99 — kitchen sink

Everything-on showcase. Don’t deploy this verbatim — it exists to demonstrate the chart’s full surface in one place. Use it as a reading reference; copy individual sections into a real values.yaml.

What this shows

• Two Deployments (api, worker) with sidecars and per-workload inherit opt-outs.
• One StatefulSet (db) with a volumeClaimTemplate and headless Service.
• Two jobGroups:
  • migrations — pre-install Job hook, tasks-mode initContainers, hashed-name idempotency.
  • nightly — CronJob.
• Service per Deployment with multi-port (http, grpc, admin, metrics) — port ordering exercises ADR 014.
• Singleton httpRoute with parent Gateway + per-workload route shorthand and priority.
• Cross-namespace referenceGrant.
• Multi-Ingress map (internal + external).
• HPA on the API; KEDA ScaledObject on the worker (event-driven on a Kafka lag scaler); VPA on the database.
• integrations.monitoring with VictoriaMetrics provider, CRD discovery, plus an annotation-mode override for one workload.
• ESO SecretStore (Vault) and two ExternalSecrets — one with explicit data, one with dataFrom.
• Stakater Reloader on with the default auto strategy.
• Argo CD ImageUpdater in shorthand mode tracking the API image with update-strategy: digest.
• commonLabels, custom podSecurityContext, automountServiceAccountToken: true for the API (RBAC-bound), NetworkPolicy, PodDisruptionBudget, topologySpreadConstraints.

Delta from 02-web-app-ingress

This example doesn’t follow the +1 progression — it’s a leap to “everything”. Read the values file with one ADR open per section:

Files

Prerequisites (CRDs)

Almost every CRD-bearing integration is touched. Don’t apply this in a cluster missing any of:

• Gateway API (gateway.networking.k8s.io)
• Prometheus or VictoriaMetrics Operator (depending on which provider you keep enabled)
• External Secrets Operator (external-secrets.io)
• KEDA (keda.sh)
• VPA (autoscaling.k8s.io)
• Argo CD Image Updater
• Stakater Reloader