@bluedynamics/cdk8s-plone 0.1.10 → 0.1.11

package/examples/production-volto/__snapshots__/main.test.ts.snap

@@ -0,0 +1,1412 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Production Volto Example Synthesizes correctly 1`] = `
+[
+  {
+    "apiVersion": "networking.k8s.io/v1",
+    "kind": "NetworkPolicy",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/component": "primary",
+        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/part-of": "plone",
+        "app.kubernetes.io/version": "18.1.0",
+        "helm.sh/chart": "postgresql-18.1.10",
+      },
+      "name": "test-chart-db-c80fdf3b-postgresql",
+      "namespace": "plone",
+    },
+    "spec": {
+      "egress": [
+        {},
+      ],
+      "ingress": [
+        {
+          "ports": [
+            {
+              "port": 5432,
+            },
+          ],
+        },
+      ],
+      "podSelector": {
+        "matchLabels": {
+          "app.kubernetes.io/component": "primary",
+          "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+          "app.kubernetes.io/name": "postgresql",
+        },
+      },
+      "policyTypes": [
+        "Ingress",
+        "Egress",
+      ],
+    },
+  },
+  {
+    "apiVersion": "policy/v1",
+    "kind": "PodDisruptionBudget",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/component": "primary",
+        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/part-of": "plone",
+        "app.kubernetes.io/version": "18.1.0",
+        "helm.sh/chart": "postgresql-18.1.10",
+      },
+      "name": "test-chart-db-c80fdf3b-postgresql",
+      "namespace": "plone",
+    },
+    "spec": {
+      "maxUnavailable": 1,
+      "selector": {
+        "matchLabels": {
+          "app.kubernetes.io/component": "primary",
+          "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+          "app.kubernetes.io/name": "postgresql",
+        },
+      },
+    },
+  },
+  {
+    "apiVersion": "v1",
+    "automountServiceAccountToken": false,
+    "kind": "ServiceAccount",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/part-of": "plone",
+        "app.kubernetes.io/version": "18.1.0",
+        "helm.sh/chart": "postgresql-18.1.10",
+      },
+      "name": "test-chart-db-c80fdf3b-postgresql",
+      "namespace": "plone",
+    },
+  },
+  {
+    "apiVersion": "v1",
+    "data": {
+      "password": "YWRtaW5AcGxvbmU=",
+      "postgres-password": "MVpZcjN6Mmg3OA==",
+    },
+    "kind": "Secret",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/part-of": "plone",
+        "app.kubernetes.io/version": "18.1.0",
+        "helm.sh/chart": "postgresql-18.1.10",
+      },
+      "name": "test-chart-db-c80fdf3b-postgresql",
+      "namespace": "plone",
+    },
+    "type": "Opaque",
+  },
+  {
+    "apiVersion": "v1",
+    "kind": "Service",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/component": "primary",
+        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/part-of": "plone",
+        "app.kubernetes.io/version": "18.1.0",
+        "helm.sh/chart": "postgresql-18.1.10",
+      },
+      "name": "test-chart-db-c80fdf3b-postgresql-hl",
+      "namespace": "plone",
+    },
+    "spec": {
+      "clusterIP": "None",
+      "ports": [
+        {
+          "name": "tcp-postgresql",
+          "port": 5432,
+          "targetPort": "tcp-postgresql",
+        },
+      ],
+      "publishNotReadyAddresses": true,
+      "selector": {
+        "app.kubernetes.io/component": "primary",
+        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+        "app.kubernetes.io/name": "postgresql",
+      },
+      "type": "ClusterIP",
+    },
+  },
+  {
+    "apiVersion": "v1",
+    "kind": "Service",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/component": "primary",
+        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/part-of": "plone",
+        "app.kubernetes.io/version": "18.1.0",
+        "helm.sh/chart": "postgresql-18.1.10",
+      },
+      "name": "test-chart-db-c80fdf3b-postgresql",
+      "namespace": "plone",
+    },
+    "spec": {
+      "ports": [
+        {
+          "name": "tcp-postgresql",
+          "port": 5432,
+          "targetPort": "tcp-postgresql",
+        },
+      ],
+      "selector": {
+        "app.kubernetes.io/component": "primary",
+        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+        "app.kubernetes.io/name": "postgresql",
+      },
+      "type": "ClusterIP",
+    },
+  },
+  {
+    "apiVersion": "apps/v1",
+    "kind": "StatefulSet",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/component": "primary",
+        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "postgresql",
+        "app.kubernetes.io/part-of": "plone",
+        "app.kubernetes.io/version": "18.1.0",
+        "helm.sh/chart": "postgresql-18.1.10",
+      },
+      "name": "test-chart-db-c80fdf3b-postgresql",
+      "namespace": "plone",
+    },
+    "spec": {
+      "replicas": 1,
+      "selector": {
+        "matchLabels": {
+          "app.kubernetes.io/component": "primary",
+          "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+          "app.kubernetes.io/name": "postgresql",
+        },
+      },
+      "serviceName": "test-chart-db-c80fdf3b-postgresql-hl",
+      "template": {
+        "metadata": {
+          "labels": {
+            "app.kubernetes.io/component": "primary",
+            "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+            "app.kubernetes.io/managed-by": "Helm",
