diff --git a/.github/workflows/_helm-ci.yml b/.github/workflows/_helm-ci.yml new file mode 100644 index 00000000..7f641376 --- /dev/null +++ b/.github/workflows/_helm-ci.yml @@ -0,0 +1,115 @@ +name: Helm CI Shared + +on: + workflow_call: + inputs: + run_release: + required: false + type: boolean + default: false + database: + required: false + type: string + default: mysql + +env: + K3D_VERSION: 5.7.4 + HELM_VERSION: 3.14.4 + KUBECTL_VERSION: 1.29.2 + KUSTOMIZE_VERSION: 5.3.0 + +jobs: + helm-ci: + runs-on: ubuntu-latest + permissions: + contents: write + + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Helm linting + run: ./test/lint.sh + + - name: Install toolchain + run: | + mkdir -p ${GITHUB_WORKSPACE}/bin/ + + # kubectl + curl -L https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl \ + -o ${GITHUB_WORKSPACE}/bin/kubectl + chmod +x ${GITHUB_WORKSPACE}/bin/kubectl + + # helm + curl -L https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz -o helm.tar.gz + tar -xzf helm.tar.gz + mv linux-amd64/helm ${GITHUB_WORKSPACE}/bin/helm + chmod +x ${GITHUB_WORKSPACE}/bin/helm + + # kustomize + curl -L https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz -o kustomize.tar.gz + tar -xzf kustomize.tar.gz + mv kustomize ${GITHUB_WORKSPACE}/bin/kustomize + chmod +x ${GITHUB_WORKSPACE}/bin/kustomize + + # k3d + curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG=v${K3D_VERSION} bash + + # taskfile + curl -sL https://taskfile.dev/install.sh | sh + + # yq + curl -L https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 \ + -o ${GITHUB_WORKSPACE}/bin/yq + chmod +x ${GITHUB_WORKSPACE}/bin/yq + + - name: Add bin to PATH + run: echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH + + - name: Create Kubernetes Cluster + run: k3d cluster create --config=cluster/config.yaml + + - name: Install Drupal Helm Chart + run: | + cd charts/drupal + + if [ "${{ inputs.database }}" = "postgresql" ]; then + echo "Testing PostgreSQL install" + helm install drupal \ + -f values.yaml \ + --set mysql.enabled=false \ + --set postgresql.enabled=true \ + . --timeout=600s + else + echo "Testing MySQL install" + helm install drupal \ + -f values.yaml \ + --set mysql.enabled=true \ + --set postgresql.enabled=false \ + . --timeout=600s + fi + + - name: Configure Git + if: inputs.run_release == true + run: | + git config user.name "chart-releaser" + git config user.email "chart-releaser@users.noreply.github.com" + + - name: Add Helm repositories + if: inputs.run_release == true + run: | + for repo in $(yq '.chart-repos[]' test/config.yaml); do + helm repo add $(echo $repo | cut -d'=' -f1) $(echo $repo | cut -d'=' -f2) --force-update + done + helm repo update + + - name: Run chart-releaser + if: inputs.run_release == true + uses: helm/chart-releaser-action@v1.6.0 + with: + charts_dir: ./charts + env: + CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" + CR_SKIP_EXISTING: "true" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5934a8c6..38fa4865 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,86 +2,15 @@ name: Release Charts on: push: - branches: - - main - -# Environment variables available to all jobs and steps in this workflow -env: - K3D_VERSION: 5.4.4 - HELM_VERSION: 3.11.3 - KUBECTL_VERSION: 1.23.4 - KUSTOMIZE_VERSION: 4.5.7 + branches: [ main ] jobs: release: - # depending on default permission settings for your org (contents being read-only or read-write for workloads), you will have to add permissions - # see: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token - permissions: - contents: write - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v2 - with: - fetch-depth: 0 - - - name: Helm linting - run: | - ./test/lint.sh - - - name: Dependencies - run: | - mkdir -p ${GITHUB_WORKSPACE}/bin/ - - # install kubectl - curl -L https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl -o ${GITHUB_WORKSPACE}/bin/kubectl && chmod +x ${GITHUB_WORKSPACE}/bin/kubectl - - # install helm - curl -L https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz -o helm-v${HELM_VERSION}-linux-amd64.tar.gz && tar -zxvf helm-v${HELM_VERSION}-linux-amd64.tar.gz && chmod +x linux-amd64/helm && mv linux-amd64/helm ${GITHUB_WORKSPACE}/bin/helm - - # install kustomize - curl -L https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz -o kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz && tar -zxvf kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz && chmod +x kustomize && mv kustomize ${GITHUB_WORKSPACE}/bin/kustomize - - # install k3d - curl -s https://raw.githubusercontent.com/rancher/k3d/main/install.sh | TAG=v${K3D_VERSION} bash - - # install taskfile - curl -sL https://taskfile.dev/install.sh | sh - - # install yq - sudo snap install yq - - - name: GitHub Path - run: | - echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH - - - name: Create Kubernetes Cluster - run: | - k3d cluster create --config=cluster/config.yaml - - # - name: Test Drupal Helm Chart - # run: | - # cd charts/drupal - # helm install drupal -f values.yaml . --timeout=600s - - - name: Configure Git - run: | - git config user.name "chart-releaser" - git config user.email "chart-releaser@users.noreply.github.com" - - - name: Install Helm - uses: azure/setup-helm@v1 - with: - version: v3.8.1 - - - name: Add repositories - run: | - for repo in $(yq '.chart-repos[]' test/config.yaml); do helm repo add $(echo $repo | cut -d'=' -f1) $(echo $repo | cut -d'=' -f2) --force-update; done - - - name: Run chart-releaser - uses: helm/chart-releaser-action@v1.4.0 - with: - charts_dir: ./charts - env: - CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" - CR_SKIP_EXISTING: 'true' + strategy: + matrix: + database: [ mysql, postgresql ] + + uses: ./.github/workflows/_helm-ci.yml + with: + database: ${{ matrix.database }} + run_release: true diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a31ab359..c50a2757 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,60 +1,15 @@ name: Test Helm Charts + on: pull_request: - branches: - - main - -# Environment variables available to all jobs and steps in this workflow -env: - K3D_VERSION: 5.4.4 - HELM_VERSION: 3.11.3 - KUBECTL_VERSION: 1.23.4 - KUSTOMIZE_VERSION: 4.5.7 + branches: [ main ] jobs: test: - name: 'Test' - runs-on: ubuntu-latest - - steps: - - name: Checkout - uses: actions/checkout@v2 - - - name: Helm linting - run: | - ./test/lint.sh - - - name: Dependencies - run: | - mkdir -p ${GITHUB_WORKSPACE}/bin/ - - # install kubectl - curl -L https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl -o ${GITHUB_WORKSPACE}/bin/kubectl && chmod +x ${GITHUB_WORKSPACE}/bin/kubectl - - # install helm - curl -L https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz -o helm-v${HELM_VERSION}-linux-amd64.tar.gz && tar -zxvf helm-v${HELM_VERSION}-linux-amd64.tar.gz && chmod +x linux-amd64/helm && mv linux-amd64/helm ${GITHUB_WORKSPACE}/bin/helm - - # install kustomize - curl -L https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz -o kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz && tar -zxvf kustomize_v${KUSTOMIZE_VERSION}_linux_amd64.tar.gz && chmod +x kustomize && mv kustomize ${GITHUB_WORKSPACE}/bin/kustomize - - # install k3d - curl -s https://raw.githubusercontent.com/rancher/k3d/main/install.sh | TAG=v${K3D_VERSION} bash - - # install taskfile - curl -sL https://taskfile.dev/install.sh | sh - - # install yq - sudo snap install yq - - - name: GitHub Path - run: | - echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH - - - name: Create Kubernetes Cluster - run: | - k3d cluster create --config=cluster/config.yaml + strategy: + matrix: + database: [ mysql, postgresql ] - - name: Test Drupal Helm Chart - run: | - cd charts/drupal - helm install drupal -f values.yaml . --timeout=600s + uses: ./.github/workflows/_helm-ci.yml + with: + database: ${{ matrix.database }} diff --git a/.gitignore b/.gitignore index 2f842da3..1e4aec28 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,5 @@ packages index.yaml - tpl/ values-*.yaml !values-example-*.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index c267028a..7ebb0872 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,29 @@ +# Changelog + +## 2.0.0-beta1 + +### ⚠️ Breaking Changes + +**Back up your MySQL/PostgreSQL databases before upgrading and proceed with caution.** + +- Replaced Bitnami Redis with **Valkey (official chart)** +- Removed Redis Sentinel support +- Switched Redis authentication from Bitnami password secret → **ACL-based auth** +- Migrated MySQL, PostgreSQL, and Solr images to the **Bitnami Legacy registry** +- Added global workaround to disable SSL requirements for MySQL connections in Drush + +### Known Issue + +- **Drush + MySQL SSL bug:** Drush attempts to enforce SSL when connecting to MySQL inside Kubernetes. + A global workaround is now applied using `--skip-ssl` to ensure site installation and maintenance commands succeed. + +### Changes + +- Upgraded MySQL and PostgreSQL chart versions +- Updated Redis readiness and maintenance scripts to use RESP protocol (BusyBox `nc` compatible) +- Added Helm CI matrix to test both MySQL and PostgreSQL installs +- Reduced Bitnami-specific assumptions across templates and scripts + ## 1.0.0-beta7 - Breaking Changes diff --git a/LICENSE.md b/LICENSE.md index 967b9cb2..0326383d 100644 --- a/LICENSE.md +++ b/LICENSE.md @@ -1,6 +1,6 @@ ## MIT License -Copyright (c) 2024 William Hearn +Copyright (c) 2026 William Hearn Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal diff --git a/README.md b/README.md index a6425c59..90f1960a 100644 --- a/README.md +++ b/README.md @@ -1,17 +1,26 @@ # Helm Charts for Drupal -A **[Helm chart][helm]** for **Drupal**. +A **[Helm chart][helm]** for deploying **Drupal** on Kubernetes. -This chart will deploy a highly available and performant enterprise Drupal site with the following integrations: +This chart is designed to support a modern, stateless, enterprise-ready Drupal deployment with optional supporting services that can be enabled for local development, testing, or self-hosted environments. -- File Storage (Azure Files) for Stateless Design -- MySQL (optionally configured with ProxySQL) -- PostgreSQL (optionally configured with PGBouncer) -- Redis -- Solr -- Varnish +## Included optional dependencies -Please consult our **Architectural Diagram** for a recommended setup on Azure: +The chart can deploy the following supporting services when enabled: + +- **File Storage** – Azure Files (for stateless Drupal file storage) +- **MariaDB / MySQL-compatible database** (optional) +- **PostgreSQL** (optional) +- **Valkey (Redis-compatible cache & queue)** (optional) +- **Apache Solr** (search) +- **Varnish** (HTTP caching / reverse proxy) + +> These services are intended primarily for **development, CI, and self-contained deployments**. +> In production environments, external managed services are typically recommended. + +## Architecture + +Please consult the **Architectural Diagram** for a recommended deployment pattern on Azure: - **[Architectural Diagram][diagram]** @@ -19,15 +28,21 @@ Please consult our **Architectural Diagram** for a recommended setup on Azure: Further documentation can be found at the individual chart level: -- **[Drupal 9/10][drupal]** +- **[Drupal 10/11][drupal]** + +## Versioning & Compatibility + +We follow **semantic versioning** for chart releases: -## Development +- **Patch** → bug fixes and non-breaking improvements +- **Minor** → new features and backwards-compatible changes +- **Major** → breaking changes -We strive to ensure for every significant changes made to the Helm Chart we will bump the `Chart.yaml` version so that there are no breaking changes introduced on your current release. +For any significant chart change, the `Chart.yaml` version is bumped accordingly. -You can consult the `values.yaml` file for the full range of options available to you. +You can consult the `values.yaml` file for the full set of configurable options. -> **Note:** We try out best to follow `https://semver.org` so that it's clear patch, minor and major releases for breaking changes. +--- [diagram]: https://github.com/drupalwxt/helm-drupal/blob/main/docs/diagram-drupal.pdf [drupal]: charts/drupal/ diff --git a/charts/drupal/Chart.lock b/charts/drupal/Chart.lock index d8932a2e..60cf7ded 100644 --- a/charts/drupal/Chart.lock +++ b/charts/drupal/Chart.lock @@ -1,18 +1,18 @@ dependencies: - name: mysql repository: https://charts.bitnami.com/bitnami - version: 9.1.7 + version: 14.0.3 - name: postgresql repository: https://charts.bitnami.com/bitnami - version: 11.6.6 -- name: redis - repository: https://charts.bitnami.com/bitnami - version: 16.13.2 + version: 15.5.38 - name: solr repository: https://charts.bitnami.com/bitnami version: 7.5.1 +- name: valkey + repository: https://valkey-io.github.io/valkey-helm + version: 0.9.3 - name: varnish repository: https://drupalwxt.github.io/helm-drupal version: 0.2.5 -digest: sha256:15c38c6e588a0089ce4b2d440ff305fd69eabf7ce03dd730f0f7706699e3c7e6 -generated: "2023-12-03T14:02:23.367433-05:00" +digest: sha256:2678da64ee92aa7da389591c84a90dc76e751ff5f7b82067963e9ff853b2fdf5 +generated: "2026-02-08T21:35:54.847832-05:00" diff --git a/charts/drupal/Chart.yaml b/charts/drupal/Chart.yaml index 1a58a2d9..ddf28904 100644 --- a/charts/drupal/Chart.yaml +++ b/charts/drupal/Chart.yaml @@ -1,8 +1,8 @@ name: drupal apiVersion: v2 type: application -version: 1.0.0-beta16 -appVersion: 6.1.0 +version: 2.0.0-beta1 +appVersion: 6.1.4 description: Helm Chart for deploying an enterprise-grade Drupal environment. keywords: - cms @@ -11,7 +11,7 @@ keywords: - php - web home: http://www.drupal.org/project/drupal -icon: https://bitnami.com/assets/stacks/drupal/img/drupal-stack-220x234.png +icon: https://www.drupal.org/files/druplicon-small.png sources: - https://github.com/drupalwxt/helm-drupal maintainers: @@ -22,21 +22,23 @@ maintainers: engine: gotpl dependencies: - name: mysql - version: 9.1.7 + version: 14.0.3 repository: https://charts.bitnami.com/bitnami + alias: mysql condition: mysql.enabled - name: postgresql - version: 11.6.6 + version: 15.5.38 repository: https://charts.bitnami.com/bitnami condition: postgresql.enabled - - name: redis - version: 16.13.2 - repository: https://charts.bitnami.com/bitnami - condition: redis.enabled - name: solr version: 7.5.1 repository: https://charts.bitnami.com/bitnami condition: solr.enabled + - name: valkey + version: 0.9.3 + repository: https://valkey-io.github.io/valkey-helm + alias: redis + condition: redis.enabled - name: varnish version: 0.2.5 repository: https://drupalwxt.github.io/helm-drupal diff --git a/charts/drupal/README.md b/charts/drupal/README.md index 711534e2..3278523e 100644 --- a/charts/drupal/README.md +++ b/charts/drupal/README.md @@ -1,6 +1,6 @@ # drupal -![Version: 1.0.0-beta15](https://img.shields.io/badge/Version-1.0.0--beta15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.1.0](https://img.shields.io/badge/AppVersion-6.1.0-informational?style=flat-square) +![Version: 2.0.0-beta1](https://img.shields.io/badge/Version-2.0.0--beta1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.1.4](https://img.shields.io/badge/AppVersion-6.1.4-informational?style=flat-square) Helm Chart for deploying an enterprise-grade Drupal environment. @@ -21,11 +21,11 @@ Helm Chart for deploying an enterprise-grade Drupal environment. | Repository | Name | Version | |------------|------|---------| -| https://charts.bitnami.com/bitnami | mysql | 9.1.7 | -| https://charts.bitnami.com/bitnami | postgresql | 11.6.6 | -| https://charts.bitnami.com/bitnami | redis | 16.13.2 | +| https://charts.bitnami.com/bitnami | mysql(mysql) | 14.0.3 | +| https://charts.bitnami.com/bitnami | postgresql | 15.5.38 | | https://charts.bitnami.com/bitnami | solr | 7.5.1 | | https://drupalwxt.github.io/helm-drupal | varnish | 0.2.5 | +| https://valkey-io.github.io/valkey-helm | redis(valkey) | 0.9.3 | ## Prerequisites @@ -154,11 +154,10 @@ helm install --name drupal -f values-.yaml | drupal.smtp.host | string | `"mail"` | | | drupal.smtp.starttls | bool | `true` | | | drupal.smtp.tls | bool | `true` | | -| drupal.theme | string | `"theme-gcweb"` | | | drupal.tolerations | list | `[]` | | | drupal.updateDBBeforeDatabaseMigration | bool | `true` | | | drupal.username | string | `"admin"` | | -| drupal.version | string | `"d10"` | | +| drupal.version | string | `"d11"` | | | drupal.volumeMounts | string | `nil` | | | drupal.volumePermissions.enabled | bool | `false` | | | drupal.volumes | string | `nil` | | @@ -212,11 +211,21 @@ helm install --name drupal -f values-.yaml | mysql.auth.rootPassword | string | `""` | | | mysql.auth.username | string | `"wxt"` | | | mysql.enabled | bool | `true` | | -| mysql.image.tag | string | `"8.0.29-debian-11-r3"` | | -| mysql.primary.configuration | string | `"[mysqld]\ndefault_authentication_plugin=mysql_native_password\nskip-name-resolve\nexplicit_defaults_for_timestamp\nbasedir=/opt/bitnami/mysql\nplugin_dir=/opt/bitnami/mysql/lib/plugin\nport=3306\nsocket=/opt/bitnami/mysql/tmp/mysql.sock\ndatadir=/bitnami/mysql/data\ntmpdir=/opt/bitnami/mysql/tmp\nmax_allowed_packet=16M\nbind-address=0.0.0.0\npid-file=/opt/bitnami/mysql/tmp/mysqld.pid\nlog-error=/opt/bitnami/mysql/logs/mysqld.log\ncharacter-set-server=UTF8\ncollation-server=utf8_general_ci\nslow_query_log=0\nslow_query_log_file=/opt/bitnami/mysql/logs/mysqld.log\nlong_query_time=10.0\ntransaction_isolation=\"READ-COMMITTED\"\n\nmax_allowed_packet = 256M\ninnodb_buffer_pool_size = 4096M\ninnodb_buffer_pool_instances = 4\ntable_definition_cache = 4096\ntable_open_cache = 8192\ninnodb_flush_log_at_trx_commit=2\n\n[client]\nport=3306\nsocket=/opt/bitnami/mysql/tmp/mysql.sock\ndefault-character-set=UTF8\nplugin_dir=/opt/bitnami/mysql/lib/plugin\n\n[manager]\nport=3306\nsocket=/opt/bitnami/mysql/tmp/mysql.sock\npid-file=/opt/bitnami/mysql/tmp/mysqld.pid"` | | +| mysql.image.pullPolicy | string | `"IfNotPresent"` | | +| mysql.image.registry | string | `"docker.io"` | | +| mysql.image.repository | string | `"bitnamilegacy/mysql"` | | +| mysql.image.tag | string | `"8.0"` | | +| mysql.primary.extraFlags | string | `"--default-authentication-plugin=mysql_native_password --skip-name-resolve --max_allowed_packet=256M --innodb_buffer_pool_size=4096M --innodb_buffer_pool_instances=4 --table_definition_cache=4096 --table_open_cache=8192 --innodb_flush_log_at_trx_commit=2 --skip_ssl --require_secure_transport=OFF"` | | | mysql.primary.persistence.enabled | bool | `true` | | | mysql.primary.persistence.size | string | `"128Gi"` | | +| mysql.primary.resources.limits.cpu | string | `"4000m"` | | +| mysql.primary.resources.limits.memory | string | `"8Gi"` | | +| mysql.primary.resources.requests.cpu | string | `"2000m"` | | +| mysql.primary.resources.requests.memory | string | `"4Gi"` | | | mysql.volumePermissions.enabled | bool | `true` | | +| mysql.volumePermissions.image.registry | string | `"docker.io"` | | +| mysql.volumePermissions.image.repository | string | `"bitnamilegacy/os-shell"` | | +| mysql.volumePermissions.image.tag | string | `"12-debian-12"` | | ### ProxySQL @@ -241,12 +250,17 @@ helm install --name drupal -f values-.yaml | postgresql.auth.postgresPassword | string | `"example"` | | | postgresql.auth.username | string | `"wxt"` | | | postgresql.enabled | bool | `false` | | -| postgresql.image.tag | string | `"14.3.0-debian-11-r3"` | | -| postgresql.primary.configuration | string | `""` | | +| postgresql.image.pullPolicy | string | `"IfNotPresent"` | | +| postgresql.image.registry | string | `"docker.io"` | | +| postgresql.image.repository | string | `"bitnamilegacy/postgresql"` | | +| postgresql.image.tag | string | `"16"` | | | postgresql.primary.extendedConfiguration | string | `"listen_addresses='*'\nmax_connections=200\nshared_buffers='512MB'\nwork_mem='2048MB'\neffective_cache_size='512MB'\nmaintenance_work_mem='32MB'\nmin_wal_size='512MB'\nmax_wal_size='512MB'\nbytea_output='escape'"` | | | postgresql.primary.persistence.enabled | bool | `true` | | | postgresql.primary.persistence.size | string | `"128Gi"` | | | postgresql.volumePermissions.enabled | bool | `true` | | +| postgresql.volumePermissions.image.registry | string | `"docker.io"` | | +| postgresql.volumePermissions.image.repository | string | `"bitnamilegacy/os-shell"` | | +| postgresql.volumePermissions.image.tag | string | `"12-debian-12"` | | ### PGBouncer @@ -310,25 +324,23 @@ helm install --name drupal -f values-.yaml | Key | Type | Default | Description | |-----|------|---------|-------------| -| redis.commonConfiguration | string | `"# Disable AOF https://redis.io/topics/persistence#append-only-file\nappendonly no\n# Disable RDB persistence.\nsave \"\""` | | -| redis.enabled | bool | `false` | | -| redis.master.disableCommands | list | `[]` | | -| redis.master.persistence.enabled | bool | `false` | | -| redis.master.service.type | string | `"ClusterIP"` | | +| redis.architecture | string | `"standalone"` | | +| redis.auth.aclUsers.default.password | string | `"secretpass"` | | +| redis.auth.aclUsers.default.permissions | string | `"~* &* +@all"` | | +| redis.auth.enabled | bool | `true` | | +| redis.configuration | string | `"appendonly no\nsave \"\""` | | +| redis.enabled | bool | `true` | | +| redis.primary.persistence.enabled | bool | `false` | | +| redis.primary.service.type | string | `"ClusterIP"` | | | redis.queue.enabled | bool | `true` | | -| redis.replica.disableCommands | list | `[]` | | -| redis.replica.enabled | bool | `false` | | -| redis.replica.persistence.enabled | bool | `false` | | | redis.replica.replicaCount | int | `0` | | -| redis.replica.service.type | string | `"ClusterIP"` | | -| redis.sentinel.enabled | bool | `false` | | ## Varnish | Key | Type | Default | Description | |-----|------|---------|-------------| | varnish.affinity | object | `{}` | | -| varnish.enabled | bool | `false` | | +| varnish.enabled | bool | `true` | | | varnish.nodeSelector | object | `{}` | | | varnish.resources | object | `{}` | | | varnish.service.port | int | `8080` | | @@ -337,7 +349,7 @@ helm install --name drupal -f values-.yaml | varnish.varnishConfigContent | string | `"vcl 4.0;\n\nimport std;\nimport directors;\n\nbackend nginx {\n .host = \"{{ include \"backend.fullname\" . }}-nginx\";\n .host_header = \"{{ include \"backend.fullname\" . }}-nginx\";\n .port = \"8080\";\n}\n\nsub vcl_init {\n new backends = directors.round_robin();\n backends.add_backend(nginx);\n}\n\nsub vcl_recv {\n set req.http.X-Forwarded-Host = req.http.Host;\n if (!req.http.X-Forwarded-Proto) {\n set req.http.X-Forwarded-Proto = \"http\";\n }\n\n # Answer healthcheck\n if (req.url == \"/_healthcheck\" || req.url == \"/healthcheck.txt\") {\n return (synth(700, \"HEALTHCHECK\"));\n }\n\n # Answer splashpage\n # if (req.url == \"/\") {\n # return (synth(701, \"SPLASH\"));\n # }\n\n set req.backend_hint = backends.backend();\n\n # Always cache certain file types\n # Remove cookies that Drupal doesn't care about\n if (req.url ~ \"(?i)\\.(asc|dat|tgz|png|gif|jpeg|jpg|ico|swf|css|js)(\\?.*)?$\") {\n unset req.http.Cookie;\n } else if (req.http.Cookie) {\n set req.http.Cookie = \";\" + req.http.Cookie;\n set req.http.Cookie = regsuball(req.http.Cookie, \"; +\", \";\");\n set req.http.Cookie = regsuball(req.http.Cookie, \";(SESS[a-z0-9]+|SSESS[a-z0-9]+|NO_CACHE)=\", \"; \\1=\");\n set req.http.Cookie = regsuball(req.http.Cookie, \";[^ ][^;]*\", \"\");\n set req.http.Cookie = regsuball(req.http.Cookie, \"^[; ]+|[; ]+$\", \"\");\n if (req.http.Cookie == \"\") {\n unset req.http.Cookie;\n } else {\n return (pass);\n }\n }\n # If POST, PUT or DELETE, then don't cache\n if (req.method == \"POST\" || req.method == \"PUT\" || req.method == \"DELETE\") {\n return (pass);\n }\n # Happens before we check if we have this in cache already.\n #\n # Typically you clean up the request here, removing cookies you don't need,\n # rewriting the request, etc.\n return (hash);\n #return (pass);\n}\n\nsub vcl_backend_fetch {\n # NEW\n set bereq.http.Host = \"{{ include \"backend.fullname\" . }}-nginx\";\n\n # Don't add 127.0.0.1 to X-Forwarded-For\n set bereq.http.X-Forwarded-For = regsub(bereq.http.X-Forwarded-For, \"(, )?127\\.0\\.0\\.\\d$\", \"\");\n}\n\nsub vcl_backend_response {\n if (beresp.http.Location && beresp.http.Location !~ \"^https://api.twitter.com/\") {\n set beresp.http.Location = regsub(\n beresp.http.Location,\n \"^https?://[^/]+/\",\n bereq.http.X-Forwarded-Proto + \"://\" + bereq.http.X-Forwarded-Host + \"/\"\n );\n }\n # Only cache select response codes\n if (beresp.status == 200 || beresp.status == 203 || beresp.status == 204 || beresp.status == 206 || beresp.status == 300 || beresp.status == 301 || beresp.status == 404 || beresp.status == 405 || beresp.status == 410 || beresp.status == 414 || beresp.status == 501) {\n # Cache for 5 minutes\n set beresp.ttl = 5m;\n set beresp.grace = 12h;\n set beresp.keep = 24h;\n } else {\n set beresp.ttl = 0s;\n }\n}\n\nsub vcl_deliver {\n # Remove identifying information\n unset resp.http.Server;\n unset resp.http.X-Powered-By;\n unset resp.http.X-Varnish;\n unset resp.http.Via;\n\n # Comment these for easier Drupal cache tag debugging in development.\n unset resp.http.Cache-Tags;\n unset resp.http.X-Drupal-Cache-Contexts;\n\n # Add Content-Security-Policy\n # set resp.http.Content-Security-Policy = \"default-src 'self' *.example.ca *.example.ca; style-src 'self' 'unsafe-inline' *.example.ca https://fonts.googleapis.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.example.ca *.adobedtm.com use.fontawesome.com blob:; connect-src 'self' *.example.ca *.omtrdc.net *.demdex.net *.everesttech.net; img-src 'self' *.example.ca *.omtrdc.net *.demdex.net *.everesttech.net data:; font-src 'self' *.example.ca https://fonts.gstatic.com\";\n\n # Add CORS Headers\n # if (req.http.Origin ~ \"(?i)\\.example\\.ca$\") {\n # if (req.url ~ \"\\.(ttd|woff|woff2)(\\?.*)?$\") {\n # set resp.http.Access-Control-Allow-Origin = \"*\";\n # set resp.http.Access-Control-Allow-Methods = \"GET\";\n # }\n # }\n\n # Add X-Frame-Options\n # if (req.url ~ \"^/(en/|fr/)?media/\") {\n # set resp.http.X-Frame-Options = \"SAMEORIGIN\";\n # } else {\n # set resp.http.X-Frame-Options = \"DENY\";\n # }\n\n set resp.http.X-Content-Type-Options = \"nosniff\";\n set resp.http.X-XSS-Protection = \"1; mode=block\";\n set resp.http.Strict-Transport-Security = \"max-age=2629800\";\n\n if (req.http.host ~ \"site.example.ca\") {\n set resp.http.X-Robots-Tag = \"noindex, nofollow\";\n }\n\n if (req.url ~ \"^/(en/|fr/)?(search/|recherche/)site/\") {\n set resp.http.X-Robots-Tag = \"noindex, nofollow\";\n }\n\n # Happens when we have all the pieces we need, and are about to send the\n # response to the client.\n #\n # You can do accounting or modifying the final object here.\n if (obj.hits > 0) {\n set resp.http.X-Cache = \"HIT\";\n } else {\n set resp.http.X-Cache = \"MISS\";\n }\n # Handle errors\n if ( (resp.status >= 500 && resp.status <= 599)\n || resp.status == 400\n || resp.status == 401\n || resp.status == 403\n || resp.status == 404) {\n return (synth(resp.status));\n }\n}\n\nsub vcl_synth {\n # Remove identifying information\n unset resp.http.Server;\n unset resp.http.X-Powered-By;\n unset resp.http.X-Varnish;\n unset resp.http.Via;\n\n # Add Content-Security-Policy\n # set resp.http.Content-Security-Policy = \"default-src 'self' *.example.ca; style-src 'self' 'unsafe-inline' *.example.ca; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.example.ca *.adobedtm.com use.fontawesome.com blob:; connect-src 'self' *.example.ca *.omtrdc.net *.demdex.net *.everesttech.net; img-src 'self' *.example.ca data:;\";\n # set resp.http.X-Content-Type-Options = \"nosniff\";\n # set resp.http.X-Frame-Options = \"DENY\";\n # set resp.http.X-XSS-Protection = \"1; mode=block\";\n\n set resp.http.Strict-Transport-Security = \"max-age=2629800\";\n\n # if (resp.status >= 500 && resp.status <= 599) {\n # set resp.http.Content-Type = \"text/html; charset=utf-8\";\n # synthetic(std.fileread(\"/data/configuration/varnish/errors/503.html\"));\n # return (deliver);\n # } elseif (resp.status == 400) { # 400 - Bad Request\n # set resp.http.Content-Type = \"text/html; charset=utf-8\";\n # synthetic(std.fileread(\"/data/configuration/varnish/errors/400.html\"));\n # return (deliver);\n # } elseif (resp.status == 401) { # 401 - Unauthorized\n # set resp.http.Content-Type = \"text/html; charset=utf-8\";\n # synthetic(std.fileread(\"/data/configuration/varnish/errors/401.html\"));\n # return (deliver);\n # } elseif (resp.status == 403) { # 403 - Forbidden\n # set resp.http.Content-Type = \"text/html; charset=utf-8\";\n # synthetic(std.fileread(\"/data/configuration/varnish/errors/403.html\"));\n # return (deliver);\n # } elseif (resp.status == 404) { # 404 - Not Found\n # set resp.http.Content-Type = \"text/html; charset=utf-8\";\n # synthetic(std.fileread(\"/data/configuration/varnish/errors/404.html\"));\n # return (deliver);\n # } else\n if (resp.status == 700) { # Respond to healthcheck\n set resp.status = 200;\n set resp.http.Content-Type = \"text/plain\";\n synthetic ( {\"OK\"} );\n return (deliver);\n }\n # elseif (resp.status == 701) { # Respond to splash\n # set resp.status = 200;\n # set resp.http.Content-Type = \"text/html\";\n # synthetic(std.fileread(\"/splash/index.html\"));\n # return (deliver);\n # }\n}\n\n##\n# ERROR HANDLING\n##\n# sub vcl_backend_error {\n# set beresp.http.Content-Type = \"text/html; charset=utf-8\";\n# synthetic(std.fileread(\"/data/configuration/varnish/errors/503.html\"));\n# return (deliver);\n# }\n"` | | | varnish.varnishd.image | string | `"varnish"` | | | varnish.varnishd.imagePullPolicy | string | `"IfNotPresent"` | | -| varnish.varnishd.tag | string | `"6.5.1"` | | +| varnish.varnishd.tag | string | `"6.6.2"` | | diff --git a/charts/drupal/charts/mysql-14.0.3.tgz b/charts/drupal/charts/mysql-14.0.3.tgz new file mode 100644 index 00000000..eb620aa5 Binary files /dev/null and b/charts/drupal/charts/mysql-14.0.3.tgz differ diff --git a/charts/drupal/charts/mysql-9.1.7.tgz b/charts/drupal/charts/mysql-9.1.7.tgz deleted file mode 100644 index 2c705d11..00000000 Binary files a/charts/drupal/charts/mysql-9.1.7.tgz and /dev/null differ diff --git a/charts/drupal/charts/postgresql-11.6.6.tgz b/charts/drupal/charts/postgresql-11.6.6.tgz deleted file mode 100644 index b743d2ba..00000000 Binary files a/charts/drupal/charts/postgresql-11.6.6.tgz and /dev/null differ diff --git a/charts/drupal/charts/postgresql-15.5.38.tgz b/charts/drupal/charts/postgresql-15.5.38.tgz new file mode 100644 index 