Skip to content

Commit 94d253b

Browse files
maarousMohamed Amine ArousNGPixel
authored
chore(helm): add support for securityContext and resources in sideload container (#7350)
--------- Co-authored-by: Mohamed Amine Arous <“maarous-prestataire@ina.fr”> Co-authored-by: Nicolas Giard <github@ngpixel.com>
1 parent c7c2057 commit 94d253b

File tree

4 files changed

+40
-13
lines changed

4 files changed

+40
-13
lines changed

‎dev/helm/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: wiki
33
# This is the chart version. This version number should be incremented each time you make changes
44
# to the chart and its templates, including the app version.
5-
version: 2.2.0
5+
version: 2.3.0
66
# This is the version number of the application being deployed. This version number should be
77
# incremented each time you make changes to the application.
88
AppVersion: latest

‎dev/helm/README.md‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -97,32 +97,35 @@ The following table lists the configurable parameters of the Wiki.js chart and t
9797
| `image.repository` | Wiki.js image | `requarks/wiki` |
9898
| `image.tag` | Wiki.js image tag | `latest` |
9999
| `imagePullPolicy` | Image pull policy | `IfNotPresent` |
100-
| `replicacount` | Amount of wiki.js service pods to run | `1` |
101-
| `revisionHistoryLimit` | Total amount of revision history points | `10` |
102-
| `resources.limits` | wiki.js service resource limits | `nil` |
103-
| `resources.requests` | wiki.js service resource requests | `nil` |
104-
| `nodeSelector` | Node labels for wiki.js pod assignment | `{}` |
105-
| `affinity` | Affinity settings for wiki.js pod assignment | `{}` |
106-
| `schedulerName` | Name of an alternate scheduler for wiki.js pod | `nil` |
107-
| `tolerations` | Toleration labels for wiki.jsk pod assignment | `[]` |
108-
| `volumeMounts` | Volume mounts for Wiki.js container | `[]` |
109-
| `volumes` | Volumes for Wiki.js Pod | `[]` |
100+
| `replicacount` | Number of Wiki.js pods to run | `1` |
101+
| `revisionHistoryLimit` | Total number of revision history points | `10` |
102+
| `resources.limits` | Wiki.js service resource limits | `nil` |
103+
| `resources.requests` | Wiki.js service resource requests | `nil` |
104+
| `nodeSelector` | Node labels for the Wiki.js pod assignment | `{}` |
105+
| `affinity` | Affinity settings for the Wiki.js pod assignment | `{}` |
106+
| `schedulerName` | Name of an alternate scheduler for the Wiki.js pod | `nil` |
107+
| `tolerations` | Toleration labels for the Wiki.js pod assignment | `[]` |
108+
| `volumeMounts` | Volume mounts for the Wiki.js container | `[]` |
109+
| `volumes` | Volumes for the Wiki.js pod | `[]` |
110110
| `ingress.enabled` | Enable ingress controller resource | `false` |
111111
| `ingress.className` | Ingress class name | `""` |
112112
| `ingress.annotations` | Ingress annotations | `{}` |
113113
| `ingress.hosts` | List of ingress rules | `[{"host": "wiki.local", "paths": ["/"]}]` |
114114
| `ingress.tls` | Ingress TLS configuration | `[]` |
115115
| `sideload.enabled` | Enable sideloading of locale files from git | `false` |
116116
| `sideload.repoURL` | Git repository URL containing locale files | `https://github.com/Requarks/wiki-localization` |
117-
| `sideload.env` | Environment variables for sideload Container | `{}` |
117+
| `sideload.env` | Environment variables for the sideload container | `{}` |
118+
| `sideload.securityContext` | Security context for the sideload container | `nil` |
119+
| `sideload.resources.limits` | Resource limits for the sideload container | `nil` |
120+
| `sideload.resources.requests` | Resource requests for the sideload container | `nil` |
118121
| `nodeExtraCaCerts` | Trusted certificates path | `nil` |
119122
| `postgresql.enabled` | Deploy postgres server (see below) | `true` |
120123
| `postgresql.postgresqlDatabase` | Postgres database name | `wiki` |
121124
| `postgresql.postgresqlUser` | Postgres username | `postgres` |
122125
| `postgresql.postgresqlHost` | External postgres host | `nil` |
123126
| `postgresql.postgresqlPassword` | External postgres password | `nil` |
124127
| `postgresql.existingSecret` | Provide an existing `Secret` for postgres | `nil` |
125-
| `postgresql.existingSecretKey` | The postgres password key in the existing `Secret` | `postgresql-password` |
128+
| `postgresql.existingSecretKey` | The postgres password key in the existing `Secret` | `postgresql-password` |
126129
| `postgresql.postgresqlPort` | External postgres port | `5432` |
127130
| `postgresql.ssl` | Enable external postgres SSL connection | `false` |
128131
| `postgresql.ca` | Certificate of Authority content for postgres | `nil` |

‎dev/helm/templates/deployment.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,16 @@ spec:
2727
{{- if .Values.sideload.enabled }}
2828
initContainers:
2929
- name: {{ .Chart.Name }}-sideload
30+
securityContext:
31+
{{- toYaml .Values.sideload.securityContext | nindent 12 }}
3032
image: "{{ .Values.image.repository }}:{{ default "latest" .Values.image.tag }}"
3133
imagePullPolicy: {{ default "IfNotPresent" .Values.image.imagePullPolicy }}
3234
env:
3335
{{- toYaml .Values.sideload.env | nindent 12 }}
3436
command: [ "sh", "-c" ]
3537
args: [ "mkdir -p /wiki/data/sideload && git clone --depth=1 {{ .Values.sideload.repoURL }} /wiki/data/sideload/" ]
38+
resources:
39+
{{- toYaml .Values.sideload.resources | nindent 12 }}
3640
{{- end }}
3741
containers:
3842
- name: {{ .Chart.Name }}

‎dev/helm/values.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,26 @@ sideload:
115115
# - name: HTTPS_PROXY
116116
# value: http://my.proxy.com:3128
117117

118+
securityContext: {}
119+
# capabilities:
120+
# drop:
121+
# - ALL
122+
# readOnlyRootFilesystem: true
123+
# runAsNonRoot: true
124+
# runAsUser: 1000
125+
126+
resources: {}
127+
# We usually recommend not to specify default resources and to leave this as a conscious
128+
# choice for the user. This also increases chances charts run on environments with little
129+
# resources, such as Minikube. If you do want to specify resources, uncomment the following
130+
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
131+
# limits:
132+
# cpu: 100m
133+
# memory: 128Mi
134+
# requests:
135+
# cpu: 100m
136+
# memory: 128Mi
137+
118138
## Append extra trusted certificates for node process from extra volume via NODE_EXTRA_CA_CERTS variable
119139
# nodeExtraCaCerts: "/path/to/certs.pem"
120140

0 commit comments

Comments
 (0)