2022-07-07 20:11:50 +00:00
local ociRegistry = std.extVar('oci_registry');
local ociRegistryRepo = std.extVar('oci_registry_repo');
local registry_secret = std.extVar('registry_secret');
local kubernetes = import 'ci/kubernetes.jsonnet';
local db = import 'ci/db.jsonnet';
local mappings = import 'ci/mappings.jsonnet';
local utils = import 'ci/utils.jsonnet';
2022-10-31 02:23:40 +00:00
local helm_mode = utils.helm_mode;
local stage = utils.stage;
local user = utils.user;
local stageNoDash = utils.stage_no_dash;
local slugify_ = function (x) std.asciiLower(std.substr(x, 0, 1)) + std.substr(x, 1, std.length(x)-1);
local slugify = function (name, extra_remove, str) slugify_(std.join('', [std.asciiUpper(std.substr(x, 0, 1)) + std.asciiLower(std.substr(x, 1, std.length(x)-1)) for x in std.split(std.strReplace(std.strReplace(str, std.asciiUpper(name)+'_', ''), extra_remove, ''), '_')]));
// Can be used to add common labels or annotations
2022-07-07 20:11:50 +00:00
local labels = {
2022-10-31 02:23:40 +00:00
labels: kubernetes.istio_labels(),
2022-07-07 20:11:50 +00:00
};
2022-10-31 02:23:40 +00:00
// We're using a helper manifestYamlStream function to fix some general issues with it for Helm templates manually.
// Currently Helm functions should use !" instead of " only for strings.
// If a value doesn't start with a Helm bracket but ends with one, then end the value with !! (and the opposite for start).
local manifestYamlStream = function (value, indent_array_in_object=false, c_document_end=false, quote_keys=false)
std.strReplace(std.strReplace(std.strReplace(std.strReplace(std.strReplace(std.manifestYamlStream(std.filter(function (x) x != null, value), indent_array_in_object, c_document_end, quote_keys), '!\\"', '"'), '"{{', '{{'), '}}"', '}}'), '}}!!', '}}'), '!!{{', '{{');
2022-07-07 20:11:50 +00:00
{
2022-10-31 02:23:40 +00:00
user():: user,
2022-07-07 20:11:50 +00:00
new(info)::
2022-10-31 02:23:40 +00:00
local metadata_init = {
2022-07-07 20:11:50 +00:00
name: info.name,
2022-10-31 02:23:40 +00:00
namespace: if helm_mode then '{{ .Release.Namespace }}' else (if stageNoDash == 'dev' then '%s-dev' % user else if std.objectHas(info, 'namespace') then info.namespace else info.name),
};
local default_labels_all = {
'app.kubernetes.io/name': if helm_mode then '{{ template !"%s.name!" . }}' % info.name else info.name,
2022-07-07 20:11:50 +00:00
};
2022-10-31 02:23:40 +00:00
local default_labels_helm = if helm_mode then {
'helm.sh/chart': '{{ template !"%s.chart!" . }}' % info.name,
'app.kubernetes.io/managed-by': '{{ .Release.Service }}',
'app.kubernetes.io/instance': '{{ .Release.Name }}',
'app.kubernetes.io/version': info.tag,
} else {};
local default_labels = default_labels_all + default_labels_helm;
local metadata = metadata_init + { labels: default_labels };
2022-07-07 20:11:50 +00:00
local fixed = kubernetes.fix_metadata(metadata);
local vshost(srv) = '%s-service.%s.svc.cluster.local' % [srv.name, fixed.namespace];
local infolabels = if info.backend then labels else { labels: kubernetes.istio_labels() };
local dbname = (if std.objectHas(info, 'dbname') then info.dbname else info.name);
2022-10-31 02:23:40 +00:00
local env = std.filter(function (x) x != null, [if x != null then if (!std.endsWith(x.name, 'DATABASE_URL') && std.objectHas(x, 'value') && x.value != null) && std.findSubstr('{{', x.value) == null then x {
value: if helm_mode then '{{ .Values.%s | default !"%s!"%s }}' % [slugify(info.name, if std.objectHas(info, 'helm_strip_prefix') then info.helm_strip_prefix else ' ', x.name), x.value, if x.value == 'true' || x.value == 'false' then ' | quote' else ''] else x.value,
