Skip to content

Commit 5cdf18e

Browse files
emmanuelmathotsunu
emmanuelmathot
and
sunu
authored
Refactor Helm Chart to Service-Specific Templates (#220)
* Refactor PostgreSQL configuration and remove deprecated database setup - Introduced a unified PostgreSQL configuration structure in values.yaml, replacing the old db configuration. - Added new helper functions for managing PostgreSQL environment variables and secrets based on the selected configuration type (postgrescluster, external-plaintext, external-secret). - Removed old database-related templates (ConfigMap, Deployment, PVC, Secrets, Service) that are no longer needed. - Updated the pgstacbootstrap job and configmap templates to align with the new PostgreSQL configuration. - Implemented validation for PostgreSQL settings to ensure required fields are set based on the selected type. * Add PostgreSQL host reader and writer environment variables, and include DATABASE_URL for connection string * Added a clarifying comment in values.yaml to explain that values in the external secret (host, port, database) will override the corresponding values defined in external.host, external.port, and external.database. Confirmed that the conditional blocks in deployment.yaml were already consolidated to eliminate redundancy. The file was already using a single include statement for PostgreSQL environment variables: env: {{- include "eoapi.postgresqlEnv" $ | nindent 12 }} Removed the unused eoapi.mapLegacyPostgresql helper function from _helpers.tpl as it wasn't being referenced anywhere in the codebase. * Refactor: Implement unified ingress configuration for nginx and traefik, streamline values.yaml, and update related documentation and tests * Remove deprecated ingress backup template from helm chart * Enhance ingress configuration in test values for Traefik with path transformation annotations * Add Traefik middleware for path rewriting and update ingress annotations * Refactor: Update Traefik ingress annotations to use middleware for path rewriting * Remove Traefik ingress annotations for entrypoints and middlewares in test cases * Add init container for pgstac migration and loading samples in deployment * Add command to retrieve and describe Traefik middleware in CI workflow * Refactor ingress configuration for Traefik and NGINX; add host for TLS support and remove deprecated middleware * Add Traefik middleware annotation for ingress tests * Add Traefik entrypoint annotation to ingress configuration * Add temporary annotation for Traefik to support ASGI prefix handling * Remove testing condition from doc-server ConfigMap template * Update Traefik service IP address to use local endpoint in helm-tests workflow * Remove hardcoded service account name from deployment template * Refactor code structure for improved readability and maintainability * Refactor service templates and tests for improved organization and clarity * Refactor Helm chart tests: Split service tests into individual files for raster, stac, vector, and multidim services; update deployment and configmap tests for backward compatibility; adjust ingress and HPA tests; clean up unused configurations in test.yaml. * Add template references to service tests for multidim, raster, stac, and vector * Refactor Helm chart to support service-specific ingress configurations for raster, stac, vector, and multidim services; enhance readability and maintainability. * Update helm-chart/eoapi/templates/services/multidim/hpa.yaml Co-authored-by: Tarashish Mishra <sunu@users.noreply.github.com> * Update helm-chart/eoapi/templates/services/raster/hpa.yaml Co-authored-by: Tarashish Mishra <sunu@users.noreply.github.com> * Update helm-chart/eoapi/templates/services/vector/hpa.yaml Co-authored-by: Tarashish Mishra <sunu@users.noreply.github.com> * Implement STAC Auth Proxy integration with EOAPI-K8S for service-specific ingress control - Added documentation for STAC Auth Proxy integration - Configured service-specific ingress settings in values.yaml - Updated ingress template to conditionally include STAC service paths - Provided deployment guide and network flow diagram - Included testing and troubleshooting sections for configuration verification * Update helm-chart/eoapi/templates/services/stac/hpa.yaml Co-authored-by: Tarashish Mishra <sunu@users.noreply.github.com> --------- Co-authored-by: Tarashish Mishra <sunu@users.noreply.github.com>
1 parent c7176cf commit 5cdf18e

