first version
This commit is contained in:
@@ -0,0 +1,487 @@
|
||||
{{- if .Modules.Additional.Storage.Longhorn.Enabled }}
|
||||
- name: longhorn
|
||||
namespace: longhorn-system
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/longhorn
|
||||
chart_version: 1.6.1
|
||||
values:
|
||||
global:
|
||||
cattle:
|
||||
# -- Default system registry.
|
||||
systemDefaultRegistry: ""
|
||||
windowsCluster:
|
||||
# -- Setting that allows Longhorn to run on a Rancher Windows cluster.
|
||||
enabled: false
|
||||
# -- Toleration for Linux nodes that can run user-deployed Longhorn components.
|
||||
tolerations:
|
||||
- key: "cattle.io/os"
|
||||
value: "linux"
|
||||
effect: "NoSchedule"
|
||||
operator: "Equal"
|
||||
# -- Node selector for Linux nodes that can run user-deployed Longhorn components.
|
||||
nodeSelector:
|
||||
kubernetes.io/os: "linux"
|
||||
defaultSetting:
|
||||
# -- Toleration for system-managed Longhorn components.
|
||||
taintToleration: cattle.io/os=linux:NoSchedule
|
||||
# -- Node selector for system-managed Longhorn components.
|
||||
systemManagedComponentsNodeSelector: kubernetes.io/os:linux
|
||||
|
||||
networkPolicies:
|
||||
# -- Setting that allows you to enable network policies that control access to Longhorn pods.
|
||||
enabled: false
|
||||
# -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
|
||||
type: "k3s"
|
||||
|
||||
image:
|
||||
longhorn:
|
||||
engine:
|
||||
# -- Repository for the Longhorn Engine image.
|
||||
repository: longhornio/longhorn-engine
|
||||
# -- Specify Longhorn engine image tag
|
||||
tag: v1.6.1
|
||||
manager:
|
||||
# -- Repository for the Longhorn Manager image.
|
||||
repository: longhornio/longhorn-manager
|
||||
# -- Specify Longhorn manager image tag
|
||||
tag: v1.6.1
|
||||
ui:
|
||||
# -- Repository for the Longhorn UI image.
|
||||
repository: longhornio/longhorn-ui
|
||||
# -- Specify Longhorn ui image tag
|
||||
tag: v1.6.1
|
||||
instanceManager:
|
||||
# -- Repository for the Longhorn Instance Manager image.
|
||||
repository: longhornio/longhorn-instance-manager
|
||||
# -- Specify Longhorn instance manager image tag
|
||||
tag: v1.6.1
|
||||
shareManager:
|
||||
# -- Repository for the Longhorn Share Manager image.
|
||||
repository: longhornio/longhorn-share-manager
|
||||
# -- Specify Longhorn share manager image tag
|
||||
tag: v1.6.1
|
||||
backingImageManager:
|
||||
# -- Repository for the Backing Image Manager image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/backing-image-manager
|
||||
# -- Specify Longhorn backing image manager image tag
|
||||
tag: v1.6.1
|
||||
supportBundleKit:
|
||||
# -- Repository for the Longhorn Support Bundle Manager image.
|
||||
repository: longhornio/support-bundle-kit
|
||||
# -- Tag for the Longhorn Support Bundle Manager image.
|
||||
tag: v0.0.36
|
||||
csi:
|
||||
attacher:
|
||||
# -- Repository for the CSI attacher image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-attacher
|
||||
# -- Tag for the CSI attacher image. When unspecified, Longhorn uses the default value.
|
||||
tag: v4.4.2
|
||||
provisioner:
|
||||
# -- Repository for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-provisioner
|
||||
# -- Tag for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
|
||||
tag: v3.6.2
|
||||
nodeDriverRegistrar:
|
||||
# -- Repository for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-node-driver-registrar
|
||||
# -- Tag for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
|
||||
tag: v2.9.2
|
||||
resizer:
|
||||
# -- Repository for the CSI Resizer image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-resizer
|
||||
# -- Tag for the CSI Resizer image. When unspecified, Longhorn uses the default value.
|
||||
tag: v1.9.2
|
||||
snapshotter:
|
||||
# -- Repository for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-snapshotter
|
||||
# -- Tag for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
|
||||
tag: v6.3.2
|
||||
livenessProbe:
|
||||
# -- Repository for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/livenessprobe
|
||||
# -- Tag for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
|
||||
tag: v2.12.0
|
||||
openshift:
|
||||
oauthProxy:
|
||||
# -- Repository for the OAuth Proxy image. This setting applies only to OpenShift users.
|
||||
repository: quay.io/openshift/origin-oauth-proxy
|
||||
# -- Tag for the OAuth Proxy image. This setting applies only to OpenShift users. Specify OCP/OKD version 4.1 or later. The latest stable version is 4.14.
|
||||
tag: 4.14
|
||||
# -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
service:
|
||||
ui:
|
||||
# -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
|
||||
type: ClusterIP
|
||||
# -- NodePort port number for Longhorn UI. When unspecified, Longhorn selects a free port between 30000 and 32767.
|
||||
nodePort: null
|
||||
manager:
|
||||
# -- Service type for Longhorn Manager.
|
||||
type: ClusterIP
|
||||
# -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
|
||||
nodePort: ""
|
||||
|
||||
persistence:
|
||||
# -- Setting that allows you to specify the default Longhorn StorageClass.
|
||||
defaultClass: true
|
||||
# -- Filesystem type of the default Longhorn StorageClass.
|
||||
defaultFsType: ext4
|
||||
# -- mkfs parameters of the default Longhorn StorageClass.
|
||||
defaultMkfsParams: ""
|
||||
# -- Replica count of the default Longhorn StorageClass.
|
||||
defaultClassReplicaCount: 3
|
||||
# -- Data locality of the default Longhorn StorageClass. (Options: "disabled", "best-effort")
|
||||
defaultDataLocality: disabled
|
||||
# -- Reclaim policy that provides instructions for handling of a volume after its claim is released. (Options: "Retain", "Delete")
|
||||
reclaimPolicy: Delete
|
||||
# -- Setting that allows you to enable live migration of a Longhorn volume from one node to another.
|
||||
migratable: false
|
||||
# -- Set NFS mount options for Longhorn StorageClass for RWX volumes
|
||||
nfsOptions: ""
|
||||
recurringJobSelector:
|
||||
# -- Setting that allows you to enable the recurring job selector for a Longhorn StorageClass.
|
||||
enable: false
|
||||
# -- Recurring job selector for a Longhorn StorageClass. Ensure that quotes are used correctly when specifying job parameters. (Example: `[{"name":"backup", "isGroup":true}]`)
|
||||
jobList: []
|
||||
backingImage:
|
||||
# -- Setting that allows you to use a backing image in a Longhorn StorageClass.
|
||||
enable: false
|
||||
# -- Backing image to be used for creating and restoring volumes in a Longhorn StorageClass. When no backing images are available, specify the data source type and parameters that Longhorn can use to create a backing image.
|
||||
name: ~
|
||||
# -- Data source type of a backing image used in a Longhorn StorageClass.
|
||||
# If the backing image exists in the cluster, Longhorn uses this setting to verify the image.
|
||||
# If the backing image does not exist, Longhorn creates one using the specified data source type.
|
||||
dataSourceType: ~
|
||||
# -- Data source parameters of a backing image used in a Longhorn StorageClass.
|
||||
# You can specify a JSON string of a map. (Example: `'{\"url\":\"https://backing-image-example.s3-region.amazonaws.com/test-backing-image\"}'`)
|
||||
dataSourceParameters: ~
|
||||
# -- Expected SHA-512 checksum of a backing image used in a Longhorn StorageClass.
|
||||
expectedChecksum: ~
|
||||
defaultNodeSelector:
|
||||
# -- Setting that allows you to enable the node selector for the default Longhorn StorageClass.
|
||||
enable: false
|
||||
# -- Node selector for the default Longhorn StorageClass. Longhorn uses only nodes with the specified tags for storing volume data. (Examples: "storage,fast")
|
||||
selector: ""
|
||||
# -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
|
||||
removeSnapshotsDuringFilesystemTrim: ignored
|
||||
|
||||
preUpgradeChecker:
|
||||
# -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
|
||||
jobEnabled: true
|
||||
# -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
|
||||
upgradeVersionCheck: true
|
||||
|
||||
csi:
|
||||
# -- kubelet root directory. When unspecified, Longhorn uses the default value.
|
||||
kubeletRootDir: ~
|
||||
# -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
|
||||
attacherReplicaCount: ~
|
||||
# -- Replica count of the CSI Provisioner. When unspecified, Longhorn uses the default value ("3").
|
||||
provisionerReplicaCount: ~
|
||||
# -- Replica count of the CSI Resizer. When unspecified, Longhorn uses the default value ("3").
|
||||
resizerReplicaCount: ~
|
||||
# -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
|
||||
snapshotterReplicaCount: ~
|
||||
|
||||
defaultSettings:
|
||||
# -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
|
||||
backupTarget: ~
|
||||
# -- Name of the Kubernetes secret associated with the backup target.
|
||||
backupTargetCredentialSecret: ~
|
||||
# -- Setting that allows Longhorn to automatically attach a volume and create snapshots or backups when recurring jobs are run.
|
||||
allowRecurringJobWhileVolumeDetached: ~
|
||||
# -- Setting that allows Longhorn to automatically create a default disk only on nodes with the label "node.longhorn.io/create-default-disk=true" (if no other disks exist). When this setting is disabled, Longhorn creates a default disk on each node that is added to the cluster.
|
||||
createDefaultDiskLabeledNodes: ~
|
||||
# -- Default path for storing data on a host. The default value is "/var/lib/longhorn/".
|
||||
defaultDataPath: ~
|
||||
# -- Default data locality. A Longhorn volume has data locality if a local replica of the volume exists on the same node as the pod that is using the volume.
|
||||
defaultDataLocality: ~
|
||||
# -- Setting that allows scheduling on nodes with healthy replicas of the same volume. This setting is disabled by default.
