Add new chart for Scalar Admin for Kubernetes (#246)

.github/workflows/helm_charts_scalar.yml

@@ -192,10 +192,13 @@ jobs:
           kubectl create secret generic auditor-keys --from-file=certificate=.github/auditor-cert.pem --from-file=private-key=.github/auditor-key.pem
           kubectl create secret generic scalardb-analytics-postgresql-superuser-password --from-literal=superuser-password=postgres
           helm install postgresql oci://registry-1.docker.io/bitnamicharts/postgresql -f .github/postgresql.yaml
+          helm dependency build charts/scalardb-cluster/
+          helm install scalardb-cluster-for-scalar-admin-for-kubernetes ./charts/scalardb-cluster/ -f ./charts/scalardb-cluster/ci/scalardb-cluster-ct-values.yaml # Create ScalarDB Cluster for Scalar Admin for Kubernetes test.
           sleep 1 # Waiting for the StatefulSet creates a PostgreSQL pod.
           kubectl wait --for=condition=Ready --timeout=120s pod/postgresql-0
-          kubectl create -f .github/schema-loading.yaml # Create schema for ScalarDB GraphQL and ScalarDB Analytics with PostgreSQL
+          kubectl create -f .github/schema-loading.yaml # Create schema for ScalarDB GraphQL and ScalarDB Analytics with PostgreSQL.
           kubectl wait --for=condition=complete --timeout=60s job/schema-loading
+          kubectl wait --for=condition=available --timeout=300s deployment/scalardb-cluster-for-scalar-admin-for-kubernetes-node
           kubectl get pods,svc,endpoints,nodes -o wide
 
       - name: Run chart-testing (updated chart)

charts/scalar-admin-for-kubernetes/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/scalar-admin-for-kubernetes/Chart.yaml

@@ -0,0 +1,20 @@
+apiVersion: v2
+name: scalar-admin-for-kubernetes
+description: Scalar Admin for Kubernetes
+type: application
+version: 1.0.0-SNAPSHOT
+appVersion: 1.2.0
+deprecated: false
+icon: https://scalar-labs.com/wp-content/themes/scalar/assets/img/logo_scalar.svg
+keywords:
+- scalardb
+- scalardb-cluster
+- scalardl-ledger
+- scalardl-auditor
+- scalar-admin-for-kubernetes
+home: https://scalar-labs.com/
+sources:
+  - https://github.com/scalar-labs/scalar-admin-for-kubernetes
+maintainers:
+  - name: Takanori Yokoyama
+    email: [email protected]

charts/scalar-admin-for-kubernetes/README.md

@@ -0,0 +1,32 @@
+# scalar-admin-for-kubernetes
+
+Scalar Admin for Kubernetes
+Current chart version is `1.0.0-SNAPSHOT`.
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| fullnameOverride | string | `""` | String to fully override scalar-admin-for-kubernetes.fullname template. |
+| nameOverride | string | `""` | String to partially override scalar-admin-for-kubernetes.fullname template (will maintain the release name). |
+| scalarAdminForKubernetes.affinity | object | `{}` | The affinity/anti-affinity feature greatly expands the types of constraints you can express. |
+| scalarAdminForKubernetes.commandArgs | list | `[]` | Arguments of Scalar Admin for Kubernetes. You can specify several args as an array. |
+| scalarAdminForKubernetes.cronJob.schedule | string | `"0 0 * * *"` | Schedule for a CronJob. |
+| scalarAdminForKubernetes.cronJob.timeZone | string | `"Etc/UTC"` | A time zone for a CronJob. |
+| scalarAdminForKubernetes.image.pullPolicy | string | `"IfNotPresent"` | Specify an image-pulling policy. |
+| scalarAdminForKubernetes.image.repository | string | `"ghcr.io/scalar-labs/scalar-admin-for-kubernetes"` | Docker image repository of Scalar Admin for Kubernetes. |
+| scalarAdminForKubernetes.image.tag | string | `""` | Override the image tag with a default that is the chart appVersion. |
+| scalarAdminForKubernetes.imagePullSecrets | list | `[{"name":"reg-docker-secrets"}]` | Optionally specify an array of imagePullSecrets. Secrets must be manually created in the namespace. |
+| scalarAdminForKubernetes.jobType | string | `"job"` | Resource which you deploy. Specify "job" or "cronjob". By default deploy scalar-admin-for-kubernetes as a Job resource. If you specify "cronjob", you can create a CronJob resource instead of a Job. |
+| scalarAdminForKubernetes.nodeSelector | object | `{}` | nodeSelector is a form of node selection constraint. |
+| scalarAdminForKubernetes.podAnnotations | object | `{}` | Pod annotations for the scalar-admin-for-kubernetes pod. |
+| scalarAdminForKubernetes.podSecurityContext | object | `{"seccompProfile":{"type":"RuntimeDefault"}}` | PodSecurityContext holds pod-level security attributes and common container settings. |
+| scalarAdminForKubernetes.resources | object | `{}` | Resources allowed to the pod. |
+| scalarAdminForKubernetes.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"runAsNonRoot":true}` | Setting security context at the pod applies those settings to all containers in the pod. |
+| scalarAdminForKubernetes.securityContext.allowPrivilegeEscalation | bool | `false` | AllowPrivilegeEscalation controls whether a process can gain more privileges than its parent process. |
+| scalarAdminForKubernetes.securityContext.capabilities | object | `{"drop":["ALL"]}` | Capabilities (specifically, Linux capabilities), are used for permission management in Linux. Some capabilities are enabled by default. |
+| scalarAdminForKubernetes.securityContext.runAsNonRoot | bool | `true` | Containers should be run as a non-root user with the minimum required permissions (principle of least privilege). |
+| scalarAdminForKubernetes.serviceAccount.automountServiceAccountToken | bool | `true` | Specify whether to mount a service account token or not. |
+| scalarAdminForKubernetes.serviceAccount.serviceAccountName | string | `""` | Name of the existing service account resource. |
+| scalarAdminForKubernetes.tolerations | list | `[]` | Tolerations are applied to pods and allow (but do not require) the pods to schedule onto nodes with matching taints. |
+| scalarAdminForKubernetes.ttlSecondsAfterFinished | int | `0` | ttlSecondsAfterFinished value for the job resource. |

