fix: resolve critical deployment issues across Helm charts, Dockerfile, and K8s fallback

- Add helm/kubectl binaries and chart directory to backend Dockerfile - Extend Helm templates for MongoDB/MariaDB database support (env vars, probes, ports) - Add Redis and RabbitMQ Helm templates (deployment, service, secret, PVC) - Add generic app-storage PVC and Fluent Bit sidecar with ES authentication - Fix imagePullSecrets in K8s API fallback, prevent secret regeneration on redeploy - Clean up Redis/RabbitMQ/FluentBit resources on app deletion without removing shared secrets - Fix HelmService chartPath resolution for production Docker builds Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-13 19:16:07 +03:30
parent 38748b0827
commit 9937ee457d
11 changed files with 665 additions and 55 deletions
@@ -54,6 +54,10 @@ Database image — auto-computed from type + version if not explicitly set
  {{- .Values.database.image }}
 {{- else if eq .Values.database.type "postgresql" }}
  {{- printf "postgres:%s-alpine" .Values.database.version }}
+{{- else if eq .Values.database.type "mariadb" }}
+  {{- printf "mariadb:%s" .Values.database.version }}
+{{- else if eq .Values.database.type "mongodb" }}
+  {{- printf "mongo:%s" .Values.database.version }}
 {{- else }}
  {{- printf "mysql:%s" .Values.database.version }}
 {{- end }}
@@ -63,14 +67,20 @@ Database image — auto-computed from type + version if not explicitly set
 Database port
 */}}
 {{- define "cloudhost-app.dbPort" -}}
-{{- if eq .Values.database.type "postgresql" }}5432{{- else }}3306{{- end }}
+{{- if eq .Values.database.type "postgresql" }}5432
+{{- else if eq .Values.database.type "mongodb" }}27017
+{{- else }}3306
+{{- end }}
 {{- end }}

 {{/*
 Database data mount path (volume mount target)
 */}}
 {{- define "cloudhost-app.dbDataPath" -}}
-{{- if eq .Values.database.type "postgresql" }}/var/lib/postgresql/data{{- else }}/var/lib/mysql{{- end }}
+{{- if eq .Values.database.type "postgresql" }}/var/lib/postgresql/data
+{{- else if eq .Values.database.type "mongodb" }}/data/db
+{{- else }}/var/lib/mysql
+{{- end }}
 {{- end }}

 {{/*
@@ -79,3 +89,25 @@ PostgreSQL PGDATA path — must be a subdirectory of the mount to avoid "initdb:
 {{- define "cloudhost-app.pgDataDir" -}}
 /var/lib/postgresql/data/pgdata
 {{- end }}
+
+{{/*
+App storage mount path based on runtime
+*/}}
+{{- define "cloudhost-app.storageMountPath" -}}
+{{- if eq .Values.app.runtime "wordpress" }}/var/www/html/wp-content
+{{- else if or (eq .Values.app.runtime "laravel") (eq .Values.app.runtime "php") }}/var/www/html/storage
+{{- else if eq .Values.app.runtime "django" }}/app/media
+{{- else }}/app/data
+{{- end }}
+{{- end }}
+
+{{/*
+Default log paths based on runtime
+*/}}
+{{- define "cloudhost-app.defaultLogPaths" -}}
+{{- if eq .Values.app.runtime "wordpress" }}/var/www/html/wp-content/debug.log,/var/log/app/*.log
+{{- else if eq .Values.app.runtime "laravel" }}/var/www/html/storage/logs/*.log,/var/log/app/*.log
+{{- else if or (eq .Values.app.runtime "php") }}/var/www/html/storage/logs/*.log,/var/log/php/*.log,/var/log/app/*.log
+{{- else }}/var/log/app/*.log
+{{- end }}
+{{- end }}
@@ -0,0 +1,17 @@
+{{- $name := include "cloudhost-app.name" . -}}
+{{- $ns   := include "cloudhost-app.namespace" . -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ $name }}-storage
+  namespace: {{ $ns }}
+  labels:
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.app.storageSize | default "2Gi" | quote }}
@@ -44,6 +44,37 @@ spec:
                secretKeyRef:
                  name: {{ $name }}-db-secret
                  key: password
+            {{- else if eq .Values.database.type "mariadb" }}
+            - name: MARIADB_DATABASE
+              value: {{ include "cloudhost-app.dbName" . }}
+            - name: MARIADB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $name }}-db-secret
+                  key: username
+            - name: MARIADB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $name }}-db-secret
+                  key: password
+            - name: MARIADB_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $name }}-db-secret
+                  key: password
+            {{- else if eq .Values.database.type "mongodb" }}
+            - name: MONGO_INITDB_DATABASE
+              value: {{ include "cloudhost-app.dbName" . }}
+            - name: MONGO_INITDB_ROOT_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $name }}-db-secret
+                  key: username
+            - name: MONGO_INITDB_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $name }}-db-secret
+                  key: password
            {{- else }}
            - name: MYSQL_DATABASE
              value: {{ include "cloudhost-app.dbName" . }}
@@ -77,6 +108,12 @@ spec:
