From 2a8fffae9043f2707376503b4427457dfa169326 Mon Sep 17 00:00:00 2001
From: Arvind Prabhakar <arvind.prabhakar@symcrest.com>
Date: Sun, 6 Sep 2026 20:01:35 +0000
Subject: [PATCH] Remove OpenProject Studio service

---
 .../applications/studio/openproject.yaml      |   18 -
 argocd-apps/studio-project.yaml               |    4 -
 charts/openproject/Chart.yaml                 |    6 -
 charts/openproject/upstream-values.yaml       |   54 -
 charts/openproject/values.yaml                |    9 -
 .../gateway/envoy/routes/openproject.yaml     |   32 -
 .../openproject/base-egress.yaml              |   39 -
 .../platform-services/postgres-ingress.yaml   |    2 -
 .../openproject/upstream-openproject.yaml     | 1219 -----------------
 9 files changed, 1383 deletions(-)
 delete mode 100644 argocd-apps/applications/studio/openproject.yaml
 delete mode 100644 charts/openproject/Chart.yaml
 delete mode 100644 charts/openproject/upstream-values.yaml
 delete mode 100644 charts/openproject/values.yaml
 delete mode 100644 infrastructure/gateway/envoy/routes/openproject.yaml
 delete mode 100644 infrastructure/network-policies/openproject/base-egress.yaml
 delete mode 100644 rendered/openproject/upstream-openproject.yaml

diff --git a/argocd-apps/applications/studio/openproject.yaml b/argocd-apps/applications/studio/openproject.yaml
deleted file mode 100644
index 5c6e38d..0000000
--- a/argocd-apps/applications/studio/openproject.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: openproject
-  namespace: argocd
-spec:
-  project: studio
-  source:
-    repoURL: http://forgejo.forgejo.svc.cluster.local:3000/symcrest/k8s-platform.git
-    targetRevision: main
-    path: rendered/openproject
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: openproject
-  syncPolicy:
-    automated:
-      prune: false
-      selfHeal: true
diff --git a/argocd-apps/studio-project.yaml b/argocd-apps/studio-project.yaml
index a692965..d1043cc 100644
--- a/argocd-apps/studio-project.yaml
+++ b/argocd-apps/studio-project.yaml
@@ -12,10 +12,6 @@ spec:
   destinations:
     - namespace: forgejo
       server: https://kubernetes.default.svc
-
-    - namespace: openproject
-      server: https://kubernetes.default.svc
-
     - namespace: pgadmin
       server: https://kubernetes.default.svc
     - namespace: phpmyadmin
diff --git a/charts/openproject/Chart.yaml b/charts/openproject/Chart.yaml
deleted file mode 100644
index 8b9e112..0000000
--- a/charts/openproject/Chart.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v2
-name: openproject
-description: Symcrest OpenProject wrapper chart
-type: application
-version: 0.1.0
-appVersion: "17.5.1"
diff --git a/charts/openproject/upstream-values.yaml b/charts/openproject/upstream-values.yaml
deleted file mode 100644
index afd3f5d..0000000
--- a/charts/openproject/upstream-values.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-openproject:
-  https: true
-  host: www.symcrest.com
-  railsRelativeUrlRoot: /services/studio/openproject
-
-  extraEnvVarsSecret: openproject-postgres-secret
-
-  useTmpVolumes: true
-  tmpVolumesStorage: "5Gi"
-  tmpVolumesStorageClassName: longhorn
-  tmpVolumesPermissionFix: true
-
-  realtime_collaboration:
-    enabled: false
-
-  admin_user:
-    password: "TempPass123"
-    password_reset: "true"
-    name: "IT Admin"
-    mail: "it.admin@symcrest.com"
-
-cron:
-  enabled: false
-
-hocuspocus:
-  enabled: false
-
-ingress:
-  enabled: false
-
-tests:
-  enabled: false
-
-nodeSelector:
-  workload: app
-
-persistence:
-  enabled: true
-  storageClassName: longhorn
-  accessModes:
-    - ReadWriteOnce
-  size: 1Gi
-
-postgresql:
-  bundled: false
-  connection:
-    host: platform-postgres.platform-services.svc.cluster.local
-    port: 5432
-  auth:
-    existingSecret: openproject-postgres-secret
-    secretKeys:
-      userPasswordKey: password
-    username: openproject
-    database: openproject
diff --git a/charts/openproject/values.yaml b/charts/openproject/values.yaml
deleted file mode 100644
index 3a0ba16..0000000
--- a/charts/openproject/values.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-hostnames:
-  - www.symcrest.com
-basePath: /services/studio/openproject
-gateway:
-  name: public-gateway
