diff --git a/incubator/gocd/Chart.yaml b/incubator/gocd/Chart.yaml index 38751783e8..7de6a75be2 100644 --- a/incubator/gocd/Chart.yaml +++ b/incubator/gocd/Chart.yaml @@ -1,8 +1,8 @@ name: gocd home: https://www.gocd.org/ -version: 0.2.1 +version: 0.2.2 appVersion: 18.1.0 -description: A GoCD Helm chart for Kubernetes. GoCD is an Open source continuous delivery server to model and visualize complex workflows with ease. +description: GoCD is an open-source continuous delivery server to model and visualize complex workflows with ease. icon: https://gocd.github.io/assets/images/go-icon-black-192x192.svg keywords: - gocd @@ -21,4 +21,4 @@ maintainers: - name: ganeshspatil email: ganeshpl@thoughtworks.com - name: varshavaradarajan - email: varshavs@thoughtworks.com + email: varshasvaradarajan@gmail.com diff --git a/incubator/gocd/README.md b/incubator/gocd/README.md index b61646a472..8abba88461 100644 --- a/incubator/gocd/README.md +++ b/incubator/gocd/README.md @@ -2,22 +2,45 @@ [![Join the chat at https://gitter.im/gocd/gocd](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/gocd/gocd?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) -A GoCD Helm chart for Kubernetes. [GoCD](https://www.gocd.org/) is an Open source continuous delivery server to model and visualize complex workflow with ease. +[GoCD](https://www.gocd.org/) is an open-source continuous delivery server to model and visualize complex workflow with ease. # Introduction -This chart bootstraps a single node GoCD server and a GoCD Agent deployment with configurable agent count on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +This chart bootstraps a single node GoCD server and GoCD agents on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. ## Prerequisites - Kubernetes 1.8+ with Beta APIs enabled - PV provisioner support in the underlying infrastructure +- LoadBalancer support or Ingress Controller +- Ensure that the service account used for starting tiller has enough permissions to create a role. + +## Setup + +Because of the [known issue] (https://github.com/kubernetes/helm/issues/2224) while creating a role, in order for the `helm install` to work, please ensure to do the following: + +- On minikube + +```bash +$ minikube start --bootstrapper kubeadm +``` + +- On GKE, if tiller's in the kube-system namespace + +```bash + +$ kubectl create clusterrolebinding clusterRoleBinding \ 1 ↵ + --clusterrole=cluster-admin \ + --serviceaccount=kube-system:default +``` ## Installing the Chart -To install the chart with the release name `my-release`: +To install the chart with the release name `gocd-app`: ```bash -$ helm install --name my-release incubator/gocd +$ helm repo add incubator https://kubernetes-charts-incubator.storage.googleapis.com/ +$ helm install --name gocd-app --namespace gocd incubator/gocd ``` The command deploys GoCD on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. @@ -26,10 +49,10 @@ The command deploys GoCD on the Kubernetes cluster in the default configuration. ## Uninstalling the Chart -To uninstall/delete the `my-release` deployment: +To uninstall/delete the `gocd-app` deployment: ```bash -$ helm delete my-release +$ helm delete --purge gocd-app ``` The command removes all the Kubernetes components associated with the chart and deletes the release. @@ -42,7 +65,7 @@ The following tables lists the configurable parameters of the GoCD chart and the | Parameter | Description | Default | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------- | ------------------- | -| `server.enabled` | Enable GoCD Server. Supported values are `true`: `Agent-Server Deployment`, `false`: `Agent Only Deployment` | `true` | +| `server.enabled` | Enable GoCD Server. Supported values are `true`, `false`. When enabled, the GoCD server deployment is done on helm install. | `true` | | `server.image.repository` | GoCD server image | `gocd/gocd-server` | | `server.image.tag` | GoCD server image tag | `.Chart.appVersion` | | `server.image.pullPolicy` | Image pull policy | `IfNotPresent` | @@ -55,22 +78,23 @@ The following tables lists the configurable parameters of the GoCD chart and the | `server.service.httpsPort` | GoCD server service HTTPS port | `8154` | | `server.service.nodeHttpPort` | GoCD server service node HTTP port. **Note**: A random nodePort will get assigned if not specified | `nil` | | `server.service.nodeHttpsPort` | GoCD