+            "app.kubernetes.io/name": "postgresql",
+            "app.kubernetes.io/part-of": "plone",
+            "app.kubernetes.io/version": "18.1.0",
+            "helm.sh/chart": "postgresql-18.1.10",
+          },
+          "name": "test-chart-db-c80fdf3b-postgresql",
+        },
+        "spec": {
+          "affinity": {
+            "podAntiAffinity": {
+              "preferredDuringSchedulingIgnoredDuringExecution": [
+                {
+                  "podAffinityTerm": {
+                    "labelSelector": {
+                      "matchLabels": {
+                        "app.kubernetes.io/component": "primary",
+                        "app.kubernetes.io/instance": "test-chart-db-c80fdf3b",
+                        "app.kubernetes.io/name": "postgresql",
+                      },
+                    },
+                    "topologyKey": "kubernetes.io/hostname",
+                  },
+                  "weight": 1,
+                },
+              ],
+            },
+          },
+          "automountServiceAccountToken": false,
+          "containers": [
+            {
+              "env": [
+                {
+                  "name": "BITNAMI_DEBUG",
+                  "value": "false",
+                },
+                {
+                  "name": "POSTGRESQL_PORT_NUMBER",
+                  "value": "5432",
+                },
+                {
+                  "name": "POSTGRESQL_VOLUME_DIR",
+                  "value": "/bitnami/postgresql",
+                },
+                {
+                  "name": "OPENSSL_FIPS",
+                  "value": "yes",
+                },
+                {
+                  "name": "PGDATA",
+                  "value": "/bitnami/postgresql/data",
+                },
+                {
+                  "name": "POSTGRES_USER",
+                  "value": "plone",
+                },
+                {
+                  "name": "POSTGRES_PASSWORD_FILE",
+                  "value": "/opt/bitnami/postgresql/secrets/password",
+                },
+                {
+                  "name": "POSTGRES_POSTGRES_PASSWORD_FILE",
+                  "value": "/opt/bitnami/postgresql/secrets/postgres-password",
+                },
+                {
+                  "name": "POSTGRES_DATABASE",
+                  "value": "plone",
+                },
+                {
+                  "name": "POSTGRESQL_ENABLE_LDAP",
+                  "value": "no",
+                },
+                {
+                  "name": "POSTGRESQL_ENABLE_TLS",
+                  "value": "no",
+                },
+                {
+                  "name": "POSTGRESQL_LOG_HOSTNAME",
+                  "value": "false",
+                },
+                {
+                  "name": "POSTGRESQL_LOG_CONNECTIONS",
+                  "value": "false",
+                },
+                {
+                  "name": "POSTGRESQL_LOG_DISCONNECTIONS",
+                  "value": "false",
+                },
+                {
+                  "name": "POSTGRESQL_PGAUDIT_LOG_CATALOG",
+                  "value": "off",
+                },
+                {
+                  "name": "POSTGRESQL_CLIENT_MIN_MESSAGES",
+                  "value": "error",
+                },
+                {
+                  "name": "POSTGRESQL_SHARED_PRELOAD_LIBRARIES",
+                  "value": "pgaudit",
+                },
+              ],
+              "image": "registry-1.docker.io/bitnami/postgresql:latest",
+              "imagePullPolicy": "IfNotPresent",
+              "livenessProbe": {
+                "exec": {
+                  "command": [
+                    "/bin/sh",
+                    "-c",
+                    "exec pg_isready -U "plone" -d "dbname=plone" -h 127.0.0.1 -p 5432",
+                  ],
+                },
+                "failureThreshold": 6,
+                "initialDelaySeconds": 30,
+                "periodSeconds": 10,
+                "successThreshold": 1,
+                "timeoutSeconds": 5,
+              },
+              "name": "postgresql",
+              "ports": [
+                {
+                  "containerPort": 5432,
+                  "name": "tcp-postgresql",
+                },
+              ],
+              "readinessProbe": {
+                "exec": {
+                  "command": [
+                    "/bin/sh",
+                    "-c",
+                    "-e",
+                    "exec pg_isready -U "plone" -d "dbname=plone" -h 127.0.0.1 -p 5432
+[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
+",
+                  ],
+                },
+                "failureThreshold": 6,
+                "initialDelaySeconds": 5,
+                "periodSeconds": 10,
+                "successThreshold": 1,
+                "timeoutSeconds": 5,
+              },
+              "resources": {
+                "limits": {
+                  "cpu": "150m",
+                  "ephemeral-storage": "2Gi",
+                  "memory": "192Mi",
+                },
+                "requests": {
+                  "cpu": "100m",
+                  "ephemeral-storage": "50Mi",
+                  "memory": "128Mi",
+                },
+              },
+              "securityContext": {
+                "allowPrivilegeEscalation": false,
+                "capabilities": {
+                  "drop": [
+                    "ALL",
