Fix/dependency track (#43)

Co-authored-by: David J. M. Karlsen <[email protected]>

.github/workflows/publish.yaml

@@ -21,7 +21,7 @@ jobs:
     - name: Install Helm
       uses: azure/setup-helm@v1
       with:
-        version: v3.5.1
+        version: v3.5.3
 
     - name: add repos
       run: |

.github/workflows/test.yaml

@@ -21,7 +21,7 @@ jobs:
     - name: Set up Helm
       uses: azure/setup-helm@v1
       with:
-        version: v3.5.0
+        version: v3.5.3
 
     - uses: actions/setup-python@v2
       with:

charts/dependency-track/Chart.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: postgresql
+  repository: https://charts.bitnami.com/bitnami
+  version: 10.3.11
+- name: common
+  repository: https://charts.bitnami.com/bitnami
+  version: 1.4.1
+digest: sha256:5f84bde102eb7fce40c1fb7e9a8edd18b794fab7fe8747646045b08d8df52246
+generated: "2021-03-10T19:45:23.233811+01:00"

charts/dependency-track/Chart.yaml

@@ -1,10 +1,10 @@
-apiVersion: v1
-appVersion: 3.8.0
+apiVersion: v2
+appVersion: 4.1.0
 description: |
   Dependency-Track is an intelligent Software Supply Chain Component Analysis platform that allows organizations to identify and reduce risk from the use of third-party and open source components. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill-of-Materials (SBOM). This approach provides capabilities that traditional Software Composition Analysis (SCA) solutions cannot achieve.
 name: dependency-track
 home: https://dependencytrack.org/
-version: 0.2.4
+version: 1.0.0
 icon: https://github.com/DependencyTrack/branding/blob/master/dt-logo-black-text.svg
 keywords:
  - security
@@ -18,3 +18,11 @@ maintainers:
 sources:
  - https://docs.dependencytrack.org/
  - https://github.com/evryfs/helm-charts
+dependencies:
+- name: postgresql
+  version: ~10.3
+  repository: https://charts.bitnami.com/bitnami
+  condition: postgresql.enabled
+- name: common
+  version: 1.4.x
+  repository: https://charts.bitnami.com/bitnami

charts/dependency-track/ci/nopersistence-values.yaml

@@ -1,4 +1,14 @@
 postgresql:
   enabled: false
-persistentVolume:
-  enabled: false
+apiserver:
+  persistentVolume:
+    enabled: false
+  resources:
+    requests:
+      cpu: 1600m
+      memory: 5Gi
+    limits:
+      cpu: 2
+      memory: 5Gi
+frontend:
+  replicaCount: 2

charts/dependency-track/ci/withpg-values.yaml

@@ -1,2 +1,12 @@
 postgresql:
   enabled: true
+apiserver:
+  resources:
+    requests:
+      cpu: 1600m
+      memory: 5Gi
+    limits:
+      cpu: 2
+      memory: 5Gi
+frontend:
+  replicaCount: 2

charts/dependency-track/templates/NOTES.txt

@@ -1,21 +1,3 @@
-1. Get the application URL by running these commands:
 {{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
-  {{- end }}
-{{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "dependency-track.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
-  echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.service.type }}
-     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "dependency-track.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "dependency-track.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
-  echo http://$SERVICE_IP:{{ .Values.service.port }}
-{{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "dependency-track.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl port-forward $POD_NAME 8080:80
+Visit {{ if .Values.ingress.tls.enabled }}https{{- else }}http{{- end }}://{{ .Values.ingress.host }} to use dependency-track.
 {{- end }}

charts/dependency-track/templates/_helpers.tpl

@@ -1,56 +1,29 @@
 {{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "dependency-track.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
 
-{{/*
-Create a default fully qualified app name.
-We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
-If release name contains chart name it will be used as a full name.
-*/}}
-{{- define "dependency-track.fullname" -}}
-{{- if .Values.fullnameOverride -}}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- $name := default .Chart.Name .Values.nameOverride -}}
-{{- if contains $name .Release.Name -}}
-{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
-{{- else -}}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
-{{- end -}}
+{{- define "apiserver.image" -}}
+{{- include "common.images.image" ( dict "imageRoot" .Values.apiserver.image "global" .Values.global ) -}}
 {{- end -}}
+
+{{- define "frontend.image" -}}
+{{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global ) -}}
 {{- end -}}
 
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "dependency-track.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- define "frontend.labels.standard" -}}
+{{ include "common.labels.standard" . }}
+app.kubernetes.io/component: frontend
 {{- end -}}
 
-{{/*
-Common labels
-*/}}
-{{- define "dependency-track.labels" -}}
-app.kubernetes.io/name: {{ include "dependency-track.name" . }}
-helm.sh/chart: {{ include "dependency-track.chart" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- define "frontend.labels.matchLabels" -}}
+{{ include "common.labels.matchLabels" . }}
+app.kubernetes.io/component: frontend
 {{- end -}}
 
