---
dashboard_enabled: false

helm_enabled: true

registry_enabled: false

metrics_server_enabled: false

# Rancher Local Path Provisioner
local_path_provisioner_enabled: true
# local_path_provisioner_namespace: "local-path-storage"
local_path_provisioner_storage_class: local-path
local_path_provisioner_reclaim_policy: Delete
# local_path_provisioner_claim_root: /opt/local-path-provisioner/
# local_path_provisioner_debug: false
# local_path_provisioner_image_repo: "rancher/local-path-provisioner"
# local_path_provisioner_image_tag: "v0.0.23"
# local_path_provisioner_helper_image_repo: "busybox"
# local_path_provisioner_helper_image_tag: "latest"

# Local volume provisioner deployment
local_volume_provisioner_enabled: false
# local_volume_provisioner_namespace: kube-system
# local_volume_provisioner_nodelabels:
#   - kubernetes.io/hostname
#   - topology.kubernetes.io/region
#   - topology.kubernetes.io/zone
# local_volume_provisioner_storage_classes:
#   local-storage:
#     host_dir: /mnt/disks
#     mount_dir: /mnt/disks
#     volume_mode: Filesystem
#     fs_type: ext4
#   fast-disks:
#     host_dir: /mnt/fast-disks
#     mount_dir: /mnt/fast-disks
#     block_cleaner_command:
#       - "/scripts/shred.sh"
#       - "2"
#     volume_mode: Filesystem
#     fs_type: ext4
# local_volume_provisioner_tolerations:
#   - effect: NoSchedule
#     operator: Exists

# CSI Volume Snapshot Controller deployment, set this to true if your CSI is able to manage snapshots
# currently, setting cinder_csi_enabled=true would automatically enable the snapshot controller
# Longhorn is an extenal CSI that would also require setting this to true but it is not included in kubespray
# csi_snapshot_controller_enabled: false
# csi snapshot namespace
# snapshot_controller_namespace: kube-system

# CephFS provisioner deployment
cephfs_provisioner_enabled: false
# cephfs_provisioner_namespace: "cephfs-provisioner"
# cephfs_provisioner_cluster: ceph
# cephfs_provisioner_monitors: "172.24.0.1:6789,172.24.0.2:6789,172.24.0.3:6789"
# cephfs_provisioner_admin_id: admin
# cephfs_provisioner_secret: secret
# cephfs_provisioner_storage_class: cephfs
# cephfs_provisioner_reclaim_policy: Delete
# cephfs_provisioner_claim_root: /volumes
# cephfs_provisioner_deterministic_names: true

# RBD provisioner deployment
rbd_provisioner_enabled: false
# rbd_provisioner_namespace: rbd-provisioner
# rbd_provisioner_replicas: 2
# rbd_provisioner_monitors: "172.24.0.1:6789,172.24.0.2:6789,172.24.0.3:6789"
# rbd_provisioner_pool: kube
# rbd_provisioner_admin_id: admin
# rbd_provisioner_secret_name: ceph-secret-admin
# rbd_provisioner_secret: ceph-key-admin
# rbd_provisioner_user_id: kube
# rbd_provisioner_user_secret_name: ceph-secret-user
# rbd_provisioner_user_secret: ceph-key-user
# rbd_provisioner_user_secret_namespace: rbd-provisioner
# rbd_provisioner_fs_type: ext4
# rbd_provisioner_image_format: "2"
# rbd_provisioner_image_features: layering
# rbd_provisioner_storage_class: rbd
# rbd_provisioner_reclaim_policy: Delete

# Nginx ingress controller deployment
ingress_nginx_enabled: false
ingress_nginx_host_network: false
ingress_publish_status_address: ""
# ingress_nginx_nodeselector:
#   kubernetes.io/os: "linux"
# ingress_nginx_tolerations:
#   - key: "node-role.kubernetes.io/master"
#     operator: "Equal"
#     value: ""
#     effect: "NoSchedule"
#   - key: "node-role.kubernetes.io/control-plane"
#     operator: "Equal"
#     value: ""
#     effect: "NoSchedule"
# ingress_nginx_namespace: "ingress-nginx"
ingress_nginx_insecure_port: 80
ingress_nginx_secure_port: 443
# ingress_nginx_configmap:
#   map-hash-bucket-size: "128"
#   ssl-protocols: "TLSv1.2 TLSv1.3"
# ingress_nginx_configmap_tcp_services:
#   9000: "default/example-go:8080"
# ingress_nginx_configmap_udp_services:
#   53: "kube-system/coredns:53"
# ingress_nginx_extra_args:
#   - --default-ssl-certificate=default/foo-tls
# ingress_nginx_termination_grace_period_seconds: 300
ingress_nginx_class: "nginx"

# ALB ingress controller deployment
ingress_alb_enabled: false
# alb_ingress_aws_region: "us-east-1"
# alb_ingress_restrict_scheme: "false"
# Enables logging on all outbound requests sent to the AWS API.
# If logging is desired, set to true.
# alb_ingress_aws_debug: "false"

# Cert manager deployment
cert_manager_enabled: false
# cert_manager_namespace: "cert-manager"
# cert_manager_tolerations:
#   - key: node-role.kubernetes.io/master
#     effect: NoSchedule
#   - key: node-role.kubernetes.io/control-plane
#     effect: NoSchedule
# cert_manager_affinity:
#  nodeAffinity:
#    preferredDuringSchedulingIgnoredDuringExecution:
#    - weight: 100
#      preference:
#        matchExpressions:
#        - key: node-role.kubernetes.io/control-plane
#          operator: In
#          values:
#          - ""
# cert_manager_nodeselector:
#   kubernetes.io/os: "linux"

# cert_manager_trusted_internal_ca: |
#   -----BEGIN CERTIFICATE-----
#   [REPLACE with your CA certificate]
#   -----END CERTIFICATE-----
# cert_manager_leader_election_namespace: kube-system

# cert_manager_dns_policy: "ClusterFirst"
cert_manager_dns_config:
  nameservers:
    - "8.8.8.8"
    - "8.8.4.4"

# MetalLB deployment
metallb_enabled: false
metallb_speaker_enabled: "{{ metallb_enabled }}"
# metallb_speaker_nodeselector:
#   kubernetes.io/os: "linux"
# metallb_controller_nodeselector:
#   kubernetes.io/os: "linux"
# metallb_speaker_tolerations:
#   - key: "node-role.kubernetes.io/master"
#     operator: "Equal"
#     value: ""
#     effect: "NoSchedule"
#   - key: "node-role.kubernetes.io/control-plane"
#     operator: "Equal"
#     value: ""
#     effect: "NoSchedule"
# metallb_controller_tolerations:
#   - key: "node-role.kubernetes.io/master"
#     operator: "Equal"
#     value: ""
#     effect: "NoSchedule"
#   - key: "node-role.kubernetes.io/control-plane"
#     operator: "Equal"
#     value: ""
#     effect: "NoSchedule"
# metallb_version: v0.13.9
# metallb_protocol: "layer2"
# metallb_port: "7472"
# metallb_memberlist_port: "7946"
# metallb_config:
#   address_pools:
#     primary:
#       ip_range:
#         - 10.5.0.0/16
#       auto_assign: true
#     pool1:
#       ip_range:
#         - 10.6.0.0/16
#       auto_assign: true
#     pool2:
#       ip_range:
#         - 10.10.0.0/16
#       auto_assign: true
#   layer2:
#     - primary
#   layer3:
#     defaults:
#       peer_port: 179
#       hold_time: 120s
#     communities:
#       vpn-only: "1234:1"
#       NO_ADVERTISE: "65535:65282"
#     metallb_peers:
#         peer1:
#           peer_address: 10.6.0.1
#           peer_asn: 64512
#           my_asn: 4200000000
#           communities:
#             - vpn-only
#           address_pool:
#             - pool1
#         peer2:
#           peer_address: 10.10.0.1
#           peer_asn: 64513
#           my_asn: 4200000000
#           communities:
#             - NO_ADVERTISE
#           address_pool:
#             - pool2

argocd_enabled: false

# The plugin manager for kubectl
krew_enabled: false
krew_root_dir: "/usr/local/krew"


########################################
# Helm apps configuration
########################################
repositories:
  - name: kube-forge
    url: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable"
  

releases:
  - name: docker-secrets-generator
    namespace: kube-system
    chart_ref: kube-forge/docker-secrets-generator
    chart_version: 0.1.0
    release_state: "absent"
  
  - name: longhorn
    namespace: longhorn-system
    create_namespace: true
    chart_ref: kube-forge/longhorn
    chart_version: 1.6.1
    release_state: "present"
    values:
      global:
        cattle:
          # -- Default system registry.
          systemDefaultRegistry: ""
          windowsCluster:
            # -- Setting that allows Longhorn to run on a Rancher Windows cluster.
            enabled: false
            # -- Toleration for Linux nodes that can run user-deployed Longhorn components.
            tolerations:
            - key: "cattle.io/os"
              value: "linux"
              effect: "NoSchedule"
              operator: "Equal"
            # -- Node selector for Linux nodes that can run user-deployed Longhorn components.
            nodeSelector:
              kubernetes.io/os: "linux"
            defaultSetting:
              # -- Toleration for system-managed Longhorn components.
              taintToleration: cattle.io/os=linux:NoSchedule
              # -- Node selector for system-managed Longhorn components.
              systemManagedComponentsNodeSelector: kubernetes.io/os:linux
  
      networkPolicies:
        # -- Setting that allows you to enable network policies that control access to Longhorn pods.
        enabled: false
        # -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
        type: "k3s"
  
      image:
        longhorn:
          engine:
            # -- Repository for the Longhorn Engine image.
            repository: longhornio/longhorn-engine
            # -- Specify Longhorn engine image tag
            tag: v1.6.1
          manager:
            # -- Repository for the Longhorn Manager image.
            repository: longhornio/longhorn-manager
            # -- Specify Longhorn manager image tag
            tag: v1.6.1
          ui:
            # -- Repository for the Longhorn UI image.
            repository: longhornio/longhorn-ui
            # -- Specify Longhorn ui image tag
            tag: v1.6.1
          instanceManager:
            # -- Repository for the Longhorn Instance Manager image.
            repository: longhornio/longhorn-instance-manager
            # -- Specify Longhorn instance manager image tag
            tag: v1.6.1
          shareManager:
            # -- Repository for the Longhorn Share Manager image.
            repository: longhornio/longhorn-share-manager
            # -- Specify Longhorn share manager image tag
            tag: v1.6.1
          backingImageManager:
            # -- Repository for the Backing Image Manager image. When unspecified, Longhorn uses the default value.
            repository: longhornio/backing-image-manager
            # -- Specify Longhorn backing image manager image tag
            tag: v1.6.1
          supportBundleKit:
            # -- Repository for the Longhorn Support Bundle Manager image.
            repository: longhornio/support-bundle-kit
            # -- Tag for the Longhorn Support Bundle Manager image.
            tag: v0.0.36
        csi:
          attacher:
            # -- Repository for the CSI attacher image. When unspecified, Longhorn uses the default value.
            repository: longhornio/csi-attacher
            # -- Tag for the CSI attacher image. When unspecified, Longhorn uses the default value.
            tag: v4.4.2
          provisioner:
            # -- Repository for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
            repository: longhornio/csi-provisioner
            # -- Tag for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
            tag: v3.6.2
          nodeDriverRegistrar:
            # -- Repository for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
            repository: longhornio/csi-node-driver-registrar
            # -- Tag for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
            tag: v2.9.2
          resizer:
            # -- Repository for the CSI Resizer image. When unspecified, Longhorn uses the default value.
            repository: longhornio/csi-resizer
            # -- Tag for the CSI Resizer image. When unspecified, Longhorn uses the default value.
            tag: v1.9.2
          snapshotter:
            # -- Repository for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
            repository: longhornio/csi-snapshotter
            # -- Tag for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
            tag: v6.3.2
          livenessProbe:
            # -- Repository for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
            repository: longhornio/livenessprobe
            # -- Tag for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
            tag: v2.12.0
        openshift:
          oauthProxy:
            # -- Repository for the OAuth Proxy image. This setting applies only to OpenShift users.
            repository: quay.io/openshift/origin-oauth-proxy
            # -- Tag for the OAuth Proxy image. This setting applies only to OpenShift users. Specify OCP/OKD version 4.1 or later. The latest stable version is 4.14.
            tag: 4.14
        # -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
        pullPolicy: IfNotPresent
  
      service:
        ui:
          # -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
          type: ClusterIP
          # -- NodePort port number for Longhorn UI. When unspecified, Longhorn selects a free port between 30000 and 32767.
          nodePort: null
        manager:
          # -- Service type for Longhorn Manager.
          type: ClusterIP
          # -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
          nodePort: ""
  
      persistence:
        # -- Setting that allows you to specify the default Longhorn StorageClass.
        defaultClass: true
        # -- Filesystem type of the default Longhorn StorageClass.
        defaultFsType: ext4
        # -- mkfs parameters of the default Longhorn StorageClass.
        defaultMkfsParams: ""
        # -- Replica count of the default Longhorn StorageClass.
        defaultClassReplicaCount: 3
        # -- Data locality of the default Longhorn StorageClass. (Options: "disabled", "best-effort")
        defaultDataLocality: disabled
        # -- Reclaim policy that provides instructions for handling of a volume after its claim is released. (Options: "Retain", "Delete")
        reclaimPolicy: Delete
        # -- Setting that allows you to enable live migration of a Longhorn volume from one node to another.
        migratable: false
        # -- Set NFS mount options for Longhorn StorageClass for RWX volumes
        nfsOptions: ""
        recurringJobSelector:
          # -- Setting that allows you to enable the recurring job selector for a Longhorn StorageClass.
          enable: false
          # -- Recurring job selector for a Longhorn StorageClass. Ensure that quotes are used correctly when specifying job parameters. (Example: `[{"name":"backup", "isGroup":true}]`)
          jobList: []
        backingImage:
          # -- Setting that allows you to use a backing image in a Longhorn StorageClass.
          enable: false
          # -- Backing image to be used for creating and restoring volumes in a Longhorn StorageClass. When no backing images are available, specify the data source type and parameters that Longhorn can use to create a backing image.
          name: ~
          # -- Data source type of a backing image used in a Longhorn StorageClass.
          # If the backing image exists in the cluster, Longhorn uses this setting to verify the image.
          # If the backing image does not exist, Longhorn creates one using the specified data source type.
          dataSourceType: ~
          # -- Data source parameters of a backing image used in a Longhorn StorageClass.
          # You can specify a JSON string of a map. (Example: `'{\"url\":\"https://backing-image-example.s3-region.amazonaws.com/test-backing-image\"}'`)
          dataSourceParameters: ~
          # -- Expected SHA-512 checksum of a backing image used in a Longhorn StorageClass.
          expectedChecksum: ~
        defaultNodeSelector:
          # -- Setting that allows you to enable the node selector for the default Longhorn StorageClass.
          enable: false
          # -- Node selector for the default Longhorn StorageClass. Longhorn uses only nodes with the specified tags for storing volume data. (Examples: "storage,fast")
          selector: ""
        # -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
        removeSnapshotsDuringFilesystemTrim: ignored
  
      preUpgradeChecker:
        # -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
        jobEnabled: true
        # -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
        upgradeVersionCheck: true
  
      csi:
        # -- kubelet root directory. When unspecified, Longhorn uses the default value.
        kubeletRootDir: ~
        # -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
        attacherReplicaCount: ~
        # -- Replica count of the CSI Provisioner. When unspecified, Longhorn uses the default value ("3").
        provisionerReplicaCount: ~
        # -- Replica count of the CSI Resizer. When unspecified, Longhorn uses the default value ("3").
        resizerReplicaCount: ~
        # -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
        snapshotterReplicaCount: ~
  
      defaultSettings:
        # -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
        backupTarget: ~
        # -- Name of the Kubernetes secret associated with the backup target.
        backupTargetCredentialSecret: ~
        # -- Setting that allows Longhorn to automatically attach a volume and create snapshots or backups when recurring jobs are run.
        allowRecurringJobWhileVolumeDetached: ~
        # -- Setting that allows Longhorn to automatically create a default disk only on nodes with the label "node.longhorn.io/create-default-disk=true" (if no other disks exist). When this setting is disabled, Longhorn creates a default disk on each node that is added to the cluster.
        createDefaultDiskLabeledNodes: ~
        # -- Default path for storing data on a host. The default value is "/var/lib/longhorn/".
        defaultDataPath: ~
        # -- Default data locality. A Longhorn volume has data locality if a local replica of the volume exists on the same node as the pod that is using the volume.
        defaultDataLocality: ~
        # -- Setting that allows scheduling on nodes with healthy replicas of the same volume. This setting is disabled by default.
        replicaSoftAntiAffinity: ~
        # -- Setting that automatically rebalances replicas when an available node is discovered.
        replicaAutoBalance: ~
        # -- Percentage of storage that can be allocated relative to hard drive capacity. The default value is "100".
        storageOverProvisioningPercentage: ~
        # -- Percentage of minimum available disk capacity. When the minimum available capacity exceeds the total available capacity, the disk becomes unschedulable until more space is made available for use. The default value is "25".
        storageMinimalAvailablePercentage: ~
        # -- Percentage of disk space that is not allocated to the default disk on each new Longhorn node.
        storageReservedPercentageForDefaultDisk: ~
        # -- Upgrade Checker that periodically checks for new Longhorn versions. When a new version is available, a notification appears on the Longhorn UI. This setting is enabled by default
        upgradeChecker: ~
        # -- Default number of replicas for volumes created using the Longhorn UI. For Kubernetes configuration, modify the `numberOfReplicas` field in the StorageClass. The default value is "3".
        defaultReplicaCount: ~
        # -- Default Longhorn StorageClass. "storageClassName" is assigned to PVs and PVCs that are created for an existing Longhorn volume. "storageClassName" can also be used as a label, so it is possible to use a Longhorn StorageClass to bind a workload to an existing PV without creating a Kubernetes StorageClass object. The default value is "longhorn-static".
        defaultLonghornStaticStorageClass: ~
        # -- Number of seconds that Longhorn waits before checking the backupstore for new backups. The default value is "300". When the value is "0", polling is disabled.
        backupstorePollInterval: ~
        # -- Number of minutes that Longhorn keeps a failed backup resource. When the value is "0", automatic deletion is disabled.
        failedBackupTTL: ~
        # -- Setting that restores recurring jobs from a backup volume on a backup target and creates recurring jobs if none exist during backup restoration.
        restoreVolumeRecurringJobs: ~
        # -- Maximum number of successful recurring backup and snapshot jobs to be retained. When the value is "0", a history of successful recurring jobs is not retained.
        recurringSuccessfulJobsHistoryLimit: ~
        # -- Maximum number of failed recurring backup and snapshot jobs to be retained. When the value is "0", a history of failed recurring jobs is not retained.
        recurringFailedJobsHistoryLimit: ~
        # -- Maximum number of snapshots or backups to be retained.
        recurringJobMaxRetention: ~
        # -- Maximum number of failed support bundles that can exist in the cluster. When the value is "0", Longhorn automatically purges all failed support bundles.
        supportBundleFailedHistoryLimit: ~
        # -- Taint or toleration for system-managed Longhorn components.
        taintToleration: ~
        # -- Node selector for system-managed Longhorn components.
        systemManagedComponentsNodeSelector: ~
        # -- PriorityClass for system-managed Longhorn components.
        # This setting can help prevent Longhorn components from being evicted under Node Pressure.
        # Notice that this will be applied to Longhorn user-deployed components by default if there are no priority class values set yet, such as `longhornManager.priorityClass`.
        priorityClass: &defaultPriorityClassNameRef "longhorn-critical"
        # -- Setting that allows Longhorn to automatically salvage volumes when all replicas become faulty (for example, when the network connection is interrupted). Longhorn determines which replicas are usable and then uses these replicas for the volume. This setting is enabled by default.
        autoSalvage: ~
        # -- Setting that allows Longhorn to automatically delete a workload pod that is managed by a controller (for example, daemonset) whenever a Longhorn volume is detached unexpectedly (for example, during Kubernetes upgrades). After deletion, the controller restarts the pod and then Kubernetes handles volume reattachment and remounting.
        autoDeletePodWhenVolumeDetachedUnexpectedly: ~
        # -- Setting that prevents Longhorn Manager from scheduling replicas on a cordoned Kubernetes node. This setting is enabled by default.
        disableSchedulingOnCordonedNode: ~
        # -- Setting that allows Longhorn to schedule new replicas of a volume to nodes in the same zone as existing healthy replicas. Nodes that do not belong to any zone are treated as existing in the zone that contains healthy replicas. When identifying zones, Longhorn relies on the label "topology.kubernetes.io/zone=<Zone name of the node>" in the Kubernetes node object.
        replicaZoneSoftAntiAffinity: ~
        # -- Setting that allows scheduling on disks with existing healthy replicas of the same volume. This setting is enabled by default.
        replicaDiskSoftAntiAffinity: ~
        # -- Policy that defines the action Longhorn takes when a volume is stuck with a StatefulSet or Deployment pod on a node that failed.
        nodeDownPodDeletionPolicy: ~
        # -- Policy that defines the action Longhorn takes when a node with the last healthy replica of a volume is drained.
        nodeDrainPolicy: ~
        # -- Setting that allows automatic detaching of manually-attached volumes when a node is cordoned.
        detachManuallyAttachedVolumesWhenCordoned: ~
        # -- Number of seconds that Longhorn waits before reusing existing data on a failed replica instead of creating a new replica of a degraded volume.
        replicaReplenishmentWaitInterval: ~
        # -- Maximum number of replicas that can be concurrently rebuilt on each node.
        concurrentReplicaRebuildPerNodeLimit: ~
        # -- Maximum number of volumes that can be concurrently restored on each node using a backup. When the value is "0", restoration of volumes using a backup is disabled.
        concurrentVolumeBackupRestorePerNodeLimit: ~
        # -- Setting that disables the revision counter and thereby prevents Longhorn from tracking all write operations to a volume. When salvaging a volume, Longhorn uses properties of the "volume-head-xxx.img" file (the last file size and the last time the file was modified) to select the replica to be used for volume recovery. This setting applies only to volumes created using the Longhorn UI.
        disableRevisionCounter: ~
        # -- Image pull policy for system-managed pods, such as Instance Manager, engine images, and CSI Driver. Changes to the image pull policy are applied only after the system-managed pods restart.
        systemManagedPodsImagePullPolicy: ~
        # -- Setting that allows you to create and attach a volume without having all replicas scheduled at the time of creation.
        allowVolumeCreationWithDegradedAvailability: ~
        # -- Setting that allows Longhorn to automatically clean up the system-generated snapshot after replica rebuilding is completed.
        autoCleanupSystemGeneratedSnapshot: ~
        # -- Setting that allows Longhorn to automatically clean up the snapshot generated by a recurring backup job.
        autoCleanupRecurringJobBackupSnapshot: ~
        # -- Maximum number of engines that are allowed to concurrently upgrade on each node after Longhorn Manager is upgraded. When the value is "0", Longhorn does not automatically upgrade volume engines to the new default engine image version.
        concurrentAutomaticEngineUpgradePerNodeLimit: ~
        # -- Number of minutes that Longhorn waits before cleaning up the backing image file when no replicas in the disk are using it.
        backingImageCleanupWaitInterval: ~
        # -- Number of seconds that Longhorn waits before downloading a backing image file again when the status of all image disk files changes to "failed" or "unknown".
        backingImageRecoveryWaitInterval: ~
        # -- Percentage of the total allocatable CPU resources on each node to be reserved for each instance manager pod when the V1 Data Engine is enabled. The default value is "12".
        guaranteedInstanceManagerCPU: ~
        # -- Setting that notifies Longhorn that the cluster is using the Kubernetes Cluster Autoscaler.
        kubernetesClusterAutoscalerEnabled: ~
        # -- Setting that allows Longhorn to automatically delete an orphaned resource and the corresponding data (for example, stale replicas). Orphaned resources on failed or unknown nodes are not automatically cleaned up.
        orphanAutoDeletion: ~
        # -- Storage network for in-cluster traffic. When unspecified, Longhorn uses the Kubernetes cluster network.
        storageNetwork: ~
        # -- Flag that prevents accidental uninstallation of Longhorn.
        deletingConfirmationFlag: ~
        # -- Timeout between the Longhorn Engine and replicas. Specify a value between "8" and "30" seconds. The default value is "8".
        engineReplicaTimeout: ~
        # -- Setting that allows you to enable and disable snapshot hashing and data integrity checks.
        snapshotDataIntegrity: ~
        # -- Setting that allows disabling of snapshot hashing after snapshot creation to minimize impact on system performance.
        snapshotDataIntegrityImmediateCheckAfterSnapshotCreation: ~
        # -- Setting that defines when Longhorn checks the integrity of data in snapshot disk files. You must use the Unix cron expression format.
        snapshotDataIntegrityCronjob: ~
        # -- Setting that allows Longhorn to automatically mark the latest snapshot and its parent files as removed during a filesystem trim. Longhorn does not remove snapshots containing multiple child files.
        removeSnapshotsDuringFilesystemTrim: ~
        # -- Setting that allows fast rebuilding of replicas using the checksum of snapshot disk files. Before enabling this setting, you must set the snapshot-data-integrity value to "enable" or "fast-check".
        fastReplicaRebuildEnabled: ~
        # -- Number of seconds that an HTTP client waits for a response from a File Sync server before considering the connection to have failed.
        replicaFileSyncHttpClientTimeout: ~
        # -- Log levels that indicate the type and severity of logs in Longhorn Manager. The default value is "Info". (Options: "Panic", "Fatal", "Error", "Warn", "Info", "Debug", "Trace")
        logLevel: ~
        # -- Setting that allows you to specify a backup compression method.
        backupCompressionMethod: ~
        # -- Maximum number of worker threads that can concurrently run for each backup.
        backupConcurrentLimit: ~
        # -- Maximum number of worker threads that can concurrently run for each restore operation.
        restoreConcurrentLimit: ~
        # -- Setting that allows you to enable the V1 Data Engine.
        v1DataEngine: ~
        # -- Setting that allows you to enable the V2 Data Engine, which is based on the Storage Performance Development Kit (SPDK). The V2 Data Engine is a preview feature and should not be used in production environments.
        v2DataEngine: ~
        # -- Setting that allows you to configure maximum huge page size (in MiB) for the V2 Data Engine.
        v2DataEngineHugepageLimit: ~
        # -- Setting that allows rebuilding of offline replicas for volumes using the V2 Data Engine.
        offlineReplicaRebuilding: ~
        # -- Number of millicpus on each node to be reserved for each Instance Manager pod when the V2 Data Engine is enabled. The default value is "1250".
        v2DataEngineGuaranteedInstanceManagerCPU: ~
        # -- Setting that allows scheduling of empty node selector volumes to any node.
        allowEmptyNodeSelectorVolume: ~
        # -- Setting that allows scheduling of empty disk selector volumes to any disk.
        allowEmptyDiskSelectorVolume: ~
        # -- Setting that allows Longhorn to periodically collect anonymous usage data for product improvement purposes. Longhorn sends collected data to the [Upgrade Responder](https://github.com/longhorn/upgrade-responder) server, which is the data source of the Longhorn Public Metrics Dashboard (https://metrics.longhorn.io). The Upgrade Responder server does not store data that can be used to identify clients, including IP addresses.
        allowCollectingLonghornUsageMetrics: ~
        # -- Setting that temporarily prevents all attempts to purge volume snapshots.
        disableSnapshotPurge: ~
        # -- Maximum snapshot count for a volume. The value should be between 2 to 250
        snapshotMaxCount: ~
  
