From 94bd12711ea4cfc8f483b8df0a1dbe1b52f82343 Mon Sep 17 00:00:00 2001 From: Marius Benthin Date: Wed, 3 Jun 2026 15:26:26 +0200 Subject: [PATCH] new: helm charts for k8s --- README.md | 61 +++++++- charts/thunderstorm/.helmignore | 10 ++ charts/thunderstorm/Chart.yaml | 17 +++ charts/thunderstorm/templates/NOTES.txt | 34 +++++ charts/thunderstorm/templates/_helpers.tpl | 82 +++++++++++ charts/thunderstorm/templates/deployment.yaml | 123 ++++++++++++++++ charts/thunderstorm/templates/httproute.yaml | 38 +++++ charts/thunderstorm/templates/ingress.yaml | 35 +++++ charts/thunderstorm/templates/pvc.yaml | 17 +++ .../templates/secret-contract-token.yaml | 11 ++ charts/thunderstorm/templates/secret-tls.yaml | 12 ++ charts/thunderstorm/templates/service.yaml | 19 +++ .../templates/serviceaccount.yaml | 12 ++ charts/thunderstorm/values.yaml | 133 ++++++++++++++++++ 14 files changed, 602 insertions(+), 2 deletions(-) create mode 100644 charts/thunderstorm/.helmignore create mode 100644 charts/thunderstorm/Chart.yaml create mode 100644 charts/thunderstorm/templates/NOTES.txt create mode 100644 charts/thunderstorm/templates/_helpers.tpl create mode 100644 charts/thunderstorm/templates/deployment.yaml create mode 100644 charts/thunderstorm/templates/httproute.yaml create mode 100644 charts/thunderstorm/templates/ingress.yaml create mode 100644 charts/thunderstorm/templates/pvc.yaml create mode 100644 charts/thunderstorm/templates/secret-contract-token.yaml create mode 100644 charts/thunderstorm/templates/secret-tls.yaml create mode 100644 charts/thunderstorm/templates/service.yaml create mode 100644 charts/thunderstorm/templates/serviceaccount.yaml create mode 100644 charts/thunderstorm/values.yaml diff --git a/README.md b/README.md index 4310303..22c4880 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,9 @@ # Deploy Thunderstorm as a Container -[THOR Thunderstorm](https://www.nextron-systems.com/thor-thunderstorm/) is a web service that lets you scan files with our compromise assessment tool THOR through a Web-API. This guide provides a base [container image](https://github.com/NextronSystems/thunderstorm-deployment/pkgs/container/thunderstorm-deployment) and a [Docker Compose template](https://raw.githubusercontent.com/NextronSystems/thunderstorm-deployment/master/docker-compose.yml) so you can run Thunderstorm as a container with just providing your contract token. +[THOR Thunderstorm](https://www.nextron-systems.com/thor-thunderstorm/) is a web service that lets you scan files with our compromise assessment tool THOR through a Web-API. This guide provides a base [container image](https://github.com/NextronSystems/thunderstorm-deployment/pkgs/container/thunderstorm-deployment), a [Docker Compose template](https://raw.githubusercontent.com/NextronSystems/thunderstorm-deployment/master/docker-compose.yml), and a [Helm chart](charts/thunderstorm) so you can run Thunderstorm as a container with just providing your contract token. -## Quick-Start +## Quick-Start (Docker Compose) 1. Download the [Docker Compose](https://raw.githubusercontent.com/NextronSystems/thunderstorm-deployment/master/docker-compose.yml) file @@ -21,6 +21,63 @@ CONTRACT_TOKEN= docker compose up -d Thunderstorm is exposed on port **8080** by default. +## Quick-Start (Kubernetes / Helm) + +A Helm chart is provided in [charts/thunderstorm](charts/thunderstorm). Requires `kubectl` connected to a cluster and `helm` 3.x. + +1. Get a contract token (see [Contract-Token](#contract-token)) + +2. Install the chart + +``` +helm install thunderstorm ./charts/thunderstorm \ + --namespace thunderstorm --create-namespace \ + --set contractToken.value= +``` + +To avoid putting the token on the command line, create the Secret yourself and reference it via `--set contractToken.existingSecret=`. + +3. Reach the API (default service type is ClusterIP) + +``` +kubectl -n thunderstorm port-forward svc/thunderstorm 8080:8080 +curl http://localhost:8080/api/status +``` + +### Common overrides + +All settings live in [charts/thunderstorm/values.yaml](charts/thunderstorm/values.yaml). Frequently-tuned knobs: + +- `env.TECHPREVIEW=true` — opt into the THOR 11 techpreview channel +- `env.SIGNATURE_UPDATE_INTERVAL=24` — recurring signature refresh (hours) +- `persistence.size`, `persistence.storageClass` — PVC for THOR binaries and signatures +- `resources.requests` / `resources.limits` — set generous memory limits; THOR can be memory-hungry +- `service.type=LoadBalancer` or `ingress.enabled=true` — expose externally + +### Expose via Cilium Gateway + +If your cluster uses Cilium as the Gateway API implementation and you already have a shared `Gateway` resource, attach an `HTTPRoute` by enabling the chart's `gateway` block. The chart only creates the `HTTPRoute`; the `Gateway` is expected to already exist. + +``` +helm upgrade thunderstorm ./charts/thunderstorm -n thunderstorm --reuse-values \ + --set gateway.enabled=true \ + --set gateway.parentRef.name=cilium-gateway \ + --set gateway.parentRef.namespace=tooling \ + --set gateway.parentRef.sectionName=https-standard \ + --set gateway.hostnames[0]=thunderstorm.example.com +``` + +### Upgrade and uninstall + +``` +helm upgrade thunderstorm ./charts/thunderstorm -n thunderstorm -f my-values.yaml +helm uninstall thunderstorm -n thunderstorm +# The THOR binaries PVC is retained by default; delete it manually to wipe state: +# kubectl -n thunderstorm delete pvc -l app.kubernetes.io/name=thunderstorm +``` + +When upgrading after the chart introduces new value defaults, prefer `--reset-then-reuse-values` (Helm 3.14+) over `--reuse-values` — the latter silently drops any new defaults shipped by the chart. + ## Contract-Token Deploying Thunderstorm as a container requires a **non-host-based** Thunderstorm contract with at least one issued license. diff --git a/charts/thunderstorm/.helmignore b/charts/thunderstorm/.helmignore new file mode 100644 index 0000000..4a4f76e --- /dev/null +++ b/charts/thunderstorm/.helmignore @@ -0,0 +1,10 @@ +.DS_Store +.git/ +.gitignore +.idea/ +.vscode/ +*.swp +*.bak +*.tmp +*.orig +*~ diff --git a/charts/thunderstorm/Chart.yaml b/charts/thunderstorm/Chart.yaml new file mode 100644 index 0000000..9db6e59 --- /dev/null +++ b/charts/thunderstorm/Chart.yaml @@ -0,0 +1,17 @@ +apiVersion: v1 +name: thunderstorm +description: THOR Thunderstorm - Nextron's web service for scanning files via the compromise-assessment API +version: 0.1.0 +appVersion: "latest" +home: https://github.com/NextronSystems/thunderstorm-deployment +sources: + - https://github.com/NextronSystems/thunderstorm-deployment +maintainers: + - name: Marius Benthin + email: marius.benthin@nextron-systems.com +keywords: + - thor + - thunderstorm + - nextron + - security + - scanner diff --git a/charts/thunderstorm/templates/NOTES.txt b/charts/thunderstorm/templates/NOTES.txt new file mode 100644 index 0000000..4483a20 --- /dev/null +++ b/charts/thunderstorm/templates/NOTES.txt @@ -0,0 +1,34 @@ +Thunderstorm has been deployed as release {{ .Release.Name }} in namespace {{ .Release.Namespace }}. + +{{- if not (or .Values.contractToken.value .Values.contractToken.existingSecret) }} + +WARNING: No CONTRACT_TOKEN configured. On initial install set either: + --set contractToken.value= + --set contractToken.existingSecret= +{{- end }} + +To reach the Thunderstorm API: +{{- if .Values.gateway.enabled }} +{{- $section := .Values.gateway.parentRef.sectionName | default "" }} +{{- $scheme := ternary "https" "http" (contains "https" $section) }} +{{- range .Values.gateway.hostnames }} + {{ $scheme }}://{{ . }} +{{- end }} + + Attached to Gateway {{ .Values.gateway.parentRef.namespace | default .Release.Namespace }}/{{ .Values.gateway.parentRef.name }}{{ with .Values.gateway.parentRef.sectionName }} (listener {{ . }}){{ end }}. + Check route status: + kubectl --namespace {{ .Release.Namespace }} get httproute {{ include "thunderstorm.fullname" . }} -o yaml +{{- else if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ .host }} +{{- end }} +{{- else if eq .Values.service.type "ClusterIP" }} + kubectl --namespace {{ .Release.Namespace }} port-forward svc/{{ include "thunderstorm.fullname" . }} 8080:{{ .Values.service.port }} + curl http://localhost:8080/api/status +{{- else if eq .Values.service.type "LoadBalancer" }} + kubectl --namespace {{ .Release.Namespace }} get svc {{ include "thunderstorm.fullname" . }} +{{- else if eq .Values.service.type "NodePort" }} + export NODE_PORT=$(kubectl --namespace {{ .Release.Namespace }} get svc {{ include "thunderstorm.fullname" . }} -o jsonpath='{.spec.ports[0].nodePort}') + export NODE_IP=$(kubectl --namespace {{ .Release.Namespace }} get nodes -o jsonpath='{.items[0].status.addresses[0].address}') + curl http://$NODE_IP:$NODE_PORT/api/status +{{- end }} diff --git a/charts/thunderstorm/templates/_helpers.tpl b/charts/thunderstorm/templates/_helpers.tpl new file mode 100644 index 0000000..98844a9 --- /dev/null +++ b/charts/thunderstorm/templates/_helpers.tpl @@ -0,0 +1,82 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "thunderstorm.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +*/}} +{{- define "thunderstorm.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Chart label. +*/}} +{{- define "thunderstorm.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels. +*/}} +{{- define "thunderstorm.labels" -}} +helm.sh/chart: {{ include "thunderstorm.chart" . }} +{{ include "thunderstorm.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels. +*/}} +{{- define "thunderstorm.selectorLabels" -}} +app.kubernetes.io/name: {{ include "thunderstorm.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Service account name. +*/}} +{{- define "thunderstorm.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "thunderstorm.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Contract token secret name. +*/}} +{{- define "thunderstorm.contractTokenSecretName" -}} +{{- if .Values.contractToken.existingSecret }} +{{- .Values.contractToken.existingSecret }} +{{- else }} +{{- printf "%s-contract-token" (include "thunderstorm.fullname" .) }} +{{- end }} +{{- end }} + +{{/* +TLS secret name. +*/}} +{{- define "thunderstorm.tlsSecretName" -}} +{{- if .Values.tls.existingSecret }} +{{- .Values.tls.existingSecret }} +{{- else }} +{{- printf "%s-tls" (include "thunderstorm.fullname" .) }} +{{- end }} +{{- end }} diff --git a/charts/thunderstorm/templates/deployment.yaml b/charts/thunderstorm/templates/deployment.yaml new file mode 100644 index 0000000..fcc7254 --- /dev/null +++ b/charts/thunderstorm/templates/deployment.yaml @@ -0,0 +1,123 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "thunderstorm.fullname" . }} + labels: + {{- include "thunderstorm.labels" . | nindent 4 }} +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + {{- include "thunderstorm.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "thunderstorm.selectorLabels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "thunderstorm.serviceAccountName" . }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: thunderstorm + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: 8080 + protocol: TCP + env: + - name: CONTRACT_TOKEN + valueFrom: + secretKeyRef: + name: {{ include "thunderstorm.contractTokenSecretName" . }} + key: {{ .Values.contractToken.existingSecretKey | default "CONTRACT_TOKEN" }} + optional: true + {{- if .Values.tls.enabled }} + - name: TLS_CERT + value: /run/secrets/tls/tls.crt + - name: TLS_KEY + value: /run/secrets/tls/tls.key + {{- end }} + {{- range $key, $value := .Values.env }} + {{- if $value }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} + {{- end }} + volumeMounts: + - name: data + mountPath: /opt/nextron/thunderstorm + {{- if .Values.tls.enabled }} + - name: tls + mountPath: /run/secrets/tls + readOnly: true + {{- end }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: + exec: + command: + - /bin/sh + - -c + - '[ -n "$TECHPREVIEW" ] || [ "${SIGNATURE_UPDATE_INTERVAL:-0}" = "0" ] || [ $(($(date +%s) - $(stat -c %Y /proc/1))) -lt $(( ${SIGNATURE_UPDATE_INTERVAL} * 3600 )) ]' + initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} + failureThreshold: {{ .Values.livenessProbe.failureThreshold }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: + tcpSocket: + port: http + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + {{- end }} + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + volumes: + - name: data + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ .Values.persistence.existingClaim | default (include "thunderstorm.fullname" .) }} + {{- else }} + emptyDir: {} + {{- end }} + {{- if .Values.tls.enabled }} + - name: tls + secret: + secretName: {{ include "thunderstorm.tlsSecretName" . }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/thunderstorm/templates/httproute.yaml b/charts/thunderstorm/templates/httproute.yaml new file mode 100644 index 0000000..4aec084 --- /dev/null +++ b/charts/thunderstorm/templates/httproute.yaml @@ -0,0 +1,38 @@ +{{- if .Values.gateway.enabled }} +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: {{ include "thunderstorm.fullname" . }} + labels: + {{- include "thunderstorm.labels" . | nindent 4 }} + {{- with .Values.gateway.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + parentRefs: + - group: gateway.networking.k8s.io + kind: Gateway + name: {{ required "gateway.parentRef.name is required when gateway.enabled is true" .Values.gateway.parentRef.name }} + {{- with .Values.gateway.parentRef.namespace }} + namespace: {{ . }} + {{- end }} + {{- with .Values.gateway.parentRef.sectionName }} + sectionName: {{ . }} + {{- end }} + {{- with .Values.gateway.hostnames }} + hostnames: + {{- toYaml . | nindent 4 }} + {{- end }} + rules: + - matches: + - path: + type: PathPrefix + value: / + backendRefs: + - group: "" + kind: Service + name: {{ include "thunderstorm.fullname" . }} + port: {{ .Values.service.port }} + weight: 1 +{{- end }} diff --git a/charts/thunderstorm/templates/ingress.yaml b/charts/thunderstorm/templates/ingress.yaml new file mode 100644 index 0000000..3873d3c --- /dev/null +++ b/charts/thunderstorm/templates/ingress.yaml @@ -0,0 +1,35 @@ +{{- if .Values.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "thunderstorm.fullname" . }} + labels: + {{- include "thunderstorm.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.ingress.className }} + ingressClassName: {{ . }} + {{- end }} + {{- with .Values.ingress.tls }} + tls: + {{- toYaml . | nindent 4 }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType }} + backend: + service: + name: {{ include "thunderstorm.fullname" $ }} + port: + number: {{ $.Values.service.port }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/thunderstorm/templates/pvc.yaml b/charts/thunderstorm/templates/pvc.yaml new file mode 100644 index 0000000..7254300 --- /dev/null +++ b/charts/thunderstorm/templates/pvc.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ include "thunderstorm.fullname" . }} + labels: + {{- include "thunderstorm.labels" . | nindent 4 }} +spec: + accessModes: + - {{ .Values.persistence.accessMode | default "ReadWriteOnce" }} + resources: + requests: + storage: {{ .Values.persistence.size }} + {{- with .Values.persistence.storageClass }} + storageClassName: {{ . | quote }} + {{- end }} +{{- end }} diff --git a/charts/thunderstorm/templates/secret-contract-token.yaml b/charts/thunderstorm/templates/secret-contract-token.yaml new file mode 100644 index 0000000..5840ef6 --- /dev/null +++ b/charts/thunderstorm/templates/secret-contract-token.yaml @@ -0,0 +1,11 @@ +{{- if and .Values.contractToken.value (not .Values.contractToken.existingSecret) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "thunderstorm.contractTokenSecretName" . }} + labels: + {{- include "thunderstorm.labels" . | nindent 4 }} +type: Opaque +stringData: + CONTRACT_TOKEN: {{ .Values.contractToken.value | quote }} +{{- end }} diff --git a/charts/thunderstorm/templates/secret-tls.yaml b/charts/thunderstorm/templates/secret-tls.yaml new file mode 100644 index 0000000..866b1e4 --- /dev/null +++ b/charts/thunderstorm/templates/secret-tls.yaml @@ -0,0 +1,12 @@ +{{- if and .Values.tls.enabled .Values.tls.cert .Values.tls.key (not .Values.tls.existingSecret) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "thunderstorm.tlsSecretName" . }} + labels: + {{- include "thunderstorm.labels" . | nindent 4 }} +type: kubernetes.io/tls +stringData: + tls.crt: {{ .Values.tls.cert | quote }} + tls.key: {{ .Values.tls.key | quote }} +{{- end }} diff --git a/charts/thunderstorm/templates/service.yaml b/charts/thunderstorm/templates/service.yaml new file mode 100644 index 