From 6068b599416b843aca5eae5f5f9062c9b42c5c95 Mon Sep 17 00:00:00 2001 From: Ryan Draga Date: Thu, 5 Nov 2026 00:59:38 -0500 Subject: [PATCH] Setting further sane chart defaults --- .github/workflows/ci.yml | 14 --------- README.md | 6 ++-- .../helm/squirrelbot/templates/_helpers.tpl | 16 ++++++++-- .../squirrelbot/templates/deployment.yaml | 6 ++-- .../helm/squirrelbot/templates/postgres.yaml | 7 ++++- .../helm/squirrelbot/templates/service.yaml | 6 +++- deploy/helm/squirrelbot/values.yaml | 30 ++----------------- 7 files changed, 33 insertions(+), 52 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0e3abdd..f85fe92 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -310,7 +310,6 @@ jobs: if: steps.gate.outputs.skip != 'true' && steps.version.outputs.skip != 'true' env: VERSION: ${{ steps.version.outputs.version }} - IMAGE: ${{ steps.version.outputs.image }} run: | set -euo pipefail chart="${RUNNER_TEMP}/squirrelbot" @@ -321,7 +320,6 @@ jobs: from pathlib import Path version = os.environ["VERSION"] - image = os.environ["IMAGE"] root = Path(os.environ["CHART_DIR"]) chart = root / "Chart.yaml" @@ -338,18 +336,6 @@ jobs: if not saw_version or not saw_app: raise SystemExit("Chart.yaml is missing version or appVersion") chart.write_text("\n".join(lines) + "\n") - - values = root / "values.yaml" - lines = values.read_text().splitlines() - found = False - for i, line in enumerate(lines): - if line.startswith(" repository:"): - lines[i] = f" repository: {image}" - found = True - break - if not found: - raise SystemExit("image.repository is missing from values.yaml") - values.write_text("\n".join(lines) + "\n") PY helm package "$chart" --destination dist ( diff --git a/README.md b/README.md index 9eefe66..ca71cea 100644 --- a/README.md +++ b/README.md @@ -67,14 +67,14 @@ The chart is `deploy/helm/squirrelbot`. It runs one replica with the Recreate st ```sh helm upgrade --install squirrelbot deploy/helm/squirrelbot \ --set publicUrl=https://mod.example.com \ - --set secrets.databaseUrl='postgres://squirrelbot:PASSWORD@db:5432/squirrelbot?sslmode=disable' \ + --set secrets.databaseUrl='postgres://squirrelbot:PASSWORD@db:5432/squirrelbot' \ --set secrets.discordToken=TOKEN \ --set secrets.discordClientId=CLIENT_ID \ --set secrets.discordClientSecret=CLIENT_SECRET \ --set secrets.sessionSecret=AT_LEAST_32_RANDOM_CHARACTERS ``` -Set `postgres.bundled=true` and `postgres.auth.password` to start a bundled Postgres StatefulSet. That database is for a single cluster and a small server. Use an external Postgres for anything you need to restore. `postgres.sslMode` sets the libpq mode on `DATABASE_URL` when the chart writes that URL. The default is `disable`. An `sslmode` already present in `secrets.databaseUrl` is left as written. +Set `postgres.bundled=true` and `postgres.auth.password` to start a bundled Postgres StatefulSet. That database is for a single cluster and a small server. Use an external Postgres for anything you need to restore. `postgres.sslMode` sets the libpq mode on `DATABASE_URL` when the chart writes that URL. Bundled Postgres uses `disable`. An external database uses `require`. An `sslmode` already present in `secrets.databaseUrl` is left as written. `make image` builds `squirrelbot:latest` and the next patch version from the repository root. The first build is one patch above the chart app version. Later builds increment the patch again. The last version is stored in `build/image-version`. Set `imagePullSecrets` when the registry is private. @@ -90,7 +90,7 @@ Each release includes: - The image `ghcr.io/boxingoctopuscreative/squirrelbot`, tagged with the version and with `latest`. - The Helm chart, attached to the GitHub release and published to `oci://ghcr.io/boxingoctopuscreative/charts/squirrelbot`. Each release also carries an `index.yaml`, so Helm can add the release archive as a chart repository. -The published chart uses that GHCR image. The chart in this repository keeps the local image name `squirrelbot`, which matches `make image`. Install the published chart with the same `--set` values as the local chart, and set `--version` to the release you want. +The chart pulls `ghcr.io/boxingoctopuscreative/squirrelbot`. `make image` builds the local name `squirrelbot`. Set `image.repository=squirrelbot` to use that image. Install the published chart with the same `--set` values as the local chart, and set `--version` to the release you want. ```sh helm repo add squirrelbot https://github.com/BoxingOctopusCreative/SquirrelBot/releases/latest/download diff --git a/deploy/helm/squirrelbot/templates/_helpers.tpl b/deploy/helm/squirrelbot/templates/_helpers.tpl index c2fec63..b69eb48 100644 --- a/deploy/helm/squirrelbot/templates/_helpers.tpl +++ b/deploy/helm/squirrelbot/templates/_helpers.tpl @@ -29,12 +29,22 @@ {{- end }} {{- define "squirrelbot.image" -}} -{{- $tag := .Values.image.tag | default "latest" }} -{{- printf "%s:%s" .Values.image.repository $tag }} +{{- $image := .Values.image | default dict }} +{{- $repository := $image.repository | default "ghcr.io/boxingoctopuscreative/squirrelbot" }} +{{- $tag := $image.tag | default "latest" }} +{{- printf "%s:%s" $repository $tag }} {{- end }} {{- define "squirrelbot.sslMode" -}} -{{- $mode := .Values.postgres.sslMode | default "disable" -}} +{{- $postgres := .Values.postgres | default dict -}} +{{- $mode := $postgres.sslMode -}} +{{- if not $mode -}} +{{- if $postgres.bundled -}} +{{- $mode = "disable" -}} +{{- else -}} +{{- $mode = "require" -}} +{{- end -}} +{{- end -}} {{- $allowed := list "disable" "allow" "prefer" "require" "verify-ca" "verify-full" -}} {{- if not (has $mode $allowed) -}} {{- fail "postgres.sslMode must be disable, allow, prefer, require, verify-ca, or verify-full" -}} diff --git a/deploy/helm/squirrelbot/templates/deployment.yaml b/deploy/helm/squirrelbot/templates/deployment.yaml index 5641cc6..fc17ddb 100644 --- a/deploy/helm/squirrelbot/templates/deployment.yaml +++ b/deploy/helm/squirrelbot/templates/deployment.yaml @@ -34,7 +34,7 @@ spec: containers: - name: squirrelbot image: {{ include "squirrelbot.image" . | quote }} - imagePullPolicy: {{ .Values.image.pullPolicy | default "IfNotPresent" }} + imagePullPolicy: {{ ((.Values.image | default dict).pullPolicy) | default "IfNotPresent" }} ports: - name: http containerPort: 8080 @@ -64,7 +64,9 @@ spec: initialDelaySeconds: 10 periodSeconds: 20 resources: - {{- toYaml .Values.resources | nindent 12 }} + {{- $defaults := dict "requests" (dict "cpu" "50m" "memory" "64Mi") "limits" (dict "memory" "256Mi") }} + {{- $set := .Values.resources | default dict }} + {{- toYaml (mergeOverwrite (deepCopy $defaults) $set) | nindent 12 }} volumes: - name: tmp emptyDir: {} diff --git a/deploy/helm/squirrelbot/templates/postgres.yaml b/deploy/helm/squirrelbot/templates/postgres.yaml index 7caf5ba..c1422aa 100644 --- a/deploy/helm/squirrelbot/templates/postgres.yaml +++ b/deploy/helm/squirrelbot/templates/postgres.yaml @@ -74,7 +74,12 @@ spec: command: ["pg_isready", "-U", {{ .Values.postgres.auth.username | quote }}] periodSeconds: 10 resources: - {{- toYaml .Values.postgres.resources | nindent 12 }} + {{- $defaults := dict "requests" (dict "cpu" "50m" "memory" "128Mi") "limits" (dict "memory" "512Mi") }} + {{- $set := dict }} + {{- if .Values.postgres }} + {{- $set = .Values.postgres.resources | default dict }} + {{- end }} + {{- toYaml (mergeOverwrite (deepCopy $defaults) $set) | nindent 12 }} volumeClaimTemplates: - metadata: name: data diff --git a/deploy/helm/squirrelbot/templates/service.yaml b/deploy/helm/squirrelbot/templates/service.yaml index efe170c..6903e60 100644 --- a/deploy/helm/squirrelbot/templates/service.yaml +++ b/deploy/helm/squirrelbot/templates/service.yaml @@ -12,5 +12,9 @@ spec: app.kubernetes.io/instance: {{ .Release.Name }} ports: - name: http - port: {{ .Values.service.port }} + {{- if .Values.service }} + port: {{ .Values.service.port | default 8080 }} + {{- else }} + port: 8080 + {{- end }} targetPort: http diff --git a/deploy/helm/squirrelbot/values.yaml b/deploy/helm/squirrelbot/values.yaml index 24be6f2..da99b87 100644 --- a/deploy/helm/squirrelbot/values.yaml +++ b/deploy/helm/squirrelbot/values.yaml @@ -1,19 +1,8 @@ -nameOverride: "" -fullnameOverride: "" - -image: - repository: squirrelbot - tag: latest - pullPolicy: IfNotPresent - imagePullSecrets: [] # The Discord gateway allows one session per bot token. The Deployment # hardcodes replicas to 1 and uses Recreate. Do not scale this chart. -service: - port: 8080 - publicUrl: "" existingSecret: "" @@ -41,23 +30,14 @@ ingress: certResolver: letsencrypt tlsSecretName: squirrelbot-tls -resources: - requests: - cpu: 50m - memory: 64Mi - limits: - memory: 256Mi - # bundled starts a Postgres StatefulSet for this release. # Leave it false and set secrets.databaseUrl for an external database. # sslMode is the libpq mode: disable, allow, prefer, require, # verify-ca, or verify-full. The bundled server does not terminate -# TLS, so leave sslMode at disable for that database. For an external -# database, an sslmode already in secrets.databaseUrl is kept. When -# that URL omits sslmode, the chart adds this value. +# TLS, so that database uses disable. An external database uses +# require. An sslmode already in secrets.databaseUrl is kept. postgres: bundled: false - sslMode: disable image: postgres:16-alpine auth: database: squirrelbot @@ -66,9 +46,3 @@ postgres: persistence: size: 8Gi storageClass: "" - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - memory: 512Mi