} else x for x in (if std.objectHas(info, 'env') then info.env else [])]);
local sa_default = fixed.name;
local sa_name = if helm_mode then '{{ .Values.serviceAccountName | default !"%s!" }}' % [fixed.name] else sa_default;
2022-07-07 20:11:50 +00:00
local envs = [stageNoDash];
2022-10-31 02:23:40 +00:00
local disableMetrics = std.objectHas(info, 'disableMetrics') && info.disableMetrics;
local ports = (if std.objectHas(info, 'ports') then info.ports else []) + (if disableMetrics then [] else [{
2022-10-30 01:59:25 +00:00
name: 'metrics',
containerPort: 7332,
protocol: 'TCP',
}]);
2022-07-07 20:11:50 +00:00
local services = if std.objectHas(info, 'services') then info.services else
2022-10-30 01:59:25 +00:00
[{ name: '%s-%s-%s' % [metadata.name, port.name, env], port: port.containerPort, portName: port.name, expose: if std.objectHas(port, 'expose') then port.expose else false } for env in envs for port in ports];
2022-07-07 20:11:50 +00:00
2022-10-31 02:23:40 +00:00
local file_yaml_prefix = if helm_mode then 'helm-' else '';
local nssa = '%s001-ns-sa.yaml' % file_yaml_prefix;
local migrate = '%s002-migrate.yaml' % file_yaml_prefix;
local deployment = '%s003-deployment.yaml' % file_yaml_prefix;
local svcVsDr = '%s004-svc-vs-dr.yaml' % file_yaml_prefix;
local custom = '%s005-custom.yaml' % file_yaml_prefix;
2022-07-07 20:11:50 +00:00
local dbPassEnv = {
name: 'DATABASE_PASSWORD',
valueFrom: !utils.local_image,
value: if utils.local_image then 'postgres',
secret: if !utils.local_image then {
name: '%s-database-password' % db.staged_name(dbname),
key: 'password',
2022-11-01 03:45:12 +00:00
optional: if utils.helm_mode then '{{ if .Values.databaseUrl }}true{{ else }}false{{ end }}' else false,
2022-07-07 20:11:50 +00:00
},
};
2022-10-31 02:23:40 +00:00
local ingress_annotations = {
'kubernetes.io/tls-acme': 'true',
'cert-manager.io/cluster-issuer': if utils.helm_mode then '!!{{ if .Values.overrideClusterIssuer }}{{ .Values.overrideClusterIssuer }}{{ else }}letsencrypt-{{ template !"resf.stage!" . }}{{ end }}!!' else 'letsencrypt-staging',
} + (if utils.local_image || !info.backend then {
'konghq.com/https-redirect-status-code': '301',
} else {});
// Helm mode doesn't need this as the deployer/operator should configure it themselves
local shouldSecureEndpoint(srv) = if helm_mode then false else (if mappings.get_env_from_svc(srv.name) == 'prod' && mappings.is_external(srv.name) then false
2022-07-07 20:11:50 +00:00
else if mappings.should_expose_all(srv.name) then false
else if utils.local_image then false
else if !std.objectHas(srv, 'expose') || !srv.expose then false
2022-10-31 02:23:40 +00:00
else true);
local imagePullSecrets = if helm_mode then '{{ if .Values.imagePullSecrets }}[{{ range .Values.imagePullSecrets }}{ name: {{.}} },{{ end }}]{{ else }}null{{end}}' else (if registry_secret != 'none' then [registry_secret] else []);
local migrate_image = if std.objectHas(info, 'migrate_image') && info.migrate_image != null then info.migrate_image else info.image;
local migrate_tag = if std.objectHas(info, 'migrate_tag') && info.migrate_tag != null then info.migrate_tag else info.tag;
local stage_in_resource = if helm_mode then '%s!!' % stage else stage;
local image = if helm_mode then '{{ ((.Values.image).repository) | default !"%s!" }}' % info.image else info.image;
local tag = if helm_mode then '{{ ((.Values.image).tag) | default !"%s!" }}' % info.tag else info.tag;
local extra_info = {
service_account_name: sa_name,
imagePullSecrets: imagePullSecrets,
image: image,
tag: tag,
};
2022-07-07 20:11:50 +00:00
{
2022-10-31 02:23:40 +00:00
[nssa]: (if helm_mode then '{{ if not .Values.serviceAccountName }}\n' else '') + manifestYamlStream([