35 files changed

+1227
-466
lines changed

‎docs/stac-auth-proxy.md‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# STAC Auth Proxy Integration with EOAPI-K8S
2+
3+
## Solution Overview
4+
5+
We have implemented support for STAC Auth Proxy integration with EOAPI-K8S through service-specific ingress control. This feature allows the STAC service to be accessible only internally while other services remain externally available.
6+
7+
## Implementation Details
8+
9+
### 1. Service-Specific Ingress Control
10+
11+
Each service can now independently control its ingress settings via the values.yaml configuration:
12+
13+
```yaml
14+
stac:
15+
enabled: true
16+
ingress:
17+
enabled: false # Disable external ingress for STAC only
18+
19+
# Other services remain externally accessible
20+
raster:
21+
enabled: true
22+
ingress:
23+
enabled: true
24+
```
25+
26+
### 2. Template Changes
27+
28+
The ingress template now checks service-specific settings:
29+
30+
```yaml
31+
{{- if and .Values.stac.enabled (or (not (hasKey .Values.stac "ingress")) .Values.stac.ingress.enabled) }}
32+
- pathType: {{ .Values.ingress.pathType }}
33+
path: /stac{{ .Values.ingress.pathSuffix }}
34+
backend:
35+
service:
36+
name: stac
37+
port:
38+
number: {{ .Values.service.port }}
39+
{{- end }}
40+
```
41+
42+
This ensures:
43+
- Service paths are only included if the service and its ingress are enabled
44+
- Backward compatibility is maintained (ingress enabled by default)
45+
- Clean separation of service configurations
46+
47+
## Deployment Guide
48+
49+
### 1. Configure EOAPI-K8S
50+
51+
```yaml
52+
# values.yaml for eoapi-k8s
53+
stac:
54+
enabled: true
55+
ingress:
56+
enabled: false # No external ingress for STAC
57+
58+
# Other services remain externally accessible
59+
raster:
60+
enabled: true
61+
vector:
62+
enabled: true
63+
multidim:
64+
enabled: true
65+
```
66+
67+
### 2. Deploy STAC Auth Proxy
68+
69+
Deploy the stac-auth-proxy Helm chart in the same namespace:
70+
71+
```yaml
72+
# values.yaml for stac-auth-proxy
73+
backend:
74+
service: stac # Internal K8s service name
75+
port: 8080 # Service port
76+
77+
auth:
78+
# Configure authentication settings
79+
provider: oauth2
80+
# ... other auth settings
81+
```
82+
83+
### 3. Network Flow
84+
85+
```mermaid
86+
graph LR
87+
A[External Request] --> B[STAC Auth Proxy]
88+
B -->|Authentication| C[Internal STAC Service]
89+
D[External Request] -->|Direct Access| E[Raster/Vector/Other Services]
90+
```
91+
92+
## Testing
93+
94+
Verify the configuration:
95+
96+
```bash
97+
# Check that STAC paths are excluded
98+
helm template eoapi --set stac.ingress.enabled=false,stac.enabled=true -f values.yaml
99+
100+
# Verify other services remain accessible
101+
kubectl get ingress
102+
kubectl get services
103+
```
104+
105+
Expected behavior:
106+
- STAC service accessible only within the cluster
107+
- Other services (raster, vector, etc.) accessible via their ingress paths
108+
- Auth proxy successfully routing authenticated requests to STAC
109+
110+
## Troubleshooting
111+
112+
1. **STAC Service Not Accessible Internally**
113+
- Verify service is running: `kubectl get services`
114+
- Check service port matches auth proxy configuration
115+
- Verify network policies allow proxy-to-STAC communication
116+
117+
2. **Other Services Affected**
118+
- Confirm ingress configuration for other services
119+
- Check ingress controller logs
120+
- Verify service-specific settings in values.yaml
121+
122+
## Additional Notes
123+
124+
- The solution leverages Kubernetes service discovery for internal communication
125+
- No changes required to the STAC service itself
126+
- Zero downtime deployment possible
127+
- Existing deployments without auth proxy remain compatible

‎helm-chart/eoapi/.helmignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,5 @@
2222
*.tmproj
2323
.vscode/
2424
tests/
25+
# Ignore all README.md in all subdirectories
26+
README.md

