fix(inventree): fix errors and restructure chart to be readable (#3594)

* fix(inventree): fix errors * update runas of init * no rofs * run init as root * fix typo * do some cleanup * lets test * more cleanup * nomount * rename * ughhh * hmm * encode * dont cd * root * update UI * change dir * back to default redis user * cleanup
2022-08-28 12:50:32 +03:00
parent 76248886c0
commit ba1c80fe36
10 changed files with 334 additions and 314 deletions
@@ -0,0 +1,96 @@
+{{/* Define the secrets */}}
+{{- define "inventree.config" -}}
+
+{{- $configName := printf "%s-inventree-config" (include "tc.common.names.fullname" .) }}
+---
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $configName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
+data:
+  INVENTREE_TIMEZONE: {{ .Values.TZ }}
+  INVENTREE_DB_ENGINE: "postgresql"
+  INVENTREE_DB_NAME: {{ .Values.postgresql.postgresqlDatabase }}
+  INVENTREE_DB_USER: {{ .Values.postgresql.postgresqlUsername }}
+  INVENTREE_DB_HOST: {{ printf "%v-%v" .Release.Name "postgresql" }}
+  INVENTREE_DB_PORT: "5432"
+  INVENTREE_CACHE_PORT: "6379"
+  INVENTREE_WEB_PORT: "8000"
+  {{- with .Values.inventree.mail.backend }}
+  INVENTREE_EMAIL_BACKEND: {{ . }}
+  {{- end }}
+  {{- with .Values.inventree.mail.host }}
+  INVENTREE_EMAIL_HOST: {{ . }}
+  {{- end }}
+  {{- with .Values.inventree.mail.port }}
+  INVENTREE_EMAIL_PORT: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.inventree.mail.username }}
+  INVENTREE_EMAIL_USERNAME: {{ . }}
+  {{- end }}
+  INVENTREE_EMAIL_TLS: '{{ ternary "True" "False" .Values.inventree.mail.tls | default "False" }}'
+  INVENTREE_EMAIL_SSL: '{{ ternary "True" "False" .Values.inventree.mail.ssl | default "False" }}'
+  {{- with .Values.inventree.mail.sender }}
+  INVENTREE_EMAIL_SENDER: {{ . }}
+  {{- end }}
+  {{- if .Values.inventree.general.debug }}
+  INVENTREE_DEBUG: {{ .Values.inventree.general.debug | quote }}
+  {{- end }}
+  {{- with .Values.inventree.general.log_level }}
+  INVENTREE_LOG_LEVEL: {{ . }}
+  {{- end }}
+  {{- if .Values.inventree.general.plugins_enabled }}
+  INVENTREE_PLUGINS_ENABLED: {{ .Values.inventree.general.plugins_enabled | quote }}
+  {{- end }}
+  {{- with .Values.inventree.general.login_confirm_days }}
+  INVENTREE_LOGIN_CONFIRM_DAYS: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.inventree.general.login_attempts }}
+  INVENTREE_LOGIN_ATTEMPTS: {{ . | quote }}
+  {{- end }}
+  nginx.conf: |-
+    server {
+      listen {{ .Values.service.main.ports.main.port }};
+      real_ip_header proxy_protocol;
+      location / {
+          proxy_set_header      Host              $http_host;
+          proxy_set_header      X-Forwarded-By    $server_addr:$server_port;
+          proxy_set_header      X-Forwarded-For   $remote_addr;
+          proxy_set_header      X-Forwarded-Proto $scheme;
+          proxy_set_header      X-Real-IP         $remote_addr;
+          proxy_set_header      CLIENT_IP         $remote_addr;
+          proxy_pass_request_headers on;
+          proxy_redirect off;
+          client_max_body_size 100M;
+          proxy_buffering off;
+          proxy_request_buffering off;
+          proxy_pass http://localhost:8000;
+      }
+      # Redirect any requests for static files
+      location /static/ {
+          alias /var/www/static/;
+          autoindex on;
+          # Caching settings
+          expires 30d;
+          add_header Pragma public;
+          add_header Cache-Control "public";
+      }
+      # Redirect any requests for media files
+      location /media/ {
+          alias /var/www/media/;
+          # Media files require user authentication
+          auth_request /auth;
+      }
+      # Use the 'user' API endpoint for auth
+      location /auth {
+          internal;
+          proxy_pass http://localhost:8000/auth/;
+          proxy_pass_request_body off;
+          proxy_set_header Content-Length "";
+          proxy_set_header X-Original-URI $request_uri;
+      }
+    }
+{{- end -}}
@@ -0,0 +1,25 @@
+{{/* Define the init container */}}
+{{- define "inventree.init" -}}
+image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+command: ["sh", "-c"]
+args:
+  - |-
+    echo "Starting initialization..."
+    cd /home/inventree || exit
+    invoke update
+    echo "Initialization finished!"
+securityContext:
+  runAsUser: {{ .Values.podSecurityContext.runAsUser }}
+  runAsGroup: {{ .Values.podSecurityContext.runAsGroup }}
+  readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }}
+  runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }}
+volumeMounts:
+  - name: data
+    mountPath: "/home/inventree/data"
+envFrom:
+  - secretRef:
+      name: '{{ include "tc.common.names.fullname" . }}-inventree-secret'
+  - configMapRef:
+      name: '{{ include "tc.common.names.fullname" . }}-inventree-config'
+{{- end -}}
@@ -0,0 +1,20 @@
+{{/* Define the nginx container */}}
+{{- define "inventree.nginx" -}}
+image: {{ .Values.nginxImage.repository }}:{{ .Values.nginxImage.tag }}
+imagePullPolicy: '{{ .Values.nginxImage.pullPolicy }}'
+securityContext:
+  runAsUser: {{ .Values.podSecurityContext.runAsUser }}
+  runAsGroup: {{ .Values.podSecurityContext.runAsGroup }}
+  readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }}
+  runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }}
+ports:
+  - containerPort: {{ .Values.service.main.ports.main.port }}
+    name: main
+volumeMounts:
+  - name: inventree-nginx
+    mountPath: "/etc/nginx/conf.d/default.conf"
+    subPath: nginx.conf
+    readOnly: true
+  - name: data
+    mountPath: "/var/www"
+{{- end -}}
@@ -1,20 +1,35 @@
 {{/* Define the secrets */}}
 {{- define "inventree.secrets" -}}
---

