jklein
a76accf7ad
No ingress gate: this chart has no Ingress at all (clients reach it via a NodePort), and ingress.domain appears neither in its templates nor in its values. 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, including the entries of the mappings list, where domain and internalUrl are required. 2. Null-safety for hardening, probes and resources (#99). Two things a rebuilt default probe must not lose, both verified: - the API port is addressed by NAME ("api-port"), so the probe keeps working when server.apiPort is overridden. - mc-router still has no /health endpoint in 1.46.4, so GET /routes is the health signal, and the "Accept: application/json" header belongs to that request. The pod context keeps pinning uid/gid 10000 even though the image declares USER 65532 since 1.46.0, so the runtime identity does not silently change with the base image. mappings stays deliberately not null-safe: the chart fails loudly on a missing or empty routing table, which is the loud class #99 excludes - a router without routes is not operable and has no sensible default. Rendering with normal values is byte-identical to 2.0.0.
87 lines
3.7 KiB
YAML
87 lines
3.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
spec:
|
|
replicas: {{ include "minecraft-router.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.server.replicas) }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
template:
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
annotations:
|
|
# Rolls the pod whenever the rendered routing ConfigMap changes.
|
|
# Without it a changed routing table stays inert: the file is mounted
|
|
# with subPath (kubelet never refreshes those in a running container)
|
|
# and mc-router reads ROUTES_CONFIG only at startup, so the router
|
|
# would keep serving the old routes while everything looks healthy.
|
|
checksum/config: {{ include (print $.Template.BasePath "/minecraft-router.configmap.yaml") . | sha256sum }}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- include "minecraft-router.podSecurityContext" .Values.server.securityContext | nindent 8 }}
|
|
containers:
|
|
- name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
image: "itzg/mc-router:{{ .Chart.AppVersion }}"
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- "--port"
|
|
- "{{ .Values.server.port }}"
|
|
- "--api-binding"
|
|
- ":{{ .Values.server.apiPort }}"
|
|
env:
|
|
- name: ROUTES_CONFIG
|
|
value: /data/custom-routing-config.json
|
|
{{- range $value := .Values.server.env }}
|
|
{{- if $value.value }}
|
|
- name: {{ $value.name }}
|
|
value: {{ tpl $value.value $ }}
|
|
{{- else if $value.valueFrom }}
|
|
{{- if $value.valueFrom.secretKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
|
|
{{- else if $value.valueFrom.configMapKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
ports:
|
|
- name: proxy-port
|
|
protocol: TCP
|
|
containerPort: {{ .Values.server.port }}
|
|
- name: api-port
|
|
protocol: TCP
|
|
containerPort: {{ .Values.server.apiPort }}
|
|
livenessProbe:
|
|
{{- include "minecraft-router.livenessProbe" .Values.server.livenessProbe | nindent 12 }}
|
|
readinessProbe:
|
|
{{- include "minecraft-router.readinessProbe" .Values.server.readinessProbe | nindent 12 }}
|
|
startupProbe:
|
|
{{- include "minecraft-router.startupProbe" .Values.server.startupProbe | nindent 12 }}
|
|
resources:
|
|
{{- include "minecraft-router.effectiveResources" .Values.server.resources | nindent 12 }}
|
|
securityContext:
|
|
{{- include "minecraft-router.containerSecurityContext" .Values.server.securityContext | nindent 12 }}
|
|
volumeMounts:
|
|
- name: config-mount
|
|
mountPath: /data/custom-routing-config.json
|
|
subPath: custom-routing-config.json
|
|
readOnly: true
|
|
volumes:
|
|
- name: config-mount
|
|
configMap:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-configmap
|
|
restartPolicy: Always
|