1a747f61a8
images/·manifests/helm/·.claude/ 의 20개 파일이 doc/decisions·doc/analysis 등 **이 레포에 존재한 적 없는 경로 15종을 48곳에서** 인용하고 있었다. security-catalog 에서 포팅할 때 따라온 것인데, 그 레포는 개인 레포(github.com/wbsong111/security-catalog)라 팀 구성원은 접근조차 못 한다 — "security-catalog 에 있으나 이관되지 않았다" 는 안내가 아무 역할을 하지 못했다. 원문을 통째로 복사하지 않았다 ---------------------------- 원본 문서들이 서로를 근거로 인용한다. decisions/0001 하나만 봐도 analysis/cnpg-image-baseline.md · analysis/vendor-unassessed-data-sources.md 처럼 **인용 목록에 없던 또 다른 미이관 문서**를 가리킨다. 복사는 문제를 옮기는 것이지 없애는 게 아니다. 그리고 대부분은 애초에 dip-catalog 가 더 나은 것을 갖고 있다. 7곳에서 인용되던 analysis/sles-oval-measurement.md 는 원문 스스로 "이 문서는 결정하지 않는다. 재측정하면 갱신된다" 고 밝히는 스냅샷인데, dip-catalog 는 같은 측정을 CoverageProbe 로 매 스캔마다 자동으로 한다. 문서를 복사하는 것보다 게이트를 가리키는 것이 정확하다. 그래서 성격별로 나눴다 --------------------- 재측정으로 복원 안 되는 것 → doc/decisions/ 에 자립적 ADR 로 다시 씀 (4건) 이미 단일 출처가 있는 것 → 그쪽으로 인용 교체 (11종 경로) ADR 4건은 security-catalog 0001·0005·0006·0007 이 원본이고, 결론과 근거만 추려 dip-catalog 맥락으로 새로 썼다 — **레포 밖을 가리키는 링크가 0이다.** 번호는 이 레포에서 0001~0004 로 다시 붙였고 원본 대응은 각 문서와 README 에 적었다. 왜 안 가져온 것은 안 가져왔는지도 README 표에 남겼다. 인용 교체는 카테고리별로: analysis/*-cve.md, cnpg-image-vuln-comparison.md → 해당 ADR · images/<image>/README.md analysis/sles-oval-measurement.md → 게이트 CoverageProbe (doc/sbom-pipeline.md) cve-zero-pipeline.md, architecture/build-pipeline.md → doc/sbom-pipeline.md image-selection.md → .claude/image-authoring.md charts/*/deploy-test.md → scripts/deploy-test/*.sh + 절차 문서 찾은 오류 2건 ------------- - images/cloudnative-pg/source.build.env 가 인용한 decisions/0004-cloudnative-pg-operator-self-build.md 는 **번호 오기**다. 원본 0004 는 postgresql-chart-selection 이고 이 결정은 0005 다. - cnpg-cluster values.yaml·templates/database.yaml 이 인용한 doc/deploy-test-cnpg.md 는 **원본 레포에도 없다.** CREATE EXTENSION 함정 설명은 주석 자체에 이미 있어 인용만 뺐다. 검증 ---- 우리 파일의 깨진 doc/ 인용 0건 (전수 스캔) 새 문서·수정 문서의 로컬 링크 전부 실재 확인 helm template cnpg-cluster · etcd · cloudnative-pg 정상 렌더 남은 doc/health-checking.md(144곳)·doc/integration/*(2곳)은 업스트림 CRD·차트 안의 문자열로 우리가 쓴 인용이 아니다 — 건드리지 않았다. Closes #33 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Etcd
Changelog
see RELEASENOTES.md
A Helm chart for a Etcd HA-cluster on Kubernetes
TL;DR
helm repo add groundhog2k https://groundhog2k.github.io/helm-charts/
helm install my-release groundhog2k/etcd
Introduction
This chart uses the original Etcd image from Quay.io to deploy a stateful Etcd cluster in Kubernetes.
It fully supports deployment of the multi-architecture docker image.
Prerequisites
- Kubernetes 1.12+
- Helm 3.x
- PV provisioner support in the underlying infrastructure
Installing the Chart
To install the chart with the release name my-release:
helm install my-release groundhog2k/etcd
Uninstalling the Chart
To uninstall/delete the my-release deployment:
helm uninstall my-release
Common parameters
| Key | Type | Default | Description |
|---|---|---|---|
| fullnameOverride | string | "" |
Fully override the deployment name |
| nameOverride | string | "" |
Partially override the deployment name |
Deployment parameters
| Key | Type | Default | Description |
|---|---|---|---|
| image.pullPolicy | string | "IfNotPresent" |
Image pull policy |
| image.registry | string | "quay.io/coreos" |
Image registry |
| image.repository | string | "etcd" |
Image name |
| image.tag | string | "" |
Image tag |
| initImage.pullPolicy | string | "IfNotPresent" |
Init image pull policy |
| initImage.registry | string | "docker.io" |
Image registry |
| initImage.repository | string | "busybox" |
Init image name |
| initImage.tag | string | "stable" |
Init image tag |
| imagePullSecrets | list | [] |
Image pull secrets |
| extraInitContainers | list | [] |
Extra init containers |
| extaContainers | list | [] |
Extra containers for usage as sidecars |
| startupProbe | object | see values.yaml |
Startup probe configuration |
| livenessProbe | object | see values.yaml |
Liveness probe configuration |
| readinessProbe | object | see values.yaml |
Readiness probe configuration |
| customStartupProbe | object | {} |
Custom startup probe (overwrites default startup probe configuration) |
| customLivenessProbe | object | {} |
Custom liveness probe (overwrites default liveness probe configuration) |
| customReadinessProbe | object | {} |
Custom readiness probe (overwrites default readiness probe configuration) |
| resources | object | {} |
Resource limits and requests |
| priorityClassName | string | "" |
Deployment priority class name |
| nodeSelector | object | {} |
Deployment node selector |
| customLabels | object | {} |
Additional labels for Deployment or StatefulSet |
| customAnnotations | object | {} |
Additional annotations for Deployment or StatefulSet |
| podAnnotations | object | {} |
Additional pod annotations |
| podLabels | object | {} |
Additional pod labels |
| podSecurityContext | object | see values.yaml |
Pod security context |
| securityContext | object | see values.yaml |
Container security context |
| env | list | [] |
Additional container environmment variables |
| args | list | [] |
Additional container command arguments |
| rbac.create | bool | true |
Enable creation of RBAC |
| serviceAccount.annotations | object | {} |
Additional service account annotations |
| serviceAccount.create | bool | true |
Enable service account creation |
| serviceAccount.name | string | "" |
Optional name of the service account |
| serviceAccount.automountServiceAccountToken | bool | true |
Specifies whether a service account token should be automatically mounted |
| affinity | object | {} |
Affinity for pod assignment |
| tolerations | list | [] |
Tolerations for pod assignment |
| topologySpreadConstraints | object | {} |
Topology spread constraints for pods |
| podManagementPolicy | string | "Parallel" |
Pod management policy |
| updateStrategyType | string | "RollingUpdate" |
Pod update strategy |
| replicas | int | 1 |
Number of replicas (Due to the nature of etcd cluster initialization this value must be set before deploying the cluster) |
| revisionHistoryLimit | int | nil |
Maximum number of revisions maintained in revision history |
| podDisruptionBudget | object | {} |
Pod disruption budget |
| podDisruptionBudget.minAvailable | int | nil |
Minimum number of pods that must be available after eviction |
| podDisruptionBudget.maxUnavailable | int | nil |
Maximum number of pods that can be unavailable after eviction |
| clusterDomain | string | "cluster.local" |
Kubernetes cluster domain (DNS) suffix |
Service parameters
| Key | Type | Default | Description |
|---|---|---|---|
| service.type | string | "ClusterIP" |
Service type |
| service.clusterIP | string | nil |
The cluster ip address (only relevant for type LoadBalancer or NodePort) |
| service.loadBalancerIP | string | nil |
The load balancer ip address (only relevant for type LoadBalancer) |
| service.loadBalancerSourceRanges | list | [] |
The list of IP CIDR ranges that are allowed to access the load balancer (only relevent for type LoadBalancer) |
| service.client.port | int | 2379 |
Client service port |
| service.client.nodePort | int | nil |
Service node port (only relevant for type LoadBalancer or NodePort) |
| service.peer.port | int | 2380 |
Peer service port |
| service.peer.nodePort | int | nil |
Service node port (only relevant for type LoadBalancer or NodePort) |
| service.annotations | object | {} |
Additional service annotations |
| service.labels | object | {} |
Additional service labels |
Service monitor parameters
| Key | Type | Default | Description |
|---|---|---|---|
| serviceMonitor.enabled | bool | false |
Enable service monitor |
| serviceMonitor.additionalLabels | object | {} |
Additional labels for the service monitor object |
| serviceMonitor.annotations | object | {} |
Annotations for the service monitor object |
| serviceMonitor.interval | Duration | nil |
Scrape interval for prometheus |
| serviceMonitor.scrapeTimeout | Duration | nil |
Scrape timeout value |
| serviceMonitor.extraEndpointParameters | object | nil |
Extra parameters rendered to the service monitor endpoint |
| serviceMonitor.extraParameters | object | nil |
Extra parameters rendered to the service monitor object |
Network policies
Allows to define optional network policies for ingress and egress The policyTypes will be automatically set
| Key | Type | Default | Description |
|---|---|---|---|
| networkPolicy.ingress | object | {} |
Ingress network policies |
| networkPolicy.egress | object | {} |
Egress network policies |
Storage parameters
| Key | Type | Default | Description |
|---|---|---|---|
| storage.accessModes[0] | string | "ReadWriteOnce" |
Storage access mode |
| storage.volumeName | string | "etcd-data" |
Internal volume name and prefix of a created PVC |
| storage.persistentVolumeClaimName | string | nil |
PVC name when existing storage volume should be used |
| storage.requestedSize | string | nil |
Size for new PVC, when no existing PVC is used |
| storage.className | string | nil |
Storage class name |
| storage.annotations | object | {} |
Additional storage annotations |
| storage.labels | object | {} |
Additional storage labels |
| extraStorage | list | [] |
A list of additional existing PVC that will be mounted into the container |
| extraStorage[].name | string | nil |
Internal name of the volume |
| extraStorage[].pvcName | string | nil |
Name of the existing PVC |
| extraStorage[].mountPath | string | nil |
Mount path where the PVC should be mounted into the container |
Etcd settings
| Key | Type | Default | Description |
|---|---|---|---|
| settings.clusterToken | bool | "etcd-cluster-0" |
Unique cluser token |
| settings.https.enabled | bool | false |
Enable HTTPS |
| settings.https.autoTls | bool | false |
Automatic TLS mode of etcd (TLS certs. created automaically) |
| settings.shutdownDelay | int | 3 |
Delay after termination request to give etcd process time for graceful shutdown |
Etcd secrets and configuration
| Key | Type | Default | Description |
|---|---|---|---|
| extraSecrets | list | [] |
A list of additional existing secrets that will be mounted into the container |
| extraSecrets[].name | string | nil |
Name of the existing K8s secret |
| extraSecrets[].defaultMode | int | 0440 |
Mount default access mode |
| extraSecrets[].mountPath | string | nil |
Mount path where the secret should be mounted into the container (f.e. /mysecretfolder) |
| extraConfigs | list | [] |
A list of additional existing configMaps that will be mounted into the container |
| extraConfigs[].name | string | nil |
Name of the existing K8s configMap |
| extraConfigs[].defaultMode | int | 0440 |
Mount default access mode |
| extraConfigs[].mountPath | string | nil |
Mount path where the configMap should be mounted into the container (f.e. /myconfigfolder) |
| extraEnvSecrets | list | [] |
A list of existing secrets that will be mounted into the container as environment variables |