not
ee8301f39f
One chart whose values.yaml is a near-literal transcription of infra/docker-compose.yml, rendered by three generic templates (Deployment, Job, Service) over a `workloads` map — so the two stacks can be diffed by eye instead of by archaeology, and adding a service is a values edit. Platform-forced deviations, each commented where it appears: - `args`, never `command`: compose replaces the image CMD, Kubernetes replaces the ENTRYPOINT. The chart fails to render on `command`, because the symptom (postgres refusing to run as root, Keycloak exec-ing `start-dev`) is nothing like the cause. - The four Django services apply their own setup_configuration in the web pod rather than in a separate init Job: both scripts migrate, and without compose's depends_on they race the same database. - OpenZaak and Objecten are addressed by service FQDN, because Django rejects a single-label host in a URL — the reason compose passes container IPs around. - NodePorts, no ingress; databases are emptyDir until persistence.storageClass is set, so the stack comes up on a cluster with no CSI driver. The upstream config inputs stay in the repo and become ConfigMaps via infra/helm/seed-configmaps.sh — the Kubernetes sibling of infra/seed-config.sh — so the compose stack and the chart cannot fork. infra/helm/registry.yaml runs an in-cluster registry because Talos cannot side-load an image and a laptop-side one needs a root-level firewall change.
40 lines
1.4 KiB
YAML
40 lines
1.4 KiB
YAML
{{- range $name, $w := .Values.workloads }}
|
|
{{- if and (ne $w.enabled false) (not $w.job) }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ $name }}
|
|
labels:
|
|
{{- include "big.labels" (dict "root" $ "name" $name) | nindent 4 }}
|
|
spec:
|
|
replicas: 1
|
|
# Recreate, not RollingUpdate: single node, ReadWriteOnce volumes, and nothing
|
|
# here is HA — a second pod would just fight the first for the disk.
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: {{ $name }}
|
|
app.kubernetes.io/instance: {{ $.Release.Name }}
|
|
template:
|
|
metadata:
|
|
{{- /*
|
|
A ConfigMap mounted with subPath never picks up updates, so a portal whose
|
|
config.json content changed has to be rolled. Hashing only the values that
|
|
render it keeps the churn off the databases — an emptyDir database that is
|
|
recreated for no reason loses its data (see the runbook §6).
|
|
*/}}
|
|
{{- range $w.files }}
|
|
{{- if hasPrefix "portal-config-" .configMap }}
|
|
annotations:
|
|
checksum/portal-config: {{ printf "%s|%v" $.Values.host (index $.Values.nodePorts "keycloak") | sha256sum }}
|
|
{{- end }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "big.labels" (dict "root" $ "name" $name) | nindent 8 }}
|
|
spec:
|
|
{{- include "big.podspec" (dict "root" $ "name" $name "w" $w) | nindent 6 }}
|
|
{{- end }}
|
|
{{- end }}
|