+                  ],
+                },
+                "privileged": false,
+                "readOnlyRootFilesystem": true,
+                "runAsGroup": 1001,
+                "runAsNonRoot": true,
+                "runAsUser": 1001,
+                "seLinuxOptions": {},
+                "seccompProfile": {
+                  "type": "RuntimeDefault",
+                },
+              },
+              "volumeMounts": [
+                {
+                  "mountPath": "/tmp",
+                  "name": "empty-dir",
+                  "subPath": "tmp-dir",
+                },
+                {
+                  "mountPath": "/opt/bitnami/postgresql/conf",
+                  "name": "empty-dir",
+                  "subPath": "app-conf-dir",
+                },
+                {
+                  "mountPath": "/opt/bitnami/postgresql/tmp",
+                  "name": "empty-dir",
+                  "subPath": "app-tmp-dir",
+                },
+                {
+                  "mountPath": "/opt/bitnami/postgresql/secrets/",
+                  "name": "postgresql-password",
+                },
+                {
+                  "mountPath": "/dev/shm",
+                  "name": "dshm",
+                },
+                {
+                  "mountPath": "/bitnami/postgresql",
+                  "name": "data",
+                },
+              ],
+            },
+          ],
+          "hostIPC": false,
+          "hostNetwork": false,
+          "securityContext": {
+            "fsGroup": 1001,
+            "fsGroupChangePolicy": "Always",
+            "supplementalGroups": [],
+            "sysctls": [],
+          },
+          "serviceAccountName": "test-chart-db-c80fdf3b-postgresql",
+          "volumes": [
+            {
+              "emptyDir": {},
+              "name": "empty-dir",
+            },
+            {
+              "name": "postgresql-password",
+              "secret": {
+                "secretName": "test-chart-db-c80fdf3b-postgresql",
+              },
+            },
+            {
+              "emptyDir": {
+                "medium": "Memory",
+              },
+              "name": "dshm",
+            },
+          ],
+        },
+      },
+      "updateStrategy": {
+        "rollingUpdate": {},
+        "type": "RollingUpdate",
+      },
+      "volumeClaimTemplates": [
+        {
+          "apiVersion": "v1",
+          "kind": "PersistentVolumeClaim",
+          "metadata": {
+            "name": "data",
+          },
+          "spec": {
+            "accessModes": [
+              "ReadWriteOnce",
+            ],
+            "resources": {
+              "requests": {
+                "storage": "8Gi",
+              },
+            },
+          },
+        },
+      ],
+    },
+  },
+  {
+    "apiVersion": "apps/v1",
+    "kind": "Deployment",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/component": "backend",
+        "app.kubernetes.io/name": "plone-backend-deployment",
+      },
+      "name": "test-chart-plone-backend-deployment-c8a3055e",
+    },
+    "spec": {
+      "replicas": 2,
+      "selector": {
+        "matchLabels": {
+          "app": "test-chart-plone-backend-c8848738",
+        },
+      },
+      "template": {
+        "metadata": {
+          "labels": {
+            "app": "test-chart-plone-backend-c8848738",
+            "app.kubernetes.io/component": "backend",
+            "app.kubernetes.io/managed-by": "cdk8s-plone",
+            "app.kubernetes.io/name": "plone-backend",
+            "app.kubernetes.io/part-of": "plone",
+            "app.kubernetes.io/version": "test.version",
+          },
+        },
+        "spec": {
+          "containers": [
+            {
+              "env": [
+                {
+                  "name": "SECRET_POSTGRESQL_USERNAME",
+                  "value": "plone",
+                },
+                {
+                  "name": "SECRET_POSTGRESQL_PASSWORD",
+                  "valueFrom": {
+                    "secretKeyRef": {
+                      "key": "password",
+                      "name": "test-chart-db-c80fdf3b-postgresql",
+                    },
+                  },
+                },
+                {
+                  "name": "INSTANCE_db_storage",
+                  "value": "relstorage",
+                },
+                {
+                  "name": "INSTANCE_db_blob_mode",
+                  "value": "cache",
+                },
+                {
+                  "name": "INSTANCE_db_cache_size",
+                  "value": "5000",
+                },
+                {
+                  "name": "INSTANCE_db_cache_size_bytes",
+                  "value": "1500MB",
+                },
+                {
+                  "name": "INSTANCE_db_relstorage",
+                  "value": "postgresql",
+                },
+                {
+                  "name": "INSTANCE_db_relstorage_postgresql_dsn",
+                  "value": "host='test-chart-db-c80fdf3b-postgresql' dbname='plone' user='$(SECRET_POSTGRESQL_USERNAME)' password='$(SECRET_POSTGRESQL_PASSWORD)'",
+                },
+                {
+                  "name": "INSTANCE_db_relstorage_cache_local_mb",
+                  "value": "800",
+                },
+              ],
+              "envFrom": [],
+              "image": "plone/plone-backend:6.1.3",
+              "imagePullPolicy": "IfNotPresent",
+              "name": "backend-container",
