54 lines
2.6 KiB
YAML
54 lines
2.6 KiB
YAML
# k8s/portainer/portainer-values.yaml
|
|
# Portainer — web UI for browsing cluster workloads, exec-ing into pods,
|
|
# and viewing logs without kubectl. Operator-only access (ClusterIP + port-forward).
|
|
#
|
|
# Node failure behaviour:
|
|
# Portainer is a Deployment (not StatefulSet), so K8s auto-evicts and
|
|
# reschedules it ~5 min after a node becomes unreachable. Longhorn
|
|
# reattaches the PVC on the new node in ~1-2 min. Worst case: ~7-10 min.
|
|
#
|
|
# To cut that down: in Longhorn UI → Settings set
|
|
# nodeDownPodDeletionPolicy = delete-deployment-pod
|
|
# Longhorn will force-delete the stuck pod immediately when the node is
|
|
# fenced rather than waiting for Kubernetes' eviction timeout.
|
|
|
|
# ── Service ───────────────────────────────────────────────────────────────────
|
|
# ClusterIP — no external exposure. Access via:
|
|
# kubectl -n dashboard port-forward svc/portainer 9000:9000
|
|
# Portainer holds cluster-admin credentials; never expose as LoadBalancer.
|
|
service:
|
|
type: ClusterIP
|
|
|
|
# ── TLS ───────────────────────────────────────────────────────────────────────
|
|
# Portainer by default redirects HTTP → HTTPS using a self-signed cert.
|
|
# force: false disables the redirect so plain HTTP over port-forward works
|
|
# without browser cert warnings. TLS is terminated at the ingress layer
|
|
# if/when an ingress rule is added.
|
|
tls:
|
|
force: false
|
|
|
|
# ── Persistence ───────────────────────────────────────────────────────────────
|
|
# Stores Portainer's own config: environment registrations, user accounts,
|
|
# stack definitions, and access control settings. Longhorn provides the
|
|
# RWO block volume. 10Gi is generous for config data but cheap on Longhorn.
|
|
persistence:
|
|
enabled: true
|
|
storageClass: "longhorn"
|
|
size: 10Gi
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
# ── Scheduling ────────────────────────────────────────────────────────────────
|
|
# Allow scheduling on talos-cp-1 (carries NoSchedule taint) so Portainer
|
|
# keeps running even when the worker node is down.
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|