jklein
6c04a68763
Three changes, all about values that do not do what they promise: 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level. 2. Ingress gate (#93): the Ingress template is wrapped in {{- if .Values.ingress.enabled }} and the key is added to values.yaml with default true, so behaviour is unchanged. The domain checkpoint from rallly ran over values.yaml and templates and came back empty here: ingress.domain is read nowhere but in the Ingress template. Unlike rallly, zipline, voucher-vault and outline, this gate therefore frees both domain and clusterIssuer, and no extra required() is needed. 3. Null-safety for hardening, probes and resources (#99). This chart's hardening is a documented deviation from the repo standard, and the fallbacks reproduce it exactly instead of restoring the standard: no runAs* values (s6-overlay boots as root and drops to PUID/PGID 1000), readOnlyRootFilesystem stays false (read-only mode disables the PUID/PGID remapping, silently moving the runtime uid from 1000 to 911 and breaking existing volume data), and capabilities.add keeps its six entries that the s6 init and supervision need. A "cleaned up" standard default here would not be tidier, it would be an outage. cwa.storage stays deliberately not null-safe: an erased value yields an invalid PVC, which is the loud class #99 excludes. Rendering with normal values is byte-identical to 4.0.0.
97 lines
3.4 KiB
YAML
97 lines
3.4 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
secrets:
|
|
cwaSecretRef: null
|
|
|
|
cwa:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
storage: 10Gi
|
|
storageClass: longhorn
|
|
timezone: "UTC"
|
|
maxUploadFileSize: "10m"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Startup budget = 10s * 30 = 300s.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 512Mi
|
|
ephemeralStorage: 100Mi
|
|
# Documented deviation from the repo-wide hardening standard: the CWA image
|
|
# (linuxserver.io-style) must start as root — it boots via the s6-overlay
|
|
# init system, whose stage-1/2 setup runs as uid 0 and then drops the app
|
|
# to the PUID/PGID user (1000), so runAsNonRoot/runAsUser are deliberately
|
|
# not set (s6 supervisors stay root, the application runs as uid 1000).
|
|
# readOnlyRootFilesystem is deliberately false: in read-only mode the image
|
|
# disables the PUID/PGID remapping (the runtime uid would silently change
|
|
# from 1000 to the built-in 911 and break existing volume data) and its
|
|
# init fails to write the ImageMagick policy under /etc. Everything else
|
|
# is hardened: no privilege escalation and all capabilities dropped except
|
|
# the minimal set the s6 init/supervision needs (verified against v4.0.6):
|
|
# CHOWN/DAC_OVERRIDE/FOWNER/SETGID/SETUID for the ownership fix-up of
|
|
# /config etc. and the root->PUID drop, KILL so the root supervisor can
|
|
# signal the uid-1000 services (without it the pod cannot shut down
|
|
# cleanly and gets SIGKILLed).
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: Always
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
- CHOWN
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- KILL
|
|
- SETGID
|
|
- SETUID
|
|
# Extra environment variables, appended to the ones the chart always sets.
|
|
# Rendered through tpl; value, secretKeyRef and configMapKeyRef forms are
|
|
# supported (see template-chart).
|
|
env: []
|
|
|
|
ingress:
|
|
# Set to false to omit the Ingress entirely. Unlike some other charts here,
|
|
# ingress.domain is read nowhere but in the Ingress template, so switching
|
|
# the Ingress off makes both domain and clusterIssuer unnecessary.
|
|
enabled: true
|
|
clusterIssuer: null
|
|
domain: null
|
|
className: nginx
|
|
# Extra annotations for the Ingress; merged with the cert-manager
|
|
# cluster-issuer and proxy-body-size annotations the chart always sets.
|
|
annotations: {}
|