jklein
c88ce80750
- apache-tika, gotenberg, cyberchef, homeassistant, patchmon: additive env value blocks rendered through tpl (value, secretKeyRef and configMapKeyRef forms), following the template-chart/outline pattern; patchmon gets separate blocks for the server container and the guacd sidecar. - homeassistant: ingress.className now defaults to nginx; an empty className omits ingressClassName from the rendered Ingress, so the flexible upstream ingress style stays intact. - outline, paperless-ngx: remove the ingress.clusterIssuer defaults (letsencrypt / letsencrypt-issuer) - the value is now strictly required, consistent with the repo-wide ingress standard; CI test-values set it explicitly. Chart bumps: apache-tika 7.2.0, gotenberg 4.2.0, cyberchef 5.2.0, patchmon 5.2.0, homeassistant 4.2.0 (minor); outline 5.0.0, paperless-ngx 10.0.0 (major).
127 lines
4.0 KiB
YAML
127 lines
4.0 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
|
|
# This is for setting up a service more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/
|
|
service:
|
|
# This sets the service type more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
|
|
type: ClusterIP
|
|
# This sets the ports more information can be found here: https://kubernetes.io/docs/concepts/services-networking/service/#field-spec-ports
|
|
port: 80
|
|
|
|
# This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
|
|
ingress:
|
|
enabled: false
|
|
# Ingress class; set to "" to omit ingressClassName from the rendered Ingress.
|
|
className: nginx
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
hosts:
|
|
- host: chart-example.local
|
|
paths:
|
|
- path: /
|
|
pathType: ImplementationSpecific
|
|
tls: []
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - chart-example.local
|
|
|
|
# Documented deviation from the repo-wide hardening standard: the official
|
|
# Home Assistant container must start as root — it boots via the s6-overlay
|
|
# init system, which performs its setup as uid 0 (the image supports no
|
|
# non-root user), so runAsNonRoot/runAsUser are deliberately not set.
|
|
# Everything else is hardened: no privilege escalation, all capabilities
|
|
# dropped and a read-only root filesystem with writable emptyDirs for
|
|
# /tmp and /run (s6-overlay state). NET_RAW is added back because Home
|
|
# Assistant's device discovery (DHCP watcher, ping/arp integrations) uses
|
|
# raw sockets and logs "Operation not permitted" without it.
|
|
securityContext:
|
|
pod: {}
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
- NET_RAW
|
|
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.2
|
|
memory: 512Mi
|
|
ephemeralStorage: 128Mi
|
|
|
|
# This is to setup the liveness, readiness and startup probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Home Assistant can take a while to
|
|
# start up, so grant a generous budget: 10s * 30 = 300s.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
|
|
# Extra environment variables, appended to the ones the chart always sets.
|
|
# Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
|
|
# forms are supported.
|
|
env: []
|
|
|
|
# Additional volumes on the output Deployment definition.
|
|
volumes: []
|
|
# - name: foo
|
|
# secret:
|
|
# secretName: mysecret
|
|
# optional: false
|
|
|
|
# Additional volumeMounts on the output Deployment definition.
|
|
volumeMounts: []
|
|
# - name: foo
|
|
# mountPath: "/etc/foo"
|
|
# readOnly: true
|
|
|
|
nodeSelector: {}
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|
|
|
|
core:
|
|
timezone: "UTC"
|
|
storage:
|
|
size: 5Gi
|
|
storageClass: "default"
|
|
|
|
# Must include the following keys:
|
|
# - config
|
|
# - http-config
|
|
# - recorder-config
|
|
secrets:
|
|
configSecretRef: null
|