00000000..55ad8887 Binary files /dev/null and b/charts/drupal/charts/postgresql-15.5.38.tgz differ diff --git a/charts/drupal/charts/redis-16.13.2.tgz b/charts/drupal/charts/redis-16.13.2.tgz deleted file mode 100644 index 33b5e967..00000000 Binary files a/charts/drupal/charts/redis-16.13.2.tgz and /dev/null differ diff --git a/charts/drupal/charts/valkey-0.9.3.tgz b/charts/drupal/charts/valkey-0.9.3.tgz new file mode 100644 index 00000000..1f6ad50d Binary files /dev/null and b/charts/drupal/charts/valkey-0.9.3.tgz differ diff --git a/charts/drupal/conf/settings.d10.php b/charts/drupal/conf/settings.d10.php index cd7cea61..d830aaf1 100644 --- a/charts/drupal/conf/settings.d10.php +++ b/charts/drupal/conf/settings.d10.php @@ -967,13 +967,8 @@ $settings['cache']['default'] = 'cache.backend.redis'; $settings['redis.connection']['interface'] = '{{ default "PhpRedis" .Values.redis.clientInterface }}'; $settings['redis.connection']['scheme'] = 'tcp'; - {{- if .Values.redis.sentinel.enabled }} - $settings['redis.connection']['host'] = ['{{ .Release.Name }}-redis:{{ .Values.redis.sentinel.service.sentinelPort }}']; - $settings['redis.connection']['instance'] = '{{ .Values.redis.sentinel.masterSet }}'; - {{- else }} - $settings['redis.connection']['host'] = '{{ .Release.Name }}-redis-master'; - $settings['redis.connection']['port'] = '{{ .Values.redis.master.service.ports.redis }}'; - {{- end }} + $settings['redis.connection']['host'] = '{{ .Release.Name }}-redis'; + $settings['redis.connection']['port'] = '{{ .Values.redis.service.port }}'; $settings['redis.connection']['password'] = getenv('REDIS_PASSWORD') ?: ''; $settings['redis.connection']['persistent'] = FALSE; diff --git a/charts/drupal/conf/settings.d11.php b/charts/drupal/conf/settings.d11.php new file mode 100644 index 00000000..d830aaf1 --- /dev/null +++ b/charts/drupal/conf/settings.d11.php @@ -0,0 +1,1041 @@ + 'database_name', + * 'username' => 'sql_username', + * 'password' => 'sql_password', + * 'host' => 'localhost', + * 'port' => '3306', + * 'driver' => 'mysql', + * 'prefix' => '', + * 'collation' => 'utf8mb4_general_ci', + * ]; + * @endcode + */ +{{- if .Values.external.enabled }} +$databases['default']['default'] = [ + 'database' => {{ .Values.external.database | quote }}, + 'username' => {{ .Values.external.user | quote }}, + 'password' => getenv('EXTERNAL_PASSWORD') ?: '', + {{- if .Values.proxysql.enabled }} + 'host' => '127.0.0.1', + {{- else if .Values.postgresql.enabled }} + 'host' => 'localhost', + {{- else }} + 'host' => {{ .Values.external.host | quote }}, + {{- end }} + 'port' => {{ .Values.external.port }}, + 'prefix' => '', + 'namespace' => 'Drupal\Core\Database\Driver\{{ .Values.external.driver }}', + 'driver' => '{{ .Values.external.driver }}', + 'collation' => 'utf8mb4_general_ci', + {{- if .Values.external.initCommands }} + 'init_commands' => [ + {{- range .Values.external.initCommands }} + {{- range $key, $value := . }} + '{{ $key }}' => {{ $value | quote }}, + {{- end }} + {{- end }} + ], + {{- end }} + {{- if .Values.external.pdo }} + 'pdo' => [ + {{- range .Values.external.pdo }} + {{- range $key, $value := . }} + {{ $key }} => {{ $value | quote }}, + {{- end }} + {{- end }} + ], + {{- end }} +]; +{{- else if .Values.mysql.enabled }} +$databases['default']['default'] = [ + 'database' => {{ .Values.mysql.auth.database | quote }}, + 'username' => {{ .Values.mysql.auth.username | quote }}, + 'password' => getenv('MYSQL_PASSWORD') ?: '', + {{- if .Values.proxysql.enabled }} + 'host' => '127.0.0.1', + {{- else }} + 'host' => '{{ .Release.Name }}-mysql', + {{- end }} + 'port' => {{ .Values.mysql.primary.service.ports.mysql | quote }}, + 'prefix' => '', + 'namespace' => 'Drupal\Core\Database\Driver\mysql', + 'driver' => 'mysql', + 'collation' => 'utf8mb4_general_ci', +]; +{{- else if .Values.postgresql.enabled }} +$databases['default']['default'] = [ + 'database' => {{ .Values.postgresql.auth.database | quote }}, + 'username' => {{ .Values.postgresql.auth.username | quote }}, + 'password' => getenv('POSTGRES_PASSWORD') ?: '', + {{- if .Values.pgbouncer.enabled }} + 'host' => 'localhost', + {{- else }} + 'host' => '{{ .Release.Name }}-postgresql', + {{- end }} + 'port' => {{ .Values.postgresql.primary.service.ports.postgresql | quote }}, + 'prefix' => '', + 'namespace' => 'Drupal\Core\Database\Driver\pgsql', + 'driver' => 'pgsql', + 'collation' => 'utf8mb4_general_ci', +]; +{{- end }} + +/** + * Customizing database settings. + * + * Many of the values of the $databases array can be customized for your + * particular database system. Refer to the sample in the section above as a + * starting point. + * + * The "driver" property indicates what Drupal database driver the + * connection should use. This is usually the same as the name of the + * database type, such as mysql or sqlite, but not always. The other + * properties will vary depending on the driver. For SQLite, you must + * specify a database file name in a directory that is writable by the + * webserver. For most other drivers, you must specify a + * username, password, host, and database name. + * + * Drupal core implements drivers for mysql, pgsql, and sqlite. Other drivers + * can be provided by contributed or custom modules. To use a contributed or + * custom driver, the "namespace" property must be set to the namespace of the + * driver. The code in this namespace must be autoloadable prior to connecting + * to the database, and therefore, prior to when module root namespaces are + * added to the autoloader. To add the driver's namespace to the autoloader, + * set the "autoload" property to the PSR-4 base directory of the driver's + * namespace. This is optional for projects managed with Composer if the + * driver's namespace is in Composer's autoloader. + * + * For each database, you may optionally specify multiple "target" databases. + * A target database allows Drupal to try to send certain queries to a + * different database if it can but fall back to the default connection if not. + * That is useful for primary/replica replication, as Drupal may try to connect + * to a replica server when appropriate and if one is not available will simply + * fall back to the single primary server (The terms primary/replica are + * traditionally referred to as master/slave in database server documentation). + * + * The general format for the $databases array is as follows: + * @code + * $databases['default']['default'] = $info_array; + * $databases['default']['replica'][] = $info_array; + * $databases['default']['replica'][] = $info_array; + * $databases['extra']['default'] = $info_array; + * @endcode + * + * In the above example, $info_array is an array of settings described above. + * The first line sets a "default" database that has one primary database + * (the second level default). The second and third lines create an array + * of potential replica databases. Drupal will select one at random for a given + * request as needed. The fourth line creates a new database with a name of + * "extra". + * + * For MySQL, MariaDB or equivalent databases the 'isolation_level' option can + * be set. The recommended transaction isolation level for Drupal sites is + * 'READ COMMITTED'. The 'REPEATABLE READ' option is supported but can result + * in deadlocks, the other two options are 'READ UNCOMMITTED' and 'SERIALIZABLE'. + * They are available but not supported; use them at your own risk. For more + * info: + * https://dev.mysql.com/doc/refman/5.7/en/innodb-transaction-isolation-levels.html + * + * On your settings.php, change the isolation level: + * @code + * $databases['default']['default']['init_commands'] = [ + * 'isolation_level' => 'SET SESSION TRANSACTION ISOLATION LEVEL READ COMMITTED', + * ]; + * @endcode + * + * You can optionally set a prefix for all database table names by using the + * 'prefix' setting. If a prefix is specified, the table name will be prepended + * with its value. Be sure to use valid database characters only, usually + * alphanumeric and underscore. If no prefix is desired, do not set the 'prefix' + * key or set its value to an empty string ''. + * + * For example, to have all database table prefixed with 'main_', set: + * @code + * 'prefix' => 'main_', + * @endcode + * + * Advanced users can add or override initial commands to execute when + * connecting to the database server, as well as PDO connection settings. For + * example, to enable MySQL SELECT queries to exceed the max_join_size system + * variable, and to reduce the database connection timeout to 5 seconds: + * @code + * $databases['default']['default'] = [ + * 'init_commands' => [ + * 'big_selects' => 'SET SQL_BIG_SELECTS=1', + * ], + * 'pdo' => [ + * PDO::ATTR_TIMEOUT => 5, + * ], + * ]; + * @endcode + * + * WARNING: The above defaults are designed for database portability. Changing + * them may cause unexpected behavior, including potential data loss. See + * https://www.drupal.org/docs/8/api/database-api/database-configuration for + * more information on these defaults and the potential issues. + * + * More details can be found in the constructor methods for each driver: + * - \Drupal\mysql\Driver\Database\mysql\Connection::__construct() + * - \Drupal\pgsql\Driver\Database\pgsql\Connection::__construct() + * - \Drupal\sqlite\Driver\Database\sqlite\Connection::__construct() + * + * Sample Database configuration format for PostgreSQL (pgsql): + * @code + * $databases['default']['default'] = [ + * 'driver' => 'pgsql', + * 'database' => 'database_name', + * 'username' => 'sql_username', + * 'password' => 'sql_password', + * 'host' => 'localhost', + * 'prefix' => '', + * ]; + * @endcode + * + * Sample Database configuration format for SQLite (sqlite): + * @code + * $databases['default']['default'] = [ + * 'driver' => 'sqlite', + * 'database' => '/path/to/database_filename', + * ]; + * @endcode + * + * Sample Database configuration format for a driver in a contributed module: + * @code + * $databases['default']['default'] = [ + * 'driver' => 'my_driver', + * 'namespace' => 'Drupal\my_module\Driver\Database\my_driver', + * 'autoload' => 'modules/my_module/src/Driver/Database/my_driver/', + * 'database' => 'database_name', + * 'username' => 'sql_username', + * 'password' => 'sql_password', + * 'host' => 'localhost', + * 'prefix' => '', + * ]; + * @endcode + * + * Sample Database configuration format for a driver that is extending another + * database driver. + * @code + * $databases['default']['default'] = [ + * 'driver' => 'my_driver', + * 'namespace' => 'Drupal\my_module\Driver\Database\my_driver', + * 'autoload' => 'modules/my_module/src/Driver/Database/my_driver/', + * 'database' => 'database_name', + * 'username' => 'sql_username', + * 'password' => 'sql_password', + * 'host' => 'localhost', + * 'prefix' => '', + * 'dependencies' => [ + * 'parent_module' => [ + * 'namespace' => 'Drupal\parent_module', + * 'autoload' => 'core/modules/parent_module/src/', + * ], + * ], + * ]; + * @endcode + */ + +/** + * Location of the site configuration files. + * + * The $settings['config_sync_directory'] specifies the location of file system + * directory used for syncing configuration data. On install, the directory is + * created. This is used for configuration imports. + * + * The default location for this directory is inside a randomly-named + * directory in the public files path. The setting below allows you to set + * its location. + */ +# $settings['config_sync_directory'] = '/directory/outside/webroot'; + +/** + * Settings: + * + * $settings contains environment-specific configuration, such as the files + * directory and reverse proxy address, and temporary configuration, such as + * security overrides. + * + * @see \Drupal\Core\Site\Settings::get() + */ + +/** + * Salt for one-time login links, cancel links, form tokens, etc. + * + * This variable will be set to a random value by the installer. All one-time + * login links will be invalidated if the value is changed. Note that if your + * site is deployed on a cluster of web servers, you must ensure that this + * variable has the same value on each server. + * + * For enhanced security, you may set this variable to the contents of a file + * outside your document root, and vary the value across environments (like + * production and development); you should also ensure that this file is not + * stored with backups of your database. + * + * Example: + * @code + * $settings['hash_salt'] = file_get_contents('/home/example/salt.txt'); + * @endcode + */ +$settings['hash_salt'] = 'default'; + +/** + * Deployment identifier. + * + * Drupal's dependency injection container will be automatically invalidated and + * rebuilt when the Drupal core version changes. When updating contributed or + * custom code that changes the container, changing this identifier will also + * allow the container to be invalidated as soon as code is deployed. + */ +# $settings['deployment_identifier'] = \Drupal::VERSION; + +/** + * Access control for update.php script. + * + * If you are updating your Drupal installation using the update.php script but + * are not logged in using either an account with the "Administer software + * updates" permission or the site maintenance account (the account that was + * created during installation), you will need to modify the access check + * statement below. Change the FALSE to a TRUE to disable the access check. + * After finishing the upgrade, be sure to open this file again and change the + * TRUE back to a FALSE! + */ +$settings['update_free_access'] = FALSE; + +/** + * Fallback to HTTP for Update Manager and for fetching security advisories. + * + * If your site fails to connect to updates.drupal.org over HTTPS (either when + * fetching data on available updates, or when fetching the feed of critical + * security announcements), you may uncomment this setting and set it to TRUE to + * allow an insecure fallback to HTTP. Note that doing so will open your site up + * to a potential man-in-the-middle attack. You should instead attempt to + * resolve the issues before enabling this option. + * @see https://www.drupal.org/docs/system-requirements/php-requirements#openssl + * @see https://en.wikipedia.org/wiki/Man-in-the-middle_attack + * @see \Drupal\update\UpdateFetcher + * @see \Drupal\system\SecurityAdvisories\SecurityAdvisoriesFetcher + */ +# $settings['update_fetch_with_http_fallback'] = TRUE; + +/** + * External access proxy settings: + * + * If your site must access the Internet via a web proxy then you can enter the + * proxy settings here. Set the full URL of the proxy, including the port, in + * variables: + * - $settings['http_client_config']['proxy']['http']: The proxy URL for HTTP + * requests. + * - $settings['http_client_config']['proxy']['https']: The proxy URL for HTTPS + * requests. + * You can pass in the user name and password for basic authentication in the + * URLs in these settings. + * + * You can also define an array of host names that can be accessed directly, + * bypassing the proxy, in $settings['http_client_config']['proxy']['no']. + */ +# $settings['http_client_config']['proxy']['http'] = 'http://proxy_user:proxy_pass@example.com:8080'; +# $settings['http_client_config']['proxy']['https'] = 