marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'nightly' into k8s-shuffle-app-ports

Browse Source
This commit is contained in:
Frikky
2025-05-18 22:48:47 +02:00
committed by GitHub
parent e4a42128e7 6358d94984
commit ed70913be5
16 changed files with 570 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
functions/kubernetes/charts/shuffle/README.md
+61 -18
View File
@@ -217,7 +217,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `backend.affinity` | Affinity for backend pods assignment | `{}` |
| `backend.nodeSelector` | Node labels for backend pods assignment | `{}` |
| `backend.tolerations` | Tolerations for backend pods assignment | `[]` |
| `backend.updateStrategy.type` | backend deployment strategy type | `RollingUpdate` |
| `backend.updateStrategy.type` | backend deployment strategy type | `Recreate` |
| `backend.priorityClassName` | backend pods' priorityClassName | `""` |
| `backend.topologySpreadConstraints` | Topology Spread Constraints for backend pod assignment spread across your cluster among failure-domains | `[]` |
| `backend.schedulerName` | Name of the k8s scheduler (other than default) for backend pods | `""` |
@@ -244,6 +244,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `backend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `backend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `backend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `backend.service.labels` | Extra labels for backend service | `{}` |
| `backend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
@@ -359,6 +360,7 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `frontend.autoscaling.hpa.maxReplicas` | Maximum number of replicas | `""` |
| `frontend.autoscaling.hpa.targetCPU` | Target CPU utilization percentage | `""` |
| `frontend.autoscaling.hpa.targetMemory` | Target Memory utilization percentage | `""` |
| `frontend.service.labels` | Extra labels for frontend service | `{}` |
| `frontend.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
@@ -477,23 +479,38 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
### worker Parameters
| Name | Description | Value |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `worker.image.registry` | worker image registry | `ghcr.io` |
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
| `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` |
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| Name | Description | Value |
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
| `worker.image.registry` | worker image registry | `ghcr.io` |
| `worker.image.repository` | worker image repository | `shuffle/shuffle-worker` |
| `worker.image.tag` | worker image tag (immutable tags are recommended, defaults to appVersion) | `""` |
| `worker.image.digest` | worker image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended) | `""` |
| `worker.podSecurityContext.enabled` | Enable worker pods' Security Context | `true` |
| `worker.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for worker pods | `Always` |
| `worker.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for worker pods | `[]` |
| `worker.podSecurityContext.supplementalGroups` | Set filesystem extra groups for worker pods | `[]` |
| `worker.podSecurityContext.fsGroup` | Set fsGroup in worker pods' Security Context | `1001` |
| `worker.containerSecurityContext.enabled` | Enabled worker container' Security Context | `true` |
| `worker.containerSecurityContext.seLinuxOptions` | Set SELinux options in worker container | `{}` |
| `worker.containerSecurityContext.runAsUser` | Set runAsUser in worker container' Security Context | `1001` |
| `worker.containerSecurityContext.runAsGroup` | Set runAsGroup in worker container' Security Context | `1001` |
| `worker.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in worker container' Security Context | `true` |
| `worker.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in worker container' Security Context | `true` |
| `worker.containerSecurityContext.privileged` | Set privileged in worker container' Security Context | `false` |
| `worker.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in worker container' Security Context | `false` |
| `worker.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in worker container | `["ALL"]` |
| `worker.containerSecurityContext.seccompProfile.type` | Set seccomp profile in worker container | `RuntimeDefault` |
| `worker.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the worker service account | `true` |
| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` |
| `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `worker.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `worker.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `worker.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### app Parameters
@@ -511,6 +528,32 @@ The password should be provided with the `SHUFFLE_OPENSEARCH_PASSWORD` env varia
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
| `app.exposedContainerPort` | The port that shuffle app containers will listen on for new requests. | `80` |
| `app.podSecurityContext.enabled` | Enable app pods' Security Context | `true` |
| `app.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy for app pods | `Always` |
| `app.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface for app pods | `[]` |
| `app.podSecurityContext.supplementalGroups` | Set filesystem extra groups for app pods | `[]` |
| `app.podSecurityContext.fsGroup` | Set fsGroup in app pods' Security Context | `1001` |
| `app.containerSecurityContext.enabled` | Enabled app container' Security Context | `true` |
