diff --git a/charts/.utils/gitlab-ci.yaml b/charts/.utils/gitlab-ci.yaml
index 89ba10c4baac78bb1ead1f998ad15b6851ca9147..2f2cd4d597837864f84148c04bf4696860f079ca 100644
--- a/charts/.utils/gitlab-ci.yaml
+++ b/charts/.utils/gitlab-ci.yaml
@@ -4,6 +4,7 @@
- CHART:
- keycloak
- mok
+ - mastodon
chart-package:
stage: build
diff --git a/charts/mastodon/.helmignore b/charts/mastodon/.helmignore
new file mode 100644
index 0000000000000000000000000000000000000000..0cbed473aa783c2bdd3b858c349c1ea9edd94d08
--- /dev/null
+++ b/charts/mastodon/.helmignore
@@ -0,0 +1,37 @@
+# A helm chart's templates and default values can be packaged into a .tgz file.
+# When doing that, not everything should be bundled into the .tgz file. This
+# file describes what to not bundle.
+#
+# Manually added by us
+# --------------------
+#
+dev-values.yaml
+mastodon-*.tgz
+
+
+# Boilerplate .helmignore from `helm create mastodon`
+# ---------------------------------------------------
+#
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/mastodon/Chart.lock b/charts/mastodon/Chart.lock
new file mode 100644
index 0000000000000000000000000000000000000000..961e4fa80feade2a3ca65a98ac5f13c48c24a022
--- /dev/null
+++ b/charts/mastodon/Chart.lock
@@ -0,0 +1,12 @@
+dependencies:
+- name: elasticsearch
+ repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
+ version: 19.0.1
+- name: postgresql
+ repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
+ version: 11.1.3
+- name: redis
+ repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
+ version: 16.13.2
+digest: sha256:17ea58a3264aa22faff18215c4269f47dabae956d0df273c684972f356416193
+generated: "2022-08-08T21:44:18.0195364+02:00"
diff --git a/charts/mastodon/Chart.yaml b/charts/mastodon/Chart.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..1787614669fa3598e668a83ad9114cbd91a96287
--- /dev/null
+++ b/charts/mastodon/Chart.yaml
@@ -0,0 +1,36 @@
+apiVersion: v2
+name: mastodon
+description: Mastodon is a free, open-source social network server based on ActivityPub.
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 3.0.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: v3.5.3
+
+dependencies:
+ - name: elasticsearch
+ version: 19.0.1
+ repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
+ condition: elasticsearch.enabled
+ - name: postgresql
+ version: 11.1.3
+ repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
+ condition: postgresql.enabled
+ - name: redis
+ version: 16.13.2
+ repository: https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami
diff --git a/charts/mastodon/README.md b/charts/mastodon/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..b05874aa21422b80028c9cf324b61bd968d5f807
--- /dev/null
+++ b/charts/mastodon/README.md
@@ -0,0 +1,116 @@
+# mastodon
+
+  
+
+Mastodon is a free, open-source social network server based on ActivityPub.
+
+## Requirements
+
+| Repository | Name | Version |
+|------------|------|---------|
+| https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami | elasticsearch | 19.0.1 |
+| https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami | postgresql | 11.1.3 |
+| https://raw.githubusercontent.com/bitnami/charts/archive-full-index/bitnami | redis | 16.13.2 |
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` | Affinity for all pods unless overwritten |
+| elasticsearch | object | `{}` | https://github.com/bitnami/charts/tree/master/bitnami/elasticsearch#parameters |
+| externalAuth.cas.enabled | bool | `false` | |
+| externalAuth.ldap.enabled | bool | `false` | |
+| externalAuth.oauth_global.omniauth_only | bool | `false` | Automatically redirect to OIDC, CAS or SAML, and don't use local account authentication when clicking on Sign-In |
+| externalAuth.oidc.enabled | bool | `false` | OpenID Connect support is proposed in PR #16221 and awaiting merge. |
+| externalAuth.pam.enabled | bool | `false` | |
+| externalAuth.saml.enabled | bool | `false` | |
+| image.pullPolicy | string | `"IfNotPresent"` | |
+| image.repository | string | `"tootsuite/mastodon"` | |
+| image.tag | string | `""` | |
+| ingress.annotations | string | `nil` | |
+| ingress.enabled | bool | `true` | |
+| ingress.hosts[0].host | string | `"mastodon.local"` | |
+| ingress.hosts[0].paths[0].path | string | `"/"` | |
+| ingress.ingressClassName | string | `nil` | you can specify the ingressClassName if it differs from the default |
+| ingress.tls[0].hosts[0] | string | `"mastodon.local"` | |
+| ingress.tls[0].secretName | string | `"mastodon-tls"` | |
+| jobAnnotations | object | `{}` | The annotations set with jobAnnotations will be added to all job pods. |
+| mastodon.authorizedFetch | bool | `false` | Enables "Secure Mode" for more details see: https://docs.joinmastodon.org/admin/config/#authorized_fetch |
+| mastodon.createAdmin | object | `{}` | create an initial administrator user; the password is autogenerated and will have to be reset |
+| mastodon.cron.removeMedia | object | `{}` | run `tootctl media remove` every week |
+| mastodon.local_domain | string | `"mastodon.local"` | |
+| mastodon.locale | string | `"en"` | available locales: https://github.com/mastodon/mastodon/blob/main/config/application.rb#L71 |
+| mastodon.metrics.statsd.address | string | `""` | Enable statsd publishing via STATSD_ADDR environment variable |
+| mastodon.persistence.assets.accessMode | string | `"ReadWriteOnce"` | ReadWriteOnce is more widely supported than ReadWriteMany, but limits scalability, since it requires the Rails and Sidekiq pods to run on the same node. |
+| mastodon.persistence.assets.resources.requests.storage | string | `"10Gi"` | |
+| mastodon.persistence.system.accessMode | string | `"ReadWriteOnce"` | |
+| mastodon.persistence.system.resources.requests.storage | string | `"100Gi"` | |
+| mastodon.s3.access_key | string | `""` | |
+| mastodon.s3.access_secret | string | `""` | |
+| mastodon.s3.alias_host | string | `""` | If you have a caching proxy, enter its base URL here. |
+| mastodon.s3.bucket | string | `""` | |
+| mastodon.s3.enabled | bool | `false` | |
+| mastodon.s3.endpoint | string | `""` | |
+| mastodon.s3.existingSecret | string | `""` | you can also specify the name of an existing Secret with keys AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY |
+| mastodon.s3.hostname | string | `""` | |
+| mastodon.s3.region | string | `""` | |
+| mastodon.secrets.existingSecret | string | `""` | you can also specify the name of an existing Secret with keys SECRET_KEY_BASE and OTP_SECRET and VAPID_PRIVATE_KEY and VAPID_PUBLIC_KEY |
+| mastodon.secrets.otp_secret | string | `""` | |
+| mastodon.secrets.secret_key_base | string | `""` | |
+| mastodon.secrets.vapid.private_key | string | `""` | |
+| mastodon.secrets.vapid.public_key | string | `""` | |
+| mastodon.sidekiq.affinity | object | `{}` | Affinity for all Sidekiq Deployments unless overwritten, overwrites .Values.affinity |
+| mastodon.sidekiq.podSecurityContext | object | `{}` | Pod security context for all Sidekiq Pods, overwrites .Values.podSecurityContext |
+| mastodon.sidekiq.resources | object | `{}` | Resources for all Sidekiq Deployments unless overwritten |
+| mastodon.sidekiq.securityContext | Sidekiq Container | `{}` | Security Context for all Pods, overwrites .Values.securityContext |
+| mastodon.sidekiq.workers[0].affinity | object | `{}` | Affinity for this specific deployment, overwrites .Values.affinity and .Values.mastodon.sidekiq.affinity |
+| mastodon.sidekiq.workers[0].concurrency | int | `25` | Number of threads / parallel sidekiq jobs that are executed per Pod |
+| mastodon.sidekiq.workers[0].name | string | `"all-queues"` | |
+| mastodon.sidekiq.workers[0].queues | list | `["default","push","mailers","pull","scheduler"]` | Sidekiq queues for Mastodon that are handled by this worker. See https://docs.joinmastodon.org/admin/scaling/#concurrency See https://github.com/mperham/sidekiq/wiki/Advanced-Options#queues for how to weight queues as argument |
+| mastodon.sidekiq.workers[0].replicas | int | `1` | Number of Pod replicas deployed by the Deployment |
+| mastodon.sidekiq.workers[0].resources | object | `{}` | Resources for this specific deployment to allow optimised scaling, overwrites .Values.mastodon.sidekiq.resources |
+| mastodon.singleUserMode | bool | `false` | If set to true, the frontpage of your Mastodon server will always redirect to the first profile in the database and registrations will be disabled. |
+| mastodon.smtp.auth_method | string | `"plain"` | |
+| mastodon.smtp.ca_file | string | `"/etc/ssl/certs/ca-certificates.crt"` | |
+| mastodon.smtp.delivery_method | string | `"smtp"` | |
+| mastodon.smtp.domain | string | `nil` | |
+| mastodon.smtp.enable_starttls | string | `"auto"` | |
+| mastodon.smtp.existingSecret | string | `nil` | you can also specify the name of an existing Secret with the keys login and password |
+| mastodon.smtp.from_address | string | `"notifications@example.com"` | |
+| mastodon.smtp.login | string | `nil` | |
+| mastodon.smtp.openssl_verify_mode | string | `"peer"` | |
+| mastodon.smtp.password | string | `nil` | |
+| mastodon.smtp.port | int | `587` | |
+| mastodon.smtp.reply_to | string | `nil` | |
+| mastodon.smtp.server | string | `"smtp.mailgun.org"` | |
+| mastodon.smtp.tls | bool | `false` | |
+| mastodon.streaming.affinity | object | `{}` | Affinity for Streaming Pods, overwrites .Values.affinity |
+| mastodon.streaming.base_url | string | `nil` | The base url for streaming can be set if the streaming API is deployed to a different domain/subdomain. |
+| mastodon.streaming.podSecurityContext | object | `{}` | Pod Security Context for Streaming Pods, overwrites .Values.podSecurityContext |
+| mastodon.streaming.port | int | `4000` | |
+| mastodon.streaming.replicas | int | `1` | Number of Streaming Pods running |
+| mastodon.streaming.resources | Streaming Container | `{}` | Resources for Streaming Pods, overwrites .Values.resources |
+| mastodon.streaming.securityContext | Streaming Container | `{}` | Security Context for Streaming Pods, overwrites .Values.securityContext |
+| mastodon.streaming.workers | int | `1` | this should be set manually since os.cpus() returns the number of CPUs on the node running the pod, which is unrelated to the resources allocated to the pod by k8s |
+| mastodon.web.affinity | object | `{}` | Affinity for Web Pods, overwrites .Values.affinity |
+| mastodon.web.podSecurityContext | object | `{}` | Pod Security Context for Web Pods, overwrites .Values.podSecurityContext |
+| mastodon.web.port | int | `3000` | |
+| mastodon.web.replicas | int | `1` | Number of Web Pods running |
+| mastodon.web.resources | Web Container | `{}` | Resources for Web Pods, overwrites .Values.resources |
+| mastodon.web.securityContext | Web Container | `{}` | Security Context for Web Pods, overwrites .Values.securityContext |
+| mastodon.web_domain | string | `nil` | Use of WEB_DOMAIN requires careful consideration: https://docs.joinmastodon.org/admin/config/#federation You must redirect the path LOCAL_DOMAIN/.well-known/ to WEB_DOMAIN/.well-known/ as described Example: mastodon.example.com |
+| podAnnotations | object | `{}` | Kubernetes manages pods for jobs and pods for deployments differently, so you might need to apply different annotations to the two different sets of pods. The annotations set with podAnnotations will be added to all deployment-managed pods. |
+| podSecurityContext | object | `{"fsGroup":991,"runAsGroup":991,"runAsUser":991}` | https://github.com/mastodon/mastodon/blob/main/Dockerfile#L75 if you manually change the UID/GID environment variables, ensure these values match: |
+| postgresql.auth.database | string | `"mastodon_production"` | |
+| postgresql.auth.existingSecret | string | `""` | |
+| postgresql.auth.password | string | `""` | |
+| postgresql.auth.username | string | `"mastodon"` | |
+| postgresql.enabled | bool | `true` | disable if you want to use an existing db; in which case the values below must match those of that external postgres instance |
+| redis.password | string | `""` | you must set a password; the password generated by the redis chart will be rotated on each upgrade: |
+| resources | object | `{}` | Default resources for all Deployments and jobs unless overwritten |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)
diff --git a/charts/mastodon/charts/elasticsearch-19.0.1.tgz b/charts/mastodon/charts/elasticsearch-19.0.1.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..7818f6c590b66abba8f5a6eccaa7f249b2214887
Binary files /dev/null and b/charts/mastodon/charts/elasticsearch-19.0.1.tgz differ
diff --git a/charts/mastodon/charts/postgresql-11.1.3.tgz b/charts/mastodon/charts/postgresql-11.1.3.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..193ac293cf0218bfddbb105305f19e0662d99221
Binary files /dev/null and b/charts/mastodon/charts/postgresql-11.1.3.tgz differ
diff --git a/charts/mastodon/charts/redis-16.13.2.tgz b/charts/mastodon/charts/redis-16.13.2.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..33b5e967b8cfff007e549c555cb64583606a7f91
Binary files /dev/null and b/charts/mastodon/charts/redis-16.13.2.tgz differ
diff --git a/charts/mastodon/templates/NOTES.txt b/charts/mastodon/templates/NOTES.txt
new file mode 100644
index 0000000000000000000000000000000000000000..0c1b1b83bb08716475fa490438d66ed7cb04214b
--- /dev/null
+++ b/charts/mastodon/templates/NOTES.txt
@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+ {{- range .paths }}
+ http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+ {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+ export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "mastodon.fullname" . }}-web)
+ export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+ echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+ NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+ You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "mastodon.fullname" . }}-web'
+ export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "mastodon.fullname" . }}-web --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+ echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+ export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "mastodon.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+ export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+ echo "Visit http://127.0.0.1:8080 to use your application"
+ kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
diff --git a/charts/mastodon/templates/_helpers.tpl b/charts/mastodon/templates/_helpers.tpl
new file mode 100644
index 0000000000000000000000000000000000000000..207780b3456d691d16a013b7e89fabfd8edec867
--- /dev/null
+++ b/charts/mastodon/templates/_helpers.tpl
@@ -0,0 +1,138 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "mastodon.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "mastodon.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "mastodon.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "mastodon.labels" -}}
+helm.sh/chart: {{ include "mastodon.chart" . }}
+{{ include "mastodon.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "mastodon.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "mastodon.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Rolling pod annotations
+*/}}
+{{- define "mastodon.rollingPodAnnotations" -}}
+rollme: {{ .Release.Revision | quote }}
+checksum/config-secrets: {{ include ( print $.Template.BasePath "/secrets.yaml" ) . | sha256sum | quote }}
+checksum/config-configmap: {{ include ( print $.Template.BasePath "/configmap-env.yaml" ) . | sha256sum | quote }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "mastodon.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "mastodon.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create a default fully qualified name for dependent services.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "mastodon.elasticsearch.fullname" -}}
+{{- printf "%s-%s" .Release.Name "elasticsearch" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "mastodon.redis.fullname" -}}
+{{- printf "%s-%s" .Release.Name "redis" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "mastodon.postgresql.fullname" -}}
+{{- printf "%s-%s" .Release.Name "postgresql" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Get the mastodon secret.
+*/}}
+{{- define "mastodon.secretName" -}}
+{{- if .Values.mastodon.secrets.existingSecret }}
+ {{- printf "%s" (tpl .Values.mastodon.secrets.existingSecret $) -}}
+{{- else -}}
+ {{- printf "%s" (include "common.names.fullname" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get the postgresql secret.
+*/}}
+{{- define "mastodon.postgresql.secretName" -}}
+{{- if (and (or .Values.postgresql.enabled .Values.postgresql.postgresqlHostname) .Values.postgresql.auth.existingSecret) }}
+ {{- printf "%s" (tpl .Values.postgresql.auth.existingSecret $) -}}
+{{- else if .Values.postgresql.enabled -}}
+ {{- printf "%s-postgresql" (tpl .Release.Name $) -}}
+{{- else -}}
+ {{- printf "%s" (include "common.names.fullname" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Get the redis secret.
