Gabriel Radureau
8b1485e143
Adds VaultAuth + VaultStaticSecret + VaultDynamicSecret templates gated behind .Values.vault.enabled (default false). Default helm install keeps working in degraded mode. Chart becomes Vault-ready without activating Vault dependencies. iac/ terraform + Vault workflow follow as PR-IAC1 (requires user manual prereqs in Vault). Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
123 lines
3.0 KiB
YAML
123 lines
3.0 KiB
YAML
# Default values for dance-lessons-coach.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
|
|
replicaCount: 1
|
|
|
|
image:
|
|
repository: gitea.arcodange.lab/arcodange/dance-lessons-coach
|
|
pullPolicy: Always
|
|
# Overrides the image tag whose default is the chart appVersion.
|
|
tag: ""
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
serviceAccount:
|
|
# Specifies whether a service account should be created
|
|
create: true
|
|
# Automatically mount a ServiceAccount's API credentials?
|
|
automount: true
|
|
# Annotations to add to the service account
|
|
annotations: {}
|
|
# The name of the service account to use.
|
|
# If not set and create is true, a name is generated using the fullname template
|
|
name: ""
|
|
|
|
podAnnotations: {}
|
|
podLabels: {}
|
|
|
|
podSecurityContext: {}
|
|
# fsGroup: 2000
|
|
|
|
securityContext: {}
|
|
# capabilities:
|
|
# drop:
|
|
# - ALL
|
|
# readOnlyRootFilesystem: true
|
|
# runAsNonRoot: true
|
|
# runAsUser: 1000
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 8080
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: ""
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: web
|
|
traefik.ingress.kubernetes.io/router.middlewares: kube-system-crowdsec@kubernetescrd
|
|
hosts:
|
|
- host: dancecoachlessons.arcodange.lab
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls: []
|
|
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/healthz
|
|
port: http
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/healthz
|
|
port: http
|
|
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 1
|
|
maxReplicas: 100
|
|
targetCPUUtilizationPercentage: 80
|
|
# targetMemoryUtilizationPercentage: 80
|
|
|
|
# Additional volumes on the output Deployment definition.
|
|
volumes: []
|
|
# - name: foo
|
|
# secret:
|
|
# secretName: mysecret
|
|
# optional: false
|
|
|
|
# Additional volumeMounts on the output Deployment definition.
|
|
volumeMounts: []
|
|
# - name: foo
|
|
# mountPath: "/etc/foo"
|
|
# readOnly: true
|
|
|
|
nodeSelector:
|
|
kubernetes.io/hostname: pi1
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|
|
|
|
# Vault Secrets Operator integration. Disabled by default ; set vault.enabled=true
|
|
# to render the VaultAuth / VaultStaticSecret / VaultDynamicSecret CRDs (requires
|
|
# VSO operator + Vault prereqs, cf. iac/ once shipped).
|
|
vault:
|
|
enabled: false
|
|
role: dance-lessons-coach # k8s auth backend role name (matches iac/main.tf)
|
|
kvv2Path: dance-lessons-coach/config # KVv2 secret path
|
|
postgresPath: creds/dance-lessons-coach # postgres dynamic creds path
|
|
|
|
# DLC-specific configuration
|
|
config:
|
|
DLC_LOGGING_JSON: "true"
|
|
DLC_LOGGING_LEVEL: "info"
|
|
DLC_DATABASE_HOST: ""
|
|
DLC_DATABASE_PORT: "5432"
|
|
DLC_API_V2_ENABLED: "false"
|