server service node HTTPS port. **Note**: A random nodePort will get assigned if not specified | `nil` | -| `server.ingress.enabled` | Enable GoCD ingress. | `false` | +| `server.ingress.enabled` | Enable/disable GoCD ingress. Allow traffic from outside the cluster via http. Do `kubectl describe ing` to get the public ip to access the gocd server. | `true` | | `server.ingress.hosts` | GoCD ingress hosts records. | `nil` | -| `server.healthCheck.initialDelaySeconds` | Initial delays in seconds to start the health checks. **Note**:GoCD server start up time. | `180` | -| `server.healthCheck.periodSeconds` | GoCD server heath check interval period. | `5` | +| `server.healthCheck.initialDelaySeconds` | Initial delays in seconds to start the health checks. **Note**:GoCD server start up time. | `90` | +| `server.healthCheck.periodSeconds` | GoCD server heath check interval period. | `15` | +| `server.healthCheck.failureThreshold` | Number of unsuccessful attempts made to the GoCD server health check endpoint before restarting. | `10` | ### GoCD Agent | Parameter | Description | Default | | ----------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | -| `agent.replicaCount` | GoCD Agent replicas Count | `1` | +| `agent.replicaCount` | GoCD Agent replicas Count. By default, no agents are provided. | `0` | | `agent.image.repository` | GoCD agent image | `gocd/gocd-agent-alpine-3.6` | | `agent.image.tag` | GoCD agent image tag | `.Chart.appVersion` | | `agent.image.pullPolicy` | Image pull policy | `IfNotPresent` | | `agent.resources` | GoCD agent resource requests and limits | `{}` | | `agent.nodeSelector` | GoCD agent nodeSelector for pod labels | `{}` | -| `agent.env.goServerUrl` | GoCD Server Url | `nil` | +| `agent.env.goServerUrl` | GoCD Server Url. If nil, discovers the GoCD server service if its available on the Kubernetes cluster | `nil` | | `agent.env.agentAutoRegisterKey` | GoCD Agent autoregister key | `nil` | | `agent.env.agentAutoRegisterResources` | Comma separated list of GoCD Agent resources | `nil` | | `agent.env.agentAutoRegisterEnvironemnts` | Comma separated list of GoCD Agent environments | `nil` | @@ -78,35 +102,57 @@ The following tables lists the configurable parameters of the GoCD chart and the | `agent.env.goAgentBootstrapperArgs` | GoCD Agent Bootstrapper Args. It can be used to [Configure end-to-end transport security](https://docs.gocd.org/current/installation/ssl_tls/end_to_end_transport_security.html) | `nil` | | `agent.env.goAgentBootstrapperJvmArgs` | GoCD Agent Bootstrapper JVM Args. | `nil` | | `agent.healthCheck.enabled` | Enable use of GoCD agent health checks. | `false` | -| `agent.healthCheck.initialDelaySeconds` | GoCD agent start up time. | `180` | +| `agent.healthCheck.initialDelaySeconds` | GoCD agent start up time. | `60` | | `agent.healthCheck.periodSeconds` | GoCD agent heath check interval period. | `60` | -| `agent.healthCheck.failureThreshold` | GoCD agent heath check failure threshold. After failure threshold timeout, agent will be restarted. | `60` | +| `agent.healthCheck.failureThreshold` | GoCD agent heath check failure threshold. Number of unsuccessful attempts made to the GoCD server health check endpoint before restarting. | `60` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, ```bash -$ helm install --name my-release -f values.yaml incubator/gocd +$ helm install --namespace gocd --name gocd-app -f values.yaml incubator/gocd ``` > **Tip**: You can use the default [values.yaml](values.yaml) -## persistence +## Persistence -The GoCD server image stores persistence under `/godata` path of the container. A dynamically managed Persistent Volume -Claim is used to keep the data across deployments, by default. This is known to work in minikube. Alternatively, -a previously configured Persistent Volume Claim can be used. +By default, the GoCD helm chart supports dynamic volume provisioning. This means that the standard storage class with a default provisioner provided by various cloud platforms used. +Refer to the [Kubernetes blog](http://blog.kubernetes.io/2017/03/dynamic-provisioning-and-storage-classes-kubernetes.html) to know more about the default provisioners across platforms. +> **Note**: The recalim policy for most default volume provisioners is `delete`. This means that, the persistent volume provisioned using the