jklein
fbe0dbac81
Chart rewrite for the 2.x single-server architecture: one stateless server deployment (frontend embedded, /api served by the same process), no PVC, single service and ingress path, optional guacd sidecar (disabled by default), 2.x env vocabulary (TRUST_PROXY, readonly role), probes send the public hostname as Host header. Fixes #29: all three reported spots (PVC storageClass guard, RWX assets PVC, frontend nginx 'backend' hostname) are removed by this rewrite.
80 lines
2.9 KiB
YAML
80 lines
2.9 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
patchmon:
|
|
server:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
# Note: the server registers itself in the agent presence registry under a
|
|
# stable identity (the pod hostname, pinned by the chart). Running more
|
|
# than one replica requires a distinct identity per replica and is not
|
|
# supported by this chart.
|
|
replicas: 1
|
|
# The 2.x server image is a hardened Alpine image running as uid 65532
|
|
# (nonroot). It is stateless: frontend, agent binaries and SCAP content
|
|
# are baked into the image, so the root filesystem stays read-only; /tmp
|
|
# is provided as an emptyDir.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 256Mi
|
|
ephemeral-storage: 10Mi
|
|
guacd:
|
|
# In-browser RDP for Windows hosts (beta) via the Apache Guacamole daemon,
|
|
# run as a sidecar container in the server pod. Disabled by default; when
|
|
# enabled, the server is pointed at it via GUACD_ADDRESS=127.0.0.1:4822.
|
|
enabled: false
|
|
# guacd is an independent upstream application, so its image is not tied
|
|
# to the chart's appVersion. Pinned to the version upstream ships with.
|
|
image: guacamole/guacd:1.6.0
|
|
# The image runs as its own unprivileged user (uid 1000); it only needs a
|
|
# writable /tmp, which the chart provides as an emptyDir.
|
|
securityContext:
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.05
|
|
memory: 64Mi
|
|
ephemeral-storage: 10Mi
|
|
|
|
ingress:
|
|
clusterIssuer: null
|
|
domain: null
|
|
|
|
secrets:
|
|
redisSecretRef: null
|
|
postgresSecretRef: null
|
|
oidcSecretRef: null
|
|
patchmonSecretRef: null
|