mirror of
https://github.com/suitenumerique/docs.git
synced 2026-09-25 02:55:10 +02:00
Manuel Raynaud
3ea699eec9
The new infra we have must be configured in the helm chart. This commit all the missing templates to deploy yhub, it also automate the creation of the private keys needed by all services.
Impress helm chart
Parameters
General configuration
| Name | Description | Value |
|---|---|---|
image.repository |
Repository to use to pull impress's container image | lasuite/impress-backend |
image.tag |
impress's container tag | latest |
image.pullPolicy |
Container image pull policy | IfNotPresent |
image.credentials.username |
Username for container registry authentication | |
image.credentials.password |
Password for container registry authentication | |
image.credentials.registry |
Registry url for which the credentials are specified | |
image.credentials.name |
Name of the generated secret for imagePullSecrets | |
nameOverride |
Override the chart name | "" |
fullnameOverride |
Override the full application name | "" |
ingress.enabled |
whether to enable the Ingress or not | false |
ingress.className |
IngressClass to use for the Ingress | nil |
ingress.host |
Host for the Ingress | impress.example.com |
ingress.path |
Path to use for the Ingress | / |
ingress.hosts |
Additional host to configure for the Ingress | [] |
ingress.tls.enabled |
Whether to enable TLS for the Ingress | true |
ingress.tls.secretName |
Secret name for TLS config | nil |
ingress.tls.additional[].secretName |
Secret name for additional TLS config | |
ingress.tls.additional[].hosts[] |
Hosts for additional TLS config | |
ingress.customBackends |
Add custom backends to ingress | [] |
ingressCollaborationWS.enabled |
whether to enable the Ingress or not | false |
ingressCollaborationWS.className |
IngressClass to use for the Ingress | nil |
ingressCollaborationWS.host |
Host for the Ingress | impress.example.com |
ingressCollaborationWS.path |
Path to use for the Ingress | /collaboration/ws/ |
ingressCollaborationWS.hosts |
Additional host to configure for the Ingress | [] |
ingressCollaborationWS.tls.enabled |
Whether to enable TLS for the Ingress | true |
ingressCollaborationWS.tls.secretName |
Secret name for TLS config | nil |
ingressCollaborationWS.tls.additional[].secretName |
Secret name for additional TLS config | |
ingressCollaborationWS.tls.additional[].hosts[] |
Hosts for additional TLS config | |
ingressCollaborationWS.customBackends |
Add custom backends to ingress | [] |
ingressCollaborationWS.annotations.nginx.ingress.kubernetes.io/enable-websocket |
true |
|
ingressCollaborationWS.annotations.nginx.ingress.kubernetes.io/proxy-read-timeout |
86400 |
|
ingressCollaborationWS.annotations.nginx.ingress.kubernetes.io/proxy-send-timeout |
86400 |
|
ingressRedirects.enabled |
whether to enable the Ingress Redirects or not | false |
ingressRedirects.className |
IngressClass to use for the Ingress Redirects | nil |
ingressRedirects.host |
Host for the Ingress Redirects | impress.example.com |
ingressRedirects.tls.enabled |
Whether to enable TLS for the Ingress Redirects | true |
ingressRedirects.tls.secretName |
Secret name for TLS config | nil |
ingressRedirects.tls.additional[].secretName |
Secret name for additional TLS config | |
ingressRedirects.tls.additional[].hosts[] |
Hosts for additional TLS config | |
ingressRedirects.rules |
Rules for the Ingress Redirects | [] |
ingressCollaborationApi.enabled |
whether to enable the Ingress or not | false |
ingressCollaborationApi.className |
IngressClass to use for the Ingress | nil |
ingressCollaborationApi.host |
Host for the Ingress | impress.example.com |
ingressCollaborationApi.path |
Path to use for the Ingress | /collaboration/api/ |
ingressCollaborationApi.paths |
Paths to route to the collaboration server, one rule each | ["/collaboration/ydoc/","/collaboration/jwks/"] |
ingressCollaborationApi.hosts |
Additional host to configure for the Ingress | [] |
ingressCollaborationApi.tls.enabled |
Whether to enable TLS for the Ingress | true |
ingressCollaborationApi.tls.secretName |
Secret name for TLS config | nil |
ingressCollaborationApi.tls.additional[].secretName |
Secret name for additional TLS config | |
ingressCollaborationApi.tls.additional[].hosts[] |
Hosts for additional TLS config | |
ingressCollaborationApi.customBackends |
Add custom backends to ingress | [] |
ingressAdmin.enabled |
whether to enable the Ingress or not | false |
ingressAdmin.className |
