5e5148e951
ns postgres-tls-test: postgresql-contour pg-tls с tls.autoGenerated, ssl_min_protocol_version TLSv1.2, pg_hba только hostssl (local для администрирования); notes-tls на образе notes-backend с PG_SSL_MODE/PGSSLMODE=verify-full и CA из pg-tls-crt. regcred в ns создаётся вручную.
57 lines
1.2 KiB
YAML
57 lines
1.2 KiB
YAML
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: pg-tls
|
|
namespace: postgres-tls-test
|
|
spec:
|
|
interval: 10m
|
|
timeout: 15m
|
|
chart:
|
|
spec:
|
|
chart: postgresql-contour
|
|
version: "17.0.7"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: yc-oci-charts
|
|
namespace: flux-system
|
|
interval: 10m
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
fullnameOverride: pg-tls
|
|
global:
|
|
security:
|
|
allowInsecureImages: true
|
|
defaultStorageClass: local-path
|
|
imagePullSecrets:
|
|
- regcred
|
|
image:
|
|
registry: cr.yandex/crp3ccidau046kdj8g9q
|
|
repository: contour/postgresql
|
|
tag: 17.0.7
|
|
auth:
|
|
username: notes
|
|
database: notes
|
|
metrics:
|
|
enabled: false
|
|
tls:
|
|
enabled: true
|
|
autoGenerated: true
|
|
primary:
|
|
persistence:
|
|
storageClass: local-path
|
|
size: 1Gi
|
|
nodeSelector:
|
|
dedicated: generic
|
|
extendedConfiguration: |
|
|
ssl_min_protocol_version = 'TLSv1.2'
|
|
pgHbaConfiguration: |
|
|
local all all scram-sha-256
|
|
hostssl all all 0.0.0.0/0 scram-sha-256
|
|
hostssl all all ::/0 scram-sha-256
|