home-ops/kubernetes/gabernetes/apps/zigbee2mqtt/app/helmrelease.yaml at main · gabe565/home-ops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-5.0.1/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: zigbee2mqtt
  namespace: zigbee2mqtt
spec:
  chart:
    spec:
      chart: app-template
      version: 5.0.1
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        namespace: flux-system
        name: bjw-s
  interval: 1h
  driftDetection:
    mode: enabled
  values:
    controllers:
      zigbee2mqtt:
        annotations:
          secret.reloader.stakater.com/reload: mqtt-tls
        containers:
          app:
            image:
              repository: ghcr.io/koenkk/zigbee2mqtt
              tag: 2.12.1@sha256:80f7f04f72a99e4c4ef51ef7e98ee736edba6db0ecbb7abc626d0c4b0f1871f1
              pullPolicy: IfNotPresent
            env:
              TZ: America/Chicago
              ZIGBEE2MQTT_DATA: /data
            resources:
              requests:
                squat.ai/zigbee: 1
              limits:
                squat.ai/zigbee: 1
            probes:
              startup:
                enabled: true
                spec:
                  failureThreshold: 30
                  periodSeconds: 5
              liveness:
                enabled: true
              readiness:
                enabled: true
            securityContext:
              allowPrivilegeEscalation: false
              readOnlyRootFilesystem: true
              capabilities: {drop: ["ALL"]}
        pod:
          labels:
            policy.gabe565.com/egress-mosquitto: "true"
            policy.gabe565.com/egress-world: "true"
            policy.gabe565.com/ingress-envoy-public: "true"
          securityContext:
            runAsNonRoot: true
            runAsUser: 65534
            runAsGroup: 65534
            fsGroup: 65534
            fsGroupChangePolicy: OnRootMismatch
            seccompProfile: {type: RuntimeDefault}

    persistence:
      data:
        suffix: data
        storageClass: longhorn-ssd
        accessMode: ReadWriteOnce
        size: 128Mi
        retain: true
      mqtt-tls:
        type: secret
        name: mqtt-tls

    service:
      zigbee2mqtt:
        controller: zigbee2mqtt
        ports:
          http:
            port: 8080

    route:
      zigbee2mqtt:
        parentRefs:
          - namespace: envoy-gateway-system
            name: public
        hostnames:
          - ${app_url}
        rules:
          - backendRefs:
              - identifier: zigbee2mqtt

    rawResources:
      auth:
        manifest:
          apiVersion: gateway.envoyproxy.io/v1alpha1
          kind: SecurityPolicy
          spec:
            mergeType: StrategicMerge
            targetRefs:
              - group: gateway.networking.k8s.io
                kind: HTTPRoute
                name: "{{ .Release.Name }}"
            oidc:
              provider:
                issuer: https://${oidc_host}/application/o/zigbee2mqtt/
                authorizationEndpoint: https://${oidc_host}/application/o/authorize/
                tokenEndpoint: https://${oidc_host}/application/o/token/
              clientIDRef:
                name: oidc
              clientSecret:
                name: oidc
              scopes: [openid, offline_access]