IngressClass to use for the Ingress | nil |
ingressAdmin.host |
Host for the Ingress | impress.example.com |
ingressAdmin.path |
Path to use for the Ingress | /admin |
ingressAdmin.hosts |
Additional host to configure for the Ingress | [] |
ingressAdmin.tls.enabled |
Whether to enable TLS for the Ingress | true |
ingressAdmin.tls.secretName |
Secret name for TLS config | nil |
ingressAdmin.tls.additional[].secretName |
Secret name for additional TLS config | |
ingressAdmin.tls.additional[].hosts[] |
Hosts for additional TLS config | |
ingressMedia.enabled |
whether to enable the Ingress or not | false |
ingressMedia.className |
IngressClass to use for the Ingress | nil |
ingressMedia.host |
Host for the Ingress | impress.example.com |
ingressMedia.path |
Path to use for the Ingress | /media/(.*) |
ingressMedia.hosts |
Additional host to configure for the Ingress | [] |
ingressMedia.tls.enabled |
Whether to enable TLS for the Ingress | true |
ingressMedia.tls.secretName |
Secret name for TLS config | nil |
ingressMedia.tls.additional[].secretName |
Secret name for additional TLS config | |
ingressMedia.tls.additional[].hosts[] |
Hosts for additional TLS config | |
ingressMedia.annotations.nginx.ingress.kubernetes.io/auth-url |
https://impress.example.com/api/v1.0/documents/media-auth/ |
|
ingressMedia.annotations.nginx.ingress.kubernetes.io/auth-response-headers |
Authorization, X-Amz-Date, X-Amz-Content-SHA256 |
|
ingressMedia.annotations.nginx.ingress.kubernetes.io/upstream-vhost |
minio.impress.svc.cluster.local:9000 |
|
ingressMedia.annotations.nginx.ingress.kubernetes.io/configuration-snippet |
`add_header Content-Security-Policy "default-src 'none'" always; | |
| ` | ||
serviceMedia.host |
Hostname of the media storage backend (S3/MinIO) used by the media ingress | minio.impress.svc.cluster.local |
serviceMedia.port |
Port of the media storage backend | 9000 |
serviceMedia.annotations |
Annotations to add to the media ExternalName Service | {} |
backend
| Name | Description | Value |
|---|---|---|
backend.command |
Override the backend container command | [] |
backend.args |
Override the backend container args | [] |
backend.replicas |
Amount of backend replicas | 3 |
backend.shareProcessNamespace |
Enable share process namespace between containers | false |
backend.sidecars |
Add sidecars containers to backend deployment | [] |
backend.migrateJobAnnotations |
Annotations for the migrate job | {} |
backend.jobs.ttlSecondsAfterFinished |
Period to wait before remove jobs | 30 |
backend.jobs.backoffLimit |
Numbers of jobs retries | 2 |
backend.securityContext.allowPrivilegeEscalation |
Whether to allow privilege escalation for the backend container | false |
backend.securityContext.capabilities.drop |
List of capabilities to drop for the backend container | ["ALL"] |
backend.securityContext.runAsNonRoot |
Whether to run the backend container as a non-root user | true |
backend.securityContext.seccompProfile.type |
Seccomp profile type for the backend container | RuntimeDefault |
backend.envVars |
Configure backend container environment variables | undefined |
backend.envVars.BY_VALUE |
Example environment variable by setting value directly | |
backend.envVars.FROM_CONFIGMAP.configMapKeyRef.name |
Name of a ConfigMap when configuring env vars from a ConfigMap | |
backend.envVars.FROM_CONFIGMAP.configMapKeyRef.key |
Key within a ConfigMap when configuring env vars from a ConfigMap | |
backend.envVars.FROM_SECRET.secretKeyRef.name |
Name of a Secret when configuring env vars from a Secret | |
backend.envVars.FROM_SECRET.secretKeyRef.key |
Key within a Secret when configuring env vars from a Secret | |
backend.django.envVars |
Backend web deployment specific environment variables (not shared with celery worker) | |
backend.podAnnotations |
Annotations to add to the backend Pod | {} |
backend.dpAnnotations |
Annotations to add to the backend Deployment | {} |
backend.service.type |
backend Service type | ClusterIP |
backend.service.port |
backend Service listening port | 80 |
backend.service.targetPort |
backend container listening port | 8000 |
backend.service.annotations |
Annotations to add to the backend Service | {} |
backend.migrate.command |
backend migrate command | ["/bin/sh","-c","attempt=0\nuntil output=$(python manage.py check --database default 2>&1)\ndo\n attempt=$((attempt + 1))\n echo \"Database check failed (attempt $attempt), retrying in 2s:\"\n echo \"$output\"\n sleep 2\ndone\n\necho \"Database is ready\"\n\npython manage.py migrate --no-input\n"] |
