values.yaml

# Default values for wordpress-bedrock.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

replicaCount: 1

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the release name
  name:
  #iamRoleArn:

podAnnotations: {}
podLabels: {}

podSecurityContext:
  fsGroup: 2000

securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: false
  className: ""
  annotations:
    alb.ingress.kubernetes.io/target-group-attributes: deregistration_delay.timeout_seconds=25,slow_start.duration_seconds=30 # deregistration_delay must be less or equal to preStop delay
    alb.ingress.kubernetes.io/healthcheck-path: /nginx-ping
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "5"
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "10"
  hosts:
    - host: chart-example.local
      paths:
        - path: /
          pathType: ImplementationSpecific

  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - chart-example.local

efs:
  enabled: false
  # fsid: fs-12345
  # subPath: defaults to release name
  awsRegion: eu-central-1
  #storageClassName: efs
  storageClassName: efs-dynamic
  # if set to true data from app docker image (specifically directories listed in php.extraVolumeMounts) will be force copied into particular efs subdirectories
  copyFromImage: false
  # extra Dirs not needed anymore
  extraDirs: []

# add karpenter specific optimizations. Remember disabling the optimization when using this helm chart on a k8s cluster without karpenter!
karpenter:
  optimization: true
  # valid values for arch are "amd64", "arm64" or "" (empty). An empty value represents multi-arch support.
  arch: amd64
  cron:
    dedicatedNodePool: true
    nodePoolPrefix: "cron-"

nginx:
  image:
    repository: public.ecr.aws/nginx/nginx
    tag: 1.26
    pullPolicy: IfNotPresent
  resources: {}
  disallow_robots: false
  client_max_body_size: 10M
  cors_origins: []
  header: {}
  rate_limit_login:
    enabled: false
    zone_memory_size: 10m
    requests_per_second: 1
    requests_burst: 2
  cache_control:
    expires: max
    js_css_enabled: true
  accessLog:
    enabled: true
    logUpstreamTime: true
  fastcgi_buffer_size: 16k
  fastcgi_buffers_number: 16
  fastcgi_buffers_size: 8k
  # this document will be attached to the nginx server block
  additional_config:
  securityContext:
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    runAsUser: 101
  extraVolumeMounts:  []
  livenessProbe:
    httpGet:
      path: /nginx-status
      port: http
    failureThreshold: 3
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 1
  readinessProbe:
    httpGet:
      path: /wp/wp-login.php
      port: http
    failureThreshold: 3
    periodSeconds: 20
    successThreshold: 1
    timeoutSeconds: 3

php:
  image:
    repository: ghcr.io/arvatoaws-labs/php
    tag: fpm
    pullPolicy: IfNotPresent
  resources: {}
  fpm:
    accessLog:
      enabled: false
    pm:
      max_children: 10
      start_servers: 2
      min_spare_servers: 1
      max_spare_servers: 3
      process_idle_timeout: 10s
      max_requests: 500
  php_admin_value:
    memory_limit: 64M
    upload_max_filesize: 10M
    post_max_size: 15M
    date.timezone: Europe/Berlin
    error_reporting: E_ALL
    display_errors: 'Off'
    log_errors: 'On'
  securityContext:
    capabilities:
      drop:
      - ALL
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    runAsUser: 82
  readOnlyWebFilesystem: true
  extraVolumeMounts:  []

# additional environment variables passed directly to containers.
env: {}
#  FOO: bar

# settings are used for WP Offload Media plugin
offload:
  bucket: null
  region: null
  domain: null
  cloudfront: null
  local_domains: null
  privateKey:
    enabled: false
    filePath: /var/local/
    fileName: wpoffload_private.pem

# these plugins will be activated using the activate-wp-plugins hook
plugins:
  - amazon-s3-and-cloudfront
  - amazon-s3-and-cloudfront-pro
  - amazon-s3-and-cloudfront-tweaks

wordpress:
  # sample setting for office hours would be "Mon-Fri 07:30-18:30 Europe/Berlin"
  uptime:

# this sections allows to configure different hooks at different stages of the helm deployment
hooks:
  init:
    resources:
      requests:
        cpu: 10m
        memory: 64Mi
  php:
    memory_limit: 128M
    date.timezone: Europe/Berlin
  type:
    pre-install:
      - wait-for-mysql-root
      - create-mysql-database
      - create-mysql-user
      - wait-for-mysql-user
      - verify-wp-core-checksums
      - install-wp-core
      - update-wp-core-database
      - activate-wp-plugins
    post-install:
      - report-versions
    pre-upgrade:
      - wait-for-mysql-user
      - verify-wp-core-checksums
      - update-wp-admin-user
    post-upgrade:
      - wait-for-mysql-user
      - update-wp-core-database
      - activate-wp-plugins
      - migrate-amazon-s3
      - report-versions

