init commit

2025-09-29 07:07:02 +02:00
commit 8b3c549d47
11 changed files with 317 additions and 0 deletions
--- a/.helmignore
+++ b/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
--- a/helm/Chart.yaml
+++ b/helm/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: mongodb
+description: A Helm chart for MongoDB
+type: application
+version: 0.1.0
+appVersion: "8.0"
--- a/helm/templates/_helpers.tpl
+++ b/helm/templates/_helpers.tpl
@@ -0,0 +1,26 @@
+{{- define "mongo.name" -}}
+{{- printf "%s" .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "mongo.name.headless" -}}
+{{- printf "%s-headless" .Chart.Name | trunc 54 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "mongo.name.config" -}}
+{{- printf "%s-config" .Chart.Name | trunc 56 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "mongo.name.secret" -}}
+{{- printf "%s-secret" .Chart.Name | trunc 56 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "mongo.name.initialize" -}}
+{{- printf "%s-initialize" .Chart.Name | trunc 52 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "mongo.labels" -}}
+app.kubernetes.io/name: {{ include "mongo.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+{{- end -}}
--- a/helm/templates/headless-service.yaml
+++ b/helm/templates/headless-service.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "mongo.name.headless" . }}
+  labels:
+    {{- include "mongo.labels" . | nindent 4 }}
+spec:
+  clusterIP: None
+  publishNotReadyAddresses: true
+  ports:
+  - port: {{ .Values.service.port }}
+    targetPort: {{ .Values.service.port }}
+    protocol: TCP
+    name: mongodb
+  selector:
+    app.kubernetes.io/name: {{ include "mongo.name" . }}
--- a/helm/templates/init-script.yaml
+++ b/helm/templates/init-script.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.auth.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "mongo.name.initialize" . }}
+  labels:
+    {{- include "mongo.labels" . | nindent 4 }}
+data:
+  init.js: |
+    db = db.getSiblingDB(process.env.MONGO_INITDB_DATABASE);
+    db.createUser({
+        user: process.env.MONGO_INITDB_USERNAME,
+        pwd: process.env.MONGO_INITDB_PASSWORD,
+        roles: [{ role: "readWrite", db: process.env.MONGO_INITDB_DATABASE }]
+    });
+{{- end }}
--- a/helm/templates/secret.yaml
+++ b/helm/templates/secret.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "mongo.name.secret" . }}
+  labels:
+    {{- include "mongo.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  {{- if .Values.auth.enabled }}
+  MONGO_INITDB_ROOT_PASSWORD: "{{ .Values.auth.rootPassword }}"
+  MONGO_INITDB_ROOT_USERNAME: "{{ .Values.auth.rootUsername }}"
+  MONGO_INITDB_DATABASE: "{{ .Values.auth.database }}"
+  MONGO_INITDB_PASSWORD: "{{ .Values.auth.password }}"
+  MONGO_INITDB_USERNAME: "{{ .Values.auth.username }}"
+{{/*  MONGO_AUTHSOURCE: "admin"*/}}
+  {{- end }}
--- a/helm/templates/service.yaml
+++ b/helm/templates/service.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "mongo.name" . }}
+  labels:
+    {{- include "mongo.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if and .Values.service.loadBalancerIP (ne .Values.service.loadBalancerIP "") }}
+  loadBalancerIP: {{ .Values.service.loadBalancerIP }}
+  {{- end }}
+  ports:
+  - port: {{ .Values.service.port }}
+    targetPort: {{ .Values.service.port }}
+    protocol: TCP
+    name: mongodb
+  selector:
+    app.kubernetes.io/name: {{ include "mongo.name" . }}
--- a/helm/templates/statefulset.yaml
+++ b/helm/templates/statefulset.yaml
@@ -0,0 +1,86 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "mongo.name" . }}
+  labels:
+    {{- include "mongo.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ include "mongo.name" . }}
+  replicas: {{ .Values.statefulset.replicas }}
+  podManagementPolicy: {{ .Values.statefulset.podManagementPolicy }}
+  updateStrategy:
