* fix(chart): Remove non-functional Horizontal Pod Autoscaler
The Horizontal Pod Autoscaler (HPA) refers to a Deployment that
doesn't exist and therefore can not work. As a result it's
pointless to carry it around in this chart and give the wrong
impression it could work. This patch removes it from the helm
chart and drops all references to it.
* refactor(chart): Refactor sidekiq deployments to scale
This patch reworks how the sidekiq deployment is set up, by
splitting it into many sidekiq deployments, but at least one,
which should allow to scale the number of sidekiq jobs as
expected while being friendly to single user instances as well
as larger ones.
Further it introduces per deployment overwrites for the most
relevant pod fields like resources, affinities and processed
queues, number of jobs and the sidekiq security contexts.
The exact implementation was inspired by an upstream issue:
https://github.com/mastodon/mastodon/issues/20453
* fix(chart): Remove linode default values from values
This patch drops the linode defaults from the values.yaml since
these are not obvious and can cause unexpected connections as
well as leaking secrets to linode, when other s3 storage
backends are used and don't explicitly configure these options
by accident.
Mastodon will then try to authenticate to the linode backends
and therefore disclose the authentication secrets.
* refactor(chart): Rework reduce value reference duplication
Since most of the values are simply setup like this:
```
{{- if .Values.someVariable }}
SOME_VARIABLE: {{ .Values.someVariable }}
{{- end }}
```
There is a lot of duplication in the references in order to
full in the variables. There is an equivalent notation, which
reduces the usage of the variable name to just once:
```
{{- with .Values.someVariable }}
SOME_VARIABLE: {{ . }}
{{- end }}
```
What seems like a pointless replacement, will reduce potential
mistakes down the line by possibly only adjusting one of the
two references.
* fix(chart): Switch to new OMNIAUTH_ONLY variable
This patch adjusts the helm chart to use the new `OMNIAUTH_ONLY`
variable, which replaced the former
`OAUTH_REDIRECT_AT_SIGN_IN` variable in the following commit:
https://github.com/mastodon/mastodon/pull/172883c8857917e
* fix(chart): Repair connection test to existing service
Currently the connect test can't work, since it's connecting to
a non-existing service this patch fixes the service name to
make the job connect to the mastodon web service to verify the
connection.
* docs(chart): Adjust values.yaml to support helm-docs
This patch updates most values to prepare an introduction of
helm-docs. This should help to make the chart more user
friendly by explaining the variables and provide a standardised
README file, like many other helm charts do.
References:
https://github.com/norwoodj/helm-docs
* refactor(chart): Allow individual overwrites for streaming and web deployment
This patch works how the streaming and web deployments work by
adding various fields to overwrite values such as affinities,
resources, replica count, and security contexts.
BREAKING CHANGE: This commit removes `.Values.replicaCount` in
favour of `.Values.mastodon.web.replicas` and
`.Values.mastodon.streaming.values`.
* feat(chart): Add option for authorized fetch
Currently the helm chart doesn't support authorized fetch aka.
"Secure Mode" this patch fixes that by adding the needed config
option to the values file and the configmap.
* docs(chart): Improve helm-docs compatiblity
This patch adjust a few more comments in the values.yaml to be
picked up by helm-docs. This way, future adoption is properly
prepared.
* fix(chart): Add automatic detection of scheduler sidekiq queue
This patch adds an automatic switch to the `Recreate` strategy
for the sidekiq Pod in order to prevent accidental concurrency
for the scheduler queue.
* fix(chart): Repair broken DB_POOL variable
# create an initial administrator user; the password is autogenerated and will
# -- create an initial administrator user; the password is autogenerated and will
# have to be reset
createAdmin:
# @ignored
enabled:false
# @ignored
username:not_gargron
# @ignored
email:not@example.com
cron:
# run `tootctl media remove` every week
# -- run `tootctl media remove` every week
removeMedia:
# @ignored
enabled:true
# @ignored
schedule:"0 0 * * 0"
# available locales: https://github.com/mastodon/mastodon/blob/main/config/application.rb#L71
# -- available locales: https://github.com/mastodon/mastodon/blob/main/config/application.rb#L71
locale:en
local_domain:mastodon.local
# Use of WEB_DOMAIN requires careful consideration: https://docs.joinmastodon.org/admin/config/#federation
# -- Use of WEB_DOMAIN requires careful consideration: https://docs.joinmastodon.org/admin/config/#federation
# You must redirect the path LOCAL_DOMAIN/.well-known/ to WEB_DOMAIN/.well-known/ as described
# web_domain: mastodon.example.com
# If set to true, the frontpage of your Mastodon server will always redirect to the first profile in the database and registrations will be disabled.