|
||||
replicaSoftAntiAffinity: ~
|
||||
# -- Setting that automatically rebalances replicas when an available node is discovered.
|
||||
replicaAutoBalance: ~
|
||||
# -- Percentage of storage that can be allocated relative to hard drive capacity. The default value is "100".
|
||||
storageOverProvisioningPercentage: ~
|
||||
# -- Percentage of minimum available disk capacity. When the minimum available capacity exceeds the total available capacity, the disk becomes unschedulable until more space is made available for use. The default value is "25".
|
||||
storageMinimalAvailablePercentage: ~
|
||||
# -- Percentage of disk space that is not allocated to the default disk on each new Longhorn node.
|
||||
storageReservedPercentageForDefaultDisk: ~
|
||||
# -- Upgrade Checker that periodically checks for new Longhorn versions. When a new version is available, a notification appears on the Longhorn UI. This setting is enabled by default
|
||||
upgradeChecker: ~
|
||||
# -- Default number of replicas for volumes created using the Longhorn UI. For Kubernetes configuration, modify the `numberOfReplicas` field in the StorageClass. The default value is "3".
|
||||
defaultReplicaCount: ~
|
||||
# -- Default Longhorn StorageClass. "storageClassName" is assigned to PVs and PVCs that are created for an existing Longhorn volume. "storageClassName" can also be used as a label, so it is possible to use a Longhorn StorageClass to bind a workload to an existing PV without creating a Kubernetes StorageClass object. The default value is "longhorn-static".
|
||||
defaultLonghornStaticStorageClass: ~
|
||||
# -- Number of seconds that Longhorn waits before checking the backupstore for new backups. The default value is "300". When the value is "0", polling is disabled.
|
||||
backupstorePollInterval: ~
|
||||
# -- Number of minutes that Longhorn keeps a failed backup resource. When the value is "0", automatic deletion is disabled.
|
||||
failedBackupTTL: ~
|
||||
# -- Setting that restores recurring jobs from a backup volume on a backup target and creates recurring jobs if none exist during backup restoration.
|
||||
restoreVolumeRecurringJobs: ~
|
||||
# -- Maximum number of successful recurring backup and snapshot jobs to be retained. When the value is "0", a history of successful recurring jobs is not retained.
|
||||
recurringSuccessfulJobsHistoryLimit: ~
|
||||
# -- Maximum number of failed recurring backup and snapshot jobs to be retained. When the value is "0", a history of failed recurring jobs is not retained.
|
||||
recurringFailedJobsHistoryLimit: ~
|
||||
# -- Maximum number of snapshots or backups to be retained.
|
||||
recurringJobMaxRetention: ~
|
||||
# -- Maximum number of failed support bundles that can exist in the cluster. When the value is "0", Longhorn automatically purges all failed support bundles.
|
||||
supportBundleFailedHistoryLimit: ~
|
||||
# -- Taint or toleration for system-managed Longhorn components.
|
||||
taintToleration: ~
|
||||
# -- Node selector for system-managed Longhorn components.
|
||||
systemManagedComponentsNodeSelector: ~
|
||||
# -- PriorityClass for system-managed Longhorn components.
|
||||
# This setting can help prevent Longhorn components from being evicted under Node Pressure.
|
||||
# Notice that this will be applied to Longhorn user-deployed components by default if there are no priority class values set yet, such as `longhornManager.priorityClass`.
|
||||
priorityClass: &defaultPriorityClassNameRef "longhorn-critical"
|
||||
# -- Setting that allows Longhorn to automatically salvage volumes when all replicas become faulty (for example, when the network connection is interrupted). Longhorn determines which replicas are usable and then uses these replicas for the volume. This setting is enabled by default.
|
||||
autoSalvage: ~
|
||||
# -- Setting that allows Longhorn to automatically delete a workload pod that is managed by a controller (for example, daemonset) whenever a Longhorn volume is detached unexpectedly (for example, during Kubernetes upgrades). After deletion, the controller restarts the pod and then Kubernetes handles volume reattachment and remounting.
|
||||
autoDeletePodWhenVolumeDetachedUnexpectedly: ~
|
||||
# -- Setting that prevents Longhorn Manager from scheduling replicas on a cordoned Kubernetes node. This setting is enabled by default.
|
||||
disableSchedulingOnCordonedNode: ~
|
||||
# -- Setting that allows Longhorn to schedule new replicas of a volume to nodes in the same zone as existing healthy replicas. Nodes that do not belong to any zone are treated as existing in the zone that contains healthy replicas. When identifying zones, Longhorn relies on the label "topology.kubernetes.io/zone=<Zone name of the node>" in the Kubernetes node object.
|
||||
replicaZoneSoftAntiAffinity: ~
|
||||
# -- Setting that allows scheduling on disks with existing healthy replicas of the same volume. This setting is enabled by default.
|
||||
replicaDiskSoftAntiAffinity: ~
|
||||
# -- Policy that defines the action Longhorn takes when a volume is stuck with a StatefulSet or Deployment pod on a node that failed.
|
||||
nodeDownPodDeletionPolicy: ~
|
||||
# -- Policy that defines the action Longhorn takes when a node with the last healthy replica of a volume is drained.
|
||||
nodeDrainPolicy: ~
|
||||
# -- Setting that allows automatic detaching of manually-attached volumes when a node is cordoned.
|
||||
detachManuallyAttachedVolumesWhenCordoned: ~
|
||||
# -- Number of seconds that Longhorn waits before reusing existing data on a failed replica instead of creating a new replica of a degraded volume.
|
||||
replicaReplenishmentWaitInterval: ~
|
||||
# -- Maximum number of replicas that can be concurrently rebuilt on each node.
|
||||
concurrentReplicaRebuildPerNodeLimit: ~
|
||||
# -- Maximum number of volumes that can be concurrently restored on each node using a backup. When the value is "0", restoration of volumes using a backup is disabled.
|
||||
concurrentVolumeBackupRestorePerNodeLimit: ~
|
||||
# -- Setting that disables the revision counter and thereby prevents Longhorn from tracking all write operations to a volume. When salvaging a volume, Longhorn uses properties of the "volume-head-xxx.img" file (the last file size and the last time the file was modified) to select the replica to be used for volume recovery. This setting applies only to volumes created using the Longhorn UI.
|
||||
disableRevisionCounter: ~
|
||||
# -- Image pull policy for system-managed pods, such as Instance Manager, engine images, and CSI Driver. Changes to the image pull policy are applied only after the system-managed pods restart.
|
||||
systemManagedPodsImagePullPolicy: ~
|
||||
# -- Setting that allows you to create and attach a volume without having all replicas scheduled at the time of creation.
|
||||
allowVolumeCreationWithDegradedAvailability: ~
|
||||
# -- Setting that allows Longhorn to automatically clean up the system-generated snapshot after replica rebuilding is completed.
|
||||
autoCleanupSystemGeneratedSnapshot: ~
|
||||
# -- Setting that allows Longhorn to automatically clean up the snapshot generated by a recurring backup job.
|
||||
autoCleanupRecurringJobBackupSnapshot: ~
|
||||
# -- Maximum number of engines that are allowed to concurrently upgrade on each node after Longhorn Manager is upgraded. When the value is "0", Longhorn does not automatically upgrade volume engines to the new default engine image version.
|
||||
concurrentAutomaticEngineUpgradePerNodeLimit: ~
|
||||
# -- Number of minutes that Longhorn waits before cleaning up the backing image file when no replicas in the disk are using it.
|
||||
backingImageCleanupWaitInterval: ~
|
||||
# -- Number of seconds that Longhorn waits before downloading a backing image file again when the status of all image disk files changes to "failed" or "unknown".
|
||||
backingImageRecoveryWaitInterval: ~
|
||||
# -- Percentage of the total allocatable CPU resources on each node to be reserved for each instance manager pod when the V1 Data Engine is enabled. The default value is "12".
|
||||
guaranteedInstanceManagerCPU: ~
|
||||
# -- Setting that notifies Longhorn that the cluster is using the Kubernetes Cluster Autoscaler.
|
||||
kubernetesClusterAutoscalerEnabled: ~
|
||||
# -- Setting that allows Longhorn to automatically delete an orphaned resource and the corresponding data (for example, stale replicas). Orphaned resources on failed or unknown nodes are not automatically cleaned up.
|
||||
orphanAutoDeletion: ~
|
||||
# -- Storage network for in-cluster traffic. When unspecified, Longhorn uses the Kubernetes cluster network.
|
||||
storageNetwork: ~
|
||||
# -- Flag that prevents accidental uninstallation of Longhorn.
|
||||
deletingConfirmationFlag: ~
|
||||
# -- Timeout between the Longhorn Engine and replicas. Specify a value between "8" and "30" seconds. The default value is "8".
|
||||
engineReplicaTimeout: ~
|
||||
# -- Setting that allows you to enable and disable snapshot hashing and data integrity checks.
|
||||
snapshotDataIntegrity: ~
|
||||
# -- Setting that allows disabling of snapshot hashing after snapshot creation to minimize impact on system performance.
|
||||
snapshotDataIntegrityImmediateCheckAfterSnapshotCreation: ~
|
||||
# -- Setting that defines when Longhorn checks the integrity of data in snapshot disk files. You must use the Unix cron expression format.
|
||||
snapshotDataIntegrityCronjob: ~
|
||||
# -- Setting that allows Longhorn to automatically mark the latest snapshot and its parent files as removed during a filesystem trim. Longhorn does not remove snapshots containing multiple child files.
|
||||
removeSnapshotsDuringFilesystemTrim: ~
|
||||
# -- Setting that allows fast rebuilding of replicas using the checksum of snapshot disk files. Before enabling this setting, you must set the snapshot-data-integrity value to "enable" or "fast-check".
|
||||
fastReplicaRebuildEnabled: ~
|
||||
# -- Number of seconds that an HTTP client waits for a response from a File Sync server before considering the connection to have failed.
