mirror of
https://github.com/dredx/prole.git
synced 2026-09-27 04:44:30 +00:00
c023c7f590
- align app/db cluster defaults for knoe-dev-0 + knoe-dev-cnpg-0 on e2-standard-2\n- harden Supabase deploy flow for cross-cluster DB ILB, GKE storage class, and node selector fallback\n- migrate Helm chart path to knoe-supabase and make external DB host rendering IP-safe\n- disable Kerberos in prod unattended config to prevent Supabase GSS auth failures\n- add Supabase port-forward mappings and DB backup context handling improvements\n\nBuild status: k8s stable Co-authored-by: Junie <junie@jetbrains.com>
47 lines
2.3 KiB
YAML
47 lines
2.3 KiB
YAML
# GKE production values overlay for knoe-supabase Helm chart.
|
|
#
|
|
# Apply on top of values.yaml:
|
|
# helm upgrade --install knoe-supabase ./supabase/helm/knoe-supabase \
|
|
# --values supabase/helm/knoe-supabase/values.yaml \
|
|
# --values supabase/helm/knoe-supabase/values-gke.yaml \
|
|
# --set environment.auth.GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID="$CLIENT_ID" \
|
|
# --set environment.auth.GOTRUE_EXTERNAL_GOOGLE_SECRET="$CLIENT_SECRET" \
|
|
# --set environment.auth.GOTRUE_SITE_URL="https://$FRONTDOOR_HOST" \
|
|
# --set environment.auth.GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI="https://$FRONTDOOR_HOST/auth/v1/callback" \
|
|
# --set environment.auth.GOTRUE_URI_ALLOW_LIST="https://$FRONTDOOR_HOST/**"
|
|
#
|
|
# Or set FRONTDOOR_HOST, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET in environment
|
|
# and let init_supabase.sh --mode k8s substitute them automatically.
|
|
|
|
# ── Storage: use GCS instead of bundled MinIO ───────────────────────────────
|
|
# When CNPG Workload Identity is active the pod SA already has storage access;
|
|
# set storage driver to gcs and disable minio.
|
|
deployment:
|
|
minio:
|
|
enabled: false
|
|
|
|
# ── GoTrue: enable Google OAuth via knoe-auth OIDC broker ───────────────────
|
|
environment:
|
|
auth:
|
|
# Override base URL to the GKE frontdoor
|
|
API_EXTERNAL_URL: "" # set to https://<frontdoor-host>/auth/v1 at deploy time
|
|
GOTRUE_SITE_URL: "" # set to https://<frontdoor-host>
|
|
GOTRUE_URI_ALLOW_LIST: "" # set to https://<frontdoor-host>/**
|
|
|
|
# Google OAuth2 — client ID and secret from knoe-auth-google-oidc secret
|
|
GOTRUE_EXTERNAL_GOOGLE_ENABLED: "true"
|
|
GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: "" # injected at deploy time
|
|
GOTRUE_EXTERNAL_GOOGLE_SECRET: "" # injected at deploy time
|
|
GOTRUE_EXTERNAL_GOOGLE_REDIRECT_URI: "" # set to https://<frontdoor-host>/auth/v1/callback
|
|
|
|
# Disable anonymous sign-in in production
|
|
GOTRUE_EXTERNAL_ANONYMOUS_USERS_ENABLED: "false"
|
|
|
|
# Auto-confirm email (Google accounts are pre-verified)
|
|
GOTRUE_MAILER_AUTOCONFIRM: "true"
|
|
|
|
# ── Ingress: use GKE-managed ingress class ──────────────────────────────────
|
|
ingress:
|
|
studio:
|
|
className: "gce" # GKE L7 load balancer; override with "kong" if Kong is installed
|