| `app.containerSecurityContext.seLinuxOptions` | Set SELinux options in app container | `{}` |
| `app.containerSecurityContext.runAsUser` | Set runAsUser in app container' Security Context | `1001` |
| `app.containerSecurityContext.runAsGroup` | Set runAsGroup in app container' Security Context | `1001` |
| `app.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in app container' Security Context | `true` |
| `app.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in app container' Security Context | `true` |
| `app.containerSecurityContext.privileged` | Set privileged in app container' Security Context | `false` |
| `app.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in app container' Security Context | `false` |
| `app.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in app container | `["ALL"]` |
| `app.containerSecurityContext.seccompProfile.type` | Set seccomp profile in app container | `RuntimeDefault` |
| `app.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` |
| `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the app service account | `true` |
| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` |
| `app.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
| `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
| `app.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
| `app.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
| `app.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true) | `[]` |
### Traffic Exposure Parameters
functions/kubernetes/charts/shuffle/templates/backend/backend-cm-env.yaml
+4 -2
View File
@@ -8,18 +8,20 @@ metadata:
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
data:
BACKEND_PORT: "5001"
BACKEND_PORT: "{{ .Values.backend.containerPorts.http }}"
{{- if .Values.shuffle.baseUrl }}
BASE_URL: "{{ .Values.shuffle.baseUrl }}"
SSO_REDIRECT_URL: "{{ .Values.shuffle.baseUrl }}"
{{- else }}
BASE_URL: "http://{{ include "shuffle.backend.name" . }}:5001"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
{{- end }}
ORG_ID: "{{ .Values.shuffle.org }}"
SHUFFLE_APP_DOWNLOAD_LOCATION: "{{ .Values.backend.apps.downloadLocation }}"
SHUFFLE_DOWNLOAD_AUTH_BRANCH: "{{ .Values.backend.apps.downloadBranch }}"
SHUFFLE_APP_FORCE_UPDATE: "{{ .Values.backend.apps.forceUpdate }}"
SHUFFLE_CHAT_DISABLED: "true"
# Sets backend_url parameter for workflow execution to the cluster-internal shuffle-backend address
SHUFFLE_CLOUDRUN_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
SHUFFLE_OPENSEARCH_URL: {{ include "common.tplvalues.render" (dict "value" .Values.backend.openSearch.url "context" $) }}
SHUFFLE_OPENSEARCH_USERNAME: "{{ .Values.backend.openSearch.username }}"
SHUFFLE_OPENSEARCH_CERTIFICATE_FILE: "{{ .Values.backend.openSearch.certificateFile }}"
functions/kubernetes/charts/shuffle/templates/backend/backend-svc.yaml
+3 -1
View File
@@ -3,7 +3,8 @@ kind: Service
metadata:
name: {{ template "shuffle.backend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.backend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
{{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.service.labels .Values.commonLabels) "context" .) }}
labels: {{- include "shuffle.backend.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
@@ -14,5 +15,6 @@ spec:
port: {{ .Values.backend.containerPorts.http }}
targetPort: http
protocol: TCP
appProtocol: http
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.backend.podLabels .Values.commonLabels) "context" .) }}
selector: {{- include "shuffle.backend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
functions/kubernetes/charts/shuffle/templates/frontend/frontend-svc.yaml
+4 -1
View File
@@ -3,7 +3,8 @@ kind: Service
metadata:
name: {{ template "shuffle.frontend.name" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "shuffle.frontend.labels" (dict "customLabels" .Values.commonLabels "context" $) | nindent 4 }}
{{- $serviceLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.service.labels .Values.commonLabels) "context" .) }}
labels: {{- include "shuffle.frontend.labels" (dict "customLabels" $serviceLabels "context" $) | nindent 4 }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
{{- end }}
@@ -14,11 +15,13 @@ spec:
port: {{ .Values.frontend.containerPorts.http }}
targetPort: http
protocol: TCP
appProtocol: http
{{- if .Values.frontend.containerPorts.https }}
- name: https
port: {{ .Values.frontend.containerPorts.https }}
targetPort: https
protocol: TCP
appProtocol: https
{{- end }}
{{- $podLabels := include "common.tplvalues.merge" (dict "values" (list .Values.frontend.podLabels .Values.commonLabels) "context" .) }}
selector: {{- include "shuffle.frontend.matchLabels" (dict "customLabels" $podLabels "context" $) | nindent 4 }}
functions/kubernetes/charts/shuffle/templates/orborus/orborus-cm-env.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ data:
ENVIRONMENT_NAME: "{{ .Values.shuffle.org }}"
ORG_ID: "{{ .Values.shuffle.org }}"
TZ: "{{ .Values.shuffle.timezone }}"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001"
BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.backend.containerPorts.http }}"
KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}"
KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }}
SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}"
functions/kubernetes/charts/shuffle/templates/orborus/orborus-dpl.yaml
+16
View File
@@ -90,8 +90,24 @@ spec:
value: {{ include "shuffle.worker.serviceAccount.name" . }}
- name: SHUFFLE_APP_EXPOSED_PORT
value: {{ .Values.app.exposedContainerPort | quote }}
{{- if .Values.worker.podSecurityContext.enabled }}
