Split Tornjak Frontend into separate subchart (#179)

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>

charts/spire/Chart.yaml

@@ -38,6 +38,10 @@ dependencies:
     condition: spiffe-oidc-discovery-provider.enabled
     repository: file://./charts/spiffe-oidc-discovery-provider
     version: 0.1.0
+  - name: tornjak-frontend
+    condition: tornjak-frontend.enabled
+    repository: file://./charts/tornjak-frontend
+    version: 0.1.0
 annotations:
   artifacthub.io/category: security
   artifacthub.io/license: Apache-2.0

charts/spire/README.md

@@ -104,6 +104,7 @@ Kubernetes: `>=1.21.0-0`
 | file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 |
 | file://./charts/spire-agent | spire-agent | 0.1.0 |
 | file://./charts/spire-server | spire-server | 0.1.0 |
+| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
 
 ## Values
 
@@ -355,5 +356,6 @@ Kubernetes: `>=1.21.0-0`
 | spire-server.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
 | spire-server.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
 | spire-server.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
+| tornjak-frontend.enabled | bool | `false` |  |
 
 ----------------------------------------------

charts/spire/charts/spire-server/README.md

@@ -106,14 +106,13 @@ A Helm chart to install the SPIRE server.
 | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
-| tornjak.config.backend.dataStore.driver | string | `"sqlite3"` |  |
+| tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | persistent DB for storing Tornjak specific information |
-| tornjak.config.backend.dataStore.file | string | `"/run/spire/data/tornjak.sqlite3"` |  |
+| tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) |
-| tornjak.config.frontend.apiServerURL | string | `"http://localhost:10000"` |  |
+| tornjak.image | object | `{"pullPolicy":"IfNotPresent","registry":"ghcr.io","repository":"spiffe/tornjak-be","version":"v1.0.2"}` | Tornjak API image |
-| tornjak.enabled | bool | `false` |  |
+| tornjak.image.version | string | `"v1.0.2"` | Overrides the image tag whose default is the chart appVersion. |
-| tornjak.image.pullPolicy | string | `"IfNotPresent"` |  |
+| tornjak.service.annotations | object | `{}` |  |
-| tornjak.image.registry | string | `"ghcr.io"` |  |
+| tornjak.service.port | int | `10000` |  |
-| tornjak.image.repository | string | `"spiffe/tornjak"` |  |
+| tornjak.service.type | string | `"ClusterIP"` |  |
-| tornjak.image.version | string | `"latest"` |  |
 | trustDomain | string | `"example.org"` |  |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |

charts/spire/charts/spire-server/templates/NOTES.txt

@@ -8,17 +8,14 @@ Installed {{ .Chart.Name }}…
 {{- if eq (.Values.tornjak.enabled | toString) "true" }}
 
 ### WARNING ###
+
 This Tornjak is configured without authentication and it is intended for
 testing only. Please do not use this version in production.
 
 Tornjak APIs (Backend):
-      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 10000:10000
+      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 {{ .Values.tornjak.service.port }}:10000
 
-Tornjak UI (Frontend):
+Open browser to: http://localhost:{{ .Values.tornjak.service.port }}
-      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 3000:3000
-
-Tornjak API access:  {{ include "tornjak.apiURL" . }}
-Tornjak UI access:   {{ include "tornjak.frontendURL" . }}
 
 Installed {{ include "spire-tornjak.fullname" . }}…
 {{- end }}

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -164,9 +164,6 @@ Tornjak specific section
 {{- define "spire-tornjak.config" -}}
 {{ include "spire-tornjak.fullname" . }}-config
 {{- end }}
-{{- define "spire-tornjak.frontend" -}}
-{{ include "spire-tornjak.fullname" . }}-fe
-{{- end }}
 {{- define "spire-tornjak.backend" -}}
 {{ include "spire-tornjak.fullname" . }}-be
 {{- end }}

charts/spire/charts/spire-server/templates/service.yaml

@@ -31,31 +31,22 @@ spec:
 ---
 apiVersion: v1
 kind: Service
-metadata:
-  namespace: {{ include "spire-server.namespace" . }}
-  name: {{ include "spire-tornjak.frontend" . }}
-spec:
-  type: {{ .Values.service.type }} # ClusterIP
-  selector:
-    {{- include "spire-server.selectorLabels" . | nindent 4 }}
-  ports:
-    - name: {{ include "spire-tornjak.frontend" . }}
-      port: 3000
-      targetPort: 3000
-      protocol: TCP
----
-apiVersion: v1
-kind: Service
 metadata:
   namespace: {{ include "spire-server.namespace" . }}
   name: {{ include "spire-tornjak.backend" . }}
+  {{- with .Values.tornjak.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
 spec:
-  type: {{ .Values.service.type }} # ClusterIP
+  type: {{ .Values.tornjak.service.type }}
   selector:
    {{- include "spire-server.selectorLabels" . | nindent 4 }}
   ports:
     - name: {{ include "spire-tornjak.backend" . }}
-      port: 10000
+      port: {{ .Values.tornjak.service.port }}
-      targetPort: 10000
+      targetPort: tornjak
       protocol: TCP
 {{- end }}