backend.migrate.restartPolicy |
backend migrate job restart policy | Never |
backend.createsuperuser.command |
backend migrate command | ["/bin/sh","-c","attempt=0\nuntil output=$(python manage.py check --database default 2>&1)\ndo\n attempt=$((attempt + 1))\n echo \"Database check failed (attempt $attempt), retrying in 2s:\"\n echo \"$output\"\n sleep 2\ndone\n\necho \"Database is ready\"\n\npython manage.py createsuperuser --email $DJANGO_SUPERUSER_EMAIL --password $DJANGO_SUPERUSER_PASSWORD\n"] |
backend.createsuperuser.restartPolicy |
backend migrate job restart policy | Never |
backend.job |
job dedicated to run a random management command, for example after a deployment | |
backend.job.name |
The name to use to describe this job | "" |
backend.job.command |
The management command to execute | [] |
backend.job.restartPolicy |
The restart policy for the job. | Never |
backend.job.annotations |
Annotations to add to the job [default: argocd.argoproj.io/hook: PostSync] | |
backend.cronjobs |
Cronjob name, schedule, command | [] |
backend.probes.liveness.path |
Configure path for backend HTTP liveness probe | /__lbheartbeat__ |
backend.probes.liveness.targetPort |
Configure port for backend HTTP liveness probe | nil |
backend.probes.liveness.initialDelaySeconds |
Configure initial delay for backend liveness probe | 10 |
backend.probes.liveness.timeoutSeconds |
Configure timeout for backend liveness probe | nil |
backend.probes.startup.path |
Configure path for backend HTTP startup probe | |
backend.probes.startup.targetPort |
Configure port for backend HTTP startup probe | |
backend.probes.startup.initialDelaySeconds |
Configure initial delay for backend startup probe | |
backend.probes.startup.timeoutSeconds |
Configure timeout for backend startup probe | |
backend.probes.readiness.path |
Configure path for backend HTTP readiness probe | /__heartbeat__ |
backend.probes.readiness.targetPort |
Configure port for backend HTTP readiness probe | nil |
backend.probes.readiness.initialDelaySeconds |
Configure initial delay for backend readiness probe | 10 |
backend.probes.readiness.timeoutSeconds |
Configure timeout for backend readiness probe | nil |
backend.resources |
Resource requirements for the backend container | {} |
backend.nodeSelector |
Node selector for the backend Pod | {} |
backend.tolerations |
Tolerations for the backend Pod | [] |
backend.affinity |
Affinity for the backend Pod | {} |
backend.persistence |
Additional volumes to create and mount on the backend. Used for debugging purposes | {} |
backend.persistence.volume-name.size |
Size of the additional volume | |
backend.persistence.volume-name.type |
Type of the additional volume, persistentVolumeClaim or emptyDir | |
backend.persistence.volume-name.mountPath |
Path where the volume should be mounted to | |
backend.extraVolumeMounts |
Additional volumes to mount on the backend. | [] |
backend.extraVolumes |
Additional volumes to mount on the backend. | [] |
backend.pdb.enabled |
Enable pdb on backend | true |
backend.serviceAccountName |
Optional service account name to use for backend pods | nil |
backend.themeCustomization.enabled |
Enable theme customization | false |
backend.themeCustomization.file_content |
Content of the theme customization file. Must be a json object. | "" |
backend.themeCustomization.mount_path |
Path where the customization file will be mounted in the backend deployment. | /app/impress/configuration/theme |
backend.celery.replicas |
Amount of celery replicas | 1 |
backend.celery.command |
Override the celery container command | [] |
backend.celery.args |
Override the celery container args | ["celery","-A","impress.celery_app","worker","-l","INFO","-n","impress@%h"] |
backend.celery.resources |
Resource requirements for the celery container | {} |
backend.celery.probes.liveness.exec.command |
Override the celery container liveness probe command | ["/bin/sh","-c","celery -A impress.celery_app inspect ping -d impress@$HOSTNAME"] |
backend.celery.probes.liveness.initialDelaySeconds |
Initial delay for the celery container liveness probe | 60 |
backend.celery.probes.liveness.timeoutSeconds |
Timeout for the celery container liveness probe | 5 |
backend.celery.probes.readiness.exec.command |
Override the celery container readiness probe command | ["/bin/sh","-c","celery -A impress.celery_app inspect ping -d impress@$HOSTNAME"] |
