From 6df63f69cd8b4b9a6b446ab26643fd7fcda535ea Mon Sep 17 00:00:00 2001 From: Serge Date: Sun, 6 Sep 2026 11:33:16 +0200 Subject: [PATCH] feat: add aralez helm chart Add basic Aralez deployment configuration, Helm chart linting workflow, and Dependabot configuration. --- .github/ct.yml | 9 ++ .github/dependabot.yml | 23 +++ .github/workflows/charts.yaml | 28 ++++ charts/aralez/.helmignore | 23 +++ charts/aralez/Chart.yaml | 18 +++ charts/aralez/README.md.gotmpl | 17 ++ charts/aralez/ci/values.yaml | 18 +++ charts/aralez/templates/NOTES.txt | 0 charts/aralez/templates/_helpers.tpl | 104 +++++++++++++ charts/aralez/templates/certs.yaml | 21 +++ charts/aralez/templates/configmap.yaml | 28 ++++ charts/aralez/templates/deployment.yaml | 130 ++++++++++++++++ charts/aralez/templates/hpa.yaml | 24 +++ charts/aralez/templates/ingressclass.yaml | 10 ++ charts/aralez/templates/service.yaml | 41 +++++ charts/aralez/templates/serviceaccount.yaml | 52 +++++++ charts/aralez/values.yaml | 164 ++++++++++++++++++++ 17 files changed, 710 insertions(+) create mode 100644 .github/ct.yml create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/charts.yaml create mode 100644 charts/aralez/.helmignore create mode 100644 charts/aralez/Chart.yaml create mode 100644 charts/aralez/README.md.gotmpl create mode 100644 charts/aralez/ci/values.yaml create mode 100644 charts/aralez/templates/NOTES.txt create mode 100644 charts/aralez/templates/_helpers.tpl create mode 100644 charts/aralez/templates/certs.yaml create mode 100644 charts/aralez/templates/configmap.yaml create mode 100644 charts/aralez/templates/deployment.yaml create mode 100644 charts/aralez/templates/hpa.yaml create mode 100644 charts/aralez/templates/ingressclass.yaml create mode 100644 charts/aralez/templates/service.yaml create mode 100644 charts/aralez/templates/serviceaccount.yaml create mode 100644 charts/aralez/values.yaml diff --git a/.github/ct.yml b/.github/ct.yml new file mode 100644 index 0000000..458a590 --- /dev/null +++ b/.github/ct.yml @@ -0,0 +1,9 @@ +helm-extra-args: --timeout 300s +check-version-increment: true +debug: true +chart-dirs: + - charts +validate-maintainers: true +namespace: default +release-label: test +target-branch: main diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..a457fb1 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,23 @@ +--- +# See https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + commit-message: + prefix: "chore:" + open-pull-requests-limit: 8 + rebase-strategy: disabled + schedule: + interval: "monthly" + day: "monday" + time: "10:00" + timezone: "UTC" + cooldown: + default-days: 7 + groups: + actions: + patterns: + - "actions/*" + - "helm/*" diff --git a/.github/workflows/charts.yaml b/.github/workflows/charts.yaml new file mode 100644 index 0000000..de51f45 --- /dev/null +++ b/.github/workflows/charts.yaml @@ -0,0 +1,28 @@ +name: Helm chart check + +on: + pull_request: + branches: + - main + paths: + - "charts/**" + +jobs: + helm-lint: + name: Helm chart check + timeout-minutes: 5 + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Install chart-testing tools + id: lint + uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0 + + - name: Run helm chart linter + run: ct --config .github/ct.yml lint + - name: Run helm template + run: helm lint charts/aralez diff --git a/charts/aralez/.helmignore b/charts/aralez/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/aralez/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/aralez/Chart.yaml b/charts/aralez/Chart.yaml new file mode 100644 index 0000000..1d683c2 --- /dev/null +++ b/charts/aralez/Chart.yaml @@ -0,0 +1,18 @@ +# yaml-language-server: $schema=https://json.schemastore.org/chart.json +apiVersion: v2 +name: aralez +description: Ingress controller for Kubernetes +type: application +home: https://github.com/sadoyan/aralez/charts +sources: + - https://github.com/sadoyan/helm-charts/tree/main/charts/aralez +keywords: + - ingress-controller + - aralez +maintainers: [] +# +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.0.1 +# +# renovate: datasource=docker depName=ghcr.io/sadoyan/aralez +appVersion: 0.93.3 diff --git a/charts/aralez/README.md.gotmpl b/charts/aralez/README.md.gotmpl new file mode 100644 index 0000000..c58fe7d --- /dev/null +++ b/charts/aralez/README.md.gotmpl @@ -0,0 +1,17 @@ +{{ template "chart.header" . }} + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} diff --git a/charts/aralez/ci/values.yaml b/charts/aralez/ci/values.yaml new file mode 100644 index 0000000..db62f08 --- /dev/null +++ b/charts/aralez/ci/values.yaml @@ -0,0 +1,18 @@ +ingressClass: aralez +ingressClassResource: + enabled: true + +# hostNetwork: true +# hostPort: +# ports: +# http: 8080 +# https: 8443 + +priorityClassName: system-cluster-critical + +env: [] + +args: [] + +useDaemonSet: true +terminationGracePeriodSeconds: 120 diff --git a/charts/aralez/templates/NOTES.txt b/charts/aralez/templates/NOTES.txt new file mode 100644 index 0000000..e69de29 diff --git a/charts/aralez/templates/_helpers.tpl b/charts/aralez/templates/_helpers.tpl new file mode 100644 index 0000000..a89b5dc --- /dev/null +++ b/charts/aralez/templates/_helpers.tpl @@ -0,0 +1,104 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "aralez.