Create a single Helm package for dracon-dev and relevant make targets

This commit unifies the installation of dracon-dev and its dependencies
via one single helm package. It installs all necessary dependencies for
development such as Elasticsearch, Kibana, Postgres, Mongo and Tekton.
Dependencies that need to be installed on a namespace different than the
dracon components such as Tekton, Nginx, ElasticOperator and ArangoDB are
installed via Make targets.

This commit also refactors Make targets introducing `deploy-dracon-dev`
which builds and loads dracon container images and installs the helm
chart.

Last this commit runs the necessary dracon migrations job as a helm
post-install hook

Makefile

@@ -184,37 +184,6 @@ deploy-elasticoperator: add-es-helm-repo
 		--create-namespace \
 		--version=$(ES_OPERATOR_VERSION)
 
-deploy-elasticsearch: deploy-elasticoperator
-	@helm upgrade dracon-es deploy/elasticsearch/ \
-		--install \
-		--set version=$(ES_VERSION) \
-		--namespace $(DRACON_NS) \
-		--create-namespace
-
-deploy-kibana: deploy-elasticsearch
-	@helm upgrade dracon-kb deploy/kibana/ \
-		--install \
-		--set version=$(ES_VERSION) \
-		--set es_name=dracon-es-elasticsearch \
-		--namespace $(DRACON_NS) \
-		--version $(ES_VERSION)
-
-deploy-mongodb:
-	@helm upgrade consumer-mongodb https://charts.bitnami.com/bitnami/mongodb-$(MONGODB_VERSION).tgz \
-		--install \
-		--namespace $(DRACON_NS) \
-		--create-namespace \
-		--set "auth.usernames[0]=consumer-mongodb" \
-		--set "auth.passwords[0]=consumer-mongodb" \
-		--set "auth.databases[0]=consumer-mongodb"
-
-deploy-pg:
-	@helm upgrade pg https://charts.bitnami.com/bitnami/postgresql-$(PG_VERSION).tgz \
-		--install \
-		--namespace $(DRACON_NS) \
-		--create-namespace \
-		--values=deploy/enrichment-db/values.yaml
-
 deploy/tektoncd/pipeline/release-v$(TEKTON_VERSION).yaml:
 	@wget "https://storage.googleapis.com/tekton-releases/pipeline/previous/v$(TEKTON_VERSION)/release.yaml" -O $@
 
@@ -239,4 +208,24 @@ deploy-tektoncd-dashboard: tektoncd-dashboard-helm
 		--values ./deploy/tektoncd/dashboard/values.yaml \
 		--namespace $(TEKTON_NS)
 
-dev-deploy: deploy-nginx deploy-arangodb deploy-kibana deploy-mongodb deploy-pg deploy-tektoncd-pipeline deploy-tektoncd-dashboard
+deploy-dracon-dev: deploy-elasticoperator
+	make draconctl-image-publish CONTAINER_REPO=localhost:5000/ocurity/dracon
+	@helm upgrade dracon ./deploy/dracon/ \
+	 	  --install \
+		  --values ./deploy/dracon/values.dev.yaml \
+		  --create-namespace \
+		  --namespace $(DRACON_NS) \
+		  --set "global.image.draconVersion=$(DRACON_VERSION)"
+		  --wait
+
+dev-deploy: 
+	make deploy-nginx
+	make deploy-arangodb
+	make deploy-tektoncd-pipeline
+	make deploy-tektoncd-dashboard
+	make deploy-dracon-dev
+
+dev-teardown:
+	kind delete clusters dracon-demo
+dev: 
+	./scripts/kind-with-registry.sh

deploy/dracon/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

deploy/dracon/Chart.lock

@@ -0,0 +1,15 @@
+dependencies:
+- name: postgresql
+  repository: https://charts.bitnami.com/bitnami
+  version: 15.2.5
+- name: mongodb
+  repository: https://charts.bitnami.com/bitnami
+  version: 15.1.5
+- name: elasticsearch
+  repository: file://../elasticsearch
+  version: 0.1.0
+- name: kibana
+  repository: file://../kibana
+  version: 0.1.0
+digest: sha256:a9bd592c24509f294eae3b9415f420b6ec7de9a141d2ba410b7eb7602e866961
+generated: "2024-04-26T18:23:56.800279848+01:00"

deploy/dracon/Chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v2
+name: dracon
+description: A Helm chart for Kubernetes
+type: application
+version: 0.1.0
+appVersion: "0.1.0"
+dependencies:
+  - name: postgresql
+    version: 15.2.5
+    repository: https://charts.bitnami.com/bitnami
+    condition: postgres.enabled
+  - name: mongodb
+    version: 15.1.5
+    repository: https://charts.bitnami.com/bitnami
+    condition: mongodb.enabled
+  - name: elasticsearch
+    version: 0.1.0
+    repository: file://../elasticsearch
+    condition: elasticsearch.enabled
+  - name: kibana
+    version: 0.1.0
+    repository: file://../kibana
+    condition: kibana.enabled