‎helm-chart/eoapi/templates/services/README.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Service-Specific Templates
2+
3+
This directory contains service-specific templates organized to improve readability, maintainability, and flexibility.
4+
5+
## Directory Structure
6+
7+
```
8+
services/
9+
├── _common.tpl # Limited common helper functions
10+
├── ingress.yaml # Single shared ingress for all services
11+
├── raster/ # Raster service templates
12+
│ ├── deployment.yaml # Deployment definition
13+
│ ├── service.yaml # Service definition
14+
│ ├── configmap.yaml # ConfigMap definition
15+
│ └── hpa.yaml # HorizontalPodAutoscaler definition
16+
├── stac/ # STAC service templates
17+
│ ├── deployment.yaml
18+
│ ├── service.yaml
19+
│ ├── configmap.yaml
20+
│ └── hpa.yaml
21+
├── vector/ # Vector service templates
22+
│ ├── deployment.yaml
23+
│ ├── service.yaml
24+
│ ├── configmap.yaml
25+
│ └── hpa.yaml
26+
└── multidim/ # Multidimensional service templates
27+
├── deployment.yaml
28+
├── service.yaml
29+
├── configmap.yaml
30+
└── hpa.yaml
31+
```
32+
33+
## Common Helpers
34+
35+
The `_common.tpl` file provides limited helper functions for truly common elements:
36+
37+
- `eoapi.mountServiceSecrets`: For mounting service secrets
38+
- `eoapi.commonEnvVars`: For common environment variables like SERVICE_NAME, RELEASE_NAME, GIT_SHA
39+
- `eoapi.pgstacInitContainers`: For init containers that wait for pgstac jobs
40+
41+
For database environment variables, we leverage the existing `eoapi.postgresqlEnv` helper from the main `_helpers.tpl` file.
42+
43+
## Usage
44+
45+
No changes to `values.yaml` structure were required. The chart maintains full backward compatibility with existing deployments.

‎helm-chart/eoapi/templates/services/_common.tpl‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{/*
2+
Helper function for mounting service secrets
3+
Only extract truly common elements that are mechanical and don't need customization
4+
*/}}
5+
{{- define "eoapi.mountServiceSecrets" -}}
6+
{{- $service := .service -}}
7+
{{- $root := .root -}}
8+
{{- if index $root.Values $service "settings" "envSecrets" }}
9+
{{- range $secret := index $root.Values $service "settings" "envSecrets" }}
10+
- secretRef:
11+
name: {{ $secret }}
12+
{{- end }}
13+
{{- end }}
14+
{{- end -}}
15+
16+
{{/*
17+
Helper function for common environment variables
18+
*/}}
19+
{{- define "eoapi.commonEnvVars" -}}
20+
{{- $service := .service -}}
21+
{{- $root := .root -}}
22+
- name: SERVICE_NAME
23+
value: {{ $service | quote }}
24+
- name: RELEASE_NAME
25+
value: {{ $root.Release.Name | quote }}
26+
- name: GIT_SHA
27+
value: {{ $root.Values.gitSha | quote }}
28+
{{- end -}}
29+
30+
{{/*
31+
Helper function for common init containers to wait for pgstac jobs
32+
*/}}
33+
{{- define "eoapi.pgstacInitContainers" -}}
34+
{{- if .Values.pgstacBootstrap.enabled }}
35+
initContainers:
36+
- name: wait-for-pgstac-jobs
37+
image: bitnami/kubectl:latest
38+
command:
39+
- /bin/sh
40+
- -c
41+
- |
42+
echo "Waiting for pgstac-migrate job to complete..."
43+
until kubectl get job pgstac-migrate -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}' | grep -q "True"; do
44+
echo "pgstac-migrate job not complete yet, waiting..."
45+
sleep 5
46+
done
47+
echo "pgstac-migrate job completed successfully."
48+
49+
{{- if .Values.pgstacBootstrap.settings.loadSamples }}
50+
echo "Waiting for pgstac-load-samples job to complete..."
51+
until kubectl get job pgstac-load-samples -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}' | grep -q "True"; do
52+
echo "pgstac-load-samples job not complete yet, waiting..."
53+
sleep 5
54+
done
55+
echo "pgstac-load-samples job completed successfully."
56+
{{- end }}
57+
{{- end }}
58+
{{- end -}}

‎helm-chart/eoapi/templates/services/configmap.yaml‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

0 commit comments

Comments
 (0)