+              "readinessProbe": {
+                "failureThreshold": 3,
+                "httpGet": {
+                  "path": "/",
+                  "port": 8080,
+                },
+                "initialDelaySeconds": 10,
+                "periodSeconds": 10,
+                "successThreshold": 1,
+                "timeoutSeconds": 15,
+              },
+              "resources": {
+                "limits": {
+                  "cpu": "500m",
+                  "memory": "512Mi",
+                },
+                "requests": {
+                  "cpu": "200m",
+                  "memory": "256Mi",
+                },
+              },
+            },
+          ],
+          "imagePullSecrets": [],
+        },
+      },
+    },
+  },
+  {
+    "apiVersion": "policy/v1",
+    "kind": "PodDisruptionBudget",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/managed-by": "cdk8s-plone",
+        "app.kubernetes.io/part-of": "plone",
+      },
+      "name": "test-chart-plone-backend-pdb-c8a5ffa9",
+    },
+    "spec": {
+      "minAvailable": 1,
+      "selector": {
+        "matchLabels": {
+          "app": "test-chart-plone-backend-c8848738",
+        },
+      },
+    },
+  },
+  {
+    "apiVersion": "v1",
+    "kind": "Service",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/component": "service",
+        "app.kubernetes.io/managed-by": "cdk8s-plone",
+        "app.kubernetes.io/name": "plone-backend-service",
+        "app.kubernetes.io/part-of": "plone",
+      },
+      "name": "test-chart-plone-backend-service-c81ad65d",
+    },
+    "spec": {
+      "ports": [
+        {
+          "name": "backend-http",
+          "port": 8080,
+          "targetPort": 8080,
+        },
+      ],
+      "selector": {
+        "app": "test-chart-plone-backend-c8848738",
+      },
+    },
+  },
+  {
+    "apiVersion": "apps/v1",
+    "kind": "Deployment",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/component": "frontend",
+        "app.kubernetes.io/name": "plone-frontend-deployment",
+      },
+      "name": "test-chart-plone-frontend-deployment-c83abfa4",
+    },
+    "spec": {
+      "replicas": 2,
+      "selector": {
+        "matchLabels": {
+          "app": "test-chart-plone-frontend-c8e96701",
+        },
+      },
+      "template": {
+        "metadata": {
+          "labels": {
+            "app": "test-chart-plone-frontend-c8e96701",
+            "app.kubernetes.io/component": "frontend",
+            "app.kubernetes.io/managed-by": "cdk8s-plone",
+            "app.kubernetes.io/name": "plone-frontend",
+            "app.kubernetes.io/part-of": "plone",
+            "app.kubernetes.io/version": "test.version",
+          },
+        },
+        "spec": {
+          "containers": [
+            {
+              "env": [
+                {
+                  "name": "RAZZLE_INTERNAL_API_PATH",
+                  "value": "http://test-chart-plone-backend-service-c81ad65d:8080/Plone",
+                },
+              ],
+              "envFrom": [],
+              "image": "plone/plone-frontend:latest",
+              "imagePullPolicy": "IfNotPresent",
+              "name": "frontend-container",
+              "resources": {
+                "limits": {
+                  "cpu": "500m",
+                  "memory": "1Gi",
+                },
+                "requests": {
+                  "cpu": "200m",
+                  "memory": "256Mi",
+                },
+              },
+            },
+          ],
+          "imagePullSecrets": [],
+        },
+      },
+    },
+  },
+  {
+    "apiVersion": "policy/v1",
+    "kind": "PodDisruptionBudget",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/managed-by": "cdk8s-plone",
+        "app.kubernetes.io/part-of": "plone",
+      },
+      "name": "test-chart-plone-frontend-pdb-c8069ea0",
+    },
+    "spec": {
+      "minAvailable": 1,
+      "selector": {
+        "matchLabels": {
+          "app": "test-chart-plone-frontend-c8e96701",
+        },
+      },
+    },
+  },
+  {
+    "apiVersion": "v1",
+    "kind": "Service",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/component": "service",
+        "app.kubernetes.io/managed-by": "cdk8s-plone",
+        "app.kubernetes.io/name": "plone-frontend-service",
+        "app.kubernetes.io/part-of": "plone",
+      },
+      "name": "test-chart-plone-frontend-service-c874cc1a",
+    },
+    "spec": {
+      "ports": [
+        {
+          "name": "frontend-http",
+          "port": 3000,
+          "targetPort": 3000,
+        },
+      ],
+      "selector": {
+        "app": "test-chart-plone-frontend-c8e96701",
+      },
+    },
+  },
+  {
+    "apiVersion": "policy/v1",
+    "kind": "PodDisruptionBudget",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "kube-httpcache",
+        "app.kubernetes.io/version": "v0.9.1",
+        "helm.sh/chart": "kube-httpcache-0.9.1",
+      },
+      "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+    },
+    "spec": {
+      "maxUnavailable": 1,
+      "selector": {
+        "matchLabels": {
+          "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+          "app.kubernetes.io/name": "kube-httpcache",
+        },
+      },
+    },
+  },
+  {
+    "apiVersion": "v1",
+    "kind": "ServiceAccount",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "kube-httpcache",
+        "app.kubernetes.io/version": "v0.9.1",
+        "helm.sh/chart": "kube-httpcache-0.9.1",
