mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-06 15:31:38 +01:00
Compare commits
9 Commits
trossner/f
...
v0.5.80
| Author | SHA1 | Date | |
|---|---|---|---|
|
391d959630 | ||
|
|
9c32058fcc | ||
|
|
bc18724d70 | ||
|
|
011ad2cd6b | ||
|
|
ee99eefb72 | ||
|
|
a2b333b462 | ||
|
|
7ee9e47e82 | ||
|
|
d677ca5691 | ||
|
|
31e5cf317c |
@@ -34,7 +34,6 @@ stages:
|
||||
- "component-deploy-stage-2"
|
||||
- "tests"
|
||||
- "env-stop"
|
||||
- "generate-release-assets"
|
||||
- ".post"
|
||||
|
||||
variables:
|
||||
@@ -508,34 +507,6 @@ avscan-start:
|
||||
job: "avscan-prepare"
|
||||
strategy: "depend"
|
||||
|
||||
generate-release-assets:
|
||||
stage: "generate-release-assets"
|
||||
image: "registry.souvap-univention.de/souvap/tooling/images/ansible:4.10.0"
|
||||
rules:
|
||||
- if: >
|
||||
$JOB_AVSCAN_ENABLED != 'false' &&
|
||||
$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH &&
|
||||
$CI_PIPELINE_SOURCE =~ "push|merge_request_event"
|
||||
when: "on_success"
|
||||
- when: "never"
|
||||
script:
|
||||
- |
|
||||
git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@${CI_SERVER_HOST}/${ASSET_GENERATOR_REPO_PATH}
|
||||
cd opendesk-asset-generator
|
||||
export OPENDESK_DEPLOYMENT_AUTOMATION_PATH=${CI_PROJECT_DIR}
|
||||
./opendesk_asset_generator.py
|
||||
mv ./build_artefacts ${CI_PROJECT_DIR}
|
||||
cd ..
|
||||
rm -rf opendesk-asset-generator
|
||||
ls -l ./build_artefacts
|
||||
artifacts:
|
||||
paths:
|
||||
- "./build_artefacts/chart-index.json"
|
||||
- "./build_artefacts/image-index.json"
|
||||
tags: []
|
||||
variables:
|
||||
ASSET_GENERATOR_REPO_PATH: "bmi/opendesk/tooling/opendesk-asset-generator"
|
||||
|
||||
# Declare .environments which is in environments repository. In case it is not available
|
||||
# 'cache' is used because job must contain at least one key, so cache is just a dummy key.
|
||||
.environments:
|
||||
@@ -574,8 +545,6 @@ generate-release-version:
|
||||
when: "on_success"
|
||||
|
||||
release:
|
||||
dependencies:
|
||||
- "generate-release-assets"
|
||||
rules:
|
||||
- if: >
|
||||
$JOB_AVSCAN_ENABLED != 'false' &&
|
||||
@@ -609,16 +578,7 @@ release:
|
||||
{
|
||||
"branches": ["main"],
|
||||
"plugins": [
|
||||
["@semantic-release/gitlab",
|
||||
{
|
||||
"assets": [
|
||||
{ "path": "./build_artefacts/chart-index.json",
|
||||
"label": "Chart Index JSON" },
|
||||
{ "path": "./build_artefacts/image-index.json",
|
||||
"label": "Image Index JSON" },
|
||||
]
|
||||
}
|
||||
],
|
||||
"@semantic-release/gitlab",
|
||||
"@semantic-release/release-notes-generator",
|
||||
"@semantic-release/changelog",
|
||||
["@semantic-release/git", {
|
||||
@@ -637,6 +597,5 @@ release:
|
||||
EOF
|
||||
- "semantic-release"
|
||||
needs:
|
||||
- "generate-release-assets"
|
||||
- "generate-docs"
|
||||
...
|
||||
|
||||
28
CHANGELOG.md
28
CHANGELOG.md
@@ -1,3 +1,31 @@
|
||||
## [0.5.80](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.79...v0.5.80) (2024-03-11)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **ci:** Remove creation of release artefacts, use the `images.yaml` and `charts.yaml` in `./helmfile/environments/default` for information about the artefacts instead. ([ee99eef](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/ee99eefb72d3207866ffd1b3bd21a36bd55ad288))
|
||||
* **collabora:** Bump image to 23.05.9.4.1 ([9c32058](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/9c32058fcc21a14e9e66a46064ea044402638920))
|
||||
* **docs:** Add development.md and refactor `images.yaml` and `charts.yaml` ([a2b333b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/a2b333b46277a4bb86b75ca04edb64e69efff916))
|
||||
* **helmfile:** YAML handling of seLinuxOptions and align overall `toYaml` syntax ([011ad2c](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/011ad2cd6bfe552e04a598452e8814d4d1029152))
|
||||
* **nextcloud:** Update images digests ([bc18724](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/bc18724d70ffff749d5192487944e62233cf4376))
|
||||
* **openproject:** Bump to 13.3.1 ([7ee9e47](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ee9e47e8269334294c80093a359b247d86f5d62))
|
||||
|
||||
## [0.5.79](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.78...v0.5.79) (2024-02-29)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* **collabora:** Bump image to 23.05.9.2.1 ([f4b8226](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/f4b8226ea13971a38d61145ea9ac3821bc35f6b3))
|
||||
* **collabora:** Fix aliasgroups configuration whitelisting the Nextcloud host ([8b065fd](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8b065fd9d789cdd597a584937fefaae40f42bba2))
|
||||
* **docs:** Update version numbers of functional components for release in README.md ([31e5cf3](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/31e5cf317ca7cd84a94cf42d57d0964152904471))
|
||||
* **element:** Provide end-to-end encryption as user controlled option ([3d31127](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/3d31127a6ab0fa1d3af02695b521db5918932279))
|
||||
* **helmfile:** Enhance objectore environment variables to allow external Object Store ([d444226](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/d4442261aa141e21222dc13407023b96570d055f))
|
||||
* **helmfile:** Set debuglevel to WARN instead of INFO when debug is not enabled. ([2efceef](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2efceef076beb06a3719859d7f4e2f0d03b99f44))
|
||||
* **nextcloud:** Bump images to enable password_policy and fix email with groupware ([8807b24](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/8807b24ce09e59aaea39c349e9e12ee2a44a117a))