-  namespace: apps
-service:
-  name: openproject
-  port: 8080
diff --git a/infrastructure/gateway/envoy/routes/openproject.yaml b/infrastructure/gateway/envoy/routes/openproject.yaml
deleted file mode 100644
index 81fd104..0000000
--- a/infrastructure/gateway/envoy/routes/openproject.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: openproject
-  namespace: openproject
-spec:
-  parentRefs:
-    - name: public-gateway
-      namespace: apps
-  hostnames:
-    - "www.symcrest.com"
-  rules:
-    - matches:
-        - path:
-            type: Exact
-            value: /services/studio/openproject
-      filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            path:
-              type: ReplaceFullPath
-              replaceFullPath: /services/studio/openproject/
-            statusCode: 301
-
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /services/studio/openproject/
-      backendRefs:
-        - name: openproject
-          port: 8080
diff --git a/infrastructure/network-policies/openproject/base-egress.yaml b/infrastructure/network-policies/openproject/base-egress.yaml
deleted file mode 100644
index 742a963..0000000
--- a/infrastructure/network-policies/openproject/base-egress.yaml
+++ /dev/null
@@ -1,39 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: openproject-base-egress
-  namespace: openproject
-spec:
-  endpointSelector: {}
-  egress:
-    - toEntities:
-        - kube-apiserver
-
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: kube-system
-            k8s:k8s-app: kube-dns
-      toPorts:
-        - ports:
-            - port: "53"
-              protocol: UDP
-            - port: "53"
-              protocol: TCP
-
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: platform-services
-            app: platform-postgres
-      toPorts:
-        - ports:
-            - port: "5432"
-              protocol: TCP
-
-    - toEndpoints:
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: openproject
-            app.kubernetes.io/name: memcached
-      toPorts:
-        - ports:
-            - port: "11211"
-              protocol: TCP
diff --git a/infrastructure/network-policies/platform-services/postgres-ingress.yaml b/infrastructure/network-policies/platform-services/postgres-ingress.yaml
index c4d9a0e..4e31076 100644
--- a/infrastructure/network-policies/platform-services/postgres-ingress.yaml
+++ b/infrastructure/network-policies/platform-services/postgres-ingress.yaml
@@ -11,8 +11,6 @@ spec:
     - fromEndpoints:
         - matchLabels:
             k8s:io.kubernetes.pod.namespace: forgejo
-        - matchLabels:
-            k8s:io.kubernetes.pod.namespace: openproject
         - matchLabels:
             k8s:io.kubernetes.pod.namespace: pgadmin
       toPorts:
diff --git a/rendered/openproject/upstream-openproject.yaml b/rendered/openproject/upstream-openproject.yaml
deleted file mode 100644
index 50ed4f5..0000000
--- a/rendered/openproject/upstream-openproject.yaml
+++ /dev/null
@@ -1,1219 +0,0 @@
----
-# Source: openproject/charts/memcached/templates/networkpolicy.yaml
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: openproject-memcached
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: memcached
-    app.kubernetes.io/version: 1.6.24
-    helm.sh/chart: memcached-6.14.0
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/instance: openproject
-      app.kubernetes.io/managed-by: Helm
-      app.kubernetes.io/name: memcached
-      app.kubernetes.io/version: 1.6.24
-      helm.sh/chart: memcached-6.14.0
-  policyTypes:
-    - Ingress
-    - Egress
-  egress:
-    - {}
-  ingress:
-    - ports:
-        - port: 11211
----
-# Source: openproject/charts/memcached/templates/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-automountServiceAccountToken: false
-metadata:
-  name: openproject-memcached
-  namespace: openproject
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: memcached
-    app.kubernetes.io/version: 1.6.24
-    helm.sh/chart: memcached-6.14.0
----
-# Source: openproject/templates/serviceaccount.yaml
-apiVersion: "v1"
-kind: "ServiceAccount"
-metadata:
-  name: openproject
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    app.kubernetes.io/component: openproject
-...
----
-# Source: openproject/templates/secret_core.yaml
-apiVersion: "v1"
-kind: "Secret"
-metadata:
-  name: "openproject-core"
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    app.kubernetes.io/component: openproject
-data: # reset data to make sure only keys defined below remain
-stringData:
-  DATABASE_HOST: "platform-postgres.platform-services.svc.cluster.local"
-  DATABASE_PORT: "5432"
-  DATABASE_URL: "postgresql://openproject@platform-postgres.platform-services.svc.cluster.local:5432/openproject"
-  OPENPROJECT_SEED_ADMIN_USER_PASSWORD: "TempPass123"
-  OPENPROJECT_SEED_ADMIN_USER_PASSWORD_RESET: "true"
-  OPENPROJECT_SEED_ADMIN_USER_NAME: "IT Admin"
-  OPENPROJECT_SEED_ADMIN_USER_MAIL: "it.admin@symcrest.com"
-  OPENPROJECT_HTTPS: "true"
-  OPENPROJECT_HOST__NAME: "www.symcrest.com"
-  OPENPROJECT_HSTS: "true"
-  OPENPROJECT_RAILS__CACHE__STORE: "memcache"
-  OPENPROJECT_RAILS__RELATIVE__URL__ROOT: "/services/studio/openproject"
-  POSTGRES_STATEMENT_TIMEOUT: "120s"
-...
----
-# Source: openproject/templates/secret_memcached.yaml
-apiVersion: "v1"
-kind: "Secret"
-metadata:
-  name: "openproject-memcached"
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    app.kubernetes.io/component: memcached
-data: # reset data to make sure only keys defined below remain
-stringData:
-  OPENPROJECT_CACHE__MEMCACHE__SERVER: "openproject-memcached:11211"
-...
----
-# Source: openproject/templates/secret_secret_key_base.yaml
-apiVersion: "v1"
-kind: "Secret"
-metadata:
-  name: secret-key-base-auto-generated
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    app.kubernetes.io/component: openproject
-  annotations:
-    # This annotation together with the lookup of the existing secret above ensures that this secret is not
-    # regenerated during each upgrade, but kept the same.
-    "helm.sh/resource-policy": "keep"
-data: # reset data to make sure only keys defined below remain
-stringData:
-  secret-key-base: 2NvoLwisgyb1TI1TFHbiJ07gQn5lkIBuzxehR4Wea1DpsYpD3Rh3xfaIgkT2Tmzu
-...
----
-# Source: openproject/templates/persistentvolumeclaim.yaml
-apiVersion: "v1"
-kind: "PersistentVolumeClaim"
-metadata:
-  name: openproject
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    app.kubernetes.io/component: openproject
-spec:
-  accessModes: [ReadWriteOnce]
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: "1Gi"
-...
----
-# Source: openproject/charts/memcached/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: openproject-memcached
-  namespace: openproject
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: memcached
-    app.kubernetes.io/version: 1.6.24
-    helm.sh/chart: memcached-6.14.0
-spec:
-  type: ClusterIP
-  ports:
-    - name: memcache
-      port: 11211
-      targetPort: memcache
-      nodePort: null
-  selector:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/name: memcached
----
-# Source: openproject/templates/service.yaml
-apiVersion: "v1"
-kind: "Service"
-metadata:
-  name: openproject
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    app.kubernetes.io/component: openproject
-spec:
-  type: ClusterIP
-  ports:
-    - port: 8080
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/instance: openproject
-    openproject/process: web
-...