|
||||
replicaFileSyncHttpClientTimeout: ~
|
||||
# -- Log levels that indicate the type and severity of logs in Longhorn Manager. The default value is "Info". (Options: "Panic", "Fatal", "Error", "Warn", "Info", "Debug", "Trace")
|
||||
logLevel: ~
|
||||
# -- Setting that allows you to specify a backup compression method.
|
||||
backupCompressionMethod: ~
|
||||
# -- Maximum number of worker threads that can concurrently run for each backup.
|
||||
backupConcurrentLimit: ~
|
||||
# -- Maximum number of worker threads that can concurrently run for each restore operation.
|
||||
restoreConcurrentLimit: ~
|
||||
# -- Setting that allows you to enable the V1 Data Engine.
|
||||
v1DataEngine: ~
|
||||
# -- Setting that allows you to enable the V2 Data Engine, which is based on the Storage Performance Development Kit (SPDK). The V2 Data Engine is a preview feature and should not be used in production environments.
|
||||
v2DataEngine: ~
|
||||
# -- Setting that allows you to configure maximum huge page size (in MiB) for the V2 Data Engine.
|
||||
v2DataEngineHugepageLimit: ~
|
||||
# -- Setting that allows rebuilding of offline replicas for volumes using the V2 Data Engine.
|
||||
offlineReplicaRebuilding: ~
|
||||
# -- Number of millicpus on each node to be reserved for each Instance Manager pod when the V2 Data Engine is enabled. The default value is "1250".
|
||||
v2DataEngineGuaranteedInstanceManagerCPU: ~
|
||||
# -- Setting that allows scheduling of empty node selector volumes to any node.
|
||||
allowEmptyNodeSelectorVolume: ~
|
||||
# -- Setting that allows scheduling of empty disk selector volumes to any disk.
|
||||
allowEmptyDiskSelectorVolume: ~
|
||||
# -- Setting that allows Longhorn to periodically collect anonymous usage data for product improvement purposes. Longhorn sends collected data to the [Upgrade Responder](https://github.com/longhorn/upgrade-responder) server, which is the data source of the Longhorn Public Metrics Dashboard (https://metrics.longhorn.io). The Upgrade Responder server does not store data that can be used to identify clients, including IP addresses.
|
||||
allowCollectingLonghornUsageMetrics: ~
|
||||
# -- Setting that temporarily prevents all attempts to purge volume snapshots.
|
||||
disableSnapshotPurge: ~
|
||||
# -- Maximum snapshot count for a volume. The value should be between 2 to 250
|
||||
snapshotMaxCount: ~
|
||||
|
||||
privateRegistry:
|
||||
# -- Setting that allows you to create a private registry secret.
|
||||
createSecret: ~
|
||||
# -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
|
||||
registryUrl: ~
|
||||
# -- User account used for authenticating with a private registry.
|
||||
registryUser: ~
|
||||
# -- Password for authenticating with a private registry.
|
||||
registryPasswd: ~
|
||||
# -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
|
||||
registrySecret: ~
|
||||
|
||||
longhornManager:
|
||||
log:
|
||||
# -- Format of Longhorn Manager logs. (Options: "plain", "json")
|
||||
format: plain
|
||||
# -- PriorityClass for Longhorn Manager.
|
||||
priorityClass: *defaultPriorityClassNameRef
|
||||
# -- Toleration for Longhorn Manager on nodes allowed to run Longhorn Manager.
|
||||
tolerations: []
|
||||
## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
|
||||
## and uncomment this example block
|
||||
# - key: "key"
|
||||
# operator: "Equal"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule"
|
||||
# -- Node selector for Longhorn Manager. Specify the nodes allowed to run Longhorn Manager.
|
||||
nodeSelector: {}
|
||||
## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
|
||||
## and uncomment this example block
|
||||
# label-key1: "label-value1"
|
||||
# label-key2: "label-value2"
|
||||
# -- Annotation for the Longhorn Manager service.
|
||||
serviceAnnotations: {}
|
||||
## If you want to set annotations for the Longhorn Manager service, delete the `{}` in the line above
|
||||
## and uncomment this example block
|
||||
# annotation-key1: "annotation-value1"
|
||||
# annotation-key2: "annotation-value2"
|
||||
|
||||
longhornDriver:
|
||||
# -- PriorityClass for Longhorn Driver.
|
||||
priorityClass: *defaultPriorityClassNameRef
|
||||
# -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
|
||||
tolerations: []
|
||||
## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
|
||||
## and uncomment this example block
|
||||
# - key: "key"
|
||||
# operator: "Equal"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule"
|
||||
# -- Node selector for Longhorn Driver. Specify the nodes allowed to run Longhorn Driver.
|
||||
nodeSelector: {}
|
||||
## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
|
||||
## and uncomment this example block
|
||||
# label-key1: "label-value1"
|
||||
# label-key2: "label-value2"
|
||||
|
||||
longhornUI:
|
||||
# -- Replica count for Longhorn UI.
|
||||
replicas: 2
|
||||
# -- PriorityClass for Longhorn UI.
|
||||
priorityClass: *defaultPriorityClassNameRef
|
||||
# -- Toleration for Longhorn UI on nodes allowed to run Longhorn components.
|
||||
tolerations: []
|
||||
## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
|
||||
## and uncomment this example block
|
||||
# - key: "key"
|
||||
# operator: "Equal"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule"
|
||||
# -- Node selector for Longhorn UI. Specify the nodes allowed to run Longhorn UI.
|
||||
nodeSelector: {}
|
||||
## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
|
||||
## and uncomment this example block
|
||||
# label-key1: "label-value1"
|
||||
# label-key2: "label-value2"
|
||||
|
||||
ingress:
|
||||
# -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
|
||||
enabled: false
|
||||
|
||||
# -- IngressClass resource that contains ingress configuration, including the name of the Ingress controller.
|
||||
# ingressClassName can replace the kubernetes.io/ingress.class annotation used in earlier Kubernetes releases.
|
||||
ingressClassName: ~
|
||||
|
||||
# -- Hostname of the Layer 7 load balancer.
|
||||
host: sslip.io
|
||||
|
||||
# -- Setting that allows you to enable TLS on ingress records.
|
||||
tls: false
|
||||
|
||||
# -- Setting that allows you to enable secure connections to the Longhorn UI service via port 443.
|
||||
secureBackends: false
|
||||
|
||||
# -- TLS secret that contains the private key and certificate to be used for TLS. This setting applies only when TLS is enabled on ingress records.
|
||||
tlsSecret: longhorn.local-tls
|
||||
|
||||
path: /
|
||||
|
||||
## If you're using kube-lego, you will want to add:
|
||||
## kubernetes.io/tls-acme: true
|
||||
##
|
||||
## For a full list of possible ingress annotations, please see
|
||||
## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
|
||||
##
|
||||
## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
|
||||
# -- Ingress annotations in the form of key-value pairs.
|
||||
annotations:
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: true
|
||||
|
||||
# -- Secret that contains a TLS private key and certificate. Use secrets if you want to use your own certificates to secure ingresses.
|
||||
secrets:
|
||||
## If you're providing your own certificates, please use this to add the certificates as secrets
|
||||
## key and certificate should start with -----BEGIN CERTIFICATE----- or
|
||||
## -----BEGIN RSA PRIVATE KEY-----
|
||||
##
|
||||
## name should line up with a tlsSecret set further up
|
||||
## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
|
||||
##
|
||||
## It is also possible to create and manage the certificates outside of this helm chart
|
||||
## Please see README.md for more information
|
||||
# - name: longhorn.local-tls
|
||||
# key:
|
||||
# certificate:
|
||||
|
||||
# -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
|
||||
enablePSP: false
|
||||
|
||||
# -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
|
||||
namespaceOverride: ""
|
||||
|
||||
# -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
|
||||
annotations: {}
|
||||
|
||||
serviceAccount:
|
||||
# -- Annotations to add to the service account
|
||||
annotations: {}
|
||||
|
||||
metrics:
|
||||
serviceMonitor:
|
||||
# -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
|
||||
enabled: false
|
||||
|
||||
## openshift settings
|
||||
openshift:
|
||||
# -- Setting that allows Longhorn to integrate with OpenShift.
|
||||
enabled: false
|
||||
ui:
|
||||
# -- Route for connections between Longhorn and the OpenShift web console.
|
||||
route: "longhorn-ui"