|
||||
* **univention-management-stack:** Bump Keycloak Extensions chart and configure the `/univention/meta.json` to be retrieved from `ums-stack-gateway` to avoid the inline 404 during Keycloak login. ([2023d5b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/2023d5bce4642f794831670713b1a2520a0419d6))
|
||||
* **univention-management-stack:** Provisioning version bump ([410a023](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/410a0237149a5e41434c09795959bc53e57fb4ca))
|
||||
* **univention-management-stack:** Template more Keycloak Extension values incl. logLevel ([7ec123b](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/commit/7ec123b9a174c8dade1fe9f6679796979749efab))
|
||||
|
||||
## [0.5.78](https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk/compare/v0.5.77...v0.5.78) (2024-02-23)
|
||||
|
||||
|
||||
|
||||
38
README.md
38
README.md
@@ -1,5 +1,5 @@
|
||||
<!--
|
||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
-->
|
||||
|
||||
@@ -11,6 +11,7 @@ SPDX-License-Identifier: Apache-2.0
|
||||
* [Requirements](#requirements)
|
||||
* [Getting started](#getting-started)
|
||||
* [Advanced customization](#advanced-customization)
|
||||
* [Development](#development)
|
||||
* [Releases](#releases)
|
||||
* [Components](#components)
|
||||
* [Feedback](#feedback)
|
||||
@@ -26,17 +27,17 @@ Aufbau ZenDiS" of Germany's Federal Ministry of the Interior.
|
||||
|
||||
openDesk currently features the following functional main components:
|
||||
|
||||
| Function | Functional Component | Component<br/>Version | Upstream Documentation |
|
||||
| -------------------- | --------------------------- | --------------------- | ----------------- |
|
||||
| Chat & collaboration | Element ft. Nordeck widgets | [1.11.52](https://github.com/element-hq/element-desktop/blob/develop/CHANGELOG.md#changes-in-11152-2023-12-19) | [For the most recent release](https://element.io/user-guide) |
|
||||
| Diagram editor | Cryptpad ft. diagrams.net | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0) | [For the most recent release](https://docs.cryptpad.org/en/) |
|
||||
| File management | Nextcloud | [28.0.2](https://nextcloud.com/de/changelog/#28-0-2) | [Nextcloud 28](https://docs.nextcloud.com/) |
|
||||
| Groupware | OX Appsuite | [8.20](https://documentation.open-xchange.com/appsuite/releases/8.20/) | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
|
||||
| Knowledge management | XWiki | [15.10.4](https://www.xwiki.org/xwiki/bin/view/Blog/XWiki15104Released) | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation) |
|
||||
| Portal & IAM | Nubus | Product Preview[^1] | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html) |
|
||||
| Project management | OpenProject | [13.3.0](https://www.openproject.org/docs/release-notes/13-3-0/) | [For the most recent release](https://www.openproject.org/docs/user-guide/) |
|
||||
| Videoconferencing | Jitsi | [2.0.8922](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_8922) | [For the most recent release](https://jitsi.github.io/handbook/docs/category/user-guide/) |
|
||||
| Weboffice | Collabora | [23.05.9.1.1](https://www.collaboraoffice.com/collabora-online-23-05-release-notes/) | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/) |
|
||||
| Function | Functional Component | Component<br/>Version | Upstream Documentation |
|
||||
| -------------------- | --------------------------- | -------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Chat & collaboration | Element ft. Nordeck widgets | [1.11.59](https://github.com/element-hq/element-desktop/releases/tag/v1.11.59) | [For the most recent release](https://element.io/user-guide) |
|
||||
| Diagram editor | Cryptpad ft. diagrams.net | [5.6.0](https://github.com/cryptpad/cryptpad/releases/tag/5.6.0) | [For the most recent release](https://docs.cryptpad.org/en/) |
|
||||
| File management | Nextcloud | [28.0.2](https://nextcloud.com/de/changelog/#28-0-2) | [Nextcloud 28](https://docs.nextcloud.com/) |
|
||||
| Groupware | OX Appsuite | [8.20](https://documentation.open-xchange.com/appsuite/releases/8.20/) | Online documentation available from within the installed application; [Additional resources](https://www.open-xchange.com/resources/oxpedia) |
|
||||
| Knowledge management | XWiki | [15.10.4](https://www.xwiki.org/xwiki/bin/view/Blog/XWiki15104Released) | [For the most recent release](https://www.xwiki.org/xwiki/bin/view/Documentation) |
|
||||
| Portal & IAM | Nubus | Product Preview[^1] | [Univention's documentation website](https://docs.software-univention.de/n/en/index.html) |
|
||||
| Project management | OpenProject | [13.3.1](https://www.openproject.org/docs/release-notes/13-3-1/) | [For the most recent release](https://www.openproject.org/docs/user-guide/) |
|
||||
| Videoconferencing | Jitsi | [2.0.8922](https://github.com/jitsi/jitsi-meet/releases/tag/stable%2Fjitsi-meet_8922) | [For the most recent release](https://jitsi.github.io/handbook/docs/category/user-guide/) |
|
||||
| Weboffice | Collabora | [23.05.9.4.1](https://www.collaboraoffice.com/collabora-online-23-05-release-notes/) | Online documentation available from within the installed application; [Additional resources](https://sdk.collaboraonline.com/) |
|
||||
|
||||
While not all components are perfectly shaped for the execution inside containers, one of the project's objectives is to
|
||||
align the applications with best practises regarding container design and operations.
