70 lines
3.0 KiB
YAML
70 lines
3.0 KiB
YAML
contour:
|
|
# This is your live `helm get values contour -n projectcontour` output,
|
|
# verbatim. This is the ingress for everything else in this repo
|
|
# (Gitea, ArgoCD, Vault all route through it) — don't tune this without
|
|
# re-checking those still resolve afterward.
|
|
#
|
|
# hostPorts, not a Service type=LoadBalancer: claude.md issue #6 — MetalLB
|
|
# got a floating IP fine, but this VM's host (VMware Workstation, Bridged
|
|
# networking, over Wi-Fi) doesn't do true MAC-level bridging, so the IP
|
|
# was never reachable from outside the VM. hostPort on Envoy binds
|
|
# directly to the node's real NIC instead.
|
|
#
|
|
# Correction from an earlier version of this file: the keys below are
|
|
# NOT what `helm get values` showed as "user-supplied" on the live
|
|
# release (envoy.hostNetworking / envoy.hostPorts.enabled). Checked
|
|
# directly against this chart's own values.yaml — this version reads
|
|
# envoy.hostNetwork (singular) and envoy.useHostPort.http/https instead.
|
|
# Helm doesn't validate unknown keys, so the old ones were silent no-ops.
|
|
# hostPort on the live pods is actually coming from the raw `kubectl
|
|
# patch` in claude.md issue #7 ("the actual working solution" — that
|
|
# title is the tell), applied completely outside Helm. Getting the real
|
|
# keys into this file is what finally makes hostPort GitOps-managed
|
|
# instead of an unmanaged patch any future plain `helm upgrade` could
|
|
# silently wipe.
|
|
#
|
|
# This is also why ArgoCD's default Ingress health check needed
|
|
# overriding (see argocd-admin-prd/custom-values.yaml) — there's no
|
|
# Service type=LoadBalancer here to ever populate
|
|
# status.loadBalancer.ingress.
|
|
|
|
contour:
|
|
resources:
|
|
limits:
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
|
|
envoy:
|
|
dnsPolicy: ClusterFirstWithHostNet
|
|
# Mistake in an earlier version of this file: this was `true`. claude.md
|
|
# is explicit that hostPort was chosen specifically INSTEAD of
|
|
# hostNetwork ("not full hostNetwork, which is heavier-handed and
|
|
# affects pod DNS") — and hostNetwork: true also has a real API
|
|
# constraint that broke sync: it requires hostPort == containerPort on
|
|
# every port, which isn't the case here (containerPort 8080/8443 vs
|
|
# hostPort 80/443). `false` is both what was actually decided and what
|
|
# the API requires for this containerPort/hostPort combination.
|
|
hostNetwork: false
|
|
useHostPort:
|
|
http: true
|
|
https: true
|
|
# Already the chart default (80/443) — pinned explicitly anyway so a
|
|
# future chart bump changing its defaults can't silently change this.
|
|
hostPorts:
|
|
http: 80
|
|
https: 443
|
|
resources:
|
|
limits:
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
service:
|
|
type: ClusterIP
|
|
# Chart default (Local) pairs with the default type: LoadBalancer —
|
|
# only valid for LoadBalancer/NodePort services. Must be cleared for
|
|
# ClusterIP, which is what the sync error actually said.
|
|
externalTrafficPolicy: ""
|