feat(deploy): add helm charts for the fluxer services (#3082)

2026-10-17 13:05:32 +09:00 · 2026-10-01 04:11:30 +02:00
1 parent cfed6cc4e0
commit 7c9564bcad
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: fluxer-svc
+description: Fluxer internal services, each a router Deployment and a shard StatefulSet
+type: application
+version: 0.1.0
+appVersion: v1
@@ -0,0 +1,203 @@
+{{- define "fluxer-svc.chart" -}}
+{{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }}
+{{- end }}
+
+{{- define "fluxer-svc.selectorLabels" -}}
+app.kubernetes.io/name: {{ .name }}
+app.kubernetes.io/instance: {{ .root.Release.Name }}
+{{- end }}
+
+{{- define "fluxer-svc.labels" -}}
+{{ include "fluxer-svc.selectorLabels" . }}
+app.kubernetes.io/component: {{ .mode }}
+app.kubernetes.io/part-of: fluxer
+app.kubernetes.io/managed-by: {{ .root.Release.Service }}
+helm.sh/chart: {{ include "fluxer-svc.chart" .root }}
+{{- end }}
+
+{{- define "fluxer-svc.envValue" -}}
+{{- if and (kindIs "float64" .) (eq . (float64 (int64 .))) -}}
+{{- int64 . | toString -}}
+{{- else -}}
+{{- toString . -}}
+{{- end -}}
+{{- end }}
+
+{{- define "fluxer-svc.mergeEnv" -}}
+{{- $out := dict -}}
+{{- range $layer := . -}}
+{{- range $k, $v := ($layer | default dict) -}}
+{{- if kindIs "invalid" $v -}}
+{{- $_ := unset $out $k -}}
+{{- else -}}
+{{- $_ := set $out $k $v -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- toYaml $out -}}
+{{- end }}
+
+{{- define "fluxer-svc.topologySpreadConstraints" -}}
+{{- $out := list -}}
+{{- range .constraints -}}
+{{- if .labelSelector -}}
+{{- $out = append $out . -}}
+{{- else -}}
+{{- $out = append $out (merge (dict "labelSelector" (dict "matchLabels" $.selector)) .) -}}
+{{- end -}}
+{{- end -}}
+{{- toYaml $out -}}
+{{- end }}
+
+{{- define "fluxer-svc.pdb" -}}
+{{- $out := dict -}}
+{{- range $k := list "minAvailable" "maxUnavailable" -}}
+{{- if and (hasKey $ $k) (not (kindIs "invalid" (index $ $k))) -}}
+{{- $_ := set $out $k (index $ $k) -}}
+{{- end -}}
+{{- end -}}
+{{- toYaml $out -}}
+{{- end }}
+
+{{- define "fluxer-svc.config" -}}
+{{- $v := .root.Values -}}
+{{- $levels := list (index $v .mode) (index .svc .mode) -}}
+{{- $c := dict "extraEnv" ($v.extraEnv | default list) "envFrom" ($v.envFrom | default list) "podAnnotations" (deepCopy ($v.podAnnotations | default dict)) "probes" (deepCopy ($v.probes | default dict)) "image" (deepCopy (.svc.image | default dict)) -}}
+{{- range $k := list "imagePullSecrets" "podSecurityContext" "securityContext" "topologySpreadConstraints" "nodeSelector" "tolerations" "affinity" (ternary "updateStrategy" "strategy" (eq .mode "shard")) -}}
+{{- $_ := set $c $k (index $v $k) -}}
+{{- end -}}
+{{- $envLayers := list $v.env -}}
+{{- range $level := $levels -}}
+{{- range $k, $x := ($level | default dict) -}}
+{{- if eq $k "env" -}}
+{{- $envLayers = append $envLayers $x -}}
+{{- else if has $k (list "podAnnotations" "image") -}}
+{{- $_ := set $c $k (mergeOverwrite (index $c $k) (deepCopy ($x | default dict))) -}}
+{{- else if has $k (list "extraEnv" "envFrom") -}}
+{{- $_ := set $c $k (concat (index $c $k) ($x | default list)) -}}
+{{- else if eq $k "probes" -}}
+{{- range $name, $p := ($x | default dict) -}}
+{{- $_ := set $c.probes $name $p -}}
+{{- end -}}
+{{- else -}}
+{{- $_ := set $c $k $x -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- $_ := set $c "env" (include "fluxer-svc.mergeEnv" $envLayers | fromYaml) -}}
+{{- toYaml $c }}
+{{- end }}
+
+{{- define "fluxer-svc.image" -}}
+{{- $g := .root.Values.image -}}
+{{- $i := .c.image -}}
+{{- $repo := $i.repository | default (printf "%s/%s" $g.registry ($i.name | default (printf "fluxer-%s" .service))) -}}
+{{- $ref := printf "%s:%s" $repo ($i.tag | default $g.tag) -}}
+{{- with $i.digest }}{{ $ref = printf "%s@%s" $ref . }}{{ end -}}
+{{- $ref -}}
+{{- end }}
+
+{{- define "fluxer-svc.pod" -}}
+{{- $v := .root.Values -}}
+{{- $c := .c -}}
+metadata:
+  {{- with $c.podAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "fluxer-svc.labels" . | nindent 4 }}
+spec:
+  {{- with $c.imagePullSecrets }}
