108 lines
2.3 KiB
YAML
108 lines
2.3 KiB
YAML
# =============================================================
|
|
# Paramètres spécifiques à ce chart (IngressRoutes, Middlewares)
|
|
# =============================================================
|
|
|
|
# Namespace des services backend et frontend
|
|
servicesNamespace: gestion
|
|
|
|
domain: example.com
|
|
|
|
tls:
|
|
# "letsencrypt" | "secret"
|
|
mode: letsencrypt
|
|
email: admin@example.com
|
|
# Si mode=secret : nom du Secret TLS Kubernetes
|
|
secretName: gestion-tls
|
|
|
|
backend:
|
|
serviceName: gestion-backend
|
|
servicePort: 8080
|
|
|
|
frontend:
|
|
serviceName: gestion-frontend
|
|
servicePort: 80
|
|
|
|
waf:
|
|
paranoia: 2
|
|
anomalyInbound: 5
|
|
anomalyOutbound: 4
|
|
|
|
rateLimit:
|
|
# requêtes moyennes par seconde par IP
|
|
average: 20
|
|
burst: 50
|
|
|
|
# =============================================================
|
|
# Valeurs passées au subchart officiel traefik
|
|
# https://github.com/traefik/traefik-helm-chart
|
|
# =============================================================
|
|
traefik:
|
|
# Expose les ports 80 et 443
|
|
ports:
|
|
web:
|
|
port: 8000
|
|
expose:
|
|
default: true
|
|
redirectTo:
|
|
port: websecure
|
|
websecure:
|
|
port: 8443
|
|
expose:
|
|
default: true
|
|
tls:
|
|
enabled: true
|
|
|
|
# Logs
|
|
logs:
|
|
general:
|
|
level: INFO
|
|
access:
|
|
enabled: true
|
|
|
|
# Plugin Coraza WAF — Traefik télécharge le plugin au démarrage
|
|
# (le cluster doit avoir accès à internet ou utiliser un plugin local)
|
|
experimental:
|
|
plugins:
|
|
coraza-traefik:
|
|
moduleName: "github.com/corazawaf/coraza-traefik"
|
|
version: "v0.3.0"
|
|
|
|
# Cert resolver Let's Encrypt (ignoré si tls.mode=secret)
|
|
certResolvers:
|
|
letsencrypt:
|
|
email: admin@example.com
|
|
storage: /data/acme.json
|
|
httpChallenge:
|
|
entryPoint: web
|
|
|
|
# ACME storage persistant
|
|
persistence:
|
|
enabled: true
|
|
size: 128Mi
|
|
|
|
# Traefik lit les IngressRoutes dans tous les namespaces
|
|
providers:
|
|
kubernetesCRD:
|
|
enabled: true
|
|
allowCrossNamespace: true
|
|
|
|
# IP réelle via X-Forwarded-For (profondeur 1 = proxy direct)
|
|
# Le rate-limiter et les logs utilisent cette IP
|
|
service:
|
|
spec:
|
|
externalTrafficPolicy: Local
|
|
|
|
# Métriques Prometheus
|
|
metrics:
|
|
prometheus:
|
|
enabled: true
|
|
|
|
# Ressources
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|