feat(oeg): rewrite the OEG subchart for OEG 2.0

apiVersion: v2

name: oeg

description: A Helm chart for the OEG Controller

description: Open Exposure Gateway 2.0 (CAMARA APIs)

type: application

version: 1.0.0

appVersion: "1.0.1"

keywords:

  - oeg

  - controller

  - camara

  - open-exposure-gateway

maintainers:

  - name: DevOps Team

Thank you for installing {{ .Chart.Name }}!

Your release is named {{ .Release.Name }}.

To learn more about the release, try:

  $ helm status {{ .Release.Name }} -n {{ include "oeg.namespace" . }}

  $ helm get all {{ .Release.Name }} -n {{ include "oeg.namespace" . }}

{{- if .Values.oegcontroller.enabled }}

OEG Controller has been deployed successfully!

1. Get the application URL:

{{- if .Values.ingress.enabled }}

  http://{{ .Values.ingress.host }}{{ .Values.ingress.path }}

{{- else if contains "NodePort" .Values.oegcontroller.service.type }}

  export NODE_PORT=$(kubectl get --namespace {{ include "oeg.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ .Values.oegcontroller.service.name }})

  export NODE_IP=$(kubectl get nodes --namespace {{ include "oeg.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")

  echo http://$NODE_IP:$NODE_PORT

{{- else if contains "LoadBalancer" .Values.oegcontroller.service.type }}

  NOTE: It may take a few minutes for the LoadBalancer IP to be available.

        Watch the status with: kubectl get svc --namespace {{ include "oeg.namespace" . }} -w {{ .Values.oegcontroller.service.name }}

  export SERVICE_IP=$(kubectl get svc --namespace {{ include "oeg.namespace" . }} {{ .Values.oegcontroller.service.name }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")

  echo http://$SERVICE_IP:{{ .Values.oegcontroller.service.port }}

{{- else if contains "ClusterIP" .Values.oegcontroller.service.type }}

  kubectl port-forward --namespace {{ include "oeg.namespace" . }} svc/{{ .Values.oegcontroller.service.name }} 8080:{{ .Values.oegcontroller.service.port }}

  echo "Visit http://127.0.0.1:8080 to access your application"

Open Exposure Gateway {{ .Values.oegcontroller.image.tag }} is deployed in namespace {{ include "oeg.namespace" . }}.

In the cluster: http://{{ .Values.oegcontroller.service.name }}{{ if ne (toString .Values.oegcontroller.service.port) "80" }}:{{ .Values.oegcontroller.service.port }}{{ end }}

{{- if or .Values.oegcontroller.publicBaseUrl (eq .Values.oegcontroller.service.type "NodePort") }}

From outside:   {{ include "oeg.publicBaseUrl" . }}/docs

{{- else }}

From your machine:

  kubectl port-forward -n {{ include "oeg.namespace" . }} svc/{{ .Values.oegcontroller.service.name }} 8080:{{ .Values.oegcontroller.service.port }}

  then open http://127.0.0.1:8080/docs

{{- end }}

2. Check the pods status:

  kubectl get pods -n {{ include "oeg.namespace" . }} -l app.kubernetes.io/instance={{ .Release.Name }}

{{- end }}

For more information, visit the documentation or check the project repository.

{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}

{{- end }}

{{/*

Create a default fully qualified app name.

*/}}

{{- define "oeg.fullname" -}}

{{- if .Values.fullnameOverride }}

{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}

{{- else }}

{{- $name := default .Chart.Name .Values.nameOverride }}

{{- if contains $name .Release.Name }}

{{- .Release.Name | trunc 63 | trimSuffix "-" }}

{{- else }}

{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}

{{- end }}

{{- end }}

{{- end }}

{{/*

Create chart name and version as used by the chart label.