'http://proxy_user:proxy_pass@example.com:8080'; +# $settings['http_client_config']['proxy']['no'] = ['127.0.0.1', 'localhost']; + +/** + * Reverse Proxy Configuration: + * + * Reverse proxy servers are often used to enhance the performance + * of heavily visited sites and may also provide other site caching, + * security, or encryption benefits. In an environment where Drupal + * is behind a reverse proxy, the real IP address of the client should + * be determined such that the correct client IP address is available + * to Drupal's logging and access management systems. In the most simple + * scenario, the proxy server will add an X-Forwarded-For header to the request + * that contains the client IP address. However, HTTP headers are vulnerable to + * spoofing, where a malicious client could bypass restrictions by setting the + * X-Forwarded-For header directly. Therefore, Drupal's proxy configuration + * requires the IP addresses of all remote proxies to be specified in + * $settings['reverse_proxy_addresses'] to work correctly. + * + * Enable this setting to get Drupal to determine the client IP from the + * X-Forwarded-For header. If you are unsure about this setting, do not have a + * reverse proxy, or Drupal operates in a shared hosting environment, this + * setting should remain commented out. + * + * In order for this setting to be used you must specify every possible + * reverse proxy IP address in $settings['reverse_proxy_addresses']. + * If a complete list of reverse proxies is not available in your + * environment (for example, if you use a CDN) you may set the + * $_SERVER['REMOTE_ADDR'] variable directly in settings.php. + * Be aware, however, that it is likely that this would allow IP + * address spoofing unless more advanced precautions are taken. + */ +$settings['reverse_proxy'] = TRUE; + +/** + * Reverse proxy addresses. + * + * Specify every reverse proxy IP address in your environment, as an array of + * IPv4/IPv6 addresses or subnets in CIDR notation. This setting is required if + * $settings['reverse_proxy'] is TRUE. + */ +$settings['reverse_proxy_addresses'] = ['0.0.0.0/0']; + +/** + * Reverse proxy trusted headers. + * + * Sets which headers to trust from your reverse proxy. + * + * Common values are: + * - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR + * - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST + * - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT + * - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO + * - \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED + * + * Note the default value of + * @code + * \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED + * @endcode + * is not secure by default. The value should be set to only the specific + * headers the reverse proxy uses. For example: + * @code + * \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO + * @endcode + * This would trust the following headers: + * - X_FORWARDED_FOR + * - X_FORWARDED_HOST + * - X_FORWARDED_PROTO + * - X_FORWARDED_PORT + * + * @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR + * @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST + * @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT + * @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO + * @see \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED + * @see \Symfony\Component\HttpFoundation\Request::setTrustedProxies + */ +# $settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED; + + +/** + * Page caching: + * + * By default, Drupal sends a "Vary: Cookie" HTTP header for anonymous page + * views. This tells a HTTP proxy that it may return a page from its local + * cache without contacting the web server, if the user sends the same Cookie + * header as the user who originally requested the cached page. Without "Vary: + * Cookie", authenticated users would also be served the anonymous page from + * the cache. If the site has mostly anonymous users except a few known + * editors/administrators, the Vary header can be omitted. This allows for + * better caching in HTTP proxies (including reverse proxies), i.e. even if + * clients send different cookies, they still get content served from the cache. + * However, authenticated users should access the site directly (i.e. not use an + * HTTP proxy, and bypass the reverse proxy if one is used) in order to avoid + * getting cached pages from the proxy. + */ +# $settings['omit_vary_cookie'] = TRUE; + + +/** + * Cache TTL for client error (4xx) responses. + * + * Items cached per-URL tend to result in a large number of cache items, and + * this can be problematic on 404 pages which by their nature are unbounded. A + * fixed TTL can be set for these items, defaulting to one hour, so that cache + * backends which do not support LRU can purge older entries. To disable caching + * of client error responses set the value to 0. Currently applies only to + * page_cache module. + */ +# $settings['cache_ttl_4xx'] = 3600; + +/** + * Expiration of cached forms. + * + * Drupal's Form API stores details of forms in a cache and these entries are + * kept for at least 6 hours by default. Expired entries are cleared by cron. + * + * @see \Drupal\Core\Form\FormCache::setCache() + */ +# $settings['form_cache_expiration'] = 21600; + +/** + * Class Loader. + * + * If the APCu extension is detected, the classloader will be optimized to use + * it. Set to FALSE to disable this. + * + * @see https://getcomposer.org/doc/articles/autoloader-optimization.md + */ +# $settings['class_loader_auto_detect'] = FALSE; + +/** + * Authorized file system operations: + * + * The Update Manager module included with Drupal provides a mechanism for + * site administrators to securely install missing updates for the site + * directly through the web user interface. On securely-configured servers, + * the Update manager will require the administrator to provide SSH or FTP + * credentials before allowing the installation to proceed; this allows the + * site to update the new files as the user who owns all the Drupal files, + * instead of as the user the webserver is running as. On servers where the + * webserver user is itself the owner of the Drupal files, the administrator + * will not be prompted for SSH or FTP credentials (note that these server + * setups are common on shared hosting, but are inherently insecure). + * + * Some sites might wish to disable the above functionality, and only update + * the code directly via SSH or FTP themselves. This setting completely + * disables all functionality related to these authorized file operations. + * + * @see https://www.drupal.org/node/244924 + * + * Remove the leading hash signs to disable. + */ +# $settings['allow_authorize_operations'] = FALSE; + +/** + * Default mode for directories and files written by Drupal. + * + * Value should be in PHP Octal Notation, with leading zero. + */ +# $settings['file_chmod_directory'] = 0775; +# $settings['file_chmod_file'] = 0664; + +/** + * Optimized assets path: + * + * A local file system path where optimized assets will be stored. This directory + * must exist and be writable by Drupal. This directory must be relative to + * the Drupal installation directory and be accessible over the web. + */ +# $settings['file_assets_path'] = 'sites/default/files'; + +/** + * Public file base URL: + * + * An alternative base URL to be used for serving public files. This must + * include any leading directory path. + * + * A different value from the domain used by Drupal to be used for accessing + * public files. This can be used for a simple CDN integration, or to improve + * security by serving user-uploaded files from a different domain or subdomain + * pointing to the same server. Do not include a trailing slash. + */ +# $settings['file_public_base_url'] = 'http://downloads.example.com/files'; + +/** + * Public file path: + * + * A local file system path where public files will be stored. This directory + * must exist and be writable by Drupal. This directory must be relative to + * the Drupal installation directory and be accessible over the web. + */ +# $settings['file_public_path'] = 'sites/default/files'; + +/** + * Additional public file schemes: + * + * Public schemes are URI schemes that allow download access to all users for + * all files within that scheme. + * + * The "public" scheme is always public, and the "private" scheme is always + * private, but other schemes, such as "https", "s3", "example", or others, + * can be either public or private depending on the site. By default, they're + * private, and access to individual files is controlled via + * hook_file_download(). + * + * Typically, if a scheme should be public, a module makes it public by + * implementing hook_file_download(), and granting access to all users for all + * files. This could be either the same module that provides the stream wrapper + * for the scheme, or a different module that decides to make the scheme + * public. However, in cases where a site needs to make a scheme public, but + * is unable to add code in a module to do so, the scheme may be added to this + * variable, the result of which is that system_file_download() grants public + * access to all files within that scheme. + */ +# $settings['file_additional_public_schemes'] = ['example']; + +/** + * File schemes whose paths should not be normalized: + * + * Normally, Drupal normalizes '/./' and '/../' segments in file URIs in order + * to prevent unintended file access. For example, 'private://css/../image.png' + * is normalized to 'private://image.png' before checking access to the file. + * + * On Windows, Drupal also replaces '\' with '/' in URIs for the local + * filesystem. + * + * If file URIs with one or more scheme should not be normalized like this, then + * list the schemes here. For example, if 'porcelain://china/./plate.png' should + * not be normalized to 'porcelain://china/plate.png', then add 'porcelain' to + * this array. In this case, make sure that the module providing the 'porcelain' + * scheme does not allow unintended file access when using '/../' to move up the + * directory tree. + */ +# $settings['file_sa_core_2023_005_schemes'] = ['porcelain']; + +/** + * Configuration for phpinfo() admin status report. + * + * Drupal's admin UI includes a report at admin/reports/status/php which shows + * the output of phpinfo(). The full output can contain sensitive information + * so by default Drupal removes some sections. + * + * This behavior can be configured by setting this variable to a different + * value corresponding to the flags parameter of phpinfo(). + * + * If you need to expose more information in the report - for example to debug a + * problem - consider doing so temporarily. + * + * @see https://www.php.net/manual/function.phpinfo.php + */ +# $settings['sa_core_2023_004_phpinfo_flags'] = ~ (INFO_VARIABLES | INFO_ENVIRONMENT); + +/** + * Private file path: + * + * A local file system path where private files will be stored. This directory + * must be absolute, outside of the Drupal installation directory and not + * accessible over the web. + * + * Note: Caches need to be cleared when this value is changed to make the + * private:// stream wrapper available to the system. + * + * See https://www.drupal.org/documentation/modules/file for more information + * about securing private files. + */ +$settings['file_private_path'] = '/private'; + +/** + * Temporary file path: + * + * A local file system path where temporary files will be stored. This directory + * must be absolute, outside of the Drupal installation directory and not + * accessible over the web. + * + * If this is not set, the default for the operating system will be used. + * + * @see \Drupal\Component\FileSystem\FileSystem::getOsTemporaryDirectory() + */ +# $settings['file_temp_path'] = '/tmp'; + +/** + * Session write interval: + * + * Set the minimum interval between each session write to database. + * For performance reasons it defaults to 180. + */ +# $settings['session_write_interval'] = 180; + +/** + * String overrides: + * + * To override specific strings on your site with or without enabling the Locale + * module, add an entry to this list. This functionality allows you to change + * a small number of your site's default English language interface strings. + * + * Remove the leading hash signs to enable. + * + * The "en" part of the variable name, is dynamic and can be any langcode of + * any added language. (eg locale_custom_strings_de for german). + */ +# $settings['locale_custom_strings_en'][''] = [ +# 'Home' => 'Front page', +# '@count min' => '@count minutes', +# ]; + +/** + * A custom theme for the offline page: + * + * This applies when the site is explicitly set to maintenance mode through the + * administration page or when the database is inactive due to an error. + * The template file should also be copied into the theme. It is located inside + * 'core/modules/system/templates/maintenance-page.html.twig'. + * + * Note: This setting does not apply to installation and update pages. + */ +# $settings['maintenance_theme'] = 'claro'; + +/** + * PHP settings: + * + * To see what PHP settings are possible, including whether they can be set at + * runtime (by using ini_set()), read the PHP documentation: + * http://php.net/manual/ini.list.php + * See \Drupal\Core\DrupalKernel::bootEnvironment() for required runtime + * settings and the .htaccess file for non-runtime settings. + * Settings defined there should not be duplicated here so as to avoid conflict + * issues. + */ + +/** + * If you encounter a situation where users post a large amount of text, and + * the result is stripped out upon viewing but can still be edited, Drupal's + * output filter may not have sufficient memory to process it. If you + * experience this issue, you may wish to uncomment the following two lines + * and increase the limits of these variables. For more information, see + * http://php.net/manual/pcre.configuration.php. + */ +# ini_set('pcre.backtrack_limit', 200000); +# ini_set('pcre.recursion_limit', 200000); + +/** + * Configuration overrides. + * + * To globally override specific configuration values for this site, + * set them here. You usually don't need to use this feature. This is + * useful in a configuration file for a vhost or directory, rather than + * the default settings.php. + * + * Note that any values you provide in these variable overrides will not be + * viewable from the Drupal administration interface. The administration + * interface displays the values stored in configuration so that you can stage + * changes to other environments that don't have the overrides. + * + * There are particular configuration values that are risky to override. For + * example, overriding the list of installed modules in 'core.extension' is not + * supported as module install or uninstall has not occurred. Other examples + * include field storage configuration, because it has effects on database + * structure, and 'core.menu.static_menu_link_overrides' since this is cached in + * a way that is not config override aware. Also, note that changing + * configuration values in settings.php will not fire any of the configuration + * change events. + */ +# $config['system.site']['name'] = 'My Drupal site'; +# $config['user.settings']['anonymous'] = 'Visitor'; + +/** + * Load services definition file. + */ +$settings['container_yamls'][] = $app_root . '/' . $site_path . '/services.yml'; + +/** + * Override the default service container class. + * + * This is useful for example to trace the service container for performance + * tracking purposes, for testing a service container with an error condition or + * to test a service container that throws an exception. + */ +# $settings['container_base_class'] = '\Drupal\Core\DependencyInjection\Container'; + +/** + * Override the default yaml parser class. + * + * Provide a fully qualified class name here if you would like to provide an + * alternate implementation YAML parser. The class must implement the + * \Drupal\Component\Serialization\SerializationInterface interface. + */ +# $settings['yaml_parser_class'] = NULL; + +/** + * Trusted host configuration. + * + * Drupal core can use the Symfony trusted host mechanism to prevent HTTP Host + * header spoofing. + * + * To enable the trusted host mechanism, you enable your allowable hosts + * in $settings['trusted_host_patterns']. This should be an array of regular + * expression patterns, without delimiters, representing the hosts you would + * like to allow. + * + * For example: + * @code + * $settings['trusted_host_patterns'] = [ + * '^www\.example\.com$', + * ]; + * @endcode + * will allow the site to only run from www.example.com. + * + * If you are running multisite, or if you are running your site from + * different domain names (eg, you don't redirect http://www.example.com to + * http://example.com), you should specify all of the host patterns that are + * allowed by your site. + * + * For example: + * @code + * $settings['trusted_host_patterns'] = [ + * '^example\.com$', + * '^.