symcrest/k8s-platform
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
k8s-platform/rendered/openproject/upstream-openproject.yaml

1219 lines
38 KiB
YAML
Raw Normal View History

Used www hostnames for internal routes
2026-06-24 18:50:42 +00:00
---
# Source: openproject/charts/memcached/templates/networkpolicy.yaml
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: openproject-memcached
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: memcached
app.kubernetes.io/version: 1.6.24
helm.sh/chart: memcached-6.14.0
spec:
podSelector:
matchLabels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: memcached
app.kubernetes.io/version: 1.6.24
helm.sh/chart: memcached-6.14.0
policyTypes:
- Ingress
- Egress
egress:
- {}
ingress:
- ports:
- port: 11211
---
# Source: openproject/charts/memcached/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
automountServiceAccountToken: false
metadata:
name: openproject-memcached
namespace: openproject
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: memcached
app.kubernetes.io/version: 1.6.24
helm.sh/chart: memcached-6.14.0
---
# Source: openproject/templates/serviceaccount.yaml
apiVersion: "v1"
kind: "ServiceAccount"
metadata:
name: openproject
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
app.kubernetes.io/component: openproject
...
---
# Source: openproject/templates/secret_core.yaml
apiVersion: "v1"
kind: "Secret"
metadata:
name: "openproject-core"
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
app.kubernetes.io/component: openproject
data: # reset data to make sure only keys defined below remain
stringData:
DATABASE_HOST: "postgres.database.svc.cluster.local"
DATABASE_PORT: "5432"
DATABASE_URL: "postgresql://openproject@postgres.database.svc.cluster.local:5432/openproject"
OPENPROJECT_SEED_ADMIN_USER_PASSWORD: "TempPass123"
OPENPROJECT_SEED_ADMIN_USER_PASSWORD_RESET: "true"
OPENPROJECT_SEED_ADMIN_USER_NAME: "IT Admin"
OPENPROJECT_SEED_ADMIN_USER_MAIL: "it.admin@symcrest.com"
OPENPROJECT_HTTPS: "true"
OPENPROJECT_HOST__NAME: "www.symcrest.com"
OPENPROJECT_HSTS: "true"
OPENPROJECT_RAILS__CACHE__STORE: "memcache"
OPENPROJECT_RAILS__RELATIVE__URL__ROOT: "/internal/dev/openproject"
POSTGRES_STATEMENT_TIMEOUT: "120s"
...
---
# Source: openproject/templates/secret_memcached.yaml
apiVersion: "v1"
kind: "Secret"
metadata:
name: "openproject-memcached"
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
app.kubernetes.io/component: memcached
data: # reset data to make sure only keys defined below remain
stringData:
OPENPROJECT_CACHE__MEMCACHE__SERVER: "openproject-memcached:11211"
...
---
# Source: openproject/templates/secret_secret_key_base.yaml
apiVersion: "v1"
kind: "Secret"
metadata:
name: secret-key-base-auto-generated
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
app.kubernetes.io/component: openproject
annotations:
# This annotation together with the lookup of the existing secret above ensures that this secret is not
# regenerated during each upgrade, but kept the same.
"helm.sh/resource-policy": "keep"
data: # reset data to make sure only keys defined below remain
stringData:
secret-key-base: dNM2C8uej7qGsjJHjKMRAxncbVREhzBOysrk7iVCVr6MHEibFCgDwbRSqB8Qe9WK
...
---
# Source: openproject/templates/persistentvolumeclaim.yaml
apiVersion: "v1"
kind: "PersistentVolumeClaim"
metadata:
name: openproject
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
app.kubernetes.io/component: openproject
spec:
accessModes: [ReadWriteOnce]
storageClassName: longhorn
resources:
requests:
storage: "1Gi"
...
---
# Source: openproject/charts/memcached/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: openproject-memcached
namespace: openproject
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: memcached
app.kubernetes.io/version: 1.6.24
helm.sh/chart: memcached-6.14.0
spec:
type: ClusterIP
ports:
- name: memcache
port: 11211
targetPort: memcache
nodePort: null
selector:
app.kubernetes.io/instance: openproject
app.kubernetes.io/name: memcached
---
# Source: openproject/templates/service.yaml
apiVersion: "v1"
kind: "Service"
metadata:
name: openproject
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
app.kubernetes.io/component: openproject
spec:
type: ClusterIP
ports:
- port: 8080
targetPort: http
protocol: TCP
name: http
selector:
app.kubernetes.io/name: openproject
app.kubernetes.io/instance: openproject
openproject/process: web
...
---
# Source: openproject/charts/memcached/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: openproject-memcached
namespace: openproject
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: memcached
app.kubernetes.io/version: 1.6.24
helm.sh/chart: memcached-6.14.0
spec:
selector:
matchLabels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/name: memcached
replicas: 1
strategy:
rollingUpdate: {}
type: RollingUpdate
template:
metadata:
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: memcached
app.kubernetes.io/version: 1.6.24
helm.sh/chart: memcached-6.14.0
annotations:
spec:
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/name: memcached
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: openproject-memcached
containers:
- name: memcached
image: docker.io/bitnamilegacy/memcached:1.6.24-debian-12-r0
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: false
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seLinuxOptions: null
seccompProfile:
type: RuntimeDefault
env:
- name: BITNAMI_DEBUG
value: "false"
- name: MEMCACHED_PORT_NUMBER
value: "11211"
ports:
- name: memcache
containerPort: 11211
livenessProbe:
failureThreshold: 6
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
tcpSocket:
port: memcache
readinessProbe:
failureThreshold: 6
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 3
tcpSocket:
port: memcache
volumeMounts:
- name: empty-dir
mountPath: /opt/bitnami/memcached/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
volumes:
- name: empty-dir
emptyDir: {}
---
# Source: openproject/templates/cron-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: openproject-cron
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
openproject/process: cron
app.kubernetes.io/component: cron
spec:
replicas: 0
strategy:
type: "Recreate"
selector:
matchLabels:
app.kubernetes.io/name: openproject
app.kubernetes.io/instance: openproject
openproject/process: cron
template:
metadata:
annotations:
# annotate pods with env value checksums so changes trigger re-deployments
checksum/env-core: d595adde5a7e1007834c68766ac51f7652c1246a63b976431b0ee5a6c9870a78
checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
checksum/env-cron-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
openproject/process: cron
app.kubernetes.io/component: cron
spec:
nodeSelector:
workload: app
securityContext:
fsGroup: 1000
serviceAccountName: openproject
volumes:
- name: tmp
# we can't use emptyDir due to the sticky bit issue
# see: https://github.com/kubernetes/kubernetes/issues/110835
ephemeral:
volumeClaimTemplate:
metadata:
creationTimestamp: null
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 5Gi
- name: app-tmp
# we can't use emptyDir due to the sticky bit / world writable issue
# see: https://github.com/kubernetes/kubernetes/issues/110835
ephemeral:
volumeClaimTemplate:
metadata:
creationTimestamp: null
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 5Gi
- name: "data"
persistentVolumeClaim:
claimName: openproject
initContainers:
- name: prepare-tmpdir
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
command:
- sh
- -c
- mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
resources:
limits:
memory: 1024Mi
requests:
memory: 512Mi
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
- name: wait-for-db
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