+{{- $secretName := printf "%s-inventree-secret" (include "tc.common.names.fullname" .) }}
+
+---
 apiVersion: v1
 kind: Secret
 type: Opaque
 metadata:
-  name: inventree-secrets
-{{- $inventreeprevious := lookup "v1" "Secret" .Release.Namespace "inventree-secrets" }}
-{{- $secret_key := "" }}
+  name: {{ $secretName }}
+  labels:
+    {{- include "tc.common.labels" . | nindent 4 }}
 data:
-  {{- if $inventreeprevious}}
-  INVENTREE_SECRET_KEY: {{ index $inventreeprevious.data "INVENTREE_SECRET_KEY" }}
+  {{- with lookup "v1" "Secret" .Release.Namespace $secretName }}
+  INVENTREE_SECRET_KEY: {{ index .data "INVENTREE_SECRET_KEY" }}
  {{- else }}
-  {{- $secret_key := randAlphaNum 32 }}
-  INVENTREE_SECRET_KEY: {{ $secret_key | b64enc }}
+  INVENTREE_SECRET_KEY: {{ randAlphaNum 32 | b64enc }}
+  {{- end }}
+  INVENTREE_DB_PASSWORD: {{ .Values.postgresql.postgresqlPassword | trimAll "\"" | b64enc }}
+  {{- $redisPass := .Values.redis.redisPassword | trimAll "\"" }}
+  INVENTREE_CACHE_HOST: {{ printf "%v:%v@%v-redis" .Values.redis.redisUsername $redisPass .Release.Name | b64enc }}
+  {{- with .Values.inventree.credentials.admin_mail }}
+  INVENTREE_ADMIN_EMAIL: {{ . | b64enc }}
+  {{- end }}
+  {{- with .Values.inventree.credentials.admin_user }}
+  INVENTREE_ADMIN_USER: {{ . | b64enc }}
+  {{- end }}
+  {{- with .Values.inventree.credentials.admin_password }}
+  INVENTREE_ADMIN_PASSWORD: {{ . | b64enc }}
+  {{- end }}
+  {{- with .Values.inventree.mail.password }}
+  INVENTREE_EMAIL_PASSWORD: {{ . | b64enc }}
  {{- end }}
-
 {{- end -}}
@@ -0,0 +1,19 @@
+{{/* Define the worker container */}}
+{{- define "inventree.worker" -}}
+image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+command: ["invoke", "worker"]
+securityContext:
+  runAsUser: {{ .Values.podSecurityContext.runAsUser }}
+  runAsGroup: {{ .Values.podSecurityContext.runAsGroup }}
+  readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem }}
+  runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }}
+volumeMounts:
+  - name: data
+    mountPath: "/home/inventree/data"
+envFrom:
+  - secretRef:
+      name: '{{ include "tc.common.names.fullname" . }}-inventree-secret'
+  - configMapRef:
+      name: '{{ include "tc.common.names.fullname" . }}-inventree-config'
+{{- end -}}
@@ -4,5 +4,12 @@
 {{/* Render secrets for inventree */}}
 {{- include "inventree.secrets" . }}

+{{/* Render config for inventree */}}
+{{- include "inventree.config" . }}
+
+{{- $_ := set .Values.initContainers "init" (include "inventree.init" . | fromYaml) -}}
+{{- $_ := set .Values.additionalContainers "nginx" (include "inventree.nginx" . | fromYaml) -}}
+{{- $_ := set .Values.additionalContainers "worker" (include "inventree.worker" . | fromYaml) -}}
+
 {{/* Render the templates */}}
 {{ include "tc.common.loader.apply" . }}