mirror of
https://github.com/block/buzz.git
synced 2026-10-28 21:11:48 +00:00
9f5a25a41e
Consumers currently need a Kustomize patch to place secret-reloader annotations on the gateway Deployment. Add optional `deploymentAnnotations` so they can express that configuration through Helm values. The setting applies only to Deployment metadata. The chart's release-namespace and external-network-policy annotations remain reserved and cannot be overridden. ### Validation Full gateway chart render suite passes, including schema rejection of reserved keys and non-string values, preservation of external-policy ownership markers, and unchanged Pod annotations and migration hooks. Repository-wide `just ci` passed with `RUST_TEST_THREADS=1`. The first parallel run failed five unrelated timing/transport tests; all five passed isolated reruns and the full serialized run completed successfully. `buzz-review-completed`: Codex review is clean on the current commit and agent render validation exercises the change. Tom confirmed the repository human-testing requirement does not apply to this chart-only change; personal human testing is not claimed. Signed-off-by: Tom Brow <tomb@block.xyz>
471 lines
10 KiB
JSON
471 lines
10 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"replicaCount": {
|
|
"type": "integer",
|
|
"minimum": 2
|
|
},
|
|
"existingSecret": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"gatewayOrigin": {
|
|
"type": "string",
|
|
"description": "Routing origin for the optional HTTPRoute; not passed to the gateway binary.",
|
|
"pattern": "^(https://[^/?#@:]+/?)?$"
|
|
},
|
|
"maxGrantLifetimeSeconds": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 31536000
|
|
},
|
|
"profiles": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"dogfood"
|
|
],
|
|
"properties": {
|
|
"dogfood": {
|
|
"$ref": "#/$defs/enabledProfile"
|
|
}
|
|
}
|
|
},
|
|
"apnsKey": false,
|
|
"deploymentAnnotations": {
|
|
"type": "object",
|
|
"properties": {
|
|
"buzz.block.xyz/release-namespace": false,
|
|
"buzz.block.xyz/external-network-policy": false
|
|
},
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"podAnnotations": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"httpRoute": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"enabled",
|
|
"parentRefs"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"parentRefs": {
|
|
"type": "array"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"parentRefs": {
|
|
"minItems": 1
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"networkPolicy": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled",
|
|
"postgresEgressCidrs",
|
|
"dns"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"apnsEgressCidrs": {
|
|
"type": "array"
|
|
},
|
|
"postgresEgressCidrs": {
|
|
"type": "array",
|
|
"minItems": 1
|
|
},
|
|
"dns": {
|
|
"type": "object",
|
|
"required": [
|
|
"namespaceSelector",
|
|
"podSelector"
|
|
]
|
|
},
|
|
"monitoring": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled",
|
|
"namespaceSelector",
|
|
"podSelector"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"namespaceSelector": {
|
|
"type": "object"
|
|
},
|
|
"podSelector": {
|
|
"type": "object"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"namespaceSelector": {
|
|
"minProperties": 1
|
|
},
|
|
"podSelector": {
|
|
"minProperties": 1
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"externalPolicyName": {
|
|
"type": "string",
|
|
"description": "Name of the replacement runtime NetworkPolicy supplied by the parent chart. Required when the upstream policy is disabled.",
|
|
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
|
"maxLength": 253
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": false
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"then": {
|
|
"required": [
|
|
"externalPolicyName"
|
|
],
|
|
"properties": {
|
|
"externalPolicyName": {
|
|
"minLength": 1
|
|
}
|
|
}
|
|
},
|
|
"else": {
|
|
"properties": {
|
|
"externalPolicyName": {
|
|
"maxLength": 0
|
|
},
|
|
"apnsEgressCidrs": {
|
|
"minItems": 1
|
|
}
|
|
},
|
|
"required": [
|
|
"apnsEgressCidrs"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"podMonitor": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"prometheusRule": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"apnsRetryRatioThreshold": {
|
|
"type": "number",
|
|
"exclusiveMinimum": 0,
|
|
"maximum": 1
|
|
},
|
|
"apnsRetryMinSamples": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
}
|
|
}
|
|
},
|
|
"image": {
|
|
"type": "object",
|
|
"required": [
|
|
"repository"
|
|
],
|
|
"properties": {
|
|
"repository": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"tag": {
|
|
"type": "string"
|
|
},
|
|
"digest": {
|
|
"type": "string",
|
|
"pattern": "^$|^sha256:[0-9a-f]{64}$"
|
|
}
|
|
},
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"tag": {
|
|
"minLength": 1
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"properties": {
|
|
"digest": {
|
|
"pattern": "^sha256:[0-9a-f]{64}$"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"migration": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"existingSecret",
|
|
"databaseUrlKey",
|
|
"runtimeDatabaseRole",
|
|
"resources"
|
|
],
|
|
"properties": {
|
|
"existingSecret": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"databaseUrlKey": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"runtimeDatabaseRole": {
|
|
"type": "string",
|
|
"pattern": "^[a-zA-Z_][a-zA-Z0-9_]{0,62}$"
|
|
},
|
|
"resources": {
|
|
"type": "object"
|
|
},
|
|
"podAnnotations": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"podLabels": {
|
|
"type": "object",
|
|
"propertyNames": {
|
|
"not": {
|
|
"enum": [
|
|
"app.kubernetes.io/name",
|
|
"app.kubernetes.io/instance",
|
|
"app.kubernetes.io/component"
|
|
]
|
|
},
|
|
"maxLength": 317,
|
|
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[A-Za-z0-9]([A-Za-z0-9_.-]{0,61}[A-Za-z0-9])?$",
|
|
"allOf": [
|
|
{
|
|
"anyOf": [
|
|
{
|
|
"pattern": "^[^/]+$"
|
|
},
|
|
{
|
|
"pattern": "^[^/]{1,253}/"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"additionalProperties": {
|
|
"type": "string",
|
|
"maxLength": 63,
|
|
"pattern": "^([A-Za-z0-9]([A-Za-z0-9_.-]{0,61}[A-Za-z0-9])?)?$"
|
|
}
|
|
},
|
|
"serviceAccountName": {
|
|
"type": "string",
|
|
"maxLength": 253,
|
|
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?$"
|
|
},
|
|
"terminationGracePeriodSeconds": {
|
|
"type": "integer",
|
|
"minimum": 60
|
|
}
|
|
},
|
|
"$defs": {
|
|
"profileBase": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"appAttestAppId",
|
|
"apnsTopic",
|
|
"apnsEnvironment"
|
|
],
|
|
"properties": {
|
|
"appAttestAppId": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"apnsTopic": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"apnsEnvironment": {
|
|
"enum": [
|
|
"production",
|
|
"sandbox"
|
|
]
|
|
},
|
|
"apnsCert": {
|
|
"$ref": "#/$defs/apnsCert"
|
|
}
|
|
}
|
|
},
|
|
"enabledProfile": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/$defs/profileBase"
|
|
},
|
|
{
|
|
"required": [
|
|
"apnsCert"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"apnsCert": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"secretName",
|
|
"secretKey"
|
|
],
|
|
"properties": {
|
|
"secretName": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"secretKey": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"replicaCount",
|
|
"existingSecret",
|
|
"maxGrantLifetimeSeconds",
|
|
"profiles",
|
|
"httpRoute",
|
|
"image",
|
|
"migration",
|
|
"terminationGracePeriodSeconds"
|
|
],
|
|
"allOf": [
|
|
{
|
|
"$comment": "A PodMonitor requires scoped 8081 ingress when this chart owns the runtime policy. In external-policy mode the named parent policy owns scrape access.",
|
|
"if": {
|
|
"properties": {
|
|
"podMonitor": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"networkPolicy": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"podMonitor",
|
|
"networkPolicy"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"networkPolicy": {
|
|
"properties": {
|
|
"monitoring": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"monitoring"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"networkPolicy"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|