envFrom:
- secretRef:
name: openproject-core
- secretRef:
name: openproject-memcached
- secretRef:
name: openproject-postgres-secret
- secretRef:
name: openproject-cron-environment
env:
- name: TMPDIR
value: /tmp/ruby
- name: OPENPROJECT_DB_PASSWORD
valueFrom:
secretKeyRef:
name: openproject-postgres-secret
key: password
- name: SECRET_KEY_BASE
valueFrom:
secretKeyRef:
name: secret-key-base-auto-generated
key: secret-key-base
args:
- bash
- /app/docker/prod/wait-for-db
resources:
limits:
memory: 1024Mi
requests:
memory: 512Mi
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
containers:
- name: "cron"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
envFrom:
- secretRef:
name: openproject-core
- secretRef:
name: openproject-memcached
- secretRef:
name: openproject-postgres-secret
- secretRef:
name: openproject-cron-environment
args:
- bash
- /app/docker/prod/cron
env:
- name: TMPDIR
value: /tmp/ruby
- name: OPENPROJECT_DB_PASSWORD
valueFrom:
secretKeyRef:
name: openproject-postgres-secret
key: password
- name: SECRET_KEY_BASE
valueFrom:
secretKeyRef:
name: secret-key-base-auto-generated
key: secret-key-base
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
- name: "data"
mountPath: "/var/openproject/assets"
resources:
limits:
cpu: "1"
memory: 1Gi
requests:
cpu: 250m
memory: 256Mi
---
# Source: openproject/templates/web-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: openproject-web
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
openproject/process: web
app.kubernetes.io/component: web
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app.kubernetes.io/name: openproject
app.kubernetes.io/instance: openproject
openproject/process: web
template:
metadata:
annotations:
# annotate pods with env value checksums so changes trigger re-deployments
checksum/env-core: d595adde5a7e1007834c68766ac51f7652c1246a63b976431b0ee5a6c9870a78
checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
openproject/process: web
app.kubernetes.io/component: web
spec:
nodeSelector:
workload: app
securityContext:
fsGroup: 1000
serviceAccountName: openproject
volumes:
- name: tmp
# we can't use emptyDir due to the sticky bit issue
# see: https://github.com/kubernetes/kubernetes/issues/110835
ephemeral:
volumeClaimTemplate:
metadata:
creationTimestamp: null
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 5Gi
- name: app-tmp
# we can't use emptyDir due to the sticky bit / world writable issue
# see: https://github.com/kubernetes/kubernetes/issues/110835
ephemeral:
volumeClaimTemplate:
metadata:
creationTimestamp: null
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 5Gi
- name: "data"
persistentVolumeClaim:
claimName: openproject
initContainers:
- name: prepare-tmpdir
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
command:
- sh
- -c
- mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
resources:
limits:
memory: 1024Mi
requests:
memory: 512Mi
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
- name: wait-for-db
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
envFrom:
- secretRef:
name: openproject-core
- secretRef:
name: openproject-memcached
- secretRef:
name: openproject-postgres-secret
env:
- name: TMPDIR
value: /tmp/ruby
- name: OPENPROJECT_DB_PASSWORD
valueFrom:
secretKeyRef:
name: openproject-postgres-secret
key: password
- name: SECRET_KEY_BASE
valueFrom:
secretKeyRef:
name: secret-key-base-auto-generated
key: secret-key-base
args:
- /app/docker/prod/wait-for-db
resources:
limits:
memory: 1024Mi
requests:
memory: 512Mi
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
containers:
- name: "openproject"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
envFrom:
- secretRef:
name: openproject-core
- secretRef:
name: openproject-memcached
- secretRef:
name: openproject-postgres-secret
env:
- name: TMPDIR
value: /tmp/ruby
- name: OPENPROJECT_DB_PASSWORD
valueFrom:
secretKeyRef:
name: openproject-postgres-secret
key: password
- name: SECRET_KEY_BASE
valueFrom:
secretKeyRef:
name: secret-key-base-auto-generated
key: secret-key-base
args:
- /app/docker/prod/web
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
- name: "data"
mountPath: "/var/openproject/assets"
ports:
- name: http
containerPort: 8080
