jklein
6320709cbc
Enable readOnlyRootFilesystem and drop all capabilities by default. The paths the image writes at runtime are covered by emptyDirs (/tmp, /opt/app/logs and STATIC_ROOT /opt/app/myapp/static); an init container seeds the static volume with the assets shipped in the image because the directory doubles as the app's static source. The ephemeral-storage request covers the ~90Mi static emptyDir. Move the Ingress to the repo-standard flexible style: ingress.className value (default nginx) instead of a hardcoded ingressClassName, and ingress.annotations merged with the cert-manager annotation. domain and clusterIssuer stay required; the TLS secret name was already standard. Major bump 3.1.2+up1.30.1 -> 4.0.0+up1.30.1 (hardening changes runtime behavior). App version unchanged. Part of #32.
12 lines
292 B
YAML
12 lines
292 B
YAML
apiVersion: v2
|
|
name: voucher-vault
|
|
description: A Helm chart to deploy VoucherVault on Kubernetes
|
|
icon: https://raw.githubusercontent.com/l4rm4nd/VoucherVault/main/myapp/static/assets/img/logo.png
|
|
|
|
type: application
|
|
|
|
version: 4.0.0+up1.30.1
|
|
appVersion: "1.30.1"
|
|
|
|
maintainers:
|
|
- name: jklein |