helmrelease.yaml

# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/app-template-3.6.1/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: stable-diffusion-webui
  namespace: stable-diffusion
spec:
  chart:
    spec:
      chart: app-template
      version: 3.6.1
      reconcileStrategy: ChartVersion
      sourceRef:
        kind: HelmRepository
        namespace: flux-system
        name: bjw-s
  interval: 1h
  driftDetection:
    mode: enabled
  timeout: 15m
  values:
    controllers:
      stable-diffusion-webui:
        containers:
          app:
            image:
              repository: ghcr.io/gabe565/stable-diffusion/webui
              tag: 1.10.0@sha256:ebe155397acbacb3bc303af291255d7f4adca3567e3e231011709b8adf44baca
              pullPolicy: IfNotPresent
            args:
              - --medvram-sdxl
              - --xformers
            env:
              TZ: America/Chicago
              IIB_ACCESS_CONTROL_ALLOWED_PATHS: /app/outputs
            resources:
              limits:
                nvidia.com/gpu: "1"
                memory: "14Gi"
            probes:
              startup:
                enabled: true
                spec:
                  failureThreshold: 90
                  periodSeconds: 5
              liveness:
                enabled: true
              readiness:
                enabled: true
        pod:
          runtimeClassName: nvidia
          tolerations:
            - key: gabe565.com/gpu
              operator: Equal
              value: nvidia
              effect: NoSchedule
          nodeSelector:
            gabe565.com/gpu: nvidia
          labels:
            policy.gabe565.com/egress-world: "true"
            policy.gabe565.com/ingress-ingress: "true"
          terminationGracePeriodSeconds: 1
          securityContext:
            fsGroup: 1000

    service:
      stable-diffusion-webui:
        controller: stable-diffusion-webui
        ports:
          http:
            port: 7860

    persistence:
      data:
        enabled: true
        storageClass: local-path
        accessMode: ReadWriteOnce
        size: 32Gi
        retain: true
        globalMounts:
          - path: /data
          - path: /app/repositories
            subPath: repositories
      outputs:
        enabled: true
        storageClass: nfs-client
        accessMode: ReadWriteMany
        size: 8Gi
        retain: true
        globalMounts:
          - path: /app/outputs

    ingress:
      stable-diffusion-webui:
        enabled: true
        hosts:
          - host: ${app_url}
            paths:
              - path: /
                service:
                  identifier: stable-diffusion-webui
                  port: http
        tls:
          - secretName: ${certificate_name}
            hosts:
              - ${app_url}
        annotations:
          nginx.ingress.kubernetes.io/auth-url: |-
            http://ak-outpost-gabernetes.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
          nginx.ingress.kubernetes.io/auth-signin: |-
            https://$host/outpost.goauthentik.io/start?rd=$scheme://$http_host$escaped_request_uri
          nginx.ingress.kubernetes.io/auth-response-headers: |-
            Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
          nginx.ingress.kubernetes.io/auth-snippet: |
            proxy_set_header X-Forwarded-Host $http_host;