helmfile.yaml.gotmpl

# FleetDM stack — declarative spec for `helmfile sync`.
#
# Reference: https://fleetdm.com/guides/deploy-fleet-on-kubernetes#option-b-install-mysql-and-redis-valkey-separately
#
# Release graph (enforced via `needs:`):
#
#     bootstrap ──┬─► mysql ─► fleet-db-init ─► fleet
#                 └─► valkey ──────────────────────┘
#
# All cluster bootstrap (namespaces, secrets, MySQL, schema migrations) lives
# in local helm charts under `charts/`. Helmfile contains no inline shell
# scripts.
#
# Why standalone MySQL (charts/mysql) instead of Oracle's MySQL Operator?
# The Oracle operator only provisions InnoDBCluster resources, which always
# run Group Replication — even on a single-node cluster. GR forbids
# `ALTER TABLE ... DROP PRIMARY KEY` without a paired `ADD PRIMARY KEY` in
# the same statement, but Fleet's `host_mdm_windows_profiles` migration does
# exactly that as two separate statements. There is no operator-level
# workaround, so we deploy the official `mysql:8.4` Docker image directly
# via a thin local chart. See charts/mysql/README.md for details.

repositories:
  - name: ingress-nginx
    url: https://kubernetes.github.io/ingress-nginx
  - name: valkey
    url: https://valkey.io/valkey-helm/
  - name: fleetdm
    url: https://fleetdm.github.io/fleet/charts
  - name: jetstack
    url: https://charts.jetstack.io

helmDefaults:
  wait: true
  timeout: 900
  createNamespace: true
  historyMax: 5

environments:
  default:
    values:
      - databaseNamespace:       database
      - cacheNamespace:          cache
      - fleetNamespace:          fleet
      - ingressNamespace:        ingress-nginx
      - certManagerNamespace:    cert-manager
      - fleetChartVersion:       v6.9.4
      - valkeyChartVersion:      0.9.4
      - ingressNginxChartVersion: 4.13.2
      - certManagerChartVersion: v1.16.2
      # Single source of truth for the Fleet binary version — propagated
      # to the `fleet` release (server image) AND the `fleet-db-init`
      # release (prepare-db Job). Keep these in lockstep, otherwise the
      # Job applies migrations the server doesn't expect.
      - fleetImageTag: v4.84.3
      # Ingress host — empty by default; set INGRESS_HOST=fleet.<ip-dashes>.nip.io
      # to publish via ingress (handled by `task fleet:expose`).
      - ingressHost: '{{ env "INGRESS_HOST" | default "" }}'

---

releases:
  # 1. Namespaces + shared secrets.
  - name: bootstrap
    namespace: default
    chart: ./charts/bootstrap

  # Ingress controller as LoadBalancer — replaces `minikube addons enable ingress`.
  # Depends on cert-manager-issuers because the admission webhook's serving
  # cert is provisioned via cert-manager (see values-ingress-nginx.yaml) —
  # this avoids the race where the chart's own post-install patch hook can
  # leave the ValidatingWebhookConfiguration with an empty caBundle, which
  # breaks every subsequent `kubectl apply` of an Ingress.
  - name: ingress-nginx
    namespace: {{ .Values.ingressNamespace }}
    chart: ingress-nginx/ingress-nginx
    version: {{ .Values.ingressNginxChartVersion }}
    needs:
      - {{ .Values.certManagerNamespace }}/cert-manager-issuers
    values:
      - deploy/values/values-ingress-nginx.yaml

  # cert-manager — issues TLS certificates for the Fleet ingress.
  # Fleet's UI bundle stores its auth token in a `__Host-token` cookie marked
  # `Secure`, which browsers only accept over HTTPS — so TLS is mandatory,
  # not optional. We use a local self-signed root CA (see
  # charts/cert-manager-issuers) to keep nip.io hosts working offline.
  - name: cert-manager
    namespace: {{ .Values.certManagerNamespace }}
    chart: jetstack/cert-manager
    version: {{ .Values.certManagerChartVersion }}
    values:
      - installCRDs: true

  # Self-signed root CA + ClusterIssuer (`fleet-ca`) consumed by the Fleet
  # ingress annotation below. Depends on cert-manager CRDs being present.
  - name: cert-manager-issuers
    namespace: {{ .Values.certManagerNamespace }}
    chart: ./charts/cert-manager-issuers
    needs:
      - {{ .Values.certManagerNamespace }}/cert-manager

  # 2. Standalone MySQL 8.x (official image, no Group Replication).
  - name: mysql
    namespace: {{ .Values.databaseNamespace }}
    chart: ./charts/mysql
    needs:
      - default/bootstrap

  # 3. Schema bootstrap: init-db + prepare-db as Helm post-install hooks.
  #    Each Job's wait-for-mysql initContainer polls until MySQL accepts TCP.
  - name: fleet-db-init
    namespace: {{ .Values.fleetNamespace }}
    chart: ./charts/fleet-db-init
    needs:
      - {{ .Values.databaseNamespace }}/mysql
    set:
      - name: fleetImage.tag
        value: {{ .Values.fleetImageTag }}

  - name: valkey
    namespace: {{ .Values.cacheNamespace }}
    chart: valkey/valkey
    version: {{ .Values.valkeyChartVersion }}
    needs:
      - default/bootstrap
    values:
      - deploy/values/values-valkey.yaml

  - name: fleet
    namespace: {{ .Values.fleetNamespace }}
    chart: fleetdm/fleet
    version: {{ .Values.fleetChartVersion }}
    needs:
      - {{ .Values.fleetNamespace }}/fleet-db-init
      - {{ .Values.cacheNamespace }}/valkey
      - {{ .Values.certManagerNamespace }}/cert-manager-issuers
    set:
      - name: imageTag
        value: {{ .Values.fleetImageTag }}
    values:
      - deploy/values/values-fleet.yaml
      # Ingress overlay — empty when INGRESS_HOST isn't set, so base values'
      # `ingress.enabled: false` wins.
      {{- if .Values.ingressHost }}
      - ingress:
          enabled: true
          ingressClassName: nginx
          annotations:
            nginx.ingress.kubernetes.io/proxy-body-size: "100m"
            # TLS is mandatory: Fleet's UI bundle stores the auth token in
            # the `__Host-token` cookie, which browsers only accept over
            # HTTPS. Without TLS, login succeeds but every subsequent API
            # call goes out as `Authorization: Bearer null` and the UI
            # bounces back to /login with "Authentication required".
            nginx.ingress.kubernetes.io/ssl-redirect: "true"
            # cert-manager mints a leaf cert from the local `fleet-ca`
            # ClusterIssuer (charts/cert-manager-issuers) into the secret
            # below. Run `task fleet:trust-ca` once to import the root CA
            # into the host keychain so the browser stops complaining.
            cert-manager.io/cluster-issuer: fleet-ca
          hosts:
            - host: {{ .Values.ingressHost }}
              paths:
                - path: /
                  pathType: Prefix
          tls:
            - hosts:
                - {{ .Values.ingressHost }}
              secretName: fleet-tls
      {{- end }}