Skip to content

Commit 8145aae

Browse files
author
RoRu
committed
infra: use helm chart for deployments
Test secContext
1 parent 5fcb2af commit 8145aae

19 files changed

+525
-369
lines changed

‎.github/workflows/production.yml‎

Lines changed: 11 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
build:
1212
runs-on: ubuntu-latest
1313
outputs:
14-
image_name: ${{ steps.build.outputs.image_name }}
14+
image_name: '${{ steps.build.outputs.image_name }}'
1515
steps:
1616
- uses: actions/checkout@v2
1717

@@ -24,7 +24,7 @@ jobs:
2424
environment: production
2525
needs: build
2626
container:
27-
image: qwolphin/kdsl:1.21.8
27+
image: ghcr.io/helmfile/helmfile-ubuntu:v0.145.3
2828
strategy:
2929
fail-fast: false
3030
matrix:
@@ -38,33 +38,23 @@ jobs:
3838
- name: GCP Auth
3939
uses: google-github-actions/[email protected]
4040
with:
41-
credentials_json: ${{ secrets.GCP_SA_KEY }}
41+
credentials_json: '${{ secrets.GCP_SA_KEY }}'
4242
- name: Get GKE credentials
4343
uses: google-github-actions/[email protected]
4444
with:
45-
cluster_name: ${{ secrets.GKE_CLUSTER }}
46-
location: ${{ secrets.GKE_CLUSTER_REGION }}
45+
cluster_name: '${{ secrets.GKE_CLUSTER }}'
46+
location: '${{ secrets.GKE_CLUSTER_REGION }}'
4747

4848
- name: Render kdsl resources into yaml
4949
env:
5050
MAINNET_RPC: '${{ secrets.MAINNET_RPC }}'
5151
POLYGON_RPC: '${{ secrets.POLYGON_RPC }}'
52-
RECIPE: "chain${{ matrix.CHAIN_ID }}"
53-
DOMAIN: cache-api-${{ matrix.CHAIN_ID }}.aave.com
54-
CHAIN_ID: ${{ matrix.CHAIN_ID }}
55-
IMAGE: ${{ needs.build.outputs.image_name }}
52+
DOMAIN: 'cache-api-${{ matrix.CHAIN_ID }}.aave.com'
53+
CHAIN_ID: '${{ matrix.CHAIN_ID }}'
54+
IMAGE: '${{ needs.build.outputs.image_name }}'
5655
COMMIT_SHA: "${{ github.sha }}"
57-
NAMESPACE: cache-${{ matrix.CHAIN_ID }}
56+
NAMESPACE: 'cache-${{ matrix.CHAIN_ID }}'
5857
ENV_NAME: production
58+
HELM_PLUGINS: '/root/.local/share/helm/plugins'
5959
run: |
60-
cd k8s/
61-
kubectl config set-context --current --namespace=${{ env.NAMESPACE }}
62-
python3 main.py > ../rendered.yml
63-
64-
- name: Apply k8s resources
65-
run: |
66-
kubectl apply -f rendered.yml --dry-run=server
67-
kubectl apply -f rendered.yml
68-
sleep 3
69-
kubectl wait --for condition=ready --timeout 90s pods -l "commit_sha=${{ github.sha }}" || \
70-
{ kubectl get pods && exit 1; }
60+
helmfile apply --suppress-diff

‎.github/workflows/pull-request-close.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -9,29 +9,29 @@ jobs:
99
runs-on: ubuntu-latest
1010
environment: preview
1111
container:
12-
image: registry.gitlab.com/aave-tech/k8s:63f618c0
13-
credentials:
14-
username: github-actions
15-
password: ${{ secrets.KUBE_IMAGE_PULL }}
12+
image: ghcr.io/helmfile/helmfile-ubuntu:v0.145.3
1613
strategy:
1714
fail-fast: false
1815
matrix:
1916
CHAIN_ID: ["1", "137", "43114"]
2017
steps:
18+
- uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
19+
2120
- name: Set k8s namespace
2221
shell: bash
23-
run: echo "NAMESPACE=cache-${NS_SUFFIX,,}" | tr -c '[:alnum:]-=\n' '-' >>${GITHUB_ENV}
22+
run: |
23+
cat <<EOF | tr -c '[:alnum:]-=\n' '-' >> ${GITHUB_ENV}
24+
NAMESPACE=cache-${NS_SUFFIX,,}
25+
EOF
2426
env:
2527
NS_SUFFIX: "${{ github.head_ref }}-${{ matrix.CHAIN_ID }}"
2628