// disable namespace creation in helm mode
if !helm_mode then kubernetes.define_namespace(metadata.namespace, infolabels),
kubernetes.define_service_account(
metadata {
name: fixed.name,
} + if std.objectHas(info, 'service_account_options') then info.service_account_options else {}
2022-07-07 20:11:50 +00:00
),
2022-10-31 02:23:40 +00:00
]) + (if helm_mode then '{{ end }}' else ''),
2022-07-07 20:11:50 +00:00
[if std.objectHas(info, 'migrate') && info.migrate == true then migrate else null]:
2022-10-31 02:23:40 +00:00
manifestYamlStream([
2022-07-07 20:11:50 +00:00
kubernetes.define_service_account(metadata {
2022-10-31 02:23:40 +00:00
name: 'init-db-%s' % [fixed.name],
2022-07-07 20:11:50 +00:00
}),
kubernetes.define_role(
metadata {
2022-10-31 02:23:40 +00:00
name: 'init-db-%s-%s' % [fixed.name, fixed.namespace],
namespace: 'initdb%s' % stage_in_resource,
2022-07-07 20:11:50 +00:00
},
[{
apiGroups: [''],
resources: ['secrets'],
2022-10-31 02:23:40 +00:00
verbs: ['get'],
2022-07-07 20:11:50 +00:00
}]
),
2022-10-31 02:23:40 +00:00
kubernetes.define_role(
2022-07-07 20:11:50 +00:00
metadata {
2022-10-31 02:23:40 +00:00
name: 'init-db-%s' % [fixed.name],
2022-07-07 20:11:50 +00:00
},
[{
apiGroups: [''],
resources: ['secrets'],
verbs: ['create', 'get'],
}]
),
kubernetes.define_role_binding(
metadata {
2022-10-31 02:23:40 +00:00
name: 'init-db-%s-%s' % [fixed.name, fixed.namespace],
namespace: 'initdb%s' % stage_in_resource,
2022-07-07 20:11:50 +00:00
},
2022-10-31 02:23:40 +00:00
'init-db-%s-%s-role' % [fixed.name, fixed.namespace],
2022-07-07 20:11:50 +00:00
[{
kind: 'ServiceAccount',
2022-10-31 02:23:40 +00:00
name: 'init-db-%s' % [fixed.name],
2022-07-07 20:11:50 +00:00
namespace: fixed.namespace,
}],
),
2022-10-31 02:23:40 +00:00
kubernetes.define_role_binding(
2022-07-07 20:11:50 +00:00
metadata {
2022-10-31 02:23:40 +00:00
name: 'init-db-%s' % [fixed.name],
2022-07-07 20:11:50 +00:00
},
2022-10-31 02:23:40 +00:00
'init-db-%s-role' % [fixed.name],
2022-07-07 20:11:50 +00:00
[{
kind: 'ServiceAccount',
2022-10-31 02:23:40 +00:00
name: 'init-db-%s' % [fixed.name],
2022-07-07 20:11:50 +00:00
namespace: fixed.namespace,
}],
),
2022-10-31 02:23:40 +00:00
if info.migrate == true && dbname != '' then kubernetes.define_job(
metadata {
name: info.name + '-migrate',
annotations: (if helm_mode then {
'helm.sh/hook': 'post-install,post-upgrade',
'helm.sh/hook-weight': '-5',
'helm.sh/hook-delete-policy': 'before-hook-creation',
} else {}),
2022-07-07 20:11:50 +00:00
},
2022-10-31 02:23:40 +00:00
{
image: if helm_mode then '{{ if ((.Values.migrate_image).repository) }}{{ .Values.migrate_image.repository }}{{ else }}{{ ((.Values.image).repository) | default !"%s!" }}{{ end }}' % migrate_image else migrate_image,
tag: if helm_mode then '{{ if ((.Values.migrate_image).tag) }}{{ .Values.migrate_image.tag }}{{ else }}{{ ((.Values.image).tag) | default !"%s!" }}{{ end }}' % migrate_tag else migrate_tag,
command: if std.objectHas(info, 'migrate_command') && info.migrate_command != null then info.migrate_command else ['/bin/sh'],
serviceAccount: 'init-db-%s' % [fixed.name],
imagePullSecrets: imagePullSecrets,
args: if std.objectHas(info, 'migrate_args') && info.migrate_args != null then info.migrate_args else [
'-c',
'export REAL_DSN=`echo $%s | sed -e "s/REPLACEME/${DATABASE_PASSWORD}/g"`; /usr/bin/migrate -source file:///migrations -database $REAL_DSN up' % [info.dsn.name],
],
volumes: (if std.objectHas(info, 'volumes') then info.volumes(metadata) else []),
initContainers: [
{
name: 'initdb',
2022-11-01 03:45:12 +00:00
image: 'quay.io/peridot/initdb:v0.1.6',
2022-10-31 02:23:40 +00:00
command: ['/bin/sh'],
args: ['-c', '/bundle/initdb*'],