+      },
+      "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+    },
+  },
+  {
+    "apiVersion": "v1",
+    "data": {
+      "secret": "T0JuOUVNTGhreHlUNEFPa2s1azZ6a2pEd2NlOWxyeHo=",
+    },
+    "kind": "Secret",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "kube-httpcache",
+        "app.kubernetes.io/version": "v0.9.1",
+        "helm.sh/chart": "kube-httpcache-0.9.1",
+      },
+      "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+    },
+    "type": "Opaque",
+  },
+  {
+    "apiVersion": "v1",
+    "data": {
+      "default.vcl.tmpl": "vcl 4.0;
+
+import std;
+import directors;
+
+probe ploneBackendProbe {
+    .url = "/ok";
+    .timeout = 5s;
+    .interval = 15s;
+    .window = 10;
+    .threshold = 8;
+    # .initial = 3;
+}
+backend ploneBackend {
+    .host = "{{ .Env.BACKEND_SERVICE_NAME }}";
+    .port = "{{ .Env.BACKEND_SERVICE_PORT }}";
+    .probe = ploneBackendProbe;
+    .connect_timeout = 0.5s;
+    .first_byte_timeout = 120s;
+    .between_bytes_timeout = 60s;
+}
+
+probe ploneFrontendProbe {
+    .url = "/ok";
+    .timeout = 5s;
+    .interval = 15s;
+    .window = 10;
+    .threshold = 8;
+    # .initial = 3;
+}
+backend ploneFrontend {
+    .host = "{{ .Env.FRONTEND_SERVICE_NAME }}";
+    .port = "{{ .Env.FRONTEND_SERVICE_PORT }}";
+    .probe = ploneFrontendProbe;
+    .connect_timeout = 0.5s;
+    .first_byte_timeout = 120s;
+    .between_bytes_timeout = 60s;
+}
+
+/* Only allow PURGE from kubernetes network */
+acl purge {
+  "10.0.0.0/8";
+}
+
+sub detect_debug{
+  # Requests with X-Varnish-Debug will display additional
+  # information about requests
+  unset req.http.x-vcl-debug;
+  # Should be changed after switch to live
+  #if (req.http.x-varnish-debug) {
+  #    set req.http.x-vcl-debug = false;
+  #}
+  set req.http.x-vcl-debug = true;
+}
+
+sub detect_auth{
+  unset req.http.x-auth;
+  if (
+      (req.http.Cookie && (
+        req.http.Cookie ~ "__ac(_(name|password|persistent))?=" || req.http.Cookie ~ "_ZopeId" || req.http.Cookie ~ "auth_token")) ||
+      (req.http.Authenticate) ||
+      (req.http.Authorization)
+  ) {
+    set req.http.x-auth = true;
+  }
+}
+
+sub detect_requesttype{
+  unset req.http.x-varnish-reqtype;
+  set req.http.x-varnish-reqtype = "Default";
+  if (req.http.x-auth){
+    set req.http.x-varnish-reqtype = "auth";
+  } elseif (req.url ~ "\\/@@(images|download|)\\/?(.*)?$"){
+    set req.http.x-varnish-reqtype = "blob";
+  } elseif (req.url ~ "\\/\\+\\+api\\+\\+/?(.*)?$") {
+    set req.http.x-varnish-reqtype = "api";
+  } else {
+    set req.http.x-varnish-reqtype = "express";
+  }
+}
+
+sub process_redirects{
+  if (req.http.x-redirect-to) {
+    return (synth(301, req.http.x-redirect-to));
+  }
+}
+
+sub vcl_init {
+  new lbPloneBackend = directors.round_robin();
+  lbPloneBackend.add_backend(ploneBackend);
+
+  new lbPloneFrontend = directors.round_robin();
+  lbPloneFrontend.add_backend(ploneFrontend);
+}
+
+sub vcl_recv {
+  # Annotate request with x-vcl-debug
+  call detect_debug;
+
+  # Annotate request with x-auth indicating if request is authenticated or not
+  call detect_auth;
+
+  # Annotate request with x-varnish-reqtype with a classification for the request
+  call detect_requesttype;
+
+  # Process redirects
+  call process_redirects;
+
+  # Routing: set the current Varnish backend to the matching Plone backend
+  # Attention:
+  # Confusing wording, we have two possible Varnish backends: the Plone frontend and the Plone backend *sigh*
+  if ((req.url ~ "^/\\+\\+api\\+\\+") || (req.http.x-varnish-reqtype ~ "blob")) {
+    set req.http.x-vcl-plone = "Backend";
+    set req.backend_hint = lbPloneBackend.backend();
+    # here we need a rewrite to add the virtualhost part of the URL for the Plone Backend
+    set req.http.x-vcl-proto = "http";
+    if (req.http.X-Forwarded-Proto) {
+      set req.http.x-vcl-proto = req.http.X-Forwarded-Proto;
+    }
+    set req.url = "/VirtualHostBase/" + req.http.x-vcl-proto + "/" + req.http.host + "/Plone/VirtualHostRoot" + req.url;
+  } else {
+    set req.http.x-vcl-plone = "Frontend";
+    set req.backend_hint = lbPloneFrontend.backend();
+  }
+
+  # short cut authenticated requests to pass
+  if (req.http.x-auth) {
+    return(pass);
+  }
+
+  # Sanitize cookies so they do not needlessly destroy cacheability for anonymous pages
+  if (req.http.Cookie) {
+    set req.http.Cookie = ";" + req.http.Cookie;
+    set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
+    set req.http.Cookie = regsuball(req.http.Cookie, ";(sticky|I18N_LANGUAGE|statusmessages|__ac|_ZopeId|__cp|beaker\\.session|authomatic|serverid|__rf|auth_token)=", "; \\1=");
+    set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
+    set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
+
+    if (req.http.Cookie == "") {
+        unset req.http.Cookie;
+    }
+  }
+
+  # Handle the different request types
+  if (req.method == "PURGE") {
+      if (!client.ip ~ purge) {
+          return (synth(405, "Not allowed."));
+      } else {
+          ban("req.url == " + req.url);
+          return (synth(200, "Purged."));
+      }
+
+  } elseif (req.method == "BAN") {
+      # Same ACL check as above:
+      if (!client.ip ~ purge) {
+          return (synth(405, "Not allowed."));
+      }
+      ban("req.http.host == " + req.http.host + "&& req.url == " + req.url);
+      # Throw a synthetic page so the
+      # request won't go to the backend.
