Paco/helm-chart

Default configuration

Security context

The securityContext section for the service deployments and jobs should be configured the following way in values.yaml:

deployments:
	<ServiceName>:
	[...]
	securityContext:
	  runAsNonRoot: true
	  allowPrivilegeEscalation: false
	[...]
jobs:
	<JobName>:
	[...]
	securityContext:
	  runAsNonRoot: true
	  allowPrivilegeEscalation: false
	[...]

Multi instances

For the zero downtime requirement, multiple instances (replicas) should be configured and deployed (replicaCount >= 2). Affected deployments: paco-service, core-service, core-web-service.

deployments:
	<ServiceName>:
	[...]
	replicaCount: 2
	[...]

Ingress routing

Each service should be configured with an ingress resource to route the traffic through a common ingress controller. For annotation reusability, a common set of nginx ingress annotations should be configured. Affected deployments: paco-service, core-service, core-web-service, printing-service.

Common nginx ingress annotations should be configured in values.yaml:

  nginxCommonAnnotations: &nginxCommonAnnotations
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
    nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504"
    nginx.ingress.kubernetes.io/proxy-buffering: "off"
    nginx.ingress.kubernetes.io/proxy-body-size: 25m
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-request-buffering: "off"

Ingress configuration for each service should be configured in values.yaml:

deployments:
	<ServiceName>:
	  [...]
      ports:
        - name: http
          protocol: TCP
          value: 2501
          expose:
            service:
              type: ClusterIP
              port: 80
            ingresses:
              - annotations:
                  <<: *nginxCommonAnnotations
                  nginx.ingress.kubernetes.io/rewrite-target: /$1$2
                name: <name of the ingress resource>
                path: '/{{ dig .Chart.Name "contextPath" "" .Values.global.modules }}/(production-api|master-data-api|reporting-api|configuration-api|core-legacy-api|authentication-api|swagger|health|ping|messaging)(/.*|$)'