feat: add helm chart

helm/warpgate/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/warpgate/Chart.yaml

@@ -0,0 +1,25 @@
+apiVersion: v2
+name: warpgate
+description: A Helm chart for WarpGate inside of Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+# version: 0.1.3
+version: 0.0.1
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "0.16.0"

helm/warpgate/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "warpgate.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "warpgate.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "warpgate.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "warpgate.labels" -}}
+helm.sh/chart: {{ include "warpgate.chart" . }}
+{{ include "warpgate.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "warpgate.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "warpgate.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "warpgate.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "warpgate.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

helm/warpgate/templates/configmap.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.overrides_config }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "warpgate.fullname" . }}-config-overrides
+  labels:
+    {{- include "warpgate.labels" . | nindent 4 }}
+data:
+  warpgate.yaml: |
+  {{ .Values.overrides_config | nindent 4 }}
+{{- end }}

helm/warpgate/templates/deployment.yaml

@@ -0,0 +1,212 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "warpgate.fullname" . }}
+  labels:
+    {{- include "warpgate.labels" . | nindent 4 }}
+    {{- with .Values.deploymentLabels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "warpgate.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "warpgate.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      initContainers:
+        - name: {{ .Chart.Name }}-setup
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          {{- if .Values.setup.envFromSecret }}
+          env:
+          {{- range $key, $val := .Values.setup.envFromSecret }}
+            - name: {{ $key }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ (split "/" $val)._0 }}
+                  key: {{ (split "/" $val)._1 }}
+          {{- end }}
+          {{- end }}
+          command: 
+            - /bin/sh
+            - -c
+            - |
+              set -e
+
+              if [ -d /ssh-keys ]; then
+                mkdir -p /data/ssh-keys
+                cp /ssh-keys/client-ed25519 /ssh-keys/client-rsa /ssh-keys/host-ed25519 /ssh-keys/host-rsa /data/ssh-keys/
+                chmod -R 600 /data/ssh-keys/*
+              fi
+
+              if [ -d /tls-cert ]; then
+                cp /tls-cert/tls.crt /data/tls.certificate.pem
+                cp /tls-cert/tls.key /data/tls.key.pem
+              fi
+
+              {{- if .Values.setup.enabled }}
+              {{- if eq .Values.setup.type "podinit" }}
+              if [ ! -f /data/warpgate.yaml ]; then
+                warpgate -c /data/warpgate.yaml  unattended-setup --data-path /data
+                  {{- if .Values.setup.http }} --http-port {{ .Values.setup.http }} {{- end }}
+                  {{- if .Values.setup.ssh }} --ssh-port {{ .Values.setup.ssh }} {{- end }}
+                  {{- if .Values.setup.mysql }} --mysql-port {{ .Values.setup.mysql }} {{- end }}
+                  {{- if .Values.setup.pgsql }} --postgres-port {{ .Values.setup.pgsql }} {{- end }}
+                  {{/*{{- if .Values.setup.kubernetes }} --kubernetes-port {{ .Values.setup.kubernetes }} {{- end }}*/}}
+                  {{- if .Values.setup.databaseUrl }} --database-url "{{ .Values.setup.databaseUrl }}" {{- end }}
+                  {{- if .Values.setup.recordSessions }} --record-sessions {{- end }}
+
+                {{- if .Values.setup.disableIpV6 }}
+                sed -i 's/\[::\]:\([0-9]\+\)/0.0.0.0:\1/g' /data/warpgate.yaml
+                {{- end }}
+              fi
+              {{- end }}
+              {{- end }}
+
+              if [ -d /override ]; then
+                cp /override/warpgate.yaml /data/warpgate.yaml
+                {{- if .Values.conifg_env_var_replace }}
+                VARS="{{ .Values.conifg_env_var_replace }}"
+                for VAR in $VARS; do
+                 VAL=$(printenv "$VAR")
+                 ESCAPED=$(printf '%s' "$VAL" | sed -e 's/[\/&]/\\&/g')
+                 FVAR=$(printf '$%s' "$VAR")
+                 sed -i "s/$FVAR/$ESCAPED/g" /data/warpgate.yaml
+                done
+                {{- end }}
+                chmod 600 /data/warpgate.yaml
+              fi
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            {{- if .Values.ssh_keys_secret  }}
+            - name: ssh-keys
+              mountPath: /ssh-keys
+            {{- end }}
+            {{- if .Values.tls_cert_secret }}
+            - name: tls-cert
+              mountPath: /tls-cert
+            {{- end }}
+            {{- if .Values.overrides_config }}
+            - name: override-config
+              mountPath: /override
+            {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          {{- with .Values.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: 
+            - warpgate
+            - -c 
+            - /data/warpgate.yaml
+            - run
+          ports:
+            {{- if .Values.setup.ssh }}
+            - name: ssh
+              containerPort: {{ .Values.setup.ssh }}
+              protocol: TCP
+            {{- end }}
+            {{- if .Values.setup.http }}
+            - name: http
+              containerPort: {{ .Values.setup.http }}
+              protocol: TCP
+            {{- end }}
+            {{- if .Values.setup.mysql }}
+            - name: mysql
+              containerPort: {{ .Values.setup.mysql }}
+              protocol: TCP
+            {{- end }}
+            {{- if .Values.setup.pgsql }}
+            - name: pgsql
+              containerPort: {{ .Values.setup.pgsql }}
+              protocol: TCP
+            {{- end }}
+            {{- if .Values.setup.kubernetes }}
+            - name: kubernetes
+              containerPort: {{ .Values.setup.kubernetes }}
+              protocol: TCP
+            {{- end }}
+          {{- with .Values.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            {{- with .Values.volume_mounts }}
+              {{- toYaml . | nindent 12 }}
+            {{- end }}
+            - name: data
+              mountPath: /data
+      volumes:
+        {{- with .Values.volumes }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.ssh_keys_secret }}
+        - name: ssh-keys
+          secret:
+            secretName: {{ . }}
+        {{- end }}
+        {{- with .Values.tls_cert_secret }}
+        - name: tls-cert
+          secret:
+            secretName: {{ . }}
+        {{- end }}
+        {{- if .Values.overrides_config }}
+        - name: override-config
+          configMap:
+            name: {{ include "warpgate.fullname" . }}-config-overrides
+        {{- end }}
+        {{- if .Values.data.pvc.enabled }}
+        - name: data
+          persistentVolumeClaim:
+            {{- if .Values.data.pvc.claimName }}
+            claimName: {{ .Values.data.pvc.claimName }}
+            {{- else }}
+            claimName: {{ include "warpgate.fullname" . }}-data
+            {{- end }}
+        {{- else }}
+        - name: data
+          emptyDir: {}
+        {{- end }}
+
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

helm/warpgate/templates/ingress.yaml

@@ -0,0 +1,45 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "warpgate.fullname" . }}
+  labels:
+    {{- include "warpgate.labels" . | nindent 4 }}
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+    nginx.ingress.kubernetes.io/proxy-ssl-verify: "false"
+  {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- with .pathType }}
+            pathType: {{ . }}
+            {{- end }}
+            backend:
+              service:
+                name: {{ include "warpgate.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.ports.http }}
+          {{- end }}
+    {{- end }}
+{{- end }}

helm/warpgate/templates/pvc.yaml

@@ -0,0 +1,10 @@
+{{- if and .Values.data.pvc.enabled (not .Values.data.pvc.claimName) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "warpgate.fullname" . }}-data
+  labels:
+    {{- include "warpgate.labels" . | nindent 4 }}
+spec:
+  {{- toYaml .Values.data.pvc.template | nindent 2 }}
+{{- end }}