From 5765c6be8b8daac30ba4d86c8832ec7265103604 Mon Sep 17 00:00:00 2001 From: Daniel Noulet Date: Wed, 7 Oct 2026 15:08:11 +0200 Subject: [PATCH] changed deployment --- deploy/helm/go-guess/values-dev.yaml | 11 +- deploy/helm/go-guess/values-lcl.yaml | 181 +++++++++++++++++++++++++++ deploy/helm/go-guess/values-prd.yaml | 11 +- deploy/helm/go-guess/values-tst.yaml | 177 ++++++++++++++++++++++++++ deploy/helm/go-guess/values.yaml | 9 +- 5 files changed, 375 insertions(+), 14 deletions(-) create mode 100644 deploy/helm/go-guess/values-lcl.yaml create mode 100644 deploy/helm/go-guess/values-tst.yaml diff --git a/deploy/helm/go-guess/values-dev.yaml b/deploy/helm/go-guess/values-dev.yaml index a03310c..00b8b87 100644 --- a/deploy/helm/go-guess/values-dev.yaml +++ b/deploy/helm/go-guess/values-dev.yaml @@ -10,7 +10,8 @@ tenants: - nmbs - ypto -imagePullSecrets: [] +imagePullSecrets: + - name: nexus-registry api: podSecurityContext: @@ -26,8 +27,8 @@ api: runAsGroup: 100 replicaCount: 1 image: - repository: batty1039.startdedicated.net:5000/go-guess-api - tag: "latest" + repository: nexus.urpi.be/docker-hosted/go-guess + tag: "0.0.1" pullPolicy: Always environment: development frontendURL: "" @@ -66,8 +67,8 @@ api: web: replicaCount: 1 image: - repository: batty1039.startdedicated.net:5000/go-guess-web - tag: "latest" + repository: nexus.urpi.be/docker-hosted/go-guess + tag: "0.0.1" pullPolicy: Always service: type: ClusterIP diff --git a/deploy/helm/go-guess/values-lcl.yaml b/deploy/helm/go-guess/values-lcl.yaml new file mode 100644 index 0000000..c1acb08 --- /dev/null +++ b/deploy/helm/go-guess/values-lcl.yaml @@ -0,0 +1,181 @@ +# Local (LCL) values for go-guess. +# Tenants are served at https://.guess-lcl.intern-urpi.be +# (nmbs, ypto), routed by the docker TLS edge into k3s Traefik. +nameOverride: "" +fullnameOverride: "" + +# Public application domain. Every tenant is served from https://.. +domain: guess-lcl.intern-urpi.be + +# Tenant slugs. Each one gets its own ingress host and TLS SAN. +tenants: + - nmbs + - ypto + +# Images live in the local registry (localhost:5000), no pull secret needed. +imagePullSecrets: [] + +api: + podSecurityContext: + runAsNonRoot: true + runAsUser: 100 + runAsGroup: 100 + fsGroup: 100 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 100 + runAsGroup: 100 + replicaCount: 1 + image: + repository: localhost:5000/go-guess + tag: "0.0.1" + pullPolicy: IfNotPresent + environment: development + frontendURL: "" + tokenTTL: 8h + maxUploadMB: 10 + service: + name: api + type: ClusterIP + port: 8080 + goLoose: + enabled: true + authDomain: auth-lcl.intern-urpi.be + # local-ca is the certificate authority used by the docker TLS edge + # (dev-infrastructure/certs/local-ca.crt). + ca: + existingSecret: "local-ca" + key: ca.crt + mountPath: /certs/local-ca.crt + tenants: + nmbs: + clientID: "" + clientSecret: "" + ypto: + clientID: "" + clientSecret: "" + resources: + requests: + cpu: 50m + memory: 96Mi + limits: + cpu: 300m + memory: 384Mi + podAnnotations: {} + podLabels: {} + strategy: + type: Recreate + +web: + replicaCount: 1 + image: + repository: localhost:5000/go-guess + tag: "0.0.1" + pullPolicy: IfNotPresent + service: + type: ClusterIP + port: 80 + nodePort: null + resources: + requests: + cpu: 