protocol: TCP
livenessProbe:
httpGet:
path: "/internal/dev/openproject/health_checks/default"
port: 8080
httpHeaders:
# required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
- name: Host
value: localhost
initialDelaySeconds: 0
timeoutSeconds: 5
periodSeconds: 15
failureThreshold: 3
successThreshold: 1
readinessProbe:
httpGet:
path: "/internal/dev/openproject/health_checks/default"
port: 8080
httpHeaders:
# required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
- name: Host
value: localhost
initialDelaySeconds: 0
timeoutSeconds: 5
periodSeconds: 10
failureThreshold: 3
successThreshold: 1
startupProbe:
httpGet:
path: "/internal/dev/openproject/health_checks/default"
port: 8080
httpHeaders:
# required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
- name: Host
value: localhost
initialDelaySeconds: 60
timeoutSeconds: 5
periodSeconds: 15
failureThreshold: 10
successThreshold: 1
resources:
limits:
cpu: "4"
memory: 4Gi
requests:
cpu: 250m
memory: 512Mi
---
# Source: openproject/templates/worker-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: openproject-worker-default
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
openproject/process: worker-default
app.kubernetes.io/component: worker-default
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app.kubernetes.io/name: openproject
app.kubernetes.io/instance: openproject
openproject/process: worker-default
template:
metadata:
annotations:
# annotate pods with env value checksums so changes trigger re-deployments
checksum/env-core: d595adde5a7e1007834c68766ac51f7652c1246a63b976431b0ee5a6c9870a78
checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
openproject/process: worker-default
app.kubernetes.io/component: worker-default
spec:
nodeSelector:
workload: app
securityContext:
fsGroup: 1000
serviceAccountName: openproject
volumes:
- name: tmp
# we can't use emptyDir due to the sticky bit issue
# see: https://github.com/kubernetes/kubernetes/issues/110835
ephemeral:
volumeClaimTemplate:
metadata:
creationTimestamp: null
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 5Gi
- name: app-tmp
# we can't use emptyDir due to the sticky bit / world writable issue
# see: https://github.com/kubernetes/kubernetes/issues/110835
ephemeral:
volumeClaimTemplate:
metadata:
creationTimestamp: null
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 5Gi
- name: "data"
persistentVolumeClaim:
claimName: openproject
initContainers:
- name: prepare-tmpdir
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
command:
- sh
- -c
- mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
resources:
limits:
memory: 1024Mi
requests:
memory: 512Mi
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
- name: wait-for-db
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
envFrom:
- secretRef:
name: openproject-core
- secretRef:
name: openproject-memcached
- secretRef:
name: openproject-postgres-secret
env:
- name: TMPDIR
value: /tmp/ruby
- name: OPENPROJECT_DB_PASSWORD
valueFrom:
secretKeyRef:
name: openproject-postgres-secret
key: password
- name: SECRET_KEY_BASE
valueFrom:
secretKeyRef:
name: secret-key-base-auto-generated
key: secret-key-base
args:
- bash
- /app/docker/prod/wait-for-db
resources:
limits:
memory: 1024Mi
requests:
memory: 512Mi
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
containers:
- name: "openproject"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
envFrom:
- secretRef:
name: openproject-core
- secretRef:
name: openproject-memcached
- secretRef:
name: openproject-postgres-secret
args:
- bash
- /app/docker/prod/worker
env:
- name: TMPDIR
value: /tmp/ruby
- name: OPENPROJECT_DB_PASSWORD
valueFrom:
secretKeyRef:
name: openproject-postgres-secret
key: password
- name: SECRET_KEY_BASE
valueFrom:
secretKeyRef:
name: secret-key-base-auto-generated
key: secret-key-base
- name: "OPENPROJECT_GOOD_JOB_QUEUES"
value: ""
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
- name: "data"
mountPath: "/var/openproject/assets"
resources:
limits:
cpu: "4"
memory: 4Gi
requests:
cpu: 250m
memory: 512Mi
---
# Source: openproject/templates/seeder-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
name: openproject-seeder-1
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
