68 lines
2.6 KiB
YAML
68 lines
2.6 KiB
YAML
# ============================================================================
|
|
# THE CONTRACT: this is the shape every lgkentang service fills in.
|
|
# Most services only need to set: name, image.repository, image.tag,
|
|
# and ingress.host. Everything else has a sensible default below.
|
|
# ============================================================================
|
|
|
|
# Resource name for the Deployment/Service/Ingress. Defaults to the ArgoCD
|
|
# release name if left empty. Set it explicitly so names stay stable even if
|
|
# the release is ever renamed.
|
|
name: ""
|
|
|
|
image:
|
|
repository: traefik/whoami
|
|
tag: latest
|
|
pullPolicy: IfNotPresent
|
|
|
|
# How many pod replicas to run.
|
|
replicas: 1
|
|
|
|
# The port your container listens on inside the pod.
|
|
containerPort: 80
|
|
|
|
service:
|
|
# Cluster-internal Service port (what the Ingress routes to).
|
|
port: 80
|
|
|
|
ingress:
|
|
# Set false for internal-only services that shouldn't be exposed/DNS'd.
|
|
enabled: true
|
|
className: traefik
|
|
# REQUIRED when enabled, e.g. myapp.dev.lgkentang.com. external-dns turns
|
|
# this into a DNS record and cert-manager into a cert (Phases 1-2).
|
|
host: ""
|
|
# URL path this Ingress routes. Default "/" (catch-all). For path-based
|
|
# routing where components share a host, give each a distinct path — e.g. the
|
|
# frontend keeps "/" and the backend uses "/api/v1". Traefik routes the
|
|
# longest-matching prefix, so "/api/v1/*" beats "/" automatically.
|
|
path: /
|
|
# Whether THIS Ingress requests a TLS cert for the host. Set false when
|
|
# another Ingress already owns the host's cert (path-based routing on a shared
|
|
# host: only ONE component — usually the frontend at "/" — should carry TLS +
|
|
# the cert-manager annotation; the others just add a path rule and are served
|
|
# over that same host cert). Avoids two Certificates fighting over one host.
|
|
tls: true
|
|
clusterIssuer: letsencrypt-prod
|
|
# tlsSecretName defaults to "<name>-tls" if left unset.
|
|
tlsSecretName: ""
|
|
|
|
# Plain, non-secret environment variables as key: value pairs.
|
|
# SECRET env vars are deliberately NOT here — those arrive in Phase 5 via the
|
|
# External Secrets Operator, so we don't build a pattern now that fights it.
|
|
env: {}
|
|
# LOG_LEVEL: info
|
|
# FEATURE_X_ENABLED: "true"
|
|
|
|
# Name of a Kubernetes Secret whose keys are loaded as env vars (envFrom).
|
|
# Empty = none. In Phase 5, the External Secrets Operator syncs a Secret from
|
|
# Infisical/Vault and you point this at it — so app secrets never touch git.
|
|
envFromSecret: ""
|
|
|
|
# Resource requests/limits. Conservative defaults suited to the single node.
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
memory: 128Mi
|