From bf49c744f19e251160dedac58d41a9e1205fe36c Mon Sep 17 00:00:00 2001 From: jklein Date: Sat, 22 Aug 2026 16:00:02 +0200 Subject: [PATCH] Align rallly chart with repo conventions (batch 3) - Rename the Deployment (and its labels/selector/pod template/container) to {{ .Release.Name }}-{{ .Chart.Name }}-deployment per the naming scheme; the Service selector follows. - Move the hardcoded pod/container security contexts into values (rallly.securityContext.pod / .container), defaults unchanged; the bogus null entry under capabilities.add becomes an empty list. - Ingress standard: ingress.className value (default nginx) and ingress.annotations merged with the cert-manager annotation; domain/clusterIssuer stay required, TLS secret name already conformed. - Add the tpl-rendered rallly.env value (value/secretKeyRef/ configMapKeyRef forms), appended to the built-in env. - Major bump 3.1.2+up4.12.3 -> 4.0.0+up4.12.3 (deployment rename replaces the Deployment on upgrade: selector is immutable). --- rallly/Chart.yaml | 2 +- rallly/templates/rallly.deployment.yaml | 47 +++++++++++++++---------- rallly/templates/rallly.ingress.yaml | 7 ++-- rallly/templates/rallly.service.yaml | 2 +- rallly/values.yaml | 23 ++++++++++++ 5 files changed, 58 insertions(+), 23 deletions(-) diff --git a/rallly/Chart.yaml b/rallly/Chart.yaml index f713931..6f856dc 100644 --- a/rallly/Chart.yaml +++ b/rallly/Chart.yaml @@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/lukevella/rallly/main/apps/landing/publi type: application -version: 3.1.2+up4.12.3 +version: 4.0.0+up4.12.3 appVersion: "4.12.3" maintainers: diff --git a/rallly/templates/rallly.deployment.yaml b/rallly/templates/rallly.deployment.yaml index d9ef0a6..339a070 100644 --- a/rallly/templates/rallly.deployment.yaml +++ b/rallly/templates/rallly.deployment.yaml @@ -1,29 +1,25 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }} + name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment labels: - app: {{ .Release.Name }}-{{ .Chart.Name }} + app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment spec: replicas: {{ include "rallly.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.rallly.replicas) }} selector: matchLabels: - app: {{ .Release.Name }}-{{ .Chart.Name }} + app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment template: metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }} + name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment labels: - app: {{ .Release.Name }}-{{ .Chart.Name }} + app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment spec: automountServiceAccountToken: false securityContext: - runAsNonRoot: true - runAsUser: 20000 - runAsGroup: 1000 - fsGroup: 1000 - fsGroupChangePolicy: Always + {{- toYaml .Values.rallly.securityContext.pod | nindent 8 }} containers: - - name: {{ .Release.Name }}-{{ .Chart.Name }} + - name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment image: "lukevella/rallly:{{ .Chart.AppVersion }}" imagePullPolicy: IfNotPresent env: @@ -120,6 +116,26 @@ spec: name: {{ .Release.Name }}-{{ .Chart.Name }}-database-secret key: database-url # TODO: Add Storage Configuration + {{- range $value := .Values.rallly.env }} + {{- if $value.value }} + - name: {{ $value.name }} + value: {{ tpl $value.value $ }} + {{- else if $value.valueFrom }} + {{- if $value.valueFrom.secretKeyRef }} + - name: {{ $value.name }} + valueFrom: + secretKeyRef: + name: {{ tpl $value.valueFrom.secretKeyRef.name $ }} + key: {{ tpl $value.valueFrom.secretKeyRef.key $ }} + {{- else if $value.valueFrom.configMapKeyRef }} + - name: {{ $value.name }} + valueFrom: + configMapKeyRef: + name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }} + key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }} + {{- end }} + {{- end }} + {{- end }} ports: - containerPort: 3000 protocol: TCP @@ -133,12 +149,5 @@ spec: resources: {{- include "rallly.resources" .Values.rallly.resources | nindent 12 }} securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - add: - - + {{- toYaml .Values.rallly.securityContext.container | nindent 12 }} restartPolicy: Always diff --git a/rallly/templates/rallly.ingress.yaml b/rallly/templates/rallly.ingress.yaml index b4c33cc..6c22769 100644 --- a/rallly/templates/rallly.ingress.yaml +++ b/rallly/templates/rallly.ingress.yaml @@ -3,9 +3,12 @@ kind: Ingress metadata: name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress annotations: - cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}} + cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }} + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: - ingressClassName: nginx + ingressClassName: {{ .Values.ingress.className }} rules: - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }} http: diff --git a/rallly/templates/rallly.service.yaml b/rallly/templates/rallly.service.yaml index dc281be..4c42512 100644 --- a/rallly/templates/rallly.service.yaml +++ b/rallly/templates/rallly.service.yaml @@ -4,7 +4,7 @@ metadata: name: {{ .Release.Name }}-{{ .Chart.Name }}-service spec: selector: - app: {{ .Release.Name }}-{{ .Chart.Name }} + app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment ports: - protocol: TCP port: 80 diff --git a/rallly/values.yaml b/rallly/values.yaml index 75659ac..a6c3405 100644 --- a/rallly/values.yaml +++ b/rallly/values.yaml @@ -23,6 +23,25 @@ rallly: pictureClaimPath: 'picture' emailClaimPath: 'email' nameClaimPath: 'name' + securityContext: + pod: + runAsNonRoot: true + runAsUser: 20000 + runAsGroup: 1000 + fsGroup: 1000 + fsGroupChangePolicy: Always + container: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + add: [] + # Extra environment variables, appended to the ones the chart always sets. + # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef + # forms are supported. + env: [] resources: # Limits are optional: memory and ephemeral-storage limits default to # limitFactor x the request, an explicitly set limit always wins, and a @@ -59,3 +78,7 @@ rallly: ingress: clusterIssuer: null domain: null + className: nginx + # Extra annotations for the Ingress; merged with the cert-manager + # cluster-issuer annotation the chart always sets. + annotations: {}