            {{- if eq .Values.database.type "postgresql" }}
            exec:
              command: ["pg_isready", "-U", {{ .Values.database.username | quote }}]
+            {{- else if eq .Values.database.type "mariadb" }}
+            exec:
+              command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
+            {{- else if eq .Values.database.type "mongodb" }}
+            exec:
+              command: ["mongosh", "--eval", "db.adminCommand('ping')"]
            {{- else }}
            exec:
              command: ["mysqladmin", "ping", "-h", "127.0.0.1"]
@@ -88,6 +125,12 @@ spec:
            {{- if eq .Values.database.type "postgresql" }}
            exec:
              command: ["pg_isready", "-U", {{ .Values.database.username | quote }}]
+            {{- else if eq .Values.database.type "mariadb" }}
+            exec:
+              command: ["healthcheck.sh", "--connect", "--innodb_initialized"]
+            {{- else if eq .Values.database.type "mongodb" }}
+            exec:
+              command: ["mongosh", "--eval", "db.adminCommand('ping')"]
            {{- else }}
            exec:
              command: ["mysqladmin", "ping", "-h", "127.0.0.1"]
@@ -74,6 +74,83 @@ spec:
            - name: DATABASE_URL
              value: "mysql://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:3306/{{ include "cloudhost-app.dbName" . }}"
            {{- end }}
+            {{- if and .Values.database.enabled (eq .Values.database.type "mariadb") }}
+            - name: DB_HOST
+              value: {{ include "cloudhost-app.dbDeploymentName" . }}
+            - name: DB_PORT
+              value: "3306"
+            - name: DB_NAME
+              value: {{ include "cloudhost-app.dbName" . }}
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $name }}-db-secret
+                  key: username
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $name }}-db-secret
+                  key: password
+            - name: DATABASE_URL
+              value: "mysql://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:3306/{{ include "cloudhost-app.dbName" . }}"
+            {{- end }}
+            {{- if and .Values.database.enabled (eq .Values.database.type "mongodb") }}
+            - name: DB_HOST
+              value: {{ include "cloudhost-app.dbDeploymentName" . }}
+            - name: DB_PORT
+              value: "27017"
+            - name: DB_NAME
+              value: {{ include "cloudhost-app.dbName" . }}
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $name }}-db-secret
+                  key: username
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $name }}-db-secret
+                  key: password
+            - name: MONGODB_URI
+              value: "mongodb://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:27017/{{ include "cloudhost-app.dbName" . }}?authSource=admin"
+            - name: DATABASE_URL
+              value: "mongodb://$(DB_USER):$(DB_PASSWORD)@{{ include "cloudhost-app.dbDeploymentName" . }}:27017/{{ include "cloudhost-app.dbName" . }}?authSource=admin"
+            {{- end }}
+            {{- /* Redis connection env vars */}}
+            {{- if .Values.redis.enabled }}
+            - name: REDIS_HOST
+              value: {{ printf "%s-redis" $name }}
+            - name: REDIS_PORT
+              value: "6379"
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ printf "%s-redis-secret" $name }}
+                  key: password
+            - name: REDIS_URL
+              value: "redis://:$(REDIS_PASSWORD)@{{ printf "%s-redis" $name }}:6379"
+            {{- end }}
+            {{- /* RabbitMQ connection env vars */}}
+            {{- if .Values.rabbitmq.enabled }}
+            - name: RABBITMQ_HOST
+              value: {{ printf "%s-rabbitmq" $name }}
+            - name: RABBITMQ_PORT
+              value: "5672"
+            - name: RABBITMQ_MANAGEMENT_PORT
+              value: "15672"
+            - name: RABBITMQ_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ printf "%s-rabbitmq-secret" $name }}
+                  key: username
+            - name: RABBITMQ_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ printf "%s-rabbitmq-secret" $name }}
+                  key: password
+            - name: AMQP_URL
+              value: "amqp://$(RABBITMQ_USER):$(RABBITMQ_PASSWORD)@{{ printf "%s-rabbitmq" $name }}:5672"
+            {{- end }}
            {{- /* WordPress-specific env vars (official image expects these) */}}
            {{- if and .Values.wordpress.enabled .Values.database.enabled }}
            - name: WORDPRESS_DB_HOST
@@ -111,14 +188,58 @@ spec:
            initialDelaySeconds: 15
            periodSeconds: 10
            failureThreshold: 5
-          {{- if .Values.wordpress.enabled }}
          volumeMounts:
-            - name: wp-content