      privateRegistry:
        # -- Setting that allows you to create a private registry secret.
        createSecret: ~
        # -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
        registryUrl: ~
        # -- User account used for authenticating with a private registry.
        registryUser: ~
        # -- Password for authenticating with a private registry.
        registryPasswd: ~
        # -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
        registrySecret: ~
  
      longhornManager:
        log:
          # -- Format of Longhorn Manager logs. (Options: "plain", "json")
          format: plain
        # -- PriorityClass for Longhorn Manager.
        priorityClass: *defaultPriorityClassNameRef
        # -- Toleration for Longhorn Manager on nodes allowed to run Longhorn Manager.
        tolerations: []
        ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
        ## and uncomment this example block
        # - key: "key"
        #   operator: "Equal"
        #   value: "value"
        #   effect: "NoSchedule"
        # -- Node selector for Longhorn Manager. Specify the nodes allowed to run Longhorn Manager.
        nodeSelector: {}
        ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
        ## and uncomment this example block
        #  label-key1: "label-value1"
        #  label-key2: "label-value2"
        # -- Annotation for the Longhorn Manager service.
        serviceAnnotations: {}
        ## If you want to set annotations for the Longhorn Manager service, delete the `{}` in the line above
        ## and uncomment this example block
        #  annotation-key1: "annotation-value1"
        #  annotation-key2: "annotation-value2"
  
      longhornDriver:
        # -- PriorityClass for Longhorn Driver.
        priorityClass: *defaultPriorityClassNameRef
        # -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
        tolerations: []
        ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
        ## and uncomment this example block
        # - key: "key"
        #   operator: "Equal"
        #   value: "value"
        #   effect: "NoSchedule"
        # -- Node selector for Longhorn Driver. Specify the nodes allowed to run Longhorn Driver.
        nodeSelector: {}
        ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
        ## and uncomment this example block
        #  label-key1: "label-value1"
        #  label-key2: "label-value2"
  
      longhornUI:
        # -- Replica count for Longhorn UI.
        replicas: 2
        # -- PriorityClass for Longhorn UI.
        priorityClass: *defaultPriorityClassNameRef
        # -- Toleration for Longhorn UI on nodes allowed to run Longhorn components.
        tolerations: []
        ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
        ## and uncomment this example block
        # - key: "key"
        #   operator: "Equal"
        #   value: "value"
        #   effect: "NoSchedule"
        # -- Node selector for Longhorn UI. Specify the nodes allowed to run Longhorn UI.
        nodeSelector: {}
        ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
        ## and uncomment this example block
        #  label-key1: "label-value1"
        #  label-key2: "label-value2"
  
      ingress:
        # -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
        enabled: false
  
        # -- IngressClass resource that contains ingress configuration, including the name of the Ingress controller.
        # ingressClassName can replace the kubernetes.io/ingress.class annotation used in earlier Kubernetes releases.
        ingressClassName: ~
  
        # -- Hostname of the Layer 7 load balancer.
        host: sslip.io
  
        # -- Setting that allows you to enable TLS on ingress records.
        tls: false
  
        # -- Setting that allows you to enable secure connections to the Longhorn UI service via port 443.
        secureBackends: false
  
        # -- TLS secret that contains the private key and certificate to be used for TLS. This setting applies only when TLS is enabled on ingress records.
        tlsSecret: longhorn.local-tls
  
        path: /
  
        ## If you're using kube-lego, you will want to add:
        ## kubernetes.io/tls-acme: true
        ##
        ## For a full list of possible ingress annotations, please see
        ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
        ##
        ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
        # -- Ingress annotations in the form of key-value pairs.
        annotations:
        #  kubernetes.io/ingress.class: nginx
        #  kubernetes.io/tls-acme: true
  
        # -- Secret that contains a TLS private key and certificate. Use secrets if you want to use your own certificates to secure ingresses.
        secrets:
        ## If you're providing your own certificates, please use this to add the certificates as secrets
        ## key and certificate should start with -----BEGIN CERTIFICATE----- or
        ## -----BEGIN RSA PRIVATE KEY-----
        ##
        ## name should line up with a tlsSecret set further up
        ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
        ##
        ## It is also possible to create and manage the certificates outside of this helm chart
        ## Please see README.md for more information
        # - name: longhorn.local-tls
        #   key:
        #   certificate:
  
      # -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
      enablePSP: false
  
      # -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
      namespaceOverride: ""
  
      # -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
      annotations: {}
  
      serviceAccount:
        # -- Annotations to add to the service account
        annotations: {}
  
      metrics:
        serviceMonitor:
          # -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
          enabled: false
  
      ## openshift settings
      openshift:
        # -- Setting that allows Longhorn to integrate with OpenShift.
        enabled: false
        ui:
          # -- Route for connections between Longhorn and the OpenShift web console.
          route: "longhorn-ui"
          # -- Port for accessing the OpenShift web console.
          port: 443
          # -- Port for proxy that provides access to the OpenShift web console.
          proxy: 8443
  
      # -- Setting that allows Longhorn to generate code coverage profiles.
      enableGoCoverDir: false
  
  - name: cert-manager
    namespace: cert-manager
    create_namespace: true
    chart_ref: kube-forge/cert-manager
    chart_version: v1.14.5
    release_state: "present"
    values:
      global:
        imagePullSecrets: []
  
        commonLabels: {}
  
        # revisionHistoryLimit: 1
  
        priorityClassName: ""
  
        rbac:
          create: true
          # Aggregate ClusterRoles to Kubernetes default user-facing roles. Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
          aggregateClusterRoles: true
  
        podSecurityPolicy:
          enabled: false
          # Configure the PodSecurityPolicy to use AppArmor
          useAppArmor: true
  
        # Set the verbosity of cert-manager. Range of 0 - 6 with 6 being the most verbose.
        logLevel: 2
  
        leaderElection:
          # Override the namespace used for the leader election lease
          namespace: "kube-system"
  
          # The duration that non-leader candidates will wait after observing a
          # leadership renewal until attempting to acquire leadership of a led but
          # unrenewed leader slot. This is effectively the maximum duration that a
          # leader can be stopped before it is replaced by another candidate.
          # leaseDuration: 60s
  
          # The interval between attempts by the acting master to renew a leadership
          # slot before it stops leading. This must be less than or equal to the
          # lease duration.
          # renewDeadline: 40s
  
          # The duration the clients should wait between attempting acquisition and
          # renewal of a leadership.
          # retryPeriod: 15s
  
      installCRDs: true
  
      # Number of replicas of the cert-manager controller to run.
      #
      # The default is 1, but in production you should set this to 2 or 3 to provide high
      # availability.
      #
      # If `replicas > 1` you should also consider setting `podDisruptionBudget.enabled=true`.
      #
      # Note: cert-manager uses leader election to ensure that there can
      # only be a single instance active at a time.
      replicaCount: 1
  
      # Deployment update strategy for the cert-manager controller deployment.
      # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
      strategy: {}
  
      podDisruptionBudget:
        # Enable or disable the PodDisruptionBudget resource
        #
        # This prevents downtime during voluntary disruptions such as during a Node upgrade.
        # For example, the PodDisruptionBudget will block `kubectl drain`
        # if it is used on the Node where the only remaining cert-manager
        # Pod is currently running.
        enabled: false
  
        # Configures the minimum available pods for disruptions. Can either be set to
        # an integer (e.g. 1) or a percentage value (e.g. 25%).
        # Cannot be used if `maxUnavailable` is set.
        # +docs:property
        # minAvailable: 1
  
        # Configures the maximum unavailable pods for disruptions. Can either be set to
        # an integer (e.g. 1) or a percentage value (e.g. 25%).
        # Cannot be used if `minAvailable` is set.
        # +docs:property
        # maxUnavailable: 1
  
      # Comma separated list of feature gates that should be enabled on the
      # controller pod.
      featureGates: ""
  
      # The maximum number of challenges that can be scheduled as 'processing' at once
      maxConcurrentChallenges: 60
  
      image:
        # The container registry to pull the manager image from
        # +docs:property
        # registry: quay.io
  
        # The container image for the cert-manager controller
        # +docs:property
        repository: quay.io/jetstack/cert-manager-controller
  
        # Override the image tag to deploy by setting this variable.
        # If no value is set, the chart's appVersion will be used.
        # +docs:property
        tag: v1.14.5
  
        # Setting a digest will override any tag
        # +docs:property
        # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
  
        # Kubernetes imagePullPolicy on Deployment.
        pullPolicy: IfNotPresent
  
      # Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
      # resources. By default, the same namespace as cert-manager is deployed within is
      # used. This namespace will not be automatically created by the Helm chart.
      clusterResourceNamespace: ""
  
      # This namespace allows you to define where the services will be installed into
      # if not set then they will use the namespace of the release
      # This is helpful when installing cert manager as a chart dependency (sub chart)
      namespace: ""
  
      serviceAccount:
        # Specifies whether a service account should be created
        create: true
  
        # The name of the service account to use.
        # If not set and create is true, a name is generated using the fullname template
        # +docs:property
        # name: ""
  
        # Optional additional annotations to add to the controller's ServiceAccount
        # +docs:property
        # annotations: {}
  
        # Optional additional labels to add to the controller's ServiceAccount
        # +docs:property
        # labels: {}
  
        # Automount API credentials for a Service Account.
        automountServiceAccountToken: true
  
      # Automounting API credentials for a particular pod
      # +docs:property
      # automountServiceAccountToken: true
  
      # When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted
      enableCertificateOwnerRef: false
  
      # Used to configure options for the controller pod.
      # This allows setting options that'd usually be provided via flags.
      # An APIVersion and Kind must be specified in your values.yaml file.
      # Flags will override options that are set here.
      #
      # For example:
      #  config:
      #    apiVersion: controller.config.cert-manager.io/v1alpha1
      #    kind: ControllerConfiguration
      #    logging:
      #      verbosity: 2
      #      format: text
      #    leaderElectionConfig:
      #      namespace: kube-system
      #    kubernetesAPIQPS: 9000
      #    kubernetesAPIBurst: 9000
      #    numberOfConcurrentWorkers: 200
      #    featureGates:
      #      AdditionalCertificateOutputFormats: true
      #      DisallowInsecureCSRUsageDefinition: true
      #      ExperimentalCertificateSigningRequestControllers: true
      #      ExperimentalGatewayAPISupport: true
      #      LiteralCertificateSubject: true
      #      SecretsFilteredCaching: true
      #      ServerSideApply: true
      #      StableCertificateRequestName: true
      #      UseCertificateRequestBasicConstraints: true
      #      ValidateCAA: true
      #    metricsTLSConfig:
      #      dynamic:
      #        secretNamespace: "cert-manager"
      #        secretName: "cert-manager-metrics-ca"
      #        dnsNames:
      #        - cert-manager-metrics
      #        - cert-manager-metrics.cert-manager
      #        - cert-manager-metrics.cert-manager.svc
      config: {}
  
      # Setting Nameservers for DNS01 Self Check
      # See: https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check
  
      # Comma separated string with host and port of the recursive nameservers cert-manager should query
      dns01RecursiveNameservers: ""
  
      # Forces cert-manager to only use the recursive nameservers for verification.
      # Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers
      dns01RecursiveNameserversOnly: false
  
      # Additional command line flags to pass to cert-manager controller binary.
      # To see all available flags run docker run quay.io/jetstack/cert-manager-controller:<version> --help
      #
      # Use this flag to enable or disable arbitrary controllers, for example, disable the CertificiateRequests approver
      #
      # For example:
      #  extraArgs:
      #    - --controllers=*,-certificaterequests-approver
      extraArgs: []
  
      # Additional environment variables to pass to cert-manager controller binary.
      extraEnv: []
      # - name: SOME_VAR
      #   value: 'some value'
  
      # Resources to provide to the cert-manager controller pod
      #
      # For example:
      #  requests:
      #    cpu: 10m
      #    memory: 32Mi
      #
      # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
      resources: {}
  
      # Pod Security Context
      # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
      # +docs:property
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
  
      # Container Security Context to be set on the controller component container
      # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
      # +docs:property
      containerSecurityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
          - ALL
        readOnlyRootFilesystem: true
  
      # Additional volumes to add to the cert-manager controller pod.
      volumes: []
  
      # Additional volume mounts to add to the cert-manager controller container.
      volumeMounts: []
  
      # Optional additional annotations to add to the controller Deployment
      # +docs:property
      # deploymentAnnotations: {}
  
      # Optional additional annotations to add to the controller Pods
      # +docs:property
      # podAnnotations: {}
  
      # Optional additional labels to add to the controller Pods
      podLabels: {}
  
      # Optional annotations to add to the controller Service
      # +docs:property
      # serviceAnnotations: {}
  
      # Optional additional labels to add to the controller Service
      # +docs:property
      # serviceLabels: {}
  
      # Optional DNS settings, useful if you have a public and private DNS zone for
      # the same domain on Route 53. What follows is an example of ensuring
      # cert-manager can access an ingress or DNS TXT records at all times.
      # NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
      # the cluster to work.
  
      # Pod DNS policy
      # ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
      # +docs:property
      # podDnsPolicy: "None"
  
      # Pod DNS config, podDnsConfig field is optional and it can work with any podDnsPolicy
      # settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified.
      # ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
      # +docs:property
      podDnsConfig:
        nameservers:
          - "8.8.8.8"
          - "1.1.1.1"
  
      # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
      # matching labels.
      # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
      #
      # This default ensures that Pods are only scheduled to Linux nodes.
      # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
      # +docs:property
      nodeSelector:
        kubernetes.io/os: linux
  
      # +docs:ignore
      ingressShim: {}
  
        # Optional default issuer to use for ingress resources
        # +docs:property=ingressShim.defaultIssuerName
        # defaultIssuerName: ""
  
        # Optional default issuer kind to use for ingress resources
        # +docs:property=ingressShim.defaultIssuerKind
        # defaultIssuerKind: ""
  
        # Optional default issuer group to use for ingress resources
        # +docs:property=ingressShim.defaultIssuerGroup
        # defaultIssuerGroup: ""
  
      # Use these variables to configure the HTTP_PROXY environment variables
  
      # Configures the HTTP_PROXY environment variable for where a HTTP proxy is required
      # +docs:property
      # http_proxy: "http://proxy:8080"
  
      # Configures the HTTPS_PROXY environment variable for where a HTTP proxy is required
      # +docs:property
      # https_proxy: "https://proxy:8080"
  
      # Configures the NO_PROXY environment variable for where a HTTP proxy is required,
      # but certain domains should be excluded
      # +docs:property
      # no_proxy: 127.0.0.1,localhost
  
  
      # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core
      #
      # For example:
      #   affinity:
      #     nodeAffinity:
      #      requiredDuringSchedulingIgnoredDuringExecution:
      #        nodeSelectorTerms:
      #        - matchExpressions:
      #          - key: foo.bar.com/role
      #            operator: In
      #            values:
      #            - master
      affinity: {}
  
      # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core
      #
      # For example:
      #   tolerations:
      #   - key: foo.bar.com/role
      #     operator: Equal
      #     value: master
      #     effect: NoSchedule
      tolerations: []
  
      # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
      #
      # For example:
      #   topologySpreadConstraints:
      #   - maxSkew: 2
      #     topologyKey: topology.kubernetes.io/zone
      #     whenUnsatisfiable: ScheduleAnyway
      #     labelSelector:
      #       matchLabels:
      #         app.kubernetes.io/instance: cert-manager
      #         app.kubernetes.io/component: controller
      topologySpreadConstraints: []
  
      # LivenessProbe settings for the controller container of the controller Pod.
      #
      # Enabled by default, because we want to enable the clock-skew liveness probe that
      # restarts the controller in case of a skew between the system clock and the monotonic clock.
      # LivenessProbe durations and thresholds are based on those used for the Kubernetes
      # controller-manager. See:
      # https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245
      # +docs:property
      livenessProbe:
        enabled: true
        initialDelaySeconds: 10
        periodSeconds: 10
        timeoutSeconds: 15
        successThreshold: 1
        failureThreshold: 8
  
      # enableServiceLinks indicates whether information about services should be
      # injected into pod's environment variables, matching the syntax of Docker
      # links.
      enableServiceLinks: false
  
      # +docs:section=Prometheus
  
      prometheus:
        # Enable Prometheus monitoring for the cert-manager controller to use with the
        # Prometheus Operator. If this option is enabled without enabling `prometheus.servicemonitor.enabled` or
        # `prometheus.podmonitor.enabled`, 'prometheus.io' annotations are added to the cert-manager Deployment
        # resources. Additionally, a service is created which can be used together
        # with your own ServiceMonitor (managed outside of this Helm chart).
        # Otherwise, a ServiceMonitor/ PodMonitor is created.
        enabled: true
        servicemonitor:
          # Create a ServiceMonitor to add cert-manager to Prometheus
          enabled: false
  
          # Specifies the `prometheus` label on the created ServiceMonitor, this is
          # used when different Prometheus instances have label selectors matching
          # different ServiceMonitors.
          prometheusInstance: default
  
          # The target port to set on the ServiceMonitor, should match the port that
          # cert-manager controller is listening on for metrics
          targetPort: 9402
  
          # The path to scrape for metrics
          path: /metrics
  
          # The interval to scrape metrics
          interval: 60s
  
          # The timeout before a metrics scrape fails
          scrapeTimeout: 30s
  
          # Additional labels to add to the ServiceMonitor
          labels: {}
  
          # Additional annotations to add to the ServiceMonitor
          annotations: {}
  
          # Keep labels from scraped data, overriding server-side labels.
          honorLabels: false
  
          # EndpointAdditionalProperties allows setting additional properties on the
          # endpoint such as relabelings, metricRelabelings etc.
          #
          # For example:
          #  endpointAdditionalProperties:
          #   relabelings:
          #   - action: replace
          #     sourceLabels:
          #     - __meta_kubernetes_pod_node_name
          #     targetLabel: instance
          #
          # +docs:property
          endpointAdditionalProperties: {}
  
        # Note: Enabling both PodMonitor and ServiceMonitor is mutually exclusive, enabling both will result in a error.
        podmonitor:
          # Create a PodMonitor to add cert-manager to Prometheus
          enabled: false
  
          # Specifies the `prometheus` label on the created PodMonitor, this is
          # used when different Prometheus instances have label selectors matching
          # different PodMonitor.
          prometheusInstance: default
  
          # The path to scrape for metrics
          path: /metrics
  
          # The interval to scrape metrics
          interval: 60s
  
          # The timeout before a metrics scrape fails
          scrapeTimeout: 30s
  
          # Additional labels to add to the PodMonitor
          labels: {}
  
          # Additional annotations to add to the PodMonitor
          annotations: {}
  
          # Keep labels from scraped data, overriding server-side labels.
          honorLabels: false
  
          # EndpointAdditionalProperties allows setting additional properties on the
          # endpoint such as relabelings, metricRelabelings etc.
          #
          # For example:
          #  endpointAdditionalProperties:
          #   relabelings:
          #   - action: replace
          #     sourceLabels:
          #     - __meta_kubernetes_pod_node_name
          #     targetLabel: instance
          #
          # +docs:property
          endpointAdditionalProperties: {}
  
      # +docs:section=Webhook
  
      webhook:
        # Number of replicas of the cert-manager webhook to run.
        #
        # The default is 1, but in production you should set this to 2 or 3 to provide high
        # availability.
        #
        # If `replicas > 1` you should also consider setting `webhook.podDisruptionBudget.enabled=true`.
        replicaCount: 1
  
        # Seconds the API server should wait for the webhook to respond before treating the call as a failure.
        # Value must be between 1 and 30 seconds. See:
        # https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/
        #
        # We set the default to the maximum value of 30 seconds. Here's why:
        # Users sometimes report that the connection between the K8S API server and
        # the cert-manager webhook server times out.
        # If *this* timeout is reached, the error message will be "context deadline exceeded",
        # which doesn't help the user diagnose what phase of the HTTPS connection timed out.
        # For example, it could be during DNS resolution, TCP connection, TLS
        # negotiation, HTTP negotiation, or slow HTTP response from the webhook
        # server.
        # So by setting this timeout to its maximum value the underlying timeout error
        # message has more chance of being returned to the end user.
        timeoutSeconds: 30
  
        # Used to configure options for the webhook pod.
        # This allows setting options that'd usually be provided via flags.
        # An APIVersion and Kind must be specified in your values.yaml file.
        # Flags will override options that are set here.
        #
        # For example:
        #  apiVersion: webhook.config.cert-manager.io/v1alpha1
        #  kind: WebhookConfiguration
        #  # The port that the webhook should listen on for requests.
        #  # In GKE private clusters, by default kubernetes apiservers are allowed to
        #  # talk to the cluster nodes only on 443 and 10250. so configuring
        #  # securePort: 10250, will work out of the box without needing to add firewall
        #  # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000.
        #  # This should be uncommented and set as a default by the chart once we graduate
        #  # the apiVersion of WebhookConfiguration past v1alpha1.
        #  securePort: 10250
        config: {}
  
        # Deployment update strategy for the cert-manager webhook deployment.
        # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
        #
        # For example:
        #  strategy:
        #    type: RollingUpdate
        #    rollingUpdate:
        #      maxSurge: 0
        #      maxUnavailable: 1
        strategy: {}
  
        # Pod Security Context to be set on the webhook component Pod
        # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
        # +docs:property
        securityContext:
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
  
        # Container Security Context to be set on the webhook component container
        # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
        # +docs:property
        containerSecurityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
  
        podDisruptionBudget:
          # Enable or disable the PodDisruptionBudget resource
          #
          # This prevents downtime during voluntary disruptions such as during a Node upgrade.
          # For example, the PodDisruptionBudget will block `kubectl drain`
          # if it is used on the Node where the only remaining cert-manager
          # Pod is currently running.
          enabled: false
  
          # Configures the minimum available pods for disruptions. Can either be set to
          # an integer (e.g. 1) or a percentage value (e.g. 25%).
          # Cannot be used if `maxUnavailable` is set.
          # +docs:property
          # minAvailable: 1
  
          # Configures the maximum unavailable pods for disruptions. Can either be set to
          # an integer (e.g. 1) or a percentage value (e.g. 25%).
          # Cannot be used if `minAvailable` is set.
          # +docs:property
          # maxUnavailable: 1
  
        # Optional additional annotations to add to the webhook Deployment
        # +docs:property
        # deploymentAnnotations: {}
  
        # Optional additional annotations to add to the webhook Pods
        # +docs:property
        # podAnnotations: {}
  
        # Optional additional annotations to add to the webhook Service
        # +docs:property
        # serviceAnnotations: {}
  
        # Optional additional annotations to add to the webhook MutatingWebhookConfiguration
        # +docs:property
        # mutatingWebhookConfigurationAnnotations: {}
  
        # Optional additional annotations to add to the webhook ValidatingWebhookConfiguration
        # +docs:property
        # validatingWebhookConfigurationAnnotations: {}
  
        validatingWebhookConfiguration:
          # Configure spec.namespaceSelector for validating webhooks.
          # +docs:property
          namespaceSelector:
            matchExpressions:
              - key: "cert-manager.io/disable-validation"
                operator: "NotIn"
                values:
                  - "true"
  
        mutatingWebhookConfiguration:
          # Configure spec.namespaceSelector for mutating webhooks.
          # +docs:property
          namespaceSelector: {}
          #  matchLabels:
          #    key: value
          #  matchExpressions:
          #    - key: kubernetes.io/metadata.name
          #      operator: NotIn
          #      values:
          #        - kube-system
  
  
        # Additional command line flags to pass to cert-manager webhook binary.
        # To see all available flags run docker run quay.io/jetstack/cert-manager-webhook:<version> --help
        extraArgs: []
        # Path to a file containing a WebhookConfiguration object used to configure the webhook
        # - --config=<path-to-config-file>
  
        # Comma separated list of feature gates that should be enabled on the
        # webhook pod.
        featureGates: ""
  
        # Resources to provide to the cert-manager webhook pod
        #
        # For example:
        #  requests:
        #    cpu: 10m
        #    memory: 32Mi
        #
        # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
        resources: {}
  
        # Liveness probe values
        # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
        #
        # +docs:property
        livenessProbe:
          failureThreshold: 3
          initialDelaySeconds: 60
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 1
  
        # Readiness probe values
        # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
        #
        # +docs:property
        readinessProbe:
          failureThreshold: 3
          initialDelaySeconds: 5
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 1
  
        # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
        # matching labels.
        # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
        #
        # This default ensures that Pods are only scheduled to Linux nodes.
        # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
        # +docs:property
        nodeSelector:
          kubernetes.io/os: linux
  
        # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core
        #
        # For example:
        #   affinity:
        #     nodeAffinity:
        #      requiredDuringSchedulingIgnoredDuringExecution:
        #        nodeSelectorTerms:
        #        - matchExpressions:
        #          - key: foo.bar.com/role
        #            operator: In
        #            values:
        #            - master
        affinity: {}
  
        # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core
        #
        # For example:
        #   tolerations:
        #   - key: foo.bar.com/role
        #     operator: Equal
        #     value: master
        #     effect: NoSchedule
        tolerations: []
  
        # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
        #
        # For example:
        #   topologySpreadConstraints:
        #   - maxSkew: 2
        #     topologyKey: topology.kubernetes.io/zone
        #     whenUnsatisfiable: ScheduleAnyway
        #     labelSelector:
        #       matchLabels:
        #         app.kubernetes.io/instance: cert-manager
        #         app.kubernetes.io/component: controller
        topologySpreadConstraints: []
  
        # Optional additional labels to add to the Webhook Pods
        podLabels: {}
  
        # Optional additional labels to add to the Webhook Service
        serviceLabels: {}
  
        image:
          # The container registry to pull the webhook image from
          # +docs:property
          # registry: quay.io
  
          # The container image for the cert-manager webhook
          # +docs:property
          repository: quay.io/jetstack/cert-manager-webhook
  
          # Override the image tag to deploy by setting this variable.
          # If no value is set, the chart's appVersion will be used.
          # +docs:property
          # tag: vX.Y.Z
  
          # Setting a digest will override any tag
          # +docs:property
          # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
  
          # Kubernetes imagePullPolicy on Deployment.
          pullPolicy: IfNotPresent
  
        serviceAccount:
          # Specifies whether a service account should be created
          create: true
  
          # The name of the service account to use.
          # If not set and create is true, a name is generated using the fullname template
          # +docs:property
          # name: ""
  
          # Optional additional annotations to add to the controller's ServiceAccount
          # +docs:property
          # annotations: {}
  
          # Optional additional labels to add to the webhook's ServiceAccount
          # +docs:property
          # labels: {}
  
          # Automount API credentials for a Service Account.
          automountServiceAccountToken: true
  
        # Automounting API credentials for a particular pod
        # +docs:property
        # automountServiceAccountToken: true
  
        # The port that the webhook should listen on for requests.
        # In GKE private clusters, by default kubernetes apiservers are allowed to
        # talk to the cluster nodes only on 443 and 10250. so configuring
        # securePort: 10250, will work out of the box without needing to add firewall
        # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000
        securePort: 10250
  
        # Specifies if the webhook should be started in hostNetwork mode.
        #
        # Required for use in some managed kubernetes clusters (such as AWS EKS) with custom
        # CNI (such as calico), because control-plane managed by AWS cannot communicate
        # with pods' IP CIDR and admission webhooks are not working
        #
        # Since the default port for the webhook conflicts with kubelet on the host
        # network, `webhook.securePort` should be changed to an available port if
        # running in hostNetwork mode.
        hostNetwork: false
  
        # Specifies how the service should be handled. Useful if you want to expose the
        # webhook to outside of the cluster. In some cases, the control plane cannot
        # reach internal services.
        serviceType: ClusterIP
  
        # Specify the load balancer IP for the created service
        # +docs:property
        # loadBalancerIP: "10.10.10.10"
  
        # Overrides the mutating webhook and validating webhook so they reach the webhook
        # service using the `url` field instead of a service.
        url: {}
          # host:
  
        # Enables default network policies for webhooks.
        networkPolicy:
          # Create network policies for the webhooks
          enabled: false
  
          # Ingress rule for the webhook network policy, by default will allow all
          # inbound traffic
          # +docs:property
          ingress:
          - from:
            - ipBlock:
                cidr: 0.0.0.0/0
  
          # Egress rule for the webhook network policy, by default will allow all
          # outbound traffic traffic to ports 80 and 443, as well as DNS ports
          # +docs:property
          egress:
          - ports:
            - port: 80
              protocol: TCP
            - port: 443
              protocol: TCP
            - port: 53
              protocol: TCP
            - port: 53
              protocol: UDP
            # On OpenShift and OKD, the Kubernetes API server listens on
            # port 6443.
            - port: 6443
              protocol: TCP
            to:
            - ipBlock:
                cidr: 0.0.0.0/0
  
        # Additional volumes to add to the cert-manager controller pod.
        volumes: []
  
        # Additional volume mounts to add to the cert-manager controller container.
        volumeMounts: []
  
        # enableServiceLinks indicates whether information about services should be
        # injected into pod's environment variables, matching the syntax of Docker
        # links.
        enableServiceLinks: false
  
      # +docs:section=CA Injector
  
      cainjector:
        # Create the CA Injector deployment
        enabled: true
  
        # Number of replicas of the cert-manager cainjector to run.
        #
        # The default is 1, but in production you should set this to 2 or 3 to provide high
        # availability.
        #
        # If `replicas > 1` you should also consider setting `cainjector.podDisruptionBudget.enabled=true`.
        #
        # Note: cert-manager uses leader election to ensure that there can
        # only be a single instance active at a time.
        replicaCount: 1
  
        # Used to configure options for the cainjector pod.
        # This allows setting options that'd usually be provided via flags.
        # An APIVersion and Kind must be specified in your values.yaml file.
        # Flags will override options that are set here.
        #
        # For example:
        #  apiVersion: cainjector.config.cert-manager.io/v1alpha1
        #  kind: CAInjectorConfiguration
        #  logging:
        #   verbosity: 2
        #   format: text
        #  leaderElectionConfig:
        #   namespace: kube-system
        config: {}
  
        # Deployment update strategy for the cert-manager cainjector deployment.
        # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
        #
        # For example:
        #  strategy:
        #    type: RollingUpdate
        #    rollingUpdate:
        #      maxSurge: 0
        #      maxUnavailable: 1
        strategy: {}
  
        # Pod Security Context to be set on the cainjector component Pod
        # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
        # +docs:property
        securityContext:
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
  
        # Container Security Context to be set on the cainjector component container
        # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
        # +docs:property
        containerSecurityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
  
        podDisruptionBudget:
          # Enable or disable the PodDisruptionBudget resource
          #
          # This prevents downtime during voluntary disruptions such as during a Node upgrade.
          # For example, the PodDisruptionBudget will block `kubectl drain`
          # if it is used on the Node where the only remaining cert-manager
          # Pod is currently running.
          enabled: false
  
          # Configures the minimum available pods for disruptions. Can either be set to
          # an integer (e.g. 1) or a percentage value (e.g. 25%).
          # Cannot be used if `maxUnavailable` is set.
          # +docs:property
          # minAvailable: 1
  
          # Configures the maximum unavailable pods for disruptions. Can either be set to
          # an integer (e.g. 1) or a percentage value (e.g. 25%).
          # Cannot be used if `minAvailable` is set.
          # +docs:property
          # maxUnavailable: 1
  
        # Optional additional annotations to add to the cainjector Deployment
        # +docs:property
        # deploymentAnnotations: {}
  
        # Optional additional annotations to add to the cainjector Pods
        # +docs:property
        # podAnnotations: {}
  
        # Additional command line flags to pass to cert-manager cainjector binary.
        # To see all available flags run docker run quay.io/jetstack/cert-manager-cainjector:<version> --help
        extraArgs: []
        # Enable profiling for cainjector
        # - --enable-profiling=true
  
        # Comma separated list of feature gates that should be enabled on the
        # cainjector pod.
        featureGates: ""
  
        # Resources to provide to the cert-manager cainjector pod
        #
        # For example:
        #  requests:
        #    cpu: 10m
        #    memory: 32Mi
        #
        # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
        resources: {}
  
  
        # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
        # matching labels.
        # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
        #
        # This default ensures that Pods are only scheduled to Linux nodes.
        # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
        # +docs:property
        nodeSelector:
          kubernetes.io/os: linux
  
        # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core
        #
        # For example:
        #   affinity:
        #     nodeAffinity:
        #      requiredDuringSchedulingIgnoredDuringExecution:
        #        nodeSelectorTerms:
        #        - matchExpressions:
        #          - key: foo.bar.com/role
        #            operator: In
        #            values:
        #            - master
        affinity: {}
  
        # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core
        #
        # For example:
        #   tolerations:
        #   - key: foo.bar.com/role
        #     operator: Equal
        #     value: master
        #     effect: NoSchedule
        tolerations: []
  
        # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
        #
        # For example:
        #   topologySpreadConstraints:
        #   - maxSkew: 2
        #     topologyKey: topology.kubernetes.io/zone
        #     whenUnsatisfiable: ScheduleAnyway
        #     labelSelector:
        #       matchLabels:
        #         app.kubernetes.io/instance: cert-manager
        #         app.kubernetes.io/component: controller
        topologySpreadConstraints: []
  
        # Optional additional labels to add to the CA Injector Pods
        podLabels: {}
  
        image:
          # The container registry to pull the cainjector image from
          # +docs:property
          # registry: quay.io
  
          # The container image for the cert-manager cainjector
          # +docs:property
          repository: quay.io/jetstack/cert-manager-cainjector
  
          # Override the image tag to deploy by setting this variable.
          # If no value is set, the chart's appVersion will be used.
          # +docs:property
          # tag: vX.Y.Z
  
          # Setting a digest will override any tag
          # +docs:property
          # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
  
          # Kubernetes imagePullPolicy on Deployment.
          pullPolicy: IfNotPresent
  
        serviceAccount:
          # Specifies whether a service account should be created
          create: true
  
          # The name of the service account to use.
          # If not set and create is true, a name is generated using the fullname template
          # +docs:property
          # name: ""
  
          # Optional additional annotations to add to the controller's ServiceAccount
          # +docs:property
          # annotations: {}
  
          # Optional additional labels to add to the cainjector's ServiceAccount
          # +docs:property
          # labels: {}
  
          # Automount API credentials for a Service Account.
          automountServiceAccountToken: true
  
        # Automounting API credentials for a particular pod
        # +docs:property
        # automountServiceAccountToken: true
  
        # Additional volumes to add to the cert-manager controller pod.
        volumes: []
  
        # Additional volume mounts to add to the cert-manager controller container.
        volumeMounts: []
  
        # enableServiceLinks indicates whether information about services should be
        # injected into pod's environment variables, matching the syntax of Docker
        # links.
        enableServiceLinks: false
  
      # +docs:section=ACME Solver
  
      acmesolver:
        image:
          # The container registry to pull the acmesolver image from
          # +docs:property
          # registry: quay.io
  
          # The container image for the cert-manager acmesolver
          # +docs:property
          repository: quay.io/jetstack/cert-manager-acmesolver
  
          # Override the image tag to deploy by setting this variable.
          # If no value is set, the chart's appVersion will be used.
          # +docs:property
          # tag: vX.Y.Z
  
          # Setting a digest will override any tag
          # +docs:property
          # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
  
          # Kubernetes imagePullPolicy on Deployment.
          pullPolicy: IfNotPresent
  
      # +docs:section=Startup API Check
      # This startupapicheck is a Helm post-install hook that waits for the webhook
      # endpoints to become available.
      # The check is implemented using a Kubernetes Job - if you are injecting mesh
      # sidecar proxies into cert-manager pods, you probably want to ensure that they
      # are not injected into this Job's pod. Otherwise the installation may time out
      # due to the Job never being completed because the sidecar proxy does not exit.
      # See https://github.com/cert-manager/cert-manager/pull/4414 for context.
  
      startupapicheck:
        # Enables the startup api check
        enabled: true
  
        # Pod Security Context to be set on the startupapicheck component Pod
        # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
        # +docs:property
        securityContext:
          runAsNonRoot: true
          seccompProfile:
            type: RuntimeDefault
  
        # Container Security Context to be set on the controller component container
        # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
        # +docs:property
        containerSecurityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: true
  
        # Timeout for 'kubectl check api' command
        timeout: 1m
  
        # Job backoffLimit
        backoffLimit: 4
  
        # Optional additional annotations to add to the startupapicheck Job
        # +docs:property
        jobAnnotations:
          helm.sh/hook: post-install
          helm.sh/hook-weight: "1"
          helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  
        # Optional additional annotations to add to the startupapicheck Pods
        # +docs:property
        # podAnnotations: {}
  
        # Additional command line flags to pass to startupapicheck binary.
        # To see all available flags run docker run quay.io/jetstack/cert-manager-ctl:<version> --help
        #
        # We enable verbose logging by default so that if startupapicheck fails, users
        # can know what exactly caused the failure. Verbose logs include details of
        # the webhook URL, IP address and TCP connect errors for example.
        # +docs:property
        extraArgs:
        - -v
  
        # Resources to provide to the cert-manager controller pod
        #
        # For example:
        #  requests:
        #    cpu: 10m
        #    memory: 32Mi
        #
        # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
        resources: {}
  
  
        # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with
        # matching labels.
        # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
        #
        # This default ensures that Pods are only scheduled to Linux nodes.
        # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
        # +docs:property
        nodeSelector:
          kubernetes.io/os: linux
  
        # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core
        #
        # For example:
        #   affinity:
        #     nodeAffinity:
        #      requiredDuringSchedulingIgnoredDuringExecution:
        #        nodeSelectorTerms:
        #        - matchExpressions:
        #          - key: foo.bar.com/role
        #            operator: In
        #            values:
        #            - master
        affinity: {}
  
        # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core
        #
        # For example:
        #   tolerations:
        #   - key: foo.bar.com/role
        #     operator: Equal
        #     value: master
        #     effect: NoSchedule
        tolerations: []
  
        # Optional additional labels to add to the startupapicheck Pods
        podLabels: {}
  
        image:
          # The container registry to pull the startupapicheck image from
          # +docs:property
          # registry: quay.io
  
          # The container image for the cert-manager startupapicheck
          # +docs:property
          repository: quay.io/jetstack/cert-manager-startupapicheck
  
          # Override the image tag to deploy by setting this variable.
          # If no value is set, the chart's appVersion will be used.
          # +docs:property
          # tag: vX.Y.Z
  
          # Setting a digest will override any tag
          # +docs:property
          # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
  
          # Kubernetes imagePullPolicy on Deployment.
          pullPolicy: IfNotPresent
  
        rbac:
          # annotations for the startup API Check job RBAC and PSP resources
          # +docs:property
          annotations:
            helm.sh/hook: post-install
            helm.sh/hook-weight: "-5"
            helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  
        # Automounting API credentials for a particular pod
        # +docs:property
        # automountServiceAccountToken: true
  
        serviceAccount:
          # Specifies whether a service account should be created
          create: true
  
          # The name of the service account to use.
          # If not set and create is true, a name is generated using the fullname template
          # +docs:property
          # name: ""
  
          # Optional additional annotations to add to the Job's ServiceAccount
          # +docs:property
          annotations:
            helm.sh/hook: post-install
            helm.sh/hook-weight: "-5"
            helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
  
          # Automount API credentials for a Service Account.
          # +docs:property
          automountServiceAccountToken: true
  
          # Optional additional labels to add to the startupapicheck's ServiceAccount
          # +docs:property
          # labels: {}
  
        # Additional volumes to add to the cert-manager controller pod.
        volumes: []
  
        # Additional volume mounts to add to the cert-manager controller container.
        volumeMounts: []
  
        # enableServiceLinks indicates whether information about services should be
        # injected into pod's environment variables, matching the syntax of Docker
        # links.
        enableServiceLinks: false
  
  - name: ingress-nginx
    namespace: ingress-nginx
    create_namespace: true
    chart_ref: kube-forge/ingress-nginx
    chart_version: 4.10.1
    release_state: "present"
    values:
      commonLabels: {}
      controller:
        name: controller
        enableAnnotationValidations: false
        image:
          ## Keep false as default for now!
          chroot: false
          ## for backwards compatibility consider setting the full image url via the repository value below
          ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
          repository: registry.k8s.io/ingress-nginx/controller
          tag: "v1.9.4"
          digest: sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
          digestChroot: sha256:5976b1067cfbca8a21d0ba53d71f83543a73316a61ea7f7e436d6cf84ddf9b26
          pullPolicy: IfNotPresent
          # www-data -> uid 101
          runAsUser: 101
          allowPrivilegeEscalation: true
        # -- Use an existing PSP instead of creating one
        existingPsp: ""
        # -- Configures the controller container name
        containerName: controller
        # -- Configures the ports that the nginx-controller listens on
        containerPort:
          http: 80
          https: 443
        # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
        config: {}
        # -- Annotations to be added to the controller config configuration configmap.
        configAnnotations: {}
        # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers
        proxySetHeaders: {}
        # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers
        addHeaders: {}
        # -- Optionally customize the pod dnsConfig.
        dnsConfig: {}
        # -- Optionally customize the pod hostAliases.
        hostAliases: []
        # - ip: 127.0.0.1
        #   hostnames:
        #   - foo.local
        #   - bar.local
        # - ip: 10.1.2.3
        #   hostnames:
        #   - foo.remote
        #   - bar.remote
        # -- Optionally customize the pod hostname.
        hostname: {}
        # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.
        # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller
        # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.
        dnsPolicy: ClusterFirst
        # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
        # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
        reportNodeInternalIp: false
        # -- Process Ingress objects without ingressClass annotation/ingressClassName field
        # Overrides value for --watch-ingress-without-class flag of the controller binary
        # Defaults to false
        watchIngressWithoutClass: false
        # -- Process IngressClass per name (additionally as per spec.controller).
        ingressClassByName: false
        # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto"
        # Defaults to false
        enableTopologyAwareRouting: false
        # -- This configuration defines if Ingress Controller should allow users to set
        # their own *-snippet annotations, otherwise this is forbidden / dropped
        # when users add those annotations.
        # Global snippets in ConfigMap are still respected
        allowSnippetAnnotations: true
        # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),
        # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920
        # is merged
        hostNetwork: true
        ## Use host ports 80 and 443
        ## Disabled by default
        hostPort:
          # -- Enable 'hostPort' or not
          enabled: false
          ports:
            # -- 'hostPort' http port
            http: 80
            # -- 'hostPort' https port
            https: 443
        # NetworkPolicy for controller component.
        networkPolicy:
          # -- Enable 'networkPolicy' or not
          enabled: false
        # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'
        electionID: ""
        ## This section refers to the creation of the IngressClass resource
        ## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19
        ingressClassResource:
          # -- Name of the ingressClass
          name: nginx
          # -- Is this ingressClass enabled or not
          enabled: true
          # -- Is this the default ingressClass for the cluster
          default: false
          # -- Controller-value of the controller that is processing this ingressClass
          controllerValue: "k8s.io/ingress-nginx"
          # -- Parameters is a link to a custom resource containing additional
          # configuration for the controller. This is optional if the controller
          # does not require extra parameters.
          parameters: {}
        # -- For backwards compatibility with ingress.class annotation, use ingressClass.
        # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation
        ingressClass: nginx
        # -- Labels to add to the pod container metadata
        podLabels: {}
  
        # -- Security Context policies for controller pods
        podSecurityContext: {}
        # -- See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls
        sysctls: {}
        # sysctls:
        #   "net.core.somaxconn": "8192"
  
        # -- Allows customization of the source of the IP address or FQDN to report
        # in the ingress status field. By default, it reads the information provided
        # by the service. If disable, the status field reports the IP address of the
        # node or nodes where an ingress controller pod is running.
        publishService:
          # -- Enable 'publishService' or not
          enabled: true
          # -- Allows overriding of the publish service to bind to
          # Must be <namespace>/<service_name>
          pathOverride: ""
        # Limit the scope of the controller to a specific namespace
        scope:
          # -- Enable 'scope' or not
          enabled: false
          # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)
          namespace: ""
          # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels
          # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.
          namespaceSelector: ""
        # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)
        configMapNamespace: ""
        tcp:
          # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)
          configMapNamespace: ""
          # -- Annotations to be added to the tcp config configmap
          annotations: {}
        udp:
          # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)
          configMapNamespace: ""
          # -- Annotations to be added to the udp config configmap
          annotations: {}
        # -- Maxmind license key to download GeoLite2 Databases.
        ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases
        maxmindLicenseKey: ""
        # -- Additional command line arguments to pass to Ingress-Nginx Controller
        # E.g. to specify the default SSL certificate you can use
        extraArgs: {}
        ## extraArgs:
        ##   default-ssl-certificate: "<namespace>/<secret_name>"
  
        # -- Additional environment variables to set
        extraEnvs: []
        # extraEnvs:
        #   - name: FOO
        #     valueFrom:
        #       secretKeyRef:
        #         key: FOO
        #         name: secret-resource
  
        # -- Use a `DaemonSet` or `Deployment`
        kind: DaemonSet
        # -- Annotations to be added to the controller Deployment or DaemonSet
        ##
        annotations: {}
        #  keel.sh/pollSchedule: "@every 60m"
  
        # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels
        ##
        labels: {}
        #  keel.sh/policy: patch
        #  keel.sh/trigger: poll
  
        # -- The update strategy to apply to the Deployment or DaemonSet
        ##
        updateStrategy: {}
        #  rollingUpdate:
        #    maxUnavailable: 1
        #  type: RollingUpdate
  
        # -- `minReadySeconds` to avoid killing pods before we are ready
        ##
        minReadySeconds: 0
        # -- Node tolerations for server scheduling to nodes with taints
        ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
        ##
        tolerations: []
        #  - key: "key"
        #    operator: "Equal|Exists"
        #    value: "value"
        #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
  
        # -- Affinity and anti-affinity rules for server scheduling to nodes
        ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
        ##
        affinity: {}
        # # An example of preferred pod anti-affinity, weight is in the range 1-100
        # podAntiAffinity:
        #   preferredDuringSchedulingIgnoredDuringExecution:
        #   - weight: 100
        #     podAffinityTerm:
        #       labelSelector:
        #         matchExpressions:
        #         - key: app.kubernetes.io/name
        #           operator: In
        #           values:
        #           - ingress-nginx
        #         - key: app.kubernetes.io/instance
        #           operator: In
        #           values:
        #           - ingress-nginx
        #         - key: app.kubernetes.io/component
        #           operator: In
        #           values:
        #           - controller
        #       topologyKey: kubernetes.io/hostname
  
        # # An example of required pod anti-affinity
        # podAntiAffinity:
        #   requiredDuringSchedulingIgnoredDuringExecution:
        #   - labelSelector:
        #       matchExpressions:
        #       - key: app.kubernetes.io/name
        #         operator: In
        #         values:
        #         - ingress-nginx
        #       - key: app.kubernetes.io/instance
        #         operator: In
        #         values:
        #         - ingress-nginx
        #       - key: app.kubernetes.io/component
        #         operator: In
        #         values:
        #         - controller
        #     topologyKey: "kubernetes.io/hostname"
  
        # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.
        ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
        ##
        topologySpreadConstraints: []
  
        # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready
        ## wait up to five minutes for the drain of connections
        ##
        terminationGracePeriodSeconds: 300
        # -- Node labels for controller pod assignment
        ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
        ##
        nodeSelector:
          kubernetes.io/os: linux
        ## Liveness and readiness probe values
        ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
        ##
        ## startupProbe:
        ##   httpGet:
        ##     # should match container.healthCheckPath
        ##     path: "/healthz"
        ##     port: 10254
        ##     scheme: HTTP
        ##   initialDelaySeconds: 5
        ##   periodSeconds: 5
        ##   timeoutSeconds: 2
        ##   successThreshold: 1
        ##   failureThreshold: 5
        livenessProbe:
          httpGet:
            # should match container.healthCheckPath
            path: "/healthz"
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 1
          successThreshold: 1
          failureThreshold: 5
        readinessProbe:
          httpGet:
            # should match container.healthCheckPath
            path: "/healthz"
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 1
          successThreshold: 1
          failureThreshold: 3
        # -- Path of the health check endpoint. All requests received on the port defined by
        # the healthz-port parameter are forwarded internally to this path.
        healthCheckPath: "/healthz"
        # -- Address to bind the health check endpoint.
        # It is better to set this option to the internal node address
        # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.
        healthCheckHost: ""
        # -- Annotations to be added to controller pods
        ##
        podAnnotations: {}
        replicaCount: 1
        # -- Minimum available pods set in PodDisruptionBudget.
        # Define either 'minAvailable' or 'maxUnavailable', never both.
        minAvailable: 1
        # -- Maximum unavalaile pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
        # maxUnavailable: 1
  
        ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes
        ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903
        ## Ideally, there should be no limits.
        ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/
        resources:
          ##  limits:
          ##    cpu: 100m
          ##    memory: 90Mi
          requests:
            cpu: 100m
            memory: 90Mi
        # Mutually exclusive with keda autoscaling
        autoscaling:
          enabled: false
          annotations: {}
          minReplicas: 1
          maxReplicas: 11
          targetCPUUtilizationPercentage: 50
          targetMemoryUtilizationPercentage: 50
          behavior: {}
          # scaleDown:
          #   stabilizationWindowSeconds: 300
          #   policies:
          #   - type: Pods
          #     value: 1
          #     periodSeconds: 180
          # scaleUp:
          #   stabilizationWindowSeconds: 300
          #   policies:
          #   - type: Pods
          #     value: 2
          #     periodSeconds: 60
        autoscalingTemplate: []
        # Custom or additional autoscaling metrics
        # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
        # - type: Pods
        #   pods:
        #     metric:
        #       name: nginx_ingress_controller_nginx_process_requests_total
        #     target:
        #       type: AverageValue
        #       averageValue: 10000m
  
        # Mutually exclusive with hpa autoscaling
        keda:
          apiVersion: "keda.sh/v1alpha1"
          ## apiVersion changes with keda 1.x vs 2.x
          ## 2.x = keda.sh/v1alpha1
          ## 1.x = keda.k8s.io/v1alpha1
          enabled: false
          minReplicas: 1
          maxReplicas: 11
          pollingInterval: 30
          cooldownPeriod: 300
          # fallback:
          #   failureThreshold: 3
          #   replicas: 11
          restoreToOriginalReplicaCount: false
          scaledObject:
            annotations: {}
            # Custom annotations for ScaledObject resource
            #  annotations:
            # key: value
          triggers: []
          # - type: prometheus
          #   metadata:
          #     serverAddress: http://<prometheus-host>:9090
          #     metricName: http_requests_total
          #     threshold: '100'
          #     query: sum(rate(http_requests_total{deployment="my-deployment"}[2m]))
  
          behavior: {}
          # scaleDown:
          #   stabilizationWindowSeconds: 300
          #   policies:
          #   - type: Pods
          #     value: 1
          #     periodSeconds: 180
          # scaleUp:
          #   stabilizationWindowSeconds: 300
          #   policies:
          #   - type: Pods
          #     value: 2
          #     periodSeconds: 60
        # -- Enable mimalloc as a drop-in replacement for malloc.
        ## ref: https://github.com/microsoft/mimalloc
        ##
        enableMimalloc: true
        ## Override NGINX template
        customTemplate:
          configMapName: ""
          configMapKey: ""
        service:
          enabled: true
          # -- If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were
          # using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
          # It allows choosing the protocol for each backend specified in the Kubernetes service.
          # See the following GitHub issue for more details about the purpose: https://github.com/kubernetes/kubernetes/issues/40244
          # Will be ignored for Kubernetes versions older than 1.20
          ##
          appProtocol: true
          # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine.
          annotations: {}
          labels: {}
          # clusterIP: ""
  
          # -- List of IP addresses at which the controller services are available
          ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
          ##
          externalIPs: []
          # -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
          loadBalancerIP: ""
          loadBalancerSourceRanges: []
          # -- Used by cloud providers to select a load balancer implementation other than the cloud provider default. https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class
          loadBalancerClass: ""
          enableHttp: true
          enableHttps: true
          ## Set external traffic policy to: "Local" to preserve source IP on providers supporting it.
          ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer
          # externalTrafficPolicy: ""
  
          ## Must be either "None" or "ClientIP" if set. Kubernetes will default to "None".
          ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
          # sessionAffinity: ""
  
          ## Specifies the health check node port (numeric port number) for the service. If healthCheckNodePort isn’t specified,
          ## the service controller allocates a port from your cluster’s NodePort range.
          ## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
          # healthCheckNodePort: 0
  
          # -- Represents the dual-stack-ness requested or required by this Service. Possible values are
          # SingleStack, PreferDualStack or RequireDualStack.
          # The ipFamilies and clusterIPs fields depend on the value of this field.
          ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/
          ipFamilyPolicy: "SingleStack"
          # -- List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically
          # based on cluster configuration and the ipFamilyPolicy field.
          ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/
          ipFamilies:
            - IPv4
          ports:
            http: 80
            https: 443
          targetPorts:
            http: http
            https: https
          type: ""
          # type: NodePort
          # nodePorts:
          #   http: 32080
          #   https: 32443
          #   tcp:
          #     8080: 32808
          nodePorts:
            http: ""
            https: ""
            tcp: {}
            udp: {}
          external:
            enabled: true
          internal:
            # -- Enables an additional internal load balancer (besides the external one).
            enabled: false
            # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine.
            annotations: {}
            # -- Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS.
            loadBalancerIP: ""
            # -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0.
            loadBalancerSourceRanges: []
            ## Set external traffic policy to: "Local" to preserve source IP on
            ## providers supporting it
            ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer
            # externalTrafficPolicy: ""
  
            # -- Custom port mapping for internal service
            ports: {}
            #  http: 80
            #  https: 443
  
            # -- Custom target port mapping for internal service
            targetPorts: {}
            #  http: http
            #  https: https
        # shareProcessNamespace enables process namespace sharing within the pod.
        # This can be used for example to signal log rotation using `kill -USR1` from a sidecar.
        shareProcessNamespace: false
        # -- Additional containers to be added to the controller pod.
        # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.
        extraContainers: []
        #  - name: my-sidecar
        #    image: nginx:latest
        #  - name: lemonldap-ng-controller
        #    image: lemonldapng/lemonldap-ng-controller:0.2.0
        #    args:
        #      - /lemonldap-ng-controller
        #      - --alsologtostderr
        #      - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration
        #    env:
        #      - name: POD_NAME
        #        valueFrom:
        #          fieldRef:
        #            fieldPath: metadata.name
        #      - name: POD_NAMESPACE
        #        valueFrom:
        #          fieldRef:
        #            fieldPath: metadata.namespace
        #    volumeMounts:
        #    - name: copy-portal-skins
        #      mountPath: /srv/var/lib/lemonldap-ng/portal/skins
  
        # -- Additional volumeMounts to the controller main container.
        extraVolumeMounts: []
        #  - name: copy-portal-skins
        #   mountPath: /var/lib/lemonldap-ng/portal/skins
  
        # -- Additional volumes to the controller pod.
        extraVolumes: []
        #  - name: copy-portal-skins
        #    emptyDir: {}
  
        # -- Containers, which are run before the app containers are started.
        extraInitContainers: []
        # - name: init-myservice
        #   image: busybox
        #   command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;']
  
        # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module
        extraModules: []
        # - name: mytestmodule
        #   image: registry.k8s.io/ingress-nginx/mytestmodule
        #   containerSecurityContext:
        #     allowPrivilegeEscalation: false
        #
        # The image must contain a `/usr/local/bin/init_module.sh` executable, which
        # will be executed as initContainers, to move its config files within the
        # mounted volume.
  
        opentelemetry:
          enabled: false
          image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
          containerSecurityContext:
            allowPrivilegeEscalation: false
          resources: {}
        admissionWebhooks:
          annotations: {}
          # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem".
  
          ## Additional annotations to the admission webhooks.
          ## These annotations will be added to the ValidatingWebhookConfiguration and
          ## the Jobs Spec of the admission webhooks.
          enabled: false
          # -- Additional environment variables to set
          extraEnvs: []
          # extraEnvs:
          #   - name: FOO
          #     valueFrom:
          #       secretKeyRef:
          #         key: FOO
          #         name: secret-resource
          # -- Admission Webhook failure policy to use
          failurePolicy: Fail
          # timeoutSeconds: 10
          port: 8443
          certificate: "/usr/local/certificates/cert"
          key: "/usr/local/certificates/key"
          namespaceSelector: {}
          objectSelector: {}
          # -- Labels to be added to admission webhooks
          labels: {}
          # -- Use an existing PSP instead of creating one
          existingPsp: ""
          service:
            annotations: {}
            # clusterIP: ""
            externalIPs: []
            # loadBalancerIP: ""
            loadBalancerSourceRanges: []
            servicePort: 443
            type: ClusterIP
          createSecretJob:
            securityContext:
              allowPrivilegeEscalation: false
            resources: {}
            # limits:
            #   cpu: 10m
            #   memory: 20Mi
            # requests:
            #   cpu: 10m
            #   memory: 20Mi
          patchWebhookJob:
            securityContext:
              allowPrivilegeEscalation: false
            resources: {}
          patch:
            enabled: true
            image:
              registry: registry.k8s.io
              image: ingress-nginx/kube-webhook-certgen
              ## for backwards compatibility consider setting the full image url via the repository value below
              ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
              ## repository:
              tag: v20231011-8b53cabe0
              digest: sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80
              pullPolicy: IfNotPresent
            # -- Provide a priority class name to the webhook patching job
            ##
            priorityClassName: ""
            podAnnotations: {}
            nodeSelector:
              kubernetes.io/os: linux
            tolerations: []
            # -- Labels to be added to patch job resources
            labels: {}
            securityContext:
              runAsNonRoot: true
              runAsUser: 2000
              fsGroup: 2000
          # Use certmanager to generate webhook certs
          certManager:
            enabled: false
            # self-signed root certificate
            rootCert:
              # default to be 5y
              duration: ""
            admissionCert:
              # default to be 1y
              duration: ""
              # issuerRef:
              #   name: "issuer"
              #   kind: "ClusterIssuer"
        metrics:
          port: 10254
          portName: metrics
          # if this port is changed, change healthz-port: in extraArgs: accordingly
          enabled: false
          service:
            annotations: {}
            # prometheus.io/scrape: "true"
            # prometheus.io/port: "10254"
            # -- Labels to be added to the metrics service resource
            labels: {}
            # clusterIP: ""
  
            # -- List of IP addresses at which the stats-exporter service is available
            ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
            ##
            externalIPs: []
            # loadBalancerIP: ""
            loadBalancerSourceRanges: []
            servicePort: 10254
            type: ClusterIP
            # externalTrafficPolicy: ""
            # nodePort: ""
          serviceMonitor:
            enabled: false
            additionalLabels: {}
            ## The label to use to retrieve the job name from.
            ## jobLabel: "app.kubernetes.io/name"
            namespace: ""
            namespaceSelector: {}
            ## Default: scrape .Release.Namespace or namespaceOverride only
            ## To scrape all, use the following:
            ## namespaceSelector:
            ##   any: true
            scrapeInterval: 30s
            # honorLabels: true
            targetLabels: []
            relabelings: []
            metricRelabelings: []
          prometheusRule:
            enabled: false
            additionalLabels: {}
            # namespace: ""
            rules: []
            # # These are just examples rules, please adapt them to your needs
            # - alert: NGINXConfigFailed
            #   expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0
            #   for: 1s
            #   labels:
            #     severity: critical
            #   annotations:
            #     description: bad ingress config - nginx config test failed
            #     summary: uninstall the latest ingress changes to allow config reloads to resume
            # - alert: NGINXCertificateExpiry
            #   expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds) by (host) - time()) < 604800
            #   for: 1s
            #   labels:
            #     severity: critical
            #   annotations:
            #     description: ssl certificate(s) will expire in less then a week
            #     summary: renew expiring certificates to avoid downtime
            # - alert: NGINXTooMany500s
            #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
            #   for: 1m
            #   labels:
            #     severity: warning
            #   annotations:
            #     description: Too many 5XXs
            #     summary: More than 5% of all requests returned 5XX, this requires your attention
            # - alert: NGINXTooMany400s
            #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
            #   for: 1m
            #   labels:
            #     severity: warning
            #   annotations:
            #     description: Too many 4XXs
            #     summary: More than 5% of all requests returned 4XX, this requires your attention
        # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:
        # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds
        # to 300, allowing the draining of connections up to five minutes.
        # If the active connections end before that, the pod will terminate gracefully at that time.
        # To effectively take advantage of this feature, the Configmap feature
        # worker-shutdown-timeout new value is 240s instead of 10s.
        ##
        lifecycle:
          preStop:
            exec:
              command:
                - /wait-shutdown
        priorityClassName: ""
      # -- Rollback limit
      ##
      revisionHistoryLimit: 10
      ## Default 404 backend
      ##
      defaultBackend:
        ##
        enabled: false
        name: defaultbackend
        image:
          ## for backwards compatibility consider setting the full image url via the repository value below
          ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
          repository: registry.k8s.io/defaultbackend-amd64
          tag: "1.5"
          pullPolicy: IfNotPresent
          # nobody user -> uid 65534
          runAsUser: 65534
          runAsNonRoot: true
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
        # -- Use an existing PSP instead of creating one
        existingPsp: ""
        extraArgs: {}
        serviceAccount:
          create: true
          name: ""
          automountServiceAccountToken: true
        # -- Additional environment variables to set for defaultBackend pods
        extraEnvs: []
        port: 8080
        ## Readiness and liveness probes for default backend
        ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
        ##
        livenessProbe:
          failureThreshold: 3
          initialDelaySeconds: 30
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 5
        readinessProbe:
          failureThreshold: 6
          initialDelaySeconds: 0
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 5
        # -- The update strategy to apply to the Deployment or DaemonSet
        ##
        updateStrategy: {}
        #  rollingUpdate:
        #    maxUnavailable: 1
        #  type: RollingUpdate
  
        # -- `minReadySeconds` to avoid killing pods before we are ready
        ##
        minReadySeconds: 0
        # -- Node tolerations for server scheduling to nodes with taints
        ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
        ##
        tolerations: []
        #  - key: "key"
        #    operator: "Equal|Exists"
        #    value: "value"
        #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
  
        affinity: {}
        # -- Security Context policies for controller pods
        # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
        # notes on enabling and using sysctls
        ##
        podSecurityContext: {}
        # -- Security Context policies for controller main container.
        # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
        # notes on enabling and using sysctls
        ##
        containerSecurityContext: {}
        # -- Labels to add to the pod container metadata
        podLabels: {}
        # -- Node labels for default backend pod assignment
        ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
        ##
        nodeSelector:
          kubernetes.io/os: linux
        # -- Annotations to be added to default backend pods
        ##
        podAnnotations: {}
        replicaCount: 1
        minAvailable: 1
        resources: {}
        # limits:
        #   cpu: 10m
        #   memory: 20Mi
        # requests:
        #   cpu: 10m
        #   memory: 20Mi
  
        extraVolumeMounts: []
        ## Additional volumeMounts to the default backend container.
        #  - name: copy-portal-skins
        #   mountPath: /var/lib/lemonldap-ng/portal/skins
  
        extraVolumes: []
        ## Additional volumes to the default backend pod.
        #  - name: copy-portal-skins
        #    emptyDir: {}
  
        autoscaling:
          annotations: {}
          enabled: false
          minReplicas: 1
          maxReplicas: 2
          targetCPUUtilizationPercentage: 50
          targetMemoryUtilizationPercentage: 50
        # NetworkPolicy for default backend component.
        networkPolicy:
          # -- Enable 'networkPolicy' or not
          enabled: false
        service:
          annotations: {}
          # clusterIP: ""
  
          # -- List of IP addresses at which the default backend service is available
          ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
          ##
          externalIPs: []
          # loadBalancerIP: ""
          loadBalancerSourceRanges: []
          servicePort: 80
          type: ClusterIP
        priorityClassName: ""
        # -- Labels to be added to the default backend resources
        labels: {}
      ## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266
      rbac:
        create: true
        scope: false
      ## If true, create & use Pod Security Policy resources
      ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
      podSecurityPolicy:
        enabled: false
      serviceAccount:
        create: true
        name: ""
        automountServiceAccountToken: true
        # -- Annotations for the controller service account
        annotations: {}
      # -- Optional array of imagePullSecrets containing private registry credentials
      ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
      imagePullSecrets: []
      # - name: secretName
  
      # -- TCP service key-value pairs
      ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
      ##
      tcp: {}
      #  8080: "default/example-tcp-svc:9000"
  
      # -- UDP service key-value pairs
      ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
      ##
      udp: {}
      #  53: "kube-system/kube-dns:53"
  
      # -- Prefix for TCP and UDP ports names in ingress controller service
      ## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration
      portNamePrefix: ""
      # -- (string) A base64-encoded Diffie-Hellman parameter.
      # This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`
      ## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param
      dhParam: ""
  
  - name: csi-secrets-store
    namespace: kube-system
    chart_ref: kube-forge/secrets-store-csi-driver
    chart_version: 1.4.3
    release_state: "present"
    values:
      linux:
        enabled: true
        image:
          repository: registry.k8s.io/csi-secrets-store/driver
          tag: v1.4.3
          #digest: sha256:
          pullPolicy: IfNotPresent
  
        crds:
          enabled: true
          image:
            repository: registry.k8s.io/csi-secrets-store/driver-crds
            tag: v1.4.3
            pullPolicy: IfNotPresent
          ## Optionally override resource limits for crd hooks(jobs)
          resources: {}
            # requests:
            #   cpu: "100m"
            #   memory: "128Mi"
            # limits:
            #   cpu: "500m"
            #   memory: "512Mi"
          annotations: {}
          podLabels: {}
  
        ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                    - key: type
                      operator: NotIn
                      values:
                        - virtual-kubelet
  
        driver:
          resources:
            limits:
              cpu: 200m
              memory: 200Mi
            requests:
              cpu: 50m
              memory: 100Mi
  
        registrarImage:
          repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
          tag: v2.10.0
          #digest: sha256:
          pullPolicy: IfNotPresent
  
        registrar:
          resources:
            limits:
              cpu: 100m
              memory: 100Mi
            requests:
              cpu: 10m
              memory: 20Mi
          logVerbosity: 5
  
        livenessProbeImage:
          repository: registry.k8s.io/sig-storage/livenessprobe
          tag: v2.12.0
          #digest: sha256:
          pullPolicy: IfNotPresent
  
        livenessProbe:
          resources:
            limits:
              cpu: 100m
              memory: 100Mi
            requests:
              cpu: 10m
              memory: 20Mi
  
        updateStrategy:
          type: RollingUpdate
          rollingUpdate:
            maxUnavailable: 1
  
        kubeletRootDir: /var/lib/kubelet
        providersDir: /var/run/secrets-store-csi-providers
        additionalProvidersDirs:
          - /etc/kubernetes/secrets-store-csi-providers
        nodeSelector: {}
        # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
        # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
        tolerations:
          - operator: "Exists"
        metricsAddr: ":8095"
        env: []
        priorityClassName: ""
        daemonsetAnnotations: {}
        podAnnotations: {}
        podLabels: {}
  
        # volumes is a list of volumes made available to secrets store csi driver.
        volumes: null
        #   - name: foo
        #     emptyDir: {}
  
        # volumeMounts is a list of volumeMounts for secrets store csi driver.
        volumeMounts: null
        #   - name: foo
        #     mountPath: /bar
        #     readOnly: true
  
      windows:
        enabled: false
        image:
          repository: registry.k8s.io/csi-secrets-store/driver
          tag: v1.4.3
          #digest: sha256:
          pullPolicy: IfNotPresent
  
        ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                    - key: type
                      operator: NotIn
                      values:
                        - virtual-kubelet
  
        driver:
          resources:
            limits:
              cpu: 400m
              memory: 400Mi
            requests:
              cpu: 100m
              memory: 100Mi
  
        registrarImage:
          repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
          tag: v2.10.0
          #digest: sha256:
          pullPolicy: IfNotPresent
  
        registrar:
          resources:
            limits:
              cpu: 200m
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
          logVerbosity: 5
  
        livenessProbeImage:
          repository: registry.k8s.io/sig-storage/livenessprobe
          tag: v2.12.0
          #digest: sha256:
          pullPolicy: IfNotPresent
  
        livenessProbe:
          resources:
            limits:
              cpu: 200m
              memory: 200Mi
            requests:
              cpu: 100m
              memory: 100Mi
  
        updateStrategy:
          type: RollingUpdate
          rollingUpdate:
            maxUnavailable: 1
  
        kubeletRootDir: C:\var\lib\kubelet
        providersDir: C:\\k\\secrets-store-csi-providers
        additionalProvidersDirs:
        nodeSelector: {}
        # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
        # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
        tolerations:
          - operator: "Exists"
        metricsAddr: ":8095"
        env: []
        priorityClassName: ""
        daemonsetAnnotations: {}
        podAnnotations: {}
        podLabels: {}
  
        # volumes is a list of volumes made available to secrets store csi driver.
        volumes: null
        #   - name: foo
        #     emptyDir: {}
  
        # volumeMounts is a list of volumeMounts for secrets store csi driver.
        volumeMounts: null
        #   - name: foo
        #     mountPath: /bar
        #     readOnly: true
  
      # log level. Uses V logs (klog)
      logVerbosity: 0
  
      # logging format JSON
      logFormatJSON: false
  
      livenessProbe:
        port: 9808
        logLevel: 2
  
      ## Maximum size in bytes of gRPC response from plugins
      maxCallRecvMsgSize: 4194304
  
      ## Install Default RBAC roles and bindings
      rbac:
        install: true
        pspEnabled: false
  
      ## Install RBAC roles and bindings required for K8S Secrets syncing if true
      syncSecret:
        enabled: false
  
      ## Enable secret rotation feature [alpha]
      enableSecretRotation: false
  
      ## Secret rotation poll interval duration
      rotationPollInterval:
  
      ## Provider HealthCheck
      providerHealthCheck: false
  
      ## Provider HealthCheck interval
      providerHealthCheckInterval: 2m
  
      imagePullSecrets: []
  
      ## This allows CSI drivers to impersonate the pods that they mount the volumes for.
      # refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
      # Supported only for Kubernetes v1.20+
      tokenRequests: []
      # - audience: aud1
      # - audience: aud2
  
      # -- Labels to apply to all resources
      commonLabels: {}
      # team_name: dev
  - name: fluent-operator
    namespace: observability
    create_namespace: true
    chart_ref: kube-forge/fluent-operator
    chart_version: 2.7.0
    release_state: "present"
    values:
      # Set this to containerd or crio if you want to collect CRI format logs
      containerRuntime: containerd
      Kubernetes: false
  
      operator:
        initcontainer:
          repository: "harbor.kvazaric.ru/kube-forge/docker"
          tag: "20.10"
  
          resources:
            limits:
              cpu: 100m
              memory: 100Mi
  
            requests:
              cpu: 50m
              memory: 64Mi
        container:
          repository: "harbor.kvazaric.ru/kube-forge/kubesphere/fluent-operator"
          tag: "v2.7.0"
        resources:
          limits:
            cpu: 100m
            memory: 100Mi
          requests:
            cpu: 100m
            memory: 60Mi
        imagePullSecrets: []
        labels: {}
        logPath:
          # The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
          # crio: /var/log
          containerd: /var/log
        disableComponentControllers: ""
  
      fluentbit:
        crdsEnable: true
        enable: false
  
      fluentd:
        crdsEnable: true
        enable: false
        name: fluentd
        # Valid modes include "collector" and "agent".
        # The "collector" mode will deploy Fluentd as a StatefulSet as before.
        # The new "agent" mode will deploy Fluentd as a DaemonSet.
        mode: "agent"
        port: 24224
        image:
          repository: "harbor.kvazaric.ru/kube-forge/kubesphere/fluentd"
          tag: "v1.15.3"
  
      nameOverride: ""
      fullnameOverride: ""
      namespaceOverride: ""
  
  - name: opentelemetry-operator
    namespace: observability
    create_namespace: true
    chart_ref: kube-forge/opentelemetry-operator
    chart_version: 0.55.0
    release_state: "present"
    values:
      replicaCount: 1
      nameOverride: ""
      imagePullSecrets: []
      pdb:
        create: false
        minAvailable: 1
        maxUnavailable: ""
  
      manager:
        image:
          repository: ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator
          tag: ""
        collectorImage:
          repository: harbor.kvazaric.ru/kube-forge/otel/opentelemetry-collector-contrib
          tag: 0.95.0
  
        featureGates: ""
        ports:
          metricsPort: 8080
          webhookPort: 9443
          healthzPort: 8081
        resources:
          limits:
            cpu: 100m
            memory: 128Mi
          requests:
            cpu: 100m
            memory: 64Mi
        env:
          ENABLE_WEBHOOKS: "true"
  
        serviceAccount:
          create: true
          annotations: {}
  
        serviceMonitor:
          enabled: true
          metricsEndpoints:
            - port: metrics
  
        prometheusRule:
          enabled: true
          groups: []
          defaultRules:
            enabled: true
  
        extraArgs: []
  
        leaderElection:
          enabled: true
  
        verticalPodAutoscaler:
          enabled: false
          controlledResources: []
          maxAllowed: {}
          minAllowed: {}
  
          updatePolicy:
            updateMode: Auto
            minReplicas: 2
        rolling: false
  
        securityContext: {}
  
      kubeRBACProxy:
        enabled: true
        image:
          repository: quay.io/brancz/kube-rbac-proxy
          tag: v0.15.0
        ports:
          proxyPort: 8443
        resources:
          limits:
            cpu: 500m
            memory: 128Mi
          requests:
            cpu: 5m
            memory: 64Mi
  
        extraArgs: []
  
        securityContext: {}
  
      admissionWebhooks:
        create: true
        servicePort: 443
        failurePolicy: Fail
        secretName: ""
        pods:
          failurePolicy: Ignore
  
        namePrefix: ""
  
        timeoutSeconds: 10
  
        namespaceSelector: {}
        objectSelector: {}
        certManager:
          enabled: true
          issuerRef: {}
          certificateAnnotations: {}
          issuerAnnotations: {}
  
        autoGenerateCert:
          enabled: true
          recreate: true
  
        secretAnnotations: {}
        secretLabels: {}
  
      role:
        create: true
  
      clusterRole:
        create: true
  
      affinity: {}
      tolerations: []
      nodeSelector: {}
      topologySpreadConstraints: []
      hostNetwork: false
  
      priorityClassName: ""
  
      securityContext:
        runAsGroup: 65532
        runAsNonRoot: true
        runAsUser: 65532
        fsGroup: 65532
  
      testFramework:
        image:
          repository: busybox
          tag: latest
  
  - name: metrics-server
    namespace: kube-system
    create_namespace: true
    chart_ref: kube-forge/metrics-server
    chart_version: 3.12.1
    release_state: "present"
    values:
      image:
        repository: registry.k8s.io/metrics-server/metrics-server
        tag: ""
        pullPolicy: IfNotPresent
  
      imagePullSecrets: []
      # - name: registrySecretName
  
      nameOverride: ""
      fullnameOverride: ""
  
      serviceAccount:
        # Specifies whether a service account should be created
        create: true
        # Annotations to add to the service account
        annotations: {}
        # The name of the service account to use.
        # If not set and create is true, a name is generated using the fullname template
        name: ""
        # The list of secrets mountable by this service account.
        # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
        secrets: []
  
      rbac:
        # Specifies whether RBAC resources should be created
        create: true
        pspEnabled: false
  
      apiService:
        create: true
        # Annotations to add to the API service
        annotations: {}
        # Specifies whether to skip TLS verification
        insecureSkipTLSVerify: true
        # The PEM encoded CA bundle for TLS verification
        caBundle: ""
  
      commonLabels: {}
      podLabels:
        "app.kubernetes.io/component": "metrics-server"
      podAnnotations: {}
  
      podSecurityContext: {}
  
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        runAsNonRoot: true
        runAsUser: 1000
        seccompProfile:
          type: RuntimeDefault
        capabilities:
          drop:
            - ALL
  
      priorityClassName: system-cluster-critical
  
      containerPort: 10250
  
      hostNetwork:
        # Specifies if metrics-server should be started in hostNetwork mode.
        #
        # You would require this enabled if you use alternate overlay networking for pods and
        # API server unable to communicate with metrics-server. As an example, this is required
        # if you use Weave network on EKS
        enabled: false
  
      replicas: 1
  
      revisionHistoryLimit:
  
      updateStrategy: {}
      #   type: RollingUpdate
      #   rollingUpdate:
      #     maxSurge: 0
      #     maxUnavailable: 1
  
      podDisruptionBudget:
        # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
        enabled: false
        minAvailable:
        maxUnavailable:
  
      defaultArgs:
        - --cert-dir=/tmp
        - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
        - --kubelet-use-node-status-port
        - --metric-resolution=15s
        - --kubelet-insecure-tls
  
      args: []
  
      livenessProbe:
        httpGet:
          path: /livez
          port: https
          scheme: HTTPS
        initialDelaySeconds: 0
        periodSeconds: 10
        failureThreshold: 3
  
      readinessProbe:
        httpGet:
          path: /readyz
          port: https
          scheme: HTTPS
        initialDelaySeconds: 20
        periodSeconds: 10
        failureThreshold: 3
  
      service:
        type: ClusterIP
        port: 443
        annotations: {}
        labels: {}
        #  Add these labels to have metrics-server show up in `kubectl cluster-info`
        #  kubernetes.io/cluster-service: "true"
        #  kubernetes.io/name: "Metrics-server"
  
      addonResizer:
        enabled: false
        image:
          repository: registry.k8s.io/autoscaling/addon-resizer
          tag: 1.8.20
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
          seccompProfile:
            type: RuntimeDefault
          capabilities:
            drop:
              - ALL
        resources:
          requests:
            cpu: 40m
            memory: 25Mi
          limits:
            cpu: 40m
            memory: 25Mi
        nanny:
          cpu: 0m
          extraCpu: 1m
          memory: 0Mi
          extraMemory: 2Mi
          minClusterSize: 100
          pollPeriod: 300000
          threshold: 5
  
      metrics:
        enabled: true
  
      serviceMonitor:
        enabled: true
        additionalLabels: {}
        interval: 1m
        scrapeTimeout: 10s
        metricRelabelings: []
        relabelings: []
  
      # See https://github.com/kubernetes-sigs/metrics-server#scaling
      resources:
        requests:
          cpu: 100m
          memory: 200Mi
        # limits:
        #   cpu:
        #   memory:
  
      extraVolumeMounts: []
  
      extraVolumes: []
  
      nodeSelector: {}
  
      tolerations: []
  
      affinity: {}
  
      topologySpreadConstraints: []
  
      dnsConfig: {}
  
      # Annotations to add to the deployment
      deploymentAnnotations: {}
  
      schedulerName: ""
  
      tmpVolume:
        emptyDir: {}
  
  
  - name: tempo
    namespace: observability
    create_namespace: true
    chart_ref: kube-forge/tempo
    chart_version: 1.7.2
    release_state: "present"
    values:
      replicas: 1
  
      tempo:
        repository: harbor.kvazaric.ru/kube-forge/grafana/tempo
        tag: "2.3.1"
        pullPolicy: IfNotPresent
  
        updateStrategy: RollingUpdate
  
        memBallastSizeMbs: 1024
        multitenancyEnabled: false
        reportingEnabled: false
  
        metricsGenerator:
          enabled: false
          remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
        retention: 24h
        global_overrides:
          per_tenant_override_config: /conf/overrides.yaml
  
        server:
          http_listen_port: 3100
        storage:
          trace:
            backend: local
            local:
              path: /var/tempo/traces
            wal:
              path: /var/tempo/wal
        receivers:
          otlp:
            protocols:
              grpc:
                endpoint: "0.0.0.0:4317"
              http:
                endpoint: "0.0.0.0:4318"
  
      tempoQuery:
        repository: harbor.kvazaric.ru/kube-forge/grafana/tempo-query
        tag: 2.3.1
        pullPolicy: IfNotPresent
  
        enabled: true
  
        service:
          port: 16686
  
        ingress:
          enabled: false
  
      serviceAccount:
        create: true
        automountServiceAccountToken: true
  
      service:
        type: ClusterIP
  
      serviceMonitor:
        enabled: true
  
      persistence:
        enabled: true
        storageClassName: local-path
        accessModes:
          - ReadWriteOnce
        size: 10Gi
  
      priorityClassName: null
  
  - name: loki
    namespace: observability
    create_namespace: true
    chart_ref: kube-forge/loki
    chart_version: 5.47.2
    release_state: "present"
    values:
      loki:
        image:
          registry: harbor.kvazaric.ru
          repository: kube-forge/grafana/loki
          tag: latest
        podAnnotations:
          app.kubernetes.io/component: "loki"
        auth_enabled: false
        commonConfig:
          replication_factor: 1
        storage:
          type: 'filesystem'
  
        frontend:
          max_outstanding_per_tenant: 10000
  
        limits_config:
          reject_old_samples: false
          split_queries_by_interval: 15m
          max_query_parallelism: 32
          max_query_series: 10000
          retention_period: 168h
  
        compactor:
          compaction_interval: 10m
          retention_enabled: true
          retention_delete_delay: 2h
  
        querier:
          max_concurrent: 2048
  
        query_scheduler:
          max_outstanding_requests_per_tenant: 10000
  
        rulerConfig:
          storage:
            type: local
            local:
              directory: /var/loki/rules
          rule_path: /tmp/rules
  
          alertmanager_url: http://observability-alert-manager:9093
  
  
      singleBinary:
        replicas: 1
  
        extraVolumes:
          - name: loki-default-rules
            configMap:
              name: loki-default-alerting-rules
  
        extraVolumeMounts:
          - name: loki-default-rules
            mountPath: /var/loki/rules
  
  
      write:
        persistence:
          volumeClaimsEnabled: true
          storageClass: "local-path"
          size: 10Gi
  
      test:
        enabled: false
  
      gateway:
        enabled: false
  
      monitoring:
        selfMonitoring:
          enabled: false
          grafanaAgent:
            installOperator: false
        lokiCanary:
          enabled: false
        rules:
          enabled: true
          alerting: true
          additionalGroups: {}
  
      extraObjects:
        - apiVersion: v1
          kind: ConfigMap
          metadata:
            name: loki-default-alerting-rules
            labels:
              loki_rule: ""
  
          data:
            loki-default-alerting-rules.yaml: |-
              groups:
                - name: kube-events-alerts
                  rules:
                    - alert: FailedEventsOccured
                      expr: |
                        count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
                      for: 1m
                      labels:
                        severity: critical
                      annotations:
                        alertname: FailedEventsOccured
                        instance: kube-cluster
                        jobName: kube_events
                        summary: Failed events occured in cluster
                        addDefaultUrl: "true"
  
                    - alert: OOMKilledEventsOccured
                      expr: |
                        count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
                      for: 1m
                      labels:
                        severity: critical
                      annotations:
                        alertname: OOMKilledEventsOccured
                        instance: kube-cluster
                        jobName: kube_events
                        summary: OOMKilled events occured in cluster
                        addDefaultUrl: "true"
  
                    - alert: EvictedEventsOccured
                      expr: |
                        count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
                      for: 1m
                      labels:
                        severity: critical
                      annotations:
                        alertname: EvictedEventsOccured
                        instance: kube-cluster
                        jobName: kube_events
                        summary: Evicted events occured in cluster
                        addDefaultUrl: "true"
  
                    - alert: ImagePullBackOffEventsOccured
                      expr: |
                        count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
                      for: 1m
                      labels:
                        severity: critical
                      annotations:
                        alertname: ImagePullBackOffEventsOccured
                        instance: kube-cluster
                        jobName: kube_events
                        summary: ImagePullBackOff events occured in cluster
                        addDefaultUrl: "true"
  
                    - alert: BackOffEventsOccured
                      expr: |
                        count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
                      for: 1m
                      labels:
                        severity: critical
                      annotations:
                        alertname: BackOffEventsOccured
                        instance: kube-cluster
                        jobName: kube_events
                        summary: BackOff events occured in cluster
                        addDefaultUrl: "true"
      sidecar:
        rules:
          enabled: true
          # -- Label that the configmaps/secrets with rules will be marked with.
          label: loki_rule
          # -- Label value that the configmaps/secrets with rules will be set to.
          labelValue: ""
          # -- Folder into which the rules will be placed.
          folder: /var/loki/rules
          # -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
          # Otherwise the namespace in which the sidecar is running will be used.
          # It's also possible to specify 'ALL' to search in all namespaces.
          searchNamespace: 'ALL'
          # -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
          watchMethod: WATCH
          # -- Search in configmap, secret, or both.
          resource: both
          # -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
          script: null
          # -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
          # defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
          watchServerTimeout: 60
          #
          # -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
          # If you have a network outage dropping all packets with no RST/FIN,
          # this is how long your client waits before realizing & dropping the connection.
          # Defaults to 66sec.
          watchClientTimeout: 60
          # -- Log level of the sidecar container.
          logLevel: INFO
  
  - name: observability
    namespace: observability
    create_namespace: true
    chart_ref: kube-forge/observability
    chart_version: 0.1.0
    release_state: "present"
    values:
      prometheus:
        enabled: true
        serviceMonitor: true
        image:
          repository: harbor.kvazaric.ru/kube-forge/prom/prometheus
          tag: v2.45.0
          pullPolicy: IfNotPresent
  
        clustering:
          enabled: false
          replicas: 3
          shards: 1
  
        persistence:
          enabled: true
  
          storageClassName: "local-path"
          storageResources:
            requests:
              storage: 3Gi
  
        scrapeInterval: 15s
        retention: 7d
        # serviceNodePort: 30008
  
        additionalConfigs: |
          - job_name: "kubelet"
            scheme: https
            metrics_path: /metrics/cadvisor
            tls_config:
              insecure_skip_verify: true
            authorization:
              credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
            kubernetes_sd_configs:
              - role: node
            relabel_configs:
              - action: labelmap
                regex: __meta_kubernetes_node_label_(.+)
  
          - job_name: "kubernetes-apiservers"
            kubernetes_sd_configs:
              - role: endpoints
            scheme: https
            tls_config:
              ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
            authorization:
              credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
            relabel_configs:
              - source_labels:
                  [
                    __meta_kubernetes_namespace,
                    __meta_kubernetes_service_name,
                    __meta_kubernetes_endpoint_port_name,
                  ]
                action: keep
                regex: default;kubernetes;https
  
          - job_name: "coredns"
            kubernetes_sd_configs:
              - role: endpoints
            scheme: http
            relabel_configs:
              - source_labels:
                  [
                    __meta_kubernetes_namespace,
                    __meta_kubernetes_service_name,
                    __meta_kubernetes_endpoint_port_name,
                  ]
                action: keep
                regex: kube-system;.*dns.*;metrics
  
          - job_name: 'ingress-endpoints'
            metrics_path: /probe
            params:
              module: [https_ok]
            kubernetes_sd_configs:
              - role: ingress
            relabel_configs:
              - source_labels: [__address__]
                target_label: __param_target
              - source_labels: [__param_target]
                target_label: instance
              - source_labels:
                  [
                    __meta_kubernetes_ingress_scheme,
                    __address__,
                    __meta_kubernetes_ingress_path,
                  ]
                regex: (.+);(.+);(.+)
                replacement: https://${2}${3}
                target_label: __param_target
              - target_label: __address__
                replacement: observability-blackbox-exporter:9115
  
      alertManager:
        enabled: true
        serviceMonitor: true
        enableDefaultRules: true
        image:
          repository: harbor.kvazaric.ru/kube-forge/prom/alertmanager
          tag: "v0.26.0"
          pullPolicy: IfNotPresent
  
        # serviceNodePort: 30009
  
        configPath: /etc/alertmanager
        route:
          group_wait: 1s
          receiver: kvazaric_notifications
          repeat_interval: 180m
          routes:
          - group_by:
            - alertname
            group_wait: 1s
            matchers:
            - fireOnce=true
            receiver: kvazaric_notifications
            repeat_interval: 8737h
        receivers:
          - name: kvazaric_notifications
            telegram_configs:
            - api_url: https://api.telegram.org
              bot_token: 6364937365:AAHcJKc-McN11gBWuQqoM87zr18eK0VKX9I
              chat_id: -968770779
              http_config:
                enable_http2: false
                follow_redirects: true
              message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw
                %}'
              parse_mode: HTML
              send_resolved: true
  
      blackboxExporter:
        enabled: true
        serviceMonitor: true
        image:
          repository: harbor.kvazaric.ru/kube-forge/prom/blackbox-exporter
          tag: "v0.24.0"
          pullPolicy: IfNotPresent
  
        # serviceNodePort: 30012
  
        configPath: /etc/blackbox_exporter
        additionalModules:
  
  
      kubeStateMetrics:
        enabled: true
        image:
          repository: harbor.kvazaric.ru/kube-forge/bitnami/kube-state-metrics
          tag: "2.9.2"
          pullPolicy: IfNotPresent
        resources:
          requests:
            cpu: 30m
            memory: 120Mi
          limits:
            memory: 240Mi
            cpu: 60m
  
      prometheusOperator:
        enabled: true
        image:
          repository: ghcr.io/prometheus-operator/prometheus-operator
          tag: v0.65.2
          pullPolicy: IfNotPresent
  
        prometheusConfigReloader:
          image:
            repository: ghcr.io/prometheus-operator/prometheus-config-reloader
            tag: v0.65.2
            pullPolicy: IfNotPresent
  
        kubeRbacProxy:
          image:
            repository: harbor.kvazaric.ru/kube-forge/bitnami/kube-rbac-proxy
            tag: 0.14.1
            pullPolicy: IfNotPresent
  
      nodeExporter:
        enabled: true
        image:
          repository: harbor.kvazaric.ru/kube-forge/prom/node-exporter
          tag: v1.5.0
          pullPolicy: IfNotPresent
  
      kubeEventsExporter:
        enabled: true
        image:
          repository: ghcr.io/resmoio/kubernetes-event-exporter
          tag: v1.4
          pullPolicy: IfNotPresent
        lokiAddress: http://loki.observability.svc.cluster.local:3100
        logLevel: warn
        logFormat: json
        kubeQPS: 100
        kubeBurst: 500
        maxEventAgeSeconds: 120
        metricsNamePrefix: event_exporter_
  
        cron:
          restartSchedule: "*/2 * * * *"
          image:
            repository: harbor.kvazaric.ru/kube-forge/bitnami/kubectl
            tag: 1.27.5-debian-11-r8
            pullPolicy: IfNotPresent
        additionalRoutes:
        additionalReceivers:
  
      grafana:
        enabled: true
        serviceMonitor: true
        domain: &grafanaDomain grafana.disk.lt.t1.cloud
        path: /
        image:
          repository: harbor.kvazaric.ru/kube-forge/grafana
          tag: 10.4.1-v2
          pullPolicy: IfNotPresent
  
        storageClassName: "local-path"
        storageResources:
          requests:
            storage: 2Gi
  
        config:
          server: |
            enable_gzip = true
            root_url = https://grafana.disk.lt.t1.cloud/
  
          security: |
            admin_user = admin
            admin_password = changeit
  
          auth: |
            
  
          authGenericAuth: |
            
  
          additionalDatasources:
            - name: Kube-loki
              type: loki
              uid: P2895588539814C92
              access: proxy
              url: http://loki:3100
              editable: false
              basicAuth: false
              isDefault: false
              jsonData:
                maxLines: 1000
            - name: Kube-jaeger-query
              type: jaeger
              access: proxy
              url: http://tempo:16686
              editable: false
              basicAuth: false
              isDefault: false
  
      opentelemetryCollector:
        enabled: true
        serviceMonitor: true
        config: |
          receivers:
            otlp:
              protocols:
                grpc:
                http:
          exporters:
            otlphttp:
              endpoint: http://tempo:4318
          service:
            telemetry:
              logs:
                level: "debug"
            pipelines:
              traces:
                receivers: [otlp]
                exporters: [otlphttp]
  
      ingress:
        enabled: true
        accountEmail: adminmail@gmail.com
        class: nginx
        annotations:
          nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
          nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
          nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
        tls:
          enabled: true
          hosts:
            - host: grafana.disk.lt.t1.cloud
              secretName: grafana-tls
  
      containerRuntime: containerd
  
      fluentbit:
        enable: true
        serviceMonitor: true
        image:
          repository: "harbor.kvazaric.ru/kube-forge/kubesphere/fluent-bit"
          tag: "v2.2.2"
  
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                    - key: node-role.kubernetes.io/edge
                      operator: DoesNotExist
        tolerations:
          - operator: Exists
  
        input:
          tail:
            enable: true
            refreshIntervalSeconds: 10
            memBufLimit: 100MB
            bufferMaxSize: ""
            path: "/var/log/containers/*.log"
            skipLongLines: true
            readFromHead: false
            storageType: memory
            pauseOnChunksOverlimit: "off"
          systemd:
            enable: true
            systemdFilter:
              enable: true
              filters: []
            path: "/var/log/journal"
            includeKubelet: true
            stripUnderscores: "off"
            storageType: memory
            pauseOnChunksOverlimit: "off"
  
          nodeExporterMetrics: {}
          fluentBitMetrics: {}
  
        output:
          es:
            enable: false
            host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
            port: 9200
            logstashPrefix: ks-logstash-log
            bufferSize: 20MB
            traceError: true
          kafka:
            enable: false
            brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
            topics: ks-log
          opentelemetry: {}
          opensearch:
            enable: false
          stdout:
            enable: false
          loki:
            enable: true
            host: loki
            port: 3100
  
          stackdriver: {}
  
        service:
          storage: {}
  
        filter:
          kubernetes:
            enable: true
            labels: true
            annotations: true
          containerd:
            enable: true
          systemd:
            enable: true
  
        kubeedge:
          enable: false
          prometheusRemoteWrite:
            # Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
            host: "<cloud-prometheus-service-host>"
            # Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
            port: "<cloud-prometheus-service-port>"
  
  - name: harbor-certificate-generator
    namespace: registry
    create_namespace: true
    chart_ref: kube-forge/certificate-generator
    chart_version: 0.1.0
    release_state: "present"
    values:
      issuer_email: adminmail@gmail.com
      solver_ingress_class: nginx
  
      certificates:
        - name: harbor-tls
          domain: harbor.disk.lt.t1.cloud
  
  - name: harbor
    namespace: registry
    create_namespace: true
    chart_ref: kube-forge/harbor
    chart_version: 1.14.2
    release_state: "present"
    values:
      expose:
        type: ingress
        tls:
          enabled: true
          certSource: secret
          secret:
            secretName: harbor-tls
        ingress:
          hosts:
            core: harbor.disk.lt.t1.cloud
          controller: default
          kubeVersionOverride: ""
          className: "nginx"
          annotations:
            ingress.kubernetes.io/ssl-redirect: "true"
            ingress.kubernetes.io/proxy-body-size: "0"
            nginx.ingress.kubernetes.io/ssl-redirect: "true"
            nginx.ingress.kubernetes.io/proxy-body-size: "0"
          labels: {}
  
        nodePort:
          name: harbor
          ports:
            http:
              port: 80
              nodePort: 30002
            https:
              port: 443
              nodePort: 30003
  
      externalURL: https://harbor.disk.lt.t1.cloud
      persistence:
        resourcePolicy: "keep"
        persistentVolumeClaim:
          registry:
            existingClaim: ""
            storageClass: "local-path"
            subPath: ""
            accessMode: ReadWriteOnce
            size: 10Gi
            annotations: {}
          jobservice:
            jobLog:
              existingClaim: ""
              storageClass: "local-path"
              subPath: ""
              accessMode: ReadWriteOnce
              size: 1Gi
              annotations: {}
          database:
            existingClaim: ""
            storageClass: "local-path"
            subPath: ""
            accessMode: ReadWriteOnce
            size: 2Gi
            annotations: {}
          redis:
            existingClaim: ""
            storageClass: "local-path"
            subPath: ""
            accessMode: ReadWriteOnce
            size: 1Gi
            annotations: {}
          trivy:
            existingClaim: ""
            storageClass: "local-path"
            subPath: ""
            accessMode: ReadWriteOnce
            size: 5Gi
            annotations: {}
  
        imageChartStorage:
          disableredirect: false
  
          type: filesystem
          filesystem:
            rootdirectory: /storage
            #maxthreads: 100
  
      imagePullPolicy: IfNotPresent
  
      updateStrategy:
        type: RollingUpdate
  
      harborAdminPassword: "changeit"
  
      logLevel: info
  
      metrics:
        enabled: true
        core:
          path: /metrics
          port: 8001
        registry:
          path: /metrics
          port: 8001
        jobservice:
          path: /metrics
          port: 8001
        exporter:
          path: /metrics
          port: 8001
  
        serviceMonitor:
          enabled: true
  
      trace:
        enabled: true
        provider: otel
        sample_rate: 1
        attributes:
          application: harbor
        jaeger:
          endpoint: http://hostname:14268/api/traces
        otel:
          endpoint: observability-opentelemetry-collector-collector.observability.svc.k8s-cluster.local:4318
          url_path: /v1/traces
          compression: false
          insecure: true
          timeout: 10
  
      portal:
        image:
          repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-portal
          tag: v2.10.1
        serviceAccountName: ""
        automountServiceAccountToken: false
        replicas: 1
        revisionHistoryLimit: 10
  
        topologySpreadConstraints: []
  
        podLabels:
          "app.kubernetes.io/component": "harbor-portal"
        priorityClassName:
  
      core:
        image:
          repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-core
          tag: v2.10.1
        serviceAccountName: ""
        automountServiceAccountToken: false
        replicas: 1
        revisionHistoryLimit: 10
        startupProbe:
          enabled: true
          initialDelaySeconds: 10
        extraEnvVars: []
        nodeSelector: {}
        tolerations: []
        affinity: {}
        topologySpreadConstraints: []
        podLabels:
          "app.kubernetes.io/component": "harbor-core"
        serviceAnnotations: {}
        priorityClassName:
        configureUserSettings:
        quotaUpdateProvider: db # Or redis
        secret: ""
        existingSecret: ""
        secretName: ""
        tokenKey: ""
  
        tokenCert: ""
  
        xsrfKey: ""
        existingXsrfSecret: ""
        existingXsrfSecretKey: CSRF_KEY
        artifactPullAsyncFlushDuration:
        gdpr:
          deleteUser: false
          auditLogsCompliant: false
  
  
      jobservice:
        image:
          repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-jobservice
          tag: v2.10.1
        serviceAccountName: ""
        automountServiceAccountToken: false
        replicas: 1
        revisionHistoryLimit: 10
        topologySpreadConstraints:
        podLabels:
          "app.kubernetes.io/component": "harbor-jobservice"
        priorityClassName:
        maxJobWorkers: 10
        jobLoggers:
          - file
          # - database
          # - stdout
        loggerSweeperDuration: 14 #days
        notification:
          webhook_job_max_retry: 3
          webhook_job_http_client_timeout: 3 # in seconds
        reaper:
          max_update_hours: 24
          max_dangling_hours: 168
        secret: ""
        existingSecret: ""
        existingSecretKey: JOBSERVICE_SECRET
  
      registry:
        registry:
          image:
            repository: harbor.kvazaric.ru/kube-forge/goharbor/registry-photon
            tag: v2.10.1
          extraEnvVars: []
        controller:
          image:
            repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-registryctl
            tag: v2.10.1
          extraEnvVars: []
        serviceAccountName: ""
        automountServiceAccountToken: false
        replicas: 1
        revisionHistoryLimit: 10
        topologySpreadConstraints: []
        podLabels:
          "app.kubernetes.io/component": "harbor-registry"
        priorityClassName:
        secret: ""
        existingSecret: ""
        existingSecretKey: REGISTRY_HTTP_SECRET
        relativeurls: false
        credentials:
          # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
          existingSecret: ""
          # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
          # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
          # htpasswdString: ""
        middleware:
          enabled: false
          type: cloudFront
          cloudFront:
            baseurl: example.cloudfront.net
            keypairid: KEYPAIRID
            duration: 3000s
            ipfilteredby: none
            # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
            # that allows access to CloudFront
            privateKeySecret: "my-secret"
        # enable purge _upload directories
        upload_purging:
          enabled: true
          # remove files in _upload directories which exist for a period of time, default is one week.
          age: 168h
          # the interval of the purge operations
          interval: 24h
          dryrun: false
  
      trivy:
        enabled: true
        image:
          repository: harbor.kvazaric.ru/kube-forge/goharbor/trivy-adapter-photon
          tag: v2.10.1
        serviceAccountName: ""
        automountServiceAccountToken: false
        resources:
          requests:
            cpu: 200m
            memory: 512Mi
          limits:
            cpu: 1
            memory: 1Gi
  
  
      database:
        # if external database is used, set "type" to "external"
        # and fill the connection information in "external" section
        type: internal
        internal:
          image:
            repository: harbor.kvazaric.ru/kube-forge/goharbor/harbor-db
            tag: v2.10.1
          serviceAccountName: ""
          automountServiceAccountToken: false
          livenessProbe:
            timeoutSeconds: 1
          readinessProbe:
            timeoutSeconds: 1
          priorityClassName:
          # The initial superuser password for internal database
          # password: "changeit"
          # The size limit for Shared memory, pgSQL use it for shared_buffer
          # More details see:
          # https://github.com/goharbor/harbor/issues/15034
          shmSizeLimit: 512Mi
          initContainer:
            migrator: {}
            # resources:
            #  requests:
            #    memory: 128Mi
            #    cpu: 100m
            permissions: {}
            # resources:
            #  requests:
            #    memory: 128Mi
            #    cpu: 100m
        external:
          host: "192.168.0.1"
          port: "5432"
          username: "user"
          password: "password"
          coreDatabase: "registry"
          # if using existing secret, the key must be "password"
          existingSecret: ""
          # "disable" - No SSL
          # "require" - Always SSL (skip verification)
          # "verify-ca" - Always SSL (verify that the certificate presented by the
          # server was signed by a trusted CA)
          # "verify-full" - Always SSL (verify that the certification presented by the
          # server was signed by a trusted CA and the server host name matches the one
          # in the certificate)
          sslmode: "disable"
        # The maximum number of connections in the idle connection pool per pod (core+exporter).
        # If it <=0, no idle connections are retained.
        maxIdleConns: 100
        # The maximum number of open connections to the database per pod (core+exporter).
        # If it <= 0, then there is no limit on the number of open connections.
        # Note: the default number of connections is 1024 for postgre of harbor.
        maxOpenConns: 900
        ## Additional deployment annotations
        podAnnotations: {}
        ## Additional deployment labels
        podLabels: {}
  
  
      redis:
        type: internal
        internal:
          image:
            repository: harbor.kvazaric.ru/kube-forge/goharbor/redis-photon
            tag: v2.10.1
          serviceAccountName: ""
          automountServiceAccountToken: false
          extraEnvVars: []
          nodeSelector: {}
          tolerations: []
          affinity: {}
          priorityClassName:
          jobserviceDatabaseIndex: "1"
          registryDatabaseIndex: "2"
          trivyAdapterIndex: "5"
          # harborDatabaseIndex: "6"
          # cacheLayerDatabaseIndex: "7"
        external:
          # support redis, redis+sentinel
          # addr for redis: <host_redis>:<port_redis>
          # addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
          addr: "192.168.0.2:6379"
          # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
          sentinelMasterSet: ""
          # The "coreDatabaseIndex" must be "0" as the library Harbor
          # used doesn't support configuring it
          # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
          # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
          coreDatabaseIndex: "0"
          jobserviceDatabaseIndex: "1"
          registryDatabaseIndex: "2"
          trivyAdapterIndex: "5"
          # harborDatabaseIndex: "6"
          # cacheLayerDatabaseIndex: "7"
          # username field can be an empty string, and it will be authenticated against the default user
          username: ""
          password: ""
          existingSecret: ""
        podAnnotations: {}
        podLabels: {}
  
  - name: argo-cd
    namespace: cicd
    create_namespace: true
    chart_ref: kube-forge/argo-cd
    chart_version: 6.7.10
    release_state: "present"
    values:
      crds:
        install: true
  
      global:
        repository: quay.io/argoproj/argocd
        tag: latest
  
      server:
        image:
          repository: quay.io/argoproj/argocd
          tag: latest
        certificateSecret:
          enabled: false
  
        metrics:
          enabled: true
          serviceMonitor:
            enabled: true
  
      redis:
        image:
          repository: public.ecr.aws/docker/library/redis
          tag: 7.2.4-alpine
        exporter:
          enabled: true
          image:
            repository: public.ecr.aws/bitnami/redis-exporter
            tag: 1.58.0
        metrics:
          enabled: true
          serviceMonitor:
            enabled: true
  
      controller:
        image:
          repository: quay.io/argoproj/argocd
          tag: latest
        replicas: 1
        metrics:
          enabled: true
          serviceMonitor:
            enabled: true
  
      applicationSet:
        image:
          repository: quay.io/argoproj/argocd
          tag: latest
        metrics:
          enabled: true
          serviceMonitor:
            enabled: true
  
      dex:
        image:
          repository: ghcr.io/dexidp/dex
          tag: v2.38.0
        metrics:
          enabled: true
          ## check later
          serviceMonitor:
            enabled: false
  
      repoServer:
        image:
          repository: quay.io/argoproj/argocd
          tag: latest
        metrics:
          enabled: true
          serviceMonitor:
            enabled: true
  
      notifications:
        image:
          repository: quay.io/argoproj/argocd
          tag: latest
        metrics:
          enabled: true
          serviceMonitor:
            enabled: true
  
      configs:
        params:
          server.insecure: true
  
        secret:
          argocdServerAdminPassword: $2a$10$Nlkv3tEZauAtWk8BUbloqujTETrG7n1rlJmRXJAxz4xiZRRRtgfO6
  
        repositories:
          # add default helm-repository from harbor
          null
  
        cm:
          create: true
          url: "https://argocd.disk.lt.t1.cloud"
  
          accounts.developer: login
          accounts.guest: login
  
          # oidc.config: ""
  
        rbac:
          create: true
          policy.csv: |
            p, role:admin, applications, create, */*, allow
            p, role:admin, applications, update, */*, allow
            p, role:admin, applications, delete, */*, allow
            p, role:admin, applications, sync, */*, allow
            p, role:admin, applications, override, */*, allow
            p, role:admin, applications, action/*, */*, allow
            p, role:admin, applicationsets, get, */*, allow
            p, role:admin, applicationsets, create, */*, allow
            p, role:admin, applicationsets, update, */*, allow
            p, role:admin, applicationsets, delete, */*, allow
            p, role:admin, certificates, create, *, allow
            p, role:admin, certificates, update, *, allow
            p, role:admin, certificates, delete, *, allow
            p, role:admin, clusters, create, *, allow
            p, role:admin, clusters, update, *, allow
            p, role:admin, clusters, delete, *, allow
            p, role:admin, repositories, create, *, allow
            p, role:admin, repositories, update, *, allow
            p, role:admin, repositories, delete, *, allow
            p, role:admin, projects, create, *, allow
            p, role:admin, projects, update, *, allow
            p, role:admin, projects, delete, *, allow
            p, role:admin, accounts, update, *, allow
            p, role:admin, gpgkeys, create, *, allow
            p, role:admin, gpgkeys, delete, *, allow
            p, role:admin, exec, create, */*, allow
  
  
          policy.default: role:''
          # scopes: "[roles,email,groups]"
  
  - name: argo-rollouts
    namespace: cicd
    create_namespace: true
    chart_ref: kube-forge/argo-rollouts
    chart_version: 2.35.1
    release_state: "present"
    values:
      installCRDs: true
      keepCRDs: false
      clusterInstall: true
      createClusterAggregateRoles: true
  
      apiVersionOverrides:
        # -- String to override apiVersion of ingresses rendered by this helm chart
        ingress: "" # networking.k8s.io/v1beta1
  
      # -- Override the Kubernetes version, which is used to evaluate certain manifests
      kubeVersionOverride: ""
  
      # -- Additional manifests to deploy within the chart. A list of objects.
      ## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
      extraObjects: []
        # - apiVersion: v1
        #   kind: Secret
        #   metadata:
        #     name: datadog
        #   type: Opaque
        #   data:
        #     address: https://api.datadoghq.com
        #     api-key: <datadog-api-key>
        #     app-key: <datadog-app-key>
  
      global:
        # -- Annotations for all deployed Deployments
        deploymentAnnotations: {}
  
      controller:
        # -- Value of label `app.kubernetes.io/component`
        component: rollouts-controller
        # -- Annotations to be added to the controller deployment
        deploymentAnnotations: {}
        # -- Annotations to be added to application controller pods
        podAnnotations: {}
        # -- [Node selector]
        nodeSelector: {}
        # -- [Tolerations] for use with node taints
        tolerations: []
        # -- Assign custom [affinity] rules to the deployment
        affinity: {}
        logging:
          # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
          level: info
          # -- Set the klog logging level
          kloglevel: "0"
          # -- Set the logging format (one of: `text`, `json`)
          format: "text"
  
        # -- Assign custom [TopologySpreadConstraints] rules to the controller
        ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
        ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
        topologySpreadConstraints: []
        # - maxSkew: 1
        #   topologyKey: topology.kubernetes.io/zone
        #   whenUnsatisfiable: DoNotSchedule
  
        # -- [priorityClassName] for the controller
        priorityClassName: ""
        # -- The number of controller pods to run
        replicas: 1
        image:
          # -- Registry to use
          registry: quay.io
          # -- Repository to use
          repository: argoproj/argo-rollouts
          # -- Overrides the image tag (default is the chart appVersion)
          tag: latest
          # -- Image pull policy
          pullPolicy: IfNotPresent
  
        # -- flag to enable creation of cluster controller role (requires cluster RBAC)
        createClusterRole: true
  
        # Controller container ports
        containerPorts:
          # -- Metrics container port
          metrics: 8090
          # -- Healthz container port
          healthz: 8080
        metrics:
          # -- Deploy metrics service
          enabled: true
          service:
            # -- Metrics service port name
            portName: metrics
            # -- Metrics service port
            port: 8090
            # -- Service annotations
            annotations: {}
          serviceMonitor:
            # -- Enable a prometheus ServiceMonitor
            enabled: true
            # -- Namespace to be used for the ServiceMonitor
            namespace: ""
            # -- Labels to be added to the ServiceMonitor
            additionalLabels: {}
            # -- Annotations to be added to the ServiceMonitor
            additionalAnnotations: {}
            # -- RelabelConfigs to apply to samples before scraping
            relabelings: []
            # -- MetricRelabelConfigs to apply to samples before ingestion
            metricRelabelings: []
  
        # -- Configure liveness [probe] for the controller
        # @default -- See [values.yaml]
        livenessProbe:
          httpGet:
            path: /healthz
            port: healthz
          initialDelaySeconds: 30
          periodSeconds: 20
          failureThreshold: 3
          successThreshold: 1
          timeoutSeconds: 10
  
        # -- Configure readiness [probe] for the controller
        # @default -- See [values.yaml]
        readinessProbe:
          httpGet:
            path: /metrics
            port: metrics
          initialDelaySeconds: 15
          periodSeconds: 5
          failureThreshold: 3
          successThreshold: 1
          timeoutSeconds: 4
  
        ## Configure Pod Disruption Budget for the controller
        pdb:
          # -- Labels to be added to controller [Pod Disruption Budget]
          labels: {}
          # -- Annotations to be added to controller [Pod Disruption Budget]
          annotations: {}
          # -- Deploy a [Pod Disruption Budget] for the controller
          enabled: false
          # -- Minimum number / percentage of pods that should remain scheduled
          minAvailable: # 1
          # -- Maximum number / percentage of pods that may be made unavailable
          maxUnavailable: # 0
  
        # -- Additional volumes to add to the controller pod
        volumes: []
          # - configMap:
          #     name: my-certs-cm
          #   name: my-certs
  
        # -- Additional volumeMounts to add to the controller container
        volumeMounts: []
          # - mountPath: /etc/ssl/certs
          #   name: my-certs
  
        # -- Configures 3rd party metric providers for controller
        ## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
        metricProviderPlugins: {}
          # metricProviderPlugins: |-
          #   - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
          #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
  
        # -- Configures 3rd party traffic router plugins for controller
        ## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
        trafficRouterPlugins: {}
          # trafficRouterPlugins: |-
          #   - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
          #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
  
      serviceAccount:
        # -- Specifies whether a service account should be created
        create: true
        # -- Annotations to add to the service account
        annotations: {}
        # -- The name of the service account to use.
        # If not set and create is true, a name is generated using the fullname template
        name: ""
  
      # -- Annotations to be added to all CRDs
      crdAnnotations: {}
  
      # -- Annotations for the all deployed pods
      podAnnotations: {}
  
      # -- Security Context to set on pod level
      podSecurityContext:
        runAsNonRoot: true
  
      # -- Security Context to set on container level
      containerSecurityContext: {}
        # capabilities:
        #   drop:
        #   - ALL
        # readOnlyRootFilesystem: true
        # runAsNonRoot: true
        # runAsUser: 1000
  
      # -- Annotations to be added to the Rollout service
      serviceAnnotations: {}
  
      # -- Labels to be added to the Rollout pods
      podLabels: {}
  
      # -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
      imagePullSecrets: []
      # - name: argo-pull-secret
  
      providerRBAC:
        # -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
        enabled: true
        # providerRBAC.enabled must be true in order to toggle the individual providers
        providers:
          # -- Adds RBAC rules for the Istio provider
          istio: true
          # -- Adds RBAC rules for the SMI provider
          smi: true
          # -- Adds RBAC rules for the Ambassador provider
          ambassador: true
          # -- Adds RBAC rules for the AWS Load Balancer Controller provider
          awsLoadBalancerController: true
          # -- Adds RBAC rules for the AWS App Mesh provider
          awsAppMesh: true
          # -- Adds RBAC rules for the Traefik provider
          traefik: true
          # -- Adds RBAC rules for the Apisix provider
          apisix: true
          # -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
          contour: true
          # -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
          glooPlatform: true
        # -- Additional RBAC rules for others providers
        additionalRules: []
  
      dashboard:
        # -- Deploy dashboard server
        enabled: true
        # -- Set cluster role to readonly
        readonly: false
        # -- Value of label `app.kubernetes.io/component`
        component: rollouts-dashboard
        # -- Annotations to be added to the dashboard deployment
        deploymentAnnotations: {}
        # -- Annotations to be added to application dashboard pods
        podAnnotations: {}
        # -- [Node selector]
        nodeSelector: {}
        # -- [Tolerations] for use with node taints
        tolerations: []
        # -- Assign custom [affinity] rules to the deployment
        affinity: {}
        logging:
          # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
          level: info
          # -- Set the klog logging level
          kloglevel: "0"
  
        # -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
        ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
        ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
        topologySpreadConstraints: []
        # - maxSkew: 1
        #   topologyKey: topology.kubernetes.io/zone
        #   whenUnsatisfiable: DoNotSchedule
  
        # -- [priorityClassName] for the dashboard server
        priorityClassName: ""
  
        # -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
        createClusterRole: true
  
        # -- The number of dashboard pods to run
        replicas: 1
        image:
          # -- Registry to use
          registry: quay.io
          # --  Repository to use
          repository: argoproj/kubectl-argo-rollouts
          # -- Overrides the image tag (default is the chart appVersion)
          tag: ""
          # -- Image pull policy
          pullPolicy: IfNotPresent
        # -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
        extraArgs: []
        # -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
        extraEnv: []
          # - name: FOO
          #   value: bar
        # -- Resource limits and requests for the dashboard pods.
        resources: {}
        # -- Security Context to set on pod level
        podSecurityContext:
          runAsNonRoot: true
        # -- Security Context to set on container level
        containerSecurityContext: {}
        service:
          # -- Sets the type of the Service
          type: ClusterIP
          nodePort:
          # -- LoadBalancer will get created with the IP specified in this field
          loadBalancerIP: ""
          # -- Source IP ranges to allow access to service from
          loadBalancerSourceRanges: []
          # -- Dashboard service external IPs
          externalIPs: []
          # -- Service annotations
          annotations: {}
          # -- Service labels
          labels: {}
          # -- Service port name
          portName: dashboard
          # -- Service port
          port: 3100
          # -- Service target port
          targetPort: 3100
          # -- (int) Service nodePort
  
        serviceAccount:
          # -- Specifies whether a dashboard service account should be created
          create: true
          # -- Annotations to add to the dashboard service account
          annotations: {}
          # -- The name of the service account to use.
          # If not set and create is true, a name is generated using the fullname template
          name: ""
  
        ## Configure Pod Disruption Budget for the dashboard
        pdb:
          # -- Labels to be added to dashboard [Pod Disruption Budget]
          labels: {}
          # -- Annotations to be added to dashboard [Pod Disruption Budget]
          annotations: {}
          # -- Deploy a [Pod Disruption Budget] for the dashboard
          enabled: false
          # -- Minimum number / percentage of pods that should remain scheduled
          minAvailable: # 1
          # -- Maximum number / percentage of pods that may be made unavailable
          maxUnavailable: # 0
  
        ## Ingress configuration.
        ## ref: https://kubernetes.io/docs/user-guide/ingress/
        ##
        ingress:
          # -- Enable dashboard ingress support
          enabled: false
          # -- Dashboard ingress annotations
          annotations: {}
          # -- Dashboard ingress labels
          labels: {}
          # -- Dashboard ingress class name
          ingressClassName: ""
  
          # -- Dashboard ingress hosts
          ## Argo Rollouts Dashboard Ingress.
          ## Hostnames must be provided if Ingress is enabled.
          ## Secrets must be manually created in the namespace
          hosts: []
            # - argorollouts.example.com
  
          # -- Dashboard ingress paths
          paths:
            - /
          # -- Dashboard ingress path type
          pathType: Prefix
          # -- Dashboard ingress extra paths
          extraPaths: []
            # - path: /*
            #   backend:
            #     serviceName: ssl-redirect
            #     servicePort: use-annotation
            ## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
            # - path: /*
            #   pathType: Prefix
            #   backend:
            #     service
            #       name: ssl-redirect
            #       port:
            #         name: use-annotation
  
          # -- Dashboard ingress tls
          tls: []
            # - secretName: argorollouts-example-tls
            #   hosts:
            #     - argorollouts.example.com
  
        # -- Additional volumes to add to the dashboard pod
        volumes: []
  
        # -- Additional volumeMounts to add to the dashboard container
        volumeMounts: []
  
      notifications:
        secret:
          # -- Whether to create notifications secret
          create: false
          # -- Generic key:value pairs to be inserted into the notifications secret
          items: {}
            # slack-token:
  
        # -- Configures notification services
        notifiers: {}
          # service.slack: |
          #   token: $slack-token
  
        # -- Notification templates
        templates: {}
  
        # -- The trigger defines the condition when the notification should be sent
        triggers: {}
          # trigger.on-purple: |
          #   - send: [my-purple-template]
          #     when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'
  
  - name: keel
    namespace: kube-system
    chart_ref: kube-forge/keel
    chart_version: 1.0.3
    release_state: "present"
    values:
      image:
        repository: harbor.kvazaric.ru/kube-forge/keelhq/keel
        tag: latest
        pullPolicy: Always
  
      # Enable insecure registries
      insecureRegistry: false
  
      # Polling is enabled by default,
      # you can disable it setting value below to false
      polling:
        enabled: true
        defaultSchedule: "@every 1m"
  
      # Extra Containers to run alongside Keel
      # extraContainers:
      #   - name: busybox
      #     image: busybox
      #     imagePullPolicy: IfNotPresent
      #     command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
  
      # Helm provider support
      helmProvider:
        enabled: true
        # set to version "v3" for Helm v3
        version: "v2"
        tillerNamespace: "kube-system"
        # optional Tiller address (if portforwarder tunnel doesn't work),
        # if you are using default configuration, setting it to
        # 'tiller-deploy:44134' is usually fine
        tillerAddress: 'tiller-deploy:44134'
      #  helmDriver: ''
      #  helmDriverSqlConnectionString: ''
  
      # Google Container Registry
      # GCP Project ID
      gcr:
        enabled: false
        projectId: ""
        gcpServiceAccount: ""
        clusterName: ""
        pubSub:
          enabled: false
  
      # Notification level (debug, info, success, warn, error, fatal)
      notificationLevel: info
  
      # AWS Elastic Container Registry
      # https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
      ecr:
        enabled: false
        roleArn: ""
        accessKeyId: ""
        secretAccessKey: ""
        region: ""
  
      # Webhook Notification
      # Remote webhook endpoint for notification delivery
      webhook:
        enabled: false
        endpoint: ""
  
      # Slack Notification
      # bot name (default keel) must exist!
      slack:
        enabled: false
        botName: ""
        token: ""
        channel: ""
        approvalsChannel: ""
  
      # Hipchat notification and approvals
      hipchat:
        enabled: false
        token: ""
        channel: ""
        approvalsChannel: ""
        botName: ""
        userName: ""
        password: ""
  
      # Mattermost notifications
      mattermost:
        enabled: false
        endpoint: ""
  
      # MS Teams notifications
      teams:
        enabled: false
        webhookUrl: ""
  
      # Discord notifications
      discord:
        enabled: false
        webhookUrl: ""
  
      # Mail notifications
      mail:
        enabled: false
        from: ""
        to: ""
        smtp:
          server: ""
          port: 25
          user: ""
          pass: ""
  
      # Basic auth on approvals
      basicauth:
        enabled: true
        user: "admin"
        password: "changeit"
  
      # Keel service
      # Enable to receive webhooks from Docker registries
      service:
        enabled: false
        type: LoadBalancer
        externalPort: 9300
        clusterIP: ""
  
      # Webhook Relay service
      # If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
      # which can deliver webhooks to your internal Keel service through Keel sidecar container.
      webhookRelay:
        enabled: false
        bucket: ""
        # webhookrelay.com credentials
        # Set the key and secret values here to create the keel-webhookrelay secret with this
        # chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
        key: ""
        secret: ""
        # webhookrelay docker image
        image:
          repository: webhookrelay/webhookrelayd
          tag: latest
          pullPolicy: IfNotPresent
  
      # Use a secret file to define passwords and tokens of third parties.
      secret:
        # Leave blank to use `keel.fullname`
        name: ""
        # Set to false to manage your own secret file, with terraform for example.
        create: true
  
      # Keel self-update
      # uncomment lines below if you want Keel to automaticly
      # self-update to the latest release version
      # keel:
      #   # keel policy (all/major/minor/patch/force)
      #   policy: patch
      #   # trigger type, defaults to events such as pubsub, webhooks
      #   trigger: poll
      #   # polling schedule
      #   pollSchedule: "@every 3m"
      #   # images to track and update
      #   images:
      #     - repository: image.repository
      #       tag: image.tag
  
      # RBAC manifests management
      rbac:
        enabled: true
        serviceAccount:
          # Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
          # name:
          # Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
          # If rbac.serviceAccount.name is not set, a new name for the service account is generated
          create: true
  
      # Resources
      resources:
        limits:
          cpu: 100m
          memory: 128Mi
        requests:
          cpu: 50m
          memory: 64Mi
  
      # NodeSelector
      nodeSelector: {}
  
      affinity: {}
  
      tolerations: {}
  
      # base64 encoded json of GCP service account
      # more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
      # e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
      googleApplicationCredentials: ""
  
      # Enable DEBUG logging
      debug: false
  
      # This is used by the static manifest generator in order to create a static
      # namespace manifest for the namespace that keel is being installed
      # within. It should **not** be used if you are using Helm for deployment.
      createNamespaceResource: false
  
      podAnnotations: {}
  
      serviceAnnotations: {}
      # Useful for making the load balancer internal
      # serviceAnnotations:
      #    cloud.google.com/load-balancer-type: Internal
  
      aws:
        region: null
  
      podDisruptionBudget:
        enabled: false
        maxUnavailable: 1
        minAvailable: null
  
      # Google Cloud Certificates
      gcloud:
        managedCertificates:
          enabled: false
          domains:
            - ""
  
      ingress:
        enabled: false
        labels: {}
        annotations: {}
      #    kubernetes.io/ingress.class: nginx
      #    kubernetes.io/tls-acme: "true"
        hosts: []
      #    - host: chart-example.local
      #      paths:
      #        - /
        tls: []
      #    - secretName: chart-example-tls
      #      hosts:
      #        - chart-example.local
  
      dockerRegistry:
        enabled: false
        name: ""
        key: ""
  
      persistence:
        enabled: false
        storageClass: "-"
        size: 1Gi
  
  - name: argo-cd-ingress
    namespace: cicd
    create_namespace: true
    chart_ref: kube-forge/service-ingress
    chart_version: 0.1.0
    release_state: "present"
    values:
      services:
        - domain: argocd.disk.lt.t1.cloud
          path: /
          address: argo-cd-argocd-server
          port: 80
          secretName: argo-cd-server-tls
  
      ingress:
        accountEmail: adminmail@gmail.com
        class: nginx
        annotations:
          nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
          nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
          nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
          nginx.ingress.kubernetes.io/proxy-body-size: "0"
        tls:
          enabled: true
          useCertManager: true
  
          # used if "useCertManager" is false
          crt: ""
          key: ""
  
  - name: vault
    namespace: secrets-storage
    create_namespace: true
    chart_ref: kube-forge/vault
    chart_version: 0.1.0
    release_state: "present"
    values:
      global:
        enabled: true
  
        imagePullSecrets: []
        tlsDisable: true
  
        externalVaultAddr: ""
  
        openshift: false
  
        # Create PodSecurityPolicy for pods
        psp:
          enable: false
          # Annotation for PodSecurityPolicy.
          # This is a multi-line templated string map, and can also be set as YAML.
          annotations: |
            seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
            apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
            seccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default
            apparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default
  
        serverTelemetry:
          # Enable integration with the Prometheus Operator
          # See the top level serverTelemetry section below before enabling this feature.
          prometheusOperator: false
  
      injector:
        enabled: true
  
        replicas: 1
  
        # Configures the port the injector should listen on
        port: 8080
  
        # If multiple replicas are specified, by default a leader will be determined
        # so that only one injector attempts to create TLS certificates.
        leaderElector:
          enabled: true
  
        # If true, will enable a node exporter metrics endpoint at /metrics.
        metrics:
          enabled: false
  
        # Deprecated: Please use global.externalVaultAddr instead.
        externalVaultAddr: ""
  
        # image sets the repo and tag of the vault-k8s image to use for the injector.
        image:
          repository: "harbor.kvazaric.ru/kube-forge/hashicorp/vault-k8s"
          tag: "1.3.1"
          pullPolicy: IfNotPresent
  
