jklein
f6de7ffa80
All audit findings for the calibre-web-automated chart (#32) in one major bump, 3.1.1+upv4.0.6 -> 4.0.0+upv4.0.6: - Rename StatefulSet, Service, OnePasswordItem secret and Ingress from the inverted <chart>-<release>-cwa-<kind> scheme to <release>-<chart>-<kind>; spec.serviceName and all references follow. Both PVCs deliberately keep their historical names (documented naming exception; renaming would orphan the data). - TLS secret renamed to the standard tls-<release>-<chart>-ingress. - Ingress on the repo standard: ingress.className (default nginx), ingress.annotations merged with the chart-managed annotations, ingress.clusterIssuer now required (was silently defaulted to "letsencrypt-issuer"). - Security hardening, values-configurable via securityContext.pod / securityContext.container: allowPrivilegeEscalation false, all capabilities dropped except the minimal set the s6-overlay init needs (CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID). Documented deviations: the image must start as root (s6 drops to PUID 1000) and readOnlyRootFilesystem stays false (read-only mode disables PUID/PGID remapping upstream and breaks the ImageMagick policy setup). - Additive env value rendered through tpl (value / secretKeyRef / configMapKeyRef forms). - CI fixtures: secret renamed to the new scheme, clusterIssuer added to test-values. Part of #32.
85 lines
2.1 KiB
YAML
85 lines
2.1 KiB
YAML
# Fixtures for the calibre-web-automated install-test: the cwa secret the
|
|
# 1Password operator would otherwise materialize and static hostPath PVs
|
|
# (the consume PVC is ReadWriteMany, which local-path cannot provision).
|
|
# Release name is ci; resources are named <release>-<chart>-..., except the
|
|
# PVCs, which keep their historical <chart>-<release>-cwa-* names
|
|
# (documented naming exception, see README).
|
|
apiVersion: storage.k8s.io/v1
|
|
kind: StorageClass
|
|
metadata:
|
|
name: ci-static
|
|
provisioner: kubernetes.io/no-provisioner
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: node-setup
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: setup
|
|
image: public.ecr.aws/docker/library/busybox:1.36
|
|
command:
|
|
- sh
|
|
- -c
|
|
- >
|
|
mkdir -p /pv/cwa/data /pv/cwa/consume &&
|
|
chmod -R 0777 /pv/cwa
|
|
volumeMounts:
|
|
- name: pv
|
|
mountPath: /pv
|
|
volumes:
|
|
- name: pv
|
|
hostPath:
|
|
path: /var/lib/ci-pv
|
|
type: DirectoryOrCreate
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolume
|
|
metadata:
|
|
name: ci-cwa-data
|
|
spec:
|
|
capacity:
|
|
storage: 2Gi
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
persistentVolumeReclaimPolicy: Retain
|
|
storageClassName: ci-static
|
|
claimRef:
|
|
namespace: default
|
|
name: calibre-web-automated-ci-cwa-pvc
|
|
hostPath:
|
|
path: /var/lib/ci-pv/cwa/data
|
|
type: DirectoryOrCreate
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolume
|
|
metadata:
|
|
name: ci-cwa-consume
|
|
spec:
|
|
capacity:
|
|
storage: 1Gi
|
|
accessModes:
|
|
- ReadWriteMany
|
|
persistentVolumeReclaimPolicy: Retain
|
|
storageClassName: ci-static
|
|
claimRef:
|
|
namespace: default
|
|
name: calibre-web-automated-ci-cwa-consume-pvc
|
|
hostPath:
|
|
path: /var/lib/ci-pv/cwa/consume
|
|
type: DirectoryOrCreate
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: ci-calibre-web-automated-secret
|
|
stringData:
|
|
hardcover-api-token: ci-dummy-token
|
|
# Mounted as /config/.config/calibre/customize.py.json (calibre plugin
|
|
# registry); an empty JSON object is a valid file.
|
|
calibre-plugins: "{}"
|