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "dependency-track.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create -}}
-    {{ default (include "dependency-track.fullname" .) .Values.serviceAccount.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccount.name }}
+{{- define "backend.labels.standard" -}}
+{{ include "common.labels.standard" . }}
+app.kubernetes.io/component: backend
 {{- end -}}
+
+{{- define "backend.labels.matchLabels" -}}
+{{ include "common.labels.matchLabels" . }}
+app.kubernetes.io/component: backend
 {{- end -}}

charts/dependency-track/templates/backend/deployment.yaml

@@ -0,0 +1,78 @@
+apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
+kind: Deployment
+metadata:
+  name: {{ include "common.names.fullname" . }}-apiserver
+  labels: {{- include "backend.labels.standard" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.apiserver.replicaCount }}
+  {{- if .Values.apiserver.persistentVolume.enabled }}
+  strategy:
+    type: Recreate
+  {{- end }}
+  selector:
+    matchLabels: {{- include "backend.labels.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels: {{- include "backend.labels.standard" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecret: {{- toYaml . | nindent 6 }}
+      {{- end }}
+      serviceAccountName: {{ include "common.names.fullname" . }}-apiserver
+      securityContext: {{- toYaml .Values.apiserver.podSecurityContext | nindent 8 }}
+      {{- with .Values.apiserver.initContainers }}
+      initContainers: {{- toYaml . | nindent 6 }}
+      {{- end }}
+      containers:
+      - name: {{ .Chart.Name }}-apiserver
+        securityContext: {{- toYaml .Values.apiserver.securityContext | nindent 12 }}
+        image: {{ include "apiserver.image" . }}
+        imagePullPolicy: {{ .Values.apiserver.image.pullPolicy }}
+        {{- with .Values.apiserver.resources }}
+        resources: {{ . | toYaml | nindent 10 }}
+        {{- end }}
+        env:
+        - name: ALPINE_DATA_DIRECTORY
+          value: "/data"
+        {{- if .Values.postgresql.enabled }}
+        - name: ALPINE_DATABASE_MODE
+          value: "external"
+        - name: ALPINE_DATABASE_DRIVER
+          value: "org.postgresql.Driver"
+        - name: ALPINE_DATABASE_URL
+          value: jdbc:postgresql://{{ .Release.Name }}-postgresql/{{ .Values.postgresql.postgresqlDatabase }}
+        - name: ALPINE_DATABASE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ .Release.Name }}-postgresql
+              key: postgresql-password
+        - name: ALPINE_DATABASE_USERNAME
+          value: {{ .Values.postgresql.postgresqlUsername }}
+        {{- end }}
+        {{- with .Values.apiserver.env }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: tmp
+          mountPath: /tmp
+        ports:
+        - name: api
+          containerPort: 8080
+          protocol: TCP
+      volumes:
+      - name: tmp
+        emptyDir: {}
+      - name: data
+        {{- if .Values.apiserver.persistentVolume.enabled }}
+        persistentVolumeClaim:
+          claimName: {{ if .Values.apiserver.persistentVolume.existingClaim }}{{ .Values.apiserver.persistentVolume.existingClaim }}{{- else }}{{ include "common.names.fullname" . }}-apiserver{{- end }}
+        {{- else }}
+        emptyDir:
+        {{- if .Values.apiserver.emptyDir.sizeLimit }}
+          sizeLimit: {{ .Values.apiserver.emptyDir.sizeLimit }}
+        {{- else }}
+          {}
+        {{- end -}}
+        {{- end }}

charts/dependency-track/templates/backend/pvc.yaml

@@ -0,0 +1,21 @@
+{{- if .Values.apiserver.persistentVolume.enabled -}}
+{{- if not .Values.apiserver.persistentVolume.existingClaim -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  {{- with .Values.apiserver.persistentVolume.annotations }}
+  annotations: {{ toYaml .| nindent 4 }}
+  {{- end }}
+  labels: {{- include "backend.labels.standard" . | nindent 4 }}
+  name: {{ include "common.names.fullname" . }}-apiserver
+spec:
+  accessModes:
+  - ReadWriteOnce
+{{- with .Values.apiserver.persistentVolume.storageClass }}
+  storageClassName: "{{ . }}"
+{{- end }}
+  resources:
+    requests:
+      storage: "{{ .Values.apiserver.persistentVolume.size }}"
+{{- end -}}
+{{- end -}}

charts/dependency-track/templates/backend/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "common.names.fullname" . }}-apiserver
+  labels: {{- include "backend.labels.standard" . | nindent 4 }}
+  {{- with .Values.apiserver.service.annotations }}
+  annotations: {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.apiserver.service.type }}
+  ports:
+  - port: {{ .Values.apiserver.service.port }}
+    targetPort: api
+  selector: {{- include "backend.labels.matchLabels" . | nindent 4 }}

charts/dependency-track/templates/backend/serviceaccount.yaml

@@ -0,0 +1,7 @@
+{{- if .Values.apiserver.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "common.names.fullname" . }}-apiserver
+  labels: {{- include "frontend.labels.standard" . | nindent 4 }}
+{{- end -}}