helm-charts/patchmon/values.yaml

# Scale the whole chart down without uninstalling it: scaleDown: true renders
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
# takes precedence over any per-workload replicas value. PVCs, Secrets and
# Services stay in place; scaleDown: false brings the workloads back up.
scaleDown: false

patchmon:
  server:
    # Replica count for this workload; 0 is allowed and scales it down.
    # The chart-global scaleDown flag takes precedence.
    # Note: the server registers itself in the agent presence registry under a
    # stable identity (the pod hostname, pinned by the chart). Running more
    # than one replica requires a distinct identity per replica and is not
    # supported by this chart.
    replicas: 1
    # The 2.x server image is a hardened Alpine image running as uid 65532
    # (nonroot). It is stateless: frontend, agent binaries and SCAP content
    # are baked into the image, so the root filesystem stays read-only; /tmp
    # is provided as an emptyDir.
    securityContext:
      pod:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        # RuntimeDefault applies the container runtime's default seccomp
        # filter, which blocks the syscalls a normal workload never makes. It
        # sits in the pod context on purpose: from here it covers every
        # container in the pod - the server and the optional guacd sidecar
        # alike - including init containers, while a container-level
        # seccompProfile would have to be repeated for each one (and silently
        # missed on the next one added). A container that genuinely needs a
        # different filter can still override it under
        # securityContext.container, which wins over this value.
        seccompProfile:
          type: RuntimeDefault
      container:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        capabilities:
          drop:
            - ALL
    resources:
      # Limits are optional: memory and ephemeral-storage limits default to
      # limitFactor x the request, an explicitly set limit always wins, and a
      # CPU limit is only set when configured explicitly under "limits".
      limitFactor: 3
      requests:
        cpu: 0.1
        memory: 256Mi
        ephemeral-storage: 10Mi
    # Probes hit GET /health ({"status": "ok"}). The 2.x server rejects
    # requests whose Host header is neither loopback nor a CORS_ORIGIN host
    # with 403 — kubelet probes target the pod IP, so they must send the
    # public hostname as Host header. Probe values are rendered through tpl,
    # so the default Host header follows ingress.domain.
    livenessProbe:
      httpGet:
        path: /health
        port: 3000
        httpHeaders:
          - name: Host
            value: "{{ .Values.ingress.domain }}"
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    readinessProbe:
      httpGet:
        path: /health
        port: 3000
        httpHeaders:
          - name: Host
            value: "{{ .Values.ingress.domain }}"
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    # The startup probe gates liveness/readiness. The server waits for the
    # database and runs migrations on startup; upstream warns that the first
    # 2.x boot rebuilds database indexes, which can take minutes on slow
    # storage: budget 10s * 60 = 600s.
    startupProbe:
      httpGet:
        path: /health
        port: 3000
        httpHeaders:
          - name: Host
            value: "{{ .Values.ingress.domain }}"
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 60
    # Extra environment variables, appended to the ones the chart always sets.
    # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
    # forms are supported.
    env: []
  guacd:
    # In-browser RDP for Windows hosts (beta) via the Apache Guacamole daemon,
    # run as a sidecar container in the server pod. Disabled by default; when
    # enabled, the server is pointed at it via GUACD_ADDRESS=127.0.0.1:4822.
    enabled: false
    # guacd is an independent upstream application, so its image is not tied
    # to the chart's appVersion. Pinned to the version upstream ships with.
    image: docker.io/guacamole/guacd:1.6.0
    # The image runs as its own unprivileged user (uid 1000); it only needs a
    # writable /tmp, which the chart provides as an emptyDir.
    securityContext:
      container:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        capabilities:
          drop:
            - ALL
    resources:
      # Limits are optional: memory and ephemeral-storage limits default to
      # limitFactor x the request, an explicitly set limit always wins, and a
      # CPU limit is only set when configured explicitly under "limits".
      limitFactor: 3
      requests:
        cpu: 0.05
        memory: 64Mi
        ephemeral-storage: 10Mi
    # Probe values are rendered through tpl.
    livenessProbe:
      tcpSocket:
        port: 4822
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    readinessProbe:
      tcpSocket:
        port: 4822
      periodSeconds: 10
      timeoutSeconds: 5
      failureThreshold: 3
    # The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
    startupProbe:
      tcpSocket:
        port: 4822
      periodSeconds: 5
      timeoutSeconds: 5
      failureThreshold: 30
    # Extra environment variables for the guacd sidecar (e.g. GUACD_LOG_LEVEL).
    # Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
    # forms are supported.
    env: []

ingress:
  # Set to false to omit the Ingress entirely. clusterIssuer is then not needed
  # either, because it is only read inside the Ingress template.
  #
  # ingress.domain is a different case and the comment here used to lump the
  # two together, which was wrong: it is read twice MORE outside the Ingress -
  # CORS_ORIGIN in the Deployment (with its own required()) and the explicit
  # Host header the probes send - so it stays mandatory with the Ingress off.
  # The 2.x server rejects requests whose Host is neither loopback nor a
  # CORS_ORIGIN host, so an empty value keeps the pod out of Ready forever.
  #
  # Mutually exclusive with httpRoute.enabled below (Gitea #114): with both
  # true the render aborts, naming both values.
  enabled: true
  clusterIssuer: null
  # The public hostname of this release. Read by the Ingress, by CORS_ORIGIN,
  # by the probes' Host header, and - when httpRoute.hostnames is empty - by
  # the HTTPRoute. Required in every mode (see above).
  domain: null
  className: nginx
  # Extra annotations for the Ingress; merged with the cert-manager
  # cluster-issuer annotation the chart always sets.
  #
  # THESE HAVE NO COUNTERPART IN GATEWAY MODE. The Gateway API has no
  # annotation channel for controller behaviour, so anything configured here is
  # simply gone when httpRoute.enabled is used instead - it is then the
  # Gateway's business, or that of an implementation-specific policy object
  # this chart deliberately does not render. Nothing this chart NEEDS lives
  # here: the server's WebSocket upgrade works on a plain route, and TRUST_PROXY
  # is an environment variable, not an annotation.
  annotations: {}

# Gateway-API alternative to the Ingress above (Gitea #114). Off by default, so
# an existing release is unaffected; exactly one of ingress.enabled and
# httpRoute.enabled may be true.
#
# The chart renders ONLY an HTTPRoute with parentRefs - no Gateway, no
# gatewayClassName, no Certificate and no implementation-specific policy
# object. Class and certificate belong to the Gateway and therefore to the
# platform, which is what keeps this chart independent of whether the cluster
# runs nginx-gateway-fabric, Cilium, Envoy Gateway or Istio.
#
# The Gateway-API CRDs must be installed in the cluster: the chart does not and
# cannot detect them (.Capabilities.APIVersions is unreliable at template
# time), so with httpRoute.enabled: true and no CRDs the INSTALL fails.
httpRoute:
  enabled: false
  # The Gateway(s) this route attaches to - a platform object, usually in
  # another namespace, which must allow this namespace in its listener's
  # allowedRoutes. One entry per parent, the fields are the Gateway API's
  # ParentReference (name, and optionally namespace, sectionName, port, group,
  # kind), passed through unchanged:
  #
  #   parentRefs:
  #     - name: public
  #       namespace: gateway
  #       sectionName: https
  #
  # REQUIRED while httpRoute.enabled is true - the render aborts on an empty
  # list, because a route without a parent is created, is valid and routes
  # nothing, with no event to say so.
  parentRefs: []
  # Empty means [ingress.domain], so the hostname has one source of truth. Set
  # explicitly only to publish under a different or an additional name - which
  # is how a migration from the Ingress runs: the HTTPRoute takes a second
  # hostname while the Ingress keeps ingress.domain.
  #
  # For THIS chart, mind that a second hostname does not move CORS_ORIGIN or
  # the probes' Host header with it: both keep following ingress.domain, and
  # the server answers the new name with a rejection until ingress.domain names
  # it too.
  hostnames: []

secrets:
  redisSecretRef: null
  postgresSecretRef: null
  oidcSecretRef: null
  patchmonSecretRef: null

# ---------------------------------------------------------------------------
# NetworkPolicy (Gitea #5). On by default. The reference implementation with
# the full reasoning is template-chart; the convention is in README, "Chart
# style guidelines", and the operator's view on this chart's wiki page.
# ---------------------------------------------------------------------------
networkPolicy:
  # WHAT THIS POLICY ALLOWS: inbound 3000 only, and outbound DNS plus TCP 5432
  # (Postgres), 6379 (Redis) and 443 (the OIDC provider).
  #
  # WHAT IT DOES NOT DO: those three are the STANDARD ports, not the configured
  # ones. All three dependencies arrive as connection details inside 1Password
  # items this chart never parses, so it cannot know where they listen. A
  # dependency on another port is BLOCKED and belongs in egress.extraPorts.
  #
  # Inbound 3000 is not restricted by source in the default (probe port), and a
  # policy is only a boundary where the CNI enforces one.
  enabled: true
  # Namespaces whose pods may reach this workload, in addition to the release's
  # own namespace, which is always allowed. Empty means: own namespace only.
  #
  # Matched on the "kubernetes.io/metadata.name" label Kubernetes sets on every
  # namespace itself, so no labelling work is needed on a namespace this chart
  # does not own - and no typo protection either: a name that does not exist
  # matches nothing and is silently ineffective. Note the granularity: an entry
  # opens the port to EVERY pod in that namespace.
  allowedNamespaces: []
  # Source CIDRs allowed to reach port 3000, which is the port all three probes address.
  #
  # EMPTY MEANS OPEN, NOT BLOCKED. With no entry that rule is rendered WITHOUT a
  # "from" selector, so the port is reachable from anywhere the CNI routes to -
  # inside the cluster, since it carries no NodePort.
  #
  # That is the deliberate choice between two bad defaults. The kubelet's probes
  # originate from the IP of the WORKER NODE running the pod, an address this
  # chart cannot know and must not guess: a CIDR that excludes the real node
  # blocks every probe, the pod never becomes Ready, the rollout times out, and
  # the symptom reads as a broken application rather than as a policy.
  #
  # Narrow it by listing the worker node IPs (e.g. ["10.0.1.11/32"]) - and mind
  # the companion trap: once this list is non-empty the rule IS restricted, so
  # everything else that needs the port has to be in it. The chart adds the own
  # namespace, the ingressController below and allowedNamespaces to the same rule for exactly that reason.
  probeSources: []
  # The ingress controller allowed to reach the routed port once probeSources
  # restricts it. Rendered only while ingress.enabled is true, and only in
  # the restricted branch - with the default (open) rule the controller reaches
  # the port anyway. The two keys become ONE "from" entry and are therefore an
  # AND: pods carrying podLabels IN namespace. That is the point of having them
  # at all - the controller's namespace in allowedNamespaces would open the port
  # to every pod in kube-system.
  #
  # MEASURED ON THIS CLUSTER, NOT ASSUMED (2026-10-14): ingress-nginx is gone,
  # the only IngressClass is "traefik" and it is the default, and the controller
  # is the DaemonSet rke2-traefik in kube-system. The same Traefik serves the
  # Gateway API here, so this one source covers the Ingress and the HTTPRoute
  # path alike. A policy written against the wrong controller is accepted, looks
  # strict, and silently blocks all web traffic - and ingress.className says
  # nothing about it, because a class names an implementation, not the pods the
  # traffic comes from.
  ingressController:
    namespace: kube-system
    podLabels:
      app.kubernetes.io/name: rke2-traefik