backend.celery.probes.readiness.initialDelaySeconds |
Initial delay for the celery container readiness probe | 15 |
backend.celery.probes.readiness.timeoutSeconds |
Timeout for the celery container readiness probe | 5 |
backend.celery.envVars |
Celery worker specific environment variables (not shared with the backend web deployment) |
frontend
| Name | Description | Value |
|---|---|---|
frontend.image.repository |
Repository to use to pull impress's frontend container image | lasuite/impress-frontend |
frontend.image.tag |
impress's frontend container tag | latest |
frontend.image.pullPolicy |
frontend container image pull policy | IfNotPresent |
frontend.command |
Override the frontend container command | [] |
frontend.args |
Override the frontend container args | [] |
frontend.replicas |
Amount of frontend replicas | 3 |
frontend.shareProcessNamespace |
Enable share process namespace between containers | false |
frontend.sidecars |
Add sidecars containers to frontend deployment | [] |
frontend.securityContext.allowPrivilegeEscalation |
Whether to allow privilege escalation for the frontend container | false |
frontend.securityContext.capabilities.drop |
List of capabilities to drop for the frontend container | ["ALL"] |
frontend.securityContext.runAsNonRoot |
Whether to run the frontend container as a non-root user | true |
frontend.securityContext.seccompProfile.type |
Seccomp profile type for the frontend container | RuntimeDefault |
frontend.envVars |
Configure frontend container environment variables | undefined |
frontend.envVars.BY_VALUE |
Example environment variable by setting value directly | |
frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.name |
Name of a ConfigMap when configuring env vars from a ConfigMap | |
frontend.envVars.FROM_CONFIGMAP.configMapKeyRef.key |
Key within a ConfigMap when configuring env vars from a ConfigMap | |
frontend.envVars.FROM_SECRET.secretKeyRef.name |
Name of a Secret when configuring env vars from a Secret | |
frontend.envVars.FROM_SECRET.secretKeyRef.key |
Key within a Secret when configuring env vars from a Secret | |
frontend.podAnnotations |
Annotations to add to the frontend Pod | {} |
frontend.dpAnnotations |
Annotations to add to the frontend Deployment | {} |
frontend.service.type |
frontend Service type | ClusterIP |
frontend.service.port |
frontend Service listening port | 80 |
frontend.service.targetPort |
frontend container listening port | 8080 |
frontend.service.annotations |
Annotations to add to the frontend Service | {} |
frontend.probes |
Configure probe for frontend | {} |
frontend.probes.liveness.path |
Configure path for frontend HTTP liveness probe | |
frontend.probes.liveness.targetPort |
Configure port for frontend HTTP liveness probe | |
frontend.probes.liveness.initialDelaySeconds |
Configure initial delay for frontend liveness probe | |
frontend.probes.liveness.initialDelaySeconds |
Configure timeout for frontend liveness probe | |
frontend.probes.startup.path |
Configure path for frontend HTTP startup probe | |
frontend.probes.startup.targetPort |
Configure port for frontend HTTP startup probe | |
frontend.probes.startup.initialDelaySeconds |
Configure initial delay for frontend startup probe | |
frontend.probes.startup.initialDelaySeconds |
Configure timeout for frontend startup probe | |
frontend.probes.readiness.path |
Configure path for frontend HTTP readiness probe | |
frontend.probes.readiness.targetPort |
Configure port for frontend HTTP readiness probe | |
frontend.probes.readiness.initialDelaySeconds |
Configure initial delay for frontend readiness probe | |
frontend.probes.readiness.initialDelaySeconds |
Configure timeout for frontend readiness probe | |
frontend.resources |
Resource requirements for the frontend container | {} |
frontend.nodeSelector |
Node selector for the frontend Pod | {} |
frontend.tolerations |
Tolerations for the frontend Pod | [] |
frontend.affinity |
Affinity for the frontend Pod | {} |
frontend.persistence |
Additional volumes to create and mount on the frontend. Used for debugging purposes | {} |
frontend.persistence.volume-name.size |
Size of the additional volume | |
frontend.persistence.volume-name.type |
Type of the additional volume, persistentVolumeClaim or emptyDir | |
frontend.persistence.volume-name.mountPath |
Path where the volume should be mounted to | |
frontend.extraVolumeMounts |
Additional volumes to mount on the frontend. | [] |
frontend.extraVolumes |
Additional volumes to mount on the frontend. | [] |
