Skip to content

Commit b090b58

Browse files
josqu4redjosqu4red
committed
Create helm chart
Change-Id: Ie438182af7eba427c4ea92295a2f52420c9a3013
1 parent d2765c1 commit b090b58

9 files changed

Lines changed: 445 additions & 0 deletions

File tree

‎chart/.helmignore‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/
24+
# Chart development files
25+
*.tgz
26+
.helmignore
27+
README.md

‎chart/Chart.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v2
2+
name: firmirror
3+
description: A Helm chart for Firmirror - LVFS-compatible firmware repository sync
4+
type: application
5+
version: 0.1.0
6+
appVersion: 0.1.0
7+
keywords:
8+
- lvfs
9+
- fwupd
10+
maintainers:
11+
- name: Criteo

‎chart/README.md‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# Firmirror Helm Chart
2+
3+
This Helm chart deploys Firmirror as a Kubernetes CronJob to periodically sync firmware from hardware vendor sources (Dell and HPE) and create an LVFS-compatible firmware repository.
4+
5+
## Prerequisites
6+
7+
- Kubernetes 1.19+
8+
- Helm 3.0+
9+
- PersistentVolume provisioner support (optional, but recommended)
10+
- Container image with firmirror binary and fwupdtool
11+
12+
## Installing the Chart
13+
14+
### Basic Installation
15+
16+
```bash
17+
# Install with default configuration (no vendors enabled by default)
18+
helm install firmirror ./chart
19+
20+
# Install with custom values
21+
helm install firmirror ./chart \
22+
--set vendors.dell.enabled=true \
23+
--set vendors.dell.machinesId="0C60,0C61" \
24+
--set vendors.hpe.enabled=true \
25+
--set vendors.hpe.gens="gen10,gen11"
26+
```
27+
28+
## Configuration
29+
30+
The following table lists the configurable parameters of the Firmirror chart and their default values.
31+
32+
### Settings
33+
34+
| Parameter | Description | Default |
35+
|-----------|-------------|---------|
36+
| `schedule` | Cron schedule for the job | `"0 2 * * *"` (2 AM daily) |
37+
| `nameOverride` | Override the chart name | `""` |
38+
| `fullnameOverride` | Override the full release name | `""` |
39+
| `image.repository` | Container image repository | `ghcr.io/criteo/firmirror` |
40+
| `image.tag` | Container image tag | `""` (Chart appVersion) |
41+
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
42+
| `imagePullSecrets` | Image pull secrets | `[]` |
43+
| `vendors.dell.enabled` | Enable Dell firmware sync | `false` |
44+
| `vendors.dell.machinesId` | Comma-separated Dell machine System IDs | `""` |
45+
| `vendors.hpe.enabled` | Enable HPE firmware sync | `false` |
46+
| `vendors.hpe.gens` | Comma-separated HPE generations (gen10,gen11,gen12) | `""` |
47+
| `outputDir` | Output directory inside container | `/data/firmirror` |
48+
| `persistence.enabled` | Enable persistent storage | `false` |
49+
| `persistence.existingClaim` | Use existing PVC | `""` |
50+
| `persistence.storageClass` | Storage class name | `""` (default class) |
51+
| `persistence.accessMode` | PVC access mode | `ReadWriteOnce` |
52+
| `persistence.size` | PVC size | `50Gi` |
53+
| `cronjob.successfulJobsHistoryLimit` | Number of successful jobs to keep | `3` |
54+
| `cronjob.failedJobsHistoryLimit` | Number of failed jobs to keep | `3` |
55+
| `cronjob.restartPolicy` | Pod restart policy | `OnFailure` |
56+
| `cronjob.backoffLimit` | Number of retries before marking job as failed | `2` |
57+
| `cronjob.activeDeadlineSeconds` | Maximum job runtime in seconds | `7200` (2 hours) |
58+
| `cronjob.ttlSecondsAfterFinished` | Time to keep finished jobs | `86400` (24 hours) |
59+
| `resources.limits.cpu` | CPU limit | `2000m` |
60+
| `resources.limits.memory` | Memory limit | `4Gi` |
61+
| `resources.requests.cpu` | CPU request | `500m` |
62+
| `resources.requests.memory` | Memory request | `1Gi` |
63+
| `podSecurityContext.fsGroup` | Pod fsGroup | `1000` |
64+
| `podSecurityContext.runAsUser` | Pod user ID | `1000` |
65+
| `podSecurityContext.runAsNonRoot` | Run as non-root | `true` |
66+
| `securityContext.allowPrivilegeEscalation` | Allow privilege escalation | `false` |
67+
| `securityContext.capabilities.drop` | Dropped capabilities | `["ALL"]` |
68+
| `securityContext.readOnlyRootFilesystem` | Read-only root filesystem | `false` |
69+
| `securityContext.runAsNonRoot` | Run as non-root | `true` |
70+
| `securityContext.runAsUser` | Container user ID | `1000` |
71+
| `env` | Additional environment variables | `[]` |
72+
| `serviceAccount.create` | Create service account | `false` |
73+
| `serviceAccount.annotations` | Service account annotations | `{}` |
74+
| `serviceAccount.name` | Service account name | `""` |
75+
76+
## License
77+
78+
See the main project repository for license information.

