undid security and emptydir

removed scc anyuid (out of band)

.gitea/workflows/publish-helm.yaml

@@ -1,57 +0,0 @@
-name: Helm Publish
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Helm
-        run: |
-          set -euo pipefail
-          curl -sSL https://get.helm.sh/helm-v3.15.0-linux-amd64.tar.gz -o /tmp/helm.tgz
-          tar xzf /tmp/helm.tgz -C /tmp
-          install /tmp/linux-amd64/helm /usr/local/bin/helm
-
-      - name: Install helm cm-push plugin
-        run: |
-          set -euo pipefail
-          helm plugin install https://github.com/chartmuseum/helm-push
-
-      - name: Lint and package chart
-        run: |
-          set -euo pipefail
-          helm lint .
-          helm dependency update . || true
-          helm package . -d /tmp
-
-      - name: Push chart to Gitea Helm registry
-        env:
-          HELM_REPO_URL: "https://gitea.apilab.us/api/packages/cscott/helm"
-          HELM_REPO_NAME: "gitea-helm"
-          HELM_USER: "cscott"
-          HELM_PASSWORD: "${{ secrets.HELM_PASSWORD }}"
-        run: |
-          set -euo pipefail
-          helm repo add "$HELM_REPO_NAME" "$HELM_REPO_URL" \
-            --username "$HELM_USER" \
-            --password "$HELM_PASSWORD"
-
-          NAME="$(grep '^name:' Chart.yaml | awk '{print $2}')"
-          YAML_VERSION="$(grep '^version:' Chart.yaml | awk '{print $2}')"
-          CHART_TGZ="/tmp/${NAME}-${YAML_VERSION}.tgz"
-          if [ ! -f "$CHART_TGZ" ]; then
-            echo "Expected packaged chart not found: $CHART_TGZ"
-            ls -l /tmp
-            exit 1
-          fi
-
-          helm cm-push "$CHART_TGZ" "$HELM_REPO_NAME"

README.md

@@ -1,4 +1,4 @@
-# plex-media-server
+# Plex Media Server
 
 ![Version: 1.2.0](https://img.shields.io/badge/Version-1.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.42.2](https://img.shields.io/badge/AppVersion-1.42.2-informational?style=flat-square)
 

argo-helm.yaml

@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: peanutflix
+  namespace: openshift-gitops
+spec:
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: peanutflix
+  source:
+    repoURL: https://gitea.apilab.us/cscott/peanutflix.git
+    targetRevision: main
+    path: .
+    helm:
+      valueFiles:
+        - values.yaml
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true

scc-updates.sh

@@ -1,2 +0,0 @@
-oc create sa peanutflix-sa -n peanutflix
-oc adm policy add-scc-to-user anyuid -z peanutflix-sa -n peanutflix

values.yaml

@@ -82,12 +82,13 @@ pms:
     # requests:
     #   cpu: 100m
     #   memory: 128Mi
-    #limits:
-    #  amd.com/gpu: 1
+    limits:
+      amd.com/gpu: 1
 
   # -- Security context for PMS pods
   securityContext: {}
 
+  # Redundant for openshift
   containerSecurityContext:
     runAsNonRoot: true
     allowPrivilegeEscalation: false
@@ -101,8 +102,7 @@ pms:
   shareProcessNamespace: false
 
   # -- Add kubernetes liveness probe to pms container.
-  livenessProbe:
-    {}
+  livenessProbe: {}
     # httpGet:
     #   path: /identity
     #   port: 32400
@@ -112,8 +112,7 @@ pms:
     # failureThreshold: 3
 
   # -- Add kubernetes readiness probe to pms container.
-  readinessProbe:
-    {}
+  readinessProbe: {}
     # httpGet:
     #   path: /identity
     #   port: 32400
@@ -284,7 +283,10 @@ priorityClassName: ""
 # -- Common Labels for all resources created by this chart.
 commonLabels: {}
 
-extraEnv: {}
+extraEnv:
+  S6_YES_I_WANT_A_WORLD_WRITABLE_RUN_BECAUSE_KUBERNETES: "1"
+  PLEX_UID: "1000"
+  PLEX_GID: "1000"
 # extraEnv:
 # This claim is optional, and is only used for the first startup of PMS
 # The claim is obtained from https://www.plex.tv/claim/ is is only valid for a few minutes
@@ -305,6 +307,8 @@ extraVolumeMounts:
   # extraVolumeMounts:
   - name: dev-dri
     mountPath: /dev/dri
+  #- name: s6-run
+  #  mountPath: /var/run/s6
   - name: pms
     mountPath: /mnt/nfs
 
@@ -318,6 +322,8 @@ extraVolumes:
   - name: pms
     persistentVolumeClaim:
       claimName: plex
+  #- name: s6-run
+  #  emptyDir: {}
 
 extraContainers: []
 # extraContainers: