diff --git a/charts/boday-it/Chart.yaml b/charts/boday-it/Chart.yaml new file mode 100644 index 0000000..bf1bfd8 --- /dev/null +++ b/charts/boday-it/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: boday-it +description: Helm Chart für die Django-Webseite von Boday-IT +type: application +version: 1.0.0 +appVersion: "1.0.0" diff --git a/charts/boday-it/templates/db-service.yaml b/charts/boday-it/templates/db-service.yaml new file mode 100644 index 0000000..39b04c5 --- /dev/null +++ b/charts/boday-it/templates/db-service.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }}-db +spec: + ports: + - port: 5432 + selector: + app: {{ .Release.Name }}-db diff --git a/charts/boday-it/templates/db-statefulset.yaml b/charts/boday-it/templates/db-statefulset.yaml new file mode 100644 index 0000000..60d7bd9 --- /dev/null +++ b/charts/boday-it/templates/db-statefulset.yaml @@ -0,0 +1,42 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ .Release.Name }}-db +spec: + serviceName: {{ .Release.Name }}-db + replicas: 1 + selector: + matchLabels: + app: {{ .Release.Name }}-db + template: + metadata: + labels: + app: {{ .Release.Name }}-db + spec: + containers: + - name: postgres + image: postgres:15-alpine + env: + - name: POSTGRES_DB + value: {{ .Values.postgres.database | quote }} + - name: POSTGRES_USER + value: {{ .Values.postgres.user | quote }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-secrets + key: postgres-password + ports: + - containerPort: 5432 + name: dbport + volumeMounts: + - name: db-data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: db-data + spec: + accessModes: [ "ReadWriteOnce" ] + resources: + requests: + storage: {{ .Values.postgres.storageSize }} diff --git a/charts/boday-it/templates/ingress.yaml b/charts/boday-it/templates/ingress.yaml new file mode 100644 index 0000000..fc97105 --- /dev/null +++ b/charts/boday-it/templates/ingress.yaml @@ -0,0 +1,44 @@ +apiVersion: kubernetes.io/ingress.v1 +kind: Ingress +metadata: + name: {{ .Release.Name }}-ingress + annotations: + kubernetes.io/ingress.class: "nginx" +spec: + rules: + - host: boday-it.ch + http: + paths: + # Statische Dateien gehen an den Nginx-Sidecar (Port 80) + - path: /static + pathType: Prefix + backend: + service: + name: {{ .Release.Name }}-web + port: + name: static + # Alles andere geht direkt an Django (Port 8000) + - path: / + pathType: Prefix + backend: + service: + name: {{ .Release.Name }}-web + port: + name: django + - host: www.boday-it.ch + http: + paths: + - path: /static + pathType: Prefix + backend: + service: + name: {{ .Release.Name }}-web + port: + name: static + - path: / + pathType: Prefix + backend: + service: + name: {{ .Release.Name }}-web + port: + name: django diff --git a/charts/boday-it/templates/secrets.yaml b/charts/boday-it/templates/secrets.yaml new file mode 100644 index 0000000..153510c --- /dev/null +++ b/charts/boday-it/templates/secrets.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Release.Name }}-secrets +type: Opaque +data: + django-secret-key: {{ .Values.secrets.djangoSecretKey | b64enc | quote }} + postgres-password: {{ .Values.secrets.postgresPassword | b64enc | quote }} diff --git a/charts/boday-it/templates/web-deployment.yaml b/charts/boday-it/templates/web-deployment.yaml new file mode 100644 index 0000000..f93c7b0 --- /dev/null +++ b/charts/boday-it/templates/web-deployment.yaml @@ -0,0 +1,72 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }}-web +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ .Release.Name }}-web + template: + metadata: + labels: + app: {{ .Release.Name }}-web + spec: + # 1. INIT-CONTAINER: Sammelt statische Dateien beim Pod-Start + initContainers: + - name: collectstatic + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: ["/bin/sh", "-c", "python manage.py collectstatic --noinput"] + env: + - name: DEBUG + value: {{ .Values.django.debug | quote }} + - name: SECRET_KEY + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-secrets + key: django-secret-key + volumeMounts: + - name: static-assets + mountPath: /code/staticfiles + + containers: + # 2. HAUPT-CONTAINER: Django / Gunicorn + - name: django + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: ["gunicorn", "boday_it.wsgi:application", "--bind", "0.0.0.0:8000"] + env: + - name: DEBUG + value: {{ .Values.django.debug | quote }} + - name: ALLOWED_HOSTS + value: {{ .Values.django.allowedHosts | quote }} + - name: SECRET_KEY + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-secrets + key: django-secret-key + - name: DATABASE_URL + value: "postgres://{{ .Values.postgres.user }}:$(POSTGRES_PASSWORD)@{{ .Release.Name }}-db:5432/{{ .Values.postgres.database }}" + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-secrets + key: postgres-password + ports: + - containerPort: 8000 + name: webport + + # 3. SIDECAR-CONTAINER: Nginx für superschnelles Static-Asset Delivery + - name: nginx-static + image: nginx:alpine + volumeMounts: + - name: static-assets + mountPath: /usr/share/nginx/html/static + ports: + - containerPort: 80 + name: staticport + + volumes: + - name: static-assets + emptyDir: {} diff --git a/charts/boday-it/templates/web-service.yaml b/charts/boday-it/templates/web-service.yaml new file mode 100644 index 0000000..3bd02d0 --- /dev/null +++ b/charts/boday-it/templates/web-service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }}-web +spec: + ports: + - port: 8000 + name: django + - port: 80 + name: static + selector: + app: {{ .Release.Name }}-web diff --git a/charts/boday-it/values.yaml b/charts/boday-it/values.yaml new file mode 100644 index 0000000..0b922a3 --- /dev/null +++ b/charts/boday-it/values.yaml @@ -0,0 +1,20 @@ +replicaCount: 1 + +image: + repository: registry.local/bast/boday-it-web + tag: latest + pullPolicy: Always + +django: + debug: "0" + allowedHosts: "boday-it.ch,www.boday-it.ch,localhost,127.0.0.1" + +# Diese Werte werden im Secret verschlüsselt +secrets: + djangoSecretKey: "aldhguroqugaplslljdgzlshfz" + postgresPassword: "asafdksdf" + +postgres: + database: "djangodb" + user: "djangouser" + storageSize: 1Gi diff --git a/main.tf b/main.tf new file mode 100644 index 0000000..98fb810 --- /dev/null +++ b/main.tf @@ -0,0 +1,46 @@ +terraform { + required_providers { + kubernetes = { + source = "hashicorp/kubernetes" + version = "~> 2.26" + } + helm = { + source = "hashicorp/helm" + version = "~> 2.12" + } + } +} + +# Variable für den dynamischen Git-SHA-Tag deiner Pipeline +variable "app_version" { + type = string + default = "latest" +} + +provider "kubernetes" { + config_path = "./kind_kubeconfig" + host = "https://local-k3s-platform:6443" + insecure = true +} + +provider "helm" { + kubernetes { + config_path = "./kind_kubeconfig" + host = "https://local-k3s-platform:6443" + insecure = true + } +} + +# DAS FINALE DJANGO HELM-CHART DEPLOYMENT +resource "helm_release" "boday_website" { + name = "boday-it" + chart = "./charts/boday-it" # Zeigt direkt auf den lokalen Chart-Ordner im Repo + namespace = "default" + + # Überschreibt das Image-Tag dynamisch mit der aktuellen Pipeline-Version + set { + name = "image.tag" + value = var.app_version + } +} +