2729
- name: Remove preview env
2830
env:
2931
REF_NAME: '${{ github.head_ref }}'
32+
CHAIN_ID: '${{ matrix.CHAIN_ID }}'
3033
run: |
3134
mkdir -p ~/.kube
3235
echo "${{ secrets.DEV_KUBECONFIG }}" > ~/.kube/config
33-
kubectl config set-context --current --namespace="${{ env.NAMESPACE }}"
34-
kubectl delete deploy --all
35-
kubectl delete svc --all
36-
kubectl delete ingress --all
37-
kubectl delete ns "${{ env.NAMESPACE }}"
36+
helmfile destroy
37+
kubectl delete ns '${{ env.NAMESPACE }}'

‎.github/workflows/pull-request.yml‎

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
environment: preview
3434
needs: build
3535
container:
36-
image: qwolphin/kdsl:1.21.8
36+
image: ghcr.io/helmfile/helmfile-ubuntu:v0.145.3
3737
strategy:
3838
fail-fast: false
3939
matrix:
@@ -44,36 +44,35 @@ jobs:
4444
- name: Set k8s namespace
4545
shell: bash
4646
run: |
47-
echo -e "NAMESPACE=cache-${NS_SUFFIX,,}\nENV_NAME=${{ github.head_ref }}" | tr -c '[:alnum:]-=\n_' '-' >> ${GITHUB_ENV}
47+
cat <<EOF | tr -c '[:alnum:]-=\n_' '-' >> ${GITHUB_ENV}
48+
NAMESPACE=cache-${NS_SUFFIX,,}
49+
ENV_NAME=${{ github.head_ref }}
50+
EOF
4851
env:
4952
NS_SUFFIX: "${{ github.head_ref }}-${{ matrix.CHAIN_ID }}"
5053

51-
- name: Render kdsl resources into yaml
52-
env:
53-
MAINNET_RPC: "${{ secrets.MAINNET_RPC }}"
54-
POLYGON_RPC: "${{ secrets.POLYGON_RPC }}"
55-
RECIPE: "chain${{ matrix.CHAIN_ID }}"
56-
DOMAIN: "${{ env.NAMESPACE }}.aaw.fi"
57-
CHAIN_ID: "${{ matrix.CHAIN_ID }}"
58-
IMAGE: "${{ needs.build.outputs.image_name }}"
59-
COMMIT_SHA: "${{ github.sha }}"
60-
run: |
61-
cd k8s/
62-
python3 main.py > ../rendered.yml
63-
6454
- name: Set up kubeconfig
6555
run: |
6656
mkdir -p ~/.kube
6757
echo "${{ secrets.DEV_KUBECONFIG }}" > ~/.kube/config
68-
kubectl config set-context --current --namespace="${{ env.NAMESPACE }}"
6958
7059
- name: Apply k8s resources
7160
shell: bash
61+
env:
62+
MAINNET_RPC: "${{ secrets.MAINNET_RPC }}"
63+
POLYGON_RPC: "${{ secrets.POLYGON_RPC }}"
64+
DOMAIN: "${{ env.NAMESPACE }}.aaw.fi"
65+
CHAIN_ID: "${{ matrix.CHAIN_ID }}"
66+
IMAGE: "${{ needs.build.outputs.image_name }}"
67+
COMMIT_SHA: "${{ github.sha }}"
68+
HELM_PLUGINS: '/root/.local/share/helm/plugins'
7269
run: |
73-
kubectl apply -f rendered.yml
74-
sleep 3
75-
kubectl wait --for condition=ready --timeout 90s pods -l "commit_sha=${{ github.sha }}" || \
76-
{ kubectl get pods && exit 1; }
70+
helmfile sync && exit 0 || true
71+
helmfile status | grep pending-upgrade
72+
RELEASE="$(helmfile status | grep NAME: | awk '{print $2}')"
73+
REVISION="$(helmfile status | grep REVISION: | awk '{print $2}')"
74+
helm rollback --wait -n "${NAMESPACE}" "${RELEASE}" "$((REVISION-1))"
75+
helmfile sync
7776
7877
- uses: actions/github-script@v5
7978
if: ${{ github.event.action == 'opened' || github.event.action == 'reopened' }}

