jklein
6c04a68763
Three changes, all about values that do not do what they promise: 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level. 2. Ingress gate (#93): the Ingress template is wrapped in {{- if .Values.ingress.enabled }} and the key is added to values.yaml with default true, so behaviour is unchanged. The domain checkpoint from rallly ran over values.yaml and templates and came back empty here: ingress.domain is read nowhere but in the Ingress template. Unlike rallly, zipline, voucher-vault and outline, this gate therefore frees both domain and clusterIssuer, and no extra required() is needed. 3. Null-safety for hardening, probes and resources (#99). This chart's hardening is a documented deviation from the repo standard, and the fallbacks reproduce it exactly instead of restoring the standard: no runAs* values (s6-overlay boots as root and drops to PUID/PGID 1000), readOnlyRootFilesystem stays false (read-only mode disables the PUID/PGID remapping, silently moving the runtime uid from 1000 to 911 and breaking existing volume data), and capabilities.add keeps its six entries that the s6 init and supervision need. A "cleaned up" standard default here would not be tidier, it would be an outage. cwa.storage stays deliberately not null-safe: an erased value yields an invalid PVC, which is the loud class #99 excludes. Rendering with normal values is byte-identical to 4.0.0.
31 lines
1.1 KiB
YAML
31 lines
1.1 KiB
YAML
{{- if .Values.ingress.enabled }}
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
|
|
nginx.ingress.kubernetes.io/proxy-body-size: {{ .Values.cwa.maxUploadFileSize }}
|
|
nginx.org/client-max-body-size: {{ .Values.cwa.maxUploadFileSize }}
|
|
{{- with .Values.ingress.annotations }}
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
ingressClassName: {{ .Values.ingress.className }}
|
|
rules:
|
|
- host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
port:
|
|
name: http
|
|
path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- hosts:
|
|
- {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
|
|
secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress
|
|
{{- end }}
|