Merge pull request #1 from ilyannn/ilya/dev

feat/chore: release 0.2.1

.github/linters/.yaml-lint.yml

@@ -0,0 +1,8 @@
+extends: default
+
+ignore-from-file: [.gitignore, .github/linters/.yamlignore]
+
+rules:
+  comments: disable
+  document-start: disable
+  line-length: disable

.github/linters/.yamlignore

@@ -0,0 +1 @@
+**/templates

.github/linters/chart-testing.yaml

@@ -0,0 +1,8 @@
+chart-dirs:
+  - .
+
+chart-repos:
+  - bitnami=https://charts.bitnami.com/bitnami
+
+# The default branch name will be 'main' soon
+target-branch: main

.github/workflows/chart-releaser.yaml

@@ -0,0 +1,34 @@
+name: Release Charts
+
+on: # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - main
+
+jobs:
+  release:
+    # depending on default permission settings for your org (contents being read-only or read-write for workloads), you will have to add permissions
+    # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Install Helm
+        uses: azure/setup-helm@v3
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.6.0
+        with:
+          charts_dir: .
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/lint-helm-chart.yaml

@@ -0,0 +1,80 @@
+name: Test Helm Charts
+
+on: # yamllint disable-line rule:truthy
+  push: {}
+
+jobs:
+  lint-with-kubeconform:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add necessary repos
+        run: |
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Prepare a charts folder
+        run: |
+          mkdir -p charts
+          for dir in */; do
+              if [[ $dir != charts/ && $dir != .* ]] ; then
+                  helm dependency build "$dir"
+                  mv "$dir" charts/
+              fi
+          done
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Generate and validate releases
+        uses: docker://ghcr.io/shivjm/helm-kubeconform-action:v0.2.0
+        env:
+          CHARTS_DIRECTORY: charts
+          HELM_UPDATE_DEPENDENCIES: false
+          LOG_LEVEL: trace
+          LOG_JSON: false
+
+  lint-test-with-ct:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v3
+
+      # Python is required because `ct lint` runs Yamale (https://github.com/23andMe/Yamale) and
+      # yamllint (https://github.com/adrienverge/yamllint) which require Python
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.11
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.6.1
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --config .github/linters/chart-testing.yaml)
+          if [[ -n "$changed" ]]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Run chart-testing (lint)
+        run: ct lint --config .github/linters/chart-testing.yaml
+
+      - name: Create kind cluster
+        uses: helm/kind-action@v1.8.0
+        if: steps.list-changed.outputs.changed == 'true'
+
+      - name: Run chart-testing (install)
+        run: ct install --config .github/linters/chart-testing.yaml

.github/workflows/super-linter.yml

@@ -0,0 +1,20 @@
+name: Lint Code Base
+
+on: # yamllint disable-line rule:truthy
+  push: {}
+
+jobs:
+  lint-code:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Lint Code Base
+        uses: github/super-linter@v5
+        env:
+          DEFAULT_BRANCH: "main"
+          VALIDATE_ALL_CODEBASE: true
+          VALIDATE_KUBERNETES_KUBECONFORM: false

README.md

@@ -1 +1,3 @@
+# Charts
+
 - [Experimental Langfuse chart](langfuse/)

langfuse/Chart.lock

@@ -2,5 +2,5 @@ dependencies:
 - name: postgresql
   repository: https://charts.bitnami.com/bitnami
   version: 13.2.27
-digest: sha256:e258f9c0089b58bc36a25ef1eeec96f6f3a674f687dc0b23ec6699173211223d
-generated: "2024-01-02T20:49:32.367192173+01:00"
+digest: sha256:c2272865ffe4c805153440d8fc6af84945d4ce566b14d0fa8698d75382ada06c
+generated: "2024-01-06T01:28:34.164996418+01:00"

langfuse/Chart.yaml

@@ -1,6 +1,8 @@
 apiVersion: v2
 name: langfuse
 description: An experimental Helm chart for Langfuse
+maintainers:
+  - name: ilyannn
 
 # A chart can be either an 'application' or a 'library' chart.
 #
@@ -15,7 +17,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.0
+version: 0.2.1
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -24,7 +26,7 @@ version: 0.2.0
 appVersion: "1.28.0"
 
 dependencies:
-    - name: postgresql
-      repository: https://charts.bitnami.com/bitnami
-      version: 13.2.27
-      condition: postgresql.enabled
+  - name: postgresql
+    repository: https://charts.bitnami.com/bitnami
+    version: 13.2.27
+    condition: postgresql.enabled

langfuse/README.md

@@ -4,32 +4,28 @@ See [values.yaml](values.yaml) for the chart values. They are subject to change!
 
 ## Installation
 
-Example installation:
-
 ```shell
-helm install langfuse-demo https://github.com/ilyannn/charts/releases/download/langfuse-v0.2.0/langfuse-0.2.0.tgz -f langfuse-values.yaml
+helm install langfuse-demo https://ilyannn.github.io/charts/langfuse -f langfuse-values.yaml
 ```
 
-### Default Installation
-
-By default, Langfuse will be installed with the bundled Postgres.
+### Config-Free Installation
 
-The password will be generated and saved in a `Secret` (in this case, `langfuse-demo-postgres-secret`).
+The default values set up the bundled Postgres, and the chart takes care of and setting up
+the authentication between the database and the service.
 