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "aralez.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "aralez.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "aralez.labels" -}} +helm.sh/chart: {{ include "aralez.chart" . }} +{{ include "aralez.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- with .Values.podLabels }} +{{ toYaml . }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "aralez.selectorLabels" -}} +app.kubernetes.io/name: {{ include "aralez.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Return a podAffinity/podAntiAffinity definition +*/}} +{{- define "affinities.pods" -}} + {{- if eq .Values.podAntiAffinityPreset "soft" }} + {{- include "affinities.pods.soft" . -}} + {{- else if eq .Values.podAntiAffinityPreset "hard" }} + {{- include "affinities.pods.hard" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return a soft podAntiAffinity definition +*/}} +{{- define "affinities.pods.soft" -}} +podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "aralez.selectorLabels" .) | nindent 12 }} + namespaces: + - {{ .Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname + weight: 1 +{{- end -}} + +{{/* +Return a hard podAntiAffinity definition +*/}} +{{- define "affinities.pods.hard" -}} +podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: {{- (include "aralez.selectorLabels" .) | nindent 10 }} + namespaces: + - {{ .Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "aralez.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "aralez.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/aralez/templates/certs.yaml b/charts/aralez/templates/certs.yaml new file mode 100644 index 0000000..a5b33b0 --- /dev/null +++ b/charts/aralez/templates/certs.yaml @@ -0,0 +1,21 @@ +{{- $ca := genCA .Chart.Name 3650 }} +{{- $server := genSignedCert "server" (list "127.0.0.1") nil 3650 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "aralez.fullname" . }}-tls + labels: + {{- include "aralez.labels" . | nindent 4 }} +type: kubernetes.io/tls +data: +{{- $secretName := printf "%s-tls" (include "aralez.fullname" .) }} +{{- $secretData := (lookup "v1" "Secret" .Release.Namespace $secretName).data }} +{{- if and $secretData (hasKey $secretData "ca.crt") }} + ca.crt: {{ get $secretData "ca.crt" }} + tls.crt: {{ get $secretData "tls.crt" }} + tls.key: {{ get $secretData "tls.key" }} +{{- else }} + ca.crt: {{ $ca.Cert | b64enc }} + tls.crt: {{ $server.Cert | b64enc }} + tls.key: {{ $server.Key | b64enc }} +{{- end }} diff --git a/charts/aralez/templates/configmap.yaml b/charts/aralez/templates/configmap.yaml new file mode 100644 index 0000000..3c42d78 --- /dev/null +++ b/charts/aralez/templates/configmap.yaml @@ -0,0 +1,28 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "aralez.fullname" . }} + labels: + {{- include "aralez.labels" . | nindent 4 }} +data: + aralez.yaml: | + daemon: false + upstreams_conf: /etc/aralez/upstreams.yaml + proxy_configs: /etc/aralez-proxy + proxy_address_http: "0.0.0.0:{{ .Values.hostPort.ports.http }}" + proxy_address_tls: "0.0.0.0:{{ .Values.hostPort.ports.https }}" + config_api_enabled: false + config_address: "0.0.0.0:3000" + upgrade_sock: /tmp/aralez.sock + pid_file: /tmp/aralez.pid + log_level: debug + hc_method: HEAD + hc_interval: 5 + + upstreams.yaml: | + provider: "kubernetes" + sticky_sessions: 172000 + kubernetes: {} + {{- with .Values.upstreams }} + {{- toYaml . | nindent 4 }} + {{- end }} diff --git a/charts/aralez/templates/deployment.yaml b/charts/aralez/templates/deployment.yaml new file mode 100644 index 0000000..a774f86 --- /dev/null +++ b/charts/aralez/templates/deployment.yaml @@ -0,0 +1,130 @@ +apiVersion: apps/v1 +{{- if .Values.useDaemonSet }} +kind: DaemonSet +{{- else }} +kind: Deployment +{{- end }} +metadata: + name: {{ include "aralez.fullname" . }} + labels: + {{- include "aralez.labels" . | nindent 4 }} +spec: + {{- if not (or .Values.autoscaling.enabled .Values.useDaemonSet) }} + replicas: {{ .Values.replicaCount }} + {{- end }} + {{- if not .Values.useDaemonSet }} + strategy: + type: {{ .Values.updateStrategy.type }} + {{- else }} + updateStrategy: + type: {{ .Values.updateStrategy.type }} + {{- end }} + selector: + matchLabels: + {{- include "aralez.