new files
This commit is contained in:
@@ -0,0 +1,27 @@
|
||||
apiVersion: argoproj.io/v1alpha
|
||||
kind: Application
|
||||
metadata: passbolt-application
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: default
|
||||
sources:
|
||||
- repoURL: 'https://download.passbolt.com/charts/passbolt'
|
||||
chart: passbolt
|
||||
targetRevision: '2.1.0'
|
||||
helm:
|
||||
valueFiles:
|
||||
- $values/dev-values.yaml
|
||||
|
||||
- repoURL: git@gitlab.com:<your-username>/<passbolt-repo>.git
|
||||
targetRevision: HEAD
|
||||
ref: values
|
||||
destination:
|
||||
server: https://kubernetes.default.svc
|
||||
namespace: passbolt
|
||||
syncPolicy:
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ApplyOutOfSyncOnly=true
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
+470
@@ -0,0 +1,470 @@
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
## Dependencies configuration parameters
|
||||
|
||||
## Redis dependency parameters
|
||||
|
||||
# -- Install redis as a depending chart
|
||||
redisDependencyEnabled: true
|
||||
# -- Install mariadb as a depending chart
|
||||
mariadbDependencyEnabled: true
|
||||
# -- Install postgresql as a depending chart
|
||||
postgresqlDependencyEnabled: false
|
||||
|
||||
# Configure postgresql as a dependency chart
|
||||
# postgresql:
|
||||
# global:
|
||||
# security:
|
||||
# # -- Allow insecure images on bitnami charts. Required as per when using bitnamilegacy https://github.com/bitnami/charts/issues/30850
|
||||
# allowInsecureImages: true
|
||||
# image:
|
||||
# # -- Pin PostgreSQL image to bitnamilegacy image repository.
|
||||
# repository: bitnamilegacy/postgresql
|
||||
# auth:
|
||||
# # -- Configure postgresql auth username
|
||||
# username: CHANGEME
|
||||
# # -- Configure postgresql auth password
|
||||
# password: CHANGEME
|
||||
# # -- Configure postgresql auth database
|
||||
# database: passbolt
|
||||
|
||||
global:
|
||||
imageRegistry: ""
|
||||
imagePullSecrets: []
|
||||
|
||||
# Configure redis dependency chart
|
||||
redis:
|
||||
global:
|
||||
security:
|
||||
# -- Allow insecure images on bitnami charts. Required as per when using bitnamilegacy https://github.com/bitnami/charts/issues/30850
|
||||
allowInsecureImages: true
|
||||
image:
|
||||
# -- Pin redis image to bitnamilegacy image repository.
|
||||
repository: bitnamilegacy/redis
|
||||
auth:
|
||||
# -- Enable redis authentication
|
||||
enabled: true
|
||||
# -- Configure redis password
|
||||
password: "CHANGEME"
|
||||
sentinel:
|
||||
image:
|
||||
# -- Pin redis-sentinel image to bitnamilegacy image repository.
|
||||
repository: bitnamilegacy/redis-sentinel
|
||||
# -- Enable redis sentinel
|
||||
enabled: true
|
||||
|
||||
## MariaDB dependency parameters
|
||||
|
||||
# Configure mariadb as a dependency chart
|
||||
mariadb:
|
||||
global:
|
||||
security:
|
||||
# -- Allow insecure images on bitnami charts. Required as per when using bitnamilegacy https://github.com/bitnami/charts/issues/30850
|
||||
allowInsecureImages: true
|
||||
image:
|
||||
# -- Pin redis image to bitnamilegacy image repository.
|
||||
repository: bitnamilegacy/mariadb
|
||||
# -- Configure mariadb architecture
|
||||
architecture: replication
|
||||
auth:
|
||||
# -- Configure mariadb auth root password
|
||||
rootPassword: root
|
||||
# -- Configure mariadb auth username
|
||||
username: pbadmin
|
||||
# -- Configure mariadb auth password
|
||||
password: DW"C_/9jTTkMjwj<'%
|
||||
# -- Configure mariadb auth database
|
||||
database: passboltdb
|
||||
# -- Configure mariadb auth replicationPassword
|
||||
replicationPassword: w(*4Ewj:m`K/Ai^/qb
|
||||
# -- Configure parameters for the primary instance.
|
||||
primary:
|
||||
# -- Configure persistence options.
|
||||
persistence:
|
||||
# -- Enable persistence on MariaDB primary replicas using a `PersistentVolumeClaim`. If false, use emptyDir
|
||||
enabled: true
|
||||
# -- Name of an existing `PersistentVolumeClaim` for MariaDB primary replicas. When it's set the rest of persistence parameters are ignored.
|
||||
existingClaim: ""
|
||||
# -- Subdirectory of the volume to mount at
|
||||
subPath: ""
|
||||
# -- Primary persistent volume storage Class
|
||||
storageClass: ""
|
||||
# -- Labels for the PVC
|
||||
labels: {}
|
||||
# -- Primary persistent volume claim annotations
|
||||
annotations: {}
|
||||
# -- Primary persistent volume access Modes
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
# -- Primary persistent volume size
|
||||
size: 8Gi
|
||||
# -- Selector to match an existing Persistent Volume
|
||||
selector: {}
|
||||
# -- Configure parameters for the secondary instance.
|
||||
secondary:
|
||||
# -- Configure persistence options.
|
||||
persistence:
|
||||
# -- Enable persistence on MariaDB secondary replicas using a `PersistentVolumeClaim`. If false, use emptyDir
|
||||
enabled: true
|
||||
# -- Subdirectory of the volume to mount at
|
||||
subPath: ""
|
||||
# -- Secondary persistent volume storage Class
|
||||
storageClass: ""
|
||||
# -- Labels for the PVC
|
||||
labels: {}
|
||||
# -- Secondary persistent volume claim annotations
|
||||
annotations: {}
|
||||
# -- Secondary persistent volume access Modes
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
# -- Secondary persistent volume size
|
||||
size: 8Gi
|
||||
# -- Selector to match an existing Persistent Volume
|
||||
selector: {}
|
||||
|
||||
## Passbolt configuration
|
||||
|
||||
## Passbolt container and sidecar parameters
|
||||
app:
|
||||
# -- Configure pasbolt deployment init container that waits for database
|
||||
databaseInitContainer:
|
||||
# -- Toggle pasbolt deployment init container that waits for database
|
||||
enabled: true
|
||||
# initImage:
|
||||
# # -- Configure pasbolt deployment init container image client for database
|
||||
# client: mariadb
|
||||
# registry: ""
|
||||
# # -- Configure pasbolt deployment image repsitory
|
||||
# repository: mariadb
|
||||
# # -- Configure pasbolt deployment image pullPolicy
|
||||
# pullPolicy: IfNotPresent
|
||||
# # -- Overrides the image tag whose default is the chart appVersion.
|
||||
# tag: latest
|
||||
image:
|
||||
# -- Configure pasbolt deployment image repsitory
|
||||
registry: ""
|
||||
repository: passbolt/passbolt
|
||||
# -- Configure pasbolt deployment image pullPolicy
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Overrides the image tag whose default is the chart appVersion.
|
||||
tag: 5.9.0-1-ce
|
||||
# Allowed options: mariadb, mysql or postgresql
|
||||
database:
|
||||
kind: mariadb
|
||||
# -- Configure ssl on mariadb/mysql clients
|
||||
# -- In case this is enabled, you will be responsible for creating and mounting the certificates and
|
||||
# -- additional configutions on both the client and the server.
|
||||
# ssl: off
|
||||
cache:
|
||||
# Use CACHE_CAKE_DEFAULT_* variables to configure the connection to redis instance
|
||||
# on the passboltEnv configuration section
|
||||
redis:
|
||||
# -- By enabling redis the chart will mount a configuration file on /etc/passbolt/app.php
|
||||
# That instructs passbolt to store sessions on redis and to use it as a general cache.
|
||||
enabled: true
|
||||
sentinelProxy:
|
||||
# -- Inject a haproxy sidecar container configured as a proxy to redis sentinel
|
||||
# Make sure that CACHE_CAKE_DEFAULT_SERVER is set to '127.0.0.1' to use the proxy
|
||||
enabled: true
|
||||
# -- Configure redis sentinel proxy image
|
||||
image:
|
||||
registry: ""
|
||||
# -- Configure redis sentinel image repository
|
||||
repository: haproxy
|
||||
# -- Configure redis sentinel image tag
|
||||
tag: "latest"
|
||||
# -- Configure redis sentinel container resources
|
||||
resources: {}
|
||||
# -- Configure the passbolt deployment resources
|
||||
extraPodLabels: {}
|
||||
resources: {}
|
||||
tls:
|
||||
# -- If autogenerate is true, the chart will generate a secret with a certificate for APP_FULL_BASE_URL hostname
|
||||
# -- if autogenerate is false, existingSecret should be filled with an existing tls kind secret name
|
||||
# @ignored
|
||||
autogenerate: true
|
||||
# existingSecret: ""
|
||||
# -- Configure additional containers to be added to the pod
|
||||
extraContainers: []
|
||||
|
||||
# -- Enable email cron
|
||||
cronJobEmail:
|
||||
enabled: true
|
||||
schedule: "* * * * *"
|
||||
extraPodLabels: {}
|
||||
|
||||
## Passbolt environment parameters
|
||||
|
||||
# -- Pro subscription key in base64 only if you are using pro version
|
||||
# subscriptionKey:
|
||||
# -- Configure passbolt subscription key path
|
||||
# subscription_keyPath: /etc/passbolt/subscription_key.txt
|
||||
|
||||
# -- Configure passbolt gpg directory
|
||||
gpgPath: /etc/passbolt/gpg
|
||||
# -- Gpg server private key in base64
|
||||
gpgServerKeyPrivate: ""
|
||||
# -- Gpg server public key in base64
|
||||
gpgServerKeyPublic: ""
|
||||
# -- Name of the existing secret for the GPG server keypair. The secret must contain the `serverkey.asc` and `serverkey_private.asc` keys.