# this section allows to inject external secrets into the wordpress deployment
externalSecrets:
  enabled: false
  engine: external-secrets # kube-external-secrets
  refreshInterval: "0"
  region: eu-central-1
  backendType: systemManager
  # additional environment variables passed directly to containers. Env values represent parameter store keys.
  env:
#    DB_ROOT_USERNAME: /dev/wordpress-1/DB/username
#    DB_ROOT_PASSWORD: /dev/wordpress-1/DB/password
#    DB_USERNAME: /dev/exampleblog/DB/username
#    DB_PASSWORD: /dev/exampleblog/DB/password
#    WORDPRESS_USERNAME: /dev/exampleblog/wordpress/username
#    WORDPRESS_PASSWORD: /dev/exampleblog/wordpress/password

monitoring:
  enabled: true
  serviceMonitor:
    # When set true and if Prometheus Operator is installed then use a ServiceMonitor to configure scraping
    enabled: true
    # Set the namespace the ServiceMonitor should be deployed
    # namespace: monitoring
    # Set how frequently Prometheus should scrape
    # interval: 30s

init:
  resources: {}

exporter:
  nginx:
    image:
      repository: ghcr.io/arvatoaws-labs/nginx-exporter
      tag: 1.0.0
      pullPolicy: IfNotPresent
    port: 9113
    telemetry_path: /metrics
    nginx_plus: false
    scrape_uri: "http://127.0.0.1:8080/nginx-status"
    ssl_verify: false
    timeout: "5s"
    nginx_retries: "0"
    nginx_retry_interval: "5s"
    resources: {}
    securityContext:
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 65534

  phpfpm:
    image:
      repository: ghcr.io/arvatoaws-labs/hipages/php-fpm_exporter
      tag: 2.2.0
      pullPolicy: IfNotPresent
    port: 9253
    metrics: /metrics
    scrape_uri: "tcp://127.0.0.1:9000/fpm-status"
    fix_process_count: false
    log_level: warn
    resources: {}
    securityContext:
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 65534

  wordpress:
    enabled: false
    image:
      repository: ghcr.io/arvatoaws-labs/wordpress_exporter
      tag: latest
      pullPolicy: IfNotPresent
    port: 9850
    metrics: /metrics
    resources: {}
    securityContext:
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 65534

hpa:
  enabled: true
  engine: keda # prometheus-adapter
  prometheus:
    serverAddress: http://prometheus-operated.monitoring.svc.cluster.local:9090
  maxReplicas: 10
  targets:
    cpu: 95
    memory: 90
    php: 7
    nginx: 1000

# karpenter.optimization will force overwrite nodeSelector and tolerations
nodeSelector: {}

tolerations: []

affinity: {}

# this section allows to configure cron jobs
cron:
  timeZone: Europe/Berlin
  # this resources and php defaults will be applied if not get overwritten in the specific job
  resources:
    limits:
      memory: 512Mi
    requests:
      cpu: 50m
      memory: 128Mi
  # karpenter.optimization will force overwrite nodeSelector and tolerations
  nodeSelector: {}
  tolerations: []
  php:
    memory_limit: 128M
    date.timezone: Europe/Berlin
  jobs:
    wp-cron:
      enabled: true
      # either schedule or scheduleEveryHrs or scheduleEveryMin must be set.
      # schedule has precedence over scheduleEveryHrs and scheduleEveryMin.
      # schedule uses Cron syntax format.
      #schedule: "*/5 * * * *"
      # schedule every x hour using random offset.
      # scheduleEveryHrs has precedence over scheduleEveryMin.
      # valid values are 1, 2, 3, 4, 6, 8, 12.
      #scheduleEveryHrs: 5
      # schedule every x min using random offset.
      # valid values are 1, 2, 3, 5, 6, 10, 15, 20, 30.
      scheduleEveryMin: 5
      # cron 'day of week' syntax format (default *)
      # can only be used in conjunction with scheduleEveryHrs or scheduleEveryMin
      #scheduleOnDay: 1-5
      command: /scripts/run-cron.sh
      concurrencyPolicy: Replace
      restartPolicy: OnFailure
      startingDeadlineSeconds: 1800
      ttlSecondsAfterFinished: 600