jklein
6320709cbc
Enable readOnlyRootFilesystem and drop all capabilities by default. The paths the image writes at runtime are covered by emptyDirs (/tmp, /opt/app/logs and STATIC_ROOT /opt/app/myapp/static); an init container seeds the static volume with the assets shipped in the image because the directory doubles as the app's static source. The ephemeral-storage request covers the ~90Mi static emptyDir. Move the Ingress to the repo-standard flexible style: ingress.className value (default nginx) instead of a hardcoded ingressClassName, and ingress.annotations merged with the cert-manager annotation. domain and clusterIssuer stay required; the TLS secret name was already standard. Major bump 3.1.2+up1.30.1 -> 4.0.0+up1.30.1 (hardening changes runtime behavior). App version unchanged. Part of #32.
29 lines
937 B
YAML
29 lines
937 B
YAML
{{- if .Values.ingress.enabled }}
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-ingress
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: {{ required "A Cluster-Issuer must be provided" .Values.ingress.clusterIssuer }}
|
|
{{- with .Values.ingress.annotations }}
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
ingressClassName: {{ .Values.ingress.className }}
|
|
rules:
|
|
- host: {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
port:
|
|
name: http
|
|
path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- hosts:
|
|
- {{ required "A Domain/Host must be provided" .Values.ingress.domain }}
|
|
secretName: tls-{{ .Release.Name }}-{{ .Chart.Name }}-ingress
|
|
{{- end }}
|