----
-# Source: openproject/charts/memcached/templates/deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: openproject-memcached
-  namespace: openproject
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: memcached
-    app.kubernetes.io/version: 1.6.24
-    helm.sh/chart: memcached-6.14.0
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: openproject
-      app.kubernetes.io/name: memcached
-  replicas: 1
-  strategy:
-    rollingUpdate: {}
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: openproject
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: memcached
-        app.kubernetes.io/version: 1.6.24
-        helm.sh/chart: memcached-6.14.0
-      annotations:
-    spec:
-      
-      automountServiceAccountToken: false
-      affinity:
-        podAffinity:
-          
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/instance: openproject
-                    app.kubernetes.io/name: memcached
-                topologyKey: kubernetes.io/hostname
-              weight: 1
-        nodeAffinity:
-          
-      securityContext:
-        fsGroup: 1001
-        fsGroupChangePolicy: Always
-        supplementalGroups: []
-        sysctls: []
-      serviceAccountName: openproject-memcached
-      containers:
-        - name: memcached
-          image: docker.io/bitnamilegacy/memcached:1.6.24-debian-12-r0
-          imagePullPolicy: "IfNotPresent"
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            privileged: false
-            readOnlyRootFilesystem: false
-            runAsGroup: 1001
-            runAsNonRoot: true
-            runAsUser: 1001
-            seLinuxOptions: null
-            seccompProfile:
-              type: RuntimeDefault
-          env:
-            - name: BITNAMI_DEBUG
-              value: "false"
-            - name: MEMCACHED_PORT_NUMBER
-              value: "11211"
-          ports:
-            - name: memcache
-              containerPort: 11211
-          livenessProbe:
-            failureThreshold: 6
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-            tcpSocket:
-              port: memcache
-          readinessProbe:
-            failureThreshold: 6
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            successThreshold: 1
-            timeoutSeconds: 3
-            tcpSocket:
-              port: memcache
-          volumeMounts:
-            - name: empty-dir
-              mountPath: /opt/bitnami/memcached/conf
-              subPath: app-conf-dir
-            - name: empty-dir
-              mountPath: /tmp
-              subPath: tmp-dir
-      volumes:
-        - name: empty-dir
-          emptyDir: {}
----
-# Source: openproject/templates/cron-deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: openproject-cron
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    openproject/process: cron
-    app.kubernetes.io/component: cron
-spec:
-  replicas: 0
-  strategy:
-    type: "Recreate"
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: openproject
-      app.kubernetes.io/instance: openproject
-      openproject/process: cron
-  template:
-    metadata:
-      annotations:
-        
-        # annotate pods with env value checksums so changes trigger re-deployments
-        
-        checksum/env-core: 2d0e679fb4fde1d473b3f274fa94ae520dd26c1045409de808b7562f7b64a454
-        checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
-        checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-        checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-        checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-        checksum/env-cron-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-      labels:
-        app.kubernetes.io/instance: openproject
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: openproject
-        app.kubernetes.io/version: 17.5.1
-        helm.sh/chart: openproject-13.8.1
-        openproject/process: cron
-        app.kubernetes.io/component: cron
-    spec:      
-      nodeSelector:
-        workload: app      
-      securityContext:
-        fsGroup: 1000
-      serviceAccountName: openproject
-      volumes:        
-        - name: tmp
-          # we can't use emptyDir due to the sticky bit issue
-          # see: https://github.com/kubernetes/kubernetes/issues/110835
-          ephemeral:
-            volumeClaimTemplate:
-              metadata:
-                creationTimestamp: null
-              spec:
-                accessModes: ["ReadWriteOnce"]
-                storageClassName: longhorn
-                resources:
-                  requests:
-                    storage: 5Gi
-        - name: app-tmp
-          # we can't use emptyDir due to the sticky bit / world writable issue
-          # see: https://github.com/kubernetes/kubernetes/issues/110835
-          ephemeral:
-            volumeClaimTemplate:
-              metadata:
-                creationTimestamp: null
-              spec:
-                accessModes: ["ReadWriteOnce"]
-                storageClassName: longhorn
-                resources:
-                  requests:
-                    storage: 5Gi
-        - name: "data"
-          persistentVolumeClaim:
-            claimName: openproject        
-      initContainers:        
-        - name: prepare-tmpdir  
