mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
1f04831a97
ingress-nginx is gone and every app is served by the Envoy Gateway. The certificates were created by cert-manager's ingress-shim and are owned by the Ingresses, so each app now declares its Certificate itself, with the same name, secret and usages, so nothing gets reissued. gateway-shim can't take over because the certificates live in the app namespaces. immich drops mbg.hensen.io, which has no route, so that one certificate is reissued through the Gateway's HTTP-01 solver. Also removes the Longhorn test-port redirect URI and updates comments that still described nginx.
44 lines
1.3 KiB
YAML
44 lines
1.3 KiB
YAML
global:
|
|
enabled: true
|
|
tlsDisable: true
|
|
injector:
|
|
enabled: true
|
|
# The chart's default anti-affinity forbids two injector pods on one
|
|
# node, so on this single node a rolling update can never start the new
|
|
# pod while the old one runs. Recreate removes the old pod first, which
|
|
# also gets past pods that still carry the old anti-affinity.
|
|
affinity: ""
|
|
strategy:
|
|
type: Recreate
|
|
rollingUpdate: null
|
|
server:
|
|
# Pinned to the running version: the chart would otherwise pull its own
|
|
# default on the next pod restart, and with Shamir unsealing a Vault
|
|
# upgrade needs someone with the unseal keys at hand.
|
|
image:
|
|
tag: "1.17.2"
|
|
dataStorage:
|
|
storageClass: longhorn
|
|
standalone:
|
|
enabled: false
|
|
affinity: ""
|
|
ha:
|
|
enabled: true
|
|
replicas: 3
|
|
raft:
|
|
enabled: true
|
|
setNodeId: true
|
|
config: |
|
|
cluster_name = "vault-integrated-storage"
|
|
ui = true
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
}
|
|
disable_mlock = true
|
|
service_registration "kubernetes" {}
|