feat: add Helm chart

Fix italia#378.

.gitignore

@@ -14,7 +14,7 @@ vendor
 
 # Compiled binaries
 bin/*
-publiccode-crawler
+/publiccode-crawler
 
 # Env
 .env

charts/publiccode-crawler/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/publiccode-crawler/Chart.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v2
+
+name: publiccode-crawler
+description: |
+   publiccode.yml crawler for the Open Source software catalog of Developers Italia
+
+type: application
+
+version: 0.1.0

charts/publiccode-crawler/templates/_helpers.tpl

@@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "publiccode-crawler.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "publiccode-crawler.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "publiccode-crawler.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

charts/publiccode-crawler/templates/cronjob.yaml

@@ -0,0 +1,62 @@
+---
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ template "publiccode-crawler.fullname" . }}
+spec:
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  concurrencyPolicy: Forbid
+  schedule: "{{ .Values.publiccode-crawler.cronjob_schedule }}"
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: "{{ template "publiccode-crawler.fullname" . }}"
+        spec:
+          securityContext:
+            fsGroup: 1000
+
+          containers:
+          - name: {{ template "publiccode-crawler.fullname" . }}
+            image: "{{ .Values.publiccode-crawler.image.repository }}:{{ tpl .Values.publiccode-crawler.image.tag . }}"
+            imagePullPolicy: {{ .Values.publiccode-crawler.image.pullPolicy }}
+
+            command:
+              - /bin/bash
+            args:
+              - -c
+              - ln -sf /secrets-store/k8s-secrets-publiccode-crawler-domains-yml domains.yml && ./start.sh
+
+            volumeMounts:
+            - name: data
+              mountPath: /var/publiccode-crawler/data
+              readOnly: false
+            - mountPath: /secrets-store
+              name: secrets-store
+
+
+            resources:
+              {{- toYaml .Values.publiccode-crawler.resources. | indent 14 }}
+            env:
+              - name: ELASTIC_URL
+                value: "{{ .Values.publiccode-crawler.env.elastic_url }}"
+              - name: ELASTIC_USER
+                value: "{{ .Values.publiccode-crawler.env.elastic_user }}"
+              - name: ELASTIC_PWD
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ template "publiccode-crawler.fullname" . }}-azure-kv
+                    key: elastic-pass
+
+          restartPolicy: Never
+
+          volumes:
+          - name: secrets-store
+            csi:
+              driver: secrets-store.csi.k8s.io
+              readOnly: true
+              volumeAttributes:
+                secretProviderClass: {{ template "publiccode-crawler.fullname" . }}

charts/publiccode-crawler/templates/secretproviderclass.yaml

@@ -0,0 +1,27 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: {{ template "publiccode-crawler.fullname" . }}
+spec:
+  provider: azure
+  parameters:
+    keyvaultName: devita-prod-kv # The name of the Azure Key Vault
+    useVMManagedIdentity: "true"
+    userAssignedIdentityID: d7174ca3-5901-47ce-a1f6-32ec772f0de5
+    objects: |
+      array:
+        - |
+          objectName: k8s-secrets-elasticsearch-password
+          objectType: secret
+        - |
+          objectName: k8s-secrets-publiccode-crawler-domains-yml
+          objectType: secret
+    tenantId: f7f7d6c7-92de-488e-b37e-8963207c7b86
+  secretObjects:
+    - data:
+        - key: elastic-pass # data field to populate
+          objectName: k8s-secrets-elasticsearch-password
+        - key: domains.yml
+          objectName: k8s-secrets-publiccode-crawler-domains-yml
+      secretName: {{ template "publiccode-crawler.fullname" . }}-azure-kv # name of the Kubernetes Secret object
+      type: Opaque

charts/publiccode-crawler/values.yaml

@@ -0,0 +1,30 @@
+---
+
+image:
+  repository: docker.io/italia/developers-italia-backend
+  tag: latest
+  pullPolicy: Always
+
+env:
+  elastic_url: "http://developersitalia-master.elasticsearch:9200"
+  elastic_user: "elastic"
+
+cronjob_schedule: "0 0 * * *"
+
+resources:
+   # We usually recommend not to specify default resources and to leave this as a conscious
+   # choice for the user. This also increases chances charts run on environments with little
+   # resources, such as Minikube. If you do want to specify resources, uncomment the following
+   # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+   # limits:
+   #   cpu: 100m
+   #   memory: 128Mi
+   # requests:
+   #   cpu: 100m
+   #   memory: 128Mi
+
+nodeSelector: {}
+
+tolerations: {}
+
+affinity: {}