jklein
999e7533ae
Batch-3 major PR for teamspeak-server (issue #32): - Rename service and StatefulSet to the repo naming scheme ({{ .Release.Name }}-{{ .Chart.Name }}-service / -sfs); the PVC keeps its historical name (documented naming exception, data preservation). - NodePorts configurable via server.voicePort / server.fileTransferPort (defaults 30987/30033, satisfactory pattern); ports are also passed to the server via TSSERVER_DEFAULT_PORT / TSSERVER_FILE_TRANSFER_PORT. - Hardened, values-configurable security contexts (securityContext.pod/container): non-root uid/gid 9987, readOnlyRootFilesystem, all capabilities dropped. - Probes values-configurable (defaults unchanged). - Additive env value rendered through tpl (value/secretKeyRef/ configMapKeyRef forms). - Chart 3.1.2 -> 4.0.0 (+up6.0.0.beta12.1).
92 lines
2.8 KiB
YAML
92 lines
2.8 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
|
|
server:
|
|
# UDP voice port and TCP file transfer port. Each value is used as the
|
|
# container port, the service port and the NodePort, and is passed to the
|
|
# server via TSSERVER_DEFAULT_PORT / TSSERVER_FILE_TRANSFER_PORT so the
|
|
# server always listens on the exposed port (file transfer requires the
|
|
# in-container port to match the externally reachable port).
|
|
voicePort: 30987
|
|
fileTransferPort: 30033
|
|
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.2
|
|
memory: 100Mi
|
|
ephemeral-storage: 100Mi
|
|
|
|
# Extra environment variables for the server container, appended to the ones
|
|
# the chart always sets (TSSERVER_LICENSE_ACCEPTED, TSSERVER_DEFAULT_PORT,
|
|
# TSSERVER_FILE_TRANSFER_PORT). Values are rendered through tpl and support
|
|
# the value, secretKeyRef and configMapKeyRef forms:
|
|
# - name: SOME_ENV
|
|
# value: "{{ .Release.Name }}"
|
|
# - name: FROM_SECRET
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: "some-secret"
|
|
# key: "someKey"
|
|
# - name: FROM_CONFIGMAP
|
|
# valueFrom:
|
|
# configMapKeyRef:
|
|
# name: "some-configmap"
|
|
# key: "someKey"
|
|
env: []
|
|
|
|
livenessProbe:
|
|
# The voice service is UDP and cannot be probed; probe the TCP
|
|
# file-transfer port instead.
|
|
tcpSocket:
|
|
port: file-transfer
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: file-transfer
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness, so those need no
|
|
# initialDelaySeconds. Startup budget = periodSeconds * failureThreshold = 150s.
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: file-transfer
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
# The teamspeak6-server image runs as the non-root user "teamspeak"
|
|
# (uid/gid 9987); fsGroup 9987 keeps the data volume writable.
|
|
runAsUser: 9987
|
|
runAsGroup: 9987
|
|
fsGroup: 9987
|
|
fsGroupChangePolicy: Always
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add: []
|
|
|
|
storage:
|
|
size: 25Gi
|
|
storageClass: longhorn
|