Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
81 lines
3.3 KiB
YAML
81 lines
3.3 KiB
YAML
{{- if .Values.reconcile.enabled }}
|
|
{{- $fullname := include "aptly.fullname" . -}}
|
|
{{- $img := .Values.reconcile.image -}}
|
|
{{- $repo := $img.repository | default .Values.image.repository -}}
|
|
{{- $tag := $img.tag | default .Values.image.tag | default .Chart.AppVersion -}}
|
|
{{- $registry := .Values.global.imageRegistry -}}
|
|
{{- $image := ternary (printf "%s/%s:%s" $registry $repo $tag) (printf "%s:%s" $repo $tag) (ne $registry "") -}}
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
{{- if eq .Values.reconcile.mode "hook" }}
|
|
name: {{ $fullname }}-reconcile
|
|
annotations:
|
|
helm.sh/hook: post-install,post-upgrade
|
|
helm.sh/hook-weight: "5"
|
|
# Deliberately no hook-failed: a failed Job stays around for `kubectl
|
|
# logs`/`kubectl describe job` instead of vanishing before anyone can
|
|
# read why reconciliation didn't converge.
|
|
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
|
{{- else }}
|
|
# A plain (non-hook) Job named after the desired state's hash, for GitOps
|
|
# controllers (ArgoCD/Flux) that reconcile hooks poorly: it only re-runs
|
|
# when aptly.{gpgKeys,localRepos,mirrors,publish} actually change.
|
|
name: {{ $fullname }}-reconcile-{{ dict "localRepos" .Values.aptly.localRepos "mirrors" .Values.aptly.mirrors "publish" .Values.aptly.publish | toYaml | sha256sum | trunc 8 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "aptly.labels" . | nindent 4 }}
|
|
spec:
|
|
backoffLimit: 3
|
|
activeDeadlineSeconds: {{ mul .Values.reconcile.timeoutSeconds 2 }}
|
|
{{- if ne .Values.reconcile.mode "hook" }}
|
|
ttlSecondsAfterFinished: 86400
|
|
{{- end }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "aptly.selectorLabels" . | nindent 8 }}
|
|
app.kubernetes.io/component: reconcile
|
|
spec:
|
|
restartPolicy: Never
|
|
{{- include "aptly.imagePullSecrets" . | nindent 6 }}
|
|
securityContext:
|
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
|
containers:
|
|
- name: reconcile
|
|
image: {{ $image }}
|
|
imagePullPolicy: {{ $img.pullPolicy | default .Values.image.pullPolicy }}
|
|
command: ["/usr/local/bin/aptly-reconcile"]
|
|
securityContext:
|
|
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
|
env:
|
|
- name: APTLY_URL
|
|
value: "http://{{ $fullname }}:{{ .Values.service.port }}"
|
|
- name: APTLY_STATE_FILE
|
|
value: /state.yaml
|
|
- name: APTLY_FAIL_ON_ERROR
|
|
value: {{ .Values.reconcile.failOnError | quote }}
|
|
- name: APTLY_WAIT_TIMEOUT
|
|
value: {{ .Values.reconcile.timeoutSeconds | quote }}
|
|
{{- if .Values.security.auth.internalUser.enabled }}
|
|
- name: APTLY_USER
|
|
value: {{ .Values.security.auth.internalUser.username | quote }}
|
|
- name: APTLY_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ $fullname }}-credentials
|
|
key: internal-password
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: state
|
|
mountPath: /state.yaml
|
|
subPath: state.yaml
|
|
readOnly: true
|
|
resources:
|
|
{{- toYaml .Values.reconcile.resources | nindent 12 }}
|
|
volumes:
|
|
- name: state
|
|
configMap:
|
|
name: {{ $fullname }}-state
|
|
{{- end }}
|