ungleich-k8s/apps/chartmuseum/templates/deployment.yaml

193 lines
5 KiB
YAML
Raw Normal View History

2021-07-19 21:05:30 +00:00
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ .Release.Name }}-chartmuseum
spec:
2021-07-25 09:05:04 +00:00
strategy:
type: Recreate
2021-07-19 21:05:30 +00:00
selector:
matchLabels:
app: {{ .Release.Name }}-chartmuseum
replicas: 1
template:
metadata:
labels:
app: {{ .Release.Name }}-chartmuseum
use-as-service: {{ .Release.Name }}
spec:
2021-07-21 11:50:28 +00:00
# Wait before trying to start any container
2021-07-25 09:05:04 +00:00
initContainers:
2021-07-21 11:50:28 +00:00
- name: wait-for-cert
image: busybox
command:
- sh
- -c
- until ls /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; do sleep 5; done
volumeMounts:
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
2021-07-19 21:05:30 +00:00
containers:
2021-07-21 11:50:28 +00:00
- name: certbot
image: ungleich/ungleich-certbot
imagePullPolicy: Always
ports:
- containerPort: 80
env:
- name: ONLYRENEWCERTS
value: "yes"
- name: DOMAIN
value: "{{ tpl .Values.fqdn . }}"
- name: EMAIL
value: "{{ .Values.email }}"
{{ if eq .Values.letsencryptStaging "no" }}
- name: STAGING
value: "no"
{{ end }}
volumeMounts:
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
2021-07-19 21:05:30 +00:00
- name: chartmuseum
2021-07-21 11:50:28 +00:00
image: ghcr.io/helm/chartmuseum:v{{ .Chart.AppVersion }}
2021-07-19 21:05:30 +00:00
ports:
2021-07-21 11:50:28 +00:00
- containerPort: 443
args:
- --tls-cert=/etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem
- --tls-key=/etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem
2021-07-19 21:05:30 +00:00
env:
- name: STORAGE
value: "local"
- name: STORAGE_LOCAL_ROOTDIR
value: "/charts"
- name: BASIC_AUTH_USER
valueFrom:
secretKeyRef:
name: {{ tpl .Values.identifier . }}
key: username
- name: BASIC_AUTH_PASS
valueFrom:
secretKeyRef:
name: {{ tpl .Values.identifier . }}
key: password
2021-07-19 21:05:30 +00:00
volumeMounts:
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
- name: data
mountPath: "/charts"
volumes:
- name: etcletsencrypt
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
- name: data
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-data
---
apiVersion: v1
kind: Service
metadata:
name: {{ tpl .Values.identifier . }}
labels:
app: {{ tpl .Values.identifier . }}
spec:
type: ClusterIP
ports:
2021-07-21 11:50:28 +00:00
- port: 80
2021-07-19 21:05:30 +00:00
name: http
- port: 443
2021-07-26 11:51:46 +00:00
targetPort: 8080
2021-07-19 21:05:30 +00:00
name: https
selector:
use-as-service: {{ .Release.Name }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ tpl .Values.identifier . }}-letsencrypt-certs
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 50Mi
storageClassName: rook-cephfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ tpl .Values.identifier . }}-data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
storageClassName: rook-ceph-block
# ---
# apiVersion: v1
# kind: ConfigMap
# metadata:
# name: {{ tpl .Values.identifier . }}-nginx-config
# data:
# default.conf: |
# server {
# listen 443 ssl;
# listen [::]:443 ssl;
# server_name {{ tpl .Values.fqdn . }};
# ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem;
# ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem;
# client_max_body_size 256m;
# location / {
# proxy_pass http://localhost:3000;
# }
# }
2021-07-21 11:50:28 +00:00
---
apiVersion: batch/v1
kind: Job
metadata:
name: {{ tpl .Values.identifier . }}-getcert
spec:
template:
metadata:
labels:
app: certbot-letsencrypt-getcert
use-as-service: {{ .Release.Name }}
spec:
restartPolicy: Never
containers:
- name: certbot
image: ungleich/ungleich-certbot
imagePullPolicy: Always
ports:
- containerPort: 80
env:
- name: ONLYGETCERT
value: "yes"
- name: DOMAIN
value: "{{ tpl .Values.fqdn . }}"
- name: EMAIL
value: "{{ .Values.email }}"
{{ if eq .Values.letsencryptStaging "no" }}
- name: STAGING
value: "no"
{{ end }}
volumeMounts:
- name: etcletsencrypt
mountPath: "/etc/letsencrypt"
volumes:
- name: etcletsencrypt
persistentVolumeClaim:
claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs
backoffLimit: 3
---
apiVersion: v1
kind: Secret
metadata:
name: {{ tpl .Values.identifier . }}
annotations:
secret-generator.v1.mittwald.de/type: basic-auth