jklein
232ecdfa05
samba.globalConfig has been part of values.yaml since the chart's first commit but is read by no template. Setting it never had an effect. Rather than implement it, the key is removed and the strict schema now rejects it: additionalProperties is already false on the samba object, so dropping the property turns a silently ignored key into a render-time error. Operationally inert: neither the cluster-smb fleet bundle nor the deployed release's user-supplied values set the key -- it only ever appeared as the chart's own null default. Major, because a published value disappears and is now rejected. Fixes #117
99 lines
3.6 KiB
YAML
99 lines
3.6 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
secrets:
|
|
# users.conf is mounted into the samba container from the Secret the 1Password
|
|
# operator materializes from this item.
|
|
#
|
|
# Known limitation (#82): changing the item in the vault does NOT restart
|
|
# samba, so added, removed or re-passworded users stay invisible to the
|
|
# running smbd. Helm cannot hash the content (it never sees it - the operator
|
|
# fills the Secret in-cluster after rendering), so the checksum/config
|
|
# mechanism used for smb.conf does not apply here. The operator's own
|
|
# "operator.1password.io/auto-restart" annotation is no help either: it only
|
|
# ever restarts Deployments, and this workload is a StatefulSet (verified
|
|
# against onepassword-operator 1.12.0). After changing the users item,
|
|
# restart samba by hand:
|
|
# kubectl rollout restart statefulset <release>-samba-sfs
|
|
sambaUsersSecretRef: null
|
|
|
|
samba:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
# NodePorts the SMB service is published on (service type NodePort).
|
|
smbNodePort: 30445
|
|
netbiosNodePort: 30139
|
|
shares:
|
|
- name: null
|
|
validUsers: null
|
|
description: null
|
|
size: null
|
|
# Extra environment variables for the samba container. Values are rendered
|
|
# through tpl; value, secretKeyRef and configMapKeyRef forms are supported.
|
|
env: []
|
|
# SMB is not an HTTP protocol, so probe the main SMB TCP port.
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: 445
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
memory: 50Mi
|
|
cpu: 0.1
|
|
ephemeralStorage: 50Mi
|
|
|
|
# Deviations from the repo's hardening baseline, forced by the
|
|
# ghcr.io/dockur/samba image (its entrypoint samba.sh):
|
|
# - no runAsNonRoot: the entrypoint creates the Unix users from users.conf
|
|
# (groupadd/adduser/usermod) and smbd impersonates the authenticated
|
|
# share user per session, both of which require starting as root.
|
|
# - readOnlyRootFilesystem: false: the entrypoint writes to the root
|
|
# filesystem at startup (/etc/passwd + /etc/group for user creation,
|
|
# the /etc/samba.conf healthcheck symlink, mkdir /shared and the Samba
|
|
# TDB databases under /var/lib/samba).
|
|
# - capabilities: ALL dropped except what a multi-user root file server
|
|
# needs: NET_BIND_SERVICE (ports 445/139), SETUID/SETGID (per-session
|
|
# user impersonation), CHOWN/FOWNER/DAC_OVERRIDE (managing share files
|
|
# on behalf of the users).
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 1000
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
- CHOWN
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- NET_BIND_SERVICE
|
|
- SETGID
|
|
- SETUID
|
|
|
|
storageClass: longhorn
|