jklein
247c01bce1
All audit findings from #32 for the satisfactory chart in one major PR: - StatefulSet renamed to {{ .Release.Name }}-{{ .Chart.Name }}-sfs, service to ...-service (standard scheme); template file satisfactory-server.sfs.yaml renamed to satisfactory.sfs.yaml. The PVC keeps its historical -vc name (documented naming exception; renaming would orphan the data). - Hardened, values-configurable security contexts (securityContext.pod / securityContext.container): runAsNonRoot with the image's steam user (uid/gid 1000), readOnlyRootFilesystem, all capabilities dropped. emptyDirs mounted at /tmp and the steam user's ~/.steam, ~/.config and ~/.local make the read-only root filesystem work; all other writes go to the PVC. - Probes are now values (livenessProbe/readinessProbe/startupProbe), defaults exactly the previously hardcoded values. - Additive env value rendered through tpl with value/secretKeyRef/ configMapKeyRef forms (template-chart pattern). Chart 3.1.1+upv1.9.10 -> 4.0.0+upv1.9.10 (major: resource renames + hardening); appVersion unchanged.
27 lines
797 B
YAML
27 lines
797 B
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
spec:
|
|
type: NodePort
|
|
ports:
|
|
- name: "api"
|
|
port: {{ .Values.server.gamePort }}
|
|
protocol: TCP
|
|
nodePort: {{ .Values.server.gamePort }}
|
|
targetPort: {{ .Values.server.gamePort }}
|
|
- name: "game"
|
|
port: {{ .Values.server.gamePort }}
|
|
protocol: UDP
|
|
nodePort: {{ .Values.server.gamePort }}
|
|
targetPort: {{ .Values.server.gamePort }}
|
|
- name: "messaging"
|
|
port: {{ .Values.server.messagingPort }}
|
|
protocol: TCP
|
|
nodePort: {{ .Values.server.messagingPort }}
|
|
targetPort: {{ .Values.server.messagingPort }}
|
|
selector:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|