0000000..fb8ec10 --- /dev/null +++ b/charts/thunderstorm/templates/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "thunderstorm.fullname" . }} + labels: + {{- include "thunderstorm.labels" . | nindent 4 }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "thunderstorm.selectorLabels" . | nindent 4 }} diff --git a/charts/thunderstorm/templates/serviceaccount.yaml b/charts/thunderstorm/templates/serviceaccount.yaml new file mode 100644 index 0000000..d7103fe --- /dev/null +++ b/charts/thunderstorm/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "thunderstorm.serviceAccountName" . }} + labels: + {{- include "thunderstorm.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/thunderstorm/values.yaml b/charts/thunderstorm/values.yaml new file mode 100644 index 0000000..9ea2f5b --- /dev/null +++ b/charts/thunderstorm/values.yaml @@ -0,0 +1,133 @@ +image: + repository: ghcr.io/nextronsystems/thunderstorm-deployment + # tag defaults to .Chart.AppVersion when empty + tag: "" + pullPolicy: IfNotPresent + +imagePullSecrets: [] + +nameOverride: "" +fullnameOverride: "" + +# Required on initial startup: non-host-based Thunderstorm contract token. +# Provide the value here (rendered into a Secret) or point at an existing Secret. +contractToken: + value: "" + existingSecret: "" + existingSecretKey: CONTRACT_TOKEN + +# Optional environment variables - empty values are omitted +env: + TECHPREVIEW: true + SIGNATURE_UPDATE_INTERVAL: "" + RESULT_CACHE_SIZE: "" + FORCE_MAX_FILE_SIZE: "" + LOG_ENABLED: "" + PURE_YARA: "" + YARA_FORGE: "" + THUNDERSTORM_ARGS: "" + THOR_ARGS: "" + # THOR 10 only + STORE_SAMPLES: "" + SYNC_ONLY_THREADS: "" + # THOR 11 only + STORE_SAMPLES_SCORE: "" + QUEUE_WARN_SIZE: "" + VFS_ENABLED: "" + +# TLS certificate and private key. When enabled, a Secret of type kubernetes.io/tls +# is mounted at /run/secrets/tls and TLS_CERT/TLS_KEY env vars are set automatically. +tls: + enabled: false + # PEM-encoded material. Ignored when existingSecret is set. + cert: "" + key: "" + existingSecret: "" + +persistence: + enabled: true + size: 5Gi + storageClass: "" + accessMode: ReadWriteOnce + existingClaim: "" + +service: + type: ClusterIP + port: 8080 + annotations: {} + +ingress: + enabled: false + className: "" + annotations: {} + hosts: + - host: thunderstorm.local + paths: + - path: / + pathType: Prefix + tls: [] + +# Gateway API HTTPRoute that attaches to an existing Gateway (typically a shared +# Cilium gateway in another namespace). The chart does NOT create a Gateway +# resource; provide parentRef pointing at one that already exists. +# Assume https when the referenced listener terminates TLS (used only for NOTES output). +gateway: + enabled: false + parentRef: + name: cilium-gateway # name of the existing Gateway + namespace: tooling # namespace where the Gateway lives (omit if same as release namespace) + sectionName: https-standard # listener name on the Gateway (omit to attach to all listeners) + hostnames: + - thunderstorm.local + annotations: {} + +resources: {} + # limits: + # cpu: "4" + # memory: 8Gi + # requests: + # cpu: "1" + # memory: 2Gi + +nodeSelector: {} +tolerations: [] +affinity: {} + +podAnnotations: {} +podLabels: {} + +# The container image runs as the non-root `thunderstorm` user (UID/GID 1000) +# created in the Containerfile. fsGroup tells kubelet to chown the mounted PVC +# to this GID before the container starts, so unzip can write into /opt/nextron/thunderstorm. +podSecurityContext: + fsGroup: 1000 + +securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + capabilities: + drop: + - ALL + +# livenessProbe: it fails once the container has been running longer than +# SIGNATURE_UPDATE_INTERVAL hours, prompting kubelet to restart the pod +# so THOR 10 re-fetches signatures on next boot. Always passes when TECHPREVIEW +# is set (THOR 11 updates in-process) or the interval is 0/unset. +livenessProbe: + enabled: true + initialDelaySeconds: 600 + periodSeconds: 300 + timeoutSeconds: 10 + failureThreshold: 1 + +readinessProbe: + enabled: true + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + +serviceAccount: + create: true + name: "" + annotations: {}