*/}}

{{- end }}

{{/*

Common labels

OEG Controller labels

*/}}

{{- define "oeg.labels" -}}

{{- define "oeg.controller.labels" -}}

helm.sh/chart: {{ include "oeg.chart" . }}

{{ include "oeg.selectorLabels" . }}

{{- if .Chart.AppVersion }}

app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}

{{- end }}

{{ include "oeg.controller.selectorLabels" . }}

app.kubernetes.io/version: {{ .Values.oegcontroller.image.tag | quote }}

app.kubernetes.io/managed-by: {{ .Release.Service }}

{{- with .Values.commonLabels }}

{{ toYaml . }}

{{- end }}

{{/*

Selector labels

OEG Controller selector labels

*/}}

{{- define "oeg.selectorLabels" -}}

app.kubernetes.io/name: {{ include "oeg.name" . }}

{{- define "oeg.controller.selectorLabels" -}}

app.kubernetes.io/name: {{ .Values.oegcontroller.name }}

app.kubernetes.io/instance: {{ .Release.Name }}

{{- end }}

{{/*

OEG Controller labels

Return the proper namespace

*/}}

{{- define "oeg.controller.labels" -}}

helm.sh/chart: {{ include "oeg.chart" . }}

{{ include "oeg.controller.selectorLabels" . }}

app.kubernetes.io/managed-by: {{ .Release.Service }}

{{- define "oeg.namespace" -}}

{{- .Release.Namespace }}

{{- end }}

{{/*

OEG Controller selector labels

*/}}

{{- define "oeg.controller.selectorLabels" -}}

app.kubernetes.io/name: {{ .Values.oegcontroller.name }}

app.kubernetes.io/instance: {{ .Release.Name }}

{{- define "oeg.authEnabled" -}}

{{- if dig "auth" "enabled" true (.Values.global | default dict) }}true{{ end -}}

{{- end }}

{{/*

Create the name of the service account to use

*/}}

{{- define "oeg.serviceAccountName" -}}

{{- if .Values.serviceAccount.create }}

{{- default (include "oeg.fullname" .) .Values.serviceAccount.name }}

{{- else }}

{{- default "default" .Values.serviceAccount.name }}

{{- define "oeg.scheme" -}}

{{- dig "scheme" "http" (.Values.global | default dict) -}}

{{- end }}

{{- define "oeg.publicHost" -}}

{{- $host := dig "publicHost" "" (.Values.global | default dict) -}}

{{- if not $host -}}

{{- $nodes := lookup "v1" "Node" "" "" -}}

{{- if and $nodes $nodes.items -}}

{{- $addresses := (index $nodes.items 0).status.addresses -}}

{{- range $addresses }}{{ if and (not $host) (eq .type "ExternalIP") }}{{ $host = .address }}{{ end }}{{ end -}}

{{- range $addresses }}{{ if and (not $host) (eq .type "InternalIP") }}{{ $host = .address }}{{ end }}{{ end -}}

{{- end -}}

{{- end -}}

{{- $host | default "localhost" -}}

{{- end }}

{{/*

Return the proper namespace

*/}}

{{- define "oeg.namespace" -}}

{{- default .Release.Namespace .Values.global.namespace }}

{{- define "oeg.publicBaseUrl" -}}

{{- $c := .Values.oegcontroller -}}

{{- if $c.publicBaseUrl -}}

{{- trimSuffix "/" $c.publicBaseUrl -}}

{{- else if and (eq $c.service.type "NodePort") $c.service.nodePort -}}

{{- printf "%s://%s:%v" (include "oeg.scheme" .) (include "oeg.publicHost" .) $c.service.nodePort -}}

{{- else -}}

{{- printf "%s://%s" (include "oeg.scheme" .) (include "oeg.publicHost" .) -}}

{{- end -}}

{{- end }}

{{- define "oeg.keycloak.publicUrl" -}}

{{- $port := dig "nodePorts" "keycloak" 30081 (.Values.global | default dict) -}}

{{- printf "%s://%s:%v" (include "oeg.scheme" .) (include "oeg.publicHost" .) $port -}}

{{- end }}

{{- define "oeg.keycloak.internalUrl" -}}

{{- $kc := (.Values.global | default dict).keycloak | default dict -}}

{{- printf "http://%s:%v" ($kc.host | default "keycloak") ($kc.port | default 8080) -}}

