From f091c3320543736cf8ff61a7a0fe96759d2f7942 Mon Sep 17 00:00:00 2001 From: jklein Date: Sat, 22 Aug 2026 15:35:09 +0200 Subject: [PATCH] Conventions batch 2: flexible ingress standard, configurable probes Establish the flexible ingress standard from #32 in template-chart and document it in README/CLAUDE.md: ingress.domain and ingress.clusterIssuer stay required, new ingress.className value (default nginx) replaces the hardcoded ingressClassName, new optional ingress.annotations are merged with the cert-manager cluster-issuer annotation, TLS secret name unchanged (tls---ingress). Apply the standard to cyberchef and patchmon (the two charts without an own batch-3 major PR) and make the patchmon probes values-configurable (server + guacd, rendered through tpl so the default Host header keeps following ingress.domain). Defaults render semantically identical to the previous hardcoded output. cyberchef 5.0.1 -> 5.1.0, patchmon 5.0.1 -> 5.1.0 (minor, additive). --- CLAUDE.md | 2 +- README.md | 2 +- cyberchef/Chart.yaml | 2 +- cyberchef/templates/cyberchef.ingress.yaml | 7 ++- cyberchef/values.yaml | 4 ++ patchmon/Chart.yaml | 2 +- patchmon/templates/patchmon.deployment.yaml | 58 +++---------------- patchmon/templates/patchmon.ingress.yaml | 7 ++- patchmon/values.yaml | 63 +++++++++++++++++++++ template-chart/templates/xxx.ingress.yaml | 7 ++- template-chart/values.yaml | 4 ++ 11 files changed, 98 insertions(+), 60 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index abf5954..90fe5c3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -58,7 +58,7 @@ App-version updates go through PRs (so the validate and install-test pipelines r - All resources are named `{{ .Release.Name }}-{{ .Chart.Name }}-` (e.g. `...-deployment`, `...-service`, `...-secret`). - Image tags come from `{{ .Chart.AppVersion }}`. - Secrets are 1Password `OnePasswordItem` CRs: values expose `secrets.SecretRef` holding an `op://` item path; the operator materializes the Kubernetes Secret. -- Ingress assumes `ingressClassName: nginx` and cert-manager: `ingress.clusterIssuer` and `ingress.domain` are `required` values, TLS secret named `tls---ingress`. +- Ingress standard: `ingress.domain` and `ingress.clusterIssuer` (cert-manager) are `required` values; `ingress.className` defaults to `nginx`; optional `ingress.annotations` are merged with the cert-manager annotation; TLS secret named `tls---ingress`. - `env` entries in values support Helm templating — the deployment renders them through `tpl`, and supports `value`, `secretKeyRef`, and `configMapKeyRef` forms. - Hardened defaults: `automountServiceAccountToken: false`, non-root user, `readOnlyRootFilesystem: true`, all capabilities dropped; probes and resource requests/limits always set. Security contexts are values-configurable (`securityContext.pod` / `securityContext.container`); image-forced deviations are documented with a comment in the chart's `values.yaml`. - Stateful apps use a StatefulSet in a `.sfs.yaml` template instead of a deployment. diff --git a/README.md b/README.md index a4a374d..36b816d 100644 --- a/README.md +++ b/README.md @@ -76,7 +76,7 @@ For runtime verification (do the workloads actually start, do probes/security se - Image tags come from `{{ .Chart.AppVersion }}`. - Auxiliary/sidecar images (images other than the app image, currently only the delegation nginx in matrix-synapse) are pinned via values (`.image.repository` / `.image.tag`) instead of being hardcoded in templates, and their pinned versions are reviewed alongside every app-version update round. - Secrets are **1Password `OnePasswordItem` CRs**: values expose `secrets.SecretRef` holding an `op://` item path; the 1Password operator materializes the Kubernetes Secret in-cluster. -- Ingress assumes ingress-nginx (`ingressClassName: nginx`) and cert-manager: `ingress.clusterIssuer` and `ingress.domain` are required values; the TLS secret is named `tls---ingress`. +- Ingress standard: `ingress.domain` and `ingress.clusterIssuer` (cert-manager) are the only required values. `ingress.className` selects the ingress class and defaults to `nginx`; `ingress.annotations` takes optional extra annotations that are merged with the cert-manager `cluster-issuer` annotation the chart always sets. The TLS secret is named `tls---ingress`. (homeassistant deliberately keeps its upstream-style flexible ingress values instead.) - `env` entries in `values.yaml` are rendered through `tpl`, so values may contain Helm templating; `value`, `secretKeyRef` and `configMapKeyRef` forms are supported. - Hardened defaults: `automountServiceAccountToken: false`, non-root user, `readOnlyRootFilesystem: true`, all capabilities dropped, probes and resource requests always set. Pod and container contexts are configurable via `securityContext.pod` / `securityContext.container` in each chart's values; writable paths (e.g. `/tmp`, nginx cache dirs, s6-overlay's `/run`) are emptyDirs. Where an image cannot satisfy the full standard (e.g. Home Assistant must start as root for s6-overlay, paperless needs a root init container to hand over `/run`), the deviation is minimal and justified with a comment in that chart's `values.yaml`. - Resource requests ship as chart defaults and are user-overridable; limits are computed by a per-chart `_helpers.tpl` helper (reference implementation in `template-chart/templates/_helpers.tpl`): an explicitly set limit always wins, missing memory and ephemeral-storage limits default to `resources.limitFactor` × the request (factor default `3`), and a CPU limit is only rendered when set explicitly — otherwise CPU stays unlimited (it is compressible, throttling instead of OOM-killing). The helper is duplicated into every chart because charts have no dependencies. diff --git a/cyberchef/Chart.yaml b/cyberchef/Chart.yaml index 0520b80..7cd0cf0 100644 --- a/cyberchef/Chart.yaml +++ b/cyberchef/Chart.yaml @@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/gchq/CyberChef/master/src/web/static/ima type: application -version: 5.0.1+up11.4.0 +version: 5.1.0+up11.4.0 appVersion: "11.4.0" maintainers: diff --git a/cyberchef/templates/cyberchef.ingress.yaml b/cyberchef/templates/cyberchef.ingress.yaml index b4c33cc..6c22769 100644 --- a/cyberchef/templates/cyberchef.ingress.yaml +++ b/cyberchef/templates/cyberchef.ingress.yaml @@ -3,9 +3,12 @@ kind: Ingress metadata: name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress annotations: - cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}} + cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }} + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: - ingressClassName: nginx + ingressClassName: {{ .Values.ingress.className }} rules: - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }} http: diff --git a/cyberchef/values.yaml b/cyberchef/values.yaml index 188c2cd..2d47606 100644 --- a/cyberchef/values.yaml +++ b/cyberchef/values.yaml @@ -59,3 +59,7 @@ ingress: enabled: true clusterIssuer: letsencrypt domain: null + className: nginx + # Extra annotations for the Ingress; merged with the cert-manager + # cluster-issuer annotation the chart always sets. + annotations: {} diff --git a/patchmon/Chart.yaml b/patchmon/Chart.yaml index 2529c17..229fd99 100644 --- a/patchmon/Chart.yaml +++ b/patchmon/Chart.yaml @@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/PatchMon/PatchMon/main/frontend/public/a type: application -version: 5.0.1+up2.1.3 +version: 5.1.0+up2.1.3 appVersion: "2.1.3" maintainers: diff --git a/patchmon/templates/patchmon.deployment.yaml b/patchmon/templates/patchmon.deployment.yaml index c4ec1cf..669298b 100644 --- a/patchmon/templates/patchmon.deployment.yaml +++ b/patchmon/templates/patchmon.deployment.yaml @@ -143,44 +143,14 @@ spec: - name: GUACD_ADDRESS value: "127.0.0.1:4822" {{- end }} - # The server exposes GET /health returning {"status": "ok"}. The - # 2.x server rejects requests whose Host header is neither loopback - # nor a CORS_ORIGIN host with 403 — kubelet probes target the pod - # IP, so they must send the public hostname as Host header. + # Probe values are rendered through tpl (see values.yaml for the + # defaults and why the probes send a Host header). livenessProbe: - httpGet: - path: /health - port: 3000 - httpHeaders: - - name: Host - value: {{ .Values.ingress.domain }} - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 + {{- tpl (toYaml .Values.patchmon.server.livenessProbe) . | nindent 12 }} readinessProbe: - httpGet: - path: /health - port: 3000 - httpHeaders: - - name: Host - value: {{ .Values.ingress.domain }} - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 - # The startup probe gates liveness/readiness. The server waits for - # the database and runs migrations on startup; upstream warns that - # the first 2.x boot rebuilds database indexes, which can take - # minutes on slow storage: budget 10s * 60 = 600s. + {{- tpl (toYaml .Values.patchmon.server.readinessProbe) . | nindent 12 }} startupProbe: - httpGet: - path: /health - port: 3000 - httpHeaders: - - name: Host - value: {{ .Values.ingress.domain }} - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 60 + {{- tpl (toYaml .Values.patchmon.server.startupProbe) . | nindent 12 }} resources: {{- include "patchmon.resources" .Values.patchmon.server.resources | nindent 12 }} volumeMounts: @@ -199,23 +169,11 @@ spec: protocol: TCP name: guacd livenessProbe: - tcpSocket: - port: 4822 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 + {{- tpl (toYaml .Values.patchmon.guacd.livenessProbe) . | nindent 12 }} readinessProbe: - tcpSocket: - port: 4822 - periodSeconds: 10 - timeoutSeconds: 5 - failureThreshold: 3 + {{- tpl (toYaml .Values.patchmon.guacd.readinessProbe) . | nindent 12 }} startupProbe: - tcpSocket: - port: 4822 - periodSeconds: 5 - timeoutSeconds: 5 - failureThreshold: 30 + {{- tpl (toYaml .Values.patchmon.guacd.startupProbe) . | nindent 12 }} resources: {{- include "patchmon.resources" .Values.patchmon.guacd.resources | nindent 12 }} volumeMounts: diff --git a/patchmon/templates/patchmon.ingress.yaml b/patchmon/templates/patchmon.ingress.yaml index 27561f3..a7de9c6 100644 --- a/patchmon/templates/patchmon.ingress.yaml +++ b/patchmon/templates/patchmon.ingress.yaml @@ -3,9 +3,12 @@ kind: Ingress metadata: name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress annotations: - cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}} + cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }} + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: - ingressClassName: nginx + ingressClassName: {{ .Values.ingress.className }} rules: - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }} http: diff --git a/patchmon/values.yaml b/patchmon/values.yaml index a808888..3423e3d 100644 --- a/patchmon/values.yaml +++ b/patchmon/values.yaml @@ -38,6 +38,45 @@ patchmon: cpu: 0.1 memory: 256Mi ephemeral-storage: 10Mi + # Probes hit GET /health ({"status": "ok"}). The 2.x server rejects + # requests whose Host header is neither loopback nor a CORS_ORIGIN host + # with 403 — kubelet probes target the pod IP, so they must send the + # public hostname as Host header. Probe values are rendered through tpl, + # so the default Host header follows ingress.domain. + livenessProbe: + httpGet: + path: /health + port: 3000 + httpHeaders: + - name: Host + value: "{{ .Values.ingress.domain }}" + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /health + port: 3000 + httpHeaders: + - name: Host + value: "{{ .Values.ingress.domain }}" + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + # The startup probe gates liveness/readiness. The server waits for the + # database and runs migrations on startup; upstream warns that the first + # 2.x boot rebuilds database indexes, which can take minutes on slow + # storage: budget 10s * 60 = 600s. + startupProbe: + httpGet: + path: /health + port: 3000 + httpHeaders: + - name: Host + value: "{{ .Values.ingress.domain }}" + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 60 guacd: # In-browser RDP for Windows hosts (beta) via the Apache Guacamole daemon, # run as a sidecar container in the server pod. Disabled by default; when @@ -67,10 +106,34 @@ patchmon: cpu: 0.05 memory: 64Mi ephemeral-storage: 10Mi + # Probe values are rendered through tpl. + livenessProbe: + tcpSocket: + port: 4822 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + tcpSocket: + port: 4822 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s. + startupProbe: + tcpSocket: + port: 4822 + periodSeconds: 5 + timeoutSeconds: 5 + failureThreshold: 30 ingress: clusterIssuer: null domain: null + className: nginx + # Extra annotations for the Ingress; merged with the cert-manager + # cluster-issuer annotation the chart always sets. + annotations: {} secrets: redisSecretRef: null diff --git a/template-chart/templates/xxx.ingress.yaml b/template-chart/templates/xxx.ingress.yaml index d2227e8..b78b361 100644 --- a/template-chart/templates/xxx.ingress.yaml +++ b/template-chart/templates/xxx.ingress.yaml @@ -4,9 +4,12 @@ kind: Ingress metadata: name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress annotations: - cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer}} + cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }} + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} spec: - ingressClassName: nginx + ingressClassName: {{ .Values.ingress.className }} rules: - host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }} http: diff --git a/template-chart/values.yaml b/template-chart/values.yaml index cf1fa52..61c3207 100644 --- a/template-chart/values.yaml +++ b/template-chart/values.yaml @@ -84,3 +84,7 @@ ingress: enabled: true clusterIssuer: null domain: null + className: nginx + # Extra annotations for the Ingress; merged with the cert-manager + # cluster-issuer annotation the chart always sets. + annotations: {}