default provisioner will be deleted along with the data when the PVC gets deleted. + +One can change the storage class to be used by overriding `server.persistence.storageClass` and `agent.persistence.storageClass` like below: + +```bash +$ helm install --namespace gocd --name gocd-app --set server.persistence.stoageClass=STORAGE_CLASS_NAME incubator/gocd +``` + +#### Static Volumes + +Alternatively, a static persistent volume can be specified. This must be manually managed by the cluster admin outside of the helm scope. +For binding with a static persistent volume, dynamic volume provisioning must be **disabled** by setting `server.persistence.storageClass` or `agent.persistence.storageClass` to `-` . +The value pvSelector must be specified so that the right persistence volume will be bound. + +#### Existing PersistentVolumeClaim + +1. Create the PersistentVolume +2. Create the PersistentVolumeClaim +3. Install the chart + +``` +$ helm install --name gocd-app --set server.persistence.existingClaim=PVC_NAME incubator/gocd +``` ### Server persistence Values | Parameter | Description | Default | | --------------------------------------------- | --------------------------------------------------- | -------------------- | -| `server.persistence.enabled` | Enable the use of a GoCD server PVC | `false` | +| `server.persistence.enabled` | Enable the use of a GoCD server PVC | `true` | | `server.persistence.accessMode` | The PVC access mode | `ReadWriteOnce` | -| `server.persistence.size` | The size of the PVC | `1Gi` | +| `server.persistence.size` | The size of the PVC | `2Gi` | | `server.persistence.storageClass` | The PVC storage class name | `nil` | | `server.persistence.pvSelector` | The godata Persistence Volume Selectors | `nil` | | `server.persistence.subpath.godata` | The /godata path on Persistence Volume | `godata` | @@ -115,15 +161,15 @@ a previously configured Persistent Volume Claim can be used. ### Agent persistence Values -| Parameter | Description | Default | -| --------------------------------------------- | --------------------------------------------------- | -------------------- | -| `agent.persistence.enabled` | Enable the use of a GoCD agent PVC | `false` | -| `agent.persistence.accessMode` | The PVC access mode | `ReadWriteOnce` | -| `agent.persistence.size` | The size of the PVC | `1Gi` | -| `agent.persistence.storageClass` | The PVC storage class name | `nil` | -| `agent.persistence.pvSelector` | The godata Persistence Volume Selectors | `nil` | -| `agent.persistence.subpath.homego` | The /home/go path on Persistence Volume | `homego` | -| `agent.persistence.subpath.dockerEntryPoint` | The /docker-entrypoint.d path on Persistence Volume | `scripts` | +| Parameter | Description | Default | +| --------------------------------------------- | ---------------------------------------------------- | -------------------- | +| `agent.persistence.enabled` | Enable the use of a GoCD agent PVC | `false` | +| `agent.persistence.accessMode` | The PVC access mode | `ReadWriteOnce` | +| `agent.persistence.size` | The size of the PVC | `1Gi` | +| `agent.persistence.storageClass` | The PVC storage class name | `nil` | +| `agent.persistence.pvSelector` | The godata Persistence Volume Selectors | `nil` | +| `agent.persistence.subpath.homego` | The /home/go path on Persistence Volume | `homego` | +| `agent.persistence.subpath.dockerEntryPoint` | The /docker-entrypoint.d path on Persistence Volume | `scripts` | ##### Note: @@ -132,14 +178,47 @@ a previously configured Persistent Volume Claim can be used. 1. That packages being cached here is shared between all the agents. 2. That all the agents sharing this directory are privy to all the secrets in `/home/go` -### Existing PersistentVolumeClaim - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. Install the chart +## RBAC and Service Accounts + +The RBAC section is for users who want to use the Kubernetes Elastic Agent Plugin with GoCD. The Kubernetes elastic agent plugin for GoCD brings up pods on demand while running a job. +If RBAC is enabled, + 1. A cluster role is created by default and the following privileges are provided. + Privileges: + - nodes: list, get + - events: list, watch + - namespace: list, get + - pods, pods/log: * + + 2. A cluster role binding to bind the specified service account with the cluster role. + + 3. A gocd service account . This service account is bound to a cluster role. + If `rbac.create=true` and `serviceAccount.create=false`, the `default` service account in the namespace will be used for cluster role binding. + + +| Parameter | Description | Default | +| --------------------------------------------- | ----------------------------------------------------------------------------------- | -------------------- | +| `rbac.create` | If true, a gocd service account, role, and role binding is created. | `true` | +| `rbac.apiVersion` | The Kubernetes API version | `v1beta1` | +| `rbac.roleRef` | An existing role that can be bound to the gocd service account. | `nil` | +| `serviceAccount.create` | Specifies whether a service account should be created. | `true` | +| `serviceAccount.name` | Name of the service account. | `nil` | + +If `rbac.create=false`, the service account that will be used, either the default or one that's created, will not have the cluster scope or pod privileges to use with the Kubernetes EA plugin. +A cluster role binding must be created like below: ``` -$ helm install --name my-release --set server.persistence.godata.existingClaim=PVC_NAME incubator/gocd +kubectl create clusterrolebinding clusterRoleBinding \ +--clusterrole=CLUSTER_ROLE_WITH_NECESSARY_PRIVILEGES \ +--serviceaccount=NAMESPACED_SERVICE_ACCOUNT + +``` + +#### Existing role references: + +The gocd service account can be associated with an existing role in the namespace that has privileges to create and delete pods. To use an existing role, + +```bash +helm install --namespace gocd --name gocd-app --set rbac.roleRef=ROLE_NAME incubator/gocd ``` # License diff --git a/incubator/gocd/templates/NOTES.txt b/incubator/gocd/templates/NOTES.txt index c6591cb606..937105ef67 100644 --- a/incubator/gocd/templates/NOTES.txt +++ b/incubator/gocd/templates/NOTES.txt @@ -1,19 +1,64 @@ -1. Get the application URL by running these commands: +1. Get the GoCD server URL by running these commands: {{- if .Values.server.ingress.enabled }} + It may take a few minutes before the IP is available to access the GoCD server. + ip=$(kubectl get ingress --namespace {{ .Release.Namespace }} {{ template "gocd.fullname" . }}-server -o jsonpath="{.status.loadBalancer.ingress[0].ip}") + echo "http://$ip" {{- range .Values.server.ingress.hosts }} http://{{ . }} {{- end }} {{- else if contains "NodePort" .Values.server.service.type }} - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "gocd.fullname" . }}-server) - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - echo http://$NODE_IP:$NODE_PORT + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "gocd.fullname" . }}-server) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT {{- else if contains "LoadBalancer" .Values.server.service.type }} NOTE: It may take a few minutes for the LoadBalancer IP to be available. You can watch the status of by running 'kubectl get svc -w {{ template "gocd.name" . }}-server' - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "gocd.name" . }}-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}') - echo http://$SERVICE_IP:{{ .Values.server.service.externalPort }} + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "gocd.name" . }}-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:{{ .Values.server.service.externalPort }} {{- else if contains "ClusterIP" .Values.server.service.type }} - export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "gocd.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - echo "Visit http://127.0.0.1:8080 to use your application" + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "gocd.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + echo "Visit http://127.0.0.1:8080 to use your application" kubectl port-forward $POD_NAME 8080:{{ .Values.server.service.httpPort }} {{- end }} + +2. Persistence +{{- if .Values.server.persistence.enabled -}} +{{ if not .Values.server.persistence.storageClass }} + ################################################################################################ + WARNING: The default storage class will be used. The reclaim policy for this is usually `Delete`. + You will lose all data at the time of pod termination! + ################################################################################################ +{{ end }} +{{ else }} + ################################################################################################ + WARNING: Persistence is disabled. You will lose all data at the time of pod termination! + ################################################################################################ +{{ end }} + +3. Get the service account token to configure the elastic agent plugin by doing the following: +{{- if .Values.rbac.create -}} + {{- if .Values.rbac.roleRef -}} + {{ else }} + A default role {{ template "gocd.fullname" . }} with cluster scoped privileges has been configured. + {{ end }} + The service account called {{ template "gocd.serviceAccountName" . }} in namespace {{ .Release.Namespace }} has been associated with the role. To check, + $ secret_name=$(kubectl --namespace={{ .Release.Namespace }} get serviceaccount {{ template "gocd.serviceAccountName" . }} -o jsonpath="{.secrets[0].name}") + $ kubectl --namespace={{ .Release.Namespace }} get secret $secret_name -o jsonpath="{.data['token']}" | base64 --decode + + To obtain the CA certificate, do + $ kubectl --namespace={{ .Release.Namespace }} get secret $secret_name -o jsonpath="{.data['ca\.crt']}" | base64 --decode +{{ else }} + Looks like rbac was disabled during installation. + For configuring the plugin settings for the kubernetes elastic agent plugin, ensure that the service account `{{ template "gocd.serviceAccountName" . }}` present in the namespace `{{ .Release.Namespace }}` or any manually created service account has been granted the following privileges. + Privileges: + - nodes: list, get + - events: list, watch + - namespace: list, get + - pods, pods/log: * +{{ end }} + +4. The GoCD server URL for configuring the Kubernetes elastic agent plugin settings: + echo "https://$(kubectl --namespace --namespace={{ .Release.Namespace }} get service {{ template "gocd.fullname" . }}-server -o jsonpath='{.spec.clusterIP}'):8154/go" + +5. The cluster URL for configuring the Kubernetes elastic agent plugin settings can be obtained by + $ kubectl cluster-info \ No newline at end of file diff --git a/incubator/gocd/templates/_helpers.tpl b/incubator/gocd/templates/_helpers.tpl index de280f6b67..6749e7f5c7 100644 --- a/incubator/gocd/templates/_helpers.tpl +++ b/incubator/gocd/templates/_helpers.tpl @@ -14,3 +14,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- $name := default .Chart.Name .Values.nameOverride -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 -}} {{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "gocd.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "gocd.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/incubator/gocd/templates/gocd-agent-deployment.yaml b/incubator/gocd/templates/gocd-agent-deployment.yaml index c20098efa2..e02aa433cc 100644 --- a/incubator/gocd/templates/gocd-agent-deployment.yaml +++ b/incubator/gocd/templates/gocd-agent-deployment.yaml @@ -26,7 +26,7 @@ spec: volumes: - name: goagent-vol persistentVolumeClaim: - claimName: {{ template "gocd.fullname" . }}-agent + claimName: {{ .Values.agent.persistence.existingClaim | default (printf "%s-%s" (include "gocd.fullname" .) "agent") }} {{- end }} containers: - name: {{ template "gocd.name" . }}-agent diff --git a/incubator/gocd/templates/gocd-ea-cluster-role-binding.yaml b/incubator/gocd/templates/gocd-ea-cluster-role-binding.yaml new file mode 100644 index 0000000000..8b24ec90f1 --- /dev/null +++ b/incubator/gocd/templates/gocd-ea-cluster-role-binding.yaml @@ -0,0 +1,19 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }} +kind: ClusterRoleBinding +metadata: + name: {{ template "gocd.fullname" . }} + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "gocd.fullname" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +subjects: +- kind: ServiceAccount + name: {{ template "gocd.