Create initial Helm chart for High Five

ucsdlib / hifive

An application supporting an Employee Recognition program workflow

MIT License

0 stars 0 forks source link

Create initial Helm chart for High Five #301

Closed mcritchlow closed 5 years ago

mcritchlow commented 5 years ago

Descriptive summary

Create initial Helm chart for deploying the High Five application to a k8s cluster.

Rationale

see: #297

Expected behavior

A /.hifive chart should be created with Helm and populated to support necessary secrets, ingress, and database support
Use official postgres Helm chart as dependency
Create a k3d script for local testing of the chart
PVC for postgres database
PVC for postfix spoolfile
...

see: recent Starlight and Theodor work for reference implementations

mcritchlow commented 5 years ago

status update: https://github.com/ucsdlib/hifive/compare/init-helm-chart

todo:

~~add pvc for spoolfile~~
test everything out w/ @VivianChu
probably fix a lot of other things
get the k3d script working

mcritchlow commented 5 years ago

Much closer, but currently having an issue w/ the database connection between the application and the database containers.

getting:

2019-10-28 23:19:49.029 GMT [3631] FATAL: password authentication failed for user "hifive"

2019-10-28 23:19:49.029 GMT [3631] DETAIL: Role "hifive" does not exist.

Otherwise, the chart is deployed in our Rancher cluster for testing. Will circle back tomorrow

mcritchlow commented 5 years ago

Progress report:

The helm chart is mostly functional. All the containers get setup and deployed successfully
The application is current unable to communicate w/ the email container/service. I'm hoping to be able to carve out a bit of time tomorrow w/ @rstanonik to troubleshoot this

Once email is working, I'm going to submit a PR to get this initial work in place

mcritchlow commented 5 years ago

Oh also I have shib commented out in the production config file. Don't let me merge/commit that change accidentally! :)

mcritchlow commented 5 years ago

Thoughts on connection issues:

do we need to set a custom network via MYNETWORKS?
Is the network policy not setup/matching correctly? Should we remove that and see if things work?

Edit: thinking this might be a policy thing: exec'ing a shell on the running app container, I can nc -z the db host just fine, but not the email host.

mcritchlow commented 5 years ago

Ok, so the network policy is/was definitely the problem. I think a few things to figure out:

does our networking solution we're using (and ucsb for that matter) support networking policies?
clearly the network policy was doing something since removing it made the app work. it seems that it did lock down the email service but that it definitely did not let the app in. Focus on that.

mcritchlow commented 5 years ago

Got it working w/ a network policy. PR coming