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -167,24 +167,20 @@ spec:
           startupProbe:
             httpGet:
               scheme: HTTP
-              port: 3000
+              port: 10000
-            failureThreshold: 6
+            failureThreshold: 3
-            initialDelaySeconds: 60
+            initialDelaySeconds: 5
-            periodSeconds: 30
+            periodSeconds: 10
             successThreshold: 1
-            timeoutSeconds: 10
+            timeoutSeconds: 5
-          env:
-          {{- if .Values.tornjak.config.frontend }}
-          - name: REACT_APP_API_SERVER_URI
-            value: {{ include "tornjak.apiURL" . | required "Either .Values.tornjak.config.backend.ingress or .Values.tornjak.config.frontend.apiServerURL is required." }}
-          {{- end }}
           args:
             - -c
             - /run/spire/config/server.conf
             - -t
             - /run/spire/tornjak-config/server.conf
           ports:
-          - containerPort: 3000
+            - name: tornjak
+              containerPort: 10000
               protocol: TCP
           volumeMounts:
             - name: {{ include "spire-tornjak.config" . }}

charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml

@@ -5,6 +5,7 @@ metadata:
   name: "{{ include "spire-tornjak.fullname" . }}-test-connection"
   namespace: {{ include "spire-server.namespace" . }}
   labels:
+    {{- include "spire-server.labels" . | nindent 4 }}
   annotations:
     "helm.sh/hook": test
 spec:
@@ -12,15 +13,9 @@ spec:
     {{- toYaml .Values.podSecurityContext | nindent 4 }}
   containers:
     - name: wget-tornjak-backend
-      image: busybox
+      image: cgr.dev/chainguard/bash:latest
-      command: ['wget']
+      command: ['curl']
-      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.backend" . }}:10000/api/tornjak/serverinfo']
+      args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.backend" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.port }}']
-      securityContext:
-        {{- toYaml .Values.securityContext | nindent 8 }}
-    - name: wget-tornjak-frontend
-      image: busybox
-      command: ['wget']
-      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.frontend" . }}:3000']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
   restartPolicy: Never

charts/spire/charts/spire-server/templates/tornjak-config.yaml

@@ -11,11 +11,11 @@ data:
     }
 
     plugins {
-    {{- if .Values.tornjak.config.backend.dataStore }}
+    {{- if .Values.tornjak.config.dataStore }}
       DataStore "sql" {
         plugin_data {
-          drivername = "{{ .Values.tornjak.config.backend.dataStore.driver }}"
+          drivername = "{{ .Values.tornjak.config.dataStore.driver }}"
-          filename = "{{ .Values.tornjak.config.backend.dataStore.file }}"
+          filename = "{{ .Values.tornjak.config.dataStore.file }}"
         }
       }
     {{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -12,7 +12,7 @@ image:
   repository: spiffe/spire-server
   # -- The image pull policy
   pullPolicy: IfNotPresent
-  # Overrides the image tag whose default is the chart appVersion.
+  # -- Overrides the image tag whose default is the chart appVersion.
   version: ""
 
 imagePullSecrets: []
@@ -258,23 +258,21 @@ nodeAttestor:
 
 # tornjak - Tornjak specific configuration
 tornjak:
+  # -- Deploys Tornjak API (backend)
   enabled: false
-  # image - Tornjak image (frontend + backend) if not separated above
+  # -- Tornjak API image
-  image: # ghcr.io/spiffe/tornjak
+  image:
     registry: ghcr.io
-    repository: spiffe/tornjak
+    repository: spiffe/tornjak-be
     pullPolicy: IfNotPresent
-    # Overrides the image tag whose default is the chart appVersion.
+    # -- Overrides the image tag whose default is the chart appVersion.
-    # TODO we should use a specific Tornjak version instead of 'latest'
+    version: "v1.0.2"
-    version: "latest"
+  service:
+    type: ClusterIP
+    port: 10000
+    annotations: {}
   config:
-    # Front-end specific configuration:
+    # -- persistent DB for storing Tornjak specific information
-    frontend:
-      # apiServerURL - URL of the Tornjak back-end
-      apiServerURL: "http://localhost:10000"  # 👈 Use it for minikube or kind
-     # Back-end specific configuration
-    backend:
-      # dataStore - persistent DB for storing Tornjak specific information
     dataStore:
       driver: "sqlite3"
       file: "/run/spire/data/tornjak.sqlite3"