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Values.rbac.roleRef | default (printf "%s" (include "gocd.fullname" .)) }} +{{ end }} \ No newline at end of file diff --git a/incubator/gocd/templates/gocd-ea-cluster-role.yaml b/incubator/gocd/templates/gocd-ea-cluster-role.yaml new file mode 100644 index 0000000000..63e518a6ec --- /dev/null +++ b/incubator/gocd/templates/gocd-ea-cluster-role.yaml @@ -0,0 +1,29 @@ +{{ if and .Values.rbac.create (not .Values.rbac.roleRef) }} +apiVersion: rbac.authorization.k8s.io/{{ required "A valid .Values.rbac.apiVersion entry required!" .Values.rbac.apiVersion }} +kind: ClusterRole +metadata: + name: {{ template "gocd.fullname" . }} + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "gocd.fullname" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +rules: +- apiGroups: [""] + resources: + - pods + - pods/log + verbs: ["*"] +- apiGroups: [""] + resources: + - nodes + verbs: ["get", "list"] +- apiGroups: [""] + resources: + - events + verbs: ["list", "watch"] +- apiGroups: [""] + resources: + - namespaces + verbs: ["list", "get"] +{{ end }} diff --git a/incubator/gocd/templates/gocd-ea-service-account.yaml b/incubator/gocd/templates/gocd-ea-service-account.yaml new file mode 100644 index 0000000000..a5b09393e0 --- /dev/null +++ b/incubator/gocd/templates/gocd-ea-service-account.yaml @@ -0,0 +1,11 @@ +{{ if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "gocd.serviceAccountName" . }} + labels: + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + app: "{{ template "gocd.fullname" . }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +{{ end }} diff --git a/incubator/gocd/templates/gocd-server-deployment.yaml b/incubator/gocd/templates/gocd-server-deployment.yaml index ccc2ba7712..13f9585174 100644 --- a/incubator/gocd/templates/gocd-server-deployment.yaml +++ b/incubator/gocd/templates/gocd-server-deployment.yaml @@ -11,6 +11,8 @@ metadata: component: server spec: replicas: 1 + strategy: + type: Recreate selector: matchLabels: app: {{ template "gocd.name" . }} @@ -27,7 +29,7 @@ spec: volumes: - name: goserver-vol persistentVolumeClaim: - claimName: {{ template "gocd.fullname" . }} + claimName: {{ .Values.server.persistence.existingClaim | default (printf "%s-%s" (include "gocd.fullname" .) "server") }} {{- end }} containers: - name: {{ template "gocd.name" . }}-server @@ -54,11 +56,14 @@ spec: port: 8153 initialDelaySeconds: {{ .Values.server.healthCheck.initialDelaySeconds }} periodSeconds: {{ .Values.server.healthCheck.periodSeconds }} + failureThreshold: {{ .Values.server.healthCheck.failureThreshold }} readinessProbe: httpGet: path: /go/api/v1/health port: 8153 initialDelaySeconds: {{ .Values.server.healthCheck.initialDelaySeconds }} + periodSeconds: {{ .Values.server.healthCheck.periodSeconds }} + failureThreshold: {{ .Values.server.healthCheck.failureThreshold }} {{- if .Values.server.persistence.enabled }} volumeMounts: - name: goserver-vol diff --git a/incubator/gocd/templates/gocd-server-pvc.yaml b/incubator/gocd/templates/gocd-server-pvc.yaml index 467ae1f0a3..f77ceffcc8 100644 --- a/incubator/gocd/templates/gocd-server-pvc.yaml +++ b/incubator/gocd/templates/gocd-server-pvc.yaml @@ -2,7 +2,7 @@ kind: PersistentVolumeClaim apiVersion: v1 metadata: - name: {{ template "gocd.fullname" . }} + name: {{ template "gocd.fullname" . }}-server labels: app: {{ template "gocd.name" . }} chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" @@ -16,9 +16,11 @@ spec: requests: storage: {{ .Values.server.persistence.size | quote }} {{- if .Values.server.persistence.storageClass }} - storageClassName: {{ .Values.server.persistence.storageClass }} -{{- else }} +{{- if (eq "-" .Values.server.persistence.storageClass) }} storageClassName: "" +{{- else }} + storageClassName: {{ .Values.server.persistence.storageClass }} +{{- end }} {{- end }} {{- if .Values.server.persistence.pvSelector }} selector: diff --git a/incubator/gocd/templates/ingress.yaml b/incubator/gocd/templates/ingress.yaml index 3e9dee97f9..a48548460b 100644 --- a/incubator/gocd/templates/ingress.yaml +++ b/incubator/gocd/templates/ingress.yaml @@ -1,5 +1,5 @@ {{- if .Values.server.ingress.enabled -}} -apiVersion: apps/v1beta2 +apiVersion: extensions/v1beta1 kind: Ingress metadata: name: {{ template "gocd.fullname" . }}-server diff --git a/incubator/gocd/values.yaml b/incubator/gocd/values.yaml index ab14cc2077..14ef41af88 100644 --- a/incubator/gocd/values.yaml +++ b/incubator/gocd/values.yaml @@ -2,6 +2,22 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. +rbac: + # Specifies whether rbac resources must be created. + create: true + # The API version to use while creating the rbac resources. Use `kubectl api-versions | grep rbac` to find which abi versions are supported for your cluster. + apiVersion: v1beta1 + # Create a cluster role binding with the existing role, do not create a new one. If left blank, a new cluster role is created. + roleRef: + +serviceAccount: + # Specifies