141 lines
4.3 KiB
YAML
141 lines
4.3 KiB
YAML
# PlanPal Helm values. Mirrors planpalto-infrato/k8s + kustomization.yaml.
|
|
# namespace empty -> defaults to the release name, so multiple installs
|
|
# (helm install planpal-a / planpal-b) land in separate namespaces and don't
|
|
# collide. Set it to pin a fixed namespace.
|
|
namespace: ""
|
|
createNamespace: true
|
|
|
|
image:
|
|
registry: 134604498185.dkr.ecr.ap-southeast-3.amazonaws.com
|
|
backend:
|
|
repository: fakhri-planpal-backend
|
|
tag: latest
|
|
frontend:
|
|
repository: fakhri-planpal-frontend
|
|
tag: latest # ECR frontend repo only publishes latest (1.1 was a minikube-local tag)
|
|
pullPolicy: IfNotPresent
|
|
|
|
serviceAccount:
|
|
name: planpal-backend # Pod Identity -> role fakhri-app-planpal
|
|
create: true
|
|
|
|
# App workloads. backend+workers share the backend image and mount backend-env+aws-env.
|
|
# frontend uses the frontend image and frontend-env.
|
|
apps:
|
|
backend:
|
|
command: [planpal-server]
|
|
image: backend
|
|
envFrom: [backend-env, aws-env]
|
|
ports:
|
|
- { name: http, containerPort: 8088 }
|
|
- { name: metrics, containerPort: 9090 }
|
|
service:
|
|
port: 8088
|
|
targetPort: 8088
|
|
probePath: /api/v1/health
|
|
probePort: 8088
|
|
resources:
|
|
requests: { cpu: 25m, memory: 64Mi }
|
|
limits: { cpu: 250m, memory: 256Mi }
|
|
hpa: { min: 2, max: 5, cpu: 50 }
|
|
pdb: { maxUnavailable: 1 }
|
|
|
|
frontend:
|
|
command: []
|
|
image: frontend
|
|
envFrom: [frontend-env]
|
|
ports:
|
|
- { name: http, containerPort: 3000 }
|
|
service:
|
|
port: 3000
|
|
targetPort: 3000
|
|
annotations:
|
|
alb.ingress.kubernetes.io/healthcheck-path: "/"
|
|
alb.ingress.kubernetes.io/success-codes: "200"
|
|
probePath: /
|
|
probePort: 3000
|
|
resources:
|
|
requests: { cpu: 25m, memory: 96Mi }
|
|
limits: { cpu: 300m, memory: 384Mi }
|
|
hpa: { min: 2, max: 5, cpu: 50 }
|
|
pdb: { maxUnavailable: 1 }
|
|
|
|
schedule-worker:
|
|
command: [planpal-schedule-worker]
|
|
image: backend
|
|
envFrom: [backend-env, aws-env]
|
|
ports: [{ name: metrics, containerPort: 9091 }]
|
|
resources:
|
|
requests: { cpu: 25m, memory: 64Mi }
|
|
limits: { cpu: 200m, memory: 256Mi }
|
|
hpa: { min: 1, max: 3, cpu: 60 }
|
|
|
|
notification-worker:
|
|
command: [planpal-notification-worker]
|
|
image: backend
|
|
envFrom: [backend-env, aws-env]
|
|
ports: [{ name: metrics, containerPort: 9092 }]
|
|
resources:
|
|
requests: { cpu: 25m, memory: 64Mi }
|
|
limits: { cpu: 200m, memory: 256Mi }
|
|
hpa: { min: 1, max: 3, cpu: 60 }
|
|
|
|
ai-worker:
|
|
command: [planpal-ai-worker]
|
|
image: backend
|
|
envFrom: [backend-env, aws-env]
|
|
ports: [{ name: metrics, containerPort: 9093 }]
|
|
resources:
|
|
requests: { cpu: 25m, memory: 64Mi }
|
|
limits: { cpu: 200m, memory: 256Mi }
|
|
hpa: { min: 1, max: 3, cpu: 60 }
|
|
|
|
# Stateless in-cluster deps.
|
|
redis:
|
|
image: redis:7-alpine
|
|
resources:
|
|
requests: { cpu: 250m, memory: 256Mi }
|
|
limits: { cpu: 500m, memory: 512Mi }
|
|
nats:
|
|
image: nats:2-alpine
|
|
resources:
|
|
requests: { cpu: 100m, memory: 128Mi }
|
|
limits: { cpu: 200m, memory: 256Mi }
|
|
|
|
# External Secrets Operator: pull each k8s Secret from AWS Secrets Manager.
|
|
externalSecrets:
|
|
enabled: true
|
|
region: ap-southeast-3
|
|
# storeName empty -> "<release>-aws-planpal". The ClusterSecretStore is
|
|
# cluster-scoped, so it must be unique per release.
|
|
storeName: ""
|
|
refreshInterval: 1h
|
|
# target k8s Secret name -> Secrets Manager key. Releases share these keys
|
|
# (same DB/seed/config is fine). Point a release at other keys to isolate it.
|
|
secrets:
|
|
backend-env: planpal/backend-env
|
|
aws-env: planpal/aws-env
|
|
seed-env: planpal/seed-env
|
|
frontend-env: planpal/frontend
|
|
|
|
# Admin seed one-shot Job.
|
|
seedJob:
|
|
enabled: true
|
|
command: [seed_admin]
|
|
envFrom: [backend-env, seed-env]
|
|
|
|
# ALB ingress. host is the external DNS name; certArn is the ACM cert.
|
|
ingress:
|
|
enabled: true
|
|
className: alb
|
|
host: fakhri-k8.sandbox.devopsinstitute.id
|
|
certArn: arn:aws:acm:ap-southeast-3:134604498185:certificate/c9fcfcb9-9d16-4dbb-989f-9f77f6496621
|
|
# groupName empty -> release name, so each install gets its own ALB. Set the
|
|
# same value on two releases to make them share one ALB.
|
|
groupName: ""
|
|
healthcheckPath: /api/v1/health
|
|
# externalDNS true adds the external-dns hostname annotation. The external-dns
|
|
# controller then creates the Route53 record for host. Needs external-dns
|
|
# installed and permitted on the target hosted zone.
|
|
externalDNS: false
|