frontend.pdb.enabled |
Enable pdb on frontend | true |
frontend.serviceAccountName |
Optional service account name to use for frontend pods | nil |
frontend.robotsTxt.enabled |
Enable serving a custom robots.txt file from the frontend, e.g. to disallow indexing of non-production instances | false |
frontend.robotsTxt.content |
Content of the robots.txt file | "User-agent: *\nAllow: /\n" |
posthog
| Name | Description | Value |
|---|---|---|
posthog.ingress.enabled |
Enable or disable the ingress resource creation | false |
posthog.ingress.className |
Kubernetes ingress class name to use (e.g., nginx, traefik) | nil |
posthog.ingress.host |
Primary hostname for the ingress resource | impress.example.com |
posthog.ingress.path |
URL path prefix for the ingress routes (e.g., /) | / |
posthog.ingress.hosts |
Additional hostnames array to be included in the ingress | [] |
posthog.ingress.tls.enabled |
Enable or disable TLS/HTTPS for the ingress | true |
posthog.ingress.tls.additional |
Additional TLS configurations for extra hosts/certificates | [] |
posthog.ingress.customBackends |
Custom backend service configurations for the ingress | [] |
posthog.ingress.annotations |
Additional Kubernetes annotations to apply to the ingress | {} |
posthog.ingressAssets.enabled |
Enable or disable the ingress resource creation | false |
posthog.ingressAssets.className |
Kubernetes ingress class name to use (e.g., nginx, traefik) | nil |
posthog.ingressAssets.host |
Primary hostname for the ingress resource | impress.example.com |
posthog.ingressAssets.paths |
URL paths prefix for the ingress routes (e.g., /static) | ["/static","/array"] |
posthog.ingressAssets.hosts |
Additional hostnames array to be included in the ingress | [] |
posthog.ingressAssets.tls.enabled |
Enable or disable TLS/HTTPS for the ingress | true |
posthog.ingressAssets.tls.additional |
Additional TLS configurations for extra hosts/certificates | [] |
posthog.ingressAssets.customBackends |
Custom backend service configurations for the ingress | [] |
posthog.ingressAssets.annotations |
Additional Kubernetes annotations to apply to the ingress | {} |
posthog.service.type |
Service type (e.g. ExternalName, ClusterIP, LoadBalancer) | ExternalName |
posthog.service.externalName |
External service hostname when type is ExternalName | eu.i.posthog.com |
posthog.service.port |
Port number for the service | 443 |
posthog.service.annotations |
Additional annotations to apply to the service | {} |
posthog.assetsService.type |
Service type (e.g. ExternalName, ClusterIP, LoadBalancer) | ExternalName |
posthog.assetsService.externalName |
External service hostname when type is ExternalName | eu-assets.i.posthog.com |
posthog.assetsService.port |
Port number for the service | 443 |
posthog.assetsService.annotations |
Additional annotations to apply to the service | {} |
yProvider
| Name | Description | Value |
|---|---|---|
yProvider.image.repository |
Repository to use to pull impress's yProvider container image | lasuite/impress-y-provider |
yProvider.image.tag |
impress's yProvider container tag | latest |
yProvider.image.pullPolicy |
yProvider container image pull policy | IfNotPresent |
yProvider.command |
Override the yProvider container command | [] |
yProvider.args |
Override the yProvider container args | [] |
yProvider.replicas |
Amount of yProvider replicas | 3 |
yProvider.shareProcessNamespace |
Enable share process nameyProvider between containers | false |
yProvider.sidecars |
Add sidecars containers to yProvider deployment | [] |
yProvider.securityContext.allowPrivilegeEscalation |
Whether to allow privilege escalation for the yProvider container | false |
yProvider.securityContext.capabilities.drop |
List of capabilities to drop for the yProvider container | ["ALL"] |
yProvider.securityContext.runAsNonRoot |
Whether to run the yProvider container as a non-root user | true |
yProvider.securityContext.seccompProfile.type |
Seccomp profile type for the yProvider container | RuntimeDefault |
yProvider.envVars |
Configure yProvider container environment variables | undefined |
yProvider.envVars.BY_VALUE |
Example environment variable by setting value directly | |
yProvider.envVars.FROM_CONFIGMAP.configMapKeyRef.name |
Name of a ConfigMap when configuring env vars from a ConfigMap | |
yProvider.envVars.FROM_CONFIGMAP.configMapKeyRef.key |
Key within a ConfigMap when configuring env vars from a ConfigMap | |