+  imagePullSecrets:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with $c.podSecurityContext }}
+  securityContext:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- if not (kindIs "invalid" $c.terminationGracePeriodSeconds) }}
+  terminationGracePeriodSeconds: {{ $c.terminationGracePeriodSeconds | int64 }}
+  {{- end }}
+  {{- with $c.nodeSelector }}
+  nodeSelector:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with $c.tolerations }}
+  tolerations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with $c.affinity }}
+  affinity:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with $c.topologySpreadConstraints }}
+  topologySpreadConstraints:
+    {{- include "fluxer-svc.topologySpreadConstraints" (dict "constraints" . "selector" (include "fluxer-svc.selectorLabels" $ | fromYaml)) | nindent 4 }}
+  {{- end }}
+  containers:
+    - name: {{ .mode }}
+      image: {{ include "fluxer-svc.image" . | quote }}
+      imagePullPolicy: {{ $c.image.pullPolicy | default $v.image.pullPolicy }}
+      env:
+        - name: FLUXER_SVC_MODE
+          value: {{ .mode | quote }}
+        - name: FLUXER_SVC_NAME
+          value: {{ .service | quote }}
+        - name: FLUXER_SVC_SHARD_COUNT
+          value: {{ .shardCount | quote }}
+        - name: FLUXER_SVC_PORT
+          value: {{ include "fluxer-svc.envValue" $v.port | quote }}
+        {{- if not (kindIs "invalid" $c.buildVersion) }}
+        - name: BUILD_VERSION
+          value: {{ include "fluxer-svc.envValue" $c.buildVersion | quote }}
+        {{- end }}
+        {{- if eq .mode "shard" }}
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        {{- end }}
+        {{- range $name, $value := $c.env }}
+        - name: {{ $name }}
+          value: {{ include "fluxer-svc.envValue" $value | quote }}
+        {{- end }}
+        {{- with $c.extraEnv }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with $c.envFrom }}
+      envFrom:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      ports:
+        - name: http
+          containerPort: {{ $v.port }}
+          protocol: TCP
+      {{- with $c.lifecycle }}
+      lifecycle:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- range $name := list "startup" "liveness" "readiness" }}
+      {{- with index $c.probes $name }}
+      {{ $name }}Probe:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with $c.resources }}
+      resources:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $c.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $c.extraVolumeMounts }}
+      volumeMounts:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+  {{- with $c.extraVolumes }}
+  volumes:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,145 @@
+{{- range $service, $svc := .Values.services }}
+{{- if not (kindIs "invalid" $svc) }}
+{{- $svc = $svc | default dict }}
+{{- $rc := fromYaml (include "fluxer-svc.config" (dict "root" $ "svc" $svc "mode" "router")) }}
+{{- $sc := fromYaml (include "fluxer-svc.config" (dict "root" $ "svc" $svc "mode" "shard")) }}
+{{- $routerReplicas := ternary $rc.replicas 1 (hasKey $rc "replicas") | int64 }}
+{{- $shardCount := ternary $sc.replicas 1 (hasKey $sc "replicas") | int64 }}
+{{- if lt $shardCount 1 }}
+{{- fail (printf "services.%s shard replicas must be at least 1" $service) }}
+{{- end }}
+{{- $router := dict "root" $ "service" $service "svc" $svc "mode" "router" "name" $service "c" $rc "shardCount" (toString $shardCount) }}
+{{- $shard := dict "root" $ "service" $service "svc" $svc "mode" "shard" "name" (printf "%s-shard" $service) "c" $sc "shardCount" (toString $shardCount) }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $service }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-svc.labels" $router | nindent 4 }}
+spec:
+  {{- if not $rc.hpa }}
+  replicas: {{ $routerReplicas }}
+  {{- end }}
+  {{- if not (kindIs "invalid" $rc.minReadySeconds) }}
+  minReadySeconds: {{ $rc.minReadySeconds | int64 }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fluxer-svc.selectorLabels" $router | nindent 6 }}
