openfga: init

Signed-off-by: Élyse Viard <[email protected]>
OpenRailAssociation · Feb 25, 2025 · 25e4d48 · 25e4d48
1 parent f6b06ba
commit 25e4d48
Show file tree

Hide file tree

Showing 6 changed files with 154 additions and 0 deletions.
diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
@@ -30,6 +30,26 @@ Create chart name and version as used by the chart label.
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
+{{/*
+Common labels OpenFGA
+*/}}
+{{- define "osrd.labels.openfga" -}}
+helm.sh/chart: {{ include "osrd.chart" . }}
+{{ include "osrd.selectorLabels.openfga" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels OpenFGA
+*/}}
+{{- define "osrd.selectorLabels.openfga" -}}
+app.kubernetes.io/name: {{ include "osrd.name" . }}-openfga
+app.kubernetes.io/instance: {{ .Release.Name }}-openfga
+{{- end }}
+
 {{/*
 Common labels Osrdyne
 */}}

diff --git a/templates/editoast/deployment.yaml b/templates/editoast/deployment.yaml
@@ -95,6 +95,11 @@ spec:
               value: "{{ $redis }}"
               {{- end }}
 
+            - name: EDITOAST_OPENFGA_URL
+              value: "http://{{ include "osrd.fullname" . }}-openfga"
+            - name: EDITOAST_OPENFGA_STORE
+              value: osrd-editoast
+
             {{- with .Values.services.editoast.env | default dict }}
             {{- toYaml . | nindent 12 }}
             {{- end }}

diff --git a/templates/openfga/deployment.yaml b/templates/openfga/deployment.yaml
@@ -0,0 +1,86 @@
+{{- if .Values.services.openfga.enabled -}}
+
+{{- $mergedAnnotations := merge (.Values.annotations | default dict) (.Values.services.openfga.annotations | default dict) }}
+{{- $generatedLabels := include "osrd.labels.openfga" . | fromYaml }}
+{{- $mergedLabels := merge (.Values.labels | default dict) (.Values.services.openfga.labels | default dict) $generatedLabels }}
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "osrd.fullname" . }}-openfga
+  labels:
+    {{- toYaml $mergedLabels | nindent 4 }}
+  annotations:
+    {{- toYaml $mergedAnnotations | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "osrd.selectorLabels.openfga" . | nindent 6 }}
+  template:
+    metadata:
+     labels:
+        {{- include "osrd.selectorLabels.openfga" . | nindent 8 }}
+    spec:
+
+      initContainers:
+        - name: openfga-migrate
+          image: "{{ .Values.images.openfga }}"
+          command: ["migrate"]
+          env:
+            - name: OPENFGA_DATASTORE_ENGINE
+              value: "postgres"
+            - name: OPENFGA_DATASTORE_URI
+              {{- $postgresql := .Values.endpoints.postgresqlOpenFGA }}
+              {{- if eq (kindOf $postgresql) "map" }}
+              valueFrom:
+                {{- toYaml $postgresql.valueFrom | nindent 16 }}
+              {{- else }}
+              value: "{{ $postgresql }}"
+              {{- end }}
+
+      containers:
+        - name: openfga
+          image: "{{ .Values.images.openfga }}"
+          ports:
+            - containerPort: {{ .Values.services.openfga.service.targetPort }}
+          env:
+            - name: OPENFGA_DATASTORE_ENGINE
+              value: "postgres"
+            - name: OPENFGA_DATASTORE_URI
+              {{- $postgresql := .Values.endpoints.postgresqlOpenFGA }}
+              {{- if eq (kindOf $postgresql) "map" }}
+              valueFrom:
+                {{- toYaml $postgresql.valueFrom | nindent 16 }}
+              {{- else }}
+              value: "{{ $postgresql }}"
+              {{- end }}
+            - name: OPENFGA_HTTP_ADDR
+              value: "0.0.0.0:{{ .Values.services.openfga.service.targetPort }}"
+            - name: OPENFGA_PLAYGROUND_ENABLED
+              value: "false"
+            {{- with .Values.services.openfga.env | default dict }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
+
+          {{- if not .Values.services.openfga.readinessProbe.disabled }}
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+          {{- end }}
+
+      nodeSelector:
+        {{- toYaml (merge (.Values.nodeSelector | default dict) (.Values.services.openfga.nodeSelector | default dict)) | nindent 8 }}
+
+      affinity:
+        {{- toYaml (merge (.Values.affinity | default dict) (.Values.services.openfga.affinity | default dict)) | nindent 8 }}
+
+      tolerations:
+        {{- with .Values.tolerations | default dict }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+        {{- with .Values.services.openfga.tolerations | default dict }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+{{- end }}
diff --git a/templates/openfga/service.yaml b/templates/openfga/service.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.services.openfga.enabled -}}
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "osrd.fullname" . }}-openfga
+  labels:
+    {{- include "osrd.labels.openfga" . | nindent 4 }}
+spec:
+  type: {{ .Values.services.openfga.service.type }}
+  ports:
+    - port: {{ .Values.services.openfga.service.port }}
+      targetPort: {{ .Values.services.openfga.service.targetPort }}
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "osrd.selectorLabels.openfga" . | nindent 4 }}
+
+{{- end }}
diff --git a/templates/stateful_editoast/deployment.yaml b/templates/stateful_editoast/deployment.yaml
@@ -95,6 +95,9 @@ spec:
               value: "{{ $redis }}"
               {{- end }}
 
+            - name: EDITOAST_OPENFGA_URL
+              value: "http://{{ include "osrd.fullname" . }}-openfga"
+
             {{- with .Values.services.editoast.env | default dict }}
             {{- toYaml . | nindent 12 }}
             {{- end }}

diff --git a/values.yaml b/values.yaml
@@ -20,6 +20,7 @@ endpoints:
     management: "http://osrd:password@rabbitmq:15672"
     managementWithVhost: "http://osrd:password@rabbitmq:15672/%2f"
   postgresql: "postgres://osrd:password@postgres:5432/osrd"
+  postgresqlOpenFGA: "postgres://osrd:password@postgres:5432/osrd?search_path=openfga"
   redis: redis://username:pwd@redis:6379/0
 
 # Container images related settings
@@ -31,9 +32,29 @@ images:
   core: ghcr.io/openrailassociation/osrd-edge/osrd-core:dev
   osrdyne: ghcr.io/openrailassociation/osrd-edge/osrd-osrdyne:dev
   images: ghcr.io/openrailassociation/osrd-edge/osrd-images:v1.0.2
+  openfga: openfga/openfga:v1.8.6
 
 # Services direct settings and overides
 services:
+  openfga:
+    enabled: false
+    service:
+      type: ClusterIP
+      port: 80
+      targetPort: 80
+    readinessProbe:
+      disabled: false
+      initialDelaySeconds: 5
+      periodSeconds: 10
+      timeoutSeconds: 3
+    annotations: {}
+    labels: {}
+    nodeSelector: {}
+    tolerations: []
+    affinity: {}
+    resources: {}
+    env: []
+
   osrdyne:
     enabled: true
     service: