cyberchef: add initial chart

charts/cyberchef/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/cyberchef/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+name: cyberchef
+version: 1.0.0

charts/cyberchef/README.md

@@ -0,0 +1,16 @@
+# Cyberchef
+
+## How to use
+
+Add repository by running:
+
+```bash
+helm repo add k8s-at-our-home https://k8s-at-our-homes.github.io/helm-charts/
+helm install infro k8s-at-our-home/cyberchef
+```
+
+Or get the chart from ghcr.io:
+
+```bash
+helm install infro oci://ghcr.io/k8s-at-our-homes/helm-charts/cyberchef
+```

charts/cyberchef/templates/_helpers.tpl

@@ -0,0 +1,31 @@
+{{- define "common.name" -}}
+{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "common.fullname" -}}
+{{- if contains .Chart.Name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "chartName" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "common.selectorLabels" -}}
+app.kubernetes.io/name: {{ template "common.name" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: "cyberchef
+{{- end -}}
+
+{{- define "common.labels" -}}
+app.kubernetes.io/name: {{ template "common.name" . }}
+helm.sh/chart: {{ include "chartName" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Values.image.tag | quote }}
+app.kubernetes.io/part-of: "cyberchef"
+{{- end -}}

charts/cyberchef/templates/deployment.yaml

@@ -0,0 +1,29 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "common.fullname" . }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}
+spec:
+  revisionHistoryLimit: 0
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      {{- include "common.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "common.selectorLabels" . | nindent 8 }}
+    spec:
+      nodeSelector: {{ .Values.nodeSelector | toYaml | nindent 8 }}
+      securityContext: {{ toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: core
+          image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          resources: {{ toYaml .Values.resources | nindent 12 }}
+          securityContext: {{ toYaml .Values.securityContext | nindent 12 }}

charts/cyberchef/templates/ingress.yaml

@@ -0,0 +1,28 @@
+{{ if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ template "common.fullname" . }}
+  annotations: {{ toYaml .Values.ingress.annotations | nindent 4 }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}
+spec:
+  ingressClassName: {{ .Values.ingress.class }}
+  rules:
+    - host: {{ .Values.ingress.domain }}
+      http:
+        paths:
+          - backend:
+              service:
+                name: {{ template "common.fullname" . }}
+                port:
+                  number: 8080
+            path: /
+            pathType: Prefix
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.domain }}
+      secretName: {{ .Values.ingress.tls.secretName }}
+  {{- end }}
+{{ end }}

charts/cyberchef/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "common.fullname" . }}
+  labels:
+    {{- include "common.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      targetPort: 8080
+      port: 8080
+      protocol: TCP
+  selector:
+    {{- include "common.selectorLabels" . | nindent 4 }}

charts/cyberchef/values.yaml

@@ -0,0 +1,38 @@
+replicas: 1
+
+nodeSelector: {}
+
+resources: {}
+#  requests:
+#    memory: 512Mi
+#    cpu: 100m
+#  limits:
+#    memory: 2048Mi
+
+podSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+  fsGroup: 1000
+  runAsNonRoot: true
+
+securityContext:
+  capabilities:
+    drop: [ "ALL" ]
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  privileged: false
+
+image:
+  registry: ghcr.io
+  repository: gchq/cyberchef
+  tag: 10.18.9
+  pullPolicy: IfNotPresent
+
+ingress:
+  enabled: true
+  domain: cyberchef.example.com
+  class:
+  annotations: {}
+  tls:
+    enabled: true
+    secretName: