Paperless-ngx chart: naming scheme, secret refs, pinned init images (conventions batch 3)
Batch-3 major PR for paperless-ngx (issue #32): - secrets.redisRef/databaseRef/paperlessRef -> redisSecretRef/ databaseSecretRef/paperlessSecretRef (consistent with the other SecretRef values in the same block); CI fixtures updated - TLS secret renamed to the standard tls-<release>-<chart>-ingress (domain no longer part of the name) - busybox init/cronjob image pinned via paperless.busybox.image values, default bumped 1.28 -> 1.38.0 - probes values-configurable (defaults unchanged, incl. the 600s startup budget); consume CronJob deliberately stays probe-less - ingress standard: ingress.className (default nginx) and ingress.annotations merge; domain/clusterIssuer stay required - additive paperless.env block rendered through tpl (value, secretKeyRef, configMapKeyRef forms) - disabled scripts ConfigMap renamed to ...-configmap; PVC names kept as documented naming-scheme exception (comments in the templates) - chart 8.0.1+up3.0.5 -> 9.0.0+up3.0.5 (breaking values changes)
This commit is contained in:
13 files changed
+93
-40
No files matched your search
@@ -3,4 +3,4 @@ kind: OnePasswordItem
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
|
||||
spec:
|
||||
itemPath: {{ required "A secret-reference for the DB-Secret must be provided" .Values.secrets.databaseRef }}
|
||||
itemPath: {{ required "A secret-reference for the DB-Secret must be provided" .Values.secrets.databaseSecretRef }}
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
{{- toYaml .Values.smbConnection.cron.securityContext.pod | nindent 12 }}
|
||||
containers:
|
||||
- name: paperless-consume-cronjob
|
||||
image: busybox:1.28
|
||||
image: "{{ .Values.paperless.busybox.image.repository }}:{{ .Values.paperless.busybox.image.tag }}"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
{{- toYaml .Values.smbConnection.cron.securityContext.container | nindent 16 }}
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
# Documented exception from the "-<kind>" naming scheme (issue #32):
|
||||
# renaming a PVC would provision a new, empty volume, so the historic
|
||||
# "-consume-volume-claim" name stays.
|
||||
name: {{ .Release.Name }}-{{ .Chart.Name }}-consume-volume-claim
|
||||
spec:
|
||||
accessModes:
|
||||
|
||||
@@ -3,4 +3,4 @@ kind: OnePasswordItem
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
|
||||
spec:
|
||||
itemPath: {{ required "A secret-reference for the Paperless-Secret must be provided" .Values.secrets.paperlessRef }}
|
||||
itemPath: {{ required "A secret-reference for the Paperless-Secret must be provided" .Values.secrets.paperlessSecretRef }}
|
||||
@@ -26,7 +26,7 @@ spec:
|
||||
# paperless.securityContext in values.yaml) so the main container can
|
||||
# run fully hardened (non-root, no privilege escalation).
|
||||
- name: init-run-ownership
|
||||
image: busybox:1.28
|
||||
image: "{{ .Values.paperless.busybox.image.repository }}:{{ .Values.paperless.busybox.image.tag }}"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- sh
|
||||
@@ -185,6 +185,26 @@ spec:
|
||||
- name: PAPERLESS_DISABLE_REGULAR_LOGIN
|
||||
value: "{{ .Values.oidc.disableRegularLogin }}"
|
||||
{{- end }}
|
||||
{{- range $value := .Values.paperless.env }}
|
||||
{{- if $value.value }}
|
||||
- name: {{ $value.name }}
|
||||
value: {{ tpl $value.value $ }}
|
||||
{{- else if $value.valueFrom }}
|
||||
{{- if $value.valueFrom.secretKeyRef }}
|
||||
- name: {{ $value.name }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
|
||||
key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
|
||||
{{- else if $value.valueFrom.configMapKeyRef }}
|
||||
- name: {{ $value.name }}
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
|
||||
key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: "/usr/src/paperless/data"
|
||||
name: "paperless-volume"
|
||||
@@ -206,32 +226,11 @@ spec:
|
||||
resources:
|
||||
{{- include "paperless-ngx.resources" .Values.paperless.resources | nindent 12 }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8000
|
||||
periodSeconds: 10
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
{{- toYaml .Values.paperless.readinessProbe | nindent 12 }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8000
|
||||
periodSeconds: 30
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
# The startup probe gates liveness/readiness. Paperless runs database
|
||||
# migrations on startup, and since 3.0 the first start after an
|
||||
# upgrade also rebuilds the search index from scratch (Whoosh ->
|
||||
# Tantivy): budget 10s * 60 = 600s.
|
||||
{{- toYaml .Values.paperless.livenessProbe | nindent 12 }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8000
|
||||
periodSeconds: 10
|
||||
failureThreshold: 60
|
||||
timeoutSeconds: 5
|
||||
{{- toYaml .Values.paperless.startupProbe | nindent 12 }}
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: tmp
|
||||
|
||||
@@ -2,6 +2,9 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
# Documented exception from the "-<kind>" naming scheme (issue #32):
|
||||
# renaming a PVC would provision a new, empty volume, so the historic
|
||||
# "-smb-volume-claim" name stays.
|
||||
name: {{ .Release.Name }}-{{ .Chart.Name }}-smb-volume-claim
|
||||
spec:
|
||||
accessModes:
|
||||
|
||||
@@ -3,11 +3,14 @@ kind: Ingress
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}}
|
||||
cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.paperless.files.maxUploadFileSize }}
|
||||
nginx.org/client-max-body-size: {{ .Values.paperless.files.maxUploadFileSize }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
rules:
|
||||
- host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
|
||||
http:
|
||||
@@ -22,4 +25,4 @@ spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
|
||||
secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-{{ .Values.ingress.domain }}-ingress
|
||||
secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress
|
||||
@@ -1,6 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
# Documented exception from the "-<kind>" naming scheme (issue #32):
|
||||
# renaming a PVC would provision a new, empty volume, so the historic
|
||||
# "-volume-claim" name stays.
|
||||
name: {{ .Release.Name }}-{{ .Chart.Name }}-volume-claim
|
||||
spec:
|
||||
accessModes:
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-{{ .Chart.Name }}-pre-post-consumption-scripts
|
||||
name: {{ .Release.Name }}-{{ .Chart.Name }}-pre-post-consumption-scripts-configmap
|
||||
data:
|
||||
pre-consume-script: |-
|
||||
#!/bin/sh
|
||||
|
||||
@@ -3,4 +3,4 @@ kind: OnePasswordItem
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-{{ .Chart.Name }}-redis-secret
|
||||
spec:
|
||||
itemPath: {{ required "A secret-reference for the Redis-Secret must be provided" .Values.secrets.redisRef }}
|
||||
itemPath: {{ required "A secret-reference for the Redis-Secret must be provided" .Values.secrets.redisSecretRef }}
|
||||
Reference in new issue
Block a user