+    type: {{ .Values.statefulset.updateStrategy.type }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "mongo.name" . }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "mongo.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      {{- if .Values.securityContext.enabled }}
+      securityContext:
+        fsGroup: {{ .Values.securityContext.fsGroup }}
+        runAsUser: {{ .Values.securityContext.runAsUser }}
+        runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }}
+      {{- end }}
+      containers:
+      - name: mongo
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        args:
+        {{- if .Values.extraCommandLineArgs }}
+        - "{{ .Values.extraCommandLineArgs }}"
+        {{- end }}
+        ports:
+        - containerPort: {{ .Values.service.port }}
+        name: mongodb
+        envFrom:
+        - secretRef:
+            name: {{ include "mongo.name.secret" . }}
+        volumeMounts:
+        - name: data
+          mountPath: /data/db
+        {{- if .Values.auth.enabled }}
+        - name: init-script
+          mountPath: /docker-entrypoint-initdb.d
+        {{- end }}
+        {{- if .Values.readinessProbe.enabled }}
+        readinessProbe:
+          exec:
+            command: {{ toJson .Values.healthCheck.command }}
+          initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
+          periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
+          timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
+          failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
+          successThreshold: {{ .Values.readinessProbe.successThreshold }}
+        {{- end }}
+        {{- if .Values.livenessProbe.enabled }}
+        livenessProbe:
+          exec:
+            command: {{ toJson .Values.healthCheck.command }}
+          initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+          periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
+          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
+          failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
+          successThreshold: {{ .Values.livenessProbe.successThreshold }}
+        {{- end }}
+        resources:
+          {{- toYaml .Values.resources | nindent 10 }}
+      volumes:
+        - name: init-script
+          configMap:
+            name: {{ include "mongo.name.initialize" . }}
+  volumeClaimTemplates:
+  - metadata:
+      name: data
+    spec:
+      accessModes:
+        {{- toYaml .Values.persistence.accessModes | nindent 10 }}
+      resources:
+        requests:
+          storage: {{ .Values.persistence.size }}
+      {{- if .Values.persistence.storageClass }}
+      storageClassName: {{ .Values.persistence.storageClass }}
+      {{- end }}
--- a/helm/values.yaml
+++ b/helm/values.yaml
@@ -0,0 +1,74 @@
+image:
+  repository: mongo
+  tag: "8.0"
+  pullPolicy: IfNotPresent
+
+
+statefulset:
+  replicas: 1
+  podManagementPolicy: OrderedReady
+  updateStrategy:
+    type: RollingUpdate
+
+
+auth:
+  enabled: true
+  rootUsername: root
+  rootPassword: verySecurePassword
+  database: user
+  username: user
+  password: securePassword
+
+persistence:
+  storageClass:
+  accessModes:
+  - ReadWriteOnce
+  size: 8Gi
+
+
+service:
+  type: ClusterIP
+  port: 27017
+  headless:
+    enabled: true
+    name: "{{ include \"mongo.name.headless\" . }}"
+
+
+resources:
+  limits:
+    cpu: "1"
+    memory: 1Gi
+  requests:
+    cpu: 100m
+    memory: 256Mi
+
+
+livenessProbe:
+  enabled: true
+  initialDelaySeconds: 30
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 5
+  successThreshold: 1
+
+readinessProbe:
+  enabled: true
+  initialDelaySeconds: 5
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 3
+  successThreshold: 1
+
+
+securityContext:
+  enabled: true
+  fsGroup: 65534
+  runAsUser: 65534
+  runAsNonRoot: true
+
+
+extraCommandLineArgs: ""
+
+
+healthCheck:
+  command: ["/bin/sh", "-c", "mongosh --quiet --eval 'db.runCommand({ ping: 1 })' --username ${MONGO_INITDB_ROOT_USERNAME} --password ${MONGO_INITDB_ROOT_PASSWORD} --authenticationDatabase admin || exit 1" ]