|
||||
# -- Port for accessing the OpenShift web console.
|
||||
port: 443
|
||||
# -- Port for proxy that provides access to the OpenShift web console.
|
||||
proxy: 8443
|
||||
|
||||
# -- Setting that allows Longhorn to generate code coverage profiles.
|
||||
enableGoCoverDir: false
|
||||
{{- end }}
|
||||
@@ -0,0 +1,6 @@
|
||||
{{- if .Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled }}
|
||||
- name: csi-secrets-store
|
||||
namespace: kube-system
|
||||
chart_ref: kube-forge/secrets-store-csi-driver
|
||||
chart_version: 1.4.3
|
||||
{{- end }}
|
||||
@@ -0,0 +1,34 @@
|
||||
- name: argo-cd-ingress
|
||||
namespace: cicd
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/service-ingress
|
||||
chart_version: 0.1.0
|
||||
{{- if and .Modules.Cicd.Enabled (eq .Modules.Cicd.ArgoCd.Expose.Type "ingress") }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
services:
|
||||
- domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
|
||||
address: argo-cd-argocd-server
|
||||
port: 80
|
||||
secretName: argo-cd-server-tls
|
||||
|
||||
ingress:
|
||||
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
|
||||
class: {{ .Modules.Additional.Ingress.Type }}
|
||||
annotations:
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
|
||||
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
|
||||
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
{{- end }}
|
||||
tls:
|
||||
enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
|
||||
useCertManager: true
|
||||
|
||||
# used if "useCertManager" is false
|
||||
crt: ""
|
||||
key: ""
|
||||
144
pkg/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
Normal file
144
pkg/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
Normal file
@@ -0,0 +1,144 @@
|
||||
- name: argo-cd
|
||||
namespace: cicd
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/argo-cd
|
||||
chart_version: 6.7.12
|
||||
{{- if .Modules.Cicd.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
crds:
|
||||
install: true
|
||||
|
||||
server:
|
||||
certificateSecret:
|
||||
enabled: false
|
||||
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
{{- else }}
|
||||
replicas: 2
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
redis:
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
controller:
|
||||
replicas: 1
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
applicationSet:
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
replicas: 2
|
||||
{{- end }}
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
dex:
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
## check later
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
|
||||
repoServer:
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
{{- else }}
|
||||
replicas: 2
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
configs:
|
||||
params:
|
||||
server.insecure: true
|
||||
|
||||
secret:
|
||||
argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
|
||||
|
||||
repositories:
|
||||
# add default helm-repository from harbor
|
||||
{{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
|
||||
|
||||
cm:
|
||||
create: true
|
||||
url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
|
||||
|
||||
accounts.developer: login
|
||||
accounts.guest: login
|
||||
|
||||
# oidc.config: ""
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
policy.csv: |
|
||||
p, role:admin, applications, create, */*, allow
|
||||
p, role:admin, applications, update, */*, allow
|
||||
p, role:admin, applications, delete, */*, allow
|
||||
p, role:admin, applications, sync, */*, allow
|
||||
p, role:admin, applications, override, */*, allow
|
||||
p, role:admin, applications, action/*, */*, allow
|
||||
p, role:admin, applicationsets, get, */*, allow
|
||||
p, role:admin, applicationsets, create, */*, allow
|
||||
p, role:admin, applicationsets, update, */*, allow
|
||||
p, role:admin, applicationsets, delete, */*, allow
|
||||
p, role:admin, certificates, create, *, allow
|
||||
p, role:admin, certificates, update, *, allow
|
||||
p, role:admin, certificates, delete, *, allow
|
||||
p, role:admin, clusters, create, *, allow
|
||||
p, role:admin, clusters, update, *, allow
|
||||
p, role:admin, clusters, delete, *, allow
|
||||
p, role:admin, repositories, create, *, allow
|
||||
p, role:admin, repositories, update, *, allow
|
||||
p, role:admin, repositories, delete, *, allow
|
||||
p, role:admin, projects, create, *, allow
|
||||
p, role:admin, projects, update, *, allow
|
||||
p, role:admin, projects, delete, *, allow
|
||||
p, role:admin, accounts, update, *, allow
|
||||
p, role:admin, gpgkeys, create, *, allow
|
||||
p, role:admin, gpgkeys, delete, *, allow
|
||||
p, role:admin, exec, create, */*, allow
|
||||
|
||||
{{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
|
||||
|
||||
|
||||
policy.default: role:''
|
||||
# scopes: "[roles,email,groups]"
|
||||
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
redis-ha:
|
||||
enabled: true
|
||||
{{- end }}
|
||||
@@ -0,0 +1,421 @@
|
||||
- name: argo-rollouts
|
||||
namespace: cicd
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/argo-rollouts
|
||||
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.Rollouts.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
chart_version: 2.35.1
|
||||
values:
|
||||
installCRDs: true
|
||||
keepCRDs: false
|
||||
clusterInstall: true
|
||||
createClusterAggregateRoles: true
|
||||
|
||||
apiVersionOverrides:
|
||||
# -- String to override apiVersion of ingresses rendered by this helm chart
|
||||
ingress: "" # networking.k8s.io/v1beta1
|
||||
|
||||
# -- Override the Kubernetes version, which is used to evaluate certain manifests
|
||||
kubeVersionOverride: ""
|
||||
|
||||
# -- Additional manifests to deploy within the chart. A list of objects.
|
||||
## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
|
||||
extraObjects: []
|
||||
# - apiVersion: v1
|
||||
# kind: Secret
|
||||
# metadata:
|
||||
# name: datadog
|
||||
# type: Opaque
|
||||
# data:
|
||||
# address: https://api.datadoghq.com
|
||||
# api-key: <datadog-api-key>
|
||||
# app-key: <datadog-app-key>
|
||||
|
||||
global:
|
||||
# -- Annotations for all deployed Deployments
|
||||
deploymentAnnotations: {}
|
||||
|
||||
controller:
|
||||
# -- Value of label `app.kubernetes.io/component`
|
||||
component: rollouts-controller
|
||||
# -- Annotations to be added to the controller deployment
|
||||
deploymentAnnotations: {}
|
||||
# -- Annotations to be added to application controller pods
|
||||
podAnnotations: {}
|
||||
# -- [Node selector]
|
||||
nodeSelector: {}
|
||||
# -- [Tolerations] for use with node taints
|
||||
tolerations: []
|
||||
# -- Assign custom [affinity] rules to the deployment
|
||||
affinity: {}
|
||||
logging:
|
||||
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
|
||||
level: info
|
||||
# -- Set the klog logging level
|
||||
kloglevel: "0"
|
||||
# -- Set the logging format (one of: `text`, `json`)
|
||||
format: "text"
|
||||
|
||||
# -- Assign custom [TopologySpreadConstraints] rules to the controller
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
|
||||
topologySpreadConstraints: []
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: DoNotSchedule
|
||||
|
||||
# -- [priorityClassName] for the controller
|
||||
priorityClassName: ""
|
||||
# -- The number of controller pods to run
|
||||
replicas: 2
|
||||
image:
|
||||
# -- Registry to use
|
||||
registry: quay.io
|
||||
# -- Repository to use
|
||||
repository: argoproj/argo-rollouts
|
||||
# -- Overrides the image tag (default is the chart appVersion)
|
||||
tag: ""
|
||||
# -- Image pull policy
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# -- flag to enable creation of cluster controller role (requires cluster RBAC)
|
||||
createClusterRole: true
|
||||
|
||||
# Controller container ports
|
||||
containerPorts:
|
||||
# -- Metrics container port
|
||||
metrics: 8090
|
||||
# -- Healthz container port
|
||||
healthz: 8080
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
metrics:
|
||||
# -- Deploy metrics service
|
||||
enabled: true
|
||||
service:
|
||||
# -- Metrics service port name
|
||||
portName: metrics
|
||||
# -- Metrics service port
|
||||
port: 8090
|
||||
# -- Service annotations
|
||||
annotations: {}
|
||||
serviceMonitor:
|
||||
# -- Enable a prometheus ServiceMonitor
|
||||
enabled: true
|
||||
# -- Namespace to be used for the ServiceMonitor
|
||||
namespace: ""
|
||||
# -- Labels to be added to the ServiceMonitor
|
||||
additionalLabels: {}
|
||||
# -- Annotations to be added to the ServiceMonitor
|
||||
additionalAnnotations: {}
|
||||
# -- RelabelConfigs to apply to samples before scraping
|
||||
relabelings: []
|
||||
# -- MetricRelabelConfigs to apply to samples before ingestion
|
||||
metricRelabelings: []
|
||||
{{- end }}
|
||||
|
||||
# -- Configure liveness [probe] for the controller
|
||||
# @default -- See [values.yaml]
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: healthz
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 20
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 10
|
||||
|
||||
# -- Configure readiness [probe] for the controller
|
||||
# @default -- See [values.yaml]
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: metrics
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 4
|
||||
|
||||
## Configure Pod Disruption Budget for the controller
|
||||
pdb:
|
||||
# -- Labels to be added to controller [Pod Disruption Budget]
|
||||
labels: {}
|
||||
# -- Annotations to be added to controller [Pod Disruption Budget]
|
||||
annotations: {}
|
||||
# -- Deploy a [Pod Disruption Budget] for the controller
|
||||
enabled: false
|
||||
# -- Minimum number / percentage of pods that should remain scheduled
|
||||
minAvailable: # 1
|
||||
# -- Maximum number / percentage of pods that may be made unavailable
|
||||
maxUnavailable: # 0
|
||||
|
||||
# -- Additional volumes to add to the controller pod
|
||||
volumes: []
|
||||
# - configMap:
|
||||
# name: my-certs-cm
|
||||
# name: my-certs
|
||||
|
||||
# -- Additional volumeMounts to add to the controller container
|
||||
volumeMounts: []
|
||||
# - mountPath: /etc/ssl/certs
|
||||
# name: my-certs
|
||||
|
||||
# -- Configures 3rd party metric providers for controller
|
||||
## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
|
||||
metricProviderPlugins: {}
|
||||
# metricProviderPlugins: |-
|
||||
# - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
|
||||
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
|
||||
|
||||
# -- Configures 3rd party traffic router plugins for controller
|
||||
## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
|
||||
trafficRouterPlugins: {}
|
||||
# trafficRouterPlugins: |-
|
||||
# - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
|
||||
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
|
||||
|
||||
serviceAccount:
|
||||
# -- Specifies whether a service account should be created
|
||||
create: true
|
||||
# -- Annotations to add to the service account
|
||||
annotations: {}
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
# -- Annotations to be added to all CRDs
|
||||
crdAnnotations: {}
|
||||
|
||||
# -- Annotations for the all deployed pods
|
||||
podAnnotations: {}
|
||||
|
||||
# -- Security Context to set on pod level
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
# -- Security Context to set on container level
|
||||
containerSecurityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
# -- Annotations to be added to the Rollout service
|
||||
serviceAnnotations: {}
|
||||
|
||||
# -- Labels to be added to the Rollout pods
|
||||
podLabels: {}
|
||||
|
||||
# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
|
||||
imagePullSecrets: []
|
||||
# - name: argo-pull-secret
|
||||
|
||||
providerRBAC:
|
||||
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
|
||||
enabled: true
|
||||
# providerRBAC.enabled must be true in order to toggle the individual providers
|
||||
providers:
|
||||
# -- Adds RBAC rules for the Istio provider
|
||||
istio: true
|
||||
# -- Adds RBAC rules for the SMI provider
|
||||
smi: true
|
||||
# -- Adds RBAC rules for the Ambassador provider
|
||||
ambassador: true
|
||||
# -- Adds RBAC rules for the AWS Load Balancer Controller provider
|
||||
awsLoadBalancerController: true
|
||||
# -- Adds RBAC rules for the AWS App Mesh provider
|
||||
awsAppMesh: true
|
||||
# -- Adds RBAC rules for the Traefik provider
|
||||
traefik: true
|
||||
# -- Adds RBAC rules for the Apisix provider
|
||||
apisix: true
|
||||
# -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
|
||||
contour: true
|
||||
# -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
|
||||
glooPlatform: true
|
||||
# -- Additional RBAC rules for others providers
|
||||
additionalRules: []
|
||||
|
||||
dashboard:
|
||||
# -- Deploy dashboard server
|
||||
enabled: true
|
||||
# -- Set cluster role to readonly
|
||||
readonly: false
|
||||
# -- Value of label `app.kubernetes.io/component`
|
||||
component: rollouts-dashboard
|
||||
# -- Annotations to be added to the dashboard deployment
|
||||
deploymentAnnotations: {}
|
||||
# -- Annotations to be added to application dashboard pods
|
||||
podAnnotations: {}
|
||||
# -- [Node selector]
|
||||
nodeSelector: {}
|
||||
# -- [Tolerations] for use with node taints
|
||||
tolerations: []
|
||||
# -- Assign custom [affinity] rules to the deployment
|
||||
affinity: {}
|
||||
logging:
|
||||
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
|
||||
level: info
|
||||
# -- Set the klog logging level
|
||||
kloglevel: "0"
|
||||
|
||||
# -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
|
||||
topologySpreadConstraints: []
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: DoNotSchedule
|
||||
|
||||
# -- [priorityClassName] for the dashboard server
|
||||
priorityClassName: ""
|
||||
|
||||
# -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
|
||||
createClusterRole: true
|
||||
|
||||
# -- The number of dashboard pods to run
|
||||
replicas: 1
|
||||
image:
|
||||
# -- Registry to use
|
||||
registry: quay.io
|
||||
# -- Repository to use
|
||||
repository: argoproj/kubectl-argo-rollouts
|
||||
# -- Overrides the image tag (default is the chart appVersion)
|
||||
tag: ""
|
||||
# -- Image pull policy
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
|
||||
extraArgs: []
|
||||
# -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
|
||||
extraEnv: []
