mirror of
https://gitlab.opencode.de/bmi/opendesk/deployment/opendesk.git
synced 2025-12-06 15:31:38 +01:00
Compare commits
45 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
6496ac787b | ||
|
|
77e32fada8 | ||
|
|
acbef3ae3e | ||
|
|
bb289d545e | ||
|
|
2d2455fdb3 | ||
|
|
0bf059e8e1 | ||
|
|
0492420d60 | ||
|
|
8f09740677 | ||
|
|
969c42a590 | ||
|
|
7daa93f061 | ||
|
|
452624ce74 | ||
|
|
b23152bb20 | ||
|
|
78993e122b | ||
|
|
87b6fcfc37 | ||
|
|
4945c13d05 | ||
|
|
08754cc527 | ||
|
|
45967c7a0b | ||
|
|
acf6816653 | ||
|
|
f8943703ed | ||
|
|
712605e4f1 | ||
|
|
a0d5fb8955 | ||
|
|
fec0d1f26a | ||
|
|
807b73c8a4 | ||
|
|
506ef4a20f | ||
|
|
306252da6f | ||
|
|
5f5a65f59d | ||
|
|
09d001b6db | ||
|
|
9aa907a909 | ||
|
|
2ad48b6fd5 | ||
|
|
6b3d99d1d1 | ||
|
|
813a2e29e9 | ||
|
|
e1f63701f1 | ||
|
|
9ff605623c | ||
|
|
db749d8b1b | ||
|
|
b30b29df8a | ||
|
|
7a145315f9 | ||
|
|
f13f39a0a0 | ||
|
|
3b557a892c | ||
|
|
41e777c81d | ||
|
|
90152bdc41 | ||
|
|
8db9bf3c99 | ||
|
|
c2e9204c56 | ||
|
|
61eb206c74 | ||
|
|
1c4db30b65 | ||
|
|
d039c65c4b |
9
.gitignore
vendored
9
.gitignore
vendored
@@ -5,9 +5,6 @@
|
|||||||
.yamllint
|
.yamllint
|
||||||
|
|
||||||
# Ignore changes to sample environments
|
# Ignore changes to sample environments
|
||||||
helmfile/environments/dev/values.yaml
|
helmfile/environments/dev/values.yaml.gotmpl
|
||||||
helmfile/environments/dev/values.gotmpl
|
helmfile/environments/test/values.yaml.gotmpl
|
||||||
helmfile/environments/test/values.yaml
|
helmfile/environments/prod/values.yaml.gotmpl
|
||||||
helmfile/environments/test/values.gotmpl
|
|
||||||
helmfile/environments/prod/values.yaml
|
|
||||||
helmfile/environments/prod/values.gotmpl
|
|
||||||
|
|||||||
137
.gitlab-ci.yml
137
.gitlab-ci.yml
@@ -15,6 +15,7 @@ include:
|
|||||||
|
|
||||||
stages:
|
stages:
|
||||||
- ".pre"
|
- ".pre"
|
||||||
|
- "scan"
|
||||||
- "automr"
|
- "automr"
|
||||||
- "lint"
|
- "lint"
|
||||||
- "env-cleanup"
|
- "env-cleanup"
|
||||||
@@ -175,7 +176,7 @@ env-cleanup:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
$ENV_STOP_BEFORE != "no"
|
$ENV_STOP_BEFORE != "no"
|
||||||
when: "always"
|
when: "on_success"
|
||||||
script:
|
script:
|
||||||
- |
|
- |
|
||||||
if [ "${OPENDESK_SLEDGEHAMMER_DESTROY_ENABLED}" = "yes" ]; then
|
if [ "${OPENDESK_SLEDGEHAMMER_DESTROY_ENABLED}" = "yes" ]; then
|
||||||
@@ -199,7 +200,7 @@ env-start:
|
|||||||
- if: >
|
- if: >
|
||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/
|
$NAMESPACE =~ /.+/
|
||||||
when: "always"
|
when: "on_success"
|
||||||
script:
|
script:
|
||||||
- "echo \"Deploying to Environment ${NAMESPACE} in ${CLUSTER} Cluster\""
|
- "echo \"Deploying to Environment ${NAMESPACE} in ${CLUSTER} Cluster\""
|
||||||
- "kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -"
|
- "kubectl create namespace ${NAMESPACE} --dry-run=client -o yaml | kubectl apply -f -"
|
||||||
@@ -221,7 +222,7 @@ services-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_SERVICES != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "services"
|
COMPONENT: "services"
|
||||||
|
|
||||||
@@ -233,7 +234,7 @@ provisioning-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no" || $DEPLOY_PROVISIONING != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no" || $DEPLOY_PROVISIONING != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "provisioning"
|
COMPONENT: "provisioning"
|
||||||
|
|
||||||
@@ -245,7 +246,7 @@ ums-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_UMS != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "univention-management-stack"
|
COMPONENT: "univention-management-stack"
|
||||||
|
|
||||||
@@ -258,7 +259,7 @@ ox-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_OX != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_OX != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "open-xchange"
|
COMPONENT: "open-xchange"
|
||||||
|
|
||||||
@@ -270,7 +271,7 @@ ics-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ICS != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ICS != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "intercom-service"
|
COMPONENT: "intercom-service"
|
||||||
|
|
||||||
@@ -282,7 +283,7 @@ xwiki-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_XWIKI != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_XWIKI != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "xwiki"
|
COMPONENT: "xwiki"
|
||||||
|
|
||||||
@@ -294,7 +295,7 @@ collabora-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no" || $DEPLOY_COLLABORA != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no" || $DEPLOY_COLLABORA != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "collabora"
|
COMPONENT: "collabora"
|
||||||
|
|
||||||
@@ -306,7 +307,7 @@ cryptpad-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no" || $DEPLOY_CRYPTPAD != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no" || $DEPLOY_CRYPTPAD != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "cryptpad"
|
COMPONENT: "cryptpad"
|
||||||
|
|
||||||
@@ -318,7 +319,7 @@ nextcloud-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_NEXTCLOUD != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "nextcloud"
|
COMPONENT: "nextcloud"
|
||||||
|
|
||||||
@@ -330,7 +331,7 @@ openproject-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_OPENPROJECT != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_OPENPROJECT != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "openproject"
|
COMPONENT: "openproject"
|
||||||
|
|
||||||
@@ -342,7 +343,7 @@ openproject-bootstrap-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || ($DEPLOY_OPENPROJECT != "no" && $DEPLOY_NEXTCLOUD != "no"))
|
($DEPLOY_ALL_COMPONENTS != "no" || ($DEPLOY_OPENPROJECT != "no" && $DEPLOY_NEXTCLOUD != "no"))
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "openproject-bootstrap"
|
COMPONENT: "openproject-bootstrap"
|
||||||
|
|
||||||
@@ -354,7 +355,7 @@ jitsi-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_JITSI != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_JITSI != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "jitsi"
|
COMPONENT: "jitsi"
|
||||||
|
|
||||||
@@ -366,7 +367,7 @@ element-deploy:
|
|||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" &&
|
||||||
$NAMESPACE =~ /.+/ &&
|
$NAMESPACE =~ /.+/ &&
|
||||||
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ELEMENT != "no")
|
($DEPLOY_ALL_COMPONENTS != "no" || $DEPLOY_ELEMENT != "no")
|
||||||
when: "always"
|
when: "on_success"
|
||||||
variables:
|
variables:
|
||||||
COMPONENT: "element"
|
COMPONENT: "element"
|
||||||
|
|
||||||
@@ -410,7 +411,7 @@ run-tests:
|
|||||||
rules:
|
rules:
|
||||||
- if: >
|
- if: >
|
||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/ && $RUN_TESTS == "yes"
|
||||||
when: "always"
|
when: "on_success"
|
||||||
script:
|
script:
|
||||||
- *ums-default-password
|
- *ums-default-password
|
||||||
- |
|
- |
|
||||||
@@ -450,7 +451,7 @@ run-souvap-dev-tests:
|
|||||||
rules:
|
rules:
|
||||||
- if: >
|
- if: >
|
||||||
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/ && $RUN_UMS_TESTS == "yes"
|
$CI_PIPELINE_SOURCE =~ "web|schedules|triggers" && $NAMESPACE =~ /.+/ && $RUN_UMS_TESTS == "yes"
|
||||||
when: "always"
|
when: "on_success"
|
||||||
script:
|
script:
|
||||||
- *ums-default-password
|
- *ums-default-password
|
||||||
- |
|
- |
|
||||||
@@ -470,12 +471,70 @@ run-souvap-dev-tests:
|
|||||||
}" \
|
}" \
|
||||||
"https://${UMS_TESTS_PROJECT_URL}/trigger/pipeline"
|
"https://${UMS_TESTS_PROJECT_URL}/trigger/pipeline"
|
||||||
|
|
||||||
|
avscan-prepare:
|
||||||
|
stage: ".pre"
|
||||||
|
rules:
|
||||||
|
- if: "$JOB_AVSCAN_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
|
||||||
|
when: "always"
|
||||||
|
- when: "never"
|
||||||
|
image: "external-registry.souvap-univention.de/docker-remote/mikefarah/yq"
|
||||||
|
script:
|
||||||
|
- |
|
||||||
|
cat << 'EOF' > dynamic-scans.yml
|
||||||
|
---
|
||||||
|
stages:
|
||||||
|
- "scan"
|
||||||
|
|
||||||
|
.container-clamav:
|
||||||
|
stage: "scan"
|
||||||
|
image: "registry.opencode.de/bmi/opendesk/components/platform-development/images/clamav-imagescan:1.0.0"
|
||||||
|
before_script:
|
||||||
|
- "sed -i \"/^DatabaseMirror .*$/c DatabaseMirror ${DATABASE_MIRROR}\" /etc/clamav/freshclam.conf"
|
||||||
|
- "freshclam"
|
||||||
|
- "mkdir /scan"
|
||||||
|
script:
|
||||||
|
- "export IMAGE=${EXTERNAL_REGISTRY:-${CONTAINER_REGISTRY}}/${CONTAINER_IMAGE}:${CONTAINER_TAG}"
|
||||||
|
- "echo Pulling and scanning $IMAGE..."
|
||||||
|
- "crane pull $IMAGE /scan/image.tar"
|
||||||
|
- "clamscan /scan"
|
||||||
|
variables:
|
||||||
|
CONTAINER_IMAGE: ""
|
||||||
|
CONTAINER_REGISTRY: ""
|
||||||
|
CONTAINER_TAG: ""
|
||||||
|
DATABASE_MIRROR: "https://nexus.souvap-univention.de/repository/ClamAV"
|
||||||
|
EOF
|
||||||
|
- >
|
||||||
|
yq '.images
|
||||||
|
| with_entries(.key |= "scan-" + .)
|
||||||
|
| .[].extends=".container-clamav"
|
||||||
|
| with(.[]; .variables.CONTAINER_IMAGE = .repository | .variables.CONTAINER_TAG = .tag | .variables.CONTAINER_REGISTRY = .registry)
|
||||||
|
| del(.[].repository)
|
||||||
|
| del(.[].tag)
|
||||||
|
| del(.[].registry)'
|
||||||
|
helmfile/environments/default/images.yaml
|
||||||
|
>> dynamic-scans.yml
|
||||||
|
artifacts:
|
||||||
|
paths:
|
||||||
|
- "dynamic-scans.yml"
|
||||||
|
|
||||||
|
avscan-start:
|
||||||
|
stage: "scan"
|
||||||
|
rules:
|
||||||
|
- if: "$JOB_AVSCAN_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
|
||||||
|
when: "always"
|
||||||
|
- when: "never"
|
||||||
|
trigger:
|
||||||
|
include:
|
||||||
|
- artifact: "dynamic-scans.yml"
|
||||||
|
job: "avscan-prepare"
|
||||||
|
strategy: "depend"
|
||||||
|
|
||||||
generate-release-assets:
|
generate-release-assets:
|
||||||
stage: "generate-release-assets"
|
stage: "generate-release-assets"
|
||||||
image: "registry.souvap-univention.de/souvap/tooling/images/ansible:4.10.0"
|
image: "registry.souvap-univention.de/souvap/tooling/images/ansible:4.10.0"
|
||||||
rules:
|
rules:
|
||||||
- if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
|
- if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
|
||||||
when: "always"
|
when: "on_success"
|
||||||
- when: "never"
|
- when: "never"
|
||||||
script:
|
script:
|
||||||
- |
|
- |
|
||||||
@@ -495,6 +554,21 @@ generate-release-assets:
|
|||||||
variables:
|
variables:
|
||||||
ASSET_GENERATOR_REPO_PATH: "bmi/opendesk/tooling/opendesk-asset-generator"
|
ASSET_GENERATOR_REPO_PATH: "bmi/opendesk/tooling/opendesk-asset-generator"
|
||||||
|
|
||||||
|
opendesk-linter:
|
||||||
|
cache: {}
|
||||||
|
image: "registry.opencode.de/bmi/opendesk/tooling/opendesk-ci-cli:1.0.1"
|
||||||
|
needs: []
|
||||||
|
rules:
|
||||||
|
- if: "$JOB_OPENDESK_LINTER_ENABLED == 'false' || $CI_PIPELINE_SOURCE =~ 'tags|merge_request_event'"
|
||||||
|
when: "never"
|
||||||
|
- when: "always"
|
||||||
|
script:
|
||||||
|
- "node /app/src/index.js sort-images ${CI_PROJECT_DIR}/helmfile/environments/default/images.yaml"
|
||||||
|
- "node /app/src/index.js sort-charts ${CI_PROJECT_DIR}/helmfile/environments/default/charts.yaml"
|
||||||
|
- "git diff --exit-code"
|
||||||
|
stage: "lint"
|
||||||
|
tags:
|
||||||
|
- "docker"
|
||||||
|
|
||||||
# Declare .environments which is in environments repository and only loaded when INCLUDE_ENVIRONMENTS_ENABLED not false.
|
# Declare .environments which is in environments repository and only loaded when INCLUDE_ENVIRONMENTS_ENABLED not false.
|
||||||
# 'cache' is used because job must contain at least one key, so cache is just a dummy key.
|
# 'cache' is used because job must contain at least one key, so cache is just a dummy key.
|
||||||
@@ -530,15 +604,36 @@ reuse-linter:
|
|||||||
generate-release-version:
|
generate-release-version:
|
||||||
rules:
|
rules:
|
||||||
- if: "$JOB_RELEASE_ENABLED != 'false'"
|
- if: "$JOB_RELEASE_ENABLED != 'false'"
|
||||||
when: "always"
|
when: "on_success"
|
||||||
|
|
||||||
release:
|
release:
|
||||||
dependencies:
|
dependencies:
|
||||||
- "generate-release-assets"
|
- "generate-release-assets"
|
||||||
rules:
|
rules:
|
||||||
- if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
|
- if: "$JOB_RELEASE_ENABLED != 'false' && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH"
|
||||||
when: "always"
|
when: "on_success"
|
||||||
script:
|
script:
|
||||||
|
- >
|
||||||
|
export RELEASE_VERSION=$(semantic-release --dry-run --branches $CI_COMMIT_REF_NAME --plugins
|
||||||
|
"@semantic-release/gitlab" | grep -oP "Published release [0-9]+\.[0-9]+\.[0-9]+ on" |
|
||||||
|
grep -oP "[0-9]+\.[0-9]+\.[0-9]+")
|
||||||
|
- |
|
||||||
|
if [ -z "${RELEASE_VERSION}" ]; then
|
||||||
|
echo "RELEASE_VERSION=$(git describe --tags --abbrev=0 | sed s@^v@@g )"
|
||||||
|
else
|
||||||
|
echo "RELEASE_VERSION=${RELEASE_VERSION}"
|
||||||
|
fi
|
||||||
|
- |
|
||||||
|
echo -e "\n[INFO] Writing data to helm value file..."
|
||||||
|
cat <<EOF >helmfile/environments/default/global.generated.yaml
|
||||||
|
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
---
|
||||||
|
global:
|
||||||
|
systemInformation:
|
||||||
|
releaseVersion: "v$(echo -E "$RELEASE_VERSION")"
|
||||||
|
...
|
||||||
|
EOF
|
||||||
- |
|
- |
|
||||||
cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
|
cat << 'EOF' > ${CI_PROJECT_DIR}/.releaserc
|
||||||
{
|
{
|
||||||
@@ -557,7 +652,7 @@ release:
|
|||||||
"@semantic-release/release-notes-generator",
|
"@semantic-release/release-notes-generator",
|
||||||
"@semantic-release/changelog",
|
"@semantic-release/changelog",
|
||||||
["@semantic-release/git", {
|
["@semantic-release/git", {
|
||||||
"assets": ["charts/**/Chart.yaml", "CHANGELOG.md", "charts/**/README.md"],
|
"assets": ["charts/**/Chart.yaml", "CHANGELOG.md", "charts/**/README.md", "helmfile/environments/default/global.generated.yaml"],
|
||||||
"message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
|
"message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
|
||||||
}]
|
}]
|
||||||
]
|
]
|
||||||
|
|||||||
47
CHANGELOG.md
47
CHANGELOG.md
@@ -1,3 +1,50 @@
|
|||||||
|
## [0.5.74](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.73...v0.5.74) (2024-01-12)
|
||||||
|
|
||||||
|
|
||||||
|
### Bug Fixes
|
||||||
|
|
||||||
|
* **ci:** Add opendesk-ci linter ([b23152b](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/b23152bb20f3460c62719e47ce519d093a42c034))
|
||||||
|
* **ci:** Scan all images for malware on release ([807b73c](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/807b73c8a4f39de31f6ae02003541cf19597a3b7))
|
||||||
|
* **ci:** Switch to 'on_success' instead of 'always' ([e1f6370](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/e1f63701f108bcc124ec67079df1a8649cc2e7c2))
|
||||||
|
* **collabora:** Migrate collabora to yaml.gotmpl file ([09d001b](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/09d001b6db167ff0a5cd95a1cd58dd2f117f338f))
|
||||||
|
* **cryptpad:** Bump image ([90152bd](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/90152bdc41131c359075556d26873c1ad5292950))
|
||||||
|
* **cryptpad:** Bump image to 5.6.0 ([1c4db30](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/1c4db30b65249294696d71e435307d2877556b2c))
|
||||||
|
* **cryptpad:** Verify against GPG key ([fec0d1f](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/fec0d1f26acd729e71d441ae8043830049028cf4))
|
||||||
|
* **docs:** Update Helm Chart Trust Chain information ([f894370](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/f8943703ede8f3757dc10b789d95239fe8038d5c))
|
||||||
|
* **element:** Fix rights & roles of neoboard ([7daa93f](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/7daa93f06179a9d6eedbc058503252d7b7aa04b1))
|
||||||
|
* **element:** Fix rights and roles configuration ([452624c](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/452624ce749b60abb1208a9f298e92af7d0168d0))
|
||||||
|
* **helmfile:** Add image annotations for mirroring ([41e777c](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/41e777c81dcb50ead8486683fea8cbbc69f07129))
|
||||||
|
* **helmfile:** Add logLevel to globals ([8db9bf3](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/8db9bf3c993845c94331c7f1891c3abda907d6e6))
|
||||||
|
* **helmfile:** Add XWiki GPG key ([712605e](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/712605e4f14913f8e5cda61f64514e077d8df5dc))
|
||||||
|
* **helmfile:** Increase timeouts for deployment of services ([3b557a8](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/3b557a892c80f4c0061c36fc706502c49a7c4607))
|
||||||
|
* **helmfile:** Merge fix values filename for Jitsi ([7a14531](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/7a145315f9768f5b5606a1b951f7f07f8a8a7673))
|
||||||
|
* **helmfile:** Remove oci flag from charts.yaml and move user/password ([2ad48b6](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/2ad48b6fd528c002501771dea96784e54d272c03))
|
||||||
|
* **helmfile:** Sort images and charts ([acf6816](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/acf681665352c84de00246b57b0be9afa48a820d))
|
||||||
|
* **helmfile:** Switch artefacts to be pulled from Open CoDE or upstream ([6b3d99d](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/6b3d99d1d1a41368650f828eaea69d9159b8e752))
|
||||||
|
* **intercom-service:** Add scaling option. ([969c42a](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/969c42a590bb47cddf4c5f59940d53d55dba8810))
|
||||||
|
* **jitsi:** Add available securityContexts here ([8f09740](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/8f097406773ad769e3bece6af6c994df8254228c))
|
||||||
|
* **nextcloud:** Replace community Nextcloud with openDesk Nextcloud ([813a2e2](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/813a2e29e964f95bff133a6b09608ff9f6fda255))
|
||||||
|
* **open-xchange:** Enable ICAP and merge yaml and gotmpl files ([306252d](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/306252da6fb70c3728cf781ea62ab76ad1099af6))
|
||||||
|
* **openproject:** Consolidate env values set by Helm chart ([08754cc](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/08754cc527e2828a44e853277ed55d6b3d041a37))
|
||||||
|
* **openproject:** Merge yaml and gotmpl value files ([45967c7](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/45967c7a0b18df6ff23ebff62d5a4c67bde7cee2))
|
||||||
|
* **services:** Add scaling to all services ([0492420](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/0492420d60bf8e866b39dc51a2e3627cc710de75))
|
||||||
|
* **univention-management-stack:** Add guardian components ([db749d8](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/db749d8b1b5982d7ffd1728a40c343928a94dc9b))
|
||||||
|
* **univention-management-stack:** Add missing image template for ums stack gateway and imagePullSecrets to keycloak extensions ([0bf059e](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/0bf059e8e1560a63d4b5efbd80a00a896539f86b))
|
||||||
|
* **univention-management-stack:** Add ums provisioning service ([d039c65](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/d039c65c4b808e2a55a428502a8cfc05d001b43c))
|
||||||
|
* **univention-management-stack:** Bump Keycloak Bootstrap image ([bb289d5](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/bb289d545e2ee306ecf032d4889c694c7182f243))
|
||||||
|
* **univention-management-stack:** Bump Keycloak chart and image and provide settings for IT-Grundschutz ([c2e9204](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/c2e9204c56c526b96e084bd7578cb981f3be29c0))
|
||||||
|
* **univention-management-stack:** Keycloak clients for guardian ([b30b29d](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/b30b29df8aa179dd065db4ade1d2911f6c7ab458))
|
||||||
|
* **univention-management-stack:** Provide openDesk version info for admins in portal menu ([5f5a65f](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/5f5a65f59d4f67b589f6ac1f5c51ed584ab91ff0))
|
||||||
|
* **univention-management-stack:** SAML join using internal Keycloak hostname ([acbef3a](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/acbef3ae3e335de0c5dfc2e54e2c31b64643990a))
|
||||||
|
* **univention-management-stack:** Streamline timeouts for deployment ([506ef4a](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/506ef4a20f8f5de509a678f7df64f24137e985f6))
|
||||||
|
* **univention-management-stack:** Updated base image ([78993e1](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/78993e122bad05cc2801acf516ebebb4accc1aaf))
|
||||||
|
* **xwiki:** Bump Helm chart und image, fix favicon ([87b6fcf](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/87b6fcfc37babaca03ffdbb1ba4ae603db4f1c23))
|
||||||
|
* **xwiki:** Ldap group sync filter ([9aa907a](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/9aa907a90996b7b4fe4addbd4ca9f0eae6f65aec))
|
||||||
|
* **xwiki:** Update default XWiki configuration ([f13f39a](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/f13f39a0a0fe9748f12270e9c933c985919b8eda))
|
||||||
|
* **xwiki:** Update Image to include XWiki 15.10.4 ([9ff6056](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/9ff605623c955d34dcccfdfb69c5b6245ab3f4fc))
|
||||||
|
* **xwiki:** Update to 1.2.6 and add imagePullSecrets ([2d2455f](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/2d2455fdb347ec001e6a48a5a61dc9098a66e6d6))
|
||||||
|
* **xwiki:** Verify against GPG key ([a0d5fb8](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/commit/a0d5fb895518aa28b6e69cffdcecde1fe2a53ceb))
|
||||||
|
|
||||||
## [0.5.73](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.72...v0.5.73) (2023-12-21)
|
## [0.5.73](https://gitlab.opencode.de/bmi/opendesk/deployment/sovereign-workplace/compare/v0.5.72...v0.5.73) (2023-12-21)
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@@ -12,8 +12,7 @@ This documentation should enable you to create your own evaluation instance of o
|
|||||||
* [Customize environment](#customize-environment)
|
* [Customize environment](#customize-environment)
|
||||||
* [Domain](#domain)
|
* [Domain](#domain)
|
||||||
* [Apps](#apps)
|
* [Apps](#apps)
|
||||||
* [Private Image registry](#private-image-registry)
|
* [Private Helm chart and container image registry](#private-helm-chart-and-container-image-registry)
|
||||||
* [Private Helm registry](#private-helm-registry)
|
|
||||||
* [Cluster capabilities](#cluster-capabilities)
|
* [Cluster capabilities](#cluster-capabilities)
|
||||||
* [Service](#service)
|
* [Service](#service)
|
||||||
* [Networking](#networking)
|
* [Networking](#networking)
|
||||||
@@ -127,58 +126,39 @@ jitsi:
|
|||||||
enabled: false
|
enabled: false
|
||||||
```
|
```
|
||||||
|
|
||||||
## Private Image registry
|
## Private Helm chart and container image registry
|
||||||
|
|
||||||
By default, all OCI artifacts are proxied via the project's image registry, which should get replaced soon by the
|
By default Helm charts and container images are fetched from OCI registries. These registries can be found for most cases
|
||||||
OCI registries provided by Open CoDE.
|
in the [openDesk/component section on Open CoDE](https://gitlab.opencode.de/bmi/opendesk/components).
|
||||||
|
|
||||||
You also can set your own registry by:
|
For untouched upstream artefacts that do not belong to a functional component's core we use upstream registries
|
||||||
|
like Docker Hub.
|
||||||
|
|
||||||
|
Doing a test deployment will most likely be fine with this setup. In case you want to deploy multiple times a day
|
||||||
|
and fetch from the same IP address you might run into rate limits at Docker Hub. In that case and in cases you
|
||||||
|
prefer the use of a private image registry anyway you can configure such for
|
||||||
|
[your target environment](./../helmfile/environments/dev/values.yaml.gotmpl.sample) by setting `global.imageRegistry`
|
||||||
|
like this:
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
global:
|
global:
|
||||||
imageRegistry: "external-registry.souvap-univention.de/sovereign-workplace"
|
imageRegistry: "external-registry.souvap-univention.de/sovereign-workplace"
|
||||||
```
|
```
|
||||||
|
|
||||||
or via environments variable:
|
alternatively you can use an environment variable:
|
||||||
|
|
||||||
```shell
|
```shell
|
||||||
export PRIVATE_IMAGE_REGISTRY_URL=external-registry.souvap-univention.de/sovereign-workplace
|
export PRIVATE_IMAGE_REGISTRY_URL=external-registry.souvap-univention.de/sovereign-workplace
|
||||||
```
|
```
|
||||||
|
|
||||||
If authentication is required, you can reference imagePullSecrets as following:
|
If authentication is required, you can reference imagePullSecrets as following:
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
global:
|
global:
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
- "external-registry"
|
- "external-registry"
|
||||||
```
|
```
|
||||||
|
|
||||||
## Private Helm registry
|
|
||||||
|
|
||||||
Some apps use OCI style registry and some use Helm chart museum style registries.
|
|
||||||
In `helmfile/environments/default/charts.yaml` you can find all helm charts used and modify their registry, repository
|
|
||||||
or version.
|
|
||||||
|
|
||||||
As an example, you can also use helmfile methods to use just a single environment variable to set registry and
|
|
||||||
authentication for all OCI helm charts.
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
charts:
|
|
||||||
certificates:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
password: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
```
|
|
||||||
|
|
||||||
There is a full example including http and OCI style registries in `examples/private-helm-registry.yaml.gotmpl`.
|
|
||||||
The following environment variables have to be exposed when using the example:
|
|
||||||
|
|
||||||
| Environment variable | Description |
|
|
||||||
|-------------------------------------|--------------------------------------------------------------------------------------------|
|
|
||||||
| `OD_PRIVATE_HELM_OCI_REGISTRY` | Registry for OCI hosted helm charts, example: `external-registry.souvap-univention.de` |
|
|
||||||
| `OD_PRIVATE_HELM_HTTP_REGISTRY` | Registry URI for http hosted helm charts, `https://external-registry.souvap-univention.de` |
|
|
||||||
| `OD_PRIVATE_HELM_REGISTRY_USERNAME` | Username |
|
|
||||||
| `OD_PRIVATE_HELM_REGISTRY_PASSWORD` | Password |
|
|
||||||
|
|
||||||
## Cluster capabilities
|
## Cluster capabilities
|
||||||
|
|
||||||
### Service
|
### Service
|
||||||
|
|||||||
@@ -20,33 +20,38 @@ Verified positive effects are marke with a check-mark in `Scaling (verified)` co
|
|||||||
marked with a gear.
|
marked with a gear.
|
||||||
|
|
||||||
|
|
||||||
| Component | Name | Scaling (effective) | Scaling (verified) |
|
| Component | Name | Scaling (effective) | Scaling (verified) |
|
||||||
|-------------|------------------------------------------|:-------------------:|:------------------:|
|
|------------------|------------------------------------------|:-------------------:|:------------------:|
|
||||||
| ClamAV | `replicas.clamav` | :white_check_mark: | :white_check_mark: |
|
| ClamAV | `replicas.clamav` | :white_check_mark: | :white_check_mark: |
|
||||||
| | `replicas.clamd` | :white_check_mark: | :white_check_mark: |
|
| | `replicas.clamd` | :white_check_mark: | :white_check_mark: |
|
||||||
| | `replicas.freshclam` | :x: | :x: |
|
| | `replicas.freshclam` | :x: | :x: |
|
||||||
| | `replicas.icap` | :white_check_mark: | :white_check_mark: |
|
| | `replicas.icap` | :white_check_mark: | :white_check_mark: |
|
||||||
| | `replicas.milter` | :white_check_mark: | :white_check_mark: |
|
| | `replicas.milter` | :white_check_mark: | :white_check_mark: |
|
||||||
| Collabora | `replicas.collabora` | :white_check_mark: | :gear: |
|
| Collabora | `replicas.collabora` | :white_check_mark: | :gear: |
|
||||||
| CryptPad | `replicas.cryptpad` | :white_check_mark: | :gear: |
|
| CryptPad | `replicas.cryptpad` | :white_check_mark: | :gear: |
|
||||||
| Dovecot | `replicas.dovecot` | :x: | :gear: |
|
| Dovecot | `replicas.dovecot` | :x: | :gear: |
|
||||||
| Element | `replicas.element` | :white_check_mark: | :white_check_mark: |
|
| Element | `replicas.element` | :white_check_mark: | :white_check_mark: |
|
||||||
| | `replicas.matrixNeoBoardWidget` | :white_check_mark: | :gear: |
|
| | `replicas.matrixNeoBoardWidget` | :white_check_mark: | :gear: |
|
||||||
| | `replicas.matrixNeoChoiceWidget` | :white_check_mark: | :gear: |
|
| | `replicas.matrixNeoChoiceWidget` | :white_check_mark: | :gear: |
|
||||||
| | `replicas.matrixNeoDateFixBot` | :white_check_mark: | :gear: |
|
| | `replicas.matrixNeoDateFixBot` | :white_check_mark: | :gear: |
|
||||||
| | `replicas.matrixNeoDateFixWidget` | :white_check_mark: | :gear: |
|
| | `replicas.matrixNeoDateFixWidget` | :white_check_mark: | :gear: |
|
||||||
| | `replicas.matrixUserVerificationService` | :white_check_mark: | :gear: |
|
| | `replicas.matrixUserVerificationService` | :white_check_mark: | :gear: |
|
||||||
| | `replicas.synapse` | :x: | :gear: |
|
| | `replicas.synapse` | :x: | :gear: |
|
||||||
| | `replicas.synapseWeb` | :white_check_mark: | :white_check_mark: |
|
| | `replicas.synapseWeb` | :white_check_mark: | :white_check_mark: |
|
||||||
| | `replicas.wellKnown` | :white_check_mark: | :white_check_mark: |
|
| | `replicas.wellKnown` | :white_check_mark: | :white_check_mark: |
|
||||||
| Jitsi | `replicas.jibri` | :white_check_mark: | :gear: |
|
| Intercom Service | `replicas.intercomService` | :white_check_mark: | :gear: |
|
||||||
| | `replicas.jicofo` | :white_check_mark: | :gear: |
|
| Jitsi | `replicas.jibri` | :white_check_mark: | :gear: |
|
||||||
| | `replicas.jitsi ` | :white_check_mark: | :gear: |
|
| | `replicas.jicofo` | :white_check_mark: | :gear: |
|
||||||
| | `replicas.jitsiKeycloakAdapter` | :white_check_mark: | :gear: |
|
| | `replicas.jitsi ` | :white_check_mark: | :gear: |
|
||||||
| | `replicas.jvb ` | :x: | :x: |
|
| | `replicas.jitsiKeycloakAdapter` | :white_check_mark: | :gear: |
|
||||||
| Keycloak | `replicas.keycloak` | :white_check_mark: | :gear: |
|
| | `replicas.jvb ` | :x: | :x: |
|
||||||
| Minio | `replicas.minioDistributed` | :white_check_mark: | :white_check_mark: |
|
| Keycloak | `replicas.keycloak` | :white_check_mark: | :gear: |
|
||||||
| Nextcloud | `replicas.nextcloud` | :white_check_mark: | :gear: |
|
| Memcached | `replicas.memcached` | :gear: | :gear: |
|
||||||
| OpenProject | `replicas.openproject` | :white_check_mark: | :white_check_mark: |
|
| Minio | `replicas.minioDistributed` | :white_check_mark: | :white_check_mark: |
|
||||||
| Postfix | `replicas.postfix` | :x: | :gear: |
|
| Nextcloud | `replicas.nextcloudApache2` | :white_check_mark: | :white_check_mark: |
|
||||||
| XWiki | `replicas.xwiki` | :x: | :gear: |
|
| | `replicas.nextcloudExporter` | :white_check_mark: | :white_check_mark: |
|
||||||
|
| | `replicas.nextcloudPHP` | :white_check_mark: | :white_check_mark: |
|
||||||
|
| OpenProject | `replicas.openproject` | :white_check_mark: | :white_check_mark: |
|
||||||
|
| Postfix | `replicas.postfix` | :x: | :gear: |
|
||||||
|
| Redis | `replicas.redis` | :gear: | :gear: |
|
||||||
|
| XWiki | `replicas.xwiki` | :x: | :gear: |
|
||||||
|
|||||||
167
docs/security.md
167
docs/security.md
@@ -15,104 +15,89 @@ This document should cover the current status of security measurements.
|
|||||||
|
|
||||||
# Helm Chart Trust Chain
|
# Helm Chart Trust Chain
|
||||||
|
|
||||||
Helm Charts which are released via openDesk CI/CD process are always signed. The public GPG keys are present in
|
Helm charts are signed and validated against GPG keys which could be found in `helmfile/files/gpg-pubkeys`.
|
||||||
`pubkey.gpg` file and are validated during helmfile installation.
|
|
||||||
|
|
||||||
| Repository | OCI | Verifiable |
|
All charts except these are verifiable:
|
||||||
|--------------------------------------|:---:|:------------------:|
|
|
||||||
| bitnami-repo (openDesk build) | yes | :white_check_mark: |
|
| Repository | Verifiable |
|
||||||
| clamav-repo | yes | :white_check_mark: |
|
|-------------------|:----------:|
|
||||||
| collabora-online-repo | no | :x: |
|
| collabora-repo | no |
|
||||||
| cryptpad-online-repo | no | :x: |
|
| open-xchange-repo | no |
|
||||||
| intercom-service-repo | yes | :white_check_mark: |
|
|
||||||
| istio-resources-repo | yes | :white_check_mark: |
|
|
||||||
| jitsi-repo | yes | :white_check_mark: |
|
|
||||||
| keycloak-extensions-repo | no | :x: |
|
|
||||||
| mariadb-repo | yes | :white_check_mark: |
|
|
||||||
| nextcloud-repo | no | :x: |
|
|
||||||
| opendesk-certificates-repo | yes | :white_check_mark: |
|
|
||||||
| opendesk-dovecot-repo | yes | :white_check_mark: |
|
|
||||||
| opendesk-element-repo | yes | :white_check_mark: |
|
|
||||||
| opendesk-keycloak-bootstrap-repo | yes | :white_check_mark: |
|
|
||||||
| opendesk-nextcloud-bootstrap-repo | yes | :white_check_mark: |
|
|
||||||
| opendesk-open-xchange-bootstrap-repo | yes | :white_check_mark: |
|
|
||||||
| openproject-repo | yes | :white_check_mark: |
|
|
||||||
| openxchange-repo | yes | :x: |
|
|
||||||
| ox-connector-repo | no | :x: |
|
|
||||||
| postfix-repo | yes | :white_check_mark: |
|
|
||||||
| postgresql-repo | yes | :white_check_mark: |
|
|
||||||
| ums-repo | no | :x: |
|
|
||||||
| univention-keycloak-repo | yes | :white_check_mark: |
|
|
||||||
| univention-keycloak-bootstrap-repo | yes | :white_check_mark: |
|
|
||||||
| xwiki-repo | no | :x: |
|
|
||||||
|
|
||||||
# Kubernetes Security Enforcements
|
# Kubernetes Security Enforcements
|
||||||
|
|
||||||
This list gives you an overview of default security settings and if they comply with security standards:
|
This list gives you an overview of default security settings and if they comply with security standards:
|
||||||
|
|
||||||
|
|
||||||
| Component | Process | = | allowPrivilegeEscalation (`false`) | capabilities (`drop: ALL`) | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
|
| Component | Process | = | allowPrivilegeEscalation (`false`) | capabilities (`drop: ALL`) | seccompProfile (`RuntimeDefault`) | readOnlyRootFilesystem (`true`) | runAsNonRoot (`true`) | runAsUser | runAsGroup | fsGroup |
|
||||||
|-----------------------------|------------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
|
|-----------------------------|-------------------------------|:------------------:|:----------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------:|:---------------------------------:|:-------------------------------:|:---------------------:|:---------:|:----------:|:-------:|
|
||||||
| ClamAV | clamd | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
| ClamAV | clamd | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||||
| | freshclam | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
| | freshclam | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||||
| | icap | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
| | icap | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||||
| | milter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
| | milter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 100 | 101 | 101 |
|
||||||
| Collabora | collabora | :x: | :x: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) | :white_check_mark: | :x: | :white_check_mark: | 100 | 101 | 100 |
|
| Collabora | collabora | :x: | :x: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`, `MKNOD`) | :white_check_mark: | :x: | :white_check_mark: | 100 | 101 | 100 |
|
||||||
| CryptPad | npm | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 4001 | 4001 | 4001 |
|
| CryptPad | cryptpad | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 4001 | 4001 | 4001 |
|
||||||
| Dovecot | dovecot | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `KILL`, `NET_BIND_SERVICE`, `SETGID`, `SETUID`, `SYS_CHROOT`) | :white_check_mark: | :white_check_mark: | :x: | - | - | 1000 |
|
| Dovecot | dovecot | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `KILL`, `NET_BIND_SERVICE`, `SETGID`, `SETUID`, `SYS_CHROOT`) | :white_check_mark: | :white_check_mark: | :x: | - | - | 1000 |
|
||||||
| Element | element | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
| Element | element | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
||||||
| | synapse | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 10991 | - | 10991 |
|
| | synapse | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 10991 | - | 10991 |
|
||||||
| | synapseWeb | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
| | synapseWeb | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
||||||
| | wellKnown | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
| | wellKnown | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 101 | 101 | 101 |
|
||||||
| IntercomService | intercom-service | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
| IntercomService | intercom-service | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
||||||
| Jitsi | jibri | :x: | :x: | :x: (`SYS_ADMIN`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| Jitsi | jibri | :x: | :x: | :x: (`SYS_ADMIN`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | jicofo | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
| | jicofo | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | jitsiKeycloakAdapter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1993 | 1993 | - |
|
| | jitsiKeycloakAdapter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1993 | 1993 | - |
|
||||||
| | jvb | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
| | jvb | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | prosody | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
| | prosody | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | web | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
| | web | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| MariaDB | mariadb | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
| MariaDB | mariadb | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||||
| Memcached | memcached | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | - | 1001 |
|
| Memcached | memcached | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | - | 1001 |
|
||||||
| Minio | minio | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
| Minio | minio | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
||||||
| Nextcloud | nextcloud | :x: | :white_check_mark: | :x: (`NET_BIND_SERVICE`, `SETGID`, `SETUID`) | :white_check_mark: | :x: | :x: | - | - | 33 |
|
| Nextcloud | opendesk-nextcloud-apache2 | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 65532 | 65532 | 65532 |
|
||||||
| | nextcloud-cron | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | 33 |
|
| | opendesk-nextcloud-cron | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 65532 | 65532 | 65532 |
|
||||||
| | opendesk-nextcloud-bootstrap | :x: | :white_check_mark: | :x: | :white_check_mark: | :x: | :x: | - | - | 33 |
|
| | opendesk-nextcloud-exporter | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 65532 | 65532 | 65532 |
|
||||||
| Open-Xchange | core-documentconverter | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 987 | 1000 | - |
|
| | opendesk-nextcloud-management | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 65532 | 65532 | 65532 |
|
||||||
| | core-guidedtours | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | opendesk-nextcloud-php | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 65532 | 65532 | 65532 |
|
||||||
| | core-imageconverter | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 987 | 1000 | - |
|
| Open-Xchange | core-documentconverter | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 987 | 1000 | - |
|
||||||
| | core-mw-default | :x: | :x: | :x: | :x: | :x: | :x: | - | - | - |
|
| | core-guidedtours | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| | core-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | core-imageconverter | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 987 | 1000 | - |
|
||||||
| | core-ui-middleware | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | core-mw-default | :x: | :x: | :x: | :x: | :x: | :x: | - | - | - |
|
||||||
| | core-ui-middleware-updater | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | core-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| | core-user-guide | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | core-ui-middleware | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| | gotenberg | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | core-ui-middleware-updater | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| | guard-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | core-user-guide | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| | nextlcoud-integration-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | gotenberg | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| | public-sector-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | guard-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| OpenProject | openproject | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
| | nextlcoud-integration-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| | opendeskOpenprojectBootstrap | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
| | public-sector-ui | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| Postfix | postfix | :x: | :x: | :x: | :white_check_mark: | :x: | :x: | - | - | 101 |
|
| OpenProject | openproject | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
||||||
| PostgreSQL | postgresql | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
| | opendeskOpenprojectBootstrap | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
||||||
| Redis | redis | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 0 | 1001 |
|
| Postfix | postfix | :x: | :x: | :x: | :white_check_mark: | :x: | :x: | - | - | 101 |
|
||||||
| Univention Management Stack | keycloak | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 1000 | 1000 | 1000 |
|
| PostgreSQL | postgresql | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||||
| | keycloakBootstrap | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 1000 | 1000 | 1000 |
|
| Redis | redis | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 0 | 1001 |
|
||||||
| | keycloakExtensionHandler | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| Univention Management Stack | guardian-authorization-api | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | keycloakExtensionProxy | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
| | guardian-management-api | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | ldap-notifier | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
| | guardian-management-ui | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | ldap-server | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| | keycloak | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 1000 | 1000 | 1000 |
|
||||||
| | notifications-api | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
| | keycloak-bootstrap | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 1000 | 1000 | 1000 |
|
||||||
| | opendeskKeycloakBootstrap | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
| | keycloak-extension-handler | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| | portal-frontend | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| | keycloak-extension-proxy | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | - |
|
||||||
| | portal-listener | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| | ldap-notifier | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | portal-server | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| | ldap-server | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | selfservice-listener | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| | notifications-api | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | stack-gateway | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
| | opendesk-keycloak-bootstrap | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1000 | 1000 | 1000 |
|
||||||
| | store-dav | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| | open-policy-agent | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | udm-rest-api | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| | portal-frontend | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | umc-gateway | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| | portal-listener | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | umc-server | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
| | portal-server | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| XWiki | xwiki | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 100 | 101 | 101 |
|
| | provisioning-api | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
| | xwiki initContainers | :x: | :x: | :x: | :white_check_mark: | :x: | :x: | - | - | 101 |
|
| | selfservice-listener | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
|
| | stack-gateway | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: | 1001 | 1001 | 1001 |
|
||||||
|
| | store-dav | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
|
| | udm-rest-api | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
|
| | umc-gateway | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
|
| | umc-server | :x: | :white_check_mark: | :x: (`CHOWN`, `DAC_OVERRIDE`, `FOWNER`, `FSETID`, `KILL`, `SETGID`, `SETUID`, `SETPCAP`, `NET_BIND_SERVICE`, `NET_RAW`, `SYS_CHROOT`) | :white_check_mark: | :x: | :x: | - | - | - |
|
||||||
|
| XWiki | xwiki | :x: | :white_check_mark: | :white_check_mark: | :white_check_mark: | :x: | :white_check_mark: | 100 | 101 | 101 |
|
||||||
|
| | xwiki initContainers | :x: | :x: | :x: | :white_check_mark: | :x: | :x: | - | - | 101 |
|
||||||
|
|
||||||
# NetworkPolicies
|
# NetworkPolicies
|
||||||
|
|
||||||
|
|||||||
@@ -53,7 +53,5 @@ theme:
|
|||||||
# Known limits
|
# Known limits
|
||||||
|
|
||||||
Not all applications support theming. Known exceptions are:
|
Not all applications support theming. Known exceptions are:
|
||||||
- Univention Corporate Container (should be superseded by the Univention Management Stack which has planned support
|
|
||||||
for theming through the deployment).
|
|
||||||
- OpenProject
|
- OpenProject
|
||||||
- Jitsi
|
- Jitsi
|
||||||
|
|||||||
@@ -84,7 +84,7 @@ The below rendering in class diagram notation shows the three component classes
|
|||||||
|
|
||||||
**Note:** The methods prefixed with '-' are not yet available in `gitlab-config` you will learn about them later.
|
**Note:** The methods prefixed with '-' are not yet available in `gitlab-config` you will learn about them later.
|
||||||
|
|
||||||
```Mermaid
|
```mermaid
|
||||||
classDiagram
|
classDiagram
|
||||||
Images <|-- Helm_charts
|
Images <|-- Helm_charts
|
||||||
Images <|-- Helmfile_based_deployment_automation
|
Images <|-- Helmfile_based_deployment_automation
|
||||||
|
|||||||
@@ -1,261 +0,0 @@
|
|||||||
{{/*
|
|
||||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
SPDX-License-Identifier: Apache-2.0
|
|
||||||
*/}}
|
|
||||||
---
|
|
||||||
charts:
|
|
||||||
certificates:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
password: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
clamav:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
clamavSimple:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
collabora:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
cryptpad:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
dovecot:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
element:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
elementWellKnown:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
intercomService:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
istioResources:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
jitsi:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsKeycloak:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsKeycloakBootstrap:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
opendeskKeycloakBootstrap:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsKeycloakExtensions:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
mariadb:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
matrixNeoboardWidget:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
matrixNeochoiseWidget:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
matrixNeodatefixBot:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
matrixNeodatefixWidget:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
matrixUserVerificationService:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
memcached:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
minio:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
nextcloud:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
nextcloudBootstrap:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
nginx:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
openproject:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
openprojectBootstrap:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
openXchangeAppSuite:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
openXchangeAppSuiteBootstrap:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
otterize:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
oxConnector:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
postfix:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
postgresql:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
redis:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
synapse:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
synapseCreateAccount:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
synapseWeb:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_OCI_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsLdapNotifier:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsLdapServer:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsNotificationsApi:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsPortalFrontend:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsPortalListener:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsPortalServer:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsStackDataSwp:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsStackDataUms:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsStoreDav:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsUdmRestApi:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsUmcGateway:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
umsUmcServer:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
|
|
||||||
xwiki:
|
|
||||||
registry: {{ requiredEnv "OD_PRIVATE_HELM_HTTP_REGISTRY" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_USERNAME" | quote }}
|
|
||||||
username: {{ env "OD_PRIVATE_HELM_REGISTRY_PASSWORD" | quote }}
|
|
||||||
...
|
|
||||||
@@ -37,18 +37,15 @@ environments:
|
|||||||
values:
|
values:
|
||||||
- "helmfile/environments/default/*.gotmpl"
|
- "helmfile/environments/default/*.gotmpl"
|
||||||
- "helmfile/environments/default/*.yaml"
|
- "helmfile/environments/default/*.yaml"
|
||||||
- "helmfile/environments/dev/values.yaml"
|
- "helmfile/environments/dev/values.yaml.gotmpl"
|
||||||
- "helmfile/environments/dev/values.gotmpl"
|
|
||||||
test:
|
test:
|
||||||
values:
|
values:
|
||||||
- "helmfile/environments/default/*.gotmpl"
|
- "helmfile/environments/default/*.gotmpl"
|
||||||
- "helmfile/environments/default/*.yaml"
|
- "helmfile/environments/default/*.yaml"
|
||||||
- "helmfile/environments/test/values.yaml"
|
- "helmfile/environments/test/values.yaml.gotmpl"
|
||||||
- "helmfile/environments/test/values.gotmpl"
|
|
||||||
prod:
|
prod:
|
||||||
values:
|
values:
|
||||||
- "helmfile/environments/default/*.gotmpl"
|
- "helmfile/environments/default/*.gotmpl"
|
||||||
- "helmfile/environments/default/*.yaml"
|
- "helmfile/environments/default/*.yaml"
|
||||||
- "helmfile/environments/prod/values.yaml"
|
- "helmfile/environments/prod/values.yaml.gotmpl"
|
||||||
- "helmfile/environments/prod/values.gotmpl"
|
|
||||||
...
|
...
|
||||||
|
|||||||
@@ -8,18 +8,18 @@ repositories:
|
|||||||
# Collabora Online
|
# Collabora Online
|
||||||
# Source: https://github.com/CollaboraOnline/online
|
# Source: https://github.com/CollaboraOnline/online
|
||||||
- name: "collabora-online-repo"
|
- name: "collabora-online-repo"
|
||||||
username: {{ .Values.charts.collabora.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.collabora.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
oci: {{ .Values.charts.collabora.oci }}
|
oci: true
|
||||||
url: "{{ .Values.charts.collabora.registry }}/{{ .Values.charts.collabora.repository }}"
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.collabora.registry }}/\
|
||||||
|
{{ .Values.charts.collabora.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "collabora-online"
|
- name: "collabora-online"
|
||||||
chart: "collabora-online-repo/{{ .Values.charts.collabora.name }}"
|
chart: "collabora-online-repo/{{ .Values.charts.collabora.name }}"
|
||||||
version: "{{ .Values.charts.collabora.version }}"
|
version: "{{ .Values.charts.collabora.version }}"
|
||||||
values:
|
values:
|
||||||
- "values.yaml"
|
- "values.yaml.gotmpl"
|
||||||
- "values.gotmpl"
|
|
||||||
installed: {{ .Values.collabora.enabled }}
|
installed: {{ .Values.collabora.enabled }}
|
||||||
|
|
||||||
commonLabels:
|
commonLabels:
|
||||||
|
|||||||
@@ -1,59 +0,0 @@
|
|||||||
{{/*
|
|
||||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
SPDX-License-Identifier: Apache-2.0
|
|
||||||
*/}}
|
|
||||||
---
|
|
||||||
image:
|
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.collabora.repository }}"
|
|
||||||
tag: {{ .Values.images.collabora.tag | quote }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
ingress:
|
|
||||||
enabled: {{ .Values.ingress.enabled }}
|
|
||||||
className: {{ .Values.ingress.ingressClassName | quote }}
|
|
||||||
hosts:
|
|
||||||
- host: "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
|
|
||||||
paths:
|
|
||||||
- path: "/"
|
|
||||||
pathType: "Prefix"
|
|
||||||
tls:
|
|
||||||
- secretName: {{ .Values.ingress.tls.secretName | quote }}
|
|
||||||
hosts:
|
|
||||||
- "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
|
|
||||||
|
|
||||||
collabora:
|
|
||||||
# Admin Console Credentials: https://CODE-domain/browser/dist/admin/admin.html
|
|
||||||
username: "collabora-internal-admin"
|
|
||||||
password: {{ .Values.secrets.collabora.adminPassword | quote }}
|
|
||||||
aliasgroups:
|
|
||||||
- host: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}:443"
|
|
||||||
|
|
||||||
replicaCount: {{ .Values.replicas.collabora }}
|
|
||||||
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.collabora | toYaml | nindent 2 }}
|
|
||||||
|
|
||||||
prometheus:
|
|
||||||
servicemonitor:
|
|
||||||
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
|
||||||
labels:
|
|
||||||
{{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
|
|
||||||
rules:
|
|
||||||
enabled: {{ .Values.prometheus.prometheusRules.enabled }}
|
|
||||||
additionalLabels:
|
|
||||||
{{- toYaml .Values.prometheus.prometheusRules.labels | nindent 6 }}
|
|
||||||
|
|
||||||
grafana:
|
|
||||||
dashboards:
|
|
||||||
enabled: {{ .Values.grafana.dashboards.enabled }}
|
|
||||||
labels:
|
|
||||||
{{- toYaml .Values.grafana.dashboards.labels | nindent 6 }}
|
|
||||||
annotations:
|
|
||||||
{{- toYaml .Values.grafana.dashboards.annotations | nindent 6 }}
|
|
||||||
|
|
||||||
...
|
|
||||||
@@ -1,16 +1,37 @@
|
|||||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
{{/*
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
---
|
---
|
||||||
# https://github.com/CollaboraOnline/online/blob/master/kubernetes/helm/README.md or
|
autoscaling:
|
||||||
# https://github.com/CollaboraOnline/online/blob/master/kubernetes/helm/collabora-online/values.yaml
|
enabled: false
|
||||||
|
|
||||||
fullnameOverride: "collabora"
|
|
||||||
|
|
||||||
image:
|
|
||||||
pullPolicy: "IfNotPresent"
|
|
||||||
|
|
||||||
collabora:
|
collabora:
|
||||||
extra_params: "--o:ssl.enable=false --o:ssl.termination=true"
|
extra_params: "--o:ssl.enable=false --o:ssl.termination=true"
|
||||||
|
username: "collabora-internal-admin"
|
||||||
|
password: {{ .Values.secrets.collabora.adminPassword | quote }}
|
||||||
|
aliasgroups:
|
||||||
|
- host: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}:443"
|
||||||
|
|
||||||
|
fullnameOverride: "collabora"
|
||||||
|
|
||||||
|
grafana:
|
||||||
|
dashboards:
|
||||||
|
enabled: {{ .Values.grafana.dashboards.enabled }}
|
||||||
|
labels:
|
||||||
|
{{- toYaml .Values.grafana.dashboards.labels | nindent 6 }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml .Values.grafana.dashboards.annotations | nindent 6 }}
|
||||||
|
|
||||||
|
image:
|
||||||
|
repository: "{{ .Values.global.imageRegistry | default .Values.images.collabora.registry }}/{{ .Values.images.collabora.repository }}"
|
||||||
|
tag: {{ .Values.images.collabora.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
ingress:
|
ingress:
|
||||||
annotations:
|
annotations:
|
||||||
@@ -50,11 +71,35 @@ ingress:
|
|||||||
acl admin_url path_beg /cool/adminws/
|
acl admin_url path_beg /cool/adminws/
|
||||||
acl admin_url path_beg /browser/dist/admin/admin.html
|
acl admin_url path_beg /browser/dist/admin/admin.html
|
||||||
http-request deny if admin_url
|
http-request deny if admin_url
|
||||||
autoscaling:
|
enabled: {{ .Values.ingress.enabled }}
|
||||||
enabled: false
|
className: {{ .Values.ingress.ingressClassName | quote }}
|
||||||
|
hosts:
|
||||||
|
- host: "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
|
||||||
|
paths:
|
||||||
|
- path: "/"
|
||||||
|
pathType: "Prefix"
|
||||||
|
tls:
|
||||||
|
- secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||||
|
hosts:
|
||||||
|
- "{{ .Values.global.hosts.collabora }}.{{ .Values.global.domain }}"
|
||||||
|
|
||||||
serviceAccount:
|
podSecurityContext:
|
||||||
create: true
|
fsGroup: 100
|
||||||
|
|
||||||
|
prometheus:
|
||||||
|
servicemonitor:
|
||||||
|
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
||||||
|
labels:
|
||||||
|
{{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
|
||||||
|
rules:
|
||||||
|
enabled: {{ .Values.prometheus.prometheusRules.enabled }}
|
||||||
|
additionalLabels:
|
||||||
|
{{- toYaml .Values.prometheus.prometheusRules.labels | nindent 6 }}
|
||||||
|
|
||||||
|
replicaCount: {{ .Values.replicas.collabora }}
|
||||||
|
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.collabora | toYaml | nindent 2 }}
|
||||||
|
|
||||||
securityContext:
|
securityContext:
|
||||||
allowPrivilegeEscalation: true
|
allowPrivilegeEscalation: true
|
||||||
@@ -82,6 +127,6 @@ securityContext:
|
|||||||
- "SYS_CHROOT"
|
- "SYS_CHROOT"
|
||||||
- "MKNOD"
|
- "MKNOD"
|
||||||
|
|
||||||
podSecurityContext:
|
serviceAccount:
|
||||||
fsGroup: 100
|
create: true
|
||||||
...
|
...
|
||||||
@@ -8,10 +8,12 @@ repositories:
|
|||||||
# CryptPad
|
# CryptPad
|
||||||
# Source: https://github.com/cryptpad/helm
|
# Source: https://github.com/cryptpad/helm
|
||||||
- name: "cryptpad-repo"
|
- name: "cryptpad-repo"
|
||||||
username: {{ .Values.charts.cryptpad.username | quote }}
|
keyring: "../../files/gpg-pubkeys/xwiki-com.gpg"
|
||||||
password: {{ .Values.charts.cryptpad.password | quote }}
|
verify: {{ .Values.charts.cryptpad.verify }}
|
||||||
oci: {{ .Values.charts.cryptpad.oci }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
url: "{{ .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.cryptpad.registry }}/{{ .Values.charts.cryptpad.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "cryptpad"
|
- name: "cryptpad"
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
image:
|
image:
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.cryptpad.repository }}"
|
repository: "{{ .Values.global.imageRegistry | default .Values.images.cryptpad.registry }}/{{ .Values.images.cryptpad.repository }}"
|
||||||
tag: {{ .Values.images.cryptpad.tag | quote }}
|
tag: {{ .Values.images.cryptpad.tag | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -8,79 +8,79 @@ repositories:
|
|||||||
# openDesk Element
|
# openDesk Element
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-element
|
||||||
- name: "element-repo"
|
- name: "element-repo"
|
||||||
oci: {{ .Values.charts.element.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.element.verify }}
|
verify: {{ .Values.charts.element.verify }}
|
||||||
username: {{ .Values.charts.element.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.element.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.element.registry }}/{{ .Values.charts.element.repository }}"
|
||||||
- name: "element-well-known-repo"
|
- name: "element-well-known-repo"
|
||||||
oci: {{ .Values.charts.elementWellKnown.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.elementWellKnown.verify }}
|
verify: {{ .Values.charts.elementWellKnown.verify }}
|
||||||
username: {{ .Values.charts.elementWellKnown.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.elementWellKnown.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.elementWellKnown.registry }}/{{ .Values.charts.elementWellKnown.repository }}"
|
||||||
- name: "synapse-web-repo"
|
- name: "synapse-web-repo"
|
||||||
oci: {{ .Values.charts.synapseWeb.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.synapseWeb.verify }}
|
verify: {{ .Values.charts.synapseWeb.verify }}
|
||||||
username: {{ .Values.charts.synapseWeb.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.synapseWeb.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.synapseWeb.registry }}/{{ .Values.charts.synapseWeb.repository }}"
|
||||||
- name: "synapse-repo"
|
- name: "synapse-repo"
|
||||||
oci: {{ .Values.charts.synapse.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.synapse.verify }}
|
verify: {{ .Values.charts.synapse.verify }}
|
||||||
username: {{ .Values.charts.synapse.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.synapse.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.synapse.registry }}/{{ .Values.charts.synapse.repository }}"
|
||||||
- name: "synapse-create-account-repo"
|
- name: "synapse-create-account-repo"
|
||||||
oci: {{ .Values.charts.synapseCreateAccount.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.synapseCreateAccount.verify }}
|
verify: {{ .Values.charts.synapseCreateAccount.verify }}
|
||||||
username: {{ .Values.charts.synapseCreateAccount.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.synapseCreateAccount.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.synapseCreateAccount.registry }}/{{ .Values.charts.synapseCreateAccount.repository }}"
|
||||||
|
|
||||||
# openDesk Matrix Widgets
|
# openDesk Matrix Widgets
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-matrix-widgets
|
||||||
- name: "matrix-user-verification-service-repo"
|
- name: "matrix-user-verification-service-repo"
|
||||||
oci: {{ .Values.charts.matrixUserVerificationService.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.matrixUserVerificationService.verify }}
|
verify: {{ .Values.charts.matrixUserVerificationService.verify }}
|
||||||
username: {{ .Values.charts.matrixUserVerificationService.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.matrixUserVerificationService.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.matrixUserVerificationService.registry }}/\
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixUserVerificationService.registry }}/\
|
||||||
{{ .Values.charts.matrixUserVerificationService.repository }}"
|
{{ .Values.charts.matrixUserVerificationService.repository }}"
|
||||||
- name: "matrix-neoboard-widget-repo"
|
- name: "matrix-neoboard-widget-repo"
|
||||||
oci: {{ .Values.charts.matrixNeoboardWidget.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
|
verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
|
||||||
username: {{ .Values.charts.matrixNeoboardWidget.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.matrixNeoboardWidget.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
|
||||||
- name: "matrix-neochoice-widget-repo"
|
- name: "matrix-neochoice-widget-repo"
|
||||||
oci: {{ .Values.charts.matrixNeoboardWidget.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
|
verify: {{ .Values.charts.matrixNeoboardWidget.verify }}
|
||||||
username: {{ .Values.charts.matrixNeoboardWidget.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.matrixNeoboardWidget.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixNeoboardWidget.registry }}/{{ .Values.charts.matrixNeoboardWidget.repository }}"
|
||||||
- name: "matrix-neodatefix-widget-repo"
|
- name: "matrix-neodatefix-widget-repo"
|
||||||
oci: {{ .Values.charts.matrixNeodatefixWidget.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
|
verify: {{ .Values.charts.matrixNeodatefixWidget.verify }}
|
||||||
username: {{ .Values.charts.matrixNeodatefixWidget.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.matrixNeodatefixWidget.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixNeodatefixWidget.registry }}/{{ .Values.charts.matrixNeodatefixWidget.repository }}"
|
||||||
- name: "matrix-neodatefix-bot-repo"
|
- name: "matrix-neodatefix-bot-repo"
|
||||||
oci: {{ .Values.charts.matrixNeodatefixBot.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
|
verify: {{ .Values.charts.matrixNeodatefixBot.verify }}
|
||||||
username: {{ .Values.charts.matrixNeodatefixBot.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.matrixNeodatefixBot.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.matrixNeodatefixBot.registry }}/{{ .Values.charts.matrixNeodatefixBot.repository }}"
|
||||||
|
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -108,7 +107,7 @@ configuration:
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.element.registry | quote }}
|
||||||
repository: {{ .Values.images.element.repository | quote }}
|
repository: {{ .Values.images.element.repository | quote }}
|
||||||
tag: {{ .Values.images.element.tag | quote }}
|
tag: {{ .Values.images.element.tag | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -13,6 +12,7 @@ global:
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoBoardWidget.registry | quote }}
|
||||||
repository: {{ .Values.images.matrixNeoBoardWidget.repository | quote }}
|
repository: {{ .Values.images.matrixNeoBoardWidget.repository | quote }}
|
||||||
tag: {{ .Values.images.matrixNeoBoardWidget.tag | quote }}
|
tag: {{ .Values.images.matrixNeoBoardWidget.tag | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -13,6 +12,7 @@ global:
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoChoiceWidget.registry | quote }}
|
||||||
repository: {{ .Values.images.matrixNeoChoiceWidget.repository | quote }}
|
repository: {{ .Values.images.matrixNeoChoiceWidget.repository | quote }}
|
||||||
tag: {{ .Values.images.matrixNeoChoiceWidget.tag | quote }}
|
tag: {{ .Values.images.matrixNeoChoiceWidget.tag | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
@@ -16,7 +15,7 @@ configuration:
|
|||||||
password: {{ .Values.secrets.matrixNeoDateFixBot.password | quote }}
|
password: {{ .Values.secrets.matrixNeoDateFixBot.password | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
|
||||||
url: {{ .Values.images.synapseCreateUser.repository | quote }}
|
url: {{ .Values.images.synapseCreateUser.repository | quote }}
|
||||||
tag: {{ .Values.images.synapseCreateUser.tag | quote }}
|
tag: {{ .Values.images.synapseCreateUser.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -16,6 +15,7 @@ configuration:
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixBot.registry | quote }}
|
||||||
repository: {{ .Values.images.matrixNeoDateFixBot.repository | quote }}
|
repository: {{ .Values.images.matrixNeoDateFixBot.repository | quote }}
|
||||||
tag: {{ .Values.images.matrixNeoDateFixBot.tag | quote }}
|
tag: {{ .Values.images.matrixNeoDateFixBot.tag | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -13,6 +12,7 @@ global:
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.matrixNeoDateFixWidget.registry | quote }}
|
||||||
repository: {{ .Values.images.matrixNeoDateFixWidget.repository | quote }}
|
repository: {{ .Values.images.matrixNeoDateFixWidget.repository | quote }}
|
||||||
tag: {{ .Values.images.matrixNeoDateFixWidget.tag | quote }}
|
tag: {{ .Values.images.matrixNeoDateFixWidget.tag | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
@@ -16,7 +15,7 @@ configuration:
|
|||||||
password: {{ .Values.secrets.matrixUserVerificationService.password | quote }}
|
password: {{ .Values.secrets.matrixUserVerificationService.password | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.synapseCreateUser.registry | quote }}
|
||||||
url: {{ .Values.images.synapseCreateUser.repository | quote }}
|
url: {{ .Values.images.synapseCreateUser.repository | quote }}
|
||||||
tag: {{ .Values.images.synapseCreateUser.tag | quote }}
|
tag: {{ .Values.images.synapseCreateUser.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -13,6 +12,7 @@ global:
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.matrixUserVerificationService.registry | quote }}
|
||||||
repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
|
repository: {{ .Values.images.matrixUserVerificationService.repository | quote }}
|
||||||
tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}
|
tag: {{ .Values.images.matrixUserVerificationService.tag | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -13,7 +12,7 @@ global:
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.synapseWeb.registry | quote }}
|
||||||
repository: {{ .Values.images.synapseWeb.repository | quote }}
|
repository: {{ .Values.images.synapseWeb.repository | quote }}
|
||||||
tag: {{ .Values.images.synapseWeb.tag | quote }}
|
tag: {{ .Values.images.synapseWeb.tag | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -13,7 +12,7 @@ global:
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.synapse.registry | quote }}
|
||||||
repository: {{ .Values.images.synapse.repository | quote }}
|
repository: {{ .Values.images.synapse.repository | quote }}
|
||||||
tag: {{ .Values.images.synapse.tag | quote }}
|
tag: {{ .Values.images.synapse.tag | quote }}
|
||||||
|
|
||||||
@@ -56,7 +55,7 @@ configuration:
|
|||||||
guestModule:
|
guestModule:
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.synapseGuestModule.registry | quote }}
|
||||||
repository: {{ .Values.images.synapseGuestModule.repository | quote }}
|
repository: {{ .Values.images.synapseGuestModule.repository | quote }}
|
||||||
tag: {{ .Values.images.synapseGuestModule.tag | quote }}
|
tag: {{ .Values.images.synapseGuestModule.tag | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -44,4 +44,9 @@ containerSecurityContext:
|
|||||||
podSecurityContext:
|
podSecurityContext:
|
||||||
enabled: true
|
enabled: true
|
||||||
fsGroup: 10991
|
fsGroup: 10991
|
||||||
|
|
||||||
|
readinessProbe:
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 5
|
||||||
|
|
||||||
...