|
||||
@@ -76,6 +77,10 @@ Of course, further development also includes enhancing the documentation itself.
|
||||
- [Monitoring](./docs/monitoring.md)
|
||||
- [Theming](./docs/theming.md)
|
||||
|
||||
# Development
|
||||
|
||||
⟶ To understand the repository contents from a developer perspective please read the [Development](./docs/development.md) guide.
|
||||
|
||||
# Releases
|
||||
|
||||
All technical releases are created using [Semantic Versioning](https://semver.org/lang/de/).
|
||||
@@ -84,9 +89,10 @@ Gitlab provides an
|
||||
[overview on the releases](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/releases)
|
||||
of this project.
|
||||
|
||||
The following release artefacts are provided beside the default source code assets:
|
||||
- `chart-index.json`: An overview of all Helm charts used by the release.
|
||||
- `image-index.json`: An overview of all container images used by the release.
|
||||
Please find a list of the artefacts related to the release either in the source code archive attached to the release or
|
||||
in the files from the release's git-tag:
|
||||
- `./helmfile/environments/default/images.yaml`
|
||||
- `./helmfile/environments/default/charts.yaml`
|
||||
|
||||
⟶ Visit our detailed [Workflow](./docs/workflow.md) docs.
|
||||
|
||||
@@ -102,7 +108,7 @@ Related to the deployment / contents of this repository,
|
||||
please use the [issues within this project](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/-/issues).
|
||||
|
||||
If you want to address other topics, please check the section
|
||||
["Rückmeldungen und Beteiligung" of the Infos' project OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung).
|
||||
["Rückmeldungen und Beteiligung" in the OVERVIEW.md](https://gitlab.opencode.de/bmi/opendesk/info/-/blob/main/OVERVIEW.md#rückmeldungen-und-beteiligung) of the [openDesk Info Repository](https://gitlab.opencode.de/bmi/opendesk/info).
|
||||
|
||||
# License
|
||||
|
||||
|
||||
@@ -73,7 +73,7 @@ flowchart TD
|
||||
|
||||
## Intercom Service (ICS)
|
||||
|
||||
The UCS Intercom Service's role is to enable cross-application integration based on browser interaction.
|
||||
The Univention Intercom Service's role is to enable cross-application integration based on browser interaction.
|
||||
Handling authentication when the frontend of an application is using the API from another application is often a
|
||||
challenge.
|
||||
For more details on the ICS please refer to its own [doc](./components/intercom-service.md).
|
||||
|
||||
141
docs/development.md
Normal file
141
docs/development.md
Normal file
@@ -0,0 +1,141 @@
|
||||
<!--
|
||||
SPDX-FileCopyrightText: 2024 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||
SPDX-License-Identifier: Apache-2.0
|
||||
-->
|
||||
|
||||
<h1>Developing openDesk deployment automation</h1>
|
||||
|
||||
Active development on the deployment is currently only available for project members.
|
||||
But contributions will be possible soon once the CLA process is sorted out.
|
||||
|
||||
* [Overview](#overview)
|
||||
* [Default branch, `develop` and other branches](#default-branch-develop-and-other-branches)
|
||||
* [External artefacts - `charts.yaml` and `images.yaml`](#external-artefacts---chartsyaml-and-imagesyaml)
|
||||
* [Linting](#linting)
|
||||
* [Renovate](#renovate)
|
||||
* [Mirroring](#mirroring)
|
||||
* [Get new artefacts mirrored](#get-new-artefacts-mirrored)
|
||||
* [Creating new charts / images](#creating-new-charts--images)
|
||||
|
||||
# Overview
|
||||
|
||||
The following sketch provides an high level overview to get a basic understanding of the deployment relevant
|
||||
structure of this repository. An understanding of that structure is vital if you want to contribute to
|
||||
the development of the deployment automation of openDesk.
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A[./helmfile.yaml]-->B[./helmfile/apps/*all_configured_apps*/helmfile.yaml\nReferences the relevant app Helm\ncharts using details from 'charts.yaml']
|
||||
B-->C[./values-*all_configured_components*.yaml.gotmpl\nValues to template the charts\nwith references to the `images.yaml`]
|
||||
A-->D[./helmfile/environments/default/*\nwith just some examples below]
|
||||
D-->F[charts.yaml]
|
||||
D-->G[images.yaml]
|
||||
D-->H[global.*]
|
||||
D-->I[secrets.yaml\nreplicas.yaml\nresources.yaml\n...]
|
||||
A-->|overwrite defaults with\nyour environment specific values|E[./helmfile/environments/*your_environment*/values.yaml.gotmpl]
|
||||
```
|
||||
|
||||
The `helmfile.yaml` in the root folder is the basis for the whole deployment. It references the app specific `helmfile.yaml` files as well as some
|
||||
global values files in `./environments/default`. It allows you to overwrite defaults by using one of the three predefined environments `dev`, `test`
|
||||
and `prod`.
|
||||
|
||||
Before you look into any app specifc configuration it is recommended to review the contents of `./environments/default` to get an understanding of what
|
||||
details are maintained in there, as they are usually referenced by the app configurations.
|
||||
|
||||
# Default branch, `develop` and other branches
|
||||
|
||||
The `main` branch is configured to be the default branch, as visitors of the project on Open CoDE should see that
|
||||
branch by default.
|
||||
|
||||
Please use the `develop` branch to diverge your own branch(es) from. See the [workflow guide](./workflow.md)
|
||||
for more details on naming conventions.
|
||||
|
||||
There is a CI bot that automatically creates a merge request once you initially pushed your branch to Open CoDE.
|
||||
The merge request will of course target the `develop` branch, be in status `draft` and have you as assignee.
|
||||
|
||||
In case you do not plan to actually merge from the branch you have pushed, please close or delete the autocreated MR.
|
||||
|
||||
# External artefacts - `charts.yaml` and `images.yaml`
|
||||
|
||||
The `charts.yaml` and `images.yaml` are the central place to reference external artefacts that are used for the deployment.
|
||||
|
||||
Beside the deployment automation itself some tools work with the contents of the files:
|
||||
|
||||
- **Linting**: Ensures consistency of the file contents for the other tools.
|
||||
- **Renovate**: Automatically create MRs that update the components to their latest version.
|
||||
- **Mirror**: Mirror artefacts to Open CoDE.
|
||||
|
||||
Please find details on these tools below.
|
||||
|
||||
## Linting
|
||||
|
||||
In the project's CI there is a step dedicated to lint the two yaml files, as we want them to be in
|
||||
- alphabetical order regarding the components and
|
||||
- in a logical order regarding the non-commented lines (registry > repository > tag).
|
||||
|
||||
In the linting step the [openDesk CI CLI](https://gitlab.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli) is used to apply the
|
||||
just mentioned sorting and the result is compared with the unsorted version. If there is a delta the linting fails and you probably
|
||||
want to fix it by running the CLI tool locally.
|
||||
|
||||
**Note**: Please ensure that in component blocks you use comments only at the beginning of the block or at its end. Ideally you just stick
|
||||
with the many available examples in the yaml files.
|
||||
|
||||
Example:
|
||||
```
|
||||
synapse:
|
||||
# providerCategory: 'Supplier'
|
||||
# providerResponsible: 'Element'
|
||||
# upstreamRegistry: 'registry-1.docker.io'
|
||||
# upstreamRepository: 'matrixdotorg/synapse'
|
||||
# upstreamMirrorTagFilterRegEx: '^v(\d+)\.(\d+)\.(\d+)$'
|
||||
# upstreamMirrorStartFrom: ['1', '91', '2']
|
||||
registry: "registry.opencode.de"
|
||||
repository: "bmi/opendesk/components/supplier/element/images-mirror/synapse"
|
||||
tag: "v1.91.2@sha256:1d19508db417bb2b911c8e086bd3dc3b719ee75c6f6194d58af59b4c32b11322"
|
||||
```
|
||||
|
||||
## Renovate
|
||||
|
||||
- See also: https://gitlab.opencode.de/bmi/opendesk/tooling/renovate-opencode
|
||||
|
||||
Uses a regular expression to match the values of the attributes
|
||||
- `# upstreamRegistry`
|
||||
- `# upstreamRepository`
|
||||
- `tag`
|
||||
check for newer versions of the given artefact and create a MR containing the newest version's tag (and digest).
|
||||
|
||||
## Mirroring
|
||||
|
||||
- See also: https://gitlab.opencode.de/bmi/opendesk/tooling/oci-pull-mirror
|
||||
|
||||
**Note:** The mirror is scheduled to run every hour at 42 minutes past the hour.
|
||||
|
||||
openDesk strives to make all relevant artefacts available on Open CoDE so there is the mirroring process
|
||||
configured to pull artefacts that do not originate from Open CoDE into projects called `*-Mirror` within the
|
||||
[openDesk Components section](https://gitlab.opencode.de/bmi/opendesk/components).
|
||||
|
||||
The mirror script takes the information on what artefacts to mirror from the annotation inside the two yaml files:
|
||||
- `# upstreamRegistry` *required*: To identify the source registry
|
||||
- `# upstreamRepository` *required*: To identify the source repository
|
||||
- `# upstreamMirrorTagFilterRegEx` *required*: If this annotation is set it activates the mirror for the component. Only tags are being mirrored that match the given regular expression.
|
||||
- `# upstreamMirrorStartFrom` *optional*: Array of numeric values in case you want to mirror only artefacts beginning with a specific version. You must use capturing groups
|
||||
in `# upstreamMirrorTagFilterRegEx` to identify the single numeric elements of the version within the tag and use per capturing group (left to right) one numeric array
|
||||
element here to define the version the mirror should start with.
|
||||
|
||||
### Get new artefacts mirrored
|
||||
|
||||
If you want new images or charts to be mirrored that are not yet included in one of the yaml files there are two options:
|
||||
|
||||
You include them in your branch with all required annotations and either
|
||||
1. ask somebody from the platform development team to trigger the mirror's CI based on your branch or
|
||||
2. you get your branch merged to `develop` already.
|
||||
|
||||
# Creating new charts / images
|
||||
|
||||
When you create new Helm charts please check out the
|
||||
[openDesk Best Practises](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-best-practises)
|
||||
for Helm charts.
|
||||
|
||||
You may also want to make use of our [standard CI](https://gitlab.opencode.de/bmi/opendesk/tooling/gitlab-config) to
|
||||
easily get Charts and Images that are signed, linted, scanned and released.
|
||||
Check out the `.gitlab-ci.yaml` files in the project's [Charts](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts) or [Images](https://gitlab.opencode.de/bmi/opendesk/components/platform-development/images) to get an idea how little you need to do yourself.
|
||||
@@ -82,7 +82,6 @@ openDesk certificate management disabled.
|
||||
|
||||
Evaluation the openDesk deployment does not require any external service to start, but features may be limited.
|
||||
|
||||
|
||||
| Group | Type | Version | Tested against |
|
||||
|----------|---------------------|---------|-----------------------|
|
||||
| Cache | Memached | `1.6.x` | Memached |
|
||||
|
||||
@@ -19,9 +19,9 @@ grafana:
|
||||
dashboards:
|
||||
enabled: {{ .Values.grafana.dashboards.enabled }}
|
||||
labels:
|
||||
{{- toYaml .Values.grafana.dashboards.labels | nindent 6 }}
|
||||
{{ .Values.grafana.dashboards.labels | toYaml | nindent 6 }}
|
||||
annotations:
|
||||
{{- toYaml .Values.grafana.dashboards.annotations | nindent 6 }}
|
||||
{{ .Values.grafana.dashboards.annotations | toYaml | nindent 6 }}
|
||||
|
||||
image:
|
||||
repository: "{{ .Values.global.imageRegistry | default .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
|
||||
@@ -90,11 +90,11 @@ prometheus:
|
||||
servicemonitor:
|
||||
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
||||
labels:
|
||||
{{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
|
||||
{{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
|
||||
rules:
|
||||
enabled: {{ .Values.prometheus.prometheusRules.enabled }}
|
||||
additionalLabels:
|
||||
{{- toYaml .Values.prometheus.prometheusRules.labels | nindent 6 }}
|
||||
{{ .Values.prometheus.prometheusRules.labels | toYaml | nindent 6 }}
|
||||
|
||||
replicaCount: {{ .Values.replicas.collabora }}
|
||||
|
||||
@@ -126,7 +126,8 @@ securityContext:
|
||||
- "NET_RAW"
|
||||
- "SYS_CHROOT"
|
||||
- "MKNOD"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.collabora }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.collabora | toYaml | nindent 4 }}
|
||||
serviceAccount:
|
||||
create: true
|
||||
...
|
||||
|
||||
@@ -70,7 +70,8 @@ securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 4001
|
||||
runAsGroup: 4001
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.cryptpad }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.cryptpad | toYaml | nindent 4 }}
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
|
||||
@@ -107,7 +107,8 @@ containerSecurityContext:
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.element }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.element | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
|
||||
@@ -14,7 +14,8 @@ containerSecurityContext:
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoBoardWidget }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.matrixNeoBoardWidget | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
|
||||
@@ -14,7 +14,8 @@ containerSecurityContext:
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoChoiceWidget }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.matrixNeoChoiceWidget | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
|
||||
@@ -35,6 +35,7 @@ securityContext:
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.synapseCreateUser }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -35,7 +35,8 @@ containerSecurityContext:
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoDateFixBot }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.matrixNeoDateFixBot | toYaml | nindent 4 }}
|
||||
|
||||
extraEnvVars:
|
||||
- name: "ACCESS_TOKEN"
|
||||
|
||||
@@ -18,7 +18,8 @@ containerSecurityContext:
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.matrixNeoDateFixWidget }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.matrixNeoDateFixWidget | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
|
||||
@@ -35,5 +35,6 @@ securityContext:
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.synapseCreateUser }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.synapseCreateUser | toYaml | nindent 4 }}
|
||||
...
|
||||
|
||||
@@ -14,7 +14,8 @@ containerSecurityContext:
|
||||
runAsUser: 0
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.matrixUserVerificationService }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.matrixUserVerificationService | toYaml | nindent 4 }}
|
||||
|
||||
extraEnvVars:
|
||||
- name: "UVS_ACCESS_TOKEN"
|
||||
|
||||
@@ -14,7 +14,8 @@ containerSecurityContext:
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.synapseWeb }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.synapseWeb | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
|
||||
@@ -79,7 +79,8 @@ containerSecurityContext:
|
||||
runAsGroup: 10991
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.synapse }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.synapse | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
|
||||
@@ -18,7 +18,8 @@ containerSecurityContext:
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.wellKnown }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.wellKnown | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
|
||||
@@ -14,7 +14,8 @@ containerSecurityContext:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.intercom }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.intercom | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
domain: {{ .Values.global.domain | quote }}
|
||||
|
||||
@@ -23,7 +23,8 @@ containerSecurityContext:
|
||||
runAsUser: 1993
|
||||
runAsGroup: 1993
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.jitsiKeycloakAdapter }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.jitsiKeycloakAdapter | toYaml | nindent 4 }}
|
||||
|
||||
cleanup:
|
||||
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
||||
@@ -75,7 +76,8 @@ jitsi:
|
||||
runAsUser: 0
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.jitsi }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.jitsi | toYaml | nindent 8 }}
|
||||
prosody:
|
||||
image:
|
||||
repository: "{{ .Values.global.imageRegistry | default .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
|
||||
@@ -123,7 +125,8 @@ jitsi:
|
||||
runAsUser: 0
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.prosody }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.prosody | toYaml | nindent 8 }}
|
||||
jicofo:
|
||||
replicaCount: {{ .Values.replicas.jicofo }}
|
||||
image:
|
||||
@@ -145,7 +148,8 @@ jitsi:
|
||||
runAsUser: 0
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.jicofo }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.jicofo | toYaml | nindent 8 }}
|
||||
jvb:
|
||||
replicaCount: {{ .Values.replicas.jvb }}
|
||||
image:
|
||||
@@ -168,7 +172,8 @@ jitsi:
|
||||
runAsUser: 0
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.jvb }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.jvb | toYaml | nindent 8 }}
|
||||
jibri:
|
||||
replicaCount: {{ .Values.replicas.jibri }}
|
||||
image:
|
||||
@@ -206,7 +211,8 @@ patchJVB:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.jitsiPatchJVB }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.jitsiPatchJVB | toYaml | nindent 6 }}
|
||||
image:
|
||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||
registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiPatchJVB.registry | quote }}
|
||||
|
||||
@@ -95,7 +95,8 @@ containerSecurityContext:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudManagement }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.nextcloudManagement | toYaml | nindent 4 }}
|
||||
|
||||
debug:
|
||||
loglevel: {{ if .Values.debug.enabled }}"0"{{ else }}"1"{{ end }}
|
||||
|
||||
@@ -25,7 +25,8 @@ exporter:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudExporter }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.nextcloudExporter | toYaml | nindent 6 }}
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudExporter.registry | quote }}
|
||||
repository: "{{ .Values.images.nextcloudExporter.repository }}"
|
||||
@@ -35,11 +36,11 @@ exporter:
|
||||
serviceMonitor:
|
||||
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
||||
labels:
|
||||
{{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 8 }}
|
||||
{{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
|
||||
prometheusRule:
|
||||
enabled: {{ .Values.prometheus.prometheusRules.enabled }}
|
||||
additionalLabels:
|
||||
{{- toYaml .Values.prometheus.prometheusRules.labels | nindent 8 }}
|
||||
{{ .Values.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
|
||||
replicaCount: {{ .Values.replicas.nextcloudExporter }}
|
||||
resources:
|
||||
{{ .Values.resources.nextcloudExporter | toYaml | nindent 4 }}
|
||||
@@ -78,7 +79,8 @@ php:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudPHP }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.nextcloudPHP | toYaml | nindent 6 }}
|
||||
cron:
|
||||
successfulJobsHistoryLimit: {{ if .Values.debug.enabled }}"3"{{ else }}"0"{{ end }}
|
||||
debug:
|
||||
@@ -92,11 +94,11 @@ php:
|
||||
serviceMonitor:
|
||||
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
||||
labels:
|
||||
{{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 8 }}
|
||||
{{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 8 }}
|
||||
prometheusRule:
|
||||
enabled: {{ .Values.prometheus.prometheusRules.enabled }}
|
||||
additionalLabels:
|
||||
{{- toYaml .Values.prometheus.prometheusRules.labels | nindent 8 }}
|
||||
{{ .Values.prometheus.prometheusRules.labels | toYaml | nindent 8 }}
|
||||
replicaCount: {{ .Values.replicas.nextcloudPHP }}
|
||||
resources:
|
||||
{{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
|
||||
@@ -118,7 +120,8 @@ apache2:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.nextcloudApache2 }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.nextcloudApache2 | toYaml | nindent 6 }}
|
||||
ingress:
|
||||
enabled: {{ .Values.ingress.enabled }}
|
||||
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
|
||||
|
||||
@@ -66,7 +66,8 @@ containerSecurityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.dovecot }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.dovecot | toYaml | nindent 4 }}
|
||||
|
||||
podSecurityContext:
|
||||
enabled: true
|
||||
|
||||
@@ -40,7 +40,8 @@ nextcloud-integration-ui:
|
||||
privileged: false
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeNextcloudIntegrationUI }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangeNextcloudIntegrationUI | toYaml | nindent 6 }}
|
||||
|
||||
public-sector-ui:
|
||||
image:
|
||||
@@ -67,7 +68,8 @@ public-sector-ui:
|
||||
privileged: false
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangePublicSectorUI }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangePublicSectorUI | toYaml | nindent 6 }}
|
||||
|
||||
appsuite:
|
||||
appsuite-toolkit:
|
||||
@@ -131,7 +133,8 @@ appsuite:
|
||||
privileged: false
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeGotenberg }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangeGotenberg | toYaml | nindent 10 }}
|
||||
hooks:
|
||||
beforeAppsuiteStart:
|
||||
create-guard-dir.sh: |
|
||||
@@ -356,7 +359,8 @@ appsuite:
|
||||
privileged: false
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeCoreUI }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangeCoreUI | toYaml | nindent 8 }}
|
||||
|
||||
core-ui-middleware:
|
||||
enabled: true
|
||||
@@ -398,7 +402,8 @@ appsuite:
|
||||
privileged: false
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeCoreUIMiddleware }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangeCoreUIMiddleware | toYaml | nindent 8 }}
|
||||
core-cacheservice:
|
||||
enabled: false
|
||||
|
||||
@@ -428,7 +433,8 @@ appsuite:
|
||||
- "ALL"
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeDocumentConverter }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangeDocumentConverter | toYaml | nindent 8 }}
|
||||
|
||||
core-documents-collaboration:
|
||||
enabled: false
|
||||
@@ -470,7 +476,8 @@ appsuite:
|
||||
privileged: false
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeCoreGuidedtours }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangeCoreGuidedtours | toYaml | nindent 8 }}
|
||||
|
||||
core-imageconverter:
|
||||
enabled: true
|
||||
@@ -500,7 +507,8 @@ appsuite:
|
||||
- "ALL"
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeImageConverter }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangeImageConverter | toYaml | nindent 8 }}
|
||||
|
||||
guard-ui:
|
||||
enabled: true
|
||||
@@ -526,7 +534,8 @@ appsuite:
|
||||
privileged: false
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeGuardUI }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangeGuardUI | toYaml | nindent 8 }}
|
||||
core-spellcheck:
|
||||
enabled: false
|
||||
|
||||
@@ -555,5 +564,6 @@ appsuite:
|
||||
privileged: false
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openxchangeCoreUserGuide }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openxchangeCoreUserGuide | toYaml | nindent 8 }}
|
||||
...