# Example: mastodon.example.com
web_domain:null
# -- If set to true, the frontpage of your Mastodon server will always redirect to the first profile in the database and registrations will be disabled.
singleUserMode:false
# -- Enables "Secure Mode" for more details see: https://docs.joinmastodon.org/admin/config/#authorized_fetch
authorizedFetch:false
persistence:
assets:
# ReadWriteOnce is more widely supported than ReadWriteMany, but limits
# -- ReadWriteOnce is more widely supported than ReadWriteMany, but limits
# scalability, since it requires the Rails and Sidekiq pods to run on the
# same node.
accessMode:ReadWriteOnce
@ -50,14 +56,14 @@ mastodon:
enabled:false
access_key:""
access_secret:""
# you can also specify the name of an existing Secret
# -- you can also specify the name of an existing Secret
# with keys AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
existingSecret:""
bucket:""
endpoint:https://us-east-1.linodeobjects.com
hostname:us-east-1.linodeobjects.com
endpoint:""
hostname:""
region:""
# If you have a caching proxy, enter its base URL here.
# -- If you have a caching proxy, enter its base URL here.
alias_host:""
# these must be set manually; autogenerated keys are rotated on each upgrade
secrets:
@ -66,12 +72,60 @@ mastodon:
vapid:
private_key:""
public_key:""
# you can also specify the name of an existing Secret
# -- you can also specify the name of an existing Secret
# with keys SECRET_KEY_BASE and OTP_SECRET and
# VAPID_PRIVATE_KEY and VAPID_PUBLIC_KEY
existingSecret:""
sidekiq:
# -- Pod security context for all Sidekiq Pods, overwrites .Values.podSecurityContext
podSecurityContext:{}
# -- (Sidekiq Container) Security Context for all Pods, overwrites .Values.securityContext
securityContext:{}
# -- Resources for all Sidekiq Deployments unless overwritten
resources:{}
# -- Affinity for all Sidekiq Deployments unless overwritten, overwrites .Values.affinity
affinity:{}
# limits:
# cpu: "1"
# memory: 768Mi
# requests:
# cpu: 250m
# memory: 512Mi
workers:
- name:all-queues
# -- Number of threads / parallel sidekiq jobs that are executed per Pod
concurrency:25
# -- Number of Pod replicas deployed by the Deployment
replicas:1
# -- Resources for this specific deployment to allow optimised scaling, overwrites .Values.mastodon.sidekiq.resources
resources:{}
# -- Affinity for this specific deployment, overwrites .Values.affinity and .Values.mastodon.sidekiq.affinity
affinity:{}
# -- Sidekiq queues for Mastodon that are handled by this worker. See https://docs.joinmastodon.org/admin/scaling/#concurrency
# See https://github.com/mperham/sidekiq/wiki/Advanced-Options#queues for how to weight queues as argument
queues:
- default
- push
- mailers
- pull
- scheduler# Make sure the scheduler queue only exists once and with a worker that has 1 replica.
#- name: push-pull
# concurrency: 50
# resources: {}
# replicas: 2
# queues:
# - push
# - pull
#- name: mailers
# concurrency: 25
# replicas: 2
# queues:
# - mailers
#- name: default
# concurrency: 25
# replicas: 2
# queues:
# - default
smtp:
auth_method:plain
ca_file:/etc/ssl/certs/ca-certificates.crt
@ -86,24 +140,56 @@ mastodon:
tls:false
login:
password:
# you can also specify the name of an existing Secret
# -- you can also specify the name of an existing Secret
# with the keys login and password
existingSecret:
streaming:
port:4000
# this should be set manually since os.cpus() returns the number of CPUs on
# -- this should be set manually since os.cpus() returns the number of CPUs on
# the node running the pod, which is unrelated to the resources allocated to
# the pod by k8s
workers:1
# The base url for streaming can be set if the streaming API is deployed to
# -- The base url for streaming can be set if the streaming API is deployed to
# a different domain/subdomain.
# base_url: wws://streaming.example.com
base_url:null
# -- Number of Streaming Pods running
replicas:1
# -- Affinity for Streaming Pods, overwrites .Values.affinity
affinity:{}
# -- Pod Security Context for Streaming Pods, overwrites .Values.podSecurityContext
Sheogorath
2 years ago
committed by
GitHub