notandClaude Opus 5.5
1cc04de630
CI / k8s (pull_request) Successful in 13s
CI / build (pull_request) Successful in 5m36s
CI / unit (pull_request) Successful in 6m18s
CI / frontend (pull_request) Successful in 3m12s
CI / verify-stack (pull_request) Canceled after 0s
CI / mutation (pull_request) Canceled after 8m0s
CI / lint (pull_request) Canceled after 21m26s
A `big-demo` Keycloak login theme (keycloak.v2 + one script) is always mounted and set as default. With demo.otpAutofill (repo variable OTP_AUTOFILL=true) the script computes the code from the committed fixture secret and submits it, so the demo shows MFA enforced without an authenticator. Off by default: the script is empty and the login is plain keycloak.v2. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
{{- range $name, $w := .Values.workloads }}
|
|
{{- if and (ne $w.enabled false) (not $w.job) }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ $name }}
|
|
labels:
|
|
{{- include "big.labels" (dict "root" $ "name" $name) | nindent 4 }}
|
|
spec:
|
|
replicas: 1
|
|
# Recreate, not RollingUpdate: single node, ReadWriteOnce volumes, and nothing
|
|
# here is HA — a second pod would just fight the first for the disk.
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: {{ $name }}
|
|
app.kubernetes.io/instance: {{ $.Release.Name }}
|
|
template:
|
|
metadata:
|
|
{{- /*
|
|
A ConfigMap mounted with subPath never picks up updates, so a portal whose
|
|
config.json content changed has to be rolled. Hashing only the values that
|
|
render it keeps the churn off the databases — an emptyDir database that is
|
|
recreated for no reason loses its data (see the runbook §6).
|
|
*/}}
|
|
{{- range $w.files }}
|
|
{{- if hasPrefix "portal-config-" .configMap }}
|
|
annotations:
|
|
checksum/portal-config: {{ include "big.keycloakUrl" $ | sha256sum }}
|
|
{{- end }}
|
|
{{- /* subPath mounts never refresh, so Keycloak restarts when the toggle flips. */}}
|
|
{{- if eq .configMap "kc-theme-js" }}
|
|
annotations:
|
|
checksum/otp-autofill: {{ $.Values.demo.otpAutofill | toString | sha256sum }}
|
|
{{- end }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "big.labels" (dict "root" $ "name" $name) | nindent 8 }}
|
|
spec:
|
|
{{- include "big.podspec" (dict "root" $ "name" $name "w" $w) | nindent 6 }}
|
|
{{- end }}
|
|
{{- end }}
|