yProvider.envVars.FROM_SECRET.secretKeyRef.name |
Name of a Secret when configuring env vars from a Secret | |
yProvider.envVars.FROM_SECRET.secretKeyRef.key |
Key within a Secret when configuring env vars from a Secret | |
yProvider.podAnnotations |
Annotations to add to the yProvider Pod | {} |
yProvider.dpAnnotations |
Annotations to add to the yProvider Deployment | {} |
yProvider.service.type |
yProvider Service type | ClusterIP |
yProvider.service.port |
yProvider Service listening port | 443 |
yProvider.service.targetPort |
yProvider container listening port | 4444 |
yProvider.service.annotations |
Annotations to add to the yProvider Service | {} |
yProvider.probes.liveness.path |
Configure path for yProvider HTTP liveness probe | /ping |
yProvider.probes.liveness.initialDelaySeconds |
Configure initial delay for yProvider liveness probe | 10 |
yProvider.probes.liveness.targetPort |
Configure port for yProvider HTTP liveness probe | |
yProvider.probes.liveness.timeoutSeconds |
Configure timeout for yProvider liveness probe | |
yProvider.probes.startup.path |
Configure path for yProvider HTTP startup probe | |
yProvider.probes.startup.targetPort |
Configure port for yProvider HTTP startup probe | |
yProvider.probes.startup.initialDelaySeconds |
Configure initial delay for yProvider startup probe | |
yProvider.probes.startup.timeoutSeconds |
Configure timeout for yProvider startup probe | |
yProvider.probes.readiness.path |
Configure path for yProvider HTTP readiness probe | |
yProvider.probes.readiness.targetPort |
Configure port for yProvider HTTP readiness probe | |
yProvider.probes.readiness.initialDelaySeconds |
Configure initial delay for yProvider readiness probe | |
yProvider.probes.readiness.timeoutSeconds |
Configure timeout for yProvider readiness probe | |
yProvider.resources |
Resource requirements for the yProvider container | {} |
yProvider.nodeSelector |
Node selector for the yProvider Pod | {} |
yProvider.tolerations |
Tolerations for the yProvider Pod | [] |
yProvider.affinity |
Affinity for the yProvider Pod | {} |
yProvider.persistence |
Additional volumes to create and mount on the yProvider. Used for debugging purposes | {} |
yProvider.persistence.volume-name.size |
Size of the additional volume | |
yProvider.persistence.volume-name.type |
Type of the additional volume, persistentVolumeClaim or emptyDir | |
yProvider.persistence.volume-name.mountPath |
Path where the volume should be mounted to | |
yProvider.extraVolumeMounts |
Additional volumes to mount on the yProvider. | [] |
yProvider.extraVolumes |
Additional volumes to mount on the yProvider. | [] |
yProvider.pdb.enabled |
Enable pdb on yProvider | true |
yProvider.serviceAccountName |
Optional service account name to use for yProvider pods | nil |
JWT signing keys
| Name | Description | Value |
|---|---|---|
jwtKeys.enabled |
Generate the JWT signing keys of the services on the cluster | false |
jwtKeys.existingSecret |
Secret already holding the keys, generated in a secret of the chart's own when empty | nil |
jwtKeys.mountPath |
Path the keys are mounted at, in every service reading them | /data/jwt |
jwtKeys.backendKeyFilename |
Name of the key signing the tokens the backend issues | private.pem |
jwtKeys.yhubKeyFilename |
Name of the key signing the calls the collaboration server makes to the backend | yhub-private.pem |
jwtKeys.keySize |
Size, in bits, of the generated RSA keys | 2048 |
jwtKeys.rbac.create |
Create the service account and the role the job needs to create the secret | true |
jwtKeys.image.repository |
Repository to use to pull the image generating the keys | alpine/openssl |
jwtKeys.image.tag |
Tag of the image generating the keys | 3.5.7 |
jwtKeys.image.pullPolicy |
Pull policy of the image generating the keys | IfNotPresent |
jwtKeys.kubectlImage.repository |
Repository to use to pull the image handing the keys to the secret | dtzar/helm-kubectl |
jwtKeys.kubectlImage.tag |
Tag of the image handing the keys to the secret | 3.16.2 |
jwtKeys.kubectlImage.pullPolicy |
Pull policy of the image handing the keys to the secret | IfNotPresent |
jwtKeys.job.podSecurityContext |
Pod security context of the generating job | {} |
jwtKeys.job.securityContext.allowPrivilegeEscalation |
Whether to allow privilege escalation for the job containers | false |
jwtKeys.job.securityContext.capabilities.drop |
List of capabilities to drop for the job containers | ["ALL"] |
jwtKeys.job.securityContext.runAsNonRoot |
