enhance Helm chart with various features

.gitignore

@@ -1 +1,2 @@
-secrets.yml
+secrets.yaml
+my.yaml

README.md

@@ -1,6 +1,6 @@
 # Wallabag Helm Chart
 
-This Helm chart deploys Wallabag v2.5.2, a self-hosted read-it-later application, on Kubernetes using SQLite as the database backend.
+This Helm chart deploys Wallabag , a self-hosted read-it-later application, on Kubernetes using SQLite as the database backend.
 
 ## Description
 
@@ -24,12 +24,37 @@ helm install wallabag .
 
 The following table lists the configurable parameters of the Wallabag chart. Modify the `values.yaml` file to customize the installation.
 
-| Parameter | Description | Default |
-|-----------|-------------|---------|
-| `image.repository` | Wallabag image repository | `wallabag/wallabag` |
-| `image.tag` | Wallabag image tag | `2.5.2` |
-| `persistence.enabled` | Enable persistence for SQLite database | `true` |
-| `persistence.hostPath` | Host path for SQLite database storage | `/path/to/data` |
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| env.FASTCGI_READ_TIMEOUT | string | `"300s"` |  |
+| env.PHP_MEMORY_LIMIT | string | `"256M"` |  |
+| env.SYMFONY__ENV__DOMAIN_NAME | string | `"https://wallabag.example.com:443"` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.repository | string | `"wallabag/wallabag"` |  |
+| image.tag | string | `"2.6.12"` |  |
+| ingress.className | string | `"nginx"` |  |
+| ingress.domainName | string | `"wallabag.example.com"` |  |
+| ingress.enabled | bool | `false` |  |
+| ingress.proxyConnectTimeout | string | `"300s"` |  |
+| ingress.proxyReadTimeout | string | `"300s"` |  |
+| ingress.tls.enabled | bool | `true` |  |
+| issuer.emailAddress | string | `"[email protected]"` |  |
+| issuer.enabled | bool | `false` |  |
+| persistence.enabled | bool | `true` |  |
+| persistence.hostPath | string | `"/tmp"` |  |
+| persistence.mountPath | string | `"/var/www/wallabag/data"` |  |
+| resources.limits.cpu | string | `"500m"` |  |
+| resources.limits.memory | string | `"500Mi"` |  |
+| resources.requests.cpu | string | `"300m"` |  |
+| resources.requests.memory | string | `"256Mi"` |  |
+| service.port | int | `80` |  |
+| service.targetPort | int | `80` |  |
+| service.type | string | `"ClusterIP"` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)
 
 ## Persistence
 

README.md.gotmpl

@@ -0,0 +1,46 @@
+# Wallabag Helm Chart
+
+This Helm chart deploys Wallabag , a self-hosted read-it-later application, on Kubernetes using SQLite as the database backend.
+
+## Description
+
+Wallabag is a self-hosted application that allows you to save web pages for later reading. This Helm chart provides a simple way to deploy Wallabag on Kubernetes with persistent storage using hostPath for SQLite database storage.
+
+## Prerequisites
+
+- Kubernetes 1.16+
+- Helm 3.0+
+- PV provisioner support in the underlying infrastructure
+
+## Installing the Chart
+
+To install the chart:
+
+```bash
+helm install wallabag .
+```
+
+## Configuration
+
+The following table lists the configurable parameters of the Wallabag chart. Modify the `values.yaml` file to customize the installation.
+
+{{ template "chart.valuesSection" . }}
+
+{{ template "helm-docs.versionFooter" . }}
+
+## Persistence
+
+This chart uses a hostPath PersistentVolume for storing the SQLite database. Make sure the specified host path exists and has the correct permissions.
+
+## Accessing Wallabag
+
+Once deployed, Wallabag will be available at the configured ingress host or service endpoint. The default login credentials are:
+
+- Username: `wallabag`
+- Password: `wallabag`
+
+Please change these credentials after the first login.
+
+## License
+
+This Helm chart is open-source and available under the MIT license.

templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "wallabag.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "wallabag.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "wallabag.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "wallabag.labels" -}}
+helm.sh/chart: {{ include "wallabag.chart" . }}
+{{ include "wallabag.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "wallabag.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "wallabag.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "wallabag.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "wallabag.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

templates/deployment.yaml

@@ -1,30 +1,56 @@
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: wallabag
+  name: {{ include "wallabag.fullname" . }}
+  labels:
+    {{- include "wallabag.labels" . | nindent 4 }}
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: wallabag
+      {{- include "wallabag.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       labels:
-        app: wallabag
+        {{- include "wallabag.selectorLabels" . | nindent 8 }}
     spec:
       containers:
         - name: wallabag
-          image: "wallabag/wallabag:2.6.12"
-          imagePullPolicy: IfNotPresent
+          image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
-            - containerPort: 80
+            - containerPort: {{ .Values.service.targetPort }}
           env:
-            - name: SYMFONY__ENV__DOMAIN_NAME
-              value: "{{ .Values.env.DOMAIN_NAME }}"
+          {{- range $key, $value := .Values.env }}
+          - name: {{ $key }}
+            value: "{{ $value }}"
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- if .Values.securityContext }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          {{- end }}
           volumeMounts:
             - name: wallabag-data
               mountPath: /var/www/wallabag/data
+            - name: wallabag-var
+              mountPath: /var/www/wallabag/var
+            - name: tmp
+              mountPath: /tmp
+      {{- if .Values.podSecurityContext }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- end }}
       volumes:
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 500Mi
+        - name: wallabag-var
+          emptyDir:
+            sizeLimit: 5Gi
         - name: wallabag-data
           hostPath:
             path: {{ .Values.persistence.hostPath }}

templates/ingress.yaml

@@ -0,0 +1,36 @@
+{{ if .Values.ingress.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "wallabag.fullname" . }}
+  labels:
+    {{- include "wallabag.labels" . | nindent 4 }}
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+    nginx.ingress.kubernetes.io/affinity: cookie
+    nginx.ingress.kubernetes.io/proxy-connect-timeout: {{ .Values.ingress.proxyConnectTimeout }}
+    nginx.ingress.kubernetes.io/proxy-read-timeout: {{ .Values.ingress.proxyReadTimeout }}
+    {{- if .Values.issuer.enabled }}
+    cert-manager.io/issuer: {{ include "wallabag.fullname" . }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  rules:
+  - host: {{ .Values.ingress.domainName }}
+    http:
+      paths:
+      - backend:
+          service:
+            name: {{ include "wallabag.fullname" . }}
+            port:
+              number: {{ .Values.service.port }}
+        path: /
+        pathType: ImplementationSpecific
+{{ if .Values.ingress.tls.enabled }}
+  tls:
+  - hosts:
+    - {{ .Values.ingress.domainName }}
+    secretName: {{ include "wallabag.fullname" . }}-tls-secret
+{{- end }}
+{{- end }}

templates/issuer.yaml

@@ -0,0 +1,19 @@
+{{ if .Values.issuer.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ include "wallabag.fullname" . }}
+  labels:
+    {{- include "wallabag.labels" . | nindent 4 }}
+spec:
+  acme:
+    email: {{ .Values.issuer.emailAddress }}
+    privateKeySecretRef:
+      name: letsencrypt-issuer-account-key
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+    - http01:
+        ingress:
+          class: {{ .Values.ingress.className }}
+{{- end }}

templates/service.yaml

@@ -1,11 +1,13 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: wallabag
+  name: {{ include "wallabag.fullname" . }}
+  labels:
+    {{- include "wallabag.labels" . | nindent 4 }}
 spec:
   selector:
-    app: wallabag
-  type: ClusterIP
+    {{- include "wallabag.selectorLabels" . | nindent 4 }}
+  type: {{ .Values.service.type }}
   ports:
-    - port: 80
-      targetPort: 80
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.targetPort }}

values.yaml

@@ -1,18 +1,73 @@
+# Container image repo and tag
 image:
   repository: wallabag/wallabag
-  tag: 2.5.2
+  tag: 2.6.12
   pullPolicy: IfNotPresent
 
+# Ingress configuration
+ingress:
+  className: nginx
+  domainName: "wallabag.example.com"
+  enabled: false
+  proxyConnectTimeout: 300s
+  proxyReadTimeout: 300s
+  tls:
+    enabled: true
+
+# cert-manager issuer configuration, would be setup Ingress annotation
+issuer:
+  enabled: false
+  emailAddress: [email protected]
+
+# service ClusterIP/NodePort and port number, typically 80
 service:
   type: ClusterIP
   port: 80
+  targetPort: 80
 
+# persistant data for assets and sqllite, must be exists
 persistence:
   enabled: true
-  hostPath: ""
+  hostPath: "/tmp"
   mountPath: /var/www/wallabag/data
 
+# environment variables, mostly domain name is required, otherwise wallabag will not work correctly
+# memory and timeout needs to increase if you have problems with import big data
 env:
-  DOMAIN_NAME: ""
+  SYMFONY__ENV__DOMAIN_NAME: "https://wallabag.example.com:443"
+  PHP_MEMORY_LIMIT: 256M
+  FASTCGI_READ_TIMEOUT: 300s
+
+# used compute resources
+resources:
+  limits:
+    memory: 500Mi
+    cpu: 500m
+  requests:
+    memory: 256Mi
+    cpu: 300m
+
+# TODO: this won't work at the moment while wallabag provision needs a lot of write permissions and wants chown directories
+# minimal permissions for pod
+#podSecurityContext:
+#  fsGroup: 65534
+#  supplementalGroups:
+#  - 65534
+#  runAsNonRoot: true
+#  seccompProfile:
+#    type: RuntimeDefault
+
+# minimal permissions for container
+#securityContext:
+#  readOnlyRootFilesystem: true
+#  allowPrivilegeEscalation: false
+#  capabilities:
+#    drop:
+#    - ALL
+#    - CAP_NET_RAW
+#  privileged: false
+#  runAsUser: 65534
+#  runAsGroup: 65534
+#  seccompProfile:
+#    type: RuntimeDefault
 
-resources: {}