jklein
edb0837246
The deployment renders SMTP_REJECT_UNAUTHORIZED from rallly.smtp.rejectUnauthorized, but values.yaml never carried the key. With SMTP enabled the variable therefore reached the app as an empty string -- a certificate check nobody had configured either way. It now defaults to true, so the mail server's certificate is verified unless the operator switches the check off deliberately. values.yaml explains when that is needed (a mail server with a self-signed certificate), because the symptom otherwise points at the mail server rather than at this value. The env var is not rendered with "| default true": an explicit false is a zero value and default would swallow it, silently re-enabling the check the operator just switched off. A nil falls back to true instead, so the variable can no longer reach the app empty. The schema now rejects strings. Operationally inert: the rallly fleet bundle and the deployed release both have smtp.enabled: false, so the variable is not rendered at all -- the render with SMTP disabled is byte-identical to before. Major, because the runtime behaviour of mail sending changes. Fixes #109
126 lines
4.8 KiB
YAML
126 lines
4.8 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
secrets:
|
|
ralllySecretRef: null
|
|
oidcSecretRef: null
|
|
databaseSecretRef: null
|
|
smtpSecretRef: null
|
|
|
|
rallly:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
smtp:
|
|
enabled: false
|
|
# Verify the mail server's TLS certificate (passed to the app as
|
|
# SMTP_REJECT_UNAUTHORIZED). Leave this at true.
|
|
#
|
|
# Set it to false ONLY for a mail server with a self-signed certificate.
|
|
# Without that hint the symptom is misleading: the send fails with a
|
|
# certificate error naming the mail server, so the search starts at the
|
|
# mail server or its CA chain rather than at this value.
|
|
#
|
|
# false disables the certificate check entirely and exposes the SMTP
|
|
# session to a man-in-the-middle; prefer trusting the CA over setting it.
|
|
rejectUnauthorized: true
|
|
allowedEmails: '*'
|
|
supportEmail: null
|
|
oidc:
|
|
name: 'OIDC'
|
|
pictureClaimPath: 'picture'
|
|
emailClaimPath: 'email'
|
|
nameClaimPath: 'name'
|
|
# Next.js writes its cache below the app directory (prerendered/ISR pages and
|
|
# the optimized images of /_next/image). The container runs as uid 20000
|
|
# while /app belongs to the image's own "nextjs" user, so that path is not
|
|
# writable for the app even without readOnlyRootFilesystem — the chart mounts
|
|
# a writable volume over it. The pod's fsGroup (1000) is what makes the
|
|
# mounted volume group-writable for the container.
|
|
#
|
|
# Deliberately an emptyDir, not a PVC: the cache is volatile. After every pod
|
|
# restart it starts out empty and Next.js rebuilds it on demand, which costs
|
|
# a little time on the first request after a restart. That is correct for a
|
|
# cache — its entries are derived data tied to the build id of the image, so
|
|
# a persistent volume would only carry stale entries across app updates.
|
|
cache:
|
|
# Mount path of the cache volume. Matches the Next.js cache directory of
|
|
# the upstream image; only needs changing if the image layout changes.
|
|
path: /app/apps/web/.next/cache
|
|
# Optional upper bound for the emptyDir, e.g. 512Mi. Unset means the volume
|
|
# is only bounded by the container's ephemeral-storage limit (computed as
|
|
# limitFactor x request, see resources below) — note that emptyDir usage
|
|
# counts against that limit, and exceeding either bound evicts the pod.
|
|
sizeLimit: null
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 20000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: Always
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
# No capabilities are added: the app is a plain Node process listening on
|
|
# the unprivileged port 3000, verified to run with all capabilities
|
|
# dropped. Do not reintroduce an "add:" key here — an empty list item
|
|
# under it renders as a null entry, which is what Trivy reported as
|
|
# AVD-KSV-0022 for the older chart version deployed in the cluster (#84).
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
# Extra environment variables, appended to the ones the chart always sets.
|
|
# Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
|
|
# forms are supported.
|
|
env: []
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 512Mi
|
|
ephemeral-storage: 100Mi
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness, so those need no initialDelaySeconds.
|
|
# Startup budget = periodSeconds * failureThreshold = 150s.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 5
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
|
|
ingress:
|
|
# Set to false to omit the Ingress entirely. Note that ingress.domain stays
|
|
# required even then: it is also the app's public base URL
|
|
# (NEXT_PUBLIC_BASE_URL), not just the Ingress host. Only clusterIssuer
|
|
# becomes unnecessary.
|
|
enabled: true
|
|
clusterIssuer: null
|
|
domain: null
|
|
className: nginx
|
|
# Extra annotations for the Ingress; merged with the cert-manager
|
|
# cluster-issuer annotation the chart always sets.
|
|
annotations: {}
|