|
||||
gpgExistingSecret: ""
|
||||
|
||||
# -- Name of the existing secret for the JWT server keypair. The secret must contain the `jwt.key` and `jwt.pem` keys.
|
||||
jwtExistingSecret: ""
|
||||
# -- Configure passbolt jwt directory
|
||||
jwtPath: /etc/passbolt/jwt
|
||||
# -- JWT server private key in base64
|
||||
jwtServerPrivate: ""
|
||||
# -- JWT server public key in base64
|
||||
jwtServerPublic: ""
|
||||
# -- Forces overwrite JWT keys
|
||||
jwtCreateKeysForced: false
|
||||
jobCreateJwtKeys:
|
||||
extraPodLabels: {}
|
||||
|
||||
jobCreateGpgKeys:
|
||||
extraPodLabels: {}
|
||||
|
||||
passboltEnv:
|
||||
plain:
|
||||
|
||||
# -- Configure passbolt privacy url
|
||||
PASSBOLT_LEGAL_PRIVACYPOLICYURL: https://www.passbolt.com/privacy
|
||||
# -- Configure passbolt fullBaseUrl
|
||||
APP_FULL_BASE_URL: https://passbolt.realm.local
|
||||
# -- Configure passbolt to force ssl
|
||||
PASSBOLT_SSL_FORCE: true
|
||||
# -- Toggle passbolt public registration
|
||||
PASSBOLT_REGISTRATION_PUBLIC: true
|
||||
# -- Configure passbolt cake cache server
|
||||
CACHE_DEFAULT_HOST: 127.0.0.1
|
||||
# -- Configure passbolt cake core cache server
|
||||
CACHE_CAKECORE_HOST: 127.0.0.1
|
||||
# -- Configure passbolt cake model cache server
|
||||
CACHE_CAKEMODEL_HOST: 127.0.0.1
|
||||
# -- Configure passbolt cake cache server port
|
||||
CACHE_DEFAULT_PORT: 6379
|
||||
# -- Configure passbolt cake core cache server port
|
||||
CACHE_CAKECORE_PORT: 6379
|
||||
# -- Configure passbolt cake model cache server port
|
||||
CACHE_CAKEMODEL_PORT: 6379
|
||||
# -- Configure passbolt cake session storage, either php, cake, database or cache
|
||||
SESSION_DEFAULTS: cache
|
||||
# -- Configure passbolt cake cache class
|
||||
CACHE_DEFAULT_CLASSNAME: Redis
|
||||
# -- Configure passbolt cake model cache class
|
||||
CACHE_CAKEMODEL_CLASSNAME: Redis
|
||||
# -- Configure passbolt cake core cache class
|
||||
CACHE_CAKECORE_CLASSNAME: Redis
|
||||
# -- Configure passbolt default email service port
|
||||
EMAIL_TRANSPORT_DEFAULT_PORT: 587
|
||||
# -- Toggle passbolt debug mode
|
||||
DEBUG: false
|
||||
# -- Configure email used on gpg key. This is used when automatically creating a new gpg server key and when automatically calculating the fingerprint.
