Tyler King
9dc5cb9eee
Helm chart (charts/bascule/): Deployment with shell sidecar container (shared jumphost model) Service (LoadBalancer/NodePort/ClusterIP) ConfigMap with auto-generated config.toml RBAC (Role + RoleBinding for pods/exec) NetworkPolicy (restrict shell egress, allow DNS + K8s API) ServiceAccount with create flag Configurable shell image (k8s-ops, net-ops, dev, minimal) Helm lint passes clean K8s backend config (bascule-core): [k8s] section: enabled, namespace, pod_name, shell_container, shell Auto-detection via POD_NAME/POD_NAMESPACE env vars (downward API) Backend priority: K8s > proxy > container > local PTY K8s exec implementation deferred to --features k8s (kube crate) SPIFFE/SPIRE auth config: [auth.spiffe] section: trust_domain, trust_bundle_path, workload_api_socket JWT-SVID token-as-password authentication pattern Implementation deferred to bascule-auth-spiffe crate Zero substrate dependencies. Default build unchanged. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
65 lines
916 B
YAML
65 lines
916 B
YAML
replicaCount: 1
|
|
|
|
image:
|
|
repository: ghcr.io/guildhouse/bascule-server
|
|
tag: "latest"
|
|
pullPolicy: IfNotPresent
|
|
|
|
shell:
|
|
enabled: true
|
|
image:
|
|
repository: ghcr.io/guildhouse/bascule-shell
|
|
tag: "k8s-ops"
|
|
pullPolicy: IfNotPresent
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
|
|
service:
|
|
type: LoadBalancer
|
|
port: 2222
|
|
|
|
auth:
|
|
mode: authorized-keys
|
|
authorizedKeysPath: /etc/bascule/keys
|
|
authorizedKeysSecret: ""
|
|
|
|
maxSessions: 100
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|
|
|
|
hostKey:
|
|
persistence: true
|
|
size: 1Mi
|
|
|
|
serviceAccount:
|
|
create: true
|
|
name: ""
|
|
|
|
rbac:
|
|
create: true
|
|
|
|
networkPolicy:
|
|
enabled: true
|
|
allowKubeApi: true
|
|
denyAllOtherEgress: true
|
|
|
|
podDisruptionBudget:
|
|
enabled: false
|
|
minAvailable: 1
|
|
|
|
extraEnv: []
|
|
|
|
tolerations: []
|
|
affinity: {}
|
|
nodeSelector: {}
|