jklein
f6de7ffa80
All audit findings for the calibre-web-automated chart (#32) in one major bump, 3.1.1+upv4.0.6 -> 4.0.0+upv4.0.6: - Rename StatefulSet, Service, OnePasswordItem secret and Ingress from the inverted <chart>-<release>-cwa-<kind> scheme to <release>-<chart>-<kind>; spec.serviceName and all references follow. Both PVCs deliberately keep their historical names (documented naming exception; renaming would orphan the data). - TLS secret renamed to the standard tls-<release>-<chart>-ingress. - Ingress on the repo standard: ingress.className (default nginx), ingress.annotations merged with the chart-managed annotations, ingress.clusterIssuer now required (was silently defaulted to "letsencrypt-issuer"). - Security hardening, values-configurable via securityContext.pod / securityContext.container: allowPrivilegeEscalation false, all capabilities dropped except the minimal set the s6-overlay init needs (CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID). Documented deviations: the image must start as root (s6 drops to PUID 1000) and readOnlyRootFilesystem stays false (read-only mode disables PUID/PGID remapping upstream and breaks the ImageMagick policy setup). - Additive env value rendered through tpl (value / secretKeyRef / configMapKeyRef forms). - CI fixtures: secret renamed to the new scheme, clusterIssuer added to test-values. Part of #32.
93 lines
3.2 KiB
YAML
93 lines
3.2 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
secrets:
|
|
cwaSecretRef: null
|
|
|
|
cwa:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
storage: 10Gi
|
|
storageClass: longhorn
|
|
timezone: "UTC"
|
|
maxUploadFileSize: "10m"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
# The startup probe gates liveness/readiness. Startup budget = 10s * 30 = 300s.
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
cpu: 0.1
|
|
memory: 512Mi
|
|
ephemeralStorage: 100Mi
|
|
# Documented deviation from the repo-wide hardening standard: the CWA image
|
|
# (linuxserver.io-style) must start as root — it boots via the s6-overlay
|
|
# init system, whose stage-1/2 setup runs as uid 0 and then drops the app
|
|
# to the PUID/PGID user (1000), so runAsNonRoot/runAsUser are deliberately
|
|
# not set (s6 supervisors stay root, the application runs as uid 1000).
|
|
# readOnlyRootFilesystem is deliberately false: in read-only mode the image
|
|
# disables the PUID/PGID remapping (the runtime uid would silently change
|
|
# from 1000 to the built-in 911 and break existing volume data) and its
|
|
# init fails to write the ImageMagick policy under /etc. Everything else
|
|
# is hardened: no privilege escalation and all capabilities dropped except
|
|
# the minimal set the s6 init/supervision needs (verified against v4.0.6):
|
|
# CHOWN/DAC_OVERRIDE/FOWNER/SETGID/SETUID for the ownership fix-up of
|
|
# /config etc. and the root->PUID drop, KILL so the root supervisor can
|
|
# signal the uid-1000 services (without it the pod cannot shut down
|
|
# cleanly and gets SIGKILLed).
|
|
securityContext:
|
|
pod:
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: Always
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
- CHOWN
|
|
- DAC_OVERRIDE
|
|
- FOWNER
|
|
- KILL
|
|
- SETGID
|
|
- SETUID
|
|
# Extra environment variables, appended to the ones the chart always sets.
|
|
# Rendered through tpl; value, secretKeyRef and configMapKeyRef forms are
|
|
# supported (see template-chart).
|
|
env: []
|
|
|
|
ingress:
|
|
clusterIssuer: null
|
|
domain: null
|
|
className: nginx
|
|
# Extra annotations for the Ingress; merged with the cert-manager
|
|
# cluster-issuer and proxy-body-size annotations the chart always sets.
|
|
annotations: {}
|