jklein
f3e8a1b686
The delegation nginx image was hardcoded as nginx:1.28.3 in the deployment template. It is now rendered from the new values matrix.delegation.image.repository / matrix.delegation.image.tag, defaulting to nginx:1.30.4 (current stable line, tag verified against Docker Hub). README documents that auxiliary/sidecar images are pinned via values and reviewed with every app-version update round. Chart version: 4.1.1+upv1.159.0 -> 4.2.0+upv1.159.0 (minor: additive values change).
66 lines
2.2 KiB
YAML
66 lines
2.2 KiB
YAML
# Scale the whole chart down without uninstalling it: scaleDown: true renders
|
|
# every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
|
|
# takes precedence over any per-workload replicas value. PVCs, Secrets and
|
|
# Services stay in place; scaleDown: false brings the workloads back up.
|
|
scaleDown: false
|
|
|
|
matrix:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
serverName: null
|
|
timezone: UTC
|
|
configSecretRef: null
|
|
delegation:
|
|
# Replica count for this workload; 0 is allowed and scales it down.
|
|
# The chart-global scaleDown flag takes precedence.
|
|
replicas: 1
|
|
enabled: false
|
|
serverUrl: null
|
|
# Auxiliary image, pinned independently of appVersion (which tracks
|
|
# Synapse). Reviewed alongside every app-version update round.
|
|
image:
|
|
repository: nginx
|
|
tag: 1.30.4
|
|
# The delegation nginx runs as the image's unprivileged nginx user
|
|
# (uid 101) and listens on the unprivileged port 8080; pid file and temp
|
|
# paths are redirected to the /tmp emptyDir by the mounted nginx.conf.
|
|
securityContext:
|
|
pod:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
memory: "64Mi"
|
|
cpu: "125m"
|
|
ephemeralStorage: "50Mi"
|
|
resources:
|
|
# Limits are optional: memory and ephemeral-storage limits default to
|
|
# limitFactor x the request, an explicitly set limit always wins, and a
|
|
# CPU limit is only set when configured explicitly under "limits".
|
|
limitFactor: 3
|
|
requests:
|
|
memory: "1Gi"
|
|
cpu: "1"
|
|
ephemeralStorage: "1Gi"
|
|
|
|
storage:
|
|
amount: 10Gi
|
|
storageClass: longhorn-encrypted
|
|
|
|
ingress:
|
|
domain: null
|
|
clusterIssuer: null
|