jklein
f6de7ffa80
All audit findings for the calibre-web-automated chart (#32) in one major bump, 3.1.1+upv4.0.6 -> 4.0.0+upv4.0.6: - Rename StatefulSet, Service, OnePasswordItem secret and Ingress from the inverted <chart>-<release>-cwa-<kind> scheme to <release>-<chart>-<kind>; spec.serviceName and all references follow. Both PVCs deliberately keep their historical names (documented naming exception; renaming would orphan the data). - TLS secret renamed to the standard tls-<release>-<chart>-ingress. - Ingress on the repo standard: ingress.className (default nginx), ingress.annotations merged with the chart-managed annotations, ingress.clusterIssuer now required (was silently defaulted to "letsencrypt-issuer"). - Security hardening, values-configurable via securityContext.pod / securityContext.container: allowPrivilegeEscalation false, all capabilities dropped except the minimal set the s6-overlay init needs (CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID). Documented deviations: the image must start as root (s6 drops to PUID 1000) and readOnlyRootFilesystem stays false (read-only mode disables PUID/PGID remapping upstream and breaks the ImageMagick policy setup). - Additive env value rendered through tpl (value / secretKeyRef / configMapKeyRef forms). - CI fixtures: secret renamed to the new scheme, clusterIssuer added to test-values. Part of #32.
14 lines
324 B
YAML
14 lines
324 B
YAML
secrets:
|
|
cwaSecretRef: op://ci/cwa
|
|
|
|
cwa:
|
|
# Both PVCs share this class and the consume PVC is RWX, which k3d's
|
|
# local-path provisioner cannot serve - the fixtures pre-bind static
|
|
# hostPath PVs of class ci-static instead.
|
|
storageClass: ci-static
|
|
storage: 2Gi
|
|
|
|
ingress:
|
|
clusterIssuer: ci
|
|
domain: cwa.ci.local
|