diff --git a/.DS_Store b/.DS_Store
new file mode 100644
index 000000000..592738679
Binary files /dev/null and b/.DS_Store differ
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
new file mode 100644
index 000000000..f3d5c415e
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: bug
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.
diff --git a/.github/ISSUE_TEMPLATE/epic-template.md b/.github/ISSUE_TEMPLATE/epic-template.md
new file mode 100644
index 000000000..3f7506062
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/epic-template.md
@@ -0,0 +1,29 @@
+---
+name: Epic Template
+about: For high-level, related sets of features and journeys.
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+## Problem
+What problem are we solving with? Is this epic part of the planned features [here](https://github.com/near/near-wallet-roadmap/projects/1), and which ones?
+
+## How did we discover this problem?
+How did this problem originate? If it was revealed through user feedback, how was that feedback received and from whom?
+
+## Job Story(s)
+- What are the [job stories](https://thoughtbot.com/blog/converting-to-jobs-stories) that frame the users' context, motivations and goals?
+- Template: When I [situation], I want to [motivation] so I can [outcome/benefit].
+
+## What are we planning to do about it?
+- What is the scope of the design and engineering work required for this project?
+Along the way, this epic will be linked with issues and pull requests
+
+## What are we not planning to do about it?
+- What items have been considered but may fall out of the scope of design and engineering work for this project?
+Sometimes the scope is too large, and this section may lead other epics, other features [here](https://github.com/near/near-wallet-roadmap/projects/1) or even other products
+
+## How will we measure success?
+- Are there a set of quantifiable metrics that we can surface once the work has been completed in order to determine how successful our solution was?
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
new file mode 100644
index 000000000..11fc491ef
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: enhancement
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.
diff --git a/.github/ISSUE_TEMPLATE/user-story-template.md b/.github/ISSUE_TEMPLATE/user-story-template.md
new file mode 100644
index 000000000..3aea4c4c7
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/user-story-template.md
@@ -0,0 +1,26 @@
+---
+name: User Story Template
+about: This template provides a basic structure for user stories.
+title: "Broad Set Template"
+labels: user-story
+assignees: ''
+
+---
+
+# User story
+Role: As a ....
+Ability: I want...
+Rationale: so that I can...
+
+*Add links to PRDs where applicable*
+
+# Acceptance criteria
+
+- [ ] This is something that can be verified to show that this user story is satisfied.
+
+# Sprint Ready Checklist
+1. - [ ] Acceptance criteria defined
+2. - [ ] Team understands acceptance criteria
+3. - [ ] Team has defined solution / steps to satisfy acceptance criteria
+4. - [ ] Acceptance criteria is verifiable / testable
+5. - [ ] External / 3rd Party dependencies identified
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 000000000..19efcc9ce
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,336 @@
+name: Build Pipeline
+run-name: Build ${{ github.event.inputs.pipeline_name }}
+
+on:
+ workflow_dispatch:
+ inputs:
+ pipeline_name:
+ description: "Name of the config pipeline to build and deploy"
+ required: true
+ type: choice
+ options:
+ - pgr-services
+ - default-data-handler
+ - digit-ui
+
+env:
+ DOCKER_USERNAME: ${{ vars.DOCKER_USERNAME }}
+ DOCKER_PASSWORD: ${{ secrets.DOCKER_ACCESS_TOKEN }}
+
+jobs:
+ resolve-config:
+ name: Resolve ${{ github.event.inputs.pipeline_name }} config
+ runs-on: ubuntu-latest
+ outputs:
+ service_work_dir: ${{ steps.setenv.outputs.SERVICE_WORK_DIR }}
+ service_image_name: ${{ steps.setenv.outputs.SERVICE_IMAGE_NAME }}
+ service_dockerfile: ${{ steps.setenv.outputs.SERVICE_DOCKERFILE }}
+ db_folder_exists: ${{ steps.check-db-folder.outputs.folder_exists }}
+ db_work_dir: ${{ steps.setenv.outputs.DB_WORK_DIR }}
+ db_image_name: ${{ steps.setenv.outputs.DB_IMAGE_NAME }}
+ db_dockerfile: ${{ steps.setenv.outputs.DB_DOCKERFILE }}
+ tag: ${{ steps.tag.outputs.tag }}
+ steps:
+ - name: Checkout Code
+ uses: actions/checkout@v3
+
+ - name: Install yq
+ run: |
+ VERSION="4.30.8"
+ URL="https://github.com/mikefarah/yq/releases/download/v${VERSION}/yq_linux_amd64"
+ sudo curl -sSL "$URL" -o /usr/local/bin/yq
+ sudo chmod +x /usr/local/bin/yq
+
+ - name: Resolve env from build-config.yml
+ id: setenv
+ run: |
+ PIPELINE_NAME="${{ github.event.inputs.pipeline_name }}"
+ DEFAULT_DOCKERFILE="Dockerfile"
+ echo "### Pipeline Name - $PIPELINE_NAME" >> $GITHUB_STEP_SUMMARY
+
+ # Step 1: List matching config blocks
+ MATCHING_CONFIGS=$(yq eval -o=json '.config[] | select(.name | test("/'"$PIPELINE_NAME"'$"))' build/build-config.yml)
+
+ # Step 2: Show matched config(s)
+ echo "Matching config(s) for pipeline '$PIPELINE_NAME':"
+ echo "$MATCHING_CONFIGS" | yq eval -P - # pretty-print for readability
+
+ # Step 3: Check count of matching configs
+ MATCH_COUNT=$(echo "$MATCHING_CONFIGS" | yq eval -o=json '.' - | jq -s 'length')
+
+ if [ "$MATCH_COUNT" -ne 1 ]; then
+ echo "ERROR: Expected exactly 1 matching pipeline config, but found $MATCH_COUNT"
+ exit 1
+ fi
+
+ # Step 4: Extract service build config (image-name not ending with -db)
+ SERVICE_BUILD_CONFIG=$(yq eval -o=json '
+ .config[]
+ | select(.name | test("/'"$PIPELINE_NAME"'$"))
+ | .build[]
+ | select(.["image-name"] | test("-db$") | not)
+ ' build/build-config.yml)
+
+ # Step 5: Extract db build config (image-name ending with -db)
+ DB_BUILD_CONFIG=$(yq eval -o=json '
+ .config[]
+ | select(.name | test("/'"$PIPELINE_NAME"'$"))
+ | .build[]
+ | select(.["image-name"] | test("-db$"))
+ ' build/build-config.yml)
+
+ # Step 6: Print for confirmation
+ echo "SERVICE_BUILD_CONFIG: $SERVICE_BUILD_CONFIG"
+ echo "DB_BUILD_CONFIG: $DB_BUILD_CONFIG"
+
+ # Step 7: Extract Required Environment Variables
+ SERVICE_DOCKERFILE=$(echo "$SERVICE_BUILD_CONFIG" | yq eval -r '.dockerfile // ""' -)
+ SERVICE_IMAGE_NAME=$(echo "$SERVICE_BUILD_CONFIG" | yq eval -r '.["image-name"] // ""' -)
+ SERVICE_WORK_DIR=$(echo "$SERVICE_BUILD_CONFIG" | yq eval -r '.["work-dir"] // ""' -)
+
+ DB_IMAGE_NAME=$(echo "$DB_BUILD_CONFIG" | yq eval -r '.["image-name"] // ""' -)
+ DB_WORK_DIR=$(echo "$DB_BUILD_CONFIG" | yq eval -r '.["work-dir"] // ""' -)
+ DB_DOCKERFILE=$(echo "$DB_BUILD_CONFIG" | yq eval -r '.["work-dir"] // ""' -)/Dockerfile
+
+ # Step 8: Set Default Dockerfile if service dockerfile config is missing
+ if [ -z "$SERVICE_DOCKERFILE" ]; then
+ echo "No dockerfile entry found for \"$PIPELINE_NAME\" in build-config.yml; using default"
+ SERVICE_DOCKERFILE="$SERVICE_WORK_DIR/$DEFAULT_DOCKERFILE"
+ fi
+
+ # Step 9: Export to github environment
+ echo "SERVICE_WORK_DIR=$SERVICE_WORK_DIR" >> "$GITHUB_OUTPUT"
+ echo "SERVICE_IMAGE_NAME=$SERVICE_IMAGE_NAME" >> "$GITHUB_OUTPUT"
+ echo "SERVICE_DOCKERFILE=$SERVICE_DOCKERFILE" >> "$GITHUB_OUTPUT"
+ echo "DB_WORK_DIR=$DB_WORK_DIR" >> "$GITHUB_OUTPUT"
+ echo "DB_IMAGE_NAME=$DB_IMAGE_NAME" >> "$GITHUB_OUTPUT"
+ echo "DB_DOCKERFILE=$DB_DOCKERFILE" >> "$GITHUB_OUTPUT"
+ missing_vars=()
+
+ # Step 10: Check if required env variables exists
+ for var in SERVICE_WORK_DIR SERVICE_IMAGE_NAME SERVICE_DOCKERFILE; do
+ if [ -z "${!var}" ]; then
+ echo "ERROR: $var is not set or is empty"
+ missing_vars+=("$var")
+ fi
+ done
+
+ if [ ${#missing_vars[@]} -gt 0 ]; then
+ echo "Required environment variables are missing: ${missing_vars[*]}"
+ exit 1 # Fail the step
+ fi
+
+ # Step 11. Put summary for the step
+ echo "#### Application Config Summary" >> $GITHUB_STEP_SUMMARY
+ echo "Application Work Directory - $SERVICE_WORK_DIR" >> $GITHUB_STEP_SUMMARY
+ echo "Image Name - $SERVICE_IMAGE_NAME" >> $GITHUB_STEP_SUMMARY
+ echo "Dockerfile Path - $SERVICE_DOCKERFILE" >> $GITHUB_STEP_SUMMARY
+
+ echo "#### DB Config Summary" >> $GITHUB_STEP_SUMMARY
+ echo "Application Work Directory - $DB_WORK_DIR" >> $GITHUB_STEP_SUMMARY
+ echo "Image Name - $DB_IMAGE_NAME" >> $GITHUB_STEP_SUMMARY
+ echo "Dockerfile Path - $DB_DOCKERFILE" >> $GITHUB_STEP_SUMMARY
+
+ - name: Check if DB folder exists
+ id: check-db-folder
+ run: |
+ FOLDER_PATH="${{ steps.setenv.outputs.DB_WORK_DIR }}"
+ if [ -d "$FOLDER_PATH" ]; then
+ echo "folder_exists=true" >> "$GITHUB_OUTPUT"
+ else
+ echo "folder_exists=false" >> "$GITHUB_OUTPUT"
+ fi
+ - name: Generate the Next Tag
+ id: tag
+ run: |
+ set -euxo pipefail
+ BRANCH="${GITHUB_REF##*/}"
+ COMMIT_HASH=$(git rev-parse --short HEAD)
+ SERVICE_NAME="${{ steps.setenv.outputs.SERVICE_IMAGE_NAME }}"
+
+ TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
+ -H "Content-Type: application/json" \
+ -d "{\"username\": \"$DOCKER_USERNAME\", \"password\": \"$DOCKER_PASSWORD\"}" \
+ | jq -r .token)
+
+ if [ -z "$TOKEN" ]; then
+ echo "Failed to authenticate with Docker Hub." >&2
+ exit 1
+ fi
+
+ # Check if repo exists
+ HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' \
+ -H "Authorization: JWT $TOKEN" \
+ "https://hub.docker.com/v2/repositories/$DOCKER_USERNAME/$SERVICE_NAME/")
+
+ if [ "$HTTP_CODE" -ne 200 ]; then
+ NEXT_TAG="${BRANCH}-${COMMIT_HASH}"
+ else
+ EXISTING_TAGS=$(curl -s -H "Authorization: JWT $TOKEN" \
+ "https://hub.docker.com/v2/repositories/$DOCKER_USERNAME/$SERVICE_NAME/tags?page_size=100" \
+ | jq -r '.results[].name')
+ LATEST_TAG=$(echo "$EXISTING_TAGS" \
+ | grep "^${BRANCH}-${COMMIT_HASH}" || true \
+ | sort -V \
+ | tail -n 1)
+ NEXT_TAG="${LATEST_TAG:-${BRANCH}-${COMMIT_HASH}}"
+ fi
+
+ echo "tag=$NEXT_TAG" >> "$GITHUB_OUTPUT"
+ echo "NEXT_TAG=$NEXT_TAG" >> "$GITHUB_ENV"
+ echo "tag - $NEXT_TAG" >> $GITHUB_STEP_SUMMARY
+
+ build-matrix:
+ name: Build image for ${{ matrix.arch }}
+ needs: resolve-config
+ strategy:
+ matrix:
+ include:
+ - arch: amd64
+ platform: linux/amd64
+ runner: ubuntu-latest
+ - arch: arm64
+ platform: linux/arm64
+ runner: ubuntu-24.04-arm
+ runs-on: ${{ matrix.runner }}
+ outputs:
+ amd64_digest: ${{ steps.digest_amd64.outputs.digest }}
+ amd64_digest_db: ${{ steps.digest_db_amd64.outputs.digest }}
+ arm64_digest: ${{ steps.digest_arm64.outputs.digest }}
+ arm64_digest_db: ${{ steps.digest_db_arm64.outputs.digest }}
+ steps:
+ - name: Checkout Code
+ uses: actions/checkout@v3
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Cache Docker Layers
+ uses: actions/cache@v3
+ with:
+ path: /tmp/.buildx-cache
+ key: ${{ runner.os }}-${{ matrix.arch }}-buildx-${{ github.event.inputs.pipeline_name }}-${{ github.ref_name }}
+ restore-keys: |
+ ${{ runner.os }}-${{ matrix.arch }}-buildx-${{ github.event.inputs.pipeline_name }}-
+
+ - name: Docker Login
+ uses: docker/login-action@v2
+ with:
+ username: ${{ env.DOCKER_USERNAME }}
+ password: ${{ env.DOCKER_PASSWORD }}
+
+ - name: Build and Push Application Image
+ run: |
+ docker buildx build \
+ --platform ${{ matrix.platform }} \
+ --build-arg WORK_DIR=${{ needs.resolve-config.outputs.service_work_dir }} \
+ --file ${{ needs.resolve-config.outputs.service_dockerfile }} \
+ --tag egovio/${{ needs.resolve-config.outputs.service_image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }} \
+ --cache-from=type=local,src=/tmp/.buildx-cache \
+ --cache-to=type=local,dest=/tmp/.buildx-cache,mode=max \
+ --push \
+ --iidfile digest.txt \
+ .
+
+ - name: Build and Push DB Image
+ if: ${{ needs.resolve-config.outputs.db_folder_exists == 'true' }}
+ run: |
+ docker buildx build \
+ --platform ${{ matrix.platform }} \
+ --build-arg WORK_DIR=${{ needs.resolve-config.outputs.db_work_dir }} \
+ --file ${{ needs.resolve-config.outputs.db_dockerfile }} \
+ --tag egovio/${{ needs.resolve-config.outputs.db_image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }} \
+ --cache-from=type=local,src=/tmp/.buildx-cache \
+ --cache-to=type=local,dest=/tmp/.buildx-cache,mode=max \
+ --push \
+ --iidfile db-digest.txt \
+ ${{ needs.resolve-config.outputs.db_work_dir }}
+
+ - name: Inspect Service Image Manifest List
+ run: |
+ docker buildx imagetools inspect egovio/${{ needs.resolve-config.outputs.service_image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }}
+ - name: Inspect DB Image Manifest List
+ if: ${{ needs.resolve-config.outputs.db_folder_exists == 'true' }}
+ run: |
+ docker buildx imagetools inspect egovio/${{ needs.resolve-config.outputs.db_image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }}
+
+ - name: Export Digest Service (amd64)
+ if: matrix.arch == 'amd64'
+ id: digest_amd64
+ run: |
+ digest=$(docker buildx imagetools inspect egovio/${{ needs.resolve-config.outputs.service_image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }} \
+ --format '{{json .}}' | jq -r '.manifest.manifests[] | select(.platform.architecture=="${{ matrix.arch }}") | .digest')
+ echo "digest=$digest" >> $GITHUB_OUTPUT
+
+ - name: Export Digest Service (arm64)
+ if: matrix.arch == 'arm64'
+ id: digest_arm64
+ run: |
+ digest=$(docker buildx imagetools inspect egovio/${{ needs.resolve-config.outputs.service_image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }} \
+ --format '{{json .}}' | jq -r '.manifest.manifests[] | select(.platform.architecture=="${{ matrix.arch }}") | .digest')
+ echo "digest=$digest" >> $GITHUB_OUTPUT
+
+ - name: Export Digest DB (amd64)
+ if: matrix.arch == 'amd64' && needs.resolve-config.outputs.db_folder_exists == 'true'
+ id: digest_db_amd64
+ run: |
+ digest=$(docker buildx imagetools inspect egovio/${{ needs.resolve-config.outputs.db_image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }} \
+ --format '{{json .}}' | jq -r '.manifest.manifests[] | select(.platform.architecture=="${{ matrix.arch }}") | .digest')
+ echo "digest=$digest" >> $GITHUB_OUTPUT
+
+ - name: Export Digest DB (arm64)
+ if: matrix.arch == 'arm64' && needs.resolve-config.outputs.db_folder_exists == 'true'
+ id: digest_db_arm64
+ run: |
+ digest=$(docker buildx imagetools inspect egovio/${{ needs.resolve-config.outputs.db_image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }} \
+ --format '{{json .}}' | jq -r '.manifest.manifests[] | select(.platform.architecture=="${{ matrix.arch }}") | .digest')
+ echo "digest=$digest" >> $GITHUB_OUTPUT
+
+ create-manifest:
+ name: Create and Push Manifest
+ needs: [resolve-config, build-matrix]
+ runs-on: ubuntu-latest
+ steps:
+ - name: Docker Login
+ uses: docker/login-action@v2
+ with:
+ username: ${{ env.DOCKER_USERNAME }}
+ password: ${{ env.DOCKER_PASSWORD }}
+
+ - name: Create and Push Docker Manifest (Application)
+ run: |
+ docker manifest create egovio/${{ needs.resolve-config.outputs.service_image_name }}:${{ needs.resolve-config.outputs.tag }} \
+ --amend egovio/${{ needs.resolve-config.outputs.service_image_name }}@${{ needs.build-matrix.outputs.amd64_digest }} \
+ --amend egovio/${{ needs.resolve-config.outputs.service_image_name }}@${{ needs.build-matrix.outputs.arm64_digest }}
+ docker manifest push egovio/${{ needs.resolve-config.outputs.service_image_name }}:${{ needs.resolve-config.outputs.tag }}
+
+ - name: Create and Push Docker Manifest (DB)
+ if: needs.resolve-config.outputs.db_folder_exists == 'true'
+ run: |
+ docker manifest create egovio/${{ needs.resolve-config.outputs.db_image_name }}:${{ needs.resolve-config.outputs.tag }} \
+ --amend egovio/${{ needs.resolve-config.outputs.db_image_name }}@${{ needs.build-matrix.outputs.amd64_digest_db }} \
+ --amend egovio/${{ needs.resolve-config.outputs.db_image_name }}@${{ needs.build-matrix.outputs.arm64_digest_db }}
+ docker manifest push egovio/${{ needs.resolve-config.outputs.db_image_name }}:${{ needs.resolve-config.outputs.tag }}
+
+ - name: Cleanup local manifest refs (Application)
+ run: |
+ docker manifest rm egovio/${{ needs.resolve-config.outputs.service_image_name }}:${{ needs.resolve-config.outputs.tag }}-amd64 || true
+ docker manifest rm egovio/${{ needs.resolve-config.outputs.service_image_name }}:${{ needs.resolve-config.outputs.tag }}-arm64 || true
+
+ - name: Cleanup local manifest refs (DB)
+ if: needs.resolve-config.outputs.db_folder_exists == 'true'
+ run: |
+ docker manifest rm egovio/${{ needs.resolve-config.outputs.db_image_name }}:${{ needs.resolve-config.outputs.tag }}-amd64 || true
+ docker manifest rm egovio/${{ needs.resolve-config.outputs.db_image_name }}:${{ needs.resolve-config.outputs.tag }}-arm64 || true
+
+ - name: Add Summary (Application)
+ run: |
+ echo "### Application Docker Manifest Summary" >> $GITHUB_STEP_SUMMARY
+ echo "- Image: egovio/${{ needs.resolve-config.outputs.service_image_name }}:${{ needs.resolve-config.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
+ echo "- Platforms: amd64, arm64" >> $GITHUB_STEP_SUMMARY
+
+ - name: Add Summary (DB)
+ run: |
+ echo "### DB Docker Manifest Summary" >> $GITHUB_STEP_SUMMARY
+ echo "- Image: egovio/${{ needs.resolve-config.outputs.db_image_name }}:${{ needs.resolve-config.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
+ echo "- Platforms: amd64, arm64" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/dataloader-tests.yml b/.github/workflows/dataloader-tests.yml
new file mode 100644
index 000000000..66842e28f
--- /dev/null
+++ b/.github/workflows/dataloader-tests.yml
@@ -0,0 +1,107 @@
+name: DataLoader E2E Tests
+
+on:
+ push:
+ branches: [main, develop, feature/*]
+ paths:
+ - 'utilities/crs_dataloader/**'
+ pull_request:
+ branches: [main, develop]
+ paths:
+ - 'utilities/crs_dataloader/**'
+ workflow_dispatch:
+ inputs:
+ environment:
+ description: 'Target environment'
+ required: true
+ default: 'chakshu'
+ type: choice
+ options:
+ - chakshu
+ - unified-dev
+
+env:
+ PYTHON_VERSION: '3.12'
+
+jobs:
+ test-dataloader:
+ name: Run DataLoader E2E Tests
+ runs-on: ubuntu-latest
+ timeout-minutes: 45
+
+ steps:
+ - name: Checkout Code
+ uses: actions/checkout@v4
+
+ - name: Set up Python
+ uses: actions/setup-python@v5
+ with:
+ python-version: ${{ env.PYTHON_VERSION }}
+ cache: 'pip'
+ cache-dependency-path: utilities/crs_dataloader/requirements.txt
+
+ - name: Install dependencies
+ working-directory: utilities/crs_dataloader
+ run: |
+ python -m pip install --upgrade pip
+ pip install -r requirements.txt
+ pip install pytest pytest-timeout
+
+ - name: Set environment variables
+ run: |
+ # Default to chakshu environment (has MDMS v2 deployed)
+ ENV="${{ github.event.inputs.environment || 'chakshu' }}"
+
+ if [ "$ENV" = "chakshu" ]; then
+ echo "DIGIT_URL=https://chakshu-digit.egov.theflywheel.in" >> $GITHUB_ENV
+ echo "DIGIT_TENANT=statea" >> $GITHUB_ENV
+ else
+ echo "DIGIT_URL=https://unified-dev.digit.org" >> $GITHUB_ENV
+ echo "DIGIT_TENANT=statea.citya" >> $GITHUB_ENV
+ fi
+
+ - name: Run E2E Tests
+ working-directory: utilities/crs_dataloader
+ env:
+ # Public test credentials for chakshu dev environment
+ DIGIT_USERNAME: ADMIN
+ DIGIT_PASSWORD: eGov@123
+ run: |
+ echo "Testing against: $DIGIT_URL"
+ echo "Tenant: $DIGIT_TENANT"
+
+ # Run tests with timeout
+ python test_crs_loader_e2e.py
+
+ - name: Test Summary
+ if: always()
+ run: |
+ echo "### DataLoader E2E Test Results" >> $GITHUB_STEP_SUMMARY
+ echo "" >> $GITHUB_STEP_SUMMARY
+ echo "- **Environment:** ${{ env.DIGIT_URL }}" >> $GITHUB_STEP_SUMMARY
+ echo "- **Tenant:** ${{ env.DIGIT_TENANT }}" >> $GITHUB_STEP_SUMMARY
+ echo "- **Python:** ${{ env.PYTHON_VERSION }}" >> $GITHUB_STEP_SUMMARY
+
+ lint-python:
+ name: Lint Python Code
+ runs-on: ubuntu-latest
+
+ steps:
+ - name: Checkout Code
+ uses: actions/checkout@v4
+
+ - name: Set up Python
+ uses: actions/setup-python@v5
+ with:
+ python-version: ${{ env.PYTHON_VERSION }}
+
+ - name: Install linters
+ run: pip install flake8
+
+ - name: Run flake8
+ working-directory: utilities/crs_dataloader
+ run: |
+ # Stop the build if there are Python syntax errors or undefined names
+ flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics --exclude=venv
+ # Exit-zero treats all errors as warnings
+ flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --exclude=venv
diff --git a/.github/workflows/local-setup-ci.yaml b/.github/workflows/local-setup-ci.yaml
new file mode 100644
index 000000000..f1f79b5ef
--- /dev/null
+++ b/.github/workflows/local-setup-ci.yaml
@@ -0,0 +1,381 @@
+name: Local Setup CI
+
+on:
+ push:
+ branches: [main, master, feature/*]
+ paths:
+ - 'local-setup/**'
+ pull_request:
+ branches: [main, master, develop]
+ paths:
+ - 'local-setup/**'
+ workflow_dispatch:
+
+defaults:
+ run:
+ working-directory: local-setup
+
+jobs:
+ test:
+ runs-on: ubuntu-latest
+ timeout-minutes: 45
+
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+
+ - name: Free disk space
+ working-directory: .
+ run: |
+ # Remove unnecessary tools to free space
+ sudo rm -rf /usr/share/dotnet
+ sudo rm -rf /opt/ghc
+ sudo rm -rf /usr/local/share/boost
+ df -h
+
+ - name: Start services
+ run: |
+ docker compose up -d
+ echo "Waiting for services to start..."
+
+ - name: Wait for infrastructure
+ run: |
+ echo "Waiting for Postgres..."
+ timeout 120 bash -c 'until docker exec docker-postgres pg_isready -U egov; do sleep 2; done'
+
+ echo "Waiting for Redis..."
+ timeout 60 bash -c 'until docker exec digit-redis redis-cli ping; do sleep 2; done'
+
+ echo "Waiting for Redpanda..."
+ timeout 120 bash -c 'until docker exec digit-redpanda rpk cluster health; do sleep 2; done'
+
+ - name: Wait for all containers healthy
+ run: |
+ echo "Waiting for all containers to be healthy (up to 15 minutes)..."
+ # Skip containers not required for API tests
+ SKIP_REGEX="digit-ui|digit-telemetry"
+ # Wait for all services to report healthy via Docker
+ timeout 900 bash -c '
+ while true; do
+ UNHEALTHY_NAMES=$(docker compose ps --format json | jq -r "select(.Health != \"healthy\" and .Health != \"\" and .State == \"running\") | .Name" | grep -vE "digit-ui|digit-telemetry" || true)
+ UNHEALTHY=$(echo "$UNHEALTHY_NAMES" | grep -c . || true)
+ TOTAL=$(docker compose ps --format json | jq -r "select(.State == \"running\") | .Name" | grep -vE "digit-ui|digit-telemetry" | wc -l)
+ echo "Healthy containers: $((TOTAL - UNHEALTHY))/$TOTAL (skipping digit-ui, digit-telemetry)"
+ if [ "$UNHEALTHY" -gt 0 ]; then
+ echo " Waiting on: $UNHEALTHY_NAMES" | tr "\n" " "
+ echo ""
+ fi
+ if [ "$UNHEALTHY" -eq 0 ] && [ "$TOTAL" -gt 0 ]; then
+ echo "All required containers healthy!"
+ break
+ fi
+ sleep 10
+ done
+ '
+
+ - name: Wait for PGR workflow seed
+ run: |
+ echo "Waiting for pgr-workflow-seed to complete..."
+ timeout 120 bash -c '
+ while true; do
+ STATUS=$(docker compose ps -a --format json 2>/dev/null | jq -r "select(.Service == \"pgr-workflow-seed\") | .State" 2>/dev/null)
+ if [ "$STATUS" = "exited" ]; then
+ EXIT_CODE=$(docker compose ps -a --format json 2>/dev/null | jq -r "select(.Service == \"pgr-workflow-seed\") | .ExitCode" 2>/dev/null)
+ if [ "$EXIT_CODE" != "0" ]; then
+ echo "pgr-workflow-seed FAILED (exit code $EXIT_CODE)"
+ docker compose logs pgr-workflow-seed
+ exit 1
+ fi
+ echo "pgr-workflow-seed completed successfully"
+ break
+ fi
+ echo " pgr-workflow-seed status: $STATUS"
+ sleep 5
+ done
+ '
+
+ - name: Verify database data
+ run: |
+ echo "=== Verifying database data (loaded from dump) ==="
+
+ # Check schema definitions in database
+ echo "1. Checking MDMS schema definitions..."
+ SCHEMA_COUNT=$(docker exec docker-postgres psql -U egov -d egov -t -c "SELECT COUNT(*) FROM eg_mdms_schema_definition WHERE isactive = true;")
+ SCHEMA_COUNT=$(echo $SCHEMA_COUNT | tr -d ' ')
+ echo " Found $SCHEMA_COUNT active schema definitions"
+ if [ "$SCHEMA_COUNT" -lt 10 ]; then
+ echo "ERROR: Expected at least 10 schema definitions, found $SCHEMA_COUNT"
+ exit 1
+ fi
+
+ # Check MDMS data records
+ echo "2. Checking MDMS data records..."
+ DATA_COUNT=$(docker exec docker-postgres psql -U egov -d egov -t -c "SELECT COUNT(*) FROM eg_mdms_data WHERE isactive = true;")
+ DATA_COUNT=$(echo $DATA_COUNT | tr -d ' ')
+ echo " Found $DATA_COUNT active MDMS data records"
+ if [ "$DATA_COUNT" -lt 100 ]; then
+ echo "ERROR: Expected at least 100 MDMS data records, found $DATA_COUNT"
+ exit 1
+ fi
+
+ # Check tenant data via API
+ echo "3. Checking tenant data via MDMS API..."
+ TENANT_RESPONSE=$(curl -sS -X POST "http://localhost:18094/mdms-v2/v1/_search" \
+ -H 'Content-Type: application/json' \
+ -d '{"RequestInfo":{"apiId":"digit","ver":"1.0","ts":0},"MdmsCriteria":{"tenantId":"pg","moduleDetails":[{"moduleName":"tenant","masterDetails":[{"name":"tenants"}]}]}}')
+ if echo "$TENANT_RESPONSE" | grep -q '"tenantId"'; then
+ echo " Tenant data verified via API"
+ else
+ echo "ERROR: Tenant data not found via API"
+ echo "$TENANT_RESPONSE"
+ exit 1
+ fi
+
+ # Check localization data
+ echo "4. Checking localization data..."
+ LOC_COUNT=$(docker exec docker-postgres psql -U egov -d egov -t -c "SELECT COUNT(*) FROM message;")
+ LOC_COUNT=$(echo $LOC_COUNT | tr -d ' ')
+ echo " Found $LOC_COUNT localization messages"
+ if [ "$LOC_COUNT" -lt 50 ]; then
+ echo "ERROR: Expected at least 50 localization messages, found $LOC_COUNT"
+ exit 1
+ fi
+
+ # Check idgen table exists (created by egov-idgen Flyway migrations)
+ echo "5. Checking IDGEN table exists..."
+ TABLE_EXISTS=$(docker exec docker-postgres psql -U egov -d egov -t -c "SELECT EXISTS (SELECT FROM information_schema.tables WHERE table_name = 'id_generator');")
+ TABLE_EXISTS=$(echo $TABLE_EXISTS | tr -d ' ')
+ if [ "$TABLE_EXISTS" = "t" ]; then
+ echo " IDGEN table exists (managed by egov-idgen Flyway)"
+ else
+ echo "ERROR: id_generator table does not exist"
+ exit 1
+ fi
+
+ echo "=== All seed data verification passed! ==="
+
+ - name: Run health checks
+ run: |
+ bash scripts/health-check.sh http://localhost
+
+ - name: Setup Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: '20'
+ cache: 'npm'
+ cache-dependency-path: local-setup/tests/package-lock.json
+
+ - name: Install test dependencies
+ run: |
+ cd tests
+ npm ci
+
+ - name: Run Node.js smoke tests
+ env:
+ BASE_URL: http://localhost
+ DB_HOST: localhost
+ DB_PORT: 15432
+ DB_PASSWORD: egov123
+ run: |
+ cd tests
+ npm test
+
+ - name: Test idgen service
+ run: |
+ echo "Testing idgen..."
+ RESPONSE=$(curl -s -X POST 'http://localhost:18088/egov-idgen/id/_generate' \
+ -H 'Content-Type: application/json' \
+ -d '{"RequestInfo":{"apiId":"digit","ver":"1.0"},"idRequests":[{"tenantId":"pg","idName":"pgr.servicerequestid"}]}')
+
+ if echo "$RESPONSE" | jq -e '.idResponses[0].id' > /dev/null 2>&1; then
+ ID=$(echo "$RESPONSE" | jq -r '.idResponses[0].id')
+ echo "idgen generated ID: $ID"
+ else
+ echo "idgen failed:"
+ echo "$RESPONSE" | jq .
+ exit 1
+ fi
+
+ - name: Run Postman core validation
+ run: |
+ npx newman@latest run postman/digit-core-validation.postman_collection.json \
+ --env-var "baseUrl=http://localhost"
+
+ - name: Run Postman complaints demo
+ run: |
+ # Install Python dependencies for ci-dataloader
+ pip install requests openpyxl pandas python-dotenv --quiet
+
+ # Run CI dataloader to create tenant, HRMS employee, and load masters
+ # Use set +e so bash -e doesn't swallow stdout on failure
+ set +e
+ CI_OUTPUT=$(DIGIT_URL=http://localhost:18000 TARGET_TENANT=pg.citest python3 scripts/ci-dataloader.py 2>&1)
+ CI_RC=$?
+ set -e
+ echo "$CI_OUTPUT"
+ if [ $CI_RC -ne 0 ]; then
+ echo "FATAL: ci-dataloader failed (exit code $CI_RC)"
+ exit 1
+ fi
+
+ # Parse output for service code
+ CI_SERVICE_CODE=$(echo "$CI_OUTPUT" | grep '^CI_SERVICE_CODE=' | cut -d= -f2)
+ if [ -z "$CI_SERVICE_CODE" ]; then
+ echo "FATAL: ci-dataloader did not output CI_SERVICE_CODE"
+ exit 1
+ fi
+ echo "Using serviceCode: $CI_SERVICE_CODE"
+
+ # Run the complaints demo collection through Kong gateway
+ npx newman@latest run postman/complaints-demo.postman_collection.json \
+ --env-var "url=http://localhost:18000" \
+ --env-var "username=CI-ADMIN" \
+ --env-var "password=eGov@123" \
+ --env-var "cityTenant=pg.citest" \
+ --env-var "stateTenant=pg" \
+ --env-var "userType=EMPLOYEE" \
+ --env-var "authorization=Basic ZWdvdi11c2VyLWNsaWVudDo=" \
+ --env-var "serviceCode=${CI_SERVICE_CODE}"
+
+ - name: Run cross-root bootstrap test
+ run: |
+ # Test that create_tenant auto-bootstraps a new tenant root (issue #225).
+ # Creates "ciboot.citya" which forces bootstrap of the "ciboot" root from "pg".
+ # Use set +e to capture output even on failure (bash -e would swallow stdout)
+ set +e
+ BOOT_OUTPUT=$(DIGIT_URL=http://localhost:18000 BOOT_TENANT=ciboot.citya python3 scripts/ci-dataloader-crossroot.py 2>&1)
+ BOOT_RC=$?
+ set -e
+ echo "$BOOT_OUTPUT"
+ if [ $BOOT_RC -ne 0 ]; then
+ echo "FATAL: cross-root bootstrap script failed (exit code $BOOT_RC)"
+ exit 1
+ fi
+
+ # Parse output for service code
+ BOOT_SERVICE_CODE=$(echo "$BOOT_OUTPUT" | grep '^BOOT_SERVICE_CODE=' | cut -d= -f2)
+ if [ -z "$BOOT_SERVICE_CODE" ]; then
+ echo "FATAL: cross-root bootstrap did not output BOOT_SERVICE_CODE"
+ exit 1
+ fi
+ echo "Using serviceCode: $BOOT_SERVICE_CODE"
+
+ # ── Verify bootstrap data integrity ──────────────────────────────
+ echo ""
+ echo "=== Verifying bootstrap data integrity on ciboot ==="
+ MDMS_URL="http://localhost:18000/mdms-v2/v1/_search"
+ FAIL=0
+
+ # 1. Verify IdFormat records were copied
+ echo -n "1. IdFormat records on ciboot... "
+ IDFORMAT=$(curl -sS -X POST "$MDMS_URL" -H 'Content-Type: application/json' \
+ -d '{"RequestInfo":{"apiId":"Rainmaker"},"MdmsCriteria":{"tenantId":"ciboot","moduleDetails":[{"moduleName":"common-masters","masterDetails":[{"name":"IdFormat"}]}]}}')
+ IDFORMAT_COUNT=$(echo "$IDFORMAT" | jq '[.MdmsRes."common-masters".IdFormat // [] | length] | .[0]')
+ if [ "$IDFORMAT_COUNT" -gt 0 ]; then
+ echo "OK ($IDFORMAT_COUNT records)"
+ else
+ echo "FAIL (expected >0, got $IDFORMAT_COUNT)"
+ FAIL=1
+ fi
+
+ # 2. Verify Department records were copied
+ echo -n "2. Department records on ciboot... "
+ DEPT=$(curl -sS -X POST "$MDMS_URL" -H 'Content-Type: application/json' \
+ -d '{"RequestInfo":{"apiId":"Rainmaker"},"MdmsCriteria":{"tenantId":"ciboot","moduleDetails":[{"moduleName":"common-masters","masterDetails":[{"name":"Department"}]}]}}')
+ DEPT_COUNT=$(echo "$DEPT" | jq '[.MdmsRes."common-masters".Department // [] | length] | .[0]')
+ if [ "$DEPT_COUNT" -gt 0 ]; then
+ echo "OK ($DEPT_COUNT records)"
+ else
+ echo "FAIL (expected >0, got $DEPT_COUNT)"
+ FAIL=1
+ fi
+
+ # 3. Verify ServiceDefs were copied
+ echo -n "3. ServiceDefs on ciboot... "
+ SVCDEFS=$(curl -sS -X POST "$MDMS_URL" -H 'Content-Type: application/json' \
+ -d '{"RequestInfo":{"apiId":"Rainmaker"},"MdmsCriteria":{"tenantId":"ciboot","moduleDetails":[{"moduleName":"RAINMAKER-PGR","masterDetails":[{"name":"ServiceDefs"}]}]}}')
+ SVCDEF_COUNT=$(echo "$SVCDEFS" | jq '[.MdmsRes."RAINMAKER-PGR".ServiceDefs // [] | length] | .[0]')
+ if [ "$SVCDEF_COUNT" -gt 0 ]; then
+ echo "OK ($SVCDEF_COUNT complaint types)"
+ else
+ echo "FAIL (expected >0, got $SVCDEF_COUNT)"
+ FAIL=1
+ fi
+
+ # 4. Verify workflow has all required states
+ echo -n "4. PGR workflow states on ciboot... "
+ WF=$(curl -sS "http://localhost:18000/egov-workflow-v2/egov-wf/businessservice/_search?tenantId=ciboot&businessServices=PGR" \
+ -H 'Content-Type: application/json' \
+ -d '{"RequestInfo":{"apiId":"Rainmaker"}}')
+ WF_STATES=$(echo "$WF" | jq '[.BusinessServices[0].states // [] | length] | .[0]')
+ if [ "$WF_STATES" -ge 6 ]; then
+ echo "OK ($WF_STATES states)"
+ else
+ echo "FAIL (expected >=6 states, got $WF_STATES)"
+ echo "$WF" | jq '.BusinessServices[0].states[].state' 2>/dev/null || true
+ FAIL=1
+ fi
+
+ # 5. Verify idgen works on bootstrapped root
+ echo -n "5. ID generation on ciboot.citya... "
+ IDGEN=$(curl -sS -X POST 'http://localhost:18000/egov-idgen/id/_generate' \
+ -H 'Content-Type: application/json' \
+ -d '{"RequestInfo":{"apiId":"Rainmaker"},"idRequests":[{"tenantId":"ciboot.citya","idName":"pgr.servicerequestid"}]}')
+ GENERATED_ID=$(echo "$IDGEN" | jq -r '.idResponses[0].id // empty')
+ if [ -n "$GENERATED_ID" ]; then
+ echo "OK (generated: $GENERATED_ID)"
+ else
+ echo "FAIL (no ID generated)"
+ echo "$IDGEN" | jq . 2>/dev/null || echo "$IDGEN"
+ FAIL=1
+ fi
+
+ if [ "$FAIL" -ne 0 ]; then
+ echo ""
+ echo "FATAL: Bootstrap data integrity checks failed"
+ exit 1
+ fi
+ echo "=== All bootstrap data integrity checks passed ==="
+ echo ""
+
+ # Run the same complaints-demo collection against the bootstrapped tenant
+ npx newman@latest run postman/complaints-demo.postman_collection.json \
+ --env-var "url=http://localhost:18000" \
+ --env-var "username=BOOT-ADMIN" \
+ --env-var "password=eGov@123" \
+ --env-var "cityTenant=ciboot.citya" \
+ --env-var "stateTenant=ciboot" \
+ --env-var "userType=EMPLOYEE" \
+ --env-var "authorization=Basic ZWdvdi11c2VyLWNsaWVudDo=" \
+ --env-var "serviceCode=${BOOT_SERVICE_CODE}"
+
+ - name: Run boundary template end-to-end test
+ run: |
+ # Tests the full boundary lifecycle:
+ # hierarchy creation → template generation → download → fill → upload → verify
+ set +e
+ BND_OUTPUT=$(DIGIT_URL=http://localhost:18000 TARGET_TENANT=pg.bndtest python3 scripts/ci-boundary-test.py 2>&1)
+ BND_RC=$?
+ set -e
+ echo "$BND_OUTPUT"
+ if [ $BND_RC -ne 0 ]; then
+ echo "FATAL: boundary end-to-end test failed (exit code $BND_RC)"
+ exit 1
+ fi
+
+ - name: Show telemetry events
+ if: always()
+ run: |
+ echo "=== Telemetry Sidecar Logs ==="
+ docker compose logs telemetry 2>&1 || echo "(no telemetry container)"
+
+ - name: Show service logs on failure
+ if: failure()
+ run: |
+ echo "=== Docker Compose Logs ==="
+ docker compose logs --tail=100
+
+ - name: Cleanup
+ if: always()
+ run: |
+ docker compose down -v --remove-orphans
diff --git a/.github/workflows/pgr-ui-build.yml b/.github/workflows/pgr-ui-build.yml
new file mode 100644
index 000000000..401db47c5
--- /dev/null
+++ b/.github/workflows/pgr-ui-build.yml
@@ -0,0 +1,216 @@
+name: Build Pipeline
+run-name: Build ${{ github.event.inputs.pipeline_name }}
+
+on:
+ workflow_dispatch:
+ inputs:
+ pipeline_name:
+ description: 'Name of the config pipeline to build and deploy'
+ required: true
+ type: choice
+ options:
+ - digit-ui
+
+env:
+ DOCKER_USERNAME: ${{ vars.DOCKER_USERNAME }}
+ DOCKER_PASSWORD: ${{ secrets.DOCKER_ACCESS_TOKEN }}
+
+jobs:
+ resolve-config:
+ name: Resolve ${{ github.event.inputs.pipeline_name }} config
+ runs-on: ubuntu-latest
+ outputs:
+ work_dir: ${{ steps.setenv.outputs.work_dir }}
+ image_name: ${{ steps.setenv.outputs.image_name }}
+ dockerfile: ${{ steps.setenv.outputs.dockerfile }}
+ tag: ${{ steps.tag.outputs.tag }}
+ steps:
+ - name: Checkout Code
+ uses: actions/checkout@v3
+
+ - name: Install yq
+ run: |
+ VERSION="4.30.8"
+ URL="https://github.com/mikefarah/yq/releases/download/v${VERSION}/yq_linux_amd64"
+ sudo curl -sSL "$URL" -o /usr/local/bin/yq
+ sudo chmod +x /usr/local/bin/yq
+
+ - name: Resolve env from build-config.yml
+ id: setenv
+ run: |
+ PIPELINE_NAME="${{ github.event.inputs.pipeline_name }}"
+ DEFAULT_DOCKERFILE="Dockerfile"
+ echo "### Pipeline Name - $PIPELINE_NAME" >> $GITHUB_STEP_SUMMARY
+
+ # Find exactly one matching config block
+ MATCHING_CONFIGS=$(yq eval -o=json '.config[] | select(.name | test("/'"$PIPELINE_NAME"'$"))' build/build-config.yml)
+ MATCH_COUNT=$(echo "$MATCHING_CONFIGS" | jq -s 'length')
+ if [ "$MATCH_COUNT" -ne 1 ]; then
+ echo "ERROR: Expected exactly 1 matching pipeline config, but found $MATCH_COUNT"
+ exit 1
+ fi
+
+ # Extract fields
+ SERVICE_BUILD_CONFIG=$(echo "$MATCHING_CONFIGS" | jq -c '.build[] | select(.["image-name"])')
+ SERVICE_WORK_DIR=$(echo "$SERVICE_BUILD_CONFIG" | yq eval -r '.["work-dir"] // ""' -)
+ SERVICE_IMAGE_NAME=$(echo "$SERVICE_BUILD_CONFIG" | yq eval -r '.["image-name"] // ""' -)
+ SERVICE_DOCKERFILE=$(echo "$SERVICE_BUILD_CONFIG" | yq eval -r '.dockerfile // ""' -)
+
+ # Default Dockerfile if none specified
+ if [ -z "$SERVICE_DOCKERFILE" ]; then
+ SERVICE_DOCKERFILE="$SERVICE_WORK_DIR/$DEFAULT_DOCKERFILE"
+ fi
+
+ # Export
+ echo "SERVICE_WORK_DIR=$SERVICE_WORK_DIR" >> "$GITHUB_ENV"
+ echo "SERVICE_IMAGE_NAME=$SERVICE_IMAGE_NAME" >> "$GITHUB_ENV"
+ echo "SERVICE_DOCKERFILE=$SERVICE_DOCKERFILE" >> "$GITHUB_ENV"
+ echo "work_dir=$SERVICE_WORK_DIR" >> $GITHUB_OUTPUT
+ echo "image_name=$SERVICE_IMAGE_NAME" >> $GITHUB_OUTPUT
+ echo "dockerfile=$SERVICE_DOCKERFILE" >> $GITHUB_OUTPUT
+
+ # Put summary for the step
+ echo "#### Application Config Summary" >> $GITHUB_STEP_SUMMARY
+ echo "Application Work Directory - $SERVICE_WORK_DIR" >> $GITHUB_STEP_SUMMARY
+ echo "Image Name - $SERVICE_IMAGE_NAME" >> $GITHUB_STEP_SUMMARY
+ echo "Dockerfile Path - $SERVICE_DOCKERFILE" >> $GITHUB_STEP_SUMMARY
+
+ - name: Generate the Next Tag
+ id: tag
+ run: |
+ set -euxo pipefail
+ BRANCH="${GITHUB_REF##*/}"
+ COMMIT_HASH=$(git rev-parse --short HEAD)
+ SERVICE_NAME="${{ env.SERVICE_IMAGE_NAME }}"
+
+ TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
+ -H "Content-Type: application/json" \
+ -d "{\"username\": \"$DOCKER_USERNAME\", \"password\": \"$DOCKER_PASSWORD\"}" \
+ | jq -r .token)
+
+ if [ -z "$TOKEN" ]; then
+ echo "Failed to authenticate with Docker Hub." >&2
+ exit 1
+ fi
+
+ # Check if repo exists
+ HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' \
+ -H "Authorization: JWT $TOKEN" \
+ "https://hub.docker.com/v2/repositories/$DOCKER_USERNAME/$SERVICE_NAME/")
+
+ if [ "$HTTP_CODE" -ne 200 ]; then
+ NEXT_TAG="${BRANCH}-${COMMIT_HASH}"
+ else
+ EXISTING_TAGS=$(curl -s -H "Authorization: JWT $TOKEN" \
+ "https://hub.docker.com/v2/repositories/$DOCKER_USERNAME/$SERVICE_NAME/tags?page_size=100" \
+ | jq -r '.results[].name')
+ LATEST_TAG=$(echo "$EXISTING_TAGS" \
+ | grep "^${BRANCH}-${COMMIT_HASH}" || true \
+ | sort -V \
+ | tail -n 1)
+ NEXT_TAG="${LATEST_TAG:-${BRANCH}-${COMMIT_HASH}}"
+ fi
+
+ echo "tag=$NEXT_TAG" >> "$GITHUB_OUTPUT"
+ echo "NEXT_TAG=$NEXT_TAG" >> "$GITHUB_ENV"
+ echo "tag - $NEXT_TAG" >> $GITHUB_STEP_SUMMARY
+
+ build-matrix:
+ name: Build application ${{ matrix.arch }}
+ needs: [resolve-config]
+ strategy:
+ matrix:
+ include:
+ - arch: amd64
+ platform: linux/amd64
+ runner: ubuntu-latest
+ - arch: arm64
+ platform: linux/arm64
+ runner: ubuntu-24.04-arm
+ runs-on: ${{ matrix.runner }}
+ outputs:
+ amd64_digest: ${{ steps.digest_amd64.outputs.digest }}
+ arm64_digest: ${{ steps.digest_arm64.outputs.digest }}
+ steps:
+ - name: Checkout Code
+ uses: actions/checkout@v3
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v3
+
+ - name: Cache Docker Layers
+ uses: actions/cache@v3
+ with:
+ path: /tmp/.buildx-cache
+ key: ${{ runner.os }}-${{ matrix.arch }}-buildx-${{ github.event.inputs.pipeline_name }}-${{ github.ref_name }}
+ restore-keys: |
+ ${{ runner.os }}-${{ matrix.arch }}-buildx-${{ github.event.inputs.pipeline_name }}-
+
+ - name: Log in to Docker Hub
+ uses: docker/login-action@v2
+ with:
+ username: ${{ env.DOCKER_USERNAME }}
+ password: ${{ env.DOCKER_PASSWORD }}
+
+ - name: Build image for ${{ matrix.arch }}
+ run: |
+ docker buildx build \
+ --platform ${{ matrix.platform }} \
+ --build-arg WORK_DIR=${{ needs.resolve-config.outputs.work_dir }} \
+ --file ${{ needs.resolve-config.outputs.dockerfile }} \
+ --tag egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }} \
+ --cache-from=type=local,src=/tmp/.buildx-cache \
+ --cache-to=type=local,dest=/tmp/.buildx-cache,mode=max \
+ --push \
+ --iidfile digest.txt \
+ .
