inecs
feb32e1285
Disable ingress-nginx intercept for 404/405 on all lab Ingresses and document how to verify JSON/XML responses after upgrade.
274 lines
7.5 KiB
YAML
274 lines
7.5 KiB
YAML
# Laboratory defaults — rotate secrets before any non-lab use.
|
|
|
|
nameOverride: ""
|
|
fullnameOverride: "simulators"
|
|
|
|
# Target Kubernetes namespace (also used by make helm up/down).
|
|
namespace: simulators
|
|
# Create the Namespace resource from this chart.
|
|
namespaceCreate: true
|
|
|
|
imagePullSecrets: []
|
|
ticketSigningKey: development-only-signing-key-change-me
|
|
logLevel: INFO
|
|
imageTag: latest
|
|
|
|
postgres:
|
|
enabled: true
|
|
image:
|
|
repository: postgres
|
|
tag: 17.5-bookworm
|
|
pullPolicy: IfNotPresent
|
|
auth:
|
|
username: lab
|
|
password: lab
|
|
database: postgres
|
|
persistence:
|
|
enabled: true
|
|
size: 5Gi
|
|
storageClass: ""
|
|
resources: {}
|
|
# users/databases created on first start (empty volume only)
|
|
initDatabases:
|
|
- user: proxmox
|
|
password: proxmox
|
|
database: proxmox_simulator
|
|
- user: ovirt
|
|
password: ovirt
|
|
database: ovirt_simulator
|
|
- user: vmware
|
|
password: vmware
|
|
database: vmware_simulator
|
|
- user: openstack
|
|
password: openstack
|
|
database: openstack_simulator
|
|
|
|
simulators:
|
|
proxmox:
|
|
enabled: true
|
|
image:
|
|
repository: inecs/proxmox-api-simulator
|
|
pullPolicy: IfNotPresent
|
|
port: 8006
|
|
healthPath: /health/ready
|
|
replicas: 1
|
|
db:
|
|
user: proxmox
|
|
password: proxmox
|
|
name: proxmox_simulator
|
|
env:
|
|
CONTRACT_SNAPSHOT: /app/contracts/pve-9.2.3.json
|
|
COMPATIBILITY_EVIDENCE: /app/evidence/pve-9.2.3.json
|
|
TASK_WORKER_CONCURRENCY: "2"
|
|
SIMULATION_TIME_SCALE: "10"
|
|
migrate:
|
|
enabled: true
|
|
command: ["python", "-m", "app.db.migrate_cli"]
|
|
seed:
|
|
enabled: true
|
|
# Skip seed Job when this query returns a row (already seeded).
|
|
skipIfSql: "SELECT 1 FROM nodes LIMIT 1"
|
|
command: ["python", "-m", "app.simulation.seed_cli"]
|
|
env:
|
|
SEED_PROFILE: small
|
|
resources: {}
|
|
|
|
ovirt:
|
|
enabled: true
|
|
image:
|
|
repository: inecs/ovirt-api-simulator
|
|
pullPolicy: IfNotPresent
|
|
port: 8080
|
|
healthPath: /health/ready
|
|
replicas: 1
|
|
db:
|
|
user: ovirt
|
|
password: ovirt
|
|
name: ovirt_simulator
|
|
env:
|
|
OVIRT_SERIES: "4.5"
|
|
APP_PORT: "8080"
|
|
migrate:
|
|
enabled: true
|
|
command: ["python", "-m", "app.db.migrate_cli"]
|
|
seed:
|
|
enabled: true
|
|
skipIfSql: "SELECT 1 FROM ov_datacenters LIMIT 1"
|
|
command: ["python", "-m", "app.ovirt.seed_cli", "--profile", "minimal"]
|
|
resources: {}
|
|
|
|
vmware:
|
|
enabled: true
|
|
image:
|
|
repository: inecs/vmware-api-simulator
|
|
pullPolicy: IfNotPresent
|
|
port: 8080
|
|
healthPath: /health/ready
|
|
replicas: 1
|
|
db:
|
|
user: vmware
|
|
password: vmware
|
|
name: vmware_simulator
|
|
env:
|
|
ENABLE_PVE_STUB: "false"
|
|
SEED_VSPHERE_PROFILE: small
|
|
APP_PORT: "8080"
|
|
TASK_WORKER_CONCURRENCY: "2"
|
|
SIMULATION_TIME_SCALE: "10"
|
|
migrate:
|
|
enabled: true
|
|
command: ["python", "-m", "app.db.migrate_cli"]
|
|
seed:
|
|
enabled: true
|
|
skipIfSql: "SELECT 1 FROM vsphere_objects LIMIT 1"
|
|
command: ["python", "-m", "app.simulation.seed_cli"]
|
|
env:
|
|
SEED_PROFILE: small
|
|
SEED_VSPHERE_PROFILE: small
|
|
resources: {}
|
|
|
|
openstack:
|
|
enabled: true
|
|
image:
|
|
repository: inecs/openstack-api-simulator
|
|
pullPolicy: IfNotPresent
|
|
port: 8080
|
|
healthPath: /health/ready
|
|
replicas: 1
|
|
db:
|
|
user: openstack
|
|
password: openstack
|
|
name: openstack_simulator
|
|
env:
|
|
APP_PORT: "8080"
|
|
TASK_WORKER_CONCURRENCY: "2"
|
|
SIMULATION_TIME_SCALE: "10"
|
|
migrate:
|
|
enabled: true
|
|
command: ["python", "-m", "app.db.migrate_cli"]
|
|
seed:
|
|
enabled: true
|
|
skipIfSql: "SELECT 1 FROM os_projects LIMIT 1"
|
|
command: ["python", "-m", "app.openstack.seed_cli", "--profile", "minimal"]
|
|
resources: {}
|
|
|
|
# Ingress hosts — edit here. Each enabled entry creates one Ingress.
|
|
# Default hosts: <name>.lab.local — for Let's Encrypt use a public DNS name.
|
|
ingressClassName: nginx
|
|
|
|
ingresses:
|
|
proxmox:
|
|
enabled: true
|
|
className: "" # falls back to ingressClassName
|
|
host: proxmox.lab.local
|
|
path: /
|
|
pathType: Prefix
|
|
service: proxmox
|
|
port: 8006
|
|
tls:
|
|
- secretName: simulators-proxmox-tls
|
|
hosts: [proxmox.lab.local]
|
|
annotations:
|
|
# Keep API JSON/XML bodies (404/405/401). Do not list 404/405 here —
|
|
# cluster custom-http-errors would otherwise replace them with branded HTML.
|
|
nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
|
|
nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
|
|
|
|
ovirt:
|
|
enabled: true
|
|
className: ""
|
|
host: ovirt.lab.local
|
|
path: /
|
|
pathType: Prefix
|
|
service: ovirt
|
|
port: 8080
|
|
tls:
|
|
- secretName: simulators-ovirt-tls
|
|
hosts: [ovirt.lab.local]
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
|
|
nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
|
|
|
|
vmware:
|
|
enabled: true
|
|
className: ""
|
|
host: vmware.lab.local
|
|
path: /
|
|
pathType: Prefix
|
|
service: vmware
|
|
port: 8080
|
|
tls:
|
|
- secretName: simulators-vmware-tls
|
|
hosts: [vmware.lab.local]
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
|
|
nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
|
|
nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
proxy_set_header X-VMware-Service "vcenter";
|
|
proxy_set_header X-Forwarded-Port "443";
|
|
|
|
openstack:
|
|
enabled: true
|
|
className: ""
|
|
host: openstack.lab.local
|
|
path: /
|
|
pathType: Prefix
|
|
service: openstack
|
|
port: 8080
|
|
tls:
|
|
- secretName: simulators-openstack-tls
|
|
hosts: [openstack.lab.local]
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
|
|
nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
|
|
nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
proxy_set_header X-OpenStack-Service "https";
|
|
proxy_set_header X-Forwarded-Port "443";
|
|
|
|
# Optional extras — same shape as above, e.g.:
|
|
# ovirt-ui:
|
|
# enabled: true
|
|
# host: ovirt-ui.lab.local
|
|
# service: ovirt
|
|
# port: 8080
|
|
# tls:
|
|
# - secretName: simulators-ovirt-ui-tls
|
|
# hosts: [ovirt-ui.lab.local]
|
|
# annotations:
|
|
# nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
|
|
# nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
|
|
# openstack-keystone:
|
|
# enabled: true
|
|
# host: keystone.lab.local
|
|
# service: openstack
|
|
# port: 8080
|
|
# tls:
|
|
# - secretName: simulators-keystone-tls
|
|
# hosts: [keystone.lab.local]
|
|
# annotations:
|
|
# nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
|
|
# nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
|
|
# nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
# proxy_set_header X-OpenStack-Service "keystone";
|
|
|
|
# TLS via cert-manager + Let's Encrypt (HTTP-01).
|
|
# Requires cert-manager in the cluster. Hosts must resolve publicly for ACME.
|
|
certManager:
|
|
enabled: true
|
|
# Create ClusterIssuer resources from this chart (false = use existing letsencrypt-prod).
|
|
createClusterIssuer: false
|
|
createStagingIssuer: true
|
|
email: "" # required when createClusterIssuer=true
|
|
issuerName: letsencrypt-prod
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
stagingIssuerName: letsencrypt-staging
|
|
stagingServer: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
useStaging: false
|
|
solverIngressClassName: nginx
|
|
|
|
seedJobs:
|
|
# post-install / post-upgrade Jobs; skipIfSql avoids re-seeding when data exists
|
|
enabled: true
|
|
backoffLimit: 3
|
|
ttlSecondsAfterFinished: 600
|