feat: chart Helm parent lions-app v1.0.0 — templates hardened (secretKeyRef, readOnlyRootFS, NetworkPolicy, ExternalSecret, PDB, SM, HPA)

templates/NOTES.txt

@@ -0,0 +1,36 @@
+Application {{ include "lions-app.name" . }} déployée sur Lions ({{ .Release.Namespace }}).
+
+1. Vérifier le rollout :
+   kubectl rollout status deployment/{{ include "lions-app.name" . }} -n {{ .Release.Namespace }}
+
+2. Vérifier les pods :
+   kubectl get pods -n {{ .Release.Namespace }} -l app={{ include "lions-app.name" . }}
+
+3. Health check :
+{{- if .Values.ingress.enabled }}
+   curl -sk https://{{ .Values.ingress.host }}{{ .Values.probes.readiness.httpGet.path | default "/q/health/ready" }}
+{{- else }}
+   kubectl port-forward -n {{ .Release.Namespace }} svc/{{ include "lions-app.name" . }} 8080:{{ .Values.service.port }}
+   curl -s http://localhost:8080{{ .Values.probes.readiness.httpGet.path | default "/q/health/ready" }}
+{{- end }}
+
+4. Logs :
+   kubectl logs -n {{ .Release.Namespace }} -l app={{ include "lions-app.name" . }} --tail=100 -f
+
+{{- if .Values.externalSecret.enabled }}
+
+5. Vérifier que les secrets Vault sont synchronisés :
+   kubectl get externalsecret -n {{ .Release.Namespace }} {{ include "lions-app.name" . }}
+   kubectl get secret -n {{ .Release.Namespace }} {{ include "lions-app.secretName" . }}
+{{- end }}
+
+{{- if .Values.hpa.enabled }}
+
+6. Vérifier l'HPA :
+   kubectl get hpa -n {{ .Release.Namespace }} {{ include "lions-app.name" . }}
+{{- end }}
+
+Image déployée : {{ include "lions-app.image" . }}
+{{- if .Values.ingress.enabled }}
+URL d'accès   : https://{{ .Values.ingress.host }}{{ .Values.ingress.path }}
+{{- end }}

templates/_helpers.tpl

@@ -0,0 +1,98 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/*
+Nom de l'app = nom du release Helm.
+Pattern DGBF : tout est nommé pareil (Deployment, Service, Ingress, ConfigMap…).
+*/}}
+{{- define "lions-app.name" -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Chart fullname = name + chart version (pour helm.sh/chart label).
+*/}}
+{{- define "lions-app.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels — appliqués sur TOUTES les ressources.
+Conformes aux recommendations Kubernetes (app.kubernetes.io/*).
+*/}}
+{{- define "lions-app.labels" -}}
+app.kubernetes.io/name: {{ include "lions-app.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/part-of: lions-infrastructure
+helm.sh/chart: {{ include "lions-app.chart" . }}
+project: lions-infrastructure-2025
+{{- with .Values.commonLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- end -}}
+
+{{/*
+Selector labels — stables (ne changent jamais), utilisés par Service et Deployment.
+"app" est gardé pour compatibilité avec les legacy deployments Lions.
+*/}}
+{{- define "lions-app.selectorLabels" -}}
+app: {{ include "lions-app.name" . }}
+app.kubernetes.io/name: {{ include "lions-app.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Image reference complète : registry/repo/name:tag
+*/}}
+{{- define "lions-app.image" -}}
+{{- $registry := .Values.image.registry | default "registry.lions.dev" -}}
+{{- $repo := .Values.image.repository | default "lionsdev" -}}
+{{- $name := .Values.image.name | default (include "lions-app.name" .) -}}
+{{- $tag := .Values.image.tag | default .Chart.AppVersion -}}
+{{- printf "%s/%s/%s:%s" $registry $repo $name $tag -}}
+{{- end -}}
+
+{{/*
+Nom du ServiceAccount.
+*/}}
+{{- define "lions-app.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+{{- .Values.serviceAccount.name | default (include "lions-app.name" .) -}}
+{{- else -}}
+{{- .Values.serviceAccount.name | default "default" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Nom du K8s Secret cible de l'ExternalSecret.
+*/}}
+{{- define "lions-app.secretName" -}}
+{{- include "lions-app.name" . -}}-secrets
+{{- end -}}
+
+{{/*
+Nom du TLS secret de l'Ingress.
+*/}}
+{{- define "lions-app.tlsSecretName" -}}
+{{- include "lions-app.name" . -}}-tls
+{{- end -}}
+
+{{/*
+Path de l'Ingress selon le mode (simple ou prefix-strip).
+*/}}
+{{- define "lions-app.ingressPath" -}}
+{{- if .Values.ingress.pathPrefix.enabled -}}
+{{- printf "%s(/|$)(.*)" .Values.ingress.pathPrefix.strip -}}
+{{- else -}}
+{{- .Values.ingress.path | default "/" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "lions-app.ingressPathType" -}}
+{{- if .Values.ingress.pathPrefix.enabled -}}
+ImplementationSpecific
+{{- else -}}
+{{- .Values.ingress.pathType | default "Prefix" -}}
+{{- end -}}
+{{- end -}}