- name: SHUFFLE_WORKER_POD_SECURITY_CONTEXT
value: {{ omit .Values.worker.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.worker.containerSecurityContext.enabled }}
- name: SHUFFLE_WORKER_CONTAINER_SECURITY_CONTEXT
value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.worker.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
- name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME
value: {{ include "shuffle.app.serviceAccount.name" . }}
{{- if .Values.app.podSecurityContext.enabled }}
- name: SHUFFLE_APP_POD_SECURITY_CONTEXT
value: {{ omit .Values.app.podSecurityContext "enabled" | mustToJson | quote }}
{{- end }}
{{- if .Values.app.containerSecurityContext.enabled }}
- name: SHUFFLE_APP_CONTAINER_SECURITY_CONTEXT
value: {{ include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.app.containerSecurityContext "context" $) | fromYaml | mustToJson | quote }}
{{- end }}
{{- if .Values.orborus.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
functions/kubernetes/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml
+10
View File
@@ -29,6 +29,16 @@ spec:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
# Allow access to backend
- ports:
- port: {{ .Values.backend.containerPorts.http }}
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: {{ .Release.Namespace }}
podSelector:
matchLabels: {{ include "shuffle.backend.matchLabels" . | nindent 14 }}
# Allow access to workers
- ports:
- port: 33333
functions/kubernetes/charts/shuffle/values.schema.json
+215 -1
View File
@@ -517,7 +517,7 @@
"type": {
"type": "string",
"description": "backend deployment strategy type",
"default": "RollingUpdate"
"default": "Recreate"
}
}
},
@@ -683,6 +683,16 @@
}
}
},
"service": {
"type": "object",
"properties": {
"labels": {
"type": "object",
"description": "Extra labels for backend service",
"default": {}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
@@ -1362,6 +1372,16 @@
}
}
},
"service": {
"type": "object",
"properties": {
"labels": {
"type": "object",
"description": "Extra labels for frontend service",
"default": {}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
@@ -2074,6 +2094,103 @@
}
}
},
"podSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable worker pods' Security Context",
"default": true
},
"fsGroupChangePolicy": {
"type": "string",
"description": "Set filesystem group change policy for worker pods",
"default": "Always"
},
"sysctls": {
"type": "array",
"description": "Set kernel settings using the sysctl interface for worker pods",
"default": [],
"items": {}
},
"supplementalGroups": {
"type": "array",
"description": "Set filesystem extra groups for worker pods",
"default": [],
"items": {}
},
"fsGroup": {
"type": "number",
"description": "Set fsGroup in worker pods' Security Context",
"default": 1001
}
}
},
"containerSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enabled worker container' Security Context",
"default": true
},
"runAsUser": {
"type": "number",
"description": "Set runAsUser in worker container' Security Context",
"default": 1001
},
"runAsGroup": {
"type": "number",
"description": "Set runAsGroup in worker container' Security Context",
"default": 1001
},
"runAsNonRoot": {
"type": "boolean",
"description": "Set runAsNonRoot in worker container' Security Context",
"default": true
},
"readOnlyRootFilesystem": {
"type": "boolean",
"description": "Set readOnlyRootFilesystem in worker container' Security Context",
"default": true
},
"privileged": {
"type": "boolean",
"description": "Set privileged in worker container' Security Context",
"default": false
},
"allowPrivilegeEscalation": {
"type": "boolean",
"description": "Set allowPrivilegeEscalation in worker container' Security Context",
"default": false
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"description": "List of capabilities to be dropped in worker container",
"default": [
"ALL"
],
"items": {
"type": "string"
}
}
}
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Set seccomp profile in worker container",
"default": "RuntimeDefault"
}
}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
@@ -2152,6 +2269,103 @@
"app": {
"type": "object",
"properties": {
"podSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enable app pods' Security Context",
"default": true
},
"fsGroupChangePolicy": {
"type": "string",
"description": "Set filesystem group change policy for app pods",
"default": "Always"
},
"sysctls": {
"type": "array",
"description": "Set kernel settings using the sysctl interface for app pods",
"default": [],
"items": {}
},
"supplementalGroups": {
"type": "array",
"description": "Set filesystem extra groups for app pods",
"default": [],
"items": {}
},
"fsGroup": {
"type": "number",
"description": "Set fsGroup in app pods' Security Context",
"default": 1001
}
}
},
"containerSecurityContext": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Enabled app container' Security Context",
"default": true
},
"runAsUser": {
"type": "number",
"description": "Set runAsUser in app container' Security Context",
"default": 1001
},
"runAsGroup": {
"type": "number",
"description": "Set runAsGroup in app container' Security Context",
"default": 1001
},
"runAsNonRoot": {
"type": "boolean",
"description": "Set runAsNonRoot in app container' Security Context",
"default": true
},
"readOnlyRootFilesystem": {
"type": "boolean",
"description": "Set readOnlyRootFilesystem in app container' Security Context",
"default": true
},
"privileged": {
"type": "boolean",
"description": "Set privileged in app container' Security Context",
"default": false
},
"allowPrivilegeEscalation": {
"type": "boolean",