+*/}}
+{{- define "mastodon.redis.secretName" -}}
+{{- if .Values.redis.auth.existingSecret }}
+ {{- printf "%s" (tpl .Values.redis.auth.existingSecret $) -}}
+{{- else if .Values.redis.existingSecret }}
+ {{- printf "%s" (tpl .Values.redis.existingSecret $) -}}
+{{- else -}}
+ {{- printf "%s-redis" (tpl .Release.Name $) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return true if a mastodon secret object should be created
+*/}}
+{{- define "mastodon.createSecret" -}}
+{{- if (or
+ (and .Values.mastodon.s3.enabled (not .Values.mastodon.s3.existingSecret))
+ (not .Values.mastodon.secrets.existingSecret )
+ (and (not .Values.postgresql.enabled) (not .Values.postgresql.auth.existingSecret))
+ ) -}}
+ {{- true -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/mastodon/templates/configmap-env.yaml b/charts/mastodon/templates/configmap-env.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..3a1df65fac101a54b27df14b78de0063f59dead7
--- /dev/null
+++ b/charts/mastodon/templates/configmap-env.yaml
@@ -0,0 +1,319 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "mastodon.fullname" . }}-env
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+data:
+ {{- if .Values.postgresql.enabled }}
+ DB_HOST: {{ template "mastodon.postgresql.fullname" . }}
+ DB_PORT: "5432"
+ {{- else }}
+ DB_HOST: {{ .Values.postgresql.postgresqlHostname }}
+ DB_PORT: {{ .Values.postgresql.postgresqlPort | default "5432" | quote }}
+ {{- end }}
+ DB_NAME: {{ .Values.postgresql.auth.database }}
+ DB_POOL: {{ .Values.mastodon.sidekiq.concurrency | quote }}
+ DB_USER: {{ .Values.postgresql.auth.username }}
+ DEFAULT_LOCALE: {{ .Values.mastodon.locale }}
+ {{- if .Values.elasticsearch.enabled }}
+ ES_ENABLED: "true"
+ ES_HOST: {{ template "mastodon.elasticsearch.fullname" . }}-master-hl
+ ES_PORT: "9200"
+ {{- end }}
+ LOCAL_DOMAIN: {{ .Values.mastodon.local_domain }}
+ {{- with .Values.mastodon.web_domain }}
+ WEB_DOMAIN: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.singleUserMode }}
+ SINGLE_USER_MODE: "true"
+ {{- end }}
+ {{- with .Values.mastodon.authorizedFetch }}
+ AUTHORIZED_FETCH: {{ . | quote }}
+ {{- end }}
+ # https://devcenter.heroku.com/articles/tuning-glibc-memory-behavior
+ MALLOC_ARENA_MAX: "2"
+ NODE_ENV: "production"
+ RAILS_ENV: "production"
+ REDIS_HOST: {{ template "mastodon.redis.fullname" . }}-master
+ REDIS_PORT: "6379"
+ {{- if .Values.mastodon.s3.enabled }}
+ S3_BUCKET: {{ .Values.mastodon.s3.bucket }}
+ S3_ENABLED: "true"
+ S3_ENDPOINT: {{ .Values.mastodon.s3.endpoint }}
+ S3_HOSTNAME: {{ .Values.mastodon.s3.hostname }}
+ S3_PROTOCOL: "https"
+ {{- with .Values.mastodon.s3.region }}
+ S3_REGION: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.s3.alias_host }}
+ S3_ALIAS_HOST: {{ .Values.mastodon.s3.alias_host}}
+ {{- end }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.auth_method }}
+ SMTP_AUTH_METHOD: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.ca_file }}
+ SMTP_CA_FILE: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.delivery_method }}
+ SMTP_DELIVERY_METHOD: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.domain }}
+ SMTP_DOMAIN: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.enable_starttls }}
+ SMTP_ENABLE_STARTTLS: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.enable_starttls_auto }}
+ SMTP_ENABLE_STARTTLS_AUTO: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.from_address }}
+ SMTP_FROM_ADDRESS: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.login }}
+ SMTP_LOGIN: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.openssl_verify_mode }}
+ SMTP_OPENSSL_VERIFY_MODE: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.password }}
+ SMTP_PASSWORD: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.port }}
+ SMTP_PORT: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.reply_to }}
+ SMTP_REPLY_TO: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.server }}
+ SMTP_SERVER: {{ . }}
+ {{- end }}
+ {{- with .Values.mastodon.smtp.tls }}
+ SMTP_TLS: {{ . | quote }}
+ {{- end }}
+ STREAMING_CLUSTER_NUM: {{ .Values.mastodon.streaming.workers | quote }}
+ {{- with .Values.mastodon.streaming.base_url }}
+ STREAMING_API_BASE_URL: {{ . | quote }}
+ {{- end }}
+ {{- if .Values.externalAuth.oidc.enabled }}
+ OIDC_ENABLED: {{ .Values.externalAuth.oidc.enabled | quote }}
+ OIDC_DISPLAY_NAME: {{ .Values.externalAuth.oidc.display_name }}
+ OIDC_ISSUER: {{ .Values.externalAuth.oidc.issuer }}
+ OIDC_DISCOVERY: {{ .Values.externalAuth.oidc.discovery | quote }}
+ OIDC_SCOPE: {{ .Values.externalAuth.oidc.scope | quote }}
+ OIDC_UID_FIELD: {{ .Values.externalAuth.oidc.uid_field }}
+ OIDC_CLIENT_ID: {{ .Values.externalAuth.oidc.client_id }}
+ OIDC_CLIENT_SECRET: {{ .Values.externalAuth.oidc.client_secret }}
+ OIDC_REDIRECT_URI: {{ .Values.externalAuth.oidc.redirect_uri }}
+ OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED: {{ .Values.externalAuth.oidc.assume_email_is_verified | quote }}
+ {{- with .Values.externalAuth.oidc.client_auth_method }}
+ OIDC_CLIENT_AUTH_METHOD: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.response_type }}
+ OIDC_RESPONSE_TYPE: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.response_mode }}
+ OIDC_RESPONSE_MODE: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.display }}
+ OIDC_DISPLAY: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.prompt }}
+ OIDC_PROMPT: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.send_nonce }}
+ OIDC_SEND_NONCE: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.send_scope_to_token_endpoint }}
+ OIDC_SEND_SCOPE_TO_TOKEN_ENDPOINT: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.idp_logout_redirect_uri }}
+ OIDC_IDP_LOGOUT_REDIRECT_URI: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.http_scheme }}
+ OIDC_HTTP_SCHEME: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.host }}
+ OIDC_HOST: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.port }}
+ OIDC_PORT: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.jwks_uri }}
+ OIDC_JWKS_URI: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.auth_endpoint }}
+ OIDC_AUTH_ENDPOINT: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.token_endpoint }}
+ OIDC_TOKEN_ENDPOINT: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.user_info_endpoint }}
+ OIDC_USER_INFO_ENDPOINT: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.oidc.end_session_endpoint }}
+ OIDC_END_SESSION_ENDPOINT: {{ . }}
+ {{- end }}
+ {{- end }}
+ {{- if .Values.externalAuth.saml.enabled }}
+ SAML_ENABLED: {{ .Values.externalAuth.saml.enabled | quote }}
+ SAML_ACS_URL: {{ .Values.externalAuth.saml.acs_url }}
+ SAML_ISSUER: {{ .Values.externalAuth.saml.issuer }}
+ SAML_IDP_SSO_TARGET_URL: {{ .Values.externalAuth.saml.idp_sso_target_url }}
+ SAML_IDP_CERT: {{ .Values.externalAuth.saml.idp_cert | quote }}
+ {{- with .Values.externalAuth.saml.idp_cert_fingerprint }}
+ SAML_IDP_CERT_FINGERPRINT: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.name_identifier_format }}
+ SAML_NAME_IDENTIFIER_FORMAT: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.cert }}
+ SAML_CERT: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.private_key }}
+ SAML_PRIVATE_KEY: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.want_assertion_signed }}
+ SAML_SECURITY_WANT_ASSERTION_SIGNED: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.want_assertion_encrypted }}
+ SAML_SECURITY_WANT_ASSERTION_ENCRYPTED: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.assume_email_is_verified }}
+ SAML_SECURITY_ASSUME_EMAIL_IS_VERIFIED: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.uid_attribute }}
+ SAML_UID_ATTRIBUTE: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.attributes_statements.uid }}
+ SAML_ATTRIBUTES_STATEMENTS_UID: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.attributes_statements.email }}
+ SAML_ATTRIBUTES_STATEMENTS_EMAIL: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.attributes_statements.full_name }}
+ SAML_ATTRIBUTES_STATEMENTS_FULL_NAME: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.attributes_statements.first_name }}
+ SAML_ATTRIBUTES_STATEMENTS_FIRST_NAME: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.attributes_statements.last_name }}
+ SAML_ATTRIBUTES_STATEMENTS_LAST_NAME: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.attributes_statements.verified }}
+ SAML_ATTRIBUTES_STATEMENTS_VERIFIED: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.saml.attributes_statements.verified_email }}
+ SAML_ATTRIBUTES_STATEMENTS_VERIFIED_EMAIL: {{ . | quote }}
+ {{- end }}
+ {{- end }}
+ {{- with .Values.externalAuth.oauth_global.omniauth_only }}
+ OMNIAUTH_ONLY: {{ . | quote }}
+ {{- end }}
+ {{- if .Values.externalAuth.cas.enabled }}
+ CAS_ENABLED: {{ .Values.externalAuth.cas.enabled | quote }}
+ CAS_URL: {{ .Values.externalAuth.cas.url }}
+ CAS_HOST: {{ .Values.externalAuth.cas.host }}
+ CAS_PORT: {{ .Values.externalAuth.cas.port }}
+ CAS_SSL: {{ .Values.externalAuth.cas.ssl | quote }}
+ {{- with .Values.externalAuth.cas.validate_url }}
+ CAS_VALIDATE_URL: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.callback_url }}
+ CAS_CALLBACK_URL: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.logout_url }}
+ CAS_LOGOUT_URL: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.login_url }}
+ CAS_LOGIN_URL: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.uid_field }}
+ CAS_UID_FIELD: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.ca_path }}
