jklein
4e97097a64
Three changes, all about values that do not do what they promise: 1. Ingress gate (#93): the Ingress template is wrapped in {{- if .Values.ingress.enabled }}. The key already existed in values.yaml with default true but was never read, so switching it off did nothing. Both required() calls for domain and clusterIssuer live inside the Ingress file, so gating also removes the contradiction that one had to supply a domain and issuer in order to turn off an Ingress one does not want. 2. Null-safety for hardening, probes and resources (#99): an override written without children is YAML null and erased the whole default sub-tree, rendering "securityContext: null" - an unhardened container that starts and reports healthy. 3. values.schema.json types (#68 + #99): the blocks covered by the null-safety accept null. This is load-bearing only for keys that have no chart default (e.g. resources.limits): there Helm has nothing to delete, so the null survives into schema validation and a strict "object" type rejected it outright. Rendering with normal values is byte-identical to 7.0.0.
72 lines
2.2 KiB
YAML
72 lines
2.2 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
cyberchef:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
# Since 11.0.0 the upstream image is nginxinc/nginx-unprivileged: nginx runs
|
|
# as its nginx user (uid 101) and listens on the unprivileged port 8080, so
|
|
# no sysctl tweaks are needed to run fully non-root.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
# Extra environment variables. Values are rendered through tpl; value,
|
|
# secretKeyRef and configMapKeyRef forms are supported.
|
|
env: []
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 512Mi
|
|
ephemeralStorage: 10Mi
|
|
|
|
ingress:
|
|
# Set to false to omit the Ingress entirely (the required domain and
|
|
# clusterIssuer values are then not needed either, because they are only
|
|
# read inside the Ingress template).
|
|
enabled: true
|
|
clusterIssuer: null
|
|
domain: null
|
|
className: nginx
|
|
# Extra annotations for the Ingress; merged with the cert-manager
|
|
# cluster-issuer annotation the chart always sets.
|
|
annotations: {}
|