        # agentImage sets the repo and tag of the Vault image to use for the Vault Agent
        # containers.  This should be set to the official Vault image.  Vault 1.3.1+ is
        # required.
        agentImage:
          repository: "harbor.kvazaric.ru/kube-forge/hashicorp/vault"
          tag: "1.16.0"
        agentDefaults:
          cpuLimit: "500m"
          cpuRequest: "250m"
          memLimit: "128Mi"
          memRequest: "64Mi"
          # ephemeralLimit: "128Mi"
          # ephemeralRequest: "64Mi"
  
          # Default template type for secrets when no custom template is specified.
          # Possible values include: "json" and "map".
          template: "map"
  
          # Default values within Agent's template_config stanza.
          templateConfig:
            exitOnRetryFailure: true
            staticSecretRenderInterval: ""
  
        # Used to define custom livenessProbe settings
        livenessProbe:
          # When a probe fails, Kubernetes will try failureThreshold times before giving up
          failureThreshold: 2
          # Number of seconds after the container has started before probe initiates
          initialDelaySeconds: 5
          # How often (in seconds) to perform the probe
          periodSeconds: 2
          # Minimum consecutive successes for the probe to be considered successful after having failed
          successThreshold: 1
          # Number of seconds after which the probe times out.
          timeoutSeconds: 5
        # Used to define custom readinessProbe settings
        readinessProbe:
          # When a probe fails, Kubernetes will try failureThreshold times before giving up
          failureThreshold: 2
          # Number of seconds after the container has started before probe initiates
          initialDelaySeconds: 5
          # How often (in seconds) to perform the probe
          periodSeconds: 2
          # Minimum consecutive successes for the probe to be considered successful after having failed
          successThreshold: 1
          # Number of seconds after which the probe times out.
          timeoutSeconds: 5
        # Used to define custom startupProbe settings
        startupProbe:
          # When a probe fails, Kubernetes will try failureThreshold times before giving up
          failureThreshold: 12
          # Number of seconds after the container has started before probe initiates
          initialDelaySeconds: 5
          # How often (in seconds) to perform the probe
          periodSeconds: 5
          # Minimum consecutive successes for the probe to be considered successful after having failed
          successThreshold: 1
          # Number of seconds after which the probe times out.
          timeoutSeconds: 5
  
        # Mount Path of the Vault Kubernetes Auth Method.
        authPath: "auth/kubernetes"
  
        # Configures the log verbosity of the injector.
        # Supported log levels include: trace, debug, info, warn, error
        logLevel: "info"
  
        # Configures the log format of the injector. Supported log formats: "standard", "json".
        logFormat: "standard"
  
        # Configures all Vault Agent sidecars to revoke their token when shutting down
        revokeOnShutdown: false
  
        webhook:
          # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
          # API Tag of the WebHook.
          # To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
          # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
          #
          failurePolicy: Ignore
  
          # matchPolicy specifies the approach to accepting changes based on the rules of
          # the MutatingWebhookConfiguration.
          # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
          # for more details.
          #
          matchPolicy: Exact
  
          # timeoutSeconds is the amount of seconds before the webhook request will be ignored
          # or fails.
          # If it is ignored or fails depends on the failurePolicy
          # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
          # for more details.
          #
          timeoutSeconds: 30
  
          # namespaceSelector is the selector for restricting the webhook to only
          # specific namespaces.
          # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
          # for more details.
          # Example:
          # namespaceSelector:
          #    matchLabels:
          #      sidecar-injector: enabled
          namespaceSelector: {}
  
          # objectSelector is the selector for restricting the webhook to only
          # specific labels.
          # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
          # for more details.
          # Example:
          # objectSelector:
          #    matchLabels:
          #      vault-sidecar-injector: enabled
  
          # Extra annotations to attach to the webhook
          annotations: {}
  
        # Deprecated: please use 'webhook.failurePolicy' instead
        # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
        # API Tag of the WebHook.
        # To block pod creation while webhook is unavailable, set the policy to `Fail` below.
        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
        #
        failurePolicy: Ignore
  
        # Deprecated: please use 'webhook.namespaceSelector' instead
        # namespaceSelector is the selector for restricting the webhook to only
        # specific namespaces.
        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
        # for more details.
        # Example:
        # namespaceSelector:
        #    matchLabels:
        #      sidecar-injector: enabled
        namespaceSelector: {}
  
        # Deprecated: please use 'webhook.objectSelector' instead
        # objectSelector is the selector for restricting the webhook to only
        # specific labels.
        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
        # for more details.
        # Example:
        # objectSelector:
        #    matchLabels:
        #      vault-sidecar-injector: enabled
        objectSelector: {}
  
        # Deprecated: please use 'webhook.annotations' instead
        # Extra annotations to attach to the webhook
        webhookAnnotations: {}
  
        certs:
          # secretName is the name of the secret that has the TLS certificate and
          # private key to serve the injector webhook. If this is null, then the
          # injector will default to its automatic management mode that will assign
          # a service account to the injector to generate its own certificates.
          secretName: null
  
          # caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
          # that signed the TLS certificate that the webhook serves. This must be set
          # if secretName is non-null unless an external service like cert-manager is
          # keeping the caBundle updated.
          caBundle: ""
  
          # certName and keyName are the names of the files within the secret for
          # the TLS cert and private key, respectively. These have reasonable
          # defaults but can be customized if necessary.
          certName: tls.crt
          keyName: tls.key
  
        securityContext:
          pod: {}
          container: {}
  
        resources: {}
  
        # extraEnvironmentVars is a list of extra environment variables to set in the
        # injector deployment.
        extraEnvironmentVars: {}
          # KUBERNETES_SERVICE_HOST: kubernetes.default.svc
  
        topologySpreadConstraints: []
  
        tolerations: []
  
        nodeSelector: {}
  
        priorityClassName: ""
  
        annotations: {}
  
        extraLabels: {}
  
        hostNetwork: false
  
  
        service:
          # Extra annotations to attach to the injector service
          annotations: {}
  
        # Injector serviceAccount specific config
        serviceAccount:
          # Extra annotations to attach to the injector serviceAccount
          annotations: {}
  
        # A disruption budget limits the number of pods of a replicated application
        # that are down simultaneously from voluntary disruptions
        podDisruptionBudget: {}
        # podDisruptionBudget:
        #   maxUnavailable: 1
  
        # strategy for updating the deployment. This can be a multi-line string or a
        # YAML map.
        strategy: {}
        # strategy: |
        #   rollingUpdate:
        #     maxSurge: 25%
        #     maxUnavailable: 25%
        #   type: RollingUpdate
  
      server:
        enabled: true
        enterpriseLicense:
          # The name of the Kubernetes secret that holds the enterprise license. The
          # secret must be in the same namespace that Vault is installed into.
          secretName: ""
          # The key within the Kubernetes secret that holds the enterprise license.
          secretKey: "license"
  
        image:
          repository: "harbor.kvazaric.ru/kube-forge/hashicorp/vault"
          tag: "1.16.0"
          # Overrides the default Image Pull Policy
          pullPolicy: IfNotPresent
  
        updateStrategyType: "RollingUpdate"
  
        # Supported log levels include: trace, debug, info, warn, error
        logLevel: ""
  
        # Supported log formats include: standard, json
        logFormat: ""
  
        resources: {}
  
        hostAliases: []
        # - ip: 127.0.0.1
        #   hostnames:
        #     - chart-example.local
  
        route:
          enabled: false
  
          # When HA mode is enabled and K8s service registration is being used,
          # configure the route to point to the Vault active service.
          activeService: true
  
          labels: {}
          annotations: {}
          host: chart-example.local
          # tls will be passed directly to the route's TLS config, which
          # can be used to configure other termination methods that terminate
          # TLS at the router
          tls:
            termination: passthrough
  
        # authDelegator enables a cluster role binding to be attached to the service
        # account.  This cluster role binding can be used to setup Kubernetes auth
        # method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes
        authDelegator:
          enabled: true
  
        extraInitContainers: null
        extraContainers: null
        shareProcessNamespace: false
        extraArgs: ""
  
        extraPorts: null
          # - containerPort: 8300
          #   name: http-monitoring
  
        readinessProbe:
          enabled: false
          # If you need to use a http path instead of the default exec
          # path: /v1/sys/health?standbyok=true
  
          # Port number on which readinessProbe will be checked.
          port: 8200
          # When a probe fails, Kubernetes will try failureThreshold times before giving up
          failureThreshold: 2
          # Number of seconds after the container has started before probe initiates
          initialDelaySeconds: 5
          # How often (in seconds) to perform the probe
          periodSeconds: 5
          # Minimum consecutive successes for the probe to be considered successful after having failed
          successThreshold: 1
          # Number of seconds after which the probe times out.
          timeoutSeconds: 3
        # Used to enable a livenessProbe for the pods
        livenessProbe:
          enabled: false
          # Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
          execCommand: []
          # - /bin/sh
          # - -c
          # - /vault/userconfig/mylivenessscript/run.sh
          # Path for the livenessProbe to use httpGet as the livenessProbe handler
          path: "/v1/sys/health?standbyok=true"
          # Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
          port: 8200
          # When a probe fails, Kubernetes will try failureThreshold times before giving up
          failureThreshold: 2
          # Number of seconds after the container has started before probe initiates
          initialDelaySeconds: 60
          # How often (in seconds) to perform the probe
          periodSeconds: 5
          # Minimum consecutive successes for the probe to be considered successful after having failed
          successThreshold: 1
          # Number of seconds after which the probe times out.
          timeoutSeconds: 3
  
        terminationGracePeriodSeconds: 10
  
        # Used to set the sleep time during the preStop step
        preStopSleepSeconds: 5
  
        extraEnvironmentVars: {}
  
        extraSecretEnvironmentVars: []
  
        extraVolumes: []
  
        volumes: null
  
        volumeMounts: null
  
        topologySpreadConstraints: []
  
        tolerations: []
        nodeSelector: {}
  
        # Enables network policy for server pods
        networkPolicy:
          enabled: false
          egress: []
          # egress:
          # - to:
          #   - ipBlock:
          #       cidr: 10.0.0.0/24
          #   ports:
          #   - protocol: TCP
          #     port: 443
          ingress:
            - from:
              - namespaceSelector: {}
              ports:
              - port: 8200
                protocol: TCP
              - port: 8201
                protocol: TCP
  
        priorityClassName: ""
        extraLabels: {}
  
        annotations: {}
  
        service:
          enabled: true
          # Enable or disable the vault-active service, which selects Vault pods that
          # have labeled themselves as the cluster leader with `vault-active: "true"`.
          active:
            enabled: true
            # Extra annotations for the service definition. This can either be YAML or a
            # YAML-formatted multi-line templated string map of the annotations to apply
            # to the active service.
            annotations: {}
          # Enable or disable the vault-standby service, which selects Vault pods that
          # have labeled themselves as a cluster follower with `vault-active: "false"`.
          standby:
            enabled: true
            # Extra annotations for the service definition. This can either be YAML or a
            # YAML-formatted multi-line templated string map of the annotations to apply
            # to the standby service.
            annotations: {}
          # When disabled, services may select Vault pods not deployed from the chart.
          # Does not affect the headless vault-internal service with `ClusterIP: None`
          instanceSelector:
            enabled: true
          # clusterIP controls whether a Cluster IP address is attached to the
          # Vault service within Kubernetes.  By default, the Vault service will
          # be given a Cluster IP address, set to None to disable.  When disabled
          # Kubernetes will create a "headless" service.  Headless services can be
          # used to communicate with pods directly through DNS instead of a round-robin
          # load balancer.
          # clusterIP: None
  
          # Configures the service type for the main Vault service.  Can be ClusterIP
          # or NodePort.
          #type: ClusterIP
  
          # The IP family and IP families options are to set the behaviour in a dual-stack environment.
          # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
          # should be.
          # These are only supported for kubernetes versions >=1.23.0
          #
          # Configures the service's supported IP family policy, can be either:
          #     SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
          #     PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
          #     RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
          ipFamilyPolicy: ""
  
          # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
          # Can be IPv4 and/or IPv6.
          ipFamilies: []
  
          # Do not wait for pods to be ready before including them in the services'
          # targets. Does not apply to the headless service, which is used for
          # cluster-internal communication.
          publishNotReadyAddresses: true
  
          # The externalTrafficPolicy can be set to either Cluster or Local
          # and is only valid for LoadBalancer and NodePort service types.
          # The default value is Cluster.
          # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
          externalTrafficPolicy: Cluster
  
          # If type is set to "NodePort", a specific nodePort value can be configured,
          # will be random if left blank.
          #nodePort: 30000
  
          # When HA mode is enabled
          # If type is set to "NodePort", a specific nodePort value can be configured,
          # will be random if left blank.
          #activeNodePort: 30001
  
          # When HA mode is enabled
          # If type is set to "NodePort", a specific nodePort value can be configured,
          # will be random if left blank.
          #standbyNodePort: 30002
  
          # Port on which Vault server is listening
          port: 8200
          # Target port to which the service should be mapped to
          targetPort: 8200
          # Extra annotations for the service definition. This can either be YAML or a
          # YAML-formatted multi-line templated string map of the annotations to apply
          # to the service.
          annotations: {}
  
        dataStorage:
          enabled: true
          size: 10Gi
          mountPath: "/vault/data"
          storageClass: local-path
          accessMode: ReadWriteOnce
          annotations: {}
          labels: {}
  
        persistentVolumeClaimRetentionPolicy: {}
  
        # required for ha installation
        auditStorage:
          enabled: false
          # Size of the PVC created
          size: 10Gi
          # Location where the PVC will be mounted.
          mountPath: "/vault/audit"
          # Name of the storage class to use.  If null it will use the
          # configured default Storage Class.
          storageClass: local-path
          # Access Mode of the storage device being used for the PVC
          accessMode: ReadWriteOnce
          # Annotations to apply to the PVC
          annotations: {}
          # Labels to apply to the PVC
          labels: {}
  
        dev:
          enabled: false
  
          # Set VAULT_DEV_ROOT_TOKEN_ID value
          devRootToken: "root"
  
        # Run Vault in "standalone" mode. This is the default mode that will deploy if
        # no arguments are given to helm. This requires a PVC for data storage to use
        # the "file" backend.  This mode is not highly available and should not be scaled
        # past a single replica.
        standalone:
          enabled: "-"
  
          # config is a raw string of default configuration when using a Stateful
          # deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data
          # and store data there. This is only used when using a Replica count of 1, and
          # using a stateful set. This should be HCL.
  
          # Note: Configuration files are stored in ConfigMaps so sensitive data
          # such as passwords should be either mounted through extraSecretEnvironmentVars
          # or through a Kube secret.  For more information see:
          # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
          config: |
            ui = true
  
            listener "tcp" {
              tls_disable = 1
              address = "[::]:8200"
              cluster_address = "[::]:8201"
              telemetry {
                unauthenticated_metrics_access = "true"
              }
            }
            storage "file" {
              path = "/vault/data"
            }
            telemetry {
              prometheus_retention_time = "30s"
              disable_hostname = true
            }
  
        # Run Vault in "HA" mode. There are no storage requirements unless the audit log
        # persistence is required.  In HA mode Vault will configure itself to use Consul
        # for its storage backend.  The default configuration provided will work the Consul
        # Helm project by default.  It is possible to manually configure Vault to use a
        # different HA backend.
        ha:
          enabled: false
          replicas: 3
  
          # Set the api_addr configuration for Vault HA
          # See https://developer.hashicorp.com/vault/docs/configuration#api_addr
          # If set to null, this will be set to the Pod IP Address
          apiAddr: null
  
          # Set the cluster_addr confuguration for Vault HA
          # See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr
          clusterAddr: null
  
          # Enables Vault's integrated Raft storage.  Unlike the typical HA modes where
          # Vault's persistence is external (such as Consul), enabling Raft mode will create
          # persistent volumes for Vault to store data according to the configuration under server.dataStorage.
          # The Vault cluster will coordinate leader elections and failovers internally.
          raft:
            # Enables Raft integrated storage
            enabled: false
            # Set the Node Raft ID to the name of the pod
            setNodeId: false
  
            config: |
              ui = true
  
              listener "tcp" {
                tls_disable = 1
                address = "[::]:8200"
                cluster_address = "[::]:8201"
                telemetry {
                  unauthenticated_metrics_access = "true"
                }
              }
  
              storage "raft" {
                path = "/vault/data"
              }
  
              service_registration "kubernetes" {}
  
          # config is a raw string of default configuration when using a Stateful
          # deployment. Default is to use a Consul for its HA storage backend.
          # This should be HCL.
  
          # Note: Configuration files are stored in ConfigMaps so sensitive data
          # such as passwords should be either mounted through extraSecretEnvironmentVars
          # or through a Kube secret.  For more information see:
          # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
          config: |
            ui = true
  
            listener "tcp" {
              tls_disable = 1
              address = "[::]:8200"
              cluster_address = "[::]:8201"
              telemetry {
                unauthenticated_metrics_access = "true"
              }
            }
            storage "consul" {
              path = "vault"
              address = "HOST_IP:8500"
            }
  
            service_registration "kubernetes" {}
  
            # Example configuration for using auto-unseal, using Google Cloud KMS. The
            # GKMS keys must already exist, and the cluster must have a service account
            # that is authorized to access GCP KMS.
            #seal "gcpckms" {
            #   project     = "vault-helm-dev-246514"
            #   region      = "global"
            #   key_ring    = "vault-helm-unseal-kr"
            #   crypto_key  = "vault-helm-unseal-key"
            #}
            telemetry {
              prometheus_retention_time = "30s"
              disable_hostname = true
            }
  
          # A disruption budget limits the number of pods of a replicated application
          # that are down simultaneously from voluntary disruptions
          disruptionBudget:
            enabled: true
  
          # maxUnavailable will default to (n/2)-1 where n is the number of
          # replicas. If you'd like a custom value, you can specify an override here.
            maxUnavailable: null
  
        serviceAccount:
          create: true
          name: ""
          createSecret: false
          annotations: {}
          extraLabels: {}
          serviceDiscovery:
            enabled: true
  
        statefulSet:
          annotations: {}
          securityContext:
            pod: {}
            container: {}
  
        hostNetwork: false
  
      # Vault UI
      ui:
        enabled: true
        domain: vault.disk.lt.t1.cloud
        path: /
        publishNotReadyAddresses: true
        # The service should only contain selectors for active Vault pod
        activeVaultPodOnly: false
        serviceType: "ClusterIP"
        serviceNodePort: null
        externalPort: 8200
        targetPort: 8200
  
        serviceIPFamilyPolicy: ""
  
        serviceIPFamilies: []
  
        externalTrafficPolicy: Cluster
  
        #loadBalancerSourceRanges:
        #   - 10.0.0.0/16
        #   - 1.78.23.3/32
  
        # loadBalancerIP:
  
        annotations: {}
  
      csi:
        # True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
        #
        # Requires installing the secrets-store-csi-driver separately, see:
        # https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
        #
        # With the driver and provider installed, you can mount Vault secrets into volumes
        # similar to the Vault Agent injector, and you can also sync those secrets into
        # Kubernetes secrets.
        enabled: true
  
        image:
          repository: "harbor.kvazaric.ru/kube-forge/hashicorp/vault-csi-provider"
          tag: "1.4.1"
          pullPolicy: IfNotPresent
  
        volumes: null
  
        volumeMounts: null
  
        resources: {}
  
        # Override the default secret name for the CSI Provider's HMAC key used for
        # generating secret versions.
        hmacSecretName: ""
  
        daemonSet:
          updateStrategy:
            type: RollingUpdate
            maxUnavailable: ""
          # Extra annotations for the daemonSet. This can either be YAML or a
          # YAML-formatted multi-line templated string map of the annotations to apply
          # to the daemonSet.
          annotations: {}
          # Provider host path (must match the CSI provider's path)
          providersDir: "/etc/kubernetes/secrets-store-csi-providers"
          # Kubelet host path
          kubeletRootDir: "/var/lib/kubelet"
          # Extra labels to attach to the vault-csi-provider daemonSet
          # This should be a YAML map of the labels to apply to the csi provider daemonSet
          extraLabels: {}
          # security context for the pod template and container in the csi provider daemonSet
          securityContext:
            pod: {}
            container: {}
  
        pod:
          annotations: {}
          tolerations:
            - key: node-role.kubernetes.io/master
              effect: NoSchedule
            - key: node-role.kubernetes.io/control-plane
              effect: NoSchedule
          nodeSelector: {}
          affinity: {}
          extraLabels: {}
  
        agent:
          enabled: true
          extraArgs: []
  
          image:
            repository: "harbor.kvazaric.ru/kube-forge/hashicorp/vault"
            tag: "1.16.0"
            pullPolicy: IfNotPresent
  
          logFormat: standard
          logLevel: info
  
          resources: {}
  
        priorityClassName: ""
  
        serviceAccount:
          annotations: {}
          extraLabels: {}
  
        readinessProbe:
          enabled: true
          failureThreshold: 2
          initialDelaySeconds: 5
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 3
  
        livenessProbe:
          failureThreshold: 2
          initialDelaySeconds: 5
          periodSeconds: 5
          successThreshold: 1
          timeoutSeconds: 3
  
        debug: false
        extraArgs: []
  
      serverTelemetry:
        # Enable support for the Prometheus Operator. Currently, this chart does not support
        # authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included
        # in the `listener "tcp"{}` stanza
        #  telemetry {
        #    unauthenticated_metrics_access = "true"
        #  }
        #
        # See the `standalone.config` for a more complete example of this.
        #
        # In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration:
        #
        # example:
        #  telemetry {
        #    prometheus_retention_time = "30s"
        #    disable_hostname = true
        #  }
        #
        # Configuration for monitoring the Vault server.
        serviceMonitor:
          enabled: true
          selectors: {}
          interval: 30s
          scrapeTimeout: 10s
  
        prometheusRules:
            enabled: true
            selectors: {}
            rules: []
  
      ingress:
        enabled: true
        accountEmail: adminmail@gmail.com
        class: nginx
        annotations:
          nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
          nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
          nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
        tls:
          enabled: true
          hosts:
            - host: vault.disk.lt.t1.cloud
              secretName: vault-tls
  
