" }, diff --git a/charts/aptly/values.yaml b/charts/aptly/values.yaml index 194b0eb..f0fadc3 100644 --- a/charts/aptly/values.yaml +++ b/charts/aptly/values.yaml @@ -176,6 +176,16 @@ proxy: readTimeout: "3600s" publishEndpointName: public +# Container ports inside the pod. aptly and nginx are two containers sharing +# one pod network namespace — they MUST NOT use the same port (nginx would +# fail to start with "address already in use"). These are internal-only; +# external access is still controlled by service.port / metrics.service.port, +# which stay decoupled from these via named ports (targetPort: http/metrics). +ports: + aptly: 8080 # aptly's own listener (loopback-only, or 0.0.0.0 when proxy.enabled=false) + nginx: 8081 # nginx's main (repo + API) listener + metrics: 9090 # nginx's /api/metrics passthrough listener, when metrics.service.enabled + persistence: enabled: true existingClaim: "" # set this in production — see docs/operations.md @@ -184,6 +194,17 @@ persistence: size: 20Gi annotations: {} +serviceAccount: + # Own ServiceAccount per release, so RBAC (if you grant any) is scoped to + # this instance rather than the namespace's shared "default" identity. + create: true + # "" -> aptly.fullname (this release's name) when create=true. When + # create=false, set this to bind to a ServiceAccount you already manage; + # leave "" to fall back to the namespace's "default" ServiceAccount. + name: "" + annotations: {} + automountServiceAccountToken: true + workload: updateStrategy: type: RollingUpdate # safe here: a StatefulSet with replicas=1 always