not
7a5840149c
One chart whose values.yaml is a near-literal transcription of infra/docker-compose.yml, rendered by three generic templates (Deployment, Job, Service) over a `workloads` map — so the two stacks can be diffed by eye instead of by archaeology, and adding a service is a values edit. Platform-forced deviations, each commented where it appears: - `args`, never `command`: compose replaces the image CMD, Kubernetes replaces the ENTRYPOINT. The chart fails to render on `command`, because the symptom (postgres refusing to run as root, Keycloak exec-ing `start-dev`) is nothing like the cause. - The four Django services apply their own setup_configuration in the web pod rather than in a separate init Job: both scripts migrate, and without compose's depends_on they race the same database. - OpenZaak and Objecten are addressed by service FQDN, because Django rejects a single-label host in a URL — the reason compose passes container IPs around. - NodePorts, no ingress; databases are emptyDir until persistence.storageClass is set, so the stack comes up on a cluster with no CSI driver. The upstream config inputs stay in the repo and become ConfigMaps via infra/helm/seed-configmaps.sh — the Kubernetes sibling of infra/seed-config.sh — so the compose stack and the chart cannot fork. infra/helm/registry.yaml runs an in-cluster registry because Talos cannot side-load an image and a laptop-side one needs a root-level firewall change.
47 lines
2.2 KiB
Bash
Executable File
47 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Turn the repo's config inputs into the ConfigMaps the Helm chart mounts.
|
|
#
|
|
# This is the Kubernetes sibling of infra/seed-config.sh: the upstream Common
|
|
# Ground images are used verbatim and read their config from a mounted directory,
|
|
# so the config has to be handed to the platform out-of-band. Compose gets it via
|
|
# `docker cp` into external volumes; Kubernetes gets it as ConfigMaps created from
|
|
# the files that already live in this repo. Copying those files into the chart
|
|
# would fork them from the compose stack, so we don't.
|
|
#
|
|
# Idempotent: re-run after editing any data.yaml, then `make k8s-reseed`.
|
|
#
|
|
# Usage: seed-configmaps.sh [namespace] (default: big)
|
|
set -euo pipefail
|
|
|
|
ns="${1:-big}"
|
|
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
repo="$(cd "$here/../.." && pwd)"
|
|
|
|
kubectl get namespace "$ns" >/dev/null 2>&1 || kubectl create namespace "$ns"
|
|
|
|
seed() { # name <kubectl --from-file args...>
|
|
local name="$1"; shift
|
|
kubectl create configmap "$name" -n "$ns" "$@" \
|
|
--dry-run=client -o yaml | kubectl apply -f - >/dev/null
|
|
echo " seeded configmap/$name"
|
|
}
|
|
|
|
seed rr-oz-config --from-file="$repo/infra/openzaak/setup_configuration/"
|
|
seed rr-nrc-config --from-file="$repo/infra/opennotificaties/setup_configuration/"
|
|
seed rr-kc-realms --from-file="$repo/infra/keycloak/realms/"
|
|
seed rr-objecttypen-config --from-file="$repo/infra/objecttypen/setup_configuration/"
|
|
seed rr-objecten-config --from-file="$repo/infra/objecten/setup_configuration/"
|
|
# register.py + the RegisterRecord JSON schema (the __pycache__ dir is skipped:
|
|
# kubectl only takes regular files from a --from-file directory).
|
|
seed rr-registerrecord-config --from-file="$repo/infra/objecttypen-registerrecord/"
|
|
# The BPMN and the DMN are two separate Flowable deployments (S-13, ADR-0016).
|
|
seed rr-fl-bpmn \
|
|
--from-file="$repo/workflows/registratie.bpmn" \
|
|
--from-file="$repo/workflows/diploma-eligibility.dmn"
|
|
# The two bootstrap scripts the compose local stack runs as init containers
|
|
# (S-B04, ADR-0020). Stdlib-only, so a plain python image can run them.
|
|
seed rr-seed-scripts \
|
|
--from-file="$repo/infra/openzaak/seed_catalogus.py" \
|
|
--from-file="$repo/infra/local/register-abonnement.py"
|