deploy/dracon/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "dracon-migrations.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "dracon-migrations.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "dracon-migrations.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "dracon-migrations.labels" -}}
+helm.sh/chart: {{ include "dracon-migrations.chart" . }}
+{{ include "dracon-migrations.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "dracon-migrations.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "dracon-migrations.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "dracon-migrations.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "dracon-migrations.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

deploy/dracon/templates/job.yaml

@@ -0,0 +1,29 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{.Release.Name}}"
+  namespace: "{{.Values.namespace }}"
+  labels:
+    app.kubernetes.io/managed-by: {{.Release.Service | quote }}
+    app.kubernetes.io/instance: {{.Release.Name | quote }}
+    helm.sh/chart: "{{.Chart.Name}}-{{.Chart.Version}}"
+  annotations:
+    # This is what defines this resource as a hook. Without this line, the
+    # job is considered part of the release.
+    "helm.sh/hook": post-install
+    "helm.sh/hook-weight": "-5"
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  template:
+    metadata:
+      name: dracon-migrations
+      labels:
+        app.kubernetes.io/managed-by: {{.Release.Service | quote }}
+        app.kubernetes.io/instance: {{.Release.Name | quote }}
+        helm.sh/chart: "{{.Chart.Name}}-{{.Chart.Version}}"
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: dracon-migrations
+        image: {{.Values.global.image.registry}}/ocurity/dracon/draconctl:{{.Values.global.image.draconVersion|default "latest"}}
+        command: ["draconctl","migrations","apply","--url", {{.Values.global.enrichmentDB.connectionStr | quote}},"/etc/dracon/migrations/enrichment"]

deploy/dracon/role.yaml → deploy/dracon/templates/role.yaml

@@ -2,6 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: dracon-migrations
+  namespace: "{{.Values.namespace }}"
 rules:
 - apiGroups:
   - coordination.k8s.io

deploy/dracon/rolebinding.yaml → deploy/dracon/templates/rolebinding.yaml

@@ -2,6 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: dracon-migrations
+  namespace: "{{.Values.namespace }}"
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role

deploy/dracon/serviceaccount.yaml → deploy/dracon/templates/serviceaccount.yaml

@@ -2,3 +2,4 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: dracon-migrations
+  namespace: "{{.Values.namespace }}"

deploy/dracon/values.dev.yaml

@@ -0,0 +1,38 @@
+
+elasticsearch:
+  enabled: true
+  version: 8.3.2
+
+kibana:
+  enabled: true
+  version: 8.3.2
+
+mongodb:
+    enabled: true
+    # auth:
+    #   enabled: true
+    #   usernames: ["consumer-mongodb"]
+    #   passwords: ["consumer-mongodb"]
+    #   databases: ["consumer-mongodb"]
+    #   rootUser: "consumer-mongodb"
+    #   rootPassword: "consumer-mongodb"
+
+postgresql:
+  enabled: true
+  auth:
+    username: dracon
+    password: dracon
+    database: dracon
+    postgresPassword: dracon
+  fullnameOverride: dracon-enrichment-db
+
+tekton:
+  enabled: true
+
+global:
+  namespace: dracon
+  image:
+    registry: kind-registry:5000
+    draconVersion: "0.1.0"
+  enrichmentDB:
+    connectionStr: postgresql://dracon:[email protected]?sslmode=disable

deploy/elasticsearch/templates/deployment.yaml

@@ -7,8 +7,8 @@ metadata:
   labels:
     {{- include "elasticsearch.labels" . | nindent 4 }}
 spec:
-  version: {{ .Values.version }}
-  image: docker.elastic.co/elasticsearch/elasticsearch:{{ .Values.version }}
+  version: {{.Values.version}}
+  image: docker.elastic.co/elasticsearch/elasticsearch:{{.Values.version}}
   http:
     tls:
       selfSignedCertificate:

deploy/kibana/Chart.yaml

@@ -1,24 +1,6 @@
 apiVersion: v2
 name: kibana
 description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
 type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
 version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
 appVersion: "1.16.0"

deploy/kibana/templates/deployment.yaml

@@ -12,8 +12,6 @@ spec:
   count: 1
   elasticsearchRef:
     name: {{ .Values.es_name }}
-  # config:
-  #   xpack.security.enabled: false
   http:
     tls:
       selfSignedCertificate: