1219 lines
38 KiB
YAML
1219 lines
38 KiB
YAML
---
|
|
# Source: openproject/charts/memcached/templates/networkpolicy.yaml
|
|
kind: NetworkPolicy
|
|
apiVersion: networking.k8s.io/v1
|
|
metadata:
|
|
name: openproject-memcached
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: memcached
|
|
app.kubernetes.io/version: 1.6.24
|
|
helm.sh/chart: memcached-6.14.0
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: memcached
|
|
app.kubernetes.io/version: 1.6.24
|
|
helm.sh/chart: memcached-6.14.0
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|
|
egress:
|
|
- {}
|
|
ingress:
|
|
- ports:
|
|
- port: 11211
|
|
---
|
|
# Source: openproject/charts/memcached/templates/serviceaccount.yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
automountServiceAccountToken: false
|
|
metadata:
|
|
name: openproject-memcached
|
|
namespace: openproject
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: memcached
|
|
app.kubernetes.io/version: 1.6.24
|
|
helm.sh/chart: memcached-6.14.0
|
|
---
|
|
# Source: openproject/templates/serviceaccount.yaml
|
|
apiVersion: "v1"
|
|
kind: "ServiceAccount"
|
|
metadata:
|
|
name: openproject
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
app.kubernetes.io/component: openproject
|
|
...
|
|
---
|
|
# Source: openproject/templates/secret_core.yaml
|
|
apiVersion: "v1"
|
|
kind: "Secret"
|
|
metadata:
|
|
name: "openproject-core"
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
app.kubernetes.io/component: openproject
|
|
data: # reset data to make sure only keys defined below remain
|
|
stringData:
|
|
DATABASE_HOST: "postgres.database.svc.cluster.local"
|
|
DATABASE_PORT: "5432"
|
|
DATABASE_URL: "postgresql://openproject@postgres.database.svc.cluster.local:5432/openproject"
|
|
OPENPROJECT_SEED_ADMIN_USER_PASSWORD: "TempPass123"
|
|
OPENPROJECT_SEED_ADMIN_USER_PASSWORD_RESET: "true"
|
|
OPENPROJECT_SEED_ADMIN_USER_NAME: "IT Admin"
|
|
OPENPROJECT_SEED_ADMIN_USER_MAIL: "it.admin@symcrest.com"
|
|
OPENPROJECT_HTTPS: "true"
|
|
OPENPROJECT_HOST__NAME: "www.symcrest.com"
|
|
OPENPROJECT_HSTS: "true"
|
|
OPENPROJECT_RAILS__CACHE__STORE: "memcache"
|
|
OPENPROJECT_RAILS__RELATIVE__URL__ROOT: "/internal/dev/openproject"
|
|
POSTGRES_STATEMENT_TIMEOUT: "120s"
|
|
...
|
|
---
|
|
# Source: openproject/templates/secret_memcached.yaml
|
|
apiVersion: "v1"
|
|
kind: "Secret"
|
|
metadata:
|
|
name: "openproject-memcached"
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
app.kubernetes.io/component: memcached
|
|
data: # reset data to make sure only keys defined below remain
|
|
stringData:
|
|
OPENPROJECT_CACHE__MEMCACHE__SERVER: "openproject-memcached:11211"
|
|
...
|
|
---
|
|
# Source: openproject/templates/secret_secret_key_base.yaml
|
|
apiVersion: "v1"
|
|
kind: "Secret"
|
|
metadata:
|
|
name: secret-key-base-auto-generated
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
app.kubernetes.io/component: openproject
|
|
annotations:
|
|
# This annotation together with the lookup of the existing secret above ensures that this secret is not
|
|
# regenerated during each upgrade, but kept the same.
|
|
"helm.sh/resource-policy": "keep"
|
|
data: # reset data to make sure only keys defined below remain
|
|
stringData:
|
|
secret-key-base: dNM2C8uej7qGsjJHjKMRAxncbVREhzBOysrk7iVCVr6MHEibFCgDwbRSqB8Qe9WK
|
|
...
|
|
---
|
|
# Source: openproject/templates/persistentvolumeclaim.yaml
|
|
apiVersion: "v1"
|
|
kind: "PersistentVolumeClaim"
|
|
metadata:
|
|
name: openproject
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
app.kubernetes.io/component: openproject
|
|
spec:
|
|
accessModes: [ReadWriteOnce]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: "1Gi"
|
|
...
|
|
---
|
|
# Source: openproject/charts/memcached/templates/service.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: openproject-memcached
|
|
namespace: openproject
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: memcached
|
|
app.kubernetes.io/version: 1.6.24
|
|
helm.sh/chart: memcached-6.14.0
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: memcache
|
|
port: 11211
|
|
targetPort: memcache
|
|
nodePort: null
|
|
selector:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/name: memcached
|
|
---
|
|
# Source: openproject/templates/service.yaml
|
|
apiVersion: "v1"
|
|
kind: "Service"
|
|
metadata:
|
|
name: openproject
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
app.kubernetes.io/component: openproject
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- port: 8080
|
|
targetPort: http
|
|
protocol: TCP
|
|
name: http
|
|
selector:
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/instance: openproject
|
|
openproject/process: web
|
|
...
|
|
---
|
|
# Source: openproject/charts/memcached/templates/deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: openproject-memcached
|
|
namespace: openproject
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: memcached
|
|
app.kubernetes.io/version: 1.6.24
|
|
helm.sh/chart: memcached-6.14.0
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/name: memcached
|
|
replicas: 1
|
|
strategy:
|
|
rollingUpdate: {}
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: memcached
|
|
app.kubernetes.io/version: 1.6.24
|
|
helm.sh/chart: memcached-6.14.0
|
|
annotations:
|
|
spec:
|
|
|
|
automountServiceAccountToken: false
|
|
affinity:
|
|
podAffinity:
|
|
|
|
podAntiAffinity:
|
|
preferredDuringSchedulingIgnoredDuringExecution:
|
|
- podAffinityTerm:
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/name: memcached
|
|
topologyKey: kubernetes.io/hostname
|
|
weight: 1
|
|
nodeAffinity:
|
|
|
|
securityContext:
|
|
fsGroup: 1001
|
|
fsGroupChangePolicy: Always
|
|
supplementalGroups: []
|
|
sysctls: []
|
|
serviceAccountName: openproject-memcached
|
|
containers:
|
|
- name: memcached
|
|
image: docker.io/bitnamilegacy/memcached:1.6.24-debian-12-r0
|
|
imagePullPolicy: "IfNotPresent"
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
privileged: false
|
|
readOnlyRootFilesystem: false
|
|
runAsGroup: 1001
|
|
runAsNonRoot: true
|
|
runAsUser: 1001
|
|
seLinuxOptions: null
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
env:
|
|
- name: BITNAMI_DEBUG
|
|
value: "false"
|
|
- name: MEMCACHED_PORT_NUMBER
|
|
value: "11211"
|
|
ports:
|
|
- name: memcache
|
|
containerPort: 11211
|
|
livenessProbe:
|
|
failureThreshold: 6
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
tcpSocket:
|
|
port: memcache
|
|
readinessProbe:
|
|
failureThreshold: 6
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
successThreshold: 1
|
|
timeoutSeconds: 3
|
|
tcpSocket:
|
|
port: memcache
|
|
volumeMounts:
|
|
- name: empty-dir
|
|
mountPath: /opt/bitnami/memcached/conf
|
|
subPath: app-conf-dir
|
|
- name: empty-dir
|
|
mountPath: /tmp
|
|
subPath: tmp-dir
|
|
volumes:
|
|
- name: empty-dir
|
|
emptyDir: {}
|
|
---
|
|
# Source: openproject/templates/cron-deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: openproject-cron
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
openproject/process: cron
|
|
app.kubernetes.io/component: cron
|
|
spec:
|
|
replicas: 0
|
|
strategy:
|
|
type: "Recreate"
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/instance: openproject
|
|
openproject/process: cron
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
|
|
# annotate pods with env value checksums so changes trigger re-deployments
|
|
|
|
checksum/env-core: d595adde5a7e1007834c68766ac51f7652c1246a63b976431b0ee5a6c9870a78
|
|
checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
|
|
checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
checksum/env-cron-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
openproject/process: cron
|
|
app.kubernetes.io/component: cron
|
|
spec:
|
|
nodeSelector:
|
|
workload: app
|
|
securityContext:
|
|
fsGroup: 1000
|
|
serviceAccountName: openproject
|
|
volumes:
|
|
- name: tmp
|
|
# we can't use emptyDir due to the sticky bit issue
|
|
# see: https://github.com/kubernetes/kubernetes/issues/110835
|
|
ephemeral:
|
|
volumeClaimTemplate:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
- name: app-tmp
|
|
# we can't use emptyDir due to the sticky bit / world writable issue
|
|
# see: https://github.com/kubernetes/kubernetes/issues/110835
|
|
ephemeral:
|
|
volumeClaimTemplate:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
- name: "data"
|
|
persistentVolumeClaim:
|
|
claimName: openproject
|
|
initContainers:
|
|
- name: prepare-tmpdir
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
command:
|
|
- sh
|
|
- -c
|
|
- mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
|
|
resources:
|
|
limits:
|
|
memory: 1024Mi
|
|
requests:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
- name: wait-for-db
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
envFrom:
|
|
- secretRef:
|
|
name: openproject-core
|
|
- secretRef:
|
|
name: openproject-memcached
|
|
- secretRef:
|
|
name: openproject-postgres-secret
|
|
- secretRef:
|
|
name: openproject-cron-environment
|
|
env:
|
|
|
|
- name: TMPDIR
|
|
value: /tmp/ruby
|
|
- name: OPENPROJECT_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openproject-postgres-secret
|
|
key: password
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: secret-key-base-auto-generated
|
|
key: secret-key-base
|
|
args:
|
|
- bash
|
|
- /app/docker/prod/wait-for-db
|
|
resources:
|
|
limits:
|
|
memory: 1024Mi
|
|
requests:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
containers:
|
|
- name: "cron"
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
envFrom:
|
|
- secretRef:
|
|
name: openproject-core
|
|
- secretRef:
|
|
name: openproject-memcached
|
|
- secretRef:
|
|
name: openproject-postgres-secret
|
|
- secretRef:
|
|
name: openproject-cron-environment
|
|
args:
|
|
- bash
|
|
- /app/docker/prod/cron
|
|
env:
|
|
|
|
- name: TMPDIR
|
|
value: /tmp/ruby
|
|
- name: OPENPROJECT_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openproject-postgres-secret
|
|
key: password
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: secret-key-base-auto-generated
|
|
key: secret-key-base
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
- name: "data"
|
|
mountPath: "/var/openproject/assets"
|
|
resources:
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
---
|
|
# Source: openproject/templates/web-deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: openproject-web
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
openproject/process: web
|
|
app.kubernetes.io/component: web
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/instance: openproject
|
|
openproject/process: web
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
|
|
# annotate pods with env value checksums so changes trigger re-deployments
|
|
|
|
checksum/env-core: d595adde5a7e1007834c68766ac51f7652c1246a63b976431b0ee5a6c9870a78
|
|
checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
|
|
checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
openproject/process: web
|
|
app.kubernetes.io/component: web
|
|
spec:
|
|
nodeSelector:
|
|
workload: app
|
|
securityContext:
|
|
fsGroup: 1000
|
|
serviceAccountName: openproject
|
|
volumes:
|
|
- name: tmp
|
|
# we can't use emptyDir due to the sticky bit issue
|
|
# see: https://github.com/kubernetes/kubernetes/issues/110835
|
|
ephemeral:
|
|
volumeClaimTemplate:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
- name: app-tmp
|
|
# we can't use emptyDir due to the sticky bit / world writable issue
|
|
# see: https://github.com/kubernetes/kubernetes/issues/110835
|
|
ephemeral:
|
|
volumeClaimTemplate:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
- name: "data"
|
|
persistentVolumeClaim:
|
|
claimName: openproject
|
|
initContainers:
|
|
- name: prepare-tmpdir
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
command:
|
|
- sh
|
|
- -c
|
|
- mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
|
|
resources:
|
|
limits:
|
|
memory: 1024Mi
|
|
requests:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
- name: wait-for-db
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
envFrom:
|
|
- secretRef:
|
|
name: openproject-core
|
|
- secretRef:
|
|
name: openproject-memcached
|
|
- secretRef:
|
|
name: openproject-postgres-secret
|
|
env:
|
|
|
|
- name: TMPDIR
|
|
value: /tmp/ruby
|
|
- name: OPENPROJECT_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openproject-postgres-secret
|
|
key: password
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: secret-key-base-auto-generated
|
|
key: secret-key-base
|
|
args:
|
|
- /app/docker/prod/wait-for-db
|
|
resources:
|
|
limits:
|
|
memory: 1024Mi
|
|
requests:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
containers:
|
|
- name: "openproject"
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
envFrom:
|
|
- secretRef:
|
|
name: openproject-core
|
|
- secretRef:
|
|
name: openproject-memcached
|
|
- secretRef:
|
|
name: openproject-postgres-secret
|
|
env:
|
|
|
|
- name: TMPDIR
|
|
value: /tmp/ruby
|
|
- name: OPENPROJECT_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openproject-postgres-secret
|
|
key: password
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: secret-key-base-auto-generated
|
|
key: secret-key-base
|
|
args:
|
|
- /app/docker/prod/web
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
- name: "data"
|
|
mountPath: "/var/openproject/assets"
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
protocol: TCP
|
|
livenessProbe:
|
|
httpGet:
|
|
path: "/internal/dev/openproject/health_checks/default"
|
|
port: 8080
|
|
httpHeaders:
|
|
# required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
|
|
- name: Host
|
|
value: localhost
|
|
initialDelaySeconds: 0
|
|
timeoutSeconds: 5
|
|
periodSeconds: 15
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
readinessProbe:
|
|
httpGet:
|
|
path: "/internal/dev/openproject/health_checks/default"
|
|
port: 8080
|
|
httpHeaders:
|
|
# required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
|
|
- name: Host
|
|
value: localhost
|
|
initialDelaySeconds: 0
|
|
timeoutSeconds: 5
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
successThreshold: 1
|
|
startupProbe:
|
|
httpGet:
|
|
path: "/internal/dev/openproject/health_checks/default"
|
|
port: 8080
|
|
httpHeaders:
|
|
# required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants
|
|
- name: Host
|
|
value: localhost
|
|
initialDelaySeconds: 60
|
|
timeoutSeconds: 5
|
|
periodSeconds: 15
|
|
failureThreshold: 10
|
|
successThreshold: 1
|
|
resources:
|
|
limits:
|
|
cpu: "4"
|
|
memory: 4Gi
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
---
|
|
# Source: openproject/templates/worker-deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: openproject-worker-default
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
openproject/process: worker-default
|
|
app.kubernetes.io/component: worker-default
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/instance: openproject
|
|
openproject/process: worker-default
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
|
|
# annotate pods with env value checksums so changes trigger re-deployments
|
|
|
|
checksum/env-core: d595adde5a7e1007834c68766ac51f7652c1246a63b976431b0ee5a6c9870a78
|
|
checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d
|
|
checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
openproject/process: worker-default
|
|
app.kubernetes.io/component: worker-default
|
|
spec:
|
|
nodeSelector:
|
|
workload: app
|
|
securityContext:
|
|
fsGroup: 1000
|
|
serviceAccountName: openproject
|
|
volumes:
|
|
- name: tmp
|
|
# we can't use emptyDir due to the sticky bit issue
|
|
# see: https://github.com/kubernetes/kubernetes/issues/110835
|
|
ephemeral:
|
|
volumeClaimTemplate:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
- name: app-tmp
|
|
# we can't use emptyDir due to the sticky bit / world writable issue
|
|
# see: https://github.com/kubernetes/kubernetes/issues/110835
|
|
ephemeral:
|
|
volumeClaimTemplate:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
- name: "data"
|
|
persistentVolumeClaim:
|
|
claimName: openproject
|
|
initContainers:
|
|
- name: prepare-tmpdir
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
command:
|
|
- sh
|
|
- -c
|
|
- mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
|
|
resources:
|
|
limits:
|
|
memory: 1024Mi
|
|
requests:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
- name: wait-for-db
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
envFrom:
|
|
- secretRef:
|
|
name: openproject-core
|
|
- secretRef:
|
|
name: openproject-memcached
|
|
- secretRef:
|
|
name: openproject-postgres-secret
|
|
env:
|
|
|
|
- name: TMPDIR
|
|
value: /tmp/ruby
|
|
- name: OPENPROJECT_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openproject-postgres-secret
|
|
key: password
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: secret-key-base-auto-generated
|
|
key: secret-key-base
|
|
args:
|
|
- bash
|
|
- /app/docker/prod/wait-for-db
|
|
resources:
|
|
limits:
|
|
memory: 1024Mi
|
|
requests:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
containers:
|
|
- name: "openproject"
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
envFrom:
|
|
- secretRef:
|
|
name: openproject-core
|
|
- secretRef:
|
|
name: openproject-memcached
|
|
- secretRef:
|
|
name: openproject-postgres-secret
|
|
args:
|
|
- bash
|
|
- /app/docker/prod/worker
|
|
env:
|
|
|
|
- name: TMPDIR
|
|
value: /tmp/ruby
|
|
- name: OPENPROJECT_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openproject-postgres-secret
|
|
key: password
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: secret-key-base-auto-generated
|
|
key: secret-key-base
|
|
- name: "OPENPROJECT_GOOD_JOB_QUEUES"
|
|
value: ""
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
- name: "data"
|
|
mountPath: "/var/openproject/assets"
|
|
resources:
|
|
limits:
|
|
cpu: "4"
|
|
memory: 4Gi
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
---
|
|
# Source: openproject/templates/seeder-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: openproject-seeder-1
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
app.kubernetes.io/component: seeder
|
|
spec:
|
|
ttlSecondsAfterFinished: 86400
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
openproject/process: seeder
|
|
app.kubernetes.io/component: seeder
|
|
spec:
|
|
serviceAccountName: openproject
|
|
securityContext:
|
|
fsGroup: 1000
|
|
nodeSelector:
|
|
workload: app
|
|
volumes:
|
|
- name: tmp
|
|
# we can't use emptyDir due to the sticky bit issue
|
|
# see: https://github.com/kubernetes/kubernetes/issues/110835
|
|
ephemeral:
|
|
volumeClaimTemplate:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
- name: app-tmp
|
|
# we can't use emptyDir due to the sticky bit / world writable issue
|
|
# see: https://github.com/kubernetes/kubernetes/issues/110835
|
|
ephemeral:
|
|
volumeClaimTemplate:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
accessModes: ["ReadWriteOnce"]
|
|
storageClassName: longhorn
|
|
resources:
|
|
requests:
|
|
storage: 5Gi
|
|
- name: "data"
|
|
persistentVolumeClaim:
|
|
claimName: openproject
|
|
initContainers:
|
|
- name: prepare-tmpdir
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: docker.io/openproject/openproject:17.5.1-slim
|
|
imagePullPolicy: Always
|
|
command:
|
|
- sh
|
|
- -c
|
|
- mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby
|
|
resources:
|
|
limits:
|
|
memory: 1024Mi
|
|
requests:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
- name: check-db-ready
|
|
image: "docker.io/postgres:16"
|
|
imagePullPolicy: Always
|
|
command: [
|
|
'sh',
|
|
'-c',
|
|
'until pg_isready -h $DATABASE_HOST -p $DATABASE_PORT -U openproject; do echo "waiting for database $DATABASE_HOST:$DATABASE_PORT"; sleep 2; done;'
|
|
]
|
|
envFrom:
|
|
- secretRef:
|
|
name: openproject-core
|
|
- secretRef:
|
|
name: openproject-memcached
|
|
- secretRef:
|
|
name: openproject-postgres-secret
|
|
env:
|
|
|
|
- name: TMPDIR
|
|
value: /tmp/ruby
|
|
- name: OPENPROJECT_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openproject-postgres-secret
|
|
key: password
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: secret-key-base-auto-generated
|
|
key: secret-key-base
|
|
resources:
|
|
limits:
|
|
memory: 200Mi
|
|
requests:
|
|
memory: 200Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: seeder
|
|
image: "docker.io/openproject/openproject:17.5.1-slim"
|
|
imagePullPolicy: Always
|
|
args:
|
|
- bash
|
|
- /app/docker/prod/seeder
|
|
envFrom:
|
|
- secretRef:
|
|
name: openproject-core
|
|
- secretRef:
|
|
name: openproject-memcached
|
|
- secretRef:
|
|
name: openproject-postgres-secret
|
|
env:
|
|
|
|
- name: TMPDIR
|
|
value: /tmp/ruby
|
|
- name: OPENPROJECT_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: openproject-postgres-secret
|
|
key: password
|
|
- name: SECRET_KEY_BASE
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: secret-key-base-auto-generated
|
|
key: secret-key-base
|
|
resources:
|
|
limits:
|
|
memory: 1Gi
|
|
requests:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/tmp
|
|
name: app-tmp
|
|
- name: "data"
|
|
mountPath: "/var/openproject/assets"
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
restartPolicy: OnFailure
|
|
---
|
|
# Source: openproject/templates/secret_hocuspocus.yaml
|
|
# Only generate this secret if
|
|
# a) the included hocuspocus deployment is enabled
|
|
# b) no existing secret is configured for the openproject realtime collaboration
|
|
# c) no existing secret is configured for the included hocuspocus deployment
|
|
# and if
|
|
# d) this automatically generated secret does not exist yet.
|
|
---
|
|
# Source: openproject/templates/secret_secret_key_base.yaml
|
|
# Only generate this secret if
|
|
# a) no existing secret is configured for SECRET_KEY_BASE
|
|
# and if
|
|
# b) SECRET_KEY_BASE is not provided via the environment values
|
|
# and if
|
|
# c) this automatically generated secret does not exist yet.
|
|
---
|
|
# Source: openproject/templates/tests/test-connection.yaml
|
|
apiVersion: "v1"
|
|
kind: "Pod"
|
|
metadata:
|
|
name: "openproject-test-connection"
|
|
namespace: "openproject"
|
|
labels:
|
|
app.kubernetes.io/instance: openproject
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: openproject
|
|
app.kubernetes.io/version: 17.5.1
|
|
helm.sh/chart: openproject-13.8.1
|
|
app.kubernetes.io/component: test-connection
|
|
annotations:
|
|
"helm.sh/hook": test
|
|
spec:
|
|
serviceAccountName: openproject
|
|
containers:
|
|
- name: "wget"
|
|
image: "busybox"
|
|
imagePullPolicy: Always
|
|
command: ['wget']
|
|
args:
|
|
- '--no-verbose'
|
|
- '--tries=1'
|
|
- '--spider'
|
|
- 'openproject:8080/health_check'
|
|
restartPolicy: "Never"
|
|
...
|