90 lines
3.7 KiB
YAML
90 lines
3.7 KiB
YAML
|
# go-bananas on the development cluster.
|
||
|
|
#
|
||
|
|
# Reproduce with:
|
||
|
|
#
|
||
|
|
# helm upgrade --install go-bananas deploy/helm/go-bananas \
|
||
|
|
# --namespace go-insane-dev -f deploy/dev/values-dev-cluster.yaml \
|
||
|
|
# --server-side=false --disable-openapi-validation \
|
||
|
|
# --wait
|
||
|
|
#
|
||
|
|
# Two flags are needed for this cluster specifically, and neither is a chart defect.
|
||
|
|
#
|
||
|
|
# --server-side=false The cluster's OpenAPI validation is incomplete:
|
||
|
|
# it rejects `imagePullPolicy` and `lifecycle` at
|
||
|
|
# `spec.template.spec` as undeclared fields on a
|
||
|
|
# k8s 1.36 API server. A hand-written Deployment
|
||
|
|
# with those two fields fails the same way. Helm 4
|
||
|
|
# uses server-side apply by default, which hits it.
|
||
|
|
# --disable-openapi-validation The same broken schema, on the client side.
|
||
|
|
#
|
||
|
|
# Nothing else in the cluster needs these; they are here so this release is
|
||
|
|
# reproducible rather than "whatever worked when it was deployed".
|
||
|
|
|
||
|
|
image:
|
||
|
|
# The development cluster pulls from a private registry whose certificate is valid
|
||
|
|
# for a different name, so the host and the port have to stay in one piece: putting
|
||
|
|
# the port in `repository` renders an image reference without it, and the kubelet
|
||
|
|
# then resolves the registry over https on port 443.
|
||
|
|
registry: batty1039.startdedicated.net:5000
|
||
|
|
repository: go-bananas
|
||
|
|
# The development registry is tagged `latest` rather than pinned to a version, to
|
||
|
|
# match every other release in this namespace. Consequently the pull policy must be
|
||
|
|
# Always: with IfNotPresent a node keeps serving the image it already has, and a
|
||
|
|
# redeploy silently does nothing.
|
||
|
|
tag: latest
|
||
|
|
pullPolicy: Always
|
||
|
|
|
||
|
|
config:
|
||
|
|
# development, which is what permits the dev identity mode below. The application
|
||
|
|
# refuses both of these outside a development environment, so this pair cannot be
|
||
|
|
# promoted to production by accident.
|
||
|
|
environment: development
|
||
|
|
publicBaseUrl: https://bananas-dev.urpi.be
|
||
|
|
|
||
|
|
identity:
|
||
|
|
# dev, not oidc.
|
||
|
|
#
|
||
|
|
# OIDC is the correct production mode and the chart is wired for it, but it cannot
|
||
|
|
# be used here yet: the cluster's CoreDNS returns NXDOMAIN for public names, so the
|
||
|
|
# issuer is unreachable from inside the cluster and the pod crash-loops in OIDC
|
||
|
|
# discovery. That is a cluster DNS problem, not a chart one, and it also explains why
|
||
|
|
# no certificate in this namespace has been issued.
|
||
|
|
#
|
||
|
|
# To switch, create the secret and set the OIDC values:
|
||
|
|
#
|
||
|
|
# kubectl create secret generic go-bananas-auth -n go-insane-dev \
|
||
|
|
# --from-literal=session-secret="$(openssl rand -base64 48)" \
|
||
|
|
# --from-literal=oidc-client-secret='<from the provider>'
|
||
|
|
#
|
||
|
|
# helm upgrade ... --set identity.mode=oidc \
|
||
|
|
# --set identity.oidc.generateSecret=false \
|
||
|
|
# --set identity.oidc.existingSecret=go-bananas-auth \
|
||
|
|
# --set identity.oidc.issuer=https://auth-dev.urpi.be \
|
||
|
|
# --set identity.oidc.clientId=go-bananas
|
||
|
|
mode: dev
|
||
|
|
oidc:
|
||
|
|
issuer: https://auth-dev.urpi.be
|
||
|
|
clientId: go-bananas
|
||
|
|
existingSecret: go-bananas-auth
|
||
|
|
generateSecret: false
|
||
|
|
|
||
|
|
ingress:
|
||
|
|
enabled: true
|
||
|
|
annotations:
|
||
|
|
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||
|
|
hosts:
|
||
|
|
- host: bananas-dev.urpi.be
|
||
|
|
paths:
|
||
|
|
- path: /
|
||
|
|
pathType: Prefix
|
||
|
|
tls:
|
||
|
|
- secretName: go-bananas-tls
|
||
|
|
hosts:
|
||
|
|
- bananas-dev.urpi.be
|
||
|
|
|
||
|
|
deployment:
|
||
|
|
# One replica. The volume is ReadWriteOnce, so a second replica cannot mount it and
|
||
|
|
# would sit in ImagePullBackOff-equivalent limbo forever. Scaling needs either this
|
||
|
|
# changed to 1 or a ReadWriteMany filesystem.
|
||
|
|
replicaCount: 1
|