jklein
f6de7ffa80
All audit findings for the calibre-web-automated chart (#32) in one major bump, 3.1.1+upv4.0.6 -> 4.0.0+upv4.0.6: - Rename StatefulSet, Service, OnePasswordItem secret and Ingress from the inverted <chart>-<release>-cwa-<kind> scheme to <release>-<chart>-<kind>; spec.serviceName and all references follow. Both PVCs deliberately keep their historical names (documented naming exception; renaming would orphan the data). - TLS secret renamed to the standard tls-<release>-<chart>-ingress. - Ingress on the repo standard: ingress.className (default nginx), ingress.annotations merged with the chart-managed annotations, ingress.clusterIssuer now required (was silently defaulted to "letsencrypt-issuer"). - Security hardening, values-configurable via securityContext.pod / securityContext.container: allowPrivilegeEscalation false, all capabilities dropped except the minimal set the s6-overlay init needs (CHOWN, DAC_OVERRIDE, FOWNER, KILL, SETGID, SETUID). Documented deviations: the image must start as root (s6 drops to PUID 1000) and readOnlyRootFilesystem stays false (read-only mode disables PUID/PGID remapping upstream and breaks the ImageMagick policy setup). - Additive env value rendered through tpl (value / secretKeyRef / configMapKeyRef forms). - CI fixtures: secret renamed to the new scheme, clusterIssuer added to test-values. Part of #32.
14 lines
264 B
YAML
14 lines
264 B
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
spec:
|
|
selector:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
ports:
|
|
- protocol: TCP
|
|
port: 80
|
|
targetPort: http
|
|
name: http
|
|
type: ClusterIP
|