diff --git a/.dockerignore b/.dockerignore index 53abb3864..11a625775 100644 --- a/.dockerignore +++ b/.dockerignore @@ -52,8 +52,6 @@ /s3_payload/ /upload_staging/ -/deploy/helm/**/Chart.lock -/deploy/helm/**/charts/ /fluxer_desktop/ diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index b91c32f9f..1d0062d4c 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -422,105 +422,3 @@ jobs: - name: Verify shipped fonts match the lockfile run: python3 tools/fonts/build_fonts.py --verify - - helm-and-scripts: - runs-on: ubuntu-24.04 - timeout-minutes: 10 - steps: - - name: Checkout code - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - - - name: Install helm - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 - - - name: Resolve Helm test build version - run: | - set -euo pipefail - read -r YEAR MONTH DAY TIME <<<"$(date -u '+%Y %m %d %H%M%S')" - echo "HELM_TEST_BUILD_VERSION=${YEAR}.$((10#$MONTH))${DAY}.$((10#$TIME))" >> "$GITHUB_ENV" - - - name: Helm dependency update (all charts) - run: | - set -euo pipefail - for chart_dir in deploy/helm/*/; do - if [[ -f "${chart_dir}Chart.yaml" ]]; then - helm dependency update "$chart_dir" - fi - done - - - name: Helm lint (all charts) - run: | - set -euo pipefail - FAILED=0 - for chart_dir in deploy/helm/*/; do - if [[ -f "${chart_dir}Chart.yaml" ]]; then - echo "--- Linting ${chart_dir} ---" - VALUES_ARGS=() - if [[ -f "${chart_dir}values.yaml" ]]; then - VALUES_ARGS=(-f "${chart_dir}values.yaml") - fi - EXTRA_SETS=(--set-string "global.registry=${GHCR_REGISTRY}") - case "${chart_dir}" in - *gateway*) - EXTRA_SETS+=(--set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}") - ;; - *api*) - EXTRA_SETS+=(--set-string app.name=api --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}") - ;; - *app-proxy*) - EXTRA_SETS+=(--set-string app.name=app-proxy --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}") - ;; - *admin*) - EXTRA_SETS+=(--set-string app.name=admin --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}") - ;; - *marketing*) - EXTRA_SETS+=(--set-string app.name=marketing --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}") - ;; - *docs*) - EXTRA_SETS+=(--set-string app.name=docs --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}") - ;; - *media-proxy*) - EXTRA_SETS+=(--set-string "mediaProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.tag=${HELM_TEST_BUILD_VERSION}" --set-string "mediaProxy.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "staticProxy.build.version=${HELM_TEST_BUILD_VERSION}") - ;; - *uploads*) - EXTRA_SETS+=(--set-string app.name=uploads --set-string "app.tag=${HELM_TEST_BUILD_VERSION}" --set-string app.config=stable --set-string "app.build.version=${HELM_TEST_BUILD_VERSION}") - ;; - *worker*) - EXTRA_SETS+=(--set-string "workerRealtime.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.tag=${HELM_TEST_BUILD_VERSION}" --set-string "workerRealtime.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerUnfurl.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerLifecycle.build.version=${HELM_TEST_BUILD_VERSION}" --set-string "workerBatch.build.version=${HELM_TEST_BUILD_VERSION}") - ;; - *gifs*|*messages*|*snowflakes*|*unfurl*|*users*) - EXTRA_SETS+=(--set-string "svc.tag=${HELM_TEST_BUILD_VERSION}" --set-string "svc.build.version=${HELM_TEST_BUILD_VERSION}" --set-string svc.build.channel=stable) - ;; - esac - if ! helm lint "$chart_dir" "${VALUES_ARGS[@]}" "${EXTRA_SETS[@]}" --strict; then - FAILED=1 - fi - fi - done - if [[ "$FAILED" -ne 0 ]]; then - echo "::error::One or more Helm charts failed linting" - exit 1 - fi - - - name: Helm template (gateway) - run: | - set -euo pipefail - helm template fluxer-gateway deploy/helm/gateway \ - -f deploy/helm/gateway/values.yaml \ - --set-string "global.registry=${GHCR_REGISTRY}" \ - --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \ - --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \ - -n fluxer > /dev/null - echo "Gateway chart templates render successfully." - - - name: Validate gateway manifests with kubeconform - run: | - set -euo pipefail - helm template fluxer-gateway deploy/helm/gateway \ - -f deploy/helm/gateway/values.yaml \ - --set-string "global.registry=${GHCR_REGISTRY}" \ - --set-string "gateway.tag=${HELM_TEST_BUILD_VERSION}" \ - --set-string "gateway.build.version=${HELM_TEST_BUILD_VERSION}" \ - -n fluxer \ - | docker run -i --rm ghcr.io/yannh/kubeconform:v0.6.7 \ - -strict -summary -kubernetes-version 1.31.0 diff --git a/.gitignore b/.gitignore index ce8f53db2..09954b186 100644 --- a/.gitignore +++ b/.gitignore @@ -45,8 +45,6 @@ /s3_payload/ /upload_staging/ -/deploy/helm/**/Chart.lock -/deploy/helm/**/charts/ **/.idea/ **/*.iml diff --git a/deploy/helm/admin/Chart.yaml b/deploy/helm/admin/Chart.yaml deleted file mode 100644 index 6668e6ecb..000000000 --- a/deploy/helm/admin/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: admin -description: Fluxer admin service -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/admin/templates/deployment.yaml b/deploy/helm/admin/templates/deployment.yaml deleted file mode 100644 index 0ecb76d9b..000000000 --- a/deploy/helm/admin/templates/deployment.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/admin/templates/pdb.yaml b/deploy/helm/admin/templates/pdb.yaml deleted file mode 100644 index d3ac0d5b8..000000000 --- a/deploy/helm/admin/templates/pdb.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}} diff --git a/deploy/helm/admin/templates/service.yaml b/deploy/helm/admin/templates/service.yaml deleted file mode 100644 index 60b585760..000000000 --- a/deploy/helm/admin/templates/service.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/admin/values.canary.prod.yaml b/deploy/helm/admin/values.canary.prod.yaml deleted file mode 100644 index 268d3a814..000000000 --- a/deploy/helm/admin/values.canary.prod.yaml +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-admin-canary release as of 2026-05-17T20:42:36Z. -# Captured via: helm -n fluxer get values fluxer-admin-canary -# Apply with: helm upgrade fluxer-admin-canary deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.canary.prod.yaml - -app: - build: - channel: canary - version: "" - image: fluxer-admin - name: admin-canary - port: 8080 - replicas: 2 - minReadySeconds: 10 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 60 - startupProbe: - enabled: true - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - failureThreshold: 24 - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - tag: "" -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-canary -pdb: - minAvailable: 50% diff --git a/deploy/helm/admin/values.stable.prod.yaml b/deploy/helm/admin/values.stable.prod.yaml deleted file mode 100644 index d4c71fc94..000000000 --- a/deploy/helm/admin/values.stable.prod.yaml +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-admin-stable release as of 2026-06-03T19:37:50Z. -# Captured via: helm -n fluxer get values fluxer-admin-stable -# Apply with: helm upgrade fluxer-admin-stable deploy/helm/admin -f deploy/helm/admin/values.yaml -f deploy/helm/admin/values.stable.prod.yaml - -app: - build: - channel: stable - version: "" - image: fluxer-admin - name: admin - port: 8080 - replicas: 2 - minReadySeconds: 10 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 60 - startupProbe: - enabled: true - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - failureThreshold: 24 - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - tag: "" -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-stable -pdb: - minAvailable: 50% diff --git a/deploy/helm/admin/values.yaml b/deploy/helm/admin/values.yaml deleted file mode 100644 index 2ad021c2f..000000000 --- a/deploy/helm/admin/values.yaml +++ /dev/null @@ -1,34 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -app: - name: '' - image: '' - tag: '' - replicas: 2 - port: 8080 - config: '' - minReadySeconds: 10 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 60 - startupProbe: - enabled: true - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - failureThreshold: 24 - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - -pdb: - minAvailable: '50%' diff --git a/deploy/helm/api/Chart.yaml b/deploy/helm/api/Chart.yaml deleted file mode 100644 index afdcad857..000000000 --- a/deploy/helm/api/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: api -description: Fluxer API service -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/api/templates/deployment.yaml b/deploy/helm/api/templates/deployment.yaml deleted file mode 100644 index 0ecb76d9b..000000000 --- a/deploy/helm/api/templates/deployment.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/api/templates/pdb.yaml b/deploy/helm/api/templates/pdb.yaml deleted file mode 100644 index d3ac0d5b8..000000000 --- a/deploy/helm/api/templates/pdb.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}} diff --git a/deploy/helm/api/templates/service.yaml b/deploy/helm/api/templates/service.yaml deleted file mode 100644 index 60b585760..000000000 --- a/deploy/helm/api/templates/service.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/api/values.canary.prod.yaml b/deploy/helm/api/values.canary.prod.yaml deleted file mode 100644 index 8b1ede050..000000000 --- a/deploy/helm/api/values.canary.prod.yaml +++ /dev/null @@ -1,105 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-api-canary release as of 2026-05-23T21:25:52Z. -# Captured via: helm -n fluxer get values fluxer-api-canary -# Apply with: helm upgrade fluxer-api-canary deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.canary.prod.yaml - -app: - build: - channel: canary - version: "" - env: - - name: NODE_TLS_REJECT_UNAUTHORIZED - value: "0" - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: "128" - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: "32" - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: "5000" - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 - valueFrom: - secretKeyRef: - key: relay_secret_base64 - name: fluxer-upload-relay - image: fluxer-api - name: api-canary - port: 8080 - replicas: 4 - minReadySeconds: 15 - terminationGracePeriodSeconds: 90 - preStopDrain: - enabled: true - path: /_health - sleepSeconds: 25 - timeoutSeconds: 2 - retryCount: 3 - retryIntervalSeconds: 1 - resources: - limits: - memory: 4Gi - requests: - cpu: 200m - memory: 512Mi - startupProbe: - enabled: true - failureThreshold: 24 - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 - tag: "" -canary: - env: - - name: NODE_TLS_REJECT_UNAUTHORIZED - value: "0" - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: "128" - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: "32" - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: "5000" - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 - valueFrom: - secretKeyRef: - key: relay_secret_base64 - name: fluxer-upload-relay - image: fluxer-api - port: 8080 - replicas: 2 - minReadySeconds: 15 - terminationGracePeriodSeconds: 90 - preStopDrain: - enabled: true - path: /_health - sleepSeconds: 25 - timeoutSeconds: 2 - retryCount: 3 - retryIntervalSeconds: 1 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - resources: - limits: - memory: 4Gi - requests: - cpu: 200m - memory: 512Mi - startupProbe: - enabled: true - failureThreshold: 24 - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - tag: "" -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-canary -pdb: - minAvailable: 75% diff --git a/deploy/helm/api/values.stable.prod.yaml b/deploy/helm/api/values.stable.prod.yaml deleted file mode 100644 index e317e347c..000000000 --- a/deploy/helm/api/values.stable.prod.yaml +++ /dev/null @@ -1,107 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-api-stable release as of 2026-06-03T19:37:50Z. -# Captured via: helm -n fluxer get values fluxer-api-stable -# Apply with: helm upgrade fluxer-api-stable deploy/helm/api -f deploy/helm/api/values.yaml -f deploy/helm/api/values.stable.prod.yaml - -app: - build: - channel: stable - version: "" - env: - - name: NODE_TLS_REJECT_UNAUTHORIZED - value: "0" - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: "128" - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: "32" - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: "5000" - - name: FLUXER_USERS_SERVICE_TIMEOUT_MS - value: "6000" - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 - valueFrom: - secretKeyRef: - key: relay_secret_base64 - name: fluxer-upload-relay - image: fluxer-api - name: api - port: 8080 - replicas: 31 - minReadySeconds: 15 - terminationGracePeriodSeconds: 90 - preStopDrain: - enabled: true - path: /_health - sleepSeconds: 25 - timeoutSeconds: 2 - retryCount: 3 - retryIntervalSeconds: 1 - resources: - limits: - memory: 4Gi - requests: - cpu: 200m - memory: 512Mi - startupProbe: - enabled: true - failureThreshold: 24 - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 - tag: "" -canary: - env: - - name: NODE_TLS_REJECT_UNAUTHORIZED - value: "0" - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: "128" - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: "32" - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: "5000" - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 - valueFrom: - secretKeyRef: - key: relay_secret_base64 - name: fluxer-upload-relay - image: fluxer-api - port: 8080 - replicas: 2 - minReadySeconds: 15 - terminationGracePeriodSeconds: 90 - preStopDrain: - enabled: true - path: /_health - sleepSeconds: 25 - timeoutSeconds: 2 - retryCount: 3 - retryIntervalSeconds: 1 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - resources: - limits: - memory: 4Gi - requests: - cpu: 200m - memory: 512Mi - startupProbe: - enabled: true - failureThreshold: 24 - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - tag: "" -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-stable -pdb: - minAvailable: 75% diff --git a/deploy/helm/api/values.yaml b/deploy/helm/api/values.yaml deleted file mode 100644 index c3237c5fb..000000000 --- a/deploy/helm/api/values.yaml +++ /dev/null @@ -1,98 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -app: - name: '' - image: '' - tag: '' - replicas: 2 - port: 8080 - minReadySeconds: 15 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 90 - preStopDrain: - enabled: true - path: /_health - sleepSeconds: 25 - timeoutSeconds: 2 - retryCount: 3 - retryIntervalSeconds: 1 - startupProbe: - enabled: true - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - failureThreshold: 24 - env: - - name: NODE_TLS_REJECT_UNAUTHORIZED - value: '0' - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: '128' - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: '32' - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: '5000' - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 - valueFrom: - secretKeyRef: - name: fluxer-upload-relay - key: relay_secret_base64 - resources: - requests: - cpu: 200m - memory: 512Mi - limits: - memory: 4Gi - -canary: - image: fluxer-api - tag: '' - replicas: 2 - port: 8080 - minReadySeconds: 15 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 90 - preStopDrain: - enabled: true - path: /_health - sleepSeconds: 25 - timeoutSeconds: 2 - retryCount: 3 - retryIntervalSeconds: 1 - startupProbe: - enabled: true - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - failureThreshold: 24 - env: - - name: NODE_TLS_REJECT_UNAUTHORIZED - value: '0' - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: '128' - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: '32' - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: '5000' - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 - valueFrom: - secretKeyRef: - name: fluxer-upload-relay - key: relay_secret_base64 - resources: - requests: - cpu: 200m - memory: 512Mi - limits: - memory: 4Gi - -pdb: - minAvailable: '75%' diff --git a/deploy/helm/app-proxy/Chart.yaml b/deploy/helm/app-proxy/Chart.yaml deleted file mode 100644 index 41f99c1d7..000000000 --- a/deploy/helm/app-proxy/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: app-proxy -description: Fluxer app proxy service -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/app-proxy/templates/deployment.yaml b/deploy/helm/app-proxy/templates/deployment.yaml deleted file mode 100644 index 0ecb76d9b..000000000 --- a/deploy/helm/app-proxy/templates/deployment.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/app-proxy/templates/pdb.yaml b/deploy/helm/app-proxy/templates/pdb.yaml deleted file mode 100644 index d3ac0d5b8..000000000 --- a/deploy/helm/app-proxy/templates/pdb.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}} diff --git a/deploy/helm/app-proxy/templates/service.yaml b/deploy/helm/app-proxy/templates/service.yaml deleted file mode 100644 index 60b585760..000000000 --- a/deploy/helm/app-proxy/templates/service.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/app-proxy/values.canary.prod.yaml b/deploy/helm/app-proxy/values.canary.prod.yaml deleted file mode 100644 index c367d10b7..000000000 --- a/deploy/helm/app-proxy/values.canary.prod.yaml +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-app-proxy-canary release as of 2026-05-17T20:42:38Z. -# Captured via: helm -n fluxer get values fluxer-app-proxy-canary -# Apply with: helm upgrade fluxer-app-proxy-canary deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.canary.prod.yaml - -app: - build: - channel: canary - version: "" - env: - - name: PUBLIC_BOOTSTRAP_API_ENDPOINT - value: /api - - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT - value: https://api.canary.fluxer.app - image: fluxer-app-proxy - name: app-proxy-canary - port: 8080 - replicas: 2 - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - tag: "" -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-canary -pdb: - minAvailable: 50% diff --git a/deploy/helm/app-proxy/values.stable.prod.yaml b/deploy/helm/app-proxy/values.stable.prod.yaml deleted file mode 100644 index a0aa1fbfd..000000000 --- a/deploy/helm/app-proxy/values.stable.prod.yaml +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-app-proxy-stable release as of 2026-05-17T20:42:39Z. -# Captured via: helm -n fluxer get values fluxer-app-proxy-stable -# Apply with: helm upgrade fluxer-app-proxy-stable deploy/helm/app-proxy -f deploy/helm/app-proxy/values.yaml -f deploy/helm/app-proxy/values.stable.prod.yaml - -app: - build: - channel: stable - version: "" - env: - - name: PUBLIC_BOOTSTRAP_API_ENDPOINT - value: /api - - name: PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT - value: https://api.fluxer.app - image: fluxer-app-proxy - name: app-proxy - port: 8080 - replicas: 2 - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - tag: "" -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-stable -pdb: - minAvailable: 50% diff --git a/deploy/helm/app-proxy/values.yaml b/deploy/helm/app-proxy/values.yaml deleted file mode 100644 index 7ba069250..000000000 --- a/deploy/helm/app-proxy/values.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -app: - name: '' - image: '' - tag: '' - replicas: 2 - port: 8080 - config: '' - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - - - - - - env: - - name: PUBLIC_BOOTSTRAP_API_ENDPOINT - value: '/api' - -pdb: - minAvailable: '50%' diff --git a/deploy/helm/common/Chart.yaml b/deploy/helm/common/Chart.yaml deleted file mode 100644 index f2b2b4b51..000000000 --- a/deploy/helm/common/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: common -description: Shared Helm templates for Fluxer services -type: library -version: 0.1.0 diff --git a/deploy/helm/common/templates/_helpers.tpl b/deploy/helm/common/templates/_helpers.tpl deleted file mode 100644 index 198299086..000000000 --- a/deploy/helm/common/templates/_helpers.tpl +++ /dev/null @@ -1,356 +0,0 @@ -{{/* SPDX-License-Identifier: AGPL-3.0-or-later */}} -{{- define "fluxer.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{- define "fluxer.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{- define "fluxer.labels" -}} -helm.sh/chart: {{ include "fluxer.chart" . }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -app.kubernetes.io/part-of: fluxer -{{- end }} - -{{- define "fluxer.selectorLabels" -}} -app.kubernetes.io/name: {{ .name }} -app.kubernetes.io/instance: {{ .context.Release.Name }} -{{- end }} - -{{- define "fluxer.imagePullSecrets" -}} -imagePullSecrets: - - name: {{ .Values.global.imagePullSecret }} -{{- end }} - -{{- define "fluxer.image" -}} -{{- $tag := required (printf ".tag is required (image: %s)" .image) .tag -}} -{{- $registry := required "global.registry is required" .context.Values.global.registry -}} -{{ $registry }}/{{ .image }}:{{ $tag }} -{{- end }} - -{{- define "fluxer.replicas" -}} -{{- $name := .name -}} -{{- $v := .values -}} -{{- $ctx := .context -}} -{{- $desired := int (required (printf ".replicas is required for %s" $name) $v.replicas) -}} -{{- $preserveLiveReplicas := dig "preserveLiveReplicas" true $v -}} -{{- if not $preserveLiveReplicas -}} -{{- $desired -}} -{{- else -}} -{{- $existing := lookup "apps/v1" "Deployment" $ctx.Values.global.namespace $name -}} -{{- if $existing -}} -{{- $current := int (dig "spec" "replicas" 0 $existing) -}} -{{- if gt $current 0 -}} -{{- $current -}} -{{- else -}} -{{- $desired -}} -{{- end -}} -{{- else -}} -{{- $desired -}} -{{- end -}} -{{- end -}} -{{- end }} - -{{- define "fluxer.deployment" -}} -{{- $name := .name -}} -{{- $v := .values -}} -{{- $ctx := .context -}} -{{- $isGateway := eq $name "gateway" -}} -{{- $defaultMaxSurge := 1 -}} -{{- $defaultMaxUnavailable := 0 -}} -{{- $defaultMinReadySeconds := 10 -}} -{{- $defaultTerminationGracePeriodSeconds := ternary 90 60 $isGateway -}} -{{- $defaultReadinessPath := ternary "/_health/ready" "/_health" $isGateway -}} -{{- $defaultReadinessTimeoutSeconds := ternary 5 2 $isGateway -}} -{{- $configuredMaxSurge := dig "rollingUpdate" "maxSurge" $defaultMaxSurge $v -}} -{{- $configuredMaxUnavailable := dig "rollingUpdate" "maxUnavailable" $defaultMaxUnavailable $v -}} -{{- $maxSurge := $configuredMaxSurge -}} -{{- $maxUnavailable := $configuredMaxUnavailable -}} -{{- $minReadySeconds := int (dig "minReadySeconds" $defaultMinReadySeconds $v) -}} -{{- $terminationGracePeriodSeconds := int (dig "terminationGracePeriodSeconds" $defaultTerminationGracePeriodSeconds $v) -}} -{{- $readinessPath := dig "readinessProbe" "path" $defaultReadinessPath $v -}} -{{- $readinessExecEnabled := dig "readinessProbe" "execEnabled" $isGateway $v -}} -{{- $readinessTimeoutSeconds := int (dig "readinessProbe" "timeoutSeconds" $defaultReadinessTimeoutSeconds $v) -}} -{{- $readinessExecCommand := printf "curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 || exit 1" $readinessTimeoutSeconds (int $v.port) $readinessPath -}} -{{- $readinessInitialDelaySeconds := int (dig "readinessProbe" "initialDelaySeconds" 5 $v) -}} -{{- $readinessPeriodSeconds := int (dig "readinessProbe" "periodSeconds" 5 $v) -}} -{{- $readinessFailureThreshold := int (dig "readinessProbe" "failureThreshold" 2 $v) -}} -{{- $livenessPath := dig "livenessProbe" "path" "/_health" $v -}} -{{- $livenessInitialDelaySeconds := int (dig "livenessProbe" "initialDelaySeconds" 10 $v) -}} -{{- $livenessPeriodSeconds := int (dig "livenessProbe" "periodSeconds" 15 $v) -}} -{{- $livenessFailureThreshold := int (dig "livenessProbe" "failureThreshold" 3 $v) -}} -{{- $livenessTimeoutSeconds := int (dig "livenessProbe" "timeoutSeconds" 5 $v) -}} -{{- $startupProbeEnabled := dig "startupProbe" "enabled" $isGateway $v -}} -{{- $startupProbePath := dig "startupProbe" "path" "/_health" $v -}} -{{- $startupProbeInitialDelaySeconds := int (dig "startupProbe" "initialDelaySeconds" 0 $v) -}} -{{- $startupProbePeriodSeconds := int (dig "startupProbe" "periodSeconds" 5 $v) -}} -{{- $startupProbeFailureThreshold := int (dig "startupProbe" "failureThreshold" 30 $v) -}} -{{- $startupProbeTimeoutSeconds := int (dig "startupProbe" "timeoutSeconds" 5 $v) -}} -{{- $preStopDrainEnabled := dig "preStopDrain" "enabled" $isGateway $v -}} -{{- $preStopDrainPath := dig "preStopDrain" "path" "/_health/drain" $v -}} -{{- $preStopDrainSleepSeconds := int (dig "preStopDrain" "sleepSeconds" 20 $v) -}} -{{- $preStopDrainTimeoutSeconds := int (dig "preStopDrain" "timeoutSeconds" 2 $v) -}} -{{- $preStopDrainRetryCount := int (dig "preStopDrain" "retryCount" 6 $v) -}} -{{- $preStopDrainRetryIntervalSeconds := int (dig "preStopDrain" "retryIntervalSeconds" 1 $v) -}} -{{- $preStopDrainCommand := printf "attempt=0; while [ \"$attempt\" -lt %d ]; do curl -fsS --max-time %d http://127.0.0.1:%d%s >/dev/null 2>&1 && break; attempt=$((attempt+1)); sleep %d; done; sleep %d" $preStopDrainRetryCount $preStopDrainTimeoutSeconds (int $v.port) $preStopDrainPath $preStopDrainRetryIntervalSeconds $preStopDrainSleepSeconds -}} -{{- $build := get $v "build" | default (dict) -}} -{{- $buildVersion := get $build "version" | default $v.tag -}} -{{- $buildSha := get $build "sha" | default "" -}} -{{- $buildChannel := get $build "channel" | default "" -}} -{{- $nsfwServiceEndpoint := get $v "nsfwServiceEndpoint" | default "" -}} -{{- $cluster := get $ctx.Values "cluster" | default (dict) -}} -{{- $gatewayClusterEnabled := and $isGateway (eq (get $cluster "enabled" | default false) true) -}} -{{- $erlangDistribution := get $cluster "erlangDistribution" | default (dict) -}} -{{- $erlangDistPort := int (get $erlangDistribution "port" | default 8081) -}} -{{- $erlangEpmdPort := int (get $erlangDistribution "epmdPort" | default 4369) -}} -{{- $erlangCookieSecret := get $cluster "erlangCookieSecret" | default (dict) -}} -{{- $erlangCookieSecretName := get $erlangCookieSecret "name" | default "fluxer-gateway-erlang-cookie" -}} -{{- $erlangCookieSecretKey := get $erlangCookieSecret "key" | default "cookie" -}} -{{- $gatewayNodeBasename := get $cluster "discoveryNodeBasename" | default "fluxer_gateway" -}} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ $name }} - namespace: {{ $ctx.Values.global.namespace }} - labels: - {{- include "fluxer.labels" $ctx | nindent 4 }} - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }} -spec: - replicas: {{ include "fluxer.replicas" (dict "name" $name "values" $v "context" $ctx) }} - minReadySeconds: {{ $minReadySeconds }} - selector: - matchLabels: - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 6 }} - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: {{ $maxSurge | toJson }} - maxUnavailable: {{ $maxUnavailable | toJson }} - template: - metadata: - labels: - {{- include "fluxer.labels" $ctx | nindent 8 }} - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 8 }} - spec: - {{- include "fluxer.imagePullSecrets" $ctx | nindent 6 }} - terminationGracePeriodSeconds: {{ $terminationGracePeriodSeconds }} - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - {{- if $v.affinity }} - affinity: - {{- toYaml $v.affinity | nindent 8 }} - {{- else if $isGateway }} - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - matchLabels: - app.kubernetes.io/name: gateway - app.kubernetes.io/instance: {{ $ctx.Release.Name }} - topologyKey: kubernetes.io/hostname - {{- end }} - {{- if $v.topologySpreadConstraints }} - topologySpreadConstraints: - {{- toYaml $v.topologySpreadConstraints | nindent 8 }} - {{- else if $isGateway }} - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app.kubernetes.io/name: gateway - app.kubernetes.io/instance: {{ $ctx.Release.Name }} - {{- else }} - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: ScheduleAnyway - nodeAffinityPolicy: Honor - nodeTaintsPolicy: Honor - labelSelector: - matchLabels: - app.kubernetes.io/name: {{ $name }} - app.kubernetes.io/instance: {{ $ctx.Release.Name }} - {{- end }} - {{- if $v.nodeSelector }} - nodeSelector: - {{- toYaml $v.nodeSelector | nindent 8 }} - {{- end }} - {{- if $v.tolerations }} - tolerations: - {{- toYaml $v.tolerations | nindent 8 }} - {{- end }} - containers: - - name: {{ $name }} - image: {{ include "fluxer.image" (dict "image" $v.image "tag" $v.tag "context" $ctx) }} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - {{- if $v.command }} - command: {{ $v.command | toJson }} - {{- end }} - ports: - - name: http - containerPort: {{ $v.port }} - protocol: TCP - {{- if $gatewayClusterEnabled }} - - name: epmd - containerPort: {{ $erlangEpmdPort }} - protocol: TCP - - name: erl-dist - containerPort: {{ $erlangDistPort }} - protocol: TCP - {{- end }} - env: - - name: NODE_ENV - value: production - - name: FLUXER_ENV - value: production - {{- if $gatewayClusterEnabled }} - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: FLUXER_ERLANG_NODE_NAME - value: {{ printf "%s@$(POD_IP)" $gatewayNodeBasename | quote }} - - name: FLUXER_ERLANG_DIST_PORT - value: {{ printf "%d" $erlangDistPort | quote }} - - name: FLUXER_ERLANG_COOKIE - valueFrom: - secretKeyRef: - name: {{ $erlangCookieSecretName }} - key: {{ $erlangCookieSecretKey }} - {{- end }} - {{- if $buildVersion }} - - name: BUILD_VERSION - value: {{ $buildVersion | quote }} - {{- end }} - {{- if $buildSha }} - - name: BUILD_SHA - value: {{ $buildSha | quote }} - {{- end }} - {{- if $buildChannel }} - - name: RELEASE_CHANNEL - value: {{ $buildChannel | quote }} - {{- end }} - {{- if $nsfwServiceEndpoint }} - - name: FLUXER_NSFW_SERVICE_ENDPOINT - value: {{ $nsfwServiceEndpoint | quote }} - {{- end }} - {{- if $ctx.Values.global.env }} - {{- toYaml $ctx.Values.global.env | nindent 12 }} - {{- end }} - {{- if $v.env }} - {{- toYaml $v.env | nindent 12 }} - {{- end }} - {{- if or $ctx.Values.global.envFrom $v.envFrom }} - envFrom: - {{- if $ctx.Values.global.envFrom }} - {{- toYaml $ctx.Values.global.envFrom | nindent 12 }} - {{- end }} - {{- if $v.envFrom }} - {{- toYaml $v.envFrom | nindent 12 }} - {{- end }} - {{- end }} - {{- if $preStopDrainEnabled }} - lifecycle: - preStop: - exec: - command: - - /bin/sh - - -c - - {{ $preStopDrainCommand | quote }} - {{- end }} - volumeMounts: - - name: keys - mountPath: /etc/fluxer/keys - readOnly: true - {{- if not $v.noHealthCheck }} - livenessProbe: - httpGet: - path: {{ $livenessPath | quote }} - port: http - initialDelaySeconds: {{ $livenessInitialDelaySeconds }} - periodSeconds: {{ $livenessPeriodSeconds }} - timeoutSeconds: {{ $livenessTimeoutSeconds }} - failureThreshold: {{ $livenessFailureThreshold }} - readinessProbe: - {{- if $readinessExecEnabled }} - exec: - command: - - /bin/sh - - -c - - {{ $readinessExecCommand | quote }} - {{- else }} - httpGet: - path: {{ $readinessPath | quote }} - port: http - {{- end }} - initialDelaySeconds: {{ $readinessInitialDelaySeconds }} - periodSeconds: {{ $readinessPeriodSeconds }} - timeoutSeconds: {{ $readinessTimeoutSeconds }} - failureThreshold: {{ $readinessFailureThreshold }} - {{- if $startupProbeEnabled }} - startupProbe: - httpGet: - path: {{ $startupProbePath | quote }} - port: http - initialDelaySeconds: {{ $startupProbeInitialDelaySeconds }} - periodSeconds: {{ $startupProbePeriodSeconds }} - timeoutSeconds: {{ $startupProbeTimeoutSeconds }} - failureThreshold: {{ $startupProbeFailureThreshold }} - {{- end }} - {{- end }} - resources: - {{- toYaml $v.resources | nindent 12 }} - volumes: - - name: keys - secret: - secretName: fluxer-keys - optional: true -{{- end }} - -{{- define "fluxer.service" -}} -{{- $name := .name -}} -{{- $selectorName := .selectorName | default $name -}} -{{- $v := .values -}} -{{- $ctx := .context -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ $name }} - namespace: {{ $ctx.Values.global.namespace }} - labels: - {{- include "fluxer.labels" $ctx | nindent 4 }} - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }} -spec: - type: ClusterIP - ports: - - port: {{ $v.port }} - targetPort: http - protocol: TCP - name: http - selector: - {{- include "fluxer.selectorLabels" (dict "name" $selectorName "context" $ctx) | nindent 4 }} -{{- end }} - -{{- define "fluxer.pdb" -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ .name }}-pdb - namespace: {{ .context.Values.global.namespace }} - labels: - {{- include "fluxer.labels" .context | nindent 4 }} -spec: - minAvailable: {{ .minAvailable }} - selector: - matchLabels: - {{- include "fluxer.selectorLabels" (dict "name" .name "context" .context) | nindent 6 }} -{{- end }} diff --git a/deploy/helm/docs/Chart.yaml b/deploy/helm/docs/Chart.yaml deleted file mode 100644 index f9416cf77..000000000 --- a/deploy/helm/docs/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: docs -description: Fluxer documentation service -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/docs/templates/deployment.yaml b/deploy/helm/docs/templates/deployment.yaml deleted file mode 100644 index 0ecb76d9b..000000000 --- a/deploy/helm/docs/templates/deployment.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/docs/templates/pdb.yaml b/deploy/helm/docs/templates/pdb.yaml deleted file mode 100644 index d3ac0d5b8..000000000 --- a/deploy/helm/docs/templates/pdb.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}} diff --git a/deploy/helm/docs/templates/service.yaml b/deploy/helm/docs/templates/service.yaml deleted file mode 100644 index 60b585760..000000000 --- a/deploy/helm/docs/templates/service.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/docs/values.stable.prod.yaml b/deploy/helm/docs/values.stable.prod.yaml deleted file mode 100644 index 558913eab..000000000 --- a/deploy/helm/docs/values.stable.prod.yaml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -app: - build: - channel: stable - version: "" - image: fluxer-docs - name: docs - port: 8080 - replicas: 2 - resources: - limits: - memory: 128Mi - requests: - cpu: 50m - memory: 64Mi - tag: "" -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" -pdb: - minAvailable: 50% diff --git a/deploy/helm/docs/values.yaml b/deploy/helm/docs/values.yaml deleted file mode 100644 index 53c5cbdaf..000000000 --- a/deploy/helm/docs/values.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -app: - name: '' - image: '' - tag: '' - replicas: 2 - port: 8080 - resources: - requests: - cpu: 50m - memory: 64Mi - limits: - memory: 128Mi - -pdb: - minAvailable: '50%' diff --git a/deploy/helm/gateway/Chart.yaml b/deploy/helm/gateway/Chart.yaml deleted file mode 100644 index 1b033aa5b..000000000 --- a/deploy/helm/gateway/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: gateway -description: Fluxer WebSocket gateway service -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/gateway/templates/deployment.yaml b/deploy/helm/gateway/templates/deployment.yaml deleted file mode 100644 index a33b94845..000000000 --- a/deploy/helm/gateway/templates/deployment.yaml +++ /dev/null @@ -1,40 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{ $gatewayValues := .Values.gateway -}} -{{- $cluster := .Values.cluster | default dict -}} -{{- if dig "enabled" false $cluster -}} -{{- $clusterEnv := list - (dict "name" "FLUXER_GATEWAY_CLUSTER_ENABLED" "value" "true") - (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME" "value" (dig "discoveryDnsName" "" $cluster)) - (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME" "value" (dig "discoveryNodeBasename" "fluxer_gateway" $cluster)) - (dict "name" "FLUXER_GATEWAY_CLUSTER_DISCOVERY_POLL_INTERVAL_MS" "value" (printf "%d" (int (dig "discoveryPollIntervalMs" 5000 $cluster)))) --}} -{{- if dig "enabled" false .Values.roles -}} -{{- $clusterEnv = concat (list (dict "name" "FLUXER_GATEWAY_ROLE" "value" (dig "websocket" "role" "websocket" .Values.roles))) $clusterEnv -}} -{{- end -}} -{{- $gatewayValues = mergeOverwrite (deepCopy .Values.gateway) (dict "env" (concat $clusterEnv (get .Values.gateway "env" | default (list)))) -}} -{{- end }} -{{- $hotpatch := get .Values.gateway "hotpatch" | default dict -}} -{{- if dig "enabled" false $hotpatch -}} -{{- $hotpatchEnv := list - (dict "name" "FLUXER_GATEWAY_HOTPATCH_ENABLED" "value" "true") - (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PORT" "value" (printf "%d" (int (get $hotpatch "cassandraPort" | default 9042)))) - (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_KEYSPACE" "value" (get $hotpatch "cassandraKeyspace" | default "fluxer")) - (dict "name" "FLUXER_GATEWAY_HOTPATCH_POLL_INTERVAL_MS" "value" (printf "%d" (int (get $hotpatch "pollIntervalMs" | default 5000)))) - (dict "name" "FLUXER_GATEWAY_HOTPATCH_STARTUP_SYNC_TIMEOUT_MS" "value" (printf "%d" (int (get $hotpatch "startupSyncTimeoutMs" | default 30000)))) --}} -{{- if get $hotpatch "cassandraHosts" -}} -{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_HOSTS" "value" (get $hotpatch "cassandraHosts")) -}} -{{- end -}} -{{- $publicKeysSecret := get $hotpatch "publicKeysSecret" | default dict -}} -{{- if get $publicKeysSecret "name" -}} -{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_PUBLIC_KEYS" "valueFrom" (dict "secretKeyRef" (dict "name" (get $publicKeysSecret "name") "key" (get $publicKeysSecret "key" | default "public_keys")))) -}} -{{- end -}} -{{- $credentialsSecret := get $hotpatch "cassandraCredentialsSecret" | default dict -}} -{{- if get $credentialsSecret "name" -}} -{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_USERNAME" "valueFrom" (dict "secretKeyRef" (dict "name" (get $credentialsSecret "name") "key" (get $credentialsSecret "usernameKey" | default "username")))) -}} -{{- $hotpatchEnv = append $hotpatchEnv (dict "name" "FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PASSWORD" "valueFrom" (dict "secretKeyRef" (dict "name" (get $credentialsSecret "name") "key" (get $credentialsSecret "passwordKey" | default "password")))) -}} -{{- end -}} -{{- $gatewayValues = mergeOverwrite (deepCopy $gatewayValues) (dict "env" (concat $hotpatchEnv (get $gatewayValues "env" | default (list)))) -}} -{{- end }} -{{ include "fluxer.deployment" (dict "name" "gateway" "values" $gatewayValues "context" .) }} diff --git a/deploy/helm/gateway/templates/networkpolicy.yaml b/deploy/helm/gateway/templates/networkpolicy.yaml deleted file mode 100644 index 18828a1b7..000000000 --- a/deploy/helm/gateway/templates/networkpolicy.yaml +++ /dev/null @@ -1,70 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{- $clusterEnabled := dig "enabled" false .Values.cluster -}} -{{- $distPort := int (dig "erlangDistribution" "port" 8081 .Values.cluster) }} -{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 .Values.cluster) }} -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: gateway - namespace: {{.Values.global.namespace}} - labels: {{- include "fluxer.labels" . | nindent 4}} -spec: - podSelector: - matchLabels: - {{- if dig "enabled" false .Values.roles }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/part-of: fluxer - {{- else }} - {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 6 }} - {{- end }} - policyTypes: - - Ingress - - Egress - ingress: - - from: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: ingress-nginx - ports: - - port: {{.Values.gateway.port}} - protocol: TCP - - from: - - podSelector: - matchLabels: - app.kubernetes.io/name: api - - podSelector: - matchLabels: - app.kubernetes.io/name: api-canary - - podSelector: - matchLabels: - app.kubernetes.io/name: worker-realtime - - podSelector: - matchLabels: - app.kubernetes.io/name: worker-lifecycle - - podSelector: - matchLabels: - app.kubernetes.io/name: worker-batch - ports: - - port: {{.Values.gateway.port}} - protocol: TCP - - from: - - podSelector: - matchLabels: - {{- if dig "enabled" false .Values.roles }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/part-of: fluxer - {{- else }} - {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 14 }} - {{- end }} - ports: - - port: {{.Values.gateway.port}} - protocol: TCP - {{- if $clusterEnabled }} - - port: {{ $epmdPort }} - protocol: TCP - - port: {{ $distPort }} - protocol: TCP - {{- end }} - egress: - - {} diff --git a/deploy/helm/gateway/templates/pdb.yaml b/deploy/helm/gateway/templates/pdb.yaml deleted file mode 100644 index 543974bd6..000000000 --- a/deploy/helm/gateway/templates/pdb.yaml +++ /dev/null @@ -1,5 +0,0 @@ -{{- if and .Values.pdb.enabled (gt (int .Values.gateway.replicas) 1) }} -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{ include "fluxer.pdb" (dict "name" "gateway" "minAvailable" .Values.pdb.minAvailable "context" .) }} -{{- end }} diff --git a/deploy/helm/gateway/templates/service.yaml b/deploy/helm/gateway/templates/service.yaml deleted file mode 100644 index f7314ffb2..000000000 --- a/deploy/helm/gateway/templates/service.yaml +++ /dev/null @@ -1,40 +0,0 @@ -{{- $clusterEnabled := dig "enabled" false .Values.cluster -}} -{{- $distPort := int (dig "erlangDistribution" "port" 8081 .Values.cluster) -}} -{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 .Values.cluster) -}} -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.service" (dict "name" "gateway" "values" .Values.gateway "context" .)}} ---- -apiVersion: v1 -kind: Service -metadata: - name: fluxer-gateway-headless - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 4 }} -spec: - type: ClusterIP - clusterIP: None - ports: - - port: {{ .Values.gateway.port }} - targetPort: http - protocol: TCP - name: http - {{- if $clusterEnabled }} - - port: {{ $epmdPort }} - targetPort: epmd - protocol: TCP - name: epmd - - port: {{ $distPort }} - targetPort: erl-dist - protocol: TCP - name: erl-dist - {{- end }} - selector: - {{- if dig "enabled" false .Values.roles }} - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/part-of: fluxer - {{- else }} - {{- include "fluxer.selectorLabels" (dict "name" "gateway" "context" .) | nindent 4 }} - {{- end }} diff --git a/deploy/helm/gateway/templates/statefulsets.yaml b/deploy/helm/gateway/templates/statefulsets.yaml deleted file mode 100644 index 0d18ddae8..000000000 --- a/deploy/helm/gateway/templates/statefulsets.yaml +++ /dev/null @@ -1,255 +0,0 @@ -{{- if dig "enabled" false .Values.roles }} -{{- $cluster := .Values.cluster | default dict -}} -{{- $distPort := int (dig "erlangDistribution" "port" 8081 $cluster) -}} -{{- $epmdPort := int (dig "erlangDistribution" "epmdPort" 4369 $cluster) -}} -{{- $cookie := dig "erlangCookieSecret" (dict) $cluster -}} -{{- $cookieName := get $cookie "name" | default "fluxer-gateway-erlang-cookie" -}} -{{- $cookieKey := get $cookie "key" | default "cookie" -}} -{{- $nodeBasename := dig "discoveryNodeBasename" "fluxer_gateway" $cluster -}} -{{- $dnsName := dig "discoveryDnsName" "" $cluster -}} -{{- if not $dnsName }} -{{- fail "cluster.discoveryDnsName is required when roles.enabled=true" }} -{{- end }} -{{- $pollIntervalMs := int (dig "discoveryPollIntervalMs" 5000 $cluster) -}} -{{- $gateway := .Values.gateway -}} -{{- $common := .Values.roles.common | default dict -}} -{{- $build := get $gateway "build" | default dict -}} -{{- $hotpatch := get $gateway "hotpatch" | default dict -}} -{{- $hotpatchPublicKeysSecret := get $hotpatch "publicKeysSecret" | default dict -}} -{{- $hotpatchCredentialsSecret := get $hotpatch "cassandraCredentialsSecret" | default dict -}} -{{- $roles := list "sessions" "presence" "guilds" "calls" "push" -}} -{{- range $role := $roles }} -{{- $roleValues := get $.Values.roles $role | default dict -}} -{{- if dig "enabled" true $roleValues }} -{{- $name := printf "gateway-%s" $role -}} -{{- $replicas := int (dig "replicas" (dig "replicas" 1 $common) $roleValues) -}} -{{- $resources := get $roleValues "resources" | default (get $common "resources" | default $gateway.resources) -}} -{{- $nodeSelector := get $roleValues "nodeSelector" | default (get $common "nodeSelector" | default $gateway.nodeSelector) -}} -{{- $tolerations := get $roleValues "tolerations" | default (get $common "tolerations" | default $gateway.tolerations) -}} -{{- $affinity := get $roleValues "affinity" | default (get $common "affinity" | default dict) -}} -{{- $topologySpreadConstraints := get $roleValues "topologySpreadConstraints" | default (get $common "topologySpreadConstraints" | default list) -}} ---- -# SPDX-License-Identifier: AGPL-3.0-or-later -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ $name }} - namespace: {{ $.Values.global.namespace }} - labels: - {{- include "fluxer.labels" $ | nindent 4 }} - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 4 }} -spec: - serviceName: fluxer-gateway-headless - replicas: {{ $replicas }} - selector: - matchLabels: - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 6 }} - updateStrategy: - type: RollingUpdate - template: - metadata: - labels: - {{- include "fluxer.labels" $ | nindent 8 }} - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 8 }} - app.kubernetes.io/gateway-role: {{ $role | quote }} - spec: - {{- include "fluxer.imagePullSecrets" $ | nindent 6 }} - terminationGracePeriodSeconds: {{ int (dig "terminationGracePeriodSeconds" 45 $roleValues) }} - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - {{- if $affinity }} - affinity: - {{- toYaml $affinity | nindent 8 }} - {{- end }} - {{- if $topologySpreadConstraints }} - topologySpreadConstraints: - {{- toYaml $topologySpreadConstraints | nindent 8 }} - {{- else }} - topologySpreadConstraints: - - maxSkew: 1 - topologyKey: kubernetes.io/hostname - whenUnsatisfiable: ScheduleAnyway - labelSelector: - matchLabels: - app.kubernetes.io/name: {{ $name }} - app.kubernetes.io/instance: {{ $.Release.Name }} - {{- end }} - {{- if $nodeSelector }} - nodeSelector: - {{- toYaml $nodeSelector | nindent 8 }} - {{- end }} - {{- if $tolerations }} - tolerations: - {{- toYaml $tolerations | nindent 8 }} - {{- end }} - containers: - - name: gateway - image: {{ include "fluxer.image" (dict "image" $gateway.image "tag" $gateway.tag "context" $) }} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - ports: - - name: http - containerPort: {{ $gateway.port }} - protocol: TCP - - name: epmd - containerPort: {{ $epmdPort }} - protocol: TCP - - name: erl-dist - containerPort: {{ $distPort }} - protocol: TCP - env: - - name: NODE_ENV - value: production - - name: FLUXER_ENV - value: production - - name: FLUXER_GATEWAY_ROLE - value: {{ $role | quote }} - - name: FLUXER_GATEWAY_CLUSTER_ENABLED - value: "true" - - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_DNS_NAME - value: {{ $dnsName | quote }} - - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_NODE_BASENAME - value: {{ $nodeBasename | quote }} - - name: FLUXER_GATEWAY_CLUSTER_DISCOVERY_POLL_INTERVAL_MS - value: {{ printf "%d" $pollIntervalMs | quote }} - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: FLUXER_ERLANG_NODE_NAME - value: {{ printf "%s@$(POD_IP)" $nodeBasename | quote }} - - name: FLUXER_ERLANG_DIST_PORT - value: {{ printf "%d" $distPort | quote }} - - name: FLUXER_ERLANG_COOKIE - valueFrom: - secretKeyRef: - name: {{ $cookieName }} - key: {{ $cookieKey }} - {{- if get $build "sha" }} - - name: BUILD_SHA - value: {{ get $build "sha" | quote }} - {{- end }} - {{- if get $build "number" }} - - name: BUILD_NUMBER - value: {{ get $build "number" | quote }} - {{- end }} - {{- if get $build "timestamp" }} - - name: BUILD_TIMESTAMP - value: {{ get $build "timestamp" | quote }} - {{- end }} - {{- if get $build "channel" }} - - name: RELEASE_CHANNEL - value: {{ get $build "channel" | quote }} - {{- end }} - {{- if dig "enabled" false $hotpatch }} - - name: FLUXER_GATEWAY_HOTPATCH_ENABLED - value: "true" - {{- if get $hotpatch "cassandraHosts" }} - - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_HOSTS - value: {{ get $hotpatch "cassandraHosts" | quote }} - {{- end }} - - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PORT - value: {{ printf "%d" (int (get $hotpatch "cassandraPort" | default 9042)) | quote }} - - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_KEYSPACE - value: {{ get $hotpatch "cassandraKeyspace" | default "fluxer" | quote }} - - name: FLUXER_GATEWAY_HOTPATCH_POLL_INTERVAL_MS - value: {{ printf "%d" (int (get $hotpatch "pollIntervalMs" | default 5000)) | quote }} - - name: FLUXER_GATEWAY_HOTPATCH_STARTUP_SYNC_TIMEOUT_MS - value: {{ printf "%d" (int (get $hotpatch "startupSyncTimeoutMs" | default 30000)) | quote }} - {{- if get $hotpatchPublicKeysSecret "name" }} - - name: FLUXER_GATEWAY_HOTPATCH_PUBLIC_KEYS - valueFrom: - secretKeyRef: - name: {{ get $hotpatchPublicKeysSecret "name" | quote }} - key: {{ get $hotpatchPublicKeysSecret "key" | default "public_keys" | quote }} - {{- end }} - {{- if get $hotpatchCredentialsSecret "name" }} - - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_USERNAME - valueFrom: - secretKeyRef: - name: {{ get $hotpatchCredentialsSecret "name" | quote }} - key: {{ get $hotpatchCredentialsSecret "usernameKey" | default "username" | quote }} - - name: FLUXER_GATEWAY_HOTPATCH_CASSANDRA_PASSWORD - valueFrom: - secretKeyRef: - name: {{ get $hotpatchCredentialsSecret "name" | quote }} - key: {{ get $hotpatchCredentialsSecret "passwordKey" | default "password" | quote }} - {{- end }} - {{- end }} - {{- if $.Values.global.env }} - {{- toYaml $.Values.global.env | nindent 12 }} - {{- end }} - {{- if $gateway.env }} - {{- toYaml $gateway.env | nindent 12 }} - {{- end }} - {{- if $common.env }} - {{- toYaml $common.env | nindent 12 }} - {{- end }} - {{- if $roleValues.env }} - {{- toYaml $roleValues.env | nindent 12 }} - {{- end }} - {{- if or $.Values.global.envFrom $gateway.envFrom $common.envFrom $roleValues.envFrom }} - envFrom: - {{- if $.Values.global.envFrom }} - {{- toYaml $.Values.global.envFrom | nindent 12 }} - {{- end }} - {{- if $gateway.envFrom }} - {{- toYaml $gateway.envFrom | nindent 12 }} - {{- end }} - {{- if $common.envFrom }} - {{- toYaml $common.envFrom | nindent 12 }} - {{- end }} - {{- if $roleValues.envFrom }} - {{- toYaml $roleValues.envFrom | nindent 12 }} - {{- end }} - {{- end }} - lifecycle: - preStop: - exec: - command: - - /bin/sh - - -c - - {{ printf "curl -fsS --max-time 2 http://127.0.0.1:%d/_health/drain >/dev/null 2>&1 || true; sleep 20" (int $gateway.port) | quote }} - volumeMounts: - - name: keys - mountPath: /etc/fluxer/keys - readOnly: true - livenessProbe: - httpGet: - path: "/_health" - port: http - initialDelaySeconds: 10 - periodSeconds: 15 - timeoutSeconds: 5 - failureThreshold: 3 - readinessProbe: - exec: - command: - - /bin/sh - - -c - - {{ printf "curl -fsS --max-time 5 http://127.0.0.1:%d/_health/ready >/dev/null 2>&1 || exit 1" (int $gateway.port) | quote }} - initialDelaySeconds: 5 - periodSeconds: 5 - timeoutSeconds: 5 - failureThreshold: 3 - startupProbe: - httpGet: - path: "/_health" - port: http - initialDelaySeconds: 0 - periodSeconds: 5 - timeoutSeconds: 5 - failureThreshold: 30 - resources: - {{- toYaml $resources | nindent 12 }} - volumes: - - name: keys - secret: - secretName: fluxer-keys - optional: true -{{ end }} -{{ end }} -{{ end }} diff --git a/deploy/helm/gateway/values.prod.yaml b/deploy/helm/gateway/values.prod.yaml deleted file mode 100644 index 3aa99d74d..000000000 --- a/deploy/helm/gateway/values.prod.yaml +++ /dev/null @@ -1,164 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-gateway release as of 2026-05-23T21:25:52Z. -# Captured via: helm -n fluxer get values fluxer-gateway -# Apply with: helm upgrade fluxer-gateway deploy/helm/gateway -f deploy/helm/gateway/values.yaml -f deploy/helm/gateway/values.prod.yaml - -cluster: - discoveryDnsName: fluxer-gateway-headless.fluxer.svc.cluster.local - discoveryNodeBasename: fluxer_gateway - discoveryPollIntervalMs: 5000 - enabled: true - erlangCookieSecret: - key: cookie - name: fluxer-gateway-erlang-cookie - erlangDistribution: - epmdPort: 4369 - port: 8081 - -gateway: - build: - channel: stable - version: "" - env: - - name: FLUXER_GATEWAY_STATIC_CDN_ENDPOINT - value: "https://fluxerstatic.com" - - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES - value: "128" - - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES - value: "1048576" - image: fluxer-gateway - hotpatch: - enabled: true - cassandraHosts: int.flx-nyc-db1.srv.fluxer.dev - cassandraPort: 9041 - cassandraKeyspace: fluxer - pollIntervalMs: 5000 - startupSyncTimeoutMs: 30000 - publicKeysSecret: - name: fluxer-gateway-hotpatch-public-keys - key: public_keys - cassandraCredentialsSecret: - name: fluxer-runtime-env-shared - usernameKey: FLUXER_CASSANDRA_USERNAME - passwordKey: FLUXER_CASSANDRA_PASSWORD - livenessProbe: - timeoutSeconds: 5 - minReadySeconds: 0 - nodeSelector: null - port: 8080 - preStopDrain: - enabled: true - retryCount: 6 - retryIntervalSeconds: 1 - sleepSeconds: 30 - timeoutSeconds: 2 - preserveLiveReplicas: false - readinessProbe: - execEnabled: true - failureThreshold: 3 - initialDelaySeconds: 5 - path: /_health/ready - periodSeconds: 5 - timeoutSeconds: 5 - replicas: 16 - resources: - limits: - memory: 16Gi - requests: - cpu: 500m - memory: 512Mi - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 - startupProbe: - enabled: true - failureThreshold: 30 - initialDelaySeconds: 0 - path: /_health - periodSeconds: 5 - timeoutSeconds: 5 - tag: "" - terminationGracePeriodSeconds: 45 - tolerations: - - effect: NoSchedule - key: dedicated - operator: Equal - value: gateway -roles: - enabled: true - websocket: - role: websocket - common: - nodeSelector: null - resources: - requests: - cpu: 500m - memory: 768Mi - limits: - memory: 12Gi - affinity: - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 60 - preference: - matchExpressions: - - key: node.kubernetes.io/instance-type - operator: In - values: - - vhf-16c-58gb - sessions: - enabled: true - replicas: 12 - resources: - requests: - cpu: 750m - memory: 2Gi - limits: - memory: 16Gi - presence: - enabled: true - replicas: 6 - resources: - requests: - cpu: 500m - memory: 768Mi - limits: - memory: 6Gi - guilds: - enabled: true - replicas: 12 - resources: - requests: - cpu: 750m - memory: 1Gi - limits: - memory: 8Gi - calls: - enabled: true - replicas: 4 - resources: - requests: - cpu: 500m - memory: 512Mi - limits: - memory: 4Gi - push: - enabled: true - replicas: 4 - resources: - requests: - cpu: 500m - memory: 512Mi - limits: - memory: 4Gi -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-shared -pdb: - enabled: false - minAvailable: 1 diff --git a/deploy/helm/gateway/values.yaml b/deploy/helm/gateway/values.yaml deleted file mode 100644 index bd2b637ac..000000000 --- a/deploy/helm/gateway/values.yaml +++ /dev/null @@ -1,118 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -gateway: - image: fluxer-gateway - tag: '' - replicas: 1 - preserveLiveReplicas: false - port: 8080 - rollingUpdate: - maxSurge: 0 - maxUnavailable: 1 - minReadySeconds: 0 - terminationGracePeriodSeconds: 45 - readinessProbe: - path: /_health/ready - execEnabled: true - timeoutSeconds: 5 - initialDelaySeconds: 5 - periodSeconds: 5 - failureThreshold: 3 - livenessProbe: - timeoutSeconds: 5 - startupProbe: - enabled: true - path: /_health - initialDelaySeconds: 0 - periodSeconds: 5 - failureThreshold: 30 - timeoutSeconds: 5 - preStopDrain: - enabled: true - sleepSeconds: 30 - timeoutSeconds: 2 - retryCount: 6 - retryIntervalSeconds: 1 - nodeSelector: - kubernetes.io/hostname: flx-nyc-k8s-worker-efd1167e6219 - tolerations: - - key: dedicated - operator: Equal - value: gateway - effect: NoSchedule - resources: - requests: - cpu: 500m - memory: 512Mi - limits: - memory: 16Gi - env: - - name: FLUXER_GATEWAY_STATIC_CDN_ENDPOINT - value: "https://fluxerstatic.com" - - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_ENTRIES - value: "128" - - name: FLUXER_GATEWAY_PRESENCE_PUSH_BUFFER_MAX_BYTES - value: "1048576" - hotpatch: - enabled: false - cassandraHosts: '' - cassandraPort: 9042 - cassandraKeyspace: fluxer - pollIntervalMs: 5000 - startupSyncTimeoutMs: 30000 - publicKeysSecret: - name: '' - key: public_keys - cassandraCredentialsSecret: - name: '' - usernameKey: username - passwordKey: password - -cluster: - enabled: false - discoveryDnsName: '' - discoveryNodeBasename: fluxer_gateway - discoveryPollIntervalMs: 5000 - erlangDistribution: - port: 8081 - epmdPort: 4369 - erlangCookieSecret: - name: fluxer-gateway-erlang-cookie - key: cookie - -roles: - enabled: false - websocket: - role: websocket - common: - replicas: 1 - resources: - requests: - cpu: 500m - memory: 512Mi - limits: - memory: 8Gi - sessions: - enabled: true - replicas: 1 - presence: - enabled: true - replicas: 1 - guilds: - enabled: true - replicas: 1 - calls: - enabled: true - replicas: 1 - push: - enabled: true - replicas: 1 - -pdb: - enabled: false - minAvailable: 1 diff --git a/deploy/helm/gifs/Chart.yaml b/deploy/helm/gifs/Chart.yaml deleted file mode 100644 index 83ec10cf1..000000000 --- a/deploy/helm/gifs/Chart.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: gifs -version: 0.1.0 -dependencies: - - name: svc-common - version: 0.1.0 - repository: file://../svc-common diff --git a/deploy/helm/gifs/templates/all.yaml b/deploy/helm/gifs/templates/all.yaml deleted file mode 100644 index 7aed1e82f..000000000 --- a/deploy/helm/gifs/templates/all.yaml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{ include "svc-common.statefulset" . }} ---- -{{ include "svc-common.deployment" . }} ---- -{{ include "svc-common.headless-service" . }} ---- -{{ include "svc-common.service" . }} ---- -{{ include "svc-common.pdb" . }} ---- -{{ include "svc-common.router-pdb" . }} diff --git a/deploy/helm/gifs/values.prod.yaml b/deploy/helm/gifs/values.prod.yaml deleted file mode 100644 index 77f8ffed9..000000000 --- a/deploy/helm/gifs/values.prod.yaml +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -svc: - shard: - replicas: 4 - resources: - requests: - cpu: 100m - memory: 512Mi - limits: - memory: 1Gi - router: - replicas: 3 - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - cache: - maxEntries: 500000 - ttlMs: '30000' - extraEnv: - - name: FLUXER_MEDIA_PROXY_ENDPOINT - value: http://media-proxy:8080 - - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT - value: https://fluxerusercontent.com - - name: FLUXER_MEDIA_PROXY_SECRET_KEY - valueFrom: - secretKeyRef: - name: fluxer-media-proxy-v2-env - key: FLUXER_MEDIA_PROXY_SECRET_KEY diff --git a/deploy/helm/gifs/values.yaml b/deploy/helm/gifs/values.yaml deleted file mode 100644 index 52f682f99..000000000 --- a/deploy/helm/gifs/values.yaml +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -svc: - name: gifs - image: fluxer-gifs - tag: '' - shard: - replicas: 2 - port: 8090 - minReadySeconds: 10 - terminationGracePeriodSeconds: 60 - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - router: - replicas: 2 - port: 8090 - minReadySeconds: 10 - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 60 - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - memory: 256Mi - nats: - url: nats://nats-core:4222 - cache: - maxEntries: 250000 - ttlMs: '30000' - extraEnv: - - name: FLUXER_MEDIA_PROXY_ENDPOINT - value: http://media-proxy:8080 - - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT - value: https://fluxerusercontent.com - - name: FLUXER_MEDIA_PROXY_SECRET_KEY - valueFrom: - secretKeyRef: - name: fluxer-media-proxy-v2-env - key: FLUXER_MEDIA_PROXY_SECRET_KEY - nodeSelector: {} - tolerations: [] - -pdb: - minAvailable: '50%' diff --git a/deploy/helm/infra/Chart.yaml b/deploy/helm/infra/Chart.yaml deleted file mode 100644 index 3f3390f24..000000000 --- a/deploy/helm/infra/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: infra -description: Fluxer infrastructure (NATS, Valkey, Ingress) -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/infra/templates/geoip-sync-cronjob.yaml b/deploy/helm/infra/templates/geoip-sync-cronjob.yaml deleted file mode 100644 index 8c7c47fa6..000000000 --- a/deploy/helm/infra/templates/geoip-sync-cronjob.yaml +++ /dev/null @@ -1,133 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Daily sync of the MaxMind GeoLite2 City and ASN MMDB files into S3. -# Runtime services read these out of the CDN bucket. Adopted into helm -# from a previously hand-applied kubectl manifest. - -apiVersion: batch/v1 -kind: CronJob -metadata: - name: geoip-sync - namespace: {{ .Values.global.namespace }} - labels: - app.kubernetes.io/name: geoip-sync - {{- include "fluxer.labels" . | nindent 4 }} -spec: - schedule: {{ .Values.geoipSync.schedule | quote }} - concurrencyPolicy: Forbid - successfulJobsHistoryLimit: 1 - failedJobsHistoryLimit: 3 - jobTemplate: - spec: - activeDeadlineSeconds: {{ .Values.geoipSync.activeDeadlineSeconds }} - backoffLimit: {{ .Values.geoipSync.backoffLimit }} - template: - metadata: - labels: - app.kubernetes.io/name: geoip-sync - app.kubernetes.io/part-of: fluxer - spec: - restartPolicy: OnFailure - terminationGracePeriodSeconds: 60 - imagePullSecrets: - - name: {{ .Values.global.imagePullSecret }} - containers: - - name: sync - image: {{ .Values.geoipSync.image }} - imagePullPolicy: IfNotPresent - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - runAsUser: 1000 - runAsGroup: 1000 - capabilities: - drop: ["ALL"] - seccompProfile: - type: RuntimeDefault - env: - - name: GEOIP_BUCKET - value: {{ .Values.geoipSync.bucket | quote }} - - name: GEOIP_CITY_UPSTREAM_URL - value: {{ .Values.geoipSync.cityUpstreamUrl | quote }} - - name: GEOIP_ASN_UPSTREAM_URL - value: {{ .Values.geoipSync.asnUpstreamUrl | quote }} - envFrom: - - secretRef: - name: {{ .Values.geoipSync.envSecret }} - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - command: - - sh - - -c - - | - set -eu - - : "${GEOIP_BUCKET:?missing GEOIP_BUCKET}" - : "${GEOIP_CITY_UPSTREAM_URL:?missing GEOIP_CITY_UPSTREAM_URL}" - : "${GEOIP_ASN_UPSTREAM_URL:?missing GEOIP_ASN_UPSTREAM_URL}" - : "${FLUXER_S3_ACCESS_KEY_ID:?missing FLUXER_S3_ACCESS_KEY_ID}" - : "${FLUXER_S3_SECRET_ACCESS_KEY:?missing FLUXER_S3_SECRET_ACCESS_KEY}" - : "${FLUXER_S3_ENDPOINT:?missing FLUXER_S3_ENDPOINT}" - : "${FLUXER_S3_REGION:?missing FLUXER_S3_REGION}" - - export AWS_ACCESS_KEY_ID="$FLUXER_S3_ACCESS_KEY_ID" - export AWS_SECRET_ACCESS_KEY="$FLUXER_S3_SECRET_ACCESS_KEY" - export AWS_DEFAULT_REGION="$FLUXER_S3_REGION" - - WORKDIR=$(mktemp -d) - trap 'rm -rf "$WORKDIR"' EXIT - - # MMDB files end with the ASCII string "MaxMind.com" after - # their metadata marker. Verifying this tail before upload - # catches the case where an upstream returns an HTML error - # page or a zero-byte body. - fetch_and_verify() { - local url="$1" - local dest="$2" - echo "-> fetching $url" - curl --fail --location --silent --show-error \ - --user-agent 'fluxer-geoip-sync/1.0' \ - --max-time 120 \ - --output "$dest" \ - "$url" - local size - size=$(wc -c < "$dest") - if [ "$size" -lt 1024 ]; then - echo "refusing to upload ${dest}: file is ${size} bytes, too small" >&2 - return 1 - fi - if ! tail -c 2048 "$dest" | grep -q "MaxMind.com"; then - echo "refusing to upload ${dest}: MaxMind.com marker not found in trailer" >&2 - return 1 - fi - echo " ok (${size} bytes)" - } - - fetch_and_verify "$GEOIP_CITY_UPSTREAM_URL" "$WORKDIR/GeoLite2-City.mmdb" - fetch_and_verify "$GEOIP_ASN_UPSTREAM_URL" "$WORKDIR/GeoLite2-ASN.mmdb" - - # Atomic-ish replacement: upload to a versioned side-key - # first, then copy to the canonical key. If the final copy - # fails the previous canonical file is untouched. - STAMP=$(date -u +%Y%m%dT%H%M%SZ) - - aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \ - "$WORKDIR/GeoLite2-City.mmdb" \ - "s3://${GEOIP_BUCKET}/archive/GeoLite2-City-${STAMP}.mmdb" - aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \ - "$WORKDIR/GeoLite2-ASN.mmdb" \ - "s3://${GEOIP_BUCKET}/archive/GeoLite2-ASN-${STAMP}.mmdb" - - aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \ - "$WORKDIR/GeoLite2-City.mmdb" \ - "s3://${GEOIP_BUCKET}/GeoLite2-City.mmdb" - aws --endpoint-url "$FLUXER_S3_ENDPOINT" s3 cp \ - "$WORKDIR/GeoLite2-ASN.mmdb" \ - "s3://${GEOIP_BUCKET}/GeoLite2-ASN.mmdb" - - echo "geoip-sync complete: city=${STAMP} asn=${STAMP}" diff --git a/deploy/helm/infra/templates/ingress.yaml b/deploy/helm/infra/templates/ingress.yaml deleted file mode 100644 index 3c6a4fde1..000000000 --- a/deploy/helm/infra/templates/ingress.yaml +++ /dev/null @@ -1,278 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{ $hosts := .Values.ingress.hosts -}} -{{ $ports := .Values.ports -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: fluxer-ingress - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - annotations: - nginx.ingress.kubernetes.io/proxy-body-size: "50m" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/proxy-send-timeout: "300" - nginx.ingress.kubernetes.io/ssl-redirect: "false" -spec: - ingressClassName: {{ .Values.ingress.className }} - rules: - - host: {{ $hosts.api }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: api - port: - number: {{ $ports.api }} - - - host: {{ $hosts.apiCanary }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: api-canary - port: - number: {{ $ports.apiCanary }} - - - host: {{ $hosts.appProxy }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: app-proxy - port: - number: {{ $ports.appProxy }} - - - host: {{ $hosts.appProxyCanary }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: app-proxy-canary - port: - number: {{ $ports.appProxyCanary }} - - - host: {{ $hosts.admin }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: admin - port: - number: {{ $ports.admin }} - - - host: {{ $hosts.adminCanary }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: admin-canary - port: - number: {{ $ports.adminCanary }} - - - host: {{ $hosts.marketing }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: marketing - port: - number: {{ $ports.marketing }} - -{{- with $hosts.help }} - - host: {{ . }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: marketing - port: - number: {{ $ports.marketing }} - -{{- end }} -{{- with $hosts.blog }} - - host: {{ . }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: marketing - port: - number: {{ $ports.marketing }} - -{{- end }} -{{- with $hosts.docs }} - - host: {{ . }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: docs - port: - number: {{ $ports.docs }} - -{{- end }} -{{- range $hosts.marketingAliases }} - - host: {{ . }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: marketing - port: - number: {{ $ports.marketing }} - -{{- end }} - - host: {{ $hosts.marketingCanary }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: marketing-canary - port: - number: {{ $ports.marketingCanary }} - - - host: {{ $hosts.mediaProxy }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: media-proxy - port: - number: {{ $ports.mediaProxy }} - - - host: {{ $hosts.staticProxy }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: static-proxy - port: - number: {{ $ports.staticProxy }} - ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: fluxer-ingress-gateway - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - annotations: - nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" - nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr" - nginx.ingress.kubernetes.io/websocket-services: gateway -spec: - ingressClassName: {{ .Values.ingress.className }} - rules: - - host: {{ $hosts.gateway }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: gateway - port: - number: {{ $ports.gateway }} - ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: fluxer-ingress-api-proxy - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - annotations: - nginx.ingress.kubernetes.io/proxy-body-size: "50m" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/proxy-send-timeout: "300" - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/use-regex: "true" - nginx.ingress.kubernetes.io/rewrite-target: /$2 -spec: - ingressClassName: {{ .Values.ingress.className }} - rules: - - host: {{ $hosts.appProxy }} - http: - paths: - - path: /api(/|$)(.*) - pathType: ImplementationSpecific - backend: - service: - name: api - port: - number: {{ $ports.api }} - - - host: {{ $hosts.appProxyCanary }} - http: - paths: - - path: /api(/|$)(.*) - pathType: ImplementationSpecific - backend: - service: - name: api-canary - port: - number: {{ $ports.apiCanary }} ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: fluxer-ingress-uploads - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - annotations: - nginx.ingress.kubernetes.io/proxy-body-size: "500m" - nginx.ingress.kubernetes.io/proxy-request-buffering: "off" - nginx.ingress.kubernetes.io/proxy-buffering: "off" - nginx.ingress.kubernetes.io/proxy-read-timeout: "900" - nginx.ingress.kubernetes.io/proxy-send-timeout: "900" - nginx.ingress.kubernetes.io/client-body-buffer-size: "1m" - nginx.ingress.kubernetes.io/ssl-redirect: "false" -spec: - ingressClassName: {{ .Values.ingress.className }} - rules: - - - host: {{ $hosts.uploads }} - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: uploads - port: - number: {{ $ports.uploads }} diff --git a/deploy/helm/infra/templates/nats-configmap.yaml b/deploy/helm/infra/templates/nats-configmap.yaml deleted file mode 100644 index 4f7f0943c..000000000 --- a/deploy/helm/infra/templates/nats-configmap.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v1 -kind: ConfigMap -metadata: - name: nats-config - namespace: {{.Values.global.namespace}} - labels: {{- include "fluxer.labels" . | nindent 4}} -data: - nats.conf: | - listen: 0.0.0.0:{{ .Values.nats.clientPort }} - http: 0.0.0.0:{{ .Values.nats.monitorPort }} - max_payload: {{ .Values.nats.maxPayload | default "64MB" }} - max_pending: {{ .Values.nats.maxPending | default "128MB" }} - max_connections: {{ .Values.nats.maxConnections | default 2048 }} - - cluster { - name: fluxer-nats - listen: 0.0.0.0:{{ .Values.nats.clusterPort }} - - routes = [ - {{- range $i := until (int .Values.nats.replicas) }} - nats-route://nats-{{ $i }}.nats-headless.{{ $.Values.global.namespace }}.svc.cluster.local:{{ $.Values.nats.clusterPort }} - {{- end }} - ] - } diff --git a/deploy/helm/infra/templates/nats-service.yaml b/deploy/helm/infra/templates/nats-service.yaml deleted file mode 100644 index 6bba7aee8..000000000 --- a/deploy/helm/infra/templates/nats-service.yaml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v1 -kind: Service -metadata: - name: nats-headless - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - app.kubernetes.io/name: nats -spec: - type: ClusterIP - clusterIP: None - ports: - - name: client - port: {{ .Values.nats.clientPort }} - targetPort: client - - name: cluster - port: {{ .Values.nats.clusterPort }} - targetPort: cluster - - name: monitor - port: {{ .Values.nats.monitorPort }} - targetPort: monitor - selector: - app.kubernetes.io/name: nats - app.kubernetes.io/instance: {{ .Release.Name }} ---- -apiVersion: v1 -kind: Service -metadata: - name: nats-core - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - app.kubernetes.io/name: nats -spec: - type: ClusterIP - ports: - - name: client - port: {{ .Values.nats.clientPort }} - targetPort: client - selector: - app.kubernetes.io/name: nats - app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/deploy/helm/infra/templates/nats-statefulset.yaml b/deploy/helm/infra/templates/nats-statefulset.yaml deleted file mode 100644 index 40c1f62f3..000000000 --- a/deploy/helm/infra/templates/nats-statefulset.yaml +++ /dev/null @@ -1,63 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: nats - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - app.kubernetes.io/name: nats -spec: - serviceName: nats-headless - replicas: {{ .Values.nats.replicas }} - selector: - matchLabels: - app.kubernetes.io/name: nats - app.kubernetes.io/instance: {{ .Release.Name }} - template: - metadata: - labels: - {{- include "fluxer.labels" . | nindent 8 }} - app.kubernetes.io/name: nats - app.kubernetes.io/instance: {{ .Release.Name }} - annotations: - checksum/config: {{ include (print $.Template.BasePath "/nats-configmap.yaml") . | sha256sum }} - spec: - terminationGracePeriodSeconds: 30 - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - containers: - - name: nats - image: {{ .Values.nats.image }}:{{ .Values.nats.tag }} - args: ["-c", "/etc/nats/nats.conf"] - ports: - - name: client - containerPort: {{ .Values.nats.clientPort }} - - name: cluster - containerPort: {{ .Values.nats.clusterPort }} - - name: monitor - containerPort: {{ .Values.nats.monitorPort }} - livenessProbe: - httpGet: - path: /healthz - port: monitor - initialDelaySeconds: 5 - periodSeconds: 10 - readinessProbe: - httpGet: - path: /healthz?js-enabled-only=true - port: monitor - initialDelaySeconds: 5 - periodSeconds: 5 - volumeMounts: - - name: config - mountPath: /etc/nats - resources: - {{- toYaml .Values.nats.resources | nindent 12 }} - volumes: - - name: config - configMap: - name: nats-config diff --git a/deploy/helm/infra/templates/pdb.yaml b/deploy/helm/infra/templates/pdb.yaml deleted file mode 100644 index ed6f4869b..000000000 --- a/deploy/helm/infra/templates/pdb.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: nats-pdb - namespace: {{.Values.global.namespace}} - labels: {{- include "fluxer.labels" . | nindent 4}} -spec: - minAvailable: 2 - selector: - matchLabels: - app.kubernetes.io/name: nats - app.kubernetes.io/instance: {{.Release.Name}} diff --git a/deploy/helm/infra/templates/valkey-service.yaml b/deploy/helm/infra/templates/valkey-service.yaml deleted file mode 100644 index b772d9dd3..000000000 --- a/deploy/helm/infra/templates/valkey-service.yaml +++ /dev/null @@ -1,39 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v1 -kind: Service -metadata: - name: valkey-headless - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - app.kubernetes.io/name: valkey -spec: - type: ClusterIP - clusterIP: None - publishNotReadyAddresses: true - ports: - - name: valkey - port: {{ .Values.valkey.port }} - targetPort: valkey - selector: - app.kubernetes.io/name: valkey - app.kubernetes.io/instance: {{ .Release.Name }} ---- -apiVersion: v1 -kind: Service -metadata: - name: valkey - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - app.kubernetes.io/name: valkey -spec: - type: ClusterIP - ports: - - name: valkey - port: {{ .Values.valkey.port }} - targetPort: valkey - selector: - app.kubernetes.io/name: valkey - app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/deploy/helm/infra/templates/valkey-statefulset.yaml b/deploy/helm/infra/templates/valkey-statefulset.yaml deleted file mode 100644 index b79be62db..000000000 --- a/deploy/helm/infra/templates/valkey-statefulset.yaml +++ /dev/null @@ -1,60 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: valkey - namespace: {{ .Values.global.namespace }} - labels: - {{- include "fluxer.labels" . | nindent 4 }} - app.kubernetes.io/name: valkey -spec: - serviceName: valkey-headless - replicas: {{ .Values.valkey.replicas }} - selector: - matchLabels: - app.kubernetes.io/name: valkey - app.kubernetes.io/instance: {{ .Release.Name }} - template: - metadata: - labels: - {{- include "fluxer.labels" . | nindent 8 }} - app.kubernetes.io/name: valkey - app.kubernetes.io/instance: {{ .Release.Name }} - spec: - terminationGracePeriodSeconds: 15 - securityContext: - runAsNonRoot: true - runAsUser: 999 - runAsGroup: 1000 - fsGroup: 1000 - seccompProfile: - type: RuntimeDefault - containers: - - name: valkey - image: {{ .Values.valkey.image }}:{{ .Values.valkey.tag }} - command: - - valkey-server - - --save - - "" - - --appendonly - - "no" - - --maxmemory - - {{ .Values.valkey.maxmemory | quote }} - - --maxmemory-policy - - allkeys-lru - ports: - - name: valkey - containerPort: {{ .Values.valkey.port }} - livenessProbe: - exec: - command: ["valkey-cli", "ping"] - initialDelaySeconds: 5 - periodSeconds: 10 - readinessProbe: - exec: - command: ["valkey-cli", "ping"] - initialDelaySeconds: 3 - periodSeconds: 5 - resources: - {{- toYaml .Values.valkey.resources | nindent 12 }} diff --git a/deploy/helm/infra/values.prod.yaml b/deploy/helm/infra/values.prod.yaml deleted file mode 100644 index 4345b55d9..000000000 --- a/deploy/helm/infra/values.prod.yaml +++ /dev/null @@ -1,74 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the infra release as of 2026-05-17T20:42:44Z. -# Captured via: helm -n fluxer get values infra -# Apply with: helm upgrade infra deploy/helm/infra -f deploy/helm/infra/values.yaml -f deploy/helm/infra/values.prod.yaml - -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" -ingress: - className: nginx - hosts: - admin: admin.fluxer.app - adminCanary: admin.canary.fluxer.app - api: api.fluxer.app - apiCanary: api.canary.fluxer.app - appProxy: web.fluxer.app - appProxyCanary: web.canary.fluxer.app - gateway: gateway.fluxer.app - help: help.fluxer.app - blog: blog.fluxer.app - docs: docs.fluxer.app - marketing: fluxer.app - marketingAliases: - - www.fluxer.app - - fluxerapp.com - - www.fluxerapp.com - - fluxer.gg - - fluxer.gift - - fluxer.dev - - www.fluxer.dev - - every.day.im.fluxer.ing - marketingCanary: canary.fluxer.app - mediaProxy: fluxerusercontent.com - staticProxy: fluxerstatic.com -nats: - clientPort: 4222 - clusterPort: 6222 - image: nats - maxConnections: 2048 - monitorPort: 8222 - replicas: 5 - resources: - limits: - memory: 2Gi - requests: - cpu: 100m - memory: 512Mi - tag: 2-alpine -ports: - admin: 8080 - adminCanary: 8080 - api: 8080 - apiCanary: 8080 - appProxy: 8080 - appProxyCanary: 8080 - gateway: 8080 - marketing: 8080 - marketingCanary: 8080 - docs: 8080 - mediaProxy: 8080 - staticProxy: 8080 -valkey: - image: valkey/valkey - port: 6379 - replicas: 1 - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 128Mi - tag: 8-alpine diff --git a/deploy/helm/infra/values.yaml b/deploy/helm/infra/values.yaml deleted file mode 100644 index 15b3fd042..000000000 --- a/deploy/helm/infra/values.yaml +++ /dev/null @@ -1,91 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -nats: - replicas: 3 - image: nats - tag: 2-alpine - clientPort: 4222 - clusterPort: 6222 - monitorPort: 8222 - maxPayload: 64MB - maxPending: 128MB - maxConnections: 2048 - resources: - requests: - cpu: 100m - memory: 512Mi - limits: - memory: 2Gi - -valkey: - replicas: 1 - image: valkey/valkey - tag: 8-alpine - port: 6379 - maxmemory: 1600mb - resources: - requests: - cpu: 100m - memory: 512Mi - limits: - memory: 2Gi - -ingress: - className: nginx - hosts: - api: api.fluxer.app - apiCanary: api.canary.fluxer.app - appProxy: web.fluxer.app - appProxyCanary: web.canary.fluxer.app - admin: admin.fluxer.app - adminCanary: admin.canary.fluxer.app - marketing: fluxer.app - marketingCanary: canary.fluxer.app - mediaProxy: fluxerusercontent.com - staticProxy: fluxerstatic.com - gateway: gateway.fluxer.app - help: help.fluxer.app - blog: blog.fluxer.app - docs: docs.fluxer.app - marketingAliases: - - www.fluxer.app - - fluxerapp.com - - www.fluxerapp.com - - fluxer.gg - - fluxer.gift - - fluxer.dev - - www.fluxer.dev - - every.day.im.fluxer.ing - uploads: uploads.fluxer.app - -ports: - api: 8080 - apiCanary: 8080 - appProxy: 8080 - appProxyCanary: 8080 - admin: 8080 - adminCanary: 8080 - marketing: 8080 - marketingCanary: 8080 - docs: 8080 - mediaProxy: 8080 - staticProxy: 8080 - gateway: 8080 - uploads: 8080 - -# MaxMind GeoLite2 sync — daily at 05:17 UTC. Runtime services read -# these mmdb files out of the CDN bucket. -geoipSync: - image: amazon/aws-cli:2.17.12 - schedule: '17 5 * * *' - activeDeadlineSeconds: 1800 - backoffLimit: 2 - bucket: fluxer-geoip - cityUpstreamUrl: https://git.io/GeoLite2-City.mmdb - asnUpstreamUrl: https://git.io/GeoLite2-ASN.mmdb - envSecret: fluxer-env-shared diff --git a/deploy/helm/marketing/Chart.yaml b/deploy/helm/marketing/Chart.yaml deleted file mode 100644 index 449dca2ef..000000000 --- a/deploy/helm/marketing/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: marketing -description: Fluxer marketing service -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/marketing/templates/deployment.yaml b/deploy/helm/marketing/templates/deployment.yaml deleted file mode 100644 index 0ecb76d9b..000000000 --- a/deploy/helm/marketing/templates/deployment.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/marketing/templates/pdb.yaml b/deploy/helm/marketing/templates/pdb.yaml deleted file mode 100644 index d3ac0d5b8..000000000 --- a/deploy/helm/marketing/templates/pdb.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}} diff --git a/deploy/helm/marketing/templates/service.yaml b/deploy/helm/marketing/templates/service.yaml deleted file mode 100644 index 60b585760..000000000 --- a/deploy/helm/marketing/templates/service.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/marketing/values.canary.prod.yaml b/deploy/helm/marketing/values.canary.prod.yaml deleted file mode 100644 index 6a69f1d95..000000000 --- a/deploy/helm/marketing/values.canary.prod.yaml +++ /dev/null @@ -1,30 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-marketing-canary release as of 2026-05-17T20:42:39Z. -# Captured via: helm -n fluxer get values fluxer-marketing-canary -# Apply with: helm upgrade fluxer-marketing-canary deploy/helm/marketing -f deploy/helm/marketing/values.yaml -f deploy/helm/marketing/values.canary.prod.yaml - -app: - build: - channel: canary - version: "" - image: fluxer-marketing - name: marketing-canary - port: 8080 - replicas: 2 - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - tag: "" -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-canary -pdb: - minAvailable: 50% diff --git a/deploy/helm/marketing/values.stable.prod.yaml b/deploy/helm/marketing/values.stable.prod.yaml deleted file mode 100644 index 04d50192f..000000000 --- a/deploy/helm/marketing/values.stable.prod.yaml +++ /dev/null @@ -1,30 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-marketing-stable release as of 2026-06-03T19:37:50Z. -# Captured via: helm -n fluxer get values fluxer-marketing-stable -# Apply with: helm upgrade fluxer-marketing-stable deploy/helm/marketing -f deploy/helm/marketing/values.yaml -f deploy/helm/marketing/values.stable.prod.yaml - -app: - build: - channel: stable - version: "" - image: fluxer-marketing - name: marketing - port: 8080 - replicas: 2 - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - tag: "" -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-stable -pdb: - minAvailable: 50% diff --git a/deploy/helm/marketing/values.yaml b/deploy/helm/marketing/values.yaml deleted file mode 100644 index 13ecd5958..000000000 --- a/deploy/helm/marketing/values.yaml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -app: - name: '' - image: '' - tag: '' - replicas: 2 - port: 8080 - config: '' - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - -pdb: - minAvailable: '50%' diff --git a/deploy/helm/media-proxy/Chart.yaml b/deploy/helm/media-proxy/Chart.yaml deleted file mode 100644 index fb2489050..000000000 --- a/deploy/helm/media-proxy/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: media-proxy -description: Fluxer media proxy and static proxy services -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/media-proxy/templates/deployment.yaml b/deploy/helm/media-proxy/templates/deployment.yaml deleted file mode 100644 index 5380fe16c..000000000 --- a/deploy/helm/media-proxy/templates/deployment.yaml +++ /dev/null @@ -1,5 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.deployment" (dict "name" "media-proxy" "values" .Values.mediaProxy "context" .)}} ---- -{{include "fluxer.deployment" (dict "name" "static-proxy" "values" .Values.staticProxy "context" .)}} diff --git a/deploy/helm/media-proxy/templates/pdb.yaml b/deploy/helm/media-proxy/templates/pdb.yaml deleted file mode 100644 index 2402312bb..000000000 --- a/deploy/helm/media-proxy/templates/pdb.yaml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{- range $name, $cfg := .Values.pdb }} -{{- if (dig "enabled" true $cfg) }} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ $name }}-pdb - namespace: {{ $.Values.global.namespace }} - labels: - {{- include "fluxer.labels" $ | nindent 4 }} - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 4 }} -spec: - minAvailable: {{ $cfg.minAvailable | quote }} - selector: - matchLabels: - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $) | nindent 6 }} ---- -{{- end }} -{{- end }} diff --git a/deploy/helm/media-proxy/templates/service.yaml b/deploy/helm/media-proxy/templates/service.yaml deleted file mode 100644 index 3205e1a85..000000000 --- a/deploy/helm/media-proxy/templates/service.yaml +++ /dev/null @@ -1,5 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.service" (dict "name" "media-proxy" "values" .Values.mediaProxy "context" .)}} ---- -{{include "fluxer.service" (dict "name" "static-proxy" "values" .Values.staticProxy "context" .)}} diff --git a/deploy/helm/media-proxy/values.prod.yaml b/deploy/helm/media-proxy/values.prod.yaml deleted file mode 100644 index e68cb866a..000000000 --- a/deploy/helm/media-proxy/values.prod.yaml +++ /dev/null @@ -1,88 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-media-proxy release as of 2026-05-17T20:42:42Z. -# Captured via: helm -n fluxer get values fluxer-media-proxy -# Apply with: helm upgrade fluxer-media-proxy deploy/helm/media-proxy -f deploy/helm/media-proxy/values.yaml -f deploy/helm/media-proxy/values.prod.yaml - -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-shared -mediaProxy: - build: - channel: canary - version: "" - env: - - name: FLUXER_MEDIA_PROXY_MODE - value: mp - - name: FLUXER_MEDIA_PROXY_NSFW_THRESHOLD - value: "0.95" - - name: FLUXER_MEDIA_PROXY_STORAGE_BACKEND - value: s3 - - name: FLUXER_MEDIA_PROXY_READ_ONLY - value: "true" - - name: FLUXER_MEDIA_PROXY_MAX_NATIVE_TRANSFORMS - value: "4" - - name: FLUXER_MEDIA_PROXY_WORKER_QUEUE_CAPACITY - value: "128" - - name: FLUXER_MEDIA_PROXY_TRANSFORM_TIMEOUT_MS - value: "30000" - - name: FLUXER_MEDIA_PROXY_MAX_ENCODE_FRAMES - value: "4096" - - name: FLUXER_MEDIA_PROXY_MAX_ENCODE_DURATION_MS - value: "30000" - - name: FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_BYTES - value: "1073741824" - - name: FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_MAX_ENTRY_BYTES - value: "134217728" - - name: FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_TTL_MS - value: "1800000" - - name: FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS - value: "30000" - image: fluxer-media-proxy - nsfwServiceEndpoint: http://int.flx-nyc-misc1.srv.fluxer.dev:8000 - port: 8080 - preserveLiveReplicas: false - replicas: 16 - resources: - limits: - cpu: 4000m - memory: 4Gi - requests: - cpu: 300m - memory: 768Mi - tag: "" -pdb: - media-proxy: - enabled: true - minAvailable: 50% - static-proxy: - enabled: true - minAvailable: 50% -staticProxy: - build: - channel: canary - version: "" - env: - - name: FLUXER_MEDIA_PROXY_MODE - value: static - - name: FLUXER_MEDIA_PROXY_STORAGE_BACKEND - value: s3 - - name: FLUXER_MEDIA_PROXY_READ_ONLY - value: "true" - - name: FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS - value: "30000" - image: fluxer-media-proxy - port: 8080 - preserveLiveReplicas: false - replicas: 4 - resources: - limits: - memory: 512Mi - requests: - cpu: 50m - memory: 256Mi - tag: "" \ No newline at end of file diff --git a/deploy/helm/media-proxy/values.yaml b/deploy/helm/media-proxy/values.yaml deleted file mode 100644 index 0d470177b..000000000 --- a/deploy/helm/media-proxy/values.yaml +++ /dev/null @@ -1,78 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -mediaProxy: - image: fluxer-media-proxy - tag: "" - replicas: 16 - preserveLiveReplicas: false - port: 8080 - nsfwServiceEndpoint: 'http://int.flx-nyc-misc1.srv.fluxer.dev:8000' - env: - - name: FLUXER_MEDIA_PROXY_MODE - value: mp - - name: FLUXER_MEDIA_PROXY_NSFW_THRESHOLD - value: '0.95' - - name: FLUXER_MEDIA_PROXY_STORAGE_BACKEND - value: s3 - - name: FLUXER_MEDIA_PROXY_READ_ONLY - value: 'true' - - name: FLUXER_MEDIA_PROXY_MAX_NATIVE_TRANSFORMS - value: '4' - - name: FLUXER_MEDIA_PROXY_WORKER_QUEUE_CAPACITY - value: '128' - - name: FLUXER_MEDIA_PROXY_TRANSFORM_TIMEOUT_MS - value: '30000' - - name: FLUXER_MEDIA_PROXY_MAX_ENCODE_FRAMES - value: '4096' - - name: FLUXER_MEDIA_PROXY_MAX_ENCODE_DURATION_MS - value: '30000' - - name: FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_BYTES - value: '1073741824' - - name: FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_MAX_ENTRY_BYTES - value: '134217728' - - name: FLUXER_MEDIA_PROXY_TRANSFORM_CACHE_TTL_MS - value: '1800000' - - name: FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS - value: '30000' - resources: - requests: - cpu: 300m - memory: 768Mi - limits: - cpu: 4000m - memory: 4Gi - -staticProxy: - image: fluxer-media-proxy - tag: "" - replicas: 4 - preserveLiveReplicas: false - port: 8080 - env: - - name: FLUXER_MEDIA_PROXY_MODE - value: static - - name: FLUXER_MEDIA_PROXY_STORAGE_BACKEND - value: s3 - - name: FLUXER_MEDIA_PROXY_READ_ONLY - value: 'true' - - name: FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS - value: '30000' - resources: - requests: - cpu: 50m - memory: 256Mi - limits: - memory: 512Mi - -pdb: - media-proxy: - enabled: true - minAvailable: '50%' - static-proxy: - enabled: true - minAvailable: '50%' diff --git a/deploy/helm/messages/Chart.yaml b/deploy/helm/messages/Chart.yaml deleted file mode 100644 index b7ba5cea9..000000000 --- a/deploy/helm/messages/Chart.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: messages -version: 0.1.0 -dependencies: - - name: svc-common - version: 0.1.0 - repository: file://../svc-common diff --git a/deploy/helm/messages/templates/all.yaml b/deploy/helm/messages/templates/all.yaml deleted file mode 100644 index 7aed1e82f..000000000 --- a/deploy/helm/messages/templates/all.yaml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{ include "svc-common.statefulset" . }} ---- -{{ include "svc-common.deployment" . }} ---- -{{ include "svc-common.headless-service" . }} ---- -{{ include "svc-common.service" . }} ---- -{{ include "svc-common.pdb" . }} ---- -{{ include "svc-common.router-pdb" . }} diff --git a/deploy/helm/messages/values.prod.yaml b/deploy/helm/messages/values.prod.yaml deleted file mode 100644 index b5810c0cb..000000000 --- a/deploy/helm/messages/values.prod.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -svc: - shard: - replicas: 4 - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - router: - replicas: 8 - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - memory: 256Mi - cassandra: - hosts: - - int.flx-nyc-db1.srv.fluxer.dev:9041 - credentialsSecret: fluxer-cassandra-credentials - cache: - maxEntries: 250000 - ttlMs: 30000 diff --git a/deploy/helm/messages/values.yaml b/deploy/helm/messages/values.yaml deleted file mode 100644 index 98885365d..000000000 --- a/deploy/helm/messages/values.yaml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -svc: - name: messages - image: fluxer-messages - tag: '' - shard: - replicas: 4 - port: 8090 - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - memory: 256Mi - router: - replicas: 2 - port: 8090 - resources: - requests: - cpu: 100m - memory: 64Mi - limits: - memory: 128Mi - nats: - url: nats://nats-core:4222 - cassandra: - hosts: - - cassandra:9042 - keyspace: fluxer - cache: - maxEntries: 100000 - ttlMs: 30000 - extraEnv: [] - nodeSelector: {} - tolerations: [] - -pdb: - minAvailable: '50%' diff --git a/deploy/helm/snowflakes/Chart.yaml b/deploy/helm/snowflakes/Chart.yaml deleted file mode 100644 index 7442ca78e..000000000 --- a/deploy/helm/snowflakes/Chart.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: snowflakes -version: 0.1.0 -dependencies: - - name: svc-common - version: 0.1.0 - repository: file://../svc-common diff --git a/deploy/helm/snowflakes/templates/all.yaml b/deploy/helm/snowflakes/templates/all.yaml deleted file mode 100644 index 7aed1e82f..000000000 --- a/deploy/helm/snowflakes/templates/all.yaml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{ include "svc-common.statefulset" . }} ---- -{{ include "svc-common.deployment" . }} ---- -{{ include "svc-common.headless-service" . }} ---- -{{ include "svc-common.service" . }} ---- -{{ include "svc-common.pdb" . }} ---- -{{ include "svc-common.router-pdb" . }} diff --git a/deploy/helm/snowflakes/values.prod.yaml b/deploy/helm/snowflakes/values.prod.yaml deleted file mode 100644 index 1304e41d4..000000000 --- a/deploy/helm/snowflakes/values.prod.yaml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -svc: - shard: - replicas: 4 - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - memory: 256Mi - router: - replicas: 3 - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - memory: 256Mi - maxConcurrentRequests: 256 diff --git a/deploy/helm/snowflakes/values.yaml b/deploy/helm/snowflakes/values.yaml deleted file mode 100644 index f6574c5d3..000000000 --- a/deploy/helm/snowflakes/values.yaml +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -svc: - name: snowflakes - image: fluxer-snowflakes - tag: '' - shard: - replicas: 4 - port: 8090 - resources: - requests: - cpu: 100m - memory: 64Mi - limits: - memory: 128Mi - router: - replicas: 2 - port: 8090 - resources: - requests: - cpu: 100m - memory: 64Mi - limits: - memory: 128Mi - nats: - url: nats://nats-core:4222 - cache: - maxEntries: 100000 - ttlMs: 30000 - maxConcurrentRequests: 128 - extraEnv: [] - nodeSelector: {} - tolerations: [] - -pdb: - minAvailable: '50%' diff --git a/deploy/helm/svc-common/Chart.yaml b/deploy/helm/svc-common/Chart.yaml deleted file mode 100644 index 9d5806741..000000000 --- a/deploy/helm/svc-common/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: svc-common -type: library -version: 0.1.0 -description: Shared templates for fluxer microservice fleet diff --git a/deploy/helm/svc-common/templates/_deployment.tpl b/deploy/helm/svc-common/templates/_deployment.tpl deleted file mode 100644 index 25cb96476..000000000 --- a/deploy/helm/svc-common/templates/_deployment.tpl +++ /dev/null @@ -1,96 +0,0 @@ -{{/* -SPDX-License-Identifier: AGPL-3.0-or-later -*/}} - -{{- define "svc-common.deployment" -}} -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ .Values.svc.name }} - namespace: {{ .Values.global.namespace }} - labels: - {{- include "svc-common.labels" . | nindent 4 }} -spec: - replicas: {{ .Values.svc.router.replicas }} - minReadySeconds: {{ default 10 .Values.svc.router.minReadySeconds }} - selector: - matchLabels: - app: {{ .Values.svc.name }} - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: {{ default 1 .Values.svc.router.maxSurge }} - maxUnavailable: {{ default 0 .Values.svc.router.maxUnavailable }} - template: - metadata: - labels: - app: {{ .Values.svc.name }} - {{- include "svc-common.labels" . | nindent 8 }} - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "{{ .Values.svc.router.port }}" - prometheus.io/path: "/_metrics" - spec: - terminationGracePeriodSeconds: {{ default 60 .Values.svc.router.terminationGracePeriodSeconds }} - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - containers: - - name: router - image: {{ include "svc-common.image" . }} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - ports: - - name: http - containerPort: {{ .Values.svc.router.port }} - env: - - name: FLUXER_SVC_MODE - value: "router" - - name: FLUXER_SVC_NAME - value: {{ .Values.svc.name }} - - name: FLUXER_SVC_SHARD_COUNT - value: {{ .Values.svc.shard.replicas | quote }} - - name: FLUXER_SVC_PORT - value: {{ .Values.svc.router.port | quote }} - - name: FLUXER_SVC_NATS_URL - value: {{ .Values.svc.nats.url }} - - name: FLUXER_SVC_CACHE_MAX_ENTRIES - value: {{ .Values.svc.cache.maxEntries | quote }} - - name: FLUXER_SVC_CACHE_TTL_MS - value: {{ .Values.svc.cache.ttlMs | quote }} - {{- if .Values.svc.build }} - - name: BUILD_VERSION - value: {{ .Values.svc.build.version | default .Values.svc.tag | quote }} - - name: RELEASE_CHANNEL - value: {{ .Values.svc.build.channel | default "stable" | quote }} - {{- end }} - {{- range .Values.svc.extraEnv }} - - name: {{ .name }} - {{- if .valueFrom }} - valueFrom: - {{- toYaml .valueFrom | nindent 16 }} - {{- else }} - value: {{ .value | quote }} - {{- end }} - {{- end }} - readinessProbe: - httpGet: - path: /_health - port: http - initialDelaySeconds: 1 - periodSeconds: 5 - livenessProbe: - httpGet: - path: /_healthz - port: http - initialDelaySeconds: 2 - periodSeconds: 15 - resources: - {{- toYaml .Values.svc.router.resources | nindent 12 }} - {{- if .Values.global.imagePullSecret }} - imagePullSecrets: - - name: {{ .Values.global.imagePullSecret }} - {{- end }} -{{- end -}} diff --git a/deploy/helm/svc-common/templates/_headless-service.tpl b/deploy/helm/svc-common/templates/_headless-service.tpl deleted file mode 100644 index e7d074793..000000000 --- a/deploy/helm/svc-common/templates/_headless-service.tpl +++ /dev/null @@ -1,19 +0,0 @@ -{{/* -SPDX-License-Identifier: AGPL-3.0-or-later -*/}} - -{{- define "svc-common.headless-service" -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ .Values.svc.name }}-shard-headless - namespace: {{ .Values.global.namespace }} -spec: - clusterIP: None - publishNotReadyAddresses: true - selector: - app: {{ .Values.svc.name }}-shard - ports: - - port: {{ .Values.svc.shard.port }} - name: http -{{- end -}} diff --git a/deploy/helm/svc-common/templates/_helpers.tpl b/deploy/helm/svc-common/templates/_helpers.tpl deleted file mode 100644 index 17a109584..000000000 --- a/deploy/helm/svc-common/templates/_helpers.tpl +++ /dev/null @@ -1,30 +0,0 @@ -{{/* -SPDX-License-Identifier: AGPL-3.0-or-later -*/}} - -{{/* -Standard labels for all resources. -*/}} -{{- define "svc-common.labels" -}} -app.kubernetes.io/name: {{ .Values.svc.name }} -app.kubernetes.io/instance: {{ .Release.Name }} -app.kubernetes.io/version: {{ .Values.svc.tag | default .Chart.AppVersion | quote }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Selector labels (subset of standard labels). -*/}} -{{- define "svc-common.selectorLabels" -}} -app.kubernetes.io/name: {{ .Values.svc.name }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end -}} - -{{/* -Construct full image path from registry + image name + tag. -*/}} -{{- define "svc-common.image" -}} -{{- $registry := required "global.registry is required" .Values.global.registry -}} -{{- $tag := required (printf "svc.tag is required (image: %s)" .Values.svc.image) .Values.svc.tag -}} -{{ $registry }}/{{ .Values.svc.image }}:{{ $tag }} -{{- end -}} diff --git a/deploy/helm/svc-common/templates/_pdb.tpl b/deploy/helm/svc-common/templates/_pdb.tpl deleted file mode 100644 index 51b6aa64a..000000000 --- a/deploy/helm/svc-common/templates/_pdb.tpl +++ /dev/null @@ -1,29 +0,0 @@ -{{/* -SPDX-License-Identifier: AGPL-3.0-or-later -*/}} - -{{- define "svc-common.pdb" -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ .Values.svc.name }}-shard - namespace: {{ .Values.global.namespace }} -spec: - minAvailable: {{ .Values.pdb.minAvailable | quote }} - selector: - matchLabels: - app: {{ .Values.svc.name }}-shard -{{- end -}} - -{{- define "svc-common.router-pdb" -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ .Values.svc.name }} - namespace: {{ .Values.global.namespace }} -spec: - minAvailable: {{ .Values.pdb.minAvailable | quote }} - selector: - matchLabels: - app: {{ .Values.svc.name }} -{{- end -}} diff --git a/deploy/helm/svc-common/templates/_service.tpl b/deploy/helm/svc-common/templates/_service.tpl deleted file mode 100644 index ec2595803..000000000 --- a/deploy/helm/svc-common/templates/_service.tpl +++ /dev/null @@ -1,17 +0,0 @@ -{{/* -SPDX-License-Identifier: AGPL-3.0-or-later -*/}} - -{{- define "svc-common.service" -}} -apiVersion: v1 -kind: Service -metadata: - name: {{ .Values.svc.name }} - namespace: {{ .Values.global.namespace }} -spec: - selector: - app: {{ .Values.svc.name }} - ports: - - port: {{ .Values.svc.router.port }} - name: http -{{- end -}} diff --git a/deploy/helm/svc-common/templates/_statefulset.tpl b/deploy/helm/svc-common/templates/_statefulset.tpl deleted file mode 100644 index 272543ec5..000000000 --- a/deploy/helm/svc-common/templates/_statefulset.tpl +++ /dev/null @@ -1,167 +0,0 @@ -{{/* -SPDX-License-Identifier: AGPL-3.0-or-later -*/}} - -{{- define "svc-common.statefulset" -}} -{{- $persistence := .Values.svc.shard.persistence | default dict -}} -{{- $ephemeral := .Values.svc.shard.ephemeral | default dict -}} -{{- $dataMountEnabled := or $persistence.enabled $ephemeral.enabled -}} -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ .Values.svc.name }}-shard - namespace: {{ .Values.global.namespace }} - labels: - {{- include "svc-common.labels" . | nindent 4 }} -spec: - serviceName: {{ .Values.svc.name }}-shard-headless - replicas: {{ .Values.svc.shard.replicas }} - minReadySeconds: {{ default 10 .Values.svc.shard.minReadySeconds }} - podManagementPolicy: Parallel - updateStrategy: - type: RollingUpdate - selector: - matchLabels: - app: {{ .Values.svc.name }}-shard - template: - metadata: - labels: - app: {{ .Values.svc.name }}-shard - {{- include "svc-common.labels" . | nindent 8 }} - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "{{ .Values.svc.shard.port }}" - prometheus.io/path: "/_metrics" - spec: - terminationGracePeriodSeconds: {{ default 60 .Values.svc.shard.terminationGracePeriodSeconds }} - securityContext: - runAsNonRoot: true - fsGroup: 65532 - seccompProfile: - type: RuntimeDefault - containers: - - name: shard - image: {{ include "svc-common.image" . }} - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - ports: - - name: http - containerPort: {{ .Values.svc.shard.port }} - env: - - name: FLUXER_SVC_MODE - value: "shard" - - name: FLUXER_SVC_NAME - value: {{ .Values.svc.name }} - - name: FLUXER_SVC_SHARD_COUNT - value: {{ .Values.svc.shard.replicas | quote }} - - name: FLUXER_SVC_PORT - value: {{ .Values.svc.shard.port | quote }} - - name: FLUXER_SVC_NATS_URL - value: {{ .Values.svc.nats.url }} - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - {{- if .Values.svc.cassandra }} - - name: FLUXER_CASSANDRA_HOSTS - value: {{ join "," .Values.svc.cassandra.hosts }} - - name: FLUXER_CASSANDRA_KEYSPACE - value: {{ .Values.svc.cassandra.keyspace }} - {{- if .Values.svc.cassandra.credentialsSecret }} - - name: FLUXER_CASSANDRA_USERNAME - valueFrom: - secretKeyRef: - name: {{ .Values.svc.cassandra.credentialsSecret }} - key: username - - name: FLUXER_CASSANDRA_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Values.svc.cassandra.credentialsSecret }} - key: password - {{- end }} - {{- end }} - - name: FLUXER_SVC_CACHE_MAX_ENTRIES - value: {{ .Values.svc.cache.maxEntries | quote }} - - name: FLUXER_SVC_CACHE_TTL_MS - value: {{ .Values.svc.cache.ttlMs | quote }} - - name: FLUXER_SVC_MAX_CONCURRENT_REQUESTS - value: {{ default 64 .Values.svc.maxConcurrentRequests | quote }} - {{- if .Values.svc.build }} - - name: BUILD_VERSION - value: {{ .Values.svc.build.version | default .Values.svc.tag | quote }} - - name: RELEASE_CHANNEL - value: {{ .Values.svc.build.channel | default "stable" | quote }} - {{- end }} - {{- range .Values.svc.extraEnv }} - - name: {{ .name }} - {{- if .valueFrom }} - valueFrom: - {{- toYaml .valueFrom | nindent 16 }} - {{- else }} - value: {{ .value | quote }} - {{- end }} - {{- end }} - readinessProbe: - httpGet: - path: /_health - port: http - initialDelaySeconds: 2 - periodSeconds: 5 - failureThreshold: 2 - livenessProbe: - httpGet: - path: /_healthz - port: http - initialDelaySeconds: 5 - periodSeconds: 15 - failureThreshold: 3 - startupProbe: - httpGet: - path: /_healthz - port: http - initialDelaySeconds: 1 - periodSeconds: 5 - failureThreshold: 60 - resources: - {{- toYaml .Values.svc.shard.resources | nindent 12 }} - {{- if $dataMountEnabled }} - volumeMounts: - - name: data - mountPath: {{ default (default "/var/lib/fluxer-svc" $persistence.mountPath) $ephemeral.mountPath }} - {{- end }} - {{- with .Values.svc.nodeSelector }} - nodeSelector: {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.svc.tolerations }} - tolerations: {{- toYaml . | nindent 8 }} - {{- end }} - {{- if and (not $persistence.enabled) $ephemeral.enabled }} - volumes: - - name: data - emptyDir: - {{- if $ephemeral.sizeLimit }} - sizeLimit: {{ $ephemeral.sizeLimit | quote }} - {{- else }} - {} - {{- end }} - {{- end }} - {{- if .Values.global.imagePullSecret }} - imagePullSecrets: - - name: {{ .Values.global.imagePullSecret }} - {{- end }} - {{- if $persistence.enabled }} - volumeClaimTemplates: - - metadata: - name: data - spec: - accessModes: - - {{ default "ReadWriteOnce" $persistence.accessMode | quote }} - {{- if $persistence.storageClassName }} - storageClassName: {{ $persistence.storageClassName | quote }} - {{- end }} - resources: - requests: - storage: {{ default "10Gi" $persistence.size | quote }} - {{- end }} -{{- end -}} diff --git a/deploy/helm/unfurl/Chart.yaml b/deploy/helm/unfurl/Chart.yaml deleted file mode 100644 index 190a5194f..000000000 --- a/deploy/helm/unfurl/Chart.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: unfurl -version: 0.1.0 -dependencies: - - name: svc-common - version: 0.1.0 - repository: file://../svc-common diff --git a/deploy/helm/unfurl/templates/all.yaml b/deploy/helm/unfurl/templates/all.yaml deleted file mode 100644 index 7aed1e82f..000000000 --- a/deploy/helm/unfurl/templates/all.yaml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{ include "svc-common.statefulset" . }} ---- -{{ include "svc-common.deployment" . }} ---- -{{ include "svc-common.headless-service" . }} ---- -{{ include "svc-common.service" . }} ---- -{{ include "svc-common.pdb" . }} ---- -{{ include "svc-common.router-pdb" . }} diff --git a/deploy/helm/unfurl/values.prod.yaml b/deploy/helm/unfurl/values.prod.yaml deleted file mode 100644 index 80d9155a7..000000000 --- a/deploy/helm/unfurl/values.prod.yaml +++ /dev/null @@ -1,39 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -svc: - shard: - replicas: 4 - resources: - requests: - cpu: 100m - memory: 512Mi - limits: - memory: 1Gi - router: - replicas: 3 - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - cache: - maxEntries: 500000 - ttlMs: '1800000' - extraEnv: - - name: FLUXER_MEDIA_PROXY_ENDPOINT - value: http://media-proxy:8080 - - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT - value: https://fluxerusercontent.com - - name: FLUXER_STATIC_CDN_ENDPOINT - value: https://fluxerstatic.com - - name: FLUXER_MEDIA_PROXY_SECRET_KEY - valueFrom: - secretKeyRef: - name: fluxer-media-proxy-v2-env - key: FLUXER_MEDIA_PROXY_SECRET_KEY - - name: FLUXER_YOUTUBE_API_KEY - valueFrom: - secretKeyRef: - name: fluxer-youtube-api - key: api_key diff --git a/deploy/helm/unfurl/values.yaml b/deploy/helm/unfurl/values.yaml deleted file mode 100644 index 5ce255f30..000000000 --- a/deploy/helm/unfurl/values.yaml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -svc: - name: unfurl - image: fluxer-unfurl - tag: '' - shard: - replicas: 4 - port: 8090 - minReadySeconds: 10 - terminationGracePeriodSeconds: 60 - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - router: - replicas: 2 - port: 8090 - minReadySeconds: 10 - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 60 - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - memory: 256Mi - nats: - url: nats://nats-core:4222 - cache: - maxEntries: 250000 - ttlMs: '1800000' - extraEnv: - - name: FLUXER_MEDIA_PROXY_ENDPOINT - value: http://media-proxy:8080 - - name: FLUXER_MEDIA_PROXY_PUBLIC_ENDPOINT - value: https://fluxerusercontent.com - - name: FLUXER_STATIC_CDN_ENDPOINT - value: https://fluxerstatic.com - - name: FLUXER_MEDIA_PROXY_SECRET_KEY - valueFrom: - secretKeyRef: - name: fluxer-media-proxy-v2-env - key: FLUXER_MEDIA_PROXY_SECRET_KEY - - name: FLUXER_YOUTUBE_API_KEY - valueFrom: - secretKeyRef: - name: fluxer-youtube-api - key: api_key - nodeSelector: {} - tolerations: [] - -pdb: - minAvailable: '75%' diff --git a/deploy/helm/uploads/Chart.yaml b/deploy/helm/uploads/Chart.yaml deleted file mode 100644 index d64872c2f..000000000 --- a/deploy/helm/uploads/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: uploads -description: Fluxer media proxy upload-mode relay (uploads.fluxer.app) -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/uploads/templates/deployment.yaml b/deploy/helm/uploads/templates/deployment.yaml deleted file mode 100644 index 0ecb76d9b..000000000 --- a/deploy/helm/uploads/templates/deployment.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.deployment" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/uploads/templates/pdb.yaml b/deploy/helm/uploads/templates/pdb.yaml deleted file mode 100644 index d3ac0d5b8..000000000 --- a/deploy/helm/uploads/templates/pdb.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.pdb" (dict "name" .Values.app.name "minAvailable" .Values.pdb.minAvailable "context" .)}} diff --git a/deploy/helm/uploads/templates/service.yaml b/deploy/helm/uploads/templates/service.yaml deleted file mode 100644 index 60b585760..000000000 --- a/deploy/helm/uploads/templates/service.yaml +++ /dev/null @@ -1,3 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.service" (dict "name" .Values.app.name "values" .Values.app "context" .)}} diff --git a/deploy/helm/uploads/values.prod.yaml b/deploy/helm/uploads/values.prod.yaml deleted file mode 100644 index 03cd43425..000000000 --- a/deploy/helm/uploads/values.prod.yaml +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-uploads release as of 2026-05-17T20:42:43Z. -# Captured via: helm -n fluxer get values fluxer-uploads -# Apply with: helm upgrade fluxer-uploads deploy/helm/uploads -f deploy/helm/uploads/values.yaml -f deploy/helm/uploads/values.prod.yaml - -app: - build: - channel: stable - version: "" - env: - - name: FLUXER_MEDIA_PROXY_MODE - value: upload - - name: FLUXER_MEDIA_PROXY_STORAGE_BACKEND - value: s3 - - name: FLUXER_MEDIA_PROXY_READ_ONLY - value: "false" - - name: FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS - value: "300000" - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_S3_TIMEOUT_MS - value: "900000" - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 - valueFrom: - secretKeyRef: - key: relay_secret_base64 - name: fluxer-upload-relay - image: fluxer-media-proxy - name: uploads - port: 8080 - preStopDrain: - enabled: true - replicas: 4 - resources: - limits: - memory: 1Gi - requests: - cpu: 200m - memory: 256Mi - startupProbe: - enabled: true - failureThreshold: 24 - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - tag: "" - terminationGracePeriodSeconds: 120 -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-stable -pdb: - minAvailable: 50% diff --git a/deploy/helm/uploads/values.yaml b/deploy/helm/uploads/values.yaml deleted file mode 100644 index 952d850a1..000000000 --- a/deploy/helm/uploads/values.yaml +++ /dev/null @@ -1,59 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -app: - name: '' - image: fluxer-media-proxy - tag: '' - replicas: 4 - port: 8080 - env: - - name: FLUXER_MEDIA_PROXY_MODE - value: upload - - name: FLUXER_MEDIA_PROXY_STORAGE_BACKEND - value: s3 - - name: FLUXER_MEDIA_PROXY_READ_ONLY - value: 'false' - - name: FLUXER_MEDIA_PROXY_SOCKET_IO_TIMEOUT_MS - value: '300000' - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_S3_TIMEOUT_MS - value: '900000' - # Buffer parts up to this size in memory so the relay can replay them on - # transient Vultr Object Storage hiccups. 32 MiB covers every realistic - # part (max ~25 MiB for a 500 MiB premium upload). Larger parts fall back - # to single-shot streaming. - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_BYTES - value: '33554432' - # Pod-wide budget. With 1.5 GiB pod limit, 512 MiB keeps buffered uploads - # well clear of the ceiling even under burst. - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_BUFFERED_RETRY_TOTAL_BYTES - value: '536870912' - - name: FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64 - valueFrom: - secretKeyRef: - name: fluxer-upload-relay - key: relay_secret_base64 - resources: - requests: - cpu: 200m - memory: 384Mi - limits: - memory: 1536Mi - startupProbe: - enabled: true - path: /_health - periodSeconds: 5 - timeoutSeconds: 2 - failureThreshold: 24 - preStopDrain: - enabled: true - - - terminationGracePeriodSeconds: 120 - -pdb: - minAvailable: '50%' diff --git a/deploy/helm/users/Chart.yaml b/deploy/helm/users/Chart.yaml deleted file mode 100644 index 748e61ad5..000000000 --- a/deploy/helm/users/Chart.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: users -version: 0.1.0 -dependencies: - - name: svc-common - version: 0.1.0 - repository: file://../svc-common diff --git a/deploy/helm/users/templates/all.yaml b/deploy/helm/users/templates/all.yaml deleted file mode 100644 index 7aed1e82f..000000000 --- a/deploy/helm/users/templates/all.yaml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{ include "svc-common.statefulset" . }} ---- -{{ include "svc-common.deployment" . }} ---- -{{ include "svc-common.headless-service" . }} ---- -{{ include "svc-common.service" . }} ---- -{{ include "svc-common.pdb" . }} ---- -{{ include "svc-common.router-pdb" . }} diff --git a/deploy/helm/users/values.prod.yaml b/deploy/helm/users/values.prod.yaml deleted file mode 100644 index 77574be8b..000000000 --- a/deploy/helm/users/values.prod.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -svc: - shard: - replicas: 4 - resources: - requests: - cpu: 100m - memory: 512Mi - limits: - memory: 1Gi - router: - replicas: 65 - resources: - requests: - cpu: 50m - memory: 128Mi - limits: - memory: 512Mi - cassandra: - hosts: - - int.flx-nyc-db1.srv.fluxer.dev:9041 - credentialsSecret: fluxer-cassandra-credentials - cache: - maxEntries: 500000 - ttlMs: 30000 diff --git a/deploy/helm/users/values.yaml b/deploy/helm/users/values.yaml deleted file mode 100644 index add78af4c..000000000 --- a/deploy/helm/users/values.yaml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -svc: - name: users - image: fluxer-users - tag: '' - shard: - replicas: 4 - port: 8090 - resources: - requests: - cpu: 100m - memory: 256Mi - limits: - memory: 512Mi - router: - replicas: 2 - port: 8090 - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - memory: 256Mi - nats: - url: nats://nats-core:4222 - cassandra: - hosts: - - cassandra:9042 - keyspace: fluxer - cache: - maxEntries: 100000 - ttlMs: 30000 - extraEnv: [] - nodeSelector: {} - tolerations: [] - -pdb: - minAvailable: '50%' diff --git a/deploy/helm/worker/Chart.yaml b/deploy/helm/worker/Chart.yaml deleted file mode 100644 index 8d9bd19d7..000000000 --- a/deploy/helm/worker/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -apiVersion: v2 -name: worker -description: Fluxer worker deployments (realtime, lifecycle, batch) -type: application -version: 0.1.0 -dependencies: - - name: common - version: 0.1.0 - repository: file://../common diff --git a/deploy/helm/worker/templates/deployment.yaml b/deploy/helm/worker/templates/deployment.yaml deleted file mode 100644 index 74030ada2..000000000 --- a/deploy/helm/worker/templates/deployment.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{ include "fluxer.deployment" (dict "name" "worker-realtime" "values" .Values.workerRealtime "context" .) }} ---- -{{ include "fluxer.deployment" (dict "name" "worker-unfurl" "values" .Values.workerUnfurl "context" .) }} ---- -{{ include "fluxer.deployment" (dict "name" "worker-lifecycle" "values" .Values.workerLifecycle "context" .) }} ---- -{{ include "fluxer.deployment" (dict "name" "worker-batch" "values" .Values.workerBatch "context" .) }} diff --git a/deploy/helm/worker/templates/hpa.yaml b/deploy/helm/worker/templates/hpa.yaml deleted file mode 100644 index 9fb7a4f63..000000000 --- a/deploy/helm/worker/templates/hpa.yaml +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{- define "worker.hpa" -}} -{{- $name := .name -}} -{{- $values := .values -}} -{{- $ctx := .context -}} -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: {{ $name }} - namespace: {{ $ctx.Values.global.namespace }} - labels: - {{- include "fluxer.labels" $ctx | nindent 4 }} - {{- include "fluxer.selectorLabels" (dict "name" $name "context" $ctx) | nindent 4 }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ $name }} - minReplicas: {{ $values.autoscaling.minReplicas }} - maxReplicas: {{ $values.autoscaling.maxReplicas }} - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: {{ $values.autoscaling.targetCPUUtilizationPercentage }} - behavior: - scaleDown: - stabilizationWindowSeconds: 300 - scaleUp: - stabilizationWindowSeconds: 30 -{{- end -}} -{{- if and .Values.workerUnfurl.autoscaling .Values.workerUnfurl.autoscaling.enabled }} -{{ include "worker.hpa" (dict "name" "worker-unfurl" "values" .Values.workerUnfurl "context" .) }} -{{- end }} -{{- if and .Values.workerBatch.autoscaling .Values.workerBatch.autoscaling.enabled }} ---- -{{ include "worker.hpa" (dict "name" "worker-batch" "values" .Values.workerBatch "context" .) }} -{{- end }} diff --git a/deploy/helm/worker/templates/pdb.yaml b/deploy/helm/worker/templates/pdb.yaml deleted file mode 100644 index f9c1995e1..000000000 --- a/deploy/helm/worker/templates/pdb.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -{{include "fluxer.pdb" (dict "name" "worker-realtime" "minAvailable" .Values.pdb.minAvailable "context" .)}} ---- -{{include "fluxer.pdb" (dict "name" "worker-unfurl" "minAvailable" .Values.pdb.minAvailable "context" .)}} ---- -{{include "fluxer.pdb" (dict "name" "worker-lifecycle" "minAvailable" .Values.pdb.minAvailable "context" .)}} ---- -{{include "fluxer.pdb" (dict "name" "worker-batch" "minAvailable" .Values.pdb.minAvailable "context" .)}} diff --git a/deploy/helm/worker/values.prod.yaml b/deploy/helm/worker/values.prod.yaml deleted file mode 100644 index 254980589..000000000 --- a/deploy/helm/worker/values.prod.yaml +++ /dev/null @@ -1,183 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# Live user-supplied values for the fluxer-worker release as of 2026-05-17T20:42:44Z. -# Captured via: helm -n fluxer get values fluxer-worker -# Apply with: helm upgrade fluxer-worker deploy/helm/worker -f deploy/helm/worker/values.yaml -f deploy/helm/worker/values.prod.yaml - -global: - imagePullSecret: ghcr-pull-secret - namespace: fluxer - registry: "" - envFrom: - - secretRef: - name: fluxer-runtime-env-shared -workerBatch: - autoscaling: - enabled: true - maxReplicas: 16 - minReplicas: 8 - targetCPUUtilizationPercentage: 60 - build: - channel: stable - version: "" - command: - - pnpm - - start:worker - image: fluxer-api - minReadySeconds: 10 - noHealthCheck: true - port: 8080 - replicas: 8 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 120 - env: - - name: FLUXER_API_WORKER_MODE - value: single_lane - - name: FLUXER_API_WORKER_LANE - value: batch - - name: FLUXER_API_WORKER_ENABLE_CRON_SCHEDULER - value: "true" - - name: FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION - value: "true" - - name: FLUXER_LIVEKIT_ENABLED - value: "true" - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: "128" - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: "32" - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: "5000" - resources: - limits: - memory: 1Gi - requests: - cpu: 150m - memory: 512Mi - tag: "" -workerLifecycle: - build: - channel: stable - version: "" - command: - - pnpm - - start:worker - image: fluxer-api - minReadySeconds: 10 - noHealthCheck: true - port: 8080 - replicas: 2 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 120 - env: - - name: FLUXER_API_WORKER_MODE - value: single_lane - - name: FLUXER_API_WORKER_LANE - value: lifecycle - - name: FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION - value: "false" - - name: FLUXER_LIVEKIT_ENABLED - value: "false" - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: "128" - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: "32" - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: "5000" - resources: - limits: - memory: 1Gi - requests: - cpu: 150m - memory: 512Mi - tag: "" -workerRealtime: - build: - channel: stable - version: "" - command: - - pnpm - - start:worker - image: fluxer-api - minReadySeconds: 10 - noHealthCheck: true - port: 8080 - replicas: 2 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 120 - env: - - name: FLUXER_API_WORKER_MODE - value: single_lane - - name: FLUXER_API_WORKER_LANE - value: realtime - - name: FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION - value: "false" - - name: FLUXER_LIVEKIT_ENABLED - value: "false" - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: "128" - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: "32" - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: "5000" - resources: - limits: - memory: 1Gi - requests: - cpu: 150m - memory: 512Mi - tag: "" -workerUnfurl: - autoscaling: - enabled: true - maxReplicas: 16 - minReplicas: 6 - targetCPUUtilizationPercentage: 60 - build: - channel: stable - version: "" - command: - - pnpm - - start:worker - image: fluxer-api - minReadySeconds: 10 - noHealthCheck: true - port: 8080 - replicas: 6 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 120 - env: - - name: NODE_OPTIONS - value: --max-old-space-size=1024 - - name: FLUXER_API_WORKER_MODE - value: single_lane - - name: FLUXER_API_WORKER_LANE - value: unfurl - - name: FLUXER_API_WORKER_LANE_CONCURRENCY_OVERRIDES - value: '{"unfurl":2}' - - name: FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION - value: "false" - - name: FLUXER_LIVEKIT_ENABLED - value: "false" - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: "128" - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: "32" - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: "5000" - resources: - limits: - memory: 2Gi - requests: - cpu: 150m - memory: 768Mi - tag: "" -pdb: - minAvailable: 75% diff --git a/deploy/helm/worker/values.yaml b/deploy/helm/worker/values.yaml deleted file mode 100644 index 473befa6a..000000000 --- a/deploy/helm/worker/values.yaml +++ /dev/null @@ -1,161 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later - -global: - namespace: fluxer - imagePullSecret: ghcr-pull-secret - registry: "" - -workerRealtime: - image: fluxer-api - tag: '' - replicas: 2 - port: 8080 - command: ['pnpm', 'start:worker'] - noHealthCheck: true - minReadySeconds: 10 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 120 - env: - - name: FLUXER_API_WORKER_MODE - value: single_lane - - name: FLUXER_API_WORKER_LANE - value: realtime - - name: FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION - value: 'false' - - name: FLUXER_LIVEKIT_ENABLED - value: 'false' - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: '128' - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: '32' - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: '5000' - resources: - requests: - cpu: 150m - memory: 512Mi - limits: - memory: 1Gi - -workerUnfurl: - image: fluxer-api - tag: '' - replicas: 6 - port: 8080 - command: ['pnpm', 'start:worker'] - noHealthCheck: true - minReadySeconds: 10 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 120 - env: - - name: NODE_OPTIONS - value: --max-old-space-size=1024 - - name: FLUXER_API_WORKER_MODE - value: single_lane - - name: FLUXER_API_WORKER_LANE - value: unfurl - - name: FLUXER_API_WORKER_LANE_CONCURRENCY_OVERRIDES - value: '{"unfurl":2}' - - name: FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION - value: 'false' - - name: FLUXER_LIVEKIT_ENABLED - value: 'false' - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: '128' - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: '32' - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: '5000' - resources: - requests: - cpu: 150m - memory: 768Mi - limits: - memory: 2Gi - autoscaling: - enabled: true - minReplicas: 6 - maxReplicas: 16 - targetCPUUtilizationPercentage: 60 - -workerLifecycle: - image: fluxer-api - tag: '' - replicas: 2 - port: 8080 - command: ['pnpm', 'start:worker'] - noHealthCheck: true - minReadySeconds: 10 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 120 - env: - - name: FLUXER_API_WORKER_MODE - value: single_lane - - name: FLUXER_API_WORKER_LANE - value: lifecycle - - name: FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION - value: 'false' - - name: FLUXER_LIVEKIT_ENABLED - value: 'false' - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: '128' - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: '32' - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: '5000' - resources: - requests: - cpu: 150m - memory: 512Mi - limits: - memory: 1Gi - -workerBatch: - image: fluxer-api - tag: '' - replicas: 8 - port: 8080 - command: ['pnpm', 'start:worker'] - noHealthCheck: true - minReadySeconds: 10 - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 - terminationGracePeriodSeconds: 120 - env: - - name: FLUXER_API_WORKER_MODE - value: single_lane - - name: FLUXER_API_WORKER_LANE - value: batch - - name: FLUXER_API_WORKER_ENABLE_CRON_SCHEDULER - value: 'true' - - name: FLUXER_API_WORKER_ENABLE_VOICE_RECONCILIATION - value: 'true' - - name: FLUXER_LIVEKIT_ENABLED - value: 'true' - - name: FLUXER_SNOWFLAKE_SERVICE_BATCH_SIZE - value: '128' - - name: FLUXER_SNOWFLAKE_SERVICE_LOW_WATERMARK - value: '32' - - name: FLUXER_SNOWFLAKE_SERVICE_MAX_BUFFER_AGE_MS - value: '5000' - resources: - requests: - cpu: 150m - memory: 512Mi - limits: - memory: 1Gi - autoscaling: - enabled: true - minReplicas: 8 - maxReplicas: 16 - targetCPUUtilizationPercentage: 60 - -pdb: - minAvailable: '75%' diff --git a/deploy/k8s/fluxer-api-approved-image-policy.yaml b/deploy/k8s/fluxer-api-approved-image-policy.yaml deleted file mode 100644 index e5dca31df..000000000 --- a/deploy/k8s/fluxer-api-approved-image-policy.yaml +++ /dev/null @@ -1,52 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicy -metadata: - name: fluxer-api-approved-image - labels: - app.kubernetes.io/part-of: fluxer - app.kubernetes.io/name: api-image-policy -spec: - failurePolicy: Fail - paramKind: - apiVersion: v1 - kind: ConfigMap - matchConstraints: - resourceRules: - - apiGroups: ["apps"] - apiVersions: ["v1"] - operations: ["CREATE", "UPDATE"] - resources: ["deployments"] - matchConditions: - - name: fluxer-api-deployments - expression: "request.namespace == 'fluxer' && (object.metadata.name == 'api' || object.metadata.name == 'api-canary')" - variables: - - name: containerName - expression: "object.metadata.name == 'api' ? 'api' : 'api-canary'" - - name: targetContainers - expression: "object.spec.template.spec.containers.filter(c, c.name == variables.containerName)" - validations: - - expression: "params.data[\"tag\"].matches(\"^[1-9][0-9]{3}\\\\.[1-9][0-9]{2,3}\\\\.(0|[1-9][0-9]{0,5})$\")" - message: "approved fluxer-api tag must be a Fluxer CalVer value" - - expression: "params.data[\"previousTag\"] == \"\" || params.data[\"previousTag\"].matches(\"^[1-9][0-9]{3}\\\\.[1-9][0-9]{2,3}\\\\.(0|[1-9][0-9]{0,5})$\")" - message: "previous approved fluxer-api tag must be empty or a Fluxer CalVer value" - - expression: "variables.targetContainers.size() == 1" - message: "api deployment must have exactly one target api container" - - expression: "variables.targetContainers.all(c, (c.image == params.data[\"image\"] && c.env.exists(e, e.name == \"BUILD_VERSION\" && e.value == params.data[\"tag\"])) || (params.data[\"previousImage\"] != \"\" && c.image == params.data[\"previousImage\"] && c.env.exists(e, e.name == \"BUILD_VERSION\" && e.value == params.data[\"previousTag\"])))" - messageExpression: "params.data[\"previousImage\"] == \"\" ? \"api deployment image and BUILD_VERSION must match \" + params.data[\"image\"] : \"api deployment image and BUILD_VERSION must match approved image \" + params.data[\"image\"] + \" or temporary rollback image \" + params.data[\"previousImage\"]" ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingAdmissionPolicyBinding -metadata: - name: fluxer-api-approved-image - labels: - app.kubernetes.io/part-of: fluxer - app.kubernetes.io/name: api-image-policy -spec: - policyName: fluxer-api-approved-image - validationActions: [Deny] - paramRef: - name: fluxer-api-approved-image - namespace: fluxer - parameterNotFoundAction: Deny