Skip to content

Commit 8adf73d

Browse files
attilaedelenyiattilaedelenyi
committed
Add ArgoCD example and fix ingress varnish backend
1 parent fea1e07 commit 8adf73d

7 files changed

Lines changed: 173 additions & 5 deletions

File tree

‎README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,14 @@ See each chart's README for full configuration reference:
4040
- [`charts/ontoserver-extras/README.md`](charts/ontoserver-extras/README.md)
4141
- [`charts/ontoserver-indexer/README.md`](charts/ontoserver-indexer/README.md) — SNOMED CT and LOINC indexing examples
4242

43+
### ArgoCD Examples
44+
45+
Ready-to-use ArgoCD Application manifests are in [`examples/argocd/`](examples/argocd/):
46+
47+
| File | Description |
48+
|------|-------------|
49+
| [`dev-readonly.yaml`](examples/argocd/dev-readonly.yaml) | Read-only dev/evaluation server — sidecar PostgreSQL, ephemeral storage, Varnish, Envoy Gateway |
50+
4351
### Prerequisites
4452

4553
Depending on features enabled, you may need these cluster components:

‎charts/ontoserver/README.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -459,6 +459,16 @@ kubectl rollout status deployment/my-ontoserver-ontoserver
459459

460460
See [`examples/k3d-traefik-values.yaml`](examples/k3d-traefik-values.yaml) for the complete quick-start values file and [`examples/local-values.yaml`](examples/local-values.yaml) for a general local cluster reference.
461461

462+
### ArgoCD
463+
464+
Ready-to-use ArgoCD Application manifests are in [`examples/argocd/`](../../examples/argocd/) at the root of this repository. Reference them directly from your ArgoCD instance or use them as a starting point.
465+
466+
| File | Description |
467+
|------|-------------|
468+
| [`dev-readonly.yaml`](../../examples/argocd/dev-readonly.yaml) | Read-only dev/evaluation server — sidecar PostgreSQL, ephemeral storage, Varnish, Envoy Gateway |
469+
470+
The ArgoCD examples use multi-source Applications with both the `ontoserver` and `ontoserver-extras` charts as sources, wired together so that enabling Varnish automatically routes the Ingress through it. See the [extras chart README](../../charts/ontoserver-extras/README.md#deploying-alongside-the-ontoserver-chart) for the wiring details.
471+
462472
> **Note:** The GitHub Actions CI integration tests use a similar k3d setup (single agent, no load balancer, Traefik disabled) to run `helm install` followed by `helm test`. See [`.github/workflows/ci.yml`](../.github/workflows/ci.yml) for details.
463473

464474
## Parameters
@@ -584,6 +594,7 @@ See [`examples/k3d-traefik-values.yaml`](examples/k3d-traefik-values.yaml) for t
584594
| `ontoserver.ingress.enabled` | Enable Ingress | `false` |
585595
| `ontoserver.ingress.annotations` | Ingress annotations | `{}` |
586596
| `ontoserver.ingress.className` | IngressClass name | `ontoserver-nginx` |
597+
| `ontoserver.ingress.backendServiceNameOverride` | Override Ingress backend service name (e.g. to route through the Varnish service from ontoserver-extras) | `""` |
587598

588599
### Observability
589600

@@ -748,7 +759,12 @@ By default neither is enabled — the chart deploys Ontoserver with no external
748759
* **Gateway API** (`ontoserver.gateway.enabled: true`) *(recommended)*: requires Gateway API CRDs and a compatible GatewayClass (e.g. [Envoy Gateway](https://gateway.envoyproxy.io/), [Traefik](https://doc.traefik.io/traefik/routing/providers/kubernetes-gateway/), [Cilium](https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/), or any conformant implementation). Creates `Gateway`, `HTTPRoute`, and optionally a cert-manager `Issuer` resource. The default `className` is `envoy-gateway-class` — set `ontoserver.gateway.className` to match your GatewayClass. The default listener port is `443`; some implementations use a different port (e.g. Traefik defaults to `8443` — set `ontoserver.gateway.listenerPortSecure: 8443`). TLS termination is optional: set `ontoserver.tls.enabled: true` with a certificate reference, or enable cert-manager for automatic provisioning.
749760
* **Ingress** (`ontoserver.ingress.enabled: true`): creates a standard `networking.k8s.io/v1` Ingress. Use the bundled F5 nginx-ingress subchart (`nginx-ingress.enabled: true`), the cluster's default controller (e.g. Traefik on k3d/k3s), or any other Ingress controller by setting `ontoserver.ingress.className` appropriately.
750761

751-
Gateway API and Ingress are mutually exclusive. Set `ontoserver.gateway.backendServiceNameOverride` to route traffic through an intermediate proxy (e.g. a Varnish cache) instead of the Ontoserver service directly.
762+
Gateway API and Ingress are mutually exclusive. Both support a `backendServiceNameOverride` to route traffic through an intermediate proxy such as the Varnish cache from `ontoserver-extras`:
763+
764+
- Gateway: `ontoserver.gateway.backendServiceNameOverride: <release>-varnish-service`
765+
- Ingress: `ontoserver.ingress.backendServiceNameOverride: <release>-varnish-service`
766+
767+
See the [extras chart README](../../charts/ontoserver-extras/README.md) for the full wiring instructions, including the recommended ArgoCD multi-source approach.
752768

753769
**Common GatewayClass configuration reference:**
754770

‎charts/ontoserver/templates/ingress.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ spec:
4949
pathType: Prefix
5050
backend:
5151
service:
52-
name: {{ $releaseName }}-ontoserver-service
52+
name: {{ $.Values.ontoserver.ingress.backendServiceNameOverride | default (printf "%s-ontoserver-service" $releaseName) }}
5353
port:
5454
number: 80
5555
{{- end }}

‎charts/ontoserver/tests/networking_test.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,20 @@ tests:
188188
path: spec.rules[0].http.paths[1].path
189189
value: /
190190

191+
- it: Ingress uses backendServiceNameOverride when set
192+
templates:
193+
- templates/ingress.yaml
194+
set:
195+
ontoserver.ingress.enabled: true
196+
ontoserver.hostNames:
197+
- localhost
198+
ontoserver.serverName: localhost
199+
ontoserver.ingress.backendServiceNameOverride: ontoserver-dev-varnish-service
200+
asserts:
201+
- equal:
202+
path: spec.rules[0].http.paths[0].backend.service.name
203+
value: ontoserver-dev-varnish-service
204+
191205
- it: Ingress has no closure path for single StatefulSet
192206
templates:
193207
- templates/ingress.yaml

‎charts/ontoserver/values.schema.json‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -269,9 +269,10 @@
269269
"ingress": {
270270
"type": "object",
271271
"properties": {
272-
"enabled": { "type": "boolean" },
273-
"annotations": { "type": "object" },
274-
"className": { "type": "string" }
272+
"enabled": { "type": "boolean" },
273+
"annotations": { "type": "object" },
274+
"className": { "type": "string" },
275+
"backendServiceNameOverride": { "type": "string" }
275276
}
276277
},
277278
"managementService": {

‎charts/ontoserver/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,8 @@ ontoserver:
242242
annotations: {}
243243
## @param ontoserver.ingress.className IngressClass name
244244
className: ontoserver-nginx
245+
## @param ontoserver.ingress.backendServiceNameOverride Override Ingress backend service name (e.g. to route through the Varnish service from ontoserver-extras)
246+
backendServiceNameOverride: ""
245247
## @section Observability
246248
managementService:
247249
## @param ontoserver.managementService.enabled Enable management service (exposes Spring Boot actuator on port 18080)