|
||||
PASSBOLT_KEY_EMAIL: passbolt@solusar.de
|
||||
# -- Toggle passbolt selenium mode
|
||||
PASSBOLT_SELENIUM_ACTIVE: false
|
||||
# -- Configure passbolt license path
|
||||
PASSBOLT_PLUGINS_LICENSE_LICENSE: /etc/passbolt/subscription_key.txt
|
||||
# -- Configure passbolt default email from
|
||||
EMAIL_DEFAULT_FROM: no-reply@passbolt.realm.local
|
||||
# -- Configure passbolt default email from name
|
||||
EMAIL_DEFAULT_FROM_NAME: Passbolt
|
||||
# -- Configure passbolt default email host
|
||||
EMAIL_TRANSPORT_DEFAULT_HOST: 127.0.0.1
|
||||
# -- Configure passbolt default email timeout
|
||||
EMAIL_TRANSPORT_DEFAULT_TIMEOUT: 30
|
||||
# -- Toggle passbolt tls
|
||||
EMAIL_TRANSPORT_DEFAULT_TLS: true
|
||||
# -- Configure passbolt jwt private key path
|
||||
PASSBOLT_JWT_SERVER_KEY: /var/www/passbolt/config/jwt/jwt.key
|
||||
# -- Configure passbolt jwt public key path
|
||||
PASSBOLT_JWT_SERVER_PEM: /var/www/passbolt/config/jwt/jwt.pem
|
||||
# -- Toggle passbolt jwt authentication
|
||||
PASSBOLT_PLUGINS_JWT_AUTHENTICATION_ENABLED: true
|
||||
# -- Download Command for kubectl
|
||||
KUBECTL_DOWNLOAD_CMD: ""
|
||||
# -- Set to false to supress warnings when running passbolt commands as non webserver user, mainly for Openshift
|
||||
PASSBOLT_SECURITY_DISPLAY_NON_WEBUSER_WARNING: true
|
||||
secret:
|
||||
# -- Configure passbolt cake cache password
|
||||
CACHE_DEFAULT_PASSWORD: ={K=X=6UcS~s^Pa,a,
|
||||
# -- Configure passbolt cake core cache password
|
||||
CACHE_CAKECORE_PASSWORD: U!L9Ue%"`_-+{.u"vQ
|
||||
# -- Configure passbolt cake model cache password
|
||||
CACHE_CAKEMODEL_PASSWORD: V!K'_6}Q\%PSufj$eV
|
||||
# -- Configure passbolt default database password
|
||||
DATASOURCES_DEFAULT_PASSWORD: DW"C_/9jTTkMjwj<'%
|
||||
# -- Configure passbolt default database username
|
||||
DATASOURCES_DEFAULT_USERNAME: pbadmin
|
||||
# -- Configure passbolt default database
|
||||
DATASOURCES_DEFAULT_DATABASE: passboltdb
|
||||
# -- Configure passbolt default email service username
|
||||
EMAIL_TRANSPORT_DEFAULT_USERNAME: admin@solusar.de
|
||||
# -- Configure passbolt default email service password
|
||||
EMAIL_TRANSPORT_DEFAULT_PASSWORD: #gentoo#
|
||||
# -- Configure passbolt server gpg key fingerprint
|
||||
# PASSBOLT_GPG_SERVER_KEY_FINGERPRINT:
|
||||
# -- Configure passbolt security salt.
|
||||
# SECURITY_SALT:
|
||||
# -- Environment variables to add to the passbolt pods
|
||||
extraEnv: []
|
||||
# -- Environment variables from secrets or configmaps to add to the passbolt pods
|
||||
extraEnvFrom:
|
||||
[]
|
||||
# - secretRef:
|
||||
# name: passbolt-secret
|
||||
## Overrides the plain value in the case of not wanting to provide the config from values
|
||||
## Do this ONLY if you know what you are doing
|
||||
configMapName: ""
|
||||
## Overrides the secrets value in the case of not wanting to provide them in the values file.
|
||||
## Do this ONLY if you know what you are doing
|
||||
secretName: ""
|
||||
## Passbolt deployment parameters
|
||||
|
||||
# -- If autoscaling is disabled this will define the number of pods to run
|
||||
replicaCount: 2
|
||||
|
||||
# Configure autoscaling on passbolt deployment
|
||||
autoscaling:
|
||||
# -- Enable autoscaling on passbolt deployment
|
||||
enabled: false
|
||||
# -- Configure autoscaling minimum replicas
|
||||
minReplicas: 1
|
||||
# -- Configure autoscaling maximum replicas
|
||||
maxReplicas: 100
|
||||
# -- Configure autoscaling target CPU uptilization percentage
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# -- Enable role based access control
|
||||
rbacEnabled: true
|
||||
|
||||
# -- Configure passbolt container livenessProbe
|
||||
livenessProbe:
|
||||
# @ignore
|
||||
httpGet:
|
||||
port: https
|
||||
scheme: HTTPS
|
||||
path: /healthcheck/status.json
|
||||
httpHeaders:
|
||||
- name: Host
|
||||
value: passbolt.realm.local
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 10
|
||||
# -- Configure passbolt container RadinessProbe
|
||||
readinessProbe:
|
||||
# @ignore
|
||||
httpGet:
|
||||
port: https
|
||||
scheme: HTTPS
|
||||
httpHeaders:
|
||||
- name: Host
|
||||
value: passbolt.realm.local
|
||||
path: /healthcheck/status.json
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
|
||||
# Configure network policies to allow ingress access passbolt pods
|
||||
# networkPolicy defines which labels are allowed to reach to passbolt
|
||||
# and which namespaces
|
||||
networkPolicy:
|
||||
# -- Enable network policies to allow ingress access passbolt pods
|
||||
enabled: false
|
||||
# -- Configure network policies label for ingress deployment
|
||||
label: app.kubernetes.io/name
|
||||
# -- Configure network policies podLabel for podSelector
|
||||
podLabel: ingress-nginx
|
||||
# -- Configure network policies namespaceLabel for namespaceSelector
|
||||
namespaceLabel: ingress-nginx
|
||||
|
||||
# -- Configure image pull secrets
|
||||
imagePullSecrets: []
|
||||
# -- Value to override the chart name on default
|
||||
nameOverride: ""
|
||||
# -- Value to override the whole fullName
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# -- Specifies whether a service account should be created
|
||||
create: true
|
||||
# -- Annotations to add to the service account
|
||||
annotations: {}
|
||||
|
||||
# -- Map of annotation for passbolt server pod
|
||||
podAnnotations: {}
|
||||
|
||||
# -- Security Context configuration for passbolt server pod
|
||||
podSecurityContext:
|
||||
{}
|
||||
# fsGroup: 2000
|
||||
|
||||
service:
|
||||
# -- Configure passbolt service type
|
||||
type: LoadBalancer
|
||||
# -- Annotations to add to the service
|
||||
annotations: {}
|
||||
# -- Configure the service ports
|
||||
ports:
|
||||
# -- Configure the HTTPS port
|
||||
https:
|
||||
# -- Configure passbolt HTTPS service port
|
||||
port: 443
|
||||
# -- Configure passbolt HTTPS service targetPort
|
||||
targetPort: 443
|
||||
# -- Configure passbolt HTTPS service port name
|
||||
name: https
|
||||
http:
|
||||
# -- Configure passbolt HTTP service port
|
||||
port: 80
|
||||
# -- Configure passbolt HTTP service targetPort
|
||||
targetPort: 80
|
||||
# -- Configure passbolt HTTP service port name
|
||||
name: http
|
||||
# -- Preference for routing traffic to endpoints that are in the same zone as the client
|
||||
# trafficDistribution: "PreferSameZone"
|
||||
|
||||
ingress:
|
||||
# -- Enable passbolt ingress
|
||||
enabled: false
|
||||
# -- Configure passbolt ingress annotations
|
||||
annotations: {}
|
||||
# -- Configure passbolt ingress class name
|
||||
# className: "nginx-example"
|
||||
# -- Configure passbolt ingress hosts
|
||||
hosts:
|
||||
# @ignored
|
||||
- host: passbolt.realm.local
|
||||
paths:
|
||||
- path: /
|
||||
port: https
|
||||
pathType: ImplementationSpecific
|
||||
# -- Configure passbolt ingress tls
|
||||
tls:
|
||||
# If autogenerate is true, the chart will generate a secret for the given hosts
|
||||
# if autogenerate is false, existingSecret should be filled with an existing tls kind secret name
|
||||
# @ignored
|
||||
- autogenerate: true
|
||||
# existingSecret: ""
|
||||
hosts:
|
||||
- passbolt.realm.local
|
||||
# -- Configure passbolt deployment nodeSelector
|
||||
nodeSelector: {}
|
||||
|
||||
# -- Configure passbolt deployment tolerations
|
||||
tolerations: []
|
||||
|
||||
# -- Configure passbolt deployment affinity
|
||||
affinity: {}
|
||||
|
||||
# -- Add additional volumes, e.g. for overwriting config files
|
||||
extraVolumes: []
|
||||
|
||||
# -- Add additional volume mounts, e.g. for overwriting config files
|
||||
extraVolumeMounts: []
|
||||
|
||||
# Toggle to true if deploying on Openshift
|
||||
# Removes security context specifying UID from the email cronjob
|
||||
# Adds a route to use
|
||||
Openshift: false
|
||||
Reference in New Issue
Block a user