Lukas Huppertz
9d613dc19d
This pull request enhances the Helm chart for the Twenty application by improving how environment variables and Redis credentials are handled for both server and worker deployments. The main changes include support for injecting additional environment variables, improved Redis password management (including external secrets), and a more robust database migration workflow. **Environment Variable Injection:** - Added support for specifying additional environment variables for both the server and worker deployments via the `additionalEnv` field in `values.yaml`. These variables are automatically injected into the respective pods. [[1]](diffhunk://#diff-b5d958eae48fd1919e5623bcf0144aac7abb323ae8743e6f31367e383c63c296R55) [[2]](diffhunk://#diff-b5d958eae48fd1919e5623bcf0144aac7abb323ae8743e6f31367e383c63c296R109-R110) [[3]](diffhunk://#diff-20bb91909627a12b50b3c165a2a027b663479c0104ed8dbf91d2b9ad8ea8a931R74-R77) [[4]](diffhunk://#diff-20bb91909627a12b50b3c165a2a027b663479c0104ed8dbf91d2b9ad8ea8a931R157-R172) [[5]](diffhunk://#diff-20bb91909627a12b50b3c165a2a027b663479c0104ed8dbf91d2b9ad8ea8a931R225-R229) [[6]](diffhunk://#diff-fb612a3b7a13156aaa607b27d23025e2c6831f111b6a582fd313fad26d2fdb5bR89-R92) **Redis Credential Management:** - Introduced support for using external secrets for Redis passwords by adding `secretName` and `passwordKey` fields under `redis.external` in `values.yaml`, and logic to inject `REDIS_PASSWORD` from a Kubernetes secret if configured. [[1]](diffhunk://#diff-b5d958eae48fd1919e5623bcf0144aac7abb323ae8743e6f31367e383c63c296R180-R182) [[2]](diffhunk://#diff-5c4fa358b10abd7581188995feb9b4d6be0bc4f06a95bf27bb31b5595d6693d8R92-R100) [[3]](diffhunk://#diff-20bb91909627a12b50b3c165a2a027b663479c0104ed8dbf91d2b9ad8ea8a931R157-R172) [[4]](diffhunk://#diff-20bb91909627a12b50b3c165a2a027b663479c0104ed8dbf91d2b9ad8ea8a931R196-R205) [[5]](diffhunk://#diff-fb612a3b7a13156aaa607b27d23025e2c6831f111b6a582fd313fad26d2fdb5bR70-R79) - Updated the logic for constructing the `REDIS_URL` to include authentication information if a password is set or an external secret is used. **Database Migration Workflow:** - Improved the startup command for the server deployment to optionally skip database migrations (using `DISABLE_DB_MIGRATIONS`), check for an existing schema before running migrations, and ensure setup scripts are only run on empty databases. These changes make the chart more flexible and secure, especially for production deployments requiring externalized secrets and custom environment configurations. --------- Co-authored-by: Charles Bochet <charles@twenty.com>
190 lines
3.4 KiB
YAML
190 lines
3.4 KiB
YAML
# Default image used by all components
|
|
image:
|
|
repository: twentycrm/twenty
|
|
tag: "" # defaults to Chart.yaml appVersion
|
|
pullPolicy: IfNotPresent
|
|
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
# Global security context (uid/gid for all pods)
|
|
securityContext:
|
|
runAsUser: 1000
|
|
fsGroup: 1000
|
|
|
|
# Storage backend: local or s3
|
|
storage:
|
|
type: local
|
|
s3:
|
|
bucket: ""
|
|
region: ""
|
|
endpoint: ""
|
|
# Option A: direct values
|
|
accessKeyId: ""
|
|
secretAccessKey: ""
|
|
# Option B: reference a Secret
|
|
# secretName: my-s3-creds
|
|
# accessKeyIdKey: accessKeyId
|
|
# secretAccessKeyKey: secretAccessKey
|
|
|
|
# Auth tokens (random if not provided)
|
|
secrets:
|
|
tokens:
|
|
create: true
|
|
name: tokens
|
|
accessToken: ""
|
|
|
|
# Server deployment
|
|
server:
|
|
enabled: true
|
|
replicaCount: 1
|
|
image: {} # override repository/tag/pullPolicy per component
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1024Mi
|
|
|
|
env:
|
|
SIGN_IN_PREFILLED: "false"
|
|
ACCESS_TOKEN_EXPIRES_IN: "7d"
|
|
LOGIN_TOKEN_EXPIRES_IN: "1h"
|
|
extraEnv: []
|
|
# - name: EMAIL_DRIVER
|
|
# value: smtp
|
|
# - name: SMTP_PASSWORD
|
|
# valueFrom:
|
|
# secretKeyRef:
|
|
# name: smtp-creds
|
|
# key: password
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 3000
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
acme: true # add cert-manager annotation for Let's Encrypt
|
|
annotations: {}
|
|
hosts:
|
|
- host: crm.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: twenty-tls
|
|
hosts:
|
|
- crm.example.com
|
|
|
|
persistence:
|
|
enabled: true
|
|
size: 10Gi
|
|
storageClass: ""
|
|
existingClaim: ""
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
|
|
dockerDataPersistence:
|
|
enabled: true
|
|
size: 100Mi
|
|
storageClass: ""
|
|
existingClaim: ""
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
|
|
extraVolumeMounts: []
|
|
|
|
# Worker deployment
|
|
worker:
|
|
enabled: true
|
|
replicaCount: 1
|
|
image: {}
|
|
command: ["yarn", "worker:prod"]
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 1024Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 2048Mi
|
|
|
|
extraEnv: []
|
|
|
|
# PostgreSQL
|
|
db:
|
|
enabled: true
|
|
internal:
|
|
database: twenty
|
|
appUser: twenty_app_user
|
|
appPassword: "" # random if empty
|
|
image:
|
|
repository: twentycrm/twenty-postgres-spilo
|
|
tag: 3.3-p2
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 1000m
|
|
memory: 1024Mi
|
|
persistence:
|
|
enabled: true
|
|
size: 10Gi
|
|
storageClass: ""
|
|
existingClaim: ""
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
env:
|
|
PGUSER_SUPERUSER: postgres
|
|
PGPASSWORD_SUPERUSER: postgres
|
|
SPILO_PROVIDER: local
|
|
ALLOW_NOSSL: "true"
|
|
|
|
external:
|
|
host: ""
|
|
port: 5432
|
|
user: twenty_app_user
|
|
password: ""
|
|
database: twenty
|
|
ssl: false
|
|
secretName: ""
|
|
passwordKey: ""
|
|
|
|
# Redis
|
|
redisInternal:
|
|
enabled: true
|
|
image:
|
|
repository: redis/redis-stack-server
|
|
tag: 7.2.0-v10
|
|
pullPolicy: IfNotPresent
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 1024Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 2048Mi
|
|
service:
|
|
port: 6379
|
|
persistence:
|
|
enabled: false
|
|
size: 1Gi
|
|
storageClass: ""
|
|
existingClaim: ""
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
|
|
# External Redis (when redisInternal.enabled=false)
|
|
redis:
|
|
external:
|
|
host: ""
|
|
port: 6379
|
|
password: ""
|
|
secretName: ""
|
|
passwordKey: ""
|