homelab/k8s/apps/portainer/portainer-values.yaml

# k8s/portainer/portainer-values.yaml
# Portainer — web UI for browsing cluster workloads, exec-ing into pods,
# and viewing logs without kubectl. Operator-only access (ClusterIP + port-forward).
#
# Node failure behaviour:
#   Portainer is a Deployment (not StatefulSet), so K8s auto-evicts and
#   reschedules it ~5 min after a node becomes unreachable. Longhorn
#   reattaches the PVC on the new node in ~1-2 min. Worst case: ~7-10 min.
#
#   To cut that down: in Longhorn UI → Settings set
#     nodeDownPodDeletionPolicy = delete-deployment-pod
#   Longhorn will force-delete the stuck pod immediately when the node is
#   fenced rather than waiting for Kubernetes' eviction timeout.

# ── Service ───────────────────────────────────────────────────────────────────
# ClusterIP — no external exposure. Access via:
#   kubectl -n dashboard port-forward svc/portainer 9000:9000
# Portainer holds cluster-admin credentials; never expose as LoadBalancer.
service:
  type: ClusterIP

# ── TLS ───────────────────────────────────────────────────────────────────────
# Portainer by default redirects HTTP → HTTPS using a self-signed cert.
# force: false disables the redirect so plain HTTP over port-forward works
# without browser cert warnings. TLS is terminated at the ingress layer
# if/when an ingress rule is added.
tls:
  force: false

# ── Persistence ───────────────────────────────────────────────────────────────
# Stores Portainer's own config: environment registrations, user accounts,
# stack definitions, and access control settings. Longhorn provides the
# RWO block volume. 10Gi is generous for config data but cheap on Longhorn.
persistence:
  enabled: true
  storageClass: "longhorn"
  size: 10Gi

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

# ── Scheduling ────────────────────────────────────────────────────────────────
# Allow scheduling on talos-cp-1 (carries NoSchedule taint) so Portainer
# keeps running even when the worker node is down.
tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule

# Pin to az-b (talos-cp-2) — sole Longhorn storage node (dedicated disks).
# Its RWO PVC can only attach there; without this the pod may land on
# cp-1/cp-3 and fail to mount.
nodeSelector:
  topology.kubernetes.io/zone: az-b