platform/manifests
1
1
Fork 0
Code Issues 7 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

feat: openfga helmfile

Browse Source
This commit is contained in:
Jonas Juselius
2025-06-24 09:58:50 +02:00
parent 9576ca0520
commit c50b1b95cc
12 changed files with 69 additions and 250 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helmfile.d/openfga.yaml.gotmpl
+43
View File
@@ -0,0 +1,43 @@
bases:
- ../envs/environments.yaml.gotmpl
repositories:
- name: openfga
url: https://openfga.github.io/helm-charts
commonLabels:
tier: system
releases:
- name: {{ .Environment.Name }}-openfga
namespace: openfga
chart: openfga/openfga
version: 0.2.35
condition: openfga.enabled
values:
- ../values/openfga/values/values.yaml
- ../values/openfga/values/values-{{ .Environment.Name }}.yaml
postRenderer: ../bin/kustomizer
postRendererArgs:
- ../values/openfga/kustomize/{{ .Environment.Name }}
missingFileHandler: Info
- name: manifests
namespace: openfga
chart: manifests
condition: openfga.enabled
missingFileHandler: Info
values:
- ../values/env.yaml
- ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
- ../values/openfga/env.yaml.gotmpl
- ../values/openfga/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
hooks:
- events: [ prepare, cleanup ]
showlogs: true
command: ../bin/helmify
args:
- '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
- '{{`{{ .Release.Chart }}`}}'
- '{{`{{ .Environment.Name }}`}}'
- ../values/openfga/manifests
- manifests
values/openfga/env-oceanbox.yaml.gotmpl
+3
View File
@@ -0,0 +1,3 @@
openfga:
enabled: true
env: prod
values/openfga/env.yaml.gotmpl
+3 -4
View File
@@ -1,5 +1,4 @@
openfga:
enabled: true
envs:
- prod
- staging
enabled: false
autosync: false
env: prod
values/openfga/kustomize/base/kustomization.yaml
-4
View File
@@ -1,4 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- _manifest.yaml
values/openfga/manifests/migration-job.yaml
-41
View File
@@ -1,41 +0,0 @@
apiVersion: batch/v1
kind: Job
metadata:
name: staging-openfga-migrate
labels:
helm.sh/chart: openfga-0.2.12
app.kubernetes.io/name: openfga
app.kubernetes.io/instance: staging
app.kubernetes.io/version: "v1.5.9"
app.kubernetes.io/managed-by: Helm
annotations:
helm.sh/hook: post-install, post-upgrade, post-rollback, post-delete
helm.sh/hook-delete-policy: before-hook-creation
helm.sh/hook-weight: "-5"
spec:
template:
metadata:
annotations:
helm.sh/hook: post-install, post-upgrade, post-rollback, post-delete
helm.sh/hook-delete-policy: before-hook-creation
helm.sh/hook-weight: "-5"
spec:
serviceAccountName: staging-openfga
containers:
- name: migrate-database
securityContext:
{}
image: "openfga/openfga:v1.5.9"
args: ["migrate"]
env:
- name: OPENFGA_DATASTORE_ENGINE
value: "postgres"
- name: OPENFGA_DATASTORE_URI
valueFrom:
secretKeyRef:
name: "staging-openfga-db-superuser"
key: "uri"
resources:
{}
restartPolicy: Never
backoffLimit: 1
values/openfga/manifests/openfga.yaml
+19 -7
View File
@@ -1,9 +1,8 @@
{{- if .Values.clusterConfig.argo.enabled }}
{{- range .Values.openfga.envs }}
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: {{ . }}-openfga
name: {{ .Values.openfga.env }}-openfga
namespace: argocd
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
@@ -12,17 +11,31 @@ metadata:
spec:
destination:
namespace: openfga
server: 'https://kubernetes.default.svc'
server: https://kubernetes.default.svc
project: sys
sources:
- repoURL: {{ .Values.clusterConfig.manifests }}
targetRevision: HEAD
path: helmfiles/openfga
path: helmfile.d
plugin:
name: helmfile
name: helmfile-cmp
env:
- name: CLUSTER_NAME
value: {{ .Values.clusterConfig.cluster }}
project: sys
- name: HELMFILE_ENVIRONMENT
value: {{ .Values.openfga.env }}
- name: HELMFILE_FILE_PATH
value: openfga.yaml.gotmpl
# - repoURL: https://openfga.github.io/helm-charts
# targetRevision: 0.2.35
# chart: openfga
# helm:
# valueFiles:
# - $values/values/openfga/values/values.yaml
# - $values/values/openfga/values/values-{{ .Values.openfga.env }}.yaml
# - repoURL: https://gitlab.com/oceanbox/manifests.git
# targetRevision: main
# ref: values
syncPolicy:
managedNamespaceMetadata:
labels:
@@ -37,4 +50,3 @@ spec:
# selfHeal: false
{{- end }}
{{- end }}
{{- end }}
values/openfga/manifests/postgres-secret.yaml
-19
View File
@@ -1,19 +0,0 @@
apiVersion: v1
stringData:
postgres-password: blT6zzv37KyFvzb1Ct3bhfAwPxhTG2fBO1EiIASQWI4wnEOB8AOWvmVa2sogGexr
uri: postgres://postgres:blT6zzv37KyFvzb1Ct3bhfAwPxhTG2fBO1EiIASQWI4wnEOB8AOWvmVa2sogGexr@prod-openfga-rw.openfga.svc.cluster.local:5432/postgres?sslmode=disable
kind: Secret
metadata:
name: prod-openfga-postgresql
namespace: openfga
type: Opaque
---
apiVersion: v1
stringData:
postgres-password: iAnMHs3eEuQM0D4jeAP1dwEoLWUBSwNXwhBuPDOgmfoeZ58iV0zogQ77U3GNUbwa
uri: postgres://postgres:iAnMHs3eEuQM0D4jeAP1dwEoLWUBSwNXwhBuPDOgmfoeZ58iV0zogQ77U3GNUbwa@staging-openfga-rw.openfga.svc.cluster.local:5432/postgres?sslmode=disable
kind: Secret
metadata:
name: staging-openfga-postgresql
namespace: openfga
type: Opaque
values/openfga/values-prod.yaml
-57
View File
@@ -1,57 +0,0 @@
replicaCount: 2
datastore:
engine: postgres
uriSecret: prod-openfga-db-superuser
migrationType: initContainer
postgresql:
enabled: false
playground:
enabled: false
telemetry:
metrics:
enabled: true
serviceMonitor:
enabled: true
enableRPCHistograms: true
trace:
enabled: true
otlp:
endpoint: opentelemetry-collector.otel.svc.cluster.local:4317
sampleRatio: 0.1
ingress:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
hosts:
- host: openfga.srv.oceanbox.io
paths:
- path: /
pathType: ImplementationSpecific
tls:
- secretName: prod-openfga-tls
hosts:
- openfga.srv.oceanbox.io
extraObjects:
- apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: prod-openfga-db
namespace: openfga
spec:
instances: 2
imageName: ghcr.io/cloudnative-pg/postgresql:17-bookworm
storage:
resizeInUseVolumes: true
size: 10Gi
backup:
retentionPolicy: 60d
target: prefer-standby
values/openfga/values/openfga-staging.yaml.gotmpl
-79
View File
@@ -1,79 +0,0 @@
replicaCount: 1
datastore:
engine: postgres
uriSecret: staging-openfga-db-superuser
migrationType: initContainer
#postgresql:
# enabled: false
#
#playground:
# enabled: false
#
#telemetry:
# metrics:
# enabled: true
# serviceMonitor:
# enabled: true
# enableRPCHistograms: true
# trace:
# enabled: true
# otlp:
# endpoint: opentelemetry-collector.otel.svc.cluster.local:4317
# sampleRatio: 0.1
ingress:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
nginx.ingress.kubernetes.io/ssl-redirect: "true"
oceanbox.io/expose: internal
hosts:
- host: openfga.dev.oceanbox.io
paths:
- path: /
pathType: ImplementationSpecific
tls:
- secretName: staging-openfga-tls
hosts:
- openfga.dev.oceanbox.io
extraObjects:
- apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: staging-openfga-db
namespace: openfga
spec:
instances: 1
imageName: ghcr.io/cloudnative-pg/postgresql:17-bookworm
storage:
resizeInUseVolumes: true
size: 10Gi
backup:
retentionPolicy: 60d
target: prefer-standby
bootstrap:
pg_basebackup:
database: ""
owner: ""
source: openfga
enableSuperuserAccess: true
externalClusters:
- name: openfga
connectionParameters:
host: prod-openfga-db-rw.openfga
sslmode: verify-full
user: streaming_replica
sslCert:
key: tls.crt
name: prod-openfga-db-replication
sslKey:
key: tls.key
name: prod-openfga-db-replication
sslRootCert:
key: ca.crt
name: prod-openfga-db-ca
values/openfga/values/openfga-prod.yaml.gotmpl → values/openfga/values/values-prod.yaml
-20
View File
@@ -5,31 +5,12 @@ datastore:
uriSecret: prod-openfga-db-superuser
migrationType: initContainer
#postgresql:
# enabled: false
#
#playground:
# enabled: false
#
#telemetry:
# metrics:
# enabled: true
# serviceMonitor:
# enabled: true
# enableRPCHistograms: true
# trace:
# enabled: true
# otlp:
# endpoint: opentelemetry-collector.otel.svc.cluster.local:4317
# sampleRatio: 0.1
ingress:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
nginx.ingress.kubernetes.io/ssl-redirect: "true"
oceanbox.io/expose: internal
hosts:
- host: openfga.srv.oceanbox.io
paths:
@@ -55,4 +36,3 @@ extraObjects:
backup:
retentionPolicy: 60d
target: prefer-standby
values/openfga/values-staging.yaml → values/openfga/values/values-staging.yaml
+1 -19
View File
@@ -5,31 +5,13 @@ datastore:
uriSecret: staging-openfga-db-superuser
migrationType: initContainer
postgresql:
enabled: false
playground:
enabled: false
telemetry:
metrics:
enabled: true
serviceMonitor:
enabled: true
enableRPCHistograms: true
trace:
enabled: true
otlp:
endpoint: opentelemetry-collector.otel.svc.cluster.local:4317
sampleRatio: 0.1
ingress:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
oceanbox.io/expose: internal
hosts:
- host: openfga.dev.oceanbox.io
paths:
values/openfga/values/openfga.yaml.gotmpl → values/openfga/values/values.yaml
View File