+
+ - name: Inspect Manifest List
+ run: |
+ docker buildx imagetools inspect egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }}
+
+ - name: Export Digest (amd64)
+ if: matrix.arch == 'amd64'
+ id: digest_amd64
+ run: |
+ digest=$(docker buildx imagetools inspect \
+ egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }} \
+ --format '{{json .}}' | jq -r '.manifest.manifests[] | select(.platform.architecture=="amd64" and .platform.os=="linux") | .digest')
+ echo "digest=$digest" >> $GITHUB_OUTPUT
+
+ - name: Export Digest (arm64)
+ if: matrix.arch == 'arm64'
+ id: digest_arm64
+ run: |
+ digest=$(docker buildx imagetools inspect \
+ egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }}-${{ matrix.arch }} \
+ --format '{{json .}}' | jq -r '.manifest.manifests[] | select(.platform.architecture=="arm64" and .platform.os=="linux") | .digest')
+ echo "digest=$digest" >> $GITHUB_OUTPUT
+
+ create-manifest:
+ name: Create and Push Manifest
+ needs: [build-matrix, resolve-config]
+ runs-on: ubuntu-latest
+ steps:
+ - name: Log in to Docker Hub
+ uses: docker/login-action@v2
+ with:
+ username: ${{ env.DOCKER_USERNAME }}
+ password: ${{ env.DOCKER_PASSWORD }}
+
+ - name: Create and push manifest
+ run: |
+ docker manifest create egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }} \
+ --amend egovio/${{ needs.resolve-config.outputs.image_name }}@${{ needs.build-matrix.outputs.amd64_digest }} \
+ --amend egovio/${{ needs.resolve-config.outputs.image_name }}@${{ needs.build-matrix.outputs.arm64_digest }}
+ docker manifest push egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }}
+
+ - name: Cleanup local manifest refs
+ run: |
+ docker manifest rm egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }}-amd64 || true
+ docker manifest rm egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }}-arm64 || true
+
+ - name: Add summary to GitHub Actions
+ run: |
+ echo "- Image: egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
+ echo "- Platform: amd64, arm64" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/publishAllPackages.yml b/.github/workflows/publishAllPackages.yml
new file mode 100644
index 000000000..a64d90c08
--- /dev/null
+++ b/.github/workflows/publishAllPackages.yml
@@ -0,0 +1,24 @@
+name: Node.js Publish UI Packages
+
+on:
+ push:
+ branches: [ 'develop', 'campaign' ]
+ paths:
+ - 'frontend/micro-ui/web/micro-ui-internals/**'
+ pull_request:
+ branches: [ 'develop', 'campaign' ]
+ paths:
+ - 'frontend/micro-ui/web/micro-ui-internals/**'
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v2
+ - uses: actions/setup-node@v2
+ with:
+ node-version: 14
+ registry-url: https://registry.npmjs.org/
+ - run: cd frontend/micro-ui/web/micro-ui-internals/ && bash ./publish-develop.sh
+ env:
+ NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
diff --git a/.github/workflows/publishAllPackagesRelease.yml b/.github/workflows/publishAllPackagesRelease.yml
new file mode 100644
index 000000000..01c5276f8
--- /dev/null
+++ b/.github/workflows/publishAllPackagesRelease.yml
@@ -0,0 +1,20 @@
+name: Node.js Publish UI Packages
+
+on:
+ push:
+ branches: [ 'master' ]
+ paths:
+ - 'frontend/micro-ui/web/micro-ui-internals/**'
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v2
+ - uses: actions/setup-node@v2
+ with:
+ node-version: 14
+ registry-url: https://registry.npmjs.org/
+ - run: cd frontend/micro-ui/web/micro-ui-internals/ && bash ./publish.sh
+ env:
+ NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
diff --git a/backend/pgr-services/README.md b/backend/pgr-services/README.md
index f574f122a..321499982 100644
--- a/backend/pgr-services/README.md
+++ b/backend/pgr-services/README.md
@@ -9,7 +9,7 @@ the citizen and will be updated by notifications whenever the status of the comp
- egov-user
- egov-localization
- egov-idgen
-- egov-mdms
+- mdms-v2
- egov-persister
- egov-notification-sms
- egov-notification-mail
@@ -73,3 +73,8 @@ the citizen and will be updated by notifications whenever the status of the comp
- Following are the Producer topic.
- **save-pgr-request** :- This topic is used to create new complaint in the system.
- **update-pgr-request** :- This topic is used to update the existing complaint in the systen.
+
+### note
+all master data, localisation data, boundary data, users, employees, workflow config will be update by a service in utilities/default-data-handler which update all these data which is maintained in resource folder.
+
+and all the configs which are required for pgr are maintained in configs folder.
\ No newline at end of file
diff --git a/build/maven/Dockerfile b/build/maven/Dockerfile
index 877e5d9da..1847aa788 100644
--- a/build/maven/Dockerfile
+++ b/build/maven/Dockerfile
@@ -1,31 +1,27 @@
-#FROM egovio/alpine-maven-builder-jdk-8:1-master-NA-6036091e AS build
-FROM egovio/amazoncorretto:17-alpine3.19 AS build
+FROM maven:3.9.6-amazoncorretto-17 AS build
ARG WORK_DIR
WORKDIR /app
-# Install Maven
-RUN apk add --no-cache maven
-
-# copy the project files
+# Copy project files
COPY ${WORK_DIR}/pom.xml ./pom.xml
COPY build/maven/start.sh ./start.sh
-
-# not useful for stateless builds
-# RUN mvn -B dependency:go-offline
-
COPY ${WORK_DIR}/src ./src
-RUN mvn -B -f /app/pom.xml package
+# Build the project
+RUN mvn -B -f /app/pom.xml package
-# Create runtime image
-#FROM egovio/8-openjdk-alpine
-FROM egovio/amazoncorretto:17-alpine3.19
-
+# Runtime image – using a multi-arch base image
+FROM amazoncorretto:17-alpine
WORKDIR /opt/egov
+# Copy artifacts from the build stage
COPY --from=build /app/target/*.jar /app/start.sh /opt/egov/
-RUN chmod +x /opt/egov/start.sh
+# Ensure the start script has correct line endings and is executable
+RUN dos2unix /opt/egov/start.sh && chmod +x /opt/egov/start.sh
+
+# Verify architecture inside the container
+RUN uname -m
-CMD ["/opt/egov/start.sh"]
\ No newline at end of file
+CMD ["/opt/egov/start.sh"]
diff --git a/devops/deploy-as-code/charts/analytics/inbox/values.yaml b/devops/deploy-as-code/charts/analytics/inbox/values.yaml
index f67af497e..9b1a20597 100644
--- a/devops/deploy-as-code/charts/analytics/inbox/values.yaml
+++ b/devops/deploy-as-code/charts/analytics/inbox/values.yaml
@@ -37,6 +37,11 @@ env: |
configMapKeyRef:
name: egov-service-host
key: egov-workflow-v2
+ - name: SPRING_DATASOURCE_URL
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: db-url
- name: EGOV_VEHICLE_HOST
valueFrom:
configMapKeyRef:
diff --git a/devops/deploy-as-code/charts/backbone-services/kafka-kraft/values.yaml b/devops/deploy-as-code/charts/backbone-services/kafka-kraft/values.yaml
index 075d8c3d4..f6b656c70 100644
--- a/devops/deploy-as-code/charts/backbone-services/kafka-kraft/values.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/kafka-kraft/values.yaml
@@ -79,7 +79,7 @@ diagnosticMode:
##
image:
registry: docker.io
- repository: bitnami/kafka
+ repository: egovio/bitnami-kafka
tag: 3.6.0-debian-11-r0
digest: ""
## Specify a imagePullPolicy
diff --git a/devops/deploy-as-code/charts/backbone-services/kibana/values.yaml b/devops/deploy-as-code/charts/backbone-services/kibana/values.yaml
index b9c2f0e1c..43b366f91 100644
--- a/devops/deploy-as-code/charts/backbone-services/kibana/values.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/kibana/values.yaml
@@ -143,6 +143,7 @@ ingress:
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
kubernetes.io/ingress.class: nginx
+ cert-manager.io/cluster-issuer: letsencrypt-prod
# nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
# nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
nginx.ingress.kubernetes.io/limit-rpm: "1200"
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/.helmignore b/devops/deploy-as-code/charts/backbone-services/minio/.helmignore
index fb56657ab..e69de29bb 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/.helmignore
+++ b/devops/deploy-as-code/charts/backbone-services/minio/.helmignore
@@ -1,23 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-# img folder
-img/
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/Chart.yaml b/devops/deploy-as-code/charts/backbone-services/minio/Chart.yaml
index a283677a8..6ae6f1161 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/Chart.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/minio/Chart.yaml
@@ -1,36 +1,18 @@
-annotations:
- category: Infrastructure
- images: |
- - name: minio-client
- image: docker.io/bitnami/minio-client:2024.1.28-debian-11-r0
- - name: minio
- image: docker.io/bitnami/minio:2024.1.29-debian-11-r0
- - name: os-shell
- image: docker.io/bitnami/os-shell:11-debian-11-r95
- licenses: Apache-2.0
-apiVersion: v2
-appVersion: 2024.1.29
-dependencies:
-- name: common
- repository: oci://registry-1.docker.io/bitnamicharts
- tags:
- - bitnami-common
- version: 2.x.x
-description: MinIO(R) is an object storage server, compatible with Amazon S3 cloud
- storage service, mainly used for storing unstructured data (such as photos, videos,
- log files, etc.).
-home: https://bitnami.com
-icon: https://bitnami.com/assets/stacks/minio/img/minio-stack-220x234.png
-keywords:
-- minio
-- storage
-- object-storage
-- s3
-- cluster
-maintainers:
-- name: VMware, Inc.
- url: https://github.com/bitnami/charts
+apiVersion: v1
+description: High Performance Object Storage
name: minio
+version: 5.4.0
+appVersion: RELEASE.2024-12-18T13-15-44Z
+keywords:
+ - minio
+ - storage
+ - object-storage
+ - s3
+ - cluster
+home: https://min.io
+icon: https://min.io/resources/img/logo/MINIO_wordmark.png
sources:
-- https://github.com/bitnami/charts/tree/main/bitnami/minio
-version: 13.3.1
+- https://github.com/minio/minio
+maintainers:
+- name: MinIO, Inc
+ email: dev@minio.io
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/README.md b/devops/deploy-as-code/charts/backbone-services/minio/README.md
index f2c56b495..a1d5c99f8 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/README.md
+++ b/devops/deploy-as-code/charts/backbone-services/minio/README.md
@@ -1,601 +1,264 @@
-
+# MinIO Community Helm Chart
-# Bitnami Object Storage based on MinIO(R)
+[](https://slack.min.io) [](https://github.com/minio/minio/blob/master/LICENSE)
-MinIO(R) is an object storage server, compatible with Amazon S3 cloud storage service, mainly used for storing unstructured data (such as photos, videos, log files, etc.).
+MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads.
-[Overview of Bitnami Object Storage based on MinIO®](https://min.io/)
-
-Disclaimer: All software products, projects and company names are trademark(TM) or registered(R) trademarks of their respective holders, and use of them does not imply any affiliation or endorsement. This software is licensed to you subject to one or more open source licenses and VMware provides the software on an AS-IS basis. MinIO(R) is a registered trademark of the MinIO Inc. in the US and other countries. Bitnami is not affiliated, associated, authorized, endorsed by, or in any way officially connected with MinIO Inc. MinIO(R) is licensed under GNU AGPL v3.0.
-
-## TL;DR
-
-```console
-helm install my-release oci://registry-1.docker.io/bitnamicharts/minio
-```
-
-Looking to use Bitnami Object Storage based on MinIOreg; in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the enterprise edition of Bitnami Application Catalog.
+| IMPORTANT |
+| -------------------------- |
+| This Helm chart is community built, maintained, and supported. MinIO does not guarantee support for any given bug, feature request, or update referencing this chart.
MinIO publishes a separate [MinIO Kubernetes Operator and Tenant Helm Chart](https://github.com/minio/operator/tree/master/helm) that is officially maintained and supported. MinIO strongly recommends using the MinIO Kubernetes Operator for production deployments. See [Deploy Operator With Helm](https://min.io/docs/minio/kubernetes/upstream/operations/install-deploy-manage/deploy-operator-helm.html?ref=github) for additional documentation. |
## Introduction
-This chart bootstraps a [MinIO®](https://github.com/bitnami/containers/tree/main/bitnami/minio) deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
-
-Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
+This chart bootstraps MinIO Cluster on [Kubernetes](http://kubernetes.io) using the [Helm](https://helm.sh) package manager.
## Prerequisites
-- Kubernetes 1.23+
-- Helm 3.8.0+
-- PV provisioner support in the underlying infrastructure
-
-## Installing the Chart
+- Helm cli with Kubernetes cluster configured.
+- PV provisioner support in the underlying infrastructure. (We recommend using )
+- Use Kubernetes version v1.19 and later for best experience.
-To install the chart with the release name `my-release`:
+## Configure MinIO Helm repo
-```console
-helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/minio
+```bash
+helm repo add minio https://charts.min.io/
```
-> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
+### Installing the Chart
-These commands deploy MinIO® on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
+Install this chart using:
-> **Tip**: List all releases using `helm list`
-
-## Uninstalling the Chart
-
-To uninstall/delete the `my-release` deployment:
-
-```console
-helm delete my-release
+```bash
+helm install --namespace minio --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio
```
-The command removes all the Kubernetes components associated with the chart and deletes the release.
+The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
-## Parameters
-
-### Global parameters
-
-| Name | Description | Value |
-| ------------------------- | ----------------------------------------------- | ----- |
-| `global.imageRegistry` | Global Docker image registry | `""` |
-| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
-| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `""` |
-
-### Common parameters
-
-| Name | Description | Value |
-| ------------------- | -------------------------------------------------------------------------------------------- | --------------- |
-| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` |
-| `namespaceOverride` | String to fully override common.names.namespace | `""` |
-| `fullnameOverride` | String to fully override common.names.fullname template | `""` |
-| `commonLabels` | Labels to add to all deployed objects | `{}` |
-| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
-| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
-| `clusterDomain` | Default Kubernetes cluster domain | `cluster.local` |
-| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
-
-### MinIO® parameters
-
-| Name | Description | Value |
-| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
-| `image.registry` | MinIO® image registry | `REGISTRY_NAME` |
-| `image.repository` | MinIO® image repository | `REPOSITORY_NAME/minio` |
-| `image.digest` | MinIO® image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
-| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
-| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
-| `image.debug` | Specify if debug logs should be enabled | `false` |
-| `clientImage.registry` | MinIO® Client image registry | `REGISTRY_NAME` |
-| `clientImage.repository` | MinIO® Client image repository | `REPOSITORY_NAME/minio-client` |
-| `clientImage.digest` | MinIO® Client image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
-| `mode` | MinIO® server mode (`standalone` or `distributed`) | `standalone` |
-| `auth.rootUser` | MinIO® root username | `admin` |
-| `auth.rootPassword` | Password for MinIO® root user | `""` |
-| `auth.existingSecret` | Use existing secret for credentials details (`auth.rootUser` and `auth.rootPassword` will be ignored and picked up from this secret). The secret has to contain the keys `root-user` and `root-password`) | `""` |
-| `auth.forcePassword` | Force users to specify required passwords | `false` |
-| `auth.useCredentialsFiles` | Mount credentials as a files instead of using an environment variable | `false` |
-| `auth.forceNewKeys` | Force root credentials (user and password) to be reconfigured every time they change in the secrets | `false` |
-| `defaultBuckets` | Comma, semi-colon or space separated list of buckets to create at initialization (only in standalone mode) | `""` |
-| `disableWebUI` | Disable MinIO® Web UI | `false` |
-| `tls.enabled` | Enable tls in front of the container | `false` |
-| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` |
-| `tls.existingSecret` | Name of an existing secret holding the certificate information | `""` |
-| `tls.mountPath` | The mount path where the secret will be located | `""` |
-| `extraEnvVars` | Extra environment variables to be set on MinIO® container | `[]` |
-| `extraEnvVarsCM` | ConfigMap with extra environment variables | `""` |
-| `extraEnvVarsSecret` | Secret with extra environment variables | `""` |
-| `command` | Default container command (useful when using custom images). Use array form | `[]` |
-| `args` | Default container args (useful when using custom images). Use array form | `[]` |
-
-### MinIO® deployment/statefulset parameters
-
-| Name | Description | Value |
-| ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
-| `schedulerName` | Specifies the schedulerName, if it's nil uses kube-scheduler | `""` |
-| `terminationGracePeriodSeconds` | In seconds, time the given to the MinIO pod needs to terminate gracefully | `""` |
-| `deployment.updateStrategy.type` | Deployment strategy type | `Recreate` |
-| `statefulset.updateStrategy.type` | StatefulSet strategy type | `RollingUpdate` |
-| `statefulset.podManagementPolicy` | StatefulSet controller supports relax its ordering guarantees while preserving its uniqueness and identity guarantees. There are two valid pod management policies: OrderedReady and Parallel | `Parallel` |
-| `statefulset.replicaCount` | Number of pods per zone (only for MinIO® distributed mode). Should be even and `>= 4` | `4` |
-| `statefulset.zones` | Number of zones (only for MinIO® distributed mode) | `1` |
-| `statefulset.drivesPerNode` | Number of drives attached to every node (only for MinIO® distributed mode) | `1` |
-| `provisioning.enabled` | Enable MinIO® provisioning Job | `false` |
-| `provisioning.schedulerName` | Name of the k8s scheduler (other than default) for MinIO® provisioning | `""` |
-| `provisioning.nodeSelector` | Node labels for pod assignment. Evaluated as a template. | `{}` |
-| `provisioning.podLabels` | Extra labels for provisioning pods | `{}` |
-| `provisioning.podAnnotations` | Provisioning Pod annotations. | `{}` |
-| `provisioning.command` | Default provisioning container command (useful when using custom images). Use array form | `[]` |
-| `provisioning.args` | Default provisioning container args (useful when using custom images). Use array form | `[]` |
-| `provisioning.extraCommands` | Optionally specify extra list of additional commands for MinIO® provisioning pod | `[]` |
-| `provisioning.extraVolumes` | Optionally specify extra list of additional volumes for MinIO® provisioning pod | `[]` |
-| `provisioning.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for MinIO® provisioning container | `[]` |
-| `provisioning.resources.limits` | The resources limits for the container | `{}` |
-| `provisioning.resources.requests` | The requested resources for the container | `{}` |
-| `provisioning.policies` | MinIO® policies provisioning | `[]` |
-| `provisioning.users` | MinIO® users provisioning. Can be used in addition to provisioning.usersExistingSecrets. | `[]` |
-| `provisioning.usersExistingSecrets` | Array if existing secrets containing MinIO® users to be provisioned. Can be used in addition to provisioning.users. | `[]` |
-| `provisioning.groups` | MinIO® groups provisioning | `[]` |
-| `provisioning.buckets` | MinIO® buckets, versioning, lifecycle, quota and tags provisioning | `[]` |
-| `provisioning.config` | MinIO® config provisioning | `[]` |
-| `provisioning.podSecurityContext.enabled` | Enable pod Security Context | `true` |
-| `provisioning.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
-| `provisioning.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
-| `provisioning.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
-| `provisioning.podSecurityContext.fsGroup` | Group ID for the container | `1001` |
-| `provisioning.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
-| `provisioning.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
-| `provisioning.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
-| `provisioning.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
-| `provisioning.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
-| `provisioning.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
-| `provisioning.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` |
-| `provisioning.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
-| `provisioning.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
-| `provisioning.cleanupAfterFinished.enabled` | Enables Cleanup for Finished Jobs | `false` |
-| `provisioning.cleanupAfterFinished.seconds` | Sets the value of ttlSecondsAfterFinished | `600` |
-| `automountServiceAccountToken` | Mount Service Account token in pod | `false` |
-| `hostAliases` | MinIO® pod host aliases | `[]` |
-| `containerPorts.api` | MinIO® container port to open for MinIO® API | `9000` |
-| `containerPorts.console` | MinIO® container port to open for MinIO® Console | `9001` |
-| `podSecurityContext.enabled` | Enable pod Security Context | `true` |
-| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
-| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
-| `podSecurityContext.fsGroup` | Group ID for the container | `1001` |
-| `podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `OnRootMismatch` |
-| `podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
-| `podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
-| `podSecurityContext.fsGroupChangePolicy` | When K8s should preform chown on attached volumes | `OnRootMismatch` |
-| `containerSecurityContext.enabled` | Enabled containers' Security Context | `true` |
-| `containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
-| `containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` |
-| `containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` |
-| `containerSecurityContext.privileged` | Set container's Security Context privileged | `false` |
-| `containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `false` |
-| `containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` |
-| `containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
-| `containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
-| `podLabels` | Extra labels for MinIO® pods | `{}` |
-| `podAnnotations` | Annotations for MinIO® pods | `{}` |
-| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
-| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
-| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
-| `nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set. | `""` |
-| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` |
-| `affinity` | Affinity for pod assignment. Evaluated as a template. | `{}` |
-| `nodeSelector` | Node labels for pod assignment. Evaluated as a template. | `{}` |
-| `tolerations` | Tolerations for pod assignment. Evaluated as a template. | `[]` |
-| `topologySpreadConstraints` | Topology Spread Constraints for MinIO® pods assignment spread across your cluster among failure-domains | `[]` |
-| `priorityClassName` | MinIO® pods' priorityClassName | `""` |
-| `runtimeClassName` | Name of the runtime class to be used by MinIO® pods' | `""` |
-| `resources.limits` | The resources limits for the MinIO® container | `{}` |
-| `resources.requests` | The requested resources for the MinIO® container | `{}` |
-| `livenessProbe.enabled` | Enable livenessProbe | `true` |
-| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
-| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
-| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
-| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` |
-| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
-| `readinessProbe.enabled` | Enable readinessProbe | `true` |
-| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
-| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
-| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` |
-| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` |
-| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` |
-| `startupProbe.enabled` | Enable startupProbe | `false` |
-| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` |
-| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
-| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
-| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `60` |
-| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` |
-| `customLivenessProbe` | Override default liveness probe | `{}` |
-| `customReadinessProbe` | Override default readiness probe | `{}` |
-| `customStartupProbe` | Override default startup probe | `{}` |
-| `lifecycleHooks` | for the MinIO® container(s) to automate configuration before or after startup | `{}` |
-| `extraVolumes` | Optionally specify extra list of additional volumes for MinIO® pods | `[]` |
-| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for MinIO® container(s) | `[]` |
-| `initContainers` | Add additional init containers to the MinIO® pods | `[]` |
-| `sidecars` | Add additional sidecar containers to the MinIO® pods | `[]` |
-
-### Traffic exposure parameters
-
-| Name | Description | Value |
-| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
-| `service.type` | MinIO® service type | `ClusterIP` |
-| `service.ports.api` | MinIO® API service port | `9000` |
-| `service.ports.console` | MinIO® Console service port | `9001` |
-| `service.nodePorts.api` | Specify the MinIO® API nodePort value for the LoadBalancer and NodePort service types | `""` |
-| `service.nodePorts.console` | Specify the MinIO® Console nodePort value for the LoadBalancer and NodePort service types | `""` |
-| `service.clusterIP` | Service Cluster IP | `""` |
-| `service.loadBalancerIP` | loadBalancerIP if service type is `LoadBalancer` (optional, cloud specific) | `""` |
-| `service.loadBalancerSourceRanges` | Addresses that are allowed when service is LoadBalancer | `[]` |
-| `service.externalTrafficPolicy` | Enable client source IP preservation | `Cluster` |
-| `service.extraPorts` | Extra ports to expose in the service (normally used with the `sidecar` value) | `[]` |
-| `service.annotations` | Annotations for MinIO® service | `{}` |
-| `service.headless.annotations` | Annotations for the headless service. | `{}` |
-| `ingress.enabled` | Enable ingress controller resource for MinIO Console | `false` |
-| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
-| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
-| `ingress.hostname` | Default host for the ingress resource | `minio.local` |
-| `ingress.path` | The Path to MinIO®. You may need to set this to '/*' in order to use this with ALB ingress controllers. | `/` |
-| `ingress.pathType` | Ingress path type | `ImplementationSpecific` |
-| `ingress.servicePort` | Service port to be used | `minio-console` |
-| `ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
-| `ingress.tls` | Enable TLS configuration for the hostname defined at `ingress.hostname` parameter | `false` |
-| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
-| `ingress.extraHosts` | The list of additional hostnames to be covered with this ingress record. | `[]` |
-| `ingress.extraPaths` | Any additional paths that may need to be added to the ingress under the main host | `[]` |
-| `ingress.extraTls` | The tls configuration for additional hostnames to be covered with this ingress record. | `[]` |
-| `ingress.secrets` | If you're providing your own certificates, please use this to add the certificates as secrets | `[]` |
-| `ingress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
-| `apiIngress.enabled` | Enable ingress controller resource for MinIO API | `false` |
-| `apiIngress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` |
-| `apiIngress.ingressClassName` | IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+) | `""` |
-| `apiIngress.hostname` | Default host for the ingress resource | `minio.local` |
-| `apiIngress.path` | The Path to MinIO®. You may need to set this to '/*' in order to use this with ALB ingress controllers. | `/` |
-| `apiIngress.pathType` | Ingress path type | `ImplementationSpecific` |
-| `apiIngress.servicePort` | Service port to be used | `minio-api` |
-| `apiIngress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` |
-| `apiIngress.tls` | Enable TLS configuration for the hostname defined at `apiIngress.hostname` parameter | `false` |
-| `apiIngress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` |
-| `apiIngress.extraHosts` | The list of additional hostnames to be covered with this ingress record. | `[]` |
-| `apiIngress.extraPaths` | Any additional paths that may need to be added to the ingress under the main host | `[]` |
-| `apiIngress.extraTls` | The tls configuration for additional hostnames to be covered with this ingress record. | `[]` |
-| `apiIngress.secrets` | If you're providing your own certificates, please use this to add the certificates as secrets | `[]` |
-| `apiIngress.extraRules` | Additional rules to be covered with this ingress record | `[]` |
-| `networkPolicy.enabled` | Enable the default NetworkPolicy policy | `false` |
-| `networkPolicy.allowExternal` | Don't require client label for connections | `true` |
-| `networkPolicy.extraFromClauses` | Allows to add extra 'from' clauses to the NetworkPolicy | `[]` |
-
-### Persistence parameters
-
-| Name | Description | Value |
-| --------------------------- | -------------------------------------------------------------------- | --------------------- |
-| `persistence.enabled` | Enable MinIO® data persistence using PVC. If false, use emptyDir | `true` |
-| `persistence.storageClass` | PVC Storage Class for MinIO® data volume | `""` |
-| `persistence.mountPath` | Data volume mount path | `/bitnami/minio/data` |
-| `persistence.accessModes` | PVC Access Modes for MinIO® data volume | `["ReadWriteOnce"]` |
-| `persistence.size` | PVC Storage Request for MinIO® data volume | `8Gi` |
-| `persistence.annotations` | Annotations for the PVC | `{}` |
-| `persistence.existingClaim` | Name of an existing PVC to use (only in `standalone` mode) | `""` |
-
-### Volume Permissions parameters
-
-| Name | Description | Value |
-| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
-| `volumePermissions.enabled` | Enable init container that changes the owner and group of the persistent volume(s) mountpoint to `runAsUser:fsGroup` | `false` |
-| `volumePermissions.image.registry` | Init container volume-permissions image registry | `REGISTRY_NAME` |
-| `volumePermissions.image.repository` | Init container volume-permissions image repository | `REPOSITORY_NAME/os-shell` |
-| `volumePermissions.image.digest` | Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
-| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `IfNotPresent` |
-| `volumePermissions.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` |
-| `volumePermissions.resources.limits` | Init container volume-permissions resource limits | `{}` |
-| `volumePermissions.resources.requests` | Init container volume-permissions resource requests | `{}` |
-| `volumePermissions.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `nil` |
-| `volumePermissions.containerSecurityContext.runAsUser` | User ID for the init container | `0` |
-
-### RBAC parameters
-
-| Name | Description | Value |
-| --------------------------------------------- | ----------------------------------------------------------- | ------- |
-| `serviceAccount.create` | Enable the creation of a ServiceAccount for MinIO® pods | `true` |
-| `serviceAccount.name` | Name of the created ServiceAccount | `""` |
-| `serviceAccount.automountServiceAccountToken` | Enable/disable auto mounting of the service account token | `false` |
-| `serviceAccount.annotations` | Custom annotations for MinIO® ServiceAccount | `{}` |
-
-### Other parameters
-
-| Name | Description | Value |
-| -------------------- | --------------------------------------------------------------------------------- | ------- |
-| `pdb.create` | Enable/disable a Pod Disruption Budget creation | `false` |
-| `pdb.minAvailable` | Minimum number/percentage of pods that must still be available after the eviction | `1` |
-| `pdb.maxUnavailable` | Maximum number/percentage of pods that may be made unavailable after the eviction | `""` |
-
-### Metrics parameters
-
-| Name | Description | Value |
-| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
-| `metrics.prometheusAuthType` | Authentication mode for Prometheus (`jwt` or `public`) | `public` |
-| `metrics.serviceMonitor.enabled` | If the operator is installed in your cluster, set to true to create a Service Monitor Entry | `false` |
-| `metrics.serviceMonitor.namespace` | Namespace which Prometheus is running in | `""` |
-| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` |
-| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in Prometheus | `""` |
-| `metrics.serviceMonitor.paths` | HTTP paths to scrape for metrics | `["/minio/v2/metrics/cluster","/minio/v2/metrics/node"]` |
-| `metrics.serviceMonitor.interval` | Interval at which metrics should be scraped | `30s` |
-| `metrics.serviceMonitor.scrapeTimeout` | Specify the timeout after which the scrape is ended | `""` |
-| `metrics.serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion | `[]` |
-| `metrics.serviceMonitor.relabelings` | Metrics relabelings to add to the scrape endpoint, applied before scraping | `[]` |
-| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` |
-| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` |
-| `metrics.serviceMonitor.apiVersion` | ApiVersion for the serviceMonitor Resource (defaults to "monitoring.coreos.com/v1") | `""` |
-| `metrics.serviceMonitor.tlsConfig` | Additional TLS configuration for metrics endpoint with "https" scheme | `{}` |
-| `metrics.prometheusRule.enabled` | Create a Prometheus Operator PrometheusRule (also requires `metrics.enabled` to be `true` and `metrics.prometheusRule.rules`) | `false` |
-| `metrics.prometheusRule.namespace` | Namespace for the PrometheusRule Resource (defaults to the Release Namespace) | `""` |
-| `metrics.prometheusRule.additionalLabels` | Additional labels that can be used so PrometheusRule will be discovered by Prometheus | `{}` |
-| `metrics.prometheusRule.rules` | Prometheus Rule definitions | `[]` |
-
-Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
-
-```console
-helm install my-release \
- --set auth.rootUser=minio-admin \
- --set auth.rootPassword=minio-secret-password \
- oci://REGISTRY_NAME/REPOSITORY_NAME/minio
-```
-
-> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
-
-The above command sets the MinIO® Server root user and password to `minio-admin` and `minio-secret-password`, respectively.
+### Installing the Chart (toy-setup)
-Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
+Minimal toy setup for testing purposes can be deployed using:
-```console
-helm install my-release -f values.yaml oci://REGISTRY_NAME/REPOSITORY_NAME/minio
+```bash
+helm install --set resources.requests.memory=512Mi --set replicas=1 --set persistence.enabled=false --set mode=standalone --set rootUser=rootuser,rootPassword=rootpass123 --generate-name minio/minio
```
-> Note: You need to substitute the placeholders `REGISTRY_NAME` and `REPOSITORY_NAME` with a reference to your Helm chart registry and repository. For example, in the case of Bitnami, you need to use `REGISTRY_NAME=registry-1.docker.io` and `REPOSITORY_NAME=bitnamicharts`.
-> **Tip**: You can use the default [values.yaml](https://github.com/bitnami/charts/tree/main/bitnami/minio/values.yaml)
-
-## Configuration and installation details
-
-### [Rolling VS Immutable tags](https://docs.bitnami.com/tutorials/understand-rolling-tags-containers)
-
-It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.
+### Upgrading the Chart
-Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.
+You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command:
-### Distributed mode
-
-By default, this chart provisions a MinIO® server in standalone mode. You can start MinIO® server in [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide) with the following parameter: `mode=distributed`
-
-This chart bootstrap MinIO® server in distributed mode with 4 nodes by default. You can change the number of nodes using the `statefulset.replicaCount` parameter. For instance, you can deploy the chart with 8 nodes using the following parameters:
-
-```console
-mode=distributed
-statefulset.replicaCount=8
+```bash
+helm get values my-release > old_values.yaml
```
-You can also bootstrap MinIO® server in distributed mode in several zones, and using multiple drives per node. For instance, you can deploy the chart with 2 nodes per zone on 2 zones, using 2 drives per node:
+Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using
-```console
-mode=distributed
-statefulset.replicaCount=2
-statefulset.zones=2
-statefulset.drivesPerNode=2
+```bash
+helm upgrade -f old_values.yaml my-release minio/minio
```
-> Note: The total number of drives should be greater than 4 to guarantee erasure coding. Please set a combination of nodes, and drives per node that match this condition.
+Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy.
-### Prometheus exporter
+### Configuration
-MinIO® exports Prometheus metrics at `/minio/v2/metrics/cluster`. To allow Prometheus collecting your MinIO® metrics, modify the `values.yaml` adding the corresponding annotations:
+Refer the [Values file](./values.yaml) for all the possible config fields.
-```diff
-- podAnnotations: {}
-+ podAnnotations:
-+ prometheus.io/scrape: "true"
-+ prometheus.io/path: "/minio/v2/metrics/cluster"
-+ prometheus.io/port: "9000"
+You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
+
+```bash
+helm install --name my-release --set persistence.size=1Ti minio/minio
```
-> Find more information about MinIO® metrics at
+The above command deploys MinIO server with a 1Ti backing persistent volume.
-## Persistence
+Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example,
-The [Bitnami Object Storage based on MinIO(®)](https://github.com/bitnami/containers/tree/main/bitnami/minio) image stores data at the `/data` path of the container.
+```bash
+helm install --name my-release -f values.yaml minio/minio
+```
-The chart mounts a [Persistent Volume](https://kubernetes.io/docs/concepts/storage/persistent-volumes/) at this location. The volume is created using dynamic volume provisioning.
+### Persistence
-### Adjust permissions of persistent volume mountpoint
+This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by:
-As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it.
+```bash
+helm install --set persistence.enabled=false minio/minio
+```
-By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions.
-As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination.
+> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."*
-You can enable this initContainer by setting `volumePermissions.enabled` to `true`.
+### Existing PersistentVolumeClaim
-### Ingress
+If a Persistent Volume Claim already exists, specify it during installation.
-This chart provides support for Ingress resources. If you have an ingress controller installed on your cluster, such as [nginx-ingress-controller](https://github.com/bitnami/charts/tree/main/bitnami/nginx-ingress-controller) or [contour](https://github.com/bitnami/charts/tree/main/bitnami/contour) you can utilize the ingress controller to serve your application.To enable Ingress integration, set `ingress.enabled` to `true`.
+1. Create the PersistentVolume
+2. Create the PersistentVolumeClaim
+3. Install the chart
-The most common scenario is to have one host name mapped to the deployment. In this case, the `ingress.hostname` property can be used to set the host name. The `ingress.tls` parameter can be used to add the TLS configuration for this host.
+```bash
+helm install --set persistence.existingClaim=PVC_NAME minio/minio
+```
-However, it is also possible to have more than one host. To facilitate this, the `ingress.extraHosts` parameter (if available) can be set with the host names specified as an array. The `ingress.extraTLS` parameter (if available) can also be used to add the TLS configuration for extra hosts.
+### NetworkPolicy
-> NOTE: For each host specified in the `ingress.extraHosts` parameter, it is necessary to set a name, path, and any annotations that the Ingress controller should know about. Not all annotations are supported by all Ingress controllers, but [this annotation reference document](https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md) lists the annotations supported by many popular Ingress controllers.
+To enable network policy for MinIO,
+install [a networking plugin that implements the Kubernetes
+NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin),
+and set `networkPolicy.enabled` to `true`.
-Adding the TLS parameter (where available) will cause the chart to generate HTTPS URLs, and the application will be available on port 443. The actual TLS secrets do not have to be generated by this chart. However, if TLS is enabled, the Ingress record will not work until the TLS secret exists.
+For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting
+the DefaultDeny namespace annotation. Note: this will enforce policy for *all* pods in the namespace:
-[Learn more about Ingress controllers](https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/).
+```
+kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}"
+```
-### TLS secrets
+When using `Cilium` as a CNI in your cluster, please edit the `flavor` field to `cilium`.
-This chart facilitates the creation of TLS secrets for use with the Ingress controller (although this is not mandatory). There are several common use cases:
+With NetworkPolicy enabled, traffic will be limited to just port 9000.
-- Generate certificate secrets based on chart parameters.
-- Enable externally generated certificates.
-- Manage application certificates via an external service (like [cert-manager](https://github.com/jetstack/cert-manager/)).
-- Create self-signed certificates within the chart (if supported).
+For more precise policy, set `networkPolicy.allowExternal=true`. This will
+only allow pods with the generated client label to connect to MinIO.
+This label will be displayed in the output of a successful install.
-In the first two cases, a certificate and a key are needed. Files are expected in `.pem` format.
+### Existing secret
-Here is an example of a certificate file:
+Instead of having this chart create the secret for you, you can supply a preexisting secret, much
+like an existing PersistentVolumeClaim.
-> NOTE: There may be more than one certificate if there is a certificate chain.
+First, create the secret:
-```text
------BEGIN CERTIFICATE-----
-MIID6TCCAtGgAwIBAgIJAIaCwivkeB5EMA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNV
-...
-jScrvkiBO65F46KioCL9h5tDvomdU1aqpI/CBzhvZn1c0ZTf87tGQR8NK7v7
------END CERTIFICATE-----
+```bash
+kubectl create secret generic my-minio-secret --from-literal=rootUser=foobarbaz --from-literal=rootPassword=foobarbazqux
```
-Here is an example of a certificate key:
+Then install the chart, specifying that you want to use an existing secret:
-```text
------BEGIN RSA PRIVATE KEY-----
-MIIEogIBAAKCAQEAvLYcyu8f3skuRyUgeeNpeDvYBCDcgq+LsWap6zbX5f8oLqp4
-...
-wrj2wDbCDCFmfqnSJ+dKI3vFLlEz44sAV8jX/kd4Y6ZTQhlLbYc=
------END RSA PRIVATE KEY-----
+```bash
+helm install --set existingSecret=my-minio-secret minio/minio
```
-- If using Helm to manage the certificates based on the parameters, copy these values into the `certificate` and `key` values for a given `*.ingress.secrets` entry.
-- If managing TLS secrets separately, it is necessary to create a TLS secret with name `INGRESS_HOSTNAME-tls` (where INGRESS_HOSTNAME is a placeholder to be replaced with the hostname you set using the `*.ingress.hostname` parameter).
-- If your cluster has a [cert-manager](https://github.com/jetstack/cert-manager) add-on to automate the management and issuance of TLS certificates, add to `*.ingress.annotations` the [corresponding ones](https://cert-manager.io/docs/usage/ingress/#supported-annotations) for cert-manager.
-- If using self-signed certificates created by Helm, set both `*.ingress.tls` and `*.ingress.selfSigned` to `true`.
+The following fields are expected in the secret:
-### Adding extra environment variables
-
-In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the `extraEnvVars` property.
-
-```yaml
-extraEnvVars:
- - name: MINIO_LOG_LEVEL
- value: DEBUG
-```
+| .data.\ in Secret | Corresponding variable | Description | Required |
+|:------------------------|:-----------------------|:---------------|:---------|
+| `rootUser` | `rootUser` | Root user. | yes |
+| `rootPassword` | `rootPassword` | Root password. | yes |
-Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the `extraEnvVarsCM` or the `extraEnvVarsSecret` values.
+All corresponding variables will be ignored in values file.
-### Sidecars and Init Containers
+### Configure TLS
-If you have a need for additional containers to run within the same pod as the MinIO® app (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec.
+To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using
-```yaml
-sidecars:
- - name: your-image-name
- image: your-image
- imagePullPolicy: Always
- ports:
- - name: portname
- containerPort: 1234
+```bash
+kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt
```
-Similarly, you can add extra init containers using the `initContainers` parameter.
+Then install the chart, specifying that you want to use the TLS secret:
-```yaml
-initContainers:
- - name: your-image-name
- image: your-image
- imagePullPolicy: Always
- ports:
- - name: portname
- containerPort: 1234
+```bash
+helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio
```
-### Setting Pod's affinity
+### Installing certificates from third party CAs
-This chart allows you to set your custom affinity using the `affinity` parameter. Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity).
+MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include MinIO's own certificate with key `public.crt`, if it also needs to be trusted.
-As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/main/bitnami/common#affinities) chart. To do so, set the `podAffinityPreset`, `podAntiAffinityPreset`, or `nodeAffinityPreset` parameters.
+For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`:
-### Deploying extra resources
-
-There are cases where you may want to deploy extra objects, such a ConfigMap containing your app's configuration or some extra deployment with a micro service used by your app. For covering this case, the chart allows adding the full specification of other objects using the `extraDeploy` parameter.
-
-## Troubleshooting
-
-Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues).
+```
+kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt
+```
-## Upgrading
+If TLS is not enabled, you would need only the third party CA:
-### To 12.0.0
+```
+kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt
+```
-This version updates MinIO® to major version 2023. All gateway features have been removed from Minio since upstream completely dropped this feature. The related options have been removed in version 12.1.0.
+The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter:
-### To 11.0.0
+```
+trustedCertsSecret: "minio-trusted-certs"
-This version deprecates the usage of `MINIO_ACCESS_KEY` and `MINIO_SECRET_KEY` environment variables in MINIO® container in favor of `MINIO_ROOT_USER` and `MINIO_ROOT_PASSWORD`.
+or
-If you were already using the new variables, no issues are expected during upgrade.
+--set trustedCertsSecret=minio-trusted-certs
+```
-### To 9.0.0
+### Create buckets after install
-This version updates MinIO® authentication parameters so they're aligned with the [current terminology](https://docs.min.io/minio/baremetal/security/minio-identity-management/user-management.html#minio-users-root). As a result the following parameters have been affected:
+Install the chart, specifying the buckets you want to create after install:
-- `accessKey.password` has been renamed to `auth.rootUser`.
-- `secretKey.password` has been renamed to `auth.rootPassword`.
-- `accessKey.forcePassword` and `secretKey.forcePassword` have been unified into `auth.forcePassword`.
-- `existingSecret`, `useCredentialsFile` and `forceNewKeys` have been renamed to `auth.existingSecret`, `auth.useCredentialsFiles` and `forceNewKeys`, respectively.
+```bash
+helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio
+```
-### To 8.0.0
+Description of the configuration parameters used above -
-This version updates MinIO® after some major changes, affecting its Web UI. MinIO® has replaced its MinIO® Browser with the MinIO® Console, and Web UI has been moved to a separated port. As a result the following variables have been affected:
+- `buckets[].name` - name of the bucket to create, must be a string with length > 0
+- `buckets[].policy` - can be one of none|download|upload|public
+- `buckets[].purge` - purge if bucket exists already
-- `service.port` has been slit into `service.ports.api` (default: 9000) and `service.ports.console` (default: 9001).
-- `containerPort` has been slit into `containerPorts.api` (default: 9000) and `containerPort.console` (default: 9001).
-- `service.nodePort`has been slit into `service.nodePorts.api` and `service.nodePorts.console`.
-- Service port `minio` has been replaced with `minio-api` and `minio-console` with target ports minio-api and minio-console respectively.
-- Liveness, readiness and startup probes now use port `minio-console` instead of `minio`.
+### Create policies after install
-Please note that Web UI, previously running on port 9000 will now use port 9001 leaving port 9000 for the MinIO® Server API.
+Install the chart, specifying the policies you want to create after install:
-### To 7.0.0
+```bash
+helm install --set policies[0].name=mypolicy,policies[0].statements[0].resources[0]='arn:aws:s3:::bucket1',policies[0].statements[0].actions[0]='s3:ListBucket',policies[0].statements[0].actions[1]='s3:GetObject' minio/minio
+```
-This version introduces pod and container securityContext support. The previous configuration of `securityContext` has moved to `podSecurityContext` and `containerSecurityContext`. Apart from this case, no issues are expected to appear when upgrading.
+Description of the configuration parameters used above -
-### To 5.0.0
+- `policies[].name` - name of the policy to create, must be a string with length > 0
+- `policies[].statements[]` - list of statements, includes actions and resources
+- `policies[].statements[].resources[]` - list of resources that applies the statement
+- `policies[].statements[].actions[]` - list of actions granted
-This version standardizes the way of defining Ingress rules. When configuring a single hostname for the Ingress rule, set the `ingress.hostname` value. When defining more than one, set the `ingress.extraHosts` array. Apart from this case, no issues are expected to appear when upgrading.
+### Create user after install
-### To 4.1.0
+Install the chart, specifying the users you want to create after install:
-This version introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/main/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade.
+```bash
+helm install --set users[0].accessKey=accessKey,users[0].secretKey=secretKey,users[0].policy=none,users[1].accessKey=accessKey2,users[1].secretRef=existingSecret,users[1].secretKey=password,users[1].policy=none minio/minio
+```
-### To 4.0.0
+Description of the configuration parameters used above -
-[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL.
+- `users[].accessKey` - accessKey of user
+- `users[].secretKey` - secretKey of usersecretRef
+- `users[].existingSecret` - secret name that contains the secretKey of user
+- `users[].existingSecretKey` - data key in existingSecret secret containing the secretKey
+- `users[].policy` - name of the policy to assign to user
-#### What changes were introduced in this major version?
+### Create service account after install
-- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field.
-- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts
+Install the chart, specifying the service accounts you want to create after install:
-#### Considerations when upgrading to this version
+```bash
+helm install --set svcaccts[0].accessKey=accessKey,svcaccts[0].secretKey=secretKey,svcaccts[0].user=parentUser,svcaccts[1].accessKey=accessKey2,svcaccts[1].secretRef=existingSecret,svcaccts[1].secretKey=password,svcaccts[1].user=parentUser2 minio/minio
+```
-- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues
-- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore
-- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3
+Description of the configuration parameters used above -
-#### Useful links
+- `svcaccts[].accessKey` - accessKey of service account
+- `svcaccts[].secretKey` - secretKey of svcacctsecretRef
+- `svcaccts[].existingSecret` - secret name that contains the secretKey of service account
+- `svcaccts[].existingSecretKey` - data key in existingSecret secret containing the secretKey
+- `svcaccts[].user` - name of the parent user to assign to service account
--
--
--
+## Uninstalling the Chart
-## License
+Assuming your release is named as `my-release`, delete it using the command:
-Copyright © 2024 Broadcom. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
+```bash
+helm delete my-release
+```
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
+or
-
+```bash
+helm uninstall my-release
+```
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
\ No newline at end of file
+The command removes all the Kubernetes components associated with the chart and deletes the release.
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/.helmignore b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/.helmignore
deleted file mode 100644
index 50af03172..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/.helmignore
+++ /dev/null
@@ -1,22 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/Chart.yaml b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/Chart.yaml
deleted file mode 100644
index 9a6aa881f..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/Chart.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-annotations:
- category: Infrastructure
- licenses: Apache-2.0
-apiVersion: v2
-appVersion: 2.14.1
-description: A Library Helm Chart for grouping common logic between bitnami charts.
- This chart is not deployable by itself.
-home: https://bitnami.com
-icon: https://bitnami.com/downloads/logos/bitnami-mark.png
-keywords:
-- common
-- helper
-- template
-- function
-- bitnami
-maintainers:
-- name: VMware, Inc.
- url: https://github.com/bitnami/charts
-name: common
-sources:
-- https://github.com/bitnami/charts
-type: library
-version: 2.14.1
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/README.md b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/README.md
deleted file mode 100644
index a76fa46a2..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/README.md
+++ /dev/null
@@ -1,235 +0,0 @@
-# Bitnami Common Library Chart
-
-A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between Bitnami charts.
-
-## TL;DR
-
-```yaml
-dependencies:
- - name: common
- version: 2.x.x
- repository: oci://registry-1.docker.io/bitnamicharts
-```
-
-```console
-helm dependency update
-```
-
-```yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: {{ include "common.names.fullname" . }}
-data:
- myvalue: "Hello World"
-```
-
-Looking to use our applications in production? Try [VMware Tanzu Application Catalog](https://bitnami.com/enterprise), the enterprise edition of Bitnami Application Catalog.
-
-## Introduction
-
-This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager.
-
-Bitnami charts can be used with [Kubeapps](https://kubeapps.dev/) for deployment and management of Helm Charts in clusters.
-
-## Prerequisites
-
-- Kubernetes 1.23+
-- Helm 3.8.0+
-
-## Parameters
-
-## Special input schemas
-
-### ImageRoot
-
-```yaml
-registry:
- type: string
- description: Docker registry where the image is located
- example: docker.io
-
-repository:
- type: string
- description: Repository and image name
- example: bitnami/nginx
-
-tag:
- type: string
- description: image tag
- example: 1.16.1-debian-10-r63
-
-pullPolicy:
- type: string
- description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-
-pullSecrets:
- type: array
- items:
- type: string
- description: Optionally specify an array of imagePullSecrets (evaluated as templates).
-
-debug:
- type: boolean
- description: Set to true if you would like to see extra information on logs
- example: false
-
-## An instance would be:
-# registry: docker.io
-# repository: bitnami/nginx
-# tag: 1.16.1-debian-10-r63
-# pullPolicy: IfNotPresent
-# debug: false
-```
-
-### Persistence
-
-```yaml
-enabled:
- type: boolean
- description: Whether enable persistence.
- example: true
-
-storageClass:
- type: string
- description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning.
- example: "-"
-
-accessMode:
- type: string
- description: Access mode for the Persistent Volume Storage.
- example: ReadWriteOnce
-
-size:
- type: string
- description: Size the Persistent Volume Storage.
- example: 8Gi
-
-path:
- type: string
- description: Path to be persisted.
- example: /bitnami
-
-## An instance would be:
-# enabled: true
-# storageClass: "-"
-# accessMode: ReadWriteOnce
-# size: 8Gi
-# path: /bitnami
-```
-
-### ExistingSecret
-
-```yaml
-name:
- type: string
- description: Name of the existing secret.
- example: mySecret
-keyMapping:
- description: Mapping between the expected key name and the name of the key in the existing secret.
- type: object
-
-## An instance would be:
-# name: mySecret
-# keyMapping:
-# password: myPasswordKey
-```
-
-#### Example of use
-
-When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets.
-
-```yaml
-# templates/secret.yaml
----
-apiVersion: v1
-kind: Secret
-metadata:
- name: {{ include "common.names.fullname" . }}
- labels:
- app: {{ include "common.names.fullname" . }}
-type: Opaque
-data:
- password: {{ .Values.password | b64enc | quote }}
-
-# templates/dpl.yaml
----
-...
- env:
- - name: PASSWORD
- valueFrom:
- secretKeyRef:
- name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }}
- key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }}
-...
-
-# values.yaml
----
-name: mySecret
-keyMapping:
- password: myPasswordKey
-```
-
-### ValidateValue
-
-#### NOTES.txt
-
-```console
-{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}}
-{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}}
-
-{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
-```
-
-If we force those values to be empty we will see some alerts
-
-```console
-helm install test mychart --set path.to.value00="",path.to.value01=""
- 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value:
-
- export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 -d)
-
- 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value:
-
- export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 -d)
-```
-
-## Upgrading
-
-### To 1.0.0
-
-[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL.