+ CAS_CA_PATH: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.disable_ssl_verification }}
+ CAS_DISABLE_SSL_VERIFICATION: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.assume_email_is_verified }}
+ CAS_SECURITY_ASSUME_EMAIL_IS_VERIFIED: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.keys.uid }}
+ CAS_UID_KEY: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.keys.name }}
+ CAS_NAME_KEY: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.keys.email }}
+ CAS_EMAIL_KEY: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.keys.nickname }}
+ CAS_NICKNAME_KEY: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.keys.first_name }}
+ CAS_FIRST_NAME_KEY: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.keys.last_name }}
+ CAS_LAST_NAME_KEY: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.keys.location }}
+ CAS_LOCATION_KEY: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.keys.image }}
+ CAS_IMAGE_KEY: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.cas.keys.phone }}
+ CAS_PHONE_KEY: {{ . | quote }}
+ {{- end }}
+ {{- end }}
+ {{- with .Values.externalAuth.pam.enabled }}
+ PAM_ENABLED: {{ . | quote }}
+ {{- with .Values.externalAuth.pam.email_domain }}
+ PAM_EMAIL_DOMAIN: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.pam.default_service }}
+ PAM_DEFAULT_SERVICE: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.pam.controlled_service }}
+ PAM_CONTROLLED_SERVICE: {{ . }}
+ {{- end }}
+ {{- end }}
+ {{- if .Values.externalAuth.ldap.enabled }}
+ LDAP_ENABLED: {{ .Values.externalAuth.ldap.enabled | quote }}
+ LDAP_HOST: {{ .Values.externalAuth.ldap.host }}
+ LDAP_PORT: {{ .Values.externalAuth.ldap.port }}
+ LDAP_METHOD: {{ .Values.externalAuth.ldap.method }}
+ {{- with .Values.externalAuth.ldap.base }}
+ LDAP_BASE: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.ldap.bind_on }}
+ LDAP_BIND_ON: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.ldap.password }}
+ LDAP_PASSWORD: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.ldap.uid }}
+ LDAP_UID: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.ldap.mail }}
+ LDAP_MAIL: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.ldap.search_filter }}
+ LDAP_SEARCH_FILTER: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.ldap.uid_conversion.enabled }}
+ LDAP_UID_CONVERSION_ENABLED: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.externalAuth.ldap.uid_conversion.search }}
+ LDAP_UID_CONVERSION_SEARCH: {{ . }}
+ {{- end }}
+ {{- with .Values.externalAuth.ldap.uid_conversion.replace }}
+ LDAP_UID_CONVERSION_REPLACE: {{ . }}
+ {{- end }}
+ {{- end }}
+ {{- with .Values.mastodon.metrics.statsd.address }}
+ STATSD_ADDR: {{ . }}
+ {{- end }}
diff --git a/charts/mastodon/templates/cronjob-media-remove.yaml b/charts/mastodon/templates/cronjob-media-remove.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..41f1feb82566fd5cd65440d72f5f50652344fc4c
--- /dev/null
+++ b/charts/mastodon/templates/cronjob-media-remove.yaml
@@ -0,0 +1,77 @@
+{{ if .Values.mastodon.cron.removeMedia.enabled -}}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+ name: {{ include "mastodon.fullname" . }}-media-remove
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+spec:
+ schedule: {{ .Values.mastodon.cron.removeMedia.schedule }}
+ jobTemplate:
+ spec:
+ template:
+ metadata:
+ name: {{ include "mastodon.fullname" . }}-media-remove
+ {{- with .Values.jobAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ spec:
+ restartPolicy: OnFailure
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ # ensure we run on the same node as the other rails components; only
+ # required when using PVCs that are ReadWriteOnce
+ {{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
+ affinity:
+ podAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchExpressions:
+ - key: app.kubernetes.io/part-of
+ operator: In
+ values:
+ - rails
+ topologyKey: kubernetes.io/hostname
+ {{- end }}
+ volumes:
+ - name: assets
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-assets
+ - name: system
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-system
+ {{- end }}
+ containers:
+ - name: {{ include "mastodon.fullname" . }}-media-remove
+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ command:
+ - bin/tootctl
+ - media
+ - remove
+ envFrom:
+ - configMapRef:
+ name: {{ include "mastodon.fullname" . }}-env
+ - secretRef:
+ name: {{ template "mastodon.secretName" . }}
+ env:
+ - name: "DB_PASS"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.postgresql.secretName" . }}
+ key: password
+ - name: "REDIS_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.redis.secretName" . }}
+ key: redis-password
+ - name: "PORT"
+ value: {{ .Values.mastodon.web.port | quote }}
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ volumeMounts:
+ - name: assets
+ mountPath: /opt/mastodon/public/assets
+ - name: system
+ mountPath: /opt/mastodon/public/system
+ {{- end }}
+{{- end }}
diff --git a/charts/mastodon/templates/deployment-sidekiq.yaml b/charts/mastodon/templates/deployment-sidekiq.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..623c550257616f7249cbdae1898c97649a8fce0b
--- /dev/null
+++ b/charts/mastodon/templates/deployment-sidekiq.yaml
@@ -0,0 +1,127 @@
+{{- $context := . }}
+{{- range .Values.mastodon.sidekiq.workers }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: {{ include "mastodon.fullname" $context }}-sidekiq-{{ .name }}
+ labels:
+ {{- include "mastodon.labels" $context | nindent 4 }}
+ app.kubernetes.io/component: sidekiq-{{ .name }}
+ app.kubernetes.io/part-of: rails
+spec:
+ replicas: {{ .replicas }}
+ selector:
+ matchLabels:
+ {{- include "mastodon.selectorLabels" $context | nindent 6 }}
+ app.kubernetes.io/component: sidekiq-{{ .name }}
+ app.kubernetes.io/part-of: rails
+ template:
+ metadata:
+ annotations:
+ {{- with $context.Values.podAnnotations }}
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ # roll the pods to pick up any db migrations or other changes
+ {{- include "mastodon.rollingPodAnnotations" $context | nindent 8 }}
+ labels:
+ {{- include "mastodon.selectorLabels" $context | nindent 8 }}
+ app.kubernetes.io/component: sidekiq-{{ .name }}
+ app.kubernetes.io/part-of: rails
+ spec:
+ {{- with $context.Values.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ serviceAccountName: {{ include "mastodon.serviceAccountName" $context }}
+ {{- with (default $context.Values.podSecurityContext $context.Values.mastodon.sidekiq.podSecurityContext) }}
+ securityContext:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with (default (default $context.Values.affinity $context.Values.mastodon.sidekiq.affinity) .affinity) }}
+ affinity:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- if (not $context.Values.mastodon.s3.enabled) }}
+ volumes:
+ - name: assets
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" $context }}-assets
+ - name: system
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" $context }}-system
+ {{- end }}
+ containers:
+ - name: {{ $context.Chart.Name }}
+ securityContext:
+ {{- toYaml $context.Values.mastodon.sidekiq.securityContext | nindent 12 }}
+ image: "{{ $context.Values.image.repository }}:{{ $context.Values.image.tag | default $context.Chart.AppVersion }}"
+ imagePullPolicy: {{ $context.Values.image.pullPolicy }}
+ command:
+ - bundle
+ - exec
+ - sidekiq
+ - -c
+ - {{ .concurrency | quote }}
+ {{- range .queues }}
+ - -q
+ - {{ . | quote }}
+ {{- end }}
+ envFrom:
+ - configMapRef:
+ name: {{ include "mastodon.fullname" $context }}-env
+ - secretRef:
+ name: {{ template "mastodon.secretName" $context }}
+ env:
+ - name: "DB_PASS"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.postgresql.secretName" $context }}
+ key: password
+ - name: "REDIS_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.redis.secretName" $context }}
+ key: redis-password
+ {{- if (and $context.Values.mastodon.s3.enabled $context.Values.mastodon.s3.existingSecret) }}
+ - name: "AWS_SECRET_ACCESS_KEY"
+ valueFrom:
+ secretKeyRef:
+ name: {{ $context.Values.mastodon.s3.existingSecret }}
+ key: AWS_SECRET_ACCESS_KEY
+ - name: "AWS_ACCESS_KEY_ID"
+ valueFrom:
+ secretKeyRef:
+ name: {{ .Values.mastodon.s3.existingSecret }}
+ key: AWS_ACCESS_KEY_ID
+ {{- end }}
+ {{- if $context.Values.mastodon.smtp.existingSecret }}
+ - name: "SMTP_LOGIN"
+ valueFrom:
+ secretKeyRef:
+ name: {{ $context.Values.mastodon.smtp.existingSecret }}
+ key: login
+ optional: true
+ - name: "SMTP_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: {{ $context.Values.mastodon.smtp.existingSecret }}
+ key: password
+ {{- end }}
+ {{- if (not $context.Values.mastodon.s3.enabled) }}
+ volumeMounts:
+ - name: assets
+ mountPath: /opt/mastodon/public/assets
+ - name: system
+ mountPath: /opt/mastodon/public/system
+ {{- end }}
+ resources:
+ {{- toYaml .resources | nindent 12 }}
+ {{- with $context.Values.nodeSelector }}
+ nodeSelector:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with $context.Values.tolerations }}
+ tolerations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/mastodon/templates/deployment-streaming.yaml b/charts/mastodon/templates/deployment-streaming.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..dd804044c97172ad17e52ded8f0240f1a806d6ae
--- /dev/null
+++ b/charts/mastodon/templates/deployment-streaming.yaml
@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: {{ include "mastodon.fullname" . }}-streaming
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+spec:
+ replicas: {{ .Values.mastodon.streaming.replicas }}
+ selector:
+ matchLabels:
+ {{- include "mastodon.selectorLabels" . | nindent 6 }}
+ app.kubernetes.io/component: streaming
+ template:
+ metadata:
+ annotations:
+ {{- with (default .Values.podAnnotations .Values.mastodon.streaming.podAnnotations) }}
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ # roll the pods to pick up any db migrations or other changes
+ {{- include "mastodon.rollingPodAnnotations" . | nindent 8 }}
+ labels:
+ {{- include "mastodon.selectorLabels" . | nindent 8 }}
+ app.kubernetes.io/component: streaming
+ spec:
+ {{- with .Values.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ serviceAccountName: {{ include "mastodon.serviceAccountName" . }}
+ {{- with (default .Values.podSecurityContext .Values.mastodon.streaming.podSecurityContext) }}
+ securityContext:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ containers:
+ - name: {{ .Chart.Name }}-streaming
+ {{- with (default .Values.securityContext .Values.mastodon.streaming.securityContext) }}
+ securityContext:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ command:
+ - node
+ - ./streaming
+ envFrom:
+ - configMapRef:
+ name: {{ include "mastodon.fullname" . }}-env
+ env:
+ - name: "DB_PASS"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.postgresql.secretName" . }}
+ key: password
+ - name: "REDIS_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.redis.secretName" . }}
+ key: redis-password
+ - name: "PORT"
+ value: {{ .Values.mastodon.streaming.port | quote }}
+ ports:
+ - name: streaming
+ containerPort: {{ .Values.mastodon.streaming.port }}
+ protocol: TCP
+ livenessProbe:
+ httpGet:
+ path: /api/v1/streaming/health
+ port: streaming
+ readinessProbe:
+ httpGet:
+ path: /api/v1/streaming/health
+ port: streaming
+ {{- with (default .Values.resources .Values.mastodon.streaming.resources) }}
+ resources:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- with .Values.nodeSelector }}
+ nodeSelector:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with (default .Values.affinity .Values.mastodon.streaming.affinity) }}
+ affinity:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.tolerations }}
+ tolerations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
diff --git a/charts/mastodon/templates/deployment-web.yaml b/charts/mastodon/templates/deployment-web.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..c1ec2327e8e11cae961ce0b8db1d396e498796dd
--- /dev/null
+++ b/charts/mastodon/templates/deployment-web.yaml
@@ -0,0 +1,128 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: {{ include "mastodon.fullname" . }}-web
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+spec:
+ replicas: {{ .Values.mastodon.web.replicas }}
+ selector:
+ matchLabels:
+ {{- include "mastodon.selectorLabels" . | nindent 6 }}
+ app.kubernetes.io/component: web
+ app.kubernetes.io/part-of: rails
+ template:
+ metadata:
+ annotations:
+ {{- with (default .Values.podAnnotations .Values.mastodon.web.podAnnotations) }}
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ # roll the pods to pick up any db migrations or other changes
+ {{- include "mastodon.rollingPodAnnotations" . | nindent 8 }}
+ labels:
+ {{- include "mastodon.selectorLabels" . | nindent 8 }}
+ app.kubernetes.io/component: web
+ app.kubernetes.io/part-of: rails
+ spec:
+ {{- with .Values.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ serviceAccountName: {{ include "mastodon.serviceAccountName" . }}
+ {{- with (default .Values.podSecurityContext .Values.mastodon.web.podSecurityContext) }}
+ securityContext:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ volumes:
+ - name: assets
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-assets
+ - name: system
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-system
+ {{- end }}
+ containers:
+ - name: {{ .Chart.Name }}-web
+ {{- with (default .Values.securityContext .Values.mastodon.web.securityContext) }}
+ securityContext:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ command:
+ - bundle
+ - exec
+ - puma
+ - -C
+ - config/puma.rb
+ envFrom:
+ - configMapRef:
+ name: {{ include "mastodon.fullname" . }}-env
+ - secretRef:
+ name: {{ template "mastodon.secretName" . }}
+ env:
+ - name: "DB_PASS"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.postgresql.secretName" . }}
+ key: password
+ - name: "REDIS_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.redis.secretName" . }}
+ key: redis-password
+ - name: "PORT"
+ value: {{ .Values.mastodon.web.port | quote }}
+ {{- if (and .Values.mastodon.s3.enabled .Values.mastodon.s3.existingSecret) }}
+ - name: "AWS_SECRET_ACCESS_KEY"
+ valueFrom:
+ secretKeyRef:
+ name: {{ .Values.mastodon.s3.existingSecret }}
+ key: AWS_SECRET_ACCESS_KEY
+ - name: "AWS_ACCESS_KEY_ID"
+ valueFrom:
+ secretKeyRef:
+ name: {{ .Values.mastodon.s3.existingSecret }}
+ key: AWS_ACCESS_KEY_ID
+ {{- end }}
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ volumeMounts:
+ - name: assets
+ mountPath: /opt/mastodon/public/assets
+ - name: system
+ mountPath: /opt/mastodon/public/system
+ {{- end }}
+ ports:
+ - name: http
+ containerPort: {{ .Values.mastodon.web.port }}
+ protocol: TCP
+ livenessProbe:
+ tcpSocket:
+ port: http
+ readinessProbe:
+ httpGet:
+ path: /health
+ port: http
+ startupProbe:
+ httpGet:
+ path: /health
+ port: http
+ failureThreshold: 30
+ periodSeconds: 5
+ {{- with (default .Values.resources .Values.mastodon.web.resources) }}
+ resources:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- with .Values.nodeSelector }}
+ nodeSelector:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with (default .Values.affinity .Values.mastodon.web.affinity) }}
+ affinity:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.tolerations }}
+ tolerations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
diff --git a/charts/mastodon/templates/ingress.yaml b/charts/mastodon/templates/ingress.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..e5c5e1dc67b49bd7c8be061bdc7e9dbd8eb276b9
--- /dev/null
+++ b/charts/mastodon/templates/ingress.yaml
@@ -0,0 +1,71 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "mastodon.fullname" . -}}
+{{- $webPort := .Values.mastodon.web.port -}}
+{{- $streamingPort := .Values.mastodon.streaming.port -}}
+{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+ name: {{ $fullName }}
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+ {{- with .Values.ingress.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ {{- if .Values.ingress.ingressClassName }}
+ ingressClassName: {{ .Values.ingress.ingressClassName }}
+ {{- end }}
+ {{- if .Values.ingress.tls }}
+ tls:
+ {{- range .Values.ingress.tls }}
+ - hosts:
+ {{- range .hosts }}
+ - {{ . | quote }}
+ {{- end }}
+ secretName: {{ .secretName }}
+ {{- end }}
+ {{- end }}
+ rules:
+ {{- range .Values.ingress.hosts }}
+ - host: {{ .host | quote }}
+ http:
+ paths:
+ {{- range .paths }}
+ - path: {{ .path }}
+ backend:
+ {{- if or ($.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not ($.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
+ service:
+ name: {{ $fullName }}-web
+ port:
+ number: {{ $webPort }}
+ {{- else }}
+ serviceName: {{ $fullName }}-web
+ servicePort: {{ $webPort }}
+ {{- end }}
+ {{- if or ($.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not ($.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
+ pathType: Prefix
+ {{- end }}
+ - path: {{ .path }}api/v1/streaming/
+ backend:
+ {{- if or ($.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not ($.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
+ service:
+ name: {{ $fullName }}-streaming
+ port:
+ number: {{ $streamingPort }}
+ {{- else }}
+ serviceName: {{ $fullName }}-streaming
+ servicePort: {{ $streamingPort }}
+ {{- end }}
+ {{- if or ($.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not ($.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
+ pathType: Exact
+ {{- end }}
+ {{- end }}
+ {{- end }}
+{{- end }}
diff --git a/charts/mastodon/templates/job-assets-precompile.yaml b/charts/mastodon/templates/job-assets-precompile.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..bc5ff7bfb827d9d34b3265d06e70ba7e3a98b2e8
--- /dev/null
+++ b/charts/mastodon/templates/job-assets-precompile.yaml
@@ -0,0 +1,77 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+ name: {{ include "mastodon.fullname" . }}-assets-precompile
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+ annotations:
+ "helm.sh/hook": post-install
+ "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+ "helm.sh/hook-weight": "-2"
+spec:
+ template:
+ metadata:
+ name: {{ include "mastodon.fullname" . }}-assets-precompile
+ {{- with .Values.jobAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ spec:
+ restartPolicy: Never
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ # ensure we run on the same node as the other rails components; only
+ # required when using PVCs that are ReadWriteOnce
+ {{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
+ affinity:
+ podAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchExpressions:
+ - key: app.kubernetes.io/part-of
+ operator: In
+ values:
+ - rails
+ topologyKey: kubernetes.io/hostname
+ {{- end }}
+ volumes:
+ - name: assets
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-assets
+ - name: system
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-system
+ {{- end }}
+ containers:
+ - name: {{ include "mastodon.fullname" . }}-assets-precompile