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "aralez.labels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + annotations: + {{- if .Values.upstreams }} + checksum/upstreams: {{ toJson .Values.upstreams | sha256sum }} + {{- end }} + spec: + enableServiceLinks: false + {{- if and .Values.hostNetwork .Values.useDaemonSet }} + hostNetwork: {{ .Values.hostNetwork }} + dnsPolicy: "ClusterFirstWithHostNet" + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName }} + {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "aralez.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- if .Values.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: ["aralez"] + args: + - --conf=/etc/aralez/aralez.yaml + {{- range $value := .Values.args }} + - {{ $value }} + {{- end }} + env: + {{- with .Values.env }} + {{- . | toYaml | nindent 12 }} + {{- end }} + ports: + {{- if .Values.hostPort.ports.http }} + - name: http + containerPort: {{ .Values.hostPort.ports.http }} + protocol: TCP + {{- end }} + {{- if .Values.hostPort.ports.https }} + - name: https + containerPort: {{ .Values.hostPort.ports.https }} + protocol: TCP + {{- end }} + # readinessProbe: + # httpGet: + # path: /status + # port: 3000 + # initialDelaySeconds: 30 + # timeoutSeconds: 5 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: config + mountPath: /etc/aralez + - name: tlscerts + mountPath: /etc/aralez-proxy/certificates + {{- with .Values.volumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + volumes: + - name: config + configMap: + name: {{ include "aralez.fullname" . }} + - name: tlscerts + secret: + secretName: {{ include "aralez.fullname" . }}-tls + defaultMode: 256 + items: + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key + {{- with .Values.volumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + affinity: + {{- include "affinities.pods" . | nindent 8 }} + {{- with .Values.affinity }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/aralez/templates/hpa.yaml b/charts/aralez/templates/hpa.yaml new file mode 100644 index 0000000..5b0bd03 --- /dev/null +++ b/charts/aralez/templates/hpa.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.autoscaling.enabled (not .Values.useDaemonSet) }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "aralez.fullname" . }} + labels: + {{- include "aralez.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "aralez.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/aralez/templates/ingressclass.yaml b/charts/aralez/templates/ingressclass.yaml new file mode 100644 index 0000000..61b1b8b --- /dev/null +++ b/charts/aralez/templates/ingressclass.yaml @@ -0,0 +1,10 @@ +{{- if .Values.ingressClassResource.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + labels: + {{- include "aralez.labels" . | nindent 4 }} + name: {{ .Values.ingressClass }} +spec: + controller: {{ .Values.ingressClassResource.controllerValue }} +{{- end }} diff --git a/charts/aralez/templates/service.yaml b/charts/aralez/templates/service.yaml new file mode 100644 index 0000000..e15b863 --- /dev/null +++ b/charts/aralez/templates/service.yaml @@ -0,0 +1,41 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "aralez.fullname" . }} + labels: + {{- include "aralez.labels" . | nindent 4 }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + {{- if eq .Values.service.type "NodePort" }} + externalTrafficPolicy: Local + {{- end }} + {{- with .Values.service.ipFamilies }} + ipFamilies: + {{- toYaml . | nindent 4 }} + {{- end }} + ipFamilyPolicy: {{ if eq (len .Values.service.ipFamilies) 2 }}PreferDualStack{{ else }}SingleStack{{ end }} + ports: + {{- if .Values.hostPort.ports.http }} + - port: 80 + targetPort: http + protocol: TCP + name: http + {{- if .Values.hostPort.enabled }} + nodePort: {{ .Values.hostPort.ports.http }} + {{- end }} + {{- end }} + {{- if .Values.hostPort.ports.https }} + - port: 443 + targetPort: https + protocol: TCP + name: https + {{- if .Values.hostPort.enabled }} + nodePort: {{ .Values.hostPort.ports.https }} + {{- end }} + {{- end }} + selector: + {{- include "aralez.selectorLabels" . | nindent 4 }} diff --git a/charts/aralez/templates/serviceaccount.yaml b/charts/aralez/templates/serviceaccount.yaml new file mode 100644 index 0000000..530fa74 --- /dev/null +++ b/charts/aralez/templates/serviceaccount.yaml @@ -0,0 +1,52 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "aralez.serviceAccountName" . }} + labels: + {{- include "aralez.