Add Drupal chart (#52)

Author: devpro

.kube-linter.yaml

@@ -24,5 +24,6 @@
     - charts/**/charts/**
     # disable for now (too many issues for something to rework from the container image)
     - charts/nfs-ganesha/**
+    - charts/drupal/**
     # disable as no easy solution for secret management for MariaDB
     - charts/dvwa/**

charts/drupal/.helmignore

@@ -0,0 +1,4 @@
+.DS_Store
+.git
+.gitignore
+README.md

charts/drupal/CONTRIBUTING.md

@@ -0,0 +1,34 @@
+# Contribution guide
+
+## Validate on a test cluster
+
+Create a `values.mine.yaml` file:
+
+```yaml
+ingress:
+  enabled: true
+  className: "traefik"
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+  tls:
+    enabled: true
+```
+
+Install the chart:
+
+```bash
+helm upgrade --install drupal . -f values.yaml -f values.mine.yaml --namespace drupal --create-namespace \
+  --set ingress.domain="drupal.console.$SANDBOX_ID.instruqt.io"
+```
+
+Wait for all pods to be ready:
+
+```bash
+kubectl get pod,rs,deploy,svc,ingress,certificate -n drupal
+```
+
+Open the web application in a browser:
+
+```bash
+echo https://drupal.console.$SANDBOX_ID.instruqt.io
+```

charts/drupal/Chart.yaml

@@ -0,0 +1,14 @@
+apiVersion: v2
+name: drupal
+description: Drupal Web Application - for container security workshops
+type: application
+version: 1.0.0
+appVersion: "1.0.0"
+keywords:
+  - security
+  - vulnerable
+  - workshop
+  - training
+maintainers:
+  - name: devpro
+    email: bertrand@devpro.fr

charts/drupal/README.md

@@ -0,0 +1,34 @@
+# Drupal Helm Chart
+
+Helm chart for Drupal — designed for container security workshops.
+
+## Quick Start
+
+Add the chart repository:
+
+```bash
+helm repo add devpro https://devpro.github.io/helm-charts
+helm repo update
+```
+
+Create the `values.yaml` file to override [default values](values.yaml).
+
+Install the chart:
+
+```bash
+helm upgrade --install drupal devpro/drupal -f values.yaml --namespace drupal --create-namespace
+```
+
+## Uninstall
+
+```bash
+helm uninstall drupal -n drupal
+kubectl delete namespace drupal
+```
+
+## Going further
+
+Check the [contribution guide](CONTRIBUTING.md).
+
+---
+> ⚠️ **FOR WORKSHOP USE ONLY** — intentionally vulnerable, never expose to the internet.

charts/drupal/templates/NOTES.txt

@@ -0,0 +1,3 @@
+🎯 Drupal deployed!
+
+⚠️  FOR WORKSHOP USE ONLY — never expose to the internet long-term!

charts/drupal/templates/deployment.yaml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: drupal
+spec:
+  replicas: {{ .Values.replicaCount }}
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app: drupal
+  template:
+    metadata:
+      labels:
+        app: drupal
+    spec:
+      containers:
+        - name: drupal
+          image: {{ .Values.image }}:{{ .Values.tag }}
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 10
+            periodSeconds: 10

charts/drupal/templates/ingress.yaml

@@ -0,0 +1,31 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: drupal
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ $.Values.ingress.className }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.domain | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: drupal
+                port:
+                  number: 80
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.domain | quote }}
+      secretName: drupal-tls-secret
+  {{- end }}
+{{- end }}

charts/drupal/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: drupal
+  labels:
+    app: drupal
+spec:
+  type: ClusterIP
+  selector:
+    app: drupal
+  ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http

charts/drupal/values.yaml

@@ -0,0 +1,11 @@
+replicaCount: 1
+image: vulhub/drupal
+tag: 8.5.0
+ingress:
+  enabled: false
+  className: ""    # traefik
+  domain: ""
+  annotations: {}
+    # cert-manager.io/cluster-issuer: letsencrypt-prod
+  tls:
+    enabled: false