Tiered LDAP groups

templates/membership-config.yml.j2

@@ -15,6 +15,7 @@ metadata:
   namespace: {{ www_namespace }}
 data:
   tiers.json: {{ www_membership_tiers | to_json | to_json }}
+  service-groups.json: {{ www_membership_service_groups | to_json | to_json }}
 ---
 # Only Apache may assert the trusted proxy headers to the membership service.
 # Requires a CNI which actually enforces NetworkPolicy.

templates/membership-httpd.conf.j2

@@ -14,6 +14,10 @@ ProxyPassReverse "/members/" "http://membership:8000/members/"
         Require all denied
     </If>
 </Location>
+<Location "/members/profile/">
+    # Bounded JPEG upload plus multipart overhead; other routes remain 256 KiB.
+    LimitRequestBody 2097152
+</Location>
 {% else %}
 # Membership proxy disabled. Existing stateful workloads are not deleted.
 <Location "/members/">

templates/website.yml.j2

@@ -152,7 +152,8 @@ metadata:
     # Redact email verification tokens and OIDC codes at the edge, not only in
     # Apache/Gunicorn. Do not enable request-body/error tracing for /members/.
     nginx.ingress.kubernetes.io/enable-access-log: "false"
-    nginx.ingress.kubernetes.io/proxy-body-size: "256k"
+    # Apache retains 256 KiB for non-profile member routes.
+    nginx.ingress.kubernetes.io/proxy-body-size: "2m"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
 spec:
   ingressClassName: {{ www_ingress_class }}