maint: add helm scripts

.github/workflows/deploy-helm.yml

@@ -0,0 +1,39 @@
+name: Trigger deploy with helm
+on:
+  workflow_call:
+
+    inputs:
+      DEPLOYMENT_NAME:
+        required: true
+        type: string
+      IMAGE_TAG:
+        required: true
+        type: string
+
+    secrets:
+      KUBECONFIG:
+        required: true
+
+env:
+  path_to_helm: .helm/voluba-prod
+  INGRESS_HOST: '[{ "host": "voluba-staging.apps.tc.humanbrainproject.eu", "paths": [{ "path": "/", "pathType": "Prefix" }] }]'
+  TLS: '[{ "secretName": "voluba-rc-tc-secret", "hosts": ["voluba-staging.apps.tc.humanbrainproject.eu"] }]'
+  ENV_HOSTNAME: 'https://voluba-staging.apps.tc.humanbrainproject.eu'
+
+jobs:
+  trigger-deploy:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: 'Deploy'
+      run: |
+        kubecfg_path=${{ runner.temp }}/.kube_config
+        echo "${{ secrets.KUBECONFIG }}" > $kubecfg_path
+
+        helm --kubeconfig=$kubecfg_path \
+          upgrade \
+          --reuse-values \
+          --set image.tag=${{ inputs.IMAGE_TAG }} \
+          ${{ inputs.DEPLOYMENT_NAME }} ${{ env.path_to_helm }}
+
+        rm $kubecfg_path

.github/workflows/dockerimg.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - master
-      - mvp_nehubaUpdated
       - staging
 
     # do not rebuild if...
@@ -14,24 +13,23 @@ on:
 
 env:
   OKD_URL: https://okd.hbp.eu:443
-
 jobs:
   build-docker-img:
     runs-on: ubuntu-latest
-
+    env:
+      DOCKERIMG: voluba
+    outputs:
+      VERSION: ${{ steps.setting-vars.outputs.VERSION }}
     steps:
-    - uses: actions/checkout@v2
-    - name: 'Setup envvar'
+    - uses: actions/checkout@v4
+    - name: 'Setup tags'
       run: |
         if [[ $GITHUB_REF == 'refs/heads/master' ]]; then
             echo "DOCKERIMG=voluba:latest" >> "$GITHUB_ENV"
         fi
         if [[ $GITHUB_REF == 'refs/heads/staging' ]]; then
             echo "DOCKERIMG=voluba:staging" >> "$GITHUB_ENV"
         fi
-        if [[ $GITHUB_REF == 'refs/heads/mvp_nehubaUpdated' ]]; then
-            echo "DOCKERIMG=voluba:mvp_nehubaUpdated" >> "$GITHUB_ENV"
-        fi
     - name: 'Setup tags'
       run: |
         if [[ -z "$DOCKERIMG" ]]
@@ -48,14 +46,16 @@ jobs:
         echo "MATOMO_ID=${{ secrets.MATOMO_ID_PROD }}" >> $GITHUB_ENV
 
     - name: 'Set version variable & expmt feature flag'
+      id: 'setting-vars'
       run: |
         GIT_HASH=$(git rev-parse --short HEAD)
         echo "Setting GIT_HASH: $GIT_HASH"
-        echo "GIT_HASH=$GIT_HASH" >> $GITHUB_ENV
+        echo "GIT_HASH=$GIT_HASH" >> $GITHUB_OUTPUT
 
-        # VERSION=$(jq -r '.version' package.json)
-        # echo "Setting VERSION: $VERSION"
-        # echo "VERSION=$VERSION" >> $GITHUB_ENV
+        VERSION=$(jq -r '.version' app/package.json)
+        echo "Setting VERSION: $VERSION"
+        echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
+        echo "VERSION=$VERSION" >> $GITHUB_ENV
 
