mirror of
https://github.com/block/buzz.git
synced 2026-10-29 13:31:44 +00:00
73a2a05c97
Platform-owned service meshes need runtime pod identity and a replacement network policy without patching rendered gateway manifests. Add runtime-only pod labels, service account and shutdown-grace settings, plus an explicit named replacement-policy mode. Migration isolation remains independent; the default render is unchanged. Chart 0.3.4 publication and live deployment verification follow in the separate release and deployment work. ### Validation Added tests cover runtime-only settings, reserved selector labels, minimum shutdown grace, replacement-policy acknowledgement and conflicting settings. The complete chart render suite and release-contract tests pass. Default rendering matches the current main chart byte-for-byte. Repository-wide `just ci` reached unit tests but failed in existing buzz-acp tests outside this chart change. Live mesh behavior has not been exercised. --------- Signed-off-by: Tom Brow <tomb@block.xyz>
461 lines
10 KiB
JSON
461 lines
10 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"replicaCount": {
|
|
"type": "integer",
|
|
"minimum": 2
|
|
},
|
|
"existingSecret": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"gatewayOrigin": {
|
|
"type": "string",
|
|
"description": "Routing origin for the optional HTTPRoute; not passed to the gateway binary.",
|
|
"pattern": "^(https://[^/?#@:]+/?)?$"
|
|
},
|
|
"maxGrantLifetimeSeconds": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 31536000
|
|
},
|
|
"profiles": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"dogfood"
|
|
],
|
|
"properties": {
|
|
"dogfood": {
|
|
"$ref": "#/$defs/enabledProfile"
|
|
}
|
|
}
|
|
},
|
|
"apnsKey": false,
|
|
"podAnnotations": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"httpRoute": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"enabled",
|
|
"parentRefs"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"parentRefs": {
|
|
"type": "array"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"parentRefs": {
|
|
"minItems": 1
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"networkPolicy": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled",
|
|
"postgresEgressCidrs",
|
|
"dns"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"apnsEgressCidrs": {
|
|
"type": "array"
|
|
},
|
|
"postgresEgressCidrs": {
|
|
"type": "array",
|
|
"minItems": 1
|
|
},
|
|
"dns": {
|
|
"type": "object",
|
|
"required": [
|
|
"namespaceSelector",
|
|
"podSelector"
|
|
]
|
|
},
|
|
"monitoring": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled",
|
|
"namespaceSelector",
|
|
"podSelector"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"namespaceSelector": {
|
|
"type": "object"
|
|
},
|
|
"podSelector": {
|
|
"type": "object"
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"namespaceSelector": {
|
|
"minProperties": 1
|
|
},
|
|
"podSelector": {
|
|
"minProperties": 1
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"externalPolicyName": {
|
|
"type": "string",
|
|
"description": "Name of the replacement runtime NetworkPolicy supplied by the parent chart. Required when the upstream policy is disabled.",
|
|
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
|
|
"maxLength": 253
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": false
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"then": {
|
|
"required": [
|
|
"externalPolicyName"
|
|
],
|
|
"properties": {
|
|
"externalPolicyName": {
|
|
"minLength": 1
|
|
}
|
|
}
|
|
},
|
|
"else": {
|
|
"properties": {
|
|
"externalPolicyName": {
|
|
"maxLength": 0
|
|
},
|
|
"apnsEgressCidrs": {
|
|
"minItems": 1
|
|
}
|
|
},
|
|
"required": [
|
|
"apnsEgressCidrs"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"podMonitor": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"prometheusRule": {
|
|
"type": "object",
|
|
"required": [
|
|
"enabled"
|
|
],
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"apnsRetryRatioThreshold": {
|
|
"type": "number",
|
|
"exclusiveMinimum": 0,
|
|
"maximum": 1
|
|
},
|
|
"apnsRetryMinSamples": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
}
|
|
}
|
|
},
|
|
"image": {
|
|
"type": "object",
|
|
"required": [
|
|
"repository"
|
|
],
|
|
"properties": {
|
|
"repository": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"tag": {
|
|
"type": "string"
|
|
},
|
|
"digest": {
|
|
"type": "string",
|
|
"pattern": "^$|^sha256:[0-9a-f]{64}$"
|
|
}
|
|
},
|
|
"anyOf": [
|
|
{
|
|
"properties": {
|
|
"tag": {
|
|
"minLength": 1
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"properties": {
|
|
"digest": {
|
|
"pattern": "^sha256:[0-9a-f]{64}$"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"migration": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"existingSecret",
|
|
"databaseUrlKey",
|
|
"runtimeDatabaseRole",
|
|
"resources"
|
|
],
|
|
"properties": {
|
|
"existingSecret": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"databaseUrlKey": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"runtimeDatabaseRole": {
|
|
"type": "string",
|
|
"pattern": "^[a-zA-Z_][a-zA-Z0-9_]{0,62}$"
|
|
},
|
|
"resources": {
|
|
"type": "object"
|
|
},
|
|
"podAnnotations": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"podLabels": {
|
|
"type": "object",
|
|
"propertyNames": {
|
|
"not": {
|
|
"enum": [
|
|
"app.kubernetes.io/name",
|
|
"app.kubernetes.io/instance",
|
|
"app.kubernetes.io/component"
|
|
]
|
|
},
|
|
"maxLength": 317,
|
|
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?[A-Za-z0-9]([A-Za-z0-9_.-]{0,61}[A-Za-z0-9])?$",
|
|
"allOf": [
|
|
{
|
|
"anyOf": [
|
|
{
|
|
"pattern": "^[^/]+$"
|
|
},
|
|
{
|
|
"pattern": "^[^/]{1,253}/"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"additionalProperties": {
|
|
"type": "string",
|
|
"maxLength": 63,
|
|
"pattern": "^([A-Za-z0-9]([A-Za-z0-9_.-]{0,61}[A-Za-z0-9])?)?$"
|
|
}
|
|
},
|
|
"serviceAccountName": {
|
|
"type": "string",
|
|
"maxLength": 253,
|
|
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*)?$"
|
|
},
|
|
"terminationGracePeriodSeconds": {
|
|
"type": "integer",
|
|
"minimum": 60
|
|
}
|
|
},
|
|
"$defs": {
|
|
"profileBase": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"appAttestAppId",
|
|
"apnsTopic",
|
|
"apnsEnvironment"
|
|
],
|
|
"properties": {
|
|
"appAttestAppId": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"apnsTopic": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"apnsEnvironment": {
|
|
"enum": [
|
|
"production",
|
|
"sandbox"
|
|
]
|
|
},
|
|
"apnsCert": {
|
|
"$ref": "#/$defs/apnsCert"
|
|
}
|
|
}
|
|
},
|
|
"enabledProfile": {
|
|
"allOf": [
|
|
{
|
|
"$ref": "#/$defs/profileBase"
|
|
},
|
|
{
|
|
"required": [
|
|
"apnsCert"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"apnsCert": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"secretName",
|
|
"secretKey"
|
|
],
|
|
"properties": {
|
|
"secretName": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"secretKey": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"replicaCount",
|
|
"existingSecret",
|
|
"maxGrantLifetimeSeconds",
|
|
"profiles",
|
|
"httpRoute",
|
|
"image",
|
|
"migration",
|
|
"terminationGracePeriodSeconds"
|
|
],
|
|
"allOf": [
|
|
{
|
|
"$comment": "A PodMonitor requires scoped 8081 ingress when this chart owns the runtime policy. In external-policy mode the named parent policy owns scrape access.",
|
|
"if": {
|
|
"properties": {
|
|
"podMonitor": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
},
|
|
"networkPolicy": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"podMonitor",
|
|
"networkPolicy"
|
|
]
|
|
},
|
|
"then": {
|
|
"properties": {
|
|
"networkPolicy": {
|
|
"properties": {
|
|
"monitoring": {
|
|
"properties": {
|
|
"enabled": {
|
|
"const": true
|
|
}
|
|
},
|
|
"required": [
|
|
"enabled"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"monitoring"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"networkPolicy"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|