charts/scalar-admin-for-kubernetes/README.md.gotmpl

@@ -0,0 +1,8 @@
+{{ template "chart.header" . }}
+
+{{ template "chart.description" . }}
+Current chart version is `{{ template "chart.version" . }}`.
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}

charts/scalar-admin-for-kubernetes/ci/scalar-admin-for-kubernetes-ct-values.yaml

@@ -0,0 +1,13 @@
+scalarAdminForKubernetes:
+
+  commandArgs:
+    - -r
+    - scalardb-cluster-for-scalar-admin-for-kubernetes
+    - -n
+    - default
+    - -d
+    - "1000"
+    - -z
+    - "Etc/UTC"
+    - -w
+    - "1000"

charts/scalar-admin-for-kubernetes/templates/NOTES.txt

@@ -0,0 +1,18 @@
+CHART NAME: {{ .Chart.Name }}
+CHART VERSION: {{ .Chart.Version }}
+APP VERSION: {{ .Chart.AppVersion }}
+RELEASE NAME: {{ .Release.Name }}
+{{ if eq .Values.scalarAdminForKubernetes.jobType "job" }}
+The Job resource {{ include "scalar-admin-for-kubernetes.fullname" . }} that runs Scalar Admin for Kubernetes is created.
+{{ else if eq .Values.scalarAdminForKubernetes.jobType "cronjob" }}
+The CronJob resource {{ include "scalar-admin-for-kubernetes.fullname" . }} that runs Scalar Admin for Kubernetes periodically is created.
+
+If you want to test the Job definition that will created by this CronJob, you can run the actual Job by running the following command:
+
+  kubectl create job "{{ .Release.Name }}-test-$(date +%s)" --from cronjob/{{ include "scalar-admin-for-kubernetes.fullname" . }} -n {{ .Release.Namespace }}
+
+  NOTE: This command creates an actual Job and runs the Scalar Admin for Kubernetes. It pauses your ScalarDB or ScalarDL. In other words, it pauses transactions in your system.
+{{ end }}
+You can see the "pause duration" as a command result that is output into the stdout of a container by running the following command:
+
+  kubectl logs -l app.kubernetes.io/app=scalar-admin-for-kubernetes,app.kubernetes.io/instance={{ .Release.Name }} -n {{ .Release.Namespace }}

charts/scalar-admin-for-kubernetes/templates/_helpers.tpl

@@ -0,0 +1,116 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "scalar-admin-for-kubernetes.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "scalar-admin-for-kubernetes.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "scalar-admin-for-kubernetes.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "scalar-admin-for-kubernetes.labels" -}}
+helm.sh/chart: {{ include "scalar-admin-for-kubernetes.chart" . }}
+{{ include "scalar-admin-for-kubernetes.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "scalar-admin-for-kubernetes.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "scalar-admin-for-kubernetes.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/app: scalar-admin-for-kubernetes
+{{- end }}
+
+{{/*
+Create the name of the service account to use.
+*/}}
+{{- define "scalar-admin-for-kubernetes.serviceAccountName" -}}
+{{- if .Values.scalarAdminForKubernetes.serviceAccount.serviceAccountName }}
+{{- .Values.scalarAdminForKubernetes.serviceAccount.serviceAccountName }}
+{{- else }}
+{{- print (include "scalar-admin-for-kubernetes.fullname" .) "-sa" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+Job template for "Job" and "CronJob" resources
+*/}}
+{{- define "job-spec" -}}
+backoffLimit: 0
+{{- if .Values.scalarAdminForKubernetes.ttlSecondsAfterFinished }}
+ttlSecondsAfterFinished: {{ .Values.scalarAdminForKubernetes.ttlSecondsAfterFinished }}
+{{- end }}
+template:
+  metadata:
+    {{- if .Values.scalarAdminForKubernetes.podAnnotations }}
+    annotations:
+      {{- toYaml .Values.scalarAdminForKubernetes.podAnnotations | nindent 8 }}
+    {{- end }}
+    labels:
+      {{- include "scalar-admin-for-kubernetes.selectorLabels" . | nindent 8 }}
+  spec:
+    restartPolicy: Never
+    serviceAccountName: {{ include "scalar-admin-for-kubernetes.serviceAccountName" . }}
+    automountServiceAccountToken: {{ .Values.scalarAdminForKubernetes.serviceAccount.automountServiceAccountToken }}
+    {{- with .Values.scalarAdminForKubernetes.imagePullSecrets }}
+    imagePullSecrets:
+      {{- toYaml . | nindent 8 }}
+    {{- end }}
+    securityContext:
+      {{- toYaml .Values.scalarAdminForKubernetes.podSecurityContext | nindent 8 }}
+    containers:
+      - name: {{ .Chart.Name }}
+        securityContext:
+          {{- toYaml .Values.scalarAdminForKubernetes.securityContext | nindent 12 }}
+        image: "{{ .Values.scalarAdminForKubernetes.image.repository }}:{{ .Values.scalarAdminForKubernetes.image.tag | default .Chart.AppVersion }}"
+        imagePullPolicy: {{ .Values.scalarAdminForKubernetes.image.pullPolicy }}
+        resources:
+          {{- toYaml .Values.scalarAdminForKubernetes.resources | nindent 12 }}
+        args:
+          {{- range .Values.scalarAdminForKubernetes.commandArgs }}
+          - {{ . | quote }}
+          {{- end }}
+    {{- with .Values.scalarAdminForKubernetes.nodeSelector }}
+    nodeSelector:
+      {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.scalarAdminForKubernetes.affinity }}
+    affinity:
+      {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.scalarAdminForKubernetes.tolerations }}
+    tolerations:
+      {{- toYaml . | nindent 8 }}
+    {{- end }}
+{{- end }}

charts/scalar-admin-for-kubernetes/templates/scalar-admin-for-kubernetes/cronjob.yaml

@@ -0,0 +1,15 @@
+{{- if eq .Values.scalarAdminForKubernetes.jobType "cronjob" }}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ include "scalar-admin-for-kubernetes.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "scalar-admin-for-kubernetes.labels" . | nindent 4 }}
+spec:
+  timeZone: "{{ .Values.scalarAdminForKubernetes.cronJob.timeZone }}"
+  schedule: "{{ .Values.scalarAdminForKubernetes.cronJob.schedule }}"
+  jobTemplate:
+    spec:
+      {{- include "job-spec" . | nindent 6 }}
+{{- end }}

charts/scalar-admin-for-kubernetes/templates/scalar-admin-for-kubernetes/job.yaml

@@ -0,0 +1,11 @@
+{{- if eq .Values.scalarAdminForKubernetes.jobType "job" }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "scalar-admin-for-kubernetes.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "scalar-admin-for-kubernetes.labels" . | nindent 4 }}
+spec:
+  {{- include "job-spec" . | nindent 2 }}
+{{- end }}

charts/scalar-admin-for-kubernetes/templates/scalar-admin-for-kubernetes/role.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "scalar-admin-for-kubernetes.fullname" . }}-role
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "services"]
+    verbs: ["get", "list"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list"]

charts/scalar-admin-for-kubernetes/templates/scalar-admin-for-kubernetes/rolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "scalar-admin-for-kubernetes.fullname" . }}-rolebinding
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "scalar-admin-for-kubernetes.serviceAccountName" . }}
+roleRef:
+  kind: Role
+  name: {{ include "scalar-admin-for-kubernetes.fullname" . }}-role
+  apiGroup: rbac.authorization.k8s.io

charts/scalar-admin-for-kubernetes/templates/scalar-admin-for-kubernetes/serviceaccount.yaml

@@ -0,0 +1,9 @@
+{{- if not .Values.scalarAdminForKubernetes.serviceAccount.serviceAccountName }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "scalar-admin-for-kubernetes.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "scalar-admin-for-kubernetes.labels" . | nindent 4 }}
+{{- end }}