  # The policy's INBOUND side. Mind the three names that overlap as substrings,
  # because a search for "ingress" matches all of them and they are different
  # things:
  #
  #   ingress                          (top level) the Ingress OBJECT this chart
  #                                    renders - host, TLS, className
  #   networkPolicy.ingress            this block: what the policy lets IN
  #   networkPolicy.ingressController  the SOURCE SELECTOR for the ingress
  #                                    controller's pods. A SIBLING of this block
  #                                    and NO PART OF IT, despite the name.
  ingress:
    # Opens the pod for Istio's ambient mesh (Gitea #143). OFF by default and
    # additive: while it is false this chart renders byte for byte as it did
    # before the value existed.
    #
    # IT RENDERS TWO THINGS, and that they come together is the point:
    #
    #   1. 15008/TCP inbound - ztunnel's HBONE tunnel. Every inbound mesh
    #      connection arrives on it, and ambient "does not and will never bypass
    #      Kubernetes NetworkPolicy enforcement", so without this port a pod
    #      whose namespace has joined the mesh is unreachable.
    #   2. 169.254.7.127/32 as an additional peer - but ONLY where the rule
    #      restricts sources at all, which here means probeSources is non-empty.
    #      Inside the mesh the kubelet's probes are redirected and no longer come
    #      from the worker node's address.
    #
    # WHY ONE SWITCH AND NOT TWO: point 2 is the one nobody thinks of. Whoever
    # adds "15008" to a port list by hand writes a policy that passes review, and
    # the first time probeSources is narrowed every probe is dropped - the pod
    # never becomes Ready and the symptom reads as a broken application rather
    # than as a policy. A switch whose halves can only be had together cannot be
    # set halfway, which is why this is a named intention and not a port list.
    #
    # TWO THINGS IT DOES NOT PROVE:
    #   - That 15008 alone is enough. That comes from Istio's documentation;
    #     measured on this cluster is only which listeners ztunnel opens.
    #     Provable at the first namespace to join the mesh - none carries
    #     istio.io/dataplane-mode yet.
    #   - That the probe-source half works. probeSources is empty in every chart
    #     here, so no release reaches that branch. CI proves its render, not its
    #     effect.
    #
    # Note where the port lands: it joins the rule that carries the probe port,
    # so once probeSources restricts that rule, 15008 is restricted with it.
    # Whether ztunnel needs a peer of its own is open - it runs with its own pod
    # IPs in istio-system (measured: no hostNetwork on the DaemonSet, Istio
    # 1.30.6), so if one proves necessary it is expressible as a
    # namespaceSelector plus podSelector and needs no unknowable node CIDR.
    ambientMesh: false

  egress:
    # Additional outbound TCP ports. DNS (UDP and TCP 53) is always allowed and
    # has no switch - a knob whose only other setting breaks every name lookup
    # in the pod is a trap, not a feature.
    #
    # PORTS, NOT DESTINATIONS, and that is a limit of the object rather than
    # laziness: a NetworkPolicy matches CIDRs and selectors and never hostnames,
    # so "only to the database host" cannot be written at all. Each entry
    # permits its port to ANY destination. What the cap still buys is real: a
    # compromised pod cannot open arbitrary outbound connections.
    #
    # Add the real port whenever Postgres, Redis or the OIDC issuer is not on
    # 5432 / 6379 / 443 - a self-hosted issuer on 8443, for instance.
    extraPorts: []