diff --git a/Dockerfile.queue-operator b/Dockerfile.queue-operator new file mode 100644 index 0000000..0922b49 --- /dev/null +++ b/Dockerfile.queue-operator @@ -0,0 +1,12 @@ +FROM golang:1.26 AS build +WORKDIR /src +ENV GOPRIVATE=forgejo.riotpiao.homelab.com +COPY go.mod go.sum ./ +RUN go mod download +COPY . . +RUN CGO_ENABLED=0 go build -trimpath -o /out/queue-operator ./cmd/queue-operator + +FROM gcr.io/distroless/static-debian12:nonroot +COPY --from=build /out/queue-operator /queue-operator +USER nonroot:nonroot +ENTRYPOINT ["/queue-operator"] diff --git a/k8s/charts/management-service/templates/ingress-grpc.yaml b/k8s/charts/management-service/templates/ingress-grpc.yaml new file mode 100644 index 0000000..8dcdcc6 --- /dev/null +++ b/k8s/charts/management-service/templates/ingress-grpc.yaml @@ -0,0 +1,27 @@ +{{- if and .Values.ingress.enabled .Values.ingress.grpcEnabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: management-service-grpc + namespace: {{ .Values.namespace }} + annotations: + cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }} + nginx.ingress.kubernetes.io/backend-protocol: "GRPC" +spec: + ingressClassName: {{ .Values.ingress.className }} + tls: + - hosts: + - {{ .Values.ingress.host }} + secretName: {{ .Values.ingress.tlsSecretName }} + rules: + - host: {{ .Values.ingress.host }} + http: + paths: + - path: {{ .Values.ingress.grpcPathPrefix }} + pathType: Prefix + backend: + service: + name: management-service + port: + number: {{ .Values.grpcPort }} +{{- end }} diff --git a/k8s/charts/management-service/values.yaml b/k8s/charts/management-service/values.yaml index 3d16a52..00ee3c5 100644 --- a/k8s/charts/management-service/values.yaml +++ b/k8s/charts/management-service/values.yaml @@ -36,3 +36,9 @@ ingress: clusterIssuer: homelab-ca host: kmsvc.homelab.internal tlsSecretName: kmsvc-tls + # kmsvc-cli connects via gRPC directly to --server/KMSVC_SERVER (default + # kmsvc.homelab.internal:443, see kmsvc-cli's README), so raw gRPC needs an + # external path too — scoped to the gRPC service's own path prefix on the + # same host/port, rather than opening the whole host to gRPC passthrough. + grpcEnabled: true + grpcPathPrefix: /kafkamgmt.v1.QueueService/ diff --git a/k8s/helmfile.yaml.gotmpl b/k8s/helmfile.yaml.gotmpl index c854083..27e4655 100644 --- a/k8s/helmfile.yaml.gotmpl +++ b/k8s/helmfile.yaml.gotmpl @@ -1,15 +1,99 @@ environments: + default: + values: + - environments/homelab.yaml homelab: values: - environments/homelab.yaml - +--- helmDefaults: wait: true timeout: 600 -helmfiles: - - path: releases.d/00-strimzi-operator.yaml.gotmpl - - path: releases.d/01-kafka-cluster.yaml.gotmpl - - path: releases.d/02-redis.yaml.gotmpl - - path: releases.d/03-queue-crd.yaml.gotmpl - - path: releases.d/04-management-service.yaml.gotmpl +repositories: + - name: strimzi + url: https://strimzi.io/charts/ + - name: bitnami + url: https://charts.bitnami.com/bitnami + +releases: + - name: strimzi-operator + namespace: {{ .Values.namespace }} + chart: strimzi/strimzi-kafka-operator + version: 0.46.0 + values: + - watchNamespaces: ["{{ .Values.namespace }}"] + + - name: kafka-cluster + namespace: {{ .Values.namespace }} + chart: charts/kafka-cluster + needs: + - {{ .Values.namespace }}/strimzi-operator + values: + - namespace: {{ .Values.namespace }} + nodePool: + replicas: {{ .Values.kafkaCluster.nodePool.replicas }} + storage: + class: {{ .Values.kafkaCluster.nodePool.storage.class }} + sizeGi: {{ .Values.kafkaCluster.nodePool.storage.sizeGi }} + resources: + memory: {{ .Values.kafkaCluster.nodePool.resources.memory }} + cpu: {{ .Values.kafkaCluster.nodePool.resources.cpu | quote }} + + - name: kmsvc-redis + namespace: {{ .Values.namespace }} + chart: bitnami/redis + version: 20.6.0 + values: + - architecture: standalone + # Bitnami stopped publishing version-pinned tags under docker.io/bitnami + # (only `latest` remains there); bitnamilegacy/* mirrors the old + # versioned tags for free, so pin there instead of floating on `latest`. + # The chart's container-image allowlist check doesn't know about the + # legacy mirror, hence allowInsecureImages. + global: + security: + allowInsecureImages: true + image: + repository: bitnamilegacy/redis + auth: + enabled: false + master: + persistence: + enabled: true + storageClass: {{ .Values.redis.storageClass }} + size: 2Gi + resources: + limits: + memory: {{ .Values.redis.memoryLimit }} + requests: + memory: {{ .Values.redis.memoryLimit }} + + - name: queue-crd + namespace: {{ .Values.namespace }} + chart: charts/queue-crd + needs: + - {{ .Values.namespace }}/kafka-cluster + - {{ .Values.namespace }}/kmsvc-redis + values: + - namespace: {{ .Values.namespace }} + kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092" + redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379" + + - name: management-service + namespace: {{ .Values.namespace }} + chart: charts/management-service + needs: + - {{ .Values.namespace }}/kafka-cluster + - {{ .Values.namespace }}/kmsvc-redis + values: + - namespace: {{ .Values.namespace }} + env: + kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092" + redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379" + authentikIssuerURL: {{ .Values.managementService.authentikIssuerURL | quote }} + authentikAudience: {{ .Values.managementService.authentikAudience | quote }} + ingress: + enabled: true + host: {{ .Values.managementService.ingress.host | quote }} + clusterIssuer: {{ .Values.managementService.ingress.clusterIssuer | quote }} diff --git a/k8s/releases.d/00-strimzi-operator.yaml.gotmpl b/k8s/releases.d/00-strimzi-operator.yaml.gotmpl deleted file mode 100644 index f4c4051..0000000 --- a/k8s/releases.d/00-strimzi-operator.yaml.gotmpl +++ /dev/null @@ -1,16 +0,0 @@ -environments: - homelab: - values: - - ../environments/homelab.yaml ---- -repositories: - - name: strimzi - url: https://strimzi.io/charts/ - -releases: - - name: strimzi-operator - namespace: {{ .Values.namespace }} - chart: strimzi/strimzi-kafka-operator - version: 0.46.0 - values: - - watchNamespaces: ["{{ .Values.namespace }}"] diff --git a/k8s/releases.d/01-kafka-cluster.yaml.gotmpl b/k8s/releases.d/01-kafka-cluster.yaml.gotmpl deleted file mode 100644 index d1d99d3..0000000 --- a/k8s/releases.d/01-kafka-cluster.yaml.gotmpl +++ /dev/null @@ -1,21 +0,0 @@ -environments: - homelab: - values: - - ../environments/homelab.yaml ---- -releases: - - name: kafka-cluster - namespace: {{ .Values.namespace }} - chart: ../charts/kafka-cluster - needs: - - {{ .Values.namespace }}/strimzi-operator - values: - - namespace: {{ .Values.namespace }} - nodePool: - replicas: {{ .Values.kafkaCluster.nodePool.replicas }} - storage: - class: {{ .Values.kafkaCluster.nodePool.storage.class }} - sizeGi: {{ .Values.kafkaCluster.nodePool.storage.sizeGi }} - resources: - memory: {{ .Values.kafkaCluster.nodePool.resources.memory }} - cpu: {{ .Values.kafkaCluster.nodePool.resources.cpu | quote }} diff --git a/k8s/releases.d/02-redis.yaml.gotmpl b/k8s/releases.d/02-redis.yaml.gotmpl deleted file mode 100644 index 9081f50..0000000 --- a/k8s/releases.d/02-redis.yaml.gotmpl +++ /dev/null @@ -1,28 +0,0 @@ -environments: - homelab: - values: - - ../environments/homelab.yaml ---- -repositories: - - name: bitnami - url: https://charts.bitnami.com/bitnami - -releases: - - name: kmsvc-redis - namespace: {{ .Values.namespace }} - chart: bitnami/redis - version: 20.6.0 - values: - - architecture: standalone - auth: - enabled: false - master: - persistence: - enabled: true - storageClass: {{ .Values.redis.storageClass }} - size: 2Gi - resources: - limits: - memory: {{ .Values.redis.memoryLimit }} - requests: - memory: {{ .Values.redis.memoryLimit }} diff --git a/k8s/releases.d/03-queue-crd.yaml.gotmpl b/k8s/releases.d/03-queue-crd.yaml.gotmpl deleted file mode 100644 index 0bd0ed6..0000000 --- a/k8s/releases.d/03-queue-crd.yaml.gotmpl +++ /dev/null @@ -1,16 +0,0 @@ -environments: - homelab: - values: - - ../environments/homelab.yaml ---- -releases: - - name: queue-crd - namespace: {{ .Values.namespace }} - chart: ../charts/queue-crd - needs: - - {{ .Values.namespace }}/kafka-cluster - - {{ .Values.namespace }}/kmsvc-redis - values: - - namespace: {{ .Values.namespace }} - kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092" - redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379" diff --git a/k8s/releases.d/04-management-service.yaml.gotmpl b/k8s/releases.d/04-management-service.yaml.gotmpl deleted file mode 100644 index 7cc3bee..0000000 --- a/k8s/releases.d/04-management-service.yaml.gotmpl +++ /dev/null @@ -1,23 +0,0 @@ -environments: - homelab: - values: - - ../environments/homelab.yaml ---- -releases: - - name: management-service - namespace: {{ .Values.namespace }} - chart: ../charts/management-service - needs: - - {{ .Values.namespace }}/kafka-cluster - - {{ .Values.namespace }}/kmsvc-redis - values: - - namespace: {{ .Values.namespace }} - env: - kafkaBrokers: "kmsvc-kafka-bootstrap.{{ .Values.namespace }}.svc.cluster.local:9092" - redisAddr: "kmsvc-redis-master.{{ .Values.namespace }}.svc.cluster.local:6379" - authentikIssuerURL: {{ .Values.managementService.authentikIssuerURL | quote }} - authentikAudience: {{ .Values.managementService.authentikAudience | quote }} - ingress: - enabled: true - host: {{ .Values.managementService.ingress.host | quote }} - clusterIssuer: {{ .Values.managementService.ingress.clusterIssuer | quote }}