Whether to run the job containers as a non-root user | true |
jwtKeys.job.securityContext.runAsUser |
User the job containers run as, their images declaring none | 1000 |
jwtKeys.job.securityContext.runAsGroup |
Group the job containers run as | 1000 |
jwtKeys.job.securityContext.seccompProfile.type |
Seccomp profile type for the job containers | RuntimeDefault |
jwtKeys.job.restartPolicy |
Restart policy of the generating job | Never |
jwtKeys.job.backoffLimit |
Numbers of generating job retries | 2 |
jwtKeys.job.ttlSecondsAfterFinished |
Period to wait before removing the generating job | 30 |
jwtKeys.job.generateCommand |
Override the command generating the keys | [] |
jwtKeys.job.publishCommand |
Override the command creating the secret from the generated keys | [] |
jwtKeys.job.annotations |
Annotations to add to the generating job | {} |
jwtKeys.job.podAnnotations |
Annotations to add to the generating job Pod | {} |
jwtKeys.job.resources |
Resource requirements for the job containers | {} |
jwtKeys.job.nodeSelector |
Node selector for the generating job Pod | {} |
jwtKeys.job.tolerations |
Tolerations for the generating job Pod | [] |
jwtKeys.job.affinity |
Affinity for the generating job Pod | {} |
jwtKeys.job.serviceAccountName |
Service account of the generating job Pod, the one created above when empty | nil |
yhub
| Name | Description | Value |
|---|---|---|
yhub.enabled |
Enable the yhub collaboration server, its service and its init-db job | true |
yhub.image.repository |
Repository to use to pull the yhub container image | lasuite/impress-yhub |
yhub.image.tag |
yhub container tag | latest |
yhub.image.pullPolicy |
yhub container image pull policy | IfNotPresent |
yhub.command |
Override the yhub container command | [] |
yhub.args |
Override the yhub container args | [] |
yhub.replicas |
Amount of yhub replicas | 3 |
yhub.shareProcessNamespace |
Enable share process namespace between containers | false |
yhub.sidecars |
Add sidecars containers to yhub deployment | [] |
yhub.terminationGracePeriodSeconds |
Grace period given to a yhub pod to drain before it is killed | 60 |
yhub.securityContext.allowPrivilegeEscalation |
Whether to allow privilege escalation for the yhub container | false |
yhub.securityContext.capabilities.drop |
List of capabilities to drop for the yhub container | ["ALL"] |
yhub.securityContext.runAsNonRoot |
Whether to run the yhub container as a non-root user | true |
yhub.securityContext.runAsUser |
User the yhub container runs as | 1000 |
yhub.securityContext.runAsGroup |
Group the yhub container runs as | 1000 |
yhub.securityContext.seccompProfile.type |
Seccomp profile type for the yhub container | RuntimeDefault |
yhub.envVars |
Configure yhub container environment variables | undefined |
yhub.envVars.REDIS |
Required, redis/valkey url holding the live document state (e.g. redis://valkey:6379/0) | |
yhub.envVars.POSTGRES |
Required, url of the yhub database, created by the init-db job (e.g. postgres://user:pass@postgres:5432/yhub) | |
yhub.envVars.REDIS_PREFIX |
Namespace of the redis keys, when the instance is shared (default: yhub) | |
yhub.envVars.COLLABORATION_BACKEND_BASE_URL |
Base url of the Docs backend, which yhub asks about users and document access rights | |
yhub.envVars.COLLABORATION_SERVER_ORIGIN |
Comma separated list of the origins allowed to open a websocket | |
yhub.envVars.YHUB_JWT_PRIVATE_KEY_FILE |
Path to the RSA private key (PEM) yhub signs its calls to the backend with, mounted from a secret | |
yhub.envVars.SOFT_MIGRATION |
Set to "true" to seed rooms from the legacy Django/S3 document store on first access | |
yhub.envVars.BY_VALUE |
Example environment variable by setting value directly | |
yhub.envVars.FROM_CONFIGMAP.configMapKeyRef.name |
Name of a ConfigMap when configuring env vars from a ConfigMap | |
yhub.envVars.FROM_CONFIGMAP.configMapKeyRef.key |
Key within a ConfigMap when configuring env vars from a ConfigMap | |
yhub.envVars.FROM_SECRET.secretKeyRef.name |
Name of a Secret when configuring env vars from a Secret | |
yhub.envVars.FROM_SECRET.secretKeyRef.key |
Key within a Secret when configuring env vars from a Secret | |
yhub.podAnnotations |
Annotations to add to the yhub Pod | {} |
yhub.dpAnnotations |
Annotations to add to the yhub Deployment | {} |
yhub.initDbJobAnnotations |
Annotations for the yhub init-db job | {} |
yhub.jobs.ttlSecondsAfterFinished |
Period to wait before removing the init-db job | 30 |
yhub.jobs.backoffLimit |
