jklein
9d22b3b921
- Rename all resources from <chart>-<release>-uv-<kind> to the repo standard <release>-<chart>-<kind> (deployment, service, ingress, both OnePasswordItem secrets); drop the uv infix. No PVCs in this chart, so no storage migration is needed. - TLS secret renamed to the standard tls-<release>-<chart>-ingress (was tls-<chart>-<release>-ingress). - Probes lifted into values (urlaubsverwaltung.livenessProbe/ readinessProbe/startupProbe); defaults are exactly the previously hardcoded, issue-#9-calibrated settings. - Repo-standard flexible ingress: ingress.className (default nginx), ingress.annotations merged with the cert-manager annotation, ingress.enabled flag; domain/clusterIssuer stay required. - Additive urlaubsverwaltung.env block rendered through tpl with value/secretKeyRef/configMapKeyRef forms. - CI fixtures updated to the new secret names. Major bump 4.1.2+up6.7.0 -> 5.0.0+up6.7.0 (resource renames).
142 lines
3.1 KiB
YAML
142 lines
3.1 KiB
YAML
# Fixtures for the urlaubsverwaltung install-test: throwaway postgres, a dex
|
|
# OIDC provider (Spring performs OIDC discovery against the issuer at boot)
|
|
# and the secrets the 1Password operator would otherwise materialize.
|
|
# Note: secrets are named <release>-<chart>-..., release name is ci.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-urlaubsverwaltung-db-secret
|
|
stringData:
|
|
jdbc-url: jdbc:postgresql://postgres:5432/urlaubsverwaltung
|
|
username: ci
|
|
password: ci
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-urlaubsverwaltung-oidc-secret
|
|
stringData:
|
|
client-id: ci-client
|
|
client-secret: ci-client-secret
|
|
issuer-name: CI
|
|
redirect-uri: https://uv.ci.local/login/oauth2/code/default
|
|
issuer-uri: http://dex.default.svc.cluster.local:5556/dex
|
|
jwt-issuer-uri: http://dex.default.svc.cluster.local:5556/dex
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: postgres
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: postgres
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: public.ecr.aws/docker/library/postgres:16-alpine
|
|
env:
|
|
- name: POSTGRES_USER
|
|
value: ci
|
|
- name: POSTGRES_PASSWORD
|
|
value: ci
|
|
- name: POSTGRES_DB
|
|
value: urlaubsverwaltung
|
|
ports:
|
|
- containerPort: 5432
|
|
readinessProbe:
|
|
exec:
|
|
command: ["pg_isready", "-U", "ci"]
|
|
periodSeconds: 5
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/postgresql/data
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: postgres
|
|
spec:
|
|
selector:
|
|
app: postgres
|
|
ports:
|
|
- port: 5432
|
|
targetPort: 5432
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: dex-config
|
|
data:
|
|
config.yaml: |
|
|
issuer: http://dex.default.svc.cluster.local:5556/dex
|
|
storage:
|
|
type: memory
|
|
web:
|
|
http: 0.0.0.0:5556
|
|
oauth2:
|
|
skipApprovalScreen: true
|
|
staticClients:
|
|
- id: ci-client
|
|
secret: ci-client-secret
|
|
name: CI Client
|
|
redirectURIs:
|
|
- https://uv.ci.local/login/oauth2/code/default
|
|
enablePasswordDB: true
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: dex
|
|
labels:
|
|
app: dex
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: dex
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: dex
|
|
spec:
|
|
containers:
|
|
- name: dex
|
|
image: ghcr.io/dexidp/dex:v2.41.1
|
|
command: ["dex", "serve", "/etc/dex/cfg/config.yaml"]
|
|
ports:
|
|
- containerPort: 5556
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /dex/healthz
|
|
port: 5556
|
|
periodSeconds: 5
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/dex/cfg
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: dex-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: dex
|
|
spec:
|
|
selector:
|
|
app: dex
|
|
ports:
|
|
- port: 5556
|
|
targetPort: 5556
|