env: [
{
name: 'INITDB_TARGET_DB',
value: db.staged_name(dbname),
},
{
name: 'INITDB_PRODUCTION',
value: 'true',
},
{
name: 'INITDB_DATABASE_URL',
value: db.dsn('postgres', true),
},
{
name: 'INITDB_SKIP',
value: if helm_mode then '!!{{ if .Values.databaseUrl }}true{{ else }}false{{ end }}!!' else 'false',
},
],
},
],
env: [
dbPassEnv,
info.dsn,
],
annotations: {
'sidecar.istio.io/inject': 'false',
'linkerd.io/inject': 'disabled',
},
}
) else {},
2022-07-07 20:11:50 +00:00
]),
2022-10-31 02:23:40 +00:00
[deployment]: manifestYamlStream([
2022-07-07 20:11:50 +00:00
kubernetes.define_deployment(
2022-10-31 02:23:40 +00:00
metadata {
annotations: if helm_mode then {
'resf.org/calculated-image': info.image,
'resf.org/calculated-tag': info.tag,
} else null
},
2022-07-07 20:11:50 +00:00
{
2022-10-31 02:23:40 +00:00
replicas: if helm_mode then '{{ .Values.replicas | default !"1!" }}' else (if std.objectHas(info, 'replicas') then info.replicas else 1),
image: image,
tag: tag,
2022-07-07 20:11:50 +00:00
command: if std.objectHas(info, 'command') then [info.command] else null,
fsGroup: if std.objectHas(info, 'fsGroup') then info.fsGroup else null,
fsUser: if std.objectHas(info, 'fsUser') then info.fsUser else null,
imagePullSecrets: imagePullSecrets,
2022-10-31 02:23:40 +00:00
annotations: (if std.objectHas(info, 'annotations') then info.annotations else {}) + (if disableMetrics then {} else {
2022-10-30 01:59:25 +00:00
'prometheus.io/scrape': 'true',
'prometheus.io/port': '7332',
2022-10-31 02:23:40 +00:00
}),
volumes: (if std.objectHas(info, 'volumes') then info.volumes(metadata) else []),
2022-10-30 01:59:25 +00:00
ports: std.map(function(x) x { expose: null, external: null }, ports),
2022-07-07 20:11:50 +00:00
health: if std.objectHas(info, 'health') then info.health,
env: env + (if dbname != '' && info.backend then ([dbPassEnv]) else []) + [
{
name: 'SELF_IDENTITY',
2022-10-31 02:23:40 +00:00
value: 'spiffe://cluster.local/ns/%s/sa/%s' % [fixed.namespace, fixed.name],
2022-07-07 20:11:50 +00:00
},
] + [
2022-10-31 02:23:40 +00:00
if std.objectHas(srv, 'expose') && srv.expose then (if helm_mode then {
name: '%s_PUBLIC_URL' % [std.asciiUpper(std.strReplace(std.strReplace(srv.name, stage, ''), '-', '_'))],
value: 'https://{{ .Values.%s.ingressHost }}!!' % [srv.portName],
} else {
2022-07-07 20:11:50 +00:00
name: '%s_PUBLIC_URL' % [std.asciiUpper(std.strReplace(std.strReplace(srv.name, stage, ''), '-', '_'))],
value: 'https://%s' % mappings.get(srv.name, user),
2022-10-31 02:23:40 +00:00
}) else null,
2022-07-07 20:11:50 +00:00
for srv in services],
limits: if std.objectHas(info, 'limits') then info.limits,
requests: if std.objectHas(info, 'requests') then info.requests,
args: if std.objectHas(info, 'args') then info.args else [],
2022-10-31 02:23:40 +00:00
serviceAccount: sa_name,
2022-07-07 20:11:50 +00:00
},
),
]),
[svcVsDr]:
2022-10-31 02:23:40 +00:00
manifestYamlStream(
2022-10-30 01:59:25 +00:00
[kubernetes.define_service(
metadata {
name: srv.name,
annotations: {
'konghq.com/protocol': std.strReplace(std.strReplace(std.strReplace(srv.name, metadata.name, ''), stage, ''), '-', ''),
}
},
srv.port,
srv.port,
portName=srv.portName,
selector=metadata.name,
2022-10-31 02:23:40 +00:00
env=mappings.get_env_from_svc(srv.name)
2022-10-30 01:59:25 +00:00
) for srv in services] +
2022-10-31 02:23:40 +00:00
if !helm_mode then [] else [if std.objectHas(srv, 'expose') && srv.expose then kubernetes.define_ingress(
metadata {
name: srv.name,
annotations: ingress_annotations + {
'kubernetes.io/ingress.class': '{{ .Values.ingressClass | default !"!" }}',
// Secure only by default
// This produces https, grpcs, etc.
