mirror of
https://github.com/block/buzz.git
synced 2026-10-29 13:31:44 +00:00
fd885b5530
Allow operators to configure migration Pod annotations independently of runtime Pod annotations. This lets clusters with automatic sidecar injection opt the migration Job out without changing the gateway Deployment or Helm hook metadata. The new string-map setting defaults to empty. Chart version 0.3.3 is prepared here; publication requires a separate approved chart release PR. ### Validation The full chart render suite and focused migration annotation tests pass. Tests verify unchanged default resources and hooks, independent runtime annotations, and rejection of non-string annotation values. Independent agent review found no blockers. Repository-wide `just ci` exited 1 in unchanged `buzz-acp` tests: idle/stdout keepalive timing and steering assertions (one failure in the first group, four in the second). Subsequent recipes were not reached. No rerun or unrelated code fix was attempted. Human testing remains pending. Signed-off-by: Tom Brow <tomb@block.xyz>
100 lines
3.5 KiB
YAML
100 lines
3.5 KiB
YAML
replicaCount: 2
|
|
image:
|
|
repository: ghcr.io/block/buzz-push-gateway
|
|
# `main` is published by the push-gateway lane on every main push.
|
|
tag: main
|
|
digest: ""
|
|
pullPolicy: IfNotPresent
|
|
pullSecrets: []
|
|
existingSecret: buzz-push-gateway
|
|
# DDL-capable credentials are used only by the pre-install/pre-upgrade migration
|
|
# Job. Runtime DATABASE_URL in existingSecret should have DML-only privileges.
|
|
migration:
|
|
# Applies only to migration Pods, independently of runtime podAnnotations.
|
|
podAnnotations: {}
|
|
existingSecret: buzz-push-gateway-migrations
|
|
databaseUrlKey: DATABASE_URL
|
|
# Existing LOGIN role used by runtime DATABASE_URL. Migrations grant it only
|
|
# CONNECT plus DML on the six gateway tables in this dedicated database.
|
|
runtimeDatabaseRole: buzz_push_gateway_runtime
|
|
resources:
|
|
requests: {cpu: 50m, memory: 64Mi}
|
|
limits: {cpu: 250m, memory: 128Mi}
|
|
# Routing origin used only when httpRoute.enabled=true. Not passed to the binary.
|
|
gatewayOrigin: ""
|
|
maxGrantLifetimeSeconds: 2592000
|
|
profiles:
|
|
dogfood:
|
|
# Production MUST override this with the exact Apple TEAMID.bundle-id.
|
|
appAttestAppId: TEAMID.xyz.block.buzz.dogfood.mobile
|
|
apnsTopic: xyz.block.buzz.dogfood.mobile
|
|
apnsEnvironment: production
|
|
apnsCert:
|
|
secretName: buzz-push-gateway
|
|
secretKey: dogfood-apns-identity.pem
|
|
appAttestRoot:
|
|
secretName: buzz-push-gateway
|
|
secretKey: app-attest-root.pem
|
|
service:
|
|
port: 8080
|
|
podAnnotations: {}
|
|
httpRoute:
|
|
# Disabled by default so a generic install cannot claim an unattached route.
|
|
# Enable only when this chart owns a Gateway API route. Environments with an
|
|
# existing ingress or service mesh route should keep this disabled.
|
|
enabled: false
|
|
parentRefs: []
|
|
resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 512Mi}
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
minAvailable: 1
|
|
networkPolicy:
|
|
enabled: true
|
|
# Kubernetes NetworkPolicy cannot allow DNS names. Production operators must
|
|
# narrow these CIDRs to their PostgreSQL/NAT destinations where supported.
|
|
apnsEgressCidrs: [0.0.0.0/0]
|
|
# Override with the actual database network. This example private range is
|
|
# intentionally separate from broad APNs HTTPS egress.
|
|
postgresEgressCidrs: [10.0.0.0/8]
|
|
dns:
|
|
namespaceSelector:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
k8s-app: kube-dns
|
|
# Scoped ingress to the private metrics port (8081). Off by default so 8081
|
|
# has no pod ingress at all; enable alongside podMonitor or an external
|
|
# annotation-discovered scraper and name its namespace/pod so reachability
|
|
# stays narrow.
|
|
monitoring:
|
|
enabled: false
|
|
namespaceSelector: {}
|
|
podSelector: {}
|
|
# Prometheus-operator PodMonitor scraping the private /metrics on port 8081.
|
|
# Off by default; requires networkPolicy.monitoring to also be enabled.
|
|
podMonitor:
|
|
enabled: false
|
|
interval: 30s
|
|
scrapeTimeout: 10s
|
|
labels: {}
|
|
# Prometheus-operator alerting rules. Off by default.
|
|
prometheusRule:
|
|
enabled: false
|
|
labels: {}
|
|
# Retryable-outcome fraction (0..1] that fires PushGatewayHighApnsRetryRate.
|
|
apnsRetryRatioThreshold: 0.25
|
|
# Minimum APNs attempts in the 10m window before the retry-ratio alert can
|
|
# fire, so a couple of retries at trivial volume cannot trip it.
|
|
apnsRetryMinSamples: 20
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: buzz-push-gateway
|