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          command:
-            - sh
-            - -c
-            - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
-          resources:
-            limits:
-              memory: 1024Mi
-            requests:
-              memory: 512Mi
-          volumeMounts:    
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-        - name: wait-for-db          
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          envFrom:
-            - secretRef:
-                name: openproject-core
-            - secretRef:
-                name: openproject-memcached
-            - secretRef:
-                name: openproject-postgres-secret
-            - secretRef:
-                name: openproject-cron-environment
-          env:
-            
-            - name: TMPDIR
-              value: /tmp/ruby
-            - name: OPENPROJECT_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: openproject-postgres-secret
-                  key: password
-            - name: SECRET_KEY_BASE
-              valueFrom:
-                secretKeyRef:
-                  name: secret-key-base-auto-generated
-                  key: secret-key-base
-          args:
-            - bash
-            - /app/docker/prod/wait-for-db
-          resources:
-            limits:
-              memory: 1024Mi
-            requests:
-              memory: 512Mi
-          volumeMounts:            
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-      containers:
-        - name: "cron"          
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          envFrom:
-            - secretRef:
-                name: openproject-core
-            - secretRef:
-                name: openproject-memcached
-            - secretRef:
-                name: openproject-postgres-secret
-            - secretRef:
-                name: openproject-cron-environment
-          args:
-            - bash
-            - /app/docker/prod/cron
-          env:
-            
-            - name: TMPDIR
-              value: /tmp/ruby
-            - name: OPENPROJECT_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: openproject-postgres-secret
-                  key: password
-            - name: SECRET_KEY_BASE
-              valueFrom:
-                secretKeyRef:
-                  name: secret-key-base-auto-generated
-                  key: secret-key-base
-          volumeMounts:            
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-            - name: "data"
-              mountPath: "/var/openproject/assets"            
-          resources:
-            limits:
-              cpu: "1"
-              memory: 1Gi
-            requests:
-              cpu: 250m
-              memory: 256Mi
----
-# Source: openproject/templates/web-deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: openproject-web
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    openproject/process: web
-    app.kubernetes.io/component: web
-spec:
-  replicas: 1
-  strategy:
-    
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: openproject
-      app.kubernetes.io/instance: openproject
-      openproject/process: web
-  template:
-    metadata:
-      annotations:
-        
-        # annotate pods with env value checksums so changes trigger re-deployments
-        
-        checksum/env-core: 2d0e679fb4fde1d473b3f274fa94ae520dd26c1045409de808b7562f7b64a454
-        checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
-        checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-        checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-        checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-      labels:
-        app.kubernetes.io/instance: openproject
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: openproject
-        app.kubernetes.io/version: 17.5.1
-        helm.sh/chart: openproject-13.8.1
-        openproject/process: web
-        app.kubernetes.io/component: web
-    spec:      
-      nodeSelector:
-        workload: app      
-      securityContext:
-        fsGroup: 1000
-      serviceAccountName: openproject
-      volumes:        
-        - name: tmp
-          # we can't use emptyDir due to the sticky bit issue
-          # see: https://github.com/kubernetes/kubernetes/issues/110835
-          ephemeral:
-            volumeClaimTemplate:
-              metadata:
-                creationTimestamp: null
-              spec:
-                accessModes: ["ReadWriteOnce"]
-                storageClassName: longhorn
-                resources:
-                  requests:
-                    storage: 5Gi
-        - name: app-tmp
-          # we can't use emptyDir due to the sticky bit / world writable issue
-          # see: https://github.com/kubernetes/kubernetes/issues/110835
-          ephemeral:
-            volumeClaimTemplate:
-              metadata:
-                creationTimestamp: null
-              spec:
-                accessModes: ["ReadWriteOnce"]
-                storageClassName: longhorn
-                resources:
-                  requests:
-                    storage: 5Gi
-        - name: "data"
-          persistentVolumeClaim:
-            claimName: openproject        
-      initContainers:        
-        - name: prepare-tmpdir  
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          command:
-            - sh
-            - -c
-            - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
-          resources:
-            limits:
-              memory: 1024Mi
-            requests:
-              memory: 512Mi
-          volumeMounts:    
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-        - name: wait-for-db          
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          envFrom:
-            - secretRef:
-                name: openproject-core
-            - secretRef:
-                name: openproject-memcached
-            - secretRef:
-                name: openproject-postgres-secret
-          env:
-            
-            - name: TMPDIR
-              value: /tmp/ruby
-            - name: OPENPROJECT_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: openproject-postgres-secret
-                  key: password
-            - name: SECRET_KEY_BASE
-              valueFrom:
-                secretKeyRef:
-                  name: secret-key-base-auto-generated
-                  key: secret-key-base
-          args:
-            - /app/docker/prod/wait-for-db
-          resources:
-            limits:
-              memory: 1024Mi
-            requests:
-              memory: 512Mi
-          volumeMounts:            
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-      containers:
-        - name: "openproject"          
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          envFrom:
-            - secretRef:
-                name: openproject-core
-            - secretRef:
-                name: openproject-memcached
-            - secretRef:
-                name: openproject-postgres-secret
-          env:
-            
-            - name: TMPDIR
-              value: /tmp/ruby
-            - name: OPENPROJECT_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: openproject-postgres-secret
-                  key: password
-            - name: SECRET_KEY_BASE
-              valueFrom:
-                secretKeyRef:
-                  name: secret-key-base-auto-generated
-                  key: secret-key-base
-          args:
-            - /app/docker/prod/web
-          volumeMounts:            
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-            - name: "data"
-              mountPath: "/var/openproject/assets"            
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: "/services/studio/openproject/health_checks/default"
-              port: 8080
-              httpHeaders:
-                # required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
-                - name: Host
-                  value: localhost
-            initialDelaySeconds: 0
-            timeoutSeconds: 5
-            periodSeconds: 15
-            failureThreshold: 3
-            successThreshold: 1
-          readinessProbe:
-            httpGet:
-              path: "/services/studio/openproject/health_checks/default"
-              port: 8080
-              httpHeaders:
-                # required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
-                - name: Host
-                  value: localhost
-            initialDelaySeconds: 0
-            timeoutSeconds: 5
-            periodSeconds: 10
-            failureThreshold: 3
-            successThreshold: 1
-          startupProbe:
-            httpGet:
-              path: "/services/studio/openproject/health_checks/default"
-              port: 8080
-              httpHeaders:
-                # required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
-                - name: Host
-                  value: localhost
-            initialDelaySeconds: 60
-            timeoutSeconds: 5
-            periodSeconds: 15
-            failureThreshold: 10
-            successThreshold: 1
-          resources:
-            limits:
-              cpu: "4"
-              memory: 4Gi
-            requests:
-              cpu: 250m
-              memory: 512Mi
----
-# Source: openproject/templates/worker-deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: openproject-worker-default
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    openproject/process: worker-default
-    app.kubernetes.io/component: worker-default
-spec:
-  replicas: 1
-  strategy:
-    
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: openproject
-      app.kubernetes.io/instance: openproject
-      openproject/process: worker-default
-  template:
-    metadata:
-      annotations:
-        
-        # annotate pods with env value checksums so changes trigger re-deployments
-        
-        checksum/env-core: 2d0e679fb4fde1d473b3f274fa94ae520dd26c1045409de808b7562f7b64a454
-        checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
-        checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-        checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-        checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
-      labels:
-        app.kubernetes.io/instance: openproject
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: openproject
-        app.kubernetes.io/version: 17.5.1
-        helm.sh/chart: openproject-13.8.1
-        openproject/process: worker-default
-        app.kubernetes.io/component: worker-default
-    spec:      
-      nodeSelector:
-        workload: app      
-      securityContext:
-        fsGroup: 1000
-      serviceAccountName: openproject
-      volumes:        
-        - name: tmp
-          # we can't use emptyDir due to the sticky bit issue
-          # see: https://github.com/kubernetes/kubernetes/issues/110835
-          ephemeral:
-            volumeClaimTemplate:
-              metadata:
-                creationTimestamp: null
-              spec:
-                accessModes: ["ReadWriteOnce"]
-                storageClassName: longhorn
-                resources:
-                  requests:
-                    storage: 5Gi
-        - name: app-tmp
-          # we can't use emptyDir due to the sticky bit / world writable issue
-          # see: https://github.com/kubernetes/kubernetes/issues/110835
-          ephemeral:
-            volumeClaimTemplate:
-              metadata:
-                creationTimestamp: null
-              spec:
-                accessModes: ["ReadWriteOnce"]
-                storageClassName: longhorn
-                resources:
-                  requests:
-                    storage: 5Gi
-        - name: "data"
-          persistentVolumeClaim:
-            claimName: openproject        
-      initContainers:        
-        - name: prepare-tmpdir  
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          command:
-            - sh
-            - -c
-            - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
-          resources:
-            limits:
-              memory: 1024Mi
-            requests:
-              memory: 512Mi
-          volumeMounts:    
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-        - name: wait-for-db          
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          envFrom:
-            - secretRef:
-                name: openproject-core
-            - secretRef:
-                name: openproject-memcached
-            - secretRef:
-                name: openproject-postgres-secret
-          env:
-            
-            - name: TMPDIR
-              value: /tmp/ruby
-            - name: OPENPROJECT_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: openproject-postgres-secret
-                  key: password
-            - name: SECRET_KEY_BASE
-              valueFrom:
-                secretKeyRef:
-                  name: secret-key-base-auto-generated
-                  key: secret-key-base
-          args:
-            - bash
-            - /app/docker/prod/wait-for-db
-          resources:
-            limits:
-              memory: 1024Mi
-            requests:
-              memory: 512Mi
-          volumeMounts:            
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-      containers:
-        - name: "openproject"          
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          envFrom:
-            - secretRef:
-                name: openproject-core
-            - secretRef:
-                name: openproject-memcached
-            - secretRef:
-                name: openproject-postgres-secret
-          args:
-            - bash
-            - /app/docker/prod/worker
-          env:
-            
-            - name: TMPDIR
-              value: /tmp/ruby
-            - name: OPENPROJECT_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: openproject-postgres-secret
-                  key: password
-            - name: SECRET_KEY_BASE
-              valueFrom:
-                secretKeyRef:
-                  name: secret-key-base-auto-generated
-                  key: secret-key-base
-            - name: "OPENPROJECT_GOOD_JOB_QUEUES"
-              value: ""
-          volumeMounts:            
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-            - name: "data"
-              mountPath: "/var/openproject/assets"            
-          resources:
-            limits:
-              cpu: "4"
-              memory: 4Gi
-            requests:
-              cpu: 250m
-              memory: 512Mi
----
-# Source: openproject/templates/seeder-job.yaml
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: openproject-seeder-1
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    app.kubernetes.io/component: seeder
-spec:
-  ttlSecondsAfterFinished: 86400
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: openproject
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: openproject
-        app.kubernetes.io/version: 17.5.1
-        helm.sh/chart: openproject-13.8.1
-        openproject/process: seeder
-        app.kubernetes.io/component: seeder
-    spec:
-      serviceAccountName: openproject            
-      securityContext:
-        fsGroup: 1000
-      nodeSelector:
-        workload: app
-      volumes:        
-        - name: tmp
-          # we can't use emptyDir due to the sticky bit issue
-          # see: https://github.com/kubernetes/kubernetes/issues/110835
-          ephemeral:
-            volumeClaimTemplate:
-              metadata:
-                creationTimestamp: null
-              spec:
-                accessModes: ["ReadWriteOnce"]
-                storageClassName: longhorn
-                resources:
-                  requests:
-                    storage: 5Gi
-        - name: app-tmp
-          # we can't use emptyDir due to the sticky bit / world writable issue