+  {{- with $rc.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    {{- include "fluxer-svc.pod" $router | nindent 4 }}
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ $service }}-shard
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-svc.labels" $shard | nindent 4 }}
+spec:
+  replicas: {{ $shardCount }}
+  {{- if not (kindIs "invalid" $sc.minReadySeconds) }}
+  minReadySeconds: {{ $sc.minReadySeconds | int64 }}
+  {{- end }}
+  podManagementPolicy: Parallel
+  serviceName: {{ $service }}-shard-headless
+  selector:
+    matchLabels:
+      {{- include "fluxer-svc.selectorLabels" $shard | nindent 6 }}
+  {{- with $sc.updateStrategy }}
+  updateStrategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  template:
+    {{- include "fluxer-svc.pod" $shard | nindent 4 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $service }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-svc.labels" $router | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "fluxer-svc.selectorLabels" $router | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ $.Values.port }}
+      targetPort: {{ $.Values.port }}
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $service }}-shard-headless
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-svc.labels" $shard | nindent 4 }}
+spec:
+  type: ClusterIP
+  clusterIP: None
+  publishNotReadyAddresses: true
+  selector:
+    {{- include "fluxer-svc.selectorLabels" $shard | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ $.Values.port }}
+      targetPort: {{ $.Values.port }}
+      protocol: TCP
+{{- with $rc.hpa }}
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ $service }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-svc.labels" $router | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ $service }}
+  minReplicas: {{ required (printf "services.%s router hpa.minReplicas is required" $service) .minReplicas | int64 }}
+  maxReplicas: {{ required (printf "services.%s router hpa.maxReplicas is required" $service) .maxReplicas | int64 }}
+  {{- if not (kindIs "invalid" .targetCPUUtilizationPercentage) }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .targetCPUUtilizationPercentage | int64 }}
+  {{- end }}
+  {{- with .behavior }}
+  behavior:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- range $ctx := list $router $shard }}
+{{- with include "fluxer-svc.pdb" ($ctx.c.pdb | default dict) | fromYaml }}
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ $ctx.name }}-pdb
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    {{- include "fluxer-svc.labels" $ctx | nindent 4 }}
+spec:
+  {{- toYaml . | nindent 2 }}
+  selector:
+    matchLabels:
+      {{- include "fluxer-svc.selectorLabels" $ctx | nindent 6 }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,89 @@
+image:
+  registry: ghcr.io/fluxerapp
+  tag: v1
+  pullPolicy: IfNotPresent
+
+imagePullSecrets: []
+
+env:
+  FLUXER_SVC_NATS_URL: nats://nats:4222
+
+extraEnv: []
+
+envFrom:
+  - secretRef:
+      name: fluxer-env
+
+podAnnotations: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  allowPrivilegeEscalation: false
+
+probes:
+  liveness:
+    httpGet:
+      path: /_healthz
+      port: http
+  readiness:
+    httpGet:
+      path: /_health
+      port: http
+
+strategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxSurge: 25%
+    maxUnavailable: 25%
+
+updateStrategy:
+  type: RollingUpdate
+
+topologySpreadConstraints: []
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+port: 8090
+
+router:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      memory: 192Mi
+
+shard:
+  replicas: 2
+  probes:
+    startup:
+      httpGet:
+        path: /_healthz
+        port: http
+      periodSeconds: 10
+      failureThreshold: 30
+  resources:
+    requests:
+      cpu: 50m
+      memory: 96Mi
+    limits:
+      memory: 384Mi
+
+services:
+  gifs:
+    shard:
+      env:
+        FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT: https://media.example.com
+  messages: {}
+  snowflakes: {}
+  unfurl:
+    shard:
+      env:
+        FLUXER_MEDIA_PROXY_ENDPOINT: http://media-proxy:8080
+  users: {}