mirror of
https://github.com/sadoyan/aralez.git
synced 2026-10-22 21:51:35 +08:00
feat: add aralez helm chart
Add basic Aralez deployment configuration, Helm chart linting workflow, and Dependabot configuration.
This commit is contained in:
Serge
@@ -0,0 +1,9 @@
|
||||
helm-extra-args: --timeout 300s
|
||||
check-version-increment: true
|
||||
debug: true
|
||||
chart-dirs:
|
||||
- charts
|
||||
validate-maintainers: true
|
||||
namespace: default
|
||||
release-label: test
|
||||
target-branch: main
|
||||
@@ -0,0 +1,23 @@
|
||||
---
|
||||
# See https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates
|
||||
|
||||
version: 2
|
||||
updates:
|
||||
- package-ecosystem: "github-actions"
|
||||
directory: "/"
|
||||
commit-message:
|
||||
prefix: "chore:"
|
||||
open-pull-requests-limit: 8
|
||||
rebase-strategy: disabled
|
||||
schedule:
|
||||
interval: "monthly"
|
||||
day: "monday"
|
||||
time: "10:00"
|
||||
timezone: "UTC"
|
||||
cooldown:
|
||||
default-days: 7
|
||||
groups:
|
||||
actions:
|
||||
patterns:
|
||||
- "actions/*"
|
||||
- "helm/*"
|
||||
@@ -0,0 +1,28 @@
|
||||
name: Helm chart check
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- "charts/**"
|
||||
|
||||
jobs:
|
||||
helm-lint:
|
||||
name: Helm chart check
|
||||
timeout-minutes: 5
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Install chart-testing tools
|
||||
id: lint
|
||||
uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
|
||||
|
||||
- name: Run helm chart linter
|
||||
run: ct --config .github/ct.yml lint
|
||||
- name: Run helm template
|
||||
run: helm lint charts/aralez
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,18 @@
|
||||
# yaml-language-server: $schema=https://json.schemastore.org/chart.json
|
||||
apiVersion: v2
|
||||
name: aralez
|
||||
description: Ingress controller for Kubernetes
|
||||
type: application
|
||||
home: https://github.com/sadoyan/aralez/charts
|
||||
sources:
|
||||
- https://github.com/sadoyan/helm-charts/tree/main/charts/aralez
|
||||
keywords:
|
||||
- ingress-controller
|
||||
- aralez
|
||||
maintainers: []
|
||||
#
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.0.1
|
||||
#
|
||||
# renovate: datasource=docker depName=ghcr.io/sadoyan/aralez
|
||||
appVersion: 0.93.3
|
||||
@@ -0,0 +1,17 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
@@ -0,0 +1,18 @@
|
||||
ingressClass: aralez
|
||||
ingressClassResource:
|
||||
enabled: true
|
||||
|
||||
# hostNetwork: true
|
||||
# hostPort:
|
||||
# ports:
|
||||
# http: 8080
|
||||
# https: 8443
|
||||
|
||||
priorityClassName: system-cluster-critical
|
||||
|
||||
env: []
|
||||
|
||||
args: []
|
||||
|
||||
useDaemonSet: true
|
||||
terminationGracePeriodSeconds: 120
|
||||
@@ -0,0 +1,104 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "aralez.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "aralez.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "aralez.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "aralez.labels" -}}
|
||||
helm.sh/chart: {{ include "aralez.chart" . }}
|
||||
{{ include "aralez.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "aralez.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "aralez.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Return a podAffinity/podAntiAffinity definition
|
||||
*/}}
|
||||
{{- define "affinities.pods" -}}
|
||||
{{- if eq .Values.podAntiAffinityPreset "soft" }}
|
||||
{{- include "affinities.pods.soft" . -}}
|
||||
{{- else if eq .Values.podAntiAffinityPreset "hard" }}
|
||||
{{- include "affinities.pods.hard" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a soft podAntiAffinity definition
|
||||
*/}}
|
||||
{{- define "affinities.pods.soft" -}}
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels: {{- (include "aralez.selectorLabels" .) | nindent 12 }}
|
||||
namespaces:
|
||||
- {{ .Release.Namespace | quote }}
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a hard podAntiAffinity definition
|
||||
*/}}
|
||||
{{- define "affinities.pods.hard" -}}
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels: {{- (include "aralez.selectorLabels" .) | nindent 10 }}
|
||||
namespaces:
|
||||
- {{ .Release.Namespace | quote }}
|
||||
topologyKey: kubernetes.io/hostname
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "aralez.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "aralez.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- $ca := genCA .Chart.Name 3650 }}
|
||||
{{- $server := genSignedCert "server" (list "127.0.0.1") nil 3650 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "aralez.fullname" . }}-tls
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 4 }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
{{- $secretName := printf "%s-tls" (include "aralez.fullname" .) }}
|
||||
{{- $secretData := (lookup "v1" "Secret" .Release.Namespace $secretName).data }}
|
||||
{{- if and $secretData (hasKey $secretData "ca.crt") }}
|
||||
ca.crt: {{ get $secretData "ca.crt" }}
|
||||
tls.crt: {{ get $secretData "tls.crt" }}
|
||||
tls.key: {{ get $secretData "tls.key" }}
|
||||
{{- else }}
|
||||
ca.crt: {{ $ca.Cert | b64enc }}
|
||||
tls.crt: {{ $server.Cert | b64enc }}
|
||||
tls.key: {{ $server.Key | b64enc }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "aralez.fullname" . }}
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 4 }}
|
||||
data:
|
||||
aralez.yaml: |
|
||||
daemon: false
|
||||
upstreams_conf: /etc/aralez/upstreams.yaml
|
||||
proxy_configs: /etc/aralez-proxy
|
||||
proxy_address_http: "0.0.0.0:{{ .Values.hostPort.ports.http }}"
|
||||
proxy_address_tls: "0.0.0.0:{{ .Values.hostPort.ports.https }}"
|
||||
config_api_enabled: false
|
||||
config_address: "0.0.0.0:3000"
|
||||
upgrade_sock: /tmp/aralez.sock
|
||||
pid_file: /tmp/aralez.pid
|
||||
log_level: debug
|
||||
hc_method: HEAD
|
||||
hc_interval: 5
|
||||
|
||||
upstreams.yaml: |
|
||||
provider: "kubernetes"
|
||||
sticky_sessions: 172000
|
||||
kubernetes: {}
|
||||
{{- with .Values.upstreams }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,130 @@
|
||||
apiVersion: apps/v1
|
||||
{{- if .Values.useDaemonSet }}
|
||||
kind: DaemonSet
|
||||
{{- else }}
|
||||
kind: Deployment
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ include "aralez.fullname" . }}
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if not (or .Values.autoscaling.enabled .Values.useDaemonSet) }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
{{- if not .Values.useDaemonSet }}
|
||||
strategy:
|
||||
type: {{ .Values.updateStrategy.type }}
|
||||
{{- else }}
|
||||
updateStrategy:
|
||||
type: {{ .Values.updateStrategy.type }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "aralez.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
{{- if .Values.upstreams }}
|
||||
checksum/upstreams: {{ toJson .Values.upstreams | sha256sum }}
|
||||
{{- end }}
|
||||
spec:
|
||||
enableServiceLinks: false
|
||||
{{- if and .Values.hostNetwork .Values.useDaemonSet }}
|
||||
hostNetwork: {{ .Values.hostNetwork }}
|
||||
dnsPolicy: "ClusterFirstWithHostNet"
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "aralez.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- if .Values.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ["aralez"]
|
||||
args:
|
||||
- --conf=/etc/aralez/aralez.yaml
|
||||
{{- range $value := .Values.args }}
|
||||
- {{ $value }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- with .Values.env }}
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
{{- if .Values.hostPort.ports.http }}
|
||||
- name: http
|
||||
containerPort: {{ .Values.hostPort.ports.http }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if .Values.hostPort.ports.https }}
|
||||
- name: https
|
||||
containerPort: {{ .Values.hostPort.ports.https }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
# readinessProbe:
|
||||
# httpGet:
|
||||
# path: /status
|
||||
# port: 3000
|
||||
# initialDelaySeconds: 30
|
||||
# timeoutSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/aralez
|
||||
- name: tlscerts
|
||||
mountPath: /etc/aralez-proxy/certificates
|
||||
{{- with .Values.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "aralez.fullname" . }}
|
||||
- name: tlscerts
|
||||
secret:
|
||||
secretName: {{ include "aralez.fullname" . }}-tls
|
||||
defaultMode: 256
|
||||
items:
|
||||
- key: tls.crt
|
||||
path: tls.crt
|
||||
- key: tls.key
|
||||
path: tls.key
|
||||
{{- with .Values.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
affinity:
|
||||
{{- include "affinities.pods" . | nindent 8 }}
|
||||
{{- with .Values.affinity }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- if and .Values.autoscaling.enabled (not .Values.useDaemonSet) }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "aralez.fullname" . }}
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "aralez.fullname" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,10 @@
|
||||
{{- if .Values.ingressClassResource.enabled -}}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: IngressClass
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 4 }}
|
||||
name: {{ .Values.ingressClass }}
|
||||
spec:
|
||||
controller: {{ .Values.ingressClassResource.controllerValue }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,41 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "aralez.fullname" . }}
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 4 }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- if eq .Values.service.type "NodePort" }}
|
||||
externalTrafficPolicy: Local
|
||||
{{- end }}
|
||||
{{- with .Values.service.ipFamilies }}
|
||||
ipFamilies:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
ipFamilyPolicy: {{ if eq (len .Values.service.ipFamilies) 2 }}PreferDualStack{{ else }}SingleStack{{ end }}
|
||||
ports:
|
||||
{{- if .Values.hostPort.ports.http }}
|
||||
- port: 80
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