         # VUE_APP_ENABLE_EXPERIMENTAL_FEATURES="{}"
 
@@ -79,8 +79,43 @@ jobs:
           -u '${{ secrets.EBRAINS_DOCKER_REG_USER }}' \
           -p '${{ secrets.EBRAINS_DOCKER_REG_TOKEN }}' \
           docker-registry.ebrains.eu
+        
         echo "Pushing $DOCKER_IMGSTREAM"
         docker push $DOCKER_IMGSTREAM
+    
+    - name: 'Tag and push version'
+      if: ${{ github.ref == 'refs/heads/master' }}
+      run: |
+        VERSIONED_DOCKER_IMGSTREAM=${{ secrets.EBRAINS_DOCKER_REG_VOLUBA_NSP }}/${{ env.DOCKERIMG }}:$VERSION
+        echo "Tagging and pushing $VERSIONED_DOCKER_IMGSTREAM"
+        docker tag $DOCKER_IMGSTREAM $VERSIONED_DOCKER_IMGSTREAM
+        
+        docker login \
+          -u '${{ secrets.EBRAINS_DOCKER_REG_USER }}' \
+          -p '${{ secrets.EBRAINS_DOCKER_REG_TOKEN }}' \
+          docker-registry.ebrains.eu
+        
+        docker push $VERSIONED_DOCKER_IMGSTREAM
+
+  deploy-prod-on-rancher:
+    needs: [ build-docker-img ]
+    if: ${{ github.ref == 'refs/heads/master' && success() }}
+    uses: ./.github/workflows/deploy-helm.yml
+    with:
+      DEPLOYMENT_NAME: voluba-prod
+      IMAGE_TAG: ${{ needs.build-docker-img.outputs.VERSION }}
+    secrets:
+      KUBECONFIG: ${{ secrets.KUBECONFIG }}
+
+  deploy-rc-on-rancher:
+    needs: [ build-docker-img ]
+    if: ${{ github.ref == 'refs/heads/staging' && success() }}
+    uses: ./.github/workflows/deploy-helm.yml
+    with:
+      DEPLOYMENT_NAME: voluba-rc
+      IMAGE_TAG: staging
+    secrets:
+      KUBECONFIG: ${{ secrets.KUBECONFIG }}
 
   deploy-on-okd:
     needs: [ build-docker-img ]

.gitignore

@@ -227,3 +227,5 @@ pyvenv.cfg
 pip-selfcheck.json
 
 # End of https://www.gitignore.io/api/python,pycharm
+
+secret*

.helm/adhoc/cert-rc-ebrains.yaml

@@ -0,0 +1,21 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: voluba-rc-ebrains-certificate
+spec:
+  secretName: voluba-rc-ebrains-secret
+  renewBefore: 120h 
+  commonName: voluba-staging.apps.ebrains.eu
+  isCA: false
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS1
+    size: 2048
+  usages:
+  - server auth
+  dnsNames:
+  # (CHANGE ME! same as `commonName`)
+  - voluba-staging.apps.ebrains.eu
+  issuerRef:
+    name: letsencrypt-production-issuer-1
+    kind: ClusterIssuer

.helm/adhoc/cert-rc-tc.yaml

@@ -0,0 +1,21 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: voluba-rc-tc-certificate
+spec:
+  secretName: voluba-rc-tc-secret
+  renewBefore: 120h 
+  commonName: voluba-staging.apps.tc.humanbrainproject.eu
+  isCA: false
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS1
+    size: 2048
+  usages:
+  - server auth
+  dnsNames:
+  # (CHANGE ME! same as `commonName`)
+  - voluba-staging.apps.tc.humanbrainproject.eu
+  issuerRef:
+    name: letsencrypt-production-issuer-1
+    kind: ClusterIssuer 

.helm/adhoc/certificate.yaml

@@ -0,0 +1,21 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: voluba-certificate
+spec:
+  secretName: voluba-prod-secret
+  renewBefore: 120h 
+  commonName: voluba.apps.tc.humanbrainproject.eu
+  isCA: false
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS1
+    size: 2048
+  usages:
+  - server auth
+  dnsNames:
+  # (CHANGE ME! same as `commonName`)
+  - voluba.apps.tc.humanbrainproject.eu
+  issuerRef:
+    name: letsencrypt-production-issuer-1
+    kind: ClusterIssuer 

.helm/adhoc/example-secrets-oidc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: voluba-oidc
+type: Opaque
+data:
+  EBRAINS_SA_CLIENT_ID: Zm9v
+  EBRAINS_SA_CLIENT_SECRET: Zm9v
+  HBP_V2_CLIENTID: Zm9v
+  HBP_V2_CLIENTSECRET: Zm9v
+  ORCID_CLIENTID: Zm9v
+  ORCID_CLIENTSECRET: Zm9v

.helm/voluba-prod/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

.helm/voluba-prod/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: voluba-prod
+description: A Helm chart for Kubernetes Voluba
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.1
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.1.1"

.helm/voluba-prod/templates/NOTES.txt

@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "voluba-prod.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "voluba-prod.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "voluba-prod.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "voluba-prod.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

.helm/voluba-prod/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "voluba-prod.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "voluba-prod.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "voluba-prod.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "voluba-prod.labels" -}}
+helm.sh/chart: {{ include "voluba-prod.chart" . }}
+{{ include "voluba-prod.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "voluba-prod.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "voluba-prod.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "voluba-prod.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "voluba-prod.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}