templates/configmap.yaml

@@ -0,0 +1,13 @@
+{{- if and .Values.configMap.enabled (or .Values.configMap.data (gt (len (keys .Values.configMap.data)) 0)) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "lions-app.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+data:
+  {{- range $key, $val := .Values.configMap.data }}
+  {{ $key }}: {{ $val | quote }}
+  {{- end }}
+{{- end }}

templates/deployment.yaml

@@ -0,0 +1,132 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "lions-app.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+  {{- with .Values.commonAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  strategy:
+    {{- toYaml .Values.strategy | nindent 4 }}
+  selector:
+    matchLabels:
+      {{- include "lions-app.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "lions-app.selectorLabels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      annotations:
+        {{- if .Values.configMap.enabled }}
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if .Values.externalSecret.enabled }}
+        checksum/externalsecret: {{ include (print $.Template.BasePath "/externalsecret.yaml") . | sha256sum }}
+        {{- end }}
+        {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      serviceAccountName: {{ include "lions-app.serviceAccountName" . }}
+      automountServiceAccountToken: false
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.image.pullSecrets }}
+      imagePullSecrets:
+        {{- range . }}
+        - name: {{ . }}
+        {{- end }}
+      {{- end }}
+      containers:
+        - name: {{ include "lions-app.name" . }}
+          image: {{ include "lions-app.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          securityContext:
+            {{- toYaml .Values.containerSecurityContext | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.container.port }}
+              protocol: TCP
+          {{- with .Values.container.extraArgs }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if or .Values.env .Values.container.extraEnv }}
+          env:
+            {{- with .Values.env }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+            {{- with .Values.container.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+          {{- end }}
+          {{- if or (and .Values.configMap.enabled .Values.configMap.envFrom (gt (len (keys .Values.configMap.data)) 0)) .Values.externalSecret.enabled }}
+          envFrom:
+            {{- if and .Values.configMap.enabled .Values.configMap.envFrom (gt (len (keys .Values.configMap.data)) 0) }}
+            - configMapRef:
+                name: {{ include "lions-app.name" . }}
+            {{- end }}
+            {{- if .Values.externalSecret.enabled }}
+            - secretRef:
+                name: {{ include "lions-app.secretName" . }}
+            {{- end }}
+          {{- end }}
+          {{- if .Values.probes.startup.enabled }}
+          startupProbe:
+            {{- omit .Values.probes.startup "enabled" | toYaml | nindent 12 }}
+          {{- end }}
+          {{- if .Values.probes.liveness.enabled }}
+          livenessProbe:
+            {{- omit .Values.probes.liveness "enabled" | toYaml | nindent 12 }}
+          {{- end }}
+          {{- if .Values.probes.readiness.enabled }}
+          readinessProbe:
+            {{- omit .Values.probes.readiness "enabled" | toYaml | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            {{- if .Values.volumes.tmp.enabled }}
+            - name: tmp
+              mountPath: /tmp
+            {{- end }}
+            {{- if .Values.volumes.logs.enabled }}
+            - name: logs
+              mountPath: {{ .Values.volumes.logs.mountPath | default "/app/logs" }}
+            {{- end }}
+            {{- with .Values.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+      volumes:
+        {{- if .Values.volumes.tmp.enabled }}
+        - name: tmp
+          emptyDir:
+            sizeLimit: {{ .Values.volumes.tmp.sizeLimit | default "100Mi" }}
+        {{- end }}
+        {{- if .Values.volumes.logs.enabled }}
+        - name: logs
+          emptyDir:
+            sizeLimit: {{ .Values.volumes.logs.sizeLimit | default "500Mi" }}
+        {{- end }}
+        {{- with .Values.volumes.extra }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

templates/externalsecret.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.externalSecret.enabled }}
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: {{ include "lions-app.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+spec:
+  refreshInterval: {{ .Values.externalSecret.refreshInterval | default "1h" }}
+  secretStoreRef:
+    kind: {{ .Values.externalSecret.secretStoreRef.kind }}
+    name: {{ .Values.externalSecret.secretStoreRef.name }}
+  target:
+    name: {{ include "lions-app.secretName" . }}
+    creationPolicy: {{ .Values.externalSecret.target.creationPolicy | default "Owner" }}
+    deletionPolicy: {{ .Values.externalSecret.target.deletionPolicy | default "Retain" }}
+  data:
+    {{- range .Values.externalSecret.data }}
+    - secretKey: {{ .secretKey }}
+      remoteRef:
+        key: {{ .remoteRef.key }}
+        property: {{ .remoteRef.property }}
+        {{- if .remoteRef.conversionStrategy }}
+        conversionStrategy: {{ .remoteRef.conversionStrategy }}
+        {{- end }}
+    {{- end }}
+{{- end }}