-
-#### What changes were introduced in this major version?
-
-- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field.
-- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information.
-- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts
-
-#### Considerations when upgrading to this version
-
-- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues
-- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore
-- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3
-
-#### Useful links
-
--
--
--
-
-## License
-
-Copyright © 2023 VMware, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_affinities.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_affinities.tpl
deleted file mode 100644
index e85b1df45..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_affinities.tpl
+++ /dev/null
@@ -1,139 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-
-{{/*
-Return a soft nodeAffinity definition
-{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
-*/}}
-{{- define "common.affinities.nodes.soft" -}}
-preferredDuringSchedulingIgnoredDuringExecution:
- - preference:
- matchExpressions:
- - key: {{ .key }}
- operator: In
- values:
- {{- range .values }}
- - {{ . | quote }}
- {{- end }}
- weight: 1
-{{- end -}}
-
-{{/*
-Return a hard nodeAffinity definition
-{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
-*/}}
-{{- define "common.affinities.nodes.hard" -}}
-requiredDuringSchedulingIgnoredDuringExecution:
- nodeSelectorTerms:
- - matchExpressions:
- - key: {{ .key }}
- operator: In
- values:
- {{- range .values }}
- - {{ . | quote }}
- {{- end }}
-{{- end -}}
-
-{{/*
-Return a nodeAffinity definition
-{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
-*/}}
-{{- define "common.affinities.nodes" -}}
- {{- if eq .type "soft" }}
- {{- include "common.affinities.nodes.soft" . -}}
- {{- else if eq .type "hard" }}
- {{- include "common.affinities.nodes.hard" . -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Return a topologyKey definition
-{{ include "common.affinities.topologyKey" (dict "topologyKey" "BAR") -}}
-*/}}
-{{- define "common.affinities.topologyKey" -}}
-{{ .topologyKey | default "kubernetes.io/hostname" -}}
-{{- end -}}
-
-{{/*
-Return a soft podAffinity/podAntiAffinity definition
-{{ include "common.affinities.pods.soft" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "context" $) -}}
-*/}}
-{{- define "common.affinities.pods.soft" -}}
-{{- $component := default "" .component -}}
-{{- $customLabels := default (dict) .customLabels -}}
-{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
-{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
-preferredDuringSchedulingIgnoredDuringExecution:
- - podAffinityTerm:
- labelSelector:
- matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 10 }}
- {{- if not (empty $component) }}
- {{ printf "app.kubernetes.io/component: %s" $component }}
- {{- end }}
- {{- range $key, $value := $extraMatchLabels }}
- {{ $key }}: {{ $value | quote }}
- {{- end }}
- topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
- weight: 1
- {{- range $extraPodAffinityTerms }}
- - podAffinityTerm:
- labelSelector:
- matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 10 }}
- {{- if not (empty $component) }}
- {{ printf "app.kubernetes.io/component: %s" $component }}
- {{- end }}
- {{- range $key, $value := .extraMatchLabels }}
- {{ $key }}: {{ $value | quote }}
- {{- end }}
- topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
- weight: {{ .weight | default 1 -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Return a hard podAffinity/podAntiAffinity definition
-{{ include "common.affinities.pods.hard" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "context" $) -}}
-*/}}
-{{- define "common.affinities.pods.hard" -}}
-{{- $component := default "" .component -}}
-{{- $customLabels := default (dict) .customLabels -}}
-{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
-{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
-requiredDuringSchedulingIgnoredDuringExecution:
- - labelSelector:
- matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 8 }}
- {{- if not (empty $component) }}
- {{ printf "app.kubernetes.io/component: %s" $component }}
- {{- end }}
- {{- range $key, $value := $extraMatchLabels }}
- {{ $key }}: {{ $value | quote }}
- {{- end }}
- topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
- {{- range $extraPodAffinityTerms }}
- - labelSelector:
- matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 8 }}
- {{- if not (empty $component) }}
- {{ printf "app.kubernetes.io/component: %s" $component }}
- {{- end }}
- {{- range $key, $value := .extraMatchLabels }}
- {{ $key }}: {{ $value | quote }}
- {{- end }}
- topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Return a podAffinity/podAntiAffinity definition
-{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
-*/}}
-{{- define "common.affinities.pods" -}}
- {{- if eq .type "soft" }}
- {{- include "common.affinities.pods.soft" . -}}
- {{- else if eq .type "hard" }}
- {{- include "common.affinities.pods.hard" . -}}
- {{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_capabilities.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_capabilities.tpl
deleted file mode 100644
index 115674af8..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_capabilities.tpl
+++ /dev/null
@@ -1,229 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-
-{{/*
-Return the target Kubernetes version
-*/}}
-{{- define "common.capabilities.kubeVersion" -}}
-{{- if .Values.global }}
- {{- if .Values.global.kubeVersion }}
- {{- .Values.global.kubeVersion -}}
- {{- else }}
- {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}}
- {{- end -}}
-{{- else }}
-{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for poddisruptionbudget.
-*/}}
-{{- define "common.capabilities.policy.apiVersion" -}}
-{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "policy/v1beta1" -}}
-{{- else -}}
-{{- print "policy/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for networkpolicy.
-*/}}
-{{- define "common.capabilities.networkPolicy.apiVersion" -}}
-{{- if semverCompare "<1.7-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "extensions/v1beta1" -}}
-{{- else -}}
-{{- print "networking.k8s.io/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for cronjob.
-*/}}
-{{- define "common.capabilities.cronjob.apiVersion" -}}
-{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "batch/v1beta1" -}}
-{{- else -}}
-{{- print "batch/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for daemonset.
-*/}}
-{{- define "common.capabilities.daemonset.apiVersion" -}}
-{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "extensions/v1beta1" -}}
-{{- else -}}
-{{- print "apps/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for deployment.
-*/}}
-{{- define "common.capabilities.deployment.apiVersion" -}}
-{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "extensions/v1beta1" -}}
-{{- else -}}
-{{- print "apps/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for statefulset.
-*/}}
-{{- define "common.capabilities.statefulset.apiVersion" -}}
-{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "apps/v1beta1" -}}
-{{- else -}}
-{{- print "apps/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for ingress.
-*/}}
-{{- define "common.capabilities.ingress.apiVersion" -}}
-{{- if .Values.ingress -}}
-{{- if .Values.ingress.apiVersion -}}
-{{- .Values.ingress.apiVersion -}}
-{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "extensions/v1beta1" -}}
-{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "networking.k8s.io/v1beta1" -}}
-{{- else -}}
-{{- print "networking.k8s.io/v1" -}}
-{{- end }}
-{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "extensions/v1beta1" -}}
-{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "networking.k8s.io/v1beta1" -}}
-{{- else -}}
-{{- print "networking.k8s.io/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for RBAC resources.
-*/}}
-{{- define "common.capabilities.rbac.apiVersion" -}}
-{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "rbac.authorization.k8s.io/v1beta1" -}}
-{{- else -}}
-{{- print "rbac.authorization.k8s.io/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for CRDs.
-*/}}
-{{- define "common.capabilities.crd.apiVersion" -}}
-{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "apiextensions.k8s.io/v1beta1" -}}
-{{- else -}}
-{{- print "apiextensions.k8s.io/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for APIService.
-*/}}
-{{- define "common.capabilities.apiService.apiVersion" -}}
-{{- if semverCompare "<1.10-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "apiregistration.k8s.io/v1beta1" -}}
-{{- else -}}
-{{- print "apiregistration.k8s.io/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for Horizontal Pod Autoscaler.
-*/}}
-{{- define "common.capabilities.hpa.apiVersion" -}}
-{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}}
-{{- if .beta2 -}}
-{{- print "autoscaling/v2beta2" -}}
-{{- else -}}
-{{- print "autoscaling/v2beta1" -}}
-{{- end -}}
-{{- else -}}
-{{- print "autoscaling/v2" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for Vertical Pod Autoscaler.
-*/}}
-{{- define "common.capabilities.vpa.apiVersion" -}}
-{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .context) -}}
-{{- if .beta2 -}}
-{{- print "autoscaling/v2beta2" -}}
-{{- else -}}
-{{- print "autoscaling/v2beta1" -}}
-{{- end -}}
-{{- else -}}
-{{- print "autoscaling/v2" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Returns true if PodSecurityPolicy is supported
-*/}}
-{{- define "common.capabilities.psp.supported" -}}
-{{- if semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .) -}}
- {{- true -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Returns true if AdmissionConfiguration is supported
-*/}}
-{{- define "common.capabilities.admissionConfiguration.supported" -}}
-{{- if semverCompare ">=1.23-0" (include "common.capabilities.kubeVersion" .) -}}
- {{- true -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for AdmissionConfiguration.
-*/}}
-{{- define "common.capabilities.admissionConfiguration.apiVersion" -}}
-{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "apiserver.config.k8s.io/v1alpha1" -}}
-{{- else if semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "apiserver.config.k8s.io/v1beta1" -}}
-{{- else -}}
-{{- print "apiserver.config.k8s.io/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the appropriate apiVersion for PodSecurityConfiguration.
-*/}}
-{{- define "common.capabilities.podSecurityConfiguration.apiVersion" -}}
-{{- if semverCompare "<1.23-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "pod-security.admission.config.k8s.io/v1alpha1" -}}
-{{- else if semverCompare "<1.25-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "pod-security.admission.config.k8s.io/v1beta1" -}}
-{{- else -}}
-{{- print "pod-security.admission.config.k8s.io/v1" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Returns true if the used Helm version is 3.3+.
-A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure.
-This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error.
-**To be removed when the catalog's minimun Helm version is 3.3**
-*/}}
-{{- define "common.capabilities.supportsHelmVersion" -}}
-{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }}
- {{- true -}}
-{{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_errors.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_errors.tpl
deleted file mode 100644
index 07ded6f64..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_errors.tpl
+++ /dev/null
@@ -1,28 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Through error when upgrading using empty passwords values that must not be empty.
-
-Usage:
-{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}}
-{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}}
-{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }}
-
-Required password params:
- - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error.
- - context - Context - Required. Parent context.
-*/}}
-{{- define "common.errors.upgrade.passwords.empty" -}}
- {{- $validationErrors := join "" .validationErrors -}}
- {{- if and $validationErrors .context.Release.IsUpgrade -}}
- {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}}
- {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}}
- {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}}
- {{- $errorString = print $errorString "\n%s" -}}
- {{- printf $errorString $validationErrors | fail -}}
- {{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_images.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_images.tpl
deleted file mode 100644
index 1bcb779df..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_images.tpl
+++ /dev/null
@@ -1,117 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Return the proper image name
-{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" .Values.global ) }}
-*/}}
-{{- define "common.images.image" -}}
-{{- $registryName := .imageRoot.registry -}}
-{{- $repositoryName := .imageRoot.repository -}}
-{{- $separator := ":" -}}
-{{- $termination := .imageRoot.tag | toString -}}
-{{- if .global }}
- {{- if .global.imageRegistry }}
- {{- $registryName = .global.imageRegistry -}}
- {{- end -}}
-{{- end -}}
-{{- if .imageRoot.digest }}
- {{- $separator = "@" -}}
- {{- $termination = .imageRoot.digest | toString -}}
-{{- end -}}
-{{- if $registryName }}
- {{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}}
-{{- else -}}
- {{- printf "%s%s%s" $repositoryName $separator $termination -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
-{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
-*/}}
-{{- define "common.images.pullSecrets" -}}
- {{- $pullSecrets := list }}
-
- {{- if .global }}
- {{- range .global.imagePullSecrets -}}
- {{- if kindIs "map" . -}}
- {{- $pullSecrets = append $pullSecrets .name -}}
- {{- else -}}
- {{- $pullSecrets = append $pullSecrets . -}}
- {{- end }}
- {{- end -}}
- {{- end -}}
-
- {{- range .images -}}
- {{- range .pullSecrets -}}
- {{- if kindIs "map" . -}}
- {{- $pullSecrets = append $pullSecrets .name -}}
- {{- else -}}
- {{- $pullSecrets = append $pullSecrets . -}}
- {{- end -}}
- {{- end -}}
- {{- end -}}
-
- {{- if (not (empty $pullSecrets)) }}
-imagePullSecrets:
- {{- range $pullSecrets | uniq }}
- - name: {{ . }}
- {{- end }}
- {{- end }}
-{{- end -}}
-
-{{/*
-Return the proper Docker Image Registry Secret Names evaluating values as templates
-{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }}
-*/}}
-{{- define "common.images.renderPullSecrets" -}}
- {{- $pullSecrets := list }}
- {{- $context := .context }}
-
- {{- if $context.Values.global }}
- {{- range $context.Values.global.imagePullSecrets -}}
- {{- if kindIs "map" . -}}
- {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}}
- {{- else -}}
- {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
- {{- end -}}
- {{- end -}}
- {{- end -}}
-
- {{- range .images -}}
- {{- range .pullSecrets -}}
- {{- if kindIs "map" . -}}
- {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" $context)) -}}
- {{- else -}}
- {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}}
- {{- end -}}
- {{- end -}}
- {{- end -}}
-
- {{- if (not (empty $pullSecrets)) }}
-imagePullSecrets:
- {{- range $pullSecrets | uniq }}
- - name: {{ . }}
- {{- end }}
- {{- end }}
-{{- end -}}
-
-{{/*
-Return the proper image version (ingores image revision/prerelease info & fallbacks to chart appVersion)
-{{ include "common.images.version" ( dict "imageRoot" .Values.path.to.the.image "chart" .Chart ) }}
-*/}}
-{{- define "common.images.version" -}}
-{{- $imageTag := .imageRoot.tag | toString -}}
-{{/* regexp from https://github.com/Masterminds/semver/blob/23f51de38a0866c5ef0bfc42b3f735c73107b700/version.go#L41-L44 */}}
-{{- if regexMatch `^([0-9]+)(\.[0-9]+)?(\.[0-9]+)?(-([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?$` $imageTag -}}
- {{- $version := semver $imageTag -}}
- {{- printf "%d.%d.%d" $version.Major $version.Minor $version.Patch -}}
-{{- else -}}
- {{- print .chart.AppVersion -}}
-{{- end -}}
-{{- end -}}
-
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_ingress.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_ingress.tpl
deleted file mode 100644
index efa5b85c7..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_ingress.tpl
+++ /dev/null
@@ -1,73 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-
-{{/*
-Generate backend entry that is compatible with all Kubernetes API versions.
-
-Usage:
-{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }}
-
-Params:
- - serviceName - String. Name of an existing service backend
- - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer.
- - context - Dict - Required. The context for the template evaluation.
-*/}}
-{{- define "common.ingress.backend" -}}
-{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}}
-{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}}
-serviceName: {{ .serviceName }}
-servicePort: {{ .servicePort }}
-{{- else -}}
-service:
- name: {{ .serviceName }}
- port:
- {{- if typeIs "string" .servicePort }}
- name: {{ .servicePort }}
- {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }}
- number: {{ .servicePort | int }}
- {{- end }}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Print "true" if the API pathType field is supported
-Usage:
-{{ include "common.ingress.supportsPathType" . }}
-*/}}
-{{- define "common.ingress.supportsPathType" -}}
-{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}}
-{{- print "false" -}}
-{{- else -}}
-{{- print "true" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Returns true if the ingressClassname field is supported
-Usage:
-{{ include "common.ingress.supportsIngressClassname" . }}
-*/}}
-{{- define "common.ingress.supportsIngressClassname" -}}
-{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}}
-{{- print "false" -}}
-{{- else -}}
-{{- print "true" -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Return true if cert-manager required annotations for TLS signed
-certificates are set in the Ingress annotations
-Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
-Usage:
-{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }}
-*/}}
-{{- define "common.ingress.certManagerRequest" -}}
-{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") (hasKey .annotations "kubernetes.io/tls-acme") }}
- {{- true -}}
-{{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_labels.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_labels.tpl
deleted file mode 100644
index d90a6cdc0..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_labels.tpl
+++ /dev/null
@@ -1,46 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-
-{{/*
-Kubernetes standard labels
-{{ include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) -}}
-*/}}
-{{- define "common.labels.standard" -}}
-{{- if and (hasKey . "customLabels") (hasKey . "context") -}}
-{{- $default := dict "app.kubernetes.io/name" (include "common.names.name" .context) "helm.sh/chart" (include "common.names.chart" .context) "app.kubernetes.io/instance" .context.Release.Name "app.kubernetes.io/managed-by" .context.Release.Service -}}
-{{- with .context.Chart.AppVersion -}}
-{{- $_ := set $default "app.kubernetes.io/version" . -}}
-{{- end -}}
-{{ template "common.tplvalues.merge" (dict "values" (list .customLabels $default) "context" .context) }}
-{{- else -}}
-app.kubernetes.io/name: {{ include "common.names.name" . }}
-helm.sh/chart: {{ include "common.names.chart" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- with .Chart.AppVersion }}
-app.kubernetes.io/version: {{ . | quote }}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Labels used on immutable fields such as deploy.spec.selector.matchLabels or svc.spec.selector
-{{ include "common.labels.matchLabels" (dict "customLabels" .Values.podLabels "context" $) -}}
-
-We don't want to loop over custom labels appending them to the selector
-since it's very likely that it will break deployments, services, etc.
-However, it's important to overwrite the standard labels if the user
-overwrote them on metadata.labels fields.
-*/}}
-{{- define "common.labels.matchLabels" -}}
-{{- if and (hasKey . "customLabels") (hasKey . "context") -}}
-{{ merge (pick (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) "app.kubernetes.io/name" "app.kubernetes.io/instance") (dict "app.kubernetes.io/name" (include "common.names.name" .context) "app.kubernetes.io/instance" .context.Release.Name ) | toYaml }}
-{{- else -}}
-app.kubernetes.io/name: {{ include "common.names.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_names.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_names.tpl
deleted file mode 100644
index a222924f1..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_names.tpl
+++ /dev/null
@@ -1,71 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "common.names.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "common.names.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "common.names.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Create a default fully qualified dependency name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-Usage:
-{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }}
-*/}}
-{{- define "common.names.dependency.fullname" -}}
-{{- if .chartValues.fullnameOverride -}}
-{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .chartName .chartValues.nameOverride -}}
-{{- if contains $name .context.Release.Name -}}
-{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
-*/}}
-{{- define "common.names.namespace" -}}
-{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{/*
-Create a fully qualified app name adding the installation's namespace.
-*/}}
-{{- define "common.names.fullname.namespace" -}}
-{{- printf "%s-%s" (include "common.names.fullname" .) (include "common.names.namespace" .) | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_secrets.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_secrets.tpl
deleted file mode 100644
index 84dbe3803..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_secrets.tpl
+++ /dev/null
@@ -1,182 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Generate secret name.
-
-Usage:
-{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }}
-
-Params:
- - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
- to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
- +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
- - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment.
- - context - Dict - Required. The context for the template evaluation.
-*/}}
-{{- define "common.secrets.name" -}}
-{{- $name := (include "common.names.fullname" .context) -}}
-
-{{- if .defaultNameSuffix -}}
-{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
-
-{{- with .existingSecret -}}
-{{- if not (typeIs "string" .) -}}
-{{- with .name -}}
-{{- $name = . -}}
-{{- end -}}
-{{- else -}}
-{{- $name = . -}}
-{{- end -}}
-{{- end -}}
-
-{{- printf "%s" $name -}}
-{{- end -}}
-
-{{/*
-Generate secret key.
-
-Usage:
-{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }}
-
-Params:
- - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user
- to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility.
- +info: https://github.com/bitnami/charts/tree/main/bitnami/common#existingsecret
- - key - String - Required. Name of the key in the secret.
-*/}}
-{{- define "common.secrets.key" -}}
-{{- $key := .key -}}
-
-{{- if .existingSecret -}}
- {{- if not (typeIs "string" .existingSecret) -}}
- {{- if .existingSecret.keyMapping -}}
- {{- $key = index .existingSecret.keyMapping $.key -}}
- {{- end -}}
- {{- end }}
-{{- end -}}
-
-{{- printf "%s" $key -}}
-{{- end -}}
-
-{{/*
-Generate secret password or retrieve one if already created.
-
-Usage:
-{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }}
-
-Params:
- - secret - String - Required - Name of the 'Secret' resource where the password is stored.
- - key - String - Required - Name of the key in the secret.
- - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
- - length - int - Optional - Length of the generated random password.
- - strong - Boolean - Optional - Whether to add symbols to the generated random password.
- - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart.
- - context - Context - Required - Parent context.
- - failOnNew - Boolean - Optional - Default to true. If set to false, skip errors adding new keys to existing secrets.
- - skipB64enc - Boolean - Optional - Default to false. If set to true, no the secret will not be base64 encrypted.
- - skipQuote - Boolean - Optional - Default to false. If set to true, no quotes will be added around the secret.
-The order in which this function returns a secret password:
- 1. Already existing 'Secret' resource
- (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned)
- 2. Password provided via the values.yaml
- (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned)
- 3. Randomly generated secret password
- (A new random secret password with the length specified in the 'length' parameter will be generated and returned)
-
-*/}}
-{{- define "common.secrets.passwords.manage" -}}
-
-{{- $password := "" }}
-{{- $subchart := "" }}
-{{- $chartName := default "" .chartName }}
-{{- $passwordLength := default 10 .length }}
-{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }}
-{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }}
-{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data }}
-{{- if $secretData }}
- {{- if hasKey $secretData .key }}
- {{- $password = index $secretData .key | b64dec }}
- {{- else if not (eq .failOnNew false) }}
- {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}}
- {{- else if $providedPasswordValue }}
- {{- $password = $providedPasswordValue | toString }}
- {{- end -}}
-{{- else if $providedPasswordValue }}
- {{- $password = $providedPasswordValue | toString }}
-{{- else }}
-
- {{- if .context.Values.enabled }}
- {{- $subchart = $chartName }}
- {{- end -}}
-
- {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}}
- {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}}
- {{- $passwordValidationErrors := list $requiredPasswordError -}}
- {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}}
-
- {{- if .strong }}
- {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }}
- {{- $password = randAscii $passwordLength }}
- {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }}
- {{- $password = printf "%s%s" $subStr $password | toString | shuffle }}
- {{- else }}
- {{- $password = randAlphaNum $passwordLength }}
- {{- end }}
-{{- end -}}
-{{- if not .skipB64enc }}
-{{- $password = $password | b64enc }}
-{{- end -}}
-{{- if .skipQuote -}}
-{{- printf "%s" $password -}}
-{{- else -}}
-{{- printf "%s" $password | quote -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Reuses the value from an existing secret, otherwise sets its value to a default value.
-
-Usage:
-{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }}
-
-Params:
- - secret - String - Required - Name of the 'Secret' resource where the password is stored.
- - key - String - Required - Name of the key in the secret.
- - defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
- - context - Context - Required - Parent context.
-
-*/}}
-{{- define "common.secrets.lookup" -}}
-{{- $value := "" -}}
-{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data -}}
-{{- if and $secretData (hasKey $secretData .key) -}}
- {{- $value = index $secretData .key -}}
-{{- else if .defaultValue -}}
- {{- $value = .defaultValue | toString | b64enc -}}
-{{- end -}}
-{{- if $value -}}
-{{- printf "%s" $value -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Returns whether a previous generated secret already exists
-
-Usage:
-{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }}
-
-Params:
- - secret - String - Required - Name of the 'Secret' resource where the password is stored.
- - context - Context - Required - Parent context.
-*/}}
-{{- define "common.secrets.exists" -}}
-{{- $secret := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret) }}
-{{- if $secret }}
- {{- true -}}
-{{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_storage.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_storage.tpl
deleted file mode 100644
index 16405a0f8..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_storage.tpl
+++ /dev/null
@@ -1,28 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Return the proper Storage Class
-{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }}
-*/}}
-{{- define "common.storage.class" -}}
-
-{{- $storageClass := .persistence.storageClass -}}
-{{- if .global -}}
- {{- if .global.storageClass -}}
- {{- $storageClass = .global.storageClass -}}
- {{- end -}}
-{{- end -}}
-
-{{- if $storageClass -}}
- {{- if (eq "-" $storageClass) -}}
- {{- printf "storageClassName: \"\"" -}}
- {{- else }}
- {{- printf "storageClassName: %s" $storageClass -}}
- {{- end -}}
-{{- end -}}
-
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_tplvalues.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_tplvalues.tpl
deleted file mode 100644
index a8ed7637e..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_tplvalues.tpl
+++ /dev/null
@@ -1,38 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Renders a value that contains template perhaps with scope if the scope is present.
-Usage:
-{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }}
-{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }}
-*/}}
-{{- define "common.tplvalues.render" -}}
-{{- $value := typeIs "string" .value | ternary .value (.value | toYaml) }}
-{{- if contains "{{" (toJson .value) }}
- {{- if .scope }}
- {{- tpl (cat "{{- with $.RelativeScope -}}" $value "{{- end }}") (merge (dict "RelativeScope" .scope) .context) }}
- {{- else }}
- {{- tpl $value .context }}
- {{- end }}
-{{- else }}
- {{- $value }}
-{{- end }}
-{{- end -}}
-
-{{/*
-Merge a list of values that contains template after rendering them.
-Merge precedence is consistent with http://masterminds.github.io/sprig/dicts.html#merge-mustmerge
-Usage:
-{{ include "common.tplvalues.merge" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }}
-*/}}
-{{- define "common.tplvalues.merge" -}}
-{{- $dst := dict -}}
-{{- range .values -}}
-{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | merge $dst -}}
-{{- end -}}
-{{ $dst | toYaml }}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_utils.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_utils.tpl
deleted file mode 100644
index bfbddf054..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_utils.tpl
+++ /dev/null
@@ -1,77 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Print instructions to get a secret value.
-Usage:
-{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }}
-*/}}
-{{- define "common.utils.secret.getvalue" -}}
-{{- $varname := include "common.utils.fieldToEnvVar" . -}}
-export {{ $varname }}=$(kubectl get secret --namespace {{ include "common.names.namespace" .context | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 -d)
-{{- end -}}
-
-{{/*
-Build env var name given a field
-Usage:
-{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }}
-*/}}
-{{- define "common.utils.fieldToEnvVar" -}}
- {{- $fieldNameSplit := splitList "-" .field -}}
- {{- $upperCaseFieldNameSplit := list -}}
-
- {{- range $fieldNameSplit -}}
- {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}}
- {{- end -}}
-
- {{ join "_" $upperCaseFieldNameSplit }}
-{{- end -}}
-
-{{/*
-Gets a value from .Values given
-Usage:
-{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }}
-*/}}
-{{- define "common.utils.getValueFromKey" -}}
-{{- $splitKey := splitList "." .key -}}
-{{- $value := "" -}}
-{{- $latestObj := $.context.Values -}}
-{{- range $splitKey -}}
- {{- if not $latestObj -}}
- {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}}
- {{- end -}}
- {{- $value = ( index $latestObj . ) -}}
- {{- $latestObj = $value -}}
-{{- end -}}
-{{- printf "%v" (default "" $value) -}}
-{{- end -}}
-
-{{/*
-Returns first .Values key with a defined value or first of the list if all non-defined
-Usage:
-{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }}
-*/}}
-{{- define "common.utils.getKeyFromList" -}}
-{{- $key := first .keys -}}
-{{- $reverseKeys := reverse .keys }}
-{{- range $reverseKeys }}
- {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }}
- {{- if $value -}}
- {{- $key = . }}
- {{- end -}}
-{{- end -}}
-{{- printf "%s" $key -}}
-{{- end -}}
-
-{{/*
-Checksum a template at "path" containing a *single* resource (ConfigMap,Secret) for use in pod annotations, excluding the metadata (see #18376).
-Usage:
-{{ include "common.utils.checksumTemplate" (dict "path" "/configmap.yaml" "context" $) }}
-*/}}
-{{- define "common.utils.checksumTemplate" -}}
-{{- $obj := include (print .context.Template.BasePath .path) .context | fromYaml -}}
-{{ omit $obj "apiVersion" "kind" "metadata" | toYaml | sha256sum }}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_warnings.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_warnings.tpl
deleted file mode 100644
index 66dffc1fe..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/_warnings.tpl
+++ /dev/null
@@ -1,19 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Warning about using rolling tag.
-Usage:
-{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }}
-*/}}
-{{- define "common.warnings.rollingTag" -}}
-
-{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }}
-WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
-+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
-{{- end }}
-
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_cassandra.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_cassandra.tpl
deleted file mode 100644
index eda9aada5..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_cassandra.tpl
+++ /dev/null
@@ -1,77 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Validate Cassandra required passwords are not empty.
-
-Usage:
-{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
-Params:
- - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret"
- - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
-*/}}
-{{- define "common.validations.values.cassandra.passwords" -}}
- {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}}
- {{- $enabled := include "common.cassandra.values.enabled" . -}}
- {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}}
- {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}}
-
- {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
- {{- $requiredPasswords := list -}}
-
- {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
-
- {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
-
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for existingSecret.
-
-Usage:
-{{ include "common.cassandra.values.existingSecret" (dict "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
-*/}}
-{{- define "common.cassandra.values.existingSecret" -}}
- {{- if .subchart -}}
- {{- .context.Values.cassandra.dbUser.existingSecret | quote -}}
- {{- else -}}
- {{- .context.Values.dbUser.existingSecret | quote -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for enabled cassandra.
-
-Usage:
-{{ include "common.cassandra.values.enabled" (dict "context" $) }}
-*/}}
-{{- define "common.cassandra.values.enabled" -}}
- {{- if .subchart -}}
- {{- printf "%v" .context.Values.cassandra.enabled -}}
- {{- else -}}
- {{- printf "%v" (not .context.Values.enabled) -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for the key dbUser
-
-Usage:
-{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false
-*/}}
-{{- define "common.cassandra.values.key.dbUser" -}}
- {{- if .subchart -}}
- cassandra.dbUser
- {{- else -}}
- dbUser
- {{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_mariadb.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_mariadb.tpl
deleted file mode 100644
index 17d83a2fd..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_mariadb.tpl
+++ /dev/null
@@ -1,108 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Validate MariaDB required passwords are not empty.
-
-Usage:
-{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
-Params:
- - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret"
- - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
-*/}}
-{{- define "common.validations.values.mariadb.passwords" -}}
- {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}}
- {{- $enabled := include "common.mariadb.values.enabled" . -}}
- {{- $architecture := include "common.mariadb.values.architecture" . -}}
- {{- $authPrefix := include "common.mariadb.values.key.auth" . -}}
- {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
- {{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
- {{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
- {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}}
-
- {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
- {{- $requiredPasswords := list -}}
-
- {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
-
- {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
- {{- if not (empty $valueUsername) -}}
- {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
- {{- end -}}
-
- {{- if (eq $architecture "replication") -}}
- {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}}
- {{- end -}}
-
- {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
-
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for existingSecret.
-
-Usage:
-{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
-*/}}
-{{- define "common.mariadb.values.auth.existingSecret" -}}
- {{- if .subchart -}}
- {{- .context.Values.mariadb.auth.existingSecret | quote -}}
- {{- else -}}
- {{- .context.Values.auth.existingSecret | quote -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for enabled mariadb.
-
-Usage:
-{{ include "common.mariadb.values.enabled" (dict "context" $) }}
-*/}}
-{{- define "common.mariadb.values.enabled" -}}
- {{- if .subchart -}}
- {{- printf "%v" .context.Values.mariadb.enabled -}}
- {{- else -}}
- {{- printf "%v" (not .context.Values.enabled) -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for architecture
-
-Usage:
-{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
-*/}}
-{{- define "common.mariadb.values.architecture" -}}
- {{- if .subchart -}}
- {{- .context.Values.mariadb.architecture -}}
- {{- else -}}
- {{- .context.Values.architecture -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for the key auth
-
-Usage:
-{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false
-*/}}
-{{- define "common.mariadb.values.key.auth" -}}
- {{- if .subchart -}}
- mariadb.auth
- {{- else -}}
- auth
- {{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_mongodb.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_mongodb.tpl
deleted file mode 100644
index bbb445b86..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_mongodb.tpl
+++ /dev/null
@@ -1,113 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Validate MongoDB® required passwords are not empty.
-
-Usage:
-{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
-Params:
- - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret"
- - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
-*/}}
-{{- define "common.validations.values.mongodb.passwords" -}}
- {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}}
- {{- $enabled := include "common.mongodb.values.enabled" . -}}
- {{- $authPrefix := include "common.mongodb.values.key.auth" . -}}
- {{- $architecture := include "common.mongodb.values.architecture" . -}}
- {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
- {{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
- {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}}
- {{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
- {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}}
- {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}}
-
- {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}}
-
- {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}}
- {{- $requiredPasswords := list -}}
-
- {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
-
- {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
- {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }}
- {{- if and $valueUsername $valueDatabase -}}
- {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
- {{- end -}}
-
- {{- if (eq $architecture "replicaset") -}}
- {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}}
- {{- end -}}
-
- {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
-
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for existingSecret.
-
-Usage:
-{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false
-*/}}
-{{- define "common.mongodb.values.auth.existingSecret" -}}
- {{- if .subchart -}}
- {{- .context.Values.mongodb.auth.existingSecret | quote -}}
- {{- else -}}
- {{- .context.Values.auth.existingSecret | quote -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for enabled mongodb.
-
-Usage:
-{{ include "common.mongodb.values.enabled" (dict "context" $) }}
-*/}}
-{{- define "common.mongodb.values.enabled" -}}
- {{- if .subchart -}}
- {{- printf "%v" .context.Values.mongodb.enabled -}}
- {{- else -}}
- {{- printf "%v" (not .context.Values.enabled) -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for the key auth
-
-Usage:
-{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
-*/}}
-{{- define "common.mongodb.values.key.auth" -}}
- {{- if .subchart -}}
- mongodb.auth
- {{- else -}}
- auth
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for architecture
-
-Usage:
-{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false
-*/}}
-{{- define "common.mongodb.values.architecture" -}}
- {{- if .subchart -}}
- {{- .context.Values.mongodb.architecture -}}
- {{- else -}}
- {{- .context.Values.architecture -}}
- {{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_mysql.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_mysql.tpl
deleted file mode 100644
index ca3953f86..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_mysql.tpl
+++ /dev/null
@@ -1,108 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Validate MySQL required passwords are not empty.
-
-Usage:
-{{ include "common.validations.values.mysql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
-Params:
- - secret - String - Required. Name of the secret where MySQL values are stored, e.g: "mysql-passwords-secret"
- - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
-*/}}
-{{- define "common.validations.values.mysql.passwords" -}}
- {{- $existingSecret := include "common.mysql.values.auth.existingSecret" . -}}
- {{- $enabled := include "common.mysql.values.enabled" . -}}
- {{- $architecture := include "common.mysql.values.architecture" . -}}
- {{- $authPrefix := include "common.mysql.values.key.auth" . -}}
- {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}}
- {{- $valueKeyUsername := printf "%s.username" $authPrefix -}}
- {{- $valueKeyPassword := printf "%s.password" $authPrefix -}}
- {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}}
-
- {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
- {{- $requiredPasswords := list -}}
-
- {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mysql-root-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}}
-
- {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }}
- {{- if not (empty $valueUsername) -}}
- {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mysql-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}}
- {{- end -}}
-
- {{- if (eq $architecture "replication") -}}
- {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mysql-replication-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}}
- {{- end -}}
-
- {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
-
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for existingSecret.
-
-Usage:
-{{ include "common.mysql.values.auth.existingSecret" (dict "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
-*/}}
-{{- define "common.mysql.values.auth.existingSecret" -}}
- {{- if .subchart -}}
- {{- .context.Values.mysql.auth.existingSecret | quote -}}
- {{- else -}}
- {{- .context.Values.auth.existingSecret | quote -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for enabled mysql.
-
-Usage:
-{{ include "common.mysql.values.enabled" (dict "context" $) }}
-*/}}
-{{- define "common.mysql.values.enabled" -}}
- {{- if .subchart -}}
- {{- printf "%v" .context.Values.mysql.enabled -}}
- {{- else -}}
- {{- printf "%v" (not .context.Values.enabled) -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for architecture
-
-Usage:
-{{ include "common.mysql.values.architecture" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
-*/}}
-{{- define "common.mysql.values.architecture" -}}
- {{- if .subchart -}}
- {{- .context.Values.mysql.architecture -}}
- {{- else -}}
- {{- .context.Values.architecture -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for the key auth
-
-Usage:
-{{ include "common.mysql.values.key.auth" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether MySQL is used as subchart or not. Default: false
-*/}}
-{{- define "common.mysql.values.key.auth" -}}
- {{- if .subchart -}}
- mysql.auth
- {{- else -}}
- auth
- {{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_postgresql.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_postgresql.tpl
deleted file mode 100644
index 8c9aa570e..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_postgresql.tpl
+++ /dev/null
@@ -1,134 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Validate PostgreSQL required passwords are not empty.
-
-Usage:
-{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
-Params:
- - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret"
- - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
-*/}}
-{{- define "common.validations.values.postgresql.passwords" -}}
- {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}}
- {{- $enabled := include "common.postgresql.values.enabled" . -}}
- {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}}
- {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}}
- {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
- {{- $requiredPasswords := list -}}
- {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}}
-
- {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}}
- {{- if (eq $enabledReplication "true") -}}
- {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}}
- {{- end -}}
-
- {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to decide whether evaluate global values.
-
-Usage:
-{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }}
-Params:
- - key - String - Required. Field to be evaluated within global, e.g: "existingSecret"
-*/}}
-{{- define "common.postgresql.values.use.global" -}}
- {{- if .context.Values.global -}}
- {{- if .context.Values.global.postgresql -}}
- {{- index .context.Values.global.postgresql .key | quote -}}
- {{- end -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for existingSecret.
-
-Usage:
-{{ include "common.postgresql.values.existingSecret" (dict "context" $) }}
-*/}}
-{{- define "common.postgresql.values.existingSecret" -}}
- {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}}
-
- {{- if .subchart -}}
- {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}}
- {{- else -}}
- {{- default (.context.Values.existingSecret | quote) $globalValue -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for enabled postgresql.
-
-Usage:
-{{ include "common.postgresql.values.enabled" (dict "context" $) }}
-*/}}
-{{- define "common.postgresql.values.enabled" -}}
- {{- if .subchart -}}
- {{- printf "%v" .context.Values.postgresql.enabled -}}
- {{- else -}}
- {{- printf "%v" (not .context.Values.enabled) -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for the key postgressPassword.
-
-Usage:
-{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
-*/}}
-{{- define "common.postgresql.values.key.postgressPassword" -}}
- {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}}
-
- {{- if not $globalValue -}}
- {{- if .subchart -}}
- postgresql.postgresqlPassword
- {{- else -}}
- postgresqlPassword
- {{- end -}}
- {{- else -}}
- global.postgresql.postgresqlPassword
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for enabled.replication.
-
-Usage:
-{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
-*/}}
-{{- define "common.postgresql.values.enabled.replication" -}}
- {{- if .subchart -}}
- {{- printf "%v" .context.Values.postgresql.replication.enabled -}}
- {{- else -}}
- {{- printf "%v" .context.Values.replication.enabled -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for the key replication.password.
-
-Usage:
-{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false
-*/}}
-{{- define "common.postgresql.values.key.replicationPassword" -}}
- {{- if .subchart -}}
- postgresql.replication.password
- {{- else -}}
- replication.password
- {{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_redis.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_redis.tpl
deleted file mode 100644
index fc0d208dd..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_redis.tpl
+++ /dev/null
@@ -1,81 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Validate Redis® required passwords are not empty.
-
-Usage:
-{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }}
-Params:
- - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret"
- - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false
-*/}}
-{{- define "common.validations.values.redis.passwords" -}}
- {{- $enabled := include "common.redis.values.enabled" . -}}
- {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}}
- {{- $standarizedVersion := include "common.redis.values.standarized.version" . }}
-
- {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }}
- {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }}
-
- {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }}
- {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }}
-
- {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}}
- {{- $requiredPasswords := list -}}
-
- {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}}
- {{- if eq $useAuth "true" -}}
- {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}}
- {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}}
- {{- end -}}
-
- {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right value for enabled redis.
-
-Usage:
-{{ include "common.redis.values.enabled" (dict "context" $) }}
-*/}}
-{{- define "common.redis.values.enabled" -}}
- {{- if .subchart -}}
- {{- printf "%v" .context.Values.redis.enabled -}}
- {{- else -}}
- {{- printf "%v" (not .context.Values.enabled) -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Auxiliary function to get the right prefix path for the values
-
-Usage:
-{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }}
-Params:
- - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false
-*/}}
-{{- define "common.redis.values.keys.prefix" -}}
- {{- if .subchart -}}redis.{{- else -}}{{- end -}}
-{{- end -}}
-
-{{/*
-Checks whether the redis chart's includes the standarizations (version >= 14)
-
-Usage:
-{{ include "common.redis.values.standarized.version" (dict "context" $) }}
-*/}}
-{{- define "common.redis.values.standarized.version" -}}
-
- {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}}
- {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }}
-
- {{- if $standarizedAuthValues -}}
- {{- true -}}
- {{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_validations.tpl b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_validations.tpl
deleted file mode 100644
index 31ceda871..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/templates/validations/_validations.tpl
+++ /dev/null
@@ -1,51 +0,0 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Validate values must not be empty.
-
-Usage:
-{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}}
-{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}}
-{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }}
-
-Validate value params:
- - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
- - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
- - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
-*/}}
-{{- define "common.validations.values.multiple.empty" -}}
- {{- range .required -}}
- {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}}
- {{- end -}}
-{{- end -}}
-
-{{/*
-Validate a value must not be empty.
-
-Usage:
-{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }}
-
-Validate value params:
- - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password"
- - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret"
- - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password"
- - subchart - String - Optional - Name of the subchart that the validated password is part of.
-*/}}
-{{- define "common.validations.values.single.empty" -}}
- {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }}
- {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }}
-
- {{- if not $value -}}
- {{- $varname := "my-value" -}}
- {{- $getCurrentValue := "" -}}
- {{- if and .secret .field -}}
- {{- $varname = include "common.utils.fieldToEnvVar" . -}}
- {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}}
- {{- end -}}
- {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}}
- {{- end -}}
-{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/values.yaml b/devops/deploy-as-code/charts/backbone-services/minio/charts/common/values.yaml
deleted file mode 100644
index 9abe0e154..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/charts/common/values.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-# Copyright VMware, Inc.
-# SPDX-License-Identifier: APACHE-2.0
-
-## bitnami/common
-## It is required by CI/CD tools and processes.
-## @skip exampleValue
-##
-exampleValue: common-chart
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/NOTES.txt b/devops/deploy-as-code/charts/backbone-services/minio/templates/NOTES.txt
index 4ed938a8b..ee02a6fd8 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/NOTES.txt
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/NOTES.txt
@@ -1,76 +1,43 @@
-CHART NAME: {{ .Chart.Name }}
-CHART VERSION: {{ .Chart.Version }}
-APP VERSION: {{ .Chart.AppVersion }}
+{{- if eq .Values.service.type "ClusterIP" "NodePort" }}
+MinIO can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster:
+{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.{{ .Values.clusterDomain }}
-** Please be patient while the chart is being deployed **
+To access MinIO from localhost, run the below commands:
-MinIO® can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster:
+ 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
- {{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
+ 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }}
-To get your credentials run:
+Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/
- export ROOT_USER=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "minio.secretName" . }} -o jsonpath="{.data.root-user}" | base64 -d)
- export ROOT_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "minio.secretName" . }} -o jsonpath="{.data.root-password}" | base64 -d)
+You can now access MinIO server on http://localhost:9000. Follow the below steps to connect to MinIO server with mc client:
-To connect to your MinIO® server using a client:
+ 1. Download the MinIO mc client - https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart
-- Run a MinIO® Client pod and append the desired command (e.g. 'admin info'):
+ 2. export MC_HOST_{{ template "minio.fullname" . }}_local=http://$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@localhost:{{ .Values.service.port }}
- kubectl run --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }}-client \
- --rm --tty -i --restart='Never' \
- --env MINIO_SERVER_ROOT_USER=$ROOT_USER \
- --env MINIO_SERVER_ROOT_PASSWORD=$ROOT_PASSWORD \
- --env MINIO_SERVER_HOST={{ include "common.names.fullname" . }} \
- {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}
- --labels="{{ include "common.names.fullname" . }}-client=true" \
- {{- end }}
- --image {{ template "minio.clientImage" . }} -- admin info minio
-
-{{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}
-
- NOTE: Since NetworkPolicy is enabled, only pods with label
- "{{ template "common.names.fullname" . }}-client=true" will be able to connect to MinIO®.
+ 3. mc ls {{ template "minio.fullname" . }}_local
{{- end }}
-{{- if (not .Values.disableWebUI) }}
-
-To access the MinIO® web UI:
-
-- Get the MinIO® URL:
-
-{{- if .Values.ingress.enabled }}
+{{- if eq .Values.service.type "LoadBalancer" }}
+MinIO can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by:
+kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }}
- You should be able to access your new MinIO® web UI through
+Note that the public IP may take a couple of minutes to be available.
- {{ if .Values.ingress.tls }}https{{ else }}http{{ end }}://{{ .Values.ingress.hostname }}/minio/
-{{- else if contains "LoadBalancer" .Values.service.type }}
+You can now access MinIO server on http://:9000. Follow the below steps to connect to MinIO server with mc client:
- NOTE: It may take a few minutes for the LoadBalancer IP to be available.
- Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ include "common.names.fullname" . }}'
+ 1. Download the MinIO mc client - https://min.io/docs/minio/linux/reference/minio-mc.html#quickstart
- {{- $port:=.Values.service.ports.console | toString }}
- export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} --template "{{ "{{ range (index .status.loadBalancer.ingress 0) }}{{ . }}{{ end }}" }}")
- echo "MinIO® web URL: http://$SERVICE_IP{{- if ne $port "80" }}:{{ .Values.service.ports.console }}{{ end }}/minio"
+ 2. export MC_HOST_{{ template "minio.fullname" . }}_local=http://$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.rootUser}" | base64 --decode):$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.rootPassword}" | base64 --decode)@:{{ .Values.service.port }}
-{{- else if contains "ClusterIP" .Values.service.type }}
-
- echo "MinIO® web URL: http://127.0.0.1:{{ .Values.containerPorts.console }}/minio"
- kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ include "common.names.fullname" . }} {{ .Values.containerPorts.console }}:{{ .Values.service.ports.console }}
-
-{{- else if contains "NodePort" .Values.service.type }}
-
- export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "common.names.fullname" . }})
- export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
- echo "MinIO® web URL: http://$NODE_IP:$NODE_PORT/minio"
+ 3. mc ls {{ template "minio.fullname" . }}
+Alternately, you can use your browser or the MinIO SDK to access the server - https://min.io/docs/minio/linux/reference/minio-server/minio-server.html
{{- end }}
-{{- else }}
- WARN: MinIO® Web UI is disabled.
+{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}
+Note: Since NetworkPolicy is enabled, only pods with label
+{{ template "minio.fullname" . }}-client=true"
+will be able to connect to this minio cluster.
{{- end }}
-
-{{- include "common.warnings.rollingTag" .Values.image }}
-{{- include "common.warnings.rollingTag" .Values.clientImage }}
-{{- include "common.warnings.rollingTag" .Values.volumePermissions.image }}
-{{- include "minio.validateValues" . }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_bucket.txt b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_bucket.txt
new file mode 100644
index 000000000..83b8dcb2d
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_bucket.txt
@@ -0,0 +1,122 @@
+#!/bin/sh
+set -e # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# connectToMinio
+# Use a check-sleep-check loop to wait for MinIO service to be available
+connectToMinio() {
+ SCHEME=$1
+ ATTEMPTS=0
+ LIMIT=29 # Allow 30 attempts
+ set -e # fail if we can't read the keys.
+ ACCESS=$(cat /config/rootUser)
+ SECRET=$(cat /config/rootPassword)
+ set +e # The connections to minio are allowed to fail.
+ echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT"
+ MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET"
+ $MC_COMMAND
+ STATUS=$?
+ until [ $STATUS = 0 ]; do
+ ATTEMPTS=$(expr $ATTEMPTS + 1)
+ echo \"Failed attempts: $ATTEMPTS\"
+ if [ $ATTEMPTS -gt $LIMIT ]; then
+ exit 1
+ fi
+ sleep 2 # 1 second intervals between attempts
+ $MC_COMMAND
+ STATUS=$?
+ done
+ set -e # reset `e` as active
+ return 0
+}
+
+# checkBucketExists ($bucket)
+# Check if the bucket exists, by using the exit code of `mc ls`
+checkBucketExists() {
+ BUCKET=$1
+ CMD=$(${MC} stat myminio/$BUCKET >/dev/null 2>&1)
+ return $?
+}
+
+# createBucket ($bucket, $policy, $purge)
+# Ensure bucket exists, purging if asked to
+createBucket() {
+ BUCKET=$1
+ POLICY=$2
+ PURGE=$3
+ VERSIONING=$4
+ OBJECTLOCKING=$5
+
+ # Purge the bucket, if set & exists
+ # Since PURGE is user input, check explicitly for `true`
+ if [ $PURGE = true ]; then
+ if checkBucketExists $BUCKET; then
+ echo "Purging bucket '$BUCKET'."
+ set +e # don't exit if this fails
+ ${MC} rm -r --force myminio/$BUCKET
+ set -e # reset `e` as active
+ else
+ echo "Bucket '$BUCKET' does not exist, skipping purge."
+ fi
+ fi
+
+ # Create the bucket if it does not exist and set objectlocking if enabled (NOTE: versioning will be not changed if OBJECTLOCKING is set because it enables versioning to the Buckets created)
+ if ! checkBucketExists $BUCKET; then
+ if [ ! -z $OBJECTLOCKING ]; then
+ if [ $OBJECTLOCKING = true ]; then
+ echo "Creating bucket with OBJECTLOCKING '$BUCKET'"
+ ${MC} mb --with-lock myminio/$BUCKET
+ elif [ $OBJECTLOCKING = false ]; then
+ echo "Creating bucket '$BUCKET'"
+ ${MC} mb myminio/$BUCKET
+ fi
+ elif [ -z $OBJECTLOCKING ]; then
+ echo "Creating bucket '$BUCKET'"
+ ${MC} mb myminio/$BUCKET
+ else
+ echo "Bucket '$BUCKET' already exists."
+ fi
+ fi
+
+ # set versioning for bucket if objectlocking is disabled or not set
+ if [ $OBJECTLOCKING = false ]; then
+ if [ ! -z $VERSIONING ]; then
+ if [ $VERSIONING = true ]; then
+ echo "Enabling versioning for '$BUCKET'"
+ ${MC} version enable myminio/$BUCKET
+ elif [ $VERSIONING = false ]; then
+ echo "Suspending versioning for '$BUCKET'"
+ ${MC} version suspend myminio/$BUCKET
+ fi
+ fi
+ else
+ echo "Bucket '$BUCKET' versioning unchanged."
+ fi
+
+ # At this point, the bucket should exist, skip checking for existence
+ # Set policy on the bucket
+ echo "Setting policy of bucket '$BUCKET' to '$POLICY'."
+ ${MC} anonymous set $POLICY myminio/$BUCKET
+}
+
+# Try connecting to MinIO instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToMinio $scheme
+
+{{ if .Values.buckets }}
+{{ $global := . }}
+# Create the buckets
+{{- range .Values.buckets }}
+createBucket {{ tpl .name $global }} {{ .policy | default "none" | quote }} {{ .purge | default false }} {{ .versioning | default false }} {{ .objectlocking | default false }}
+{{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_policy.txt b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_policy.txt
new file mode 100644
index 000000000..aa584952f
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_policy.txt
@@ -0,0 +1,75 @@
+#!/bin/sh
+set -e ; # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# connectToMinio
+# Use a check-sleep-check loop to wait for MinIO service to be available
+connectToMinio() {
+ SCHEME=$1
+ ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
+ set -e ; # fail if we can't read the keys.
+ ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
+ set +e ; # The connections to minio are allowed to fail.
+ echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
+ MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
+ $MC_COMMAND ;
+ STATUS=$? ;
+ until [ $STATUS = 0 ]
+ do
+ ATTEMPTS=`expr $ATTEMPTS + 1` ;
+ echo \"Failed attempts: $ATTEMPTS\" ;
+ if [ $ATTEMPTS -gt $LIMIT ]; then
+ exit 1 ;
+ fi ;
+ sleep 2 ; # 1 second intervals between attempts
+ $MC_COMMAND ;
+ STATUS=$? ;
+ done ;
+ set -e ; # reset `e` as active
+ return 0
+}
+
+# checkPolicyExists ($policy)
+# Check if the policy exists, by using the exit code of `mc admin policy info`
+checkPolicyExists() {
+ POLICY=$1
+ CMD=$(${MC} admin policy info myminio $POLICY > /dev/null 2>&1)
+ return $?
+}
+
+# createPolicy($name, $filename)
+createPolicy () {
+ NAME=$1
+ FILENAME=$2
+
+ # Create the name if it does not exist
+ echo "Checking policy: $NAME (in /config/$FILENAME.json)"
+ if ! checkPolicyExists $NAME ; then
+ echo "Creating policy '$NAME'"
+ else
+ echo "Policy '$NAME' already exists."
+ fi
+ ${MC} admin policy create myminio $NAME /config/$FILENAME.json
+
+}
+
+# Try connecting to MinIO instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToMinio $scheme
+
+{{ if .Values.policies }}
+# Create the policies
+{{- range $idx, $policy := .Values.policies }}
+createPolicy {{ $policy.name }} policy_{{ $idx }}
+{{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_svcacct.txt b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_svcacct.txt
new file mode 100644
index 000000000..5c8aec4f0
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_svcacct.txt
@@ -0,0 +1,106 @@
+#!/bin/sh
+set -e ; # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters.
+# Special characters for example : ',",<,>,{,}
+MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_svcacct_tmp"
+
+# connectToMinio
+# Use a check-sleep-check loop to wait for MinIO service to be available
+connectToMinio() {
+ SCHEME=$1
+ ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
+ set -e ; # fail if we can't read the keys.
+ ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
+ set +e ; # The connections to minio are allowed to fail.
+ echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
+ MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
+ $MC_COMMAND ;
+ STATUS=$? ;
+ until [ $STATUS = 0 ]
+ do
+ ATTEMPTS=`expr $ATTEMPTS + 1` ;
+ echo \"Failed attempts: $ATTEMPTS\" ;
+ if [ $ATTEMPTS -gt $LIMIT ]; then
+ exit 1 ;
+ fi ;
+ sleep 2 ; # 2 second intervals between attempts
+ $MC_COMMAND ;
+ STATUS=$? ;
+ done ;
+ set -e ; # reset `e` as active
+ return 0
+}
+
+# checkSvcacctExists ()
+# Check if the svcacct exists, by using the exit code of `mc admin user svcacct info`
+checkSvcacctExists() {
+ CMD=$(${MC} admin user svcacct info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
+ return $?
+}
+
+# createSvcacct ($user)
+createSvcacct () {
+ USER=$1
+ FILENAME=$2
+ #check accessKey_and_secretKey_tmp file
+ if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then
+ echo "credentials file does not exist"
+ return 1
+ fi
+ if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then
+ echo "credentials file is invalid"
+ rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
+ return 1
+ fi
+ SVCACCT=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP)
+ # Create the svcacct if it does not exist
+ if ! checkSvcacctExists ; then
+ echo "Creating svcacct '$SVCACCT'"
+ # Check if policy file is define
+ if [ -z $FILENAME ]; then
+ ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) myminio $USER
+ else
+ ${MC} admin user svcacct add --access-key $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --secret-key $(tail -n1 $MINIO_ACCESSKEY_SECRETKEY_TMP) --policy /config/$FILENAME.json myminio $USER
+ fi
+ else
+ echo "Svcacct '$SVCACCT' already exists."
+ fi
+ #clean up credentials files.
+ rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
+}
+
+# Try connecting to MinIO instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToMinio $scheme
+
+{{ if .Values.svcaccts }}
+{{ $global := . }}
+# Create the svcaccts
+{{- range $idx, $svc := .Values.svcaccts }}
+echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP
+{{- if .existingSecret }}
+cat /config/secrets-svc/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+# Add a new line if it doesn't exist
+echo >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+{{ else }}
+echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+{{- end }}
+{{- if $svc.policy}}
+createSvcacct {{ .user }} svc_policy_{{ $idx }}
+{{ else }}
+createSvcacct {{ .user }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_user.txt b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_user.txt
new file mode 100644
index 000000000..bfb79bee5
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_create_user.txt
@@ -0,0 +1,107 @@
+#!/bin/sh
+set -e ; # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# AccessKey and secretkey credentials file are added to prevent shell execution errors caused by special characters.
+# Special characters for example : ',",<,>,{,}
+MINIO_ACCESSKEY_SECRETKEY_TMP="/tmp/accessKey_and_secretKey_tmp"
+
+# connectToMinio
+# Use a check-sleep-check loop to wait for MinIO service to be available
+connectToMinio() {
+ SCHEME=$1
+ ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
+ set -e ; # fail if we can't read the keys.
+ ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
+ set +e ; # The connections to minio are allowed to fail.
+ echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
+ MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
+ $MC_COMMAND ;
+ STATUS=$? ;
+ until [ $STATUS = 0 ]
+ do
+ ATTEMPTS=`expr $ATTEMPTS + 1` ;
+ echo \"Failed attempts: $ATTEMPTS\" ;
+ if [ $ATTEMPTS -gt $LIMIT ]; then
+ exit 1 ;
+ fi ;
+ sleep 2 ; # 1 second intervals between attempts
+ $MC_COMMAND ;
+ STATUS=$? ;
+ done ;
+ set -e ; # reset `e` as active
+ return 0
+}
+
+# checkUserExists ()
+# Check if the user exists, by using the exit code of `mc admin user info`
+checkUserExists() {
+ CMD=$(${MC} admin user info myminio $(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP) > /dev/null 2>&1)
+ return $?
+}
+
+# createUser ($policy)
+createUser() {
+ POLICY=$1
+ #check accessKey_and_secretKey_tmp file
+ if [[ ! -f $MINIO_ACCESSKEY_SECRETKEY_TMP ]];then
+ echo "credentials file does not exist"
+ return 1
+ fi
+ if [[ $(cat $MINIO_ACCESSKEY_SECRETKEY_TMP|wc -l) -ne 2 ]];then
+ echo "credentials file is invalid"
+ rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
+ return 1
+ fi
+ USER=$(head -1 $MINIO_ACCESSKEY_SECRETKEY_TMP)
+ # Create the user if it does not exist
+ if ! checkUserExists ; then
+ echo "Creating user '$USER'"
+ cat $MINIO_ACCESSKEY_SECRETKEY_TMP | ${MC} admin user add myminio
+ else
+ echo "User '$USER' already exists."
+ fi
+ #clean up credentials files.
+ rm -f $MINIO_ACCESSKEY_SECRETKEY_TMP
+
+ # set policy for user
+ if [ ! -z $POLICY -a $POLICY != " " ] ; then
+ echo "Adding policy '$POLICY' for '$USER'"
+ set +e ; # policy already attach errors out, allow it.
+ ${MC} admin policy attach myminio $POLICY --user=$USER
+ set -e
+ else
+ echo "User '$USER' has no policy attached."
+ fi
+}
+
+# Try connecting to MinIO instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToMinio $scheme
+
+{{ if .Values.users }}
+{{ $global := . }}
+# Create the users
+{{- range .Values.users }}
+echo {{ tpl .accessKey $global }} > $MINIO_ACCESSKEY_SECRETKEY_TMP
+{{- if .existingSecret }}
+cat /config/secrets/{{ tpl .existingSecret $global }}/{{ tpl .existingSecretKey $global }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+# Add a new line if it doesn't exist
+echo >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+createUser {{ .policy }}
+{{ else }}
+echo {{ .secretKey }} >> $MINIO_ACCESSKEY_SECRETKEY_TMP
+createUser {{ .policy }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_custom_command.txt b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_custom_command.txt
new file mode 100644
index 000000000..b583a7782
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_custom_command.txt
@@ -0,0 +1,58 @@
+#!/bin/sh
+set -e ; # Have script exit in the event of a failed command.
+
+{{- if .Values.configPathmc }}
+MC_CONFIG_DIR="{{ .Values.configPathmc }}"
+MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}"
+{{- else }}
+MC="/usr/bin/mc --insecure"
+{{- end }}
+
+# connectToMinio
+# Use a check-sleep-check loop to wait for MinIO service to be available
+connectToMinio() {
+ SCHEME=$1
+ ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts
+ set -e ; # fail if we can't read the keys.
+ ACCESS=$(cat /config/rootUser) ; SECRET=$(cat /config/rootPassword) ;
+ set +e ; # The connections to minio are allowed to fail.
+ echo "Connecting to MinIO server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ;
+ MC_COMMAND="${MC} alias set myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ;
+ $MC_COMMAND ;
+ STATUS=$? ;
+ until [ $STATUS = 0 ]
+ do
+ ATTEMPTS=`expr $ATTEMPTS + 1` ;
+ echo \"Failed attempts: $ATTEMPTS\" ;
+ if [ $ATTEMPTS -gt $LIMIT ]; then
+ exit 1 ;
+ fi ;
+ sleep 2 ; # 1 second intervals between attempts
+ $MC_COMMAND ;
+ STATUS=$? ;
+ done ;
+ set -e ; # reset `e` as active
+ return 0
+}
+
+# runCommand ($@)
+# Run custom mc command
+runCommand() {
+ ${MC} "$@"
+ return $?
+}
+
+# Try connecting to MinIO instance
+{{- if .Values.tls.enabled }}
+scheme=https
+{{- else }}
+scheme=http
+{{- end }}
+connectToMinio $scheme
+
+{{ if .Values.customCommands }}
+# Run custom commands
+{{- range .Values.customCommands }}
+runCommand {{ .command }}
+{{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_policy.tpl b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_policy.tpl
new file mode 100644
index 000000000..8be998e5d
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helper_policy.tpl
@@ -0,0 +1,28 @@
+{{- $statements_length := len .statements -}}
+{{- $statements_length := sub $statements_length 1 -}}
+{
+ "Version": "2012-10-17",
+ "Statement": [
+{{- range $i, $statement := .statements }}
+ {
+ "Effect": "{{ $statement.effect | default "Allow" }}",
+ "Action": [
+"{{ $statement.actions | join "\",\n\"" }}"
+ ]{{ if $statement.resources }},
+ "Resource": [
+"{{ $statement.resources | join "\",\n\"" }}"
+ ]{{ end }}
+{{- if $statement.conditions }}
+{{- $condition_len := len $statement.conditions }}
+{{- $condition_len := sub $condition_len 1 }}
+ ,
+ "Condition": {
+ {{- range $k,$v := $statement.conditions }}
+ {{- range $operator,$object := $v }}
+ "{{ $operator }}": { {{ $object }} }{{- if lt $k $condition_len }},{{- end }}
+ {{- end }}{{- end }}
+ }{{- end }}
+ }{{ if lt $i $statements_length }},{{end }}
+{{- end }}
+ ]
+}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/_helpers.tpl b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helpers.tpl
index 75f410dc8..410bc4e00 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/_helpers.tpl
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/_helpers.tpl
@@ -1,244 +1,227 @@
-{{/*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
{{/* vim: set filetype=mustache: */}}
-
-{{/*
-Return the proper MinIO® image name
-*/}}
-{{- define "minio.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }}
-
-{{- end -}}
-
-{{/*
-Return the proper MinIO® Client image name
-*/}}
-{{- define "minio.clientImage" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.clientImage "global" .Values.global) }}
-{{- end -}}
-
{{/*
-Return the proper image name (for the init container volume-permissions image)
+Expand the name of the chart.
*/}}
-{{- define "minio.volumePermissions.image" -}}
-{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }}
+{{- define "minio.name" -}}
+ {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
-Return the proper Docker Image Registry Secret Names
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
*/}}
-{{- define "minio.imagePullSecrets" -}}
-{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.image .Values.clientImage .Values.volumePermissions.image) "context" $) -}}
-{{- end -}}
-
-{{/*
-Returns the available value for certain key in an existing secret (if it exists),
-otherwise it generates a random value.
-*/}}
-{{- define "getValueFromSecret" }}
-{{- $len := (default 16 .Length) | int -}}
-{{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}}
-{{- if $obj }}
-{{- index $obj .Key | b64dec -}}
-{{- else -}}
-{{- randAlphaNum $len -}}
+{{- define "minio.fullname" -}}
+ {{- $envOverrides := index .Values (tpl (default .Chart.Name .Values.name) .) -}}
+ {{- $baseValues := .Values | deepCopy -}}
+ {{- $values := dict "Values" (mustMergeOverwrite $baseValues $envOverrides) -}}
+ {{- with mustMergeOverwrite . $values -}}
+ {{- if .Values.fullnameOverride -}}
+ {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+ {{- else -}}
+ {{- $name := default .Chart.Name .Values.nameOverride -}}
+ {{- if contains $name .Release.Name -}}
+ {{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+ {{- else -}}
+ {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+ {{- end -}}
+ {{- end -}}
+ {{- end -}}
{{- end -}}
-{{- end }}
{{/*
-Get the user to use to access MinIO®
+Create chart name and version as used by the chart label.
*/}}
-{{- define "minio.secret.userValue" -}}
-{{- if .Values.auth.rootUser }}
- {{- .Values.auth.rootUser -}}
-{{- else if (not .Values.auth.forcePassword) }}
- {{- include "getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "common.names.fullname" .) "Length" 10 "Key" "root-user") -}}
-{{- else -}}
- {{ required "A root username is required!" .Values.auth.rootUser }}
-{{- end -}}
+{{- define "minio.chart" -}}
+ {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
-Get the password to use to access MinIO®
+Return the appropriate apiVersion for networkpolicy.
*/}}
-{{- define "minio.secret.passwordValue" -}}
-{{- if .Values.auth.rootPassword }}
- {{- .Values.auth.rootPassword -}}
-{{- else if (not .Values.auth.forcePassword) }}
- {{- include "getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "common.names.fullname" .) "Length" 10 "Key" "root-password") -}}
-{{- else -}}
- {{ required "A root password is required!" .Values.auth.rootPassword }}
-{{- end -}}
+{{- define "minio.networkPolicy.apiVersion" -}}
+ {{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}}
+ {{- print "extensions/v1beta1" -}}
+ {{- else if semverCompare ">=1.7-0, <1.16-0" .Capabilities.KubeVersion.Version -}}
+ {{- print "networking.k8s.io/v1beta1" -}}
+ {{- else if semverCompare "^1.16-0" .Capabilities.KubeVersion.Version -}}
+ {{- print "networking.k8s.io/v1" -}}
+ {{- end -}}
{{- end -}}
{{/*
-Get the credentials secret.
+Return the appropriate apiVersion for deployment.
*/}}
-{{- define "minio.secretName" -}}
-{{- if .Values.auth.existingSecret -}}
- {{- printf "%s" (tpl .Values.auth.existingSecret $) -}}
-{{- else -}}
- {{- printf "%s" (include "common.names.fullname" .) -}}
-{{- end -}}
+{{- define "minio.deployment.apiVersion" -}}
+ {{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}}
+ {{- print "apps/v1beta2" -}}
+ {{- else -}}
+ {{- print "apps/v1" -}}
+ {{- end -}}
{{- end -}}
{{/*
-Return true if a secret object should be created
+Return the appropriate apiVersion for statefulset.
*/}}
-{{- define "minio.createSecret" -}}
-{{- if .Values.auth.existingSecret -}}
-{{- else -}}
- {{- true -}}
-{{- end -}}
+{{- define "minio.statefulset.apiVersion" -}}
+ {{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}}
+ {{- print "apps/v1beta2" -}}
+ {{- else -}}
+ {{- print "apps/v1" -}}
+ {{- end -}}
{{- end -}}
{{/*
-Return true if a PVC object should be created (only in standalone mode)
+Return the appropriate apiVersion for ingress.
*/}}
-{{- define "minio.createPVC" -}}
-{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) (eq .Values.mode "standalone") }}
- {{- true -}}
-{{- end -}}
+{{- define "minio.ingress.apiVersion" -}}
+ {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+ {{- print "extensions/v1beta1" -}}
+ {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+ {{- print "networking.k8s.io/v1beta1" -}}
+ {{- else -}}
+ {{- print "networking.k8s.io/v1" -}}
+ {{- end -}}
{{- end -}}
{{/*
-Return the PVC name (only in standalone mode)
+Return the appropriate apiVersion for console ingress.
*/}}
-{{- define "minio.claimName" -}}
-{{- if and .Values.persistence.existingClaim }}
- {{- printf "%s" (tpl .Values.persistence.existingClaim $) -}}
-{{- else -}}
- {{- printf "%s" (include "common.names.fullname" .) -}}
-{{- end -}}
+{{- define "minio.consoleIngress.apiVersion" -}}
+ {{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+ {{- print "extensions/v1beta1" -}}
+ {{- else if semverCompare "<1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+ {{- print "networking.k8s.io/v1beta1" -}}
+ {{- else -}}
+ {{- print "networking.k8s.io/v1" -}}
+ {{- end -}}
{{- end -}}
{{/*
-Returns the proper service account name depending if an explicit service account name is set
-in the values file. If the name is not set it will default to either common.names.fullname if serviceAccount.create
-is true or default otherwise.
+Determine secret name.
*/}}
-{{- define "minio.serviceAccountName" -}}
- {{- if .Values.serviceAccount.create -}}
- {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
- {{- else -}}
- {{ default "default" .Values.serviceAccount.name }}
- {{- end -}}
+{{- define "minio.secretName" -}}
+ {{- if .Values.existingSecret -}}
+ {{- .Values.existingSecret }}
+ {{- else -}}
+ {{- include "minio.fullname" . -}}
+ {{- end -}}
{{- end -}}
{{/*
-Compile all warnings into a single message, and call fail.
+Determine name for scc role and rolebinding
*/}}
-{{- define "minio.validateValues" -}}
-{{- $messages := list -}}
-{{- $messages := append $messages (include "minio.validateValues.mode" .) -}}
-{{- $messages := append $messages (include "minio.validateValues.totalDrives" .) -}}
-{{- $messages := append $messages (include "minio.validateValues.tls" .) -}}
-{{- $messages := without $messages "" -}}
-{{- $message := join "\n" $messages -}}
-
-{{- if $message -}}
-{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
-{{- end -}}
+{{- define "minio.sccRoleName" -}}
+ {{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
-Validate values of MinIO® - must provide a valid mode ("distributed" or "standalone")
+Properly format optional additional arguments to MinIO binary
*/}}
-{{- define "minio.validateValues.mode" -}}
-{{- $allowedValues := list "distributed" "standalone" }}
-{{- if not (has .Values.mode $allowedValues) -}}
-minio: mode
- Invalid mode selected. Valid values are "distributed" and
- "standalone". Please set a valid mode (--set mode="xxxx")
+{{- define "minio.extraArgs" -}}
+{{- range .Values.extraArgs -}}
+{{ " " }}{{ . }}
{{- end -}}
{{- end -}}
{{/*
-Validate values of MinIO® - total number of drives should be greater than 4
+Return the proper Docker Image Registry Secret Names
*/}}
-{{- define "minio.validateValues.totalDrives" -}}
-{{- $replicaCount := int .Values.statefulset.replicaCount }}
-{{- $drivesPerNode := int .Values.statefulset.drivesPerNode }}
-{{- $totalDrives := mul $replicaCount $drivesPerNode }}
-{{- if and (eq .Values.mode "distributed") (lt $totalDrives 4) -}}
-minio: total drives
- The total number of drives should be greater than 4 to guarantee erasure coding!
- Please set a combination of nodes, and drives per node that match this condition.
- For instance (--set statefulset.replicaCount=2 --set statefulset.drivesPerNode=2)
-{{- end -}}
-{{- end -}}
-
+{{- define "minio.imagePullSecrets" -}}
{{/*
-Validate values of MinIO® - TLS secret must provided if TLS is enabled
+Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
+but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic.
+Also, we can not use a single if because lazy evaluation is not an option
*/}}
-{{- define "minio.validateValues.tls" -}}
-{{- if and .Values.tls.enabled (not .Values.tls.existingSecret) (not .Values.tls.autoGenerated) }}
-minio: tls.existingSecret, tls.autoGenerated
- In order to enable TLS, you also need to provide
- an existing secret containing the TLS certificates or
- enable auto-generated certificates.
-{{- end -}}
+{{- if .Values.global }}
+{{- if .Values.global.imagePullSecrets }}
+imagePullSecrets:
+{{- range .Values.global.imagePullSecrets }}
+ - name: {{ . }}
+{{- end }}
+{{- else if .Values.imagePullSecrets }}
+imagePullSecrets:
+ {{ toYaml .Values.imagePullSecrets }}
{{- end -}}
-
-{{/*
-Return the secret containing MinIO TLS certificates
-*/}}
-{{- define "minio.tlsSecretName" -}}
-{{- if .Values.tls.existingSecret -}}
- {{- printf "%s" (tpl .Values.tls.existingSecret $) -}}
-{{- else -}}
- {{- printf "%s-crt" (include "common.names.fullname" .) -}}
+{{- else if .Values.imagePullSecrets }}
+imagePullSecrets:
+ {{ toYaml .Values.imagePullSecrets }}
{{- end -}}
{{- end -}}
-{{/*
-Return true if a TLS secret object should be created
-*/}}
-{{- define "minio.createTlsSecret" -}}
-{{- if and .Values.tls.enabled .Values.tls.autoGenerated (not .Values.tls.existingSecret) }}
- {{- true -}}
-{{- end -}}
+{{- define "minio.svcFQDN" -}}
+{{ include "minio.fullname" . }}-svc.{{ .Values.namespace }}.svc.cluster.local
{{- end -}}
{{/*
-Provisioning job labels (exclude matchLabels from standard labels)
+Formats volumeMount for MinIO TLS keys and trusted certs
*/}}
-{{- define "minio.labels.provisioning" -}}
-{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.provisioning.podLabels .Values.commonLabels ) "context" . ) }}
-{{- $provisioningLabels := (include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | fromYaml ) -}}
-{{- range (include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | fromYaml | keys ) -}}
-{{- $_ := unset $provisioningLabels . -}}
-{{- end -}}
-{{- print ($provisioningLabels | toYaml) -}}
+{{- define "minio.tlsKeysVolumeMount" -}}
+{{- if .Values.tls.enabled }}
+- name: cert-secret-volume
+ mountPath: {{ .Values.certsPath }}
+{{- end }}
+{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }}
+{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }}
+- name: trusted-cert-secret-volume
+ mountPath: {{ $casPath }}
+{{- end }}
{{- end -}}
{{/*
-Return the ingress anotation
+Formats volume for MinIO TLS keys and trusted certs
*/}}
-{{- define "minio.ingress.annotations" -}}
-{{ .Values.ingress.annotations | toYaml }}
+{{- define "minio.tlsKeysVolume" -}}
+{{- if .Values.tls.enabled }}
+- name: cert-secret-volume
+ secret:
+ secretName: {{ tpl .Values.tls.certSecret $ }}
+ items:
+ - key: {{ .Values.tls.publicCrt }}
+ path: public.crt
+ - key: {{ .Values.tls.privateKey }}
+ path: private.key
+{{- end }}
+{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }}
+{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }}
+{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }}
+- name: trusted-cert-secret-volume
+ secret:
+ secretName: {{ $certSecret }}
+ {{- if ne $publicCrt "" }}
+ items:
+ - key: {{ $publicCrt }}
+ path: public.crt
+ {{- end }}
+{{- end }}
{{- end -}}
{{/*
-Return the api ingress anotation
+Returns the available value for certain key in an existing secret (if it exists),
+otherwise it generates a random value.
*/}}
-{{- define "minio.apiIngress.annotations" -}}
-{{ .Values.apiIngress.annotations | toYaml }}
-{{- end -}}
+{{- define "minio.getValueFromSecret" }}
+ {{- $len := (default 16 .Length) | int -}}
+ {{- $obj := (lookup "v1" "Secret" .Namespace .Name).data -}}
+ {{- if $obj }}
+ {{- index $obj .Key | b64dec -}}
+ {{- else -}}
+ {{- randAlphaNum $len -}}
+ {{- end -}}
+{{- end }}
-{{/*
-Return the ingress hostname
-*/}}
-{{- define "minio.ingress.hostname" -}}
-{{- tpl .Values.ingress.hostname $ -}}
+{{- define "minio.root.username" -}}
+ {{- if .Values.rootUser }}
+ {{- .Values.rootUser | toString }}
+ {{- else }}
+ {{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 20 "Key" "rootUser") }}
+ {{- end }}
{{- end -}}
-{{/*
-Return the api ingress hostname
-*/}}
-{{- define "minio.apiIngress.hostname" -}}
-{{- tpl .Values.apiIngress.hostname $ -}}
+{{- define "minio.root.password" -}}
+ {{- if .Values.rootPassword }}
+ {{- .Values.rootPassword | toString }}
+ {{- else }}
+ {{- include "minio.getValueFromSecret" (dict "Namespace" .Release.Namespace "Name" (include "minio.fullname" .) "Length" 40 "Key" "rootPassword") }}
+ {{- end }}
{{- end -}}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/api-ingress.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/api-ingress.yaml
deleted file mode 100644
index a408aec8f..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/api-ingress.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if .Values.apiIngress.enabled -}}
-apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
-kind: Ingress
-metadata:
- name: {{ include "common.names.fullname" . }}-api
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list (include "minio.apiIngress.annotations" . | fromYaml) .Values.commonAnnotations ) "context" . ) }}
- {{- if $annotations }}
- annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" $) | nindent 4 }}
- {{- end }}
-spec:
- {{- if and .Values.apiIngress.ingressClassName (include "common.ingress.supportsIngressClassname" .) }}
- ingressClassName: {{ .Values.apiIngress.ingressClassName | quote }}
- {{- end }}
- rules:
- {{- if (include "minio.apiIngress.hostname" .) }}
- - host: {{ include "minio.apiIngress.hostname" . }}
- http:
- paths:
- {{- if .Values.apiIngress.extraPaths }}
- {{- toYaml .Values.apiIngress.extraPaths | nindent 10 }}
- {{- end }}
- - path: {{ .Values.apiIngress.path }}
- {{- if eq "true" (include "common.ingress.supportsPathType" .) }}
- pathType: {{ .Values.apiIngress.pathType }}
- {{- end }}
- backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" .) "servicePort" "minio-api" "context" $) | nindent 14 }}
- {{- end }}
- {{- range .Values.apiIngress.extraHosts }}
- - host: {{ .name | quote }}
- http:
- paths:
- - path: {{ default "/" .path }}
- {{- if eq "true" (include "common.ingress.supportsPathType" $) }}
- pathType: {{ default "ImplementationSpecific" .pathType }}
- {{- end }}
- backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" "minio-api" "context" $) | nindent 14 }}
- {{- end }}
- {{- if .Values.apiIngress.extraRules }}
- {{- include "common.tplvalues.render" (dict "value" .Values.apiIngress.extraRules "context" $) | nindent 4 }}
- {{- end }}
- {{- $annotationsMap := include "common.tplvalues.render" (dict "value" $annotations "context" $) | fromYaml }}
- {{- if or (and .Values.apiIngress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" $annotationsMap )) .Values.apiIngress.selfSigned)) .Values.apiIngress.extraTls }}
- tls:
- {{- if and .Values.apiIngress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" $annotationsMap )) .Values.apiIngress.selfSigned) }}
- - hosts:
- - {{ include "minio.apiIngress.hostname" . }}
- secretName: {{ printf "%s-tls" (include "minio.apiIngress.hostname" .) }}
- {{- end }}
- {{- if .Values.apiIngress.extraTls }}
- {{- include "common.tplvalues.render" ( dict "value" .Values.apiIngress.extraTls "context" $ ) | nindent 4 }}
- {{- end }}
- {{- end }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/ciliumnetworkpolicy.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/ciliumnetworkpolicy.yaml
new file mode 100644
index 000000000..d333a22e8
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/ciliumnetworkpolicy.yaml
@@ -0,0 +1,34 @@
+{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "cilium") }}
+kind: CiliumNetworkPolicy
+apiVersion: cilium.io/v2
+metadata:
+ name: {{ template "minio.fullname" . }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+spec:
+ endpointSelector:
+ matchLabels:
+ app: {{ template "minio.name" . }}
+ release: {{ .Release.Name }}
+ ingress:
+ - toPorts:
+ - ports:
+ - port: "{{ .Values.minioAPIPort }}"
+ protocol: TCP
+ - port: "{{ .Values.minioConsolePort }}"
+ protocol: TCP
+ {{- if not .Values.networkPolicy.allowExternal }}
+ fromEndpoints:
+ - matchLabels:
+ {{ template "minio.name" . }}-client: "true"
+ {{- end }}
+ egress:
+ {{- range $entity := .Values.networkPolicy.egressEntities }}
+ - toEntities:
+ - {{ $entity }}
+ {{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/configmap.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/configmap.yaml
new file mode 100644
index 000000000..f98607451
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/configmap.yaml
@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ template "minio.fullname" . }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+data:
+ initialize: |-
+ {{- include (print $.Template.BasePath "/_helper_create_bucket.txt") . | nindent 4 }}
+ add-user: |-
+ {{- include (print $.Template.BasePath "/_helper_create_user.txt") . | nindent 4 }}
+ add-policy: |-
+ {{- include (print $.Template.BasePath "/_helper_create_policy.txt") . | nindent 4 }}
+ {{- range $idx, $policy := .Values.policies }}
+ # Policy: {{ $policy.name }}
+ policy_{{ $idx }}.json: |-
+ {{- include (print $.Template.BasePath "/_helper_policy.tpl") . | nindent 4 }}
+ {{ end }}
+ {{- range $idx, $svc := .Values.svcaccts }}
+ {{- if $svc.policy }}
+ # SVC: {{ $svc.accessKey }}
+ svc_policy_{{ $idx }}.json: |-
+ {{- include (print $.Template.BasePath "/_helper_policy.tpl") .policy | nindent 4 }}
+ {{- end }}
+ {{- end }}
+ add-svcacct: |-
+ {{- include (print $.Template.BasePath "/_helper_create_svcacct.txt") . | nindent 4 }}
+ custom-command: |-
+ {{- include (print $.Template.BasePath "/_helper_custom_command.txt") . | nindent 4 }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/console-ingress.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/console-ingress.yaml
new file mode 100644
index 000000000..db5db5b4a
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/console-ingress.yaml
@@ -0,0 +1,57 @@
+{{- if .Values.consoleIngress.enabled -}}
+{{- $fullName := printf "%s-console" (include "minio.fullname" .) -}}
+{{- $servicePort := .Values.consoleService.port -}}
+{{- $ingressPath := .Values.consoleIngress.path -}}
+apiVersion: {{ template "minio.consoleIngress.apiVersion" . }}
+kind: Ingress
+metadata:
+ name: {{ $fullName }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+ {{- with .Values.consoleIngress.labels }}
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ {{- with .Values.consoleIngress.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ {{- if .Values.consoleIngress.ingressClassName }}
+ ingressClassName: {{ .Values.consoleIngress.ingressClassName }}
+ {{- end }}
+ {{- if .Values.consoleIngress.tls }}
+ tls:
+ {{- range .Values.consoleIngress.tls }}
+ - hosts:
+ {{- range .hosts }}
+ - {{ tpl . $ | quote }}
+ {{- end }}
+ secretName: {{ tpl .secretName $ }}
+ {{- end }}
+ {{- end }}
+ rules:
+ {{- range .Values.consoleIngress.hosts }}
+ - http:
+ paths:
+ - path: {{ $ingressPath }}
+ {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+ pathType: ImplementationSpecific
+ backend:
+ service:
+ name: {{ $fullName }}
+ port:
+ number: {{ $servicePort }}
+ {{- else }}
+ backend:
+ serviceName: {{ $fullName }}
+ servicePort: {{ $servicePort }}
+ {{- end }}
+ {{- if . }}
+ host: {{ tpl . $ | quote }}
+ {{- end }}
+ {{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/console-service.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/console-service.yaml
new file mode 100644
index 000000000..dca4bf5af
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/console-service.yaml
@@ -0,0 +1,46 @@
+{{ $scheme := .Values.tls.enabled | ternary "https" "http" }}
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ template "minio.fullname" . }}-console
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+ {{- if .Values.consoleService.annotations }}
+ annotations: {{- toYaml .Values.consoleService.annotations | nindent 4 }}
+ {{- end }}
+spec:
+ type: {{ .Values.consoleService.type }}
+ {{- if and (eq .Values.consoleService.type "ClusterIP") .Values.consoleService.clusterIP }}
+ clusterIP: {{ .Values.consoleService.clusterIP }}
+ {{- end }}
+ {{- if or (eq .Values.consoleService.type "LoadBalancer") (eq .Values.consoleService.type "NodePort") }}
+ externalTrafficPolicy: {{ .Values.consoleService.externalTrafficPolicy | quote }}
+ {{- end }}
+ {{- if and (eq .Values.consoleService.type "LoadBalancer") .Values.consoleService.loadBalancerSourceRanges }}
+ loadBalancerSourceRanges: {{ .Values.consoleService.loadBalancerSourceRanges }}
+ {{ end }}
+ {{- if and (eq .Values.consoleService.type "LoadBalancer") (not (empty .Values.consoleService.loadBalancerIP)) }}
+ loadBalancerIP: {{ .Values.consoleService.loadBalancerIP }}
+ {{- end }}
+ ports:
+ - name: {{ $scheme }}
+ port: {{ .Values.consoleService.port }}
+ protocol: TCP
+ {{- if (and (eq .Values.consoleService.type "NodePort") ( .Values.consoleService.nodePort)) }}
+ nodePort: {{ .Values.consoleService.nodePort }}
+ {{- else }}
+ targetPort: {{ .Values.minioConsolePort }}
+ {{- end }}
+ {{- if .Values.consoleService.externalIPs }}
+ externalIPs:
+ {{- range $i , $ip := .Values.consoleService.externalIPs }}
+ - {{ $ip }}
+ {{- end }}
+ {{- end }}
+ selector:
+ app: {{ template "minio.name" . }}
+ release: {{ .Release.Name }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/deployment.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/deployment.yaml
new file mode 100644
index 000000000..3438778bc
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/deployment.yaml
@@ -0,0 +1,214 @@
+{{- if eq .Values.mode "standalone" }}
+{{ $scheme := .Values.tls.enabled | ternary "https" "http" }}
+{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }}
+apiVersion: {{ template "minio.deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+ name: {{ template "minio.fullname" . }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+ {{- if .Values.additionalLabels }}
+ {{- toYaml .Values.additionalLabels | nindent 4 }}
+ {{- end }}
+ {{- if .Values.additionalAnnotations }}
+ annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }}
+ {{- end }}
+spec:
+ strategy:
+ type: {{ .Values.deploymentUpdate.type }}
+ {{- if eq .Values.deploymentUpdate.type "RollingUpdate" }}
+ rollingUpdate:
+ maxSurge: {{ .Values.deploymentUpdate.maxSurge }}
+ maxUnavailable: {{ .Values.deploymentUpdate.maxUnavailable }}
+ {{- end }}
+ replicas: 1
+ selector:
+ matchLabels:
+ app: {{ template "minio.name" . }}
+ release: {{ .Release.Name }}
+ template:
+ metadata:
+ name: {{ template "minio.fullname" . }}
+ labels:
+ app: {{ template "minio.name" . }}
+ release: {{ .Release.Name }}
+ {{- if .Values.podLabels }}
+ {{- toYaml .Values.podLabels | nindent 8 }}
+ {{- end }}
+ annotations:
+ {{- if not .Values.ignoreChartChecksums }}
+ checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+ checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+ {{- end }}
+ {{- if .Values.podAnnotations }}
+ {{- toYaml .Values.podAnnotations | trimSuffix "\n" | nindent 8 }}
+ {{- end }}
+ spec:
+ {{- if .Values.priorityClassName }}
+ priorityClassName: "{{ .Values.priorityClassName }}"
+ {{- end }}
+ {{- if .Values.runtimeClassName }}
+ runtimeClassName: "{{ .Values.runtimeClassName }}"
+ {{- end }}
+ {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
+ securityContext:
+ {{ omit .Values.securityContext "enabled" | toYaml | nindent 8 }}
+ {{- end }}
+ {{ if .Values.serviceAccount.create }}
+ serviceAccountName: {{ .Values.serviceAccount.name }}
+ {{- end }}
+ containers:
+ - name: {{ .Chart.Name }}
+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ command:
+ - "/bin/sh"
+ - "-ce"
+ - "/usr/bin/docker-entrypoint.sh minio server {{ $bucketRoot }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template "minio.extraArgs" . }}"
+ volumeMounts:
+ - name: minio-user
+ mountPath: "/tmp/credentials"
+ readOnly: true
+ - name: export
+ mountPath: {{ .Values.mountPath }}
+ {{- if and .Values.persistence.enabled .Values.persistence.subPath }}
+ subPath: "{{ .Values.persistence.subPath }}"
+ {{- end }}
+ {{- if .Values.extraSecret }}
+ - name: extra-secret
+ mountPath: "/tmp/minio-config-env"
+ {{- end }}
+ {{- include "minio.tlsKeysVolumeMount" . | indent 12 }}
+ {{- if .Values.extraVolumeMounts }}
+ {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+ {{- end }}
+ ports:
+ - name: {{ $scheme }}
+ containerPort: {{ .Values.minioAPIPort }}
+ - name: {{ $scheme }}-console
+ containerPort: {{ .Values.minioConsolePort }}
+ env:
+ - name: MINIO_ROOT_USER
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "minio.secretName" . }}
+ key: rootUser
+ - name: MINIO_ROOT_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "minio.secretName" . }}
+ key: rootPassword
+ {{- if .Values.extraSecret }}
+ - name: MINIO_CONFIG_ENV_FILE
+ value: "/tmp/minio-config-env/config.env"
+ {{- end }}
+ {{- if .Values.metrics.serviceMonitor.public }}
+ - name: MINIO_PROMETHEUS_AUTH_TYPE
+ value: "public"
+ {{- end }}
+ {{- if .Values.oidc.enabled }}
+ - name: MINIO_IDENTITY_OPENID_CONFIG_URL
+ value: {{ .Values.oidc.configUrl }}
+ - name: MINIO_IDENTITY_OPENID_CLIENT_ID
+ {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientIdKey }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ .Values.oidc.existingClientSecretName }}
+ key: {{ .Values.oidc.existingClientIdKey }}
+ {{- else }}
+ value: {{ .Values.oidc.clientId }}
+ {{- end }}
+ - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+ {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientSecretKey }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ .Values.oidc.existingClientSecretName }}
+ key: {{ .Values.oidc.existingClientSecretKey }}
+ {{- else }}
+ value: {{ .Values.oidc.clientSecret }}
+ {{- end }}
+ - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
+ value: {{ .Values.oidc.claimName }}
+ - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX
+ value: {{ .Values.oidc.claimPrefix }}
+ - name: MINIO_IDENTITY_OPENID_SCOPES
+ value: {{ .Values.oidc.scopes }}
+ - name: MINIO_IDENTITY_OPENID_COMMENT
+ value: {{ .Values.oidc.comment }}
+ - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
+ value: {{ .Values.oidc.redirectUri }}
+ - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
+ value: {{ .Values.oidc.displayName }}
+ {{- end }}
+ {{- if .Values.etcd.endpoints }}
+ - name: MINIO_ETCD_ENDPOINTS
+ value: {{ join "," .Values.etcd.endpoints | quote }}
+ {{- if .Values.etcd.clientCert }}
+ - name: MINIO_ETCD_CLIENT_CERT
+ value: "/tmp/credentials/etcd_client_cert.pem"
+ {{- end }}
+ {{- if .Values.etcd.clientCertKey }}
+ - name: MINIO_ETCD_CLIENT_CERT_KEY
+ value: "/tmp/credentials/etcd_client_cert_key.pem"
+ {{- end }}
+ {{- if .Values.etcd.pathPrefix }}
+ - name: MINIO_ETCD_PATH_PREFIX
+ value: {{ .Values.etcd.pathPrefix }}
+ {{- end }}
+ {{- if .Values.etcd.corednsPathPrefix }}
+ - name: MINIO_ETCD_COREDNS_PATH
+ value: {{ .Values.etcd.corednsPathPrefix }}
+ {{- end }}
+ {{- end }}
+ {{- range $key, $val := .Values.environment }}
+ - name: {{ $key }}
+ value: {{ tpl $val $ | quote }}
+ {{- end }}
+ resources: {{- toYaml .Values.resources | nindent 12 }}
+ {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
+ {{- with .Values.containerSecurityContext }}
+ securityContext: {{ toYaml . | nindent 12}}
+ {{- end }}
+ {{- end }}
+ {{- with .Values.extraContainers }}
+ {{- if eq (typeOf .) "string" }}
+ {{- tpl . $ | nindent 8 }}
+ {{- else }}
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- end }}
+ {{- with .Values.nodeSelector }}
+ nodeSelector: {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- include "minio.imagePullSecrets" . | indent 6 }}
+ {{- with .Values.affinity }}
+ affinity: {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.tolerations }}
+ tolerations: {{- toYaml . | nindent 8 }}
+ {{- end }}
+ volumes:
+ - name: export
+ {{- if .Values.persistence.enabled }}
+ persistentVolumeClaim:
+ claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }}
+ {{- else }}
+ emptyDir: {}
+ {{- end }}
+ {{- if .Values.extraSecret }}
+ - name: extra-secret
+ secret:
+ secretName: {{ .Values.extraSecret }}
+ {{- end }}
+ - name: minio-user
+ secret:
+ secretName: {{ template "minio.secretName" . }}
+ {{- include "minio.tlsKeysVolume" . | indent 8 }}
+ {{- if .Values.extraVolumes }}
+ {{ toYaml .Values.extraVolumes | nindent 8 }}
+ {{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/distributed/headless-svc.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/distributed/headless-svc.yaml
deleted file mode 100644
index 657ad1a4e..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/distributed/headless-svc.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if (eq .Values.mode "distributed") }}
-apiVersion: v1
-kind: Service
-metadata:
- name: {{ printf "%s-headless" (include "common.names.fullname" .) | trunc 63 }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if or .Values.service.headless.annotations .Values.commonAnnotations }}
- {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.headless.annotations .Values.commonAnnotations ) "context" . ) }}
- annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" $) | nindent 4 }}
- {{- end }}
-spec:
- type: ClusterIP
- clusterIP: None
- ports:
- - name: minio-api
- port: {{ .Values.service.ports.api }}
- targetPort: minio-api
- - name: minio-console
- port: {{ .Values.service.ports.console }}
- targetPort: minio-console
- publishNotReadyAddresses: true
- {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
- selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/distributed/pdb.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/distributed/pdb.yaml
deleted file mode 100644
index d5dcd6a36..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/distributed/pdb.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if and .Values.pdb.create (eq .Values.mode "distributed") }}
-apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
-kind: PodDisruptionBudget
-metadata:
- name: {{ include "common.names.fullname" . }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
-spec:
- {{- if .Values.pdb.minAvailable }}
- minAvailable: {{ .Values.pdb.minAvailable }}
- {{- end }}
- {{- if .Values.pdb.maxUnavailable }}
- maxUnavailable: {{ .Values.pdb.maxUnavailable }}
- {{- end }}
- {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
- selector:
- matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/distributed/statefulset.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/distributed/statefulset.yaml
deleted file mode 100644
index 1d59c5c43..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/distributed/statefulset.yaml
+++ /dev/null
@@ -1,342 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if (eq .Values.mode "distributed") }}
-{{- $fullname := include "common.names.fullname" . }}
-{{- $headlessService := printf "%s-headless" (include "common.names.fullname" .) | trunc 63 }}
-{{- $releaseNamespace := include "common.names.namespace" . }}
-{{- $clusterDomain := .Values.clusterDomain }}
-{{- $apiPort := toString .Values.containerPorts.api }}
-{{- $replicaCount := int .Values.statefulset.replicaCount }}
-{{- $zoneCount := int .Values.statefulset.zones }}
-{{- $drivesPerNode := int .Values.statefulset.drivesPerNode }}
-{{- $mountPath := .Values.persistence.mountPath }}
-apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
-kind: StatefulSet
-metadata:
- name: {{ $fullname }}
- namespace: {{ $releaseNamespace | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
-spec:
- {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
- selector:
- matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
- serviceName: {{ $headlessService }}
- replicas: {{ mul $zoneCount $replicaCount }}
- podManagementPolicy: {{ .Values.statefulset.podManagementPolicy }}
- {{- if .Values.statefulset.updateStrategy }}
- updateStrategy: {{- toYaml .Values.statefulset.updateStrategy | nindent 4 }}
- {{- end }}
- template:
- metadata:
- labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
- {{- if or .Values.podAnnotations (include "minio.createSecret" .) }}
- annotations:
- {{- if (include "minio.createSecret" .) }}
- checksum/credentials-secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
- {{- end }}
- {{- if .Values.podAnnotations }}
- {{- include "common.tplvalues.render" ( dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
- {{- end }}
- {{- end }}
- spec:
- {{- include "minio.imagePullSecrets" . | nindent 6 }}
- {{- if .Values.schedulerName }}
- schedulerName: {{ .Values.schedulerName }}
- {{- end }}
- serviceAccountName: {{ template "minio.serviceAccountName" . }}
- {{- if .Values.affinity }}
- affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }}
- {{- else }}
- affinity:
- podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
- podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
- nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
- {{- end }}
- {{- if .Values.nodeSelector }}
- nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
- {{- end }}
- automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
- {{- if .Values.hostAliases }}
- hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
- {{- end }}
- {{- if .Values.tolerations }}
- tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
- {{- end }}
- {{- if .Values.topologySpreadConstraints }}
- topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" $) | nindent 8 }}
- {{- end }}
- {{- if .Values.priorityClassName }}
- priorityClassName: {{ .Values.priorityClassName | quote }}
- {{- end }}
- {{- if .Values.runtimeClassName }}
- runtimeClassName: {{ .Values.runtimeClassName | quote }}
- {{- end}}
- {{- if .Values.podSecurityContext.enabled }}
- securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
- {{- end }}
- {{- if .Values.terminationGracePeriodSeconds }}
- terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
- {{- end }}
- {{- if or .Values.initContainers (and .Values.volumePermissions.enabled .Values.persistence.enabled) }}
- initContainers:
- {{- if .Values.initContainers }}
- {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
- {{- end }}
- {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
- - name: volume-permissions
- image: {{ template "minio.volumePermissions.image" . }}
- imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }}
- command:
- - /bin/bash
- - -ec
- - |
- {{- if and .Values.persistence.enabled (gt $drivesPerNode 1) }}
- chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ range $diskId := until $drivesPerNode }}{{ $mountPath }}-{{ $diskId }} {{ end }}
- {{- else }}
- chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ $mountPath }}
- {{- end }}
- securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }}
- {{- if .Values.volumePermissions.resources }}
- resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
- {{- end }}
- volumeMounts:
- {{- if and .Values.persistence.enabled (gt $drivesPerNode 1) }}
- {{- range $diskId := until $drivesPerNode }}
- - name: data-{{ $diskId }}
- mountPath: {{ $mountPath }}-{{ $diskId }}
- {{- end }}
- {{- else }}
- - name: data
- mountPath: {{ $mountPath }}
- {{- end }}
- {{- end }}
- {{- end }}
- containers:
- - name: minio
- image: {{ include "minio.image" . }}
- imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
- {{- if .Values.containerSecurityContext.enabled }}
- securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
- {{- end }}
- {{- if .Values.command }}
- command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
- {{- end }}
- {{- if .Values.args }}
- args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
- {{- end }}
- env:
- - name: BITNAMI_DEBUG
- value: {{ ternary "true" "false" .Values.image.debug | quote }}
- - name: MINIO_DISTRIBUTED_MODE_ENABLED
- value: "yes"
- - name: MINIO_DISTRIBUTED_NODES
- {{- $clusters := list }}
- {{- range $i := until $zoneCount }}
- {{- $factor := mul $i $replicaCount }}
- {{- $endIndex := sub (add $factor $replicaCount) 1 }}
- {{- $beginIndex := mul $i $replicaCount }}
- {{- $bucket := ternary (printf "%s-{0...%d}" $mountPath (sub $drivesPerNode 1)) $mountPath (gt $drivesPerNode 1) }}
- {{- $clusters = append $clusters (printf "%s-{%d...%d}.%s.%s.svc.%s:%s%s" $fullname $beginIndex $endIndex $headlessService $releaseNamespace $clusterDomain $apiPort $bucket) }}
- {{- end }}
- value: {{ join "," $clusters | quote }}
- - name: MINIO_SCHEME
- value: {{ ternary "https" "http" .Values.tls.enabled | quote }}
- - name: MINIO_FORCE_NEW_KEYS
- value: {{ ternary "yes" "no" .Values.auth.forceNewKeys | quote }}
- {{- if .Values.auth.useCredentialsFiles }}
- - name: MINIO_ROOT_USER_FILE
- value: "/opt/bitnami/minio/secrets/root-user"
- {{- else }}
- - name: MINIO_ROOT_USER
- valueFrom:
- secretKeyRef:
- name: {{ include "minio.secretName" . }}
- key: root-user
- {{- end }}
- {{- if .Values.auth.useCredentialsFiles }}
- - name: MINIO_ROOT_PASSWORD_FILE
- value: "/opt/bitnami/minio/secrets/root-password"
- {{- else }}
- - name: MINIO_ROOT_PASSWORD
- valueFrom:
- secretKeyRef:
- name: {{ include "minio.secretName" . }}
- key: root-password
- {{- end }}
- - name: MINIO_SKIP_CLIENT
- value: {{ ternary "yes" "no" (empty .Values.defaultBuckets) | quote }}
- {{- if .Values.defaultBuckets }}
- - name: MINIO_DEFAULT_BUCKETS
- value: {{ .Values.defaultBuckets }}
- {{- end }}
- - name: MINIO_BROWSER
- value: {{ ternary "off" "on" .Values.disableWebUI | quote }}
- - name: MINIO_PROMETHEUS_AUTH_TYPE
- value: {{ .Values.metrics.prometheusAuthType | quote }}
- {{- if .Values.tls.mountPath }}
- - name: MINIO_CERTS_DIR
- value: {{ .Values.tls.mountPath | quote }}
- - name: MINIO_CONSOLE_PORT_NUMBER
- value: {{ .Values.containerPorts.console | quote }}
- {{- end }}
- {{- if .Values.extraEnvVars }}
- {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
- {{- end }}
- envFrom:
- {{- if .Values.extraEnvVarsCM }}
- - configMapRef:
- name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
- {{- end }}
- {{- if .Values.extraEnvVarsSecret }}
- - secretRef:
- name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
- {{- end }}
- ports:
- - name: minio-api
- containerPort: {{ .Values.containerPorts.api }}
- protocol: TCP
- - name: minio-console
- containerPort: {{ .Values.containerPorts.console }}
- protocol: TCP
- {{- if .Values.customLivenessProbe }}
- livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
- {{- else if .Values.livenessProbe.enabled }}
- livenessProbe:
- httpGet:
- path: /minio/health/live
- port: minio-api
- scheme: {{ ternary "HTTPS" "HTTP" .Values.tls.enabled | quote }}
- initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
- periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
- timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
- successThreshold: {{ .Values.livenessProbe.successThreshold }}
- failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
- {{- end }}
- {{- if .Values.customReadinessProbe }}
- readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
- {{- else if .Values.readinessProbe.enabled }}
- readinessProbe:
- tcpSocket:
- port: minio-api
- initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
- periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
- timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
- successThreshold: {{ .Values.readinessProbe.successThreshold }}
- failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
- {{- end }}
- {{- if .Values.customStartupProbe }}
- startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
- {{- else if .Values.startupProbe.enabled }}
- startupProbe:
- tcpSocket:
- port: minio-api
- initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
- periodSeconds: {{ .Values.startupProbe.periodSeconds }}
- timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
- successThreshold: {{ .Values.startupProbe.successThreshold }}
- failureThreshold: {{ .Values.startupProbe.failureThreshold }}
- {{- end }}
- {{- if .Values.resources }}
- resources: {{- toYaml .Values.resources | nindent 12 }}
- {{- end }}
- {{- if .Values.lifecycleHooks }}
- lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
- {{- end }}
- volumeMounts:
- {{- if .Values.auth.useCredentialsFiles }}
- - name: minio-credentials
- mountPath: /opt/bitnami/minio/secrets/
- {{- end }}
- {{- if .Values.tls.enabled }}
- - name: minio-certs
- mountPath: {{ default "/certs" .Values.tls.mountPath }}
- {{- end }}
- {{- if gt $drivesPerNode 1 }}
- {{- range $diskId := until $drivesPerNode }}
- - name: data-{{ $diskId }}
- mountPath: {{ $mountPath }}-{{ $diskId }}
- {{- end }}
- {{- else }}
- - name: data
- mountPath: {{ $mountPath }}
- {{- end }}
- {{- if .Values.extraVolumeMounts }}
- {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
- {{- end }}
- {{- if .Values.sidecars }}
- {{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
- {{- end }}
- volumes:
- {{- if .Values.auth.useCredentialsFiles }}
- - name: minio-credentials
- secret:
- secretName: {{ include "minio.secretName" . }}
- {{- end }}
- {{- if .Values.tls.enabled }}
- - name: minio-certs
- secret:
- secretName: {{ include "minio.tlsSecretName" . }}
- items:
- - key: tls.crt
- path: public.crt
- - key: tls.key
- path: private.key
- - key: ca.crt
- path: CAs/public.crt
- {{- end }}
- {{- if .Values.extraVolumes }}
- {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
- {{- end }}
- {{- if and (not .Values.persistence.enabled) (gt $drivesPerNode 1) }}
- {{- range $diskId := until $drivesPerNode }}
- - name: data-{{ $diskId }}
- emptyDir: {}
- {{- end }}
- {{- else if not .Values.persistence.enabled }}
- - name: data
- emptyDir: {}
- {{- else }}
- volumeClaimTemplates:
- {{- if gt $drivesPerNode 1 }}
- {{- range $diskId := until $drivesPerNode }}
- - metadata:
- name: data-{{ $diskId }}
- labels: {{- include "common.labels.matchLabels" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 10 }}
- {{- if $.Values.persistence.annotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.persistence.annotations "context" $) | nindent 10 }}
- {{- end }}
- spec:
- accessModes:
- {{- range $.Values.persistence.accessModes }}
- - {{ . | quote }}
- {{- end }}
- resources:
- requests:
- storage: {{ $.Values.persistence.size | quote }}
- {{- include "common.storage.class" (dict "persistence" $.Values.persistence "global" $.Values.global) | nindent 8 }}
- {{- end }}
- {{- else }}
- - metadata:
- name: data
- labels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 10 }}
- {{- if .Values.persistence.annotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.persistence.annotations "context" $) | nindent 10 }}
- {{- end }}
- spec:
- accessModes:
- {{- range .Values.persistence.accessModes }}
- - {{ . | quote }}
- {{- end }}
- resources:
- requests:
- storage: {{ .Values.persistence.size | quote }}
- {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 8 }}
- {{- end }}
- {{- end }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/extra-list.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/extra-list.yaml
deleted file mode 100644
index 2d35a580e..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/extra-list.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- range .Values.extraDeploy }}
----
-{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/ingress.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/ingress.yaml
index b05390f58..1749712ac 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/ingress.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/ingress.yaml
@@ -1,60 +1,56 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if and .Values.ingress.enabled (not .Values.disableWebUI ) -}}
-apiVersion: {{ include "common.capabilities.ingress.apiVersion" . }}
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "minio.fullname" . -}}
+{{- $servicePort := .Values.service.port -}}
+{{- $ingressPath := .Values.ingress.path -}}
+apiVersion: {{ template "minio.ingress.apiVersion" . }}
kind: Ingress
metadata:
- name: {{ include "common.names.fullname" . }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list (include "minio.ingress.annotations" . | fromYaml) .Values.commonAnnotations ) "context" . ) }}
- {{- if $annotations }}
- annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" $) | nindent 4 }}
+ name: {{ $fullName }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+ {{- with .Values.ingress.labels }}
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ {{- with .Values.ingress.annotations }}
+ annotations: {{- toYaml . | nindent 4 }}
{{- end }}
spec:
- {{- if and .Values.ingress.ingressClassName (include "common.ingress.supportsIngressClassname" .) }}
- ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
+ {{- if .Values.ingress.ingressClassName }}
+ ingressClassName: {{ .Values.ingress.ingressClassName }}
{{- end }}
- rules:
- {{- if (include "minio.ingress.hostname" .) }}
- - host: {{ include "minio.ingress.hostname" . }}
- http:
- paths:
- {{- if .Values.ingress.extraPaths }}
- {{- toYaml .Values.ingress.extraPaths | nindent 10 }}
- {{- end }}
- - path: {{ .Values.ingress.path }}
- {{- if eq "true" (include "common.ingress.supportsPathType" .) }}
- pathType: {{ .Values.ingress.pathType }}
- {{- end }}
- backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" .) "servicePort" "minio-console" "context" $) | nindent 14 }}
- {{- end }}
- {{- range .Values.ingress.extraHosts }}
- - host: {{ .name | quote }}
- http:
- paths:
- - path: {{ default "/" .path }}
- {{- if eq "true" (include "common.ingress.supportsPathType" $) }}
- pathType: {{ default "ImplementationSpecific" .pathType }}
- {{- end }}
- backend: {{- include "common.ingress.backend" (dict "serviceName" (include "common.names.fullname" $) "servicePort" "minio-console" "context" $) | nindent 14 }}
- {{- end }}
- {{- if .Values.ingress.extraRules }}
- {{- include "common.tplvalues.render" (dict "value" .Values.ingress.extraRules "context" $) | nindent 4 }}
- {{- end }}
- {{- $annotationsMap := include "common.tplvalues.render" (dict "value" $annotations "context" $) | fromYaml }}
- {{- if or (and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" $annotationsMap )) .Values.ingress.selfSigned)) .Values.ingress.extraTls }}
+ {{- if .Values.ingress.tls }}
tls:
- {{- if and .Values.ingress.tls (or (include "common.ingress.certManagerRequest" ( dict "annotations" $annotationsMap )) .Values.ingress.selfSigned) }}
+ {{- range .Values.ingress.tls }}
- hosts:
- - {{ include "minio.ingress.hostname" . }}
- secretName: {{ printf "%s-tls" (include "minio.ingress.hostname" .) }}
- {{- end }}
- {{- if .Values.ingress.extraTls }}
- {{- include "common.tplvalues.render" ( dict "value" .Values.ingress.extraTls "context" $ ) | nindent 4 }}
+ {{- range .hosts }}
+ - {{ tpl . $ | quote }}
+ {{- end }}
+ secretName: {{ tpl .secretName $ }}
{{- end }}
{{- end }}
+ rules:
+ {{- range .Values.ingress.hosts }}
+ - http:
+ paths:
+ - path: {{ $ingressPath }}
+ {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+ pathType: ImplementationSpecific
+ backend:
+ service:
+ name: {{ $fullName }}
+ port:
+ number: {{ $servicePort }}
+ {{- else }}
+ backend:
+ serviceName: {{ $fullName }}
+ servicePort: {{ $servicePort }}
+ {{- end }}
+ {{- if . }}
+ host: {{ tpl . $ | quote }}
+ {{- end }}
+ {{- end }}
{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/networkpolicy.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/networkpolicy.yaml
index 2d6188403..698bb91ae 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/networkpolicy.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/networkpolicy.yaml
@@ -1,36 +1,27 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if .Values.networkPolicy.enabled }}
+{{- if and (.Values.networkPolicy.enabled) (eq .Values.networkPolicy.flavor "kubernetes") }}
kind: NetworkPolicy
-apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
+apiVersion: {{ template "minio.networkPolicy.apiVersion" . }}
metadata:
- name: {{ include "common.names.fullname" . }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
+ name: {{ template "minio.fullname" . }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
spec:
- {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
podSelector:
- matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
+ matchLabels:
+ app: {{ template "minio.name" . }}
+ release: {{ .Release.Name }}
ingress:
- # Allow inbound connections
- ports:
- - port: {{ .Values.containerPorts.console }}
- - port: {{ .Values.containerPorts.api }}
+ - port: {{ .Values.minioAPIPort }}
+ - port: {{ .Values.minioConsolePort }}
{{- if not .Values.networkPolicy.allowExternal }}
from:
- podSelector:
matchLabels:
- {{ include "common.names.fullname" . }}-client: "true"
- - podSelector:
- matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
- {{- if .Values.networkPolicy.extraFromClauses }}
- {{- toYaml .Values.networkPolicy.extraFromClauses | nindent 8 }}
- {{- end }}
+ {{ template "minio.name" . }}-client: "true"
{{- end }}
{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/poddisruptionbudget.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/poddisruptionbudget.yaml
new file mode 100644
index 000000000..1b7d10c27
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/poddisruptionbudget.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodDisruptionBudget" }}
+apiVersion: policy/v1beta1
+{{- else }}
+apiVersion: policy/v1
+{{- end }}
+kind: PodDisruptionBudget
+metadata:
+ name: minio
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+spec:
+ maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+ selector:
+ matchLabels:
+ app: {{ template "minio.name" . }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/post-job.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/post-job.yaml
new file mode 100644
index 000000000..301485ffa
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/post-job.yaml
@@ -0,0 +1,259 @@
+{{- if or .Values.buckets .Values.users .Values.policies .Values.customCommands .Values.svcaccts }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+ name: {{ template "minio.fullname" . }}-post-job
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}-post-job
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+ annotations:
+ "helm.sh/hook": post-install,post-upgrade
+ "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation
+ {{- with .Values.postJob.annotations }}
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ template:
+ metadata:
+ labels:
+ app: {{ template "minio.name" . }}-job
+ release: {{ .Release.Name }}
+ {{- if .Values.podLabels }}
+ {{- toYaml .Values.podLabels | nindent 8 }}
+ {{- end }}
+ {{- if .Values.postJob.podAnnotations }}
+ annotations: {{- toYaml .Values.postJob.podAnnotations | nindent 8 }}
+ {{- end }}
+ spec:
+ restartPolicy: OnFailure
+ {{- include "minio.imagePullSecrets" . | indent 6 }}
+ {{- if .Values.nodeSelector }}
+ nodeSelector: {{- toYaml .Values.postJob.nodeSelector | nindent 8 }}
+ {{- end }}
+ {{- with .Values.postJob.affinity }}
+ affinity: {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.postJob.tolerations }}
+ tolerations: {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- if .Values.postJob.securityContext.enabled }}
+ securityContext: {{ omit .Values.postJob.securityContext "enabled" | toYaml | nindent 12 }}
+ {{- end }}
+ volumes:
+ - name: etc-path
+ emptyDir: {}
+ - name: tmp
+ emptyDir: {}
+ - name: minio-configuration
+ projected:
+ sources:
+ - configMap:
+ name: {{ template "minio.fullname" . }}
+ - secret:
+ name: {{ template "minio.secretName" . }}
+ {{- range (concat .Values.users (default (list) .Values.svcaccts)) }}
+ {{- if .existingSecret }}
+ - secret:
+ name: {{ tpl .existingSecret $ }}
+ items:
+ - key: {{ .existingSecretKey }}
+ path: secrets/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }}
+ {{- end }}
+ {{- end }}
+ {{- range ( default list .Values.svcaccts ) }}
+ {{- if .existingSecret }}
+ - secret:
+ name: {{ tpl .existingSecret $ }}
+ items:
+ - key: {{ .existingSecretKey }}
+ path: secrets-svc/{{ tpl .existingSecret $ }}/{{ tpl .existingSecretKey $ }}
+ {{- end }}
+ {{- end }}
+ {{- if .Values.tls.enabled }}
+ - name: cert-secret-volume-mc
+ secret:
+ secretName: {{ .Values.tls.certSecret }}
+ items:
+ - key: {{ .Values.tls.publicCrt }}
+ path: CAs/public.crt
+ {{- end }}
+ {{- if .Values.customCommandJob.extraVolumes }}
+ {{- toYaml .Values.customCommandJob.extraVolumes | nindent 8 }}
+ {{- end }}
+ {{- if .Values.serviceAccount.create }}
+ serviceAccountName: {{ .Values.serviceAccount.name }}
+ {{- end }}
+ {{- if .Values.policies }}
+ initContainers:
+ - name: minio-make-policy
+ image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+ {{- if .Values.makePolicyJob.securityContext.enabled }}
+ {{- with .Values.makePolicyJob.containerSecurityContext }}
+ securityContext: {{ toYaml . | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+ {{- if .Values.makePolicyJob.exitCommand }}
+ command: [ "/bin/sh", "-c" ]
+ args: [ "/bin/sh /config/add-policy; EV=$?; {{ .Values.makePolicyJob.exitCommand }} && exit $EV" ]
+ {{- else }}
+ command: [ "/bin/sh", "/config/add-policy" ]
+ {{- end }}
+ env:
+ - name: MINIO_ENDPOINT
+ value: {{ template `minio.svcFQDN` $ }}
+ - name: MINIO_PORT
+ value: {{ .Values.service.port | quote }}
+ volumeMounts:
+ - name: etc-path
+ mountPath: /etc/minio/mc
+ - name: tmp
+ mountPath: /tmp
+ - name: minio-configuration
+ mountPath: /config
+ {{- if .Values.tls.enabled }}
+ - name: cert-secret-volume-mc
+ mountPath: {{ .Values.configPathmc }}certs
+ {{- end }}
+ resources: {{- toYaml .Values.makePolicyJob.resources | nindent 12 }}
+ {{- end }}
+ containers:
+ {{- if .Values.buckets }}
+ - name: minio-make-bucket
+ image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+ {{- if .Values.makeBucketJob.securityContext.enabled }}
+ {{- with .Values.makeBucketJob.containerSecurityContext }}
+ securityContext: {{ toYaml . | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+ {{- if .Values.makeBucketJob.exitCommand }}
+ command: [ "/bin/sh", "-c" ]
+ args: [ "/bin/sh /config/initialize; EV=$?; {{ .Values.makeBucketJob.exitCommand }} && exit $EV" ]
+ {{- else }}
+ command: [ "/bin/sh", "/config/initialize" ]
+ {{- end }}
+ env:
+ - name: MINIO_ENDPOINT
+ value: {{ template `minio.svcFQDN` $ }}
+ - name: MINIO_PORT
+ value: {{ .Values.service.port | quote }}
+ volumeMounts:
+ - name: etc-path
+ mountPath: /etc/minio/mc
+ - name: tmp
+ mountPath: /tmp
+ - name: minio-configuration
+ mountPath: /config
+ {{- if .Values.tls.enabled }}
+ - name: cert-secret-volume-mc
+ mountPath: {{ .Values.configPathmc }}certs
+ {{- end }}
+ resources: {{- toYaml .Values.makeBucketJob.resources | nindent 12 }}
+ {{- end }}
+ {{- if .Values.users }}
+ - name: minio-make-user
+ image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+ {{- if .Values.makeUserJob.securityContext.enabled }}
+ {{- with .Values.makeUserJob.containerSecurityContext }}
+ securityContext: {{ toYaml . | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+ {{- if .Values.makeUserJob.exitCommand }}
+ command: [ "/bin/sh", "-c" ]
+ args: [ "/bin/sh /config/add-user; EV=$?; {{ .Values.makeUserJob.exitCommand }} && exit $EV" ]
+ {{- else }}
+ command: [ "/bin/sh", "/config/add-user" ]
+ {{- end }}
+ env:
+ - name: MINIO_ENDPOINT
+ value: {{ template `minio.svcFQDN` $ }}
+ - name: MINIO_PORT
+ value: {{ .Values.service.port | quote }}
+ volumeMounts:
+ - name: etc-path
+ mountPath: /etc/minio/mc
+ - name: tmp
+ mountPath: /tmp
+ - name: minio-configuration
+ mountPath: /config
+ {{- if .Values.tls.enabled }}
+ - name: cert-secret-volume-mc
+ mountPath: {{ .Values.configPathmc }}certs
+ {{- end }}
+ resources: {{- toYaml .Values.makeUserJob.resources | nindent 12 }}
+ {{- end }}
+ {{- if .Values.customCommands }}
+ - name: minio-custom-command
+ image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+ {{- if .Values.customCommandJob.securityContext.enabled }}
+ {{- with .Values.customCommandJob.containerSecurityContext }}
+ securityContext: {{ toYaml . | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+ {{- if .Values.customCommandJob.exitCommand }}
+ command: [ "/bin/sh", "-c" ]
+ args: [ "/bin/sh /config/custom-command; EV=$?; {{ .Values.customCommandJob.exitCommand }} && exit $EV" ]
+ {{- else }}
+ command: [ "/bin/sh", "/config/custom-command" ]
+ {{- end }}
+ env:
+ - name: MINIO_ENDPOINT
+ value: {{ template `minio.svcFQDN` $ }}
+ - name: MINIO_PORT
+ value: {{ .Values.service.port | quote }}
+ volumeMounts:
+ - name: etc-path
+ mountPath: /etc/minio/mc
+ - name: tmp
+ mountPath: /tmp
+ - name: minio-configuration
+ mountPath: /config
+ {{- if .Values.tls.enabled }}
+ - name: cert-secret-volume-mc
+ mountPath: {{ .Values.configPathmc }}certs
+ {{- end }}
+ {{- if .Values.customCommandJob.extraVolumeMounts }}
+ {{- toYaml .Values.customCommandJob.extraVolumeMounts | nindent 12 }}
+ {{- end }}
+ resources: {{- toYaml .Values.customCommandJob.resources | nindent 12 }}
+ {{- end }}
+ {{- if .Values.svcaccts }}
+ - name: minio-make-svcacct
+ image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}"
+ {{- if .Values.makeServiceAccountJob.securityContext.enabled }}
+ {{- with .Values.makeServiceAccountJob.containerSecurityContext }}
+ securityContext: {{ toYaml . | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ imagePullPolicy: {{ .Values.mcImage.pullPolicy }}
+ {{- if .Values.makeServiceAccountJob.exitCommand }}
+ command: [ "/bin/sh", "-c" ]
+ args: ["/bin/sh /config/add-svcacct; EV=$?; {{ .Values.makeServiceAccountJob.exitCommand }} && exit $EV" ]
+ {{- else }}
+ command: ["/bin/sh", "/config/add-svcacct"]
+ {{- end }}
+ env:
+ - name: MINIO_ENDPOINT
+ value: {{ template `minio.svcFQDN` $ }}
+ - name: MINIO_PORT
+ value: {{ .Values.service.port | quote }}
+ volumeMounts:
+ - name: etc-path
+ mountPath: /etc/minio/mc
+ - name: tmp
+ mountPath: /tmp
+ - name: minio-configuration
+ mountPath: /config
+ {{- if .Values.tls.enabled }}
+ - name: cert-secret-volume-mc
+ mountPath: {{ .Values.configPathmc }}certs
+ {{- end }}
+ resources: {{- toYaml .Values.makeServiceAccountJob.resources | nindent 12 }}
+ {{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/prometheusrule.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/prometheusrule.yaml
deleted file mode 100644
index 0e54c6326..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/prometheusrule.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }}
-{{- $releaseNamespace := default (include "common.names.namespace" .) .Values.metrics.prometheusRule.namespace }}
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
- name: {{ include "common.names.fullname" . }}
- namespace: {{ $releaseNamespace | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- app.kubernetes.io/component: metrics
- {{- if .Values.metrics.prometheusRule.additionalLabels }}
- {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $ ) | nindent 4 }}
- {{- end }}
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
-spec:
- groups:
- - name: {{ include "common.names.fullname" . }}
- rules: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.rules "context" $ ) | nindent 6 }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/provisioning-configmap.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/provisioning-configmap.yaml
deleted file mode 100644
index 6d8a34bad..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/provisioning-configmap.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if .Values.provisioning.enabled }}
-{{- $fullname := printf "%s-provisioning" (include "common.names.fullname" .) }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: {{ $fullname }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- app.kubernetes.io/component: minio-provisioning
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
-data:
- {{- range $bucket := .Values.provisioning.buckets }}
- {{- if $bucket.lifecycle }}
- bucket-{{ $bucket.name }}.json: |
- {
- "Rules": [
- {{- range $idx, $lifecycle := $bucket.lifecycle }}
- {{- if not (eq $idx 0) }}
- ,
- {{- end }}
- {
- "ID": "{{ $lifecycle.id }}",
- "Status": "{{ ternary "Disabled" "Enabled" (and (not (empty $lifecycle.disabled)) $lifecycle.disabled) }}",
- {{- if $lifecycle.expiry }}
- "Expiration": {
- {{- with $lifecycle.expiry.date }}
- "Date": "{{ . }}"
- {{- end }}
- {{- with $lifecycle.expiry.days }}
- "Days": {{ . }}
- {{- end }}
- }
- {{- with $lifecycle.expiry.nonconcurrentDays }}
- ,
- "NoncurrentVersionExpiration": {
- "NoncurrentDays": {{ . }}
- }
- {{- end }}
- {{- with $lifecycle.prefix }}
- ,
- "Filter": {
- "Prefix": "{{ . }}"
- }
- {{- end }}
- }
- {{- end }}
- {{- end }}
- ]
- }
- {{- end }}
- {{- end }}
- {{- range $policy := .Values.provisioning.policies }}
- policy-{{ $policy.name }}.json: |
- {{- $statementsLength := sub (len $policy.statements) 1 }}
- {
- "Version": "2012-10-17",
- "Statement": [
- {{- range $i, $statement := $policy.statements }}
- {
- "Effect": "{{ default "Deny" $statement.effect }}"{{ if $statement.actions }},
- "Action": {{ toJson $statement.actions }}{{end}}{{ if $statement.resources }},
- "Resource": {{ toJson $statement.resources }}{{end}}
- }{{ if lt $i $statementsLength }},{{end }}
- {{- end }}
- ]
- }
- {{- end }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/provisioning-job.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/provisioning-job.yaml
deleted file mode 100644
index 4ce284e7e..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/provisioning-job.yaml
+++ /dev/null
@@ -1,336 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if .Values.provisioning.enabled }}
-{{- $fullname := printf "%s-provisioning" (include "common.names.fullname" .) }}
-{{- $minioAlias := "provisioning" }}
-apiVersion: batch/v1
-kind: Job
-metadata:
- name: {{ $fullname }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- app.kubernetes.io/component: minio-provisioning
- annotations:
- helm.sh/hook: post-install,post-upgrade
- helm.sh/hook-delete-policy: before-hook-creation
- {{- if .Values.commonAnnotations }}
- {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
-spec:
- {{- if .Values.provisioning.cleanupAfterFinished.enabled }}
- ttlSecondsAfterFinished: {{ .Values.provisioning.cleanupAfterFinished.seconds }}
- {{- end }}
- parallelism: 1
- template:
- metadata:
- labels: {{- include "minio.labels.provisioning" . | nindent 8 }}
- app.kubernetes.io/component: minio-provisioning
- {{- if .Values.provisioning.podAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.provisioning.podAnnotations "context" $) | nindent 8 }}
- {{- end }}
- spec:
- {{- include "minio.imagePullSecrets" . | nindent 6 }}
- {{- if .Values.provisioning.schedulerName }}
- schedulerName: {{ .Values.provisioning.schedulerName }}
- {{- end }}
- restartPolicy: OnFailure
- terminationGracePeriodSeconds: 0
- {{- if .Values.provisioning.podSecurityContext.enabled }}
- securityContext: {{- omit .Values.provisioning.podSecurityContext "enabled" | toYaml | nindent 8 }}
- {{- end }}
- serviceAccountName: {{ template "minio.serviceAccountName" . }}
- initContainers:
- - name: wait-for-available-minio
- image: {{ include "minio.image" . }}
- imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
- {{- if .Values.provisioning.containerSecurityContext.enabled }}
- securityContext: {{- omit .Values.provisioning.containerSecurityContext "enabled" | toYaml | nindent 12 }}
- {{- end }}
- command:
- - /bin/bash
- - -c
- - |-
- set -e;
- echo "Waiting for Minio";
- wait-for-port \
- --host={{ include "common.names.fullname" . }} \
- --state=inuse \
- --timeout=120 \
- {{ .Values.service.ports.api | int64 }};
- echo "Minio is available";
- {{- if .Values.provisioning.resources }}
- resources: {{- toYaml .Values.provisioning.resources | nindent 12 }}
- {{- end }}
- containers:
- - name: minio
- image: {{ include "minio.image" . }}
- imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
- {{- if .Values.provisioning.containerSecurityContext.enabled }}
- securityContext: {{- omit .Values.provisioning.containerSecurityContext "enabled" | toYaml | nindent 12 }}
- {{- end }}
- {{- if .Values.provisioning.command }}
- command: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.command "context" $) | nindent 12 }}
- {{- else }}
- command:
- - /bin/bash
- - -c
- - >-
- set -e;
- echo "Start Minio provisioning";
-
- function attachPolicy() {
- local tmp=$(mc admin $1 info {{ $minioAlias }} $2 | sed -n -e 's/^Policy.*: \(.*\)$/\1/p');
- IFS=',' read -r -a CURRENT_POLICIES <<< "$tmp";
- if [[ ! "${CURRENT_POLICIES[*]}" =~ "$3" ]]; then
- mc admin policy attach {{ $minioAlias }} $3 --$1=$2;
- fi;
- };
-
- function detachDanglingPolicies() {
- local tmp=$(mc admin $1 info {{ $minioAlias }} $2 | sed -n -e 's/^Policy.*: \(.*\)$/\1/p');
- IFS=',' read -r -a CURRENT_POLICIES <<< "$tmp";
- IFS=',' read -r -a DESIRED_POLICIES <<< "$3";
- for current in "${CURRENT_POLICIES[@]}"; do
- if [[ ! "${DESIRED_POLICIES[*]}" =~ "${current}" ]]; then
- mc admin policy detach {{ $minioAlias }} $current --$1=$2;
- fi;
- done;
- }
-
- function addUsersFromFile() {
- local username=$(grep -oP '^username=\K.+' $1);
- local password=$(grep -oP '^password=\K.+' $1);
- local disabled=$(grep -oP '^disabled=\K.+' $1);
- local policies_list=$(grep -oP '^policies=\K.+' $1);
- local set_policies=$(grep -oP '^setPolicies=\K.+' $1);
-
- mc admin user add {{ $minioAlias }} "${username}" "${password}";
-
- IFS=',' read -r -a POLICIES <<< "${policies_list}";
- for policy in "${POLICIES[@]}"; do
- attachPolicy user "${username}" "${policy}";
- done;
- if [ "${set_policies}" == "true" ]; then
- detachDanglingPolicies user "${username}" "${policies_list}";
- fi;
-
- local user_status="enable";
- if [[ "${disabled}" != "" && "${disabled,,}" == "true" ]]; then
- user_status="disable";
- fi;
-
- mc admin user "${user_status}" {{ $minioAlias }} "${username}";
- };
-
- {{- $minioUrl := printf "$MINIO_SCHEME://%s:%d" (include "common.names.fullname" .) (.Values.service.ports.api | int) }}
- {{- $minioRootUser := ternary ("$(<$MINIO_ROOT_USER_FILE)") ("$MINIO_ROOT_USER") (.Values.auth.useCredentialsFiles) }}
- {{- $minioRootPassword := ternary ("$(<$MINIO_ROOT_PASSWORD_FILE)") ("$MINIO_ROOT_PASSWORD") (.Values.auth.useCredentialsFiles) }}
- mc alias set {{ $minioAlias }} {{ $minioUrl }} {{ $minioRootUser }} {{ $minioRootPassword }};
-
- {{- range $config := .Values.provisioning.config }}
- {{- $options := list }}
- {{- range $name, $value := $config.options }}
- {{- $options = (printf "%s=%s" $name $value) | append $options }}
- {{- end }}
- {{- $options := join " " $options }}
- mc admin config set {{ $minioAlias }} {{ $config.name }} {{ $options }};
- {{- end }}
-
- mc admin service restart {{ $minioAlias }};
-
- {{- range $policy := .Values.provisioning.policies }}
- mc admin policy create {{ $minioAlias }} {{ $policy.name }} /etc/ilm/policy-{{ $policy.name }}.json;
- {{- end }}
-
- {{- range $user := .Values.provisioning.users }}
- mc admin user add {{ $minioAlias }} {{ $user.username }} {{ $user.password }};
- {{- range $policy := $user.policies }}
- attachPolicy user {{ $user.username }} {{ $policy }};
- {{- end }}
- {{- if $user.setPolicies }}
- detachDanglingPolicies user {{ $user.username }} "{{ join "," $user.policies }}";
- {{- end }}
- {{- $userStatus := ternary ("disable") ("enable") (and (not (empty $user.disabled)) $user.disabled) }}
- mc admin user {{ $userStatus }} {{ $minioAlias }} {{ $user.username }};
- {{- end }}
- {{- if gt (len .Values.provisioning.usersExistingSecrets) 0 }}
- while read -d '' configFile; do
- addUsersFromFile "${configFile}";
- done < <(find "/opt/bitnami/minio/users/" -type l -not -name '..data' -print0);
- {{- end }}
-
- {{- range $group := .Values.provisioning.groups }}
- mc admin group add {{ $minioAlias }} {{ $group.name }} {{ join " " $group.members }};
- {{- range $policy := $group.policies }}
- attachPolicy group {{ $group.name }} {{ $policy }};
- {{- end }}
- {{- if $group.setPolicies }}
- detachDanglingPolicies group {{ $group.name }} "{{ join "," $group.policies }}";
- {{- end }}
- {{- $groupStatus := ternary ("disable") ("enable") (and (not (empty $group.disabled)) $group.disabled) }}
- mc admin group {{ $groupStatus }} {{ $minioAlias }} {{ $group.name }};
- {{- end }}
-
- {{- $isDistributedMode := (eq .Values.mode "distributed") }}
- {{- range $bucket := .Values.provisioning.buckets }}
- {{- $target := printf "%s/%s" $minioAlias $bucket.name }}
- {{- $region := ternary (printf "--region=%s" $bucket.region) ("") (not (empty $bucket.region)) }}
- {{- $withLock := ternary ("--with-lock") ("") (and (not (empty $bucket.withLock)) $bucket.withLock) }}
- mc mb {{ $target }} --ignore-existing {{ $region }} {{ $withLock }};
-
- {{- if $bucket.lifecycle }}
- mc ilm import {{ $minioAlias }}/{{ $bucket.name }} < /etc/ilm/bucket-{{ $bucket.name }}.json;
- {{- end }}
-
- {{- with $bucket.quota }}
- {{- if eq .type "hard" }}
- mc quota set {{ $minioAlias }}/{{ $bucket.name }} {{ if .size }}--size {{ .size }}{{ end }};
- {{- else }}
- mc quota {{ .type }} {{ $minioAlias }}/{{ $bucket.name }} {{ if .size }}--size {{ .size }}{{ end }};
- {{- end }}
- {{- end }}
-
- {{- if $isDistributedMode }}
- {{- if (or ((empty $bucket.withLock)) (not $bucket.withLock)) }}
- {{- $versioning := default "Suspended" $bucket.versioning }}
- {{- if kindIs "bool" $bucket.versioning }}
- {{- $versioning = ternary "Versioned" "Suspended" $bucket.versioning }}
- {{- end }}
- {{- if eq $versioning "Versioned" }}
- mc version enable {{ $minioAlias }}/{{ $bucket.name }};
- {{- else if eq $versioning "Suspended" }}
- mc version suspend {{ $minioAlias }}/{{ $bucket.name }};
- {{- else if ne $versioning "Unchanged" }}
- {{- fail (printf "Invalid value '%s' for versioning of bucket '%s'" $versioning $bucket.name) }}
- {{- end }}
- {{- end }}
- {{- end }}
-
- {{- if $bucket.tags }}
- {{- $target := printf "%s/%s" $minioAlias $bucket.name }}
- {{- $tags := list }}
- {{- range $name, $value := $bucket.tags }}
- {{- $tags = (printf "%s=%s" $name $value) | append $tags }}
- {{- end }}
- {{- $tags := join "&" $tags | quote }}
- mc tag set {{ $target }} {{ $tags }};
- {{- end }}
- {{- end }}
-
- {{- if .Values.provisioning.extraCommands }}
- {{ join ";" .Values.provisioning.extraCommands | nindent 14 }};
- {{- end }}
-
- echo "End Minio provisioning";
- {{- end }}
- {{- if .Values.provisioning.args }}
- args: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.args "context" $) | nindent 12 }}
- {{- end }}
- env:
- - name: MINIO_SCHEME
- value: {{ ternary "https" "http" .Values.tls.enabled | quote }}
- {{- if .Values.auth.useCredentialsFiles }}
- - name: MINIO_ROOT_USER_FILE
- value: "/opt/bitnami/minio/secrets/root-user"
- {{- else }}
- - name: MINIO_ROOT_USER
- valueFrom:
- secretKeyRef:
- name: {{ include "minio.secretName" . }}
- key: root-user
- {{- end }}
- {{- if .Values.auth.useCredentialsFiles }}
- - name: MINIO_ROOT_PASSWORD_FILE
- value: "/opt/bitnami/minio/secrets/root-password"
- {{- else }}
- - name: MINIO_ROOT_PASSWORD
- valueFrom:
- secretKeyRef:
- name: {{ include "minio.secretName" . }}
- key: root-password
- {{- end }}
- {{- if .Values.tls.mountPath }}
- - name: MINIO_CERTS_DIR
- value: {{ .Values.tls.mountPath | quote }}
- {{- end }}
- envFrom:
- {{- if .Values.extraEnvVarsCM }}
- - configMapRef:
- name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
- {{- end }}
- {{- if .Values.extraEnvVarsSecret }}
- - secretRef:
- name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
- {{- end }}
- {{- if .Values.provisioning.resources }}
- resources: {{- toYaml .Values.provisioning.resources | nindent 12 }}
- {{- end }}
- volumeMounts:
- {{- if .Values.provisioning.enabled }}
- - name: minio-provisioning
- mountPath: /etc/ilm
- {{- end }}
- {{- if .Values.auth.useCredentialsFiles }}
- - name: minio-credentials
- mountPath: /opt/bitnami/minio/secrets/
- {{- end }}
- {{- if .Values.tls.enabled }}
- - name: minio-certs
- mountPath: {{ default "/certs" .Values.tls.mountPath }}
- - name: minio-client-certs
- mountPath: /.mc/certs
- {{- end }}
- {{- range $idx, $_ := .Values.provisioning.usersExistingSecrets }}
- - name: {{ printf "users-secret-%d" $idx }}
- mountPath: /opt/bitnami/minio/users/{{ $idx }}/
- {{- end }}
- {{- if .Values.provisioning.extraVolumeMounts }}
- {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.extraVolumeMounts "context" $) | nindent 12 }}
- {{- end }}
- {{- if .Values.tolerations }}
- tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
- {{- end }}
- {{- if .Values.provisioning.nodeSelector }}
- nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.nodeSelector "context" $) | nindent 8 }}
- {{- end }}
- volumes:
- {{- if .Values.provisioning.enabled }}
- - name: minio-provisioning
- configMap:
- name: {{ $fullname }}
- {{- end }}
- {{- if .Values.auth.useCredentialsFiles }}
- - name: minio-credentials
- secret:
- secretName: {{ include "minio.secretName" . }}
- {{- end }}
- {{- range $idx, $userSecret := .Values.provisioning.usersExistingSecrets }}
- - name: {{ printf "users-secret-%d" $idx }}
- secret:
- secretName: {{ $userSecret }}
- {{- end }}
- {{- if .Values.tls.enabled }}
- - name: minio-certs
- secret:
- secretName: {{ include "minio.tlsSecretName" . }}
- items:
- - key: tls.crt
- path: public.crt
- - key: tls.key
- path: private.key
- - key: ca.crt
- path: CAs/public.crt
- - name: minio-client-certs
- secret:
- secretName: {{ include "minio.tlsSecretName" . }}
- items:
- - key: ca.crt
- path: CAs/public.crt
- {{- end }}
- {{- if .Values.provisioning.extraVolumes }}
- {{- include "common.tplvalues.render" (dict "value" .Values.provisioning.extraVolumes "context" $) | nindent 8 }}
- {{- end }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/pvc.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/pvc.yaml
deleted file mode 100644
index e59e59b99..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/pvc.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if (include "minio.createPVC" .) }}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
- name: {{ include "common.names.fullname" . }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if or .Values.persistence.annotations .Values.commonAnnotations }}
- {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.persistence.annotations .Values.commonAnnotations ) "context" . ) }}
- annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" $) | nindent 4 }}
- {{- end }}
-spec:
- accessModes:
- {{- range .Values.persistence.accessModes }}
- - {{ . | quote }}
- {{- end }}
- resources:
- requests:
- storage: {{ .Values.persistence.size | quote }}
- {{- include "common.storage.class" (dict "persistence" .Values.persistence "global" .Values.global) | nindent 2 }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/secrets.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/secrets.yaml
index f4d48cd65..2475bf1ac 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/secrets.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/secrets.yaml
@@ -1,20 +1,22 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if (include "minio.createSecret" .) }}
+{{- if not .Values.existingSecret }}
apiVersion: v1
kind: Secret
metadata:
- name: {{ include "common.names.fullname" . }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
+ name: {{ template "minio.secretName" . }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
type: Opaque
data:
- root-user: {{ include "minio.secret.userValue" . | b64enc | quote }}
- root-password: {{ include "minio.secret.passwordValue" . | b64enc | quote }}
+ rootUser: {{ include "minio.root.username" . | b64enc | quote }}
+ rootPassword: {{ include "minio.root.password" . | b64enc | quote }}
+ {{- if .Values.etcd.clientCert }}
+ etcd_client.crt: {{ .Values.etcd.clientCert | toString | b64enc | quote }}
+ {{- end }}
+ {{- if .Values.etcd.clientCertKey }}
+ etcd_client.key: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }}
+ {{- end }}
{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/securitycontextconstraints.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/securitycontextconstraints.yaml
new file mode 100644
index 000000000..38eb372fd
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/securitycontextconstraints.yaml
@@ -0,0 +1,46 @@
+{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }}
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+ name: {{ template "minio.fullname" . }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: false
+allowedCapabilities: []
+readOnlyRootFilesystem: false
+defaultAddCapabilities: []
+requiredDropCapabilities:
+- KILL
+- MKNOD
+- SETUID
+- SETGID
+fsGroup:
+ type: MustRunAs
+ ranges:
+ - max: {{ .Values.securityContext.fsGroup }}
+ min: {{ .Values.securityContext.fsGroup }}
+runAsUser:
+ type: MustRunAs
+ uid: {{ .Values.securityContext.runAsUser }}
+seLinuxContext:
+ type: MustRunAs
+supplementalGroups:
+ type: RunAsAny
+volumes:
+- configMap
+- downwardAPI
+- emptyDir
+- persistentVolumeClaim
+- projected
+- secret
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/service.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/service.yaml
index 1b9467b18..2f4e5cd68 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/service.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/service.yaml
@@ -1,17 +1,17 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
+{{ $scheme := .Values.tls.enabled | ternary "https" "http" }}
apiVersion: v1
kind: Service
metadata:
- name: {{ include "common.names.fullname" . }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if or .Values.service.annotations .Values.commonAnnotations }}
- {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.service.annotations .Values.commonAnnotations ) "context" . ) }}
- annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" $) | nindent 4 }}
+ name: {{ template "minio.fullname" . }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+ monitoring: "true"
+ {{- if .Values.service.annotations }}
+ annotations: {{- toYaml .Values.service.annotations | nindent 4 }}
{{- end }}
spec:
type: {{ .Values.service.type }}
@@ -25,27 +25,23 @@ spec:
loadBalancerSourceRanges: {{ .Values.service.loadBalancerSourceRanges }}
{{ end }}
{{- if and (eq .Values.service.type "LoadBalancer") (not (empty .Values.service.loadBalancerIP)) }}
- loadBalancerIP: {{ .Values.service.loadBalancerIP }}
+ loadBalancerIP: {{ default "" .Values.service.loadBalancerIP | quote }}
{{- end }}
ports:
- - name: minio-api
- port: {{ .Values.service.ports.api }}
- targetPort: minio-api
- {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.api)) }}
- nodePort: {{ .Values.service.nodePorts.api }}
- {{- else if eq .Values.service.type "ClusterIP" }}
- nodePort: null
+ - name: {{ $scheme }}
+ port: {{ .Values.service.port }}
+ protocol: TCP
+ {{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }}
+ nodePort: {{ .Values.service.nodePort }}
+ {{- else }}
+ targetPort: {{ .Values.minioAPIPort }}
{{- end }}
- - name: minio-console
- port: {{ .Values.service.ports.console }}
- targetPort: minio-console
- {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePorts.console)) }}
- nodePort: {{ .Values.service.nodePorts.console }}
- {{- else if eq .Values.service.type "ClusterIP" }}
- nodePort: null
- {{- end }}
- {{- if .Values.service.extraPorts }}
- {{- include "common.tplvalues.render" (dict "value" .Values.service.extraPorts "context" $) | nindent 4 }}
+ {{- if .Values.service.externalIPs }}
+ externalIPs:
+ {{- range $i , $ip := .Values.service.externalIPs }}
+ - {{ $ip }}
{{- end }}
- {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
- selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
+ {{- end }}
+ selector:
+ app: {{ template "minio.name" . }}
+ release: {{ .Release.Name }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/serviceaccount.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/serviceaccount.yaml
index 43ddbf1e9..b8661eea9 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/serviceaccount.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/serviceaccount.yaml
@@ -1,20 +1,7 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
{{- if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
- name: {{ template "minio.serviceAccountName" . }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
- {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
- annotations: {{- include "common.tplvalues.render" (dict "value" $annotations "context" $) | nindent 4 }}
- {{- end }}
-automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
-secrets:
- - name: {{ include "common.names.fullname" . }}
+ name: {{ .Values.serviceAccount.name | quote }}
+ namespace: {{ .Values.namespace }}
{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/servicemonitor.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/servicemonitor.yaml
index b71ca5646..e7c8d64fb 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/servicemonitor.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/servicemonitor.yaml
@@ -1,66 +1,116 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if .Values.metrics.serviceMonitor.enabled }}
-{{- $releaseNamespace := default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace }}
-apiVersion: {{ default "monitoring.coreos.com/v1" .Values.metrics.serviceMonitor.apiVersion }}
+{{- if and .Values.metrics.serviceMonitor.enabled .Values.metrics.serviceMonitor.includeNode }}
+apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
- name: {{ include "common.names.fullname" . }}
- namespace: {{ $releaseNamespace | quote }}
- {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels ) "context" . ) }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+ name: {{ template "minio.fullname" . }}
+ {{- if .Values.metrics.serviceMonitor.namespace }}
+ namespace: {{ .Values.metrics.serviceMonitor.namespace }}
+ {{- else }}
+ namespace: {{ .Values.namespace }}
+ {{- end }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+ {{- if .Values.metrics.serviceMonitor.additionalLabels }}
+ {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }}
+ {{- end }}
+ {{- if .Values.metrics.serviceMonitor.annotations }}
+ annotations: {{- toYaml .Values.metrics.serviceMonitor.annotations | nindent 4 }}
{{- end }}
spec:
endpoints:
- {{- /* Backward Compatibility for .Values.metrics.serviceMonitor.path */}}
- {{- $paths := list }}
- {{- if (.Values.metrics.serviceMonitor.paths | empty | not) }}
- {{- $paths = .Values.metrics.serviceMonitor.paths }}
- {{- end }}
- {{- if (.Values.metrics.serviceMonitor.path | empty | not) }}
- {{- $paths = prepend $paths .Values.metrics.serviceMonitor.path }}
+ {{- if .Values.tls.enabled }}
+ - port: https
+ scheme: https
+ tlsConfig:
+ ca:
+ secret:
+ name: {{ .Values.tls.certSecret }}
+ key: {{ .Values.tls.publicCrt }}
+ serverName: {{ template "minio.fullname" . }}
+ {{- else }}
+ - port: http
+ scheme: http
{{- end }}
- {{- range $idx, $path := ($paths | uniq) }}
- {{- with $ }}
- - port: minio-api
- path: {{ $path }}
+ path: /minio/v2/metrics/node
{{- if .Values.metrics.serviceMonitor.interval }}
interval: {{ .Values.metrics.serviceMonitor.interval }}
{{- end }}
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
{{- end }}
- {{- if .Values.metrics.serviceMonitor.honorLabels }}
- honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
- {{- end }}
- {{- if .Values.metrics.serviceMonitor.metricRelabelings }}
- metricRelabelings: {{- toYaml .Values.metrics.serviceMonitor.metricRelabelings | nindent 8 }}
- {{- end }}
- {{- if .Values.metrics.serviceMonitor.relabelings }}
- relabelings: {{- toYaml .Values.metrics.serviceMonitor.relabelings | nindent 8 }}
+ {{- if .Values.metrics.serviceMonitor.relabelConfigs }}
+ {{- toYaml .Values.metrics.serviceMonitor.relabelConfigs | nindent 6 }}
{{- end }}
- {{- if .Values.tls.enabled }}
- scheme: https
- {{- end }}
- {{- if .Values.metrics.serviceMonitor.tlsConfig }}
- tlsConfig: {{- toYaml .Values.metrics.serviceMonitor.tlsConfig | nindent 8 }}
+ {{- if not .Values.metrics.serviceMonitor.public }}
+ bearerTokenSecret:
+ name: {{ template "minio.fullname" . }}-prometheus
+ key: token
{{- end }}
- {{- end }}
- {{- end }}
- {{- if .Values.metrics.serviceMonitor.jobLabel }}
- jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel }}
- {{- end }}
namespaceSelector:
matchNames:
- - {{ include "common.names.namespace" . | quote }}
+ - {{ .Release.Namespace | quote }}
selector:
- matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
- {{- if .Values.metrics.serviceMonitor.selector }}
- {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
+ matchLabels:
+ app: {{ include "minio.name" . }}
+ release: {{ .Release.Name }}
+ monitoring: "true"
+{{- end }}
+{{- if .Values.metrics.serviceMonitor.enabled }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: Probe
+metadata:
+ name: {{ template "minio.fullname" . }}-cluster
+ {{- if .Values.metrics.serviceMonitor.namespace }}
+ namespace: {{ .Values.metrics.serviceMonitor.namespace }}
+ {{- else }}
+ namespace: {{ .Values.namespace }}
+ {{- end }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+ {{- if .Values.metrics.serviceMonitor.additionalLabels }}
+ {{- toYaml .Values.metrics.serviceMonitor.additionalLabels | nindent 4 }}
+ {{- end }}
+spec:
+ jobName: {{ template "minio.fullname" . }}
+ {{- if .Values.tls.enabled }}
+ tlsConfig:
+ ca:
+ secret:
+ name: {{ .Values.tls.certSecret }}
+ key: {{ .Values.tls.publicCrt }}
+ serverName: {{ template "minio.fullname" . }}
+ {{- end }}
+ prober:
+ url: {{ template "minio.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}
+ path: /minio/v2/metrics/cluster
+ {{- if .Values.tls.enabled }}
+ scheme: https
+ {{- else }}
+ scheme: http
+ {{- end }}
+ {{- if .Values.metrics.serviceMonitor.relabelConfigsCluster }}
+ {{- toYaml .Values.metrics.serviceMonitor.relabelConfigsCluster | nindent 2 }}
+ {{- end }}
+ targets:
+ staticConfig:
+ static:
+ - {{ template "minio.fullname" . }}.{{ .Release.Namespace }}
+ {{- if not .Values.metrics.serviceMonitor.public }}
+ {{- if .Values.metrics.serviceMonitor.interval }}
+ interval: {{ .Values.metrics.serviceMonitor.interval }}
+ {{- end }}
+ {{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
+ scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
+ {{- end }}
+ bearerTokenSecret:
+ name: {{ template "minio.fullname" . }}-prometheus
+ key: token
{{- end }}
{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/standalone/deployment.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/standalone/deployment.yaml
deleted file mode 100644
index 227730c23..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/standalone/deployment.yaml
+++ /dev/null
@@ -1,259 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if (eq .Values.mode "standalone") }}
-apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
-kind: Deployment
-metadata:
- name: {{ include "common.names.fullname" . }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
-spec:
- {{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
- selector:
- matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
- {{- if .Values.deployment.updateStrategy }}
- strategy: {{- toYaml .Values.deployment.updateStrategy | nindent 4 }}
- {{- end }}
- template:
- metadata:
- labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
- {{- if or .Values.podAnnotations (include "minio.createSecret" .) }}
- annotations:
- {{- if (include "minio.createSecret" .) }}
- checksum/credentials-secret: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
- {{- end }}
- {{- if .Values.podAnnotations }}
- {{- include "common.tplvalues.render" ( dict "value" .Values.podAnnotations "context" $) | nindent 8 }}
- {{- end }}
- {{- end }}
- spec:
- {{- include "minio.imagePullSecrets" . | nindent 6 }}
- {{- if .Values.schedulerName }}
- schedulerName: {{ .Values.schedulerName }}
- {{- end }}
- serviceAccountName: {{ template "minio.serviceAccountName" . }}
- {{- if .Values.affinity }}
- affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }}
- {{- else }}
- affinity:
- podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
- podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "customLabels" $podLabels "context" $) | nindent 10 }}
- nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }}
- {{- end }}
- {{- if .Values.nodeSelector }}
- nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
- {{- end }}
- {{- if .Values.tolerations }}
- tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }}
- {{- end }}
- {{- if .Values.topologySpreadConstraints }}
- topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" $) | nindent 8 }}
- {{- end }}
- {{- if .Values.priorityClassName }}
- priorityClassName: {{ .Values.priorityClassName | quote }}
- {{- end }}
- {{- if .Values.runtimeClassName }}
- runtimeClassName: {{ .Values.runtimeClassName | quote }}
- {{- end}}
- automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
- {{- if .Values.hostAliases }}
- hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
- {{- end }}
- {{- if .Values.podSecurityContext.enabled }}
- securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
- {{- end }}
- {{- if .Values.terminationGracePeriodSeconds }}
- terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
- {{- end }}
- {{- if or .Values.initContainers (and .Values.volumePermissions.enabled .Values.persistence.enabled) }}
- initContainers:
- {{- if .Values.initContainers }}
- {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }}
- {{- end }}
- {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
- - name: volume-permissions
- image: {{ template "minio.volumePermissions.image" . }}
- imagePullPolicy: {{ default "" .Values.volumePermissions.image.pullPolicy | quote }}
- command:
- - /bin/bash
- - -ec
- - |
- chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ .Values.persistence.mountPath }}
- securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }}
- {{- if .Values.volumePermissions.resources }}
- resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
- {{- end }}
- volumeMounts:
- - name: data
- mountPath: {{ .Values.persistence.mountPath }}
- {{- end }}
- {{- end }}
- containers:
- - name: minio
- image: {{ include "minio.image" . }}
- imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
- {{- if .Values.containerSecurityContext.enabled }}
- securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }}
- {{- end }}
- {{- if .Values.command }}
- command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }}
- {{- end }}
- {{- if .Values.args }}
- args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }}
- {{- end }}
- env:
- - name: BITNAMI_DEBUG
- value: {{ ternary "true" "false" .Values.image.debug | quote }}
- - name: MINIO_SCHEME
- value: {{ ternary "https" "http" .Values.tls.enabled | quote }}
- - name: MINIO_FORCE_NEW_KEYS
- value: {{ ternary "yes" "no" .Values.auth.forceNewKeys | quote }}
- {{- if .Values.auth.useCredentialsFiles }}
- - name: MINIO_ROOT_USER_FILE
- value: "/opt/bitnami/minio/secrets/root-user"
- {{- else }}
- - name: MINIO_ROOT_USER
- valueFrom:
- secretKeyRef:
- name: {{ include "minio.secretName" . }}
- key: root-user
- {{- end }}
- {{- if .Values.auth.useCredentialsFiles }}
- - name: MINIO_ROOT_PASSWORD_FILE
- value: "/opt/bitnami/minio/secrets/root-password"
- {{- else }}
- - name: MINIO_ROOT_PASSWORD
- valueFrom:
- secretKeyRef:
- name: {{ include "minio.secretName" . }}
- key: root-password
- {{- end }}
- {{- if .Values.defaultBuckets }}
- - name: MINIO_DEFAULT_BUCKETS
- value: {{ .Values.defaultBuckets }}
- {{- end }}
- - name: MINIO_BROWSER
- value: {{ ternary "off" "on" .Values.disableWebUI | quote }}
- - name: MINIO_PROMETHEUS_AUTH_TYPE
- value: {{ .Values.metrics.prometheusAuthType | quote }}
- - name: MINIO_CONSOLE_PORT_NUMBER
- value: {{ .Values.containerPorts.console | quote }}
- {{- if .Values.tls.mountPath }}
- - name: MINIO_CERTS_DIR
- value: {{ .Values.tls.mountPath | quote }}
- {{- end }}
- {{- if .Values.extraEnvVars }}
- {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }}
- {{- end }}
- envFrom:
- {{- if .Values.extraEnvVarsCM }}
- - configMapRef:
- name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }}
- {{- end }}
- {{- if .Values.extraEnvVarsSecret }}
- - secretRef:
- name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }}
- {{- end }}
- ports:
- - name: minio-api
- containerPort: {{ .Values.containerPorts.api }}
- protocol: TCP
- - name: minio-console
- containerPort: {{ .Values.containerPorts.console }}
- protocol: TCP
- {{- if .Values.customLivenessProbe }}
- livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }}
- {{- else if .Values.livenessProbe.enabled }}
- livenessProbe:
- httpGet:
- path: /minio/health/live
- port: minio-api
- scheme: {{ ternary "HTTPS" "HTTP" .Values.tls.enabled | quote }}
- initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
- periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
- timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
- successThreshold: {{ .Values.livenessProbe.successThreshold }}
- failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
- {{- end }}
- {{- if .Values.customReadinessProbe }}
- readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }}
- {{- else if .Values.readinessProbe.enabled }}
- readinessProbe:
- tcpSocket:
- port: minio-api
- initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
- periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
- timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
- successThreshold: {{ .Values.readinessProbe.successThreshold }}
- failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
- {{- end }}
- {{- if .Values.customStartupProbe }}
- startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }}
- {{- else if .Values.startupProbe.enabled }}
- startupProbe:
- tcpSocket:
- port: minio-console
- initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
- periodSeconds: {{ .Values.startupProbe.periodSeconds }}
- timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
- successThreshold: {{ .Values.startupProbe.successThreshold }}
- failureThreshold: {{ .Values.startupProbe.failureThreshold }}
- {{- end }}
- {{- if .Values.resources }}
- resources: {{- toYaml .Values.resources | nindent 12 }}
- {{- end }}
- {{- if .Values.lifecycleHooks }}
- lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }}
- {{- end }}
- volumeMounts:
- {{- if .Values.auth.useCredentialsFiles }}
- - name: minio-credentials
- mountPath: /opt/bitnami/minio/secrets/
- {{- end }}
- - name: data
- mountPath: {{ .Values.persistence.mountPath }}
- {{- if .Values.tls.enabled }}
- - name: minio-certs
- mountPath: {{ default "/certs" .Values.tls.mountPath }}
- {{- end }}
- {{- if .Values.extraVolumeMounts }}
- {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }}
- {{- end }}
- {{- if .Values.sidecars }}
- {{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
- {{- end }}
- volumes:
- {{- if .Values.auth.useCredentialsFiles }}
- - name: minio-credentials
- secret:
- secretName: {{ include "minio.secretName" . }}
- {{- end }}
- - name: data
- {{- if .Values.persistence.enabled }}
- persistentVolumeClaim:
- claimName: {{ include "minio.claimName" . }}
- {{- else }}
- emptyDir: {}
- {{- end }}
- {{- if .Values.tls.enabled }}
- - name: minio-certs
- secret:
- secretName: {{ include "minio.tlsSecretName" . }}
- items:
- - key: tls.crt
- path: public.crt
- - key: tls.key
- path: private.key
- - key: ca.crt
- path: CAs/public.crt
- {{- end }}
- {{- if .Values.extraVolumes }}
- {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }}
- {{- end }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/statefulset.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/statefulset.yaml
new file mode 100644
index 000000000..bedab38ff
--- /dev/null
+++ b/devops/deploy-as-code/charts/backbone-services/minio/templates/statefulset.yaml
@@ -0,0 +1,269 @@
+{{- if eq .Values.mode "distributed" }}
+{{ $poolCount := .Values.pools | int }}
+{{ $nodeCount := .Values.replicas | int }}
+{{ $replicas := mul $poolCount $nodeCount }}
+{{ $drivesPerNode := .Values.drivesPerNode | int }}
+{{ $scheme := .Values.tls.enabled | ternary "https" "http" }}
+{{ $mountPath := .Values.mountPath }}
+{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }}
+{{ $subPath := .Values.persistence.subPath }}
+{{ $penabled := .Values.persistence.enabled }}
+{{ $accessMode := .Values.persistence.accessMode }}
+{{ $storageClass := .Values.persistence.storageClass }}
+{{ $psize := .Values.persistence.size }}
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ template "minio.fullname" . }}-svc
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+spec:
+ publishNotReadyAddresses: true
+ clusterIP: None
+ ports:
+ - name: {{ $scheme }}
+ port: {{ .Values.service.port }}
+ protocol: TCP
+ targetPort: {{ .Values.minioAPIPort }}
+ selector:
+ app: {{ template "minio.name" . }}
+ release: {{ .Release.Name }}
+---
+apiVersion: {{ template "minio.statefulset.apiVersion" . }}
+kind: StatefulSet
+metadata:
+ name: {{ template "minio.fullname" . }}
+ namespace: {{ .Values.namespace }}
+ labels:
+ app: {{ template "minio.name" . }}
+ chart: {{ template "minio.chart" . }}
+ release: {{ .Release.Name }}
+ heritage: {{ .Release.Service }}
+ {{- if .Values.additionalLabels }}
+ {{- toYaml .Values.additionalLabels | nindent 4 }}
+ {{- end }}
+ {{- if .Values.additionalAnnotations }}
+ annotations: {{- toYaml .Values.additionalAnnotations | nindent 4 }}
+ {{- end }}
+spec:
+ updateStrategy:
+ type: {{ .Values.statefulSetUpdate.updateStrategy }}
+ podManagementPolicy: "Parallel"
+ serviceName: {{ template "minio.fullname" . }}-svc
+ replicas: {{ $replicas }}
+ selector:
+ matchLabels:
+ app: {{ template "minio.name" . }}
+ release: {{ .Release.Name }}
+ template:
+ metadata:
+ name: {{ template "minio.fullname" . }}
+ labels:
+ app: {{ template "minio.name" . }}
+ release: {{ .Release.Name }}
+ {{- if .Values.podLabels }}
+ {{- toYaml .Values.podLabels | nindent 8 }}
+ {{- end }}
+ annotations:
+ {{- if not .Values.ignoreChartChecksums }}
+ checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
+ checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+ {{- end }}
+ {{- if .Values.podAnnotations }}
+ {{- toYaml .Values.podAnnotations | nindent 8 }}
+ {{- end }}
+ spec:
+ {{- if .Values.priorityClassName }}
+ priorityClassName: "{{ .Values.priorityClassName }}"
+ {{- end }}
+ {{- if .Values.runtimeClassName }}
+ runtimeClassName: "{{ .Values.runtimeClassName }}"
+ {{- end }}
+ {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
+ securityContext:
+ {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }}
+ {{- end }}
+ {{- if .Values.serviceAccount.create }}
+ serviceAccountName: {{ .Values.serviceAccount.name }}
+ {{- end }}
+ containers:
+ - name: {{ .Chart.Name }}
+ image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ command: [
+ "/bin/sh",
+ "-ce",
+ "/usr/bin/docker-entrypoint.sh minio server {{- range $i := until $poolCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.svcFQDN` $ }}{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{ else }}{{ $bucketRoot }}{{end }}{{- end }} -S {{ .Values.certsPath }} --address :{{ .Values.minioAPIPort }} --console-address :{{ .Values.minioConsolePort }} {{- template `minio.extraArgs` . }}"
+ ]
+ volumeMounts:
+ {{- if $penabled }}
+ {{- if (gt $drivesPerNode 1) }}
+ {{- range $i := until $drivesPerNode }}
+ - name: export-{{ $i }}
+ mountPath: {{ $mountPath }}-{{ $i }}
+ {{- if and $penabled $subPath }}
+ subPath: {{ $subPath }}
+ {{- end }}
+ {{- end }}
+ {{- else }}
+ - name: export
+ mountPath: {{ $mountPath }}
+ {{- if and $penabled $subPath }}
+ subPath: {{ $subPath }}
+ {{- end }}
+ {{- end }}
+ {{- end }}
+ {{- if .Values.extraSecret }}
+ - name: extra-secret
+ mountPath: "/tmp/minio-config-env"
+ {{- end }}
+ {{- include "minio.tlsKeysVolumeMount" . | indent 12 }}
+ {{- if .Values.extraVolumeMounts }}
+ {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+ {{- end }}
+ ports:
+ - name: {{ $scheme }}
+ containerPort: {{ .Values.minioAPIPort }}
+ - name: {{ $scheme }}-console
+ containerPort: {{ .Values.minioConsolePort }}
+ env:
+ - name: MINIO_ROOT_USER
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "minio.secretName" . }}
+ key: rootUser
+ - name: MINIO_ROOT_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "minio.secretName" . }}
+ key: rootPassword
+ {{- if .Values.extraSecret }}
+ - name: MINIO_CONFIG_ENV_FILE
+ value: "/tmp/minio-config-env/config.env"
+ {{- end }}
+ {{- if .Values.metrics.serviceMonitor.public }}
+ - name: MINIO_PROMETHEUS_AUTH_TYPE
+ value: "public"
+ {{- end }}
+ {{- if .Values.oidc.enabled }}
+ - name: MINIO_IDENTITY_OPENID_CONFIG_URL
+ value: {{ .Values.oidc.configUrl }}
+ - name: MINIO_IDENTITY_OPENID_CLIENT_ID
+ {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientIdKey }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ .Values.oidc.existingClientSecretName }}
+ key: {{ .Values.oidc.existingClientIdKey }}
+ {{- else }}
+ value: {{ .Values.oidc.clientId }}
+ {{- end }}
+ - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+ {{- if and .Values.oidc.existingClientSecretName .Values.oidc.existingClientSecretKey }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ .Values.oidc.existingClientSecretName }}
+ key: {{ .Values.oidc.existingClientSecretKey }}
+ {{- else }}
+ value: {{ .Values.oidc.clientSecret }}
+ {{- end }}
+ - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
+ value: {{ .Values.oidc.claimName }}
+ - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX
+ value: {{ .Values.oidc.claimPrefix }}
+ - name: MINIO_IDENTITY_OPENID_SCOPES
+ value: {{ .Values.oidc.scopes }}
+ - name: MINIO_IDENTITY_OPENID_COMMENT
+ value: {{ .Values.oidc.comment }}
+ - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
+ value: {{ .Values.oidc.redirectUri }}
+ - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
+ value: {{ .Values.oidc.displayName }}
+ {{- end }}
+ {{- range $key, $val := .Values.environment }}
+ - name: {{ $key }}
+ value: {{ tpl $val $ | quote }}
+ {{- end }}
+ resources: {{- toYaml .Values.resources | nindent 12 }}
+ {{- if and .Values.securityContext.enabled .Values.persistence.enabled }}
+ {{- with .Values.containerSecurityContext }}
+ securityContext: {{ toYaml . | nindent 12}}
+ {{- end }}
+ {{- end }}
+ {{- with .Values.extraContainers }}
+ {{- if eq (typeOf .) "string" }}
+ {{- tpl . $ | nindent 8 }}
+ {{- else }}
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- end }}
+ {{- with .Values.nodeSelector }}
+ nodeSelector: {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- include "minio.imagePullSecrets" . | indent 6 }}
+ {{- with .Values.affinity }}
+ affinity: {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.tolerations }}
+ tolerations: {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- if and (gt $replicas 1) (ge .Capabilities.KubeVersion.Major "1") (ge .Capabilities.KubeVersion.Minor "19") }}
+ {{- with .Values.topologySpreadConstraints }}
+ topologySpreadConstraints: {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- end }}
+ volumes:
+ - name: minio-user
+ secret:
+ secretName: {{ template "minio.secretName" . }}
+ {{- if .Values.extraSecret }}
+ - name: extra-secret
+ secret:
+ secretName: {{ .Values.extraSecret }}
+ {{- end }}
+ {{- include "minio.tlsKeysVolume" . | indent 8 }}
+ {{- if .Values.extraVolumes }}
+ {{- toYaml .Values.extraVolumes | nindent 8 }}
+ {{- end }}
+ {{- if .Values.persistence.enabled }}
+ volumeClaimTemplates:
+ {{- if gt $drivesPerNode 1 }}
+ {{- range $diskId := until $drivesPerNode}}
+ - apiVersion: v1
+ kind: PersistentVolumeClaim
+ metadata:
+ name: export-{{ $diskId }}
+ {{- if $.Values.persistence.annotations }}
+ annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }}
+ {{- end }}
+ spec:
+ accessModes: [ {{ $accessMode | quote }} ]
+ {{- if $.Values.persistence.storageClass }}
+ storageClassName: {{ $.Values.persistence.storageClass }}
+ {{- end }}
+ resources:
+ requests:
+ storage: {{ $.Values.persistence.size }}
+ {{- end }}
+ {{- else }}
+ - apiVersion: v1
+ kind: PersistentVolumeClaim
+ metadata:
+ name: export
+ {{- if $.Values.persistence.annotations }}
+ annotations: {{- toYaml $.Values.persistence.annotations | nindent 10 }}
+ {{- end }}
+ spec:
+ accessModes: [ {{ $accessMode | quote }} ]
+ {{- if $.Values.persistence.storageClass }}
+ storageClassName: {{ $.Values.persistence.storageClass }}
+ {{- end }}
+ resources:
+ requests:
+ storage: {{ $.Values.persistence.size }}
+ {{- end }}
+ {{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/templates/tls-secrets.yaml b/devops/deploy-as-code/charts/backbone-services/minio/templates/tls-secrets.yaml
deleted file mode 100644
index 2f6730215..000000000
--- a/devops/deploy-as-code/charts/backbone-services/minio/templates/tls-secrets.yaml
+++ /dev/null
@@ -1,69 +0,0 @@
-{{- /*
-Copyright VMware, Inc.
-SPDX-License-Identifier: APACHE-2.0
-*/}}
-
-{{- if .Values.ingress.enabled }}
-{{- if .Values.ingress.secrets }}
-{{- range .Values.ingress.secrets }}
-apiVersion: v1
-kind: Secret
-metadata:
- name: {{ .name }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" $.Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if $.Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
-type: kubernetes.io/tls
-data:
- tls.crt: {{ .certificate | b64enc }}
- tls.key: {{ .key | b64enc }}
----
-{{- end }}
-{{- end }}
-{{- if and .Values.ingress.tls .Values.ingress.selfSigned }}
-{{- $secretName := printf "%s-tls" .Values.ingress.hostname }}
-{{- $ca := genCA "minio-ca" 365 }}
-{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }}
-apiVersion: v1
-kind: Secret
-metadata:
- name: {{ $secretName }}
- namespace: {{ include "common.names.namespace" . | quote }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
-type: kubernetes.io/tls
-data:
- tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
- tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
- ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
-{{- end }}
-{{- end }}
-{{- if (include "minio.createTlsSecret" .) }}
-{{- $secretName := printf "%s-crt" (include "common.names.fullname" .) }}
-{{- $ca := genCA "minio-ca" 365 }}
-{{- $releaseNamespace := include "common.names.namespace" . }}
-{{- $clusterDomain := .Values.clusterDomain }}
-{{- $fullname := include "common.names.fullname" . }}
-{{- $serviceName := include "common.names.fullname" . }}
-{{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) }}
-{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) "127.0.0.1" "localhost" $fullname }}
-{{- $cert := genSignedCert $fullname nil $altNames 365 $ca }}
----
-apiVersion: v1
-kind: Secret
-metadata:
- name: {{ $secretName }}
- labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
- {{- if .Values.commonAnnotations }}
- annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
- {{- end }}
-type: kubernetes.io/tls
-data:
- tls.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.crt" "defaultValue" $cert.Cert "context" $) }}
- tls.key: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "tls.key" "defaultValue" $cert.Key "context" $) }}
- ca.crt: {{ include "common.secrets.lookup" (dict "secret" $secretName "key" "ca.crt" "defaultValue" $ca.Cert "context" $) }}
-{{- end }}
diff --git a/devops/deploy-as-code/charts/backbone-services/minio/values.yaml b/devops/deploy-as-code/charts/backbone-services/minio/values.yaml
index 09c25915c..0169a03ae 100644
--- a/devops/deploy-as-code/charts/backbone-services/minio/values.yaml
+++ b/devops/deploy-as-code/charts/backbone-services/minio/values.yaml
@@ -1,1161 +1,599 @@
-# Copyright VMware, Inc.
-# SPDX-License-Identifier: APACHE-2.0
-
-## @section Global parameters
-## Global Docker image parameters
-## Please, note that this will override the image parameters, including dependencies, configured to use the global value
-## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass
-
-## @param global.imageRegistry Global Docker image registry
-## @param global.imagePullSecrets Global Docker registry secret names as an array
-## @param global.storageClass Global StorageClass for Persistent Volume(s)
-##
-global:
- imageRegistry: ""
- ## e.g.
- ## imagePullSecrets:
- ## - myRegistryKeySecretName
- ##
- imagePullSecrets: []
- storageClass: ""
-
-## @section Common parameters
-
-## @param nameOverride String to partially override common.names.fullname template (will maintain the release name)
+## Provide a name in place of minio for `app:` labels
##
nameOverride: ""
-## @param namespaceOverride String to fully override common.names.namespace
-##
-namespaceOverride: ""
-## @param fullnameOverride String to fully override common.names.fullname template
-##
-fullnameOverride: ""
-## @param commonLabels Labels to add to all deployed objects
-##
-commonLabels: {}
-## @param commonAnnotations Annotations to add to all deployed objects
-##
-commonAnnotations: {}
-## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)
+
+## Provide a name to substitute for the full names of resources
##
-kubeVersion: ""
-## @param clusterDomain Default Kubernetes cluster domain
+fullnameOverride: "minio"
+
+namespace: "backbone"
+## set kubernetes cluster domain where minio is running
##
clusterDomain: cluster.local
-## @param extraDeploy Array of extra objects to deploy with the release
-##
-extraDeploy: []
-## @section MinIO® parameters
-
-## Bitnami MinIO® image version
-## ref: https://hub.docker.com/r/bitnami/minio/tags/
-## @param image.registry [default: REGISTRY_NAME] MinIO® image registry
-## @param image.repository [default: REPOSITORY_NAME/minio] MinIO® image repository
-## @skip image.tag MinIO® image tag (immutable tags are recommended)
-## @param image.digest MinIO® image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
-## @param image.pullPolicy Image pull policy
-## @param image.pullSecrets Specify docker-registry secret names as an array
-## @param image.debug Specify if debug logs should be enabled
+## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the
##
image:
- registry: docker.io
- repository: bitnami/minio
- tag: 2024.1.29-debian-11-r0
- digest: ""
- ## Specify a imagePullPolicy
- ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
- ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
- ##
+ repository: quay.io/minio/minio
+ tag: RELEASE.2024-12-18T13-15-44Z
pullPolicy: IfNotPresent
- ## Optionally specify an array of imagePullSecrets.
- ## Secrets must be manually created in the namespace.
- ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
- ## e.g:
- ## pullSecrets:
- ## - myRegistryKeySecretName
- ##
- pullSecrets: []
- ## Set to true if you would like to see extra information on logs
- ##
- debug: false
-## Bitnami MinIO® Client image version
-## ref: https://hub.docker.com/r/bitnami/minio-client/tags/
-## @param clientImage.registry [default: REGISTRY_NAME] MinIO® Client image registry
-## @param clientImage.repository [default: REPOSITORY_NAME/minio-client] MinIO® Client image repository
-## @skip clientImage.tag MinIO® Client image tag (immutable tags are recommended)
-## @param clientImage.digest MinIO® Client image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
-##
-clientImage:
- registry: docker.io
- repository: bitnami/minio-client
- tag: 2024.1.28-debian-11-r0
- digest: ""
-## @param mode MinIO® server mode (`standalone` or `distributed`)
-## ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide
-##
-mode: standalone
-## MinIO® authentication parameters
-##
-auth:
- ## @param auth.rootUser MinIO® root username
- ##
- rootUser: admin
- ## @param auth.rootPassword Password for MinIO® root user
- ##
- rootPassword: ""
- ## @param auth.existingSecret Use existing secret for credentials details (`auth.rootUser` and `auth.rootPassword` will be ignored and picked up from this secret). The secret has to contain the keys `root-user` and `root-password`)
- ##
- existingSecret: ""
- ## @param auth.forcePassword Force users to specify required passwords
- ##
- forcePassword: false
- ## @param auth.useCredentialsFiles Mount credentials as a files instead of using an environment variable
- ##
- useCredentialsFiles: false
- ## @param auth.forceNewKeys Force root credentials (user and password) to be reconfigured every time they change in the secrets
- ##
- forceNewKeys: false
-## @param defaultBuckets Comma, semi-colon or space separated list of buckets to create at initialization (only in standalone mode)
-## e.g:
-## defaultBuckets: "my-bucket, my-second-bucket"
-##
-defaultBuckets: ""
-## @param disableWebUI Disable MinIO® Web UI
-## ref: https://github.com/minio/minio/tree/master/docs/config/#browser
-##
-disableWebUI: false
-## Enable tls in front of MinIO® containers.
-##
-tls:
- ## @param tls.enabled Enable tls in front of the container
- ##
- enabled: false
- ## @param tls.autoGenerated Generate automatically self-signed TLS certificates
- ##
- autoGenerated: false
- ## @param tls.existingSecret Name of an existing secret holding the certificate information
- ##
- existingSecret: ""
- ## @param tls.mountPath The mount path where the secret will be located
- ## Custom mount path where the certificates will be located, if empty will default to /certs
- mountPath: ""
-## @param extraEnvVars Extra environment variables to be set on MinIO® container
-## e.g:
-## extraEnvVars:
-## - name: FOO
-## value: "bar"
-##
-extraEnvVars: []
-## @param extraEnvVarsCM ConfigMap with extra environment variables
-##
-extraEnvVarsCM: ""
-## @param extraEnvVarsSecret Secret with extra environment variables
-##
-extraEnvVarsSecret: ""
-## @param command Default container command (useful when using custom images). Use array form
-##
-command: []
-## @param args Default container args (useful when using custom images). Use array form
-##
-args: []
-## @section MinIO® deployment/statefulset parameters
+imagePullSecrets: []
+# - name: "image-pull-secret"
-## @param schedulerName Specifies the schedulerName, if it's nil uses kube-scheduler
-## https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
-##
-schedulerName: ""
-## @param terminationGracePeriodSeconds In seconds, time the given to the MinIO pod needs to terminate gracefully
-## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
-##
-terminationGracePeriodSeconds: ""
-## MinIO® deployment parameters
-## Only when 'mode' is 'standalone'
-##
-deployment:
- ## @param deployment.updateStrategy.type Deployment strategy type
- ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
- ## e.g:
- ## updateStrategy:
- ## type: RollingUpdate
- ## rollingUpdate:
- ## maxSurge: 25%
- ## maxUnavailable: 25%
- ##
- updateStrategy:
- type: Recreate
-## MinIO® statefulset parameters
-## Only when mode is 'distributed'
+## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio
+## client used to create a default bucket).
##
-statefulset:
- ## @param statefulset.updateStrategy.type StatefulSet strategy type
- ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
- ## e.g:
- ## updateStrategy:
- ## type: RollingUpdate
- ## rollingUpdate:
- ## maxSurge: 25%
- ## maxUnavailable: 25%
- ##
- updateStrategy:
- type: RollingUpdate
- ## @param statefulset.podManagementPolicy StatefulSet controller supports relax its ordering guarantees while preserving its uniqueness and identity guarantees. There are two valid pod management policies: OrderedReady and Parallel
- ## ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#pod-management-policy
- ##
- podManagementPolicy: Parallel
- ## @param statefulset.replicaCount Number of pods per zone (only for MinIO® distributed mode). Should be even and `>= 4`
- ##
- replicaCount: 4
- ## @param statefulset.zones Number of zones (only for MinIO® distributed mode)
- ##
- zones: 1
- ## @param statefulset.drivesPerNode Number of drives attached to every node (only for MinIO® distributed mode)
- ##
- drivesPerNode: 1
+mcImage:
+ repository: quay.io/minio/mc
+ tag: RELEASE.2024-11-21T17-21-54Z
+ pullPolicy: IfNotPresent
-## MinIO® provisioning
-##
-provisioning:
- ## @param provisioning.enabled Enable MinIO® provisioning Job
- ##
- enabled: false
- ## @param provisioning.schedulerName Name of the k8s scheduler (other than default) for MinIO® provisioning
- ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
- ##
- schedulerName: ""
- ## @param provisioning.nodeSelector Node labels for pod assignment. Evaluated as a template.
- ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/
- ##
- nodeSelector: {}
- ## @param provisioning.podLabels Extra labels for provisioning pods
- ## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
- ##
- podLabels: {}
- ## @param provisioning.podAnnotations Provisioning Pod annotations.
- ##
- podAnnotations: {}
- ## @param provisioning.command Default provisioning container command (useful when using custom images). Use array form
- ##
- command: []
- ## @param provisioning.args Default provisioning container args (useful when using custom images). Use array form
- ##
- args: []
- ## @param provisioning.extraCommands Optionally specify extra list of additional commands for MinIO® provisioning pod
- ##
- extraCommands: []
- ## @param provisioning.extraVolumes Optionally specify extra list of additional volumes for MinIO® provisioning pod
- ##
- extraVolumes: []
- ## @param provisioning.extraVolumeMounts Optionally specify extra list of additional volumeMounts for MinIO® provisioning container
- ##
- extraVolumeMounts: []
- ## We usually recommend not to specify default resources and to leave this as a conscious
- ## choice for the user. This also increases chances charts run on environments with little
- ## resources, such as Minikube. If you do want to specify resources, uncomment the following
- ## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
- ## @param provisioning.resources.limits The resources limits for the container
- ## @param provisioning.resources.requests The requested resources for the container
- ##
- resources:
- ## Example:
- ## limits:
- ## cpu: 100m
- ## memory: 64Mi
- limits: {}
- ## Examples:
- ## requests:
- ## cpu: 200m
- ## memory: 128Mi
- requests: {}
- ## @param provisioning.policies MinIO® policies provisioning
- ## https://docs.min.io/docs/minio-admin-complete-guide.html#policy
- ## e.g.
- ## policies:
- ## - name: custom-bucket-specific-policy
- ## statements:
- ## - resources:
- ## - "arn:aws:s3:::my-bucket"
- ## actions:
- ## - "s3:GetBucketLocation"
- ## - "s3:ListBucket"
- ## - "s3:ListBucketMultipartUploads"
- ## - resources:
- ## - "arn:aws:s3:::my-bucket/*"
- ## # Allowed values: "Allow" | "Deny"
- ## # Defaults to "Deny" if not specified
- ## effect: "Allow"
- ## actions:
- ## - "s3:AbortMultipartUpload"
- ## - "s3:DeleteObject"
- ## - "s3:GetObject"
- ## - "s3:ListMultipartUploadParts"
- ## - "s3:PutObject"
- policies: []
- ## @param provisioning.users MinIO® users provisioning. Can be used in addition to provisioning.usersExistingSecrets.
- ## https://docs.min.io/docs/minio-admin-complete-guide.html#user
- ## e.g.
- ## users:
- ## - username: test-username
- ## password: test-password
- ## disabled: false
- ## policies:
- ## - readwrite
- ## - consoleAdmin
- ## - diagnostics
- ## # When set to true, it will replace all policies with the specified.
- ## # When false, the policies will be added to the existing.
- ## setPolicies: false
- users: []
- ## @param provisioning.usersExistingSecrets Array if existing secrets containing MinIO® users to be provisioned. Can be used in addition to provisioning.users.
- ## https://docs.min.io/docs/minio-admin-complete-guide.html#user
- ##
- ## Instead of configuring users inside values.yaml, referring to existing Kubernetes secrets containing user
- ## configurations is possible.
- ## e.g.
- ## usersExistingSecrets:
- ## - centralized-minio-users
- ##
- ## All provided Kubernetes secrets require a specific data structure. The same data from the provisioning.users example above
- ## can be defined via secrets with the following data structure. The secret keys have no meaning to the provisioning job except that
- ## they are used as filenames.
- ## ## apiVersion: v1
- ## ## kind: Secret
- ## ## metadata:
- ## ## name: centralized-minio-users
- ## ## type: Opaque
- ## ## stringData:
- ## ## username1: |
- ## ## username=test-username
- ## ## password=test-password
- ## ## disabled=false
- ## ## policies=readwrite,consoleAdmin,diagnostics
- ## ## setPolicies=false
- usersExistingSecrets: []
- ## @param provisioning.groups MinIO® groups provisioning
- ## https://docs.min.io/docs/minio-admin-complete-guide.html#group
- ## e.g.
- ## groups
- ## - name: test-group
- ## disabled: false
- ## members:
- ## - test-username
- ## policies:
- ## - readwrite
- ## # When set to true, it will replace all policies with the specified.
- ## # When false, the policies will be added to the existing.
- ## setPolicies: false
- groups: []
- ## @param provisioning.buckets MinIO® buckets, versioning, lifecycle, quota and tags provisioning
- ## Buckets https://docs.min.io/docs/minio-client-complete-guide.html#mb
- ## Lifecycle https://docs.min.io/docs/minio-client-complete-guide.html#ilm
- ## Quotas https://docs.min.io/docs/minio-admin-complete-guide.html#bucket
- ## Tags https://docs.min.io/docs/minio-client-complete-guide.html#tag
- ## Versioning https://docs.min.io/docs/minio-client-complete-guide.html#version
- ## e.g.
- ## buckets:
- ## - name: test-bucket
- ## region: us-east-1
- ## # Only when mode is 'distributed'
- ## # Allowed values: "Versioned" | "Suspended" | "Unchanged"
- ## # Defaults to "Suspended" if not specified.
- ## # For compatibility, accepts boolean values as well, where true maps
- ## # to "Versioned" and false to "Suspended".
- ## # ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide
- ## versioning: Suspended
- ## # Versioning is automatically enabled if withLock is true
- ## # ref: https://docs.min.io/docs/minio-bucket-versioning-guide.html
- ## withLock: true
- ## # Only when mode is 'distributed'
- ## # ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide
- ## lifecycle:
- ## - id: TestPrefix7dRetention
- ## prefix: test-prefix
- ## disabled: false
- ## expiry:
- ## days: 7
- ## # Days !OR! date
- ## # date: "2021-11-11T00:00:00Z"
- ## nonconcurrentDays: 3
- ## # Only when mode is 'distributed'
- ## # ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide
- ## quota:
- ## # set (hard still works as an alias but is deprecated) or clear(+ omit size)
- ## type: set
- ## size: 10GiB
- ## tags:
- ## key1: value1
- buckets: []
- ## @param provisioning.config MinIO® config provisioning
- ## https://docs.min.io/docs/minio-server-configuration-guide.html
- ## e.g.
- ## config:
- ## - name: region
- ## options:
- ## name: us-east-1
- config: []
- ## MinIO® pod Security Context
- ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
- ## @param provisioning.podSecurityContext.enabled Enable pod Security Context
- ## @param provisioning.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
- ## @param provisioning.podSecurityContext.sysctls Set kernel settings using the sysctl interface
- ## @param provisioning.podSecurityContext.supplementalGroups Set filesystem extra groups
- ## @param provisioning.podSecurityContext.fsGroup Group ID for the container
- ##
- podSecurityContext:
- enabled: true
- fsGroupChangePolicy: Always
- sysctls: []
- supplementalGroups: []
- fsGroup: 1001
- ## MinIO® container Security Context
- ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
- ## @param provisioning.containerSecurityContext.enabled Enabled containers' Security Context
- ## @param provisioning.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
- ## @param provisioning.containerSecurityContext.runAsUser Set containers' Security Context runAsUser
- ## @param provisioning.containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
- ## @param provisioning.containerSecurityContext.privileged Set container's Security Context privileged
- ## @param provisioning.containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
- ## @param provisioning.containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
- ## @param provisioning.containerSecurityContext.capabilities.drop List of capabilities to be dropped
- ## @param provisioning.containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
- ##
- containerSecurityContext:
- enabled: true
- seLinuxOptions: null
- runAsUser: 1001
- runAsNonRoot: true
- privileged: false
- readOnlyRootFilesystem: false
- allowPrivilegeEscalation: false
- capabilities:
- drop: ["ALL"]
- seccompProfile:
- type: "RuntimeDefault"
+## minio mode, i.e. standalone or distributed
+mode: distributed ## other supported values are "standalone"
- ## Automatic Cleanup for Finished Jobs
- ## @param provisioning.cleanupAfterFinished.enabled Enables Cleanup for Finished Jobs
- ## @param provisioning.cleanupAfterFinished.seconds Sets the value of ttlSecondsAfterFinished
- ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/
- ##
- cleanupAfterFinished:
- enabled: false
- seconds: 600
-## @param automountServiceAccountToken Mount Service Account token in pod
-##
-automountServiceAccountToken: false
-## @param hostAliases MinIO® pod host aliases
-## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
-##
-hostAliases: []
-## @param containerPorts.api MinIO® container port to open for MinIO® API
-## @param containerPorts.console MinIO® container port to open for MinIO® Console
-##
-containerPorts:
- api: 9000
- console: 9001
-## MinIO® pod Security Context
-## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
-## @param podSecurityContext.enabled Enable pod Security Context
-## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface
-## @param podSecurityContext.supplementalGroups Set filesystem extra groups
-## @param podSecurityContext.fsGroup Group ID for the container
-## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
-## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface
-## @param podSecurityContext.supplementalGroups Set filesystem extra groups
-## @param podSecurityContext.fsGroupChangePolicy When K8s should preform chown on attached volumes
-##
-podSecurityContext:
- enabled: true
- sysctls: []
- supplementalGroups: []
- fsGroup: 1001
- fsGroupChangePolicy: "OnRootMismatch"
-## MinIO® container Security Context
-## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
-## @param containerSecurityContext.enabled Enabled containers' Security Context
-## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
-## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser
-## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
-## @param containerSecurityContext.privileged Set container's Security Context privileged
-## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
-## @param containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
-## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped
-## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
-##
-containerSecurityContext:
- enabled: true
- seLinuxOptions: null
- runAsUser: 1001
- runAsNonRoot: true
- privileged: false
- readOnlyRootFilesystem: false
- allowPrivilegeEscalation: false
- capabilities:
- drop: ["ALL"]
- seccompProfile:
- type: "RuntimeDefault"
-## @param podLabels Extra labels for MinIO® pods
-## Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
-##
-podLabels: {}
-## @param podAnnotations Annotations for MinIO® pods
-## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
-##
-podAnnotations: {}
-## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
-## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
-##
-podAffinityPreset: ""
-## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
-## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
-##
-podAntiAffinityPreset: soft
-## Node affinity preset
-## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
-##
-nodeAffinityPreset:
- ## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
- ##
- type: ""
- ## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set.
- ## E.g.
- ## key: "kubernetes.io/e2e-az-name"
- ##
- key: ""
- ## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set.
- ## E.g.
- ## values:
- ## - e2e-az1
- ## - e2e-az2
- ##
- values: []
-## @param affinity Affinity for pod assignment. Evaluated as a template.
-## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set
-##
-affinity: {}
-## @param nodeSelector Node labels for pod assignment. Evaluated as a template.
-## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
-##
-nodeSelector: {}
-## @param tolerations Tolerations for pod assignment. Evaluated as a template.
-## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-##
-tolerations: []
-## @param topologySpreadConstraints Topology Spread Constraints for MinIO® pods assignment spread across your cluster among failure-domains
-## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods
-##
-topologySpreadConstraints: []
-## @param priorityClassName MinIO® pods' priorityClassName
+## Additional labels to include with deployment or statefulset
+additionalLabels: {}
+
+## Additional annotations to include with deployment or statefulset
+additionalAnnotations: {}
+
+## Typically the deployment/statefulset includes checksums of secrets/config,
+## So that when these change on a subsequent helm install, the deployment/statefulset
+## is restarted. This can result in unnecessary restarts under GitOps tooling such as
+## flux, so set to "true" to disable this behaviour.
+ignoreChartChecksums: false
+
+## Additional arguments to pass to minio binary
+extraArgs: []
+# example for enabling FTP:
+# - --ftp=\"address=:8021\"
+# - --ftp=\"passive-port-range=10000-10010\"
+
+## Additional volumes to minio container
+extraVolumes: []
+
+## Additional volumeMounts to minio container
+extraVolumeMounts: []
+
+## Additional sidecar containers
+extraContainers: []
+
+## Internal port number for MinIO S3 API container
+## Change service.port to change external port number
+minioAPIPort: "9000"
+
+## Internal port number for MinIO Browser Console container
+## Change consoleService.port to change external port number
+minioConsolePort: "9001"
+
+## Update strategy for Deployments
+deploymentUpdate:
+ type: RollingUpdate
+ maxUnavailable: 0
+ maxSurge: 100%
+
+## Update strategy for StatefulSets
+statefulSetUpdate:
+ updateStrategy: RollingUpdate
+
+## Pod priority settings
+## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
##
priorityClassName: ""
-## @param runtimeClassName Name of the runtime class to be used by MinIO® pods'
-## ref: https://kubernetes.io/docs/concepts/containers/runtime-class/
+
+## Pod runtime class name
+## ref https://kubernetes.io/docs/concepts/containers/runtime-class/
##
runtimeClassName: ""
-## MinIO® containers' resource requests and limits
-## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
-## We usually recommend not to specify default resources and to leave this as a conscious
-## choice for the user. This also increases chances charts run on environments with little
-## resources, such as Minikube. If you do want to specify resources, uncomment the following
-## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-## @param resources.limits The resources limits for the MinIO® container
-## @param resources.requests The requested resources for the MinIO® container
+
+## Set default rootUser, rootPassword
+## rootUser and rootPassword is generated when not set
+## Distributed MinIO ref: https://min.io/docs/minio/linux/operations/install-deploy-manage/deploy-minio-multi-node-multi-drive.html
##
-resources:
- ## Example:
- ## limits:
- ## cpu: 250m
- ## memory: 256Mi
- limits: {}
- ## Examples:
- ## requests:
- ## cpu: 250m
- ## memory: 256Mi
- requests: {}
-## Configure extra options for liveness probe
-## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
-## @param livenessProbe.enabled Enable livenessProbe
-## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
-## @param livenessProbe.periodSeconds Period seconds for livenessProbe
-## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
-## @param livenessProbe.failureThreshold Failure threshold for livenessProbe
-## @param livenessProbe.successThreshold Success threshold for livenessProbe
+rootUser: "root"
+rootPassword: "root@123"
+
+## Use existing Secret that store following variables:
##
-livenessProbe:
- enabled: true
- initialDelaySeconds: 5
- periodSeconds: 5
- timeoutSeconds: 5
- successThreshold: 1
- failureThreshold: 5
-## Configure extra options for readiness probe
-## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
-## @param readinessProbe.enabled Enable readinessProbe
-## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
-## @param readinessProbe.periodSeconds Period seconds for readinessProbe
-## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
-## @param readinessProbe.failureThreshold Failure threshold for readinessProbe
-## @param readinessProbe.successThreshold Success threshold for readinessProbe
+## | Chart var | .data. in Secret |
+## |:----------------------|:-------------------------|
+## | rootUser | rootUser |
+## | rootPassword | rootPassword |
##
-readinessProbe:
- enabled: true
- initialDelaySeconds: 5
- periodSeconds: 5
- timeoutSeconds: 1
- successThreshold: 1
- failureThreshold: 5
-## Configure extra options for startupProbe probe
-## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
-## @param startupProbe.enabled Enable startupProbe
-## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
-## @param startupProbe.periodSeconds Period seconds for startupProbe
-## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
-## @param startupProbe.failureThreshold Failure threshold for startupProbe
-## @param startupProbe.successThreshold Success threshold for startupProbe
+## All mentioned variables will be ignored in values file.
+## .data.rootUser and .data.rootPassword are mandatory,
+## others depend on enabled status of corresponding sections.
+existingSecret: "minio"
+
+## Directory on the MinIO pof
+certsPath: "/etc/minio/certs/"
+configPathmc: "/etc/minio/mc/"
+
+## Path where PV would be mounted on the MinIO Pod
+mountPath: "/export"
+## Override the root directory which the minio server should serve from.
+## If left empty, it defaults to the value of {{ .Values.mountPath }}
+## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }}
##
-startupProbe:
+bucketRoot: ""
+
+# Number of drives attached to a node
+drivesPerNode: 1
+# Number of MinIO containers running
+replicas: 2
+# Number of expanded MinIO clusters
+pools: 1
+
+## TLS Settings for MinIO
+tls:
enabled: false
- initialDelaySeconds: 0
- periodSeconds: 10
- timeoutSeconds: 5
- successThreshold: 1
- failureThreshold: 60
-## @param customLivenessProbe Override default liveness probe
-##
-customLivenessProbe: {}
-## @param customReadinessProbe Override default readiness probe
-##
-customReadinessProbe: {}
-## @param customStartupProbe Override default startup probe
-##
-customStartupProbe: {}
-## @param lifecycleHooks for the MinIO® container(s) to automate configuration before or after startup
-##
-lifecycleHooks: {}
-## @param extraVolumes Optionally specify extra list of additional volumes for MinIO® pods
-##
-extraVolumes: []
-## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for MinIO® container(s)
-##
-extraVolumeMounts: []
-## @param initContainers Add additional init containers to the MinIO® pods
-## e.g:
-## initContainers:
-## - name: your-image-name
-## image: your-image
-## imagePullPolicy: Always
-## ports:
-## - name: portname
-## containerPort: 1234
-##
-initContainers: []
-## @param sidecars Add additional sidecar containers to the MinIO® pods
-## e.g:
-## sidecars:
-## - name: your-image-name
-## image: your-image
-## imagePullPolicy: Always
-## ports:
-## - name: portname
-## containerPort: 1234
+ ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
+ certSecret: ""
+ publicCrt: public.crt
+ privateKey: private.key
+
+## Trusted Certificates Settings for MinIO. Ref: https://min.io/docs/minio/linux/operations/network-encryption.html#third-party-certificate-authorities
+## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret
+## When using self-signed certificates, remember to include MinIO's own certificate in the bundle with key public.crt.
+## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret.
+trustedCertsSecret: ""
+
+## Enable persistence using Persistent Volume Claims
+## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
##
-sidecars: []
+persistence:
+ enabled: true
+ annotations: {}
+
+ ## A manually managed Persistent Volume and Claim
+ ## Requires persistence.enabled: true
+ ## If defined, PVC must be created manually before volume will be bound
+ existingClaim: ""
-## @section Traffic exposure parameters
+ ## minio data Persistent Volume Storage Class
+ ## If defined, storageClassName:
+ ## If set to "-", storageClassName: "", which disables dynamic provisioning
+ ## If undefined (the default) or set to null, no storageClassName spec is
+ ## set, choosing the default provisioner. (gp2 on AWS, standard on
+ ## GKE, AWS & OpenStack)
+ ##
+ ## Storage class of PV to bind. By default it looks for standard storage class.
+ ## If the PV uses a different storage class, specify that here.
+ storageClass: "gp2"
+ volumeName: ""
+ accessMode: ReadWriteOnce
+ size: 50Gi
+
+ ## If subPath is set mount a sub folder of a volume instead of the root of the volume.
+ ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs).
+ ##
+ subPath: ""
-## MinIO® Service properties
+## Expose the MinIO service to be accessed from outside the cluster (LoadBalancer service).
+## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it.
+## ref: http://kubernetes.io/docs/user-guide/services/
##
service:
- ## @param service.type MinIO® service type
- ##
type: ClusterIP
- ## @param service.ports.api MinIO® API service port
- ## @param service.ports.console MinIO® Console service port
- ##
- ports:
- api: 9000
- console: 9001
- ## @param service.nodePorts.api Specify the MinIO® API nodePort value for the LoadBalancer and NodePort service types
- ## @param service.nodePorts.console Specify the MinIO® Console nodePort value for the LoadBalancer and NodePort service types
- ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
- ##
- nodePorts:
- api: ""
- console: ""
- ## @param service.clusterIP Service Cluster IP
- ## e.g.:
- ## clusterIP: None
- ##
- clusterIP: ""
- ## @param service.loadBalancerIP loadBalancerIP if service type is `LoadBalancer` (optional, cloud specific)
- ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer
- ##
- loadBalancerIP: ""
- ## @param service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer
+ clusterIP: ~
+ port: "9000"
+ nodePort: 32000
+ loadBalancerIP: ~
+ externalIPs: []
+ annotations: {}
+
+ ## service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer
## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
- ## e.g:
- ## loadBalancerSourceRanges:
- ## - 10.10.10.0/24
##
+ #loadBalancerSourceRanges:
+ # - 10.10.10.0/24
loadBalancerSourceRanges: []
- ## @param service.externalTrafficPolicy Enable client source IP preservation
- ## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
+
+ ## service.externalTrafficPolicy minio service external traffic policy
+ ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
##
externalTrafficPolicy: Cluster
- ## @param service.extraPorts Extra ports to expose in the service (normally used with the `sidecar` value)
- ##
- extraPorts: []
- ## @param service.annotations Annotations for MinIO® service
- ## This can be used to set the LoadBalancer service type to internal only.
- ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
- ##
- annotations: {}
- ## Headless service properties
- ##
- headless:
- ## @param service.headless.annotations Annotations for the headless service.
- ##
- annotations: {}
-## Configure the ingress resource that allows you to access the
-## MinIO® Console. Set up the URL
-## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
+
+## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/
##
+
ingress:
- ## @param ingress.enabled Enable ingress controller resource for MinIO Console
- ##
- enabled: false
- ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set)
- ##
- apiVersion: ""
- ## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)
- ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster.
- ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
- ##
- ingressClassName: ""
- ## @param ingress.hostname Default host for the ingress resource
- ##
- hostname: minio.local
- ## @param ingress.path The Path to MinIO®. You may need to set this to '/*' in order to use this with ALB ingress controllers.
- ##
- path: /
- ## @param ingress.pathType Ingress path type
- ##
- pathType: ImplementationSpecific
- ## @param ingress.servicePort Service port to be used
- ## Default is http. Alternative is https.
- ##
- servicePort: minio-console
- ## @param ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.
- ## For a full list of possible ingress annotations, please see
- ## ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md
- ## Use this parameter to set the required annotations for cert-manager, see
- ## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
- ##
- ## e.g:
- ## annotations:
- ## kubernetes.io/ingress.class: nginx
- ## cert-manager.io/cluster-issuer: cluster-issuer-name
- ##
+ enabled: true
+ ingressClassName: ~
+ labels: {}
+ # node-role.kubernetes.io/ingress: platform
annotations: {}
- ## @param ingress.tls Enable TLS configuration for the hostname defined at `ingress.hostname` parameter
- ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`
- ## You can:
- ## - Use the `ingress.secrets` parameter to create this TLS secret
- ## - Rely on cert-manager to create it by setting the corresponding annotations
- ## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`
- ##
- tls: false
- ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm
- ##
- selfSigned: false
- ## @param ingress.extraHosts The list of additional hostnames to be covered with this ingress record.
- ## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array
- ## e.g:
- ## extraHosts:
- ## - name: minio.local
- ## path: /
- ##
- extraHosts: []
- ## @param ingress.extraPaths Any additional paths that may need to be added to the ingress under the main host
- ## For example: The ALB ingress controller requires a special rule for handling SSL redirection.
- ## extraPaths:
- ## - path: /*
- ## backend:
- ## serviceName: ssl-redirect
- ## servicePort: use-annotation
- ##
- extraPaths: []
- ## @param ingress.extraTls The tls configuration for additional hostnames to be covered with this ingress record.
- ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
- ## e.g:
- ## extraTls:
- ## - hosts:
- ## - minio.local
- ## secretName: minio.local-tls
- ##
- extraTls: []
- ## @param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets
- ## key and certificate are expected in PEM format
- ## name should line up with a secretName set further up
- ##
- ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates
- ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days
- ## It is also possible to create and manage the certificates outside of this helm chart
- ## Please see README.md for more information
- ##
- ## Example
- ## secrets:
- ## - name: minio.local-tls
- ## key: ""
- ## certificate: ""
- ##
- secrets: []
- ## @param ingress.extraRules Additional rules to be covered with this ingress record
- ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
- ## e.g:
- ## extraRules:
- ## - host: example.local
- ## http:
- ## path: /
- ## backend:
- ## service:
- ## name: example-svc
- ## port:
- ## name: http
- ##
- extraRules: []
+ # kubernetes.io/ingress.class: nginx
+ # kubernetes.io/tls-acme: "true"
+ # kubernetes.io/ingress.allow-http: "false"
+ # kubernetes.io/ingress.global-static-ip-name: ""
+ # nginx.ingress.kubernetes.io/secure-backends: "true"
+ # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+ # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
+ path: /static-assets
+ hosts:
+ - "{{ .Values.global.domain }}"
+ tls:
+ - secretName: "{{ .Values.global.domain }}-tls-certs"
+ hosts:
+ - "{{ .Values.global.domain }}"
-## Configure the ingress resource that allows you to access the
-## MinIO® API. Set up the URL
-## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
-##
-apiIngress:
- ## @param apiIngress.enabled Enable ingress controller resource for MinIO API
- ##
- enabled: false
- ## @param apiIngress.apiVersion Force Ingress API version (automatically detected if not set)
- ##
- apiVersion: ""
- ## @param apiIngress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)
- ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster.
- ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
- ##
- ingressClassName: ""
- ## @param apiIngress.hostname Default host for the ingress resource
- ##
- hostname: minio.local
- ## @param apiIngress.path The Path to MinIO®. You may need to set this to '/*' in order to use this with ALB ingress controllers.
- ##
- path: /
- ## @param apiIngress.pathType Ingress path type
- ##
- pathType: ImplementationSpecific
- ## @param apiIngress.servicePort Service port to be used
- ## Default is http. Alternative is https.
- ##
- servicePort: minio-api
- ## @param apiIngress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.
- ## For a full list of possible ingress annotations, please see
- ## ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md
- ## Use this parameter to set the required annotations for cert-manager, see
- ## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
- ##
- ## e.g:
- ## annotations:
- ## kubernetes.io/ingress.class: nginx
- ## cert-manager.io/cluster-issuer: cluster-issuer-name
- ##
+consoleService:
+ type: ClusterIP
+ clusterIP: ~
+ port: "9001"
+ nodePort: 32001
+ loadBalancerIP: ~
+ externalIPs: []
annotations: {}
- ## @param apiIngress.tls Enable TLS configuration for the hostname defined at `apiIngress.hostname` parameter
- ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.apiIngress.hostname }}`
- ## You can:
- ## - Use the `ingress.secrets` parameter to create this TLS secret
- ## - Rely on cert-manager to create it by setting the corresponding annotations
- ## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`
- ##
- tls: false
- ## @param apiIngress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm
- ##
- selfSigned: false
- ## @param apiIngress.extraHosts The list of additional hostnames to be covered with this ingress record.
- ## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array
- ## e.g:
- ## extraHosts:
- ## - name: minio.local
- ## path: /
- ##
- extraHosts: []
- ## @param apiIngress.extraPaths Any additional paths that may need to be added to the ingress under the main host
- ## For example: The ALB ingress controller requires a special rule for handling SSL redirection.
- ## extraPaths:
- ## - path: /*
- ## backend:
- ## serviceName: ssl-redirect
- ## servicePort: use-annotation
- ##
- extraPaths: []
- ## @param apiIngress.extraTls The tls configuration for additional hostnames to be covered with this ingress record.
- ## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
- ## e.g:
- ## extraTls:
- ## - hosts:
- ## - minio.local
- ## secretName: minio.local-tls
- ##
- extraTls: []
- ## @param apiIngress.secrets If you're providing your own certificates, please use this to add the certificates as secrets
- ## key and certificate are expected in PEM format
- ## name should line up with a secretName set further up
- ##
- ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates
- ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days
- ## It is also possible to create and manage the certificates outside of this helm chart
- ## Please see README.md for more information
- ##
- ## Example
- ## secrets:
- ## - name: minio.local-tls
- ## key: ""
- ## certificate: ""
- ##
- secrets: []
- ## @param apiIngress.extraRules Additional rules to be covered with this ingress record
- ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
- ## e.g:
- ## extraRules:
- ## - host: example.local
- ## http:
- ## path: /
- ## backend:
- ## service:
- ## name: example-svc
- ## port:
- ## name: http
- ##
- extraRules: []
-## NetworkPolicy parameters
-##
-networkPolicy:
- ## @param networkPolicy.enabled Enable the default NetworkPolicy policy
+ ## consoleService.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer
+ ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
##
- enabled: false
- ## @param networkPolicy.allowExternal Don't require client label for connections
- ## When set to false, only pods with the correct client label will have network access to the port MinIO® is
- ## listening on. When true, MinIO® will accept connections from any source (with the correct destination port).
+ #loadBalancerSourceRanges:
+ # - 10.10.10.0/24
+ loadBalancerSourceRanges: []
+
+ ## servconsoleServiceice.externalTrafficPolicy minio service external traffic policy
+ ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
##
- allowExternal: true
- ## @param networkPolicy.extraFromClauses Allows to add extra 'from' clauses to the NetworkPolicy
- extraFromClauses: []
- ## Example
- ## extraFromClauses:
- ## - podSelector:
- ## matchLabels:
- ## a: b
+ externalTrafficPolicy: Cluster
-## @section Persistence parameters
+consoleIngress:
+ enabled: true
+ ingressClassName: ~
+ labels: {}
+ # node-role.kubernetes.io/ingress: platform
+ annotations:
+ kubernetes.io/ingress.class: nginx
+ nginx.ingress.kubernetes.io/rewrite-target: /$1
+ nginx.ingress.kubernetes.io/use-regex: "true"
+ nginx.ingress.kubernetes.io/proxy-body-size: 8m
+ # kubernetes.io/tls-acme: "true"
+ # kubernetes.io/ingress.allow-http: "false"
+ # kubernetes.io/ingress.global-static-ip-name: ""
+ # nginx.ingress.kubernetes.io/secure-backends: "true"
+ # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+ # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0
+ path: /minio/?(.*)
+ hosts:
+ - "{{ .Values.global.domain }}"
+ tls:
+ - secretName: "{{ .Values.global.domain }}-tls-certs"
+ hosts:
+ - "{{ .Values.global.domain }}"
-## Enable persistence using Persistent Volume Claims
-## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/
+## Node labels for pod assignment
+## Ref: https://kubernetes.io/docs/user-guide/node-selection/
##
-persistence:
- ## @param persistence.enabled Enable MinIO® data persistence using PVC. If false, use emptyDir
- ##
+nodeSelector: {}
+tolerations: []
+affinity: {}
+topologySpreadConstraints: []
+
+## Add stateful containers to have security context, if enabled MinIO will run as this
+## user and group NOTE: securityContext is only enabled if persistence.enabled=true
+securityContext:
enabled: true
- ## @param persistence.storageClass PVC Storage Class for MinIO® data volume
- ## If defined, storageClassName:
- ## If set to "-", storageClassName: "", which disables dynamic provisioning
- ## If undefined (the default) or set to null, no storageClassName spec is
- ## set, choosing the default provisioner. (gp2 on AWS, standard on
- ## GKE, AWS & OpenStack)
- ##
- storageClass: ""
- ## @param persistence.mountPath Data volume mount path
- ##
- mountPath: /bitnami/minio/data
- ## @param persistence.accessModes PVC Access Modes for MinIO® data volume
- ##
- accessModes:
- - ReadWriteOnce
- ## @param persistence.size PVC Storage Request for MinIO® data volume
- ##
- size: 8Gi
- ## @param persistence.annotations Annotations for the PVC
- ##
- annotations: {}
- ## @param persistence.existingClaim Name of an existing PVC to use (only in `standalone` mode)
- ##
- existingClaim: ""
+ runAsUser: 1000
+ runAsGroup: 1000
+ fsGroup: 1000
+ fsGroupChangePolicy: "OnRootMismatch"
-## @section Volume Permissions parameters
+containerSecurityContext:
+ readOnlyRootFilesystem: false
-## Init containers parameters:
-## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section.
+# Additational pod annotations
+podAnnotations: {}
+
+# Additional pod labels
+podLabels: {}
+
+## Configure resource requests and limits
+## ref: http://kubernetes.io/docs/user-guide/compute-resources/
##
-volumePermissions:
- ## @param volumePermissions.enabled Enable init container that changes the owner and group of the persistent volume(s) mountpoint to `runAsUser:fsGroup`
- ##
- enabled: false
- ## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume-permissions image registry
- ## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume-permissions image repository
- ## @skip volumePermissions.image.tag Init container volume-permissions image tag (immutable tags are recommended)
- ## @param volumePermissions.image.digest Init container volume-permissions image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
- ## @param volumePermissions.image.pullPolicy Init container volume-permissions image pull policy
- ## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array
- ##
- image:
- registry: docker.io
- repository: bitnami/os-shell
- tag: 11-debian-11-r95
- digest: ""
- pullPolicy: IfNotPresent
- ## Optionally specify an array of imagePullSecrets.
- ## Secrets must be manually created in the namespace.
- ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
- ## e.g:
- ## pullSecrets:
- ## - myRegistryKeySecretName
- ##
- pullSecrets: []
- ## Init container' resource requests and limits
- ## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
- ## We usually recommend not to specify default resources and to leave this as a conscious
- ## choice for the user. This also increases chances charts run on environments with little
- ## resources, such as Minikube. If you do want to specify resources, uncomment the following
- ## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
- ## @param volumePermissions.resources.limits Init container volume-permissions resource limits
- ## @param volumePermissions.resources.requests Init container volume-permissions resource requests
- ##
+resources:
+ requests:
+ memory: 512Mi
+
+## List of policies to be created after minio install
+##
+## In addition to default policies [readonly|readwrite|writeonly|consoleAdmin|diagnostics]
+## you can define additional policies with custom supported actions and resources
+policies: []
+## writeexamplepolicy policy grants creation or deletion of buckets with name
+## starting with example. In addition, grants objects write permissions on buckets starting with
+## example.
+# - name: writeexamplepolicy
+# statements:
+# - effect: Allow # this is the default
+# resources:
+# - 'arn:aws:s3:::example*/*'
+# actions:
+# - "s3:AbortMultipartUpload"
+# - "s3:GetObject"
+# - "s3:DeleteObject"
+# - "s3:PutObject"
+# - "s3:ListMultipartUploadParts"
+# - resources:
+# - 'arn:aws:s3:::example*'
+# actions:
+# - "s3:CreateBucket"
+# - "s3:DeleteBucket"
+# - "s3:GetBucketLocation"
+# - "s3:ListBucket"
+# - "s3:ListBucketMultipartUploads"
+## readonlyexamplepolicy policy grants access to buckets with name starting with example.
+## In addition, grants objects read permissions on buckets starting with example.
+# - name: readonlyexamplepolicy
+# statements:
+# - resources:
+# - 'arn:aws:s3:::example*/*'
+# actions:
+# - "s3:GetObject"
+# - resources:
+# - 'arn:aws:s3:::example*'
+# actions:
+# - "s3:GetBucketLocation"
+# - "s3:ListBucket"
+# - "s3:ListBucketMultipartUploads"
+## conditionsexample policy creates all access to example bucket with aws:username="johndoe" and source ip range 10.0.0.0/8 and 192.168.0.0/24 only
+# - name: conditionsexample
+# statements:
+# - resources:
+# - 'arn:aws:s3:::example/*'
+# actions:
+# - 's3:*'
+# conditions:
+# - StringEquals: '"aws:username": "johndoe"'
+# - IpAddress: |
+# "aws:SourceIp": [
+# "10.0.0.0/8",
+# "192.168.0.0/24"
+# ]
+#
+## Additional Annotations for the Kubernetes Job makePolicyJob
+makePolicyJob:
+ securityContext:
+ enabled: false
+ runAsUser: 1000
+ runAsGroup: 1000
resources:
- ## Example:
- ## limits:
- ## cpu: 500m
- ## memory: 1Gi
- limits: {}
- requests: {}
- ## Init container' Security Context
- ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser
- ## and not the below volumePermissions.containerSecurityContext.runAsUser
- ## @param volumePermissions.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
- ## @param volumePermissions.containerSecurityContext.runAsUser User ID for the init container
- ##
- containerSecurityContext:
- seLinuxOptions: null
- runAsUser: 0
+ requests:
+ memory: 128Mi
+ # Command to run after the main command on exit
+ exitCommand: ""
-## @section RBAC parameters
+## List of users to be created after minio install
+##
+users:
+ ## Username, password and policy to be assigned to the user
+ ## Default policies are [readonly|readwrite|writeonly|consoleAdmin|diagnostics]
+ ## Add new policies as explained here https://min.io/docs/minio/kubernetes/upstream/administration/identity-access-management.html#access-management
+ ## NOTE: this will fail if LDAP is enabled in your MinIO deployment
+ ## make sure to disable this if you are using LDAP.
+ - accessKey: console
+ secretKey: console123
+ policy: consoleAdmin
+ # Or you can refer to specific secret
+ #- accessKey: externalSecret
+ # existingSecret: my-secret
+ # existingSecretKey: password
+ # policy: readonly
-## Specifies whether a ServiceAccount should be created
-##
-serviceAccount:
- ## @param serviceAccount.create Enable the creation of a ServiceAccount for MinIO® pods
- ##
- create: true
- ## @param serviceAccount.name Name of the created ServiceAccount
- ## If not set and create is true, a name is generated using the common.names.fullname template
- ##
- name: ""
- ## @param serviceAccount.automountServiceAccountToken Enable/disable auto mounting of the service account token
- ##
- automountServiceAccountToken: false
- ## @param serviceAccount.annotations Custom annotations for MinIO® ServiceAccount
- ##
+## Additional Annotations for the Kubernetes Job makeUserJob
+makeUserJob:
+ securityContext:
+ enabled: false
+ runAsUser: 1000
+ runAsGroup: 1000
+ resources:
+ requests:
+ memory: 128Mi
+ # Command to run after the main command on exit
+ exitCommand: ""
+
+## List of service accounts to be created after minio install
+##
+svcaccts: []
+ ## accessKey, secretKey and parent user to be assigned to the service accounts
+ ## Add new service accounts as explained here https://min.io/docs/minio/kubernetes/upstream/administration/identity-access-management/minio-user-management.html#service-accounts
+ # - accessKey: console-svcacct
+ # secretKey: console123
+ # user: console
+ ## Or you can refer to specific secret
+ # - accessKey: externalSecret
+ # existingSecret: my-secret
+ # existingSecretKey: password
+ # user: console
+ ## You also can pass custom policy
+ # - accessKey: console-svcacct
+ # secretKey: console123
+ # user: console
+ # policy:
+ # statements:
+ # - resources:
+ # - 'arn:aws:s3:::example*/*'
+ # actions:
+ # - "s3:AbortMultipartUpload"
+ # - "s3:GetObject"
+ # - "s3:DeleteObject"
+ # - "s3:PutObject"
+ # - "s3:ListMultipartUploadParts"
+
+makeServiceAccountJob:
+ securityContext:
+ enabled: false
+ runAsUser: 1000
+ runAsGroup: 1000
+ resources:
+ requests:
+ memory: 128Mi
+ # Command to run after the main command on exit
+ exitCommand: ""
+
+## List of buckets to be created after minio install
+##
+buckets: []
+ # # Name of the bucket
+ # - name: bucket1
+ # # Policy to be set on the
+ # # bucket [none|download|upload|public]
+ # policy: none
+ # # Purge if bucket exists already
+ # purge: false
+ # # set versioning for
+ # # bucket [true|false]
+ # versioning: false # remove this key if you do not want versioning feature
+ # # set objectlocking for
+ # # bucket [true|false] NOTE: versioning is enabled by default if you use locking
+ # objectlocking: false
+ # - name: bucket2
+ # policy: none
+ # purge: false
+ # versioning: true
+ # # set objectlocking for
+ # # bucket [true|false] NOTE: versioning is enabled by default if you use locking
+ # objectlocking: false
+
+## Additional Annotations for the Kubernetes Job makeBucketJob
+makeBucketJob:
+ securityContext:
+ enabled: false
+ runAsUser: 1000
+ runAsGroup: 1000
+ resources:
+ requests:
+ memory: 128Mi
+ # Command to run after the main command on exit
+ exitCommand: ""
+
+## List of command to run after minio install
+## NOTE: the mc command TARGET is always "myminio"
+customCommands:
+ # - command: "admin policy attach myminio consoleAdmin --group='cn=ops,cn=groups,dc=example,dc=com'"
+
+## Additional Annotations for the Kubernetes Job customCommandJob
+customCommandJob:
+ securityContext:
+ enabled: false
+ runAsUser: 1000
+ runAsGroup: 1000
+ resources:
+ requests:
+ memory: 128Mi
+ ## Additional volumes to add to the post-job.
+ extraVolumes: []
+ # - name: extra-policies
+ # configMap:
+ # name: my-extra-policies-cm
+ ## Additional volumeMounts to add to the custom commands container when
+ ## running the post-job.
+ extraVolumeMounts: []
+ # - name: extra-policies
+ # mountPath: /mnt/extras/
+ # Command to run after the main command on exit
+ exitCommand: ""
+
+## Merge jobs
+postJob:
+ podAnnotations: {}
annotations: {}
+ securityContext:
+ enabled: false
+ runAsUser: 1000
+ runAsGroup: 1000
+ fsGroup: 1000
+ nodeSelector: {}
+ tolerations: []
+ affinity: {}
-## @section Other parameters
+## Use this field to add environment variables relevant to MinIO server. These fields will be passed on to MinIO container(s)
+## when Chart is deployed
+environment:
+ ## Please refer for comprehensive list https://min.io/docs/minio/linux/reference/minio-server/minio-server.html
+ ## MINIO_SUBNET_LICENSE: "License key obtained from https://subnet.min.io"
+ # MINIO_BROWSER: "on"
+ # MINIO_DOMAIN: "digit-lts.digit.org"
+ MINIO_BROWSER_REDIRECT_URL: "https://{{ .Values.global.domain }}/minio/"
-## MinIO® Pod Disruption Budget configuration in distributed mode.
-## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+## The name of a secret in the same kubernetes namespace which contain secret values
+## This can be useful for LDAP password, etc
+## The key in the secret must be 'config.env'
##
-pdb:
- ## @param pdb.create Enable/disable a Pod Disruption Budget creation
- ##
- create: false
- ## @param pdb.minAvailable Minimum number/percentage of pods that must still be available after the eviction
- ##
- minAvailable: 1
- ## @param pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable after the eviction
- ##
- maxUnavailable: ""
+extraSecret: ~
-## @section Metrics parameters
+## OpenID Identity Management
+## The following section documents environment variables for enabling external identity management using an OpenID Connect (OIDC)-compatible provider.
+## See https://min.io/docs/minio/linux/operations/external-iam/configure-openid-external-identity-management.html for a tutorial on using these variables.
+oidc:
+ enabled: false
+ configUrl: "https://identity-provider-url/.well-known/openid-configuration"
+ clientId: "minio"
+ clientSecret: ""
+ # Provide existing client secret from the Kubernetes Secret resource, existing secret will have priority over `clientId` and/or `clientSecret``
+ existingClientSecretName: ""
+ existingClientIdKey: ""
+ existingClientSecretKey: ""
+ claimName: "policy"
+ scopes: "openid,profile,email"
+ redirectUri: "https://console-endpoint-url/oauth_callback"
+ # Can leave empty
+ claimPrefix: ""
+ comment: ""
+ displayName: ""
+
+networkPolicy:
+ enabled: false
+ # Specifies whether the policies created will be standard Network Policies (flavor: kubernetes)
+ # or Cilium Network Policies (flavor: cilium)
+ flavor: kubernetes
+ allowExternal: true
+ # only when using flavor: cilium
+ egressEntities:
+ - kube-apiserver
+
+## PodDisruptionBudget settings
+## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
+##
+podDisruptionBudget:
+ enabled: false
+ maxUnavailable: 1
+
+## Specify the service account to use for the MinIO pods. If 'create' is set to 'false'
+## and 'name' is left unspecified, the account 'default' will be used.
+serviceAccount:
+ create: true
+ ## The name of the service account to use. If 'create' is 'true', a service account with that name
+ ## will be created.
+ name: "minio-sa"
metrics:
- ## @param metrics.prometheusAuthType Authentication mode for Prometheus (`jwt` or `public`)
- ## To allow public access without authentication for prometheus metrics set environment as follows.
- ##
- prometheusAuthType: public
- ## Prometheus Operator ServiceMonitor configuration
- ##
serviceMonitor:
- ## @param metrics.serviceMonitor.enabled If the operator is installed in your cluster, set to true to create a Service Monitor Entry
- ##
enabled: false
- ## @param metrics.serviceMonitor.namespace Namespace which Prometheus is running in
- ##
- namespace: ""
- ## @param metrics.serviceMonitor.labels Extra labels for the ServiceMonitor
- ##
- labels: {}
- ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in Prometheus
- ##
- jobLabel: ""
- ## DEPRECATED metrics.serviceMonitor.path - please use `metrics.serviceMonitor.paths` instead
- ##
- ## path: /minio/v2/metrics/cluster
- ## @param metrics.serviceMonitor.paths HTTP paths to scrape for metrics
- ##
- paths:
- - /minio/v2/metrics/cluster
- - /minio/v2/metrics/node
- ## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped
- ##
- interval: 30s
- ## @param metrics.serviceMonitor.scrapeTimeout Specify the timeout after which the scrape is ended
- ## e.g:
- ## scrapeTimeout: 30s
- scrapeTimeout: ""
- ## @param metrics.serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion
- ##
- metricRelabelings: []
- ## @param metrics.serviceMonitor.relabelings Metrics relabelings to add to the scrape endpoint, applied before scraping
- ##
- relabelings: []
- ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint
- ##
- honorLabels: false
- ## @param metrics.serviceMonitor.selector Prometheus instance selector labels
- ## ref: https://github.com/bitnami/charts/tree/main/bitnami/prometheus-operator#prometheus-configuration
- ##
- selector: {}
- ## @param metrics.serviceMonitor.apiVersion ApiVersion for the serviceMonitor Resource (defaults to "monitoring.coreos.com/v1")
- apiVersion: ""
- ## @param metrics.serviceMonitor.tlsConfig Additional TLS configuration for metrics endpoint with "https" scheme
- ## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig
- tlsConfig: {}
-
- ## Prometheus Operator PrometheusRule configuration
- ##
- prometheusRule:
- ## @param metrics.prometheusRule.enabled Create a Prometheus Operator PrometheusRule (also requires `metrics.enabled` to be `true` and `metrics.prometheusRule.rules`)
- ##
- enabled: false
- ## @param metrics.prometheusRule.namespace Namespace for the PrometheusRule Resource (defaults to the Release Namespace)
- ##
- namespace: ""
- ## @param metrics.prometheusRule.additionalLabels Additional labels that can be used so PrometheusRule will be discovered by Prometheus
- ##
+ # scrape each node/pod individually for additional metrics
+ includeNode: false
+ public: true
additionalLabels: {}
- ## @param metrics.prometheusRule.rules Prometheus Rule definitions
- # - alert: minio cluster nodes offline
- # annotations:
- # summary: "minio cluster nodes offline"
- # description: "minio cluster nodes offline, pod {{`{{`}} $labels.pod {{`}}`}} service {{`{{`}} $labels.job {{`}}`}} offline"
- # for: 10m
- # expr: minio_cluster_nodes_offline_total > 0
- # labels:
- # severity: critical
- # group: PaaS
- ##
- rules: []
+ annotations: {}
+ # for node metrics
+ relabelConfigs: {}
+ # for cluster metrics
+ relabelConfigsCluster: {}
+ # metricRelabelings:
+ # - regex: (server|pod)
+ # action: labeldrop
+ namespace: ~
+ # Scrape interval, for example `interval: 30s`
+ interval: ~
+ # Scrape timeout, for example `scrapeTimeout: 10s`
+ scrapeTimeout: ~
+
+## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md
+## Define endpoints to enable this section.
+etcd:
+ endpoints: []
+ pathPrefix: ""
+ corednsPathPrefix: ""
+ clientCert: ""
+ clientCertKey: ""
diff --git a/devops/deploy-as-code/charts/common-services/egov-hrms/values.yaml b/devops/deploy-as-code/charts/common-services/egov-hrms/values.yaml
index d7e56ed05..16a80eb79 100644
--- a/devops/deploy-as-code/charts/common-services/egov-hrms/values.yaml
+++ b/devops/deploy-as-code/charts/common-services/egov-hrms/values.yaml
@@ -16,12 +16,12 @@ initContainers:
schemaTable: "egov_hrms_schema"
image:
repository: "egov-hrms-db"
- tag: "hrms-boundary-dfe1cb188f-16"
+ tag: "hrms-boundary-0a4e737"
# Container Configs
image:
repository: "egov-hrms"
- tag: "hrms-boundary-dfe1cb188f-16"
+ tag: "hrms-boundary-0a4e737"
replicas: "1"
healthChecks:
enabled: true
@@ -75,6 +75,11 @@ env: |
configMapKeyRef:
name: egov-service-host
key: egov-idgen
+ - name: SPRING_DATASOURCE_URL
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: db-url
- name: EGOV_SERVICES_EGOV_IDGEN_CREATEPATH
value: /egov-idgen/id/_generate
- name: EGOV_SERVICES_EGOV_IDGEN_EMP_CODE_NAME
@@ -140,5 +145,12 @@ env: |
value: "false"
{{- if index .Values "tracing-enabled" }}
- name: TRACER_OPENTRACING_ENABLED
- value: "true"
+ value: "true"
{{- end }}
+ - name: EGOV_HRMS_DEV_MODE
+ value: "true"
+ - name: EGOV_HRMS_EMPLOYEE_DEFAULT_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: egov-hrms
+ key: employee-default-password
diff --git a/devops/deploy-as-code/charts/common-services/egov-user-event/values.yaml b/devops/deploy-as-code/charts/common-services/egov-user-event/values.yaml
index 171ea544a..8dab769b5 100644
--- a/devops/deploy-as-code/charts/common-services/egov-user-event/values.yaml
+++ b/devops/deploy-as-code/charts/common-services/egov-user-event/values.yaml
@@ -40,6 +40,11 @@ env: |
configMapKeyRef:
name: egov-service-host
key: egov-mdms-service
+ - name: SPRING_DATASOURCE_URL
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: db-url
- name: EGOV_MDMS_SEARCH_ENDPOINT
value: /egov-mdms-service/v1/_search
- name: SPRING_KAFKA_CONSUMER_GROUP_ID
diff --git a/devops/deploy-as-code/charts/common/templates/_deployment.yaml b/devops/deploy-as-code/charts/common/templates/_deployment.yaml
index abb912629..cd4cdc4f2 100644
--- a/devops/deploy-as-code/charts/common/templates/_deployment.yaml
+++ b/devops/deploy-as-code/charts/common/templates/_deployment.yaml
@@ -146,12 +146,12 @@ spec:
{{- end }}
{{- if or .Values.env (eq .Values.appType "java-spring") (index .Values "global" "tracing-enabled") }}
env:
- {{- if .Values.env }}
- {{- tpl .Values.env . | nindent 12 }}
- {{- end -}}
{{- if eq .Values.appType "java-spring" }}
{{- tpl .Values.extraEnv.java . | nindent 12 }}
- {{- end -}}
+ {{- end -}}
+ {{- if .Values.env }}
+ {{- tpl .Values.env . | nindent 12 }}
+ {{- end -}}
{{- if or (index .Values "global" "tracing-enabled") (index .Values "tracing-enabled") }}
{{- tpl .Values.extraEnv.jaeger . | nindent 12 }}
{{- end }}
diff --git a/devops/deploy-as-code/charts/common/values.yaml b/devops/deploy-as-code/charts/common/values.yaml
index 6ca59baa1..2afeb8dd7 100644
--- a/devops/deploy-as-code/charts/common/values.yaml
+++ b/devops/deploy-as-code/charts/common/values.yaml
@@ -43,7 +43,7 @@ initContainers:
valueFrom:
configMapKeyRef:
name: egov-config
- key: db-otel-url
+ key: db-url
- name: "SCHEMA_TABLE"
value: {{ .Values.initContainers.dbMigration.schemaTable | quote }}
- name: "FLYWAY_USER"
@@ -128,7 +128,7 @@ extraEnv:
valueFrom:
configMapKeyRef:
name: egov-config
- key: db-url
+ key: db-otel-url
- name: FLYWAY_ENABLED
value: "false"
- name: SPRING_FLYWAY_ENABLED
@@ -160,6 +160,8 @@ extraEnv:
configMapKeyRef:
name: egov-config
key: spring-datasource-tomcat-initialSize
+ - name: OTEL_TRACES_EXPORTER
+ value: "none"
- name: SERVER_TOMCAT_MAX_THREADS
{{- if index .Values "server-tomcat-max-threads" }}
value: {{ index .Values "server-tomcat-max-threads" | quote }}
@@ -288,4 +290,4 @@ cron:
vpa:
enabled: false
- updateMode: "Off"
\ No newline at end of file
+ updateMode: "Off"
diff --git a/devops/deploy-as-code/charts/core-services/configmaps/templates/secrets/egov-filestore-secret.yaml b/devops/deploy-as-code/charts/core-services/configmaps/templates/secrets/egov-filestore-secret.yaml
new file mode 100644
index 000000000..9d6655cac
--- /dev/null
+++ b/devops/deploy-as-code/charts/core-services/configmaps/templates/secrets/egov-filestore-secret.yaml
@@ -0,0 +1,13 @@
+{{- with index .Values "secrets" "egov-filestore" }}
+{{- if index . "aws-secret-key" }}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ .name }}
+ namespace: {{ .namespace }}
+type: Opaque
+data:
+ awskey: {{ index . "aws-key" | b64enc | quote }}
+ awssecretkey: {{ index . "aws-secret-key" | b64enc | quote }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/devops/deploy-as-code/charts/core-services/configmaps/templates/secrets/egov-hrms-secrets.yaml b/devops/deploy-as-code/charts/core-services/configmaps/templates/secrets/egov-hrms-secrets.yaml
new file mode 100644
index 000000000..f551a9ef4
--- /dev/null
+++ b/devops/deploy-as-code/charts/core-services/configmaps/templates/secrets/egov-hrms-secrets.yaml
@@ -0,0 +1,10 @@
+{{- with index .Values "secrets" "egov-hrms" }}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ .name }}
+ namespace: {{ .namespace }}
+type: Opaque
+data:
+ employee-default-password: {{ index . "employee-default-password" | b64enc | quote }}
+{{- end }}
\ No newline at end of file
diff --git a/devops/deploy-as-code/charts/core-services/configmaps/templates/secrets/minio-root-secret.yaml b/devops/deploy-as-code/charts/core-services/configmaps/templates/secrets/minio-root-secret.yaml
new file mode 100644
index 000000000..2d05ac183
--- /dev/null
+++ b/devops/deploy-as-code/charts/core-services/configmaps/templates/secrets/minio-root-secret.yaml
@@ -0,0 +1,13 @@
+{{- with index .Values "secrets" "minio" }}
+{{- if index . "password" }}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ .name }}
+ namespace: {{ .namespace }}
+type: Opaque
+data:
+ rootUser: {{ .username | b64enc | quote }}
+ rootPassword: {{ .password | b64enc | quote }}
+{{- end }}
+{{- end }}
diff --git a/devops/deploy-as-code/charts/core-services/configmaps/values.yaml b/devops/deploy-as-code/charts/core-services/configmaps/values.yaml
index 3c1969892..93cb86af2 100644
--- a/devops/deploy-as-code/charts/core-services/configmaps/values.yaml
+++ b/devops/deploy-as-code/charts/core-services/configmaps/values.yaml
@@ -157,6 +157,9 @@ secrets:
git-sync:
name: git-creds
namespace: egov
+ minio:
+ namespace: backbone
+ name: minio
pgadmin:
name: pgadmin
namespace: backbone
@@ -205,3 +208,6 @@ secrets:
egov-user-chatbot:
namespace: egov
name: egov-user-chatbot
+ egov-hrms:
+ name: egov-hrms
+ namespace: egov
diff --git a/devops/deploy-as-code/charts/core-services/coreservices-helmfile.yaml b/devops/deploy-as-code/charts/core-services/coreservices-helmfile.yaml
index 2e87facac..b267010d5 100644
--- a/devops/deploy-as-code/charts/core-services/coreservices-helmfile.yaml
+++ b/devops/deploy-as-code/charts/core-services/coreservices-helmfile.yaml
@@ -53,10 +53,6 @@ releases:
installed: true
<<: *default
- - name: egov-location
- installed: true
- <<: *default
-
- name: egov-indexer
installed: true
<<: *default
@@ -112,10 +108,6 @@ releases:
- name: gateway
installed: true
<<: *default
-
- - name: egov-pg-service
- installed: true
- <<: *default
- name: boundary-bulk-bff
installed: true
diff --git a/devops/deploy-as-code/charts/core-services/egov-location/Chart.lock b/devops/deploy-as-code/charts/core-services/egov-location/Chart.lock
deleted file mode 100644
index 277f97a6b..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-location/Chart.lock
+++ /dev/null
@@ -1,6 +0,0 @@
-dependencies:
-- name: common
- repository: file://../../common
- version: 0.0.5
-digest: sha256:5ecdd1fdad744b1a0d5873f42283e09223272e4c8717a0679c27d8e215bdbc85
-generated: "2025-07-04T17:59:29.202642692+05:30"
diff --git a/devops/deploy-as-code/charts/core-services/egov-location/charts/common-0.0.5.tgz b/devops/deploy-as-code/charts/core-services/egov-location/charts/common-0.0.5.tgz
deleted file mode 100644
index 9b5c2b749..000000000
Binary files a/devops/deploy-as-code/charts/core-services/egov-location/charts/common-0.0.5.tgz and /dev/null differ
diff --git a/devops/deploy-as-code/charts/core-services/egov-location/values.yaml b/devops/deploy-as-code/charts/core-services/egov-location/values.yaml
deleted file mode 100644
index 0216cc908..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-location/values.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
-# Common Labels
-labels:
- app: "egov-location"
- group: "core"
-
-# Ingress Configs
-ingress:
- enabled: true
- zuul: true
- context: "egov-location"
-
-# Init Containers Configs
-initContainers:
- dbMigration:
- enabled: true
- schemaTable: "egov_location_schema"
- image:
- repository: "egov-location-db"
- tag: v2.9.2-4a60f20
-
-# Container Configs
-image:
- repository: "egov-location"
- tag: v2.9.2-4a60f20
-replicas: "1"
-healthChecks:
- enabled: true
- livenessProbePath: "/egov-location/health"
- readinessProbePath: "/egov-location/health"
-appType: "java-spring"
-tracing-enabled: true
-heap: "-Xmx192m -Xms192m"
-java-args: "-Dspring.profiles.active=monitoring"
-gmaps: true
-# Additional Container Envs
-env: |
- - name: SPRING_KAFKA_CONSUMER_GROUP_ID
- value: egov-location-consumer-group
- - name: SPRING_KAFKA_PRODUCER_KEY_SERIALIZER
- value: org.apache.kafka.common.serialization.StringSerializer
- {{- if index .Values "global" "serializers-timezone-in-ist" }}
- - name: SPRING_KAFKA_PRODUCER_VALUE_SERIALIZER
- value: org.egov.tracer.kafka.serializer.ISTTimeZoneJsonSerializer
- {{- end }}
- - name: SERVER_PORT
- value: "8080"
- - name: EGOV_SERVICES_EGOV_MDMS_HOSTNAME
- valueFrom:
- configMapKeyRef:
- name: egov-service-host
- key: {{ .Values.mdmsHost | default "egov-mdms-service" }}
- - name: EGOV_SERVICES_EGOV_MDMS_SEARCHPATH
- value: {{ .Values.mdmsSearchPath | default "egov-mdms-service/v1/_search" }}
- {{- if index .Values "gmaps" }}
- - name: GMAPS_API_KEY
- valueFrom:
- secretKeyRef:
- name: egov-location
- key: gmapskey
- {{- end }}
- - name: JAVA_OPTS
- value: {{ index .Values "heap" | quote }}
- - name: JAVA_ARGS
- value: {{ index .Values "java-args" | quote }}
- - name: SECURITY_BASIC_ENABLED
- value: "false"
- - name: MANAGEMENT_SECURITY_ENABLED
- value: "false"
- {{- if index .Values "tracing-enabled" }}
- - name: TRACER_OPENTRACING_ENABLED
- value: "true"
- {{- end }}
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/Chart.lock b/devops/deploy-as-code/charts/core-services/egov-mdms-service/Chart.lock
deleted file mode 100644
index eaeec8815..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-mdms-service/Chart.lock
+++ /dev/null
@@ -1,6 +0,0 @@
-dependencies:
-- name: common
- repository: file://../../common
- version: 0.0.5
-digest: sha256:5ecdd1fdad744b1a0d5873f42283e09223272e4c8717a0679c27d8e215bdbc85
-generated: "2025-07-04T17:59:37.387412307+05:30"
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/Chart.yaml b/devops/deploy-as-code/charts/core-services/egov-mdms-service/Chart.yaml
deleted file mode 100644
index 812bc70b8..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-mdms-service/Chart.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: v2
-name: egov-mdms-service
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application.
-appVersion: 1.16.0
-
-dependencies:
-- name: common
- version: 0.0.5
- repository: file://../../common
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/charts/common-0.0.5.tgz b/devops/deploy-as-code/charts/core-services/egov-mdms-service/charts/common-0.0.5.tgz
deleted file mode 100644
index e452e60b1..000000000
Binary files a/devops/deploy-as-code/charts/core-services/egov-mdms-service/charts/common-0.0.5.tgz and /dev/null differ
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/ispirit-mdms-service-values.yaml b/devops/deploy-as-code/charts/core-services/egov-mdms-service/ispirit-mdms-service-values.yaml
deleted file mode 100644
index de6d21f46..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-mdms-service/ispirit-mdms-service-values.yaml
+++ /dev/null
@@ -1,70 +0,0 @@
-# Common Labels
-labels:
- app: "ispirit-mdms-service"
- group: "core"
-
-# Ingress Configs
-ingress:
- enabled: true
- zuul: true
- context: "ispirit-mdms-service"
-
-# Init Containers Configs
-initContainers:
- gitSync:
- enabled: true
- repo: "git@github.com:egovernments/egov-mdms-data"
- branch: "master"
-
-# Container Configs
-image:
- repository: "ispirit-mdms-service"
-replicas: "1"
-healthChecks:
- enabled: true
- livenessProbePath: "/ispirit-mdms-service/health"
- readinessProbePath: "/ispirit-mdms-service/health"
-appType: "java-spring"
-tracing-enabled: true
-heap: "-Xmx192m -Xms192m"
-java-args: "-Dspring.profiles.active=monitoring"
-mdms-path: "/work-dir/egov-mdms-data/data"
-mdms-git-url: ""
-mdms-folder: "egov-mdms-data"
-masters-config-url: "file:///work-dir/egov-mdms-data/master-config.json"
-branch: "master"
-
-# Additional Container Envs
-env: |
- - name: SERVER_CONTEXT_PATH
- value: /ispirit-mdms-service
- - name: SPRING_KAFKA_CONSUMER_GROUP_ID
- value: ispirit-mdms-service-consumer-group
- - name: SPRING_KAFKA_PRODUCER_KEY_SERIALIZER
- value: org.apache.kafka.common.serialization.StringSerializer
- {{- if index .Values "global" "serializers-timezone-in-ist" }}
- - name: SPRING_KAFKA_PRODUCER_VALUE_SERIALIZER
- value: org.egov.tracer.kafka.serializer.ISTTimeZoneJsonSerializer
- {{- end }}
- - name: JAVA_OPTS
- value: {{ index .Values "heap" | quote }}
- - name: JAVA_ARGS
- value: {{ index .Values "java-args" | quote }}
- - name: SERVER_PORT
- value: "8080"
- - name: EGOV_MDMS_CONF_PATH
- value: {{ index .Values "mdms-path" | quote }}
- - name: EGOV_MDMS_GIT_URL
- value: {{ index .Values "mdms-git-url" | quote }}
- - name: EGOV_MDMS_FOLDER
- value: {{ index .Values "mdms-folder" | quote }}
- - name: MASTERS_CONFIG_URL
- value: {{ index .Values "masters-config-url" | quote }}
- {{- if index .Values "branch" }}
- - name: BRANCH
- value: {{ index .Values "branch" | quote }}
- {{- end }}
- - name: SECURITY_BASIC_ENABLED
- value: "false"
- - name: MANAGEMENT_SECURITY_ENABLED
- value: "false"
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/templates/deployment.yaml b/devops/deploy-as-code/charts/core-services/egov-mdms-service/templates/deployment.yaml
deleted file mode 100644
index 3455c0005..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-mdms-service/templates/deployment.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-# deployment.yaml
-{{- template "common.deployment" . -}}
\ No newline at end of file
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/templates/ingress.yaml b/devops/deploy-as-code/charts/core-services/egov-mdms-service/templates/ingress.yaml
deleted file mode 100644
index 9a573c0d7..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-mdms-service/templates/ingress.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-# ingress.yaml
-{{- template "common.ingress" . -}}
\ No newline at end of file
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/templates/service.yaml b/devops/deploy-as-code/charts/core-services/egov-mdms-service/templates/service.yaml
deleted file mode 100644
index 735644576..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-mdms-service/templates/service.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-# service.yaml
-{{- template "common.service" . -}}
\ No newline at end of file
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/tenant-a-mdms-data.yaml b/devops/deploy-as-code/charts/core-services/egov-mdms-service/tenant-a-mdms-data.yaml
deleted file mode 100644
index 1347c0a84..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-mdms-service/tenant-a-mdms-data.yaml
+++ /dev/null
@@ -1,70 +0,0 @@
-# Common Labels
-labels:
- app: "egov-mdms-service-in"
- group: "core"
-
-# Ingress Configs
-ingress:
- enabled: true
- zuul: true
- context: "egov-mdms-service-tenant-a"
-
-# Init Containers Configs
-initContainers:
- gitSync:
- enabled: true
- repo: "git@github.com:egovernments/egov-mdms-data"
- branch: "master"
-
-# Container Configs
-image:
- repository: "egov-mdms-service-tenant-a"
-replicas: "1"
-healthChecks:
- enabled: true
- livenessProbePath: "/egov-mdms-service-tenant-a/health"
- readinessProbePath: "/egov-mdms-service-tenant-a/health"
-appType: "java-spring"
-tracing-enabled: true
-heap: "-Xmx192m -Xms192m"
-java-args: "-Dspring.profiles.active=monitoring"
-mdms-path: "/work-dir/egov-mdms-data/data"
-mdms-git-url: ""
-mdms-folder: "egov-mdms-data"
-masters-config-url: "file:///work-dir/egov-mdms-data/master-config.json"
-branch: "master"
-
-# Additional Container Envs
-env: |
- - name: SERVER_CONTEXT_PATH
- value: /egov-mdms-service-tenant-a
- - name: SPRING_KAFKA_CONSUMER_GROUP_ID
- value: egov-mdms-service-tenant-a-consumer-group
- - name: SPRING_KAFKA_PRODUCER_KEY_SERIALIZER
- value: org.apache.kafka.common.serialization.StringSerializer
- {{- if index .Values "global" "serializers-timezone-in-ist" }}
- - name: SPRING_KAFKA_PRODUCER_VALUE_SERIALIZER
- value: org.egov.tracer.kafka.serializer.ISTTimeZoneJsonSerializer
- {{- end }}
- - name: JAVA_OPTS
- value: {{ index .Values "heap" | quote }}
- - name: JAVA_ARGS
- value: {{ index .Values "java-args" | quote }}
- - name: SERVER_PORT
- value: "8080"
- - name: EGOV_MDMS_CONF_PATH
- value: {{ index .Values "mdms-path" | quote }}
- - name: EGOV_MDMS_GIT_URL
- value: {{ index .Values "mdms-git-url" | quote }}
- - name: EGOV_MDMS_FOLDER
- value: {{ index .Values "mdms-folder" | quote }}
- - name: MASTERS_CONFIG_URL
- value: {{ index .Values "masters-config-url" | quote }}
- {{- if index .Values "branch" }}
- - name: BRANCH
- value: {{ index .Values "branch" | quote }}
- {{- end }}
- - name: SECURITY_BASIC_ENABLED
- value: "false"
- - name: MANAGEMENT_SECURITY_ENABLED
- value: "false"
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/tenant-b-mdms-data.yaml b/devops/deploy-as-code/charts/core-services/egov-mdms-service/tenant-b-mdms-data.yaml
deleted file mode 100644
index 3b3fb3b15..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-mdms-service/tenant-b-mdms-data.yaml
+++ /dev/null
@@ -1,70 +0,0 @@
-# Common Labels
-labels:
- app: "egov-mdms-service-tenant-b"
- group: "core"
-
-# Ingress Configs
-ingress:
- enabled: true
- zuul: true
- context: "egov-mdms-service-tenant-b"
-
-# Init Containers Configs
-initContainers:
- gitSync:
- enabled: true
- repo: "git@github.com:egovernments/egov-mdms-data"
- branch: "master"
-
-# Container Configs
-image:
- repository: "egov-mdms-service-tenant-b"
-replicas: "1"
-healthChecks:
- enabled: true
- livenessProbePath: "/egov-mdms-service-tenant-b/health"
- readinessProbePath: "/egov-mdms-service-tenant-b/health"
-appType: "java-spring"
-tracing-enabled: true
-heap: "-Xmx192m -Xms192m"
-java-args: "-Dspring.profiles.active=monitoring"
-mdms-path: "/work-dir/egov-mdms-data/data"
-mdms-git-url: ""
-mdms-folder: "egov-mdms-data"
-masters-config-url: "file:///work-dir/egov-mdms-data/master-config.json"
-branch: "master"
-
-# Additional Container Envs
-env: |
- - name: SERVER_CONTEXT_PATH
- value: /egov-mdms-service-tenant-b
- - name: SPRING_KAFKA_CONSUMER_GROUP_ID
- value: egov-mdms-service-tenant-b-consumer-group
- - name: SPRING_KAFKA_PRODUCER_KEY_SERIALIZER
- value: org.apache.kafka.common.serialization.StringSerializer
- {{- if index .Values "global" "serializers-timezone-in-ist" }}
- - name: SPRING_KAFKA_PRODUCER_VALUE_SERIALIZER
- value: org.egov.tracer.kafka.serializer.ISTTimeZoneJsonSerializer
- {{- end }}
- - name: JAVA_OPTS
- value: {{ index .Values "heap" | quote }}
- - name: JAVA_ARGS
- value: {{ index .Values "java-args" | quote }}
- - name: SERVER_PORT
- value: "8080"
- - name: EGOV_MDMS_CONF_PATH
- value: {{ index .Values "mdms-path" | quote }}
- - name: EGOV_MDMS_GIT_URL
- value: {{ index .Values "mdms-git-url" | quote }}
- - name: EGOV_MDMS_FOLDER
- value: {{ index .Values "mdms-folder" | quote }}
- - name: MASTERS_CONFIG_URL
- value: {{ index .Values "masters-config-url" | quote }}
- {{- if index .Values "branch" }}
- - name: BRANCH
- value: {{ index .Values "branch" | quote }}
- {{- end }}
- - name: SECURITY_BASIC_ENABLED
- value: "false"
- - name: MANAGEMENT_SECURITY_ENABLED
- value: "false"
diff --git a/devops/deploy-as-code/charts/core-services/egov-mdms-service/values.yaml b/devops/deploy-as-code/charts/core-services/egov-mdms-service/values.yaml
deleted file mode 100644
index 6dd4f0597..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-mdms-service/values.yaml
+++ /dev/null
@@ -1,71 +0,0 @@
-# Common Labels
-labels:
- app: "egov-mdms-service"
- group: "core"
-
-# Ingress Configs
-ingress:
- enabled: true
- zuul: true
- context: "egov-mdms-service"
-
-# Init Containers Configs
-initContainers:
- gitSync:
- enabled: true
- repo: "git@github.com:egovernments/egov-mdms-data"
- branch: "staging"
-
-# Container Configs
-image:
- repository: "egov-mdms-service"
- tag: v2.9.2-4a60f20
-replicas: "1"
-healthChecks:
- enabled: true
- livenessProbePath: "/egov-mdms-service/health"
- readinessProbePath: "/egov-mdms-service/health"
-appType: "java-spring"
-tracing-enabled: true
-heap: "-Xmx192m -Xms192m"
-java-args: "-Dspring.profiles.active=monitoring"
-mdms-path: "/work-dir/egov-mdms-data/data"
-mdms-git-url: ""
-mdms-folder: "egov-mdms-data"
-masters-config-url: "file:///work-dir/egov-mdms-data/master-config.json"
-branch: "master"
-
-# Additional Container Envs
-env: |
- - name: SERVER_CONTEXT_PATH
- value: /egov-mdms-service
- - name: SPRING_KAFKA_CONSUMER_GROUP_ID
- value: egov-mdms-service-consumer-group
- - name: SPRING_KAFKA_PRODUCER_KEY_SERIALIZER
- value: org.apache.kafka.common.serialization.StringSerializer
- {{- if index .Values "global" "serializers-timezone-in-ist" }}
- - name: SPRING_KAFKA_PRODUCER_VALUE_SERIALIZER
- value: org.egov.tracer.kafka.serializer.ISTTimeZoneJsonSerializer
- {{- end }}
- - name: JAVA_OPTS
- value: {{ index .Values "heap" | quote }}
- - name: JAVA_ARGS
- value: {{ index .Values "java-args" | quote }}
- - name: SERVER_PORT
- value: "8080"
- - name: EGOV_MDMS_CONF_PATH
- value: {{ index .Values "mdms-path" | quote }}
- - name: EGOV_MDMS_GIT_URL
- value: {{ index .Values "mdms-git-url" | quote }}
- - name: EGOV_MDMS_FOLDER
- value: {{ index .Values "mdms-folder" | quote }}
- - name: MASTERS_CONFIG_URL
- value: {{ index .Values "masters-config-url" | quote }}
- {{- if index .Values "branch" }}
- - name: BRANCH
- value: {{ index .Values "branch" | quote }}
- {{- end }}
- - name: SECURITY_BASIC_ENABLED
- value: "false"
- - name: MANAGEMENT_SECURITY_ENABLED
- value: "false"
diff --git a/devops/deploy-as-code/charts/core-services/egov-otp/values.yaml b/devops/deploy-as-code/charts/core-services/egov-otp/values.yaml
index 474278c85..9a6092a00 100644
--- a/devops/deploy-as-code/charts/core-services/egov-otp/values.yaml
+++ b/devops/deploy-as-code/charts/core-services/egov-otp/values.yaml
@@ -41,3 +41,8 @@ env: |
value: "false"
- name: MANAGEMENT_SECURITY_ENABLED
value: "false"
+ - name: SPRING_DATASOURCE_URL
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: db-url
diff --git a/devops/deploy-as-code/charts/core-services/egov-pg-service/Chart.lock b/devops/deploy-as-code/charts/core-services/egov-pg-service/Chart.lock
deleted file mode 100644
index 3cd8e8985..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-pg-service/Chart.lock
+++ /dev/null
@@ -1,6 +0,0 @@
-dependencies:
-- name: common
- repository: file://../../common
- version: 0.0.5
-digest: sha256:5ecdd1fdad744b1a0d5873f42283e09223272e4c8717a0679c27d8e215bdbc85
-generated: "2025-07-04T18:00:20.946254561+05:30"
diff --git a/devops/deploy-as-code/charts/core-services/egov-pg-service/Chart.yaml b/devops/deploy-as-code/charts/core-services/egov-pg-service/Chart.yaml
deleted file mode 100644
index fd4c9c284..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-pg-service/Chart.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: v2
-name: egov-pg-service
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
-type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application.
