apiVersion: apps/v1 kind: Deployment metadata: annotations: meta.helm.sh/release-name: semaphore meta.helm.sh/release-namespace: infrastructure labels: app.kubernetes.io/instance: semaphore app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: semaphore app.kubernetes.io/version: 2.17.34 helm.sh/chart: semaphore-16.1.2 name: semaphore namespace: infrastructure spec: progressDeadlineSeconds: 600 replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app.kubernetes.io/instance: semaphore app.kubernetes.io/name: semaphore strategy: type: Recreate template: metadata: annotations: checksum/config: 6db2d80fdda45e7be278174345179b6ece77d6ca957902f08bb3ba861921e4a8 checksum/secret-admin: 3c0ad6cefcee43617216b7c1703bdd864766da7cee9e43f18724fe4a70c89545 checksum/secret-general: 91136cb91b1e8cc2540294d8ecd541338bffdb2127897e8bea112160e6a3705d checksum/secret-runner: 8e3582b533083a64b4205c22d9b2d476f93d90b27276d88e74fe4c885f7db60a kubectl.kubernetes.io/restartedAt: '2026-10-28T18:13:14.547755+00:00' labels: app.kubernetes.io/instance: semaphore app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: semaphore app.kubernetes.io/version: 2.17.34 helm.sh/chart: semaphore-16.1.2 spec: containers: - env: - name: SEMAPHORE_PORT value: '3000' - name: SEMAPHORE_GIT_CLIENT value: cmd_git - name: SEMAPHORE_TMP_PATH value: /tmp/semaphore - name: SEMAPHORE_MAX_PARALLEL_TASKS value: '0' - name: SEMAPHORE_PASSWORD_LOGIN_DISABLED value: 'false' - name: SEMAPHORE_NON_ADMIN_CAN_CREATE_PROJECT value: 'false' - name: SEMAPHORE_USE_REMOTE_RUNNER value: 'false' - name: SEMAPHORE_DB_DIALECT value: bolt - name: SEMAPHORE_DB_HOST value: /var/lib/semaphore/database.boltdb - name: SEMAPHORE_LDAP_ENABLE value: 'false' - name: SEMAPHORE_EMAIL_ALERT value: 'false' - name: SEMAPHORE_TELEGRAM_ALERT value: 'false' - name: SEMAPHORE_SLACK_ALERT value: 'false' - name: SEMAPHORE_RUNNER_REGISTRATION_TOKEN valueFrom: secretKeyRef: key: token name: semaphore-runner - name: SEMAPHORE_COOKIE_HASH valueFrom: secretKeyRef: key: cookieHash name: semaphore-general - name: SEMAPHORE_COOKIE_ENCRYPTION valueFrom: secretKeyRef: key: cookieEncryption name: semaphore-general - name: SEMAPHORE_ACCESS_KEY_ENCRYPTION valueFrom: secretKeyRef: key: accesskeyEncryption name: semaphore-general - name: SEMAPHORE_OIDC_PROVIDERS value: '{"authentik": {"display_name": "Sign in with Authentik", "provider_url": "https://authentik.snarfnet.net/application/o/semaphore/", "client_id": "semaphore-2e50dbdf", "client_secret": "V4uazPXN9toUn5Jf2DfsRIFrygf1T0Vcltga-APrzTRjWFN0DIIqNw", "redirect_url": "https://semaphore.snarfnet.net/api/auth/oidc/authentik/redirect", "username_claim": "preferred_username", "name_claim": "name", "email_claim": "email", "scopes": ["openid", "profile", "email", "groups"]}}' - name: SEMAPHORE_WEB_HOST value: https://semaphore.snarfnet.net image: semaphoreui/semaphore:v2.17.34 imagePullPolicy: IfNotPresent livenessProbe: failureThreshold: 3 httpGet: path: / port: http scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 name: semaphore ports: - containerPort: 3000 name: http protocol: TCP readinessProbe: failureThreshold: 3 httpGet: path: / port: http scheme: HTTP periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 resources: requests: cpu: 100m memory: 64Mi terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /etc/semaphore/config.json name: config subPath: config.json - mountPath: /tmp/semaphore name: workdir - mountPath: /var/lib/semaphore name: boltdb dnsPolicy: ClusterFirst initContainers: - command: - sh - -c - "if ! semaphore user get --config=/etc/semaphore/config.json --login $(SEMAPHORE_ADMIN_USERNAME)\ \ >/dev/null; then\n semaphore user add \\\n --config=/etc/semaphore/config.json\ \ \\\n --admin \\\n --name=$(SEMAPHORE_ADMIN_FULLNAME) \\\n --login=$(SEMAPHORE_ADMIN_USERNAME)\ \ \\\n --password=$(SEMAPHORE_ADMIN_PASSWORD) \\\n --email=$(SEMAPHORE_ADMIN_EMAIL)\n\ else\n echo \"Admin already extists\"\nfi\n" env: - name: SEMAPHORE_ADMIN_FULLNAME valueFrom: secretKeyRef: key: fullname name: semaphore-admin - name: SEMAPHORE_ADMIN_USERNAME valueFrom: secretKeyRef: key: username name: semaphore-admin - name: SEMAPHORE_ADMIN_PASSWORD valueFrom: secretKeyRef: key: password name: semaphore-admin - name: SEMAPHORE_ADMIN_EMAIL valueFrom: secretKeyRef: key: email name: semaphore-admin - name: SEMAPHORE_PORT value: '3000' - name: SEMAPHORE_GIT_CLIENT value: cmd_git - name: SEMAPHORE_TMP_PATH value: /tmp/semaphore - name: SEMAPHORE_SSH_PATH - name: SEMAPHORE_MAX_PARALLEL_TASKS value: '0' - name: SEMAPHORE_PASSWORD_LOGIN_DISABLED value: 'false' - name: SEMAPHORE_NON_ADMIN_CAN_CREATE_PROJECT value: 'false' - name: SEMAPHORE_USE_REMOTE_RUNNER value: 'false' - name: SEMAPHORE_DB_DIALECT value: bolt - name: SEMAPHORE_DB_HOST value: /var/lib/semaphore/database.boltdb - name: SEMAPHORE_LDAP_ENABLE value: 'false' - name: SEMAPHORE_EMAIL_ALERT value: 'false' - name: SEMAPHORE_TELEGRAM_ALERT value: 'false' - name: SEMAPHORE_SLACK_ALERT value: 'false' - name: SEMAPHORE_RUNNER_REGISTRATION_TOKEN valueFrom: secretKeyRef: key: token name: semaphore-runner - name: SEMAPHORE_COOKIE_HASH valueFrom: secretKeyRef: key: cookieHash name: semaphore-general - name: SEMAPHORE_COOKIE_ENCRYPTION valueFrom: secretKeyRef: key: cookieEncryption name: semaphore-general - name: SEMAPHORE_ACCESS_KEY_ENCRYPTION valueFrom: secretKeyRef: key: accesskeyEncryption name: semaphore-general image: semaphoreui/semaphore:v2.17.34 imagePullPolicy: IfNotPresent name: admin resources: requests: cpu: 100m memory: 64Mi terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /etc/semaphore/config.json name: config subPath: config.json - mountPath: /tmp/semaphore name: workdir - mountPath: /var/lib/semaphore name: boltdb restartPolicy: Always schedulerName: default-scheduler securityContext: fsGroup: 1001 serviceAccount: semaphore serviceAccountName: semaphore terminationGracePeriodSeconds: 30 volumes: - configMap: defaultMode: 420 name: semaphore-config name: config - name: workdir persistentVolumeClaim: claimName: semaphore-workdir - name: boltdb persistentVolumeClaim: claimName: semaphore-boltdb --- apiVersion: v1 kind: Service metadata: annotations: meta.helm.sh/release-name: semaphore meta.helm.sh/release-namespace: infrastructure labels: app.kubernetes.io/instance: semaphore app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: semaphore app.kubernetes.io/version: 2.17.34 helm.sh/chart: semaphore-16.1.2 name: semaphore namespace: infrastructure spec: clusterIP: 10.43.119.206 clusterIPs: - 10.43.119.206 internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: http port: 3000 protocol: TCP targetPort: http selector: app.kubernetes.io/instance: semaphore app.kubernetes.io/name: semaphore sessionAffinity: None type: ClusterIP --- apiVersion: v1 data: config.json: '{ } ' kind: ConfigMap metadata: annotations: meta.helm.sh/release-name: semaphore meta.helm.sh/release-namespace: infrastructure labels: app.kubernetes.io/instance: semaphore app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: semaphore app.kubernetes.io/version: 2.17.34 helm.sh/chart: semaphore-16.1.2 name: semaphore-config namespace: infrastructure