jklein
f091c33205
Establish the flexible ingress standard from #32 in template-chart and document it in README/CLAUDE.md: ingress.domain and ingress.clusterIssuer stay required, new ingress.className value (default nginx) replaces the hardcoded ingressClassName, new optional ingress.annotations are merged with the cert-manager cluster-issuer annotation, TLS secret name unchanged (tls-<release>-<chart>-ingress). Apply the standard to cyberchef and patchmon (the two charts without an own batch-3 major PR) and make the patchmon probes values-configurable (server + guacd, rendered through tpl so the default Host header keeps following ingress.domain). Defaults render semantically identical to the previous hardcoded output. cyberchef 5.0.1 -> 5.1.0, patchmon 5.0.1 -> 5.1.0 (minor, additive).
66 lines
1.9 KiB
YAML
66 lines
1.9 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
cyberchef:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
# Since 11.0.0 the upstream image is nginxinc/nginx-unprivileged: nginx runs
|
|
# as its nginx user (uid 101) and listens on the unprivileged port 8080, so
|
|
# no sysctl tweaks are needed to run fully non-root.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Startup budget = 5s * 30 = 150s.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 512Mi
|
|
ephemeralStorage: 10Mi
|
|
|
|
ingress:
|
|
enabled: true
|
|
clusterIssuer: letsencrypt
|
|
domain: null
|
|
className: nginx
|
|
# Extra annotations for the Ingress; merged with the cert-manager
|
|
# cluster-issuer annotation the chart always sets.
|
|
annotations: {}
|