initial commit

charts/api/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: go-places
+description: A Helm chart for deploying the Go Places API service.
+type: application
+version: 0.1.0
+appVersion: "latest"

charts/api/templates/_helpers.tpl

@@ -0,0 +1,41 @@
+{{/*
+Full name.
+Used for naming resources like Deployments and Services.
+*/}}
+{{- define "go-places.fullname" -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Labels.
+Used to mark resources for selection.
+*/}}
+{{- define "go-places.labels" -}}
+helm.sh/chart: {{ include "go-places.chart" . }}
+{{ include "go-places.selectorLabels" . }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels.
+Used by a Service to find the pods it should route traffic to.
+*/}}
+{{- define "go-places.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "go-places.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Name template helper.
+*/}}
+{{- define "go-places.name" -}}
+{{- default .Chart.Name .Values.nameOverride -}}
+{{- end -}}
+
+{{/*
+Chart name helper.
+*/}}
+{{- define "go-places.chart" -}}
+{{- printf "%s-%s-%s" .Chart.Name .Chart.Version .Chart.AppVersion | replace "+" "_" -}}
+{{- end -}}

charts/api/templates/deployment.yaml

@@ -0,0 +1,99 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "go-places.fullname" . }}
+  labels:
+    {{- include "go-places.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  {{- if .Values.persistence.enabled }}
+  # Recreate, not RollingUpdate: the volume is ReadWriteOnce and SQLite allows a
+  # single writer, so the old pod must be gone before the new one mounts the
+  # claim and opens the database.
+  strategy:
+    type: Recreate
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "go-places.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "go-places.selectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        # The image runs as uid 10001. fsGroup makes the mounted volume group
+        # writable by that user, which is what allows the non-root process to
+        # create the database file and the media directory.
+        {{- if .Values.persistence.enabled }}
+        fsGroup: {{ .Values.securityContext.fsGroup }}
+        {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            # These names must match the variables read by
+            # internal/config.Load(). Unrecognised names are ignored, so a typo
+            # here would silently leave the service on its defaults.
+            - name: ADDR
+              value: ":8080"
+            - name: DATABASE_URL
+              value: {{ .Values.apiConfig.databaseURL | quote }}
+            - name: MEDIA_DIR
+              value: {{ .Values.apiConfig.mediaDir | quote }}
+            - name: PUBLIC_BASE_URL
+              value: {{ .Values.apiConfig.publicBaseURL | quote }}
+            # "jwt" verifies the HS256 tokens go-loose issues. The secret is
+            # referenced rather than inlined so it can come from a Secret.
+            - name: AUTH_MODE
+              value: {{ .Values.apiConfig.authMode | quote }}
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.apiConfig.jwtSecretName | quote }}
+                  key: {{ .Values.apiConfig.jwtSecretKey | quote }}
+                  optional: true
+            - name: JWT_AUDIENCE
+              value: {{ .Values.apiConfig.jwtAudience | quote }}
+            - name: ANALYZER_MODE
+              value: {{ .Values.apiConfig.analyzerMode | quote }}
+            - name: ANALYZER_URL
+              value: {{ .Values.apiConfig.analyzerUrl | quote }}
+            - name: LOG_FORMAT
+              value: {{ .Values.apiConfig.logFormat | quote }}
+            {{- if .Values.apiConfig.amqpUrl }}
+            # Event publishing is off unless a broker URL is given; without it
+            # the service logs events instead.
+            - name: AMQP_URL
+              value: {{ .Values.apiConfig.amqpUrl | quote }}
+            {{- end }}
+            - name: EVENTS_EXCHANGE
+              value: {{ .Values.apiConfig.eventsExchange | quote }}
+          {{- with .Values.probes.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.probes.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: {{ .Values.persistence.mountPath | quote }}
+      volumes:
+        - name: data
+          {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.existingClaim | default (printf "%s-data" (include "go-places.fullname" .)) }}
+          {{- else }}
+          # Without persistence the service still runs, but the database and every
+          # uploaded picture are lost whenever the pod is replaced.
+          emptyDir: {}
+          {{- end }}

charts/api/templates/pvc.yaml

@@ -0,0 +1,20 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "go-places.fullname" . }}-data
+  labels:
+    {{- include "go-places.labels" . | nindent 4 }}
+spec:
+  accessModes:
+    {{- toYaml .Values.persistence.accessModes | nindent 4 }}
+  {{- if .Values.persistence.storageClass }}
+  # An empty storageClassName would ask for dynamic provisioning from *no*
+  # class, which leaves the claim Pending, so the field is only emitted when a
+  # class is actually named.
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- end }}