-appVersion: 1.16.0
-
-dependencies:
-- name: common
- version: 0.0.5
- repository: file://../../common
diff --git a/devops/deploy-as-code/charts/core-services/egov-pg-service/charts/common-0.0.5.tgz b/devops/deploy-as-code/charts/core-services/egov-pg-service/charts/common-0.0.5.tgz
deleted file mode 100644
index cc6e11fbb..000000000
Binary files a/devops/deploy-as-code/charts/core-services/egov-pg-service/charts/common-0.0.5.tgz and /dev/null differ
diff --git a/devops/deploy-as-code/charts/core-services/egov-pg-service/templates/deployment.yaml b/devops/deploy-as-code/charts/core-services/egov-pg-service/templates/deployment.yaml
deleted file mode 100644
index 3455c0005..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-pg-service/templates/deployment.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-# deployment.yaml
-{{- template "common.deployment" . -}}
\ No newline at end of file
diff --git a/devops/deploy-as-code/charts/core-services/egov-pg-service/templates/ingress.yaml b/devops/deploy-as-code/charts/core-services/egov-pg-service/templates/ingress.yaml
deleted file mode 100644
index 9a573c0d7..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-pg-service/templates/ingress.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-# ingress.yaml
-{{- template "common.ingress" . -}}
\ No newline at end of file
diff --git a/devops/deploy-as-code/charts/core-services/egov-pg-service/templates/service.yaml b/devops/deploy-as-code/charts/core-services/egov-pg-service/templates/service.yaml
deleted file mode 100644
index 735644576..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-pg-service/templates/service.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-# service.yaml
-{{- template "common.service" . -}}
\ No newline at end of file
diff --git a/devops/deploy-as-code/charts/core-services/egov-pg-service/values.yaml b/devops/deploy-as-code/charts/core-services/egov-pg-service/values.yaml
deleted file mode 100644
index b863efb5c..000000000
--- a/devops/deploy-as-code/charts/core-services/egov-pg-service/values.yaml
+++ /dev/null
@@ -1,196 +0,0 @@
-# Common Labels
-labels:
- app: "egov-pg-service"
- group: "core"
-
-# Ingress Configs
-ingress:
- enabled: true
- zuul: true
- context: "pg-service"
-
-# Init Containers Configs
-initContainers:
- dbMigration:
- enabled: true
- schemaTable: "egov_pg_service_schema"
- image:
- repository: "egov-pg-service-db"
- tag: v2.9.2-4a60f20
-
-# Container Configs
-image:
- repository: "egov-pg-service"
- tag: v2.9.2-4a60f20
-replicas: "1"
-healthChecks:
- enabled: true
- livenessProbePath: "/pg-service/health"
- readinessProbePath: "/pg-service/health"
-appType: "java-spring"
-tracing-enabled: true
-axis: true
-payu-url: ""
-payu-url-status: ""
-ccavenue-status-access-code: ""
-ccavenue-redirect-access-code: ""
-ccavenue-url: ""
-ccavenue-url-status: ""
-ccavenue-url-redirect: ""
-ccavenue-url-cancel: ""
-memory_limits: "512Mi"
-heap: "-Xmx256m -Xms256m"
-java-args: "-Dspring.profiles.active=monitoring"
-java-debug: "true"
-
-# Additional Container Envs
-env: |
- - name: SPRING_KAFKA_CONSUMER_GROUP_ID
- value: egov-pg-service
- - name: SPRING_KAFKA_PRODUCER_KEY_SERIALIZER
- value: org.apache.kafka.common.serialization.StringSerializer
- - name: SPRING_KAFKA_PRODUCER_VALUE_SERIALIZER
- value: org.springframework.kafka.support.serializer.JsonSerializer
- - name: EGOV_IDGEN_HOST
- valueFrom:
- configMapKeyRef:
- name: egov-service-host
- key: egov-idgen
- - name: EGOV_MDMS_HOST
- valueFrom:
- configMapKeyRef:
- name: egov-service-host
- key: egov-mdms-service
- - name: EGOV_BILLINGSERVICE_HOST
- valueFrom:
- configMapKeyRef:
- name: egov-service-host
- key: billing-service
- - name: EGOV_COLLECTIONSERVICE_HOST
- valueFrom:
- configMapKeyRef:
- name: egov-service-host
- key: collection-services
- - name: NOTIFICATION_URL
- valueFrom:
- configMapKeyRef:
- name: egov-config
- key: egov-services-fqdn-name
- - name: EGOV_BANKACCOUNTSERVICE_HOST
- valueFrom:
- configMapKeyRef:
- name: egov-service-host
- key: egf-master
- - name: EGOV_BUSINESSDETAILSSERVICE_HOST
- valueFrom:
- configMapKeyRef:
- name: egov-service-host
- key: egov-common-masters
- {{- if .Values.axis }}
- - name: AXIS_ACTIVE
- value: "true"
- - name: AXIS_CURRENCY
- value: "INR"
- - name: AXIS_MERCHANT_VPC_VERSION
- value: "1"
- - name: AXIS_MERCHANT_VPC_COMMAND_PAY
- value: "pay"
- - name: AXIS_MERCHANT_VPC_COMMAND_STATUS
- value: "queryDR"
- - name: AXIS_LOCALE
- value: "en_IN"
- - name: AXIS_URL_DEBIT
- value: "https://migs.mastercard.co.in/vpcpay"
- - name: AXIS_URL_STATUS
- value: "https://migs.mastercard.co.in/vpcdps"
- - name: AXIS_MERCHANT_ID
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: axismerchantid
- - name: AXIS_MERCHANT_SECRET_KEY
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: axismerchantsecret
- - name: AXIS_MERCHANT_USER
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: axismerchantuser
- - name: AXIS_MERCHANT_PWD
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: axismerchantpwd
- - name: AXIS_MERCHANT_ACCESS_CODE
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: axismerchantaccesscode
- {{- end }}
- {{- if index .Values "payu-url" }}
- - name: PAYU_ACTIVE
- value: "true"
- - name: PAYU_URL
- value: {{ index .Values "payu-url" | quote }}
- - name: PAYU_URL_STATUS
- value: {{ index .Values "payu-url-status" | quote }}
- - name: PAYU_MERCHANT_KEY
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: payumerchantkey
- - name: PAYU_MERCHANT_SALT
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: payumerchantsalt
- {{- end }}
- {{- if .Values.ccavenue }}
- - name: CCAVENUE_ACTIVE
- value: "true"
- - name: CCAVENUE_MERCHANT_ID
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: ccavenue-merchant-id
- - name: CCAVENUE_STATUS_WORKING_KEY
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: ccavenue-status-working-key
- - name: CCAVENUE_REDIRECT_WORKING_KEY
- valueFrom:
- secretKeyRef:
- name: egov-pg-service
- key: ccavenue-redirect-working-key
- - name: CCAVENUE_STATUS_ACCESS_CODE
- value: {{ index .Values "ccavenue-status-access-code" | quote }}
- - name: CCAVENUE_REDIRECT_ACCESS_CODE
- value: {{ index .Values "ccavenue-redirect-access-code" | quote }}
- - name: CCAVENUE_GATEWAY_URL
- value: {{ index .Values "ccavenue-url" | quote }}
- - name: CCAVENUE_GATEWAY_STATUS_URL
- value: {{ index .Values "ccavenue-url-status" | quote }}
- - name: CCAVENUE_REDIRECT_URL
- value: {{ index .Values "ccavenue-url-redirect" | quote }}
- - name: CCAVENUE_CANCEL_URL
- value: {{ index .Values "ccavenue-url-cancel" | quote }}
- {{- end }}
- - name: JAVA_OPTS
- value: {{ index .Values "heap" | quote }}
- - name: JAVA_ARGS
- value: {{ index .Values "java-args" | quote }}
- - name: JAVA_ENABLE_DEBUG
- value: {{ index .Values "java-debug" | quote }}
- - name: SERVER_PORT
- value: "8080"
- - name: SECURITY_BASIC_ENABLED
- value: "false"
- - name: MANAGEMENT_SECURITY_ENABLED
- value: "false"
- {{- if index .Values "tracing-enabled" }}
- - name: TRACER_OPENTRACING_ENABLED
- value: "true"
- {{- end }}
diff --git a/devops/deploy-as-code/charts/core-services/egov-user/values.yaml b/devops/deploy-as-code/charts/core-services/egov-user/values.yaml
index 65bf74f06..b807be923 100644
--- a/devops/deploy-as-code/charts/core-services/egov-user/values.yaml
+++ b/devops/deploy-as-code/charts/core-services/egov-user/values.yaml
@@ -81,6 +81,11 @@ env: |
configMapKeyRef:
name: egov-service-host
key: egov-mdms-service
+ - name: EGOV_MDMS_V2_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-service-host
+ key: egov-mdms-service
- name: EGOV_ENC_HOST
valueFrom:
configMapKeyRef:
@@ -96,6 +101,11 @@ env: |
configMapKeyRef:
name: egov-config
key: egov-state-level-tenant-id
+ - name: SPRING_DATASOURCE_URL
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: db-url
- name: DECRYPTION_ABAC_ENABLED
value: {{ index .Values "decryption-abac-enabled" | quote }}
- name: KAFKA_TOPIC_AUDIT
diff --git a/devops/deploy-as-code/charts/core-services/user-otp/values.yaml b/devops/deploy-as-code/charts/core-services/user-otp/values.yaml
index 81a5fc69a..4e49f3646 100644
--- a/devops/deploy-as-code/charts/core-services/user-otp/values.yaml
+++ b/devops/deploy-as-code/charts/core-services/user-otp/values.yaml
@@ -45,7 +45,17 @@ env: |
valueFrom:
configMapKeyRef:
name: egov-service-host
- key: egov-localization
+ key: egov-localization
+ - name: EGOV_MDMS_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-service-host
+ key: egov-mdms-service
+ - name: EGOV_MDMS_SEARCH_ENDPOINT
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: egov-mdms-search-endpoint
- name: SMS_TOPIC
value: egov.core.notification.sms
- name: JAVA_OPTS
diff --git a/devops/deploy-as-code/charts/environments/env-secrets.yaml b/devops/deploy-as-code/charts/environments/env-secrets.yaml
index 6965b0954..074725323 100644
--- a/devops/deploy-as-code/charts/environments/env-secrets.yaml
+++ b/devops/deploy-as-code/charts/environments/env-secrets.yaml
@@ -22,6 +22,13 @@ secrets:
egov-notification-sms:
username: demo
password: demo
+ # HRMS service default employee password
+ egov-hrms:
+ employee-default-password: eGov@123
+ # To work Filestore service add the IAM user details which has access on the filestore s3 bucket.
+ egov-filestore:
+ aws-key: AKIAVCXXXXXXXXXXXXXX
+ aws-secret-key: JLc9M5bYiK/QghQ4LvnstLJ1xxxxxxxxxxxxx
# To work pg service add your respective bank details
egov-pg-service:
axis_merchant_accesscode: demo
@@ -55,6 +62,9 @@ secrets:
clusterID: HshRPdVrWoB4kuTdEbawtq
elasticsearch:
password: 8fwbD6HbJh6HU0oddsHm8TEI
+ minio:
+ username: root
+ password: minio@123
# To work oauth2-proxy service, create and add your github OAuth Apps details
oauth2-proxy:
cookieSecret: qwgethjymnbv
diff --git a/devops/deploy-as-code/charts/environments/env.yaml b/devops/deploy-as-code/charts/environments/env.yaml
index 237c87281..0f5537503 100644
--- a/devops/deploy-as-code/charts/environments/env.yaml
+++ b/devops/deploy-as-code/charts/environments/env.yaml
@@ -19,7 +19,11 @@ configmaps:
egov-state-level-tenant-id: ###### Replace with your own tenant ID if you are not using the default tenant ID (pg)
state-level-tenant-id: ###### Replace with your own tenant ID if you are not using the default tenant ID (pg)
host-map: "{'':'https:///'}" # update state tenant-id & domain
-
+
+ ### make it false in production
+ dev-enabled: "true"
+ egov-mdms-search-endpoint: /mdms-v2/v1/_search
+
egov-service-host:
data:
internal-gateway-scg: "http://internal-gateway-scg.egov:8080/"
@@ -42,7 +46,7 @@ configmaps:
location: "http://location.egov:8080/"
pdf-service: "http://pdf-service.egov:8080/"
user-otp: "http://user-otp.egov:8080/"
- minio-url: "https://minio-multiinstance.digit.org/"
+ minio-url: "http://minio-svc.backbone:9000/"
egov-url-shortening: "http://egov-url-shortening.egov:8080/"
inbox: "http://inbox.egov:8080/"
mdms-service-v2: "http://mdms-v2.egov:8080/"
@@ -65,10 +69,9 @@ egov-filestore:
memory_limits: 728Mi
volume: /opt/eGov/filestore
is-bucket-fixed: "true"
- minio.url : "http://minio.backbone:9000/"
is-s3-enabled: "true"
minio-enabled: false
- fixed-bucketname: ### Update your bucket name
+ fixed-bucketname: ## Update your bucket name
allowed-file-formats-map: "{jpg:{'image/jpg','image/jpeg'},jpeg:{'image/jpeg','image/jpg'},png:{'image/png'},pdf:{'application/pdf'},odt:{'application/vnd.oasis.opendocument.text'},ods:{'application/vnd.oasis.opendocument.spreadsheet'},docx:{'application/x-tika-msoffice','application/x-tika-ooxml','application/vnd.oasis.opendocument.text','application/msword'},doc:{'application/x-tika-msoffice','application/x-tika-ooxml','application/vnd.oasis.opendocument.text','application/msword'},dxf:{'text/plain','application/dxf','application/octet-stream','image/vnd.dxf','image/vnd.dxf; format=ascii','image/vnd.dxf; format=binary','image/vnd.dxb'},csv:{'text/plain'},txt:{'text/plain'},xlsx:{'application/x-tika-ooxml','application/x-tika-msoffice','application/vnd.ms-excel','application/vnd.openxmlformats-officedocument.spreadsheetml.sheet','application/zip'},xls:{'application/x-tika-ooxml','application/x-tika-msoffice','application/vnd.ms-excel','multipart/form-data'},zip:{'application/zip','application/octet-stream'},geojson:{'application/json','text/plain','application/geo+json','multipart/form-data'},json:{'application/json','text/plain'}}"
allowed-file-formats: "jpg,jpeg,png,doc,docx,pdf,odt,ods,text,dxf,xls,xlsx,json"
@@ -89,6 +92,7 @@ egov-notification-sms:
sms-destination-mobile-req-param-name: "mobilenumber"
sms-message-req-param-name: "message"
sms-error-codes: "401,403,404,405,406,407,408,409,410,411,412,413,414"
+ sms.mobile.prefix: "+91"
egov-user:
replicas: 1
@@ -196,7 +200,7 @@ gateway:
server-tomcat-max-connections: "1500"
#egov-statelevel-tenant-map: "{'kenya-demo.digit.org':'ke','unified-demo.digit.org':'pg','central-instance.digit.org':'in'}"
egov-encrypted-endpoints-list: "/user/oauth/token,/employee/user/login,/filestore/v1/files"
- egov-open-endpoints-whitelist: "/user/oauth/token,/user-otp/v1/_send,/otp/v1/_validate,/user/citizen/_create,/localization/messages,/localization/messages/v1/_search,/user/password/nologin/_update,/pgr/servicedefinition/v1/_search,/pgr/servicecategories/v1/_search,/pgr/v1/otp/_send,/pgr-master/receivingmode/v1/_search,/tenant/v1/tenant/_search,/egov-location/boundarys,/egov-location/boundarys/boundariesByBndryTypeNameAndHierarchyTypeName,/pgr-master/service/v1/_search,/egov-location/boundarys/getLocationByLocationName,/pgr-master/OTPConfig/_search,/pgr-master/serviceGroup/v1/_search,/egov-location/boundarys/isshapefileexist,/pgr/services/v1/_search,/hr-masters/hrconfigurations/_search,/collection-services/receipts/_view,/pgr-master/service/v2/_search,/pgr-master/servicedefinition/v1/_search,/citizen-services,/citizen-services/v1/requests/receipt/_create,/citizen-services/v1/pgresponse,/citizen-services/v1/requests/anonymous/_search,/egov-mdms-service/v1/_search,/egov-mdms-service/v1/_get,/egov-mdms-service/v1/_reload,/egov-mdms-service/v1/_reloadobj,/egov-location/boundarys/getshapefile,/egov-indexer/index-operations/_index,/egov-indexer/index-operations/_reload,/egov-mdms-service-test/v1/_search,/egov-mdms-create/v1/_update,/egov-mdms-create/v1/_create,/egov-mdms-service-test/v1/_reload,/filestore/v1/files/url,/egov-url-shortening,/whatsapp-webhook/messages,/edcr/rest/dcr/downloadfile,/mdms-v2/schema/v1/_search,/mdms-v2/v2/_search,/mdms-v2/v1/_search,/trackingservice/api/v3/trip/_search,/trackingservice/api/v3/trip/_create,/trackingservice/api/v3/trip/_alerts,/trackingservice/api/v3/trip/_progress/_search,/trackingservice/api/v3/trip/_progress,/trackingservice/api/v3/trip/_searchfsm,/trackingservice/api/v3/trip/_update,/trackingservice/api/v3/trip/_progress/_update,/trackingservice/api/v3/route/_create,/trackingservice/api/v3/route/_search,/trackingservice/api/v3/route/_update,/trackingservice/api/v3/poi/_create,/trackingservice/api/v3/poi/_search,/trackingservice/api/v3/poi/_inactivate,/trackingservice/api/v3/poi/_searchNearby,/trackingservice/api/v3/poi/_updateLocation,/trackingservice/api/v3/config/_alerts,/trackingservice/api/v3/config/_services,/dashboard-analytics/dashboard/getChartV2,/dashboard-analytics/dashboard/getDashboardConfig/propertytax,dashboard-analytics/dashboard/getDashboardConfig/tradelicense,/dashboard-analytics/dashboard/getDashboardConfig/ws,/dashboard-analytics/dashboard/getDashboardConfig/overview,/dashboard-analytics/dashboard/getDashboardConfig/mCollect,/dashboard-analytics/dashboard/getDashboardConfig/noc,/dashboard-analytics/dashboard/getDashboardConfig/obps,/dashboard-analytics/dashboard/getDashboardConfig/birth-death,/dashboard-analytics/dashboard/getDashboardConfig/finance,/dashboard-analytics/dashboard/getDashboardConfig/fsm,/dashboard-analytics/dashboard/getDashboardConfig/home,/dashboard-analytics/dashboard/getDashboardConfig/pqm"
+ egov-open-endpoints-whitelist: "/user/oauth/token,/user-otp/v1/_send,/otp/v1/_validate,/user/citizen/_create,/localization/messages,/localization/messages/v1/_search,/user/password/nologin/_update,/pgr/servicedefinition/v1/_search,/pgr/servicecategories/v1/_search,/pgr/v1/otp/_send,/pgr-master/receivingmode/v1/_search,/tenant/v1/tenant/_search,/egov-location/boundarys,/egov-location/boundarys/boundariesByBndryTypeNameAndHierarchyTypeName,/pgr-master/service/v1/_search,/egov-location/boundarys/getLocationByLocationName,/pgr-master/OTPConfig/_search,/pgr-master/serviceGroup/v1/_search,/egov-location/boundarys/isshapefileexist,/pgr/services/v1/_search,/hr-masters/hrconfigurations/_search,/collection-services/receipts/_view,/pgr-master/service/v2/_search,/pgr-master/servicedefinition/v1/_search,/citizen-services,/citizen-services/v1/requests/receipt/_create,/citizen-services/v1/pgresponse,/citizen-services/v1/requests/anonymous/_search,/egov-mdms-service/v1/_search,/egov-mdms-service/v1/_get,/egov-mdms-service/v1/_reload,/egov-mdms-service/v1/_reloadobj,/egov-location/boundarys/getshapefile,/egov-indexer/index-operations/_index,/egov-indexer/index-operations/_reload,/egov-mdms-service-test/v1/_search,/egov-mdms-create/v1/_update,/egov-mdms-create/v1/_create,/egov-mdms-service-test/v1/_reload,/filestore/v1/files/url,/egov-url-shortening,/whatsapp-webhook/messages,/edcr/rest/dcr/downloadfile,/mdms-v2/schema/v1/_search,/mdms-v2/v2/_search,/mdms-v2/v1/_search,/dashboard-analytics/dashboard/getChartV2,/dashboard-analytics/dashboard/getDashboardConfig/overview,/filestore/v1/file,/default-data-handler/tenant/new"
egov-mixed-mode-endpoints-whitelist: "/pgr/seva/v1/_create,/pgr/seva/v1/_search,/pgr/seva/v1/_count,/workflow/history/v1/_search,/filestore/v1/files/id,/filestore/v1/files,/filestore/v1/files/tag,/egov-common-masters/departments/_search,/pt-property/property/propertytypes/_search,/pt-property/properties/_search,/pt-property/property/usages/_search,/egov-idgen/id/_generate,/egf-masters/financialyears/_search,/egov-common-workflows/process/_start,/egov-common-workflows/process/_search,/egov-common-workflows/tasks,/egov-common-workflows/tasks/{id}/_update,/user/_search,/billing-service/demand/_dues,/billing-service/bill/_generate,/billing-service/demand/_create,/wcms/masters/waterchargesconfig/_search,/wcms/masters/usagetypes/_search,/wcms/masters/pipesizes/_search,/wcms-connection/connection/_getbillingtypes,/wcms-connection/connection/_getconnectiontypes,/wcms/masters/sourcetypes/_search,/wcms/masters/supplytypes/_search,/wcms/masters/storagereservoirs/_search,/wcms/masters/treatmentplants/_search,/wcms/masters/documenttypes-applicationtypes/_search,/wcms/masters/donations/_search,/wcms/masters/nonmeterwaterrates/_search,/wcms-connection/connection/_create,/egov-common-masters/genders/_search,/egov-common-workflows/designations/_search,/access/v1/actions/mdms/_get,/tl-services/v1/BPAREG/_create,/tl-services/v1/BPAREG/_update,/tl-calculator/v1/BPAREG/_getbill,/property-services/property/_search,/billing-service/bill/v2/_search,/egov-location/location/v11/boundarys/_search,/pg-service/transaction/v1/_create,/collection-services/payments/_search,/pdf-service/v1/_create,/billing-service/bill/v2/_fetchbill,/pg-service/transaction/v1/_update,/ws-services/wc/_search,/sw-services/swc/_search,/edcr/rest/dcr/scrutinydetails,/edcr/rest/dcr/occomparison"
# <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
@@ -227,6 +231,12 @@ egov-hrms:
heap: "-Xmx192m -Xms192m"
memory_limits: 386Mi
+default-data-handler:
+ java-args: -Dspring.profiles.active=monitoring
+ heap: "-Xmx192m -Xms192m"
+ memory_limits: 386Mi
+ ### make it false in production
+ dev-enabled: "true"
boundary-service:
replicas: 1
@@ -360,3 +370,11 @@ loki:
retention_deletes_enabled: true
retention_period: 72h # 3 days
# <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
+
+### minio >>>>>>>>>>>>>>>>>>>>
+minio:
+ persistence:
+ storageClass:
+ accessMode: ReadWriteOnce
+ size: 20Gi
+# <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
diff --git a/devops/deploy-as-code/charts/urban/default-data-handler/values.yaml b/devops/deploy-as-code/charts/urban/default-data-handler/values.yaml
index 6af383204..6766268c2 100644
--- a/devops/deploy-as-code/charts/urban/default-data-handler/values.yaml
+++ b/devops/deploy-as-code/charts/urban/default-data-handler/values.yaml
@@ -29,7 +29,7 @@ initContainers:
# Container Configs
image:
repository: "default-data-handler"
- tag: develop-87e7d70-27
+ tag: v0.0.1-3ef6b5f-34
replicas: "1"
healthChecks:
enabled: true
@@ -125,6 +125,8 @@ env: |
value: {{ index .Values "default-localization-locale-list" | quote }}
- name: DEFAULT_LOCALIZATION_MODULE_CREATE_LIST
value: {{ index .Values "default-localization-module-list" | quote }}
+ - name: DEV_ENABLED
+ value: {{ index .Values "dev-enabled" | quote }}
- name: JAVA_OPTS
value: {{ index .Values "heap" | quote }}
- name: JAVA_ARGS
diff --git a/devops/deploy-as-code/charts/urban/digit-ui/values.yaml b/devops/deploy-as-code/charts/urban/digit-ui/values.yaml
index 042293745..0f9307796 100644
--- a/devops/deploy-as-code/charts/urban/digit-ui/values.yaml
+++ b/devops/deploy-as-code/charts/urban/digit-ui/values.yaml
@@ -14,7 +14,7 @@ initContainers: {}
# Container Configs
image:
repository: "digit-ui"
- tag: "PGR_JULY_21-d0c152d-46"
+ tag: "v0.0.1-e3046cc-87"
replicas: "1"
httpPort: 80
healthChecks:
diff --git a/devops/deploy-as-code/charts/core-services/egov-location/Chart.yaml b/devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/Chart.yaml
similarity index 94%
rename from devops/deploy-as-code/charts/core-services/egov-location/Chart.yaml
rename to devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/Chart.yaml
index 8f00c9c19..0741f7fed 100644
--- a/devops/deploy-as-code/charts/core-services/egov-location/Chart.yaml
+++ b/devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/Chart.yaml
@@ -1,5 +1,5 @@
-apiVersion: v2
-name: egov-location
+apiVersion: v1
+name: egov-bndry-mgmnt
description: A Helm chart for Kubernetes
# A chart can be either an 'application' or a 'library' chart.
@@ -18,7 +18,7 @@ version: 0.1.0
# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application.
-appVersion: 1.16.0
+appVersion: 1.0.0
dependencies:
- name: common
diff --git a/devops/deploy-as-code/charts/core-services/egov-location/templates/deployment.yaml b/devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/templates/deployment.yaml
similarity index 100%
rename from devops/deploy-as-code/charts/core-services/egov-location/templates/deployment.yaml
rename to devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/templates/deployment.yaml
diff --git a/devops/deploy-as-code/charts/core-services/egov-location/templates/ingress.yaml b/devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/templates/ingress.yaml
similarity index 100%
rename from devops/deploy-as-code/charts/core-services/egov-location/templates/ingress.yaml
rename to devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/templates/ingress.yaml
diff --git a/devops/deploy-as-code/charts/core-services/egov-location/templates/service.yaml b/devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/templates/service.yaml
similarity index 100%
rename from devops/deploy-as-code/charts/core-services/egov-location/templates/service.yaml
rename to devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/templates/service.yaml
diff --git a/devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/values.yaml b/devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/values.yaml
new file mode 100644
index 000000000..63b91e975
--- /dev/null
+++ b/devops/deploy-as-code/charts/urban/egov-bndry-mgmnt/values.yaml
@@ -0,0 +1,183 @@
+# Common Labels
+labels:
+ app: "egov-bndry-mgmnt"
+ group: "rainmaker"
+
+namespace: urban
+
+# Ingress Configs
+ingress:
+ namespace: egov
+ enabled: true
+ zuul: true
+ context: "egov-bndry-mgmnt"
+ additionalAnnotations: |
+ nginx.ingress.kubernetes.io/proxy-body-size: "20m"
+
+# Init Containers Configs
+initContainers:
+ dbMigration:
+ enabled: true
+ schemaTable: "egov-bndry-mgmnt_schema"
+ image:
+ repository: "egov-bndry-mgmnt-db"
+
+# Container Configs
+image:
+ repository: "egov-bndry-mgmnt"
+replicas: "1"
+appType: "java-spring"
+tracing-enabled: true
+heap: '-Xmx1000m -Xms756m'
+memory_limits: '1Gi'
+cpu_limits: '756m'
+
+# Additional Container Envs
+env: |
+ - name: KAFKA_BROKER_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: kafka-brokers
+ - name: KAFKA_CREATE_PROCESSED_BOUNDARY_MANAGEMENT_TOPIC
+ value: create-processed-boundary-management-urban
+ - name: KAFKA_UPDATE_PROCESSED_BOUNDARY_MANAGEMENT_TOPIC
+ value: update-processed-boundary-management-urban
+ - name: KAFKA_UPDATE_GENERATED_BOUNDARY_MANAGEMENT_TOPIC
+ value: update-generated-boundary-management-urban
+ - name: KAFKA_CREATE_GENERATED_BOUNDARY_MANAGEMENT_TOPIC
+ value: create-generated-boundary-management-urban
+ - name: EGOV_MDMS_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-service-host
+ key: egov-mdms-service
+ - name: EGOV_MDMS_V2_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-service-host
+ key: mdms-service-v2
+ - name: EGOV_FILESTORE_SERVICE_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-service-host
+ key: egov-filestore
+ - name: EGOV_BOUNDARY_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-service-host
+ key: boundary-service
+ - name: EGOV_LOCALIZATION_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-service-host
+ key: egov-localization
+ - name: CONTEXT_PATH
+ value: "/egov-bndry-mgmnt"
+ - name: FILE_STORE_SERVICE_END_POINT
+ value: filestore/v1/files
+ - name: EGOV_MDMS_V2_SEARCH_ENDPOINT
+ value: {{ .Values.mdmsV2SearchEndpoint | default "egov-mdms-service/v2/_search" }}
+ - name: EGOV_MDMS_V2_CREATE_ENDPOINT
+ value: {{ .Values.mdmsV2CreateEndpoint | default "egov-mdms-service/v2/_create" }}
+ - name: EGOV_MDMS_V2_UPDATE_ENDPOINT
+ value: {{ .Values.mdmsV2UpdateEndpoint | default "egov-mdms-service/v2/_update" }}
+ - name: EGOV_MDMS_V1_SEARCH_ENDPOINT
+ value: {{ .Values.mdmsV1SearchEndpoint | default "egov-mdms-service/v1/_search" }}
+ - name: EGOV_MDMS_SCHEMA_PATH
+ value: {{ .Values.mdmsV1SchemaSearchEndpoint | default "egov-mdms-service/schema/v1/_search" }}
+ - name: EGOV_BOUNDARY_RELATIONSHIP_SEARCHPATH
+ value: boundary-service/boundary-relationships/_search
+ - name: EGOV_BOUNDARY_SERVICE_SEARCHPATH
+ value: boundary-service/boundary/_search
+ - name: EGOV_BOUNDARY_HIERARCHY_SEARCHPATH
+ value: boundary-service/boundary-hierarchy-definition/_search
+ - name: EGOV_BOUNDARY_ENTITY_SEARCHPATH
+ value: boundary-service/boundary/_search
+ - name: EGOV_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: egov-services-fqdn-name
+ - name: "DB_URL"
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: db-url
+ - name: "SCHEMA_TABLE"
+ value: {{ .Values.initContainers.dbMigration.schemaTable | quote }}
+ - name: "FLYWAY_USER"
+ valueFrom:
+ secretKeyRef:
+ name: db
+ key: flyway-username
+ - name: "FLYWAY_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: db
+ key: flyway-password
+ - name: "FLYWAY_LOCATIONS"
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: flyway-locations
+ - name: DB_HOST
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: db-host
+ - name: DB_NAME
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: db-name
+ - name: DB_USER
+ valueFrom:
+ secretKeyRef:
+ name: db
+ key: username
+ - name: DB_PASSWORD
+ valueFrom:
+ secretKeyRef:
+ name: db
+ key: password
+ - name: DB_PORT
+ value: "5432"
+ - name: SPLIT_BOUNDARIES_ON_LENGTH
+ value: "2"
+ - name: BOUNDARY_TAB_NAME
+ value: "CRS_BOUNDARY_DATA"
+ - name: LOCALE
+ value: {{ .Values.defaultLocale | default "en_IN" }}
+ - name: LOCALIZATION_MODULE
+ value: "crs-admin-schemas"
+ - name: LOCALIZATION_WAIT_TIME_IN_BOUNDARY_CREATION
+ value: "30000"
+ - name: LOCALIZATION_CHUNK_SIZE_FOR_BOUNDARY_CREATION
+ value: "2000"
+ - name: APP_LOG_LEVEL
+ value: {{ .Values.logLevel | default "info" }}
+ - name: APP_MAX_DEBUG_CHAR
+ value: "{{ .Values.maxDebugChar | default "500" }}"
+ - name: DEBUG
+ value: "{{ .Values.DEBUG | default "false" }}"
+ - name: DEFAULT_TENANT_ID
+ value: {{ .Values.defaultTenantId | default "mz" }}
+
+
+ - name: CACHE_ENABLED
+ value: "true"
+ - name: RESET_CACHE
+ value: "true"
+ - name: REDIS_PORT
+ value: "6379"
+ - name: REDIS_HOST
+ value: "redis.backbone"
+ - name: AUTO_RETRY_IF_HTTP_ERROR
+ value: "socket hang up"
+ - name: EXCLUDE_HIERARCHY_TYPE_FROM_BOUNDARY_CODES
+ value: {{ .Values.ExcludeHierarchyTypeFromBoundaryCodes | default "false" | quote }}
+ - name: EXCLUDE_BOUNDARY_NAME_AT_LAST_FROM_BOUNDARY_CODES
+ value: {{ .Values.ExcludeBoundaryTypeFromLastBoundaryCodes | default "false" | quote }}
+ - name: VALIDATE_CAMPAIGN_ID_IN_METADATA
+ value: {{ .Values.validateCampaignIdInMetadata | default "false" | quote }}
diff --git a/devops/deploy-as-code/charts/urban/pgr-services/values.yaml b/devops/deploy-as-code/charts/urban/pgr-services/values.yaml
index a8336a913..d29718705 100644
--- a/devops/deploy-as-code/charts/urban/pgr-services/values.yaml
+++ b/devops/deploy-as-code/charts/urban/pgr-services/values.yaml
@@ -17,7 +17,7 @@ initContainers:
schemaTable: "pgr_services_schema"
image:
repository: "pgr-services-db"
- tag: "develop-de5dc8c-3"
+ tag: "v2.9.0-8b3aa24-4"
env: |
{{- if index .Values "pgr-ismultischema-enabled" }}
- name: SCHEMA_NAME
@@ -49,7 +49,7 @@ initContainers:
# Container Configs
image:
repository: "pgr-services"
- tag: "develop-de5dc8c-3"
+ tag: "v2.9.0-8b3aa24-4"
replicas: "1"
healthChecks:
enabled: true
@@ -184,6 +184,11 @@ env: |
configMapKeyRef:
name: egov-config
key: egov-state-level-tenant-id
+ - name: SPRING_DATASOURCE_URL
+ valueFrom:
+ configMapKeyRef:
+ name: egov-config
+ key: db-url
{{- if index .Values "tracing-enabled" }}
- name: TRACER_OPENTRACING_ENABLED
value: "true"
diff --git a/devops/deploy-as-code/charts/urban/urban-helmfile.yaml b/devops/deploy-as-code/charts/urban/urban-helmfile.yaml
index 0bc5668ae..50865c18a 100644
--- a/devops/deploy-as-code/charts/urban/urban-helmfile.yaml
+++ b/devops/deploy-as-code/charts/urban/urban-helmfile.yaml
@@ -31,4 +31,7 @@ releases:
installed: true
<<: *default
+ - name: egov-bndry-mgmnt # Replace with your desired namespace
+ installed: true
+ <<: *default
# Frontend services end
\ No newline at end of file
diff --git a/devops/infra-as-code/terraform/sample-aws/main.tf b/devops/infra-as-code/terraform/sample-aws/main.tf
index 82b423090..a11e0cb22 100644
--- a/devops/infra-as-code/terraform/sample-aws/main.tf
+++ b/devops/infra-as-code/terraform/sample-aws/main.tf
@@ -13,6 +13,10 @@ terraform {
source = "gavinbunney/kubectl"
version = "~> 1.14.0"
}
+ kubernetes = {
+ source = "hashicorp/kubernetes"
+ version = "2.37.1"
+ }
}
}
@@ -194,8 +198,8 @@ module "db" {
subnet_ids = "${module.network.private_subnets}"
vpc_security_group_ids = ["${module.network.rds_db_sg_id}"]
availability_zone = "${element(var.availability_zones, 0)}"
- instance_class = "db.t4g.medium" ## postgres db instance type
- engine_version = "15.8" ## postgres version
+ instance_class = "${var.db_instance_type}"
+ engine_version = "${var.db_version}"
storage_type = "gp3"
storage_gb = "20" ## postgres disk size
backup_retention_days = "7"
@@ -276,7 +280,7 @@ module "eks_managed_node_group" {
max_size = var.max_worker_nodes
desired_size = var.desired_worker_nodes
instance_types = var.instance_types
- capacity_type = "SPOT"
+ capacity_type = "${var.instance_reservation}"
ebs_optimized = "true"
enable_monitoring = "true"
iam_role_additional_policies = {
@@ -320,12 +324,14 @@ resource "aws_eks_addon" "kube_proxy" {
addon_name = "kube-proxy"
resolve_conflicts_on_create = "OVERWRITE"
}
+
resource "aws_eks_addon" "core_dns" {
depends_on = [module.eks_managed_node_group]
cluster_name = var.cluster_name
addon_name = "coredns"
resolve_conflicts_on_create = "OVERWRITE"
}
+
resource "aws_eks_addon" "aws_ebs_csi_driver" {
depends_on = [module.eks_managed_node_group]
cluster_name = var.cluster_name
@@ -334,9 +340,13 @@ resource "aws_eks_addon" "aws_ebs_csi_driver" {
}
provider "kubernetes" {
- host = data.aws_eks_cluster.cluster.endpoint
- cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
- token = data.aws_eks_cluster_auth.cluster.token
+ host = module.eks.cluster_endpoint
+ cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
+ exec {
+ api_version = "client.authentication.k8s.io/v1beta1"
+ args = ["eks", "get-token", "--cluster-name", var.cluster_name]
+ command = "aws"
+ }
}
resource "kubernetes_storage_class" "ebs_csi_encrypted_gp3_storage_class" {
diff --git a/devops/infra-as-code/terraform/sample-aws/variables.tf b/devops/infra-as-code/terraform/sample-aws/variables.tf
index a868c24f0..43dacd23f 100644
--- a/devops/infra-as-code/terraform/sample-aws/variables.tf
+++ b/devops/infra-as-code/terraform/sample-aws/variables.tf
@@ -32,7 +32,11 @@ variable "kubernetes_version" {
variable "instance_types" {
description = "Arry of instance types for SPOT instances"
default = ["m5a.xlarge"]
-
+}
+
+variable "instance_reservation" {
+ description = "instance reservation SPOT or ON_DEMAND"
+ default = "ON_DEMAND"
}
variable "min_worker_nodes" {
@@ -50,6 +54,15 @@ variable "max_worker_nodes" {
default = "5" #REPLACE IF NEEDED
}
+variable "db_version" {
+ description = "postgres version"
+ default = "15.8"
+}
+
+variable "db_instance_type" {
+ description = "Instance type for RDS instance"
+ default = "db.t4g.medium"
+}
variable "db_name" {
description = "RDS DB name. Make sure there are no hyphens or other special characters in the DB name. Else, DB creation will fail"
diff --git a/frontend/micro-ui/web/dev-build.sh b/frontend/micro-ui/web/dev-build.sh
new file mode 100755
index 000000000..267ae5471
--- /dev/null
+++ b/frontend/micro-ui/web/dev-build.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+# Fast local build + deploy to running digit-ui container
+# Usage: ./dev-build.sh
+# Build: ~3s, Deploy: ~1s, Total: ~4s
+
+set -e
+
+CONTAINER_NAME="digit-ui"
+DEPLOY_PATH="/var/web/digit-ui"
+
+echo "=== Building with esbuild ==="
+rm -rf build
+node esbuild.build.js 2>&1 | grep -E "esbuild done|ERROR"
+
+if [ $? -ne 0 ]; then
+ echo "Build failed!"
+ exit 1
+fi
+
+echo "=== Deploying to container ==="
+docker cp build/. "${CONTAINER_NAME}:${DEPLOY_PATH}/"
+echo "=== Done! Reload browser to see changes ==="
diff --git a/frontend/micro-ui/web/docker/Dockerfile b/frontend/micro-ui/web/docker/Dockerfile
index 933f759cb..fc2e54e99 100644
--- a/frontend/micro-ui/web/docker/Dockerfile
+++ b/frontend/micro-ui/web/docker/Dockerfile
@@ -1,25 +1,41 @@
-# FROM egovio/alpine-node-builder-14:yarn AS build
-FROM ghcr.io/egovernments/alpine-node-builder-14:yarn AS build
-RUN apk update && apk upgrade
-RUN apk add --no-cache git>2.30.0
+FROM node:14-bullseye-slim AS build
+
+# Install runtime/build deps: python2 (if node-sass/native modules need it),
+# build-essential (gcc/g++/make), git and ca-certificates.
+# Note: we intentionally DO NOT npm install -g yarn because the base image
+# already provides a yarn binary which caused the EEXIST symlink error.
+RUN apt-get update && \
+ apt-get install -y --no-install-recommends \
+ python2 \
+ build-essential \
+ git \
+ ca-certificates \
+ && rm -rf /var/lib/apt/lists/*
+
+# Ensure "python" resolves to python2 and force npm/node-gyp to use it
+RUN ln -sf /usr/bin/python2 /usr/bin/python
+ENV PYTHON=/usr/bin/python
+RUN npm config set python /usr/bin/python
+
ARG WORK_DIR
WORKDIR /app
-ENV NODE_OPTIONS "--max-old-space-size=8168"
+ENV NODE_OPTIONS="--max-old-space-size=8168"
COPY ${WORK_DIR} .
RUN ls -lah
-#RUN node web/envs.js
-RUN cd web/ \
- && chmod +x install-deps.sh \
- && yarn install \
- && yarn build:webpack
+WORKDIR /app/web
+
+RUN chmod +x ./install-deps.sh
+RUN ./install-deps.sh
+RUN yarn config set network-timeout 600000
+
+# Use frozen-lockfile for deterministic installs in CI
+RUN yarn install --frozen-lockfile
+RUN yarn build:webpack
FROM nginx:mainline-alpine
-#FROM ghcr.io/egovernments/nginx:mainline-alpine
ENV WORK_DIR=/var/web/digit-ui
-
RUN mkdir -p ${WORK_DIR}
-
COPY --from=build /app/web/build ${WORK_DIR}/
-COPY --from=build /app/web/docker/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /app/web/docker/nginx.conf /etc/nginx/conf.d/default.conf
\ No newline at end of file
diff --git a/frontend/micro-ui/web/esbuild.build.js b/frontend/micro-ui/web/esbuild.build.js
new file mode 100644
index 000000000..7ae21f36b
--- /dev/null
+++ b/frontend/micro-ui/web/esbuild.build.js
@@ -0,0 +1,150 @@
+const esbuild = require("esbuild");
+const path = require("path");
+const fs = require("fs");
+
+const OUTDIR = path.resolve(__dirname, "build");
+const PUBLIC_PATH = "/digit-ui/";
+
+// Plugin: map CDN-loaded globals so require("xlsx") → window.XLSX etc.
+const cdnGlobalsPlugin = {
+ name: "cdn-globals",
+ setup(build) {
+ const globals = {
+ xlsx: "XLSX",
+ };
+ for (const [pkg, globalName] of Object.entries(globals)) {
+ build.onResolve({ filter: new RegExp("^" + pkg + "$") }, () => ({
+ path: pkg,
+ namespace: "cdn-global",
+ }));
+ }
+ build.onLoad({ filter: /.*/, namespace: "cdn-global" }, (args) => ({
+ contents: `module.exports = window.${globals[args.path]};`,
+ loader: "js",
+ }));
+ },
+};
+
+// Plugin: handle CRA-style SVG imports (import { ReactComponent } from './file.svg')
+const svgPlugin = {
+ name: "svg-component",
+ setup(build) {
+ build.onLoad({ filter: /\.svg$/ }, async (args) => {
+ const svg = fs.readFileSync(args.path, "utf-8");
+ const escaped = svg.replace(/`/g, "\\`").replace(/\$/g, "\\$");
+ return {
+ contents: `
+ import React from 'react';
+ var svgContent = \`${escaped}\`;
+ export var ReactComponent = function(props) {
+ return React.createElement('span', Object.assign({}, props, {
+ dangerouslySetInnerHTML: { __html: svgContent }
+ }));
+ };
+ export default "data:image/svg+xml," + encodeURIComponent(svgContent);
+ `,
+ loader: "jsx",
+ };
+ });
+ },
+};
+
+async function build() {
+ const start = Date.now();
+
+ const result = await esbuild.build({
+ entryPoints: [path.resolve(__dirname, "src/index.js")],
+ bundle: true,
+ outdir: OUTDIR,
+ publicPath: PUBLIC_PATH,
+ splitting: true,
+ format: "esm",
+ target: ["es2018"],
+ minify: true,
+ metafile: true,
+ treeShaking: true,
+ jsx: "transform",
+ jsxFactory: "React.createElement",
+ jsxFragment: "React.Fragment",
+ loader: {
+ ".js": "jsx",
+ ".css": "css",
+ ".png": "file",
+ ".jpg": "file",
+ ".jpeg": "file",
+ ".gif": "file",
+ ".svg": "file",
+ },
+ alias: {
+ // Resolve core module from LOCAL SOURCE (not npm dist) so our
+ // Module.js / App.js changes are included without microbundle
+ "@egovernments/digit-ui-module-core": path.resolve(
+ __dirname,
+ "micro-ui-internals/packages/modules/core/src/Module.js"
+ ),
+ // Use local library source so auth adapter exports are available
+ "@egovernments/digit-ui-libraries": path.resolve(
+ __dirname,
+ "micro-ui-internals/packages/libraries/src/index.js"
+ ),
+ // Force single React instance to prevent "Invalid hook call" errors
+ // when core module source resolves React from micro-ui-internals/node_modules
+ react: path.resolve(__dirname, "node_modules/react"),
+ "react-dom": path.resolve(__dirname, "node_modules/react-dom"),
+ "react-router-dom": path.resolve(__dirname, "node_modules/react-router-dom"),
+ },
+ nodePaths: [
+ path.resolve(__dirname, "node_modules"),
+ path.resolve(__dirname, "micro-ui-internals/node_modules"),
+ ],
+ define: {
+ "process.env.NODE_ENV": '"production"',
+ "process.env.REACT_APP_STATE_LEVEL_TENANT_ID": '""',
+ global: "window",
+ },
+ plugins: [cdnGlobalsPlugin, svgPlugin],
+ logLevel: "info",
+ });
+
+ // --- Inject bundles into index.html ---
+ const html = fs.readFileSync(
+ path.resolve(__dirname, "public/index.html"),
+ "utf-8"
+ );
+
+ const outputs = Object.keys(result.metafile.outputs);
+ // Entry chunks (not internal chunks)
+ const entryJS = outputs
+ .filter((f) => f.endsWith(".js") && result.metafile.outputs[f].entryPoint)
+ .map((f) => path.basename(f));
+ const cssFiles = outputs
+ .filter((f) => f.endsWith(".css"))
+ .map((f) => path.basename(f));
+
+ const scriptTags = entryJS
+ .map((f) => ` `)
+ .join("\n");
+ const linkTags = cssFiles
+ .map((f) => ` `)
+ .join("\n");
+
+ const injected = html
+ .replace("", `${linkTags}\n`)
+ .replace(" ", `${scriptTags}\n`);
+
+ fs.writeFileSync(path.resolve(OUTDIR, "index.html"), injected);
+
+ const elapsed = ((Date.now() - start) / 1000).toFixed(1);
+ console.log(`\nesbuild done in ${elapsed}s`);
+
+ // Print size summary
+ const analyze = await esbuild.analyzeMetafile(result.metafile, {
+ verbose: false,
+ });
+ console.log(analyze);
+}
+
+build().catch((err) => {
+ console.error(err);
+ process.exit(1);
+});
diff --git a/frontend/micro-ui/web/micro-ui-internals/.npmrc b/frontend/micro-ui/web/micro-ui-internals/.npmrc
new file mode 100644
index 000000000..b6f27f135
--- /dev/null
+++ b/frontend/micro-ui/web/micro-ui-internals/.npmrc
@@ -0,0 +1 @@
+engine-strict=true
diff --git a/frontend/micro-ui/web/micro-ui-internals/example/package.json b/frontend/micro-ui/web/micro-ui-internals/example/package.json
index fa0e665ac..7608f33cb 100644
--- a/frontend/micro-ui/web/micro-ui-internals/example/package.json
+++ b/frontend/micro-ui/web/micro-ui-internals/example/package.json
@@ -1,6 +1,6 @@
{
"name": "@egovernments/digit-ui-example",
- "version": "1.0.0",
+ "version": "1.0.2",
"main": "index.js",
"license": "MIT",
"private": true,
@@ -9,14 +9,14 @@
"start": "react-scripts start"
},
"devDependencies": {
- "@egovernments/digit-ui-libraries": "1.8.15",
- "@egovernments/digit-ui-components": "0.2.0-beta.45",
- "@egovernments/digit-ui-module-core": "1.8.44",
+ "@egovernments/digit-ui-libraries": "1.9.3",
+ "@egovernments/digit-ui-components": "0.2.3",
+ "@egovernments/digit-ui-module-core": "1.9.9",
"@egovernments/digit-ui-module-utilities": "1.0.12",
"@egovernments/digit-ui-react-components": "1.8.21",
- "@egovernments/digit-ui-module-health-pgr": "0.0.1",
- "@egovernments/digit-ui-module-workbench": "1.0.28",
- "@egovernments/digit-ui-module-hrms": "1.8.16",
+ "@egovernments/digit-ui-module-cms": "1.0.2",
+ "@egovernments/digit-ui-module-workbench": "1.0.28",
+ "@egovernments/digit-ui-module-hrms": "1.9.4",
"http-proxy-middleware": "^1.0.5",
"react": "17.0.2",
"react-dom": "17.0.2",
@@ -36,4 +36,4 @@
"last 1 safari version"
]
}
-}
+}
\ No newline at end of file
diff --git a/frontend/micro-ui/web/micro-ui-internals/example/public/index.html b/frontend/micro-ui/web/micro-ui-internals/example/public/index.html
index 388d60e67..afc2b12fe 100644
--- a/frontend/micro-ui/web/micro-ui-internals/example/public/index.html
+++ b/frontend/micro-ui/web/micro-ui-internals/example/public/index.html
@@ -1,34 +1,164 @@
-