add micro squid helm chart

[DaMandal0rian]

Type

Enhancement

---

Description

• Introduced a new Helm chart for the Rewards Squid application, including templates for deployments, services, and configurations.
• Configured essential Kubernetes resources such as ConfigMaps, Secrets, Persistent Volumes, and Roles.
• Added annotations and labels for better management and operability within a Kubernetes environment.
• Established security settings and resource management to ensure proper operation of the application components.

---

Changes walkthrough

	Relevant files
Configuration changes	22 files _helpers.tpl Add Helm Template Helpers for Rewards Squid                            explorer/k8s/helm/rewards-squid/templates/_helpers.tpl Added Helm template helpers for defining chart metadata and labels. Included definitions for chart name, labels, and service account naming. +60/-0    .helmignore Initialize Helm Ignore File for Rewards Squid                        explorer/k8s/helm/rewards-squid/.helmignore Created a .helmignore file to specify patterns to ignore during Helm packaging. +23/-0    Chart.yaml Setup Chart Metadata for Rewards Squid                                      explorer/k8s/helm/rewards-squid/Chart.yaml Set up basic metadata for the Rewards Squid Helm chart. Defined the chart as an application with versioning details. +24/-0    explorer-env-file Configure Environment Variables for Rewards Squid                explorer/k8s/helm/rewards-squid/config/explorer-env-file Configured environment variables for database and network endpoints. +8/-0      acme-certificate.yaml Define ClusterIssuer for SSL Certificate Management            explorer/k8s/helm/rewards-squid/misc/acme-certificate.yaml Defined a ClusterIssuer for managing SSL certificates via Let's Encrypt. +20/-0    clusterroles.yaml Setup ClusterRoles and Bindings for Rewards Squid                explorer/k8s/helm/rewards-squid/templates/clusterroles.yaml Created ClusterRole and ClusterRoleBinding configurations for access control. +55/-0    configmap.yaml Configure PostgreSQL Settings via ConfigMap                            explorer/k8s/helm/rewards-squid/templates/configmap.yaml - Configured a ConfigMap for PostgreSQL settings. +13/-0    hpa.yaml Add Horizontal Pod Autoscaler Configuration                            explorer/k8s/helm/rewards-squid/templates/hpa.yaml Added HorizontalPodAutoscaler configuration for scaling based on CPU and memory usage. +46/-0    ingress.yaml Setup Ingress Configuration for External Access                    explorer/k8s/helm/rewards-squid/templates/ingress.yaml - Configured Ingress for external access, including TLS settings. +45/-0    loadbal-svc.yaml Define LoadBalancer Service for Traffic Management              explorer/k8s/helm/rewards-squid/templates/loadbal-svc.yaml - Defined a LoadBalancer service for handling incoming traffic. +26/-0    namespace.yaml Create Namespace for Rewards Squid Application                      explorer/k8s/helm/rewards-squid/templates/namespace.yaml - Created a Kubernetes namespace for the Rewards Squid application. +6/-0      postgres-configmap.yaml Detailed PostgreSQL Configuration via ConfigMap                    explorer/k8s/helm/rewards-squid/templates/postgres-configmap.yaml - Configured PostgreSQL with detailed settings via a ConfigMap. +27/-0    pv.yaml Setup Persistent Volume for Data Storage                                  explorer/k8s/helm/rewards-squid/templates/pv.yaml Setup PersistentVolume for data storage with specific access modes and capacity. +15/-0    pvc.yaml Define Persistent Volume Claim for Storage                              explorer/k8s/helm/rewards-squid/templates/pvc.yaml Defined PersistentVolumeClaim for persistent data storage requirements. +17/-0    quota.yaml Establish Resource Quotas in Namespace                                      explorer/k8s/helm/rewards-squid/templates/quota.yaml - Established resource quotas for CPU and memory in the namespace. +11/-0    roles.yaml Configure Roles and Role Bindings for Operational Permissions explorer/k8s/helm/rewards-squid/templates/roles.yaml Configured various roles and role bindings for different operational permissions. +141/-0  secrets.yaml Secure PostgreSQL Credentials with Kubernetes Secrets        explorer/k8s/helm/rewards-squid/templates/secrets.yaml - Created secrets for securely storing PostgreSQL credentials. +9/-0      service.yaml Define Kubernetes Service for Application Access                  explorer/k8s/helm/rewards-squid/templates/service.yaml - Defined a Kubernetes service for the Rewards Squid application. +23/-0    serviceaccount.yaml Create Service Accounts for Operational Roles                        explorer/k8s/helm/rewards-squid/templates/serviceaccount.yaml Created service accounts for different operational roles within the application. +21/-0    statefulset.yaml Configure StatefulSet for Application Components                  explorer/k8s/helm/rewards-squid/templates/statefulset.yaml Configured a StatefulSet for managing stateful application components. +168/-0  storageclass.yaml Define StorageClass for Kubernetes Storage Management        explorer/k8s/helm/rewards-squid/templates/storageclass.yaml - Defined a StorageClass for managing storage in Kubernetes. +5/-0      values.yaml Set Default Values for Rewards Squid Helm Chart                    explorer/k8s/helm/rewards-squid/values.yaml Set default values for the Helm chart, including image repositories, service configurations, and resource limits. +178/-0
Documentation	1 files NOTES.txt Add Access Instructions to Helm NOTES for Rewards Squid    explorer/k8s/helm/rewards-squid/templates/NOTES.txt Provided instructions on how to access the deployed application based on service type. +22/-0

---

✨ PR-Agent usage: Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[github-actions[bot]]

PR Description updated to latest commit (https://github.com/subspace/infra/commit/31ba640a44663c7992d6d95f9d701aa20512339d)

[github-actions[bot]]

PR Review

⏱️ Estimated effort to review [1-5]	4, due to the extensive changes across multiple Kubernetes resources including configurations, roles, and deployment strategies. The PR introduces a new Helm chart which requires careful validation of templates and values to ensure they are correctly set up and do not introduce security or operational issues.
🧪 Relevant tests	No
🔍 Possible issues	Possible Security Concern: The PR includes sensitive data handling, especially in `templates/secrets.yaml` where database credentials are managed. If not properly secured, this could lead to unauthorized access.
	Configuration Concern: The PR sets up various configurations and environment variables (like in `templates/statefulset.yaml` and `config/explorer-env-file`). Misconfigurations here could lead to application failures or security vulnerabilities.
🔒 Security concerns	- Sensitive Information Exposure: The handling of PostgreSQL credentials in `templates/secrets.yaml` needs to ensure encryption and restricted access to avoid exposure.

Code feedback:

---

relevant file	explorer/k8s/helm/rewards-squid/templates/secrets.yaml
suggestion	Ensure that the base64 encoding for secrets is securely handled and consider implementing more secure secret management practices. [important]
relevant line	POSTGRES_PASSWORD: {{ .Values.postgres.postgresPassword | b64enc}}

---

relevant file	explorer/k8s/helm/rewards-squid/templates/statefulset.yaml
suggestion	Verify the environment variables for database connections are correctly sourced from secrets or config maps to avoid hardcoding sensitive information. [important]
relevant line	- name: POSTGRES_PASSWORD

---

relevant file	explorer/k8s/helm/rewards-squid/templates/ingress.yaml
suggestion	Review the ingress configuration to ensure that the TLS secrets and host configurations align with security best practices, especially in production environments. [important]
relevant line	secretName: {{ .Values.ingress.tls.secretName | quote }}

---

relevant file	explorer/k8s/helm/rewards-squid/templates/configmap.yaml
suggestion	Ensure that the configuration parameters like `POSTGRES_PORT` and `POSTGRES_HOST` are validated to prevent misconfigurations that could lead to service disruptions. [medium]
relevant line	POSTGRES_PORT: {{ .Values.postgres.postgresPort }}

---

---

✨ Review tool usage guide:

---

**Overview:** The `review` tool scans the PR code changes, and generates a PR review which includes several types of feedbacks, such as possible PR issues, security threats and relevant test in the PR. More feedbacks can be [added](https://pr-agent-docs.codium.ai/tools/review/#general-configurations) by configuring the tool. The tool can be triggered [automatically](https://pr-agent-docs.codium.ai/usage-guide/automations_and_usage/#github-app-automatic-tools-when-a-new-pr-is-opened) every time a new PR is opened, or can be invoked manually by commenting on any PR. - When commenting, to edit [configurations](https://github.com/Codium-ai/pr-agent/blob/main/pr_agent/settings/configuration.toml#L23) related to the review tool (`pr_reviewer` section), use the following template: ``` /review --pr_reviewer.some_config1=... --pr_reviewer.some_config2=... ``` - With a [configuration file](https://pr-agent-docs.codium.ai/usage-guide/configuration_options/), use the following template: ``` [pr_reviewer] some_config1=... some_config2=... ``` See the review [usage page](https://pr-agent-docs.codium.ai/tools/review/) for a comprehensive guide on using this tool.

