not
ee8301f39f
One chart whose values.yaml is a near-literal transcription of infra/docker-compose.yml, rendered by three generic templates (Deployment, Job, Service) over a `workloads` map — so the two stacks can be diffed by eye instead of by archaeology, and adding a service is a values edit. Platform-forced deviations, each commented where it appears: - `args`, never `command`: compose replaces the image CMD, Kubernetes replaces the ENTRYPOINT. The chart fails to render on `command`, because the symptom (postgres refusing to run as root, Keycloak exec-ing `start-dev`) is nothing like the cause. - The four Django services apply their own setup_configuration in the web pod rather than in a separate init Job: both scripts migrate, and without compose's depends_on they race the same database. - OpenZaak and Objecten are addressed by service FQDN, because Django rejects a single-label host in a URL — the reason compose passes container IPs around. - NodePorts, no ingress; databases are emptyDir until persistence.storageClass is set, so the stack comes up on a cluster with no CSI driver. The upstream config inputs stay in the repo and become ConfigMaps via infra/helm/seed-configmaps.sh — the Kubernetes sibling of infra/seed-config.sh — so the compose stack and the chart cannot fork. infra/helm/registry.yaml runs an in-cluster registry because Talos cannot side-load an image and a laptop-side one needs a root-level firewall change.
61 lines
1.6 KiB
YAML
61 lines
1.6 KiB
YAML
# Throwaway in-cluster OCI registry, published on NodePort 30500.
|
|
#
|
|
# Talos has no Docker daemon and no way to side-load an image, so the images built
|
|
# from this repo must come from a registry. This one lives *inside* the cluster on
|
|
# purpose: a registry on the laptop needs an inbound port opened on firewalld's
|
|
# libvirt zone (root), while pushing from the laptop to the node is outbound and
|
|
# always allowed. The node then pulls from its own NodePort.
|
|
#
|
|
# Talos must be told it speaks plain HTTP — see the machine.registries.mirrors
|
|
# patch in docs/runbooks/kubernetes-talos.md. Storage is emptyDir: if this pod is
|
|
# replaced, re-run `make k8s-images`.
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: registry
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: registry
|
|
namespace: registry
|
|
spec:
|
|
replicas: 1
|
|
strategy: { type: Recreate }
|
|
selector:
|
|
matchLabels: { app: registry }
|
|
template:
|
|
metadata:
|
|
labels: { app: registry }
|
|
spec:
|
|
containers:
|
|
- name: registry
|
|
image: docker.io/library/registry:2
|
|
env:
|
|
- name: REGISTRY_STORAGE_DELETE_ENABLED
|
|
value: "true"
|
|
ports:
|
|
- containerPort: 5000
|
|
readinessProbe:
|
|
httpGet: { path: /v2/, port: 5000 }
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /var/lib/registry
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: registry
|
|
namespace: registry
|
|
spec:
|
|
type: NodePort
|
|
selector: { app: registry }
|
|
ports:
|
|
- name: http
|
|
port: 5000
|
|
targetPort: 5000
|
|
nodePort: 30500
|