Add Helm chart and GitLab CI pipeline

- Helm chart with PostgreSQL, MinIO, Redis as optional subcharts
- Production and external infrastructure value files
- HPA, Ingress, and health probe support
- GitLab CI pipeline using Buildah for container builds
- Multi-stage pipeline: test, build, publish

helm/orchard/templates/deployment.yaml

@@ -0,0 +1,111 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "orchard.fullname" . }}
+  labels:
+    {{- include "orchard.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "orchard.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
+      {{- with .Values.podAnnotations }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "orchard.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "orchard.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      initContainers:
+        {{- if .Values.migrations.enabled }}
+        - name: wait-for-db
+          image: busybox:1.36
+          command: ['sh', '-c', 'until nc -z {{ include "orchard.postgresql.host" . }} 5432; do echo waiting for database; sleep 2; done;']
+        {{- end }}
+        {{- if .Values.minio.enabled }}
+        - name: wait-for-minio
+          image: busybox:1.36
+          command: ['sh', '-c', 'until nc -z {{ .Release.Name }}-minio 9000; do echo waiting for minio; sleep 2; done;']
+        {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.orchard.server.port }}
+              protocol: TCP
+          env:
+            - name: ORCHARD_SERVER_HOST
+              value: {{ .Values.orchard.server.host | quote }}
+            - name: ORCHARD_SERVER_PORT
+              value: {{ .Values.orchard.server.port | quote }}
+            - name: ORCHARD_DATABASE_HOST
+              value: {{ include "orchard.postgresql.host" . | quote }}
+            - name: ORCHARD_DATABASE_PORT
+              value: {{ .Values.orchard.database.port | quote }}
+            - name: ORCHARD_DATABASE_USER
+              value: {{ .Values.orchard.database.user | default .Values.postgresql.auth.username | quote }}
+            - name: ORCHARD_DATABASE_DBNAME
+              value: {{ .Values.orchard.database.dbname | default .Values.postgresql.auth.database | quote }}
+            - name: ORCHARD_DATABASE_SSLMODE
+              value: {{ .Values.orchard.database.sslmode | quote }}
+            - name: ORCHARD_DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "orchard.postgresql.secretName" . }}
+                  key: {{ include "orchard.postgresql.passwordKey" . }}
+            - name: ORCHARD_S3_ENDPOINT
+              value: {{ include "orchard.minio.host" . | quote }}
+            - name: ORCHARD_S3_REGION
+              value: {{ .Values.orchard.s3.region | quote }}
+            - name: ORCHARD_S3_BUCKET
+              value: {{ .Values.orchard.s3.bucket | quote }}
+            - name: ORCHARD_S3_USE_PATH_STYLE
+              value: {{ .Values.orchard.s3.usePathStyle | quote }}
+            - name: ORCHARD_S3_ACCESS_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "orchard.minio.secretName" . }}
+                  key: {{ if .Values.minio.enabled }}root-user{{ else }}{{ .Values.orchard.s3.existingSecretAccessKeyKey }}{{ end }}
+            - name: ORCHARD_S3_SECRET_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "orchard.minio.secretName" . }}
+                  key: {{ if .Values.minio.enabled }}root-password{{ else }}{{ .Values.orchard.s3.existingSecretSecretKeyKey }}{{ end }}
+          livenessProbe:
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}