-              mountPath: /var/www/html/wp-content
-          {{- end }}
-      {{- if .Values.wordpress.enabled }}
+            - name: app-storage
+              mountPath: {{ include "cloudhost-app.storageMountPath" . | trim }}
+            {{- if .Values.elasticsearch.enabled }}
+            - name: app-logs
+              mountPath: /var/log/app
+            {{- end }}
+        {{- if .Values.elasticsearch.enabled }}
+        - name: fluent-bit
+          image: fluent/fluent-bit:2.2
+          resources:
+            requests:
+              cpu: "10m"
+              memory: "32Mi"
+            limits:
+              cpu: "50m"
+              memory: "64Mi"
+          volumeMounts:
+            - name: app-logs
+              mountPath: /var/log/app
+              readOnly: true
+            - name: fluent-bit-config
+              mountPath: /fluent-bit/etc
+          env:
+            - name: APP_NAME
+              value: {{ $name }}
+            - name: APP_NAMESPACE
+              value: {{ $ns }}
+            - name: ES_HOST
+              value: "elasticsearch.logging.svc.cluster.local"
+            - name: ES_PORT
+              value: "9200"
+            - name: ES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: elasticsearch-credentials
+                  key: ELASTIC_PASSWORD
+                  optional: true
+        {{- end }}
      volumes:
+        - name: app-storage
+          persistentVolumeClaim:
+            claimName: {{ $name }}-storage
+        {{- if .Values.wordpress.enabled }}
        - name: wp-content
          persistentVolumeClaim:
            claimName: {{ $name }}-wp-content
-      {{- end }}
+        {{- end }}
+        {{- if .Values.elasticsearch.enabled }}
+        - name: app-logs
+          emptyDir: {}
+        - name: fluent-bit-config
+          configMap:
+            name: {{ $name }}-fluent-bit-config
+        {{- end }}
@@ -0,0 +1,71 @@
+{{- if .Values.elasticsearch.enabled }}
+{{- $name := include "cloudhost-app.name" . -}}
+{{- $ns   := include "cloudhost-app.namespace" . -}}
+{{- $logPaths := .Values.elasticsearch.logPaths -}}
+{{- $defaultPaths := include "cloudhost-app.defaultLogPaths" . | trim -}}
+{{- $paths := ternary ($logPaths | join ",") $defaultPaths (and $logPaths (gt (len $logPaths) 0)) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $name }}-fluent-bit-config
+  namespace: {{ $ns }}
+  labels:
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+data:
+  fluent-bit.conf: |
+    [SERVICE]
+        Flush         5
+        Daemon        Off
+        Log_Level     info
+        Parsers_File  /fluent-bit/etc/parsers.conf
+
+    [INPUT]
+        Name          tail
+        Path          {{ $paths }}
+        Tag           app.{{ $name }}
+        Refresh_Interval 5
+        Mem_Buf_Limit 5MB
+        Skip_Long_Lines On
+
+    [FILTER]
+        Name          record_modifier
+        Match         *
+        Record        app {{ $name }}
+        Record        namespace {{ $ns }}
+        Record        runtime {{ .Values.app.runtime }}
+
+    [FILTER]
+        Name          parser
+        Match         *
+        Key_Name      log
+        Parser        json
+        Reserve_Data  On
+        Preserve_Key  On
+
+    [OUTPUT]
+        Name          es
+        Match         *
+        Host          ${ES_HOST}
+        Port          ${ES_PORT}
+        HTTP_User     elastic
+        HTTP_Passwd   ${ES_PASSWORD}
+        Index         logs-{{ $ns }}-{{ $name }}
+        Logstash_Format On
+        Logstash_Prefix logs-{{ $ns }}
+        Suppress_Type_Name On
+        tls           Off
+        Retry_Limit   3
+
+  parsers.conf: |
+    [PARSER]
+        Name        json
+        Format      json
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L
+
+    [PARSER]
+        Name        docker
+        Format      json
+        Time_Key    time
+        Time_Format %Y-%m-%dT%H:%M:%S.%L
+{{- end }}
@@ -0,0 +1,123 @@
+{{- if .Values.rabbitmq.enabled }}
+{{- $name       := include "cloudhost-app.name" . -}}
+{{- $ns         := include "cloudhost-app.namespace" . -}}
+{{- $rabbitName := printf "%s-rabbitmq" $name -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $rabbitName }}-secret
+  namespace: {{ $ns }}
+  labels:
+    app: {{ $rabbitName }}
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+type: Opaque
+data:
+  username: {{ "appuser" | b64enc | quote }}
+  password: {{ randAlphaNum 16 | b64enc | quote }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ $rabbitName }}-data
+  namespace: {{ $ns }}
+  labels:
+    app: {{ $rabbitName }}
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.rabbitmq.storageSize | default "2Gi" | quote }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $rabbitName }}
