feat: pure helm prerequisites sandbox ingress nginx

.gitignore

@@ -0,0 +1,2 @@
+*.lock
+*.tgz

modules/prerequisites/Chart.yaml

@@ -18,3 +18,18 @@ apiVersion: v2
 name: prerequisites
 description: A Helm chart for installing OKDP prerequisites
 version: 0.1.0
+dependencies:
+  - name: reloader
+    version: "1.0.72"
+    repository: "https://stakater.github.io/stakater-charts"
+  - name: kubernetes-replicator
+    version: "2.9.2"
+    repository: "https://helm.mittwald.de"
+    alias: replicator
+  - name: kubernetes-secret-generator
+    version: "3.4.0"
+    repository: "https://helm.mittwald.de"
+    alias: secret-generator
+  - name: ingress-nginx
+    version: "4.12.1"
+    repository: "https://kubernetes.github.io/ingress-nginx"

modules/prerequisites/README.md

@@ -11,6 +11,7 @@ A Helm chart for installing OKDP prerequisites.
 To install the chart with the release name `prerequisites`:
 
 ```sh
+$ helm dependency update modules/prerequisites/
 $ helm install prerequisites modules/prerequisites
 ```
 

modules/prerequisites/values.schema.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "reloader": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean", "default": true }
+      }
+    },
+    "replicator": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean", "default": true }
+      }
+    },
+    "secret-generator": {
+      "type": "object",
+      "properties": {
+        "enabled": { "type": "boolean", "default": true }
+      }
+    }
+  }
+}

modules/prerequisites/values/sandbox.yaml

@@ -0,0 +1,73 @@
+#
+# Copyright 2026 The OKDP Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+reloader:
+  enabled: true
+  reloader:
+    deployment:
+      securityContext:
+        seccompProfile: { type: RuntimeDefault }
+      containerSecurityContext:
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        capabilities:
+          drop: ["ALL"]
+
+replicator:
+  enabled: true
+  podSecurityContext:
+    seccompProfile: { type: RuntimeDefault }
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+    capabilities:
+      drop: ["ALL"]
+  livenessProbe: { initialDelaySeconds: 10 }
+  readinessProbe: { initialDelaySeconds: 10 }
+
+secret-generator:
+  enabled: true
+  fullnameOverride: secret-generator
+  podSecurityContext:
+    fsGroup: 2000
+    seccompProfile: { type: RuntimeDefault }
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+    capabilities:
+      drop: ["ALL"]
+
+ingress-nginx:
+  enabled: true
+  controller:
+    allowSnippetAnnotations: "false"
+    extraArgs:
+      enable-ssl-passthrough: "true"
+    admissionWebhooks:
+      enabled: true
+    service:
+      # To change type you just need to update here
+      # type: LoadBlancer
+      type: NodePort
+      nodePorts:
+        http: 30080
+        https: 30443
+      # annotations:
+      #   metallb.universe.tf/loadBalancerIPs: "192.168.1.50"
+