jklein
24d3366e8b
No ingress gate: this chart has no Ingress at all (SMB and NetBIOS are exposed via NodePort), and ingress.domain appears neither in its templates nor in its values. 1. values.schema.json (#68): additionalProperties: false on every chart-owned object level, including the entries of the samba.shares list. 2. Null-safety for hardening, probes and resources (#99). This chart's hardening is a documented deviation forced by the ghcr.io/dockur/samba image, and the fallbacks reproduce it exactly instead of restoring the repo standard: no runAs* values (the entrypoint creates Unix users and smbd impersonates the share user per session, both requiring a root start), readOnlyRootFilesystem stays false (the entrypoint writes /etc/passwd, /etc/group, the healthcheck symlink and the Samba TDBs), and capabilities.add keeps the six entries a multi-user root file server needs. Restoring the standard here would stop the file server from working. The probes target the SMB TCP port directly, because SMB is not HTTP. The users.conf / checksum-config limitation from #82 is untouched: Helm never sees the Secret content, so it cannot be hashed, and the comment in values.yaml documenting the manual rollout restart stays as it is. Rendering with normal values is byte-identical to 5.0.0.
108 lines
4.3 KiB
YAML
108 lines
4.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
spec:
|
|
replicas: {{ include "samba.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.samba.replicas) }}
|
|
serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
template:
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
annotations:
|
|
# Hash of the rendered ConfigMap: a changed smb.conf (i.e. a changed
|
|
# samba.shares list) changes the pod template and thus restarts the
|
|
# pod. Without it a new or renamed share never reaches the running
|
|
# smbd - smb.conf is mounted with subPath (never refreshed by the
|
|
# kubelet) and is read once at start.
|
|
# users.conf is NOT covered: it comes from a 1Password-backed Secret
|
|
# whose content Helm never sees. See secrets.sambaUsersSecretRef in
|
|
# values.yaml.
|
|
checksum/config: {{ include (print $.Template.BasePath "/samba-config.configmap.yaml") . | sha256sum }}
|
|
spec:
|
|
containers:
|
|
- name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
image: "ghcr.io/dockur/samba:{{ .Chart.AppVersion }}"
|
|
imagePullPolicy: IfNotPresent
|
|
{{- with .Values.samba.env }}
|
|
env:
|
|
{{- range $value := . }}
|
|
{{- if $value.value }}
|
|
- name: {{ $value.name }}
|
|
value: {{ tpl $value.value $ | quote }}
|
|
{{- else if $value.valueFrom }}
|
|
{{- if $value.valueFrom.secretKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
|
|
key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
|
|
{{- else if $value.valueFrom.configMapKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
|
|
key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
ports:
|
|
- containerPort: 445
|
|
protocol: TCP
|
|
- containerPort: 139
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- name: smb-config
|
|
mountPath: "/etc/samba/smb.conf"
|
|
readOnly: true
|
|
subPath: smb.conf
|
|
- name: smb-users
|
|
mountPath: "/etc/samba/users.conf"
|
|
readOnly: true
|
|
subPath: users.conf
|
|
{{- range $index, $value := .Values.samba.shares }}
|
|
|
|
- name: "{{ $value.name }}"
|
|
mountPath: "/shares/{{ $value.name }}"
|
|
{{- end }}
|
|
livenessProbe:
|
|
{{- include "samba.livenessProbe" .Values.samba.livenessProbe | nindent 12 }}
|
|
readinessProbe:
|
|
{{- include "samba.readinessProbe" .Values.samba.readinessProbe | nindent 12 }}
|
|
startupProbe:
|
|
{{- include "samba.startupProbe" .Values.samba.startupProbe | nindent 12 }}
|
|
resources:
|
|
{{- include "samba.effectiveResources" .Values.samba.resources | nindent 12 }}
|
|
securityContext:
|
|
{{- include "samba.containerSecurityContext" .Values.samba.securityContext | nindent 12 }}
|
|
restartPolicy: Always
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- include "samba.podSecurityContext" .Values.samba.securityContext | nindent 8 }}
|
|
volumes:
|
|
- name: smb-config
|
|
configMap:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-configmap
|
|
items:
|
|
- key: smb.conf
|
|
path: smb.conf
|
|
- name: smb-users
|
|
secret:
|
|
secretName: {{ .Release.Name }}-{{ .Chart.Name }}-users-secret
|
|
items:
|
|
- key: users.conf
|
|
path: users.conf
|
|
{{- range $index, $value := .Values.samba.shares }}
|
|
|
|
- name: "{{ $value.name }}"
|
|
persistentVolumeClaim:
|
|
claimName: "{{ $.Release.Name }}-{{ $value.name }}-volume-claim"
|
|
{{- end }}
|