951dd8d26b
Some checks failed
ci / go (push) Has been cancelled
ci / admin-ui (push) Has been cancelled
ci / runtime-sdk (push) Has been cancelled
ci / helm (push) Has been cancelled
ci / openapi (push) Has been cancelled
ci / container (push) Has been cancelled
ci / release-config (push) Has been cancelled
ci / shared styling (push) Has been cancelled
ci / security (push) Has been cancelled
ci / all green (push) Has been cancelled
93 lines
No EOL
4.4 KiB
YAML
93 lines
No EOL
4.4 KiB
YAML
{{/*
|
|
The ConfigMap holding every non-secret setting.
|
|
|
|
Splitting configuration from secrets is the point of this file: a ConfigMap is
|
|
readable by anyone with namespace access and appears in `kubectl describe`, so
|
|
nothing sensitive can end up in one by accident.
|
|
*/}}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "go-bananas.fullname" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "go-bananas.labels" . | nindent 4 }}
|
|
{{- with .Values.global.extraAnnotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
data:
|
|
# ---------------------------------------------------------------- runtime ---
|
|
BANANAS_ENVIRONMENT: {{ .Values.config.environment | quote }}
|
|
BANANAS_HTTP_ADDR: ":8080"
|
|
BANANAS_PUBLIC_BASE_URL: {{ include "go-bananas.publicUrl" . | quote }}
|
|
BANANAS_BASE_PATH: {{ include "go-bananas.basePath" . | quote }}
|
|
BANANAS_STATIC_DIR: "/srv/web"
|
|
BANANAS_SDK_DIR: "/srv/sdk"
|
|
|
|
BANANAS_LOG_LEVEL: {{ .Values.config.logLevel | quote }}
|
|
BANANAS_LOG_FORMAT: {{ .Values.config.logFormat | quote }}
|
|
|
|
# ---------------------------------------------------------------- storage ---
|
|
BANANAS_DATABASE_PATH: {{ include "go-bananas.databasePath" . | quote }}
|
|
BANANAS_DB_MAX_CONNS: {{ .Values.config.database.maxConns | quote }}
|
|
BANANAS_DB_BUSY_TIMEOUT: {{ printf "%dms" (int .Values.config.database.busyTimeoutMs) | quote }}
|
|
BANANAS_SEED_ON_START: "true"
|
|
|
|
# ------------------------------------------------------------------- http ---
|
|
BANANAS_HTTP_READ_TIMEOUT: "15s"
|
|
BANANAS_HTTP_WRITE_TIMEOUT: "30s"
|
|
BANANAS_HTTP_IDLE_TIMEOUT: "120s"
|
|
BANANAS_SHUTDOWN_TIMEOUT: {{ printf "%dms" (int .Values.config.shutdownTimeoutMs) | quote }}
|
|
BANANAS_RATE_LIMIT_PER_MINUTE: {{ .Values.config.rateLimitPerMinute | quote }}
|
|
BANANAS_ENABLE_METRICS: {{ .Values.config.enableMetrics | quote }}
|
|
BANANAS_ENABLE_PROFILER: {{ .Values.config.enableProfiler | quote }}
|
|
|
|
# Rendered as a comma-separated list because that is what the config loader
|
|
# parses. An empty value is deliberate: it means forwarding headers are ignored,
|
|
# so the audit log records the real peer rather than a spoofable header.
|
|
BANANAS_TRUSTED_PROXIES: {{ join "," .Values.config.trustedProxies | quote }}
|
|
BANANAS_CORS_ALLOWED_ORIGINS: {{ join "," .Values.config.corsAllowedOrigins | quote }}
|
|
|
|
# ----------------------------------------------------------------- runtime ---
|
|
BANANAS_RUNTIME_PUBLIC: "true"
|
|
BANANAS_RUNTIME_CACHE_CONTROL: "public, max-age=60, s-maxage=300, stale-while-revalidate=86400"
|
|
# Set this when assets are served from a CDN, so the manifest hands consumers the
|
|
# CDN URL rather than this service.
|
|
BANANAS_RUNTIME_CDN_BASE_URL: {{ .Values.config.runtimeCdnBaseUrl | default "" | quote }}
|
|
|
|
# ------------------------------------------------------------- identity ---
|
|
BANANAS_AUTH_MODE: {{ .Values.identity.mode | quote }}
|
|
|
|
{{- if eq .Values.identity.mode "oidc" }}
|
|
BANANAS_OIDC_ISSUER: {{ .Values.identity.oidc.issuer | quote }}
|
|
BANANAS_OIDC_CLIENT_ID: {{ .Values.identity.oidc.clientId | quote }}
|
|
BANANAS_OIDC_SCOPES: {{ join "," .Values.identity.oidc.scopes | quote }}
|
|
BANANAS_OIDC_REDIRECT_URL: {{ .Values.identity.oidc.redirectURL | default "" | quote }}
|
|
BANANAS_OIDC_POST_LOGOUT_REDIRECT_URL: {{ .Values.identity.oidc.postLogoutRedirectURL | default "" | quote }}
|
|
{{- with .Values.identity.oidc.adminGroups }}
|
|
BANANAS_OIDC_ADMIN_GROUPS: {{ join "," . | quote }}
|
|
{{- end }}
|
|
{{- with .Values.identity.oidc.editorGroups }}
|
|
BANANAS_OIDC_EDITOR_GROUPS: {{ join "," . | quote }}
|
|
{{- end }}
|
|
{{- with .Values.identity.oidc.viewerGroups }}
|
|
BANANAS_OIDC_VIEWER_GROUPS: {{ join "," . | quote }}
|
|
{{- end }}
|
|
{{- if .Values.identity.oidc.skipTLSVerify }}
|
|
BANANAS_OIDC_SKIP_TLS_VERIFY: "true"
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- if eq .Values.identity.mode "dev" }}
|
|
# Development bypass: every request is a local administrator. The application
|
|
# refuses to start in this mode outside a development environment, so this block
|
|
# is refused by config.environment: production above.
|
|
BANANAS_DEV_FALLBACK_ROLE: "admin"
|
|
{{- end }}
|
|
|
|
# ----------------------------------------------------------------- session ---
|
|
BANANAS_SESSION_COOKIE_NAME: "go-bananas-session"
|
|
BANANAS_SESSION_TTL: {{ printf "%dh" (int .Values.config.sessionTTLHours) | quote }}
|
|
BANANAS_SESSION_SECURE: {{ .Values.service.sessionSecure | quote }}
|
|
BANANAS_SESSION_SAMESITE: {{ .Values.service.sessionSameSite | quote }} |