‎examples/argocd/dev-readonly.yaml‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# Read-only development server
2+
#
3+
# Topology: Deployment (single) · isReadOnly · sidecar PostgreSQL · ephemeral storage · Varnish cache
4+
#
5+
# Suitable for a development or evaluation instance on any Kubernetes cluster
6+
# (AKS, EKS, GKE, on-prem). Not suitable for production — storage is ephemeral
7+
# so the Lucene index is rebuilt from syndication feeds on every pod restart.
8+
#
9+
# Prerequisites on the cluster:
10+
# - Envoy Gateway installed and a GatewayClass named "envoy-gateway-class"
11+
# https://gateway.envoyproxy.io/docs/install/install-helm/
12+
# - (Optional) cert-manager for automatic TLS certificates
13+
# https://cert-manager.io/docs/installation/
14+
#
15+
# Customise before applying:
16+
# 1. Replace <YOUR-HOSTNAME> with your actual DNS name (e.g. ontoserver-dev.example.com)
17+
# 2. Set quay.io credentials — either inline (not recommended for production)
18+
# or via a pre-created pull secret and ontoserver.deployment.imagePullSecrets
19+
# 3. Uncomment the syndication subscription block and point it at your feed
20+
# 4. Uncomment the TLS / cert-manager block if you want HTTPS
21+
#
22+
# Apply to your ArgoCD instance:
23+
# kubectl apply -f dev-readonly.yaml -n argocd
24+
25+
apiVersion: argoproj.io/v1alpha1
26+
kind: Application
27+
metadata:
28+
name: ontoserver-dev
29+
namespace: argocd
30+
finalizers:
31+
- resources-finalizer.argocd.argoproj.io
32+
spec:
33+
project: default
34+
destination:
35+
server: https://kubernetes.default.svc
36+
namespace: ontoserver-dev
37+
sources:
38+
# ── ontoserver ─────────────────────────────────────────────────────────────
39+
- repoURL: https://github.com/aehrc/ontoserver-deploy
40+
targetRevision: HEAD
41+
path: charts/ontoserver
42+
helm:
43+
valuesObject:
44+
ontoserver:
45+
deployment:
46+
kind: Deployment
47+
type: single
48+
isReadOnly: true
49+
replicas: 1
50+
db:
51+
enabled: true # sidecar PostgreSQL — no external database needed
52+
53+
imageCredentials:
54+
username: your-quay-username
55+
password: your-quay-password
56+
57+
serverName: <YOUR-HOSTNAME>
58+
hostNames:
59+
- <YOUR-HOSTNAME>
60+
61+
timeZone: Australia/Brisbane
62+
language: en_AU
63+
64+
resources:
65+
ontoserver:
66+
requests:
67+
cpu: "500m"
68+
memory: "2Gi"
69+
limits:
70+
cpu: "2000m"
71+
memory: "4Gi"
72+
initialHeapSize: "512m"
73+
maxHeapSize: "3000m"
74+
db:
75+
requests:
76+
cpu: "100m"
77+
memory: "256Mi"
78+
limits:
79+
cpu: "500m"
80+
memory: "512Mi"
81+
82+
# -l: hold the pod unready while the startup preload is running.
83+
# Traffic is allowed as soon as the preload finishes.
84+
healthCheckOption: -l
85+
86+
gateway:
87+
enabled: true
88+
className: envoy-gateway-class
89+
requestTimeout: 120s
90+
# Route all requests through the Varnish service deployed below.
91+
# The service name is always <ArgoCD-app-name>-varnish-service.
92+
backendServiceNameOverride: ontoserver-dev-varnish-service
93+
94+
# Uncomment to enable HTTPS via cert-manager:
95+
# tls:
96+
# enabled: true
97+
# certRef: ontoserver-dev-tls
98+
# certmanager:
99+
# enabled: true
100+
# email: your-email@example.com
101+
102+
# Configure what terminology to load on startup.
103+
# Add subscriptions to your syndication server here:
104+
# config:
105+
# ontoserver.syndication.plus.subscriptions.0.uri: https://your-syndication-server/fhir/SubscriptionDefinition/...
106+
107+
# ── ontoserver-extras (Varnish) ────────────────────────────────────────────
108+
- repoURL: https://github.com/aehrc/ontoserver-deploy
109+
targetRevision: HEAD
110+
path: charts/ontoserver-extras
111+
helm:
112+
valuesObject:
113+
varnish:
114+
enabled: true
115+
# 30 s grace period: serve stale content if ontoserver is temporarily
116+
# unavailable (e.g. during a pod restart).
117+
graceSeconds: 30
118+
cache:
119+
time200: 10m
120+
time404: 1m
121+
122+
syncPolicy:
123+
automated:
124+
prune: true
125+
selfHeal: true
126+
syncOptions:
127+
- CreateNamespace=true

0 commit comments

Comments
 (0)