‎chart/templates/NOTES.txt‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
Thank you for installing {{ .Chart.Name }}!
2+
3+
Your release is named {{ .Release.Name }}.
4+
5+
Firmirror has been configured to run as a CronJob with the following settings:
6+
7+
Schedule: {{ .Values.schedule }}
8+
9+
Enabled vendors:
10+
{{- if .Values.vendors.dell.enabled }}
11+
- Dell firmware
12+
{{- if .Values.vendors.dell.machinesId }}
13+
Machine IDs: {{ .Values.vendors.dell.machinesId }}
14+
{{- end }}
15+
{{- end }}
16+
{{- if .Values.vendors.hpe.enabled }}
17+
- HPE firmware
18+
{{- if .Values.vendors.hpe.gens }}
19+
Generations: {{ .Values.vendors.hpe.gens }}
20+
{{- end }}
21+
{{- end }}
22+
23+
Output directory: {{ .Values.outputDir }}
24+
{{- if .Values.persistence.enabled }}
25+
Persistent storage: {{ .Values.persistence.size }} ({{ .Values.persistence.accessMode }})
26+
{{- else }}
27+
Persistent storage: disabled (using emptyDir)
28+
{{- end }}
29+
30+
To check the status of your CronJob:
31+
32+
kubectl get cronjob {{ include "firmirror.fullname" . }} -n {{ .Release.Namespace }}
33+
34+
To view recent jobs:
35+
36+
kubectl get jobs -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }}
37+
38+
To manually trigger a job now:
39+
40+
kubectl create job --from=cronjob/{{ include "firmirror.fullname" . }} {{ include "firmirror.fullname" . }}-manual-$(date +%s) -n {{ .Release.Namespace }}
41+
42+
To view logs from the latest job:
43+
44+
kubectl logs -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} --tail=100
45+
46+
{{- if .Values.persistence.enabled }}
47+
48+
To access the firmware repository data:
49+
50+
kubectl exec -it -n {{ .Release.Namespace }} <pod-name> -- ls -lh {{ .Values.outputDir }}
51+
{{- end }}
52+
53+
For more information, visit: https://github.com/criteo/firmirror

‎chart/templates/_helpers.tpl‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "firmirror.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
*/}}
11+
{{- define "firmirror.fullname" -}}
12+
{{- if .Values.fullnameOverride }}
13+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
14+
{{- else }}
15+
{{- $name := default .Chart.Name .Values.nameOverride }}
16+
{{- if contains $name .Release.Name }}
17+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
18+
{{- else }}
19+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
20+
{{- end }}
21+
{{- end }}
22+
{{- end }}
23+
24+
{{/*
25+
Create chart name and version as used by the chart label.
26+
*/}}
27+
{{- define "firmirror.chart" -}}
28+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
29+
{{- end }}
30+
31+
{{/*
32+
Common labels
33+
*/}}
34+
{{- define "firmirror.labels" -}}
35+
helm.sh/chart: {{ include "firmirror.chart" . }}
36+
{{ include "firmirror.selectorLabels" . }}
37+
{{- if .Chart.AppVersion }}
38+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
39+
{{- end }}
40+
app.kubernetes.io/managed-by: {{ .Release.Service }}
41+
{{- end }}
42+
43+
{{/*
44+
Selector labels
45+
*/}}
46+
{{- define "firmirror.selectorLabels" -}}
47+
app.kubernetes.io/name: {{ include "firmirror.name" . }}
48+
app.kubernetes.io/instance: {{ .Release.Name }}
49+
{{- end }}
50+
51+
{{/*
52+
Create the name of the service account to use
53+
*/}}
54+
{{- define "firmirror.serviceAccountName" -}}
55+
{{- if .Values.serviceAccount.create }}
56+
{{- default (include "firmirror.fullname" .) .Values.serviceAccount.name }}
57+
{{- else }}
58+
{{- default "default" .Values.serviceAccount.name }}
59+
{{- end }}
60+
{{- end }}
61+
62+
{{/*
63+
Get the image tag
64+
*/}}
65+
{{- define "firmirror.imageTag" -}}
66+
{{- .Values.image.tag | default .Chart.AppVersion }}
67+
{{- end }}
68+
69+
{{/*
70+
Build the firmirror command arguments
71+
*/}}
72+
{{- define "firmirror.args" -}}
73+
- "refresh"
74+
- {{ .Values.outputDir | quote }}
75+
{{- if .Values.vendors.dell.enabled }}
76+
- "--dell.enable"
77+
{{- if .Values.vendors.dell.machinesId }}
78+
- {{ printf "--dell.machines-id=%s" .Values.vendors.dell.machinesId | quote }}
79+
{{- end }}
80+
{{- end }}
81+
{{- if .Values.vendors.hpe.enabled }}
82+
- "--hpe.enable"
83+
{{- if .Values.vendors.hpe.gens }}
84+
- {{ printf "--hpe.gens=%s" .Values.vendors.hpe.gens | quote }}
85+
{{- end }}
86+
{{- end }}
87+
{{- end }}