+  namespace: {{ $ns }}
+  labels:
+    app: {{ $rabbitName }}
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ $rabbitName }}
+  template:
+    metadata:
+      labels:
+        app: {{ $rabbitName }}
+    spec:
+      containers:
+        - name: rabbitmq
+          image: {{ printf "rabbitmq:%s-management-alpine" (.Values.rabbitmq.version | default "3.13") }}
+          ports:
+            - containerPort: 5672
+              name: amqp
+            - containerPort: 15672
+              name: management
+          env:
+            - name: RABBITMQ_DEFAULT_USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $rabbitName }}-secret
+                  key: username
+            - name: RABBITMQ_DEFAULT_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $rabbitName }}-secret
+                  key: password
+          volumeMounts:
+            - name: rabbitmq-data
+              mountPath: /var/lib/rabbitmq
+          resources:
+            requests:
+              cpu: {{ .Values.rabbitmq.resources.cpuRequest | default "100m" | quote }}
+              memory: {{ .Values.rabbitmq.resources.memoryRequest | default "256Mi" | quote }}
+            limits:
+              cpu: {{ .Values.rabbitmq.resources.cpuLimit | default "500m" | quote }}
+              memory: {{ .Values.rabbitmq.resources.memoryLimit | default "512Mi" | quote }}
+          readinessProbe:
+            exec:
+              command: ["rabbitmq-diagnostics", "-q", "ping"]
+            initialDelaySeconds: 20
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            exec:
+              command: ["rabbitmq-diagnostics", "-q", "status"]
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 10
+      volumes:
+        - name: rabbitmq-data
+          persistentVolumeClaim:
+            claimName: {{ $rabbitName }}-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $rabbitName }}
+  namespace: {{ $ns }}
+  labels:
+    app: {{ $rabbitName }}
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ $rabbitName }}
+  ports:
+    - port: 5672
+      targetPort: 5672
+      protocol: TCP
+      name: amqp
+    - port: 15672
+      targetPort: 15672
+      protocol: TCP
+      name: management
+{{- end }}
@@ -0,0 +1,108 @@
+{{- if .Values.redis.enabled }}
+{{- $name    := include "cloudhost-app.name" . -}}
+{{- $ns      := include "cloudhost-app.namespace" . -}}
+{{- $redisName := printf "%s-redis" $name -}}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $redisName }}-secret
+  namespace: {{ $ns }}
+  labels:
+    app: {{ $redisName }}
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+type: Opaque
+data:
+  password: {{ randAlphaNum 16 | b64enc | quote }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ $redisName }}-data
+  namespace: {{ $ns }}
+  labels:
+    app: {{ $redisName }}
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/resource-policy": keep
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.redis.storageSize | default "1Gi" | quote }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $redisName }}
+  namespace: {{ $ns }}
+  labels:
+    app: {{ $redisName }}
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ $redisName }}
+  template:
+    metadata:
+      labels:
+        app: {{ $redisName }}
+    spec:
+      containers:
+        - name: redis
+          image: {{ printf "redis:%s-alpine" (.Values.redis.version | default "7.2") }}
+          args: ["--requirepass", "$(REDIS_PASSWORD)"]
+          ports:
+            - containerPort: 6379
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $redisName }}-secret
+                  key: password
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+          resources:
+            requests:
+              cpu: {{ .Values.redis.resources.cpuRequest | default "50m" | quote }}
+              memory: {{ .Values.redis.resources.memoryRequest | default "64Mi" | quote }}
+            limits:
+              cpu: {{ .Values.redis.resources.cpuLimit | default "200m" | quote }}
+              memory: {{ .Values.redis.resources.memoryLimit | default "256Mi" | quote }}
+          readinessProbe:
+            exec:
+              command: ["redis-cli", "ping"]
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            exec:
+              command: ["redis-cli", "ping"]
+            initialDelaySeconds: 15
+            periodSeconds: 20
+      volumes:
+        - name: redis-data
+          persistentVolumeClaim:
+            claimName: {{ $redisName }}-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ $redisName }}
+  namespace: {{ $ns }}
+  labels:
+    app: {{ $redisName }}
+    {{- include "cloudhost-app.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ $redisName }}
+  ports:
+    - port: 6379
+      targetPort: 6379
+      protocol: TCP
+{{- end }}