abrban/cloud-host
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve critical deployment issues across Helm charts, Dockerfile, and K8s fallback

Browse Source 
- Add helm/kubectl binaries and chart directory to backend Dockerfile
- Extend Helm templates for MongoDB/MariaDB database support (env vars, probes, ports)
- Add Redis and RabbitMQ Helm templates (deployment, service, secret, PVC)
- Add generic app-storage PVC and Fluent Bit sidecar with ES authentication
- Fix imagePullSecrets in K8s API fallback, prevent secret regeneration on redeploy
- Clean up Redis/RabbitMQ/FluentBit resources on app deletion without removing shared secrets
- Fix HelmService chartPath resolution for production Docker builds

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
keyhan
2026-05-13 19:16:07 +03:30
parent 38748b0827
commit 9937ee457d
11 changed files with 665 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/helm/cloudhost-app/templates/_helpers.tpl
+34 -2
View File
@@ -54,6 +54,10 @@ Database image — auto-computed from type + version if not explicitly set
{{- .Values.database.image }}
{{- else if eq .Values.database.type "postgresql" }}
{{- printf "postgres:%s-alpine" .Values.database.version }}
{{- else if eq .Values.database.type "mariadb" }}
{{- printf "mariadb:%s" .Values.database.version }}
{{- else if eq .Values.database.type "mongodb" }}
{{- printf "mongo:%s" .Values.database.version }}
{{- else }}
{{- printf "mysql:%s" .Values.database.version }}
{{- end }}
@@ -63,14 +67,20 @@ Database image — auto-computed from type + version if not explicitly set
Database port
*/}}
{{- define "cloudhost-app.dbPort" -}}
{{- if eq .Values.database.type "postgresql" }}5432{{- else }}3306{{- end }}
{{- if eq .Values.database.type "postgresql" }}5432
{{- else if eq .Values.database.type "mongodb" }}27017
{{- else }}3306
{{- end }}
{{- end }}
{{/*
Database data mount path (volume mount target)
*/}}
{{- define "cloudhost-app.dbDataPath" -}}
{{- if eq .Values.database.type "postgresql" }}/var/lib/postgresql/data{{- else }}/var/lib/mysql{{- end }}
{{- if eq .Values.database.type "postgresql" }}/var/lib/postgresql/data
{{- else if eq .Values.database.type "mongodb" }}/data/db
{{- else }}/var/lib/mysql
{{- end }}
{{- end }}
{{/*
@@ -79,3 +89,25 @@ PostgreSQL PGDATA path — must be a subdirectory of the mount to avoid "initdb:
{{- define "cloudhost-app.pgDataDir" -}}
/var/lib/postgresql/data/pgdata
{{- end }}
{{/*
App storage mount path based on runtime
*/}}
{{- define "cloudhost-app.storageMountPath" -}}
{{- if eq .Values.app.runtime "wordpress" }}/var/www/html/wp-content
{{- else if or (eq .Values.app.runtime "laravel") (eq .Values.app.runtime "php") }}/var/www/html/storage
{{- else if eq .Values.app.runtime "django" }}/app/media
{{- else }}/app/data
{{- end }}
{{- end }}
{{/*
Default log paths based on runtime
*/}}
{{- define "cloudhost-app.defaultLogPaths" -}}
{{- if eq .Values.app.runtime "wordpress" }}/var/www/html/wp-content/debug.log,/var/log/app/*.log
{{- else if eq .Values.app.runtime "laravel" }}/var/www/html/storage/logs/*.log,/var/log/app/*.log
{{- else if or (eq .Values.app.runtime "php") }}/var/www/html/storage/logs/*.log,/var/log/php/*.log,/var/log/app/*.log
{{- else }}/var/log/app/*.log
{{- end }}
{{- end }}
backend/helm/cloudhost-app/templates/app-storage-pvc.yaml
+17
View File
@@ -0,0 +1,17 @@
{{- $name := include "cloudhost-app.name" . -}}
{{- $ns := include "cloudhost-app.namespace" . -}}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ $name }}-storage
namespace: {{ $ns }}
labels:
{{- include "cloudhost-app.labels" . | nindent 4 }}
annotations:
"helm.sh/resource-policy": keep
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: {{ .Values.app.storageSize | default "2Gi" | quote }}
backend/helm/cloudhost-app/templates/db-deployment.yaml
+43
View File
@@ -44,6 +44,37 @@ spec:
secretKeyRef:
name: {{ $name }}-db-secret
key: password
{{- else if eq .Values.database.type "mariadb" }}
- name: MARIADB_DATABASE
value: {{ include "cloudhost-app.dbName" . }}
- name: MARIADB_USER
valueFrom:
secretKeyRef:
name: {{ $name }}-db-secret
key: username
- name: MARIADB_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $name }}-db-secret
key: password
- name: MARIADB_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $name }}-db-secret
key: password
{{- else if eq .Values.database.type "mongodb" }}
- name: MONGO_INITDB_DATABASE
value: {{ include "cloudhost-app.dbName" . }}
- name: MONGO_INITDB_ROOT_USERNAME
valueFrom:
secretKeyRef:
name: {{ $name }}-db-secret
key: username
- name: MONGO_INITDB_ROOT_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $name }}-db-secret
key: password
{{- else }}
- name: MYSQL_DATABASE
value: {{ include "cloudhost-app.dbName" . }}
@@ -77,6 +108,12 @@ spec:
{{- if eq .Values.database.type "postgresql" }}
exec:
command: ["pg_isready", "-U", {{ .Values.database.username | quote }}]
{{- else if eq .Values.database.type "mariadb" }}
exec:
command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
{{- else if eq .Values.database.type "mongodb" }}
exec:
command: ["mongosh", "--eval", "db.adminCommand('ping')"]
{{- else }}
exec:
command: ["mysqladmin", "ping", "-h", "127.0.0.1"]
@@ -88,6 +125,12 @@ spec:
{{- if eq .Values.database.type "postgresql" }}
exec:
command: ["pg_isready", "-U", {{ .Values.database.username | quote }}]
{{- else if eq .Values.database.type "mariadb" }}
exec:
command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
{{- else if eq .Values.database.type "mongodb" }}
exec:
command: ["mongosh", "--eval", "db.adminCommand('ping')"]
{{- else }}
exec:
command: ["mysqladmin", "ping", "-h", "127.0.0.1"]
backend/helm/cloudhost-app/templates/deployment.yaml
+127 -6
View File
@@ -74,6 +74,83 @@ spec:
- name: DATABASE_URL
value: "mysql://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:3306/{{ include "cloudhost-app.dbName" . }}"
{{- end }}
{{- if and .Values.database.enabled (eq .Values.database.type "mariadb") }}
- name: DB_HOST
value: {{ include "cloudhost-app.dbDeploymentName" . }}
- name: DB_PORT
value: "3306"
- name: DB_NAME
value: {{ include "cloudhost-app.dbName" . }}
- name: DB_USER
valueFrom:
secretKeyRef:
name: {{ $name }}-db-secret
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $name }}-db-secret
key: password
- name: DATABASE_URL
value: "mysql://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:3306/{{ include "cloudhost-app.dbName" . }}"
{{- end }}
{{- if and .Values.database.enabled (eq .Values.database.type "mongodb") }}
- name: DB_HOST
value: {{ include "cloudhost-app.dbDeploymentName" . }}
- name: DB_PORT
value: "27017"
- name: DB_NAME
value: {{ include "cloudhost-app.dbName" . }}
- name: DB_USER
valueFrom:
secretKeyRef:
name: {{ $name }}-db-secret
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $name }}-db-secret
key: password
- name: MONGODB_URI
value: "mongodb://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:27017/{{ include "cloudhost-app.dbName" . }}?authSource=admin"