charts/spire/charts/tornjak-frontend/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+name: tornjak-frontend
+description: A Helm chart to deploy Tornjak frontend
+type: application
+version: 0.1.0
+appVersion: "v1.0.2"
+maintainers:
+  - name: mrsabath
+    email: [email protected]
+    url: https://mrsabath.github.io

charts/spire/charts/tornjak-frontend/README.md

@@ -0,0 +1,64 @@
+# tornjak-frontend
+
+<!-- This README.md is generated. Please edit README.md.gotmpl -->
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.0.2](https://img.shields.io/badge/AppVersion-v1.0.2-informational?style=flat-square)
+[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
+
+A Helm chart to deploy Tornjak frontend
+
+## Version support
+
+> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
+> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
+> we do aim for as much stability as possible.
+
+| Dependency | Supported Versions |
+|:-----------|:-------------------|
+| SPIRE      | `1.5.3+`, `1.6.x`  |
+| Tornjak    | `1.0.x`            |
+| Helm       | `3.x`              |
+
+## Prerequisites
+
+This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
+This URL needs to be reachable from your webbrowser and can therefore not be a cluster internal URL.
+
+Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
+Tornjak APIs are typically available at `http://localhost:10000`.
+Review Tornjak documentation for more details.
+
+## Usage
+
+Since this is just a demo version, to access Tornjak APIs you can use
+port forwarding. See the chart NOTES output for more details.
+
+## Maintainers
+
+| Name | Email | Url |
+| ---- | ------ | --- |
+| mrsabath | <mrsabath@gmail.com> | <https://mrsabath.github.io> |
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| apiServerURL | string | `"http://localhost:10000/"` | URL of the Tornjak APIs (backend) Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. |
+| fullnameOverride | string | `""` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.registry | string | `"ghcr.io"` |  |
+| image.repository | string | `"spiffe/tornjak-fe"` |  |
+| image.version | string | `""` | Overrides the image tag whose default is the chart appVersion. |
+| imagePullSecrets | list | `[]` |  |
+| labels | object | `{}` |  |
+| nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
+| podSecurityContext | object | `{}` |  |
+| securityContext | object | `{}` |  |
+| service.annotations | object | `{}` |  |
+| service.port | int | `3000` |  |
+| service.type | string | `"ClusterIP"` |  |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+----------------------------------------------

charts/spire/charts/tornjak-frontend/README.md.gotmpl

@@ -0,0 +1,47 @@
+{{ template "chart.header" . }}
+
+<!-- This README.md is generated. Please edit README.md.gotmpl -->
+
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.badgesSection" . }}
+[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
+
+{{ template "chart.description" . }}
+
+{{ template "chart.homepageLine" . }}
+
+## Version support
+
+> **Note**: This Chart is still in development and still subject to change the API (`values.yaml`).
+> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
+> we do aim for as much stability as possible.
+
+| Dependency | Supported Versions |
+|:-----------|:-------------------|
+| SPIRE      | `1.5.3+`, `1.6.x`  |
+| Tornjak    | `1.0.x`            |
+| Helm       | `3.x`              |
+
+## Prerequisites
+
+This chart requires access to Tornjak Backend (`tornjakFrontend.apiServerURL`).
+This URL needs to be reachable from your webbrowser and can therefore not be a cluster internal URL.
+
+Obtain the URL for Tornjak APIs. If deployed in the same cluster, locally,
+Tornjak APIs are typically available at `http://localhost:10000`.
+Review Tornjak documentation for more details.
+
+## Usage
+
+Since this is just a demo version, to access Tornjak APIs you can use
+port forwarding. See the chart NOTES output for more details.
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}
+----------------------------------------------

charts/spire/charts/tornjak-frontend/templates/NOTES.txt

@@ -0,0 +1,25 @@
+Installed {{ .Chart.Name }}…
+
+Name: {{ include "tornjak-frontend.name" . }}
+Fullname: {{ include "tornjak-frontend.fullname" . }}
+Your release is named: {{ .Release.Name }}
+Namespace: {{ include "tornjak-frontend.namespace" . }}
+
+Tornjak UI (Frontend)
+  image: {{ template "tornjak-frontend.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+  pull policy: {{ .Values.image.pullPolicy }}
+Configured with Tornjak API (Backend): {{ include "tornjak-frontend.apiURL" . }}
+
+### WARNING ###
+This Tornjak is configured without authentication and it is intended for
+testing only. Please do not use this version in production.
+
+You can use port forwarding to access UI:
+  kubectl -n {{ include "tornjak-frontend.namespace" . }} port-forward service/{{ include "tornjak-frontend.fullname" . }} {{ .Values.service.port }}:3000
+
+Open browser to: http://localhost:{{ .Values.service.port }}
+
+To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }}
+  $ helm get all {{ .Release.Name }}

charts/spire/charts/tornjak-frontend/templates/_helpers.tpl

@@ -0,0 +1,109 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "tornjak-frontend.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "tornjak-frontend.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "tornjak-frontend.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "tornjak-frontend.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "tornjak-frontend.cluster-domain" -}}
+{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
+{{- .Values.global.k8s.clusterDomain }}
+{{- else }}
+{{- .Values.clusterDomain }}
+{{- end }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "tornjak-frontend.labels" -}}
+helm.sh/chart: {{ include "tornjak-frontend.chart" . }}
+{{ include "tornjak-frontend.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "tornjak-frontend.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "tornjak-frontend.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "tornjak-frontend.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "tornjak-frontend.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create an image name
+*/}}
+{{- define "tornjak-frontend.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if
+    .Values.tornjakFrontend.image.version -}}
+{{- printf "%s/%s:%s" .Values.tornjakFrontend.image.registry .Values.tornjakFrontend.image.repository .Values.tornjakFrontend.image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .Values.tornjakFrontend.image.registry .Values.tornjakFrontend.image.repository -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Create URL for accessing Tornjak APIs
+*/}}
+{{- define "tornjak-frontend.apiURL" -}}
+{{- if .Values.apiServerURL -}}
+{{- .Values.apiServerURL -}}
+{{- else }}
+{{- $feurl := print "http://localhost:" .Values.service.port }}
+{{- $feurl }}
+{{- end }}
+{{- end }}

charts/spire/charts/tornjak-frontend/templates/deployment.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "tornjak-frontend.fullname" . }}
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "tornjak-frontend.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "tornjak-frontend.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "tornjak-frontend.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name:  {{ include "tornjak-frontend.fullname" . }}
+          image: {{ template "tornjak-frontend.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: REACT_APP_API_SERVER_URI
+              value: {{ include "tornjak-frontend.apiURL" . }}
+          startupProbe:
+            httpGet:
+              scheme: HTTP
+              port: {{ .Values.service.port }}
+            failureThreshold: 6
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 10

charts/spire/charts/tornjak-frontend/templates/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  name: {{ include "tornjak-frontend.fullname" . }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    {{- include "tornjak-frontend.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "tornjak-frontend.fullname" . }}
+      port: {{ .Values.service.port }}
+      targetPort: http

charts/spire/charts/tornjak-frontend/templates/serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "tornjak-frontend.serviceAccountName" . }}
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/spire/charts/tornjak-frontend/templates/tests/test-tornjak-connection.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "tornjak-frontend.fullname" . }}-test-connection"
+  namespace: {{ include "tornjak-frontend.namespace" . }}
+  labels:
+    {{- include "tornjak-frontend.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  securityContext:
+    {{- toYaml .Values.podSecurityContext | nindent 4 }}
+  containers:
+    - name: curl-tornjak-frontend
+      image: cgr.dev/chainguard/bash:latest
+      command: ['curl']
+      args: ['-k', '-s', '-f', 'http://{{ include "tornjak-frontend.fullname" . }}.{{ include "tornjak-frontend.namespace" . }}.svc.{{ include "tornjak-frontend.cluster-domain" . }}:{{ .Values.service.port }}']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+  restartPolicy: Never
+

charts/spire/charts/tornjak-frontend/values.yaml

@@ -0,0 +1,47 @@
+# Default values for Tornjak UI (Frontend).
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+image:
+  registry: ghcr.io
+  repository: spiffe/tornjak-fe
+  pullPolicy: IfNotPresent
+  # -- Overrides the image tag whose default is the chart appVersion.
+  version: ""
+
+imagePullSecrets: []
+nameOverride: ""
+namespaceOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # -- Specifies whether a service account should be created
+  create: true
+  # -- Annotations to add to the service account
+  annotations: {}
+  # -- The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+labels: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  type: ClusterIP
+  port: 3000
+  annotations: {}
+
+# -- URL of the Tornjak APIs (backend)
+# Since Tornjak Frontend runs in the browser, this URL must be accessible from
+# the machine running a browser.
+apiServerURL: "http://localhost:10000/"  # 👈 Use it for minikube or kind

charts/spire/values.yaml

@@ -41,3 +41,6 @@ spiffe-csi-driver:
 
 spiffe-oidc-discovery-provider:
   enabled: false
+
+tornjak-frontend:
+  enabled: false