[JN-1396] templatizing k8s manifests with helm (#1121)

terraform/gcp/db.tf

@@ -51,7 +51,7 @@ resource "google_sql_database_instance" "d2p" {
     }
     database_flags {
       name  = "pgaudit.log"
-      value = "'all'"
+      value = "all"
     }
 
     backup_configuration {

terraform/gcp/juniper_service_account.tf

@@ -34,7 +34,7 @@ resource "google_service_account_iam_binding" "workload_identity_binding" {
   service_account_id = google_service_account.junper-app-gsa.name
   role               = "roles/iam.workloadIdentityUser"
   members = [
-    "serviceAccount:${var.project}.svc.id.goog[default/juniper-app-ksa]"
+    "serviceAccount:${var.project}.svc.id.goog[juniper/juniper-app-ksa]"
   ]
 }
 

terraform/gcp/k8s/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: juniper
+description: Juniper Helm chart
+type: application
+# this is the chart version, increment with each change
+version: 0.0.1

terraform/gcp/k8s/environments/dev.yaml

@@ -0,0 +1,58 @@
+gcpProject: broad-juniper-dev
+gcpRegion: us-central1
+adminUrl: juniper-cmi.dev
+# "portals" adds certificates for each portal - both for the juniper-cmi.dev subdomains and the custom domain
+portals:
+  - name: demo
+  # customDomain: juniper-demostudy.org <-- add once we purchase this domain
+  - name: hearthive
+  - name: ourhealth
+  - name: cmi
+  - name: rgp
+  - name: atcp
+b2c:
+  admin:
+    clientId: 705c09dc-5cca-43d3-ae06-07de78bad29a
+    tenantName: ddpdevb2c
+    policyName: B2C_1A_ddp_admin_signup_signin_dev
+  portals:
+    atcp:
+      changePasswordPolicyName: does-not-exist
+      clientId: does-not-exist
+      policyName: does-not-exist
+      tenantName: does-not-exist
+    cmi:
+      changePasswordPolicyName: B2C_1A_ddp_participant_change_password_cmi-dev
+      clientId: 0cdfdafd-75fb-4e36-b6a2-c00e79c86bb0
+      policyName: B2C_1A_ddp_participant_signup_signin_cmi-dev
+      tenantName: junipercmidemo
+    demo:
+      changePasswordPolicyName: B2C_1A_ddp_participant_change_password_demo-dev
+      clientId: 37d95cc4-7c71-465e-9fc2-66be9a54c202
+      policyName: B2C_1A_ddp_participant_signup_signin_demo-dev
+      tenantName: juniperdemodev
+    gvasc:
+      changePasswordPolicyName: B2C_1A_ddp_participant_change_password_gvasc-dev
+      clientId: 441d57d2-5f17-473b-8b19-a2ed523c09bf
+      policyName: B2C_1A_ddp_participant_signup_signin_gvasc-dev
+      tenantName: gvascdev
+    hearthive:
+      changePasswordPolicyName: B2C_1A_ddp_participant_change_password_hearthive-dev
+      clientId: 8c778931-b7f6-4503-b30e-e975ab8ea615
+      policyName: B2C_1A_ddp_participant_signup_signin_hearthive-dev
+      tenantName: hearthivedev
+    ourhealth:
+      changePasswordPolicyName: B2C_1A_DDP_participant_change_password_ourhealth-dev
+      clientId: 206a23da-f303-4a9b-ad86-f51d1be51777
+      policyName: B2C_1A_DDP_participant_signup_signin_ourhealth-dev
+      tenantName: ourhealthdev
+    rgp:
+      changePasswordPolicyName: B2C_1A_ddp_participant_change_password_rgp-dev
+      clientId: 42445bb9-7ab2-48e9-b7a7-c5f84258e87b
+      policyName: B2C_1A_ddp_participant_signup_signin_rgp-dev
+      tenantName: juniperrgpdemo
+    template:
+      changePasswordPolicyName: does-not-exist
+      clientId: does-not-exist
+      policyName: does-not-exist
+      tenantName: does-not-exist

terraform/gcp/k8s/admin-cert.yml → terraform/gcp/k8s/templates/admin-cert.yml

@@ -4,6 +4,6 @@ metadata:
   name: admin-cert
 spec:
   domains:
-    - juniper-cmi.dev
-    - www.juniper-cmi.dev
+    - {{ .Values.adminUrl }}
+    - www.{{ .Values.adminUrl }}
 

terraform/gcp/k8s/admin-deployment.yml → terraform/gcp/k8s/templates/admin-deployment.yml

@@ -30,7 +30,7 @@ spec:
 
