mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
842f087da7
wordpress:7.1.3-php8.3-apache was rebuilt at 15:57 UTC on PHP 8.3.36, which fixes CVE-2026-109618 and CVE-2026-109619. WordPress core lives on the volume, so the tag only moves PHP (8.3.30 -> 8.3.36) and Apache. Its ca-certificates (20250419+deb13u1) no longer carries the roots above the compromised eMudhra intermediates either.
139 lines
3.7 KiB
YAML
139 lines
3.7 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: mbgwp-official-helm
|
|
namespace: argocd
|
|
finalizers:
|
|
- resources-finalizer.argocd.argoproj.io
|
|
spec:
|
|
destination:
|
|
namespace: mbgwp
|
|
server: https://kubernetes.default.svc
|
|
project: default
|
|
source:
|
|
repoURL: https://groundhog2k.github.io/helm-charts/
|
|
targetRevision: 0.15.0
|
|
chart: wordpress
|
|
helm:
|
|
values: |
|
|
# Official WordPress image configuration. WordPress core lives on the
|
|
# volume, so the tag only sets PHP and Apache; 7.1.3-php8.3-apache
|
|
# ships PHP 8.3.36, which fixes CVE-2026-109618 and CVE-2026-109619.
|
|
image:
|
|
registry: docker.io
|
|
repository: wordpress
|
|
tag: "7.1.3-php8.3-apache"
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Disable embedded MariaDB
|
|
mariadb:
|
|
enabled: false
|
|
|
|
# Database configuration via environment variables
|
|
# Using external MariaDB (operator-managed)
|
|
env:
|
|
- name: WORDPRESS_DB_HOST
|
|
value: "mbgwp-mariadb:3306"
|
|
- name: WORDPRESS_DB_USER
|
|
value: "bn_wordpress"
|
|
- name: WORDPRESS_DB_NAME
|
|
value: "bitnami_wordpress"
|
|
- name: WORDPRESS_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: mbgwp-mariadb-credentials
|
|
key: password
|
|
- name: WF_ENCRYPTION_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: wordpress-credentials
|
|
key: wf-encryption-key
|
|
|
|
# WordPress specific settings
|
|
settings:
|
|
tablePrefix: "wp_"
|
|
maxFileUploadSize: "64M"
|
|
memoryLimit: "128M"
|
|
|
|
# Persistence configuration
|
|
storage:
|
|
className: longhorn
|
|
requestedSize: 10Gi
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
keepPvc: true
|
|
|
|
# Service configuration
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
|
|
# Ingress configuration
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
maxBodySize: 1024m
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: prod-cluster-issuer
|
|
nginx.ingress.kubernetes.io/proxy-body-size: 1G
|
|
hosts:
|
|
- host: scoutingmbg.nl
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
- host: www.scoutingmbg.nl
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: scoutingmbg-nl-tls
|
|
hosts:
|
|
- scoutingmbg.nl
|
|
- www.scoutingmbg.nl
|
|
|
|
# Resource limits (matching Bitnami "small" preset)
|
|
resources:
|
|
requests:
|
|
memory: "512Mi"
|
|
cpu: "300m"
|
|
limits:
|
|
memory: "1024Mi"
|
|
cpu: "2000m"
|
|
|
|
# Health probes
|
|
livenessProbe:
|
|
enabled: false
|
|
|
|
readinessProbe:
|
|
enabled: true
|
|
httpGet:
|
|
path: /wp-login.php
|
|
port: 80
|
|
initialDelaySeconds: 120
|
|
periodSeconds: 30
|
|
timeoutSeconds: 10
|
|
failureThreshold: 6
|
|
|
|
startupProbe:
|
|
enabled: true
|
|
httpGet:
|
|
path: /wp-login.php
|
|
port: 80
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 30
|
|
|
|
# Custom PHP configuration
|
|
customPhpConfig: |
|
|
upload_max_filesize = 64M
|
|
post_max_size = 64M
|
|
max_execution_time = 600
|
|
memory_limit = 128M
|
|
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
automated:
|
|
selfHeal: true
|