9a4942daad
- Updated Dockerfile to run as non-root user 'nginx' and adjusted Nginx configuration for improved security. - Added pod security context in values.yaml to align with the non-root user setup. - Refined deployment.yaml to utilize the new pod security context for better compliance with Kubernetes security standards.
68 lines
1.8 KiB
YAML
68 lines
1.8 KiB
YAML
# Image : git.specificat.io/specificat.io/talks-slides
|
||
# Avec release "talks-slides" et nameOverride "talks-slides", le fullname reste cohérent.
|
||
nameOverride: "talks-slides"
|
||
fullnameOverride: ""
|
||
|
||
slides:
|
||
image:
|
||
repository: git.specificat.io/specificat.io/talks-slides
|
||
tag: "latest"
|
||
pullPolicy: IfNotPresent
|
||
|
||
imagePullSecrets:
|
||
- name: prd-gitea-registry-secret
|
||
|
||
replicaCount: 1
|
||
|
||
# Port d’écoute dans le conteneur (doit correspondre à server/nginx/default.conf, ex. 8080).
|
||
containerPort: 8080
|
||
|
||
# Aligné sur l’utilisateur nginx de l’image (UID/GID 101). L’image utilise USER nginx.
|
||
podSecurityContext:
|
||
runAsUser: 101
|
||
runAsGroup: 101
|
||
runAsNonRoot: true
|
||
seccompProfile:
|
||
type: RuntimeDefault
|
||
|
||
service:
|
||
type: ClusterIP
|
||
# Port du Service (Ingress pointe ici) ; le trafic est envoyé vers containerPort sur les pods.
|
||
port: 80
|
||
|
||
resources:
|
||
limits:
|
||
memory: 128Mi
|
||
requests:
|
||
cpu: 10m
|
||
memory: 32Mi
|
||
|
||
autoscaling:
|
||
enabled: false
|
||
|
||
nodeSelector: {}
|
||
affinity: {}
|
||
tolerations: []
|
||
podLabels: {}
|
||
|
||
ingress:
|
||
enabled: true
|
||
className: ""
|
||
annotations: {}
|
||
hosts:
|
||
- host: slides.specificat.io
|
||
paths:
|
||
- path: /
|
||
pathType: Prefix
|
||
# TLS : soit manuel (tls.enabled + secretName), soit via cert-manager (certManager.enabled).
|
||
# Le nom d’hôte vient de hosts[].host (réutilisé pour le bloc tls.hosts).
|
||
certManager:
|
||
enabled: false
|
||
# Ex. letsencrypt-prod — requis si certManager.enabled est true
|
||
clusterIssuer: ""
|
||
tls:
|
||
enabled: false
|
||
# Secret TLS dans le namespace (créé par cert-manager ou importé à la main).
|
||
# Vide : suffixe -tls sur le nom complet de la release (ex. talks-slides-tls).
|
||
secretName: ""
|