templates/hpa.yaml

@@ -0,0 +1,46 @@
+{{- if .Values.hpa.enabled }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "lions-app.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "lions-app.name" . }}
+  minReplicas: {{ .Values.hpa.minReplicas | default 1 }}
+  maxReplicas: {{ .Values.hpa.maxReplicas | default 3 }}
+  metrics:
+    {{- if .Values.hpa.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.hpa.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.hpa.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.hpa.targetMemoryUtilizationPercentage }}
+    {{- end }}
+  behavior:
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Percent
+          value: 10
+          periodSeconds: 60
+    scaleUp:
+      stabilizationWindowSeconds: 30
+      policies:
+        - type: Percent
+          value: 50
+          periodSeconds: 30
+{{- end }}

templates/ingress.yaml

@@ -0,0 +1,49 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "lions-app.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+  annotations:
+    # cert-manager
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer | quote }}
+    {{- if .Values.ingress.pathPrefix.enabled }}
+    # Mode prefix-strip : le path /prefix(/|$)(.*) est rewrité en /$2
+    nginx.ingress.kubernetes.io/use-regex: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    {{- end }}
+    {{- if .Values.ingress.rateLimit.enabled }}
+    nginx.ingress.kubernetes.io/limit-rpm: {{ .Values.ingress.rateLimit.rpm | default 1000 | quote }}
+    nginx.ingress.kubernetes.io/limit-connections: {{ .Values.ingress.rateLimit.connections | default 100 | quote }}
+    {{- end }}
+    {{- if .Values.ingress.cors.enabled }}
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/cors-allow-origin: {{ .Values.ingress.cors.origins | quote }}
+    nginx.ingress.kubernetes.io/cors-allow-methods: {{ .Values.ingress.cors.methods | quote }}
+    nginx.ingress.kubernetes.io/cors-allow-headers: {{ .Values.ingress.cors.headers | quote }}
+    {{- end }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className | default "nginx" }}
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host | quote }}
+      secretName: {{ .Values.ingress.tls.secretName | default (include "lions-app.tlsSecretName" .) }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.host | quote }}
+      http:
+        paths:
+          - path: {{ include "lions-app.ingressPath" . }}
+            pathType: {{ include "lions-app.ingressPathType" . }}
+            backend:
+              service:
+                name: {{ include "lions-app.name" . }}
+                port:
+                  number: {{ .Values.service.port }}
+{{- end }}

templates/networkpolicy.yaml

@@ -0,0 +1,79 @@
+{{- if .Values.networkPolicy.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "lions-app.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "lions-app.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Ingress depuis les namespaces autorisés
+    {{- range .Values.networkPolicy.allowIngressFrom }}
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              {{- toYaml .namespaceSelector | nindent 14 }}
+      {{- with .ports }}
+      ports:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
+    # Ingress depuis pods du même namespace (pour communication intra-ns)
+    - from:
+        - podSelector: {}
+  egress:
+    # DNS (CoreDNS dans kube-system)
+    {{- if .Values.networkPolicy.allowEgressDNS }}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    {{- end }}
+    # K8s API (nécessaire si l'app utilise l'API via ServiceAccount)
+    {{- if .Values.networkPolicy.allowEgressKubeAPI }}
+    - to:
+        - ipBlock:
+            cidr: 10.96.0.0/12   # service CIDR
+      ports:
+        - port: 443
+          protocol: TCP
+        - port: 6443
+          protocol: TCP
+    {{- end }}
+    # Egress spécifique de l'app (Postgres, Keycloak, Kafka, etc.)
+    {{- range .Values.networkPolicy.allowEgressTo }}
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              {{- toYaml .namespaceSelector | nindent 14 }}
+      {{- with .ports }}
+      ports:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
+    # Sortie HTTPS vers Internet (Let's Encrypt ACME, external APIs)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              - 10.0.0.0/8
+              - 172.16.0.0/12
+              - 192.168.0.0/16
+      ports:
+        - port: 443
+          protocol: TCP
+        - port: 80
+          protocol: TCP
+{{- end }}

templates/pdb.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.pdb.enabled (gt (int .Values.replicaCount) 1) }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "lions-app.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.pdb.minAvailable }}
+  minAvailable: {{ .Values.pdb.minAvailable }}
+  {{- else if .Values.pdb.maxUnavailable }}
+  maxUnavailable: {{ .Values.pdb.maxUnavailable }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "lions-app.selectorLabels" . | nindent 6 }}
+{{- end }}

templates/service.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "lions-app.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+  {{- with .Values.service.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.targetPort }}
+      protocol: {{ .Values.service.protocol }}
+  selector:
+    {{- include "lions-app.selectorLabels" . | nindent 4 }}

templates/serviceaccount.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "lions-app.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: false
+{{- end }}

templates/servicemonitor.yaml

@@ -0,0 +1,25 @@
+{{- if .Values.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "lions-app.name" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lions-app.labels" . | nindent 4 }}
+    {{- with .Values.serviceMonitor.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  endpoints:
+    - port: http
+      path: {{ .Values.serviceMonitor.path | default "/q/metrics" }}
+      interval: {{ .Values.serviceMonitor.interval | default "30s" }}
+      scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout | default "10s" }}
+      scheme: http
+  selector:
+    matchLabels:
+      {{- include "lions-app.selectorLabels" . | nindent 6 }}
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+{{- end }}