‎helm/chart/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎helm/chart/Chart.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: v2
2+
name: aave-caching-server
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0

‎helm/chart/templates/_helpers.tpl‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "chart.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "chart.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "chart.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{- define "common.env" -}}
34+
{{- with .Values.common.env }}
35+
{{ toYaml . }}
36+
{{- end }}
37+
{{- end }}
38+
39+
{{/*
40+
Common labels
41+
*/}}
42+
{{- define "common.labels" -}}
43+
{{- with .Values.common.labels }}
44+
{{- toYaml . }}
45+
{{- end }}
46+
app.kubernetes.io/managed-by: {{ .Release.Service }}
47+
{{- end }}
48+
49+
{{/*
50+
Common annotations
51+
*/}}
52+
{{- define "common.annotations" -}}
53+
{{- with .Values.common.annotations }}
54+
{{- toYaml . }}
55+
{{- end }}
56+
{{- end }}

‎helm/chart/templates/api.yaml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: api
5+
labels:
6+
{{- include "common.labels" . | nindent 4 }}
7+
component: api
8+
annotations:
9+
{{- include "common.annotations" . | nindent 4 }}
10+
spec:
11+
strategy:
12+
type: RollingUpdate
13+
rollingUpdate:
14+
maxSurge: 1
15+
maxUnavailable: 0
16+
replicas: 1
17+
selector:
18+
matchLabels:
19+
component: api
20+
template:
21+
metadata:
22+
annotations:
23+
{{- with .Values.api.podAnnotations }}
24+
{{- toYaml . | nindent 8 }}
25+
{{- end }}
26+
{{- include "common.annotations" . | nindent 8 }}
27+
labels:
28+
{{- include "common.labels" . | nindent 8 }}
29+
component: api
30+
spec:
31+
automountServiceAccountToken: false
32+
enableServiceLinks: false
33+
containers:
34+
- name: api
35+
env:
36+
- name: REDIS_HOST
37+
value: redis
38+
{{- include "common.env" . | nindent 12 }}
39+
image: "{{ .Values.common.image }}"
40+
imagePullPolicy: Always
41+
ports:
42+
- name: http
43+
containerPort: 3000
44+
protocol: TCP
45+
livenessProbe:
46+
httpGet:
47+
path: '/.well-known/apollo/server-health'
48+
port: http
49+
initialDelaySeconds: 5
50+
periodSeconds: 10
51+
successThreshold: 1
52+
timeoutSeconds: 3
53+
failureThreshold: 5
54+
readinessProbe:
55+
httpGet:
56+
path: '/.well-known/apollo/server-health'
57+
port: http
58+
initialDelaySeconds: 5
59+
periodSeconds: 10
60+
successThreshold: 1
61+
timeoutSeconds: 3
62+
failureThreshold: 5
63+
resources:
64+
{{- toYaml .Values.api.resources | nindent 12 }}
65+
securityContext:
66+
allowPrivilegeEscalation: false
67+
privileged: false
68+
runAsNonRoot: true
69+
runAsUser: 1000
70+
runAsGroup: 1000
71+
capabilities:
72+
drop:
73+
- ALL
74+
---
75+
apiVersion: v1
76+
kind: Service
77+
metadata:
78+
name: api
79+
labels:
80+
{{- include "common.labels" . | nindent 4 }}
81+
component: api
82+
annotations:
83+
{{- include "common.annotations" . | nindent 4 }}
84+
spec:
85+
type: ClusterIP
86+
ports:
87+
- port: 3000
88+
targetPort: http
89+
protocol: TCP
90+
name: http-3000
91+
selector:
92+
component: api

‎helm/chart/templates/ingress.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: main
5+
labels:
6+
{{- include "common.labels" . | nindent 4 }}
7+
annotations:
8+
{{- with .Values.ingress.annotations }}
9+
{{- toYaml . | nindent 4 }}
10+
{{- end }}
11+
{{- include "common.annotations" . | nindent 4 }}
12+
spec:
13+
ingressClassName: nginx
14+
tls:
15+
- hosts:
16+
- {{ .Values.ingress.domain | quote }}
17+
rules:
18+
- host: {{ .Values.ingress.domain | quote }}
19+
http:
20+
paths:
21+
- path: /
22+
pathType: Prefix
23+
backend:
24+
service:
25+
name: api
26+
port:
27+
name: http-3000

0 commit comments

Comments
 (0)