wbsong111
17d5aafa1f
nemo 의 NGC API 키와, airflow git-sync · gitea · keycloakx 가 공유하던 암호가 평문으로 커밋돼 있었다. airflow 쪽은 같은 값을 base64 로 감싼 것이라 5개 파일을 함께 교체했다. 4개 차트 helm template 렌더 확인. 히스토리와 GitHub PR ref 에는 남으므로 키 로테이션이 별도로 필요하다. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
98 lines
2.0 KiB
YAML
98 lines
2.0 KiB
YAML
global:
|
|
imageRegistry: ""
|
|
|
|
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "root-ca-issuer"
|
|
cert-manager.io/duration: 8760h
|
|
cert-manager.io/renew-before: 720h
|
|
konghq.com/protocols: https
|
|
konghq.com/https-redirect-status-code: "301"
|
|
|
|
hosts:
|
|
- host: gitea.example.org
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- hosts:
|
|
host: gitea.example.org
|
|
secretName: gitea-tls
|
|
|
|
# 사설 인증서를 사용 시 아래 내용 추가
|
|
extraVolumes:
|
|
- name: keycloak-tls
|
|
secret:
|
|
secretName: keycloak.example.org-tls
|
|
|
|
extraContainerVolumeMounts:
|
|
- name: keycloak-tls
|
|
mountPath: /etc/ssl/certs/ca.crt
|
|
subPath: ca.crt
|
|
|
|
## pod 설정
|
|
replicaCount: 1
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 300Mi
|
|
limits:
|
|
cpu: 300m
|
|
memory: 500Mi
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: ""
|
|
size: "10Gi"
|
|
|
|
|
|
## 같은 네임스페이스에 postgresql 배포 가정
|
|
gitea:
|
|
admin:
|
|
username: sudouser
|
|
password: ChangeMe1234!
|
|
email: "sudouser@cro.com"
|
|
config:
|
|
APP_NAME: paasup git
|
|
RUN_MODE: prod
|
|
server:
|
|
ROOT_URL: https://gitea.example.org
|
|
database:
|
|
DB_TYPE: postgres
|
|
HOST: postgresql-postgresql-ha-postgresql:5432
|
|
NAME: gitea
|
|
USER: gitea
|
|
PASSWD: ChangeMe1234!
|
|
CHARSET: utf8
|
|
SCHEMA: gitea
|
|
SSL_MODE: disable
|
|
session:
|
|
PROVIDER: postgres
|
|
PROVIDER_CONFIG: user=gitea password=ChangeMe1234! host=postgresql-postgresql-ha-postgresql port=5432 dbname=gitea_session sslmode=disable
|
|
COOKIE_NAME: i_hate_gitea
|
|
service:
|
|
DEFAULT_ALLOW_CREATE_ORGANIZATION: true
|
|
repository:
|
|
DEFAULT_BRANCH: master
|
|
oauth:
|
|
- name: keycloak'
|
|
provider: "openidConnect"
|
|
key: "gitea"
|
|
secret: "VWIjYDNosSlPseEo5Uo8nkP3OHO4MigC"
|
|
autoDiscoverUrl: http://keycloak/realms/paasup/.well-known/openid-configuration
|
|
|
|
|
|
|
|
postgresql:
|
|
enabled: false
|
|
|
|
postgresql-ha:
|
|
enabled: false
|
|
|
|
valkey:
|
|
enabled: false
|
|
|
|
valkey-cluster:
|
|
enabled: false |