|
||||
|
||||
@@ -38,7 +38,8 @@ containerSecurityContext:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openprojectBootstrap }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openprojectBootstrap | toYaml | nindent 4 }}
|
||||
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectBootstrap.registry | quote }}
|
||||
|
||||
@@ -20,7 +20,8 @@ containerSecurityContext:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.openproject }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.openproject | toYaml | nindent 4 }}
|
||||
|
||||
environment:
|
||||
# For more details and more options see
|
||||
|
||||
@@ -85,7 +85,8 @@ securityContext:
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.oxConnector }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.oxConnector | toYaml | nindent 4 }}
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
|
||||
@@ -15,7 +15,8 @@ clamd:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.clamd }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.clamd | toYaml | nindent 6 }}
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
|
||||
repository: {{ .Values.images.clamd.repository | quote }}
|
||||
@@ -41,7 +42,8 @@ containerSecurityContext:
|
||||
capabilities:
|
||||
drop: []
|
||||
privileged: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.clamav }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.clamav | toYaml | nindent 4 }}
|
||||
|
||||
freshclam:
|
||||
containerSecurityContext:
|
||||
@@ -57,7 +59,8 @@ freshclam:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.freshclam }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.freshclam | toYaml | nindent 6 }}
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | default .Values.images.freshclam.registry | quote }}
|
||||
repository: {{ .Values.images.freshclam.repository | quote }}
|
||||
@@ -89,7 +92,8 @@ icap:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.icap }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.icap | toYaml | nindent 6 }}
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
|
||||
repository: {{ .Values.images.icap.repository | quote }}
|
||||
@@ -117,7 +121,8 @@ milter:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.milter }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.milter | toYaml | nindent 6 }}
|
||||
image:
|
||||
registry: {{ .Values.global.imageRegistry | default .Values.images.milter.registry | quote }}
|
||||
repository: {{ .Values.images.milter.repository | quote }}
|
||||
|
||||
@@ -14,7 +14,8 @@ containerSecurityContext:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.clamavSimple }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.clamavSimple | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
imagePullSecrets:
|
||||
|
||||
@@ -17,7 +17,8 @@ containerSecurityContext:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.mariadb }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.mariadb | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
imagePullSecrets:
|
||||
|
||||
@@ -16,7 +16,8 @@ containerSecurityContext:
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.memcached }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.memcached | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
imagePullSecrets:
|
||||
|
||||
@@ -29,7 +29,8 @@ containerSecurityContext:
|
||||
readOnlyRootFilesystem: false
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.minio }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.minio | toYaml | nindent 4 }}
|
||||
|
||||
defaultBuckets: "openproject,openxchange,ums,nextcloud"
|
||||
|
||||
@@ -68,7 +69,7 @@ metrics:
|
||||
serviceMonitor:
|
||||
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
||||
additionalLabels:
|
||||
{{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
|
||||
{{ .Values.prometheus.serviceMonitors.labels | toYaml | nindent 6 }}
|
||||
|
||||
networkPolicy:
|
||||
enabled: false
|
||||
|
||||
@@ -20,8 +20,6 @@ apps:
|
||||
enabled: {{ .Values.intercom.enabled }}
|
||||
jitsi:
|
||||
enabled: {{ .Values.jitsi.enabled }}
|
||||
keycloak:
|
||||
enabled: {{ .Values.keycloak.enabled }}
|
||||
mariadb:
|
||||
enabled: {{ .Values.mariadb.enabled }}
|
||||
memcached:
|
||||
|
||||
@@ -17,7 +17,8 @@ containerSecurityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
privileged: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.postfix }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.postfix | toYaml | nindent 4 }}
|
||||
|
||||
global:
|
||||
imagePullSecrets:
|
||||
|
||||
@@ -14,7 +14,8 @@ containerSecurityContext:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.postgresql }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.postgresql | toYaml | nindent 4 }}
|
||||
|
||||
job:
|
||||
|
||||
|
||||
@@ -30,7 +30,8 @@ master:
|
||||
capabilities:
|
||||
drop:
|
||||
- "ALL"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.redis }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.redis | toYaml | nindent 6 }}
|
||||
count: {{ .Values.replicas.redis }}
|
||||
persistence:
|
||||
size: {{ .Values.persistence.size.redis | quote }}
|
||||
|
||||
@@ -55,6 +55,7 @@ securityContext:
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsGuardianAuthorizationApi }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsGuardianAuthorizationApi | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -73,6 +73,7 @@ securityContext:
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsGuardianManagementApi }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsGuardianManagementApi | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -46,6 +46,7 @@ securityContext:
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
readOnlyRootFilesystem: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsGuardianManagementUi }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsGuardianManagementUi | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -27,7 +27,8 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsLdapNotifier }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsLdapNotifier | toYaml | nindent 4 }}
|
||||
|
||||
volumes:
|
||||
claims:
|
||||
|
||||
@@ -76,7 +76,8 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsLdapServer }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsLdapServer | toYaml | nindent 4 }}
|
||||
|
||||
service:
|
||||
type: "ClusterIP"
|
||||
|
||||
@@ -44,6 +44,7 @@ securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsNotificationsApi }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsNotificationsApi | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -46,6 +46,7 @@ securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsOpenPolicyAgent }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsOpenPolicyAgent | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -597,7 +597,8 @@ containerSecurityContext:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.opendeskKeycloakBootstrap }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.opendeskKeycloakBootstrap | toYaml | nindent 4 }}
|
||||
|
||||
podAnnotations:
|
||||
intents.otterize.com/service-name: "ums-keycloak-bootstrap"
|
||||
|
||||
@@ -112,5 +112,6 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsPortalFrontend }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsPortalFrontend | toYaml | nindent 4 }}
|
||||
...
