Public Access
f.weber
1675ea9a4e
- Updated Chart.yaml to version 0.2.0 and added annotations for changes. - Modified release-chart.yaml to trigger releases via Gitea and handle pre-releases. - Introduced ServiceAccount configuration in values.yaml and related templates. - Adjusted internal container ports to prevent conflicts between nginx and aptly. - Updated README.md and NOTES.txt to reflect new configurations and usage instructions.
303 lines
11 KiB
YAML
303 lines
11 KiB
YAML
{{- $fullname := include "aptly.fullname" . -}}
|
|
{{- $hasGpgSecret := or .Values.aptly.gpg.signingKey.existingSecret (and (not .Values.aptly.gpg.signingKey.existingSecret) .Values.aptly.gpg.signingKey.privateKey) -}}
|
|
{{- $gpgSecretName := .Values.aptly.gpg.signingKey.existingSecret | default (printf "%s-gpg" $fullname) -}}
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: {{ $fullname }}
|
|
labels:
|
|
{{- include "aptly.labels" . | nindent 4 }}
|
|
{{- with .Values.workload.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
serviceName: {{ $fullname }}
|
|
# LevelDB (aptly's database) takes an exclusive OS-level file lock — two
|
|
# writers would corrupt it. A StatefulSet with replicas=1 always terminates
|
|
# the old pod before creating its replacement, so RollingUpdate is safe
|
|
# here in a way it would not be for a Deployment on a ReadWriteOnce PVC
|
|
# (which would deadlock on a Multi-Attach error instead).
|
|
replicas: 1
|
|
podManagementPolicy: {{ .Values.workload.podManagementPolicy }}
|
|
revisionHistoryLimit: {{ .Values.workload.revisionHistoryLimit }}
|
|
updateStrategy:
|
|
type: {{ .Values.workload.updateStrategy.type }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "aptly.selectorLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "aptly.selectorLabels" . | nindent 8 }}
|
|
{{- with .Values.workload.podLabels }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
annotations:
|
|
checksum/config: {{ include "aptly.config" . | sha256sum }}
|
|
checksum/nginx: {{ include "aptly.nginxConf" . | sha256sum }}
|
|
{{- with .Values.workload.podAnnotations }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- include "aptly.imagePullSecrets" . | nindent 6 }}
|
|
{{- with include "aptly.serviceAccountName" . }}
|
|
serviceAccountName: {{ . }}
|
|
{{- end }}
|
|
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
|
terminationGracePeriodSeconds: {{ .Values.workload.terminationGracePeriodSeconds }}
|
|
securityContext:
|
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.topologySpreadConstraints }}
|
|
topologySpreadConstraints:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.priorityClassName }}
|
|
priorityClassName: {{ . }}
|
|
{{- end }}
|
|
initContainers:
|
|
- name: config-init
|
|
image: {{ include "aptly.image" . }}
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
command: ["/usr/local/bin/aptly-init"]
|
|
securityContext:
|
|
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
|
env:
|
|
- name: APTLY_ROOT_DIR
|
|
value: /var/lib/aptly
|
|
- name: APTLY_CONFIG_SRC
|
|
value: /etc/aptly-src/aptly.yaml
|
|
- name: APTLY_CONFIG_DST
|
|
value: /run/aptly/aptly.yaml
|
|
- name: APTLY_GPG_ENABLED
|
|
value: {{ .Values.aptly.gpg.enabled | quote }}
|
|
{{- if not .Values.security.auth.existingSecret }}
|
|
- name: APTLY_USERS_FILE
|
|
value: /etc/aptly-secrets/users
|
|
{{- else }}
|
|
- name: APTLY_HTPASSWD_SRC
|
|
value: /etc/aptly-secrets-existing/htpasswd
|
|
{{- end }}
|
|
{{- if .Values.security.auth.internalUser.enabled }}
|
|
- name: APTLY_INTERNAL_USER
|
|
value: {{ .Values.security.auth.internalUser.username | quote }}
|
|
- name: APTLY_INTERNAL_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ $fullname }}-credentials
|
|
key: internal-password
|
|
{{- end }}
|
|
{{- if $hasGpgSecret }}
|
|
- name: APTLY_GPG_PRIVATE_KEY_FILE
|
|
value: /etc/aptly-gpg/privateKey
|
|
- name: APTLY_GPG_SECRET_KEYRING_FILE
|
|
value: /etc/aptly-gpg/secretKeyring
|
|
- name: APTLY_GPG_PASSPHRASE_FILE
|
|
value: /etc/aptly-gpg/passphrase
|
|
{{- end }}
|
|
{{- if .Values.aptly.gpgKeys }}
|
|
- name: APTLY_GPG_KEYS_DIR
|
|
value: /etc/aptly-gpg-keys
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: config-src
|
|
mountPath: /etc/aptly-src
|
|
readOnly: true
|
|
- name: run
|
|
mountPath: /run/aptly
|
|
- name: data
|
|
mountPath: /var/lib/aptly
|
|
{{- if not .Values.security.auth.existingSecret }}
|
|
- name: credentials
|
|
mountPath: /etc/aptly-secrets
|
|
readOnly: true
|
|
{{- else }}
|
|
- name: credentials-existing
|
|
mountPath: /etc/aptly-secrets-existing
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if $hasGpgSecret }}
|
|
- name: gpg-secret
|
|
mountPath: /etc/aptly-gpg