|
...
|
||||||
|
|||||||
@@ -5,7 +5,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -13,7 +12,7 @@ global:
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.wellKnown.registry | quote }}
|
||||||
repository: {{ .Values.images.wellKnown.repository | quote }}
|
repository: {{ .Values.images.wellKnown.repository | quote }}
|
||||||
tag: {{ .Values.images.wellKnown.tag | quote }}
|
tag: {{ .Values.images.wellKnown.tag | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -8,12 +8,12 @@ repositories:
|
|||||||
# Intercom Service
|
# Intercom Service
|
||||||
# Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
|
# Source: https://gitlab.souvap-univention.de/souvap/tooling/charts/intercom-service
|
||||||
- name: "intercom-service-repo"
|
- name: "intercom-service-repo"
|
||||||
oci: {{ .Values.charts.intercomService.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
||||||
verify: {{ .Values.charts.intercomService.verify }}
|
verify: {{ .Values.charts.intercomService.verify }}
|
||||||
username: {{ .Values.charts.intercomService.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.intercomService.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.intercomService.registry }}/{{ .Values.charts.intercomService.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "intercom-service"
|
- name: "intercom-service"
|
||||||
|
|||||||
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
@@ -34,12 +33,14 @@ ics:
|
|||||||
port: {{ .Values.cache.intercomService.port }}
|
port: {{ .Values.cache.intercomService.port }}
|
||||||
password: {{ .Values.cache.intercomService.password | default .Values.secrets.redis.password | quote }}
|
password: {{ .Values.cache.intercomService.password | default .Values.secrets.redis.password | quote }}
|
||||||
openxchange:
|
openxchange:
|
||||||
|
oci: true
|
||||||
url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
||||||
audience: "opendesk-oxappsuite"
|
audience: "opendesk-oxappsuite"
|
||||||
nextcloud:
|
nextcloud:
|
||||||
audience: "opendesk-nextcloud"
|
audience: "opendesk-nextcloud"
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.intercom.registry | quote }}
|
||||||
repository: {{ .Values.images.intercom.repository | quote }}
|
repository: {{ .Values.images.intercom.repository | quote }}
|
||||||
tag: {{ .Values.images.intercom.tag | quote }}
|
tag: {{ .Values.images.intercom.tag | quote }}
|
||||||
|
|
||||||
@@ -51,6 +52,8 @@ ingress:
|
|||||||
enabled: {{ .Values.ingress.tls.enabled }}
|
enabled: {{ .Values.ingress.tls.enabled }}
|
||||||
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||||
|
|
||||||
|
replicaCount: {{ .Values.replicas.intercomService }}
|
||||||
|
|
||||||
resources:
|
resources:
|
||||||
{{ .Values.resources.intercomService | toYaml | nindent 2 }}
|
{{ .Values.resources.intercomService | toYaml | nindent 2 }}
|
||||||
...
|
...
|
||||||
|
|||||||
@@ -8,19 +8,19 @@ repositories:
|
|||||||
# openDesk Jitsi
|
# openDesk Jitsi
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-jitsi
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-jitsi
|
||||||
- name: "jitsi-repo"
|
- name: "jitsi-repo"
|
||||||
oci: {{ .Values.charts.jitsi.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.jitsi.verify }}
|
verify: {{ .Values.charts.jitsi.verify }}
|
||||||
username: {{ .Values.charts.jitsi.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.jitsi.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.jitsi.registry }}/{{ .Values.charts.jitsi.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "jitsi"
|
- name: "jitsi"
|
||||||
chart: "jitsi-repo/{{ .Values.charts.jitsi.name }}"
|
chart: "jitsi-repo/{{ .Values.charts.jitsi.name }}"
|
||||||
version: "{{ .Values.charts.jitsi.version }}"
|
version: "{{ .Values.charts.jitsi.version }}"
|
||||||
values:
|
values:
|
||||||
- "values-jitsi.gotmpl"
|
- "values-jitsi.yaml.gotmpl"
|
||||||
installed: {{ .Values.jitsi.enabled }}
|
installed: {{ .Values.jitsi.enabled }}
|
||||||
timeout: 900
|
timeout: 900
|
||||||
|
|
||||||
|
|||||||
@@ -5,18 +5,30 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
enabled: true
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
runAsUser: 1993
|
||||||
|
runAsGroup: 1993
|
||||||
|
runAsNonRoot: true
|
||||||
|
|
||||||
cleanup:
|
cleanup:
|
||||||
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiKeycloakAdapter.registry | quote }}
|
||||||
repository: {{ .Values.images.jitsiKeycloakAdapter.repository | quote }}
|
repository: {{ .Values.images.jitsiKeycloakAdapter.repository | quote }}
|
||||||
tag: {{ .Values.images.jitsiKeycloakAdapter.tag | quote }}
|
tag: {{ .Values.images.jitsiKeycloakAdapter.tag | quote }}
|
||||||
|
|
||||||
@@ -33,7 +45,7 @@ jitsi:
|
|||||||
web:
|
web:
|
||||||
replicaCount: {{ .Values.replicas.jitsi }}
|
replicaCount: {{ .Values.replicas.jitsi }}
|
||||||
image:
|
image:
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jitsi.repository }}"
|
repository: "{{ .Values.global.imageRegistry | default .Values.images.jitsi.registry }}/{{ .Values.images.jitsi.repository }}"
|
||||||
tag: {{ .Values.images.jitsi.tag | quote }}
|
tag: {{ .Values.images.jitsi.tag | quote }}
|
||||||
ingress:
|
ingress:
|
||||||
enabled: {{ .Values.ingress.enabled }}
|
enabled: {{ .Values.ingress.enabled }}
|
||||||
@@ -52,7 +64,7 @@ jitsi:
|
|||||||
{{ .Values.resources.jitsi | toYaml | nindent 6 }}
|
{{ .Values.resources.jitsi | toYaml | nindent 6 }}
|
||||||
prosody:
|
prosody:
|
||||||
image:
|
image:
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.prosody.repository }}"
|
repository: "{{ .Values.global.imageRegistry | default .Values.images.prosody.registry }}/{{ .Values.images.prosody.repository }}"
|
||||||
tag: {{ .Values.images.prosody.tag | quote }}
|
tag: {{ .Values.images.prosody.tag | quote }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
@@ -89,7 +101,7 @@ jitsi:
|
|||||||
jicofo:
|
jicofo:
|
||||||
replicaCount: {{ .Values.replicas.jicofo }}
|
replicaCount: {{ .Values.replicas.jicofo }}
|
||||||
image:
|
image:
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jicofo.repository }}"
|
repository: "{{ .Values.global.imageRegistry | default .Values.images.jicofo.registry }}/{{ .Values.images.jicofo.repository }}"
|
||||||
tag: {{ .Values.images.jicofo.tag | quote }}
|
tag: {{ .Values.images.jicofo.tag | quote }}
|
||||||
xmpp:
|
xmpp:
|
||||||
password: {{ .Values.secrets.jitsi.jicofoAuthPassword | quote }}
|
password: {{ .Values.secrets.jitsi.jicofoAuthPassword | quote }}
|
||||||
@@ -99,7 +111,7 @@ jitsi:
|
|||||||
jvb:
|
jvb:
|
||||||
replicaCount: {{ .Values.replicas.jvb }}
|
replicaCount: {{ .Values.replicas.jvb }}
|
||||||
image:
|
image:
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jvb.repository }}"
|
repository: "{{ .Values.global.imageRegistry | default .Values.images.jvb.registry }}/{{ .Values.images.jvb.repository }}"
|
||||||
tag: {{ .Values.images.jvb.tag | quote }}
|
tag: {{ .Values.images.jvb.tag | quote }}
|
||||||
xmpp:
|
xmpp:
|
||||||
password: {{ .Values.secrets.jitsi.jvbAuthPassword | quote }}
|
password: {{ .Values.secrets.jitsi.jvbAuthPassword | quote }}
|
||||||
@@ -110,7 +122,7 @@ jitsi:
|
|||||||
jibri:
|
jibri:
|
||||||
replicaCount: {{ .Values.replicas.jibri }}
|
replicaCount: {{ .Values.replicas.jibri }}
|
||||||
image:
|
image:
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.jibri.repository }}"
|
repository: "{{ .Values.global.imageRegistry | default .Values.images.jibri.registry }}/{{ .Values.images.jibri.repository }}"
|
||||||
tag: {{ .Values.images.jibri.tag | quote }}
|
tag: {{ .Values.images.jibri.tag | quote }}
|
||||||
recorder:
|
recorder:
|
||||||
password: {{ .Values.secrets.jitsi.jibriRecorderPassword | quote }}
|
password: {{ .Values.secrets.jitsi.jibriRecorderPassword | quote }}
|
||||||
@@ -127,9 +139,13 @@ patchJVB:
|
|||||||
configuration:
|
configuration:
|
||||||
staticLoadbalancerIP: {{ .Values.cluster.networking.ingressGatewayIP | quote }}
|
staticLoadbalancerIP: {{ .Values.cluster.networking.ingressGatewayIP | quote }}
|
||||||
loadbalancerStatusField: {{ .Values.cluster.networking.loadBalancerStatusField | quote }}
|
loadbalancerStatusField: {{ .Values.cluster.networking.loadBalancerStatusField | quote }}
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
enabled: true
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
image:
|
image:
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.jitsiPatchJVB.registry | quote }}
|
||||||
repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
|
repository: {{ .Values.images.jitsiPatchJVB.repository | quote }}
|
||||||
tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
|
tag: {{ .Values.images.jitsiPatchJVB.tag | quote }}
|
||||||
replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}
|
replicaCount: {{ .Values.replicas.jitsiKeycloakAdapter }}
|
||||||
@@ -5,46 +5,41 @@ bases:
|
|||||||
- "../../bases/environments.yaml"
|
- "../../bases/environments.yaml"
|
||||||
---
|
---
|
||||||
repositories:
|
repositories:
|
||||||
# openDesk Keycloak Bootstrap
|
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/sovereign-workplace-nextcloud-bootstrap
|
|
||||||
- name: "nextcloud-bootstrap-repo"
|
|
||||||
oci: {{ .Values.charts.nextcloudBootstrap.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
|
||||||
verify: {{ .Values.charts.nextcloudBootstrap.verify }}
|
|
||||||
username: {{ .Values.charts.nextcloudBootstrap.username | quote }}
|
|
||||||
password: {{ .Values.charts.nextcloudBootstrap.password | quote }}
|
|
||||||
url: "{{ .Values.charts.nextcloudBootstrap.registry }}/{{ .Values.charts.nextcloudBootstrap.repository }}"
|
|
||||||
|
|
||||||
# Nextcloud
|
# Nextcloud
|
||||||
# Source: https://github.com/nextcloud/helm/
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-nextcloud
|
||||||
|
- name: "nextcloud-management-repo"
|
||||||
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
|
verify: {{ .Values.charts.nextcloudManagement.verify }}
|
||||||
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.nextcloudManagement.registry }}/{{ .Values.charts.nextcloudManagement.repository }}"
|
||||||
- name: "nextcloud-repo"
|
- name: "nextcloud-repo"
|
||||||
oci: {{ .Values.charts.nextcloud.oci }}
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
username: {{ .Values.charts.nextcloud.username | quote }}
|
verify: {{ .Values.charts.nextcloud.verify }}
|
||||||
password: {{ .Values.charts.nextcloud.password | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
url: "{{ .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.nextcloud.registry }}/{{ .Values.charts.nextcloud.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "opendesk-nextcloud-bootstrap"
|
- name: "opendesk-nextcloud-management"
|
||||||
chart: "nextcloud-bootstrap-repo/{{ .Values.charts.nextcloudBootstrap.name }}"
|
chart: "nextcloud-repo/{{ .Values.charts.nextcloudManagement.name }}"
|
||||||
version: "{{ .Values.charts.nextcloudBootstrap.version }}"
|
version: "{{ .Values.charts.nextcloudManagement.version }}"
|
||||||
wait: true
|
|
||||||
waitForJobs: true
|
|
||||||
values:
|
values:
|
||||||
- "values-bootstrap.gotmpl"
|
- "values-nextcloud-mgmt.yaml.gotmpl"
|
||||||
- "values-bootstrap.yaml"
|
waitForJobs: true
|
||||||
|
wait: true
|
||||||
installed: {{ .Values.nextcloud.enabled }}
|
installed: {{ .Values.nextcloud.enabled }}
|
||||||
timeout: 900
|
timeout: 900
|
||||||
|
- name: "opendesk-nextcloud"
|
||||||
- name: "nextcloud"
|
|
||||||
chart: "nextcloud-repo/{{ .Values.charts.nextcloud.name }}"
|
chart: "nextcloud-repo/{{ .Values.charts.nextcloud.name }}"
|
||||||
version: "{{ .Values.charts.nextcloud.version }}"
|
version: "{{ .Values.charts.nextcloud.version }}"
|
||||||
needs:
|
|
||||||
- "opendesk-nextcloud-bootstrap"
|
|
||||||
values:
|
values:
|
||||||
- "values-nextcloud.gotmpl"
|
- "values-nextcloud.yaml.gotmpl"
|
||||||
- "values-nextcloud.yaml"
|
needs:
|
||||||
|
- "opendesk-nextcloud-management"
|
||||||
installed: {{ .Values.nextcloud.enabled }}
|
installed: {{ .Values.nextcloud.enabled }}
|
||||||
timeout: 900
|
|
||||||
|
|
||||||
commonLabels:
|
commonLabels:
|
||||||
deploy-stage: "component-1"
|
deploy-stage: "component-1"
|
||||||
|
|||||||
@@ -1,82 +0,0 @@
|
|||||||
{{/*
|
|
||||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
SPDX-License-Identifier: Apache-2.0
|
|
||||||
*/}}
|
|
||||||
---
|
|
||||||
global:
|
|
||||||
domain: {{ .Values.global.domain | quote }}
|
|
||||||
istioDomain: {{ .Values.istio.domain | quote }}
|
|
||||||
hosts:
|
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
|
||||||
|
|
||||||
config:
|
|
||||||
administrator:
|
|
||||||
password: {{ .Values.secrets.nextcloud.adminPassword | quote }}
|
|
||||||
|
|
||||||
antivirus:
|
|
||||||
{{- if .Values.clamavDistributed.enabled }}
|
|
||||||
host: "clamav-icap"
|
|
||||||
{{- else if .Values.clamavSimple.enabled }}
|
|
||||||
host: "clamav-simple"
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
apps:
|
|
||||||
integrationSwp:
|
|
||||||
password: {{ .Values.secrets.centralnavigation.apiKey | quote }}
|
|
||||||
userOidc:
|
|
||||||
password: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
|
|
||||||
realm: {{ .Values.platform.realm }}
|
|
||||||
|
|
||||||
database:
|
|
||||||
host: {{ .Values.databases.nextcloud.host | quote }}
|
|
||||||
name: {{ .Values.databases.nextcloud.name | quote }}
|
|
||||||
user: {{ .Values.databases.nextcloud.username | quote }}
|
|
||||||
password: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
|
|
||||||
|
|
||||||
ldapSearch:
|
|
||||||
host: {{ .Values.ldap.host | quote }}
|
|
||||||
password: {{ .Values.secrets.univentionManagementStack.ldapSearch.nextcloud | quote }}
|
|
||||||
|
|
||||||
serverinfo:
|
|
||||||
token: {{ .Values.secrets.nextcloud.metricsToken | quote }}
|
|
||||||
|
|
||||||
smtp:
|
|
||||||
host: {{ .Values.smtp.host | quote }}
|
|
||||||
port: {{ .Values.smtp.port | quote }}
|
|
||||||
username: {{ .Values.smtp.username | quote }}
|
|
||||||
password: {{ .Values.smtp.password | quote }}
|
|
||||||
|
|
||||||
cleanup:
|
|
||||||
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
|
||||||
deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
|
|
||||||
keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
|
|
||||||
|
|
||||||
image:
|
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
repository: {{ .Values.images.nextcloud.repository | quote }}
|
|
||||||
tag: {{ .Values.images.nextcloud.tag | quote }}
|
|
||||||
|
|
||||||
persistence:
|
|
||||||
{{- if .Values.cluster.persistence.readWriteMany.enabled }}
|
|
||||||
accessModes:
|
|
||||||
- "ReadWriteMany"
|
|
||||||
storageClass: {{ .Values.persistence.storageClassNames.RWX | quote }}
|
|
||||||
{{- else }}
|
|
||||||
accessModes:
|
|
||||||
- "ReadWriteOnce"
|
|
||||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
|
||||||
{{- end }}
|
|
||||||
size:
|
|
||||||
main: {{ .Values.persistence.size.nextcloud.main | quote }}
|
|
||||||
data: {{ .Values.persistence.size.nextcloud.data | quote }}
|
|
||||||
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.nextcloud | toYaml | nindent 2 }}
|
|
||||||
|
|
||||||
theme:
|
|
||||||
{{ .Values.theme | toYaml | nindent 2 }}
|
|
||||||
...
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
---
|
|
||||||
config:
|
|
||||||
administrator:
|
|
||||||
username: "nextcloud"
|
|
||||||
|
|
||||||
apps:
|
|
||||||
integrationSwp:
|
|
||||||
username: "opendesk_username"
|
|
||||||
userOidc:
|
|
||||||
username: "opendesk-nextcloud"
|
|
||||||
userIdAttribute: "opendesk_useruuid"
|
|
||||||
|
|
||||||
cryptpad:
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
containerSecurityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
enabled: true
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
readOnlyRootFilesystem: false
|
|
||||||
runAsNonRoot: false
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
enabled: true
|
|
||||||
fsGroup: 33
|
|
||||||
fsGroupChangePolicy: "Always"
|
|
||||||
...
|
|
||||||
98
helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
Normal file
98
helmfile/apps/nextcloud/values-nextcloud-mgmt.yaml.gotmpl
Normal file
@@ -0,0 +1,98 @@
|
|||||||
|
{{/*
|
||||||
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
|
---
|
||||||
|
global:
|
||||||
|
domain: {{ .Values.global.domain | quote }}
|
||||||
|
hosts:
|
||||||
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
istioDomain: {{ .Values.istio.domain }}
|
||||||
|
|
||||||
|
additionalAnnotations:
|
||||||
|
intents.otterize.com/service-name: "opendesk-nextcloud-php"
|
||||||
|
|
||||||
|
configuration:
|
||||||
|
administrator:
|
||||||
|
username: "nextcloud"
|
||||||
|
password: {{ .Values.secrets.nextcloud.adminPassword | quote }}
|
||||||
|
antivirus:
|
||||||
|
{{- if .Values.clamavDistributed.enabled }}
|
||||||
|
host: "clamav-icap"
|
||||||
|
{{- else if .Values.clamavSimple.enabled }}
|
||||||
|
host: "clamav-simple"
|
||||||
|
{{- end }}
|
||||||
|
cache:
|
||||||
|
auth:
|
||||||
|
enabled: true
|
||||||
|
username:
|
||||||
|
value: "default"
|
||||||
|
password:
|
||||||
|
value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
|
||||||
|
host: {{ .Values.cache.nextcloud.host | quote }}
|
||||||
|
port: {{ .Values.cache.nextcloud.port | quote }}
|
||||||
|
database:
|
||||||
|
host: {{ .Values.databases.nextcloud.host | quote }}
|
||||||
|
port: {{ .Values.databases.nextcloud.port | quote }}
|
||||||
|
auth:
|
||||||
|
username:
|
||||||
|
value: "nextcloud_user"
|
||||||
|
password:
|
||||||
|
value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
|
||||||
|
ldap:
|
||||||
|
host: {{ .Values.ldap.host | quote }}
|
||||||
|
password: {{ .Values.secrets.univentionManagementStack.ldapSearch.nextcloud | quote }}
|
||||||
|
objectstore:
|
||||||
|
auth:
|
||||||
|
accessKey:
|
||||||
|
value: "nextcloud_user"
|
||||||
|
secretKey:
|
||||||
|
value: {{ .Values.secrets.minio.nextcloudUser | quote }}
|
||||||
|
oidc:
|
||||||
|
username:
|
||||||
|
value: "opendesk-nextcloud"
|
||||||
|
password:
|
||||||
|
value: {{ .Values.secrets.keycloak.clientSecret.ncoidc | quote }}
|
||||||
|
opendeskIntegration:
|
||||||
|
username:
|
||||||
|
value: "opendesk_username"
|
||||||
|
password:
|
||||||
|
value: {{ .Values.secrets.centralnavigation.apiKey | quote }}
|
||||||
|
smtp:
|
||||||
|
auth:
|
||||||
|
username:
|
||||||
|
value: {{ .Values.smtp.username | quote }}
|
||||||
|
password:
|
||||||
|
value: {{ .Values.smtp.password | quote }}
|
||||||
|
host: {{ .Values.smtp.host | quote }}
|
||||||
|
port: {{ .Values.smtp.port | quote }}
|
||||||
|
serverinfo:
|
||||||
|
token: {{ .Values.secrets.nextcloud.metricsToken | quote }}
|
||||||
|
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
enabled: true
|
||||||
|
runAsUser: 65532
|
||||||
|
runAsGroup: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
runAsNonRoot: true
|
||||||
|
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudManagement.registry | quote }}
|
||||||
|
repository: "{{ .Values.images.nextcloudManagement.repository }}"
|
||||||
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.nextcloudManagement.tag | quote }}
|
||||||
|
|
||||||
|
theme:
|
||||||
|
{{ .Values.theme | toYaml | nindent 2 }}
|
||||||
|
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
|
||||||
|
...
|
||||||
@@ -1,63 +0,0 @@
|
|||||||
{{/*
|
|
||||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
SPDX-License-Identifier: Apache-2.0
|
|
||||||
*/}}
|
|
||||||
---
|
|
||||||
nextcloud:
|
|
||||||
host: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
|
|
||||||
username: "nextcloud"
|
|
||||||
password: {{ .Values.secrets.nextcloud.adminPassword | quote }}
|
|
||||||
externalDatabase:
|
|
||||||
database: {{ .Values.databases.nextcloud.name | quote }}
|
|
||||||
user: {{ .Values.databases.nextcloud.username | quote }}
|
|
||||||
host: {{ .Values.databases.nextcloud.host | quote }}
|
|
||||||
password: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
|
|
||||||
extraEnv:
|
|
||||||
REDIS_HOST: {{ .Values.cache.nextcloud.host | quote }}
|
|
||||||
REDIS_HOST_PORT: {{ .Values.cache.nextcloud.port | quote }}
|
|
||||||
REDIS_HOST_PASSWORD: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
|
|
||||||
redis:
|
|
||||||
auth:
|
|
||||||
enabled: true
|
|
||||||
password: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
|
|
||||||
ingress:
|
|
||||||
enabled: {{ .Values.ingress.enabled }}
|
|
||||||
className: {{ .Values.ingress.ingressClassName | quote }}
|
|
||||||
tls:
|
|
||||||
- secretName: {{ .Values.ingress.tls.secretName | quote }}
|
|
||||||
hosts:
|
|
||||||
- "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
|
|
||||||
image:
|
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.nextcloud.repository }}"
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
tag: {{ .Values.images.nextcloud.tag | quote }}
|
|
||||||
pullSecrets:
|
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
|
||||||
|
|
||||||
metrics:
|
|
||||||
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
|
||||||
https: true
|
|
||||||
token: {{ .Values.secrets.nextcloud.metricsToken | quote }}
|
|
||||||
image:
|
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.nextcloudExporter.repository }}"
|
|
||||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
|
||||||
tag: {{ .Values.images.nextcloudExporter.tag | quote }}
|
|
||||||
pullSecrets:
|
|
||||||
{{- toYaml .Values.global.imagePullSecrets | nindent 4 }}
|
|
||||||
|
|
||||||
serviceMonitor:
|
|
||||||
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
|
||||||
labels:
|
|
||||||
{{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.nextcloudMetrics | toYaml | nindent 4 }}
|
|
||||||
|
|
||||||
{{- if .Values.cluster.persistence.readWriteMany.enabled }}
|
|
||||||
replicaCount: {{ .Values.replicas.nextcloud }}
|
|
||||||
{{- else }}
|
|
||||||
replicaCount: 1
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.nextcloud | toYaml | nindent 2 }}
|
|
||||||
...
|
|
||||||
@@ -1,77 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
---
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
existingClaim: "nextcloud-main"
|
|
||||||
nextcloudData:
|
|
||||||
enabled: true
|
|
||||||
existingClaim: "nextcloud-data"
|
|
||||||
|
|
||||||
redis:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
cronjob:
|
|
||||||
enabled: true
|
|
||||||
lifecycle:
|
|
||||||
postStartCommand:
|
|
||||||
- "sh"
|
|
||||||
- "-c"
|
|
||||||
- >
|
|
||||||
sed -i "s/\*\/5 \* \* \* \* php -f \/var\/www\/html\/cron.php/\*\/1 \* \* \* \* php -f
|
|
||||||
\/var\/www\/html\/cron.php/g" /var/spool/cron/crontabs/www-data
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
|
|
||||||
ingress:
|
|
||||||
annotations:
|
|
||||||
nginx.ingress.kubernetes.io/proxy-body-size: "4G"
|
|
||||||
nginx.org/client-max-body-size: "4G"
|
|
||||||
|
|
||||||
internalDatabase:
|
|
||||||
enabled: false
|
|
||||||
postgresql:
|
|
||||||
enabled: false
|
|
||||||
mariadb:
|
|
||||||
enabled: false
|
|
||||||
externalDatabase:
|
|
||||||
enabled: true
|
|
||||||
# The nextcloud helm chart provides a sub-chart for mariadb.
|
|
||||||
# If we use mariadb as a sub-chart it's linked to nextcloud,
|
|
||||||
# and it is not independent anymore. Since externalDatabase.type
|
|
||||||
# allows just mysql or postgres, mysql is chosen to connect
|
|
||||||
# to the mariadb:
|
|
||||||
type: "mysql"
|
|
||||||
|
|
||||||
nextcloud:
|
|
||||||
configs:
|
|
||||||
mimetypealiases.json: |-
|
|
||||||
{
|
|
||||||
"application/x-drawio": "image"
|
|
||||||
}
|
|
||||||
|
|
||||||
mimetypemapping.json: |-
|
|
||||||
{
|
|
||||||
"drawio": ["application/x-drawio"]
|
|
||||||
}
|
|
||||||
podSecurityContext:
|
|
||||||
fsGroup: 33
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
add:
|
|
||||||
- "NET_BIND_SERVICE"
|
|
||||||
- "SETGID"
|
|
||||||
- "SETUID"
|
|
||||||
|
|
||||||
# this is not documented but can be found in values.yaml
|
|
||||||
service:
|
|
||||||
port: "80"
|
|
||||||
126
helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
Normal file
126
helmfile/apps/nextcloud/values-nextcloud.yaml.gotmpl
Normal file
@@ -0,0 +1,126 @@
|
|||||||
|
{{/*
|
||||||
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
|
---
|
||||||
|
global:
|
||||||
|
imagePullSecrets:
|
||||||
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
|
exporter:
|
||||||
|
enabled: true
|
||||||
|
configuration:
|
||||||
|
token:
|
||||||
|
value: {{ .Values.secrets.nextcloud.metricsToken | quote }}
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
enabled: true
|
||||||
|
runAsUser: 65532
|
||||||
|
runAsGroup: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudExporter.registry | quote }}
|
||||||
|
repository: "{{ .Values.images.nextcloudExporter.repository }}"
|
||||||
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.nextcloudExporter.tag | quote }}
|
||||||
|
prometheus:
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
||||||
|
labels:
|
||||||
|
{{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
|
||||||
|
prometheusRule:
|
||||||
|
enabled: {{ .Values.prometheus.prometheusRules.enabled }}
|
||||||
|
additionalLabels:
|
||||||
|
{{- toYaml .Values.prometheus.prometheusRules.labels | nindent 6 }}
|
||||||
|
replicas: {{ .Values.replicas.nextcloudExporter }}
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.nextcloudExporter | toYaml | nindent 4 }}
|
||||||
|
|
||||||
|
php:
|
||||||
|
additionalAnnotations:
|
||||||
|
intents.otterize.com/service-name: "opendesk-nextcloud-php"
|
||||||
|
configuration:
|
||||||
|
cache:
|
||||||
|
auth:
|
||||||
|
enabled: true
|
||||||
|
username:
|
||||||
|
value: "default"
|
||||||
|
password:
|
||||||
|
value: {{ .Values.cache.nextcloud.password | default .Values.secrets.redis.password | quote }}
|
||||||
|
host: {{ .Values.cache.nextcloud.host | quote }}
|
||||||
|
port: {{ .Values.cache.nextcloud.port | quote }}
|
||||||
|
database:
|
||||||
|
host: {{ .Values.databases.nextcloud.host | quote }}
|
||||||
|
port: {{ .Values.databases.nextcloud.port | quote }}
|
||||||
|
auth:
|
||||||
|
username:
|
||||||
|
value: "nextcloud_user"
|
||||||
|
password:
|
||||||
|
value: {{ .Values.databases.nextcloud.password | default .Values.secrets.mariadb.nextcloudUser | quote }}
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
enabled: true
|
||||||
|
runAsUser: 65532
|
||||||
|
runAsGroup: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudPHP.registry | quote }}
|
||||||
|
repository: "{{ .Values.images.nextcloudPHP.repository }}"
|
||||||
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.nextcloudPHP.tag | quote }}
|
||||||
|
prometheus:
|
||||||
|
serviceMonitor:
|
||||||
|
enabled: {{ .Values.prometheus.serviceMonitors.enabled }}
|
||||||
|
labels:
|
||||||
|
{{- toYaml .Values.prometheus.serviceMonitors.labels | nindent 6 }}
|
||||||
|
prometheusRule:
|
||||||
|
enabled: {{ .Values.prometheus.prometheusRules.enabled }}
|
||||||
|
additionalLabels:
|
||||||
|
{{- toYaml .Values.prometheus.prometheusRules.labels | nindent 6 }}
|
||||||
|
replicas: {{ .Values.replicas.nextcloudPHP }}
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.nextcloudPHP | toYaml | nindent 4 }}
|
||||||
|
|
||||||
|
apache2:
|
||||||
|
configuration:
|
||||||
|
php:
|
||||||
|
host: "opendesk-nextcloud-php.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}"
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
enabled: true
|
||||||
|
runAsUser: 65532
|
||||||
|
runAsGroup: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
ingress:
|
||||||
|
enabled: {{ .Values.ingress.enabled }}
|
||||||
|
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
|
||||||
|
host: "{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}"
|
||||||
|
tls:
|
||||||
|
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.nextcloudApache2.registry | quote }}
|
||||||
|
repository: {{ .Values.images.nextcloudApache2.repository | quote }}
|
||||||
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.nextcloudApache2.tag | quote }}
|
||||||
|
replicas: {{ .Values.replicas.nextcloudApache2 }}
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.nextcloudApache2 | toYaml | nindent 4 }}
|
||||||
|
...
|
||||||
@@ -8,29 +8,29 @@ repositories:
|
|||||||
# openDesk Dovecot
|
# openDesk Dovecot
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-dovecot
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-dovecot
|
||||||
- name: "dovecot-repo"
|
- name: "dovecot-repo"
|
||||||
oci: {{ .Values.charts.dovecot.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.dovecot.verify }}
|
verify: {{ .Values.charts.dovecot.verify }}
|
||||||
username: {{ .Values.charts.dovecot.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.dovecot.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.dovecot.registry }}/{{ .Values.charts.dovecot.repository }}"
|
||||||
|
|
||||||
# Open-Xchange
|
# Open-Xchange
|
||||||
- name: "open-xchange-repo"
|
- name: "open-xchange-repo"
|
||||||
oci: {{ .Values.charts.openXchangeAppSuite.oci }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
username: {{ .Values.charts.openXchangeAppSuite.username | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
password: {{ .Values.charts.openXchangeAppSuite.password | quote }}
|
oci: true
|
||||||
url: "{{ .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.openXchangeAppSuite.registry }}/{{ .Values.charts.openXchangeAppSuite.repository }}"
|
||||||
|
|
||||||
# openDesk Open-Xchange Bootstrap
|
# openDesk Open-Xchange Bootstrap
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-open-xchange-bootstrap
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/charts/opendesk-open-xchange-bootstrap
|
||||||
- name: "open-xchange-bootstrap-repo"
|
- name: "open-xchange-bootstrap-repo"
|
||||||
oci: {{ .Values.charts.openXchangeAppSuiteBootstrap.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.openXchangeAppSuiteBootstrap.verify }}
|
verify: {{ .Values.charts.openXchangeAppSuiteBootstrap.verify }}
|
||||||
username: {{ .Values.charts.openXchangeAppSuiteBootstrap.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.openXchangeAppSuiteBootstrap.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.openXchangeAppSuiteBootstrap.registry }}/\
|
||||||
{{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
|
{{ .Values.charts.openXchangeAppSuiteBootstrap.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
@@ -38,8 +38,7 @@ releases:
|
|||||||
chart: "dovecot-repo/{{ .Values.charts.dovecot.name }}"
|
chart: "dovecot-repo/{{ .Values.charts.dovecot.name }}"
|
||||||
version: "{{ .Values.charts.dovecot.version }}"
|
version: "{{ .Values.charts.dovecot.version }}"
|
||||||
values:
|
values:
|
||||||
- "values-dovecot.yaml"
|
- "values-dovecot.yaml.gotmpl"
|
||||||
- "values-dovecot.gotmpl"
|
|
||||||
installed: {{ .Values.dovecot.enabled }}
|
installed: {{ .Values.dovecot.enabled }}
|
||||||
timeout: 900
|
timeout: 900
|
||||||
|
|
||||||
@@ -47,10 +46,8 @@ releases:
|
|||||||
chart: "open-xchange-repo/{{ .Values.charts.openXchangeAppSuite.name }}"
|
chart: "open-xchange-repo/{{ .Values.charts.openXchangeAppSuite.name }}"
|
||||||
version: "{{ .Values.charts.openXchangeAppSuite.version }}"
|
version: "{{ .Values.charts.openXchangeAppSuite.version }}"
|
||||||
values:
|
values:
|
||||||
- "values-openxchange.yaml"
|
- "values-openxchange.yaml.gotmpl"
|
||||||
- "values-openxchange.gotmpl"
|
- "values-openxchange-enterprise-contact-picker.yaml.gotmpl"
|
||||||
- "values-openxchange-enterprise-contact-picker.yaml"
|
|
||||||
- "values-openxchange-enterprise-contact-picker.gotmpl"
|
|
||||||
installed: {{ .Values.oxAppsuite.enabled }}
|
installed: {{ .Values.oxAppsuite.enabled }}
|
||||||
timeout: 900
|
timeout: 900
|
||||||
|
|
||||||
@@ -58,7 +55,7 @@ releases:
|
|||||||
chart: "open-xchange-bootstrap-repo/{{ .Values.charts.openXchangeAppSuiteBootstrap.name }}"
|
chart: "open-xchange-bootstrap-repo/{{ .Values.charts.openXchangeAppSuiteBootstrap.name }}"
|
||||||
version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
|
version: "{{ .Values.charts.openXchangeAppSuiteBootstrap.version }}"
|
||||||
values:
|
values:
|
||||||
- "values-openxchange-bootstrap.gotmpl"
|
- "values-openxchange-bootstrap.yaml.gotmpl"
|
||||||
installed: {{ .Values.oxAppsuite.enabled }}
|
installed: {{ .Values.oxAppsuite.enabled }}
|
||||||
timeout: 900
|
timeout: 900
|
||||||
|
|
||||||
|
|||||||
@@ -4,8 +4,8 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.dovecot.registry | quote }}
|
||||||
url: {{ .Values.images.dovecot.repository | quote }}
|
repository: {{ .Values.images.dovecot.repository | quote }}
|
||||||
tag: {{ .Values.images.dovecot.tag | quote }}
|
tag: {{ .Values.images.dovecot.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|
||||||
@@ -18,16 +18,28 @@ dovecot:
|
|||||||
mailDomain: {{ .Values.global.domain | quote }}
|
mailDomain: {{ .Values.global.domain | quote }}
|
||||||
password: {{ .Values.secrets.dovecot.doveadm | quote }}
|
password: {{ .Values.secrets.dovecot.doveadm | quote }}
|
||||||
ldap:
|
ldap:
|
||||||
dn: "uid=ldapsearch_dovecot,cn=users,dc=swp-ldap,dc=internal"
|
enabled: true
|
||||||
host: {{ .Values.ldap.host | quote }}
|
host: {{ .Values.ldap.host | quote }}
|
||||||
|
port: 389
|
||||||
|
base: "dc=swp-ldap,dc=internal"
|
||||||
|
dn: "uid=ldapsearch_dovecot,cn=users,dc=swp-ldap,dc=internal"
|
||||||
password: {{ .Values.secrets.univentionManagementStack.ldapSearch.dovecot | quote }}
|
password: {{ .Values.secrets.univentionManagementStack.ldapSearch.dovecot | quote }}
|
||||||
oidc:
|
oidc:
|
||||||
|
enabled: true
|
||||||
|
clientID: "opendesk-dovecot"
|
||||||
|
clientSecret: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
|
||||||
introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
|
introspectionHost: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
|
||||||
introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
|
introspectionPath: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token/introspect"
|
||||||
clientSecret: {{ .Values.secrets.keycloak.clientSecret.dovecot | quote }}
|
usernameAttribute: "opendesk_username"
|
||||||
clientID: "opendesk-dovecot"
|
|
||||||
loginTrustedNetworks: {{ .Values.cluster.networking.cidr | quote }}
|
loginTrustedNetworks: {{ .Values.cluster.networking.cidr | quote }}
|
||||||
|
|
||||||
|
submission:
|
||||||
|
enabled: true
|
||||||
|
ssl: "no"
|
||||||
|
host: "postfix:25"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
certificate:
|
certificate:
|
||||||
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||||
|
|
||||||
@@ -37,6 +49,28 @@ replicaCount: {{ .Values.replicas.dovecot }}
|
|||||||
replicaCount: 1
|
replicaCount: 1
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
add:
|
||||||
|
- "CHOWN"
|
||||||
|
- "DAC_OVERRIDE"
|
||||||
|
- "KILL"
|
||||||
|
- "NET_BIND_SERVICE"
|
||||||
|
- "SETGID"
|
||||||
|
- "SETUID"
|
||||||
|
- "SYS_CHROOT"
|
||||||
|
enabled: true
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
|
||||||
|
podSecurityContext:
|
||||||
|
enabled: true
|
||||||
|
fsGroup: 1000
|
||||||
|
|
||||||
persistence:
|
persistence:
|
||||||
{{- if .Values.cluster.persistence.readWriteMany.enabled }}
|
{{- if .Values.cluster.persistence.readWriteMany.enabled }}
|
||||||
storageClassName: {{ .Values.persistence.storageClassNames.RWX | quote }}
|
storageClassName: {{ .Values.persistence.storageClassNames.RWX | quote }}
|
||||||
@@ -8,7 +8,7 @@ cleanup:
|
|||||||
deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
|
deletePodsOnSuccessTimeout: {{ .Values.cleanup.deletePodsOnSuccessTimeout }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeBootstrap.registry | quote }}
|
||||||
url: {{ .Values.images.openxchangeBootstrap.repository | quote }}
|
url: {{ .Values.images.openxchangeBootstrap.repository | quote }}
|
||||||
tag: {{ .Values.images.openxchangeBootstrap.tag | quote }}
|
tag: {{ .Values.images.openxchangeBootstrap.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
{{/*
|
|
||||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
SPDX-License-Identifier: Apache-2.0
|
|
||||||
*/}}
|
|
||||||
---
|
|
||||||
appsuite:
|
|
||||||
core-mw:
|
|
||||||
secretYAMLFiles:
|
|
||||||
ldap-client-config.yml:
|
|
||||||
contactsLdapClient:
|
|
||||||
pool:
|
|
||||||
host:
|
|
||||||
address: {{ .Values.ldap.host | quote }}
|
|
||||||
port: 389
|
|
||||||
auth:
|
|
||||||
adminDN:
|
|
||||||
password: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
|
|
||||||
...
|
|
||||||
@@ -16,10 +16,14 @@ appsuite:
|
|||||||
contactsLdapClient:
|
contactsLdapClient:
|
||||||
pool:
|
pool:
|
||||||
type: "simple"
|
type: "simple"
|
||||||
|
host:
|
||||||
|
address: {{ .Values.ldap.host | quote }}
|
||||||
|
port: 389
|
||||||
auth:
|
auth:
|
||||||
type: "adminDN"
|
type: "adminDN"
|
||||||
adminDN:
|
adminDN:
|
||||||
dn: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
|
dn: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
|
||||||
|
password: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
|
||||||
|
|
||||||
uiSettings:
|
uiSettings:
|
||||||
# Enterprise contact picker
|
# Enterprise contact picker
|
||||||
@@ -1,214 +0,0 @@
|
|||||||
{{/*
|
|
||||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
SPDX-License-Identifier: Apache-2.0
|
|
||||||
*/}}
|
|
||||||
---
|
|
||||||
global:
|
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
|
||||||
mysql:
|
|
||||||
host: {{ .Values.databases.oxAppsuite.host | quote }}
|
|
||||||
database: {{ .Values.databases.oxAppsuite.name | quote }}
|
|
||||||
auth:
|
|
||||||
user: {{ .Values.databases.oxAppsuite.username | quote }}
|
|
||||||
password: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
|
|
||||||
rootPassword: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
|
|
||||||
|
|
||||||
istio:
|
|
||||||
enabled: {{ .Values.istio.enabled }}
|
|
||||||
|
|
||||||
nextcloud-integration-ui:
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangeNextcloudIntegrationUI.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangeNextcloudIntegrationUI.tag | quote }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.openxchangeNextcloudIntegrationUI | toYaml | nindent 4 }}
|
|
||||||
|
|
||||||
public-sector-ui:
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangePublicSectorUI.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangePublicSectorUI.tag | quote }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.openxchangePublicSectorUI | toYaml | nindent 4 }}
|
|
||||||
|
|
||||||
appsuite:
|
|
||||||
istio:
|
|
||||||
enabled: {{ .Values.istio.enabled }}
|
|
||||||
ingressGateway:
|
|
||||||
hosts:
|
|
||||||
- "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
|
||||||
virtualServices:
|
|
||||||
appsuite:
|
|
||||||
hosts:
|
|
||||||
- "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
|
||||||
dav:
|
|
||||||
hosts:
|
|
||||||
- "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
|
||||||
|
|
||||||
core-mw:
|
|
||||||
masterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
|
|
||||||
hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
|
||||||
gotenberg:
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
image:
|
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
|
|
||||||
tag: {{ .Values.images.openxchangeGotenberg.tag | quote }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.openxchangeGotenberg | toYaml | nindent 8 }}
|
|
||||||
properties:
|
|
||||||
"com.openexchange.oauth.provider.jwt.jwksUri": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
|
|
||||||
"com.openexchange.oauth.provider.allowedIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
|
|
||||||
"com.openexchange.authentication.oauth.tokenEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
|
|
||||||
"com.openexchange.authentication.oauth.clientSecret": {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
|
|
||||||
"com.openexchange.oidc.rpRedirectURIAuth": "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/appsuite/api/oidc/auth"
|
|
||||||
"com.openexchange.oidc.opAuthorizationEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/auth"
|
|
||||||
"com.openexchange.oidc.opTokenEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
|
|
||||||
"com.openexchange.oidc.opIssuer": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
|
|
||||||
"com.openexchange.oidc.opJwkSetEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
|
|
||||||
"com.openexchange.oidc.clientSecret": {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
|
|
||||||
"com.openexchange.oidc.rpRedirectURIPostSSOLogout": "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/appsuite/api/oidc/logout"
|
|
||||||
"com.openexchange.oidc.opLogoutEndpoint": "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
|
|
||||||
"com.openexchange.oidc.rpRedirectURILogout": "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
secretProperties:
|
|
||||||
com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
|
|
||||||
com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
|
|
||||||
com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
|
|
||||||
propertiesFiles:
|
|
||||||
"/opt/open-xchange/etc/ldapauth.properties":
|
|
||||||
bindDNPassword: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
|
|
||||||
java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/dc=swp-ldap,dc=internal"
|
|
||||||
uiSettings:
|
|
||||||
"io.ox.nextcloud//server": "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/fs/"
|
|
||||||
"io.ox.public-sector//ics/url": "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/"
|
|
||||||
# Dynamic theme
|
|
||||||
io.ox/dynamic-theme//mainColor: {{ .Values.theme.colors.primary | quote }}
|
|
||||||
io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
|
|
||||||
io.ox/dynamic-theme//topbarBackground: {{ .Values.theme.colors.white | quote }}
|
|
||||||
io.ox/dynamic-theme//topbarColor: {{ .Values.theme.colors.black | quote }}
|
|
||||||
io.ox/dynamic-theme//listSelected: {{ .Values.theme.colors.primary15 | quote }}
|
|
||||||
io.ox/dynamic-theme//listHover: {{ .Values.theme.colors.secondaryGreyLight | quote }}
|
|
||||||
io.ox/dynamic-theme//folderBackground: {{ .Values.theme.colors.white | quote }}
|
|
||||||
io.ox/dynamic-theme//folderSelected: {{ .Values.theme.colors.primary15 | quote }}
|
|
||||||
io.ox/dynamic-theme//folderHover: {{ .Values.theme.colors.secondaryGreyLight | quote }}
|
|
||||||
secretETCFiles:
|
|
||||||
# Format of the OX Guard master key:
|
|
||||||
# MC+base64(20 random bytes)
|
|
||||||
# RC+base64(20 random bytes)
|
|
||||||
oxguardpass: |
|
|
||||||
{{ .Values.secrets.oxAppsuite.oxguardMC }}
|
|
||||||
{{ .Values.secrets.oxAppsuite.oxguardRC }}
|
|
||||||
redis:
|
|
||||||
auth:
|
|
||||||
password: {{ .Values.secrets.redis.password | quote }}
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangeCoreMW.tag | quote }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
update:
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangeCoreMW.tag | quote }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.openxchangeCoreMW | toYaml | nindent 6 }}
|
|
||||||
|
|
||||||
core-ui:
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangeCoreUI.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangeCoreUI.tag | quote }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.openxchangeCoreUI | toYaml | nindent 6 }}
|
|
||||||
|
|
||||||
core-ui-middleware:
|
|
||||||
ingress:
|
|
||||||
hosts:
|
|
||||||
- host: "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
|
||||||
enabled: false
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangeCoreUIMiddleware.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag | quote }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
redis:
|
|
||||||
auth:
|
|
||||||
password: {{ .Values.secrets.redis.password | quote }}
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.openxchangeCoreUIMiddleware | toYaml | nindent 6 }}
|
|
||||||
updater:
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.openxchangeCoreUIMiddlewareUpdater | toYaml | nindent 6 }}
|
|
||||||
|
|
||||||
core-documentconverter:
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
|
|
||||||
resources:
|
|
||||||
{{- .Values.resources.openxchangeCoreDocumentConverter | toYaml | nindent 6 }}
|
|
||||||
|
|
||||||
core-guidedtours:
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangeCoreGuidedtours.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangeCoreGuidedtours.tag | quote }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
resources:
|
|
||||||
{{- .Values.resources.openxchangeCoreGuidedtours | toYaml | nindent 6 }}
|
|
||||||
|
|
||||||
core-imageconverter:
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangeImageConverter.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangeImageConverter.tag | quote }}
|
|
||||||
resources:
|
|
||||||
{{- .Values.resources.openxchangeCoreImageConverter | toYaml | nindent 6 }}
|
|
||||||
|
|
||||||
guard-ui:
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
image:
|
|
||||||
repository: "{{ .Values.global.imageRegistry }}/{{ .Values.images.openxchangeGuardUI.repository }}"
|
|
||||||
tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
resources:
|
|
||||||
{{- .Values.resources.openxchangeGuardUI | toYaml | nindent 6 }}
|
|
||||||
|
|
||||||
core-user-guide:
|
|
||||||
image:
|
|
||||||
repository: {{ .Values.images.openxchangeCoreUserGuide.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openxchangeCoreUserGuide.tag | quote }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{- range .Values.global.imagePullSecrets }}
|
|
||||||
- name: {{ . | quote }}
|
|
||||||
{{- end }}
|
|
||||||
resources:
|
|
||||||
{{- .Values.resources.openxchangeCoreUserGuide | toYaml | nindent 6 }}
|
|
||||||
...
|
|
||||||
@@ -1,347 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
---
|
|
||||||
appsuite:
|
|
||||||
appsuite-toolkit:
|
|
||||||
enabled: false
|
|
||||||
istio:
|
|
||||||
ingressGateway:
|
|
||||||
name: "opendesk-gateway-istio-gateway"
|
|
||||||
|
|
||||||
switchboard:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
core-mw:
|
|
||||||
enabled: true
|
|
||||||
masterAdmin: "admin"
|
|
||||||
gotenberg:
|
|
||||||
enabled: true
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
privileged: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1001
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
features:
|
|
||||||
status:
|
|
||||||
# enable admin pack
|
|
||||||
# admin: enabled
|
|
||||||
documents: "disabled"
|
|
||||||
guard: "enabled"
|
|
||||||
packages:
|
|
||||||
status:
|
|
||||||
open-xchange-oidc: "enabled"
|
|
||||||
open-xchange-authentication-database: "disabled"
|
|
||||||
open-xchange-authentication-oauth: "enabled"
|
|
||||||
properties:
|
|
||||||
com.openexchange.UIWebPath: "/appsuite/"
|
|
||||||
com.openexchange.showAdmin: "false"
|
|
||||||
# PDF Export
|
|
||||||
com.openexchange.capability.mail_export_pdf: "true"
|
|
||||||
com.openexchange.mail.exportpdf.gotenberg.enabled: "true"
|
|
||||||
com.openexchange.mail.exportpdf.collabora.enabled: "true"
|
|
||||||
com.openexchange.mail.exportpdf.pdfa.collabora.enabled: "true"
|
|
||||||
com.openexchange.mail.exportpdf.collabora.url: "http://collabora:9980"
|
|
||||||
com.openexchange.mail.exportpdf.gotenberg.url: "http://open-xchange-gotenberg:3000"
|
|
||||||
# OIDC
|
|
||||||
com.openexchange.oidc.enabled: "true"
|
|
||||||
com.openexchange.oidc.autologinCookieMode: "ox_direct"
|
|
||||||
com.openexchange.oidc.contextLookupClaim: "context"
|
|
||||||
com.openexchange.oidc.contextLookupNamePart: "full"
|
|
||||||
com.openexchange.oidc.backchannelLogoutEnabled: "true"
|
|
||||||
com.openexchange.oidc.startDefaultBackend: "true"
|
|
||||||
com.openexchange.oidc.ssoLogout: "true"
|
|
||||||
com.openexchange.oidc.userLookupNamePart: "full"
|
|
||||||
com.openexchange.oidc.userLookupClaim: "opendesk_username"
|
|
||||||
com.openexchange.oidc.clientId: "opendesk-oxappsuite"
|
|
||||||
# OAUTH
|
|
||||||
com.openexchange.oauth.provider.enabled: "true"
|
|
||||||
com.openexchange.oauth.provider.contextLookupClaim: "context"
|
|
||||||
com.openexchange.oauth.provider.contextLookupNamePart: "full"
|
|
||||||
com.openexchange.oauth.provider.mode: "expect_jwt"
|
|
||||||
com.openexchange.oauth.provider.userLookupNamePart: "full"
|
|
||||||
com.openexchange.oauth.provider.userLookupClaim: "opendesk_username"
|
|
||||||
com.openexchange.authentication.oauth.clientId: "opendesk-oxappsuite"
|
|
||||||
# MAIL
|
|
||||||
com.openexchange.mail.authType: "xoauth2"
|
|
||||||
com.openexchange.mail.loginSource: "mail"
|
|
||||||
com.openexchange.mail.mailServer: "dovecot"
|
|
||||||
com.openexchange.mail.mailServerSource: "global"
|
|
||||||
com.openexchange.mail.transport.authType: "xoauth2"
|
|
||||||
com.openexchange.mail.transportServer: "postfix"
|
|
||||||
com.openexchange.mail.transportServerSource: "global"
|
|
||||||
# Mailfilter
|
|
||||||
com.openexchange.mail.filter.loginType: "global"
|
|
||||||
com.openexchange.mail.filter.credentialSource: "mail"
|
|
||||||
com.openexchange.mail.filter.server: "dovecot"
|
|
||||||
com.openexchange.mail.filter.preferredSaslMech: "XOAUTH2"
|
|
||||||
# Dovecot
|
|
||||||
com.openexchange.imap.attachmentMarker.enabled: "true"
|
|
||||||
# Capabilities
|
|
||||||
# Old capability can be used to toggle all integrations with a single switch
|
|
||||||
com.openexchange.capability.public-sector: "true"
|
|
||||||
# New capabilities in 2.0
|
|
||||||
com.openexchange.capability.public-sector-element: "true"
|
|
||||||
com.openexchange.capability.public-sector-navigation: "true"
|
|
||||||
com.openexchange.capability.client-onboarding: "true"
|
|
||||||
com.openexchange.capability.dynamic-theme: "true"
|
|
||||||
com.openexchange.capability.filestorage_nextcloud: "true"
|
|
||||||
com.openexchange.capability.filestorage_nextcloud_oauth: "true"
|
|
||||||
com.openexchange.capability.guard: "true"
|
|
||||||
com.openexchange.capability.guard-mail: "true"
|
|
||||||
com.openexchange.capability.smime: "true"
|
|
||||||
com.openexchange.capability.share_links: "false"
|
|
||||||
com.openexchange.capability.invite_guests: "false"
|
|
||||||
com.openexchange.capability.document_preview: "true"
|
|
||||||
# Secondary Accounts
|
|
||||||
com.openexchange.mail.secondary.authType: "XOAUTH2"
|
|
||||||
com.openexchange.mail.transport.secondary.authType: "xoauth2"
|
|
||||||
# Nextcloud integration
|
|
||||||
com.openexchange.file.storage.nextcloud.oauth.url: "http://nextcloud/"
|
|
||||||
com.openexchange.file.storage.nextcloud.oauth.webdav.username.strategy: "user"
|
|
||||||
com.openexchange.nextcloud.filepicker.includeAccessToken: "false"
|
|
||||||
# GDPR
|
|
||||||
com.openexchange.gdpr.dataexport.enabled: "false"
|
|
||||||
com.openexchange.gdpr.dataexport.active: "false"
|
|
||||||
# Guard
|
|
||||||
com.openexchange.guard.storage.file.fileStorageType: "file"
|
|
||||||
com.openexchange.guard.storage.file.uploadDirectory: "/opt/open-xchange/guard-files/"
|
|
||||||
com.openexchange.guard.guestSMTPServer: "postfix"
|
|
||||||
# S/MIME
|
|
||||||
# Usage (in browser console after login):
|
|
||||||
# http = (await import('./io.ox/core/http.js')).default
|
|
||||||
# await http.POST({ module: 'oxguard/smime', params: { action: 'test' } })
|
|
||||||
com.openexchange.smime.test: "true"
|
|
||||||
# Other
|
|
||||||
com.openexchange.secret.secretSource: "\"<user-id> + '@' + <context-id> + '/' + <random>\""
|
|
||||||
propertiesFiles:
|
|
||||||
/opt/open-xchange/etc/AdminDaemon.properties:
|
|
||||||
MASTER_ACCOUNT_OVERRIDE: "true"
|
|
||||||
/opt/open-xchange/etc/system.properties:
|
|
||||||
SERVER_NAME: "oxserver"
|
|
||||||
/opt/open-xchange/etc/ldapauth.properties:
|
|
||||||
bindOnly: "false"
|
|
||||||
bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
|
|
||||||
|
|
||||||
uiSettings:
|
|
||||||
# Show the Enterprise Picker in the top right corner instead of the launcher drop-down
|
|
||||||
io.ox/core//features/enterprisePicker/showLauncher: "false"
|
|
||||||
io.ox/core//features/enterprisePicker/showTopRightLauncher: "true"
|
|
||||||
# Text and icon color in the topbar
|
|
||||||
io.ox/dynamic-theme//topbarColor: "#000"
|
|
||||||
io.ox/dynamic-theme//logoWidth: "82"
|
|
||||||
io.ox/dynamic-theme//topbarHover: "rgba(0, 0, 0, 0.1)"
|
|
||||||
# Resources
|
|
||||||
io.ox/core//features/resourceCalendars: "true"
|
|
||||||
io.ox/core//features/managedResources: "true"
|
|
||||||
# Categories
|
|
||||||
io.ox/core//features/categories: "true"
|
|
||||||
io.ox/core//categories/predefined: >
|
|
||||||
[{ "name": "Predefined", "color": "orange", "icon": "bi/exclamation-circle.svg" }]
|
|
||||||
# Nextcloud integration
|
|
||||||
# io.ox.nextcloud//server: "https://ics.<DOMAIN>/fs/"
|
|
||||||
# Central navigation
|
|
||||||
io.ox.public-sector//navigation/oxtabname: "tab_groupware"
|
|
||||||
# io.ox.public-sector//ics/url: "https://ics.<DOMAIN>/"
|
|
||||||
io.ox/core//apps/quickLaunchCount: "0"
|
|
||||||
io.ox/core//coloredIcons: "false"
|
|
||||||
# Mail templates
|
|
||||||
io.ox/core//features/templates: "true"
|
|
||||||
# Contact Collector
|
|
||||||
io.ox/mail//contactCollectOnMailTransport: "true"
|
|
||||||
# io.ox/mail//contactCollectOnMailAccess: "true"
|
|
||||||
|
|
||||||
asConfig:
|
|
||||||
default:
|
|
||||||
host: "all"
|
|
||||||
pageHeaderPrefix: "as8.souvap App Suite"
|
|
||||||
oidcLogin: true
|
|
||||||
oidcPath: "/oidc"
|
|
||||||
|
|
||||||
redis:
|
|
||||||
enabled: true
|
|
||||||
mode: "standalone"
|
|
||||||
hosts:
|
|
||||||
- "redis-master"
|
|
||||||
|
|
||||||
hooks:
|
|
||||||
beforeAppsuiteStart:
|
|
||||||
create-guard-dir.sh: |
|
|
||||||
mkdir -p /opt/open-xchange/guard-files
|
|
||||||
chown open-xchange:open-xchange /opt/open-xchange/guard-files
|
|
||||||
|
|
||||||
# Security context for core-mw has no effect yet
|
|
||||||
# podSecurityContext: {}
|
|
||||||
# securityContext: {}
|
|
||||||
|
|
||||||
core-ui:
|
|
||||||
enabled: true
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
|
|
||||||
core-ui-middleware:
|
|
||||||
enabled: true
|
|
||||||
overrides: {}
|
|
||||||
redis:
|
|
||||||
mode: "standalone"
|
|
||||||
hosts:
|
|
||||||
- "redis-master:6379"
|
|
||||||
auth:
|
|
||||||
enabled: true
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
|
|
||||||
core-guidedtours:
|
|
||||||
enabled: true
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
|
|
||||||
guard-ui:
|
|
||||||
enabled: true
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
|
|
||||||
core-cacheservice:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
core-user-guide:
|
|
||||||
enabled: true
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
|
|
||||||
core-imageconverter:
|
|
||||||
enabled: true
|
|
||||||
objectCache:
|
|
||||||
s3ObjectStores:
|
|
||||||
- id: -1
|
|
||||||
endpoint: "."
|
|
||||||
accessKey: "."
|
|
||||||
secretKey: "."
|
|
||||||
podSecurityContext:
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 987
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
securityContext:
|
|
||||||
# missing:
|
|
||||||
# readOnlyRootFilesystem: true
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
|
|
||||||
core-spellcheck:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
core-documentconverter:
|
|
||||||
enabled: true
|
|
||||||
documentConverter:
|
|
||||||
cache:
|
|
||||||
remoteCache:
|
|
||||||
enabled: false
|
|
||||||
podSecurityContext:
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 987
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
securityContext:
|
|
||||||
# missing:
|
|
||||||
# readOnlyRootFilesystem: true
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
|
|
||||||
core-documents-collaboration:
|
|
||||||
enabled: false
|
|
||||||
office-web:
|
|
||||||
enabled: false
|
|
||||||
office-user-guide:
|
|
||||||
enabled: false
|
|
||||||
plugins-ui:
|
|
||||||
enabled: false
|
|
||||||
cloud-plugins-ui:
|
|
||||||
enabled: false
|
|
||||||
drive-client-windows-ox:
|
|
||||||
enabled: false
|
|
||||||
core-drive-help:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
nextcloud-integration-ui:
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
|
|
||||||
public-sector-ui:
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
...
|
|
||||||
536
helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
Normal file
536
helmfile/apps/open-xchange/values-openxchange.yaml.gotmpl
Normal file
@@ -0,0 +1,536 @@
|
|||||||
|
{{/*
|
||||||
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
|
---
|
||||||
|
global:
|
||||||
|
hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
||||||
|
mysql:
|
||||||
|
host: {{ .Values.databases.oxAppsuite.host | quote }}
|
||||||
|
database: {{ .Values.databases.oxAppsuite.name | quote }}
|
||||||
|
auth:
|
||||||
|
user: {{ .Values.databases.oxAppsuite.username | quote }}
|
||||||
|
password: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
|
||||||
|
rootPassword: {{ .Values.databases.oxAppsuite.password | default .Values.secrets.mariadb.rootPassword | quote }}
|
||||||
|
|
||||||
|
istio:
|
||||||
|
enabled: {{ .Values.istio.enabled }}
|
||||||
|
|
||||||
|
nextcloud-integration-ui:
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeNextcloudIntegrationUI.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openxchangeNextcloudIntegrationUI.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangeNextcloudIntegrationUI.tag | quote }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.openxchangeNextcloudIntegrationUI | toYaml | nindent 4 }}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
|
||||||
|
public-sector-ui:
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangePublicSectorUI.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openxchangePublicSectorUI.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangePublicSectorUI.tag | quote }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.openxchangePublicSectorUI | toYaml | nindent 4 }}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
|
||||||
|
appsuite:
|
||||||
|
appsuite-toolkit:
|
||||||
|
enabled: false
|
||||||
|
switchboard:
|
||||||
|
enabled: false
|
||||||
|
istio:
|
||||||
|
enabled: {{ .Values.istio.enabled }}
|
||||||
|
ingressGateway:
|
||||||
|
name: "opendesk-gateway-istio-gateway"
|
||||||
|
hosts:
|
||||||
|
- "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
||||||
|
virtualServices:
|
||||||
|
appsuite:
|
||||||
|
hosts:
|
||||||
|
- "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
||||||
|
dav:
|
||||||
|
hosts:
|
||||||
|
- "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
||||||
|
core-mw:
|
||||||
|
enabled: true
|
||||||
|
asConfig:
|
||||||
|
default:
|
||||||
|
host: "all"
|
||||||
|
pageHeaderPrefix: "as8.souvap App Suite"
|
||||||
|
oidcLogin: true
|
||||||
|
oidcPath: "/oidc"
|
||||||
|
masterAdmin: "admin"
|
||||||
|
masterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
|
||||||
|
hostname: "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
||||||
|
features:
|
||||||
|
status:
|
||||||
|
# enable admin pack
|
||||||
|
# admin: enabled
|
||||||
|
documents: "disabled"
|
||||||
|
guard: "enabled"
|
||||||
|
gotenberg:
|
||||||
|
enabled: true
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
image:
|
||||||
|
repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGotenberg.registry }}/{{ .Values.images.openxchangeGotenberg.repository }}"
|
||||||
|
tag: {{ .Values.images.openxchangeGotenberg.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.openxchangeGotenberg | toYaml | nindent 8 }}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
hooks:
|
||||||
|
beforeAppsuiteStart:
|
||||||
|
create-guard-dir.sh: |
|
||||||
|
mkdir -p /opt/open-xchange/guard-files
|
||||||
|
chown open-xchange:open-xchange /opt/open-xchange/guard-files
|
||||||
|
packages:
|
||||||
|
status:
|
||||||
|
open-xchange-oidc: "enabled"
|
||||||
|
open-xchange-authentication-database: "disabled"
|
||||||
|
open-xchange-authentication-oauth: "enabled"
|
||||||
|
properties:
|
||||||
|
com.openexchange.UIWebPath: "/appsuite/"
|
||||||
|
com.openexchange.showAdmin: "false"
|
||||||
|
# PDF Export
|
||||||
|
com.openexchange.capability.mail_export_pdf: "true"
|
||||||
|
com.openexchange.mail.exportpdf.gotenberg.enabled: "true"
|
||||||
|
com.openexchange.mail.exportpdf.collabora.enabled: "true"
|
||||||
|
com.openexchange.mail.exportpdf.pdfa.collabora.enabled: "true"
|
||||||
|
com.openexchange.mail.exportpdf.collabora.url: "http://collabora:9980"
|
||||||
|
com.openexchange.mail.exportpdf.gotenberg.url: "http://open-xchange-gotenberg:3000"
|
||||||
|
# OIDC
|
||||||
|
com.openexchange.oidc.enabled: "true"
|
||||||
|
com.openexchange.oidc.autologinCookieMode: "ox_direct"
|
||||||
|
com.openexchange.oidc.backchannelLogoutEnabled: "true"
|
||||||
|
com.openexchange.oidc.clientId: "opendesk-oxappsuite"
|
||||||
|
com.openexchange.oidc.clientSecret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
|
||||||
|
com.openexchange.oidc.contextLookupClaim: "context"
|
||||||
|
com.openexchange.oidc.contextLookupNamePart: "full"
|
||||||
|
com.openexchange.oidc.opAuthorizationEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/auth"
|
||||||
|
com.openexchange.oidc.opIssuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
|
||||||
|
com.openexchange.oidc.opJwkSetEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
|
||||||
|
com.openexchange.oidc.opLogoutEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
|
||||||
|
com.openexchange.oidc.opTokenEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
|
||||||
|
com.openexchange.oidc.rpRedirectURIAuth: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/appsuite/api/oidc/auth"
|
||||||
|
com.openexchange.oidc.rpRedirectURILogout: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
||||||
|
com.openexchange.oidc.rpRedirectURIPostSSOLogout: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/appsuite/api/oidc/logout"
|
||||||
|
com.openexchange.oidc.ssoLogout: "true"
|
||||||
|
com.openexchange.oidc.startDefaultBackend: "true"
|
||||||
|
com.openexchange.oidc.userLookupClaim: "opendesk_username"
|
||||||
|
com.openexchange.oidc.userLookupNamePart: "full"
|
||||||
|
# OAUTH
|
||||||
|
com.openexchange.oauth.provider.enabled: "true"
|
||||||
|
com.openexchange.oauth.provider.allowedIssuer: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
|
||||||
|
com.openexchange.oauth.provider.contextLookupClaim: "context"
|
||||||
|
com.openexchange.oauth.provider.contextLookupNamePart: "full"
|
||||||
|
com.openexchange.oauth.provider.jwt.jwksUri: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/certs"
|
||||||
|
com.openexchange.oauth.provider.mode: "expect_jwt"
|
||||||
|
com.openexchange.oauth.provider.userLookupNamePart: "full"
|
||||||
|
com.openexchange.oauth.provider.userLookupClaim: "opendesk_username"
|
||||||
|
com.openexchange.authentication.oauth.clientId: "opendesk-oxappsuite"
|
||||||
|
com.openexchange.authentication.oauth.tokenEndpoint: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
|
||||||
|
com.openexchange.authentication.oauth.clientSecret: {{ .Values.secrets.keycloak.clientSecret.as8oidc | quote }}
|
||||||
|
# MAIL
|
||||||
|
com.openexchange.mail.authType: "xoauth2"
|
||||||
|
com.openexchange.mail.loginSource: "mail"
|
||||||
|
com.openexchange.mail.mailServer: "dovecot"
|
||||||
|
com.openexchange.mail.mailServerSource: "global"
|
||||||
|
com.openexchange.mail.transport.authType: "xoauth2"
|
||||||
|
com.openexchange.mail.transportServer: "postfix"
|
||||||
|
com.openexchange.mail.transportServerSource: "global"
|
||||||
|
# Mailfilter
|
||||||
|
com.openexchange.mail.filter.loginType: "global"
|
||||||
|
com.openexchange.mail.filter.credentialSource: "mail"
|
||||||
|
com.openexchange.mail.filter.server: "dovecot"
|
||||||
|
com.openexchange.mail.filter.preferredSaslMech: "XOAUTH2"
|
||||||
|
# Dovecot
|
||||||
|
com.openexchange.imap.attachmentMarker.enabled: "true"
|
||||||
|
# Capabilities
|
||||||
|
# Old capability can be used to toggle all integrations with a single switch
|
||||||
|
com.openexchange.capability.public-sector: "true"
|
||||||
|
# New capabilities in 2.0
|
||||||
|
com.openexchange.capability.public-sector-element: "true"
|
||||||
|
com.openexchange.capability.public-sector-navigation: "true"
|
||||||
|
com.openexchange.capability.client-onboarding: "true"
|
||||||
|
com.openexchange.capability.dynamic-theme: "true"
|
||||||
|
com.openexchange.capability.filestorage_nextcloud: "true"
|
||||||
|
com.openexchange.capability.filestorage_nextcloud_oauth: "true"
|
||||||
|
com.openexchange.capability.guard: "true"
|
||||||
|
com.openexchange.capability.guard-mail: "true"
|
||||||
|
com.openexchange.capability.smime: "true"
|
||||||
|
com.openexchange.capability.share_links: "false"
|
||||||
|
com.openexchange.capability.invite_guests: "false"
|
||||||
|
com.openexchange.capability.document_preview: "true"
|
||||||
|
# Secondary Accounts
|
||||||
|
com.openexchange.mail.secondary.authType: "XOAUTH2"
|
||||||
|
com.openexchange.mail.transport.secondary.authType: "xoauth2"
|
||||||
|
# Nextcloud integration
|
||||||
|
com.openexchange.file.storage.nextcloud.oauth.url: "http://opendesk-nextcloud-apache2/"
|
||||||
|
com.openexchange.file.storage.nextcloud.oauth.webdav.username.strategy: "user"
|
||||||
|
com.openexchange.nextcloud.filepicker.includeAccessToken: "false"
|
||||||
|
# GDPR
|
||||||
|
com.openexchange.gdpr.dataexport.enabled: "false"
|
||||||
|
com.openexchange.gdpr.dataexport.active: "false"
|
||||||
|
# Guard
|
||||||
|
com.openexchange.guard.storage.file.fileStorageType: "file"
|
||||||
|
com.openexchange.guard.storage.file.uploadDirectory: "/opt/open-xchange/guard-files/"
|
||||||
|
com.openexchange.guard.guestSMTPServer: "postfix"
|
||||||
|
# S/MIME
|
||||||
|
# Usage (in browser console after login):
|
||||||
|
# http = (await import('./io.ox/core/http.js')).default
|
||||||
|
# await http.POST({ module: 'oxguard/smime', params: { action: 'test' } })
|
||||||
|
com.openexchange.smime.test: "true"
|
||||||
|
# Other
|
||||||
|
com.openexchange.secret.secretSource: "\"<user-id> + '@' + <context-id> + '/' + <random>\""
|
||||||
|
secretProperties:
|
||||||
|
com.openexchange.cookie.hash.salt: {{ .Values.secrets.oxAppsuite.cookieHashSalt | quote }}
|
||||||
|
com.openexchange.sessiond.encryptionKey: {{ .Values.secrets.oxAppsuite.sessiondEncryptionKey | quote }}
|
||||||
|
com.openexchange.share.cryptKey: {{ .Values.secrets.oxAppsuite.shareCryptKey | quote }}
|
||||||
|
propertiesFiles:
|
||||||
|
/opt/open-xchange/etc/AdminDaemon.properties:
|
||||||
|
MASTER_ACCOUNT_OVERRIDE: "true"
|
||||||
|
/opt/open-xchange/etc/system.properties:
|
||||||
|
SERVER_NAME: "oxserver"
|
||||||
|
/opt/open-xchange/etc/ldapauth.properties:
|
||||||
|
java.naming.provider.url: "ldap://{{ .Values.ldap.host }}:389/dc=swp-ldap,dc=internal"
|
||||||
|
bindDN: "uid=ldapsearch_ox,cn=users,dc=swp-ldap,dc=internal"
|
||||||
|
bindDNPassword: {{ .Values.secrets.univentionManagementStack.ldapSearch.ox | quote }}
|
||||||
|
bindOnly: "false"
|
||||||
|
/opt/open-xchange/etc/antivirus.properties:
|
||||||
|
com.openexchange.antivirus.enabled: "true"
|
||||||
|
{{- if .Values.clamavDistributed.enabled }}
|
||||||
|
com.openexchange.antivirus.server: "clamav-icap"
|
||||||
|
{{- else if .Values.clamavSimple.enabled }}
|
||||||
|
com.openexchange.antivirus.server: "clamav-simple"
|
||||||
|
{{- end }}
|
||||||
|
com.openexchange.antivirus.port: "1344"
|
||||||
|
com.openexchange.antivirus.maxFileSize: "1024"
|
||||||
|
uiSettings:
|
||||||
|
io.ox.nextcloud//server: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/fs/"
|
||||||
|
io.ox.public-sector//ics/url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/"
|
||||||
|
# Show the Enterprise Picker in the top right corner instead of the launcher drop-down
|
||||||
|
io.ox/core//features/enterprisePicker/showLauncher: "false"
|
||||||
|
io.ox/core//features/enterprisePicker/showTopRightLauncher: "true"
|
||||||
|
# Text and icon color in the topbar
|
||||||
|
io.ox/dynamic-theme//topbarColor: "#000"
|
||||||
|
io.ox/dynamic-theme//logoWidth: "82"
|
||||||
|
io.ox/dynamic-theme//topbarHover: "rgba(0, 0, 0, 0.1)"
|
||||||
|
# Resources
|
||||||
|
io.ox/core//features/resourceCalendars: "true"
|
||||||
|
io.ox/core//features/managedResources: "true"
|
||||||
|
# Categories
|
||||||
|
io.ox/core//features/categories: "true"
|
||||||
|
io.ox/core//categories/predefined: >
|
||||||
|
[{ "name": "Predefined", "color": "orange", "icon": "bi/exclamation-circle.svg" }]
|
||||||
|
# Nextcloud integration
|
||||||
|
# io.ox.nextcloud//server: "https://ics.<DOMAIN>/fs/"
|
||||||
|
# Central navigation
|
||||||
|
io.ox.public-sector//navigation/oxtabname: "tab_groupware"
|
||||||
|
# io.ox.public-sector//ics/url: "https://ics.<DOMAIN>/"
|
||||||
|
io.ox/core//apps/quickLaunchCount: "0"
|
||||||
|
io.ox/core//coloredIcons: "false"
|
||||||
|
# Mail templates
|
||||||
|
io.ox/core//features/templates: "true"
|
||||||
|
# Contact Collector
|
||||||
|
io.ox/mail//contactCollectOnMailTransport: "true"
|
||||||
|
# io.ox/mail//contactCollectOnMailAccess: "true"
|
||||||
|
# Dynamic theme
|
||||||
|
io.ox/dynamic-theme//mainColor: {{ .Values.theme.colors.primary | quote }}
|
||||||
|
io.ox/dynamic-theme//logoURL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/icons/logos/domain.svg"
|
||||||
|
io.ox/dynamic-theme//topbarBackground: {{ .Values.theme.colors.white | quote }}
|
||||||
|
io.ox/dynamic-theme//topbarColor: {{ .Values.theme.colors.black | quote }}
|
||||||
|
io.ox/dynamic-theme//listSelected: {{ .Values.theme.colors.primary15 | quote }}
|
||||||
|
io.ox/dynamic-theme//listHover: {{ .Values.theme.colors.secondaryGreyLight | quote }}
|
||||||
|
io.ox/dynamic-theme//folderBackground: {{ .Values.theme.colors.white | quote }}
|
||||||
|
io.ox/dynamic-theme//folderSelected: {{ .Values.theme.colors.primary15 | quote }}
|
||||||
|
io.ox/dynamic-theme//folderHover: {{ .Values.theme.colors.secondaryGreyLight | quote }}
|
||||||
|
secretETCFiles:
|
||||||
|
# Format of the OX Guard master key:
|
||||||
|
# MC+base64(20 random bytes)
|
||||||
|
# RC+base64(20 random bytes)
|
||||||
|
oxguardpass: |
|
||||||
|
{{ .Values.secrets.oxAppsuite.oxguardMC }}
|
||||||
|
{{ .Values.secrets.oxAppsuite.oxguardRC }}
|
||||||
|
redis:
|
||||||
|
enabled: true
|
||||||
|
mode: "standalone"
|
||||||
|
hosts:
|
||||||
|
- "redis-master"
|
||||||
|
auth:
|
||||||
|
password: {{ .Values.secrets.redis.password | quote }}
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreMW.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangeCoreMW.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
# Security context for core-mw has no effect yet
|
||||||
|
# podSecurityContext: {}
|
||||||
|
# securityContext: {}
|
||||||
|
update:
|
||||||
|
image:
|
||||||
|
repository: {{ .Values.images.openxchangeCoreMW.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangeCoreMW.tag | quote }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.openxchangeCoreMW | toYaml | nindent 6 }}
|
||||||
|
|
||||||
|
core-ui:
|
||||||
|
enabled: true
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUI.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openxchangeCoreUI.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangeCoreUI.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.openxchangeCoreUI | toYaml | nindent 6 }}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
|
||||||
|
core-ui-middleware:
|
||||||
|
enabled: true
|
||||||
|
ingress:
|
||||||
|
hosts:
|
||||||
|
- host: "{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}"
|
||||||
|
enabled: false
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUIMiddleware.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openxchangeCoreUIMiddleware.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangeCoreUIMiddleware.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
overrides: {}
|
||||||
|
redis:
|
||||||
|
mode: "standalone"
|
||||||
|
hosts:
|
||||||
|
- "redis-master:6379"
|
||||||
|
auth:
|
||||||
|
enabled: true
|
||||||
|
password: {{ .Values.secrets.redis.password | quote }}
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.openxchangeCoreUIMiddleware | toYaml | nindent 6 }}
|
||||||
|
updater:
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.openxchangeCoreUIMiddlewareUpdater | toYaml | nindent 6 }}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
|
||||||
|
core-cacheservice:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
core-documentconverter:
|
||||||
|
enabled: true
|
||||||
|
documentConverter:
|
||||||
|
cache:
|
||||||
|
remoteCache:
|
||||||
|
enabled: false
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeDocumentConverter.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openxchangeDocumentConverter.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangeDocumentConverter.tag | quote }}
|
||||||
|
podSecurityContext:
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 987
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
resources:
|
||||||
|
{{- .Values.resources.openxchangeCoreDocumentConverter | toYaml | nindent 6 }}
|
||||||
|
securityContext:
|
||||||
|
# missing:
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
|
||||||
|
core-documents-collaboration:
|
||||||
|
enabled: false
|
||||||
|
office-web:
|
||||||
|
enabled: false
|
||||||
|
office-user-guide:
|
||||||
|
enabled: false
|
||||||
|
plugins-ui:
|
||||||
|
enabled: false
|
||||||
|
cloud-plugins-ui:
|
||||||
|
enabled: false
|
||||||
|
drive-client-windows-ox:
|
||||||
|
enabled: false
|
||||||
|
core-drive-help:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
core-guidedtours:
|
||||||
|
enabled: true
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreGuidedtours.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openxchangeCoreGuidedtours.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangeCoreGuidedtours.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
resources:
|
||||||
|
{{- .Values.resources.openxchangeCoreGuidedtours | toYaml | nindent 6 }}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
|
||||||
|
core-imageconverter:
|
||||||
|
enabled: true
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeImageConverter.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openxchangeImageConverter.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangeImageConverter.tag | quote }}
|
||||||
|
objectCache:
|
||||||
|
s3ObjectStores:
|
||||||
|
- id: -1
|
||||||
|
endpoint: "."
|
||||||
|
accessKey: "."
|
||||||
|
secretKey: "."
|
||||||
|
podSecurityContext:
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 987
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
resources:
|
||||||
|
{{- .Values.resources.openxchangeCoreImageConverter | toYaml | nindent 6 }}
|
||||||
|
securityContext:
|
||||||
|
# missing:
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
|
||||||
|
guard-ui:
|
||||||
|
enabled: true
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
image:
|
||||||
|
repository: "{{ .Values.global.imageRegistry | default .Values.images.openxchangeGuardUI.registry }}/{{ .Values.images.openxchangeGuardUI.repository }}"
|
||||||
|
tag: {{ .Values.images.openxchangeGuardUI.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
resources:
|
||||||
|
{{- .Values.resources.openxchangeGuardUI | toYaml | nindent 6 }}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
|
||||||
|
core-spellcheck:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
core-user-guide:
|
||||||
|
enabled: true
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openxchangeCoreUserGuide.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openxchangeCoreUserGuide.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openxchangeCoreUserGuide.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
resources:
|
||||||
|
{{- .Values.resources.openxchangeCoreUserGuide | toYaml | nindent 6 }}
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
...
|
||||||
@@ -8,12 +8,12 @@ repositories:
|
|||||||
# openDesk OpenProject Bootstrap
|
# openDesk OpenProject Bootstrap
|
||||||
# Source: Set when repo is managed on Open CoDE
|
# Source: Set when repo is managed on Open CoDE
|
||||||
- name: "openproject-bootstrap-repo"
|
- name: "openproject-bootstrap-repo"
|
||||||
oci: {{ .Values.charts.openprojectBootstrap.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.openprojectBootstrap.verify }}
|
verify: {{ .Values.charts.openprojectBootstrap.verify }}
|
||||||
username: {{ .Values.charts.openprojectBootstrap.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.openprojectBootstrap.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.openprojectBootstrap.registry }}/{{ .Values.charts.openprojectBootstrap.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "opendesk-openproject-bootstrap"
|
- name: "opendesk-openproject-bootstrap"
|
||||||
@@ -22,8 +22,7 @@ releases:
|
|||||||
wait: true
|
wait: true
|
||||||
waitForJobs: true
|
waitForJobs: true
|
||||||
values:
|
values:
|
||||||
- "values.yaml"
|
- "values.yaml.gotmpl"
|
||||||
- "values.gotmpl"
|
|
||||||
installed: {{ .Values.openproject.enabled }}
|
installed: {{ .Values.openproject.enabled }}
|
||||||
timeout: 900
|
timeout: 900
|
||||||
|
|
||||||
|
|||||||
@@ -7,16 +7,9 @@ global:
|
|||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
image:
|
|
||||||
registry: {{ .Values.global.imageRegistry }}
|
|
||||||
repository: {{ .Values.images.openprojectBootstrap.repository | quote }}
|
|
||||||
tag: {{ .Values.images.openprojectBootstrap.tag | quote }}
|
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy |quote }}
|
|
||||||
|
|
||||||
cleanup:
|
cleanup:
|
||||||
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
||||||
keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
|
keepPVCOnDelete: {{ .Values.cleanup.keepPVCOnDelete }}
|
||||||
@@ -31,4 +24,33 @@ config:
|
|||||||
admin:
|
admin:
|
||||||
username: "nextcloud"
|
username: "nextcloud"
|
||||||
password: {{ .Values.secrets.nextcloud.adminPassword | quote }}
|
password: {{ .Values.secrets.nextcloud.adminPassword | quote }}
|
||||||
|
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
enabled: true
|
||||||
|
privileged: false
|
||||||
|
runAsUser: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectBootstrap.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openprojectBootstrap.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openprojectBootstrap.tag | quote }}
|
||||||
|
imagePullPolicy: {{ .Values.global.imagePullPolicy |quote }}
|
||||||
|
|
||||||
|
job:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
podSecurityContext:
|
||||||
|
enabled: true
|
||||||
|
fsGroup: 1000
|
||||||
|
fsGroupChangePolicy: "OnRootMismatch"
|
||||||
|
|
||||||
...
|
...
|
||||||
@@ -8,12 +8,12 @@ repositories:
|
|||||||
# OpenProject
|
# OpenProject
|
||||||
# Source: https://github.com/opf/helm-charts
|
# Source: https://github.com/opf/helm-charts
|
||||||
- name: "openproject-repo"
|
- name: "openproject-repo"
|
||||||
oci: {{ .Values.charts.openproject.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/openproject-com.gpg"
|
keyring: "../../files/gpg-pubkeys/openproject-com.gpg"
|
||||||
verify: {{ .Values.charts.openproject.verify }}
|
verify: {{ .Values.charts.openproject.verify }}
|
||||||
username: {{ .Values.charts.openproject.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.openproject.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.openproject.registry }}/{{ .Values.charts.openproject.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "openproject"
|
- name: "openproject"
|
||||||
@@ -22,8 +22,7 @@ releases:
|
|||||||
wait: true
|
wait: true
|
||||||
waitForJobs: true
|
waitForJobs: true
|
||||||
values:
|
values:
|
||||||
- "values.yaml"
|
- "values.yaml.gotmpl"
|
||||||
- "values.gotmpl"
|
|
||||||
installed: {{ .Values.openproject.enabled }}
|
installed: {{ .Values.openproject.enabled }}
|
||||||
timeout: 900
|
timeout: 900
|
||||||
|
|
||||||
|
|||||||
@@ -1,99 +0,0 @@
|
|||||||
{{/*
|
|
||||||
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
SPDX-License-Identifier: Apache-2.0
|
|
||||||
*/}}
|
|
||||||
---
|
|
||||||
global:
|
|
||||||
imagePullSecrets:
|
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
|
||||||
|
|
||||||
image:
|
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
repository: {{ .Values.images.openproject.repository | quote }}
|
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
|
||||||
tag: {{ .Values.images.openproject.tag | quote }}
|
|
||||||
|
|
||||||
initdb:
|
|
||||||
image:
|
|
||||||
registry: "{{ .Values.global.imageRegistry }}"
|
|
||||||
repository: "{{ .Values.images.openprojectInitDb.repository }}"
|
|
||||||
tag: "{{ .Values.images.openprojectInitDb.tag }}"
|
|
||||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
|
||||||
|
|
||||||
memcached:
|
|
||||||
connection:
|
|
||||||
host: {{ .Values.cache.openproject.host | quote }}
|
|
||||||
port: {{ .Values.cache.openproject.port }}
|
|
||||||
image:
|
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
repository: {{ .Values.images.memcached.repository | quote }}
|
|
||||||
tag: {{ .Values.images.memcached.tag | quote }}
|
|
||||||
|
|
||||||
postgresql:
|
|
||||||
auth:
|
|
||||||
password: {{ .Values.databases.openproject.password | default .Values.secrets.postgresql.openprojectUser | quote }}
|
|
||||||
username: {{ .Values.databases.openproject.username | quote }}
|
|
||||||
database: {{ .Values.databases.openproject.name | quote }}
|
|
||||||
connection:
|
|
||||||
host: {{ .Values.databases.openproject.host | quote }}
|
|
||||||
port: {{ .Values.databases.openproject.port }}
|
|
||||||
|
|
||||||
openproject:
|
|
||||||
host: "{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
|
|
||||||
# Will only be set on initial seed / installation
|
|
||||||
admin_user:
|
|
||||||
name: "OpenProject Internal Admin"
|
|
||||||
mail: "openproject-admin@swp-domain.internal"
|
|
||||||
password_reset: "false"
|
|
||||||
password: {{ .Values.secrets.openproject.adminPassword | quote }}
|
|
||||||
oidc:
|
|
||||||
authorizationEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/auth"
|
|
||||||
tokenEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
|
|
||||||
userinfoEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/userinfo"
|
|
||||||
ingress:
|
|
||||||
host: "{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
|
|
||||||
enabled: {{ .Values.ingress.enabled }}
|
|
||||||
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
|
|
||||||
tls:
|
|
||||||
enabled: {{ .Values.ingress.tls.enabled }}
|
|
||||||
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
|
||||||
|
|
||||||
environment:
|
|
||||||
OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_USER: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
|
|
||||||
OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
|
|
||||||
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_SECRET: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
|
|
||||||
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
|
|
||||||
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
|
|
||||||
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_HOST: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
|
||||||
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_END__SESSION__ENDPOINT: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
|
|
||||||
# Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_HOST: {{ .Values.ldap.host | quote }}
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
|
|
||||||
OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
|
|
||||||
OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
|
||||||
OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.domain | quote }}
|
|
||||||
OPENPROJECT_SMTP__USER__NAME: {{ .Values.smtp.username | quote }}
|
|
||||||
OPENPROJECT_SMTP__PASSWORD: {{ .Values.smtp.password | quote }}
|
|
||||||
OPENPROJECT_SMTP__PORT: {{ .Values.smtp.port | quote }}
|
|
||||||
OPENPROJECT_SMTP__SSL: "false" # (default=false)
|
|
||||||
OPENPROJECT_SMTP__ADDRESS: {{ .Values.smtp.host | quote }}
|
|
||||||
OPENPROJECT_MAIL__FROM: "do-not-reply@{{ .Values.global.domain }}"
|
|
||||||
# Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.univentionManagementStack.ldapSearch.openproject | quote }}
|
|
||||||
{{ if ne .Values.objectstores.openproject.backend "aws" }}
|
|
||||||
OPENPROJECT_FOG_CREDENTIALS_ENDPOINT: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
|
|
||||||
OPENPROJECT_FOG_CREDENTIALS_PATH__STYLE: "true"
|
|
||||||
{{ end }}
|
|
||||||
OPENPROJECT_FOG_CREDENTIALS_AWS__ACCESS__KEY__ID: {{ .Values.objectstores.openproject.username | quote }}
|
|
||||||
OPENPROJECT_FOG_CREDENTIALS_AWS__SECRET__ACCESS__KEY: {{ .Values.objectstores.openproject.secret | default .Values.secrets.minio.openprojectUser | quote }}
|
|
||||||
OPENPROJECT_FOG_CREDENTIALS_PROVIDER: {{ .Values.objectstores.openproject.provider | default "AWS" | quote }}
|
|
||||||
OPENPROJECT_FOG_CREDENTIALS_REGION: {{ .Values.objectstores.openproject.region | quote }}
|
|
||||||
OPENPROJECT_FOG_DIRECTORY: {{ .Values.objectstores.openproject.bucket | quote }}
|
|
||||||
OPENPROJECT_FOG_CREDENTIALS_USE__IAM__PROFILE: {{ .Values.objectstores.openproject.useIAMProfile | default "false" | quote }}
|
|
||||||
OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
|
||||||
|
|
||||||
replicaCount: {{ .Values.replicas.openproject }}
|
|
||||||
|
|
||||||
resources:
|
|
||||||
{{ .Values.resources.openproject | toYaml | nindent 2 }}
|
|
||||||
...
|
|
||||||
@@ -1,90 +0,0 @@
|
|||||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
|
||||||
---
|
|
||||||
image:
|
|
||||||
registry: "registry.souvap-univention.de"
|
|
||||||
|
|
||||||
memcached:
|
|
||||||
bundled: false
|
|
||||||
|
|
||||||
probes:
|
|
||||||
liveness:
|
|
||||||
initialDelaySeconds: 300
|
|
||||||
failureThreshold: 30
|
|
||||||
readiness:
|
|
||||||
initialDelaySeconds: 150
|
|
||||||
failureThreshold: 30
|
|
||||||
|
|
||||||
postgresql:
|
|
||||||
bundled: false
|
|
||||||
|
|
||||||
openproject:
|
|
||||||
oidc:
|
|
||||||
enabled: true
|
|
||||||
provider: "keycloak"
|
|
||||||
identifier: "opendesk-openproject"
|
|
||||||
scope: "[openid,opendesk]"
|
|
||||||
# seed will only be executed on initial installation
|
|
||||||
seed_locale: "de"
|
|
||||||
|
|
||||||
containerSecurityContext:
|
|
||||||
enabled: true
|
|
||||||
runAsUser: 1000
|
|
||||||
runAsGroup: 1000
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
seccompProfile:
|
|
||||||
type: "RuntimeDefault"
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsNonRoot: true
|
|
||||||
|
|
||||||
persistence:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
s3:
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
# For more details and more options see
|
|
||||||
# https://www.openproject.org/docs/installation-and-operations/configuration/environment/
|
|
||||||
environment:
|
|
||||||
OPENPROJECT_LOG__LEVEL: "info"
|
|
||||||
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ATTRIBUTE__MAP_LOGIN: "opendesk_username"
|
|
||||||
OPENPROJECT_LOGIN__REQUIRED: "true"
|
|
||||||
OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
|
|
||||||
OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"
|
|
||||||
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_DISPLAY__NAME: "Keycloak"
|
|
||||||
OPENPROJECT_PER__PAGE__OPTIONS: "20, 50, 100, 200"
|
|
||||||
OPENPROJECT_EMAIL__DELIVERY__METHOD: "smtp"
|
|
||||||
OPENPROJECT_SMTP__AUTHENTICATION: "plain"
|
|
||||||
OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
|
|
||||||
OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
|
|
||||||
OPENPROJECT_DEFAULT__COMMENT__SORT__ORDER: "desc"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_SECURITY: "plain_ldap"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,dc=swp-ldap,dc=internal"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "dc=swp-ldap,dc=internal"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_FILTER:
|
|
||||||
"(&(objectClass=opendeskProjectmanagementUser)(opendeskProjectmanagementEnabled=TRUE))"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_SYNC__USERS: "true"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_LOGIN__MAPPING: "uid"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_FIRSTNAME__MAPPING: "givenName"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_LASTNAME__MAPPING: "sn"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_MAIL__MAPPING: "mailPrimaryAddress"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_ADMIN__MAPPING: "opendeskProjectmanagementAdmin"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_BASE: "dc=swp-ldap,dc=internal"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_FILTER:
|
|
||||||
"(&(objectClass=opendeskProjectmanagementGroup)(opendeskProjectmanagementEnabled=TRUE))"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_SYNC__USERS: "true"
|
|
||||||
OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_GROUP__ATTRIBUTE: "cn"
|
|
||||||
# Details: https://www.openproject.org/docs/installation-and-operations/configuration/#attachments-storage
|
|
||||||
OPENPROJECT_ATTACHMENTS__STORAGE: "fog"
|
|
||||||
OPENPROJECT_FOG_CREDENTIALS_PATH__STYLE: "true"
|
|
||||||
# Define an admin mapping from the claim
|
|
||||||
# The attribute mapping cannot currently be defined in the value
|
|
||||||
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ATTRIBUTE__MAP_ADMIN: "openproject_admin"
|
|
||||||
|
|
||||||
seederJob:
|
|
||||||
annotations:
|
|
||||||
intents.otterize.com/service-name: "openproject-seeder"
|
|
||||||
...
|
|
||||||
166
helmfile/apps/openproject/values.yaml.gotmpl
Normal file
166
helmfile/apps/openproject/values.yaml.gotmpl
Normal file
@@ -0,0 +1,166 @@
|
|||||||
|
{{/*
|
||||||
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
|
---
|
||||||
|
global:
|
||||||
|
imagePullSecrets:
|
||||||
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
|
containerSecurityContext:
|
||||||
|
enabled: true
|
||||||
|
runAsUser: 1000
|
||||||
|
runAsGroup: 1000
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
|
||||||
|
environment:
|
||||||
|
# For more details and more options see
|
||||||
|
# https://www.openproject.org/docs/installation-and-operations/configuration/environment/
|
||||||
|
OPENPROJECT_LOG__LEVEL: {{ .Values.debug.logLevel | lower | quote }}
|
||||||
|
OPENPROJECT_LOGIN__REQUIRED: "true"
|
||||||
|
OPENPROJECT_OAUTH__ALLOW__REMAPPING__OF__EXISTING__USERS: "true"
|
||||||
|
OPENPROJECT_OMNIAUTH__DIRECT__LOGIN__PROVIDER: "keycloak"
|
||||||
|
OPENPROJECT_PER__PAGE__OPTIONS: "20, 50, 100, 200"
|
||||||
|
OPENPROJECT_EMAIL__DELIVERY__METHOD: "smtp"
|
||||||
|
OPENPROJECT_SMTP__AUTHENTICATION: "plain"
|
||||||
|
OPENPROJECT_SMTP__ENABLE__STARTTLS__AUTO: "true"
|
||||||
|
OPENPROJECT_SMTP__OPENSSL__VERIFY__MODE: "peer"
|
||||||
|
OPENPROJECT_DEFAULT__COMMENT__SORT__ORDER: "desc"
|
||||||
|
# Details: https://www.openproject-edge.com/docs/installation-and-operations/configuration/#seeding-ldap-connections
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_HOST: {{ .Values.ldap.host | quote }}
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_PORT: "389"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_BINDPASSWORD: {{ .Values.secrets.univentionManagementStack.ldapSearch.openproject | quote }}
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_SECURITY: "plain_ldap"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_BINDUSER: "uid=ldapsearch_openproject,cn=users,dc=swp-ldap,dc=internal"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_BASEDN: "dc=swp-ldap,dc=internal"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_FILTER:
|
||||||
|
"(&(objectClass=opendeskProjectmanagementUser)(opendeskProjectmanagementEnabled=TRUE))"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_SYNC__USERS: "true"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_LOGIN__MAPPING: "uid"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_FIRSTNAME__MAPPING: "givenName"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_LASTNAME__MAPPING: "sn"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_MAIL__MAPPING: "mailPrimaryAddress"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_ADMIN__MAPPING: "opendeskProjectmanagementAdmin"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_BASE: "dc=swp-ldap,dc=internal"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_FILTER:
|
||||||
|
"(&(objectClass=opendeskProjectmanagementGroup)(opendeskProjectmanagementEnabled=TRUE))"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_SYNC__USERS: "true"
|
||||||
|
OPENPROJECT_SEED_LDAP_OPENDESK_GROUPFILTER_OPENDESK_GROUP__ATTRIBUTE: "cn"
|
||||||
|
OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_USER: {{ .Values.secrets.openproject.apiAdminUsername | quote }}
|
||||||
|
OPENPROJECT_AUTHENTICATION_GLOBAL__BASIC__AUTH_PASSWORD: {{ .Values.secrets.openproject.apiAdminPassword | quote }}
|
||||||
|
OPENPROJECT_SOUVAP__NAVIGATION__SECRET: {{ .Values.secrets.centralnavigation.apiKey | quote }}
|
||||||
|
OPENPROJECT_SOUVAP__NAVIGATION__URL: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/portal/navigation.json?base=https%3A//{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}"
|
||||||
|
OPENPROJECT_SMTP__DOMAIN: {{ .Values.global.domain | quote }}
|
||||||
|
OPENPROJECT_SMTP__USER__NAME: {{ .Values.smtp.username | quote }}
|
||||||
|
OPENPROJECT_SMTP__PASSWORD: {{ .Values.smtp.password | quote }}
|
||||||
|
OPENPROJECT_SMTP__PORT: {{ .Values.smtp.port | quote }}
|
||||||
|
OPENPROJECT_SMTP__SSL: "false" # (default=false)
|
||||||
|
OPENPROJECT_SMTP__ADDRESS: {{ .Values.smtp.host | quote }}
|
||||||
|
OPENPROJECT_MAIL__FROM: "do-not-reply@{{ .Values.global.domain }}"
|
||||||
|
OPENPROJECT_HOME__URL: {{ printf "https://%s.%s/" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
||||||
|
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_ISSUER: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}"
|
||||||
|
OPENPROJECT_OPENID__CONNECT_KEYCLOAK_POST__LOGOUT__REDIRECT__URI: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/"
|
||||||
|
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openproject.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openproject.repository | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.openproject.tag | quote }}
|
||||||
|
|
||||||
|
initdb:
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.openprojectInitDb.registry | quote }}
|
||||||
|
repository: {{ .Values.images.openprojectInitDb.repository | quote }}
|
||||||
|
tag: {{ .Values.images.openprojectInitDb.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|
||||||
|
memcached:
|
||||||
|
bundled: false
|
||||||
|
connection:
|
||||||
|
host: {{ .Values.cache.openproject.host | quote }}
|
||||||
|
port: {{ .Values.cache.openproject.port }}
|
||||||
|
|
||||||
|
persistence:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
postgresql:
|
||||||
|
bundled: false
|
||||||
|
auth:
|
||||||
|
password: {{ .Values.databases.openproject.password | default .Values.secrets.postgresql.openprojectUser | quote }}
|
||||||
|
username: {{ .Values.databases.openproject.username | quote }}
|
||||||
|
database: {{ .Values.databases.openproject.name | quote }}
|
||||||
|
connection:
|
||||||
|
host: {{ .Values.databases.openproject.host | quote }}
|
||||||
|
port: {{ .Values.databases.openproject.port }}
|
||||||
|
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
initialDelaySeconds: 300
|
||||||
|
failureThreshold: 30
|
||||||
|
readiness:
|
||||||
|
initialDelaySeconds: 150
|
||||||
|
failureThreshold: 30
|
||||||
|
|
||||||
|
openproject:
|
||||||
|
# seed will only be executed on initial installation
|
||||||
|
seed_locale: "de"
|
||||||
|
host: "{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
|
||||||
|
# Will only be set on initial seed / installation
|
||||||
|
admin_user:
|
||||||
|
name: "OpenProject Internal Admin"
|
||||||
|
mail: "openproject-admin@swp-domain.internal"
|
||||||
|
password_reset: "false"
|
||||||
|
password: {{ .Values.secrets.openproject.adminPassword | quote }}
|
||||||
|
oidc:
|
||||||
|
enabled: true
|
||||||
|
authorizationEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/auth"
|
||||||
|
endSessionEndpoint : "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}/realms/{{ .Values.platform.realm }}/protocol/openid-connect/logout"
|
||||||
|
host: "{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||||
|
identifier: "opendesk-openproject"
|
||||||
|
provider: "keycloak"
|
||||||
|
scope: "[openid,opendesk]"
|
||||||
|
secret: {{ .Values.secrets.keycloak.clientSecret.openproject | quote }}
|
||||||
|
tokenEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/token"
|
||||||
|
userinfoEndpoint: "/realms/{{ .Values.platform.realm }}/protocol/openid-connect/userinfo"
|
||||||
|
attribute_map:
|
||||||
|
login: "opendesk_username"
|
||||||
|
admin: "openproject_admin"
|
||||||
|
useTmpVolumes: true
|
||||||
|
|
||||||
|
ingress:
|
||||||
|
host: "{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}"
|
||||||
|
enabled: {{ .Values.ingress.enabled }}
|
||||||
|
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
|
||||||
|
tls:
|
||||||
|
enabled: {{ .Values.ingress.tls.enabled }}
|
||||||
|
secretName: {{ .Values.ingress.tls.secretName | quote }}
|
||||||
|
|
||||||
|
replicaCount: {{ .Values.replicas.openproject }}
|
||||||
|
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.openproject | toYaml | nindent 2 }}
|
||||||
|
|
||||||
|
s3:
|
||||||
|
enabled: true
|
||||||
|
endpoint: {{ .Values.objectstores.openproject.endpoint | default (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
|
||||||
|
host: {{ (printf "https://%s.%s" .Values.global.hosts.minioApi .Values.global.domain) | quote }}
|
||||||
|
pathStyle: "true"
|
||||||
|
region: {{ .Values.objectstores.openproject.region | quote }}
|
||||||
|
bucketName: {{ .Values.objectstores.openproject.bucket | quote }}
|
||||||
|
use_iam_profile: {{ .Values.objectstores.openproject.useIAMProfile | default "false" | quote }}
|
||||||
|
auth:
|
||||||
|
accessKeyId: {{ .Values.objectstores.openproject.username | quote }}
|
||||||
|
secretAccessKey: {{ .Values.objectstores.openproject.secret | default .Values.secrets.minio.openprojectUser | quote }}
|
||||||
|
|
||||||
|
seederJob:
|
||||||
|
annotations:
|
||||||
|
intents.otterize.com/service-name: "openproject-seeder"
|
||||||
|
|
||||||
|
...
|
||||||
@@ -7,10 +7,10 @@ bases:
|
|||||||
repositories:
|
repositories:
|
||||||
# OX Connector
|
# OX Connector
|
||||||
- name: "ox-connector-repo"
|
- name: "ox-connector-repo"
|
||||||
oci: {{ .Values.charts.oxConnector.oci }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
username: {{ .Values.charts.oxConnector.username | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
password: {{ .Values.charts.oxConnector.password | quote }}
|
oci: true
|
||||||
url: "{{ .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.oxConnector.registry }}/{{ .Values.charts.oxConnector.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "ox-connector"
|
- name: "ox-connector"
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.oxConnector.registry | quote }}
|
||||||
repository: {{ .Values.images.oxConnector.repository | quote }}
|
repository: {{ .Values.images.oxConnector.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.oxConnector.tag | quote }}
|
tag: {{ .Values.images.oxConnector.tag | quote }}
|
||||||
@@ -21,6 +21,7 @@ oxConnector:
|
|||||||
domainName: {{ .Values.global.domain | quote }}
|
domainName: {{ .Values.global.domain | quote }}
|
||||||
ldapHost: {{ .Values.ldap.host | quote }}
|
ldapHost: {{ .Values.ldap.host | quote }}
|
||||||
notifierServer: {{ .Values.ldap.notifierHost | quote }}
|
notifierServer: {{ .Values.ldap.notifierHost | quote }}
|
||||||
|
logLevel: {{ .Values.debug.logLevel | quote }}
|
||||||
#oxMasterAdmin: "(( .Values.appsuite.core-mw.masterAdmin ))"
|
#oxMasterAdmin: "(( .Values.appsuite.core-mw.masterAdmin ))"
|
||||||
oxMasterAdmin: "admin"
|
oxMasterAdmin: "admin"
|
||||||
oxMasterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
|
oxMasterPassword: {{ .Values.secrets.oxAppsuite.adminPassword | quote }}
|
||||||
|
|||||||
@@ -10,7 +10,6 @@ oxConnector:
|
|||||||
tlsMode: "off"
|
tlsMode: "off"
|
||||||
caCert: "ucctempldapstring"
|
caCert: "ucctempldapstring"
|
||||||
debugLevel: "5"
|
debugLevel: "5"
|
||||||
logLevel: "DEBUG"
|
|
||||||
oxDefaultContext: "1"
|
oxDefaultContext: "1"
|
||||||
oxLocalTimezone: "Europe/Berlin"
|
oxLocalTimezone: "Europe/Berlin"
|
||||||
oxLanguage: "de_DE"
|
oxLanguage: "de_DE"
|
||||||
|
|||||||
@@ -8,103 +8,103 @@ repositories:
|
|||||||
# openDesk Otterize
|
# openDesk Otterize
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-otterize
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-otterize
|
||||||
- name: "otterize-repo"
|
- name: "otterize-repo"
|
||||||
oci: {{ .Values.charts.otterize.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.otterize.verify }}
|
verify: {{ .Values.charts.otterize.verify }}
|
||||||
username: {{ .Values.charts.otterize.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.otterize.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.otterize.registry }}/{{ .Values.charts.otterize.repository }}"
|
||||||
|
|
||||||
# openDesk Certificates
|
# openDesk Certificates
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-certificates
|
||||||
- name: "certificates-repo"
|
- name: "certificates-repo"
|
||||||
oci: {{ .Values.charts.certificates.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.certificates.verify }}
|
verify: {{ .Values.charts.certificates.verify }}
|
||||||
username: {{ .Values.charts.certificates.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.certificates.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.certificates.registry }}/{{ .Values.charts.certificates.repository }}"
|
||||||
|
|
||||||
# openDesk PostgreSQL
|
# openDesk PostgreSQL
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postgresql
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postgresql
|
||||||
- name: "postgresql-repo"
|
- name: "postgresql-repo"
|
||||||
oci: {{ .Values.charts.postgresql.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.postgresql.verify }}
|
verify: {{ .Values.charts.postgresql.verify }}
|
||||||
username: {{ .Values.charts.postgresql.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.postgresql.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.postgresql.registry }}/{{ .Values.charts.postgresql.repository }}"
|
||||||
|
|
||||||
# openDesk MariaDB
|
# openDesk MariaDB
|
||||||
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
|
# Source: https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-mariadb
|
||||||
- name: "mariadb-repo"
|
- name: "mariadb-repo"
|
||||||
oci: {{ .Values.charts.mariadb.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.mariadb.verify }}
|
verify: {{ .Values.charts.mariadb.verify }}
|
||||||
username: {{ .Values.charts.mariadb.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.mariadb.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.mariadb.registry }}/{{ .Values.charts.mariadb.repository }}"
|
||||||
|
|
||||||
# openDesk Postfix
|
# openDesk Postfix
|
||||||
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
|
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-postfix
|
||||||
- name: "postfix-repo"
|
- name: "postfix-repo"
|
||||||
oci: {{ .Values.charts.postfix.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.postfix.verify }}
|
verify: {{ .Values.charts.postfix.verify }}
|
||||||
username: {{ .Values.charts.postfix.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.postfix.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.postfix.registry }}/{{ .Values.charts.postfix.repository }}"
|
||||||
|
|
||||||
# openDesk Istio Resources
|
# openDesk Istio Resources
|
||||||
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-istio-resources
|
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-istio-resources
|
||||||
- name: "istio-resources-repo"
|
- name: "istio-resources-repo"
|
||||||
oci: {{ .Values.charts.istioResources.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.istioResources.verify }}
|
verify: {{ .Values.charts.istioResources.verify }}
|
||||||
username: {{ .Values.charts.istioResources.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.istioResources.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.istioResources.registry }}/{{ .Values.charts.istioResources.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.istioResources.registry }}/{{ .Values.charts.istioResources.repository }}"
|
||||||
|
|
||||||
# openDesk ClamAV
|
# openDesk ClamAV
|
||||||
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
|
# https://gitlab.opencode.de/bmi/opendesk/components/platform-development/charts/opendesk-clamav
|
||||||
- name: "clamav-repo"
|
- name: "clamav-repo"
|
||||||
oci: {{ .Values.charts.clamav.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.clamav.verify }}
|
verify: {{ .Values.charts.clamav.verify }}
|
||||||
username: {{ .Values.charts.clamav.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.clamav.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.clamav.registry }}/{{ .Values.charts.clamav.repository }}"
|
||||||
- name: "clamav-simple-repo"
|
- name: "clamav-simple-repo"
|
||||||
oci: {{ .Values.charts.clamavSimple.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.clamavSimple.verify }}
|
verify: {{ .Values.charts.clamavSimple.verify }}
|
||||||
username: {{ .Values.charts.clamavSimple.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.clamavSimple.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.clamavSimple.registry }}/{{ .Values.charts.clamavSimple.repository }}"
|
||||||
|
|
||||||
# VMWare Bitnami
|
# VMWare Bitnami
|
||||||
# Source: https://github.com/bitnami/charts/
|
# Source: https://github.com/bitnami/charts/
|
||||||
- name: "memcached-repo"
|
- name: "memcached-repo"
|
||||||
oci: {{ .Values.charts.memcached.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.memcached.verify }}
|
verify: {{ .Values.charts.memcached.verify }}
|
||||||
username: {{ .Values.charts.memcached.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.memcached.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.memcached.registry }}/{{ .Values.charts.memcached.repository }}"
|
||||||
- name: "redis-repo"
|
- name: "redis-repo"
|
||||||
oci: {{ .Values.charts.redis.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.redis.verify }}
|
verify: {{ .Values.charts.redis.verify }}
|
||||||
username: {{ .Values.charts.redis.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.redis.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.redis.registry }}/{{ .Values.charts.redis.repository }}"
|
||||||
- name: "minio-repo"
|
- name: "minio-repo"
|
||||||
oci: {{ .Values.charts.minio.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.minio.verify }}
|
verify: {{ .Values.charts.minio.verify }}
|
||||||
username: {{ .Values.charts.minio.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.minio.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.minio.registry }}/{{ .Values.charts.minio.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "opendesk-otterize"
|
- name: "opendesk-otterize"
|
||||||
@@ -113,6 +113,7 @@ releases:
|
|||||||
values:
|
values:
|
||||||
- "values-otterize.gotmpl"
|
- "values-otterize.gotmpl"
|
||||||
installed: {{ .Values.security.otterizeIntents.enabled }}
|
installed: {{ .Values.security.otterizeIntents.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "opendesk-certificates"
|
- name: "opendesk-certificates"
|
||||||
chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
|
chart: "certificates-repo/{{ .Values.charts.certificates.name }}"
|
||||||
@@ -120,6 +121,7 @@ releases:
|
|||||||
values:
|
values:
|
||||||
- "values-certificates.gotmpl"
|
- "values-certificates.gotmpl"
|
||||||
installed: {{ .Values.certificates.enabled }}
|
installed: {{ .Values.certificates.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "redis"
|
- name: "redis"
|
||||||
chart: "redis-repo/{{ .Values.charts.redis.name }}"
|
chart: "redis-repo/{{ .Values.charts.redis.name }}"
|
||||||
@@ -128,6 +130,7 @@ releases:
|
|||||||
- "values-redis.gotmpl"
|
- "values-redis.gotmpl"
|
||||||
- "values-redis.yaml"
|
- "values-redis.yaml"
|
||||||
installed: {{ .Values.redis.enabled }}
|
installed: {{ .Values.redis.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "memcached"
|
- name: "memcached"
|
||||||
chart: "memcached-repo/{{ .Values.charts.memcached.name }}"
|
chart: "memcached-repo/{{ .Values.charts.memcached.name }}"
|
||||||
@@ -136,6 +139,7 @@ releases:
|
|||||||
- "values-memcached.yaml"
|
- "values-memcached.yaml"
|
||||||
- "values-memcached.gotmpl"
|
- "values-memcached.gotmpl"
|
||||||
installed: {{ .Values.memcached.enabled }}
|
installed: {{ .Values.memcached.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "postgresql"
|
- name: "postgresql"
|
||||||
chart: "postgresql-repo/{{ .Values.charts.postgresql.name }}"
|
chart: "postgresql-repo/{{ .Values.charts.postgresql.name }}"
|
||||||
@@ -162,6 +166,7 @@ releases:
|
|||||||
- "values-postfix.yaml"
|
- "values-postfix.yaml"
|
||||||
- "values-postfix.gotmpl"
|
- "values-postfix.gotmpl"
|
||||||
installed: {{ .Values.postfix.enabled }}
|
installed: {{ .Values.postfix.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "clamav"
|
- name: "clamav"
|
||||||
chart: "clamav-repo/{{ .Values.charts.clamav.name }}"
|
chart: "clamav-repo/{{ .Values.charts.clamav.name }}"
|
||||||
@@ -170,6 +175,7 @@ releases:
|
|||||||
- "values-clamav-distributed.yaml"
|
- "values-clamav-distributed.yaml"
|
||||||
- "values-clamav-distributed.gotmpl"
|
- "values-clamav-distributed.gotmpl"
|
||||||
installed: {{ .Values.clamavDistributed.enabled }}
|
installed: {{ .Values.clamavDistributed.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "clamav-simple"
|
- name: "clamav-simple"
|
||||||
chart: "clamav-simple-repo/{{ .Values.charts.clamavSimple.name }}"
|
chart: "clamav-simple-repo/{{ .Values.charts.clamavSimple.name }}"
|
||||||
@@ -178,6 +184,7 @@ releases:
|
|||||||
- "values-clamav-simple.yaml"
|
- "values-clamav-simple.yaml"
|
||||||
- "values-clamav-simple.gotmpl"
|
- "values-clamav-simple.gotmpl"
|
||||||
installed: {{ .Values.clamavSimple.enabled }}
|
installed: {{ .Values.clamavSimple.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "opendesk-gateway"
|
- name: "opendesk-gateway"
|
||||||
chart: "istio-resources-repo/{{ .Values.charts.istioResources.name }}"
|
chart: "istio-resources-repo/{{ .Values.charts.istioResources.name }}"
|
||||||
@@ -186,6 +193,7 @@ releases:
|
|||||||
- "values-istio-gateway.yaml"
|
- "values-istio-gateway.yaml"
|
||||||
- "values-istio-gateway.gotmpl"
|
- "values-istio-gateway.gotmpl"
|
||||||
installed: {{ .Values.istio.enabled }}
|
installed: {{ .Values.istio.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "minio"
|
- name: "minio"
|
||||||
chart: "minio-repo/{{ .Values.charts.minio.name }}"
|
chart: "minio-repo/{{ .Values.charts.minio.name }}"
|
||||||
@@ -194,6 +202,7 @@ releases:
|
|||||||
- "values-minio.yaml"
|
- "values-minio.yaml"
|
||||||
- "values-minio.gotmpl"
|
- "values-minio.gotmpl"
|
||||||
installed: {{ .Values.minio.enabled }}
|
installed: {{ .Values.minio.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
commonLabels:
|
commonLabels:
|
||||||
deploy-stage: "services"
|
deploy-stage: "services"
|
||||||
|
|||||||
@@ -7,7 +7,7 @@ clamd:
|
|||||||
podSecurityContext:
|
podSecurityContext:
|
||||||
replicaCount: {{ .Values.replicas.clamd }}
|
replicaCount: {{ .Values.replicas.clamd }}
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
|
||||||
repository: {{ .Values.images.clamd.repository | quote }}
|
repository: {{ .Values.images.clamd.repository | quote }}
|
||||||
tag: {{ .Values.images.clamd.tag | quote }}
|
tag: {{ .Values.images.clamd.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
@@ -18,7 +18,7 @@ freshclam:
|
|||||||
podSecurityContext:
|
podSecurityContext:
|
||||||
replicaCount: {{ .Values.replicas.freshclam }}
|
replicaCount: {{ .Values.replicas.freshclam }}
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.freshclam.registry | quote }}
|
||||||
repository: {{ .Values.images.freshclam.repository | quote }}
|
repository: {{ .Values.images.freshclam.repository | quote }}
|
||||||
tag: {{ .Values.images.freshclam.tag | quote }}
|
tag: {{ .Values.images.freshclam.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
@@ -32,7 +32,7 @@ global:
|
|||||||
icap:
|
icap:
|
||||||
replicaCount: {{ .Values.replicas.icap }}
|
replicaCount: {{ .Values.replicas.icap }}
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
|
||||||
repository: {{ .Values.images.icap.repository | quote }}
|
repository: {{ .Values.images.icap.repository | quote }}
|
||||||
tag: {{ .Values.images.icap.tag | quote }}
|
tag: {{ .Values.images.icap.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
@@ -43,7 +43,7 @@ milter:
|
|||||||
podSecurityContext:
|
podSecurityContext:
|
||||||
replicaCount: {{ .Values.replicas.milter }}
|
replicaCount: {{ .Values.replicas.milter }}
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.milter.registry | quote }}
|
||||||
repository: {{ .Values.images.milter.repository | quote }}
|
repository: {{ .Values.images.milter.repository | quote }}
|
||||||
tag: {{ .Values.images.milter.tag | quote }}
|
tag: {{ .Values.images.milter.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|||||||
@@ -7,12 +7,12 @@ replicaCount: {{ .Values.replicas.clamav }}
|
|||||||
|
|
||||||
image:
|
image:
|
||||||
clamav:
|
clamav:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.clamd.registry | quote }}
|
||||||
repository: {{ .Values.images.clamd.repository | quote }}
|
repository: {{ .Values.images.clamd.repository | quote }}
|
||||||
tag: {{ .Values.images.clamd.tag | quote }}
|
tag: {{ .Values.images.clamd.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
icap:
|
icap:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.icap.registry | quote }}
|
||||||
repository: {{ .Values.images.icap.repository | quote }}
|
repository: {{ .Values.images.icap.repository | quote }}
|
||||||
tag: {{ .Values.images.icap.tag | quote }}
|
tag: {{ .Values.images.icap.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|||||||
@@ -4,7 +4,6 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
@@ -12,6 +11,7 @@ cleanup:
|
|||||||
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.mariadb.registry | quote }}
|
||||||
repository: {{ .Values.images.mariadb.repository | quote }}
|
repository: {{ .Values.images.mariadb.repository | quote }}
|
||||||
tag: {{ .Values.images.mariadb.tag | quote }}
|
tag: {{ .Values.images.mariadb.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
@@ -19,6 +19,8 @@ image:
|
|||||||
# Open-Xchange and XWiki require the permission to create database schemas, so they use the `root` account anyway.
|
# Open-Xchange and XWiki require the permission to create database schemas, so they use the `root` account anyway.
|
||||||
# Please refer to `databases.yaml` for details.
|
# Please refer to `databases.yaml` for details.
|
||||||
job:
|
job:
|
||||||
|
retries: 10
|
||||||
|
wait: 30
|
||||||
users:
|
users:
|
||||||
- username: "xwiki_user"
|
- username: "xwiki_user"
|
||||||
password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
|
password: {{ .Values.secrets.mariadb.xwikiUser | quote }}
|
||||||
|
|||||||
@@ -22,4 +22,6 @@ podSecurityContext:
|
|||||||
enabled: true
|
enabled: true
|
||||||
fsGroup: 1001
|
fsGroup: 1001
|
||||||
fsGroupChangePolicy: "OnRootMismatch"
|
fsGroupChangePolicy: "OnRootMismatch"
|
||||||
|
|
||||||
|
replicaCount: 1
|
||||||
...
|
...
|
||||||
|
|||||||
@@ -4,16 +4,17 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.memcached.registry | quote }}
|
||||||
repository: {{ .Values.images.memcached.repository | quote }}
|
repository: {{ .Values.images.memcached.repository | quote }}
|
||||||
tag: {{ .Values.images.memcached.tag | quote }}
|
tag: {{ .Values.images.memcached.tag | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|
||||||
|
replicaCount: {{ .Values.replicas.memcached }}
|
||||||
|
|
||||||
resources:
|
resources:
|
||||||
{{ .Values.resources.memcached | toYaml | nindent 2 }}
|
{{ .Values.resources.memcached | toYaml | nindent 2 }}
|
||||||
...
|
...
|
||||||
|
|||||||
@@ -4,12 +4,11 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
registry: "{{ .Values.global.imageRegistry }}"
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: "{{ .Values.global.imageRegistry }}"
|
registry: {{ .Values.global.imageRegistry | default .Values.images.minio.registry | quote }}
|
||||||
repository: "{{ .Values.images.minio.repository }}"
|
repository: "{{ .Values.images.minio.repository }}"
|
||||||
tag: "{{ .Values.images.minio.tag }}"
|
tag: "{{ .Values.images.minio.tag }}"
|
||||||
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
pullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
||||||
|
|||||||
@@ -23,6 +23,11 @@ ingress:
|
|||||||
annotations:
|
annotations:
|
||||||
nginx.org/websocket-services: "minio"
|
nginx.org/websocket-services: "minio"
|
||||||
|
|
||||||
|
apiIngress:
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/proxy-body-size: "4G"
|
||||||
|
nginx.org/client-max-body-size: "4G"
|
||||||
|
|
||||||
networkPolicy:
|
networkPolicy:
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|
||||||
|
|||||||
@@ -4,12 +4,11 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.postfix.registry | quote }}
|
||||||
repository: {{ .Values.images.postfix.repository | quote }}
|
repository: {{ .Values.images.postfix.repository | quote }}
|
||||||
tag: {{ .Values.images.postfix.tag | quote }}
|
tag: {{ .Values.images.postfix.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|||||||
@@ -4,11 +4,11 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.postgresql.registry | quote }}
|
||||||
repository: {{ .Values.images.postgresql.repository | quote }}
|
repository: {{ .Values.images.postgresql.repository | quote }}
|
||||||
tag: {{ .Values.images.postgresql.tag | quote }}
|
tag: {{ .Values.images.postgresql.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
@@ -25,6 +25,8 @@ job:
|
|||||||
password: {{ .Values.secrets.postgresql.matrixUser | quote }}
|
password: {{ .Values.secrets.postgresql.matrixUser | quote }}
|
||||||
- username: "notificationsapi_user"
|
- username: "notificationsapi_user"
|
||||||
password: {{ .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
|
password: {{ .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
|
||||||
|
- username: "guardianmanagementapi_user"
|
||||||
|
password: {{ .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
|
||||||
- username: "selfservice_user"
|
- username: "selfservice_user"
|
||||||
password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
|
password: {{ .Values.secrets.postgresql.umsSelfserviceUser | quote }}
|
||||||
databases:
|
databases:
|
||||||
@@ -37,6 +39,8 @@ job:
|
|||||||
- name: "matrix"
|
- name: "matrix"
|
||||||
user: "matrix_user"
|
user: "matrix_user"
|
||||||
additionalParams: "ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0"
|
additionalParams: "ENCODING 'UTF8' LC_COLLATE='C' LC_CTYPE='C' template=template0"
|
||||||
|
- name: "guardianmanagementapi"
|
||||||
|
user: "guardianmanagementapi_user"
|
||||||
- name: "notificationsapi"
|
- name: "notificationsapi"
|
||||||
user: "notificationsapi_user"
|
user: "notificationsapi_user"
|
||||||
- name: "selfservice"
|
- name: "selfservice"
|
||||||
|
|||||||
@@ -23,7 +23,8 @@ podSecurityContext:
|
|||||||
fsGroup: 1001
|
fsGroup: 1001
|
||||||
fsGroupChangePolicy: "OnRootMismatch"
|
fsGroupChangePolicy: "OnRootMismatch"
|
||||||
|
|
||||||
|
|
||||||
postgres:
|
postgres:
|
||||||
user: "postgres"
|
user: "postgres"
|
||||||
|
|
||||||
|
replicaCount: 1
|
||||||
...
|
...
|
||||||
|
|||||||
@@ -7,18 +7,18 @@ auth:
|
|||||||
password: {{ .Values.secrets.redis.password | quote }}
|
password: {{ .Values.secrets.redis.password | quote }}
|
||||||
|
|
||||||
global:
|
global:
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
storageClass: {{ .Values.persistence.storageClassNames.RWO | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.redis.registry | quote }}
|
||||||
repository: {{ .Values.images.redis.repository | quote }}
|
repository: {{ .Values.images.redis.repository | quote }}
|
||||||
tag: {{ .Values.images.redis.tag | quote }}
|
tag: {{ .Values.images.redis.tag | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|
||||||
master:
|
master:
|
||||||
|
count: {{ .Values.replicas.redis }}
|
||||||
persistence:
|
persistence:
|
||||||
size: {{ .Values.persistence.size.redis | quote }}
|
size: {{ .Values.persistence.size.redis | quote }}
|
||||||
|
|
||||||
|
|||||||
@@ -6,136 +6,171 @@ bases:
|
|||||||
---
|
---
|
||||||
repositories:
|
repositories:
|
||||||
# Univention Management Stack
|
# Univention Management Stack
|
||||||
|
- name: "ums-guardian-management-api-repo"
|
||||||
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
|
verify: {{ .Values.charts.umsGuardianManagementApi.verify }}
|
||||||
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsGuardianManagementApi.registry }}/{{ .Values.charts.umsGuardianManagementApi.repository }}"
|
||||||
|
- name: "ums-guardian-management-ui-repo"
|
||||||
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
|
verify: {{ .Values.charts.umsGuardianManagementUi.verify }}
|
||||||
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsGuardianManagementUi.registry }}/{{ .Values.charts.umsGuardianManagementUi.repository }}"
|
||||||
|
- name: "ums-guardian-authorization-api-repo"
|
||||||
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
|
verify: {{ .Values.charts.umsGuardianAuthorizationApi.verify }}
|
||||||
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsGuardianAuthorizationApi.registry }}/{{ .Values.charts.umsGuardianAuthorizationApi.repository }}"
|
||||||
|
- name: "ums-open-policy-agent-repo"
|
||||||
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
|
verify: {{ .Values.charts.umsOpenPolicyAgent.verify }}
|
||||||
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsOpenPolicyAgent.registry }}/{{ .Values.charts.umsOpenPolicyAgent.repository }}"
|
||||||
- name: "ums-store-dav-repo"
|
- name: "ums-store-dav-repo"
|
||||||
oci: {{ .Values.charts.umsStoreDav.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsStoreDav.verify }}
|
verify: {{ .Values.charts.umsStoreDav.verify }}
|
||||||
username: {{ .Values.charts.umsStoreDav.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsStoreDav.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsStoreDav.registry }}/{{ .Values.charts.umsStoreDav.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsStoreDav.registry }}/{{ .Values.charts.umsStoreDav.repository }}"
|
||||||
- name: "ums-ldap-server-repo"
|
- name: "ums-ldap-server-repo"
|
||||||
oci: {{ .Values.charts.umsLdapServer.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsLdapServer.verify }}
|
verify: {{ .Values.charts.umsLdapServer.verify }}
|
||||||
username: {{ .Values.charts.umsLdapServer.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsLdapServer.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsLdapServer.registry }}/{{ .Values.charts.umsLdapServer.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsLdapServer.registry }}/{{ .Values.charts.umsLdapServer.repository }}"
|
||||||
- name: "ums-ldap-notifier-repo"
|
- name: "ums-ldap-notifier-repo"
|
||||||
oci: {{ .Values.charts.umsLdapNotifier.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsLdapNotifier.verify }}
|
verify: {{ .Values.charts.umsLdapNotifier.verify }}
|
||||||
username: {{ .Values.charts.umsLdapNotifier.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsLdapNotifier.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsLdapNotifier.registry }}/{{ .Values.charts.umsLdapNotifier.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsLdapNotifier.registry }}/{{ .Values.charts.umsLdapNotifier.repository }}"
|
||||||
- name: "ums-udm-rest-api-repo"
|
- name: "ums-udm-rest-api-repo"
|
||||||
oci: {{ .Values.charts.umsUdmRestApi.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsUdmRestApi.verify }}
|
verify: {{ .Values.charts.umsUdmRestApi.verify }}
|
||||||
username: {{ .Values.charts.umsUdmRestApi.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsUdmRestApi.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsUdmRestApi.registry }}/{{ .Values.charts.umsUdmRestApi.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsUdmRestApi.registry }}/{{ .Values.charts.umsUdmRestApi.repository }}"
|
||||||
- name: "ums-stack-data-ums-repo"
|
- name: "ums-stack-data-ums-repo"
|
||||||
oci: {{ .Values.charts.umsStackDataUms.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsStackDataUms.verify }}
|
verify: {{ .Values.charts.umsStackDataUms.verify }}
|
||||||
username: {{ .Values.charts.umsStackDataUms.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsStackDataUms.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsStackDataUms.registry }}/{{ .Values.charts.umsStackDataUms.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsStackDataUms.registry }}/{{ .Values.charts.umsStackDataUms.repository }}"
|
||||||
- name: "ums-stack-data-swp-repo"
|
- name: "ums-stack-data-swp-repo"
|
||||||
oci: {{ .Values.charts.umsStackDataSwp.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsStackDataSwp.verify }}
|
verify: {{ .Values.charts.umsStackDataSwp.verify }}
|
||||||
username: {{ .Values.charts.umsStackDataSwp.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsStackDataSwp.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsStackDataSwp.registry }}/{{ .Values.charts.umsStackDataSwp.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsStackDataSwp.registry }}/{{ .Values.charts.umsStackDataSwp.repository }}"
|
||||||
- name: "ums-portal-server-repo"
|
- name: "ums-portal-server-repo"
|
||||||
oci: {{ .Values.charts.umsPortalServer.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsPortalServer.verify }}
|
verify: {{ .Values.charts.umsPortalServer.verify }}
|
||||||
username: {{ .Values.charts.umsPortalServer.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsPortalServer.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsPortalServer.registry }}/{{ .Values.charts.umsPortalServer.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsPortalServer.registry }}/{{ .Values.charts.umsPortalServer.repository }}"
|
||||||
- name: "ums-notifications-api-repo"
|
- name: "ums-notifications-api-repo"
|
||||||
oci: {{ .Values.charts.umsNotificationsApi.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsNotificationsApi.verify }}
|
verify: {{ .Values.charts.umsNotificationsApi.verify }}
|
||||||
username: {{ .Values.charts.umsNotificationsApi.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsNotificationsApi.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsNotificationsApi.registry }}/{{ .Values.charts.umsNotificationsApi.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsNotificationsApi.registry }}/{{ .Values.charts.umsNotificationsApi.repository }}"
|
||||||
- name: "ums-portal-listener-repo"
|
- name: "ums-portal-listener-repo"
|
||||||
oci: {{ .Values.charts.umsPortalListener.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsPortalListener.verify }}
|
verify: {{ .Values.charts.umsPortalListener.verify }}
|
||||||
username: {{ .Values.charts.umsPortalListener.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsPortalListener.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsPortalListener.registry }}/{{ .Values.charts.umsPortalListener.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsPortalListener.registry }}/{{ .Values.charts.umsPortalListener.repository }}"
|
||||||
- name: "ums-portal-frontend-repo"
|
- name: "ums-portal-frontend-repo"
|
||||||
oci: {{ .Values.charts.umsPortalFrontend.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsPortalFrontend.verify }}
|
verify: {{ .Values.charts.umsPortalFrontend.verify }}
|
||||||
username: {{ .Values.charts.umsPortalFrontend.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsPortalFrontend.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsPortalFrontend.registry }}/{{ .Values.charts.umsPortalFrontend.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsPortalFrontend.registry }}/{{ .Values.charts.umsPortalFrontend.repository }}"
|
||||||
- name: "ums-umc-gateway-repo"
|
- name: "ums-umc-gateway-repo"
|
||||||
oci: {{ .Values.charts.umsUmcGateway.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsUmcGateway.verify }}
|
verify: {{ .Values.charts.umsUmcGateway.verify }}
|
||||||
username: {{ .Values.charts.umsUmcGateway.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsUmcGateway.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsUmcGateway.registry }}/{{ .Values.charts.umsUmcGateway.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsUmcGateway.registry }}/{{ .Values.charts.umsUmcGateway.repository }}"
|
||||||
- name: "ums-umc-server-repo"
|
- name: "ums-umc-server-repo"
|
||||||
oci: {{ .Values.charts.umsUmcServer.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsUmcServer.verify }}
|
verify: {{ .Values.charts.umsUmcServer.verify }}
|
||||||
username: {{ .Values.charts.umsUmcServer.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsUmcServer.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsUmcServer.registry }}/{{ .Values.charts.umsUmcServer.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsUmcServer.registry }}/{{ .Values.charts.umsUmcServer.repository }}"
|
||||||
- name: "ums-selfservice-listener-repo"
|
- name: "ums-selfservice-listener-repo"
|
||||||
oci: {{ .Values.charts.umsSelfserviceListener.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsSelfserviceListener.verify }}
|
verify: {{ .Values.charts.umsSelfserviceListener.verify }}
|
||||||
username: {{ .Values.charts.umsSelfserviceListener.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.umsSelfserviceListener.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.umsSelfserviceListener.registry }}/{{ .Values.charts.umsSelfserviceListener.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsSelfserviceListener.registry }}/{{ .Values.charts.umsSelfserviceListener.repository }}"
|
||||||
|
- name: "ums-provisioning-repo"
|
||||||
|
keyring: "../../files/gpg-pubkeys/univention-de.gpg"
|
||||||
|
verify: {{ .Values.charts.umsProvisioning.verify }}
|
||||||
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsProvisioning.registry }}/{{ .Values.charts.umsProvisioning.repository }}"
|
||||||
|
|
||||||
# Univention Keycloak Extensions
|
# Univention Keycloak Extensions
|
||||||
- name: "ums-keycloak-extensions-repo"
|
- name: "ums-keycloak-extensions-repo"
|
||||||
oci: {{ .Values.charts.umsKeycloakExtensions.oci }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
username: {{ .Values.charts.umsKeycloakExtensions.username | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
password: {{ .Values.charts.umsKeycloakExtensions.password | quote }}
|
oci: true
|
||||||
url: "{{ .Values.charts.umsKeycloakExtensions.registry }}/{{ .Values.charts.umsKeycloakExtensions.repository }}"
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsKeycloakExtensions.registry }}/{{ .Values.charts.umsKeycloakExtensions.repository }}"
|
||||||
# Univention Keycloak
|
# Univention Keycloak
|
||||||
- name: "ums-keycloak-repo"
|
- name: "ums-keycloak-repo"
|
||||||
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsKeycloak.verify }}
|
verify: {{ .Values.charts.umsKeycloak.verify }}
|
||||||
oci: {{ .Values.charts.umsKeycloak.oci }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
username: {{ .Values.charts.umsKeycloak.username | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
password: {{ .Values.charts.umsKeycloak.password | quote }}
|
oci: true
|
||||||
url: "{{ .Values.charts.umsKeycloak.registry }}/{{ .Values.charts.umsKeycloak.repository }}"
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsKeycloak.registry }}/{{ .Values.charts.umsKeycloak.repository }}"
|
||||||
- name: "ums-keycloak-bootstrap-repo"
|
- name: "ums-keycloak-bootstrap-repo"
|
||||||
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
keyring: "../../files/gpg-pubkeys/souvap-univention-de.gpg"
|
||||||
verify: {{ .Values.charts.umsKeycloakBootstrap.verify }}
|
verify: {{ .Values.charts.umsKeycloakBootstrap.verify }}
|
||||||
oci: {{ .Values.charts.umsKeycloakBootstrap.oci }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
username: {{ .Values.charts.umsKeycloakBootstrap.username | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
password: {{ .Values.charts.umsKeycloakBootstrap.password | quote }}
|
oci: true
|
||||||
url: "{{ .Values.charts.umsKeycloakBootstrap.registry }}/{{ .Values.charts.umsKeycloakBootstrap.repository }}"
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.umsKeycloakBootstrap.registry }}/{{ .Values.charts.umsKeycloakBootstrap.repository }}"
|
||||||
- name: "opendesk-keycloak-bootstrap-repo"
|
- name: "opendesk-keycloak-bootstrap-repo"
|
||||||
oci: {{ .Values.charts.opendeskKeycloakBootstrap.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
|
verify: {{ .Values.charts.opendeskKeycloakBootstrap.verify }}
|
||||||
username: {{ .Values.charts.opendeskKeycloakBootstrap.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.opendeskKeycloakBootstrap.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.opendeskKeycloakBootstrap.registry }}/\
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.opendeskKeycloakBootstrap.registry }}/\
|
||||||
{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
|
{{ .Values.charts.opendeskKeycloakBootstrap.repository }}"
|
||||||
# VMWare Bitnami
|
# VMWare Bitnami
|
||||||
# Source: https://github.com/bitnami/charts/
|
# Source: https://github.com/bitnami/charts/
|
||||||
- name: "nginx-repo"
|
- name: "nginx-repo"
|
||||||
oci: {{ .Values.charts.nginx.oci }}
|
|
||||||
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
keyring: "../../files/gpg-pubkeys/opencode.gpg"
|
||||||
verify: {{ .Values.charts.nginx.verify }}
|
verify: {{ .Values.charts.nginx.verify }}
|
||||||
username: {{ .Values.charts.nginx.username | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
password: {{ .Values.charts.nginx.password | quote }}
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
url: "{{ .Values.charts.nginx.registry }}/{{ .Values.charts.nginx.repository }}"
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.nginx.registry }}/{{ .Values.charts.nginx.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "ums-keycloak"
|
- name: "ums-keycloak"
|
||||||
@@ -154,6 +189,7 @@ releases:
|
|||||||
needs:
|
needs:
|
||||||
- "ums-keycloak"
|
- "ums-keycloak"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-keycloak-bootstrap"
|
- name: "ums-keycloak-bootstrap"
|
||||||
chart: "ums-keycloak-bootstrap-repo/{{ .Values.charts.umsKeycloakBootstrap.name }}"
|
chart: "ums-keycloak-bootstrap-repo/{{ .Values.charts.umsKeycloakBootstrap.name }}"
|
||||||
@@ -163,6 +199,7 @@ releases:
|
|||||||
needs:
|
needs:
|
||||||
- "ums-keycloak"
|
- "ums-keycloak"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "opendesk-keycloak-bootstrap"
|
- name: "opendesk-keycloak-bootstrap"
|
||||||
chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.opendeskKeycloakBootstrap.name }}"
|
chart: "opendesk-keycloak-bootstrap-repo/{{ .Values.charts.opendeskKeycloakBootstrap.name }}"
|
||||||
@@ -172,6 +209,7 @@ releases:
|
|||||||
needs:
|
needs:
|
||||||
- "ums-keycloak-bootstrap"
|
- "ums-keycloak-bootstrap"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-stack-gateway"
|
- name: "ums-stack-gateway"
|
||||||
chart: "nginx-repo/{{ .Values.charts.nginx.name }}"
|
chart: "nginx-repo/{{ .Values.charts.nginx.name }}"
|
||||||
@@ -180,6 +218,7 @@ releases:
|
|||||||
- "values-ums-stack-gateway.gotmpl"
|
- "values-ums-stack-gateway.gotmpl"
|
||||||
- "values-ums-stack-gateway.yaml"
|
- "values-ums-stack-gateway.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-store-dav"
|
- name: "ums-store-dav"
|
||||||
chart: "ums-store-dav-repo/{{ .Values.charts.umsStoreDav.name }}"
|
chart: "ums-store-dav-repo/{{ .Values.charts.umsStoreDav.name }}"
|
||||||
@@ -190,6 +229,7 @@ releases:
|
|||||||
- "values-store-dav.gotmpl"
|
- "values-store-dav.gotmpl"
|
||||||
- "values-store-dav.yaml"
|
- "values-store-dav.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-ldap-server"
|
- name: "ums-ldap-server"
|
||||||
chart: "ums-ldap-server-repo/{{ .Values.charts.umsLdapServer.name }}"
|
chart: "ums-ldap-server-repo/{{ .Values.charts.umsLdapServer.name }}"
|
||||||
@@ -222,6 +262,7 @@ releases:
|
|||||||
- "values-udm-rest-api.gotmpl"
|
- "values-udm-rest-api.gotmpl"
|
||||||
- "values-udm-rest-api.yaml"
|
- "values-udm-rest-api.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-stack-data-ums"
|
- name: "ums-stack-data-ums"
|
||||||
chart: "ums-stack-data-ums-repo/{{ .Values.charts.umsStackDataUms.name }}"
|
chart: "ums-stack-data-ums-repo/{{ .Values.charts.umsStackDataUms.name }}"
|
||||||
@@ -232,6 +273,7 @@ releases:
|
|||||||
- "values-stack-data-ums.gotmpl"
|
- "values-stack-data-ums.gotmpl"
|
||||||
- "values-stack-data-ums.yaml"
|
- "values-stack-data-ums.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-stack-data-swp"
|
- name: "ums-stack-data-swp"
|
||||||
chart: "ums-stack-data-swp-repo/{{ .Values.charts.umsStackDataSwp.name }}"
|
chart: "ums-stack-data-swp-repo/{{ .Values.charts.umsStackDataSwp.name }}"
|
||||||
@@ -242,6 +284,7 @@ releases:
|
|||||||
- "values-stack-data-swp.gotmpl"
|
- "values-stack-data-swp.gotmpl"
|
||||||
- "values-stack-data-swp.yaml"
|
- "values-stack-data-swp.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-portal-server"
|
- name: "ums-portal-server"
|
||||||
chart: "ums-portal-server-repo/{{ .Values.charts.umsPortalServer.name }}"
|
chart: "ums-portal-server-repo/{{ .Values.charts.umsPortalServer.name }}"
|
||||||
@@ -252,6 +295,7 @@ releases:
|
|||||||
- "values-portal-server.gotmpl"
|
- "values-portal-server.gotmpl"
|
||||||
- "values-portal-server.yaml"
|
- "values-portal-server.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-notifications-api"
|
- name: "ums-notifications-api"
|
||||||
chart: "ums-notifications-api-repo/{{ .Values.charts.umsNotificationsApi.name }}"
|
chart: "ums-notifications-api-repo/{{ .Values.charts.umsNotificationsApi.name }}"
|
||||||
@@ -262,6 +306,7 @@ releases:
|
|||||||
- "values-notifications-api.gotmpl"
|
- "values-notifications-api.gotmpl"
|
||||||
- "values-notifications-api.yaml"
|
- "values-notifications-api.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-portal-listener"
|
- name: "ums-portal-listener"
|
||||||
chart: "ums-portal-listener-repo/{{ .Values.charts.umsPortalListener.name }}"
|
chart: "ums-portal-listener-repo/{{ .Values.charts.umsPortalListener.name }}"
|
||||||
@@ -272,6 +317,7 @@ releases:
|
|||||||
- "values-portal-listener.gotmpl"
|
- "values-portal-listener.gotmpl"
|
||||||
- "values-portal-listener.yaml"
|
- "values-portal-listener.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-portal-frontend"
|
- name: "ums-portal-frontend"
|
||||||
chart: "ums-portal-frontend-repo/{{ .Values.charts.umsPortalFrontend.name }}"
|
chart: "ums-portal-frontend-repo/{{ .Values.charts.umsPortalFrontend.name }}"
|
||||||
@@ -282,6 +328,7 @@ releases:
|
|||||||
- "values-portal-frontend.gotmpl"
|
- "values-portal-frontend.gotmpl"
|
||||||
- "values-portal-frontend.yaml"
|
- "values-portal-frontend.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-umc-gateway"
|
- name: "ums-umc-gateway"
|
||||||
chart: "ums-umc-gateway-repo/{{ .Values.charts.umsUmcGateway.name }}"
|
chart: "ums-umc-gateway-repo/{{ .Values.charts.umsUmcGateway.name }}"
|
||||||
@@ -292,6 +339,7 @@ releases:
|
|||||||
- "values-umc-gateway.gotmpl"
|
- "values-umc-gateway.gotmpl"
|
||||||
- "values-umc-gateway.yaml"
|
- "values-umc-gateway.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
- name: "ums-umc-server"
|
- name: "ums-umc-server"
|
||||||
chart: "ums-umc-server-repo/{{ .Values.charts.umsUmcServer.name }}"
|
chart: "ums-umc-server-repo/{{ .Values.charts.umsUmcServer.name }}"
|
||||||
@@ -313,6 +361,62 @@ releases:
|
|||||||
- "values-selfservice-listener.gotmpl"
|
- "values-selfservice-listener.gotmpl"
|
||||||
- "values-selfservice-listener.yaml"
|
- "values-selfservice-listener.yaml"
|
||||||
installed: {{ .Values.univentionManagementStack.enabled }}
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
|
- name: "ums-provisioning"
|
||||||
|
chart: "ums-provisioning-repo/{{ .Values.charts.umsProvisioning.name }}"
|
||||||
|
version: "{{ .Values.charts.umsProvisioning.version }}"
|
||||||
|
values:
|
||||||
|
- "values-common.gotmpl"
|
||||||
|
- "values-common.yaml"
|
||||||
|
- "values-provisioning.gotmpl"
|
||||||
|
- "values-provisioning.yaml"
|
||||||
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
|
- name: "ums-guardian-management-api"
|
||||||
|
chart: "ums-guardian-management-api-repo/{{ .Values.charts.umsGuardianManagementApi.name }}"
|
||||||
|
version: "{{ .Values.charts.umsGuardianManagementApi.version }}"
|
||||||
|
values:
|
||||||
|
- "values-common.gotmpl"
|
||||||
|
- "values-common.yaml"
|
||||||
|
- "values-guardian-management-api.gotmpl"
|
||||||
|
- "values-guardian-management-api.yaml"
|
||||||
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
|
- name: "ums-guardian-management-ui"
|
||||||
|
chart: "ums-guardian-management-ui-repo/{{ .Values.charts.umsGuardianManagementUi.name }}"
|
||||||
|
version: "{{ .Values.charts.umsGuardianManagementUi.version }}"
|
||||||
|
values:
|
||||||
|
- "values-common.gotmpl"
|
||||||
|
- "values-common.yaml"
|
||||||
|
- "values-guardian-management-ui.gotmpl"
|
||||||
|
- "values-guardian-management-ui.yaml"
|
||||||
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
|
- name: "ums-guardian-authorization-api"
|
||||||
|
chart: "ums-guardian-authorization-api-repo/{{ .Values.charts.umsGuardianAuthorizationApi.name }}"
|
||||||
|
version: "{{ .Values.charts.umsGuardianAuthorizationApi.version }}"
|
||||||
|
values:
|
||||||
|
- "values-common.gotmpl"
|
||||||
|
- "values-common.yaml"
|
||||||
|
- "values-guardian-authorization-api.gotmpl"
|
||||||
|
- "values-guardian-authorization-api.yaml"
|
||||||
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
|
- name: "ums-open-policy-agent"
|
||||||
|
chart: "ums-open-policy-agent-repo/{{ .Values.charts.umsOpenPolicyAgent.name }}"
|
||||||
|
version: "{{ .Values.charts.umsOpenPolicyAgent.version }}"
|
||||||
|
values:
|
||||||
|
- "values-common.gotmpl"
|
||||||
|
- "values-common.yaml"
|
||||||
|
- "values-open-policy-agent.gotmpl"
|
||||||
|
- "values-open-policy-agent.yaml"
|
||||||
|
installed: {{ .Values.univentionManagementStack.enabled }}
|
||||||
|
timeout: 900
|
||||||
|
|
||||||
commonLabels:
|
commonLabels:
|
||||||
deploy-stage: "component-1"
|
deploy-stage: "component-1"
|
||||||
|
|||||||
@@ -0,0 +1,21 @@
|
|||||||
|
{{/*
|
||||||
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
|
---
|
||||||
|
guardianAuthorizationApi:
|
||||||
|
udmDataAdapterPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
|
||||||
|
oauthAdapterWellKnownUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080/realms/{{ .Values.platform.realm }}/.well-known/openid-configuration"
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsGuardianAuthorizationApi.registry | quote }}
|
||||||
|
repository: {{ .Values.images.umsGuardianAuthorizationApi.repository | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.umsGuardianAuthorizationApi.tag | quote }}
|
||||||
|
pullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.umsGuardianAuthorizationApi | toYaml | nindent 2 }}
|
||||||
|
...
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
---
|
||||||
|
guardianAuthorizationApi:
|
||||||
|
home: "/guardian_service_dir"
|
||||||
|
guardianAuthzCorsAllowedOrigins: "*"
|
||||||
|
guardianAuthzAdapterSettingsPort: "env"
|
||||||
|
guardianAuthzAdapterAppPersistencePort: "udm_data"
|
||||||
|
guardianAuthzAdapterPolicyPort: "opa"
|
||||||
|
guardianAuthzAdapterAuthenticationPort: "fast_api_oauth"
|
||||||
|
isUniventionAppCenter: 0
|
||||||
|
udmDataAdapterUrl: "http://ums-udm-rest-api/udm/"
|
||||||
|
udmDataAdapterUsername: "cn=admin"
|
||||||
|
opaAdapterUrl: "http://ums-open-policy-agent/"
|
||||||
|
guardianAuthzLoggingLevel: "DEBUG"
|
||||||
|
guardianAuthzLoggingStructured: false
|
||||||
|
guardianAuthzLoggingFormat: "<green>{time:YYYY-MM-DD HH:mm:ss.SSS ZZ}</green> | <level>{level}</level> | <level>{message}</level> | {extra}"
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
add:
|
||||||
|
- "CHOWN"
|
||||||
|
- "DAC_OVERRIDE"
|
||||||
|
- "FOWNER"
|
||||||
|
- "FSETID"
|
||||||
|
- "KILL"
|
||||||
|
- "SETGID"
|
||||||
|
- "SETUID"
|
||||||
|
- "SETPCAP"
|
||||||
|
- "NET_BIND_SERVICE"
|
||||||
|
- "NET_RAW"
|
||||||
|
- "SYS_CHROOT"
|
||||||
|
privileged: false
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
...
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
{{/*
|
||||||
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
|
---
|
||||||
|
guardianManagementApi:
|
||||||
|
oauthAdapterM2mSecret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
|
||||||
|
oauthAdapterWellKnownUrl: "http://ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080/realms/{{ .Values.platform.realm }}/.well-known/openid-configuration"
|
||||||
|
|
||||||
|
postgresql:
|
||||||
|
bundled: false
|
||||||
|
connection:
|
||||||
|
host: {{ .Values.databases.umsGuardianManagementApi.host | quote }}
|
||||||
|
port: {{ .Values.databases.umsGuardianManagementApi.port | quote }}
|
||||||
|
auth:
|
||||||
|
username: {{ .Values.databases.umsGuardianManagementApi.username | quote }}
|
||||||
|
database: {{ .Values.databases.umsGuardianManagementApi.name | quote }}
|
||||||
|
password: {{ .Values.databases.umsGuardianManagementApi.password | default .Values.secrets.postgresql.umsGuardianManagementApiUser | quote }}
|
||||||
|
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsGuardianManagementApi.registry | quote }}
|
||||||
|
repository: {{ .Values.images.umsGuardianManagementApi.repository | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.umsGuardianManagementApi.tag | quote }}
|
||||||
|
pullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.umsGuardianManagementApi | toYaml | nindent 2 }}
|
||||||
|
...
|
||||||
@@ -0,0 +1,47 @@
|
|||||||
|
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
---
|
||||||
|
guardianManagementApi:
|
||||||
|
home: "/guardian_service_dir"
|
||||||
|
guardianManagementCorsAllowedOrigins: "*"
|
||||||
|
guardianManagementAdapterSettingsPort: "env"
|
||||||
|
guardianManagementAdapterAppPersistencePort: "sql"
|
||||||
|
guardianManagementAdapterConditionPersistencePort: "sql"
|
||||||
|
guardianManagementAdapterContextPersistencePort: "sql"
|
||||||
|
guardianManagementAdapterNamespacePersistencePort: "sql"
|
||||||
|
guardianManagementAdapterPermissionPersistencePort: "sql"
|
||||||
|
guardianManagementAdapterRolePersistencePort: "sql"
|
||||||
|
guardianManagementAdapterCapabilityPersistencePort: "sql"
|
||||||
|
guardianManagementAdapterAuthenticationPort: "fast_api_oauth"
|
||||||
|
guardianManagementAdapterAuthorizationApiUrl: "http://ums-guardian-authorization-api/guardian/authorization"
|
||||||
|
guardianManagementAdapterResourceAuthorizationPort: "always"
|
||||||
|
isUniventionAppCenter: 0
|
||||||
|
sqlPersistenceAdapterDialect: "postgresql"
|
||||||
|
sqlPersistenceAdapterDbName: "postgres"
|
||||||
|
oauthAdapterM2mSecretFile: "/var/secrets/oauthAdapterM2mSecret"
|
||||||
|
guardianManagementLoggingLevel: "DEBUG"
|
||||||
|
guardianManagementLoggingStructured: false
|
||||||
|
guardianManagementLoggingFormat: "<green>{time:YYYY-MM-DD HH:mm:ss.SSS ZZ}</green> | <level>{level}</level> | <level>{message}</level> | {extra}"
|
||||||
|
guardianManagementBaseUrl: "http://0.0.0.0:8000"
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
add:
|
||||||
|
- "CHOWN"
|
||||||
|
- "DAC_OVERRIDE"
|
||||||
|
- "FOWNER"
|
||||||
|
- "FSETID"
|
||||||
|
- "KILL"
|
||||||
|
- "SETGID"
|
||||||
|
- "SETUID"
|
||||||
|
- "SETPCAP"
|
||||||
|
- "NET_BIND_SERVICE"
|
||||||
|
- "NET_RAW"
|
||||||
|
- "SYS_CHROOT"
|
||||||
|
privileged: false
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
...
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
{{/*
|
||||||
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
|
---
|
||||||
|
guardianManagementUi:
|
||||||
|
viteApiDataAdapterUri: "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/management"
|
||||||
|
viteKeycloakAuthenticationAdapterSsoUri: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||||
|
viteKeycloakAuthenticationAdapterRealm: {{ .Values.platform.realm | quote }}
|
||||||
|
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsGuardianManagementUi.registry | quote }}
|
||||||
|
repository: {{ .Values.images.umsGuardianManagementUi.repository | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.umsGuardianManagementUi.tag | quote }}
|
||||||
|
pullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.umsGuardianManagementUi | toYaml | nindent 2 }}
|
||||||
|
...
|
||||||
@@ -1,7 +1,12 @@
|
|||||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
---
|
---
|
||||||
containerSecurityContext:
|
guardianManagementUi:
|
||||||
|
viteManagementUiAdapterAuthenticationPort: "keycloak"
|
||||||
|
viteManagementUiAdapterDataPort: "api"
|
||||||
|
viteKeycloakAuthenticationAdapterClientId: "guardian-ui"
|
||||||
|
|
||||||
|
securityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
capabilities:
|
capabilities:
|
||||||
drop:
|
drop:
|
||||||
@@ -9,33 +14,16 @@ containerSecurityContext:
|
|||||||
add:
|
add:
|
||||||
- "CHOWN"
|
- "CHOWN"
|
||||||
- "DAC_OVERRIDE"
|
- "DAC_OVERRIDE"
|
||||||
|
- "FOWNER"
|
||||||
|
- "FSETID"
|
||||||
- "KILL"
|
- "KILL"
|
||||||
- "NET_BIND_SERVICE"
|
|
||||||
- "SETGID"
|
- "SETGID"
|
||||||
- "SETUID"
|
- "SETUID"
|
||||||
|
- "SETPCAP"
|
||||||
|
- "NET_BIND_SERVICE"
|
||||||
|
- "NET_RAW"
|
||||||
- "SYS_CHROOT"
|
- "SYS_CHROOT"
|
||||||
enabled: true
|
privileged: false
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
seccompProfile:
|
seccompProfile:
|
||||||
type: "RuntimeDefault"
|
type: "RuntimeDefault"
|
||||||
|
|
||||||
dovecot:
|
|
||||||
ldap:
|
|
||||||
enabled: true
|
|
||||||
port: 389
|
|
||||||
base: "dc=swp-ldap,dc=internal"
|
|
||||||
|
|
||||||
oidc:
|
|
||||||
enabled: true
|
|
||||||
clientID: "opendesk-dovecot"
|
|
||||||
usernameAttribute: "opendesk_username"
|
|
||||||
|
|
||||||
submission:
|
|
||||||
enabled: true
|
|
||||||
ssl: "no"
|
|
||||||
host: "postfix:25"
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
enabled: true
|
|
||||||
fsGroup: 1000
|
|
||||||
...
|
...
|
||||||
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsLdapNotifier.registry | quote }}
|
||||||
repository: {{ .Values.images.umsLdapNotifier.repository | quote }}
|
repository: {{ .Values.images.umsLdapNotifier.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsLdapNotifier.tag | quote }}
|
tag: {{ .Values.images.umsLdapNotifier.tag | quote }}
|
||||||
|
|||||||
@@ -8,7 +8,7 @@ ldapServer:
|
|||||||
ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
|
ldapBaseDn: {{ .Values.ldap.baseDn | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsLdapServer.registry | quote }}
|
||||||
repository: {{ .Values.images.umsLdapServer.repository | quote }}
|
repository: {{ .Values.images.umsLdapServer.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsLdapServer.tag | quote }}
|
tag: {{ .Values.images.umsLdapServer.tag | quote }}
|
||||||
@@ -18,7 +18,7 @@ image:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
waitForDependency:
|
waitForDependency:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsWaitForDependency.registry | quote }}
|
||||||
repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
|
repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
|
tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
|
||||||
|
|||||||
@@ -14,7 +14,7 @@ postgresql:
|
|||||||
password: {{ .Values.databases.umsNotificationsApi.password | default .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
|
password: {{ .Values.databases.umsNotificationsApi.password | default .Values.secrets.postgresql.umsNotificationsApiUser | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsNotificationsApi.registry | quote }}
|
||||||
repository: {{ .Values.images.umsNotificationsApi.repository }}
|
repository: {{ .Values.images.umsNotificationsApi.repository }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy }}
|
pullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||||
tag: {{ .Values.images.umsNotificationsApi.tag }}
|
tag: {{ .Values.images.umsNotificationsApi.tag }}
|
||||||
|
|||||||
@@ -0,0 +1,18 @@
|
|||||||
|
{{/*
|
||||||
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
|
---
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsOpenPolicyAgent.registry | quote }}
|
||||||
|
repository: {{ .Values.images.umsOpenPolicyAgent.repository | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.umsOpenPolicyAgent.tag | quote }}
|
||||||
|
pullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.umsOpenPolicyAgent | toYaml | nindent 2 }}
|
||||||
|
...
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
---
|
||||||
|
openPolicyAgent:
|
||||||
|
isUniventionAppCenter: 0
|
||||||
|
opaDataBundle: "bundles/GuardianDataBundle.tar.gz"
|
||||||
|
opaPolicyBundle: "bundles/GuardianPolicyBundle.tar.gz"
|
||||||
|
opaPollingMinDelay: 10
|
||||||
|
opaPollingMaxDelay: 15
|
||||||
|
opaGuardianManagementUrl: "http://ums-guardian-management-api/guardian/management"
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- "ALL"
|
||||||
|
add:
|
||||||
|
- "CHOWN"
|
||||||
|
- "DAC_OVERRIDE"
|
||||||
|
- "FOWNER"
|
||||||
|
- "FSETID"
|
||||||
|
- "KILL"
|
||||||
|
- "SETGID"
|
||||||
|
- "SETUID"
|
||||||
|
- "SETPCAP"
|
||||||
|
- "NET_BIND_SERVICE"
|
||||||
|
- "NET_RAW"
|
||||||
|
- "SYS_CHROOT"
|
||||||
|
privileged: false
|
||||||
|
seccompProfile:
|
||||||
|
type: "RuntimeDefault"
|
||||||
|
...
|
||||||
@@ -7,15 +7,14 @@ global:
|
|||||||
domain: "{{ .Values.global.domain }}"
|
domain: "{{ .Values.global.domain }}"
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
registry: "{{ .Values.global.imageRegistry }}"
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: "{{ .Values.global.imageRegistry }}"
|
registry: {{ .Values.global.imageRegistry | default .Values.images.opendeskKeycloakBootstrap.registry | quote }}
|
||||||
repository: "{{ .Values.images.opendeskKeycloakBootstrap.repository }}"
|
repository: {{ .Values.images.opendeskKeycloakBootstrap.repository | quote }}
|
||||||
tag: "{{ .Values.images.opendeskKeycloakBootstrap.tag }}"
|
tag: {{ .Values.images.opendeskKeycloakBootstrap.tag | quote }}
|
||||||
imagePullPolicy: "{{ .Values.global.imagePullPolicy }}"
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|
||||||
cleanup:
|
cleanup:
|
||||||
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
deletePodsOnSuccess: {{ .Values.cleanup.deletePodsOnSuccess }}
|
||||||
@@ -69,6 +68,7 @@ config:
|
|||||||
consentRequired: false
|
consentRequired: false
|
||||||
frontchannelLogout: false
|
frontchannelLogout: false
|
||||||
publicClient: false
|
publicClient: false
|
||||||
|
authorizationServicesEnabled: false
|
||||||
attributes:
|
attributes:
|
||||||
backchannel.logout.session.required: false
|
backchannel.logout.session.required: false
|
||||||
defaultClientScopes:
|
defaultClientScopes:
|
||||||
@@ -83,6 +83,7 @@ config:
|
|||||||
consentRequired: false
|
consentRequired: false
|
||||||
frontchannelLogout: false
|
frontchannelLogout: false
|
||||||
publicClient: false
|
publicClient: false
|
||||||
|
authorizationServicesEnabled: false
|
||||||
attributes:
|
attributes:
|
||||||
backchannel.logout.session.required: true
|
backchannel.logout.session.required: true
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
|
backchannel.logout.url: "https://{{ .Values.global.hosts.intercomService }}.{{ .Values.global.domain }}/backchannel-logout"
|
||||||
@@ -136,6 +137,7 @@ config:
|
|||||||
frontchannelLogout: false
|
frontchannelLogout: false
|
||||||
publicClient: true
|
publicClient: true
|
||||||
fullScopeAllowed: true
|
fullScopeAllowed: true
|
||||||
|
authorizationServicesEnabled: false
|
||||||
defaultClientScopes:
|
defaultClientScopes:
|
||||||
- "opendesk"
|
- "opendesk"
|
||||||
- "profile"
|
- "profile"
|
||||||
@@ -154,6 +156,7 @@ config:
|
|||||||
consentRequired: false
|
consentRequired: false
|
||||||
frontchannelLogout: false
|
frontchannelLogout: false
|
||||||
publicClient: false
|
publicClient: false
|
||||||
|
authorizationServicesEnabled: false
|
||||||
attributes:
|
attributes:
|
||||||
backchannel.logout.session.required: true
|
backchannel.logout.session.required: true
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
|
backchannel.logout.url: "https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/_synapse/client/oidc/backchannel_logout"
|
||||||
@@ -174,6 +177,7 @@ config:
|
|||||||
consentRequired: false
|
consentRequired: false
|
||||||
frontchannelLogout: false
|
frontchannelLogout: false
|
||||||
publicClient: false
|
publicClient: false
|
||||||
|
authorizationServicesEnabled: false
|
||||||
attributes:
|
attributes:
|
||||||
post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
post.logout.redirect.uris: "https://{{ .Values.global.hosts.element }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.synapse }}.{{ .Values.global.domain }}/*##https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/*"
|
||||||
- name: "opendesk-nextcloud"
|
- name: "opendesk-nextcloud"
|
||||||
@@ -187,6 +191,7 @@ config:
|
|||||||
consentRequired: false
|
consentRequired: false
|
||||||
frontchannelLogout: false
|
frontchannelLogout: false
|
||||||
publicClient: false
|
publicClient: false
|
||||||
|
authorizationServicesEnabled: false
|
||||||
attributes:
|
attributes:
|
||||||
backchannel.logout.session.required: true
|
backchannel.logout.session.required: true
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/user_oidc/backchannel-logout/ncoidc"
|
backchannel.logout.url: "https://{{ .Values.global.hosts.nextcloud }}.{{ .Values.global.domain }}/apps/user_oidc/backchannel-logout/ncoidc"
|
||||||
@@ -220,6 +225,7 @@ config:
|
|||||||
frontchannelLogout: false
|
frontchannelLogout: false
|
||||||
publicClient: false
|
publicClient: false
|
||||||
serviceAccountsEnabled: true
|
serviceAccountsEnabled: true
|
||||||
|
authorizationServicesEnabled: false
|
||||||
attributes:
|
attributes:
|
||||||
backchannel.logout.session.required: true
|
backchannel.logout.session.required: true
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
|
backchannel.logout.url: "https://{{ .Values.global.hosts.openproject }}.{{ .Values.global.domain }}/auth/keycloak/backchannel-logout"
|
||||||
@@ -251,6 +257,7 @@ config:
|
|||||||
consentRequired: false
|
consentRequired: false
|
||||||
frontchannelLogout: false
|
frontchannelLogout: false
|
||||||
publicClient: false
|
publicClient: false
|
||||||
|
authorizationServicesEnabled: false
|
||||||
attributes:
|
attributes:
|
||||||
backchannel.logout.session.required: true
|
backchannel.logout.session.required: true
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/ajax/oidc/backchannel_logout"
|
backchannel.logout.url: "https://{{ .Values.global.hosts.openxchange }}.{{ .Values.istio.domain }}/ajax/oidc/backchannel_logout"
|
||||||
@@ -282,6 +289,7 @@ config:
|
|||||||
consentRequired: false
|
consentRequired: false
|
||||||
frontchannelLogout: false
|
frontchannelLogout: false
|
||||||
publicClient: false
|
publicClient: false
|
||||||
|
authorizationServicesEnabled: false
|
||||||
attributes:
|
attributes:
|
||||||
backchannel.logout.session.required: false
|
backchannel.logout.session.required: false
|
||||||
backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/NOT_YET_IMPLEMENTED_DONT_FORGET_TO_DISABLE_FCL_WHEN_BCL_IS_ACTIVATED/backchannel-logout"
|
backchannel.logout.url: "https://{{ .Values.global.hosts.xwiki }}.{{ .Values.global.domain }}/NOT_YET_IMPLEMENTED_DONT_FORGET_TO_DISABLE_FCL_WHEN_BCL_IS_ACTIVATED/backchannel-logout"
|
||||||
@@ -291,6 +299,255 @@ config:
|
|||||||
- "address"
|
- "address"
|
||||||
- "email"
|
- "email"
|
||||||
- "profile"
|
- "profile"
|
||||||
|
- name: "guardian-cli"
|
||||||
|
clientId: "guardian-cli"
|
||||||
|
rootUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||||
|
baseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
clientAuthenticatorType: "client-secret"
|
||||||
|
secret: {{ .Values.secrets.keycloak.clientSecret.guardian | quote }}
|
||||||
|
redirectUris:
|
||||||
|
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
|
||||||
|
fullScopeAllowed: true
|
||||||
|
protocolMappers:
|
||||||
|
- name: "Client Host"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usersessionmodel-note-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
user.session.note: "clientHost"
|
||||||
|
userinfo.token.claim: true
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "clientHost"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "Client ID"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usersessionmodel-note-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
user.session.note: "client_id"
|
||||||
|
userinfo.token.claim: true
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "client_id"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "guardian-audience"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-audience-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
included.client.audience: "guardian"
|
||||||
|
userinfo.token.claim: false
|
||||||
|
id.token.claim: false
|
||||||
|
access.token.claim: true
|
||||||
|
- name: "audiencemap"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-audience-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
included.client.audience: "guardian-cli"
|
||||||
|
userinfo.token.claim: true
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
- name: "dn"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-attribute-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: false
|
||||||
|
user.attribute: "LDAP_ENTRY_DN"
|
||||||
|
id.token.claim: false
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "dn"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "username"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-property-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: true
|
||||||
|
user.attribute: "username"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "preferred_username"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "uid"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-attribute-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: true
|
||||||
|
user.attribute: "uid"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "uid"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "email"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-property-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: true
|
||||||
|
user.attribute: "email"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "email"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "Client IP Address"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usersessionmodel-note-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
user.session.note: "clientAddress"
|
||||||
|
userinfo.token.claim: true
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "clientAddress"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "guardian"
|
||||||
|
clientId: "guardian"
|
||||||
|
rootUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||||
|
baseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||||
|
clientAuthenticatorType: "client-secret"
|
||||||
|
redirectUris:
|
||||||
|
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/guardian/*"
|
||||||
|
fullScopeAllowed: true
|
||||||
|
protocol: "openid-connect"
|
||||||
|
publicClient: true
|
||||||
|
frontchannelLogout: false
|
||||||
|
standardFlowEnabled: true
|
||||||
|
attributes:
|
||||||
|
use.refresh.tokens: "true"
|
||||||
|
backchannel.logout.session.required: "true"
|
||||||
|
protocolMappers:
|
||||||
|
- name: "email"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-property-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: true
|
||||||
|
user.attribute: "email"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "email"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "dn"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-attribute-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: false
|
||||||
|
user.attribute: "LDAP_ENTRY_DN"
|
||||||
|
id.token.claim: false
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "dn"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "uid"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-attribute-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: true
|
||||||
|
user.attribute: "uid"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "udi"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "username"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-property-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: true
|
||||||
|
user.attribute: "username"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "preferred_username"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "audiencemap"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-audience-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
included.client.audience: "guardian"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
userinfo.token.claim: true
|
||||||
|
- name: "guardian-ui"
|
||||||
|
clientId: "guardian-ui"
|
||||||
|
rootUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||||
|
baseUrl: "https://{{ .Values.global.hosts.keycloak }}.{{ .Values.global.domain }}"
|
||||||
|
clientAuthenticatorType: "client-secret"
|
||||||
|
redirectUris:
|
||||||
|
- "https://{{ .Values.global.hosts.univentionManagementStack }}.{{ .Values.global.domain }}/univention/guardian/*"
|
||||||
|
standardFlowEnabled: true
|
||||||
|
publicClient: true
|
||||||
|
protocol: "openid-connect"
|
||||||
|
fullScopeAllowed: true
|
||||||
|
protocolMappers:
|
||||||
|
- name: "uid"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-attribute-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: true
|
||||||
|
user.attribute: "uid"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "uid"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "username"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-property-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: true
|
||||||
|
user.attribute: "username"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "preferred_username"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "dn"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-attribute-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: "false"
|
||||||
|
user.attribute: "LDAP_ENTRY_DN"
|
||||||
|
id.token.claim: false
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "dn"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "audiencemap"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-audience-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
included.client.audience: "guardian-ui"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
userinfo.token.claim: true
|
||||||
|
- name: "email"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-usermodel-property-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
userinfo.token.claim: true
|
||||||
|
user.attribute: "email"
|
||||||
|
id.token.claim: true
|
||||||
|
access.token.claim: true
|
||||||
|
claim.name: "email"
|
||||||
|
jsonType.label: "String"
|
||||||
|
- name: "guardian-audience"
|
||||||
|
protocol: "openid-connect"
|
||||||
|
protocolMapper: "oidc-audience-mapper"
|
||||||
|
consentRequired: false
|
||||||
|
config:
|
||||||
|
included.client.audience: "guardian"
|
||||||
|
id.token.claim: false
|
||||||
|
access.token.claim: true
|
||||||
|
userinfo.token.claim: false
|
||||||
|
|
||||||
containerSecurityContext:
|
containerSecurityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsPortalFrontend.registry | quote }}
|
||||||
repository: {{ .Values.images.umsPortalFrontend.repository | quote }}
|
repository: {{ .Values.images.umsPortalFrontend.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsPortalFrontend.tag | quote }}
|
tag: {{ .Values.images.umsPortalFrontend.tag | quote }}
|
||||||
|
|||||||
@@ -20,7 +20,7 @@ portalListener:
|
|||||||
|
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsPortalListener.registry | quote }}
|
||||||
repository: {{ .Values.images.umsPortalListener.repository | quote }}
|
repository: {{ .Values.images.umsPortalListener.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsPortalListener.tag | quote }}
|
tag: {{ .Values.images.umsPortalListener.tag | quote }}
|
||||||
@@ -30,7 +30,7 @@ image:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
waitForDependency:
|
waitForDependency:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsWaitForDependency.registry | quote }}
|
||||||
repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
|
repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
|
tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
|
||||||
|
|||||||
@@ -4,13 +4,14 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
portalServer:
|
portalServer:
|
||||||
|
logLevel: {{ .Values.debug.logLevel | quote }}
|
||||||
adminGroup: {{ printf "%s,%s" "cn=Domain Admins,cn=groups" .Values.ldap.baseDn | quote }}
|
adminGroup: {{ printf "%s,%s" "cn=Domain Admins,cn=groups" .Values.ldap.baseDn | quote }}
|
||||||
ucsInternalUrl: {{ printf "%s%s%s" "http://portal-server:" .Values.secrets.univentionManagementStack.storeDavUsers.portalServer "@ums-store-dav/portal-data" | quote }}
|
ucsInternalUrl: {{ printf "%s%s%s" "http://portal-server:" .Values.secrets.univentionManagementStack.storeDavUsers.portalServer "@ums-store-dav/portal-data" | quote }}
|
||||||
centralNavigation:
|
centralNavigation:
|
||||||
authenticatorSecret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
|
authenticatorSecret: {{ .Values.secrets.centralnavigation.apiKey | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsPortalServer.registry | quote }}
|
||||||
repository: {{ .Values.images.umsPortalServer.repository | quote }}
|
repository: {{ .Values.images.umsPortalServer.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsPortalServer.tag | quote }}
|
tag: {{ .Values.images.umsPortalServer.tag | quote }}
|
||||||
|
|||||||
@@ -5,7 +5,6 @@
|
|||||||
portalServer:
|
portalServer:
|
||||||
authMode: "saml"
|
authMode: "saml"
|
||||||
editable: "false"
|
editable: "false"
|
||||||
logLevel: "DEBUG"
|
|
||||||
umcGetUrl: "http://ums-umc-server/get"
|
umcGetUrl: "http://ums-umc-server/get"
|
||||||
umcSessionUrl: "http://ums-umc-server/get/session-info"
|
umcSessionUrl: "http://ums-umc-server/get/session-info"
|
||||||
centralNavigation:
|
centralNavigation:
|
||||||
|
|||||||
@@ -0,0 +1,19 @@
|
|||||||
|
{{/*
|
||||||
|
SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
|
SPDX-License-Identifier: Apache-2.0
|
||||||
|
*/}}
|
||||||
|
---
|
||||||
|
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsProvisioning.registry | quote }}
|
||||||
|
repository: {{ .Values.images.umsProvisioning.repository | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
tag: {{ .Values.images.umsProvisioning.tag | quote }}
|
||||||
|
pullSecrets:
|
||||||
|
{{- range .Values.global.imagePullSecrets }}
|
||||||
|
- name: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
resources:
|
||||||
|
{{ .Values.resources.umsProvisioning | toYaml | nindent 2 }}
|
||||||
|
...
|
||||||
@@ -1,25 +1,15 @@
|
|||||||
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
# SPDX-FileCopyrightText: 2023 Bundesministerium des Innern und für Heimat, PG ZenDiS "Projektgruppe für Aufbau ZenDiS"
|
||||||
# SPDX-License-Identifier: Apache-2.0
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
---
|
---
|
||||||
containerSecurityContext:
|
provisioningApi:
|
||||||
|
rootPath: "/univention/provisioning-api"
|
||||||
|
|
||||||
|
securityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
capabilities:
|
capabilities:
|
||||||
drop:
|
drop:
|
||||||
- "ALL"
|
- "ALL"
|
||||||
enabled: true
|
|
||||||
privileged: false
|
privileged: false
|
||||||
runAsUser: 1000
|
|
||||||
runAsGroup: 1000
|
|
||||||
seccompProfile:
|
seccompProfile:
|
||||||
type: "RuntimeDefault"
|
type: "RuntimeDefault"
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsNonRoot: true
|
|
||||||
|
|
||||||
job:
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
podSecurityContext:
|
|
||||||
enabled: true
|
|
||||||
fsGroup: 1000
|
|
||||||
fsGroupChangePolicy: "OnRootMismatch"
|
|
||||||
...
|
...
|
||||||
@@ -21,17 +21,17 @@ image:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
selfserviceListener:
|
selfserviceListener:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsSelfserviceListener.registry | quote }}
|
||||||
repository: {{ .Values.images.umsSelfserviceListener.repository | quote }}
|
repository: {{ .Values.images.umsSelfserviceListener.repository | quote }}
|
||||||
tag: {{ .Values.images.umsSelfserviceListener.tag | quote }}
|
tag: {{ .Values.images.umsSelfserviceListener.tag | quote }}
|
||||||
|
|
||||||
selfserviceInvitation:
|
selfserviceInvitation:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsSelfserviceInvitation.registry | quote }}
|
||||||
repository: {{ .Values.images.umsSelfserviceInvitation.repository | quote }}
|
repository: {{ .Values.images.umsSelfserviceInvitation.repository | quote }}
|
||||||
tag: {{ .Values.images.umsSelfserviceInvitation.tag | quote }}
|
tag: {{ .Values.images.umsSelfserviceInvitation.tag | quote }}
|
||||||
|
|
||||||
waitForDependency:
|
waitForDependency:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsWaitForDependency.registry | quote }}
|
||||||
repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
|
repository: {{ .Values.images.umsWaitForDependency.repository | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
|
tag: {{ .Values.images.umsWaitForDependency.tag | quote }}
|
||||||
|
|||||||
@@ -5,6 +5,9 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
stackDataSwp:
|
stackDataSwp:
|
||||||
udmApiPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
|
udmApiPassword: {{ .Values.secrets.univentionManagementStack.ldapSecret | quote }}
|
||||||
|
systemInformation:
|
||||||
|
deployDate: "Deployed: {{ now | date "2006-01-02T15:04:05-0700" }}"
|
||||||
|
releaseVersion: "Release: {{ .Values.global.systemInformation.releaseVersion }}"
|
||||||
|
|
||||||
stackDataContext:
|
stackDataContext:
|
||||||
ldapSearchUsers:
|
ldapSearchUsers:
|
||||||
@@ -34,7 +37,7 @@ stackDataContext:
|
|||||||
adminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
|
adminPassword: {{ .Values.secrets.univentionManagementStack.defaultAccounts.adminPassword | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsDataLoader.registry | quote }}
|
||||||
repository: {{ .Values.images.umsDataLoader.repository | quote }}
|
repository: {{ .Values.images.umsDataLoader.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsDataLoader.tag | quote }}
|
tag: {{ .Values.images.umsDataLoader.tag | quote }}
|
||||||
|
|||||||
@@ -14,7 +14,7 @@ stackDataContext:
|
|||||||
ldapBase: {{ .Values.ldap.baseDn | quote }}
|
ldapBase: {{ .Values.ldap.baseDn | quote }}
|
||||||
ldapHostDn: {{ printf "%s,%s" "cn=admin" .Values.ldap.baseDn | quote }}
|
ldapHostDn: {{ printf "%s,%s" "cn=admin" .Values.ldap.baseDn | quote }}
|
||||||
|
|
||||||
idpSamlMetadataUrl: {{ printf "https://%s.%s/%s/%s/%s" .Values.global.hosts.keycloak .Values.global.domain "realms" .Values.platform.realm "protocol/saml/descriptor" | quote }}
|
idpSamlMetadataUrl: {{ printf "http://ums-keycloak.%s.svc.%s:8080/realms/%s/protocol/saml/descriptor" .Release.Namespace .Values.cluster.networking.domain .Values.platform.realm | quote }}
|
||||||
umcSamlSpFqdn: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
umcSamlSpFqdn: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
||||||
idpFqdn: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
|
idpFqdn: {{ printf "%s.%s" .Values.global.hosts.keycloak .Values.global.domain | quote }}
|
||||||
ldapSamlSpUrls: {{ printf "https://%s.%s%s" .Values.global.hosts.univentionManagementStack .Values.global.domain "/univention/saml/metadata" | quote }}
|
ldapSamlSpUrls: {{ printf "https://%s.%s%s" .Values.global.hosts.univentionManagementStack .Values.global.domain "/univention/saml/metadata" | quote }}
|
||||||
@@ -22,7 +22,7 @@ stackDataContext:
|
|||||||
initialPasswordAdministrator: {{ .Values.secrets.univentionManagementStack.defaultAccounts.administratorPassword | quote }}
|
initialPasswordAdministrator: {{ .Values.secrets.univentionManagementStack.defaultAccounts.administratorPassword | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsDataLoader.registry | quote }}
|
||||||
repository: {{ .Values.images.umsDataLoader.repository | quote }}
|
repository: {{ .Values.images.umsDataLoader.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsDataLoader.tag | quote }}
|
tag: {{ .Values.images.umsDataLoader.tag | quote }}
|
||||||
|
|||||||
@@ -9,7 +9,7 @@ storeDav:
|
|||||||
portal-listener: {{ .Values.secrets.univentionManagementStack.storeDavUsers.portalListener | quote }}
|
portal-listener: {{ .Values.secrets.univentionManagementStack.storeDavUsers.portalListener | quote }}
|
||||||
portal-server: {{ .Values.secrets.univentionManagementStack.storeDavUsers.portalServer | quote }}
|
portal-server: {{ .Values.secrets.univentionManagementStack.storeDavUsers.portalServer | quote }}
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsStoreDav.registry | quote }}
|
||||||
repository: {{ .Values.images.umsStoreDav.repository | quote }}
|
repository: {{ .Values.images.umsStoreDav.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsStoreDav.tag | quote }}
|
tag: {{ .Values.images.umsStoreDav.tag | quote }}
|
||||||
@@ -19,7 +19,7 @@ image:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
configHtpasswd:
|
configHtpasswd:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsConfigHtpasswd.registry | quote }}
|
||||||
repository: {{ .Values.images.umsConfigHtpasswd.repository | quote }}
|
repository: {{ .Values.images.umsConfigHtpasswd.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsConfigHtpasswd.tag | quote }}
|
tag: {{ .Values.images.umsConfigHtpasswd.tag | quote }}
|
||||||
|
|||||||
@@ -10,7 +10,7 @@ udmRestApi:
|
|||||||
machineSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | b64enc | quote }}
|
machineSecret: {{ .Values.secrets.univentionManagementStack.ldapSecret | b64enc | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsUdmRestApi.registry | quote }}
|
||||||
repository: {{ .Values.images.umsUdmRestApi.repository | quote }}
|
repository: {{ .Values.images.umsUdmRestApi.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsUdmRestApi.tag | quote }}
|
tag: {{ .Values.images.umsUdmRestApi.tag | quote }}
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
*/}}
|
*/}}
|
||||||
---
|
---
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsUmcGateway.registry | quote }}
|
||||||
repository: {{ .Values.images.umsUmcGateway.repository | quote }}
|
repository: {{ .Values.images.umsUmcGateway.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsUmcGateway.tag | quote }}
|
tag: {{ .Values.images.umsUmcGateway.tag | quote }}
|
||||||
|
|||||||
@@ -25,7 +25,7 @@ memcached:
|
|||||||
server: {{ .Values.cache.umsSelfservice.host | quote }}
|
server: {{ .Values.cache.umsSelfservice.host | quote }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsUmcServer.registry | quote }}
|
||||||
repository: {{ .Values.images.umsUmcServer.repository | quote }}
|
repository: {{ .Values.images.umsUmcServer.repository | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
tag: {{ .Values.images.umsUmcServer.tag | quote }}
|
tag: {{ .Values.images.umsUmcServer.tag | quote }}
|
||||||
|
|||||||
@@ -12,7 +12,7 @@ global:
|
|||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsKeycloakBootstrap.registry | quote }}
|
||||||
repository: {{ .Values.images.umsKeycloakBootstrap.repository | quote }}
|
repository: {{ .Values.images.umsKeycloakBootstrap.repository | quote }}
|
||||||
tag: {{ .Values.images.umsKeycloakBootstrap.tag | quote }}
|
tag: {{ .Values.images.umsKeycloakBootstrap.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy }}
|
||||||
|
|||||||
@@ -5,7 +5,7 @@ SPDX-License-Identifier: Apache-2.0
|
|||||||
---
|
---
|
||||||
global:
|
global:
|
||||||
keycloak:
|
keycloak:
|
||||||
host: "ums-keycloak:8080"
|
host: "ums-keycloak.{{ .Release.Namespace }}.svc.{{ .Values.cluster.networking.domain }}:8080"
|
||||||
adminUsername: "kcadmin"
|
adminUsername: "kcadmin"
|
||||||
adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
|
adminPassword: {{ .Values.secrets.keycloak.adminPassword | quote }}
|
||||||
adminRealm: "master"
|
adminRealm: "master"
|
||||||
@@ -20,10 +20,11 @@ global:
|
|||||||
password: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
|
password: {{ .Values.databases.keycloakExtension.password | default .Values.secrets.postgresql.keycloakExtensionUser | quote }}
|
||||||
handler:
|
handler:
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsKeycloakExtensionHandler.registry | quote }}
|
||||||
repository: {{ .Values.images.umsKeycloakExtensionHandler.repository | quote }}
|
repository: {{ .Values.images.umsKeycloakExtensionHandler.repository | quote }}
|
||||||
tag: {{ .Values.images.umsKeycloakExtensionHandler.tag | quote }}
|
tag: {{ .Values.images.umsKeycloakExtensionHandler.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
imagePullSecrets: {{ .Values.global.imagePullSecrets }}
|
||||||
appConfig:
|
appConfig:
|
||||||
captchaProtectionEnable: false
|
captchaProtectionEnable: false
|
||||||
smtpPassword: {{ .Values.smtp.password | quote }}
|
smtpPassword: {{ .Values.smtp.password | quote }}
|
||||||
@@ -48,10 +49,11 @@ postgresql:
|
|||||||
enabled: false
|
enabled: false
|
||||||
proxy:
|
proxy:
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsKeycloakExtensionProxy.registry | quote }}
|
||||||
repository: {{ .Values.images.umsKeycloakExtensionProxy.repository | quote }}
|
repository: {{ .Values.images.umsKeycloakExtensionProxy.repository | quote }}
|
||||||
tag: {{ .Values.images.umsKeycloakExtensionProxy.tag | quote }}
|
tag: {{ .Values.images.umsKeycloakExtensionProxy.tag | quote }}
|
||||||
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
imagePullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
imagePullSecrets: {{ .Values.global.imagePullSecrets }}
|
||||||
ingress:
|
ingress:
|
||||||
annotations:
|
annotations:
|
||||||
nginx.org/proxy-buffer-size: "8k"
|
nginx.org/proxy-buffer-size: "8k"
|
||||||
|
|||||||
@@ -7,12 +7,11 @@ global:
|
|||||||
domain: {{ .Values.global.domain | quote }}
|
domain: {{ .Values.global.domain | quote }}
|
||||||
hosts:
|
hosts:
|
||||||
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
{{ .Values.global.hosts | toYaml | nindent 4 }}
|
||||||
imageRegistry: {{ .Values.global.imageRegistry | quote }}
|
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
{{ .Values.global.imagePullSecrets | toYaml | nindent 4 }}
|
||||||
|
|
||||||
image:
|
image:
|
||||||
registry: {{ .Values.global.imageRegistry | quote }}
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsKeycloak.registry | quote }}
|
||||||
repository: {{ .Values.images.umsKeycloak.repository | quote }}
|
repository: {{ .Values.images.umsKeycloak.repository | quote }}
|
||||||
tag: {{ .Values.images.umsKeycloak.tag | quote }}
|
tag: {{ .Values.images.umsKeycloak.tag | quote }}
|
||||||
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
@@ -26,6 +25,12 @@ config:
|
|||||||
user: {{ .Values.databases.keycloak.username | quote }}
|
user: {{ .Values.databases.keycloak.username | quote }}
|
||||||
database: {{ .Values.databases.keycloak.name | quote }}
|
database: {{ .Values.databases.keycloak.name | quote }}
|
||||||
password: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
|
password: {{ .Values.databases.keycloak.password | default .Values.secrets.postgresql.keycloakUser | quote }}
|
||||||
|
logLevel: {{ .Values.debug.logLevel | quote }}
|
||||||
|
enableMetrics: true
|
||||||
|
# The availability of the admin console is already restricted through the path settings in the Keycloak Extensions
|
||||||
|
# Proxy which is used in openDesk. The setting here is just relevant when Keycloak endpoints are exposed directly
|
||||||
|
# through an own ingress.
|
||||||
|
exposeAdminConsole: false
|
||||||
|
|
||||||
containerSecurityContext:
|
containerSecurityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
|
|||||||
@@ -2,6 +2,12 @@
|
|||||||
# SPDX-License-Identifier: Apache-2.0
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
---
|
---
|
||||||
|
|
||||||
|
image:
|
||||||
|
registry: {{ .Values.global.imageRegistry | default .Values.images.umsStackGateway.registry | quote }}
|
||||||
|
repository: {{ .Values.images.umsStackGateway.repository | quote }}
|
||||||
|
tag: {{ .Values.images.umsStackGateway.tag | quote }}
|
||||||
|
pullPolicy: {{ .Values.global.imagePullPolicy | quote }}
|
||||||
|
|
||||||
ingress:
|
ingress:
|
||||||
enabled: {{ .Values.ingress.enabled }}
|
enabled: {{ .Values.ingress.enabled }}
|
||||||
hostname: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
hostname: {{ printf "%s.%s" .Values.global.hosts.univentionManagementStack .Values.global.domain | quote }}
|
||||||
|
|||||||
@@ -237,6 +237,27 @@ serverBlock: |
|
|||||||
proxy_pass http://ums-portal-frontend:80/;
|
proxy_pass http://ums-portal-frontend:80/;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
## provisioning-api
|
||||||
|
location /univention/provisioning-api/ {
|
||||||
|
rewrite ^/univention/provisioning-api(/.*)$ $1 break;
|
||||||
|
proxy_pass http://ums-provisioning-provisioning-api:80;
|
||||||
|
}
|
||||||
|
|
||||||
|
## guardian
|
||||||
|
location /univention/guardian/management-ui {
|
||||||
|
proxy_pass http://ums-guardian-management-ui:80/univention/guardian/management-ui;
|
||||||
|
}
|
||||||
|
location /guardian/opa {
|
||||||
|
rewrite ^/guardian/opa(/.*)$ $1 break;
|
||||||
|
proxy_pass http://ums-open-policy-agent:80/;
|
||||||
|
}
|
||||||
|
location /guardian/management {
|
||||||
|
proxy_pass http://ums-guardian-management-api:80/guardian/management;
|
||||||
|
}
|
||||||
|
location /guardian/authorization {
|
||||||
|
proxy_pass http://ums-guardian-authorization-api:80/guardian/authorization;
|
||||||
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
podSecurityContext:
|
podSecurityContext:
|
||||||
|
|||||||
@@ -8,10 +8,12 @@ repositories:
|
|||||||
# XWiki
|
# XWiki
|
||||||
# Source: https://github.com/xwiki-contrib/xwiki-helm
|
# Source: https://github.com/xwiki-contrib/xwiki-helm
|
||||||
- name: "xwiki-repo"
|
- name: "xwiki-repo"
|
||||||
oci: {{ .Values.charts.xwiki.oci }}
|
keyring: "../../files/gpg-pubkeys/xwiki-com.gpg"
|
||||||
username: {{ .Values.charts.xwiki.username | quote }}
|
verify: {{ .Values.charts.xwiki.verify }}
|
||||||
password: {{ .Values.charts.xwiki.password | quote }}
|
username: {{ env "OD_PRIVATE_REGISTRY_USERNAME" | quote }}
|
||||||
url: "{{ .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
|
password: {{ env "OD_PRIVATE_REGISTRY_PASSWORD" | quote }}
|
||||||
|
oci: true
|
||||||
|
url: "{{ .Values.global.imageRegistry | default .Values.charts.xwiki.registry }}/{{ .Values.charts.xwiki.repository }}"
|
||||||
|
|
||||||
releases:
|
releases:
|
||||||
- name: "xwiki"
|
- name: "xwiki"
|
||||||
@@ -19,8 +21,7 @@ releases:
|
|||||||
version: "{{ .Values.charts.xwiki.version }}"
|
version: "{{ .Values.charts.xwiki.version }}"
|
||||||
wait: true
|
wait: true
|
||||||
values:
|
values:
|
||||||
- "values.yaml"
|
- "values.yaml.gotmpl"
|
||||||
- "values.gotmpl"
|
|
||||||
installed: {{ .Values.xwiki.enabled }}
|
installed: {{ .Values.xwiki.enabled }}
|
||||||
timeout: 900
|
timeout: 900
|
||||||
|
|
||||||
|
|||||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user