jklein
0021becba2
- Values-driven securityContext for the Synapse pod/container with hardened defaults: runAsNonRoot as uid/gid 1000 (matching the image's previous gosu drop target), readOnlyRootFilesystem, allowPrivilegeEscalation false, all capabilities dropped; /tmp mounted as emptyDir. The now-ineffective UID/GID env vars are removed (the securityContext controls the user). - Naming scheme: delegation Deployment renamed to ...-delegation-nginx-deployment, ConfigMap to ...-delegation-nginx-configmap (references and service selector updated). - matrix.configSecretRef moved to secrets.configSecretRef (repo standard). - Probes for Synapse and the delegation nginx are values-configurable; defaults are the previous hardcoded settings. - Flexible ingress standard: ingress.className (default nginx) and ingress.annotations merged with the cert-manager annotation. - Additive matrix.env block rendered through tpl (value/secretKeyRef/ configMapKeyRef forms). - CI fixtures: secret ref moved, seed job image synced to appVersion. - Chart 4.2.1+upv1.159.0 -> 5.0.0+upv1.159.0 (major; app version unchanged).
15 lines
353 B
YAML
15 lines
353 B
YAML
{{- if .Values.matrix.delegation.enabled }}
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-service
|
|
spec:
|
|
selector:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-delegation-nginx-deployment
|
|
ports:
|
|
- protocol: TCP
|
|
port: 80
|
|
targetPort: http
|
|
name: http
|
|
type: ClusterIP
|
|
{{- end }} |