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.aptly.gpgKeys }}
|
|
- name: gpg-keys
|
|
mountPath: /etc/aptly-gpg-keys
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- with .Values.extraInitContainers }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: aptly
|
|
image: {{ include "aptly.image" . }}
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
securityContext:
|
|
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
|
|
env:
|
|
- name: APTLY_API_LISTEN
|
|
value: {{ include "aptly.apiListen" . }}
|
|
- name: APTLY_CONFIG
|
|
value: /run/aptly/aptly.yaml
|
|
- name: GNUPGHOME
|
|
value: /run/aptly/gnupg
|
|
{{- with .Values.extraEnv }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- if or .Values.aptly.existingSecretEnv .Values.extraEnvFrom }}
|
|
envFrom:
|
|
{{- range .Values.aptly.existingSecretEnv }}
|
|
- secretRef:
|
|
name: {{ . }}
|
|
{{- end }}
|
|
{{- with .Values.extraEnvFrom }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
ports:
|
|
- name: aptly
|
|
containerPort: {{ .Values.ports.aptly }}
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/aptly
|
|
- name: run
|
|
mountPath: /run/aptly
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
{{- with .Values.extraVolumeMounts }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
startupProbe:
|
|
httpGet: { path: /api/ready, port: aptly }
|
|
periodSeconds: {{ .Values.probes.startup.periodSeconds }}
|
|
failureThreshold: {{ .Values.probes.startup.failureThreshold }}
|
|
readinessProbe:
|
|
httpGet: { path: /api/ready, port: aptly }
|
|
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
|
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
|
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
|
livenessProbe:
|
|
httpGet: { path: /api/healthy, port: aptly }
|
|
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
|
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
|
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
|
resources:
|
|
{{- toYaml .Values.resources | nindent 12 }}
|
|
- name: nginx
|
|
image: {{ include "aptly.nginxImage" . }}
|
|
imagePullPolicy: {{ .Values.nginx.image.pullPolicy }}
|
|
securityContext:
|
|
{{- toYaml .Values.nginx.securityContext | nindent 12 }}
|
|
ports:
|
|
- name: http
|
|
containerPort: {{ .Values.ports.nginx }}
|
|
{{- if .Values.metrics.service.enabled }}
|
|
- name: metrics
|
|
containerPort: {{ .Values.ports.metrics }}
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/aptly/public
|
|
subPath: public
|
|
readOnly: true
|
|
- name: run
|
|
mountPath: /run/aptly
|
|
readOnly: true
|
|
- name: nginx-config
|
|
mountPath: /etc/nginx/conf.d/default.conf
|
|
subPath: default.conf
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- name: nginx-cache
|
|
mountPath: /var/cache/nginx
|
|
readinessProbe:
|
|
httpGet: { path: /healthz, port: http }
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet: { path: /healthz, port: http }
|
|
periodSeconds: 30
|
|
resources:
|
|
{{- toYaml .Values.nginx.resources | nindent 12 }}
|
|
{{- with .Values.extraContainers }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: config-src
|
|
configMap:
|
|
name: {{ $fullname }}-config
|
|
- name: nginx-config
|
|
configMap:
|
|
name: {{ $fullname }}-nginx
|
|
- name: run
|
|
emptyDir:
|
|
medium: Memory
|
|
sizeLimit: 16Mi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: nginx-cache
|
|
emptyDir: {}
|
|
{{- if not .Values.security.auth.existingSecret }}
|
|
- name: credentials
|
|
secret:
|
|
secretName: {{ $fullname }}-credentials
|
|
optional: true
|
|
{{- else }}
|
|
- name: credentials-existing
|
|
secret:
|
|
secretName: {{ .Values.security.auth.existingSecret }}
|
|
{{- end }}
|
|
{{- if $hasGpgSecret }}
|
|
- name: gpg-secret
|
|
secret:
|
|
secretName: {{ $gpgSecretName }}
|
|
optional: true
|
|
{{- end }}
|
|
{{- if .Values.aptly.gpgKeys }}
|
|
- name: gpg-keys
|
|
configMap:
|
|
name: {{ $fullname }}-gpg-keys
|
|
{{- end }}
|
|
{{- if not .Values.persistence.enabled }}
|
|
- name: data
|
|
emptyDir: {}
|
|
{{- else if .Values.persistence.existingClaim }}
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: {{ .Values.persistence.existingClaim }}
|
|
{{- end }}
|
|
{{- with .Values.extraVolumes }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
|
|
volumeClaimTemplates:
|
|
- metadata:
|
|
name: data
|
|
{{- with .Values.persistence.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
spec:
|
|
accessModes: [{{ .Values.persistence.accessMode }}]
|
|
{{- $sc := .Values.persistence.storageClass | default .Values.global.defaultStorageClass }}
|
|
{{- if $sc }}
|
|
storageClassName: {{ $sc }}
|
|
{{- end }}
|
|
resources:
|
|
requests:
|
|
storage: {{ .Values.persistence.size }}
|
|
{{- end }}
|