Numbers of init-db job retries | 2 |
yhub.initDb.enabled |
Run the job creating and upgrading the yhub schema | true |
yhub.initDb.command |
Override the command creating and upgrading the yhub schema | [] |
yhub.initDb.retries |
How many times the schema script is retried while the postgres server does not answer | 60 |
yhub.initDb.retryDelaySeconds |
Seconds between two attempts | 5 |
yhub.initDb.restartPolicy |
Restart policy of the init-db job | Never |
yhub.service.type |
yhub Service type | ClusterIP |
yhub.service.port |
yhub Service listening port | 443 |
yhub.service.targetPort |
yhub container listening port | 3002 |
yhub.service.annotations |
Annotations to add to the yhub Service | {} |
yhub.probes.liveness.path |
Configure path for yhub HTTP liveness probe | /collaboration/jwks/v1 |
yhub.probes.liveness.initialDelaySeconds |
Configure initial delay for yhub liveness probe | 10 |
yhub.probes.readiness.path |
Configure path for yhub HTTP readiness probe | /collaboration/jwks/v1 |
yhub.probes.readiness.initialDelaySeconds |
Configure initial delay for yhub readiness probe | 5 |
yhub.probes.liveness.targetPort |
Configure port for yhub HTTP liveness probe | |
yhub.probes.liveness.timeoutSeconds |
Configure timeout for yhub liveness probe | |
yhub.probes.readiness.targetPort |
Configure port for yhub HTTP readiness probe | |
yhub.probes.readiness.timeoutSeconds |
Configure timeout for yhub readiness probe | |
yhub.probes.startup.path |
Configure path for yhub HTTP startup probe | |
yhub.probes.startup.targetPort |
Configure port for yhub HTTP startup probe | |
yhub.probes.startup.initialDelaySeconds |
Configure initial delay for yhub startup probe | |
yhub.probes.startup.timeoutSeconds |
Configure timeout for yhub startup probe | |
yhub.resources |
Resource requirements for the yhub container | {} |
yhub.nodeSelector |
Node selector for the yhub Pod | {} |
yhub.tolerations |
Tolerations for the yhub Pod | [] |
yhub.affinity |
Affinity for the yhub Pod | {} |
yhub.persistence |
Additional volumes to create and mount on the yhub. Used for debugging purposes | {} |
yhub.persistence.volume-name.size |
Size of the additional volume | |
yhub.persistence.volume-name.type |
Type of the additional volume, persistentVolumeClaim or emptyDir | |
yhub.persistence.volume-name.mountPath |
Path where the volume should be mounted to | |
yhub.extraVolumeMounts |
Additional volumes to mount on the yhub. Mounted on the init-db job too | [] |
yhub.extraVolumes |
Additional volumes to mount on the yhub. Mounted on the init-db job too | [] |
yhub.pdb.enabled |
Enable pdb on yhub | true |
yhub.serviceAccountName |
Optional service account name to use for yhub pods | nil |
docSpec
| Name | Description | Value |
|---|---|---|
docSpec.enabled |
Enable docSpec deployment | false |
docSpec.image.repository |
Repository to use to pull docSpec container image | ghcr.io/docspecio/api |
docSpec.image.tag |
docSpec container tag | 3.0.1 |
docSpec.image.pullPolicy |
docSpec container image pull policy | IfNotPresent |
docSpec.command |
Override the docSpec container command | [] |
docSpec.args |
Override the docSpec container args | [] |
docSpec.replicas |
Amount of docSpec replicas | 1 |
docSpec.securityContext.allowPrivilegeEscalation |
Whether to allow privilege escalation for the docSpec container | false |
docSpec.securityContext.capabilities.drop |
List of capabilities to drop for the docSpec container | ["ALL"] |
docSpec.securityContext.runAsNonRoot |
Whether to run the docSpec container as a non-root user | true |
docSpec.securityContext.seccompProfile.type |
Seccomp profile type for the docSpec container | RuntimeDefault |
docSpec.envVars |
Configure docSpec container environment variables | {} |
docSpec.service.type |
docSpec Service type | ClusterIP |
docSpec.service.port |
docSpec Service listening port | 4000 |
docSpec.service.targetPort |
docSpec container listening port | 3000 |
docSpec.probes.liveness.path |
Configure path for docSpec HTTP liveness probe | /health |
docSpec.probes.readiness.path |
Configure path for docSpec HTTP readiness probe | /health |
docSpec.resources |
docSpec resources | {} |
docSpec.nodeSelector |
Node selector for the docSpec Pod | {} |
docSpec.tolerations |
Tolerations for the docSpec Pod | [] |
docSpec.affinity |
Affinity for the docSpec Pod | {} |
docSpec.extraVolumeMounts |
Additional volumes to mount on docSpec | [] |
docSpec.extraVolumes |
Additional volumes to mount on docSpec | [] |