25m + memory: 32Mi + limits: + cpu: 200m + memory: 96Mi + podAnnotations: {} + podLabels: {} + podSecurityContext: {} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + add: + - CHOWN + - SETGID + - SETUID + - NET_BIND_SERVICE + readOnlyRootFilesystem: false + runAsNonRoot: false + runAsUser: 0 + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + +ingress: + enabled: true + className: traefik + annotations: {} + path: / + pathType: Prefix + tls: + enabled: true + # local-dev-cert is signed by the local CA (dev-infrastructure/certs). + existingSecret: "local-dev-cert" + secretName: "" + +# No cert-manager in the local cluster. +certManager: + enabled: false + issuerRef: null + duration: 8760h + renewBefore: 720h + caSecretName: "" + +# Empty values are generated once and preserved in the release secret. +secrets: + jwtSecret: "" + databaseURL: "" + rabbitmqURL: "" + postgresqlPassword: "" + rabbitmqPassword: "" + +postgresql: + enabled: true + image: + repository: postgres + tag: 18-alpine + pullPolicy: IfNotPresent + auth: + username: go_guess + database: go_guess + persistence: + enabled: true + size: 2Gi + storageClass: "" + resources: + requests: + cpu: 50m + memory: 96Mi + limits: + cpu: 300m + memory: 384Mi + +rabbitmq: + enabled: true + image: + repository: rabbitmq + tag: 4-alpine + pullPolicy: IfNotPresent + auth: + username: go_guess + persistence: + enabled: true + size: 2Gi + storageClass: "" + resources: + requests: + cpu: 50m + memory: 96Mi + limits: + cpu: 300m + memory: 384Mi + +nodeSelector: {} +tolerations: [] +affinity: {} diff --git a/deploy/helm/go-guess/values-prd.yaml b/deploy/helm/go-guess/values-prd.yaml index a3847ec..ddc5f0f 100644 --- a/deploy/helm/go-guess/values-prd.yaml +++ b/deploy/helm/go-guess/values-prd.yaml @@ -10,7 +10,8 @@ tenants: - nmbs - ypto -imagePullSecrets: [] +imagePullSecrets: + - name: nexus-registry api: podSecurityContext: @@ -26,8 +27,8 @@ api: runAsGroup: 100 replicaCount: 2 image: - repository: batty1039.startdedicated.net:5000/go-guess-api - tag: "latest" + repository: nexus.urpi.be/docker-hosted/go-guess + tag: "0.0.1" pullPolicy: Always environment: production frontendURL: "" @@ -69,8 +70,8 @@ api: web: replicaCount: 2 image: - repository: batty1039.startdedicated.net:5000/go-guess-web - tag: "latest" + repository: nexus.urpi.be/docker-hosted/go-guess + tag: "0.0.1" pullPolicy: Always service: type: ClusterIP diff --git a/deploy/helm/go-guess/values-tst.yaml b/deploy/helm/go-guess/values-tst.yaml new file mode 100644 index 0000000..977fdbb --- /dev/null +++ b/deploy/helm/go-guess/values-tst.yaml @@ -0,0 +1,177 @@ +# TST values for go-guess +nameOverride: "" +fullnameOverride: "" + +# Public application domain. Every tenant is served from https://.. +domain: guess-tst.intern-urpi.be + +# Tenant slugs. Each one gets its own ingress host and TLS SAN. +tenants: + - nmbs + - ypto + +imagePullSecrets: + - name: nexus-registry + +api: + podSecurityContext: + runAsNonRoot: true + runAsUser: 100 + runAsGroup: 100 + fsGroup: 100 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 100 + runAsGroup: 100 + replicaCount: 1 + image: + repository: nexus.urpi.be/docker-hosted/go-guess + tag: "0.0.1" + pullPolicy: Always + environment: development + frontendURL: "" + tokenTTL: 