whether a service account should be created + create: true + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + # If create if false and a name is not specified, the default service account is used for the cluster role binding. + name: + server: # server.enabled is the toggle to run GoCD Server. Change to false for Agent Only Deployment. enabled: true @@ -30,11 +46,14 @@ server: healthCheck: # server.healthCheck.initialDelaySeconds is the initial delays in seconds to start the health checks - initialDelaySeconds: 180 + initialDelaySeconds: 90 # server.healthCheck.periodSeconds is the health check interval duration - periodSeconds: 5 + periodSeconds: 15 + # server.healthCheck.failureThreshold is the number of unsuccessful attempts made to the GoCD server health check endpoint before the container is restarted (for liveness) or marked as unready (for readiness) + failureThreshold: 10 env: - # server.env.goServerSystemProperties is the GoCD Server system properties + # server.env.goServerSystemProperties is a list of Java system properties, which needs to be provided to the GoCD Server, typically prefixed with -D unless otherwise stated. + # Example: "-Xmx4096mb -Dfoo=bar" goServerSystemProperties: # server.env.extraEnvVars is the list of environment variables passed to GoCD Server extraEnvVars: @@ -53,30 +72,43 @@ server: # server.service.nodeHttpPort is the GoCD Server Service Node HTTPS port nodeHttpsPort: ingress: - # server.ingress.enabled is the toggle to enable GoCD Server Ingress - enabled: false + # server.ingress.enabled is the toggle to enable/disable GoCD Server Ingress + enabled: true # server.ingress.hosts is used to create an Ingress record. # hosts: # - foo.go.cd persistence: - # server.persistence.enabled is the toggle for server volume persistence. Change to true if a persistent volume is available and configured manually. - enabled: false + # server.persistence.enabled is the toggle for server volume persistence. + enabled: true accessMode: "ReadWriteOnce" - size: 1Gi - storageClass: - ExistingClaim: + # The storage space that should be claimed from the persistent volume + size: 2Gi + # If defined, storageClassName: + # If set to "-", storageClassName: "", which disables dynamic provisioning + # If undefined (the default) or set to null, no storageClassName spec is + # set, choosing 'standard' storage class available with the default provisioner (gcd-pd on GKE, hostpath on minikube, etc). + +# storageClass: "-" + + # A manually managed Persistent Volume and Claim + # If defined, PVC must be created manually before volume will be bound + existingClaim: + # To choose a suitable persistent volume from available static persistent volumes, selectors are used. pvSelector: # matchLabels: # volume-type: ssd subpath: + # godata is where the config, db, plugins are stored godata: godata + # homego can be used for storing and mounting secrets homego: homego + # custom entrypoint scripts that should be run before starting the GoCD server inside the container. dockerEntryPoint: scripts agent: # agent.replicaCount is the GoCD Agent replicas Count. Specify the number of GoCD agents to run - replicaCount: 1 + replicaCount: 0 image: # agent.image.repository is the GoCD Agent image name repository: "gocd/gocd-agent-alpine-3.6" @@ -106,8 +138,16 @@ agent: enabled: false accessMode: "ReadWriteOnce" size: 1Gi - storageClass: - ExistingClaim: + # If defined, storageClassName: + # If set to "-", storageClassName: "", which disables dynamic provisioning + # If undefined (the default) or set to null, no storageClassName spec is + # set, choosing 'standard' storage class available with the default provisioner (gcd-pd on GKE, hostpath on minikube, etc). + +# storageClass: "-" + + # A manually managed Persistent Volume and Claim + # If defined, PVC must be created manually before volume will be bound + existingClaim: pvSelector: # matchLabels: # app: godata-gocd-agent @@ -119,7 +159,7 @@ agent: # agent.healthCheck.enable is the toggle for GoCD agent health checks enabled: false # agent.healthCheck.initialDelaySeconds is the initial delays in seconds to start the health checks - initialDelaySeconds: 180 + initialDelaySeconds: 60 # agent.healthCheck.periodSeconds is the health check interval duration periodSeconds: 60 # agent.healthCheck.failureThreshold is the health check failure threshold of GoCD agent