keyhan
d3bbc0c0a0
Build and Deploy Platform / build-and-deploy (push) Successful in 14m57s
User-app builds no longer pull gcr.io/docker.io directly when build.images is configured in values.yaml, fixing ImagePullBackOff on clusters without upstream registry access. Co-authored-by: Cursor <cursoragent@cursor.com>
84 lines
2.5 KiB
YAML
84 lines
2.5 KiB
YAML
# Example production overrides for cloudhost-platform
|
|
# cp values-production.example.yaml values-production.yaml && edit secrets/hosts
|
|
|
|
namespace: cloudhost
|
|
createNamespace: true
|
|
|
|
global:
|
|
storageClass: local-path # k3s example
|
|
|
|
images:
|
|
# Mirror Docker Hub images through your private registry so cluster nodes
|
|
# never pull from docker.io directly (matches the kaniko/Harbor setup).
|
|
postgres: registry.example.com/mirror/postgres:16-alpine
|
|
redis: registry.example.com/mirror/redis:7-alpine
|
|
busybox: registry.example.com/mirror/busybox:1.36
|
|
backend:
|
|
repository: registry.example.com/cloudhost-backend
|
|
tag: "1.0.0"
|
|
pullPolicy: Always
|
|
frontend:
|
|
repository: registry.example.com/cloudhost-frontend
|
|
tag: "1.0.0"
|
|
pullPolicy: Always
|
|
|
|
# Build job images — override for clusters without Harbor proxy-cache.
|
|
build:
|
|
images:
|
|
kaniko: registry.example.com/proxy-gcr/kaniko-project/executor:v1.23.2
|
|
alpine: registry.example.com/proxy-dockerhub/library/alpine:3.19
|
|
alpineGit: registry.example.com/proxy-dockerhub/alpine/git:2.43.0
|
|
baseImageRegistry: registry.example.com/proxy-dockerhub/library
|
|
|
|
postgres:
|
|
password: "CHANGE_ME_STRONG_POSTGRES_PASSWORD"
|
|
# Pull secret for the mirrored postgres image
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
|
|
redis:
|
|
# Auto-generated and persisted in the platform Secret when left empty.
|
|
password: ""
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
|
|
secrets:
|
|
jwtSecret: "CHANGE_ME_LONG_JWT_SECRET"
|
|
jwtRefreshSecret: "CHANGE_ME_LONG_REFRESH_SECRET"
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
frontend:
|
|
host: platform.example.com
|
|
api:
|
|
host: api.platform.example.com
|
|
tls:
|
|
enabled: true
|
|
clusterIssuer: letsencrypt-prod
|
|
|
|
backend:
|
|
# Enable after copying ceph-app-sources-credentials secret into the cloudhost namespace
|
|
sourceStorage:
|
|
enabled: false
|
|
existingSecret: ceph-app-sources-credentials
|
|
env:
|
|
PLATFORM_DOMAIN: apps.example.com
|
|
REGISTRY_URL: registry.cloudhost-builds.svc.cluster.local:5000
|
|
REGISTRY_PULL_URL: registry.cloudhost-builds.svc.cluster.local:5000
|
|
# Elastic log-stack credentials (must match the logging namespace Secret)
|
|
ELASTIC_PASSWORD: "CHANGE_ME_ELASTIC_PASSWORD"
|
|
FLUENTBIT_PASSWORD: "CHANGE_ME_FLUENTBIT_PASSWORD"
|
|
KIBANA_SYSTEM_PASSWORD: "CHANGE_ME_KIBANA_PASSWORD"
|
|
# Swagger stays off in production; set SWAGGER_ENABLED: "true" to expose it
|
|
|
|
migrations:
|
|
enabled: true
|
|
|
|
backups:
|
|
postgres:
|
|
enabled: true
|
|
schedule: "0 3 * * *"
|
|
storageSize: 10Gi
|
|
retentionDays: 7
|