Merge pull request #135 from holaplex/mpw/update-analytics-chart

Mpw/update analytics chart

.github/workflows/linters/ct.yaml

@@ -9,6 +9,7 @@ chart-repos:
   - ory=https://k8s.ory.sh/helm/charts
   - bitnami=https://charts.bitnami.com/bitnami
   - influxdata=https://helm.influxdata.com
+  - cube=https://gadsme.github.io/charts
 helm-extra-args: --timeout 600s
 validate-maintainers: false
 excluded-charts:

.github/workflows/release.yaml

@@ -37,6 +37,7 @@ jobs:
           helm repo add ory https://k8s.ory.sh/helm/charts
           helm repo add bitnami https://charts.bitnami.com/bitnami
           helm repo add influxdata https://helm.influxdata.com/
+          helm repo add cube https://gadsme.github.io/charts
 
       - name: Run chart-releaser
         uses: helm/[email protected]

charts/hub-analytics/Chart.lock

@@ -1,6 +1,9 @@
 dependencies:
-- name: influxdb2
-  repository: https://helm.influxdata.com
-  version: 2.1.1
-digest: sha256:0761db11171266c6d37183004b4932b0d83c3af0a617b96b2cf8c56ac32d1347
-generated: "2023-03-22T21:44:30.561775-03:00"
+- name: cube
+  repository: https://gadsme.github.io/charts
+  version: 2.0.1
+- name: cubestore
+  repository: https://gadsme.github.io/charts
+  version: 0.9.2
+digest: sha256:4285f807a53ad6982fbe62d072ee6876cf9702b9f8acd7a3eaca22c00c0afd6d
+generated: "2023-08-05T10:56:25.86116-03:00"

charts/hub-analytics/Chart.yaml

@@ -19,7 +19,7 @@ type: application
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 
-version: "0.1.0"
+version: 0.2.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -28,9 +28,12 @@ version: "0.1.0"
 appVersion: "0.1"
 sources:
   - https://github.com/holaplex/helm-charts
-
 dependencies:
-  - name: influxdb2
-    condition: influxdb2.enabled
-    version: 2.1.1
-    repository: https://helm.influxdata.com
+  - name: cube
+    condition: cube.enabled
+    version: 2.0.1
+    repository: https://gadsme.github.io/charts
+  - name: cubestore
+    condition: cubestore.enabled
+    version: 0.9.2
+    repository: https://gadsme.github.io/charts

charts/hub-analytics/templates/environment.yaml

@@ -8,7 +8,4 @@ data:
   KAFKA_BROKERS: {{ required "must set kafka brokers" .kafkaBrokers | quote }}
   KAFKA_SSL: {{ default "false" .kafkaSsl | quote }}
   KAFKA_USERNAME: {{ required "must set kafka username" .kafkaUsername | quote }}
-  DB_URL: {{ required "must set influxdb url" .influxdbUrl | quote }}
-  DB_BUCKET: {{ required "must set influxdb bucket" .influxdbBucket | quote }}
-  DB_ORG: {{ required "must set influxdb org" .influxdbOrg | quote }}
   {{- end }}

charts/hub-analytics/templates/migrate.yaml

@@ -0,0 +1,34 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ .Release.Name }}-migrate-db"
+  labels:
+    {{- include "hub-analytics.labels" . | nindent 4 }}
+    app.kubernetes.io/component: migrations
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-delete-policy": hook-succeeded
+spec:
+  template:
+    metadata:
+      name: "{{ .Release.Name }}-migrate-db"
+      labels:
+        {{- include "hub-analytics.labels" . | nindent 8 }}
+        app.kubernetes.io/component: migrations
+    spec:
+      restartPolicy: Never
+      containers:
+      - name: migrate
+        {{- with .Values.migrate.image }}
+        imagePullPolicy: {{ .pullPolicy }}
+        image: "{{ .repository }}:{{ .tag }}"
+        {{- end }}
+        command: ["/usr/local/bin/migration"]
+        args: ["-u", "$(DATABASE_URL)"]
+        env:
+          - name: DATABASE_URL
+            valueFrom:
+              secretKeyRef:
+                name: {{ include "hub-analytics.fullname" . }}
+                key: DATABASE_URL
+                optional: false

charts/hub-analytics/templates/netpol.yaml

@@ -0,0 +1,57 @@
+{{- if .Values.networkPolicies.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "hub-analytics.fullname" . }}
+  labels:
+    {{- include "hub-analytics.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "hub-analytics.selectorLabels" . | nindent 8 }}
+  egress:
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: redpanda
+      ports:
+        - port: 9092
+          protocol: TCP
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: postgresql
+      ports:
+        - port: 5432
+          protocol: TCP
+    - to:
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - port: 53
+          protocol: UDP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: node-local-dns
+      ports:
+        - port: 53
+          protocol: UDP
+{{- if .Values.networkPolicies.extraEgress }}
+{{ toYaml .Values.networkPolicies.extraEgress | indent 4 }}
+{{- end }}
+{{- if .Values.networkPolicies.extraIngress }}
+  ingress:
+{{ toYaml .Values.networkPolicies.extraIngress | indent 4 }}
+{{- end }}
+  policyTypes:
+{{- if .Values.networkPolicies.extraIngress }}
+    - Ingress
+{{- end }}
+    - Egress
+{{- end }}

charts/hub-analytics/templates/secrets.yaml

@@ -9,8 +9,6 @@ metadata:
 type: Opaque
 data:
   KAFKA_PASSWORD: {{ required "must set kafka password" .entries.kafkaPassword | b64enc }}
-  admin-password: {{ required "must set influxDB password" .entries.influxdbPassword | b64enc }}
-  admin-token: {{ required "must set influxDB token" .entries.influxdbToken | b64enc }}
-  DB_TOKEN: {{ required "must set influxdb token" .entries.influxdbToken | b64enc }}
+  DATABASE_URL: {{ .entries.databaseUrl | b64enc }}
 {{- end }}
 {{- end }}

charts/hub-analytics/values.yaml

@@ -4,6 +4,13 @@
 
 replicaCount: 1
 
+migrate:
+  image:
+    repository: holaplex/hub-analytics-migrations
+    pullPolicy: IfNotPresent
+    # Overrides the image tag whose default is the chart appVersion.
+    tag: "latest"
+
 image:
   repository: holaplex/hub-analytics
   pullPolicy: IfNotPresent
@@ -28,13 +35,12 @@ podAnnotations: {}
 podSecurityContext: {}
   # fsGroup: 2000
 
-securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
+securityContext:
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: true
+  runAsNonRoot: true
+  runAsUser: 10000
+  runAsGroup: 10000
 
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
@@ -55,6 +61,21 @@ autoscaling:
   targetCPUUtilizationPercentage: 80
   # targetMemoryUtilizationPercentage: 80
 
+networkPolicies:
+  enabled: false
+  extraEgress: []
+  extraIngress: []
+  # Example:
+  # extraEgress:
+  #  - to:
+  #      - ipBlock:
+  #          cidr: 1.2.3.4/16
+  #  - to:
+  #      - podSelector:
+  #          matchLabels:
+  #            app.kubernetes.io/name: hub-services-db
+  # extraIngress: []
+
 nodeSelector: {}
 
 tolerations: []
@@ -65,68 +86,16 @@ secrets:
   enabled: true
   entries:
     kafkaPassword: ""
-    influxdbPassword: ""
-    influxdbToken: ""
+    databaseUrl: ""
 
 environment:
   logLevel: "info"
   kafkaBrokers: "hub-eventbus-cluster-0.hub-eventbus-cluster.default.svc.cluster.local.:9093"
   kafkaSsl: false
   kafkaUsername: ""
-  influxdbUrl: http://hub-analytics-influxdb2
-  influxdbOrg: holaplex
-  influxdbBucket: hub-analytics
 
-influxdb2:
-  enabled: true
-  image:
-    repository: influxdb
-    tag: 2.6.1
-    pullPolicy: IfNotPresent
+cube:
+  enabled: false
 
-  persistence:
-    enabled: true
-    # storageClass: "-"
-    accessMode: ReadWriteOnce
-    size: 8Gi
-    mountPath: /var/lib/influxdb2
-
-  enterprise:
-    enabled: false
-
-  adminUser:
-    organization: "holaplex"
-    bucket: "hub-analytics"
-    user: "admin"
-    retention_policy: "0s"
-    existingSecret: hub-analytics
-
-  ingress:
-    enabled: false
-
-  pdb:
-    create: false
-    minAvailable: 1
-
-  backup:
-    enabled: false
-    resources:
-      requests:
-        ephemeral-storage: "8Gi"
-    persistence:
-      enabled: false
-      # storageClass: "-"
-      annotations:
-      accessMode: ReadWriteOnce
-      size: 8Gi
-    schedule: "0 0 * * *"
-
-  backupRetention:
-    enabled: false
-    resources:
-      requests:
-      schedule: "0 0 * * *"
-    startingDeadlineSeconds:
-    annotations: {}
-    podAnnotations: {}
-    daysToRetain: 7
+cubestore:
+  enabled: false