charts/api/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "go-places.fullname" . }}
+  labels:
+    {{- include "go-places.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }} # Should be ClusterIP for internal communication
+  ports:
+    - port: {{ .Values.service.port }} # Port the Service exposes internally
+      targetPort: http # TargetPort should match the containerPort in deployment.yaml
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "go-places.selectorLabels" . | nindent 4 }}

charts/api/values.yaml

@@ -0,0 +1,92 @@
+# Values for the go-places chart.
+
+replicaCount: 1
+# SQLite accepts a single writer and the data volume is ReadWriteOnce, so this
+# service must run as exactly one replica. The chart forces a Recreate strategy
+# when persistence is enabled for the same reason.
+
+image:
+  repository: go-places
+  pullPolicy: IfNotPresent
+  tag: "latest"
+
+service:
+  type: ClusterIP
+  port: 8080
+
+apiConfig:
+  # SQLite lives on the pod's data volume. The pragmas mirror the local
+  # development default in internal/config.
+  databaseURL: "file:/app/data/go-places.db?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(1)"
+  mediaDir: /app/data/media
+  # Prefix applied to stored media paths when building absolute URLs. Set this
+  # to the externally reachable origin so pictures resolve outside the cluster.
+  publicBaseURL: ""
+
+  # "jwt" verifies the HS256 tokens go-loose issues. Never set "dev" here: it
+  # accepts a fixed token table and would let anyone in act as any user.
+  authMode: jwt
+  jwtSecretName: go-loose-jwt
+  jwtSecretKey: secret
+  jwtAudience: ""
+
+  # "local" uses the built-in heuristics. "remote" additionally calls the
+  # inference service at analyzerUrl; the local pass still runs first, so
+  # pictures get badges even if that service is down.
+  analyzerMode: local
+  analyzerUrl: ""
+  logFormat: json
+
+  # Empty disables the event broker; events are then written to the log.
+  amqpUrl: ""
+  eventsExchange: go-places.events
+
+probes:
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 10
+    periodSeconds: 20
+  readinessProbe:
+    httpGet:
+      path: /readyz
+      port: http
+    initialDelaySeconds: 5
+    periodSeconds: 10
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 250m
+    memory: 256Mi
+
+persistence:
+  # When disabled the pod still starts, but the database and every uploaded
+  # picture live in an emptyDir and are lost on each pod replacement.
+  enabled: true
+  # Mounted over /app/data so the database file and the media directory share
+  # one volume. apiConfig.databaseURL and apiConfig.mediaDir must stay inside
+  # this path or they will not be persisted.
+  mountPath: /app/data
+  # WARNING: raising this on a running release breaks `helm upgrade`. The
+  # local-path StorageClass does not allow volume expansion, so the API server
+  # rejects the resized claim, the upgrade aborts part-way, and the release is
+  # left in STATUS=failed until it is rolled back or upgraded again without the
+  # size change. Grow the underlying storage (or add a StorageClass that
+  # supports expansion) before editing this value.
+  size: 2Gi
+  accessModes:
+    - ReadWriteOnce
+  # Empty means "use the cluster's default StorageClass". The cluster this
+  # deploys to provides "local-path", which stores data on the node's own disk:
+  # that survives pod replacement but not loss of the node.
+  storageClass: ""
+  # Set to the name of a pre-created claim to use that instead of creating one.
+  existingClaim: ""
+
+securityContext:
+  # Must match the uid the image runs as, so the mounted volume is writable.
+  fsGroup: 10001

charts/go-loose/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: postgresql
+  repository: https://charts.bitnami.com/bitnami
+  version: 16.7.27
+digest: sha256:e8b999a3aaad6328a13d0c666207650897b69c61367c947d363b2acbe0ea1b42
+generated: "2026-10-04T19:38:06.343578353+02:00"

charts/go-loose/Chart.yaml

@@ -0,0 +1,13 @@
+# Chart metadata for go-loose, the authentication service.
+# Note: this file is plain YAML, not a Helm template, so comments start with '#'.
+apiVersion: v2
+name: go-loose
+description: A Helm chart for deploying the go-loose SSO service.
+type: application
+version: 0.1.0
+appVersion: "latest"
+dependencies:
+  - name: postgresql
+    version: "16.x.x"
+    repository: "https://charts.bitnami.com/bitnami"
+    condition: postgresql.enabled

