home-ops/kubernetes/gabernetes/apps/tools/resources/it-tools/helmrelease.yaml at main · gabe565/home-ops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-5.0.1/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: it-tools
  namespace: tools
spec:
  chart:
    spec:
      chart: app-template
      version: 5.0.1
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        namespace: flux-system
        name: bjw-s
  interval: 1h
  driftDetection:
    mode: enabled
  values:
    controllers:
      main:
        strategy: RollingUpdate
        containers:
          app:
            image:
              repository: ghcr.io/nginx/nginx-unprivileged
              tag: stable-alpine
              pullPolicy: Always
            probes:
              startup:
                enabled: true
                spec:
                  failureThreshold: 30
                  periodSeconds: 5
            securityContext:
              readOnlyRootFilesystem: true
              allowPrivilegeEscalation: false
              capabilities: { drop: [ALL] }
        pod:
          labels:
            policy.gabe565.com/ingress-envoy-public: "true"
          securityContext:
            runAsNonRoot: true
            runAsUser: 101
            runAsGroup: 101
            fsGroup: 101
            fsGroupChangePolicy: OnRootMismatch
            seccompProfile: { type: RuntimeDefault }

    persistence:
      nginx:
        type: configMap
        identifier: nginx
        globalMounts:
          - path: /etc/nginx/conf.d
      it-tools:
        type: image
        image: ghcr.io/corentinth/it-tools:2024.10.22-7ca5933@sha256:8b8128748339583ca951af03dfe02a9a4d7363f61a216226fc28030731a5a61f
        globalMounts:
          - path: /usr/share/nginx/html
            subPath: usr/share/nginx/html
      tmp:
        type: emptyDir

    service:
      main:
        ports:
          http:
            port: 8080

    route:
      main:
        parentRefs:
          - namespace: envoy-gateway-system
            name: public
        hostnames:
          - ${it_tools_host}
        rules:
          - backendRefs:
              - identifier: main
            filters:
              - type: ResponseHeaderModifier
                responseHeaderModifier:
                  set:
                    - name: X-Robots-Tag
                      value: none

    configMaps:
      nginx:
        data:
          default.conf: |
            server {
                listen 8080;
                server_name localhost;

                location / {
                    root /usr/share/nginx/html;
                    try_files $uri $uri/ /index.html;
                }

                error_page 500 502 503 504 /50x.html;
                location = /50x.html {
                    root /usr/share/nginx/html;
                }
            }