+      return (synth(200, "Ban added"));
+
+  } elseif (req.method != "GET" &&
+      req.method != "HEAD" &&
+      req.method != "PUT" &&
+      req.method != "POST" &&
+      req.method != "PATCH" &&
+      req.method != "TRACE" &&
+      req.method != "OPTIONS" &&
+      req.method != "DELETE") {
+      /* Non-RFC2616 or CONNECT which is weird. */
+      return (pipe);
+  } elseif (req.method != "GET" &&
+      req.method != "HEAD" &&
+      req.method != "OPTIONS") {
+      /* POST, PUT, PATCH will pass, always */
+      return(pass);
+  }
+
+  return(hash);
+}
+
+sub vcl_pipe {
+  /* This is not necessary if you do not do any request rewriting. */
+  set req.http.connection = "close";
+}
+
+sub vcl_purge {
+  return (synth(200, "PURGE: " + req.url + " - " + req.hash));
+}
+
+sub vcl_synth {
+  if (resp.status == 301) {
+    set resp.http.location = resp.reason;
+    set resp.reason = "Moved";
+    return (deliver);
+  }
+}
+
+sub vcl_hit {
+  if (obj.ttl >= 0s) {
+    // A pure unadulterated hit, deliver it
+    return (deliver);
+  } elsif (obj.ttl + obj.grace > 0s) {
+    // Object is in grace, deliver it
+    // Automatically triggers a background fetch
+    return (deliver);
+  } else {
+    return (restart);
+  }
+}
+
+
+sub vcl_backend_response {
+  # Annotate request with info about the backend used
+  set beresp.http.x-varnish-plone-part = bereq.http.x-vcl-plone;
+  # set beresp.http.x-varnish-plone-proto = bereq.http.x-vcl-proto;
+  # set beresp.http.x-varnish-plone-host = bereq.http.x-vcl-host;
+  # Don't allow static files to set cookies.
+  # (?i) denotes case insensitive in PCRE (perl compatible regular expressions).
+  # make sure you edit both and keep them equal.
+  if (bereq.url ~ "(?i)\\.(pdf|asc|dat|txt|doc|xls|ppt|tgz|png|gif|jpeg|jpg|ico|swf|css|js)(\\?.*)?$") {
+    unset beresp.http.set-cookie;
+  }
+  if (beresp.http.Set-Cookie) {
+    set beresp.http.x-varnish-action = "FETCH (pass - response sets cookie)";
+    set beresp.uncacheable = true;
+    set beresp.ttl = 120s;
+    return(deliver);
+  }
+  if (beresp.http.Cache-Control ~ "(private|no-cache|no-store)") {
+    set beresp.http.x-varnish-action = "FETCH (pass - cache control disallows)";
+    set beresp.uncacheable = true;
+    set beresp.ttl = 120s;
+    return(deliver);
+  }
+
+  # if (beresp.http.Authorization && !beresp.http.Cache-Control ~ "public") {
+  # Do NOT cache if there is an "Authorization" header
+  # beresp never has an Authorization header in beresp, right?