[github-actions[bot]]

PR Code Suggestions

Category	Suggestions
Best practice	Use consistent and clear naming conventions for Helm templates. ___ **It's a best practice to use a consistent naming convention for Helm templates. The template name rewards-squid.name should be prefixed with the chart name to avoid conflicts and improve clarity when this chart is used as a dependency.** [explorer/k8s/helm/rewards-squid/templates/_helpers.tpl [4]](https://github.com/subspace/infra/pull/304/files#diff-1edc1bbca75a5a77bc63bbe03531c0b5fa04d7c2a8eda53971728fcfe17c18c9R4-R4) ```diff -{{- define "rewards-squid.name" -}} +{{- define "rewards-squid.chart-name" -}} ```
	Improve security by specifying the API group explicitly in role definitions. ___ **Consider using a more specific apiGroups instead of [""] which defaults to the core API group. This will make the permissions more explicit and can help in maintaining security best practices.** [explorer/k8s/helm/rewards-squid/templates/roles.yaml [7-9]](https://github.com/subspace/infra/pull/304/files#diff-180ebb43ea815291b80e8fe35ba0c284ffd2ef734855dc4edb04cb8faf33fe08R7-R9) ```diff -- apiGroups: [""] +- apiGroups: ["core"] resources: ["pods"] verbs: ["get", "watch", "list"] ```
Security	Specify the apiGroup in roleRef to target the correct API group. ___ **To enhance security, specify the apiGroup for the roleRef in the ClusterRoleBinding to ensure it targets the correct API group, especially when custom roles or extensions are used.** [explorer/k8s/helm/rewards-squid/templates/clusterroles.yaml [12-14]](https://github.com/subspace/infra/pull/304/files#diff-afc3c89c4cc14603b59146821b333f65ff9d48672e6dd47e95bc286420694322R12-R14) ```diff roleRef: kind: ClusterRole name: secret-reader + apiGroup: rbac.authorization.k8s.io ```
	Use HTTPS by default in ingress rules to enhance security. ___ **To improve the security of your Helm chart, consider using HTTPS for all ingress rules by default, especially if sensitive data is handled.** [explorer/k8s/helm/rewards-squid/templates/ingress.yaml [5]](https://github.com/subspace/infra/pull/304/files#diff-38eb1abb2dfd8b0637a6c11dcc72b736604c0c616410f35e91bd63fa67b260b0R5-R5) ```diff -http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} +https://{{ $host.host }}{{ .path }} ```
	Reduce the scope of verbs in role definitions to enhance security. ___ **It's recommended to avoid using overly broad permissions such as ["create", "update", "patch", "delete"] for resources unless absolutely necessary. Consider scoping down the permissions or splitting them into different roles for better security practices.** [explorer/k8s/helm/rewards-squid/templates/roles.yaml [36-38]](https://github.com/subspace/infra/pull/304/files#diff-180ebb43ea815291b80e8fe35ba0c284ffd2ef734855dc4edb04cb8faf33fe08R36-R38) ```diff - apiGroups: [""] resources: ["deployments"] - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + verbs: ["get", "list", "watch"] ```
	Improve security by handling sensitive data properly. ___ **The base64 encoding of secrets is not secure as it's merely an encoding, not encryption. It's recommended to store sensitive data securely using Kubernetes secrets management practices or external secrets management systems.** [explorer/k8s/helm/rewards-squid/templates/secrets.yaml [8-9]](https://github.com/subspace/infra/pull/304/files#diff-2444023fb66255910884d24244b5a66c05e8e375001a50bda6869f80cf70fbe0R8-R9) ```diff -POSTGRES_PASSWORD: {{ .Values.postgres.postgresPassword | b64enc}} -POSTGRES_USER: {{ .Values.postgres.postgresUser | b64enc}} +POSTGRES_PASSWORD: {{ .Values.postgres.postgresPassword }} +POSTGRES_USER: {{ .Values.postgres.postgresUser }} ```
Possible issue	Ensure consistent spacing in ConfigMap keys to avoid parsing errors. ___ **To avoid potential configuration errors, ensure that spaces are consistent in the ConfigMap keys. The key POSTGRES_HOST has an extra space before the colon which could lead to issues when parsing the key.** [explorer/k8s/helm/rewards-squid/templates/configmap.yaml [11]](https://github.com/subspace/infra/pull/304/files#diff-ab3577e2d64345cac4cbca8be03384cf37108735988084c7eba37448db0d4846R11-R11) ```diff -POSTGRES_HOST : {{ .Values.postgres.postgresHost }} +POSTGRES_HOST: {{ .Values.postgres.postgresHost }} ```
Maintainability	Use variables instead of hard-coded values in PersistentVolume configurations. ___ **For better maintainability and to avoid hard-coded values, use a variable for the volumeHandle in the PersistentVolume configuration to allow easy updates and environment-specific configurations.** [explorer/k8s/helm/rewards-squid/templates/pv.yaml [15]](https://github.com/subspace/infra/pull/304/files#diff-145a735a61210da81e03a31ee698eb67820d6e28740d39b94287483d8c396baeR15-R15) ```diff -volumeHandle: fs-073d77123471b2917 +volumeHandle: {{ .Values.persistence.volumeHandle }} ```
	Enhance flexibility by parameterizing the namespace in the ServiceAccount name. ___ **Using a hardcoded namespace in the ServiceAccount name could lead to conflicts or deployment issues in environments with different namespaces. Consider parameterizing the namespace part of the ServiceAccount name.** [explorer/k8s/helm/rewards-squid/templates/statefulset.yaml [21]](https://github.com/subspace/infra/pull/304/files#diff-b2c9a61b03dc3ac722f17e32d3679c65483fb1a22875e9c369cc1ea119313ca8R21-R21) ```diff -serviceAccountName: {{ include "rewards-squid.serviceAccountName" . }} +serviceAccountName: {{ include "rewards-squid.serviceAccountName" . }}-{{ .Values.namespace | quote }} ```
Performance	Optimize image pulling by using cached images when available. ___ **The imagePullPolicy is set to Always, which can lead to unnecessary pulling of images. Consider using IfNotPresent to utilize the cached images when available, which can reduce network bandwidth and speed up the deployment process.** [explorer/k8s/helm/rewards-squid/templates/statefulset.yaml [27]](https://github.com/subspace/infra/pull/304/files#diff-b2c9a61b03dc3ac722f17e32d3679c65483fb1a22875e9c369cc1ea119313ca8R27-R27) ```diff -imagePullPolicy: {{ .Values.image.pullPolicy | quote }} +imagePullPolicy: IfNotPresent ```

---

✨ Improve tool usage guide:

---

**Overview:** The `improve` tool scans the PR code changes, and automatically generates suggestions for improving the PR code. The tool can be triggered [automatically](https://pr-agent-docs.codium.ai/usage-guide/automations_and_usage/#github-app-automatic-tools-when-a-new-pr-is-opened) every time a new PR is opened, or can be invoked manually by commenting on a PR. - When commenting, to edit [configurations](https://github.com/Codium-ai/pr-agent/blob/main/pr_agent/settings/configuration.toml#L78) related to the improve tool (`pr_code_suggestions` section), use the following template: ``` /improve --pr_code_suggestions.some_config1=... --pr_code_suggestions.some_config2=... ``` - With a [configuration file](https://pr-agent-docs.codium.ai/usage-guide/configuration_options/), use the following template: ``` [pr_code_suggestions] some_config1=... some_config2=... ``` See the improve [usage page](https://pr-agent-docs.codium.ai/tools/improve/) for a comprehensive guide on using this tool.

[jfrank-summit]

/review

[github-actions[bot]]

PR Review 🔍

⏱️ Estimated effort to review [1-5]	4, due to the extensive number of files and configurations involved, which includes complex Helm templates, Kubernetes resources, and security settings. The PR introduces a new Helm chart with multiple components that need careful review to ensure they are correctly configured and secure.
🧪 Relevant tests	No
⚡ Possible issues	Possible Security Issue: The `POSTGRES_PASSWORD` and `POSTGRES_USER` are base64 encoded but not encrypted in the secrets.yaml file, which might expose sensitive data if the secret is accessed.
	Configuration Concern: The `listen_addresses` in the `postgres-configmap.yaml` is set to '0.0.0.0', which might expose the PostgreSQL service to the internet if not properly secured by network policies or firewalls.
🔒 Security concerns	Sensitive information exposure: Secrets like `POSTGRES_PASSWORD` are only base64 encoded, which is not secure as base64 is easily decodable. Consider encrypting these secrets or using a more secure method of storing sensitive information.

Code feedback:

---

relevant file	explorer/k8s/helm/micro-squid/templates/secrets.yaml
suggestion	Consider using Kubernetes secret encryption or an external secrets manager to enhance the security of sensitive data like `POSTGRES_PASSWORD`. This can prevent unauthorized access to sensitive information. [important]
relevant line	POSTGRES_PASSWORD: {{ .Values.postgres.postgresPassword | b64enc}}

---

relevant file	explorer/k8s/helm/micro-squid/templates/postgres-configmap.yaml
suggestion	Change the `listen_addresses` in the PostgreSQL configuration to listen only on localhost or a secure internal network to prevent unauthorized external access. This enhances security by reducing the potential attack surface. [important]
relevant line	listen_addresses = '0.0.0.0'

---

relevant file	explorer/k8s/helm/micro-squid/templates/ingress.yaml
suggestion	Ensure that the ingress annotations include security headers such as HSTS and XSS protection to enhance security for clients accessing the application through ingress. [medium]
relevant line	annotations:

---

relevant file	explorer/k8s/helm/micro-squid/templates/statefulset.yaml
suggestion	Add a startup probe to the PostgreSQL container to ensure the database is fully operational before marking it as ready, which can prevent traffic from being routed to a non-ready database instance. [medium]
relevant line	livenessProbe:

---