charts/go-loose/templates/_helpers.tpl

@@ -0,0 +1,41 @@
+{{/*
+Full name.
+Used for naming resources like Deployments and Services.
+*/}}
+{{- define "go-loose.fullname" -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Labels.
+Used to mark resources for selection.
+*/}}
+{{- define "go-loose.labels" -}}
+helm.sh/chart: {{ include "go-loose.chart" . }}
+{{ include "go-loose.selectorLabels" . }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels.
+Used by a Service to find the pods it should route traffic to.
+*/}}
+{{- define "go-loose.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "go-loose.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Name template helper.
+*/}}
+{{- define "go-loose.name" -}}
+{{- default .Chart.Name .Values.nameOverride -}}
+{{- end -}}
+
+{{/*
+Chart name helper.
+*/}}
+{{- define "go-loose.chart" -}}
+{{- printf "%s-%s-%s" .Chart.Name .Chart.Version .Chart.AppVersion | replace "+" "_" -}}
+{{- end -}}

charts/go-loose/templates/deployment.yaml

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "go-loose.fullname" . }}
+  labels:
+    {{- include "go-loose.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "go-loose.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "go-loose.labels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          env:
+            - name: GO_LOOSE_SESSION_SECRET
+              value: {{ .Values.sessionSecret | quote }}
+            - name: GO_LOOSE_DATABASE_URL
+              value: "postgres://{{ .Values.postgresql.auth.username }}:{{ .Values.postgresql.auth.password }}@{{ .Release.Name }}-postgresql:5432/{{ .Values.postgresql.auth.database }}?sslmode=disable"
+          {{- with .Values.probes.livenessProbe }}
+          livenessProbe:
+            httpGet:
+              path: {{ .httpGet.path }}
+              port: http
+            initialDelaySeconds: {{ .initialDelaySeconds }}
+            periodSeconds: {{ .periodSeconds }}
+          {{- end }}
+          {{- with .Values.probes.readinessProbe }}
+          readinessProbe:
+            httpGet:
+              path: {{ .httpGet.path }}
+              port: http
+            initialDelaySeconds: {{ .initialDelaySeconds }}
+            periodSeconds: {{ .periodSeconds }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}

charts/go-loose/templates/ingress.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "go-loose.fullname" . }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "go-loose.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- toYaml .Values.ingress.tls | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

charts/go-loose/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "go-loose.fullname" . }}
+  labels:
+    {{- include "go-loose.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }} # ClusterIP for internal service discovery
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http # Must match the containerPort in deployment.yaml
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "go-loose.selectorLabels" . | nindent 4 }}

charts/go-loose/values-dev.yaml

@@ -0,0 +1,73 @@
+# Development values for go-loose
+replicaCount: 1
+
+sessionSecret: "dev-session-secret-change-me-to-32-plus-chars"
+
+postgresql:
+  enabled: true
+  image:
+    registry: docker.io
+    repository: bitnami/postgresql
+    tag: latest
+    pullPolicy: IfNotPresent
+  auth:
+    username: goloose
+    password: goloose
+    database: goloose
+  primary:
+    persistence:
+      enabled: true
+      size: 2Gi
+
+image:
+  repository: batty1039.startdedicated.net:5000/go-loose
+  pullPolicy: Always
+  tag: latest
+
+service:
+  type: ClusterIP
+  port: 8080
+
+probes:
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 15
+    periodSeconds: 20
+  readinessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 5
+    periodSeconds: 10
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  hosts:
+    - host: auth-dev.urpi.be
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: go-loose-tls
+      hosts:
+        - auth-dev.urpi.be
+
+certManager:
+  enabled: true
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer

charts/go-loose/values-lcl.yaml

@@ -0,0 +1,73 @@
+# Local (LCL) values for go-loose (the auth service).
+# Served at https://auth-lcl.intern-urpi.be by the docker TLS edge.
+replicaCount: 1
+
+sessionSecret: "lcl-session-secret-change-me-to-32-plus-chars"
+
+postgresql:
+  enabled: true
+  image:
+    registry: docker.io
+    repository: bitnami/postgresql
+    tag: latest
+    pullPolicy: IfNotPresent
+  auth:
+    username: goloose
+    password: goloose
+    database: goloose
+  primary:
+    persistence:
+      enabled: true
+      size: 2Gi
+
+image:
+  repository: localhost:5000/go-loose
+  pullPolicy: IfNotPresent
+  tag: "0.0.1"
+
+service:
+  type: ClusterIP
+  port: 8080
+
+probes:
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 15
+    periodSeconds: 20
+  readinessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 5
+    periodSeconds: 10
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 128Mi
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations: {}
+  hosts:
+    - host: auth-lcl.intern-urpi.be
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: local-dev-cert
+      hosts:
+        - auth-lcl.intern-urpi.be
+
+# No cert-manager in the local cluster.
+certManager:
+  enabled: false
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer

charts/go-loose/values-prd.yaml

@@ -0,0 +1,73 @@
+# Production values for go-loose
+replicaCount: 2
+
+sessionSecret: ""  # Set via --set or secret
+
+postgresql:
+  enabled: true
+  image:
+    registry: docker.io
+    repository: bitnami/postgresql
+    tag: latest
+    pullPolicy: IfNotPresent
+  auth:
+    username: goloose
+    password: goloose
+    database: goloose
+  primary:
+    persistence:
+      enabled: true
+      size: 10Gi
+
+image:
+  repository: batty1039.startdedicated.net:5000/go-loose
+  pullPolicy: Always
+  tag: latest
+
+service:
+  type: ClusterIP
+  port: 8080
+
+probes:
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 15
+    periodSeconds: 20
+  readinessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 5
+    periodSeconds: 10
+
+resources:
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+  requests:
+    cpu: 200m
+    memory: 256Mi
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  hosts:
+    - host: auth.urpi.be
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: go-loose-tls
+      hosts:
+        - auth.urpi.be
+
+certManager:
+  enabled: true
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer

charts/go-loose/values-tst.yaml

@@ -0,0 +1,73 @@
+# TST values for go-loose
+replicaCount: 1
+
+sessionSecret: "tst-session-secret-change-me-to-32-plus-chars"
+
+postgresql:
+  enabled: true
+  image:
+    registry: docker.io
+    repository: bitnami/postgresql
+    tag: latest
+    pullPolicy: IfNotPresent
+  auth:
+    username: goloose
+    password: goloose
+    database: goloose
+  primary:
+    persistence:
+      enabled: true
+      size: 5Gi
+
+image:
+  repository: batty1039.startdedicated.net:5000/go-loose
+  pullPolicy: Always
+  tag: latest
+
+service:
+  type: ClusterIP
+  port: 8080
+
+probes:
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 15
+    periodSeconds: 20
+  readinessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 5
+    periodSeconds: 10
+
+resources:
+  limits:
+    cpu: 750m
+    memory: 512Mi
+  requests:
+    cpu: 150m
+    memory: 256Mi
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+  hosts:
+    - host: auth-tst.intern-urpi.be
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: go-loose-tls
+      hosts:
+        - auth-tst.intern-urpi.be
+
+certManager:
+  enabled: true
+  issuerRef:
+    name: letsencrypt-staging
+    kind: ClusterIssuer

charts/go-loose/values.yaml

@@ -0,0 +1,53 @@
+# Default values for go-loose.
+# This is where you can override the default values in the chart.
+
+replicaCount: 1
+
+sessionSecret: "local-development-secret-change-me-now"
+databaseURL: "postgres://goloose:goloose@go-guess-postgresql:5432/goloose?sslmode=disable"
+
+image:
+  # Placeholder: needs the real registry path for the go-loose image.
+  repository: batty1039.startdedicated.net:5000/go-loose
+  pullPolicy: IfNotPresent
+  tag: latest
+
+service:
+  type: ClusterIP
+  port: 8080
+
+# ingress is off by default. The template reads .Values.ingress.enabled
+# directly, so the key has to exist even when ingress is disabled, otherwise
+# `helm template` fails with a nil pointer error.
+ingress:
+  enabled: false
+  className: nginx
+  annotations: {}
+  # tls: []
+  hosts:
+    - host: go-loose.local
+      paths:
+        - path: /
+          pathType: Prefix
+
+probes:
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 15
+    periodSeconds: 20
+  readinessProbe:
+    httpGet:
+      path: /readyz
+      port: http
+    initialDelaySeconds: 5
+    periodSeconds: 10
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 128Mi