+  if (beresp.http.Authorization) {
+    set beresp.http.x-varnish-action = "FETCH (pass - authorized and no public cache control)";
+    set beresp.uncacheable = true;
+    set beresp.ttl = 120s;
+    return(deliver);
+  }
+
+  # Use this rule IF no cache-control (SSR content)
+  if ((bereq.http.x-varnish-reqtype ~ "express") && (!beresp.http.Cache-Control)) {
+    set beresp.http.x-varnish-action = "INSERT (30s caching / 60s grace)";
+    set beresp.uncacheable = false;
+    set beresp.ttl = 30s;
+    set beresp.grace = 60s;
+    return(deliver);
+  }
+
+  if (!beresp.http.Cache-Control) {
+    set beresp.http.x-varnish-action = "FETCH (override - backend not setting cache control)";
+    set beresp.uncacheable = true;
+    set beresp.ttl = 120s;
+    return (deliver);
+  }
+
+  if (beresp.http.X-Anonymous && !beresp.http.Cache-Control) {
+    set beresp.http.x-varnish-action = "FETCH (override - anonymous backend not setting cache control)";
+    set beresp.ttl = 600s;
+    return (deliver);
+  }
+
+  set beresp.http.x-varnish-action = "FETCH (insert)";
+  return (deliver);
+}
+
+sub vcl_deliver {
+
+  if (req.http.x-vcl-debug) {
+    set resp.http.x-varnish-ttl = obj.ttl;
+    set resp.http.x-varnish-grace = obj.grace;
+    set resp.http.x-hits = obj.hits;
+    set resp.http.x-varnish-reqtype = req.http.x-varnish-reqtype;
+    if (req.http.x-auth) {
+      set resp.http.x-auth = "Logged-in";
+    } else {
+      set resp.http.x-auth = "Anon";
+    }
+    if (obj.hits > 0) {
+      set resp.http.x-cache = "HIT";
+    } else {
+      set resp.http.x-cache = "MISS";
+    }
+  } else {
+    unset resp.http.x-varnish-action;
+    unset resp.http.x-cache-operation;
+    unset resp.http.x-cache-rule;
+    unset resp.http.x-powered-by;
+  }
+}
+",
+    },
+    "kind": "ConfigMap",
+    "metadata": {
+      "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+    },
+  },
+  {
+    "apiVersion": "v1",
+    "kind": "Service",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "kube-httpcache",
+        "app.kubernetes.io/version": "v0.9.1",
+        "helm.sh/chart": "kube-httpcache-0.9.1",
+      },
+      "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+    },
+    "spec": {
+      "ports": [
+        {
+          "name": "http",
+          "port": 80,
+          "protocol": "TCP",
+          "targetPort": 8080,
+        },
+        {
+          "name": "signaller",
+          "port": 8090,
+          "targetPort": 8090,
+        },
+        {
+          "name": "metrics",
+          "port": 9131,
+          "targetPort": 9131,
+        },
+      ],
+      "selector": {
+        "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+        "app.kubernetes.io/name": "kube-httpcache",
+      },
+      "type": "ClusterIP",
+    },
+  },
+  {
+    "apiVersion": "apps/v1",
+    "kind": "StatefulSet",
+    "metadata": {
+      "labels": {
+        "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+        "app.kubernetes.io/managed-by": "Helm",
+        "app.kubernetes.io/name": "kube-httpcache",
+        "app.kubernetes.io/version": "v0.9.1",
+        "helm.sh/chart": "kube-httpcache-0.9.1",
+      },
+      "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+    },
+    "spec": {
+      "replicas": 2,
+      "selector": {
+        "matchLabels": {
+          "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+          "app.kubernetes.io/name": "kube-httpcache",
+        },
+      },
+      "serviceName": "test-chart-httpcache-c89dd29d-kube-httpcache",
+      "template": {
+        "metadata": {
+          "labels": {
+            "app.kubernetes.io/instance": "test-chart-httpcache-c89dd29d",
+            "app.kubernetes.io/name": "kube-httpcache",
+          },
+        },
+        "spec": {
+          "containers": [
+            {
+              "args": [
+                "-admin-addr=0.0.0.0",
+                "-admin-port=6083",
+                "-signaller-enable",
+                "-signaller-port=8090",
+                "-frontend-port=8080",
+                "-frontend-watch=false",
+                "-frontend-namespace=$(NAMESPACE)",
+                "-frontend-service=test-chart-httpcache-c89dd29d-kube-httpcache",
+                "-backend-watch=false",
+                "-backend-namespace=$(NAMESPACE)",
+                "-backend-service=backend-service",
+                "-varnish-secret-file=/etc/varnish/k8s-secret/secret",
+                "-varnish-vcl-template=/etc/varnish/tmpl/default.vcl.tmpl",
+                "-varnish-storage=malloc,128M",
+                "-varnish-vcl-template-poll",
+              ],
+              "env": [
+                {
+                  "name": "NAMESPACE",
+                  "valueFrom": {
+                    "fieldRef": {
+                      "fieldPath": "metadata.namespace",
+                    },
+                  },
+                },
+                {
+                  "name": "BACKEND_SERVICE_NAME",
+                  "value": "test-chart-plone-backend-service-c81ad65d",
+                },
+                {
+                  "name": "BACKEND_SERVICE_PORT",
+                  "value": "8080",
+                },
+                {
+                  "name": "BACKEND_SITE_ID",
+                  "value": "Plone",
+                },
+                {
+                  "name": "FRONTEND_SERVICE_NAME",
+                  "value": "test-chart-plone-frontend-service-c874cc1a",
+                },
+                {
+                  "name": "FRONTEND_SERVICE_PORT",
+                  "value": "3000",
+                },
+              ],
+              "image": "quay.io/mittwald/kube-httpcache:stable",
+              "imagePullPolicy": "IfNotPresent",
+              "name": "kube-httpcache",
+              "resources": {
+                "limits": {
+                  "cpu": "500m",