+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ command:
+ - bash
+ - -c
+ - |
+ bundle exec rake assets:precompile && yarn cache clean
+ envFrom:
+ - configMapRef:
+ name: {{ include "mastodon.fullname" . }}-env
+ - secretRef:
+ name: {{ template "mastodon.secretName" . }}
+ env:
+ - name: "DB_PASS"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.postgresql.secretName" . }}
+ key: password
+ - name: "REDIS_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.redis.secretName" . }}
+ key: redis-password
+ - name: "PORT"
+ value: {{ .Values.mastodon.web.port | quote }}
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ volumeMounts:
+ - name: assets
+ mountPath: /opt/mastodon/public/assets
+ - name: system
+ mountPath: /opt/mastodon/public/system
+ {{- end }}
diff --git a/charts/mastodon/templates/job-chewy-upgrade.yaml b/charts/mastodon/templates/job-chewy-upgrade.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..f86a4e34f667b4d22e63e018983365ab7861d811
--- /dev/null
+++ b/charts/mastodon/templates/job-chewy-upgrade.yaml
@@ -0,0 +1,79 @@
+{{- if .Values.elasticsearch.enabled -}}
+apiVersion: batch/v1
+kind: Job
+metadata:
+ name: {{ include "mastodon.fullname" . }}-chewy-upgrade
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+ annotations:
+ "helm.sh/hook": post-install
+ "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+ "helm.sh/hook-weight": "-1"
+spec:
+ template:
+ metadata:
+ name: {{ include "mastodon.fullname" . }}-chewy-upgrade
+ {{- with .Values.jobAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ spec:
+ restartPolicy: Never
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ # ensure we run on the same node as the other rails components; only
+ # required when using PVCs that are ReadWriteOnce
+ {{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
+ affinity:
+ podAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchExpressions:
+ - key: app.kubernetes.io/part-of
+ operator: In
+ values:
+ - rails
+ topologyKey: kubernetes.io/hostname
+ {{- end }}
+ volumes:
+ - name: assets
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-assets
+ - name: system
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-system
+ {{- end }}
+ containers:
+ - name: {{ include "mastodon.fullname" . }}-chewy-setup
+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ command:
+ - bundle
+ - exec
+ - rake
+ - chewy:upgrade
+ envFrom:
+ - configMapRef:
+ name: {{ include "mastodon.fullname" . }}-env
+ - secretRef:
+ name: {{ template "mastodon.secretName" . }}
+ env:
+ - name: "DB_PASS"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.postgresql.secretName" . }}
+ key: password
+ - name: "REDIS_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.redis.secretName" . }}
+ key: redis-password
+ - name: "PORT"
+ value: {{ .Values.mastodon.web.port | quote }}
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ volumeMounts:
+ - name: assets
+ mountPath: /opt/mastodon/public/assets
+ - name: system
+ mountPath: /opt/mastodon/public/system
+ {{- end }}
+{{- end }}
diff --git a/charts/mastodon/templates/job-create-admin.yaml b/charts/mastodon/templates/job-create-admin.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..f28cdab4187a2ecfefd09533deff17b5f07b24c9
--- /dev/null
+++ b/charts/mastodon/templates/job-create-admin.yaml
@@ -0,0 +1,84 @@
+{{- if .Values.mastodon.createAdmin.enabled -}}
+apiVersion: batch/v1
+kind: Job
+metadata:
+ name: {{ include "mastodon.fullname" . }}-create-admin
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+ annotations:
+ "helm.sh/hook": post-install
+ "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+ "helm.sh/hook-weight": "-1"
+spec:
+ template:
+ metadata:
+ name: {{ include "mastodon.fullname" . }}-create-admin
+ {{- with .Values.jobAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ spec:
+ restartPolicy: Never
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ # ensure we run on the same node as the other rails components; only
+ # required when using PVCs that are ReadWriteOnce
+ {{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
+ affinity:
+ podAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchExpressions:
+ - key: app.kubernetes.io/part-of
+ operator: In
+ values:
+ - rails
+ topologyKey: kubernetes.io/hostname
+ {{- end }}
+ volumes:
+ - name: assets
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-assets
+ - name: system
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-system
+ {{- end }}
+ containers:
+ - name: {{ include "mastodon.fullname" . }}-create-admin
+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ command:
+ - bin/tootctl
+ - accounts
+ - create
+ - {{ .Values.mastodon.createAdmin.username }}
+ - --email
+ - {{ .Values.mastodon.createAdmin.email }}
+ - --confirmed
+ - --role
+ - admin
+ envFrom:
+ - configMapRef:
+ name: {{ include "mastodon.fullname" . }}-env
+ - secretRef:
+ name: {{ template "mastodon.secretName" . }}
+ env:
+ - name: "DB_PASS"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.postgresql.secretName" . }}
+ key: password
+ - name: "REDIS_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.redis.secretName" . }}
+ key: redis-password
+ - name: "PORT"
+ value: {{ .Values.mastodon.web.port | quote }}
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ volumeMounts:
+ - name: assets
+ mountPath: /opt/mastodon/public/assets
+ - name: system
+ mountPath: /opt/mastodon/public/system
+ {{- end }}
+{{- end }}
diff --git a/charts/mastodon/templates/job-db-migrate.yaml b/charts/mastodon/templates/job-db-migrate.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..41324fbd0c5df21f79e03c9faf8d0d83ebb4b4d8
--- /dev/null
+++ b/charts/mastodon/templates/job-db-migrate.yaml
@@ -0,0 +1,77 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+ name: {{ include "mastodon.fullname" . }}-db-migrate
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+ annotations:
+ "helm.sh/hook": post-install,pre-upgrade
+ "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+ "helm.sh/hook-weight": "-2"
+spec:
+ template:
+ metadata:
+ name: {{ include "mastodon.fullname" . }}-db-migrate
+ {{- with .Values.jobAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ spec:
+ restartPolicy: Never
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ # ensure we run on the same node as the other rails components; only
+ # required when using PVCs that are ReadWriteOnce
+ {{- if or (eq "ReadWriteOnce" .Values.mastodon.persistence.assets.accessMode) (eq "ReadWriteOnce" .Values.mastodon.persistence.system.accessMode) }}
+ affinity:
+ podAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchExpressions:
+ - key: app.kubernetes.io/part-of
+ operator: In
+ values:
+ - rails
+ topologyKey: kubernetes.io/hostname
+ {{- end }}
+ volumes:
+ - name: assets
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-assets
+ - name: system
+ persistentVolumeClaim:
+ claimName: {{ template "mastodon.fullname" . }}-system
+ {{- end }}
+ containers:
+ - name: {{ include "mastodon.fullname" . }}-db-migrate
+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ command:
+ - bundle
+ - exec
+ - rake
+ - db:migrate
+ envFrom:
+ - configMapRef:
+ name: {{ include "mastodon.fullname" . }}-env
+ - secretRef:
+ name: {{ template "mastodon.secretName" . }}
+ env:
+ - name: "DB_PASS"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.postgresql.secretName" . }}
+ key: password
+ - name: "REDIS_PASSWORD"
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "mastodon.redis.secretName" . }}
+ key: redis-password
+ - name: "PORT"
+ value: {{ .Values.mastodon.web.port | quote }}
+ {{- if (not .Values.mastodon.s3.enabled) }}
+ volumeMounts:
+ - name: assets
+ mountPath: /opt/mastodon/public/assets
+ - name: system
+ mountPath: /opt/mastodon/public/system
+ {{- end }}
diff --git a/charts/mastodon/templates/pvc-assets.yaml b/charts/mastodon/templates/pvc-assets.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..36d555898e744c7594bdb11eed068c4920193282
--- /dev/null
+++ b/charts/mastodon/templates/pvc-assets.yaml
@@ -0,0 +1,16 @@
+{{- if (not .Values.mastodon.s3.enabled) -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+ name: {{ template "mastodon.fullname" . }}-assets
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+spec:
+ accessModes:
+ - {{ .Values.mastodon.persistence.system.accessMode }}
+ {{- with .Values.mastodon.persistence.assets.resources }}
+ resources:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ storageClassName: {{ .Values.mastodon.persistence.assets.storageClassName }}
+{{- end }}
diff --git a/charts/mastodon/templates/pvc-system.yaml b/charts/mastodon/templates/pvc-system.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..9865346eaac5901bc9d47691cf6e46796491a908
--- /dev/null
+++ b/charts/mastodon/templates/pvc-system.yaml
@@ -0,0 +1,16 @@
+{{- if (not .Values.mastodon.s3.enabled) -}}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+ name: {{ template "mastodon.fullname" . }}-system
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+spec:
+ accessModes:
+ - {{ .Values.mastodon.persistence.system.accessMode }}
+ {{- with .Values.mastodon.persistence.system.resources }}
+ resources:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ storageClassName: {{ .Values.mastodon.persistence.system.storageClassName }}
+{{- end }}
diff --git a/charts/mastodon/templates/secrets.yaml b/charts/mastodon/templates/secrets.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..d1776ac590b6ce57e1a2bd5a779aec68f593045a
--- /dev/null
+++ b/charts/mastodon/templates/secrets.yaml
@@ -0,0 +1,43 @@
+{{- if (include "mastodon.createSecret" .) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ template "mastodon.fullname" . }}
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+type: Opaque
+data:
+ {{- if .Values.mastodon.s3.enabled }}
+ {{- if not .Values.mastodon.s3.existingSecret }}
+ AWS_ACCESS_KEY_ID: "{{ .Values.mastodon.s3.access_key | b64enc }}"
+ AWS_SECRET_ACCESS_KEY: "{{ .Values.mastodon.s3.access_secret | b64enc }}"
+ {{- end }}
+ {{- end }}
+ {{- if not .Values.mastodon.secrets.existingSecret }}
+ {{- if not (empty .Values.mastodon.secrets.secret_key_base) }}
+ SECRET_KEY_BASE: "{{ .Values.mastodon.secrets.secret_key_base | b64enc }}"
+ {{- else }}
+ SECRET_KEY_BASE: {{ required "secret_key_base is required" .Values.mastodon.secrets.secret_key_base }}
+ {{- end }}
+ {{- if not (empty .Values.mastodon.secrets.otp_secret) }}
+ OTP_SECRET: "{{ .Values.mastodon.secrets.otp_secret | b64enc }}"
+ {{- else }}
+ OTP_SECRET: {{ required "otp_secret is required" .Values.mastodon.secrets.otp_secret }}
+ {{- end }}
+ {{- if not (empty .Values.mastodon.secrets.vapid.private_key) }}
+ VAPID_PRIVATE_KEY: "{{ .Values.mastodon.secrets.vapid.private_key | b64enc }}"
+ {{- else }}
+ VAPID_PRIVATE_KEY: {{ required "vapid.private_key is required" .Values.mastodon.secrets.vapid.private_key }}
+ {{- end }}
+ {{- if not (empty .Values.mastodon.secrets.vapid.public_key) }}
+ VAPID_PUBLIC_KEY: "{{ .Values.mastodon.secrets.vapid.public_key | b64enc }}"
+ {{- else }}
+ VAPID_PUBLIC_KEY: {{ required "vapid.public_key is required" .Values.mastodon.secrets.vapid.public_key }}
+ {{- end }}
+ {{- end }}
+ {{- if not .Values.postgresql.enabled }}
+ {{- if not .Values.postgresql.auth.existingSecret }}
+ password: "{{ .Values.postgresql.auth.password | b64enc }}"
+ {{- end }}
+ {{- end }}
+{{- end }}
diff --git a/charts/mastodon/templates/service-streaming.yaml b/charts/mastodon/templates/service-streaming.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..bade7b1e5193da1f7d5303d9bf194ab615677aa3
--- /dev/null
+++ b/charts/mastodon/templates/service-streaming.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "mastodon.fullname" . }}-streaming
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+spec:
+ type: {{ .Values.service.type }}
+ ports:
+ - port: {{ .Values.mastodon.streaming.port }}
+ targetPort: streaming
+ protocol: TCP
+ name: streaming
+ selector:
+ {{- include "mastodon.selectorLabels" . | nindent 4 }}
+ app.kubernetes.io/component: streaming
diff --git a/charts/mastodon/templates/service-web.yaml b/charts/mastodon/templates/service-web.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..acf1233dcefe35223e6d9a000b647aa5de289575
--- /dev/null
+++ b/charts/mastodon/templates/service-web.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "mastodon.fullname" . }}-web
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+spec:
+ type: {{ .Values.service.type }}
+ ports:
+ - port: {{ .Values.mastodon.web.port }}
+ targetPort: http
+ protocol: TCP
+ name: http
+ selector:
+ {{- include "mastodon.selectorLabels" . | nindent 4 }}
+ app.kubernetes.io/component: web
diff --git a/charts/mastodon/templates/serviceaccount.yaml b/charts/mastodon/templates/serviceaccount.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..b2f3d87c593f69d7ddaf8a6772ecdd2fa08688e8
--- /dev/null
+++ b/charts/mastodon/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: {{ include "mastodon.serviceAccountName" . }}
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+ {{- with .Values.serviceAccount.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+{{- end }}
diff --git a/charts/mastodon/templates/tests/test-connection.yaml b/charts/mastodon/templates/tests/test-connection.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..185c037ab29b4652f7f46f68d050208add251940
--- /dev/null
+++ b/charts/mastodon/templates/tests/test-connection.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+ name: "{{ include "mastodon.fullname" . }}-test-connection"
+ labels:
+ {{- include "mastodon.labels" . | nindent 4 }}
+ annotations:
+ "helm.sh/hook": test-success
+spec:
+ containers:
+ - name: wget
+ image: busybox
+ command: ['wget']
+ args: ['{{ include "mastodon.fullname" . }}-web:{{ .Values.service.port }}']
+ restartPolicy: Never
diff --git a/charts/mastodon/values.yaml b/charts/mastodon/values.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..fabfeee7a8cbd20c1fc2bcdb1225ba8ce0e2ba79
--- /dev/null
+++ b/charts/mastodon/values.yaml
@@ -0,0 +1,419 @@
+image:
+ repository: tootsuite/mastodon
+ # https://hub.docker.com/r/tootsuite/mastodon/tags
+ #
+ # alternatively, use `latest` for the latest release or `edge` for the image
+ # built from the most recent commit
+ #
+ # tag: latest
+ tag: ""
+ # use `Always` when using `latest` tag
+ pullPolicy: IfNotPresent
+
+mastodon:
+ # -- create an initial administrator user; the password is autogenerated and will
+ # have to be reset
+ createAdmin:
+ # @ignored
+ enabled: false
+ # @ignored
+ username: not_gargron
+ # @ignored
+ email: not@example.com
+ cron:
+ # -- run `tootctl media remove` every week
+ removeMedia:
+ # @ignored
+ enabled: true
+ # @ignored
+ schedule: "0 0 * * 0"
+ # -- available locales: https://github.com/mastodon/mastodon/blob/main/config/application.rb#L71
+ locale: en
+ local_domain: mastodon.local
+ # -- Use of WEB_DOMAIN requires careful consideration: https://docs.joinmastodon.org/admin/config/#federation
+ # You must redirect the path LOCAL_DOMAIN/.well-known/ to WEB_DOMAIN/.well-known/ as described
+ # Example: mastodon.example.com
+ web_domain: null
+ # -- If set to true, the frontpage of your Mastodon server will always redirect to the first profile in the database and registrations will be disabled.
+ singleUserMode: false
+ # -- Enables "Secure Mode" for more details see: https://docs.joinmastodon.org/admin/config/#authorized_fetch
+ authorizedFetch: false
+ persistence:
+ assets:
+ # -- ReadWriteOnce is more widely supported than ReadWriteMany, but limits
+ # scalability, since it requires the Rails and Sidekiq pods to run on the
+ # same node.
+ accessMode: ReadWriteOnce
+ resources:
+ requests:
+ storage: 10Gi
+ system:
+ accessMode: ReadWriteOnce
+ resources:
+ requests:
+ storage: 100Gi
+ s3:
+ enabled: false
+ access_key: ""
+ access_secret: ""
+ # -- you can also specify the name of an existing Secret
+ # with keys AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
+ existingSecret: ""
+ bucket: ""
+ endpoint: ""
+ hostname: ""
+ region: ""
+ # -- If you have a caching proxy, enter its base URL here.
+ alias_host: ""
+ # these must be set manually; autogenerated keys are rotated on each upgrade
+ secrets:
+ secret_key_base: ""
+ otp_secret: ""
+ vapid:
+ private_key: ""
+ public_key: ""
+ # -- you can also specify the name of an existing Secret
+ # with keys SECRET_KEY_BASE and OTP_SECRET and
+ # VAPID_PRIVATE_KEY and VAPID_PUBLIC_KEY
+ existingSecret: ""
+ sidekiq:
+ # -- Pod security context for all Sidekiq Pods, overwrites .Values.podSecurityContext
+ podSecurityContext: {}
+ # -- (Sidekiq Container) Security Context for all Pods, overwrites .Values.securityContext
+ securityContext: {}
+ # -- Resources for all Sidekiq Deployments unless overwritten
+ resources: {}
+ # -- Affinity for all Sidekiq Deployments unless overwritten, overwrites .Values.affinity
+ affinity: {}
+ # limits:
+ # cpu: "1"
+ # memory: 768Mi
+ # requests:
+ # cpu: 250m
+ # memory: 512Mi
+ workers:
+ - name: all-queues
+ # -- Number of threads / parallel sidekiq jobs that are executed per Pod
+ concurrency: 25
+ # -- Number of Pod replicas deployed by the Deployment
+ replicas: 1
+ # -- Resources for this specific deployment to allow optimised scaling, overwrites .Values.mastodon.sidekiq.resources
+ resources: {}
+ # -- Affinity for this specific deployment, overwrites .Values.affinity and .Values.mastodon.sidekiq.affinity
+ affinity: {}
+ # -- Sidekiq queues for Mastodon that are handled by this worker. See https://docs.joinmastodon.org/admin/scaling/#concurrency
+ # See https://github.com/mperham/sidekiq/wiki/Advanced-Options#queues for how to weight queues as argument
+ queues:
+ - default
+ - push
+ - mailers
+ - pull
+ - scheduler # Make sure the scheduler queue only exists once and with a worker that has 1 replica.
+ #- name: push-pull
+ # concurrency: 50
+ # resources: {}
+ # replicas: 2
+ # queues:
+ # - push
+ # - pull
+ #- name: mailers
+ # concurrency: 25
+ # replicas: 2
+ # queues:
+ # - mailers
+ #- name: default
+ # concurrency: 25
+ # replicas: 2
+ # queues:
+ # - default
+ smtp:
+ auth_method: plain
+ ca_file: /etc/ssl/certs/ca-certificates.crt
+ delivery_method: smtp
+ domain:
+ enable_starttls: 'auto'
+ from_address: notifications@example.com
+ openssl_verify_mode: peer
+ port: 587
+ reply_to:
+ server: smtp.mailgun.org
+ tls: false
+ login:
+ password:
+ # -- you can also specify the name of an existing Secret
+ # with the keys login and password
+ existingSecret:
+ streaming:
+ port: 4000
+ # -- this should be set manually since os.cpus() returns the number of CPUs on
+ # the node running the pod, which is unrelated to the resources allocated to
+ # the pod by k8s
+ workers: 1
+ # -- The base url for streaming can be set if the streaming API is deployed to
+ # a different domain/subdomain.
+ base_url: null
+ # -- Number of Streaming Pods running
+ replicas: 1
+ # -- Affinity for Streaming Pods, overwrites .Values.affinity
+ affinity: {}
+ # -- Pod Security Context for Streaming Pods, overwrites .Values.podSecurityContext
+ podSecurityContext: {}
+ # -- (Streaming Container) Security Context for Streaming Pods, overwrites .Values.securityContext
+ securityContext: {}
+ # -- (Streaming Container) Resources for Streaming Pods, overwrites .Values.resources
+ resources: {}
+ # limits:
+ # cpu: "500m"
+ # memory: 512Mi
+ # requests:
+ # cpu: 250m
+ # memory: 128Mi
+ web:
+ port: 3000
+ # -- Number of Web Pods running
+ replicas: 1
+ # -- Affinity for Web Pods, overwrites .Values.affinity
+ affinity: {}
+ # -- Pod Security Context for Web Pods, overwrites .Values.podSecurityContext
+ podSecurityContext: {}
+ # -- (Web Container) Security Context for Web Pods, overwrites .Values.securityContext
+ securityContext: {}
+ # -- (Web Container) Resources for Web Pods, overwrites .Values.resources
+ resources: {}
+ # limits:
+ # cpu: "1"
+ # memory: 1280Mi
+ # requests:
+ # cpu: 250m
+ # memory: 768Mi
+
+ metrics:
+ statsd:
+ # -- Enable statsd publishing via STATSD_ADDR environment variable
+ address: ""
+
+ingress:
+ enabled: true
+ annotations:
+ # For choosing an ingress ingressClassName is preferred over annotations
+ # kubernetes.io/ingress.class: nginx
+ #
+ # To automatically request TLS certificates use one of the following
+ # kubernetes.io/tls-acme: "true"
+ # cert-manager.io/cluster-issuer: "letsencrypt"
+ #
+ # ensure that NGINX's upload size matches Mastodon's
+ # for the K8s ingress controller:
+ # nginx.ingress.kubernetes.io/proxy-body-size: 40m
+ # for the NGINX ingress controller:
+ # nginx.org/client-max-body-size: 40m
+ # -- you can specify the ingressClassName if it differs from the default
+ ingressClassName:
+ hosts:
+ - host: mastodon.local
+ paths:
+ - path: '/'
+ tls:
+ - secretName: mastodon-tls
+ hosts:
+ - mastodon.local
+
+# -- https://github.com/bitnami/charts/tree/master/bitnami/elasticsearch#parameters
+elasticsearch:
+ # `false` will disable full-text search
+ #
+ # if you enable ES after the initial install, you will need to manually run
+ # RAILS_ENV=production bundle exec rake chewy:sync
+ # (https://docs.joinmastodon.org/admin/optional/elasticsearch/)
+ # @ignored
+ enabled: true
+ # @ignored
+ image:
+ tag: 7
+
+# https://github.com/bitnami/charts/tree/master/bitnami/postgresql#parameters
+postgresql:
+ # -- disable if you want to use an existing db; in which case the values below
+ # must match those of that external postgres instance
+ enabled: true
+ # postgresqlHostname: preexisting-postgresql
+ # postgresqlPort: 5432
+ auth:
+ database: mastodon_production
+ username: mastodon
+ # you must set a password; the password generated by the postgresql chart will
+ # be rotated on each upgrade:
+ # https://github.com/bitnami/charts/tree/master/bitnami/postgresql#upgrade
+ password: ""
+ # Set the password for the "postgres" admin user
+ # set this to the same value as above if you've previously installed
+ # this chart and you're having problems getting mastodon to connect to the DB
+ # postgresPassword: ""
+ # you can also specify the name of an existing Secret
+ # with a key of password set to the password you want
+ existingSecret: ""
+
+# https://github.com/bitnami/charts/tree/master/bitnami/redis#parameters
+redis:
+ # -- you must set a password; the password generated by the redis chart will be
+ # rotated on each upgrade:
+ password: ""
+ # you can also specify the name of an existing Secret
+ # with a key of redis-password set to the password you want
+ # auth:
+ # existingSecret: ""
+
+# @ignored
+service:
+ type: ClusterIP
+ port: 80
+
+externalAuth:
+ oidc:
+ # -- OpenID Connect support is proposed in PR #16221 and awaiting merge.
+ enabled: false
+ # display_name: "example-label"
+ # issuer: https://login.example.space/auth/realms/example-space
+ # discovery: true
+ # scope: "openid,profile"
+ # uid_field: uid
+ # client_id: mastodon
+ # client_secret: SECRETKEY
+ # redirect_uri: https://example.com/auth/auth/openid_connect/callback
+ # assume_email_is_verified: true
+ # client_auth_method:
+ # response_type:
+ # response_mode:
+ # display:
+ # prompt:
+ # send_nonce:
+ # send_scope_to_token_endpoint:
+ # idp_logout_redirect_uri:
+ # http_scheme:
+ # host:
+ # port:
+ # jwks_uri:
+ # auth_endpoint:
+ # token_endpoint:
+ # user_info_endpoint:
+ # end_session_endpoint:
+ saml:
+ enabled: false
+ # acs_url: http://mastodon.example.com/auth/auth/saml/callback
+ # issuer: mastodon
+ # idp_sso_target_url: https://login.example.com/auth/realms/example/protocol/saml
+ # idp_cert: '-----BEGIN CERTIFICATE-----[your_cert_content]-----END CERTIFICATE-----'
+ # idp_cert_fingerprint:
+ # name_identifier_format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
+ # cert:
+ # private_key:
+ # want_assertion_signed: true
+ # want_assertion_encrypted: true
+ # assume_email_is_verified: true
+ # uid_attribute: "urn:oid:0.9.2342.19200300.100.1.1"
+ # attributes_statements:
+ # uid: "urn:oid:0.9.2342.19200300.100.1.1"
+ # email: "urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
+ # full_name: "urn:oid:2.16.840.1.113730.3.1.241"
+ # first_name: "urn:oid:2.5.4.42"
+ # last_name: "urn:oid:2.5.4.4"
+ # verified:
+ # verified_email:
+ oauth_global:
+ # -- Automatically redirect to OIDC, CAS or SAML, and don't use local account authentication when clicking on Sign-In
+ omniauth_only: false
+ cas:
+ enabled: false
+ # url: https://sso.myserver.com
+ # host: sso.myserver.com
+ # port: 443
+ # ssl: true
+ # validate_url:
+ # callback_url:
+ # logout_url:
+ # login_url:
+ # uid_field: 'user'
+ # ca_path:
+ # disable_ssl_verification: false
+ # assume_email_is_verified: true
+ # keys:
+ # uid: 'user'
+ # name: 'name'
+ # email: 'email'
+ # nickname: 'nickname'
+ # first_name: 'firstname'
+ # last_name: 'lastname'
+ # location: 'location'
+ # image: 'image'
+ # phone: 'phone'
+ pam:
+ enabled: false
+ # email_domain: example.com
+ # default_service: rpam
+ # controlled_service: rpam
+ ldap:
+ enabled: false
+ # host: myservice.namespace.svc
+ # port: 389
+ # method: simple_tls
+ # base:
+ # bind_on:
+ # password:
+ # uid: cn
+ # mail: mail
+ # search_filter: "(|(%{uid}=%{email})(%{mail}=%{email}))"
+ # uid_conversion:
+ # enabled: true
+ # search: "., -"
+ # replace: _
+
+# -- https://github.com/mastodon/mastodon/blob/main/Dockerfile#L75
+#
+# if you manually change the UID/GID environment variables, ensure these values
+# match:
+podSecurityContext:
+ runAsUser: 991
+ runAsGroup: 991
+ fsGroup: 991
+
+# @ignored
+securityContext: {}
+
+serviceAccount:
+ # -- Specifies whether a service account should be created
+ create: true
+ # -- Annotations to add to the service account
+ annotations: {}
+ # -- The name of the service account to use.
+ # If not set and create is true, a name is generated using the fullname template
+ name: ""
+
+# -- Kubernetes manages pods for jobs and pods for deployments differently, so you might
+# need to apply different annotations to the two different sets of pods. The annotations
+# set with podAnnotations will be added to all deployment-managed pods.
+podAnnotations: {}
+
+# -- The annotations set with jobAnnotations will be added to all job pods.
+jobAnnotations: {}
+
+# -- Default resources for all Deployments and jobs unless overwritten
+resources: {}
+ # We usually recommend not to specify default resources and to leave this as a conscious
+ # choice for the user. This also increases chances charts run on environments with little
+ # resources, such as Minikube. If you do want to specify resources, uncomment the following
+ # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+ # limits:
+ # cpu: 100m
+ # memory: 128Mi
+ # requests:
+ # cpu: 100m
+ # memory: 128Mi
+
+# @ignored
+nodeSelector: {}
+
+# @ignored
+tolerations: []
+
+# -- Affinity for all pods unless overwritten
+affinity: {}