|
||||
|
||||
@@ -79,6 +79,7 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsPortalListener }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsPortalListener | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -56,6 +56,7 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsPortalServer }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsPortalServer | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -73,6 +73,7 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsSelfserviceListener }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsSelfserviceListener | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -29,7 +29,8 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsDataLoader }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsDataLoader | toYaml | nindent 4 }}
|
||||
|
||||
stackDataContext:
|
||||
ldapBase: "dc=swp-ldap,dc=internal"
|
||||
|
||||
@@ -29,7 +29,8 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsDataLoader }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsDataLoader | toYaml | nindent 4 }}
|
||||
|
||||
stackDataContext:
|
||||
idpSamlMetadataUrlInternal: null
|
||||
|
||||
@@ -53,7 +53,8 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsStoreDav }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsStoreDav | toYaml | nindent 4 }}
|
||||
|
||||
storeDav:
|
||||
auth:
|
||||
|
||||
@@ -53,7 +53,8 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsUdmRestApi }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsUdmRestApi | toYaml | nindent 4 }}
|
||||
|
||||
udmRestApi:
|
||||
# TODO: Stub value currently
|
||||
|
||||
@@ -58,6 +58,7 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsUmcGateway }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsUmcGateway | toYaml | nindent 4 }}
|
||||
|
||||
...
|
||||
|
||||
@@ -94,7 +94,8 @@ securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
runAsNonRoot: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsUmcServer }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsUmcServer | toYaml | nindent 4 }}
|
||||
|
||||
umcServer:
|
||||
certPemFile: "/var/secrets/ssl/tls.crt"
|
||||
|
||||
@@ -66,7 +66,8 @@ containerSecurityContext:
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsKeycloakBootstrap }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsKeycloakBootstrap | toYaml | nindent 4 }}
|
||||
|
||||
podAnnotations:
|
||||
intents.otterize.com/service-name: "ums-keycloak-bootstrap"
|
||||
|
||||
@@ -48,7 +48,8 @@ handler:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsKeycloakExtensionHandler }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsKeycloakExtensionHandler | toYaml | nindent 6 }}
|
||||
resources:
|
||||
{{ .Values.resources.umsKeycloakExtensionHandler | toYaml | nindent 4 }}
|
||||
postgresql:
|
||||
@@ -103,7 +104,8 @@ proxy:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsKeycloakExtensionProxy }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsKeycloakExtensionProxy | toYaml | nindent 6 }}
|
||||
resources:
|
||||
{{ .Values.resources.umsKeycloakExtensionProxy | toYaml | nindent 4 }}
|
||||
...
|
||||
|
||||
@@ -44,7 +44,8 @@ containerSecurityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsKeycloak }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsKeycloak | toYaml | nindent 4 }}
|
||||
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
|
||||
@@ -45,7 +45,8 @@ containerSecurityContext:
|
||||
- "ALL"
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.umsStackGateway }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.umsStackGateway | toYaml | nindent 4 }}
|
||||
|
||||
service:
|
||||
type: "ClusterIP"
|
||||
|
||||
@@ -36,7 +36,8 @@ containerSecurityContext:
|
||||
seccompProfile:
|
||||
type: "RuntimeDefault"
|
||||
readOnlyRootFilesystem: false
|
||||
seLinuxOptions: {{ .Values.seLinuxOptions.xwiki }}
|
||||
seLinuxOptions:
|
||||
{{ .Values.seLinuxOptions.xwiki | toYaml | nindent 4 }}
|
||||
|
||||
customConfigs:
|
||||
xwiki.cfg:
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -3,5 +3,5 @@
|
||||
---
|
||||
global:
|
||||
systemInformation:
|
||||
releaseVersion: "v0.5.78"
|
||||
releaseVersion: "v0.5.80"
|
||||
...
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -19,8 +19,6 @@ intercom:
|
||||
enabled: true
|
||||
jitsi:
|
||||
enabled: true
|
||||
keycloak:
|
||||
enabled: true
|
||||
mariadb:
|
||||
enabled: true
|
||||
memcached:
|
||||
|
||||
Reference in New Issue
Block a user