migrate gitops-demo to generic chart

charts/app/app/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: app
+description: >-
+  Generic application chart for lgkentang services. Renders a Deployment +
+  Service + Ingress (with cert-manager TLS) from a small values.yaml, so a new
+  service is a handful of values instead of copy-pasted manifests.
+type: application
+# Chart version: bump when the TEMPLATES change (the chart's own releases).
+version: 0.1.0
+# The default app version; individual services override via image.tag.
+appVersion: "1.0.0"

charts/app/app/templates/_helpers.tpl

@@ -0,0 +1,24 @@
+{{/*
+Resource name: explicit .Values.name wins, else the release name.
+Keeping this in one helper means every template names things identically.
+*/}}
+{{- define "app.name" -}}
+{{- default .Release.Name .Values.name -}}
+{{- end -}}
+
+{{/*
+Common labels stamped on every object, so `kubectl get all -l ...` and ArgoCD
+can group a service's resources together.
+*/}}
+{{- define "app.labels" -}}
+app.kubernetes.io/name: {{ include "app.name" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels: the stable subset used to wire Deployment <-> Service. Must
+NOT change over a release's life or the Service would stop matching the pods.
+*/}}
+{{- define "app.selectorLabels" -}}
+app: {{ include "app.name" . }}
+{{- end -}}

charts/app/app/templates/deployment.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "app.name" . }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      {{- include "app.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "app.selectorLabels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: {{ include "app.name" . }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: {{ .Values.containerPort }}
+          {{- with .Values.env }}
+          env:
+            {{- range $key, $val := . }}
+            - name: {{ $key }}
+              value: {{ $val | quote }}
+            {{- end }}
+          {{- end }}
+          {{- if .Values.envFromSecret }}
+          # Loads every key of this Secret as an env var. In Phase 5 this Secret
+          # is created + kept in sync by the External Secrets Operator.
+          envFrom:
+            - secretRef:
+                name: {{ .Values.envFromSecret }}
+          {{- end }}
+          {{- with .Values.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}

charts/app/app/templates/ingress.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.ingress.enabled }}
+{{- if not .Values.ingress.host }}
+{{- fail "ingress.enabled is true but ingress.host is empty — set the hostname in your service's values.yaml" }}
+{{- end }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "app.name" . }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+  annotations:
+    # Phase 1: cert-manager issues the cert. Phase 2: external-dns reads the
+    # host below and creates the DNS record. Both driven off this one Ingress.
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host }}
+      secretName: {{ .Values.ingress.tlsSecretName | default (printf "%s-tls" (include "app.name" .)) }}
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "app.name" . }}
+                port:
+                  number: {{ .Values.service.port }}
+{{- end }}

charts/app/app/templates/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "app.name" . }}
+  labels:
+    {{- include "app.labels" . | nindent 4 }}
+spec:
+  selector:
+    {{- include "app.selectorLabels" . | nindent 4 }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.containerPort }}

charts/app/app/values.yaml

@@ -0,0 +1,56 @@
+# ============================================================================
+# THE CONTRACT: this is the shape every lgkentang service fills in.
+# Most services only need to set: name, image.repository, image.tag,
+# and ingress.host. Everything else has a sensible default below.
+# ============================================================================
+
+# Resource name for the Deployment/Service/Ingress. Defaults to the ArgoCD
+# release name if left empty. Set it explicitly so names stay stable even if
+# the release is ever renamed.
+name: ""
+
+image:
+  repository: traefik/whoami
+  tag: latest
+  pullPolicy: IfNotPresent
+
+# How many pod replicas to run.
+replicas: 1
+
+# The port your container listens on inside the pod.
+containerPort: 80
+
+service:
+  # Cluster-internal Service port (what the Ingress routes to).
+  port: 80
+
+ingress:
+  # Set false for internal-only services that shouldn't be exposed/DNS'd.
+  enabled: true
+  className: traefik
+  # REQUIRED when enabled, e.g. myapp.dev.lgkentang.com. external-dns turns
+  # this into a DNS record and cert-manager into a cert (Phases 1-2).
+  host: ""
+  clusterIssuer: letsencrypt-prod
+  # tlsSecretName defaults to "<name>-tls" if left unset.
+  tlsSecretName: ""
+
+# Plain, non-secret environment variables as key: value pairs.
+# SECRET env vars are deliberately NOT here — those arrive in Phase 5 via the
+# External Secrets Operator, so we don't build a pattern now that fights it.
+env: {}
+  # LOG_LEVEL: info
+  # FEATURE_X_ENABLED: "true"
+
+# Name of a Kubernetes Secret whose keys are loaded as env vars (envFrom).
+# Empty = none. In Phase 5, the External Secrets Operator syncs a Secret from
+# Infisical/Vault and you point this at it — so app secrets never touch git.
+envFromSecret: ""
+
+# Resource requests/limits. Conservative defaults suited to the single node.
+resources:
+  requests:
+    cpu: 10m
+    memory: 32Mi
+  limits:
+    memory: 128Mi