‎chart/templates/cronjob.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
apiVersion: batch/v1
2+
kind: CronJob
3+
metadata:
4+
name: {{ include "firmirror.fullname" . }}
5+
labels:
6+
{{- include "firmirror.labels" . | nindent 4 }}
7+
spec:
8+
schedule: {{ .Values.schedule | quote }}
9+
successfulJobsHistoryLimit: {{ .Values.cronjob.successfulJobsHistoryLimit }}
10+
failedJobsHistoryLimit: {{ .Values.cronjob.failedJobsHistoryLimit }}
11+
concurrencyPolicy: Forbid # could cause metadata corruption
12+
jobTemplate:
13+
metadata:
14+
labels:
15+
{{- include "firmirror.selectorLabels" . | nindent 8 }}
16+
spec:
17+
backoffLimit: {{ .Values.cronjob.backoffLimit }}
18+
{{- if .Values.cronjob.activeDeadlineSeconds }}
19+
activeDeadlineSeconds: {{ .Values.cronjob.activeDeadlineSeconds }}
20+
{{- end }}
21+
{{- if .Values.cronjob.ttlSecondsAfterFinished }}
22+
ttlSecondsAfterFinished: {{ .Values.cronjob.ttlSecondsAfterFinished }}
23+
{{- end }}
24+
template:
25+
metadata:
26+
labels:
27+
{{- include "firmirror.selectorLabels" . | nindent 12 }}
28+
{{- with .Values.podLabels }}
29+
{{- toYaml . | nindent 12 }}
30+
{{- end }}
31+
{{- with .Values.podAnnotations }}
32+
annotations:
33+
{{- toYaml . | nindent 12 }}
34+
{{- end }}
35+
spec:
36+
{{- with .Values.imagePullSecrets }}
37+
imagePullSecrets:
38+
{{- toYaml . | nindent 12 }}
39+
{{- end }}
40+
serviceAccountName: {{ include "firmirror.serviceAccountName" . }}
41+
securityContext:
42+
{{- toYaml .Values.podSecurityContext | nindent 12 }}
43+
restartPolicy: {{ .Values.cronjob.restartPolicy }}
44+
containers:
45+
- name: firmirror
46+
securityContext:
47+
{{- toYaml .Values.securityContext | nindent 14 }}
48+
image: "{{ .Values.image.repository }}:{{ include "firmirror.imageTag" . }}"
49+
imagePullPolicy: {{ .Values.image.pullPolicy }}
50+
command: ["/bin/firmirror"]
51+
args:
52+
{{- include "firmirror.args" . | nindent 14 }}
53+
{{- with .Values.env }}
54+
env:
55+
{{- toYaml . | nindent 14 }}
56+
{{- end }}
57+
resources:
58+
{{- toYaml .Values.resources | nindent 14 }}
59+
volumeMounts:
60+
- name: data
61+
mountPath: {{ .Values.outputDir }}
62+
volumes:
63+
- name: data
64+
{{- if .Values.persistence.enabled }}
65+
persistentVolumeClaim:
66+
claimName: {{ .Values.persistence.existingClaim | default (include "firmirror.fullname" .) }}
67+
{{- else }}
68+
emptyDir: {}
69+
{{- end }}

‎chart/templates/pvc.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
2+
apiVersion: v1
3+
kind: PersistentVolumeClaim
4+
metadata:
5+
name: {{ include "firmirror.fullname" . }}
6+
labels:
7+
{{- include "firmirror.labels" . | nindent 4 }}
8+
spec:
9+
accessModes:
10+
- {{ .Values.persistence.accessMode }}
11+
resources:
12+
requests:
13+
storage: {{ .Values.persistence.size }}
14+
{{- if .Values.persistence.storageClass }}
15+
{{- if (eq "-" .Values.persistence.storageClass) }}
16+
storageClassName: ""
17+
{{- else }}
18+
storageClassName: {{ .Values.persistence.storageClass }}
19+
{{- end }}
20+
{{- end }}
21+
{{- end }}

‎chart/templates/serviceaccount.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- if .Values.serviceAccount.create -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "firmirror.serviceAccountName" . }}
6+
labels:
7+
{{- include "firmirror.labels" . | nindent 4 }}
8+
{{- with .Values.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
{{- end }}

0 commit comments

Comments
 (0)