Container & Kubernetes Deployment

1. Docker Container Deployment

The git2iris tool is packaged as a multi-stage, lightweight Docker image based on alpine:latest. The container contains CA certificates for secure TLS/SSL API endpoints and runs with zero external dependencies.

Building the Docker Image

To compile and package git2iris locally from source, execute:

# Build Docker image
docker build -t git2iris:latest .

# Verify image creation
docker images git2iris

Dockerfile Specification

Below is the official multi-stage Dockerfile included in the repository:

# Multi-stage Dockerfile for git2iris

# Stage 1: Build binary
FROM golang:1.22-alpine AS builder

WORKDIR /app

# Download Go module dependencies
COPY go.mod ./
RUN go mod download

# Copy source code
COPY . .

# Build statically linked executable
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o git2iris .

# Stage 2: Minimal runtime container
FROM alpine:3.21

# Install CA certificates for SSL/TLS connections
RUN apk --no-cache add ca-certificates tzdata

WORKDIR /app

# Copy executable from builder
COPY --from=builder /app/git2iris /app/git2iris

# Expose CLI flags as environment variables
ENV ATELIER_URL="http://192.168.1.200:52773/api/atelier" \
    IRIS_USER="_SYSTEM" \
    IRIS_PASS="SYS" \
    IRIS_NS="USER" \
    LOCAL_DIR="" \
    GITLAB_URL="https://gitlab.com" \
    GITLAB_TOKEN="" \
    GITLAB_PROJECT="" \
    GITLAB_REF="main" \
    GITLAB_PATH="" \
    COMPILE="true" \
    COMPILE_FLAGS="ck" \
    CONCURRENCY="4" \
    DRY_RUN="false" \
    VERBOSE="false" \
    INSECURE="false"

ENTRYPOINT ["/app/git2iris"]

Running Containerized Syncs

You can execute containerized sync jobs by supplying environment variables to docker run:

# Example: Syncing a GitLab repository to IRIS via Docker
docker run --rm \
  -e ATELIER_URL="http://192.168.1.200:52773/api/atelier" \
  -e IRIS_USER="_SYSTEM" \
  -e IRIS_PASS="SYS" \
  -e IRIS_NS="USER" \
  -e GITLAB_URL="https://gitlab.com" \
  -e GITLAB_PROJECT="mygroup/myrepo" \
  -e GITLAB_TOKEN="glpat-xxxxxxxxxxxx" \
  git2iris:latest

---

2. Kubernetes CronJob & Guide Instructions

Running git2iris as a Kubernetes CronJob enables automated, hands-off synchronization of ObjectScript repositories into target InterSystems IRIS namespaces on a predefined cron schedule (e.g. hourly or daily).

Architecture Components

• ConfigMap (git2iris-config): Holds non-sensitive operational parameters such as the Atelier REST endpoint, target namespace, GitLab URL, repository ID, and compilation flags.
• Secret (git2iris-secret): Securely stores sensitive authentication credentials including IRIS_USER, IRIS_PASS, and GITLAB_TOKEN.
• CronJob (git2iris-sync-job): Manages scheduled execution, concurrency locks (concurrencyPolicy: Forbid), and pod restart policies.

Deployment Guide

Deploy the Kubernetes resources using kubectl:

# Apply ConfigMap, Secret, and CronJob
kubectl apply -f examples/kubernetes-cronjob.yaml

# Verify CronJob status
kubectl get cronjobs

# Manually trigger an immediate test sync run
kubectl create job --from=cronjob/git2iris-sync-job manual-sync-01

# Inspect execution logs
kubectl logs -l app.kubernetes.io/name=git2iris --tail=100

Kubernetes Manifest Specification (kubernetes-cronjob.yaml)

apiVersion: v1
kind: ConfigMap
metadata:
  name: git2iris-config
  namespace: default
  labels:
    app.kubernetes.io/name: git2iris
    app.kubernetes.io/component: sync-job
data:
  # InterSystems Atelier REST API configuration
  ATELIER_URL: "http://iris-service.default.svc.cluster.local:52773/api/atelier"
  IRIS_NS: "USER"

  # GitLab API v4 repository configuration
  GITLAB_URL: "https://gitlab.com"
  GITLAB_PROJECT: "mygroup/myrepo"
  GITLAB_REF: "main"
  GITLAB_PATH: ""