+\.example\.com$', + * '^example\.org$', + * '^.+\.example\.org$', + * ]; + * @endcode + * will allow the site to run off of all variants of example.com and + * example.org, with all subdomains included. + * + * @see https://www.drupal.org/docs/installing-drupal/trusted-host-settings + */ +# $settings['trusted_host_patterns'] = []; + +/** + * The default list of directories that will be ignored by Drupal's file API. + * + * By default ignore node_modules and bower_components folders to avoid issues + * with common frontend tools and recursive scanning of directories looking for + * extensions. + * + * @see \Drupal\Core\File\FileSystemInterface::scanDirectory() + * @see \Drupal\Core\Extension\ExtensionDiscovery::scanDirectory() + */ +$settings['file_scan_ignore_directories'] = [ + 'node_modules', + 'bower_components', +]; + +/** + * The default number of entities to update in a batch process. + * + * This is used by update and post-update functions that need to go through and + * change all the entities on a site, so it is useful to increase this number + * if your hosting configuration (i.e. RAM allocation, CPU speed) allows for a + * larger number of entities to be processed in a single batch run. + */ +$settings['entity_update_batch_size'] = 50; + +/** + * Entity update backup. + * + * This is used to inform the entity storage handler that the backup tables as + * well as the original entity type and field storage definitions should be + * retained after a successful entity update process. + */ +$settings['entity_update_backup'] = TRUE; + +/** + * State caching. + * + * State caching uses the cache collector pattern to cache all requested keys + * from the state API in a single cache entry, which can greatly reduce the + * amount of database queries. However, some sites may use state with a + * lot of dynamic keys which could result in a very large cache. + */ +$settings['state_cache'] = TRUE; + +/** + * Node migration type. + * + * This is used to force the migration system to use the classic node migrations + * instead of the default complete node migrations. The migration system will + * use the classic node migration only if there are existing migrate_map tables + * for the classic node migrations and they contain data. These tables may not + * exist if you are developing custom migrations and do not want to use the + * complete node migrations. Set this to TRUE to force the use of the classic + * node migrations. + */ +$settings['migrate_node_migrate_type_classic'] = FALSE; + +/** + * The default settings for migration sources. + * + * These settings are used as the default settings on the Credential form at + * /upgrade/credentials. + * + * - migrate_source_version - The version of the source database. This can be + * '6' or '7'. Defaults to '7'. + * - migrate_source_connection - The key in the $databases array for the source + * site. + * - migrate_file_public_path - The location of the source Drupal 6 or Drupal 7 + * public files. This can be a local file directory containing the source + * Drupal 6 or Drupal 7 site (e.g /var/www/docroot), or the site address + * (e.g http://example.com). + * - migrate_file_private_path - The location of the source Drupal 7 private + * files. This can be a local file directory containing the source Drupal 7 + * site (e.g /var/www/docroot), or empty to use the same value as Public + * files directory. + * + * Sample configuration for a drupal 6 source site with the source files in a + * local directory. + * + * @code + * $settings['migrate_source_version'] = '6'; + * $settings['migrate_source_connection'] = 'migrate'; + * $settings['migrate_file_public_path'] = '/var/www/drupal6'; + * @endcode + * + * Sample configuration for a drupal 7 source site with public source files on + * the source site and the private files in a local directory. + * + * @code + * $settings['migrate_source_version'] = '7'; + * $settings['migrate_source_connection'] = 'migrate'; + * $settings['migrate_file_public_path'] = 'https://drupal7.com'; + * $settings['migrate_file_private_path'] = '/var/www/drupal7'; + * @endcode + */ +# $settings['migrate_source_connection'] = ''; +# $settings['migrate_source_version'] = ''; +# $settings['migrate_file_public_path'] = ''; +# $settings['migrate_file_private_path'] = ''; + +/** + * Load local development override configuration, if available. + * + * Create a settings.local.php file to override variables on secondary (staging, + * development, etc.) installations of this site. + * + * Typical uses of settings.local.php include: + * - Disabling caching. + * - Disabling JavaScript/CSS compression. + * - Rerouting outgoing emails. + * + * Keep this code block at the end of this file to take full effect. + */ +# +# if (file_exists($app_root . '/' . $site_path . '/settings.local.php')) { +# include $app_root . '/' . $site_path . '/settings.local.php'; +# } + +$settings["config_sync_directory"] = '{{ .Values.drupal.configSync.directory }}'; + +{{- if .Values.redis.enabled }} +if (extension_loaded('redis')) { + // Set Redis as the default backend for any cache bin not otherwise specified. + $settings['cache']['default'] = 'cache.backend.redis'; + $settings['redis.connection']['interface'] = '{{ default "PhpRedis" .Values.redis.clientInterface }}'; + $settings['redis.connection']['scheme'] = 'tcp'; + $settings['redis.connection']['host'] = '{{ .Release.Name }}-redis'; + $settings['redis.connection']['port'] = '{{ .Values.redis.service.port }}'; + $settings['redis.connection']['password'] = getenv('REDIS_PASSWORD') ?: ''; + $settings['redis.connection']['persistent'] = FALSE; + + // Allow the services to work before the Redis module itself is enabled. + $settings['container_yamls'][] = 'modules/contrib/redis/example.services.yml'; + $settings['container_yamls'][] = 'modules/contrib/redis/redis.services.yml'; + + // Manually add the classloader path, this is required for the container cache bin definition below + // and allows to use it without the redis module being enabled. + $class_loader->addPsr4('Drupal\\redis\\', 'modules/contrib/redis/src'); + + $settings['bootstrap_container_definition'] = [ + 'parameters' => [], + 'services' => [ + 'redis.factory' => [ + 'class' => 'Drupal\redis\ClientFactory', + ], + 'cache.backend.redis' => [ + 'class' => 'Drupal\redis\Cache\CacheBackendFactory', + 'arguments' => ['@redis.factory', '@cache_tags_provider.container', '@serialization.phpserialize'], + ], + 'cache.container' => [ + 'class' => '\Drupal\redis\Cache\PhpRedis', + 'factory' => ['@cache.backend.redis', 'get'], + 'arguments' => ['container'], + ], + 'cache_tags_provider.container' => [ + 'class' => 'Drupal\redis\Cache\RedisCacheTagsChecksum', + 'arguments' => ['@redis.factory'], + ], + 'serialization.phpserialize' => [ + 'class' => 'Drupal\Component\Serialization\PhpSerialize', + ], + ], + ]; + + /** Optional prefix for cache entries */ + $settings['cache_prefix'] = 'drupal_'; + + // Always set the fast backend for bootstrap, discover and config, otherwise + // this gets lost when redis is enabled. + $settings['cache']['bins']['bootstrap'] = 'cache.backend.chainedfast'; + $settings['cache']['bins']['discovery'] = 'cache.backend.chainedfast'; + $settings['cache']['bins']['config'] = 'cache.backend.chainedfast'; + + // Use for all bins otherwise specified. + $settings['cache']['default'] = 'cache.backend.redis'; + + {{- if .Values.redis.queue.enabled }} + // Use for all queues unless otherwise specified for a specific queue. + $settings['queue_default'] = 'queue.redis'; + {{- end }} + + // Or if you want to use reliable queue implementation. + // $settings['queue_default'] = 'queue.redis_reliable'; + + // Use this to only use Redis for a specific queue. + // $settings['queue_service_aggregator_feeds'] = 'queue.redis'; + + // Use this to use reliable queue implementation. + // $settings['queue_service_aggregator_feeds'] = 'queue.redis_reliable'; +} +{{- end }} + +// As recommended in the S3FS docs, change the twig storage directory +$settings['php_storage']['twig']['directory'] = '/cache/twig'; + +if (is_file(__DIR__ . '/extra.settings.php')) { + include __DIR__ . '/extra.settings.php'; +} diff --git a/charts/drupal/conf/settings.d9.php b/charts/drupal/conf/settings.d9.php index 80e14bc8..fff7d863 100644 --- a/charts/drupal/conf/settings.d9.php +++ b/charts/drupal/conf/settings.d9.php @@ -850,13 +850,8 @@ $settings['cache']['default'] = 'cache.backend.redis'; $settings['redis.connection']['interface'] = '{{ default "PhpRedis" .Values.redis.clientInterface }}'; $settings['redis.connection']['scheme'] = 'tcp'; - {{- if .Values.redis.sentinel.enabled }} - $settings['redis.connection']['host'] = ['{{ .Release.Name }}-redis:{{ .Values.redis.sentinel.service.sentinelPort }}']; - $settings['redis.connection']['instance'] = '{{ .Values.redis.sentinel.masterSet }}'; - {{- else }} - $settings['redis.connection']['host'] = '{{ .Release.Name }}-redis-master'; - $settings['redis.connection']['port'] = '{{ .Values.redis.master.service.ports.redis }}'; - {{- end }} + $settings['redis.connection']['host'] = '{{ .Release.Name }}-redis'; + $settings['redis.connection']['port'] = '{{ .Values.redis.service.port }}'; $settings['redis.connection']['password'] = getenv('REDIS_PASSWORD') ?: ''; $settings['redis.connection']['persistent'] = FALSE; diff --git a/charts/drupal/templates/NOTES.txt b/charts/drupal/templates/NOTES.txt index 12f596e5..f676051c 100644 --- a/charts/drupal/templates/NOTES.txt +++ b/charts/drupal/templates/NOTES.txt @@ -76,11 +76,3 @@ kubectl exec -it $POD_NAME -n {{ .Release.Namespace }} -- drush si {{ .Values.dr export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/instance={{ .Release.Name }},tier=drupal" -o jsonpath="{.items[0].metadata.name}") kubectl exec -it $POD_NAME -n {{ .Release.Namespace }} -- drush $YOUR_COMMAND - -** Istio - -Running with Istio sidecar injection? - -1. The jobs won't finish, so you'll need to monitor the pods and once they reach 1/2 ready, terminate the proxy: - - kubectl exec -it $POD_NAME -n {{ .Release.Namespace }} -c istio-proxy -- kill -INT 1 diff --git a/charts/drupal/templates/_helpers.tpl b/charts/drupal/templates/_helpers.tpl index 29b74d45..b4a78d95 100644 --- a/charts/drupal/templates/_helpers.tpl +++ b/charts/drupal/templates/_helpers.tpl @@ -80,7 +80,7 @@ Create common environment variables for Drupal secretKeyRef: name: {{ template "drupal.fullname" . }} key: databasePassword -{{- else if and .Values.mysql.enabled (not .Values.mysql.auth.usePasswordFiles) }} +{{- else if and .Values.mysql.enabled }} - name: MYSQL_PASSWORD valueFrom: secretKeyRef: @@ -97,8 +97,8 @@ Create common environment variables for Drupal - name: REDIS_PASSWORD valueFrom: secretKeyRef: - name: "{{ .Release.Name }}-redis" - key: redis-password + name: "{{ .Release.Name }}-redis-auth" + key: default-password {{- end }} {{- if not .Values.drupal.usePasswordFiles }} - name: DRUPAL_ADMIN_PASSWORD diff --git a/charts/drupal/templates/cm/drupal.yaml b/charts/drupal/templates/cm/drupal.yaml index a9b6db59..93416f09 100644 --- a/charts/drupal/templates/cm/drupal.yaml +++ b/charts/drupal/templates/cm/drupal.yaml @@ -20,6 +20,8 @@ data: {{- tpl (.Files.Get "conf/settings.d9.php") . | nindent 4 }} {{- else if eq "d10" .Values.drupal.version }} {{- tpl (.Files.Get "conf/settings.d10.php") . | nindent 4 }} + {{- else if eq "d11" .Values.drupal.version }} + {{- tpl (.Files.Get "conf/settings.d11.php") . | nindent 4 }} {{- else }} settings.php: ~/.my.cnf + [client] + ssl = false + ssl-verify-server-cert = false + EOF + + echo "Configuring Drush to disable MySQL SSL" + mkdir -p /var/www/html/drush + cat <<'EOF' > /var/www/html/drush/drush.yml + command: + sql: + cli: + options: + extra: "--skip-ssl" + connect: + options: + extra: "--skip-ssl" + create: + options: + extra: "--skip-ssl" + drop: + options: + extra: "--skip-ssl" + dump: + options: + extra: "--skip-ssl" + query: + options: + extra: "--skip-ssl" + EOF + {{- end }} + # Wait for DB to be available {{ .Values.drupal.dbAvailabilityScript | nindent 14}} {{- if .Values.redis.enabled }} - {{- if .Values.redis.sentinel.enabled }} - until [[ $(printf "AUTH $REDIS_PASSWORD\r\n" | nc -w 2 {{ .Release.Name }}-redis {{ .Values.redis.sentinel.service.sentinelPort }}) == $(printf "+OK\r\n") ]]; do echo Waiting for Redis; sleep 3; done - {{- else }} - until [[ $(printf "AUTH $REDIS_PASSWORD\r\n" | nc -w 2 {{ .Release.Name }}-redis-master {{ .Values.redis.master.service.ports.redis }}) == $(printf "+OK\r\n") ]]; do echo Waiting for Redis; sleep 3; done - {{- end }} + PASS="$REDIS_PASSWORD" + + until ( + printf '*3\r\n$4\r\nAUTH\r\n$7\r\ndefault\r\n$%s\r\n%s\r\n*1\r\n$4\r\nPING\r\n' \ + "$(printf %s "$PASS" | wc -c)" "$PASS" + sleep 1 + ) | nc -w 2 {{ .Release.Name }}-redis {{ .Values.redis.service.port }} | grep -q PONG; do + echo Waiting for Redis + sleep 3 + done echo Redis available {{- end }} @@ -72,12 +111,13 @@ spec: drush status || true {{- if .Values.redis.enabled }} - # Flush redis caches - {{- if .Values.redis.sentinel.enabled }} - printf "AUTH $REDIS_PASSWORD\r\nFLUSHDB\r\n" | nc -w 2 {{ .Release.Name }}-redis {{ .Values.redis.sentinel.service.sentinelPort }} - {{- else }} - printf "AUTH $REDIS_PASSWORD\r\nFLUSHDB\r\n" | nc -w 2 {{ .Release.Name }}-redis-master {{ .Values.redis.master.service.ports.redis }} - {{- end }} + PASS="$REDIS_PASSWORD" + + ( + printf '*3\r\n$4\r\nAUTH\r\n$7\r\ndefault\r\n$%s\r\n%s\r\n*1\r\n$7\r\nFLUSHDB\r\n' \ + "$(printf %s "$PASS" | wc -c)" "$PASS" + sleep 1 + ) | nc -w 2 {{ .Release.Name }}-redis {{ .Values.redis.service.port }} {{- end }} # Run site install diff --git a/charts/drupal/templates/job/post-upgrade-reconfigure.yaml b/charts/drupal/templates/job/post-upgrade-reconfigure.yaml index 20fe1a40..e045c640 100644 --- a/charts/drupal/templates/job/post-upgrade-reconfigure.yaml +++ b/charts/drupal/templates/job/post-upgrade-reconfigure.yaml @@ -56,15 +56,54 @@ spec: {{ toYaml .Values.drupal.preUpgradeScripts | nindent 14}} {{- end }} + {{- if .Values.mysql.enabled }} + echo "Fixing MariaDB client SSL defaults" + cat < ~/.my.cnf + [client] + ssl = false + ssl-verify-server-cert = false + EOF + + echo "Configuring Drush to disable MySQL SSL" + mkdir -p /var/www/html/drush + cat <<'EOF' > /var/www/html/drush/drush.yml + command: + sql: + cli: + options: + extra: "--skip-ssl" + connect: + options: + extra: "--skip-ssl" + create: + options: + extra: "--skip-ssl" + drop: + options: + extra: "--skip-ssl" + dump: + options: + extra: "--skip-ssl" + query: + options: + extra: "--skip-ssl" + EOF + {{- end }} + # Wait for DB to be available {{ .Values.drupal.dbAvailabilityScript | nindent 14}} {{- if .Values.redis.enabled }} - {{- if .Values.redis.sentinel.enabled }} - until [[ $(printf "AUTH $REDIS_PASSWORD\r\n" | nc -w 2 {{ .Release.Name }}-redis {{ .Values.redis.sentinel.service.sentinelPort }}) == $(printf "+OK\r\n") ]]; do echo Waiting for Redis; sleep 3; done - {{- else }} - until [[ $(printf "AUTH $REDIS_PASSWORD\r\n" | nc -w 2 {{ .Release.Name }}-redis-master {{ .Values.redis.master.service.ports.redis }}) == $(printf "+OK\r\n") ]]; do echo Waiting for Redis; sleep 3; done - {{- end }} + PASS="$REDIS_PASSWORD" + + until ( + printf '*3\r\n$4\r\nAUTH\r\n$7\r\ndefault\r\n$%s\r\n%s\r\n*1\r\n$4\r\nPING\r\n' \ + "$(printf %s "$PASS" | wc -c)" "$PASS" + sleep 1 + ) | nc -w 2 {{ .Release.Name }}-redis {{ .Values.redis.service.port }} | grep -q PONG; do + echo Waiting for Redis + sleep 3 + done echo Redis available {{- end }} diff --git a/charts/drupal/values-example-csi-azure.yaml b/charts/drupal/values-example-csi-azure.yaml deleted file mode 100644 index 2ddc627d..00000000 --- a/charts/drupal/values-example-csi-azure.yaml +++ /dev/null @@ -1,328 +0,0 @@ -# Default values for Example CSI Azure. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -ingress: - enabled: true - path: / - hosts: - - site.example.ca - annotations: - kubernetes.io/ingress.class: istio - -## Drupal -## Ref: https://github.com/drupalwxt/helm-drupal -drupal: - ## Drupal image version - ## ref: https://hub.docker.com/drupalwxt/site-wxt/tags/ - ## - image: example.azurecr.io/site-example - tag: 1.0.0 - - imagePullSecrets: - - name: acr-registry - - ## Site configuration - ## - profile: wxt - siteEmail: admin@example.com - siteName: Drupal Install Profile (WxT) - - ## Application password - ## - password: XXXXX - - # php-fpm healthcheck - # Requires https://github.com/renatomefi/php-fpm-healthcheck in the container. - # (note: official images do not contain this feature yet) - healthcheck: - enabled: true - - # Switch to canada.ca theme (only used if install and/or reconfigure are enabled) - # Common options include: theme-wet-boew, theme-gcweb-legacy - wxtTheme: theme-gcweb - - # Install Drupal automatically - install: false - - # Run migrations for default content - migrate: false - - # PHP configuration - php: - ini: - mysqlnd_azure.enableRedirect: off - - # Reconfigure on upgrade - reconfigure: true - cacheRebuildBeforeDatabaseMigration: true - - securityContext: {} - # fsGroup: 82 - # runAsGroup: 82 - # runAsUser: 82 - - # Run extra install scripts - # postInstallScripts: |- - # - - ## Extra settings.php settings - ## - extraSettings: |- - $databases['default']['default']['pdo'][PDO::MYSQL_ATTR_SSL_CA] = '/etc/ssl/certs/ca-certificates.crt'; - $_SERVER['HTTPS'] = $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ? 'on' : 'off'; - $_SERVER['HTTP_HOST'] = $_SERVER['HTTP_X_FORWARDED_HOST']; - $settings['file_temp_path'] = '/drupal-tmp'; - $config['config_split.config_split.dev']['status'] = TRUE; - - postUpgradeScripts: |- - drush config:import --yes - - # Restore Drupal automatically - restore: - enabled: false - - # Configure the Drupal cron - cron: - # When enabled, a CronJob will run the job based on the schedule - enabled: true - - # CronJob schedule (standard cron syntax) - # Defaults to once an hour - schedule: '*/2 * * * *' - - # Configure additional Drupal crons - additionalCrons: - clean-backups: - # Run at 03:00AM UTC every day. - schedule: '00 03 * * *' - script: | - find /backup/ -mindepth 1 -maxdepth 1 -type d -mtime +30 -exec echo "rm -rf " {} \; 2>&1; - find /backup/ -mindepth 1 -maxdepth 1 -type d -mtime +30 -exec rm -rf {} \; 2>&1; - - volumes: - - name: backup - persistentVolumeClaim: - claimName: example-drupal-backup - - volumeMounts: - - name: backup - mountPath: /backup - - # Configure the Drupal backup cron - backup: - # When enabled, a CronJob will run the job based on the schedule - enabled: true - - # CronJob schedule (standard cron syntax) - # Defaults to midnight - schedule: '0 0 * * *' - - volume: - persistentVolumeClaim: - claimName: example-drupal-backup - - # Allows custom /var/www/html/sites/default/files and /var/www/private mounts - disableDefaultFilesMount: true - - volumes: - - name: files-tmp - persistentVolumeClaim: - claimName: example-drupal-tmp - - volumeMounts: - - name: files-public - mountPath: /var/www/html/sites/default/files - - name: files-private - mountPath: /private - - name: files-tmp - mountPath: /drupal-tmp - - smtp: {} - # host: mail.example.ca:25 - # tls: true - # starttls: true - - configSync: - directory: "/var/www/config/sync" - -## Nginx -## Ref: https://github.com/drupalwxt/helm-drupal -nginx: - image: example.azurecr.io/site-example-nginx - tag: 1.0.0 - - imagePullSecrets: - - name: acr-registry - - # Set your cluster's DNS resolution service here - resolver: 10.0.0.10 - - volumeMounts: - - name: files-public - mountPath: /var/www/html/sites/default/files - - securityContext: {} - # fsGroup: 33 - -azure: - storageClass: - create: true - - ## Azure Files - # kubectl create secret generic example-storage --from-literal=azurestorageaccountname=$STORAGE_ACCOUNT_NAME --from-literal=azurestorageaccountkey=$STORAGE_KEY -n example - azureFile: - enabled: true - # storageClass: "-" - - size: 100Gi - - protocol: nfs - - public: - spec: - # azureFile: - # secretName: example-storage - # shareName: public - # # secretNamespace: "" - # readOnly: false - - csi: - driver: file.csi.azure.com - volumeHandle: "example-drupal-public-nfs" - volumeAttributes: - resourceGroup: "managed-dev-cc-drupal" - storageAccount: "manageddevccdrupal" - shareName: public - protocol: nfs - - private: - spec: - # azureFile: - # secretName: example-storage - # shareName: private - # # secretNamespace: "" - # readOnly: false - - csi: - driver: file.csi.azure.com - volumeHandle: "example-drupal-private-nfs" - volumeAttributes: - resourceGroup: "managed-dev-cc-drupal" - storageAccount: "manageddevccdrupal" - shareName: public - protocol: nfs - - backup: - spec: - # azureFile: - # secretName: example-storage - # shareName: private - # # secretNamespace: "" - # readOnly: false - - csi: - driver: file.csi.azure.com - volumeHandle: "example-drupal-backup-nfs" - volumeAttributes: - resourceGroup: "managed-dev-cc-drupal" - storageAccount: "manageddevccdrupal" - shareName: backup - protocol: nfs - tmp: - spec: - # azureFile: - # secretName: example-storage - # shareName: private - # # secretNamespace: "" - # readOnly: false - - csi: - driver: file.csi.azure.com - volumeHandle: "example-drupal-tmp-nfs" - volumeAttributes: - resourceGroup: "managed-dev-cc-drupal" - storageAccount: "manageddevccdrupal" - shareName: tmp - protocol: nfs - -## Redis -## Ref: https://github.com/bitnami/charts/tree/master/bitnami/redis -redis: - enabled: true - global: - redis: - password: XXXXX - image: - pullSecrets: - - acr-registry - replica: - enabled: false - replicaCount: 0 - service: - type: ClusterIP - disableCommands: [] - persistence: - enabled: false - sentinel: - enabled: false - master: - service: - type: ClusterIP - disableCommands: [] - persistence: - enabled: false - livenessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 5 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 5 - readinessProbe: - enabled: true - initialDelaySeconds: 20 - periodSeconds: 5 - timeoutSeconds: 5 - successThreshold: 1 - failureThreshold: 5 - commonConfiguration: |- - # Disable AOF https://redis.io/topics/persistence#append-only-file - appendonly no - # Disable RDB persistence. - save "" - # Redis Memory - maxmemory "8024mb" - maxmemory-policy "volatile-lfu" - -## Varnish -## Ref: https://github.com/StatCan/charts/tree/master/stable/varnish -varnish: - enabled: true - varnishd: - image: docker.io/varnish - imagePullSecrets: - - name: acr-registry - - memorySize: 1G - -## External DB -## Ref: https://github.com/drupalwxt/helm-drupal -external: - enabled: true - driver: mysql - port: 3306 - host: XXXXX.mysql.database.azure.com - database: "example" - user: examplemysqladmin - password: XXXXX - -## MySQL -## Ref: https://github.com/bitnami/charts/tree/master/bitnami/mysql -mysql: - enabled: false - -## ProxySQL -## Ref: https://github.com/drupalwxt/helm-drupal -proxysql: - enabled: false diff --git a/charts/drupal/values-example-single-node.yaml b/charts/drupal/values-example-single-node.yaml deleted file mode 100644 index 555c934b..00000000 --- a/charts/drupal/values-example-single-node.yaml +++ /dev/null @@ -1,23 +0,0 @@ -# Default values for Example Single Node. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -drupal: - persistence: - enabled: true - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - # existingClaim: - - ## Drupal data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - # storageClass: "-" - annotations: {} - accessMode: ReadWriteOnce - size: 8Gi diff --git a/charts/drupal/values.yaml b/charts/drupal/values.yaml index cecc0bce..11e2019c 100644 --- a/charts/drupal/values.yaml +++ b/charts/drupal/values.yaml @@ -75,15 +75,11 @@ drupal: # (NOTE: Root must always start with a / and should NOT have a trailing slash) siteRoot: / - # Default WxT Library theme (only used if install and/or reconfigure are enabled) - # Common options include: theme-wet-boew, theme-gcweb-legacy, theme-gcweb, ... - theme: theme-gcweb - ## Version of the application ## - ## Supported versions: d9, d10 + ## Supported versions: d9, d10, d11 ## - version: d10 + version: d11 services: '' # |- @@ -706,78 +702,73 @@ azure: ## ref: https://github.com/bitnami/charts/blob/master/bitnami/mysql/README.md mysql: enabled: true + image: - tag: 8.0.29-debian-11-r3 + registry: docker.io + repository: bitnamilegacy/mysql + tag: "8.0" + pullPolicy: IfNotPresent + auth: rootPassword: "" database: wxt username: wxt password: "" + primary: persistence: enabled: true - # storageClass: managed-premium size: 128Gi - configuration: |- - [mysqld] - default_authentication_plugin=mysql_native_password - skip-name-resolve - explicit_defaults_for_timestamp - basedir=/opt/bitnami/mysql - plugin_dir=/opt/bitnami/mysql/lib/plugin - port=3306 - socket=/opt/bitnami/mysql/tmp/mysql.sock - datadir=/bitnami/mysql/data - tmpdir=/opt/bitnami/mysql/tmp - max_allowed_packet=16M - bind-address=0.0.0.0 - pid-file=/opt/bitnami/mysql/tmp/mysqld.pid - log-error=/opt/bitnami/mysql/logs/mysqld.log - character-set-server=UTF8 - collation-server=utf8_general_ci - slow_query_log=0 - slow_query_log_file=/opt/bitnami/mysql/logs/mysqld.log - long_query_time=10.0 - transaction_isolation="READ-COMMITTED" - - max_allowed_packet = 256M - innodb_buffer_pool_size = 4096M - innodb_buffer_pool_instances = 4 - table_definition_cache = 4096 - table_open_cache = 8192 - innodb_flush_log_at_trx_commit=2 - - [client] - port=3306 - socket=/opt/bitnami/mysql/tmp/mysql.sock - default-character-set=UTF8 - plugin_dir=/opt/bitnami/mysql/lib/plugin - - [manager] - port=3306 - socket=/opt/bitnami/mysql/tmp/mysql.sock - pid-file=/opt/bitnami/mysql/tmp/mysqld.pid + resources: + requests: + memory: 4Gi + cpu: 2000m + limits: + memory: 8Gi + cpu: 4000m + + extraFlags: >- + --default-authentication-plugin=mysql_native_password + --skip-name-resolve + --max_allowed_packet=256M + --innodb_buffer_pool_size=4096M + --innodb_buffer_pool_instances=4 + --table_definition_cache=4096 + --table_open_cache=8192 + --innodb_flush_log_at_trx_commit=2 + --skip_ssl + --require_secure_transport=OFF + volumePermissions: enabled: true + image: + registry: docker.io + repository: bitnamilegacy/os-shell + tag: "12-debian-12" ## Configuration values for the PostgreSQL dependency sub-chart ## ref: https://github.com/bitnami/charts/blob/master/bitnami/postgresql/README.md postgresql: enabled: false + image: - tag: 14.3.0-debian-11-r3 + registry: docker.io + repository: bitnamilegacy/postgresql + tag: "16" + pullPolicy: IfNotPresent + auth: enablePostgresUser: true postgresPassword: "example" username: "wxt" password: "example" database: "wxt" + primary: persistence: enabled: true - # storageClass: managed-premium size: 128Gi - configuration: "" + extendedConfiguration: |- listen_addresses='*' max_connections=200 @@ -788,8 +779,13 @@ postgresql: min_wal_size='512MB' max_wal_size='512MB' bytea_output='escape' + volumePermissions: enabled: true + image: + registry: docker.io + repository: bitnamilegacy/os-shell + tag: "12-debian-12" pgbouncer: enabled: false @@ -813,32 +809,29 @@ proxysql: stackSize: 1048576 ## Configuration values for the Redis dependency sub-chart -## ref: https://github.com/bitnami/charts/blob/master/bitnami/redis/README.md +## ref: https://github.com/valkey-io/valkey-helm/blob/main/README.md redis: - enabled: false - queue: + enabled: true + architecture: standalone + auth: enabled: true - replica: - enabled: false - replicaCount: 0 - service: - type: ClusterIP - disableCommands: [] - persistence: - enabled: false - sentinel: - enabled: false - master: + aclUsers: + default: + permissions: "~* &* +@all" + password: "secretpass" + + primary: service: type: ClusterIP - disableCommands: [] persistence: enabled: false - commonConfiguration: |- - # Disable AOF https://redis.io/topics/persistence#append-only-file + replica: + replicaCount: 0 + configuration: |- appendonly no - # Disable RDB persistence. save "" + queue: + enabled: true ## Configuration values for the Solr dependency sub-chart ## ref: https://github.com/bitnami/charts/blob/master/bitnami/redis/README.md @@ -846,8 +839,9 @@ solr: enabled: false image: registry: docker.io - repository: bitnami/solr - tag: 9.2.1-debian-11-r16 + repository: bitnamilegacy/solr + tag: "9.2.1-debian-11-r73" + pullPolicy: IfNotPresent cloudEnabled: false cloudBootstrap: false zookeeper: @@ -856,12 +850,12 @@ solr: collectionReplicas: 1 ## Configuration values for the Varnish dependency sub-chart -## ref: https://github.com/statcan/charts/blob/master/stable/varnish/README.md +## ref: https://github.com/drupalwxt/helm-drupal/blob/main/charts/varnish/README.md varnish: - enabled: false + enabled: true varnishd: image: varnish - tag: 6.5.1 + tag: 6.6.2 imagePullPolicy: IfNotPresent service: type: ClusterIP @@ -1095,6 +1089,3 @@ varnish: # synthetic(std.fileread("/data/configuration/varnish/errors/503.html")); # return (deliver); # } - -solr: - enabled: false diff --git a/charts/solr/.helmignore b/charts/solr/.helmignore deleted file mode 100644 index 0e8a0eb3..00000000 --- a/charts/solr/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/charts/solr/Chart.yaml b/charts/solr/Chart.yaml deleted file mode 100644 index 7ea490c7..00000000 --- a/charts/solr/Chart.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: v2 -name: solr -description: A Helm chart for a Solr instance using the official Solr Operator. - -# A chart can be either an 'application' or a 'library' chart. -# -# Application charts are a collection of templates that can be packaged into versioned archives -# to be deployed. -# -# Library charts provide useful utilities or functions for the chart developer. They're included as -# a dependency of application charts to inject those utilities and functions into the rendering -# pipeline. Library charts do not define any templates and therefore cannot be deployed. -type: application - -# This is the chart version. This version number should be incremented each time you make changes -# to the chart and its templates, including the app version. -# Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.10 - -# This is the version number of the application being deployed. This version number should be -# incremented each time you make changes to the application. Versions are not expected to -# follow Semantic Versioning. They should reflect the version the application is using. -# It is recommended to use it with quotes. -appVersion: "8.11.3" diff --git a/charts/solr/README.md b/charts/solr/README.md deleted file mode 100644 index 38a3362c..00000000 --- a/charts/solr/README.md +++ /dev/null @@ -1,28 +0,0 @@ -# solr - -![Version: 0.1.10](https://img.shields.io/badge/Version-0.1.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 8.11.3](https://img.shields.io/badge/AppVersion-8.11.3-informational?style=flat-square) - -A Helm chart for a Solr instance using the official Solr Operator. - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| destinationRule.enabled | bool | `false` | | -| destinationRule.mode | string | `"DISABLE"` | | -| ingress.annotations | object | `{}` | | -| ingress.enabled | bool | `false` | | -| ingress.hosts[0] | string | `"chart-example.local"` | | -| ingress.path | string | `"/.*"` | | -| ingress.pathType | string | `"ImplementationSpecific"` | | -| ingress.tls | list | `[]` | | -| solr.basicAuthSecret | string | `nil` | | -| solr.replicas | int | `1` | | -| solr.solrJavaMem | string | `"-Xms1g -Xmx5g"` | | -| solr.storage.size | string | `"5Gi"` | | -| zookeeper.replicas | int | `1` | | -| zookeeper.resources | object | `{}` | | -| zookeeper.storage.size | string | `"5Gi"` | | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2) diff --git a/charts/solr/charts/.gitkeep b/charts/solr/charts/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/charts/solr/templates/NOTES.txt b/charts/solr/templates/NOTES.txt deleted file mode 100644 index 95138986..00000000 --- a/charts/solr/templates/NOTES.txt +++ /dev/null @@ -1 +0,0 @@ -Your Solr Cloud instance has been installed. diff --git a/charts/solr/templates/_helpers.tpl b/charts/solr/templates/_helpers.tpl deleted file mode 100644 index ec00c62f..00000000 --- a/charts/solr/templates/_helpers.tpl +++ /dev/null @@ -1,62 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "solr.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "solr.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "solr.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "solr.labels" -}} -helm.sh/chart: {{ include "solr.chart" . }} -{{ include "solr.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "solr.selectorLabels" -}} -app.kubernetes.io/name: {{ include "solr.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "solr.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "solr.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} diff --git a/charts/solr/templates/dr/solr.yaml b/charts/solr/templates/dr/solr.yaml deleted file mode 100644 index 99b0dd33..00000000 --- a/charts/solr/templates/dr/solr.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.destinationRule.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ include "solr.fullname" . }} - labels: - {{- include "solr.labels" . | nindent 4 }} -spec: - host: "{{ template "solr.fullname" . }}.{{ .Release.Namespace }}.svc.{{ default "cluster.local" .Values.clusterDomain }}" - trafficPolicy: - tls: - mode: "{{ default "DISABLE" .Values.destinationRule.mode }}" -{{- end }} diff --git a/charts/solr/templates/ing/solr.yaml b/charts/solr/templates/ing/solr.yaml deleted file mode 100644 index 4dd1acaa..00000000 --- a/charts/solr/templates/ing/solr.yaml +++ /dev/null @@ -1,53 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "solr.fullname" . -}} -{{- $releaseName := .Release.Name -}} -{{- $ingressPath := .Values.ingress.path -}} -{{- $ingressPathType := .Values.ingress.pathType -}} -{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} -apiVersion: networking.k8s.io/v1 -{{- else }} -apiVersion: networking.k8s.io/v1beta1 -{{- end }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - {{- include "solr.labels" . | nindent 4 }} -{{- with .Values.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.className }} - ingressClassName: {{ .Values.ingress.className }} -{{- end }} -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - - host: {{ . | quote }} - http: - paths: - {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} - - pathType: {{ $ingressPathType }} - path: {{ $ingressPath }} - backend: - service: - name: {{ $fullName }}-solrcloud-common - port: - number: 80 - {{- else }} - - backend: - serviceName: {{ $fullName }}-solrcloud-common - servicePort: 80 - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/solr/templates/solrcloud/solr.yaml b/charts/solr/templates/solrcloud/solr.yaml deleted file mode 100644 index 7bba5635..00000000 --- a/charts/solr/templates/solrcloud/solr.yaml +++ /dev/null @@ -1,44 +0,0 @@ -apiVersion: solr.apache.org/v1beta1 -kind: SolrCloud -metadata: - name: {{ include "solr.fullname" . }} - labels: - {{- include "solr.labels" . | nindent 4 }} -spec: - replicas: {{ .Values.solr.replicas }} - dataStorage: - persistent: - reclaimPolicy: Delete - pvcTemplate: - spec: - resources: - requests: - storage: "{{ .Values.solr.storage.size }}" - solrImage: - tag: "{{ default .Chart.AppVersion .Values.solr.tag }}" - solrJavaMem: "{{ .Values.solr.solrJavaMem }}" - solrSecurity: - authenticationType: Basic - probesRequireAuth: true - basicAuthSecret: {{ .Values.solr.basicAuthSecret }} - {{- if .Values.solr.customSolrKubeOptions }} - customSolrKubeOptions: - {{- toYaml .Values.solr.customSolrKubeOptions | nindent 4 }} - {{- end }} - zookeeperRef: - provided: - chroot: "/this/will/be/auto/created" - persistence: - spec: - storageClassName: "default" - resources: - requests: - storage: "{{ .Values.zookeeper.storage.size }}" - replicas: {{ .Values.zookeeper.replicas }} - {{- if .Values.zookeeper.resources }} - zookeeperPodPolicy: - resources: - {{- toYaml .Values.zookeeper.resources | nindent 10 }} - {{- end }} - solrOpts: "-Dsolr.autoSoftCommit.maxTime=10000" - solrGCTune: "-XX:SurvivorRatio=4 -XX:TargetSurvivorRatio=90 -XX:MaxTenuringThreshold=8" diff --git a/charts/solr/values.yaml b/charts/solr/values.yaml deleted file mode 100644 index 652dde10..00000000 --- a/charts/solr/values.yaml +++ /dev/null @@ -1,58 +0,0 @@ -## Configure Ingress resource that allow you to access the Solr installation -## Set up the URL -## ref: http://kubernetes.io/docs/user-guide/ingress/ -## -ingress: - enabled: false - # className: nginx - annotations: {} - # kubernetes.io/tls-acme: "true" - path: /.* - pathType: ImplementationSpecific - hosts: - - chart-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -solr: - # https://github.com/apache/solr-operator/blob/main/docs/solr-cloud/solr-cloud-crd.md#k8s-oper-user - basicAuthSecret: - replicas: 1 - solrJavaMem: "-Xms1g -Xmx5g" - # customSolrKubeOptions: - # podOptions: - # livenessProbe: - # periodSeconds: 15 - # timeoutSeconds: 5 - # readinessProbe: - # timeoutSeconds: 5 - # resources: - # limits: - # memory: "5Gi" - # requests: - # cpu: "250m" - # memory: "256Mi" - - storage: - size: 5Gi - -zookeeper: - replicas: 1 - resources: {} - # limits: - # memory: 2Gi - # requests: - # cpu: 250m - # memory: 256Mi - - storage: - size: 5Gi - -## Configure Istio -## ref: http://istio.io -## -destinationRule: - enabled: false - mode: DISABLE diff --git a/charts/varnish/Chart.yaml b/charts/varnish/Chart.yaml index bc51e0d3..1f26dcd3 100644 --- a/charts/varnish/Chart.yaml +++ b/charts/varnish/Chart.yaml @@ -3,7 +3,7 @@ type: application description: A Helm chart for using Varnish. name: varnish version: 0.2.5 -appVersion: 6.6.0 +appVersion: 6.6.2 home: https://www.varnish-software.com sources: - https://github.com/varnish diff --git a/cluster/config.yaml b/cluster/config.yaml index 305f196c..551406ba 100644 --- a/cluster/config.yaml +++ b/cluster/config.yaml @@ -1,24 +1,23 @@ # k3d cluster create local --config=cluster/config.yaml -apiVersion: k3d.io/v1alpha4 +apiVersion: k3d.io/v1alpha5 kind: Simple -image: docker.io/rancher/k3s:v1.23.4-k3s1 +image: rancher/k3s:v1.29.1-k3s1 servers: 1 agents: 1 options: k3d: wait: true - timeout: "60s" - disableLoadbalancer: false + timeout: "120s" disableRollback: true k3s: extraArgs: - - arg: --no-deploy=traefik,metrics-server #--no-deploy=traefik, but we deploy ingress-nginx-controller by custom manifests in k3s + - arg: --disable=traefik,metrics-server,servicelb nodeFilters: - server:* kubeconfig: updateDefaultKubeconfig: true switchCurrentContext: true ports: - - port: 8081:80 # same as `--port '8081:80@loadbalancer'` + - port: 8081:80 nodeFilters: - loadbalancer diff --git a/docs/README.md b/docs/README.md deleted file mode 100644 index 45854f86..00000000 --- a/docs/README.md +++ /dev/null @@ -1,273 +0,0 @@ -# Architecture - -By: The Cloud Native Team at Statistics Canada - -## Introduction - -* [Architectual Diagram][architectual-diagram] -* [Helm Chart for Drupal WxT][helm-drupal] - -This document represents a high-level technical overview of how the [Helm Chart for Drupal WxT][helm-drupal] was built and how we envision [Drupal][drupal] itself should be architected in the cloud to support any of the Government of Canada procured cloud service providers (`AWS`, `Azure`, and `GCP`), as well as upcoming ones such as `IBM` and `Oracle`. It should be noted that this would also work in an on-premise environment with the appropriate Kubernetes infrastructure. - -A key mandate when creating this architecture was to follow the **Open Source Directive as given by the Treasury Board Secretariat (C.2.3.8)** which states that you should try to use open standards and open source software first. Additionally, where possible all functionality should be exposed as services (RESTFul) and leverage microservices via a containerized approach (C2.3.10). - -We will be leveraging a microservices design pattern utilizing immutable and scanned images through containerization running on Kubernetes with a platform that has been built and open sourced by Statistics Canada. While the platform will be discussed briefly to provide context but the bulk of the document discusses how Drupal is installed on top of it. Finally, we are also aligning our Kubernetes platform with the [DevSecOps][devsecops] approach documented by the United States Department of Defense (DoD) as part of their **Platform One** team. - -### Key Criteria - -* Ability to dynamically scale workloads based on custom metrics (CPU / memory) -* Blue-Green, and Canary style deployments -* Design networks to be compliant with ITSG-22 -* Automated CIS Benchmarks for both Docker + Kubernetes -* Facilitate a managed Drupal service model -* Creation of both a Concept of Operations and Security Control Profile - -## Kubernetes - -> The base of the platform - Kubernetes is the first graduate of the [CNCF][CNCF] (Cloud Native Computing Foundation). - -Kubernetes orchestrates the computing, networking, and storage infrastructure on behalf of user workloads. It assigns workloads and resources to a series of nearly identically-configured machines. - -Kukbernetes supports worloads running anywhere, from IoT devices, to private cloud and all the way to public cloud. This is possible due to Kubernetes' pluggable architecture, which defines interfaces that are then implemented for the different environments. Kubernetes provides an Infrastructure as Code environment defined through declarative configuration. Because Kubernetes abastracts away the implementation of the computing environment, application dependencies such as storage, networking, etc., applications do not have to concern themselves with these differences. - -Kubernetes is backed by a huge (tens ouf thousands) and vibrant growing community, consisting of end users, business, vendors and large cloud providers. - -### Key Points - -The Statistics Canada architecture brings many benefits to the Government of Canada: - -* Support for hybrid workloads (Linux and Windows), deployed using the same methodology -* Abstraction of underlying hardware ("cattle rather than pets") enabling an automated, highly-available and scaleable infrastructure for microservices -* Declarative configuration enabling Infrastructure as Code allowing for deployment automation, reproducibility and re-use -* Constructs to support advanced deployment patterns (blue/green, canary, etc.) enabling zero-downtime deployments -* Platform-level tools for traffic handling (routing, error recovery, encyption, etc.), monitoring, observability and logging, secrets management; avoiding duplication across applications in the environment - -Kubernetes is supported across all cloud service providers (fully managed and self managed), preventing vendor lock-in. Managed offerings are available from Google, IBM, Azure, Digital Ocean, Amazon, Oracle and more. The choice whether to roll your own, using a managed service or a Platform as a Service (PAaS offering) is up to the organization to decide based on their requirements and risks. The Statistics Canada platform stays as close to Open Source version and tools as possible in order to remain compatible with the different Kubernetes offerings (raw, managed, platform, etc.). Other offerings, such as OpenShift, Pivotal and VMWare PKS, are more opiniated in hwo to use them, provinding more guard rails and being more locked down out of the box. - -### Government - -Kubernetes is being actively investigated and/or used by many departments across the Government of Canada. Departments are starting to collaborate more and work together towards a common, well-vetted solution and this is why we have have Open Sourced our platform on the GC Accelerators hoping to foster this collaboration and form a community of practice. - -Provided below is the Terraform (Infrastructure as Code) necessarily to install the Azure Kubernetes Service Infrastructure as well as configure with optional platform components (RBAC, Service Mesh, Policies, etc). - -* **Terraform for Kubernetes Infrastructure**: [https://github.com/canada-ca-terraform-modules/terraform-kubernetes-aks][aks] -* **Terraform for Kubernetes Platform**: [https://github.com/canada-ca-terraform-modules/terraform-kubernetes-aks-platform][aks-platform] - -To highlight that this solution can run on any cloud service provider, we are currently working on support for the IBM Kubernetes Services: - -* **Terraform for Kubernetes Infrastructure**: [https://github.com/canada-ca-terraform-modules/terraform-kubernetes-iks][iks] -* **Terraform for Kubernetes Platform**: [https://github.com/canada-ca-terraform-modules/terraform-kubernetes-iks-platform][iks-platform] - -IBM's managed Kubernetes offering is entirely managed, reducing operational requirements. This is similar to Google Cloud Run, and is where other other cloud providers (such as Azure) is moving towards. - -#### Statistics Canada - -Statistics Canada leverages Kubernetes currently on the Azure Kubernetes Managed Service for the bulk of its platform services and all net new applications are first considered whether they can run on our managed cloud native platform. - -Statistics Canada is looking at levearing Kubernetes for a majority of its workloads. The platform that we are sharing was initially developed at Statistics Canada, and enables a quick onboarding of new development teams, reduced application scope via platform-level pluggable services such as: - -* **Artifactory/X-Ray**: Providing package management and CVE vulnerability scanning -* **Istio**: Service mesh, providing better traffic management and observability, as well as automatic mutually-verified TLS encryption -* **Elastic**: Provides both cluster-level and application-level log aggregation and searching -* **Prometheus/Grafana**: Provides real-time cluster and application metrics -* **Velero**: Provides Kubernetes state and data backups -* **Hashicorp Vault**: Provides static and dynamic secret management -* **Cert-manager**: Using Let's Encrypt, providing automatic certificate issuance and renewal -* **Open Policy Agent**: Provides enforcement of defined policies (for example, using images from authorized sources only) - -#### Others - -Many others across the Government of Canada, municipalities and internal Government agencies are actively and/or investigating Kubernetes. This includes Shared Services Canada (SSC) through their investigation into a managed cloud platform powered by OpenShift (Kubernetes) for use by other departments. The Communication Security Establishment (CSE) is leveraging Kubernetes in their on-premise computing environment, running cloud native technologies in a restricted environment. - -To highlight a few more: - -* The City of Montreal -* The City of Ottawa -* UK Home Office - -#### United States Air Force - -The United States Department of Defense (DoD) has Open Sourced all the documentation associated with their modernization initiative for the operation and deployment of infrastructure and applications in environments of all data classifications. The work of the DoD is not limited to just the technology but also the culture changes their undertook to move to a DevSecOps model. The "Platform One" team is responsible for the Cloud One platform and supporting the business and weapon systems. - -The DoD was looking to avoid vendor lock-in and empower development teams and enable application deployment into secure environments at a rapid pace. They have defined requirements that enable flexibility while maintaining a strict security posture through their "hardening" process. Their Cloud One system is based on Kubernetes, Istio, and other Cloud Native Computing Foundation technologies, aligning with the decisions made by Statistics Canada in the development of their architecture. - -Lead by the Chief Software Officer, a combination of both Microsoft and Amazon Web Services’ cloud platforms has allowed the Air Force to operate at heightened speeds, providing access to cloud capabilities to airmen within days to enable software development on the cloud or leveraging artificial intelligence (AI). - -Shared Services Canada and the Royal Canadian Mounted Police are in active talks with the DoD to better understand their environment. - -### Enterprises - -Kubernetes' use extends beyond the government and is used by many large and small organizations. At the hyperscale level, we have Google, GitHub, Reddit, Shopify using Kubernetes. In research and data science, organizations such as CERN use Kubernetes for analyzing data from the Large Hadron Collider. Additionally, large regulated organizations in the financial industry are also embracing Kubernetes, such Bloomberg, Capital One, MasterCard and American Express. Finally, Kubernetes and cloud native is playing role in the rollout of 5G technologies around the world, such as the large contract with AT&T. - -## Drupal WxT on Kubernetes - -![WxT](wxt.png "Drupal WxT") - -A managed Drupal Platform as a Service is a strong candidate to take advantage of what the Statistics Canada platform offers. The design enables a quick onboarding of new workloads through the repeatabile deployment methodology provided by Kubernetes. - -### Components - -The components are individually described below. - -#### Kubernetes - -**Recommendation:** [Kubernetes][kubernetes] - -* [Helm Chart for Drupal WxT][helm-drupal] - -Kubernetes is the basis of the Drupal platform and was further discussed above. - -The whole Drupal application stack can be easily installed in a distributed fashion in minutes using our Helm chart, The chart facilitates a managed service workflow (rolling updates, cronjobs, health checks, auto-scaling, etc.) without user intervention. - -#### Ingress controller - -**Recommendation:** [Istio][istio] - -The ingress controller is responsible for accepting external HTTPS connections and routing them to backend applications based on configuration defined in Kubernetes Ingress objects. Routing can be done by domain and/or path. - -#### Varnish - -**Recommendation:** [Varnish][varnish] - -Varnish is a highly customizable reverse proxy cache. This will aid in supporting a large number of concurrent visitors as the final rendered pages can be served from cache. Varnish is only required on the public environment and is not used in the content staging environment. - -Nginx can technically address some of the cache requirements needed, however the open source version does not support purging selective pages. We need to clear caches based on content being updated / saved which Varnish supports along with the Expire Drupal module quite readily - -#### Nginx - -**Recommendation:** [Nginx][nginx] - -Nginx is an open source web server that can also be used a reverse proxy, HTTP cache, and load balancer. Due to its root in performance optimization under scale, Nginx often outperforms similarly popular web servers and is built to offer low memory usage, and high concurrency. - -> **Note**: It should be noted that Nginx in this model addresses the cache requirements that are needed in Drupal. - -#### Web (PHP-FPM) - -**Recommendation:** [PHP-FPM][php-fpm] - -Drupal runs in the PHP runtime environment. PHP-FPM is the process manager organized as a master process managing pools of individual worker processes. Its architecture shares design similarities with event-driven web servers such as Nginx and allows for PHP scripts to use as much of the server's available resources as necessary without additional overhead that comes from running them inside of web server processes. - -The PHP-FPM master process dynamically creates and terminates worker processes (within configurable limits) as traffic to PHP scripts increases and decreases. Processing scripts in this way allows for much higher processing performance, improved security, and better stability. The primary performance benefits from using PHP-FPM are more efficient PHP handling and ability to use opcode caching. - -### Redis - -**Recommendation:** [Redis][redis] - -Redis is an advanced key-value cache and store. - -It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets, sorted sets, bitmaps, etc. - -Redis is particularly useful when using cloud managed databases to limit the overall database load and to make performance more consistent. - -#### Database - -**Recommendation:** [MySQL][mysql] or [PostgreSQL][postgresql] - -* [Terraform for MySQL Database][terraform-mysql] -* [Terraform for PostgreSQL Database][terraform-postgresql] - -Drupal maintains its state in a database and while supports several types only MySQL or PostgreSQL should be considered. Personally, we highly recommend PostgreSQL based on the experience we had building / launching quite a few Drupal sites in the cloud with it. However both run quite well with minimal operational concerns. Additionally the Helm Chart supports connection pooling using either [ProxySQL][proxysql] and / or [PGBouncer][pgbouncer] depending on the database used. - -* [ProxySQL][proxysql] -* [PGBouncer][pgbouncer] - -> Our recommendation would be to use a managed database offering from the cloud providers for a production environment. Coupled with a managed file service, this removes all stateful components from the cluster enabling the best application experience possible. - -#### Stateful Assets - -Drupal stores generated CSS/JS assets and uploaded content (images, videos, etc.) in a file storage. As the architecture is designed to be distributed, this present some design considerations for us. - -##### Azure Files (CIFS / NFS) - -Fully managed file shares in the cloud that are accessible via Server Message Block (SMB) protocol (also known as Common Internet File System or CIFS). Support is provided for dynamically creating and using a persistent volume with Azure Files in the Azure Kubernetes Service. - -For more information on Azure Files, please see [Azure Files for applications in AKS][azure-files]. - -> **Note**: This is currently our recommended choice as it results in a simpler installation in Azure then relying on an S3 compatible object store discussed below. Similar storage solutions exist with the other cloud providers. - -### Installation Profile - -[https://github.com/drupalwxt/wxt] - -Installation profiles provide site features and functions for a specific type of site as a single download containing Drupal core, contributed modules, themes, and predefined configuration. They make it possible to quickly set up a complex, use-specific site. - -Note: The `WxT` installation profile is very light and only adds the `GCWeb` theme and WxT related plugin support. - -### Composer Project - -Project for managing your dependencies via a Composer workflow. - -[https://github.com/drupalwxt/site-wxt][site-wxt] - -### Continuous Integration - -Currently we are running all of our CI builds using GitHub Actions but can be easily switched to any of the other options such as GitLab CI, Azure DevOps, Jenkins, etc. - -* [https://github.com/drupalwxt/wxt/actions][github-wxt] -* [https://github.com/drupalwxt/site-wxt/actions][github-site-wxt] - -> **Note**: We are currently moving our CI builds from Travis CI to run on GitHub Actions. - -### Docker Registry - -[https://hub.docker.com/r/drupalwxt/site-wxt][docker] - -Currently we are storing all of our containers in Docker Hub. - -These containers are also stored and scanned against Statistics Canada's internal docker registry namely [Artifactory][jfrog-artifactory] which coupled with [XRay][jfrog-xray] scans all of our containers against the known CVE's in the wild. Shoud any critical vulnerability be found we ensure that our public containers stored in Docker Hub recieve these fixes / mitigations as well. - -## Connecting To Other Services - -Drupal is built to be API first and with its rich data model is able to integrate with innumerable other services whether using API’s (JsonAPI, GraphQL), direction connections, and / or legacy methods (SOAP). - -### Solr - -Using the SearchAPI module in Drupal we can index content in a variety of search platforms with particular attention focused on either Solr. The Drupal WxT Helm Chart provides integration with the [Solr Operator](solr-operator). - -### Decoupled Approach (Vue.js, React, Angular) - -An increasing trend in Drupal websites is the move to a more progressively enhanced, decoupled approach. Leveraging Drupal’s entity api front-end JavaScript frameworks can perform the rendering whether the whole page or even a single component on the page. - -## Resources - -Here are some resources that we recommend should you wish to further explore Kubernetes, Cloud Native and DevSecOps principals. - -* [Cloud Native Platform for Government][govcloud] -* [United States Department of Defense][devsecops] -* [Digital Academy Course on Cloud Native Development][youtube-digican] - - - -[aks]: https://github.com/canada-ca-terraform-modules/terraform-kubernetes-aks -[aks-platform]: https://github.com/canada-ca-terraform-modules/terraform-kubernetes-aks-platform -[architectual-diagram]: https://github.com/drupalwxt/helm-drupal/blob/master/docs/diagram-drupal.pdf -[azure-files]: https://docs.microsoft.com/en-us/azure/aks/azure-files-dynamic-pv -[cncf]: https://www.cncf.io -[devsecops]: https://software.af.mil/dsop/documents/ -[docker]: https://hub.docker.com/r/drupalwxt/site-wxt -[drupal]: https://github.com/drupalwxt/wxt -[iks]: https://github.com/canada-ca-terraform-modules/terraform-kubernetes-iks -[iks-platform]: https://github.com/canada-ca-terraform-modules/terraform-kubernetes-iks-platform -[jfrog-artifactory]: https://jfrog.com/artifactory -[jfrog-xray]: https://jfrog.com/xray -[govcloud]: https://govcloud.ca -[istio]: https://istio.io/docs/tasks/traffic-management/ingress/ingress-control -[github-wxt]: https://github.com/drupalwxt/wxt/actions -[github-site-wxt]: https://github.com/drupalwxt/site-wxt/actions -[helm-drupal]: https://github.com/drupalwxt/helm-drupal -[kubernetes]: https://kubernetes.io -[minio]: https://www.minio.io -[mysql]: https://www.mysql.com -[nginx]: https://www.nginx.com -[pgbouncer]: https://www.pgbouncer.org -[php-fpm]: https://php-fpm.org -[postgresql]: https://www.postgresql.org -[proxysql]: https://proxysql.com -[redis]: https://redis.io -[site-wxt]: https://github.com/drupalwxt/site-wxt -[solr-operator]: https://github.com/apache/solr-operator -[terraform-mysql]: https://github.com/canada-ca-terraform-modules/terraform-azurerm-mysql -[terraform-postgresql]: https://github.com/canada-ca-terraform-modules/terraform-azurerm-postgresql -[varnish]: https://varnish-cache.org -[wxt]: https://github.com/drupalwxt/wxt -[youtube-digican]: https://www.youtube.com/watch?v=QvMWls8OdmM diff --git a/test/config.yaml b/test/config.yaml index fda2799d..6a4ed924 100644 --- a/test/config.yaml +++ b/test/config.yaml @@ -3,8 +3,9 @@ chart-dirs: - . chart-repos: - bitnami=https://charts.bitnami.com/bitnami - - helm=https://charts.helm.sh/stable - drupal=https://drupalwxt.github.io/helm-drupal + - solr=https://solr.apache.org/charts + - valkey=https://valkey-io.github.io/valkey-helm check-version-increment: true validate-maintainers: false excluded-charts: diff --git a/test/lint.sh b/test/lint.sh index 68b57ffa..02415cea 100755 --- a/test/lint.sh +++ b/test/lint.sh @@ -3,7 +3,7 @@ set -euxo pipefail CHARTS="$@" -CHART_TESTING_VERSION="3.7.0" +CHART_TESTING_VERSION="3.14.0" if [ -z "$CHARTS" ]; then CHARTS="--all"