-          # see: https://github.com/kubernetes/kubernetes/issues/110835
-          ephemeral:
-            volumeClaimTemplate:
-              metadata:
-                creationTimestamp: null
-              spec:
-                accessModes: ["ReadWriteOnce"]
-                storageClassName: longhorn
-                resources:
-                  requests:
-                    storage: 5Gi
-        - name: "data"
-          persistentVolumeClaim:
-            claimName: openproject        
-      initContainers:        
-        - name: prepare-tmpdir  
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-          image: docker.io/openproject/openproject:17.5.1-slim
-          imagePullPolicy: Always
-          command:
-            - sh
-            - -c
-            - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
-          resources:
-            limits:
-              memory: 1024Mi
-            requests:
-              memory: 512Mi
-          volumeMounts:    
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-        - name: check-db-ready
-          image: "docker.io/postgres:16"
-          imagePullPolicy: Always
-          command: [
-            'sh',
-            '-c',
-            'until pg_isready -h $DATABASE_HOST -p $DATABASE_PORT -U openproject; do echo "waiting for database $DATABASE_HOST:$DATABASE_PORT"; sleep 2; done;'
-          ]
-          envFrom:
-            - secretRef:
-                name: openproject-core
-            - secretRef:
-                name: openproject-memcached
-            - secretRef:
-                name: openproject-postgres-secret
-          env:
-            
-            - name: TMPDIR
-              value: /tmp/ruby
-            - name: OPENPROJECT_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: openproject-postgres-secret
-                  key: password
-            - name: SECRET_KEY_BASE
-              valueFrom:
-                secretKeyRef:
-                  name: secret-key-base-auto-generated
-                  key: secret-key-base
-          resources:
-            limits:
-              memory: 200Mi
-            requests:
-              memory: 200Mi
-          volumeMounts:            
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp          
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-      containers:
-        - name: seeder
-          image: "docker.io/openproject/openproject:17.5.1-slim"
-          imagePullPolicy: Always
-          args:
-            - bash
-            - /app/docker/prod/seeder
-          envFrom:
-            - secretRef:
-                name: openproject-core
-            - secretRef:
-                name: openproject-memcached
-            - secretRef:
-                name: openproject-postgres-secret
-          env:
-            
-            - name: TMPDIR
-              value: /tmp/ruby
-            - name: OPENPROJECT_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: openproject-postgres-secret
-                  key: password
-            - name: SECRET_KEY_BASE
-              valueFrom:
-                secretKeyRef:
-                  name: secret-key-base-auto-generated
-                  key: secret-key-base
-          resources:
-            limits:
-              memory: 1Gi
-            requests:
-              memory: 512Mi
-          volumeMounts:            
-            - mountPath: /tmp
-              name: tmp
-            - mountPath: /app/tmp
-              name: app-tmp
-            - name: "data"
-              mountPath: "/var/openproject/assets"                      
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-              - ALL
-            readOnlyRootFilesystem: true
-            runAsGroup: 1000
-            runAsNonRoot: true
-            runAsUser: 1000
-            seccompProfile:
-              type: RuntimeDefault
-      restartPolicy: OnFailure
----
-# Source: openproject/templates/secret_hocuspocus.yaml
-# Only generate this secret if
-#   a) the included hocuspocus deployment is enabled
-#   b) no existing secret is configured for the openproject realtime collaboration
-#   c) no existing secret is configured for the included hocuspocus deployment
-# and if
-#   d) this automatically generated secret does not exist yet.
----
-# Source: openproject/templates/secret_secret_key_base.yaml
-# Only generate this secret if
-#   a) no existing secret is configured for SECRET_KEY_BASE
-# and if
-#   b) SECRET_KEY_BASE is not provided via the environment values
-# and if
-#   c) this automatically generated secret does not exist yet.
----
-# Source: openproject/templates/tests/test-connection.yaml
-apiVersion: "v1"
-kind: "Pod"
-metadata:
-  name: "openproject-test-connection"
-  namespace: "openproject"
-  labels:
-    app.kubernetes.io/instance: openproject
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: openproject
-    app.kubernetes.io/version: 17.5.1
-    helm.sh/chart: openproject-13.8.1
-    app.kubernetes.io/component: test-connection
-  annotations:
-    "helm.sh/hook": test
-spec:
-  serviceAccountName: openproject
-  containers:
-    - name: "wget"
-      image: "busybox"
-      imagePullPolicy: Always
-      command: ['wget']
-      args:
-        - '--no-verbose'
-        - '--tries=1'
-        - '--spider'
-        - 'openproject:8080/health_check'
-  restartPolicy: "Never"
-...