"description": "Set allowPrivilegeEscalation in app container' Security Context",
"default": false
},
"capabilities": {
"type": "object",
"properties": {
"drop": {
"type": "array",
"description": "List of capabilities to be dropped in app container",
"default": [
"ALL"
],
"items": {
"type": "string"
}
}
}
},
"seccompProfile": {
"type": "object",
"properties": {
"type": {
"type": "string",
"description": "Set seccomp profile in app container",
"default": "RuntimeDefault"
}
}
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
functions/kubernetes/charts/shuffle/values.yaml
+102 -2
View File
@@ -310,14 +310,14 @@ backend:
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
##
tolerations: []
## ONLY FOR DEPLOYMENTS:
## @param backend.updateStrategy.type backend deployment strategy type
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
##
updateStrategy:
## Can be set to RollingUpdate or Recreate
## Backend uses ReadWriteOnce volumes by default, which is incompatible with RollingUpdate
##
type: RollingUpdate
type: Recreate
## @param backend.priorityClassName backend pods' priorityClassName
##
priorityClassName: ""
@@ -421,6 +421,14 @@ backend:
targetCPU: ""
targetMemory: ""
## Service configuration
##
service:
## @param backend.service.labels Extra labels for backend service
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
labels: {}
## ServiceAccount configuration
##
serviceAccount:
@@ -870,6 +878,14 @@ frontend:
targetCPU: ""
targetMemory: ""
## Service configuration
##
service:
## @param frontend.service.labels Extra labels for frontend service
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
##
labels: {}
## ServiceAccount configuration
##
serviceAccount:
@@ -1328,6 +1344,48 @@ worker:
tag: ""
digest: ""
## Configure Pods Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param worker.podSecurityContext.enabled Enable worker pods' Security Context
## @param worker.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for worker pods
## @param worker.podSecurityContext.sysctls Set kernel settings using the sysctl interface for worker pods
## @param worker.podSecurityContext.supplementalGroups Set filesystem extra groups for worker pods
## @param worker.podSecurityContext.fsGroup Set fsGroup in worker pods' Security Context
##
podSecurityContext:
enabled: true
fsGroupChangePolicy: Always
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param worker.containerSecurityContext.enabled Enabled worker container' Security Context
## @param worker.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in worker container
## @param worker.containerSecurityContext.runAsUser Set runAsUser in worker container' Security Context
## @param worker.containerSecurityContext.runAsGroup Set runAsGroup in worker container' Security Context
## @param worker.containerSecurityContext.runAsNonRoot Set runAsNonRoot in worker container' Security Context
## @param worker.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in worker container' Security Context
## @param worker.containerSecurityContext.privileged Set privileged in worker container' Security Context
## @param worker.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in worker container' Security Context
## @param worker.containerSecurityContext.capabilities.drop List of capabilities to be dropped in worker container
## @param worker.containerSecurityContext.seccompProfile.type Set seccomp profile in worker container
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
privileged: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## ServiceAccount configuration
##
serviceAccount:
@@ -1390,6 +1448,48 @@ worker:
## @section app Parameters
##
app:
## Configure Pods Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
## @param app.podSecurityContext.enabled Enable app pods' Security Context
## @param app.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for app pods
## @param app.podSecurityContext.sysctls Set kernel settings using the sysctl interface for app pods
## @param app.podSecurityContext.supplementalGroups Set filesystem extra groups for app pods
## @param app.podSecurityContext.fsGroup Set fsGroup in app pods' Security Context
##
podSecurityContext:
enabled: true
fsGroupChangePolicy: Always
sysctls: []
supplementalGroups: []
fsGroup: 1001
## Configure Container Security Context
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
## @param app.containerSecurityContext.enabled Enabled app container' Security Context
## @param app.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in app container
## @param app.containerSecurityContext.runAsUser Set runAsUser in app container' Security Context
## @param app.containerSecurityContext.runAsGroup Set runAsGroup in app container' Security Context
## @param app.containerSecurityContext.runAsNonRoot Set runAsNonRoot in app container' Security Context
## @param app.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in app container' Security Context
## @param app.containerSecurityContext.privileged Set privileged in app container' Security Context
## @param app.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in app container' Security Context
## @param app.containerSecurityContext.capabilities.drop List of capabilities to be dropped in app container
## @param app.containerSecurityContext.seccompProfile.type Set seccomp profile in app container
##
containerSecurityContext:
enabled: true
seLinuxOptions: {}
runAsUser: 1001
runAsGroup: 1001
runAsNonRoot: true
readOnlyRootFilesystem: true
privileged: false
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: "RuntimeDefault"
## ServiceAccount configuration
##
serviceAccount: