feat: add Helm chart (#379)

Fix #378.

.gitignore

@@ -14,7 +14,7 @@ vendor
 
 # Compiled binaries
 bin/*
-publiccode-crawler
+/publiccode-crawler
 
 # Env
 .env

charts/publiccode-crawler/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/publiccode-crawler/Chart.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v2
+
+name: publiccode-crawler
+description: |
+   publiccode.yml crawler for the Open Source software catalog of Developers Italia
+
+type: application
+
+version: 0.1.0

charts/publiccode-crawler/templates/_helpers.tpl

@@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "publiccode-crawler.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "publiccode-crawler.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "publiccode-crawler.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

charts/publiccode-crawler/templates/cronjob.yaml

@@ -0,0 +1,65 @@
+---
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ template "publiccode-crawler.fullname" . }}
+spec:
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  concurrencyPolicy: Forbid
+  schedule: "{{ .Values.publiccode-crawler.cronjob_schedule }}"
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: "{{ template "publiccode-crawler.fullname" . }}"
+        spec:
+          securityContext:
+            fsGroup: 1000
+
+          containers:
+          - name: {{ template "publiccode-crawler.fullname" . }}
+            image: "{{ .Values.publiccode-crawler.image.repository }}:{{ tpl .Values.publiccode-crawler.image.tag . }}"
+            imagePullPolicy: {{ .Values.publiccode-crawler.image.pullPolicy }}
+
+            command:
+              - /bin/bash
+            args:
+              - -c
+              - ln -sf /secrets-store/k8s-secrets-publiccode-crawler-domains-yml domains.yml && ./start.sh
+
+            volumeMounts:
+            - mountPath: /secrets-store
+              name: secrets-store
+
+            resources:
+              {{- toYaml .Values.publiccode-crawler.resources. | indent 14 }}
+            env:
+              - name: API_BASEURL
+                value: "{{ .Values.publiccode-crawler.env.API_BASEURL}}"
+              - name: MAIN_PUBLISHER_ID
+                value: "{{ .Values.publiccode-crawler.env.MAIN_PUBLISHER_ID }}"
+              - name: SKIP_VITALITY
+                value: "{{ .Values.publiccode-crawler.env.SKIP_VITALITY }}"
+              - name: API_BEARER_TOKEN
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ default (include "publiccode-crawler.fullname" .) .Values.useExistingSecret }}
+                    key: api-bearer-token
+              - name: GITHUB_TOKEN
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ default (include "publiccode-crawler.fullname" .) .Values.useExistingSecret }}
+                    key: github-token
+
+          restartPolicy: Never
+
+          volumes:
+          - name: secrets-store
+            csi:
+              driver: secrets-store.csi.k8s.io
+              readOnly: true
+              volumeAttributes:
+                secretProviderClass: {{ template "publiccode-crawler.fullname" . }}

charts/publiccode-crawler/templates/secret.yaml

@@ -0,0 +1,12 @@
+{{- if not .Values.useExistingSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "publiccode-crawler.fullname" . }}
+  labels:
+    {{- include "publiccode-crawler.labels" . | nindent 4 }}
+type: Opaque
+data:
+  api-bearer-token: {{ .Values.secrets.apiBearerToken | b64enc }}
+  github-token: {{ .Values.secrets.githubToken | b64enc }}
+{{- end }}

charts/publiccode-crawler/values.yaml

@@ -0,0 +1,48 @@
+---
+
+image:
+  repository: docker.io/italia/publiccode-crawler
+  tag: latest
+  pullPolicy: Always
+
+env:
+  # fe. "https://api.developers.italia.it/v1"
+  API_BASEURL:
+
+  # fe. "456123fe-e5ad-41fa-b894-8a021a8ed972"
+  # (https://api.developers.italia.it/v1/publishers/456123fe-e5ad-41fa-b894-8a021a8ed972)
+  MAIN_PUBLISHER_ID:
+
+  SKIP_VITALITY: true
+
+# -- (string) When to run the crawler (cronjob format)
+cronjob_schedule: "0 0 * * *"
+
+# -- (string) Name of existing Kubernetes secret containing 'api-bearer-token'
+# and 'github-token'. If not provided, a secret will be generated using values
+# from 'apiBearerToken' and 'githubToken'.
+useExistingSecret:
+
+secrets:
+  # -- (string) The Developers Italia API compatible PASETO bearer token
+  apiBearerToken:
+  # -- (string) The GitHub token to use for the GitHub API requests
+  githubToken:
+
+resources:
+   # We usually recommend not to specify default resources and to leave this as a conscious
+   # choice for the user. This also increases chances charts run on environments with little
+   # resources, such as Minikube. If you do want to specify resources, uncomment the following
+   # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+   # limits:
+   #   cpu: 100m
+   #   memory: 128Mi
+   # requests:
+   #   cpu: 100m
+   #   memory: 128Mi
+
+nodeSelector: {}
+
+tolerations: {}
+
+affinity: {}