app.kubernetes.io/component: seeder
spec:
ttlSecondsAfterFinished: 86400
template:
metadata:
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
openproject/process: seeder
app.kubernetes.io/component: seeder
spec:
serviceAccountName: openproject
securityContext:
fsGroup: 1000
nodeSelector:
workload: app
volumes:
- name: tmp
# we can't use emptyDir due to the sticky bit issue
# see: https://github.com/kubernetes/kubernetes/issues/110835
ephemeral:
volumeClaimTemplate:
metadata:
creationTimestamp: null
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 5Gi
- name: app-tmp
# we can't use emptyDir due to the sticky bit / world writable issue
# see: https://github.com/kubernetes/kubernetes/issues/110835
ephemeral:
volumeClaimTemplate:
metadata:
creationTimestamp: null
spec:
accessModes: ["ReadWriteOnce"]
storageClassName: longhorn
resources:
requests:
storage: 5Gi
- name: "data"
persistentVolumeClaim:
claimName: openproject
initContainers:
- name: prepare-tmpdir
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
image: docker.io/openproject/openproject:17.5.1-slim
imagePullPolicy: Always
command:
- sh
- -c
- mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
resources:
limits:
memory: 1024Mi
requests:
memory: 512Mi
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
- name: check-db-ready
image: "docker.io/postgres:16"
imagePullPolicy: Always
command: [
'sh',
'-c',
'until pg_isready -h $DATABASE_HOST -p $DATABASE_PORT -U openproject; do echo "waiting for database $DATABASE_HOST:$DATABASE_PORT"; sleep 2; done;'
]
envFrom:
- secretRef:
name: openproject-core
- secretRef:
name: openproject-memcached
- secretRef:
name: openproject-postgres-secret
env:
- name: TMPDIR
value: /tmp/ruby
- name: OPENPROJECT_DB_PASSWORD
valueFrom:
secretKeyRef:
name: openproject-postgres-secret
key: password
- name: SECRET_KEY_BASE
valueFrom:
secretKeyRef:
name: secret-key-base-auto-generated
key: secret-key-base
resources:
limits:
memory: 200Mi
requests:
memory: 200Mi
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
containers:
- name: seeder
image: "docker.io/openproject/openproject:17.5.1-slim"
imagePullPolicy: Always
args:
- bash
- /app/docker/prod/seeder
envFrom:
- secretRef:
name: openproject-core
- secretRef:
name: openproject-memcached
- secretRef:
name: openproject-postgres-secret
env:
- name: TMPDIR
value: /tmp/ruby
- name: OPENPROJECT_DB_PASSWORD
valueFrom:
secretKeyRef:
name: openproject-postgres-secret
key: password
- name: SECRET_KEY_BASE
valueFrom:
secretKeyRef:
name: secret-key-base-auto-generated
key: secret-key-base
resources:
limits:
memory: 1Gi
requests:
memory: 512Mi
volumeMounts:
- mountPath: /tmp
name: tmp
- mountPath: /app/tmp
name: app-tmp
- name: "data"
mountPath: "/var/openproject/assets"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
restartPolicy: OnFailure
---
# Source: openproject/templates/secret_hocuspocus.yaml
# Only generate this secret if
# a) the included hocuspocus deployment is enabled
# b) no existing secret is configured for the openproject realtime collaboration
# c) no existing secret is configured for the included hocuspocus deployment
# and if
# d) this automatically generated secret does not exist yet.
---
# Source: openproject/templates/secret_secret_key_base.yaml
# Only generate this secret if
# a) no existing secret is configured for SECRET_KEY_BASE
# and if
# b) SECRET_KEY_BASE is not provided via the environment values
# and if
# c) this automatically generated secret does not exist yet.
---
# Source: openproject/templates/tests/test-connection.yaml
apiVersion: "v1"
kind: "Pod"
metadata:
name: "openproject-test-connection"
namespace: "openproject"
labels:
app.kubernetes.io/instance: openproject
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: openproject
app.kubernetes.io/version: 17.5.1
helm.sh/chart: openproject-13.8.1
app.kubernetes.io/component: test-connection
annotations:
"helm.sh/hook": test
spec:
serviceAccountName: openproject
containers:
- name: "wget"
image: "busybox"
imagePullPolicy: Always
command: ['wget']
args:
- '--no-verbose'
- '--tries=1'
- '--spider'
- 'openproject:8080/health_check'
restartPolicy: "Never"
...
Reference in a new issue Copy permalink