8h + maxUploadMB: 10 + service: + name: api + type: ClusterIP + port: 8080 + goLoose: + enabled: true + authDomain: auth-tst.intern-urpi.be + ca: + existingSecret: "" + key: ca.crt + mountPath: /certs/local-ca.crt + tenants: + nmbs: + clientID: "" + clientSecret: "" + ypto: + clientID: "" + clientSecret: "" + resources: + requests: + cpu: 50m + memory: 96Mi + limits: + cpu: 300m + memory: 384Mi + podAnnotations: {} + podLabels: {} + strategy: + type: Recreate + +web: + replicaCount: 1 + image: + repository: nexus.urpi.be/docker-hosted/go-guess + tag: "0.0.1" + pullPolicy: Always + service: + type: ClusterIP + port: 80 + nodePort: null + resources: + requests: + cpu: 25m + memory: 32Mi + limits: + cpu: 200m + memory: 96Mi + podAnnotations: {} + podLabels: {} + podSecurityContext: {} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: false + runAsNonRoot: false + runAsUser: 0 + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + +ingress: + enabled: true + className: nginx + annotations: + nginx.ingress.kubernetes.io/proxy-body-size: 10m + nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" + nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" + nginx.ingress.kubernetes.io/proxy-buffering: "off" + nginx.ingress.kubernetes.io/ssl-redirect: "true" + cert-manager.io/cluster-issuer: letsencrypt-staging + path: / + pathType: Prefix + tls: + enabled: true + existingSecret: "" + secretName: "" + +certManager: + enabled: true + issuerRef: + name: letsencrypt-staging + kind: ClusterIssuer + duration: 8760h + renewBefore: 720h + caSecretName: "" + +secrets: + jwtSecret: "" + databaseURL: "" + rabbitmqURL: "" + postgresqlPassword: "" + rabbitmqPassword: "" + +postgresql: + enabled: true + image: + repository: postgres + tag: 18-alpine + pullPolicy: IfNotPresent + auth: + username: go_guess + database: go_guess + persistence: + enabled: true + size: 5Gi + storageClass: "" + resources: + requests: + cpu: 50m + memory: 96Mi + limits: + cpu: 300m + memory: 384Mi + +rabbitmq: + enabled: true + image: + repository: rabbitmq + tag: 4-alpine + pullPolicy: IfNotPresent + auth: + username: go_guess + persistence: + enabled: true + size: 5Gi + storageClass: "" + resources: + requests: + cpu: 50m + memory: 96Mi + limits: + cpu: 300m + memory: 384Mi + +nodeSelector: {} +tolerations: [] +affinity: {} \ No newline at end of file diff --git a/deploy/helm/go-guess/values.yaml b/deploy/helm/go-guess/values.yaml index c16a699..7d3d117 100644 --- a/deploy/helm/go-guess/values.yaml +++ b/deploy/helm/go-guess/values.yaml @@ -9,7 +9,8 @@ tenants: - nmbs - ypto -imagePullSecrets: [] +imagePullSecrets: + - name: nexus-registry api: podSecurityContext: @@ -25,7 +26,7 @@ api: runAsGroup: 100 replicaCount: 1 image: - repository: batty1039.startdedicated.net:5000/go-guess-api + repository: nexus.urpi.be/docker-hosted/go-guess tag: "0.0.1" pullPolicy: IfNotPresent environment: development @@ -77,8 +78,8 @@ api: web: replicaCount: 2 image: - repository: batty1039.startdedicated.net:5000/go-guess-web - tag: "0.1.0" + repository: nexus.urpi.be/docker-hosted/go-guess + tag: "0.0.1" pullPolicy: IfNotPresent # Origin of the go-bananas runtime supplying the shared styling contract, for # example https://bananas-dev.urpi.be. Empty keeps this application's own