jklein
0481007cfe
- Pod and container securityContext are now values-configurable (outline.securityContext.pod/container) with hardened defaults: runAsNonRoot (uid/gid 1001, the upstream image's nodejs user), readOnlyRootFilesystem, allowPrivilegeEscalation false, all capabilities dropped. /tmp is mounted as an emptyDir for Outline's import/export scratch files. - Probes moved to values (outline.livenessProbe/readinessProbe/ startupProbe); defaults are exactly the previously hardcoded ones. - Ingress raised to the repo standard: ingress.className (default nginx), ingress.annotations merged with the always-set annotations, ingress.enabled flag; domain/clusterIssuer stay required and the TLS secret name was already conform. - Additive outline.env block rendered through tpl with value/ secretKeyRef/configMapKeyRef forms; chart-managed env stays in the template. Major bump 3.1.1+up1.9.2 -> 4.0.0+up1.9.2 (runtime behavior changes through hardening). Part of #32
90 lines
2.8 KiB
YAML
90 lines
2.8 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
secrets:
|
|
configSecretRef: null
|
|
redisSecretRef: null
|
|
dbSecretRef: null
|
|
outline:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
maxUploadSize: '262144000'
|
|
forceHttps: 'false'
|
|
oidc:
|
|
displayName: OIDC
|
|
storage:
|
|
size: 10Gi
|
|
storageClass: null
|
|
# The upstream image (outlinewiki/outline) runs as its nodejs user
|
|
# (uid/gid 1001). Outline only writes to the upload storage (PVC) and to
|
|
# /tmp (import/export scratch files), which the chart mounts as an
|
|
# emptyDir, so the root filesystem stays read-only.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
runAsGroup: 1001
|
|
fsGroup: 1001
|
|
fsGroupChangePolicy: Always
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
# Outline exposes a dedicated health endpoint at /_health (also used
|
|
# by the upstream Docker HEALTHCHECK). It checks Postgres and Redis;
|
|
# there is no dependency-free HTTP endpoint ("/" returns 500 too when
|
|
# the database is down), so all three probes use /_health.
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /_health
|
|
port: 3000
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /_health
|
|
port: 3000
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Outline runs database
|
|
# migrations on startup: budget 10s * 30 = 300s.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /_health
|
|
port: 3000
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
# Extra environment variables, appended to the ones the chart always sets.
|
|
# Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
|
|
# forms are supported.
|
|
env: []
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 512Mi
|
|
ephemeralStorage: 10Mi
|
|
|
|
ingress:
|
|
enabled: true
|
|
maxUploadFileSize: 25m
|
|
clusterIssuer: letsencrypt
|
|
domain: null
|
|
className: nginx
|
|
# Extra annotations for the Ingress; merged with the cert-manager
|
|
# cluster-issuer and proxy-body-size annotations the chart always sets.
|
|
annotations: {}
|