mirror of
https://github.com/block/buzz.git
synced 2026-10-28 21:11:48 +00:00
9f5a25a41e
Consumers currently need a Kustomize patch to place secret-reloader annotations on the gateway Deployment. Add optional `deploymentAnnotations` so they can express that configuration through Helm values. The setting applies only to Deployment metadata. The chart's release-namespace and external-network-policy annotations remain reserved and cannot be overridden. ### Validation Full gateway chart render suite passes, including schema rejection of reserved keys and non-string values, preservation of external-policy ownership markers, and unchanged Pod annotations and migration hooks. Repository-wide `just ci` passed with `RUST_TEST_THREADS=1`. The first parallel run failed five unrelated timing/transport tests; all five passed isolated reruns and the full serialized run completed successfully. `buzz-review-completed`: Codex review is clean on the current commit and agent render validation exercises the change. Tom confirmed the repository human-testing requirement does not apply to this chart-only change; personal human testing is not claimed. Signed-off-by: Tom Brow <tomb@block.xyz>
110 lines
3.9 KiB
YAML
110 lines
3.9 KiB
YAML
replicaCount: 2
|
|
image:
|
|
repository: ghcr.io/block/buzz-push-gateway
|
|
# `main` is published by the push-gateway lane on every main push.
|
|
tag: main
|
|
digest: ""
|
|
pullPolicy: IfNotPresent
|
|
pullSecrets: []
|
|
existingSecret: buzz-push-gateway
|
|
# DDL-capable credentials are used only by the pre-install/pre-upgrade migration
|
|
# Job. Runtime DATABASE_URL in existingSecret should have DML-only privileges.
|
|
migration:
|
|
# Applies only to migration Pods, independently of runtime podAnnotations.
|
|
podAnnotations: {}
|
|
existingSecret: buzz-push-gateway-migrations
|
|
databaseUrlKey: DATABASE_URL
|
|
# Existing LOGIN role used by runtime DATABASE_URL. Migrations grant it only
|
|
# CONNECT plus DML on the six gateway tables in this dedicated database.
|
|
runtimeDatabaseRole: buzz_push_gateway_runtime
|
|
resources:
|
|
requests: {cpu: 50m, memory: 64Mi}
|
|
limits: {cpu: 250m, memory: 128Mi}
|
|
# Routing origin used only when httpRoute.enabled=true. Not passed to the binary.
|
|
gatewayOrigin: ""
|
|
maxGrantLifetimeSeconds: 2592000
|
|
profiles:
|
|
dogfood:
|
|
# Production MUST override this with the exact Apple TEAMID.bundle-id.
|
|
appAttestAppId: TEAMID.xyz.block.buzz.dogfood.mobile
|
|
apnsTopic: xyz.block.buzz.dogfood.mobile
|
|
apnsEnvironment: production
|
|
apnsCert:
|
|
secretName: buzz-push-gateway
|
|
secretKey: dogfood-apns-identity.pem
|
|
appAttestRoot:
|
|
secretName: buzz-push-gateway
|
|
secretKey: app-attest-root.pem
|
|
service:
|
|
port: 8080
|
|
# Optional Deployment metadata, independent of runtime and migration Pods.
|
|
# The chart owns buzz.block.xyz/release-namespace and external-network-policy.
|
|
deploymentAnnotations: {}
|
|
podAnnotations: {}
|
|
httpRoute:
|
|
# Disabled by default so a generic install cannot claim an unattached route.
|
|
# Enable only when this chart owns a Gateway API route. Environments with an
|
|
# existing ingress or service mesh route should keep this disabled.
|
|
enabled: false
|
|
parentRefs: []
|
|
resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 512Mi}
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
minAvailable: 1
|
|
networkPolicy:
|
|
# Parent chart must supply this named replacement when enabled is false.
|
|
externalPolicyName: ""
|
|
enabled: true
|
|
# Kubernetes NetworkPolicy cannot allow DNS names. Production operators must
|
|
# narrow these CIDRs to their PostgreSQL/NAT destinations where supported.
|
|
apnsEgressCidrs: [0.0.0.0/0]
|
|
# Override with the actual database network. This example private range is
|
|
# intentionally separate from broad APNs HTTPS egress.
|
|
postgresEgressCidrs: [10.0.0.0/8]
|
|
dns:
|
|
namespaceSelector:
|
|
kubernetes.io/metadata.name: kube-system
|
|
podSelector:
|
|
k8s-app: kube-dns
|
|
# Scoped ingress to the private metrics port (8081). Off by default so 8081
|
|
# has no pod ingress at all; enable alongside podMonitor or an external
|
|
# annotation-discovered scraper and name its namespace/pod so reachability
|
|
# stays narrow.
|
|
monitoring:
|
|
enabled: false
|
|
namespaceSelector: {}
|
|
podSelector: {}
|
|
# Prometheus-operator PodMonitor scraping the private /metrics on port 8081.
|
|
# Off by default; requires networkPolicy.monitoring to also be enabled.
|
|
podMonitor:
|
|
enabled: false
|
|
interval: 30s
|
|
scrapeTimeout: 10s
|
|
labels: {}
|
|
# Prometheus-operator alerting rules. Off by default.
|
|
prometheusRule:
|
|
enabled: false
|
|
labels: {}
|
|
# Retryable-outcome fraction (0..1] that fires PushGatewayHighApnsRetryRate.
|
|
apnsRetryRatioThreshold: 0.25
|
|
# Minimum APNs attempts in the 10m window before the retry-ratio alert can
|
|
# fire, so a couple of retries at trivial volume cannot trip it.
|
|
apnsRetryMinSamples: 20
|
|
nodeSelector: {}
|
|
tolerations: []
|
|
affinity: {}
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: buzz-push-gateway
|
|
|
|
# Runtime-only mesh integration. Migration settings remain separate.
|
|
podLabels: {}
|
|
serviceAccountName: ""
|
|
terminationGracePeriodSeconds: 60
|