{{- end }}

{{- define "oeg.keycloakIssuer" -}}

{{- $kc := .Values.oegcontroller.keycloak -}}

{{- if $kc.issuer -}}

{{- trimSuffix "/" $kc.issuer -}}

{{- else -}}

{{- printf "%s/realms/%s" (include "oeg.keycloak.publicUrl" .) $kc.realm -}}

{{- end -}}

{{- end }}

{{- define "oeg.keycloakJwksUrl" -}}

{{- printf "%s/realms/%s/protocol/openid-connect/certs" (include "oeg.keycloak.internalUrl" .) .Values.oegcontroller.keycloak.realm -}}

{{- end }}

{{- define "oeg.db.host" -}}

{{- .Values.oegcontroller.database.host | default (dig "postgresql" "host" "postgres" (.Values.global | default dict)) -}}

{{- end }}

{{- define "oeg.db.port" -}}

{{- .Values.oegcontroller.database.port | default (dig "postgresql" "port" 5432 (.Values.global | default dict)) -}}

{{- end }}

{{- define "oeg.db.secretName" -}}

{{- .Values.oegcontroller.database.existingSecret | default (dig "postgresql" "secretName" "postgres-credentials" (.Values.global | default dict)) -}}

{{- end }}

{{- define "oeg.db.waitImage" -}}

{{- dig "images" "postgres" "postgres:18.6-alpine" (.Values.global | default dict) -}}

{{- end }}

{{- if .Values.oegcontroller.enabled }}

{{- $c := .Values.oegcontroller }}

apiVersion: apps/v1

kind: Deployment

metadata:

  name: {{ .Values.oegcontroller.name }}

  name: {{ $c.name }}

  namespace: {{ include "oeg.namespace" . }}

  labels:

    {{- include "oeg.controller.labels" . | nindent 4 }}

    {{- toYaml . | nindent 4 }}

  {{- end }}

spec:

  replicas: {{ .Values.oegcontroller.replicaCount }}

  replicas: {{ $c.replicaCount }}

  selector:

    matchLabels:

      {{- include "oeg.controller.selectorLabels" . | nindent 6 }}

    metadata:

      labels:

        {{- include "oeg.controller.selectorLabels" . | nindent 8 }}

        postgres-client: "true"

      {{- with .Values.commonAnnotations }}

      annotations:

        {{- toYaml . | nindent 8 }}

      {{- end }}

    spec:

      initContainers:

        - name: wait-for-database

          image: {{ include "oeg.db.waitImage" . | quote }}

          imagePullPolicy: IfNotPresent

          env:

            - name: PGPASSWORD

              valueFrom:

                secretKeyRef:

                  name: {{ include "oeg.db.secretName" . }}

                  key: {{ $c.database.passwordKey }}

          command: ["/bin/sh", "-c"]

          args:

            - |

              until psql -h {{ include "oeg.db.host" . }} -p {{ include "oeg.db.port" . }} -U {{ $c.database.user }} -d {{ $c.database.name }} -c 'SELECT 1' >/dev/null 2>&1; do

                echo "waiting for database {{ $c.database.name }} at {{ include "oeg.db.host" . }}:{{ include "oeg.db.port" . }}"

                sleep 3

              done

      containers:

        - name: {{ .Values.oegcontroller.name }}

          image: "{{ .Values.oegcontroller.image.repository }}:{{ .Values.oegcontroller.image.tag }}"

          imagePullPolicy: {{ .Values.oegcontroller.image.pullPolicy }}

        - name: {{ $c.name }}

          image: "{{ $c.image.repository }}:{{ $c.image.tag }}"

          imagePullPolicy: {{ $c.image.pullPolicy }}

          ports:

            - name: http

              containerPort: {{ .Values.oegcontroller.service.targetPort }}

              containerPort: {{ $c.service.targetPort }}

              protocol: TCP

          env:

            - name: NATS_URL

              value: {{ .Values.oegcontroller.env.natsUrl | quote }}

          {{- with .Values.oegcontroller.resources }}

            - name: DB_PASSWORD

              valueFrom:

                secretKeyRef:

                  name: {{ include "oeg.db.secretName" . }}

                  key: {{ $c.database.passwordKey }}

            - name: POSTGRESQL_SETTINGS__URL

              value: "postgresql+asyncpg://{{ $c.database.user }}:$(DB_PASSWORD)@{{ include "oeg.db.host" . }}:{{ include "oeg.db.port" . }}/{{ $c.database.name }}"