  # Execution & compilation options
  COMPILE: "true"
  COMPILE_FLAGS: "ck"
  CONCURRENCY: "4"
  DRY_RUN: "false"
  VERBOSE: "true"
  INSECURE: "false"
---
apiVersion: v1
kind: Secret
metadata:
  name: git2iris-secret
  namespace: default
  labels:
    app.kubernetes.io/name: git2iris
type: Opaque
stringData:
  # Sensitive authentication credentials
  IRIS_USER: "_SYSTEM"
  IRIS_PASS: "SYS"
  GITLAB_TOKEN: "glpat-xxxxxxxxxxxx"
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: git2iris-sync-job
  namespace: default
  labels:
    app.kubernetes.io/name: git2iris
    app.kubernetes.io/component: sync-job
spec:
  # Schedule sync execution (e.g. every hour at minute 0)
  schedule: "0 * * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 5
  startingDeadlineSeconds: 300
  jobTemplate:
    spec:
      backoffLimit: 3
      template:
        metadata:
          labels:
            app.kubernetes.io/name: git2iris
        spec:
          restartPolicy: OnFailure
          containers:
            - name: git2iris
              image: git2iris:latest
              imagePullPolicy: IfNotPresent
              envFrom:
                - configMapRef:
                    name: git2iris-config
                - secretRef:
                    name: git2iris-secret
              resources:
                requests:
                  cpu: 100m
                  memory: 128Mi
                limits:
                  cpu: 500m
                  memory: 512Mi
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                runAsNonRoot: true
                runAsUser: 10001
                capabilities:
                  drop:
                    - ALL

---

3. InterSystems IRIS Operator (IrisCluster) Sidecar Deployment

For cloud-native deployments managed by the InterSystems Kubernetes Operator (IKO), git2iris can be deployed as an inline sidecar container directly inside the IrisCluster pod specification.

Key Benefits of Sidecar Architecture

• Sub-Millisecond Loopback Networking: Communicates directly with the IRIS container over http://localhost:52773/api/atelier without traversing cluster routing or ingress controllers.
• Automated Pod Initialization & Sync: Synchronizes and compiles ObjectScript classes immediately as InterSystems IRIS boots up in the pod.
• Zero-Trust Credential Injection: Mounts Kubernetes Secret references (IRIS_USER, IRIS_PASS, GITLAB_TOKEN) directly into sidecar environment variables.

Deployment & Verification Guide

# Apply the IrisCluster CRD definition with git2iris sidecar
kubectl apply -f examples/iris-cluster-sidecar.yaml

# Check IrisCluster resource deployment
kubectl get irisclusters

# Monitor sidecar logs inside the IRIS pod
kubectl logs -f pod/iris-cluster-standalone-0 -c git2iris-sidecar

InterSystems IrisCluster Specification (iris-cluster-sidecar.yaml)

apiVersion: intersystems.com/v1alpha1
kind: IrisCluster
metadata:
  name: iris-cluster
  namespace: default
  labels:
    app.kubernetes.io/name: iris-cluster
spec:
  licenseKeySecret:
    name: iris-license-secret
  image: containers.intersystems.com/intersystems/iris-community:2024.1.0.267.0
  serviceTemplate:
    spec:
      type: ClusterIP
  topology:
    standalone:
      image: containers.intersystems.com/intersystems/iris-community:2024.1.0.267.0
      podTemplate:
        spec:
          containers:
            # git2iris Sidecar Container
            - name: git2iris-sidecar
              image: git2iris:latest
              imagePullPolicy: IfNotPresent
              env:
                - name: ATELIER_URL
                  value: "http://localhost:52773/api/atelier"
                - name: IRIS_NS
                  value: "USER"
                - name: GITLAB_URL
                  value: "https://gitlab.com"
                - name: GITLAB_PROJECT
                  value: "mygroup/myrepo"
                - name: GITLAB_REF
                  value: "main"
                - name: COMPILE
                  value: "true"
                - name: COMPILE_FLAGS
                  value: "ck"
                - name: CONCURRENCY
                  value: "4"
                - name: IRIS_USER
                  valueFrom:
                    secretKeyRef:
                      name: git2iris-secret
                      key: IRIS_USER
                - name: IRIS_PASS
                  valueFrom:
                    secretKeyRef:
                      name: git2iris-secret
                      key: IRIS_PASS
                - name: GITLAB_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: git2iris-secret
                      key: GITLAB_TOKEN
              resources:
                requests:
                  cpu: 100m
                  memory: 128Mi
                limits:
                  cpu: 500m
                  memory: 512Mi
              securityContext:
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                runAsNonRoot: true
                runAsUser: 10001
                capabilities:
                  drop:
                    - ALL