{{- if .Values.hostPort.enabled }}
|
||||
nodePort: {{ .Values.hostPort.ports.http }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostPort.ports.https }}
|
||||
- port: 443
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
name: https
|
||||
{{- if .Values.hostPort.enabled }}
|
||||
nodePort: {{ .Values.hostPort.ports.https }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "aralez.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,52 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "aralez.serviceAccountName" . }}
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: true
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "aralez.fullname" . }}
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes", "services", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "aralez.fullname" . }}
|
||||
labels:
|
||||
{{- include "aralez.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "aralez.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "aralez.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,164 @@
|
||||
# Default values for aralez.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
repository: ghcr.io/sadoyan/aralez
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
tag: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
# -- Environment variables
|
||||
env: []
|
||||
|
||||
# -- Aralez arguments
|
||||
args: []
|
||||
|
||||
# -- Aralez upstreams file body
|
||||
# refs: https://aralez.rs/docs/kubernetes/
|
||||
upstreams:
|
||||
rate_limit: 500000
|
||||
x4xx_limit: 100000
|
||||
to_https: true
|
||||
server_headers:
|
||||
- "X-Forwarded-Proto:https"
|
||||
- "X-Forwarded-Port:443"
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
# -- Annotations for pod.
|
||||
# ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
|
||||
podAnnotations: {}
|
||||
# cluster-autoscaler.kubernetes.io/safe-to-evict: "false"
|
||||
|
||||
# -- Extra labels for pod.
|
||||
# ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
|
||||
podLabels: {}
|
||||
|
||||
# -- Pod Security Context.
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 9999
|
||||
runAsGroup: 9999
|
||||
fsGroup: 9999
|
||||
fsGroupChangePolicy: "OnRootMismatch"
|
||||
|
||||
# -- Container Security Context.
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
|
||||
# -- Pod host network
|
||||
# Use it only for performance reason
|
||||
hostNetwork: false
|
||||
|
||||
# -- Service node port
|
||||
# refs: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
|
||||
hostPort:
|
||||
enabled: false
|
||||
ports:
|
||||
http: 8080
|
||||
https: 8443
|
||||
|
||||
ingressClass: aralez
|
||||
ingressClassResource:
|
||||
enabled: true
|
||||
controllerValue: aralez.proxy/ingress-controller
|
||||
|
||||
# -- Bitwarden service parameters
|
||||
# ref: https://kubernetes.io/docs/user-guide/services/
|
||||
service:
|
||||
# -- service type
|
||||
type: ClusterIP
|
||||
|
||||
annotations: {}
|
||||
|
||||
# -- IP families for service
|
||||
# possible values: IPv4, IPv6
|
||||
# ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/
|
||||
ipFamilies: [IPv4]
|
||||
|
||||
# -- Resource requests and limits.
|
||||
# ref: https://kubernetes.io/docs/user-guide/compute-resources/
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
# -- Horizontal and Vertical pod autoscaler.
|
||||
# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
|
||||
autoscaling:
|
||||
enabled: false
|
||||
|
||||
minReplicas: 1
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 80
|
||||
|
||||
# -- Use a daemonset instead of a deployment
|
||||
useDaemonSet: false
|
||||
|
||||
# -- The time in seconds that is allowed for a Aralez instance to gracefully shutdown
|
||||
# ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks
|
||||
terminationGracePeriodSeconds: 120
|
||||
|
||||
## updateStrategy for PostgreSQL StatefulSet and its slaves StatefulSets
|
||||
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
|
||||
# -- Priority Class Name
|
||||
# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass
|
||||
priorityClassName: ""
|
||||
|
||||
# Additional volumes on the output Deployment definition.
|
||||
volumes: []
|
||||
# - name: foo
|
||||
# secret:
|
||||
# secretName: mysecret
|
||||
# optional: false
|
||||
|
||||
# Additional volumeMounts on the output Deployment definition.
|
||||
volumeMounts: []
|
||||
# - name: foo
|
||||
# mountPath: "/etc/foo"
|
||||
# readOnly: true
|
||||
|
||||
# -- Node labels for pod assignment.
|
||||
# ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
nodeSelector: {}
|
||||
|
||||
# -- Tolerations for pod assignment.
|
||||
# ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
tolerations: []
|
||||
|
||||
# -- Pod Anti Affinity
|
||||
# soft/hard
|
||||
podAntiAffinityPreset: soft
|
||||
|
||||
# -- Affinity for pod assignment.
|
||||
# ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
affinity: {}
|
||||
Reference in New Issue
Block a user