keyhan
d3bbc0c0a0
Build and Deploy Platform / build-and-deploy (push) Successful in 14m57s
User-app builds no longer pull gcr.io/docker.io directly when build.images is configured in values.yaml, fixing ImagePullBackOff on clusters without upstream registry access. Co-authored-by: Cursor <cursoragent@cursor.com>
155 lines
4.3 KiB
YAML
155 lines
4.3 KiB
YAML
# Production values template — copy and customize for YOUR environment.
|
|
#
|
|
# Full step-by-step (from zero, any cluster):
|
|
# See RUNBOOK-DEPLOY.fa.md — Phase 2 (values) and Phase 3 (secrets)
|
|
#
|
|
# Example for abrban.com:
|
|
# cp values-abrban.example.yaml ../cloud-host-gitops/platform/values-abrban.yaml
|
|
#
|
|
# CI only updates images.backend.tag and images.frontend.tag on each deploy.
|
|
|
|
namespace: cloudhost
|
|
createNamespace: false
|
|
|
|
global:
|
|
storageClass: local-path
|
|
|
|
images:
|
|
# Harbor proxy-cache — first pull is slow, no manual seed needed (see gitops/README.md)
|
|
postgres: registry.abrban.com/proxy-dockerhub/library/postgres:16-alpine
|
|
redis: registry.abrban.com/proxy-dockerhub/library/redis:7-alpine
|
|
busybox: registry.abrban.com/proxy-dockerhub/library/busybox:1.36
|
|
backend:
|
|
repository: registry.abrban.com/abrban/cloudhost-backend
|
|
tag: "1.0.0" # ← CI overwrites on each deploy
|
|
pullPolicy: IfNotPresent
|
|
frontend:
|
|
repository: registry.abrban.com/abrban/cloudhost-frontend
|
|
tag: "1.0.0" # ← CI overwrites on each deploy
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Kaniko job images — Harbor proxy-cache (first pull is slow, no manual seed needed).
|
|
build:
|
|
images:
|
|
kaniko: registry.abrban.com/proxy-gcr/kaniko-project/executor:v1.23.2
|
|
alpine: registry.abrban.com/proxy-dockerhub/library/alpine:3.19
|
|
alpineGit: registry.abrban.com/proxy-dockerhub/alpine/git:2.43.0
|
|
baseImageRegistry: registry.abrban.com/proxy-dockerhub/library
|
|
|
|
postgres:
|
|
enabled: true
|
|
database: cloudhost
|
|
username: cloudhost
|
|
password: "" # managed in abrban-platform-secrets (postgres-password)
|
|
storage: 10Gi
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
|
|
redis:
|
|
enabled: true
|
|
storage: 1Gi
|
|
password: "" # managed in abrban-platform-secrets (redis-password)
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
# GitOps: never let Helm generate random JWT/redis passwords on each sync.
|
|
# Create once with kubeseal — see gitops/sealed-secrets/abrban-platform-secrets.example.yaml
|
|
secrets:
|
|
existingSecret: abrban-platform-secrets
|
|
|
|
backend:
|
|
enabled: true
|
|
replicas: 1
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
uploads:
|
|
size: 20Gi
|
|
sourceStorage:
|
|
enabled: false
|
|
existingSecret: ceph-app-sources-credentials
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
env:
|
|
NODE_ENV: production
|
|
PORT: "4000"
|
|
JWT_EXPIRES_IN: 15m
|
|
JWT_REFRESH_EXPIRES_IN: 7d
|
|
PLATFORM_DOMAIN: apps.abrban.com
|
|
PREVIEW_BASE_DOMAIN: apps.abrban.com
|
|
FRONTEND_URL: https://panel.abrban.com,https://abrban.com
|
|
REGISTRY_URL: harbor-registry.cloudhost.svc.cluster.local:5000/abrban
|
|
REGISTRY_PULL_URL: registry.abrban.com/abrban
|
|
BUILD_NAMESPACE: cloudhost-builds
|
|
BUILD_SERVICE_ACCOUNT: kaniko-builder
|
|
UPLOAD_DIR: /app/uploads
|
|
PLATFORM_CREATE_STORAGE_CLASS: "true"
|
|
PLATFORM_STORAGE_CLASS: cloudhost-expandable
|
|
PLATFORM_STORAGE_PROVISIONER: rancher.io/local-path
|
|
ELASTICSEARCH_HOST: elasticsearch.logging.svc.cluster.local
|
|
ELASTICSEARCH_AUTO_PORT_FORWARD: "false"
|
|
# Must match elasticsearch-credentials Secret in logging namespace (not in Helm chart)
|
|
ELASTIC_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"
|
|
FLUENTBIT_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"
|
|
KIBANA_SYSTEM_PASSWORD: "CHANGE_VIA_SEALEDSECRET_OR_KUBECTL"
|
|
# Swagger disabled in production unless explicitly enabled
|
|
# SWAGGER_ENABLED: "true"
|
|
|
|
frontend:
|
|
enabled: true
|
|
replicas: 1
|
|
imagePullSecrets:
|
|
- name: registry-pull-secret
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
frontend:
|
|
host: abrban.com
|
|
panel:
|
|
host: panel.abrban.com
|
|
api:
|
|
host: api.abrban.com
|
|
tls:
|
|
enabled: true
|
|
clusterIssuer: letsencrypt-prod
|
|
|
|
migrations:
|
|
enabled: true
|
|
image: registry.abrban.com/proxy-dockerhub/library/postgres:16-alpine
|
|
|
|
backups:
|
|
postgres:
|
|
enabled: true
|
|
schedule: "0 3 * * *"
|
|
storageSize: 10Gi
|
|
retentionDays: 7
|
|
|
|
monitoring:
|
|
enabled: false
|