initial commit

charts/api/values.yaml

@@ -0,0 +1,92 @@
+# Values for the go-places chart.
+
+replicaCount: 1
+# SQLite accepts a single writer and the data volume is ReadWriteOnce, so this
+# service must run as exactly one replica. The chart forces a Recreate strategy
+# when persistence is enabled for the same reason.
+
+image:
+  repository: go-places
+  pullPolicy: IfNotPresent
+  tag: "latest"
+
+service:
+  type: ClusterIP
+  port: 8080
+
+apiConfig:
+  # SQLite lives on the pod's data volume. The pragmas mirror the local
+  # development default in internal/config.
+  databaseURL: "file:/app/data/go-places.db?_pragma=busy_timeout(5000)&_pragma=journal_mode(WAL)&_pragma=foreign_keys(1)"
+  mediaDir: /app/data/media
+  # Prefix applied to stored media paths when building absolute URLs. Set this
+  # to the externally reachable origin so pictures resolve outside the cluster.
+  publicBaseURL: ""
+
+  # "jwt" verifies the HS256 tokens go-loose issues. Never set "dev" here: it
+  # accepts a fixed token table and would let anyone in act as any user.
+  authMode: jwt
+  jwtSecretName: go-loose-jwt
+  jwtSecretKey: secret
+  jwtAudience: ""
+
+  # "local" uses the built-in heuristics. "remote" additionally calls the
+  # inference service at analyzerUrl; the local pass still runs first, so
+  # pictures get badges even if that service is down.
+  analyzerMode: local
+  analyzerUrl: ""
+  logFormat: json
+
+  # Empty disables the event broker; events are then written to the log.
+  amqpUrl: ""
+  eventsExchange: go-places.events
+
+probes:
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 10
+    periodSeconds: 20
+  readinessProbe:
+    httpGet:
+      path: /readyz
+      port: http
+    initialDelaySeconds: 5
+    periodSeconds: 10
+
+resources:
+  limits:
+    cpu: 500m
+    memory: 512Mi
+  requests:
+    cpu: 250m
+    memory: 256Mi
+
+persistence:
+  # When disabled the pod still starts, but the database and every uploaded
+  # picture live in an emptyDir and are lost on each pod replacement.
+  enabled: true
+  # Mounted over /app/data so the database file and the media directory share
+  # one volume. apiConfig.databaseURL and apiConfig.mediaDir must stay inside
+  # this path or they will not be persisted.
+  mountPath: /app/data
+  # WARNING: raising this on a running release breaks `helm upgrade`. The
+  # local-path StorageClass does not allow volume expansion, so the API server
+  # rejects the resized claim, the upgrade aborts part-way, and the release is
+  # left in STATUS=failed until it is rolled back or upgraded again without the
+  # size change. Grow the underlying storage (or add a StorageClass that
+  # supports expansion) before editing this value.
+  size: 2Gi
+  accessModes:
+    - ReadWriteOnce
+  # Empty means "use the cluster's default StorageClass". The cluster this
+  # deploys to provides "local-path", which stores data on the node's own disk:
+  # that survives pod replacement but not loss of the node.
+  storageClass: ""
+  # Set to the name of a pre-created claim to use that instead of creating one.
+  existingClaim: ""
+
+securityContext:
+  # Must match the uid the image runs as, so the mounted volume is writable.
+  fsGroup: 10001