             # Replace DB_PORT with the port the proxy should listen on
             - "--port=5432"
-            - "broad-juniper-dev:us-central1:d2p"
+            - "{{ .Values.gcpProject }}:{{ .Values.gcpRegion }}:d2p"
 
           securityContext:
             # The default Cloud SQL Auth Proxy image runs as the
@@ -55,7 +55,7 @@ spec:
 
         - name: admin
           imagePullPolicy: Always
-          image: us-central1-docker.pkg.dev/broad-juniper-eng-infra/juniper/juniper-admin:1.3.96
+          image: "us-central1-docker.pkg.dev/broad-juniper-eng-infra/juniper/juniper-admin:{{.Values.appVersion}}"
           livenessProbe:
             failureThreshold: 30
             httpGet:
@@ -89,25 +89,25 @@ spec:
             - name: DB_USER_SECRET_ID
               value: "d2p-db-user"
             - name: GCP_PROJECT_ID
-              value: "broad-juniper-dev"
+              value: {{ .Values.gcpProject }}
             - name: DATABASE_NAME
               value: "d2p"
             - name: DEPLOYMENT_ZONE
               value: dev
             - name: ADMIN_API_HOSTNAME
-              value: "juniper-cmi.dev"
+              value: {{ .Values.adminUrl }}
             - name: ADMIN_UI_HOSTNAME
-              value: "juniper-cmi.dev"
+              value: {{ .Values.adminUrl }}
             - name: PARTICIPANT_API_HOSTNAME
-              value: "juniper-cmi.dev"
+              value: {{ .Values.adminUrl }}
             - name: PARTICIPANT_UI_HOSTNAME
-              value: "juniper-cmi.dev"
+              value: {{ .Values.adminUrl }}
             - name: B2C_CLIENT_ID
-              value: 705c09dc-5cca-43d3-ae06-07de78bad29a
+              value: {{ .Values.b2c.admin.clientId }}
             - name: B2C_POLICY_NAME
-              value: B2C_1A_ddp_admin_signup_signin_dev
+              value: {{ .Values.b2c.admin.policyName }}
             - name: B2C_TENANT_NAME
-              value: ddpdevb2c
+              value: {{ .Values.b2c.admin.tenantName }}
             - name: TDR_ADDRESS
               value: https://jade.datarepo-dev.broadinstitute.org
             - name: TDR_EXPORT_ENABLED
@@ -159,7 +159,7 @@ spec:
             - name: REMOTE_USER_CLAIM
               value: sub
             - name: B2C_APPLICATION_ID
-              value: 705c09dc-5cca-43d3-ae06-07de78bad29a
+              value: {{ .Values.b2c.admin.clientId }}
           volumeMounts:
             - mountPath: /etc/httpd/conf.d/site.conf
               name: d2p-site-configmap-mount

terraform/gcp/k8s/templates/b2c-config.yml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: portal-b2c-configmap
+data:
+  portalB2CConfig.yaml: |
+    b2c:
+      {{range $key, $value := .Values.b2c.portals}}
+      {{$key}}:
+          tenantName: {{$value.tenantName}}
+          policyName: {{$value.policyName}}
+          clientId: {{$value.clientId}}
+          changePasswordPolicyName: {{$value.changePasswordPolicyName}}
+      {{end}}

terraform/gcp/k8s/templates/ingress.yml

@@ -0,0 +1,35 @@
+{{- define "customer-certs" -}}
+{{- range $idx, $val := $.Values.portals -}}
+{{- if $idx }}
+{{- print ","  -}}
+{{- end -}}
+{{- $val.name -}}-admin-subdomain-cert{{if $val.customDomain}},{{- $val.name -}}-public-url-cert{{end}}
+{{- end -}}
+{{- end -}}
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: juniper-ingress
+  annotations:
+    kubernetes.io/ingress.global-static-ip-name: admin-ip
+    networking.gke.io/managed-certificates: "admin-cert,{{ template "customer-certs" . }}"
+    # If the class annotation is not specified it defaults to "gce".
+    kubernetes.io/ingress.class: "gce"
+spec:
+  rules:
+    - host: "juniper-cmi.dev"
+      http:
+        paths:
+          - path: /*
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: admin-service
+                port:
+                  number: 80
+  defaultBackend:
+    service:
+      name: participant-service
+      port:
+        number: 80

terraform/gcp/k8s/templates/juniper-ksa-user.yml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: juniper-app-ksa
+  annotations:
+    iam.gke.io/gcp-service-account: juniper-app-gsa@{{.Values.gcpProject}}.iam.gserviceaccount.com
+
+
+