+                  "memory": "500Mi",
+                },
+                "requests": {
+                  "cpu": "100m",
+                  "memory": "100Mi",
+                },
+              },
+              "securityContext": {},
+              "volumeMounts": [
+                {
+                  "mountPath": "/etc/varnish/tmpl",
+                  "name": "template",
+                },
+                {
+                  "mountPath": "/etc/varnish/k8s-secret",
+                  "name": "secret",
+                },
+                {
+                  "mountPath": "/var/lib/varnish",
+                  "name": "var",
+                },
+              ],
+            },
+            {
+              "args": [
+                "-no-exit",
+              ],
+              "command": [
+                "/exporter/prometheus_varnish_exporter",
+              ],
+              "env": [
+                {
+                  "name": "VSM_NOPID",
+                  "value": "1",
+                },
+              ],
+              "image": "quay.io/mittwald/kube-httpcache:stable",
+              "imagePullPolicy": "IfNotPresent",
+              "name": "exporter",
+              "ports": [
+                {
+                  "containerPort": 9131,
+                  "name": "metrics",
+                },
+              ],
+              "resources": {
+                "limits": {
+                  "cpu": "100m",
+                  "memory": "100Mi",
+                },
+                "requests": {
+                  "cpu": "10m",
+                  "memory": "50Mi",
+                },
+              },
+              "securityContext": {},
+              "volumeMounts": [
+                {
+                  "mountPath": "/var/lib/varnish",
+                  "name": "var",
+                },
+              ],
+            },
+          ],
+          "nodeSelector": {
+            "kubernetes.io/arch": "amd64",
+          },
+          "securityContext": {},
+          "serviceAccountName": "test-chart-httpcache-c89dd29d-kube-httpcache",
+          "volumes": [
+            {
+              "configMap": {
+                "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+              },
+              "name": "template",
+            },
+            {
+              "name": "secret",
+              "secret": {
+                "secretName": "test-chart-httpcache-c89dd29d-kube-httpcache",
+              },
+            },
+            {
+              "emptyDir": {},
+              "name": "var",
+            },
+          ],
+        },
+      },
+    },
+  },
+  {
+    "apiVersion": "networking.k8s.io/v1",
+    "kind": "Ingress",
+    "metadata": {
+      "annotations": {
+        "cert-manager.io/cluster-issuer": "letsencrypt-prod",
+        "kubernetes.io/ingress.class": "traefik",
+      },
+      "name": "test-chart-ingress-main-cached-c8b108e1",
+    },
+    "spec": {
+      "ingressClassName": "traefik",
+      "rules": [
+        {
+          "host": "mxplone-cached.example.com",
+          "http": {
+            "paths": [
+              {
+                "backend": {
+                  "service": {
+                    "name": "test-chart-httpcache-c89dd29d-kube-httpcache",
+                    "port": {
+                      "number": 80,
+                    },
+                  },
+                },
+                "path": "/",
+                "pathType": "Prefix",
+              },
+            ],
+          },
+        },
+      ],
+    },
+  },
+  {
+    "apiVersion": "networking.k8s.io/v1",
+    "kind": "Ingress",
+    "metadata": {
+      "annotations": {
+        "cert-manager.io/cluster-issuer": "letsencrypt-prod",
+        "kubernetes.io/ingress.class": "traefik",
+      },
+      "name": "test-chart-ingress-main-uncached-c85166a3",
+    },
+    "spec": {
+      "ingressClassName": "traefik",
+      "rules": [
+        {
+          "host": "mxplone-cached.example.com",
+          "http": {
+            "paths": [
+              {
+                "backend": {
+                  "service": {
+                    "name": "test-chart-plone-frontend-service-c874cc1a",
+                    "port": {
+                      "number": 3000,
+                    },
+                  },
+                },
+                "path": "/",
+                "pathType": "Prefix",
+              },
+            ],
+          },
+        },
+      ],
+    },
+  },
+  {
+    "apiVersion": "traefik.io/v1alpha1",
+    "kind": "Middleware",
+    "metadata": {
+      "name": "test-chart-ingress-main-maintenance-addprefix-c8dc1efe",
+    },
+    "spec": {
+      "addPrefix": {
+        "prefix": "/VirtualHostBase/https/mxplone-maintenance.example.com/VirtualHostRoot/",
+      },
+    },
+  },
+  {
+    "apiVersion": "networking.k8s.io/v1",
+    "kind": "Ingress",
+    "metadata": {
+      "annotations": {
+        "cert-manager.io/cluster-issuer": "letsencrypt-prod",
+        "kubernetes.io/ingress.class": "traefik",
+        "traefik.ingress.kubernetes.io/router.middlewares": "plone-test-chart-ingress-main-maintenance-addprefix-c8dc1efe@kubernetescrd",
+      },
+      "name": "test-chart-ingress-main-maintenance-c874242e",
+    },
+    "spec": {
+      "ingressClassName": "traefik",
+      "rules": [
+        {
+          "host": "mxplone-maintenance.example.com",
+          "http": {
+            "paths": [
+              {
+                "backend": {
+                  "service": {
+                    "name": "test-chart-plone-backend-service-c81ad65d",
+                    "port": {
+                      "number": 8080,
+                    },
+                  },
+                },
+                "path": "/",
+                "pathType": "Prefix",
+              },
+            ],
+          },
+        },
+      ],
+    },
+  },
+]
+`;