✨(helm) add feature environment for review apps

.github/workflows/docker-hub.yml

@@ -14,7 +14,7 @@ on:
 
 env:
   DOCKER_USER: 1001:127
-  SHOULD_PUSH: ${{ github.event_name != 'pull_request' }}
+  SHOULD_PUSH: ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'preview') }}
 
 jobs:
   build-and-push-backend:
@@ -101,7 +101,7 @@ jobs:
       - build-and-push-frontend
       - build-and-push-backend
     runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'preview')
     steps:
       - uses: numerique-gouv/action-argocd-webhook-notification@main
         id: notify

.github/workflows/label_preview.yml

@@ -0,0 +1,27 @@
+name: Label Preview
+
+on:
+  pull_request:
+    types: [labeled, opened]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+    if: contains(github.event.pull_request.labels.*.name, 'preview')
+    steps:
+      - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3
+        with:
+          message: |
+            :rocket: Preview will be available at [https://${{ github.event.pull_request.number }}-drive.ppr-fichiers.beta.numerique.gouv.fr/](https://${{ github.event.pull_request.number }}-drive.ppr-fichiers.beta.numerique.gouv.fr/)
+
+            You can use the existing account with these credentials:
+            - username: `drive`
+            - password: `drive`
+
+            You can also create a new account if you want to.
+
+            Once this Pull Request is merged, the preview will be destroyed.
+          comment-tag: preview-url

src/helm/env.d/dev/values.dev-backend.yaml.gotmpl

@@ -0,0 +1,105 @@
+postgres:
+  enabled: true
+  name: postgres
+  #serviceNameOverride: postgres
+  image: postgres:16-alpine
+  username: dinum
+  password: pass
+  database: dinum
+  size: 1Gi
+redis:
+  enabled: true
+  name: redis
+  #serviceNameOverride: redis
+  image: redis:8.2-alpine
+  username: user
+  password: pass
+minio:
+  enabled: true
+  image: minio/minio
+  name: minio
+  # serviceNameOverride: drive-minio
+  ingress:
+    enabled: true
+    hostname: drive-minio.127.0.0.1.nip.io
+    tls:
+      enabled: true
+      secretName: drive-tls
+  consoleIngress:
+    enabled: true
+    hostname: drive-minio-console.127.0.0.1.nip.io
+    tls:
+      enabled: true
+      secretName: drive-tls
+  api:
+    port: 80
+  username: dinum
+  password: password
+  bucket: drive-media-storage
+  versioning: true
+  size: 1Gi
+keycloak:
+  enabled: true
+  image: quay.io/keycloak/keycloak:20.0.1
+  name: keycloak
+  #serviceNameOverride: keycloak
+  hostname: drive-keycloak.127.0.0.1.nip.io
+  username: admin
+  password: pass
+  tls:
+    enabled: true
+    secretName: drive-tls
+  db:
+    username: dinum
+    password: pass
+    database: keycloak
+    size: 1Gi
+    image: postgres:16-alpine
+  realm:
+    name: drive
+    username: drive
+    password: drive
+    email: drive@example.com
+dsproxy:
+  enabled: false
+  aws_url: https://drive-minio.127.0.0.1.nip.io
+  image: demarchenumerique/ds-proxy:v2.0.0-alpha.2
+  command:
+    - /bin/sh
+    - "-c"
+    - |
+      /dsproxy/ds_proxy proxy --address=0.0.0.0:4444 --verify-ssl-certificate=false --password-file /etc/dsproxy/PASSWORD \
+      --salt "$SALT" --keyring-file /etc/dsproxy/keyring.toml --upstream-url ${AWS_URL} \
+      --local-encryption-directory /var/tmp/local_encryption/ --s3-access-key ${AWS_ACCESS_KEY} \
+      --s3-secret-key ${AWS_SECRET_KEY} --s3-region ${AWS_REGION}
+    # Extra volume mounts to manage our local custom CA and avoid to set ssl_verify: false
+  ingress:
+    enabled: true
+    hostname: drive-dsproxy.127.0.0.1.nip.io
+    tls:
+      enabled: true
+  localSecret:
+    enabled: true
+  envVars:
+    RUST_LOG: debug,ds_proxy::http::handlers::fetch=trace,ds_proxy::http::handlers::forward=trace,ds_proxy::config=trace
+    RUST_BACKTRACE: full
+    SALT:
+      secretKeyRef:
+        name: dev-backend-dsproxy
+        key: SALT
+    AWS_ACCESS_KEY:
+      secretKeyRef:
+        name: dev-backend-dsproxy
+        key: AWS_ACCESS_KEY
+    AWS_SECRET_KEY:
+      secretKeyRef:
+        name: dev-backend-dsproxy
+        key: AWS_SECRET_KEY
+    AWS_URL:
+      secretKeyRef:
+        name: dev-backend-dsproxy
+        key: AWS_URL
+    AWS_REGION:
+      secretKeyRef:
+        name: dev-backend-dsproxy
+        key: AWS_REGION

src/helm/env.d/feature/values.dev-backend.yaml.gotmpl

@@ -0,0 +1,63 @@
+postgres:
+  enabled: true
+  name: postgres
+  #serviceNameOverride: postgres
+  image: postgres:16-alpine
+  username: dinum
+  password: pass
+  database: dinum
+  size: 1Gi
+redis:
+  enabled: true
+  name: redis
+  #serviceNameOverride: redis
+  image: redis:8.2-alpine
+  username: user
+  password: pass
+minio:
+  enabled: true
+  image: minio/minio
+  name: minio
+  ingress:
+    enabled: true
+    hostname: {{ .Values.feature }}-drive-minio.{{ .Values.domain }}
+    tls:
+      enabled: true
+      secretName: drive-tls
+  consoleIngress:
+    enabled: true
+    hostname: {{ .Values.feature }}-drive-minio-console.{{ .Values.domain }}
+    tls:
+      enabled: true
+      secretName: drive-tls
+  username: dinum
+  password: password
+  bucket: drive-media-storage
+  versioning: true
+  size: 1Gi
+keycloak:
+  enabled: true
+  image: quay.io/keycloak/keycloak:20.0.1
+  name: keycloak
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+  #serviceNameOverride: keycloak
+  hostname: {{ .Values.feature }}-drive-keycloak.{{ .Values.domain }}
+  username: admin
+  password: pass
+  tls:
+    enabled: true
+    secretName: drive-tls
+  db:
+    username: dinum
+    password: pass
+    database: keycloak
+    size: 1Gi
+    image: postgres:16-alpine
+  realm:
+    name: drive
+    username: drive
+    password: drive
+    email: drive@example.com
+dsproxy:
+  enabled: false