- name: DATABASE_URL
value: "mongodb://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:27017/{{ include "cloudhost-app.dbName" . }}?authSource=admin"
{{- end }}
{{- /* Redis connection env vars */}}
{{- if .Values.redis.enabled }}
- name: REDIS_HOST
value: {{ printf "%s-redis" $name }}
- name: REDIS_PORT
value: "6379"
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
name: {{ printf "%s-redis-secret" $name }}
key: password
- name: REDIS_URL
value: "redis://:$(REDIS_PASSWORD)@{{ printf "%s-redis" $name }}:6379"
{{- end }}
{{- /* RabbitMQ connection env vars */}}
{{- if .Values.rabbitmq.enabled }}
- name: RABBITMQ_HOST
value: {{ printf "%s-rabbitmq" $name }}
- name: RABBITMQ_PORT
value: "5672"
- name: RABBITMQ_MANAGEMENT_PORT
value: "15672"
- name: RABBITMQ_USER
valueFrom:
secretKeyRef:
name: {{ printf "%s-rabbitmq-secret" $name }}
key: username
- name: RABBITMQ_PASSWORD
valueFrom:
secretKeyRef:
name: {{ printf "%s-rabbitmq-secret" $name }}
key: password
- name: AMQP_URL
value: "amqp://$(RABBITMQ_USER):$(RABBITMQ_PASSWORD)@{{ printf "%s-rabbitmq" $name }}:5672"
{{- end }}
{{- /* WordPress-specific env vars (official image expects these) */}}
{{- if and .Values.wordpress.enabled .Values.database.enabled }}
- name: WORDPRESS_DB_HOST
@@ -111,14 +188,58 @@ spec:
initialDelaySeconds: 15
periodSeconds: 10
failureThreshold: 5
{{- if .Values.wordpress.enabled }}
volumeMounts:
- name: wp-content
mountPath: /var/www/html/wp-content
{{- end }}
{{- if .Values.wordpress.enabled }}
- name: app-storage
mountPath: {{ include "cloudhost-app.storageMountPath" . | trim }}
{{- if .Values.elasticsearch.enabled }}
- name: app-logs
mountPath: /var/log/app
{{- end }}
{{- if .Values.elasticsearch.enabled }}
- name: fluent-bit
image: fluent/fluent-bit:2.2
resources:
requests:
cpu: "10m"
memory: "32Mi"
limits:
cpu: "50m"
memory: "64Mi"
volumeMounts:
- name: app-logs
mountPath: /var/log/app
readOnly: true
- name: fluent-bit-config
mountPath: /fluent-bit/etc
env:
- name: APP_NAME
value: {{ $name }}
- name: APP_NAMESPACE
value: {{ $ns }}
- name: ES_HOST
value: "elasticsearch.logging.svc.cluster.local"
- name: ES_PORT
value: "9200"
- name: ES_PASSWORD
valueFrom:
secretKeyRef:
name: elasticsearch-credentials
key: ELASTIC_PASSWORD
optional: true
{{- end }}
volumes:
- name: app-storage
persistentVolumeClaim:
claimName: {{ $name }}-storage
{{- if .Values.wordpress.enabled }}
- name: wp-content
persistentVolumeClaim:
claimName: {{ $name }}-wp-content
{{- end }}
{{- end }}
{{- if .Values.elasticsearch.enabled }}
- name: app-logs
emptyDir: {}
- name: fluent-bit-config
configMap:
name: {{ $name }}-fluent-bit-config
{{- end }}
backend/helm/cloudhost-app/templates/fluent-bit-configmap.yaml
+71
View File
@@ -0,0 +1,71 @@
{{- if .Values.elasticsearch.enabled }}
{{- $name := include "cloudhost-app.name" . -}}
{{- $ns := include "cloudhost-app.namespace" . -}}
{{- $logPaths := .Values.elasticsearch.logPaths -}}
{{- $defaultPaths := include "cloudhost-app.defaultLogPaths" . | trim -}}
{{- $paths := ternary ($logPaths | join ",") $defaultPaths (and $logPaths (gt (len $logPaths) 0)) -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ $name }}-fluent-bit-config
namespace: {{ $ns }}
labels:
{{- include "cloudhost-app.labels" . | nindent 4 }}
data:
fluent-bit.conf: |
[SERVICE]
Flush 5
Daemon Off
Log_Level info
Parsers_File /fluent-bit/etc/parsers.conf
[INPUT]
Name tail
Path {{ $paths }}
Tag app.{{ $name }}
Refresh_Interval 5
Mem_Buf_Limit 5MB
Skip_Long_Lines On
[FILTER]
Name record_modifier
Match *
Record app {{ $name }}
Record namespace {{ $ns }}
Record runtime {{ .Values.app.runtime }}
[FILTER]
Name parser
Match *
Key_Name log
Parser json
Reserve_Data On
Preserve_Key On
[OUTPUT]
Name es
Match *
Host ${ES_HOST}
Port ${ES_PORT}
HTTP_User elastic
HTTP_Passwd ${ES_PASSWORD}
Index logs-{{ $ns }}-{{ $name }}
Logstash_Format On
Logstash_Prefix logs-{{ $ns }}
Suppress_Type_Name On
tls Off
Retry_Limit 3
parsers.conf: |
[PARSER]
Name json
Format json
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
[PARSER]
Name docker
Format json
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
{{- end }}
backend/helm/cloudhost-app/templates/rabbitmq-deployment.yaml
+123
View File
@@ -0,0 +1,123 @@
{{- if .Values.rabbitmq.enabled }}
{{- $name := include "cloudhost-app.name" . -}}
{{- $ns := include "cloudhost-app.namespace" . -}}
{{- $rabbitName := printf "%s-rabbitmq" $name -}}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ $rabbitName }}-secret
namespace: {{ $ns }}
labels:
app: {{ $rabbitName }}
{{- include "cloudhost-app.labels" . | nindent 4 }}
annotations:
"helm.sh/resource-policy": keep
type: Opaque
data:
username: {{ "appuser" | b64enc | quote }}
password: {{ randAlphaNum 16 | b64enc | quote }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ $rabbitName }}-data
namespace: {{ $ns }}
labels:
app: {{ $rabbitName }}
{{- include "cloudhost-app.labels" . | nindent 4 }}
annotations:
"helm.sh/resource-policy": keep
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: {{ .Values.rabbitmq.storageSize | default "2Gi" | quote }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ $rabbitName }}
namespace: {{ $ns }}
labels:
app: {{ $rabbitName }}
{{- include "cloudhost-app.labels" . | nindent 4 }}
spec:
replicas: 1
selector:
matchLabels:
app: {{ $rabbitName }}
template:
metadata:
labels:
app: {{ $rabbitName }}
spec:
containers:
- name: rabbitmq
image: {{ printf "rabbitmq:%s-management-alpine" (.Values.rabbitmq.version | default "3.13") }}
ports:
- containerPort: 5672
name: amqp
- containerPort: 15672
name: management
env:
- name: RABBITMQ_DEFAULT_USER
valueFrom:
secretKeyRef:
name: {{ $rabbitName }}-secret
key: username
- name: RABBITMQ_DEFAULT_PASS
valueFrom:
secretKeyRef:
name: {{ $rabbitName }}-secret
key: password
volumeMounts:
- name: rabbitmq-data
mountPath: /var/lib/rabbitmq
resources:
requests:
cpu: {{ .Values.rabbitmq.resources.cpuRequest | default "100m" | quote }}
memory: {{ .Values.rabbitmq.resources.memoryRequest | default "256Mi" | quote }}
limits:
cpu: {{ .Values.rabbitmq.resources.cpuLimit | default "500m" | quote }}
memory: {{ .Values.rabbitmq.resources.memoryLimit | default "512Mi" | quote }}
readinessProbe:
exec:
command: ["rabbitmq-diagnostics", "-q", "ping"]
initialDelaySeconds: 20
periodSeconds: 10
timeoutSeconds: 5
livenessProbe:
exec:
command: ["rabbitmq-diagnostics", "-q", "status"]
initialDelaySeconds: 60
periodSeconds: 30
timeoutSeconds: 10
volumes:
- name: rabbitmq-data
persistentVolumeClaim:
claimName: {{ $rabbitName }}-data
---
apiVersion: v1
kind: Service
metadata:
name: {{ $rabbitName }}
namespace: {{ $ns }}
labels:
app: {{ $rabbitName }}
{{- include "cloudhost-app.labels" . | nindent 4 }}
spec:
type: ClusterIP
selector:
app: {{ $rabbitName }}
ports:
- port: 5672
targetPort: 5672
protocol: TCP
name: amqp
- port: 15672
targetPort: 15672
protocol: TCP
name: management
{{- end }}
backend/helm/cloudhost-app/templates/redis-deployment.yaml
+108
View File
@@ -0,0 +1,108 @@
{{- if .Values.redis.enabled }}
{{- $name := include "cloudhost-app.name" . -}}
{{- $ns := include "cloudhost-app.namespace" . -}}
{{- $redisName := printf "%s-redis" $name -}}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ $redisName }}-secret
namespace: {{ $ns }}
labels:
app: {{ $redisName }}
{{- include "cloudhost-app.labels" . | nindent 4 }}
annotations:
"helm.sh/resource-policy": keep
type: Opaque
data:
password: {{ randAlphaNum 16 | b64enc | quote }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ $redisName }}-data
namespace: {{ $ns }}
labels:
app: {{ $redisName }}
{{- include "cloudhost-app.labels" . | nindent 4 }}
annotations:
"helm.sh/resource-policy": keep
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: {{ .Values.redis.storageSize | default "1Gi" | quote }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ $redisName }}
namespace: {{ $ns }}
labels:
app: {{ $redisName }}
{{- include "cloudhost-app.labels" . | nindent 4 }}
spec:
replicas: 1
selector:
matchLabels:
app: {{ $redisName }}
template:
metadata:
labels:
app: {{ $redisName }}
spec:
containers:
- name: redis
image: {{ printf "redis:%s-alpine" (.Values.redis.version | default "7.2") }}
args: ["--requirepass", "$(REDIS_PASSWORD)"]
ports:
- containerPort: 6379
env:
- name: REDIS_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $redisName }}-secret
key: password
volumeMounts:
- name: redis-data
mountPath: /data
resources:
requests:
cpu: {{ .Values.redis.resources.cpuRequest | default "50m" | quote }}
memory: {{ .Values.redis.resources.memoryRequest | default "64Mi" | quote }}
limits:
cpu: {{ .Values.redis.resources.cpuLimit | default "200m" | quote }}
memory: {{ .Values.redis.resources.memoryLimit | default "256Mi" | quote }}
readinessProbe:
exec:
command: ["redis-cli", "ping"]
initialDelaySeconds: 5
periodSeconds: 10
livenessProbe:
exec:
command: ["redis-cli", "ping"]
initialDelaySeconds: 15
periodSeconds: 20
volumes:
- name: redis-data
persistentVolumeClaim:
claimName: {{ $redisName }}-data
---
apiVersion: v1
kind: Service
metadata:
name: {{ $redisName }}
namespace: {{ $ns }}
labels:
app: {{ $redisName }}
{{- include "cloudhost-app.labels" . | nindent 4 }}
spec:
type: ClusterIP
selector:
app: {{ $redisName }}
ports:
- port: 6379
targetPort: 6379
protocol: TCP
{{- end }}
backend/helm/cloudhost-app/values.yaml
+29 -1
View File
@@ -7,10 +7,11 @@
app:
name: my-app
namespace: user-default
runtime: nodejs # nodejs | laravel | wordpress
runtime: nodejs # nodejs | laravel | wordpress | go | php | python | django | dotnet
image: "" # e.g. registry.example.com/my-app:v1
port: 3000
replicas: 1
storageSize: "2Gi" # PVC size for app files (uploads, media, data)
# ── Resources ────────────────────────────────────────────
resources:
@@ -51,6 +52,33 @@ wordpress:
enabled: false
wpContentStorageSize: "2Gi"
# ── Redis ──────────────────────────────────────────────
redis:
enabled: false
version: "7.2"
storageSize: "1Gi"
resources:
cpuRequest: "50m"
cpuLimit: "200m"
memoryRequest: "64Mi"
memoryLimit: "256Mi"
# ── RabbitMQ ──────────────────────────────────────────
rabbitmq:
enabled: false
version: "3.13"
storageSize: "2Gi"
resources:
cpuRequest: "100m"
cpuLimit: "500m"
memoryRequest: "256Mi"
memoryLimit: "512Mi"
# ── Elasticsearch (Fluent Bit sidecar for logging) ────
elasticsearch:
enabled: false
logPaths: []
# ── Change metadata ─────────────────────────────────────
changeCause: ""