claude
1bd0fec23a
gateway(nginx) + manager(python 標準ライブラリ) + セッションごとの使い捨て Pod + reaper CronJob の構成。ブラウザ(PC/スマホ)からアクセスし、セッション単位で 独立した Alpine コンテナに Git リポジトリ(GitHub/Gitea など)をチェックアウトして 編集・検証・プッシュする。無操作が続いたセッションは Pod ごと自動破棄。 - セキュリティ: セッション NS 分離 / restricted PodSecurity / RBAC はセッション NS の pods,services のみの Role / セッション Pod は SA トークン非マウント・非 root・ readOnlyRootFilesystem・drop ALL caps・seccomp / NetworkPolicy で egress を DNS+HTTPS+SSH に限定 / Git ホスト allow-list / ResourceQuota+LimitRange - ライフサイクル: idleTimeout(Pod 内ウォッチドッグ + manager 回収) / maxLifetime (activeDeadlineSeconds) / maxSessions / 予備の孤児掃除 CronJob - 認証: token(既定) / basic / forward(外部SSO) / none。WebSocket は Cookie トークン - Claude 認証: ANTHROPIC_API_KEY または CLAUDE_CODE_OAUTH_TOKEN - CI: helm-release.yaml(未リリース版のみ tag+release+publish) / image-update-and-release.yaml(週次 npm 追従) / session-image.yaml(multi-arch build) - files/ 実体を .Files.Get で ConfigMap 化。helm lint / template 検証済み
270 lines
8.5 KiB
JSON
270 lines
8.5 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft-07/schema#",
|
|
"title": "claude-code Helm chart values",
|
|
"type": "object",
|
|
"additionalProperties": true,
|
|
"properties": {
|
|
"nameOverride": { "type": "string" },
|
|
"fullnameOverride": { "type": "string" },
|
|
|
|
"image": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["gateway", "manager", "session"],
|
|
"properties": {
|
|
"gateway": { "$ref": "#/definitions/image" },
|
|
"manager": { "$ref": "#/definitions/image" },
|
|
"session": { "$ref": "#/definitions/image" }
|
|
}
|
|
},
|
|
"imagePullSecrets": {
|
|
"type": "array",
|
|
"items": { "type": "object", "required": ["name"], "properties": { "name": { "type": "string" } } }
|
|
},
|
|
|
|
"gateway": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"replicaCount": { "type": "integer", "minimum": 1 },
|
|
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"resources": { "type": "object" }
|
|
}
|
|
},
|
|
|
|
"manager": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"logLevel": { "type": "string", "enum": ["debug", "info", "warning", "error"] },
|
|
"resources": { "type": "object" }
|
|
}
|
|
},
|
|
|
|
"sessionsNamespace": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"name": { "type": "string" },
|
|
"create": { "type": "boolean" },
|
|
"podSecurityLevel": { "type": "string", "enum": ["privileged", "baseline", "restricted"] },
|
|
"resourceQuota": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"hard": { "type": "object" }
|
|
}
|
|
},
|
|
"limitRange": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"max": { "type": "object" },
|
|
"default": { "type": "object" },
|
|
"defaultRequest": { "type": "object" }
|
|
}
|
|
}
|
|
}
|
|
},
|
|
|
|
"auth": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["mode"],
|
|
"properties": {
|
|
"mode": { "type": "string", "enum": ["token", "basic", "forward", "none"] },
|
|
"token": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"value": { "type": "string" },
|
|
"existingSecret": { "type": "string" },
|
|
"existingSecretKey": { "type": "string" }
|
|
}
|
|
},
|
|
"basic": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"users": { "type": "array", "items": { "type": "string" } },
|
|
"existingSecret": { "type": "string" },
|
|
"existingSecretKey": { "type": "string" }
|
|
}
|
|
},
|
|
"forward": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"url": { "type": "string" },
|
|
"signInUrl": { "type": "string" }
|
|
}
|
|
}
|
|
}
|
|
},
|
|
|
|
"anthropic": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["authMode"],
|
|
"properties": {
|
|
"authMode": { "type": "string", "enum": ["apiKey", "oauth"] },
|
|
"apiKey": { "type": "string" },
|
|
"oauthToken": { "type": "string" },
|
|
"existingSecret": { "type": "string" },
|
|
"existingSecretKeyApiKey": { "type": "string" },
|
|
"existingSecretKeyOauthToken": { "type": "string" },
|
|
"extraEnv": { "type": "object" }
|
|
}
|
|
},
