147 lines
3.9 KiB
YAML
147 lines
3.9 KiB
YAML
secrets:
|
|
voucherVaultSecretRef: null
|
|
oidcSecretRef: null
|
|
databaseSecretRef: null
|
|
|
|
voucherVault:
|
|
resources:
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 256Mi
|
|
ephemeral-storage: 10Mi
|
|
limits:
|
|
cpu: 1
|
|
memory: 384Mi
|
|
ephemeral-storage: 100Mi
|
|
# TODO: Refine liness, readiness, startup probes
|
|
livenessProbe: null
|
|
readinessProbe: null
|
|
startupProbe: null
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 33
|
|
runAsGroup: 33
|
|
fsGroup: 33
|
|
fsGroupChangePolicy: Always
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
ports:
|
|
- containerPort: 8000
|
|
protocol: TCP
|
|
name: http
|
|
env:
|
|
- name: DOMAIN
|
|
value: "{{ .Values.ingress.domain }}"
|
|
- name: SECURE_COOKIES
|
|
value: "True"
|
|
- name: SESSION_COOKIE_AGE
|
|
value: "30"
|
|
- name: SESSION_EXPIRE_AT_BROWSER_CLOSE
|
|
value: "True"
|
|
- name: EXPIRY_THRESHOLD_DAYS
|
|
value: "90"
|
|
- name: EXPIRY_LAST_NOTIFICATION_DAYS
|
|
value: "7"
|
|
- name: TZ
|
|
value: "UTC"
|
|
- name: PORT
|
|
value: "8000"
|
|
- name: SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-secret"
|
|
key: "secretKey"
|
|
- name: REDIS_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-secret"
|
|
key: "redis-url"
|
|
- name: CELERY_WORKER_CONCURRENCY
|
|
value: "1"
|
|
- name: CELERY_WORKER_PREFETCH_MULTIPLIER
|
|
value: "1"
|
|
- name: OIDC_ENABLED
|
|
value: "True"
|
|
- name: OIDC_AUTOLOGIN
|
|
value: "True"
|
|
- name: OIDC_CREATE_USER
|
|
value: "True"
|
|
- name: OIDC_RP_SIGN_ALGO
|
|
value: "RS256"
|
|
- name: OIDC_OP_JWKS_ENDPOINT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
|
|
key: "oidc-jwks-endpoint"
|
|
- name: OIDC_RP_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
|
|
key: "client-id"
|
|
- name: OIDC_RP_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
|
|
key: "client-secret"
|
|
- name: OIDC_OP_AUTHORIZATION_ENDPOINT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
|
|
key: "authorization-endpoint"
|
|
- name: OIDC_OP_TOKEN_ENDPOINT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
|
|
key: "token-endpoint"
|
|
- name: OIDC_OP_USER_ENDPOINT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-oidc-secret"
|
|
key: "user-endpoint"
|
|
- name: DB_ENGINE
|
|
value: "postgres"
|
|
- name: POSTGRES_HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
|
|
key: "host"
|
|
- name: POSTGRES_PORT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
|
|
key: "port"
|
|
- name: POSTGRES_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
|
|
key: "user"
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
|
|
key: "password"
|
|
- name: POSTGRES_DB
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: "{{ .Release.Name }}-{{ .Chart.Name }}-db-secret"
|
|
key: "database"
|
|
storage:
|
|
volumes:
|
|
- name: voucher-vault-data
|
|
persistentVolumeClaim:
|
|
claimName: "{{ .Release.Name }}-{{ .Chart.Name }}-pvc"
|
|
volumeMounts:
|
|
- name: voucher-vault-data
|
|
mountPath: /opt/app/database
|
|
subPath: voucher-vault-data
|
|
|
|
storage:
|
|
amount: 10Gi
|
|
storageClass: null
|
|
|
|
ingress:
|
|
enabled: true
|
|
clusterIssuer: null
|
|
domain: null |