jklein
edb0837246
The deployment renders SMTP_REJECT_UNAUTHORIZED from rallly.smtp.rejectUnauthorized, but values.yaml never carried the key. With SMTP enabled the variable therefore reached the app as an empty string -- a certificate check nobody had configured either way. It now defaults to true, so the mail server's certificate is verified unless the operator switches the check off deliberately. values.yaml explains when that is needed (a mail server with a self-signed certificate), because the symptom otherwise points at the mail server rather than at this value. The env var is not rendered with "| default true": an explicit false is a zero value and default would swallow it, silently re-enabling the check the operator just switched off. A nil falls back to true instead, so the variable can no longer reach the app empty. The schema now rejects strings. Operationally inert: the rallly fleet bundle and the deployed release both have smtp.enabled: false, so the variable is not rendered at all -- the render with SMTP disabled is byte-identical to before. Major, because the runtime behaviour of mail sending changes. Fixes #109
177 lines
7.7 KiB
YAML
177 lines
7.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
spec:
|
|
replicas: {{ include "rallly.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.rallly.replicas) }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
template:
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- include "rallly.podSecurityContext" .Values.rallly.securityContext | nindent 8 }}
|
|
containers:
|
|
- name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
image: "lukevella/rallly:{{ .Chart.AppVersion }}"
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
# ingress.domain is not a pure Ingress value: it is also the app's
|
|
# public base URL, so it stays required even when the Ingress is
|
|
# switched off (an empty value would render "https://" and break
|
|
# every generated link silently).
|
|
- name: NEXT_PUBLIC_BASE_URL
|
|
value: "https://{{ required "A Domain/Host must be provided (ingress.domain)" .Values.ingress.domain }}"
|
|
- name: SECRET_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
|
|
key: secret-key
|
|
- name: SUPPORT_EMAIL
|
|
value: "{{ required "A Support-Email must be provided" .Values.rallly.supportEmail }}"
|
|
{{- if .Values.rallly.smtp.enabled }}
|
|
- name: NOREPLY_EMAIL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret
|
|
key: no-reply-email
|
|
- name: NOREPLY_EMAIL_NAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret
|
|
key: no-reply-email-name
|
|
- name: SMTP_HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret
|
|
key: host
|
|
- name: SMTP_PORT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret
|
|
key: port
|
|
- name: SMTP_SECURE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret
|
|
key: secure
|
|
- name: SMTP_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret
|
|
key: user
|
|
- name: SMTP_PWD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret
|
|
key: password
|
|
- name: SMTP_REJECT_UNAUTHORIZED
|
|
{{- /* Not "| default true": an explicit false is a zero value, and
|
|
"default" would swallow it and silently re-enable the check
|
|
the operator just switched off. A nil (erased key) falls back
|
|
to the chart default true, so the variable can never reach
|
|
the app as an empty string (issues #109, #99). */}}
|
|
value: "{{ if kindIs "invalid" .Values.rallly.smtp.rejectUnauthorized }}true{{ else }}{{ .Values.rallly.smtp.rejectUnauthorized }}{{ end }}"
|
|
- name: SMTP_TLS_SERVERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-smtp-secret
|
|
key: tls-servername
|
|
{{- end }}
|
|
- name: EMAIL_LOGIN_ENABLED
|
|
value: "false"
|
|
- name: REGISTRATION_ENABLED
|
|
value: "false"
|
|
- name: OIDC_NAME
|
|
value: "{{ .Values.rallly.oidc.name }}"
|
|
- name: OIDC_NAME_CLAIM_PATH
|
|
value: "{{ .Values.rallly.oidc.nameClaimPath }}"
|
|
- name: OIDC_EMAIL_CLAIM_PATH
|
|
value: "{{ .Values.rallly.oidc.emailClaimPath }}"
|
|
- name: OIDC_PICTURE_CLAIM_PATH
|
|
value: "{{ .Values.rallly.oidc.pictureClaimPath }}"
|
|
- name: OIDC_DISCOVERY_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
|
|
key: discovery-url
|
|
- name: OIDC_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
|
|
key: client-id
|
|
- name: OIDC_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret
|
|
key: client-secret
|
|
- name: ALLOWED_EMAILS
|
|
value: "{{ .Values.rallly.allowedEmails }}"
|
|
- name: INITIAL_ADMIN_EMAIL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-secret
|
|
key: initial-admin-email
|
|
- name: DATABASE_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-database-secret
|
|
key: database-url
|
|
# TODO: Add Storage Configuration
|
|
{{- range $value := .Values.rallly.env }}
|
|
{{- if $value.value }}
|
|
- name: {{ $value.name }}
|
|
value: {{ tpl $value.value $ }}
|
|
{{- else if $value.valueFrom }}
|
|
{{- if $value.valueFrom.secretKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
|
|
{{- else if $value.valueFrom.configMapKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
ports:
|
|
- containerPort: 3000
|
|
protocol: TCP
|
|
name: http
|
|
livenessProbe:
|
|
{{- include "rallly.livenessProbe" .Values.rallly.livenessProbe | nindent 12 }}
|
|
readinessProbe:
|
|
{{- include "rallly.readinessProbe" .Values.rallly.readinessProbe | nindent 12 }}
|
|
startupProbe:
|
|
{{- include "rallly.startupProbe" .Values.rallly.startupProbe | nindent 12 }}
|
|
resources:
|
|
{{- include "rallly.effectiveResources" .Values.rallly.resources | nindent 12 }}
|
|
securityContext:
|
|
{{- include "rallly.containerSecurityContext" .Values.rallly.securityContext | nindent 12 }}
|
|
volumeMounts:
|
|
# Next.js writes prerendered pages and optimized images into its
|
|
# cache directory; with a read-only root filesystem this must be a
|
|
# writable volume (see rallly.cache in values.yaml).
|
|
- name: next-cache
|
|
mountPath: {{ required "A cache path must be provided (rallly.cache.path)" .Values.rallly.cache.path | quote }}
|
|
volumes:
|
|
- name: next-cache
|
|
{{- if .Values.rallly.cache.sizeLimit }}
|
|
emptyDir:
|
|
sizeLimit: {{ .Values.rallly.cache.sizeLimit | quote }}
|
|
{{- else }}
|
|
emptyDir: {}
|
|
{{- end }}
|
|
restartPolicy: Always
|