initial commit

deploy/dev/values-dev-cluster.yaml

@@ -0,0 +1,90 @@
+# go-bananas on the development cluster.
+#
+# Reproduce with:
+#
+#   helm upgrade --install go-bananas deploy/helm/go-bananas \
+#     --namespace go-insane-dev -f deploy/dev/values-dev-cluster.yaml \
+#     --server-side=false --disable-openapi-validation \
+#     --wait
+#
+# Two flags are needed for this cluster specifically, and neither is a chart defect.
+#
+#   --server-side=false              The cluster's OpenAPI validation is incomplete:
+#                                    it rejects `imagePullPolicy` and `lifecycle` at
+#                                    `spec.template.spec` as undeclared fields on a
+#                                    k8s 1.36 API server. A hand-written Deployment
+#                                    with those two fields fails the same way. Helm 4
+#                                    uses server-side apply by default, which hits it.
+#   --disable-openapi-validation     The same broken schema, on the client side.
+#
+# Nothing else in the cluster needs these; they are here so this release is
+# reproducible rather than "whatever worked when it was deployed".
+
+image:
+  # The development cluster pulls from a private registry whose certificate is valid
+  # for a different name, so the host and the port have to stay in one piece: putting
+  # the port in `repository` renders an image reference without it, and the kubelet
+  # then resolves the registry over https on port 443.
+  registry: batty1039.startdedicated.net:5000
+  repository: go-bananas
+  # The development registry is tagged `latest` rather than pinned to a version, to
+  # match every other release in this namespace. Consequently the pull policy must be
+  # Always: with IfNotPresent a node keeps serving the image it already has, and a
+  # redeploy silently does nothing.
+  tag: latest
+  pullPolicy: Always
+
+config:
+  # development, which is what permits the dev identity mode below. The application
+  # refuses both of these outside a development environment, so this pair cannot be
+  # promoted to production by accident.
+  environment: development
+  publicBaseUrl: https://bananas-dev.urpi.be
+
+identity:
+  # dev, not oidc.
+  #
+  # OIDC is the correct production mode and the chart is wired for it, but it cannot
+  # be used here yet: the cluster's CoreDNS returns NXDOMAIN for public names, so the
+  # issuer is unreachable from inside the cluster and the pod crash-loops in OIDC
+  # discovery. That is a cluster DNS problem, not a chart one, and it also explains why
+  # no certificate in this namespace has been issued.
+  #
+  # To switch, create the secret and set the OIDC values:
+  #
+  #   kubectl create secret generic go-bananas-auth -n go-insane-dev \
+  #     --from-literal=session-secret="$(openssl rand -base64 48)" \
+  #     --from-literal=oidc-client-secret='<from the provider>'
+  #
+  #   helm upgrade ... --set identity.mode=oidc \
+  #     --set identity.oidc.generateSecret=false \
+  #     --set identity.oidc.existingSecret=go-bananas-auth \
+  #     --set identity.oidc.issuer=https://auth-dev.urpi.be \
+  #     --set identity.oidc.clientId=go-bananas
+  mode: dev
+  oidc:
+    issuer: https://auth-dev.urpi.be
+    clientId: go-bananas
+    existingSecret: go-bananas-auth
+    generateSecret: false
+
+ingress:
+  enabled: true
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  hosts:
+    - host: bananas-dev.urpi.be
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: go-bananas-tls
+      hosts:
+        - bananas-dev.urpi.be
+
+deployment:
+  # One replica. The volume is ReadWriteOnce, so a second replica cannot mount it and
+  # would sit in ImagePullBackOff-equivalent limbo forever. Scaling needs either this
+  # changed to 1 or a ReadWriteMany filesystem.
+  replicaCount: 1