|
|
|
|
"git": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["allowedHosts"],
|
|
"properties": {
|
|
"allowedHosts": { "type": "array", "items": { "type": "string" } },
|
|
"allowArbitraryRepos": { "type": "boolean" },
|
|
"defaultAuthorName": { "type": "string" },
|
|
"defaultAuthorEmail": { "type": "string" },
|
|
"identities": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["type"],
|
|
"properties": {
|
|
"type": { "type": "string", "enum": ["ssh", "https-token"] },
|
|
"sshPrivateKey": { "type": "string" },
|
|
"knownHosts": { "type": "string" },
|
|
"username": { "type": "string" },
|
|
"token": { "type": "string" },
|
|
"existingSecret": { "type": "string" },
|
|
"existingSecretKeyPrivateKey": { "type": "string" },
|
|
"existingSecretKeyKnownHosts": { "type": "string" },
|
|
"existingSecretKeyToken": { "type": "string" }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
|
|
"session": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"autoStartClaude": { "type": "boolean" },
|
|
"workspaceDir": { "type": "string" },
|
|
"ttydPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"extraApkPackages": { "type": "array", "items": { "type": "string" } },
|
|
"claudeCodeVersion": { "type": "string" },
|
|
"resources": { "type": "object" },
|
|
"idleTimeoutSeconds": { "type": "integer", "minimum": 60 },
|
|
"maxLifetimeSeconds": { "type": "integer", "minimum": 300 },
|
|
"reaper": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"intervalSeconds": { "type": "integer", "minimum": 10 },
|
|
"cronjob": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"schedule": { "type": "string" }
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"maxSessions": { "type": "integer", "minimum": 1 },
|
|
"verifyCommand": { "type": "string" },
|
|
"autoPush": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"branchPrefix": { "type": "string" },
|
|
"protectedBranches": { "type": "array", "items": { "type": "string" } }
|
|
}
|
|
},
|
|
"podLabels": { "type": "object" },
|
|
"podAnnotations": { "type": "object" },
|
|
"nodeSelector": { "type": "object" },
|
|
"tolerations": { "type": "array" },
|
|
"priorityClassName": { "type": "string" }
|
|
}
|
|
},
|
|
|
|
"networkPolicy": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"dnsNamespaceSelector": { "type": "object" },
|
|
"allowInternetHttps": { "type": "boolean" },
|
|
"allowSshGit": { "type": "boolean" },
|
|
"blockedEgressCIDRs": { "type": "array", "items": { "type": "string" } },
|
|
"sessionEgressExtra": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"required": ["cidr", "ports"],
|
|
"properties": {
|
|
"cidr": { "type": "string" },
|
|
"ports": { "type": "array" }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
|
|
"ingress": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"className": { "type": "string" },
|
|
"annotations": { "type": "object" },
|
|
"hosts": { "type": "array" },
|
|
"tls": { "type": "array" }
|
|
}
|
|
},
|
|
|
|
"service": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"type": { "type": "string", "enum": ["ClusterIP", "NodePort", "LoadBalancer"] },
|
|
"port": { "type": "integer", "minimum": 1, "maximum": 65535 }
|
|
}
|
|
},
|
|
|
|
"podSecurityContext": { "type": "object" },
|
|
"containerSecurityContext": { "type": "object" },
|
|
"commonLabels": { "type": "object" },
|
|
"commonAnnotations": { "type": "object" },
|
|
"podDisruptionBudget": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"enabled": { "type": "boolean" },
|
|
"minAvailable": { "type": ["integer", "string"] }
|
|
}
|
|
}
|
|
},
|
|
"definitions": {
|
|
"image": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["registry", "repository", "tag"],
|
|
"properties": {
|
|
"registry": { "type": "string" },
|
|
"repository": { "type": "string" },
|
|
"tag": { "type": "string" },
|
|
"pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] }
|
|
}
|
|
}
|
|
}
|
|
}
|