            - name: POSTGRESQL_SETTINGS__CREATE_SCHEMA_ON_STARTUP

              value: {{ $c.database.createSchemaOnStartup | toString | quote }}

            - name: SRM_SETTINGS__BASE_URL

              value: {{ $c.srm.url | quote }}

            - name: SRM_SETTINGS__TIMEOUT

              value: {{ $c.srm.timeout | toString | quote }}

            - name: FM_SETTINGS__BASE_URL

              value: {{ $c.fm.url | quote }}

            - name: FM_SETTINGS__TIMEOUT

              value: {{ $c.fm.timeout | toString | quote }}

            - name: NATS_SETTINGS__URL

              value: {{ $c.nats.url | quote }}

            - name: KEYCLOAK_SETTINGS__ISSUER

              value: {{ include "oeg.keycloakIssuer" . | quote }}

            - name: KEYCLOAK_SETTINGS__JWKS_URL

              value: {{ include "oeg.keycloakJwksUrl" . | quote }}

            - name: KEYCLOAK_SETTINGS__AUDIENCE

              value: {{ $c.keycloak.audience | quote }}

            - name: KEYCLOAK_SETTINGS__ENFORCEMENT_ENABLED

              value: {{ ternary "true" "false" (eq (include "oeg.authEnabled" .) "true") | quote }}

            - name: PUBLIC_BASE_URL

              value: {{ include "oeg.publicBaseUrl" . | quote }}

            - name: OBSERVABILITY_SETTINGS__LOG_LEVEL

              value: {{ $c.logLevel | quote }}

            - name: RECONCILIATION_SETTINGS__ENABLED

              value: {{ $c.reconciliation.enabled | toString | quote }}

            - name: RECONCILIATION_SETTINGS__INTERVAL_SECONDS

              value: {{ $c.reconciliation.intervalSeconds | toString | quote }}

            - name: RECONCILIATION_SETTINGS__OPERATION_DEADLINE_SECONDS

              value: {{ $c.reconciliation.operationDeadlineSeconds | toString | quote }}

          livenessProbe:

            httpGet:

              path: /platform/healthz

              port: http

            periodSeconds: 10

          readinessProbe:

            httpGet:

              path: {{ ternary "/platform/readyz" "/platform/healthz" (eq (include "oeg.authEnabled" .) "true") }}

              port: http

            periodSeconds: 5

          securityContext:

            allowPrivilegeEscalation: false

            capabilities:

              drop: ["ALL"]

          {{- with $c.resources }}

          resources:

            {{- toYaml . | nindent 12 }}

          {{- end }}

# Global settings

global:

  namespace: oop

# OEG Controller configuration

oegcontroller:

  enabled: true

  name: oegcontroller

  image:

    repository: labs.etsi.org:5050/oop/code/open-exposure-gateway

    tag: "1.1"

    pullPolicy: Always

    pullPolicy: IfNotPresent

  service:

    name: oeg

    type: ClusterIP

    port: 80

    targetPort: 8080

    nodePort: ""

  resources: {}

  # Environment variables

  env:

    natsUrl: "nats://oop-nats:4222"

  database:

    name: oeg

    user: oeg

    host: ""

    port: ""

    existingSecret: ""

    passwordKey: oeg-password

    createSchemaOnStartup: true

  keycloak:

    realm: oop

    audience: oeg

    issuer: ""

  srm:

    url: "http://srm:8080"

    timeout: 10

  fm:

    url: "http://federation-manager:8082"

    timeout: 10

  nats:

    url: "nats://oop-nats:4222"

  publicBaseUrl: ""

  logLevel: INFO

  reconciliation:

    enabled: true

    intervalSeconds: 60

    operationDeadlineSeconds: 1800

# Ingress configuration

ingress:

  enabled: false

  className: ""

  host: ""

  path: /

  pathType: Prefix

  # TLS configuration (optional)

  tls:

    enabled: false

    secretName: oeg-tls

# Labels to apply to all resources

commonLabels: {}

# Annotations to apply to all resources

commonAnnotations: {}