init

templates/_helpers.tpl

@@ -0,0 +1,26 @@
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "template.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "template.labels" -}}
+helm.sh/chart: {{ include "template.chart" . }}
+{{ include "template.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "template.selectorLabels" -}}
+app.kubernetes.io/name: {{ .Values.name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

templates/cm-env.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.env }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Values.name }}-env
+  annotations:
+    reloader.stakater.com/match: "true"
+data:
+{{- range $k, $v := .Values.env }}
+  {{- $k | nindent 2 }}: {{ $v | quote }}
+{{- end }}
+{{- end }}

templates/deployment.yaml

@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Values.name }}
+  labels: {{ include "template.labels" . | nindent 4 }}
+  annotations:
+    {{- if .Values.env }}
+    reloader.stakater.com/search: "true"
+    {{- end }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  revisionHistoryLimit: {{ .Values.revisionHistoryLimit | default 0 }}
+  selector:
+    matchLabels: {{ include "template.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels: {{ include "template.labels" . | nindent 8 }}
+    spec:
+    {{- with .Values.imagePullSecrets }}
+      imagePullSecrets: {{ toYaml . | nindent 8 }}
+    {{- end }}
+    {{- if .Values.nodeSelector }}
+      nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }}
+    {{- end }}
+    {{- with .Values.volumes }}
+      volumes: {{ toYaml . | nindent 8 }}
+    {{- end }}
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken | default false }}
+      securityContext:
+    {{- if .Values.podSecurityContext }}
+    {{- toYaml .Values.podSecurityContext | nindent  8 }}
+    {{- else }}
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+    {{- end }}
+      containers:
+        - name: {{ .Values.name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          {{- with .Values.customCommand }}
+          {{- with .command }}
+          command: {{ toYaml . | nindent 12}}
+          {{- end}}
+          {{- with .args }}
+          args: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          securityContext:
+          {{- if .Values.securityContext }}
+          {{- toYaml .Values.securityContext | nindent 12 }}
+          {{- else }}
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          {{- end }}
+          envFrom:
+          {{- if .Values.env }}
+            - configMapRef:
+                name: {{ .Values.name }}-env
+          {{- end }}
+          {{- if .Values.vault }}
+          {{- if .Values.vault.path }}
+            - secretRef:
+                name: {{ .Values.name }}-env
+          {{- end }}
+          {{- end }}
+          {{- if .Values.services }}
+          ports:
+            {{- range $name, $s := .Values.services }}
+            - name: {{ $name }}
+              containerPort: {{ $s.port }}
+              protocol: {{ $s.protocol }}
+          {{- end }}
+          {{- end }}
+          {{- with .Values.livenessProbe }}
+          livenessProbe: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.volumeMounts }}
+          volumeMounts: {{ toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.resources }}
+          resources: {{ toYaml . | nindent 12 }}
+          {{- end }}

templates/dockerconfig.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.vault }}
+{{- if .Values.vault.imagePullSecret }}
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: imagepull
+spec:
+  type: kv-v2
+  mount: {{ .Values.vault.mount }}
+  path: {{ .Values.vault.imagePullSecret.path }}
+  destination:
+    name: {{ .Values.vault.imagePullSecret.name }}
+    create: true
+    type: kubernetes.io/dockerconfigjson
+  refreshAfter: 30s
+  vaultAuthRef: vault-auth
+{{- end }}
+{{- end }}

templates/pvc.yaml

@@ -0,0 +1,14 @@
+{{- range $pvc := .Values.pvc }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ $pvc.name }}
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ $pvc.capacity }}
+  volumeName: {{ $pvc.volume }}
+  storageClassName: {{ $pvc.storageClass }}
+{{- end }}

templates/secret-env.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.vault }}
+{{- if .Values.vault.path }}
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: {{ .Values.name }}-env
+spec:
+  type: kv-v2
+  mount: {{ .Values.vault.mount }}
+  path: {{ .Values.vault.path }}
+  destination:
+    name: {{ .Values.name }}-env
+    create: true
+    annotations:
+      reloader.stakater.com/match: "true"
+  refreshAfter: 30s
+  vaultAuthRef: vault-auth
+{{- end }}
+{{- end }}

templates/service.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.services }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Values.name }}
+  labels:
+    {{- include "template.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    {{- range $name, $s := .Values.services }}
+    - name: {{ $name }}
+      port: {{ $s.port }}
+      protocol: {{ $s.protocol }}
+      {{- end}}
+  selector:
+    {{- include "template.selectorLabels" . | nindent 4 }}
+{{- end }}

templates/vault-auth.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.vault }}
+{{- if .Values.vault.auth }}
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: vault-auth
+spec:
+  method: kubernetes
+  mount: {{ .Values.vault.auth.mount }}
+  kubernetes:
+    role: {{ .Values.vault.auth.role }}
+    serviceAccount: default
+    audiences:
+      - vault
+{{- end }}
+{{- end }}