aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--charts/mirum/templates/server-deployment.yaml40+0 −40
-rw-r--r--charts/mirum/templates/server-tcproute.yaml22+0 −22
-rw-r--r--charts/mirum/values.yaml28+3 −25
-rw-r--r--mise.toml2+1 −1
4 files changed, 4 insertions, 88 deletions
diff --git a/charts/mirum/templates/server-deployment.yaml b/charts/mirum/templates/server-deployment.yaml
index 9191159..c5cb8c8 100644
--- a/charts/mirum/templates/server-deployment.yaml
+++ b/charts/mirum/templates/server-deployment.yaml
@@ -4,9 +4,6 @@
{{- if and .Values.server.enabled (ne (int .Values.server.replicaCount) 1) }}
{{- fail "mirum: server.replicaCount must be 1 while the task queue is process-local" }}
{{- end }}
-{{- if and .Values.server.enabled .Values.server.postgresqlMtls.enabled (not .Values.server.serviceAccountName) }}
-{{- fail "mirum: server.serviceAccountName is required when server.postgresqlMtls.enabled=true" }}
-{{- end }}
{{- if .Values.server.enabled }}
apiVersion: apps/v1
kind: Deployment
@@ -34,9 +31,6 @@ spec:
{{- end }}
spec:
automountServiceAccountToken: false
- {{- with .Values.server.serviceAccountName }}
- serviceAccountName: {{ . | quote }}
- {{- end }}
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
securityContext:
runAsNonRoot: true
@@ -82,16 +76,6 @@ spec:
- name: config
mountPath: /etc/mirum/secret
readOnly: true
- {{- with .Values.server.grpcTls.existingSecret }}
- - name: grpc-tls
- mountPath: /etc/mirum/grpc-tls
- readOnly: true
- {{- end }}
- {{- if .Values.server.postgresqlMtls.enabled }}
- - name: postgresql-tls
- mountPath: {{ .Values.server.postgresqlMtls.mountPath }}
- readOnly: true
- {{- end }}
- name: run
mountPath: /run/mirum-server
volumes:
@@ -99,30 +83,6 @@ spec:
secret:
secretName: {{ .Values.server.existingSecret }}
defaultMode: 0440
- {{- with .Values.server.grpcTls.existingSecret }}
- - name: grpc-tls
- secret:
- secretName: {{ . }}
- defaultMode: 0440
- {{- end }}
- {{- if .Values.server.postgresqlMtls.enabled }}
- - name: postgresql-tls
- csi:
- driver: csi.cert-manager.io
- readOnly: true
- volumeAttributes:
- csi.cert-manager.io/issuer-name: {{ required "mirum: server.postgresqlMtls.issuerName is required" .Values.server.postgresqlMtls.issuerName | quote }}
- csi.cert-manager.io/issuer-kind: {{ .Values.server.postgresqlMtls.issuerKind | quote }}
- csi.cert-manager.io/common-name: {{ required "mirum: server.postgresqlMtls.commonName is required" .Values.server.postgresqlMtls.commonName | quote }}
- csi.cert-manager.io/uri-sans: {{ .Values.server.postgresqlMtls.uriSan | quote }}
- csi.cert-manager.io/key-algorithm: "ECDSA"
- csi.cert-manager.io/key-size: "256"
- csi.cert-manager.io/key-encoding: "PKCS8"
- csi.cert-manager.io/key-usages: "digital signature,client auth"
- csi.cert-manager.io/duration: {{ .Values.server.postgresqlMtls.duration | quote }}
- csi.cert-manager.io/renew-before: {{ .Values.server.postgresqlMtls.renewBefore | quote }}
- csi.cert-manager.io/fs-group: {{ .Values.server.postgresqlMtls.fsGroup | quote }}
- {{- end }}
- name: run
emptyDir: {}
{{- with .Values.server.nodeSelector }}
diff --git a/charts/mirum/templates/server-tcproute.yaml b/charts/mirum/templates/server-tcproute.yaml
deleted file mode 100644
--- a/charts/mirum/templates/server-tcproute.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Nikolay Govorov
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{{- if and .Values.server.enabled .Values.server.grpcRoute.enabled }}
-apiVersion: gateway.networking.k8s.io/v1
-kind: TCPRoute
-metadata:
- name: {{ include "mirum.fullname" . }}-grpc
- labels:
- {{- include "mirum.componentLabels" (dict "root" . "component" "server") | nindent 4 }}
-spec:
- {{- with .Values.server.grpcRoute.parentRefs }}
- parentRefs:
- {{- toYaml . | nindent 4 }}
- {{- end }}
- rules:
- - backendRefs:
- - name: {{ include "mirum.fullname" . }}
- port: {{ .Values.server.grpcPort }}
-{{- end }}
-
-# vim: set filetype=helm:
diff --git a/charts/mirum/values.yaml b/charts/mirum/values.yaml
index f51ae16..3383b48 100644
--- a/charts/mirum/values.yaml
+++ b/charts/mirum/values.yaml
@@ -13,38 +13,16 @@ server:
tag: ""
digest: ""
pullPolicy: IfNotPresent
- # Must contain config.yaml and any private files other than the gRPC
- # certificate. Keep database_uri, pepper, token, and webhook_secret in this
- # Secret rather than Helm values.
+ # Must contain config.yaml and every file referenced by that config, normally
+ # grpc.crt and grpc.key. Keep database_uri, pepper, token, and webhook_secret
+ # in this Secret rather than Helm values.
existingSecret: mirum-server
- # Optional existing ServiceAccount used by the server. The default empty
- # value preserves the current Deployment and external database path.
- serviceAccountName: ""
- postgresqlMtls:
- # Opt-in client-certificate mount for passwordless PostgreSQL mTLS. Disabled
- # by default; no CSI resources or volume mounts are rendered unless enabled.
- enabled: false
- mountPath: /etc/mirum/postgresql-tls
- issuerName: ""
- issuerKind: ClusterIssuer
- commonName: ""
- uriSan: "spiffe://ddlabs.internal/ns/${POD_NAMESPACE}/sa/${SERVICE_ACCOUNT_NAME}/pod/${POD_UID}"
- duration: 2160h
- renewBefore: 360h
- fsGroup: 10000
- grpcTls:
- # Optional cert-manager-style Secret containing tls.crt and tls.key. The
- # files are mounted at /etc/mirum/grpc-tls/ for config.yaml to reference.
- existingSecret: ""
webPort: 3000
grpcPort: 2000
route:
enabled: false
hostnames: []
parentRefs: []
- grpcRoute:
- enabled: false
- parentRefs: []
resources: {}
extraEnv: []
podAnnotations: {}
diff --git a/mise.toml b/mise.toml
index 9170cef..2abf2b7 100644
--- a/mise.toml
+++ b/mise.toml
@@ -34,5 +34,5 @@ zig = "0.16.0"
[task_config]
dir = "{{cwd}}"
includes = [
- "git::https://github.com/dimidiumlabs/platform.git//tasks?ref=8bc35fe8be889c50db2d1fb4425cc1b4097dc6b8",
+ "git::https://github.com/dimidiumlabs/infra.git//tasks?ref=8bc35fe8be889c50db2d1fb4425cc1b4097dc6b8",
]
generated by Gilti