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: true +{{- end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "aralez.fullname" . }} + labels: + {{- include "aralez.labels" . | nindent 4 }} +rules: +- apiGroups: ["networking.k8s.io"] + resources: ["ingresses", "ingressclasses"] + verbs: ["get", "list", "watch"] +- apiGroups: ["networking.k8s.io"] + resources: ["ingresses/status"] + verbs: ["get", "update", "patch"] +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] +- apiGroups: [""] + resources: ["nodes", "services", "endpoints"] + verbs: ["get", "list", "watch"] +- apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "watch"] + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "aralez.fullname" . }} + labels: + {{- include "aralez.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "aralez.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ include "aralez.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} diff --git a/charts/aralez/values.yaml b/charts/aralez/values.yaml new file mode 100644 index 0000000..f33397c --- /dev/null +++ b/charts/aralez/values.yaml @@ -0,0 +1,164 @@ +# Default values for aralez. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: ghcr.io/sadoyan/aralez + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +# -- Environment variables +env: [] + +# -- Aralez arguments +args: [] + +# -- Aralez upstreams file body +# refs: https://aralez.rs/docs/kubernetes/ +upstreams: + rate_limit: 500000 + x4xx_limit: 100000 + to_https: true + server_headers: + - "X-Forwarded-Proto:https" + - "X-Forwarded-Port:443" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +# -- Annotations for pod. +# ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ +podAnnotations: {} + # cluster-autoscaler.kubernetes.io/safe-to-evict: "false" + +# -- Extra labels for pod. +# ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ +podLabels: {} + +# -- Pod Security Context. +# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod +podSecurityContext: + runAsNonRoot: true + runAsUser: 9999 + runAsGroup: 9999 + fsGroup: 9999 + fsGroupChangePolicy: "OnRootMismatch" + +# -- Container Security Context. +# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod +securityContext: + seccompProfile: + type: RuntimeDefault + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + +# -- Pod host network +# Use it only for performance reason +hostNetwork: false + +# -- Service node port +# refs: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport +hostPort: + enabled: false + ports: + http: 8080 + https: 8443 + +ingressClass: aralez +ingressClassResource: + enabled: true + controllerValue: aralez.proxy/ingress-controller + +# -- Bitwarden service parameters +# ref: https://kubernetes.io/docs/user-guide/services/ +service: + # -- service type + type: ClusterIP + + annotations: {} + + # -- IP families for service + # possible values: IPv4, IPv6 + # ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ipFamilies: [IPv4] + +# -- Resource requests and limits. +# ref: https://kubernetes.io/docs/user-guide/compute-resources/ +resources: + limits: + cpu: 1 + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + +# -- Horizontal and Vertical pod autoscaler. +# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/ +autoscaling: + enabled: false + + minReplicas: 1 + maxReplicas: 10 + targetCPUUtilizationPercentage: 80 + +# -- Use a daemonset instead of a deployment +useDaemonSet: false + +# -- The time in seconds that is allowed for a Aralez instance to gracefully shutdown +# ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks +terminationGracePeriodSeconds: 120 + +## updateStrategy for PostgreSQL StatefulSet and its slaves StatefulSets +## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies +updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + +# -- Priority Class Name +# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass +priorityClassName: "" + +# Additional volumes on the output Deployment definition. +volumes: [] +# - name: foo +# secret: +# secretName: mysecret +# optional: false + +# Additional volumeMounts on the output Deployment definition. +volumeMounts: [] +# - name: foo +# mountPath: "/etc/foo" +# readOnly: true + +# -- Node labels for pod assignment. +# ref: https://kubernetes.io/docs/user-guide/node-selection/ +nodeSelector: {} + +# -- Tolerations for pod assignment. +# ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +tolerations: [] + +# -- Pod Anti Affinity +# soft/hard +podAntiAffinityPreset: soft + +# -- Affinity for pod assignment. +# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +affinity: {}