diff options
Diffstat
| -rw-r--r-- | charts/mirum/templates/server-deployment.yaml | 29 | +0 −29 |
| -rw-r--r-- | charts/mirum/values.yaml | 15 | +0 −15 |
| -rw-r--r-- | mise.toml | 2 | +1 −1 |
3 files changed, 1 insertions, 45 deletions
diff --git a/charts/mirum/templates/server-deployment.yaml b/charts/mirum/templates/server-deployment.yaml index 9191159..82df4b0 100644 --- a/charts/mirum/templates/server-deployment.yaml +++ b/charts/mirum/templates/server-deployment.yaml @@ -4,9 +4,6 @@ {{- if and .Values.server.enabled (ne (int .Values.server.replicaCount) 1) }} {{- fail "mirum: server.replicaCount must be 1 while the task queue is process-local" }} {{- end }} -{{- if and .Values.server.enabled .Values.server.postgresqlMtls.enabled (not .Values.server.serviceAccountName) }} -{{- fail "mirum: server.serviceAccountName is required when server.postgresqlMtls.enabled=true" }} -{{- end }} {{- if .Values.server.enabled }} apiVersion: apps/v1 kind: Deployment @@ -34,9 +31,6 @@ spec: {{- end }} spec: automountServiceAccountToken: false - {{- with .Values.server.serviceAccountName }} - serviceAccountName: {{ . | quote }} - {{- end }} terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} securityContext: runAsNonRoot: true @@ -87,11 +81,6 @@ spec: mountPath: /etc/mirum/grpc-tls readOnly: true {{- end }} - {{- if .Values.server.postgresqlMtls.enabled }} - - name: postgresql-tls - mountPath: {{ .Values.server.postgresqlMtls.mountPath }} - readOnly: true - {{- end }} - name: run mountPath: /run/mirum-server volumes: @@ -105,24 +94,6 @@ spec: secretName: {{ . }} defaultMode: 0440 {{- end }} - {{- if .Values.server.postgresqlMtls.enabled }} - - name: postgresql-tls - csi: - driver: csi.cert-manager.io - readOnly: true - volumeAttributes: - csi.cert-manager.io/issuer-name: {{ required "mirum: server.postgresqlMtls.issuerName is required" .Values.server.postgresqlMtls.issuerName | quote }} - csi.cert-manager.io/issuer-kind: {{ .Values.server.postgresqlMtls.issuerKind | quote }} - csi.cert-manager.io/common-name: {{ required "mirum: server.postgresqlMtls.commonName is required" .Values.server.postgresqlMtls.commonName | quote }} - csi.cert-manager.io/uri-sans: {{ .Values.server.postgresqlMtls.uriSan | quote }} - csi.cert-manager.io/key-algorithm: "ECDSA" - csi.cert-manager.io/key-size: "256" - csi.cert-manager.io/key-encoding: "PKCS8" - csi.cert-manager.io/key-usages: "digital signature,client auth" - csi.cert-manager.io/duration: {{ .Values.server.postgresqlMtls.duration | quote }} - csi.cert-manager.io/renew-before: {{ .Values.server.postgresqlMtls.renewBefore | quote }} - csi.cert-manager.io/fs-group: {{ .Values.server.postgresqlMtls.fsGroup | quote }} - {{- end }} - name: run emptyDir: {} {{- with .Values.server.nodeSelector }} diff --git a/charts/mirum/values.yaml b/charts/mirum/values.yaml index f51ae16..13158a2 100644 --- a/charts/mirum/values.yaml +++ b/charts/mirum/values.yaml @@ -17,21 +17,6 @@ server: # certificate. Keep database_uri, pepper, token, and webhook_secret in this # Secret rather than Helm values. existingSecret: mirum-server - # Optional existing ServiceAccount used by the server. The default empty - # value preserves the current Deployment and external database path. - serviceAccountName: "" - postgresqlMtls: - # Opt-in client-certificate mount for passwordless PostgreSQL mTLS. Disabled - # by default; no CSI resources or volume mounts are rendered unless enabled. - enabled: false - mountPath: /etc/mirum/postgresql-tls - issuerName: "" - issuerKind: ClusterIssuer - commonName: "" - uriSan: "spiffe://ddlabs.internal/ns/${POD_NAMESPACE}/sa/${SERVICE_ACCOUNT_NAME}/pod/${POD_UID}" - duration: 2160h - renewBefore: 360h - fsGroup: 10000 grpcTls: # Optional cert-manager-style Secret containing tls.crt and tls.key. The # files are mounted at /etc/mirum/grpc-tls/ for config.yaml to reference. diff --git a/mise.toml b/mise.toml index 9170cef..2abf2b7 100644 --- a/mise.toml +++ b/mise.toml @@ -34,5 +34,5 @@ zig = "0.16.0" [task_config] dir = "{{cwd}}" includes = [ - "git::https://github.com/dimidiumlabs/platform.git//tasks?ref=8bc35fe8be889c50db2d1fb4425cc1b4097dc6b8", + "git::https://github.com/dimidiumlabs/infra.git//tasks?ref=8bc35fe8be889c50db2d1fb4425cc1b4097dc6b8", ] |