Provide a helm chart for kubernetes deployments (#870)

.gitignore

@@ -21,7 +21,7 @@ yarn-error.log
 !.env.docker.production
 !.env.sqlite.production
 !.env.example
+!.env.k8s
 .phpunit.result.cache
 _ide_helper.php
 _ide_helper_models.php
-linkace

app/Http/Middleware/SetupCheckMiddleware.php

@@ -33,6 +33,10 @@ public function handle(Request $request, Closure $next): mixed
 
         $setupCompleted = setupCompleted();
 
+        if ($request->is('_health')) {
+            return $next($request);
+        }
+
         if ($request->is('setup/*')) {
             if ($setupCompleted) {
                 // Do not allow access to the setup after it was completed

deploy/README.md

@@ -0,0 +1,87 @@
+# LinkAce Helm Chart (BETA)
+
+This Helm chart can be used to deploy LinkAce to your Kubernetes cluster. Please note that this chart deploys the
+full application stack by default, including a MariaDB database and Redis for caching. It is possible to use an existing
+database or Redis. Please see the values.yml file for details.
+
+This Helm Chart is currently a beta version. Please give feedback if you are using it.
+
+
+## Overview
+
+The following resources will be created during the deployment of LinkAce:
+
+- Deployment for LinkAce itself including
+  - a Service
+  - an Ingress
+  - a Secret for the configuration and passwords
+  - PersistentVolumeClaim for both logs and backups
+  - a cronjob which runs every minute to properly execute scheduled commands
+  - if autoscaling is enabled
+    - a HorizontalPodAutoscaler for the LinkAce container
+- if MariaDB and Redis
+  - an additional Deployment including MariaDB and Redis
+  - Services for both applications
+  - PersistentVolumeClaim for both applications
+
+
+## Requirements
+
+- a working Kubernetes cluster
+- `kubectl` installed and configured to access your cluster
+- `helm` installed
+
+
+## Deployment
+
+### Prepare the environment variables
+
+To be able to correctly use LinkAce you have to adjust some parts of the configuration **before** the deployment. 
+Please open the `.env.k8s` file and do the following adjustments: 
+
+- Please run `docker run --rm linkace/linkace php artisan key:generate --show` and set the output as the `APP_KEY` variable.
+- Change the database password at `DB_PASSWORD` from the current value to something unique and secure.
+- Change the redis password at `REDIS_PASSWORD` from the current value to something unique and secure.
+- Configure sending emails from LinkAce by adjusting the settings starting with `MAIL`. 
+
+LinkAce stores the configuration from the .env.k8s file as a Secret in Kubernetes, as there is sensible data which should
+not be exposed as regular environment variables.
+
+### Adjust the Kubernetes deployment configuration (optional)
+
+You may change certain settings of the deployment such as the allowed resources, volume sizes or database version used.
+Depending on the type of changes you want to do, you may either
+- pass specific options directly to helm with
+  ```
+  helm upgrade linkace ./linkace --set database.volumeSize=2Gi
+  ```
+- or change the values directly in the `values.yml`.
+
+> Please be advised that enabling autoscaling must NOT be turned on if you have either the database or redis enabled! 
+
+### Deploy the application for the first time
+
+```bash
+cd deploy
+helm install linkace ./linkace
+```
+
+To deploy LinkAce without a database and Redis, use this command:
+
+```bash
+helm install linkace ./linkace  --set database.enabled=false --set redis.enabled=false
+```
+
+### Update an existing LinkAce deployment
+
+```bash
+cd deploy
+helm upgrade linkace ./linkace
+```
+
+### Remove an existing LinkAce deployment
+
+```bash
+cd deploy
+helm uninstall linkace
+```

deploy/linkace/.env.k8s

@@ -0,0 +1,25 @@
+APP_KEY=someRandomStringWith32Characters
+
+DB_CONNECTION=mysql
+DB_HOST=linkace-mariadb
+DB_PORT=3306
+DB_DATABASE=linkace
+DB_USERNAME=linkace
+DB_PASSWORD=ChangeThisToASecurePassword!
+
+REDIS_HOST=linkace-redis
+REDIS_PASSWORD=ChangeThisToASecurePassword!
+REDIS_PORT=6379
+
+[email protected]
+MAIL_FROM_NAME=LinkAce
+MAIL_DRIVER=smtp
+MAIL_HOST=smtp.mailtrap.io
+MAIL_PORT=2525
+MAIL_USERNAME=null
+MAIL_PASSWORD=null
+MAIL_ENCRYPTION=null
+
+BACKUP_ENABLED=true
+SESSION_DRIVER=redis
+CACHE_DRIVER=redis

deploy/linkace/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

deploy/linkace/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: linkace
+description: A Helm chart for deploying LinkAce to Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 1.0.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "2.0.0"

deploy/linkace/templates/NOTES.txt

@@ -0,0 +1,20 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.paths }}
+http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $.Values.ingress.host }}{{ .path }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "linkace.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "linkace.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "linkace.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "linkace.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

deploy/linkace/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "linkace.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "linkace.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "linkace.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "linkace.labels" -}}
+helm.sh/chart: {{ include "linkace.chart" . }}
+{{ include "linkace.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "linkace.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "linkace.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "linkace.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "linkace.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

deploy/linkace/templates/cronjob.yaml

@@ -0,0 +1,30 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ include "linkace.fullname" . }}-cronjob
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure
+          volumes:
+            - name: {{ .Release.Name }}-app-logs
+              persistentVolumeClaim:
+                claimName: {{ .Release.Name }}-app-logs-pvc
+            - name: {{ .Release.Name }}-app-backups
+              persistentVolumeClaim:
+                claimName: {{ .Release.Name }}-app-backups-pvc
+          containers:
+            - name: {{ .Release.Name }}-cron
+              image: "{{ .Values.linkace.repository }}:{{ .Values.linkace.tag }}"
+              command: ["php", "artisan", "schedule:run"]
+              envFrom:
+                - secretRef:
+                    name: {{ .Release.Name }}-env
+              volumeMounts:
+                - name: {{ .Release.Name }}-app-logs
+                  mountPath: "/app/storage/logs"
+                - name: {{ .Release.Name }}-app-backups
+                  mountPath: "/app/storage/app/backups/LinkAce"