+The Postgres password will be generated and saved in a `Secret` (in the example above, named
+`langfuse-demo-postgres-secret`).
 
-### OAuth 
+### Connecting to an Existing Database
 
-### Using Existing Database Connection
-
-Disable the bundled database and pass an exising connection URL instead.
+If the bundled chart is disabled, one can authenticate to an existing database.
 
 ```yaml
-databaseURL: "postgresql://some-existing-url"
-
 postgresql:
   enabled: false
-```
 
+databaseURL: "postgresql://some-existing-url"
+```
 
 ### Accessing the installation
 
@@ -41,18 +37,32 @@ ingress:
   hosts: ...
 ```
 
+### Additional options
 
-### Uninstalling
+Any options not present in the [values file](values.yaml) can be put into a `Secret` to be passed to Langfuse:
 
+```yaml
+additionalConfigurationSecret: langfuse-additional-options
+```
+
+You can create and update the secret at any time as it will not be managed by Helm.
+
+```shell
+kubectl create secret generic langfuse-additional-options \
+  --from-literal=AUTH_GITHUB_CLIENT_ID=... \
+  --from-literal=AUTH_GITHUB_CLIENT_SECRET=...
+```
+
+## Uninstalling
 
 The usual `helm uninstall RELEASE_NAME` should work, but note that the following objects are not deleted automatically:
 
 - the data PVC of the `postgres` subchart (if the subchart was enabled)
 - the `-postgres-secret` secret (unless `postgresql.secret.alwaysKeepWhenUninstalled` is unset)
+- the `-internal-secret` secret
 
-This means that you can reinstall the chart and continue accessing the same data. 
-
+This means that you can reinstall the chart and continue accessing the same data.
 
-### Example values
+## Example values
 
 See [megaver.se demo](https://docs.cluster.megaver.se/cluster/langfuse-demo-values.yaml)

langfuse/templates/_helpers.tpl

@@ -41,12 +41,18 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}
 
+{{- define "langfuse.internalSecret.annotations" -}}
+    "helm.sh/resource-policy": "keep"
+{{- end }}
+
 {{- define "langfuse.databaseHost" -}}
+{{- if .Values.postgresql.enabled -}}
 {{- printf "%s.%s.%s" 
     (include "postgresql.v1.primary.fullname" .Subcharts.postgresql) 
     .Release.Namespace
     "svc.cluster.local" -}}
 {{- end }}
+{{- end }}
 
 {{- define "langfuse.configMap" -}}
 {{- printf "%s-%s" (include "langfuse.fullname" .) "config-map" -}}

langfuse/templates/connection-secret.yaml

@@ -1,16 +1,16 @@
-{{- if (or .Values.databaseURL .Values.directURL) -}}
+{{- if (or (and (not .Values.postgresql.enabled) .Values.databaseURL) .Values.directURL) -}}
 
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ include "langfuse.connectionSecret.name" . }}
+  name: {{ include "langfuse.connectionSecret" . }}
 type: Opaque
-data:
+stringData:
   {{- if .Values.databaseURL }}
-  database-url: {{ .Values.databaseURL }}
+  database-url: {{ .Values.databaseURL | quote}}
   {{- end }}
   {{- if .Values.directURL }}
-  direct-url: {{ .Values.directURL }}
+  direct-url: {{ .Values.directURL | quote }}
   {{- end }}
 
 {{- end -}}

langfuse/templates/deployment.yaml

@@ -38,13 +38,7 @@ spec:
               containerPort: 3000
               protocol: TCP
           env:
-            {{- if .Values.databaseURL }}
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: {{- include "langfuse.connectionSecret" . }}
-                  key: database-url
-            {{- else }}
+            {{- if .Values.postgresql.enabled }}
             - name: DATABASE_USERNAME
               value: {{ .Values.postgresql.auth.username }}
             - name: DATABASE_NAME
@@ -56,6 +50,12 @@ spec:
                 secretKeyRef:
                   name: {{ include "langfuse.postgresqlSecret" . }}
                   key: {{ .Values.postgresql.auth.secretKeys.userPasswordKey }}
+            {{- else }}
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "langfuse.connectionSecret" . }}
+                  key: database-url
             {{- end }}
             {{- if .Values.directURL }}
             - name: DIRECT_URL
@@ -78,7 +78,11 @@ spec:
                   key: salt
           envFrom:
             - configMapRef:
-                  name: {{ include "langfuse.configMap" . }}
+                name: {{ include "langfuse.configMap" . }}
+            {{- if .Values.additionalConfigurationSecret }}
+            - secretRef:
+                name: {{ .Values.additionalConfigurationSecret }}
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /api/public/health

langfuse/templates/internal-secret.yaml

@@ -1,7 +1,8 @@
 {{- $secretName := (include "langfuse.internalSecret" .) -}}
 
 {{- include "langfuse.mergeSecretWithRandomForKeys" (dict 
-   "keys" (list "salt" "auth-secret") 
    "name" $secretName 
+   "annotations" (include "langfuse.internalSecret.annotations" .)
+   "keys" (list "salt" "auth-secret") 
    "context" .
  ) -}} 

langfuse/tests/existing_connection.yaml

@@ -0,0 +1,4 @@
+postgresql:
+  enabled: false
+
+databaseURL: "postgresql://user:password@example.com:1234/database"

langfuse/tests/localhost_connection.yaml

@@ -0,0 +1,2 @@
+postgresql:
+  enabled: false