jklein
4e97097a64
Three changes, all about values that do not do what they promise: 1. Ingress gate (#93): the Ingress template is wrapped in {{- if .Values.ingress.enabled }}. The key already existed in values.yaml with default true but was never read, so switching it off did nothing. Both required() calls for domain and clusterIssuer live inside the Ingress file, so gating also removes the contradiction that one had to supply a domain and issuer in order to turn off an Ingress one does not want. 2. Null-safety for hardening, probes and resources (#99): an override written without children is YAML null and erased the whole default sub-tree, rendering "securityContext: null" - an unhardened container that starts and reports healthy. 3. values.schema.json types (#68 + #99): the blocks covered by the null-safety accept null. This is load-bearing only for keys that have no chart default (e.g. resources.limits): there Helm has nothing to delete, so the null survives into schema validation and a strict "object" type rejected it outright. Rendering with normal values is byte-identical to 7.0.0.
71 lines
2.9 KiB
YAML
71 lines
2.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
spec:
|
|
replicas: {{ include "cyberchef.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.cyberchef.replicas) }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
template:
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- include "cyberchef.podSecurityContext" .Values.cyberchef.securityContext | nindent 8 }}
|
|
containers:
|
|
- name: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
|
|
image: "ghcr.io/gchq/cyberchef:{{ .Chart.AppVersion }}"
|
|
imagePullPolicy: IfNotPresent
|
|
{{- if .Values.cyberchef.env }}
|
|
env:
|
|
{{- range $value := .Values.cyberchef.env }}
|
|
{{- if $value.value }}
|
|
- name: {{ $value.name | quote }}
|
|
value: {{ tpl $value.value $ | quote }}
|
|
{{- else if $value.valueFrom }}
|
|
{{- if $value.valueFrom.secretKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
|
|
key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
|
|
{{- else if $value.valueFrom.configMapKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
|
|
key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
securityContext:
|
|
{{- include "cyberchef.containerSecurityContext" .Values.cyberchef.securityContext | nindent 12 }}
|
|
volumeMounts:
|
|
# nginx-unprivileged keeps its pid file and temp/cache dirs under
|
|
# /tmp, which needs to be writable with a read-only root filesystem.
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
ports:
|
|
- containerPort: 8080
|
|
protocol: TCP
|
|
name: http
|
|
livenessProbe:
|
|
{{- include "cyberchef.livenessProbe" .Values.cyberchef.livenessProbe | nindent 12 }}
|
|
readinessProbe:
|
|
{{- include "cyberchef.readinessProbe" .Values.cyberchef.readinessProbe | nindent 12 }}
|
|
startupProbe:
|
|
{{- include "cyberchef.startupProbe" .Values.cyberchef.startupProbe | nindent 12 }}
|
|
resources:
|
|
{{- include "cyberchef.effectiveResources" .Values.cyberchef.resources | nindent 12 }}
|
|
volumes:
|
|
- name: tmp
|
|
emptyDir: {}
|
|
restartPolicy: Always
|