// todo(mustafa): check if we need to add an exemption to a protocol (TCP comes to mind)
'konghq.com/protocols': '{{ .Values.kongProtocols | default !"%ss!"' % std.strReplace(std.strReplace(std.strReplace(srv.name, metadata.name, ''), stage, ''), '-', ''),
}
},
host=if helm_mode then '{{ .Values.%s.ingressHost }}' % srv.portName else mappings.get(srv.name, user),
port=srv.port,
srvName=srv.name + '-service',
) else null for srv in services] +
if helm_mode then [] else [kubernetes.define_virtual_service(metadata { name: srv.name + '-internal' }, {
2022-07-07 20:11:50 +00:00
hosts: [vshost(srv)],
gateways: [],
http: [
{
route: [{
destination: {
host: vshost(srv),
subset: mappings.get_env_from_svc(srv.name),
port: {
number: srv.port,
},
},
} + (if std.objectHas(info, 'internal_route_options') then info.internal_route_options else {})],
},
],
},) for srv in services] +
2022-10-31 02:23:40 +00:00
if helm_mode then [] else [if std.objectHas(srv, 'expose') && srv.expose then kubernetes.define_virtual_service(
2022-07-07 20:11:50 +00:00
metadata {
name: srv.name,
annotations: {
'external-dns.alpha.kubernetes.io/target': if mappings.is_external(srv.name) then 'ingress.build.resf.org' else 'ingress-internal.build.resf.org',
},
},
{
hosts: [mappings.get(srv.name, user)],
gateways: if mappings.is_external(srv.name) then ['istio-system/base-gateway-public'] else ['istio-system/base-gateway-confidential'],
http: [
{
route: [{
destination: {
host: vshost(srv),
subset: mappings.get_env_from_svc(srv.name),
port: {
number: srv.port,
},
},
} + (if std.objectHas(info, 'external_route_options') then info.external_route_options else {})],
},
],
}
) else null for srv in services] +
2022-10-31 02:23:40 +00:00
if helm_mode then [] else [{
2022-07-07 20:11:50 +00:00
apiVersion: 'security.istio.io/v1beta1',
kind: 'RequestAuthentication',
metadata: metadata {
name: srv.name,
},
spec: {
selector: {
matchLabels: {
app: metadata.name,
env: mappings.get_env_from_svc(srv.name),
},
},
// todo(mustafa): Introduce ObsidianProxy to support BeyondCorp
jwtRules: if shouldSecureEndpoint(srv) then [{
issuer: 'https://cloud.google.com/iap',
jwksUri: 'https://www.gstatic.com/iap/verify/public_key-jwk',
fromHeaders: [{ name: 'x-goog-iap-jwt-assertion' }],
}] else [],
},
} for srv in services] +
2022-10-31 02:23:40 +00:00
if helm_mode then [] else [{
2022-07-07 20:11:50 +00:00
apiVersion: 'security.istio.io/v1beta1',
kind: 'AuthorizationPolicy',
metadata: metadata {
name: srv.name,
},
spec: {
selector: {
matchLabels: {
app: metadata.name,
env: mappings.get_env_from_svc(srv.name),
},
},
action: 'ALLOW',
rules: [(if shouldSecureEndpoint(srv) then {
from: [],
} else {}) + {
to: [{
operation: {
ports: [std.toString(srv.port)]
}
}]
}],
},
} for srv in services] +
2022-10-31 02:23:40 +00:00
if helm_mode then [] else [kubernetes.define_destination_rule(metadata { name: srv.name }, {
2022-07-07 20:11:50 +00:00
host: vshost(srv),
trafficPolicy: {
tls: {
mode: 'ISTIO_MUTUAL',
},
},
subsets: [
{
name: mappings.get_env_from_svc(srv.name),
labels: {
app: metadata.name,
env: mappings.get_env_from_svc(srv.name),
},
},
],
},) for srv in services]
),
[if std.objectHas(info, 'custom_job_items') then custom else null]:
2022-10-31 02:23:40 +00:00
manifestYamlStream(if std.objectHas(info, 'custom_job_items') then info.custom_job_items(metadata, extra_info) else [{}]),
2022-07-07 20:11:50 +00:00
},
}