|
||||
# - name: FOO
|
||||
# value: bar
|
||||
# -- Resource limits and requests for the dashboard pods.
|
||||
resources: {}
|
||||
# -- Security Context to set on pod level
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
# -- Security Context to set on container level
|
||||
containerSecurityContext: {}
|
||||
service:
|
||||
# -- Sets the type of the Service
|
||||
type: ClusterIP
|
||||
# -- LoadBalancer will get created with the IP specified in this field
|
||||
loadBalancerIP: ""
|
||||
# -- Source IP ranges to allow access to service from
|
||||
loadBalancerSourceRanges: []
|
||||
# -- Dashboard service external IPs
|
||||
externalIPs: []
|
||||
# -- Service annotations
|
||||
annotations: {}
|
||||
# -- Service labels
|
||||
labels: {}
|
||||
# -- Service port name
|
||||
portName: dashboard
|
||||
# -- Service port
|
||||
port: 3100
|
||||
# -- Service target port
|
||||
targetPort: 3100
|
||||
# -- (int) Service nodePort
|
||||
nodePort:
|
||||
serviceAccount:
|
||||
# -- Specifies whether a dashboard service account should be created
|
||||
create: true
|
||||
# -- Annotations to add to the dashboard service account
|
||||
annotations: {}
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
## Configure Pod Disruption Budget for the dashboard
|
||||
pdb:
|
||||
# -- Labels to be added to dashboard [Pod Disruption Budget]
|
||||
labels: {}
|
||||
# -- Annotations to be added to dashboard [Pod Disruption Budget]
|
||||
annotations: {}
|
||||
# -- Deploy a [Pod Disruption Budget] for the dashboard
|
||||
enabled: false
|
||||
# -- Minimum number / percentage of pods that should remain scheduled
|
||||
minAvailable: # 1
|
||||
# -- Maximum number / percentage of pods that may be made unavailable
|
||||
maxUnavailable: # 0
|
||||
|
||||
## Ingress configuration.
|
||||
## ref: https://kubernetes.io/docs/user-guide/ingress/
|
||||
##
|
||||
ingress:
|
||||
# -- Enable dashboard ingress support
|
||||
enabled: false
|
||||
# -- Dashboard ingress annotations
|
||||
annotations: {}
|
||||
# -- Dashboard ingress labels
|
||||
labels: {}
|
||||
# -- Dashboard ingress class name
|
||||
ingressClassName: ""
|
||||
|
||||
# -- Dashboard ingress hosts
|
||||
## Argo Rollouts Dashboard Ingress.
|
||||
## Hostnames must be provided if Ingress is enabled.
|
||||
## Secrets must be manually created in the namespace
|
||||
hosts: []
|
||||
# - argorollouts.example.com
|
||||
|
||||
# -- Dashboard ingress paths
|
||||
paths:
|
||||
- /
|
||||
# -- Dashboard ingress path type
|
||||
pathType: Prefix
|
||||
# -- Dashboard ingress extra paths
|
||||
extraPaths: []
|
||||
# - path: /*
|
||||
# backend:
|
||||
# serviceName: ssl-redirect
|
||||
# servicePort: use-annotation
|
||||
## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
|
||||
# - path: /*
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service
|
||||
# name: ssl-redirect
|
||||
# port:
|
||||
# name: use-annotation
|
||||
|
||||
# -- Dashboard ingress tls
|
||||
tls: []
|
||||
# - secretName: argorollouts-example-tls
|
||||
# hosts:
|
||||
# - argorollouts.example.com
|
||||
|
||||
# -- Additional volumes to add to the dashboard pod
|
||||
volumes: []
|
||||
|
||||
# -- Additional volumeMounts to add to the dashboard container
|
||||
volumeMounts: []
|
||||
|
||||
notifications:
|
||||
secret:
|
||||
# -- Whether to create notifications secret
|
||||
create: false
|
||||
# -- Generic key:value pairs to be inserted into the notifications secret
|
||||
items: {}
|
||||
# slack-token:
|
||||
|
||||
# -- Configures notification services
|
||||
notifiers: {}
|
||||
# service.slack: |
|
||||
# token: $slack-token
|
||||
|
||||
# -- Notification templates
|
||||
templates: {}
|
||||
|
||||
# -- The trigger defines the condition when the notification should be sent
|
||||
triggers: {}
|
||||
# trigger.on-purple: |
|
||||
# - send: [my-purple-template]
|
||||
# when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'
|
||||
@@ -0,0 +1,9 @@
|
||||
- name: keel
|
||||
namespace: kube-system
|
||||
chart_ref: kube-forge/keel
|
||||
chart_version: 1.0.3
|
||||
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.UpdatesOperator.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
@@ -0,0 +1,66 @@
|
||||
- name: fluent-operator
|
||||
namespace: observability
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/fluent-operator
|
||||
chart_version: 2.7.0
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
# Set this to containerd or crio if you want to collect CRI format logs
|
||||
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
|
||||
Kubernetes: false
|
||||
|
||||
operator:
|
||||
initcontainer:
|
||||
repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
|
||||
tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
container:
|
||||
repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
|
||||
tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 60Mi
|
||||
imagePullSecrets: []
|
||||
labels: {}
|
||||
logPath:
|
||||
# The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
|
||||
# crio: /var/log
|
||||
containerd: /var/log
|
||||
disableComponentControllers: ""
|
||||
|
||||
fluentbit:
|
||||
crdsEnable: true
|
||||
enable: false
|
||||
|
||||
fluentd:
|
||||
crdsEnable: true
|
||||
enable: false
|
||||
name: fluentd
|
||||
# Valid modes include "collector" and "agent".
|
||||
# The "collector" mode will deploy Fluentd as a StatefulSet as before.
|
||||
# The new "agent" mode will deploy Fluentd as a DaemonSet.
|
||||
mode: "agent"
|
||||
port: 24224
|
||||
image:
|
||||
repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
|
||||
tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
namespaceOverride: ""
|
||||
@@ -0,0 +1,200 @@
|
||||
- name: loki
|
||||
namespace: observability
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/loki
|
||||
chart_version: 5.47.2
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
loki:
|
||||
image:
|
||||
registry: {{ .Modules.Observability.Logging.Loki.Registry }}
|
||||
repository: {{ .Modules.Observability.Logging.Loki.Image }}
|
||||
tag: {{ .Modules.Observability.Logging.Loki.Tag }}
|
||||
podAnnotations:
|
||||
app.kubernetes.io/component: "loki"
|
||||
auth_enabled: false
|
||||
commonConfig:
|
||||
replication_factor: 1
|
||||
storage:
|
||||
type: 'filesystem'
|
||||
|
||||
frontend:
|
||||
max_outstanding_per_tenant: 10000
|
||||
|
||||
limits_config:
|
||||
reject_old_samples: false
|
||||
split_queries_by_interval: 15m
|
||||
max_query_parallelism: 32
|
||||
max_query_series: 10000
|
||||
retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
|
||||
|
||||
compactor:
|
||||
compaction_interval: 10m
|
||||
retention_enabled: true
|
||||
retention_delete_delay: 2h
|
||||
|
||||
querier:
|
||||
max_concurrent: 2048
|
||||
|
||||
query_scheduler:
|
||||
max_outstanding_requests_per_tenant: 10000
|
||||
|
||||
rulerConfig:
|
||||
storage:
|
||||
type: local
|
||||
local:
|
||||
directory: /var/loki/rules
|
||||
rule_path: /tmp/rules
|
||||
|
||||
alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
|
||||
|
||||
|
||||
singleBinary:
|
||||
replicas: 1
|
||||
|
||||
extraVolumes:
|
||||
- name: loki-default-rules
|
||||
configMap:
|
||||
name: loki-default-alerting-rules
|
||||
|
||||
extraVolumeMounts:
|
||||
- name: loki-default-rules
|
||||
mountPath: /var/loki/rules
|
||||
|
||||
|
||||
write:
|
||||
persistence:
|
||||
volumeClaimsEnabled: true
|
||||
storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
|
||||
size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
|
||||
|
||||
test:
|
||||
enabled: false
|
||||
|
||||
gateway:
|
||||
enabled: false
|
||||
|
||||
monitoring:
|
||||
selfMonitoring:
|
||||
enabled: false
|
||||
grafanaAgent:
|
||||
installOperator: false
|
||||
lokiCanary:
|
||||
enabled: false
|
||||
rules:
|
||||
enabled: true
|
||||
alerting: true
|
||||
additionalGroups: {}
|
||||
|
||||
extraObjects:
|
||||
- apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: loki-default-alerting-rules
|
||||
labels:
|
||||
loki_rule: ""
|
||||
|
||||
data:
|
||||
loki-default-alerting-rules.yaml: |-
|
||||
groups:
|
||||
{{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
|
||||
- name: kube-events-alerts
|
||||
rules:
|
||||
- alert: FailedEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: FailedEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: Failed events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
|
||||
- alert: OOMKilledEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: OOMKilledEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: OOMKilled events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
|
||||
- alert: EvictedEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: EvictedEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: Evicted events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
|
||||
- alert: ImagePullBackOffEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: ImagePullBackOffEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: ImagePullBackOff events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
|
||||
- alert: BackOffEventsOccured
|
||||
expr: |
|
||||
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
|
||||
for: 1m
|
||||
labels:
|
||||
severity: critical
|
||||
annotations:
|
||||
alertname: BackOffEventsOccured
|
||||
instance: kube-cluster
|
||||
jobName: kube_events
|
||||
summary: BackOff events occured in cluster
|
||||
addDefaultUrl: "true"
|
||||
sidecar:
|
||||
rules:
|
||||
enabled: true
|
||||
# -- Label that the configmaps/secrets with rules will be marked with.
|
||||
label: loki_rule
|
||||
# -- Label value that the configmaps/secrets with rules will be set to.
|
||||
labelValue: ""
|
||||
# -- Folder into which the rules will be placed.
|
||||
folder: /var/loki/rules
|
||||
# -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
|
||||
# Otherwise the namespace in which the sidecar is running will be used.
|
||||
# It's also possible to specify 'ALL' to search in all namespaces.
|
||||
searchNamespace: 'ALL'
|
||||
# -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
|
||||
watchMethod: WATCH
|
||||
# -- Search in configmap, secret, or both.
|
||||
resource: both
|
||||
# -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
|
||||
script: null
|
||||
# -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
|
||||
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
|
||||
watchServerTimeout: 60
|
||||
#
|
||||
# -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
|
||||
# If you have a network outage dropping all packets with no RST/FIN,
|
||||
# this is how long your client waits before realizing & dropping the connection.
|
||||
# Defaults to 66sec.
|
||||
watchClientTimeout: 60
|
||||
# -- Log level of the sidecar container.
|
||||
logLevel: INFO
|
||||
@@ -0,0 +1,315 @@
|
||||
- name: observability
|
||||
namespace: observability
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/observability
|
||||
chart_version: 0.1.0
|
||||
{{- if .Modules.Observability.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
prometheus:
|
||||
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor: true
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
clustering:
|
||||
enabled: false
|
||||
replicas: 3
|
||||
shards: 1
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
|
||||
storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
|
||||
storageResources:
|
||||
requests:
|
||||
storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
|
||||
|
||||
scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
|
||||
retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
|
||||
# serviceNodePort: 30008
|
||||
|
||||
alertManager:
|
||||
enabled: {{ .Modules.Observability.Monitoring.AlertManager.Enabled }}
|
||||
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
enableDefaultRules: true
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
|
||||
tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# serviceNodePort: 30009
|
||||
|
||||
configPath: /etc/alertmanager
|
||||
|
||||
route:
|
||||
{{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
|
||||
|
||||
receivers:
|
||||
{{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
|
||||
|
||||
|
||||
blackboxExporter:
|
||||
enabled: {{ .Modules.Observability.Monitoring.Blackbox.Enabled }}
|
||||
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
|
||||
tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# serviceNodePort: 30012
|
||||
|
||||
configPath: /etc/blackbox_exporter
|
||||
additionalModules:
|
||||
|
||||
|
||||
kubeStateMetrics:
|
||||
enabled: {{ .Modules.Observability.Monitoring.KubeState.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
|
||||
tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
resources:
|
||||
requests:
|
||||
cpu: 30m
|
||||
memory: 120Mi
|
||||
limits:
|
||||
memory: 240Mi
|
||||
cpu: 60m
|
||||
|
||||
prometheusOperator:
|
||||
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
prometheusConfigReloader:
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
kubeRbacProxy:
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
nodeExporter:
|
||||
enabled: {{ .Modules.Observability.Monitoring.Node.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Monitoring.Node.Image }}
|
||||
tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
kubeEventsExporter:
|
||||
enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
|
||||
tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
lokiAddress: http://loki.observability.svc.cluster.local:3100
|
||||
logLevel: warn
|
||||
logFormat: json
|
||||
kubeQPS: 100
|
||||
kubeBurst: 500
|
||||
maxEventAgeSeconds: 120
|
||||
metricsNamePrefix: event_exporter_
|
||||
|
||||
cron:
|
||||
restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
|
||||
tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
additionalRoutes:
|
||||
additionalReceivers:
|
||||
|
||||
grafana:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
|
||||
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
|
||||
domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
|
||||
tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
|
||||
storageResources:
|
||||
requests:
|
||||
storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
|
||||
|
||||
config:
|
||||
server: |
|
||||
root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
|
||||
|
||||
security: |
|
||||
admin_user = admin
|
||||
admin_password = {{ .Modules.AdminPassword }}
|
||||
|
||||
auth: |
|
||||
{{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
|
||||
|
||||
authGenericAuth: |
|
||||
{{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
|
||||
|
||||
additionalDatasources:
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
|
||||
- name: Kube-loki
|
||||
type: loki
|
||||
access: proxy
|
||||
url: http://loki:3100
|
||||
editable: false
|
||||
basicAuth: false
|
||||
isDefault: false
|
||||
jsonData:
|
||||
maxLines: 1000
|
||||
{{- end }}
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
|
||||
- name: Kube-jaeger-query
|
||||
type: jaeger
|
||||
access: proxy
|
||||
url: http://tempo:16686
|
||||
editable: false
|
||||
basicAuth: false
|
||||
isDefault: false
|
||||
{{- end }}
|
||||
{{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
|
||||
{{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
|
||||
{{- end }}
|
||||
|
||||
opentelemetryCollector:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
|
||||
serviceMonitor: true
|
||||
config: |
|
||||
receivers:
|
||||
otlp:
|
||||
protocols:
|
||||
grpc:
|
||||
http:
|
||||
exporters:
|
||||
otlphttp:
|
||||
endpoint: http://tempo:4318
|
||||
service:
|
||||
telemetry:
|
||||
logs:
|
||||
level: "debug"
|
||||
pipelines:
|
||||
traces:
|
||||
receivers: [otlp]
|
||||
exporters: [otlphttp]
|
||||
|
||||
ingress:
|
||||
{{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress" }}
|
||||
enabled: true
|
||||
{{- end }}
|
||||
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
|
||||
class: {{ .Modules.Additional.Ingress.Type }}
|
||||
annotations:
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
|
||||
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
|
||||
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
|
||||
{{- end }}
|
||||
tls:
|
||||
{{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
|
||||
enabled: true
|
||||
{{- end }}
|
||||
hosts:
|
||||
- host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
|
||||
secretName: grafana-tls
|
||||
|
||||
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
|
||||
|
||||
fluentbit:
|
||||
enable: {{ .Modules.Observability.Logging.Enabled }}
|
||||
serviceMonitor: true
|
||||
image:
|
||||
repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
|
||||
tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
|
||||
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/edge
|
||||
operator: DoesNotExist
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
|
||||
input:
|
||||
tail:
|
||||
enable: true
|
||||
refreshIntervalSeconds: 10
|
||||
memBufLimit: 100MB
|
||||
bufferMaxSize: ""
|
||||
path: "/var/log/containers/*.log"
|
||||
skipLongLines: true
|
||||
readFromHead: false
|
||||
storageType: memory
|
||||
pauseOnChunksOverlimit: "off"
|
||||
systemd:
|
||||
enable: true
|
||||
systemdFilter:
|
||||
enable: true
|
||||
filters: []
|
||||
path: "/var/log/journal"
|
||||
includeKubelet: true
|
||||
stripUnderscores: "off"
|
||||
storageType: memory
|
||||
pauseOnChunksOverlimit: "off"
|
||||
|
||||
nodeExporterMetrics: {}
|
||||
fluentBitMetrics: {}
|
||||
|
||||
output:
|
||||
es:
|
||||
enable: false
|
||||
host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
|
||||
port: 9200
|
||||
logstashPrefix: ks-logstash-log
|
||||
bufferSize: 20MB
|
||||
traceError: true
|
||||
kafka:
|
||||
enable: false
|
||||
brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
|
||||
topics: ks-log
|
||||
opentelemetry: {}
|
||||
opensearch:
|
||||
enable: false
|
||||
stdout:
|
||||
enable: false
|
||||
loki:
|
||||
enable: true
|
||||
host: loki
|
||||
port: 3100
|
||||
|
||||
stackdriver: {}
|
||||
|
||||
service:
|
||||
storage: {}
|
||||
|
||||
filter:
|
||||
kubernetes:
|
||||
enable: true
|
||||
labels: true
|
||||
annotations: true
|
||||
containerd:
|
||||
enable: true
|
||||
systemd:
|
||||
enable: true
|
||||
|
||||
kubeedge:
|
||||
enable: false
|
||||
prometheusRemoteWrite:
|
||||
# Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
|
||||
host: "<cloud-prometheus-service-host>"
|
||||
# Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
|
||||
port: "<cloud-prometheus-service-port>"
|
||||
@@ -0,0 +1,145 @@
|
||||
- name: opentelemetry-operator
|
||||
namespace: observability
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/opentelemetry-operator
|
||||
chart_version: 0.55.0
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
replicaCount: 1
|
||||
nameOverride: ""
|
||||
imagePullSecrets: []
|
||||
pdb:
|
||||
create: false
|
||||
minAvailable: 1
|
||||
maxUnavailable: ""
|
||||
|
||||
manager:
|
||||
image:
|
||||
repository: {{ .Modules.Observability.Tracing.Operator.Image }}
|
||||
tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
|
||||
collectorImage:
|
||||
repository: {{ .Modules.Observability.Tracing.Collector.Image }}
|
||||
tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
|
||||
|
||||
featureGates: ""
|
||||
ports:
|
||||
metricsPort: 8080
|
||||
webhookPort: 9443
|
||||
healthzPort: 8081
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
env:
|
||||
ENABLE_WEBHOOKS: "true"
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
annotations: {}
|
||||
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
metricsEndpoints:
|
||||
- port: metrics
|
||||
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
groups: []
|
||||
defaultRules:
|
||||
enabled: true
|
||||
|
||||
extraArgs: []
|
||||
|
||||
leaderElection:
|
||||
enabled: true
|
||||
|
||||
verticalPodAutoscaler:
|
||||
enabled: false
|
||||
controlledResources: []
|
||||
maxAllowed: {}
|
||||
minAllowed: {}
|
||||
|
||||
updatePolicy:
|
||||
updateMode: Auto
|
||||
minReplicas: 2
|
||||
rolling: false
|
||||
|
||||
securityContext: {}
|
||||
|
||||
kubeRBACProxy:
|
||||
enabled: true
|
||||
image:
|
||||
repository: quay.io/brancz/kube-rbac-proxy
|
||||
tag: v0.15.0
|
||||
ports:
|
||||
proxyPort: 8443
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
|
||||
extraArgs: []
|
||||
|
||||
securityContext: {}
|
||||
|
||||
admissionWebhooks:
|
||||
create: true
|
||||
servicePort: 443
|
||||
failurePolicy: Fail
|
||||
secretName: ""
|
||||
pods:
|
||||
failurePolicy: Ignore
|
||||
|
||||
namePrefix: ""
|
||||
|
||||
timeoutSeconds: 10
|
||||
|
||||
namespaceSelector: {}
|
||||
objectSelector: {}
|
||||
certManager:
|
||||
enabled: true
|
||||
issuerRef: {}
|
||||
certificateAnnotations: {}
|
||||
issuerAnnotations: {}
|
||||
|
||||
autoGenerateCert:
|
||||
enabled: true
|
||||
recreate: true
|
||||
|
||||
secretAnnotations: {}
|
||||
secretLabels: {}
|
||||
|
||||
role:
|
||||
create: true
|
||||
|
||||
clusterRole:
|
||||
create: true
|
||||
|
||||
affinity: {}
|
||||
tolerations: []
|
||||
nodeSelector: {}
|
||||
topologySpreadConstraints: []
|
||||
hostNetwork: false
|
||||
|
||||
priorityClassName: ""
|
||||
|
||||
securityContext:
|
||||
runAsGroup: 65532
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
fsGroup: 65532
|
||||
|
||||
testFramework:
|
||||
image:
|
||||
repository: busybox
|
||||
tag: latest
|
||||
@@ -0,0 +1,79 @@
|
||||
- name: tempo
|
||||
namespace: observability
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/tempo
|
||||
chart_version: 1.7.2
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
replicas: 1
|
||||
|
||||
tempo:
|
||||
repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
|
||||
tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
updateStrategy: RollingUpdate
|
||||
|
||||
memBallastSizeMbs: 1024
|
||||
multitenancyEnabled: false
|
||||
reportingEnabled: false
|
||||
|
||||
metricsGenerator:
|
||||
enabled: false
|
||||
remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
|
||||
retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
|
||||
global_overrides:
|
||||
per_tenant_override_config: /conf/overrides.yaml
|
||||
|
||||
server:
|
||||
http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
|
||||
storage:
|
||||
trace:
|
||||
backend: local
|
||||
local:
|
||||
path: /var/tempo/traces
|
||||
wal:
|
||||
path: /var/tempo/wal
|
||||
receivers:
|
||||
otlp:
|
||||
protocols:
|
||||
grpc:
|
||||
endpoint: "0.0.0.0:4317"
|
||||
http:
|
||||
endpoint: "0.0.0.0:4318"
|
||||
|
||||
tempoQuery:
|
||||
repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
|
||||
tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
automountServiceAccountToken: true
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
|
||||
|
||||
priorityClassName: null
|
||||
@@ -0,0 +1,17 @@
|
||||
- name: harbor-certificate-generator
|
||||
namespace: {{ .Modules.Registry.Namespace }}
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/certificate-generator
|
||||
chart_version: 0.1.0
|
||||
{{- if and .Modules.Registry.Enabled (eq .Modules.Registry.Expose.Type "ingress") }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
|
||||
solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
|
||||
|
||||
certificates:
|
||||
- name: harbor-tls
|
||||
domain: {{ .Modules.Registry.Expose.Domain }}
|
||||
@@ -0,0 +1,382 @@
|
||||
- name: harbor
|
||||
namespace: {{ .Modules.Registry.Namespace }}
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/harbor
|
||||
chart_version: 1.14.2
|
||||
{{- if .Modules.Registry.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
expose:
|
||||
type: {{ .Modules.Registry.Expose.Type }}
|
||||
tls:
|
||||
enabled: {{ .Modules.Registry.Tls.Enabled }}
|
||||
certSource: secret
|
||||
secret:
|
||||
secretName: harbor-tls
|
||||
ingress:
|
||||
hosts:
|
||||
core: {{ .Modules.Registry.Expose.Domain }}
|
||||
controller: default
|
||||
kubeVersionOverride: ""
|
||||
className: "{{ .Modules.Additional.Ingress.Type }}"
|
||||
annotations:
|
||||
ingress.kubernetes.io/ssl-redirect: "true"
|
||||
ingress.kubernetes.io/proxy-body-size: "0"
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
{{- end }}
|
||||
labels: {}
|
||||
|
||||
nodePort:
|
||||
name: harbor
|
||||
ports:
|
||||
http:
|
||||
port: 80
|
||||
nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
|
||||
https:
|
||||
port: 443
|
||||
nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
|
||||
|
||||
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}
|
||||
persistence:
|
||||
resourcePolicy: "keep"
|
||||
persistentVolumeClaim:
|
||||
registry:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.RegistrySize }}
|
||||
annotations: {}
|
||||
jobservice:
|
||||
jobLog:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.JobserviceSize }}
|
||||
annotations: {}
|
||||
database:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.DatabaseSize }}
|
||||
annotations: {}
|
||||
redis:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.RedisSize }}
|
||||
annotations: {}
|
||||
trivy:
|
||||
existingClaim: ""
|
||||
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
|
||||
subPath: ""
|
||||
accessMode: ReadWriteOnce
|
||||
size: {{ .Modules.Registry.Persistence.TrivySize }}
|
||||
annotations: {}
|
||||
|
||||
imageChartStorage:
|
||||
disableredirect: false
|
||||
|
||||
type: filesystem
|
||||
filesystem:
|
||||
rootdirectory: /storage
|
||||
#maxthreads: 100
|
||||
|
||||
imagePullPolicy: IfNotPresent
|
||||
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
|
||||
harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
|
||||
|
||||
logLevel: info
|
||||
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
core:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
registry:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
jobservice:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
exporter:
|
||||
path: /metrics
|
||||
port: 8001
|
||||
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
trace:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
|
||||
provider: otel
|
||||
sample_rate: 1
|
||||
attributes:
|
||||
application: harbor
|
||||
jaeger:
|
||||
endpoint: http://hostname:14268/api/traces
|
||||
otel:
|
||||
endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
|
||||
url_path: /v1/traces
|
||||
compression: false
|
||||
insecure: true
|
||||
timeout: 10
|
||||
|
||||
portal:
|
||||
image:
|
||||
repository: goharbor/harbor-portal
|
||||
tag: {{ .Modules.Registry.Version }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
podLabels:
|
||||
"app.kubernetes.io/component": "harbor-portal"
|
||||
priorityClassName:
|
||||
|
||||
core:
|
||||
image:
|
||||
repository: goharbor/harbor-core
|
||||
tag: {{ .Modules.Registry.Version }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
startupProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 10
|
||||
extraEnvVars: []
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
topologySpreadConstraints: []
|
||||
podLabels:
|
||||
"app.kubernetes.io/component": "harbor-core"
|
||||
serviceAnnotations: {}
|
||||
priorityClassName:
|
||||
configureUserSettings:
|
||||
quotaUpdateProvider: db # Or redis
|
||||
secret: ""
|
||||
existingSecret: ""
|
||||
secretName: ""
|
||||
tokenKey: ""
|
||||
|
||||
tokenCert: ""
|
||||
|
||||
xsrfKey: ""
|
||||
existingXsrfSecret: ""
|
||||
existingXsrfSecretKey: CSRF_KEY
|
||||
artifactPullAsyncFlushDuration:
|
||||
gdpr:
|
||||
deleteUser: false
|
||||
auditLogsCompliant: false
|
||||
|
||||
|
||||
jobservice:
|
||||
image:
|
||||
repository: goharbor/harbor-jobservice
|
||||
tag: {{ .Modules.Registry.Version }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
topologySpreadConstraints:
|
||||
podLabels:
|
||||
"app.kubernetes.io/component": "harbor-jobservice"
|
||||
priorityClassName:
|
||||
maxJobWorkers: 10
|
||||
jobLoggers:
|
||||
- file
|
||||
# - database
|
||||
# - stdout
|
||||
loggerSweeperDuration: 14 #days
|
||||
notification:
|
||||
webhook_job_max_retry: 3
|
||||
webhook_job_http_client_timeout: 3 # in seconds
|
||||
reaper:
|
||||
max_update_hours: 24
|
||||
max_dangling_hours: 168
|
||||
secret: ""
|
||||
existingSecret: ""
|
||||
existingSecretKey: JOBSERVICE_SECRET
|
||||
|
||||
registry:
|
||||
registry:
|
||||
image:
|
||||
repository: goharbor/registry-photon
|
||||
tag: {{ .Modules.Registry.Version }}
|
||||
extraEnvVars: []
|
||||
controller:
|
||||
image:
|
||||
repository: goharbor/harbor-registryctl
|
||||
tag: {{ .Modules.Registry.Version }}
|
||||
extraEnvVars: []
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
topologySpreadConstraints: []
|
||||
podLabels:
|
||||
"app.kubernetes.io/component": "harbor-registry"
|
||||
priorityClassName:
|
||||
secret: ""
|
||||
existingSecret: ""
|
||||
existingSecretKey: REGISTRY_HTTP_SECRET
|
||||
relativeurls: false
|
||||
credentials:
|
||||
# If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
|
||||
existingSecret: ""
|
||||
# Login and password in htpasswd string format. Excludes `registry.credentials.username` and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
|
||||
# htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
|
||||
# htpasswdString: ""
|
||||
middleware:
|
||||
enabled: false
|
||||
type: cloudFront
|
||||
cloudFront:
|
||||
baseurl: example.cloudfront.net
|
||||
keypairid: KEYPAIRID
|
||||
duration: 3000s
|
||||
ipfilteredby: none
|
||||
# The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
|
||||
# that allows access to CloudFront
|
||||
privateKeySecret: "my-secret"
|
||||
# enable purge _upload directories
|
||||
upload_purging:
|
||||
enabled: true
|
||||
# remove files in _upload directories which exist for a period of time, default is one week.
|
||||
age: 168h
|
||||
# the interval of the purge operations
|
||||
interval: 24h
|
||||
dryrun: false
|
||||
|
||||
trivy:
|
||||
enabled: {{ .Modules.Registry.EnabledScanner }}
|
||||
image:
|
||||
repository: goharbor/trivy-adapter-photon
|
||||
tag: {{ .Modules.Registry.Version }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1
|
||||
memory: 1Gi
|
||||
|
||||
|
||||
database:
|
||||
# if external database is used, set "type" to "external"
|
||||
# and fill the connection information in "external" section
|
||||
type: internal
|
||||
internal:
|
||||
image:
|
||||
repository: goharbor/harbor-db
|
||||
tag: {{ .Modules.Registry.Version }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
livenessProbe:
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
timeoutSeconds: 1
|
||||
priorityClassName:
|
||||
# The initial superuser password for internal database
|
||||
# password: "changeit"
|
||||
# The size limit for Shared memory, pgSQL use it for shared_buffer
|
||||
# More details see:
|
||||
# https://github.com/goharbor/harbor/issues/15034
|
||||
shmSizeLimit: 512Mi
|
||||
initContainer:
|
||||
migrator: {}
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 128Mi
|
||||
# cpu: 100m
|
||||
permissions: {}
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 128Mi
|
||||
# cpu: 100m
|
||||
external:
|
||||
host: "192.168.0.1"
|
||||
port: "5432"
|
||||
username: "user"
|
||||
password: "password"
|
||||
coreDatabase: "registry"
|
||||
# if using existing secret, the key must be "password"
|
||||
existingSecret: ""
|
||||
# "disable" - No SSL
|
||||
# "require" - Always SSL (skip verification)
|
||||
# "verify-ca" - Always SSL (verify that the certificate presented by the
|
||||
# server was signed by a trusted CA)
|
||||
# "verify-full" - Always SSL (verify that the certification presented by the
|
||||
# server was signed by a trusted CA and the server host name matches the one
|
||||
# in the certificate)
|
||||
sslmode: "disable"
|
||||
# The maximum number of connections in the idle connection pool per pod (core+exporter).
|
||||
# If it <=0, no idle connections are retained.
|
||||
maxIdleConns: 100
|
||||
# The maximum number of open connections to the database per pod (core+exporter).
|
||||
# If it <= 0, then there is no limit on the number of open connections.
|
||||
# Note: the default number of connections is 1024 for postgre of harbor.
|
||||
maxOpenConns: 900
|
||||
## Additional deployment annotations
|
||||
podAnnotations: {}
|
||||
## Additional deployment labels
|
||||
podLabels: {}
|
||||
|
||||
|
||||
redis:
|
||||
type: internal
|
||||
internal:
|
||||
image:
|
||||
repository: goharbor/redis-photon
|
||||
tag: {{ .Modules.Registry.Version }}
|
||||
serviceAccountName: ""
|
||||
automountServiceAccountToken: false
|
||||
extraEnvVars: []
|
||||
nodeSelector: {}
|
||||
tolerations: []
|
||||
affinity: {}
|
||||
priorityClassName:
|
||||
jobserviceDatabaseIndex: "1"
|
||||
registryDatabaseIndex: "2"
|
||||
trivyAdapterIndex: "5"
|
||||
# harborDatabaseIndex: "6"
|
||||
# cacheLayerDatabaseIndex: "7"
|
||||
external:
|
||||
# support redis, redis+sentinel
|
||||
# addr for redis: <host_redis>:<port_redis>
|
||||
# addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
|
||||
addr: "192.168.0.2:6379"
|
||||
# The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
|
||||
sentinelMasterSet: ""
|
||||
# The "coreDatabaseIndex" must be "0" as the library Harbor
|
||||
# used doesn't support configuring it
|
||||
# harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
|
||||
# cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
|
||||
coreDatabaseIndex: "0"
|
||||
jobserviceDatabaseIndex: "1"
|
||||
registryDatabaseIndex: "2"
|
||||
trivyAdapterIndex: "5"
|
||||
# harborDatabaseIndex: "6"
|
||||
# cacheLayerDatabaseIndex: "7"
|
||||
# username field can be an empty string, and it will be authenticated against the default user
|
||||
username: ""
|
||||
password: ""
|
||||
existingSecret: ""
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
@@ -0,0 +1,883 @@
|
||||
- name: vault
|
||||
namespace: secrets-storage
|
||||
create_namespace: true
|
||||
chart_ref: kube-forge/vault
|
||||
chart_version: 0.1.0
|
||||
{{- if .Modules.SecretsStorage.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
global:
|
||||
enabled: true
|
||||
|
||||
imagePullSecrets: []
|
||||
tlsDisable: true
|
||||
|
||||
externalVaultAddr: ""
|
||||
|
||||
openshift: false
|
||||
|
||||
# Create PodSecurityPolicy for pods
|
||||
psp:
|
||||
enable: false
|
||||
# Annotation for PodSecurityPolicy.
|
||||
# This is a multi-line templated string map, and can also be set as YAML.
|
||||
annotations: |
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
|
||||
|
||||
serverTelemetry:
|
||||
# Enable integration with the Prometheus Operator
|
||||
# See the top level serverTelemetry section below before enabling this feature.
|
||||
prometheusOperator: false
|
||||
|
||||
injector:
|
||||
enabled: true
|
||||
|
||||
replicas: 1
|
||||
|
||||
# Configures the port the injector should listen on
|
||||
port: 8080
|
||||
|
||||
# If multiple replicas are specified, by default a leader will be determined
|
||||
# so that only one injector attempts to create TLS certificates.
|
||||
leaderElector:
|
||||
enabled: true
|
||||
|
||||
# If true, will enable a node exporter metrics endpoint at /metrics.
|
||||
metrics:
|
||||
enabled: false
|
||||
|
||||
# Deprecated: Please use global.externalVaultAddr instead.
|
||||
externalVaultAddr: ""
|
||||
|
||||
# image sets the repo and tag of the vault-k8s image to use for the injector.
|
||||
image:
|
||||
repository: "{{ .Modules.SecretsStorage.Injector.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.Injector.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# agentImage sets the repo and tag of the Vault image to use for the Vault Agent
|
||||
# containers. This should be set to the official Vault image. Vault 1.3.1+ is
|
||||
# required.
|
||||
agentImage:
|
||||
repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
|
||||
agentDefaults:
|
||||
cpuLimit: "500m"
|
||||
cpuRequest: "250m"
|
||||
memLimit: "128Mi"
|
||||
memRequest: "64Mi"
|
||||
# ephemeralLimit: "128Mi"
|
||||
# ephemeralRequest: "64Mi"
|
||||
|
||||
# Default template type for secrets when no custom template is specified.
|
||||
# Possible values include: "json" and "map".
|
||||
template: "map"
|
||||
|
||||
# Default values within Agent's template_config stanza.
|
||||
templateConfig:
|
||||
exitOnRetryFailure: true
|
||||
staticSecretRenderInterval: ""
|
||||
|
||||
# Used to define custom livenessProbe settings
|
||||
livenessProbe:
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 2
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 5
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 2
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 5
|
||||
# Used to define custom readinessProbe settings
|
||||
readinessProbe:
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 2
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 5
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 2
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 5
|
||||
# Used to define custom startupProbe settings
|
||||
startupProbe:
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 12
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 5
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 5
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 5
|
||||
|
||||
# Mount Path of the Vault Kubernetes Auth Method.
|
||||
authPath: "auth/kubernetes"
|
||||
|
||||
# Configures the log verbosity of the injector.
|
||||
# Supported log levels include: trace, debug, info, warn, error
|
||||
logLevel: "info"
|
||||
|
||||
# Configures the log format of the injector. Supported log formats: "standard", "json".
|
||||
logFormat: "standard"
|
||||
|
||||
# Configures all Vault Agent sidecars to revoke their token when shutting down
|
||||
revokeOnShutdown: false
|
||||
|
||||
webhook:
|
||||
# Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
|
||||
# API Tag of the WebHook.
|
||||
# To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
|
||||
#
|
||||
failurePolicy: Ignore
|
||||
|
||||
# matchPolicy specifies the approach to accepting changes based on the rules of
|
||||
# the MutatingWebhookConfiguration.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
|
||||
# for more details.
|
||||
#
|
||||
matchPolicy: Exact
|
||||
|
||||
# timeoutSeconds is the amount of seconds before the webhook request will be ignored
|
||||
# or fails.
|
||||
# If it is ignored or fails depends on the failurePolicy
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
|
||||
# for more details.
|
||||
#
|
||||
timeoutSeconds: 30
|
||||
|
||||
# namespaceSelector is the selector for restricting the webhook to only
|
||||
# specific namespaces.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
|
||||
# for more details.
|
||||
# Example:
|
||||
# namespaceSelector:
|
||||
# matchLabels:
|
||||
# sidecar-injector: enabled
|
||||
namespaceSelector: {}
|
||||
|
||||
# objectSelector is the selector for restricting the webhook to only
|
||||
# specific labels.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
|
||||
# for more details.
|
||||
# Example:
|
||||
# objectSelector:
|
||||
# matchLabels:
|
||||
# vault-sidecar-injector: enabled
|
||||
|
||||
# Extra annotations to attach to the webhook
|
||||
annotations: {}
|
||||
|
||||
# Deprecated: please use 'webhook.failurePolicy' instead
|
||||
# Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
|
||||
# API Tag of the WebHook.
|
||||
# To block pod creation while webhook is unavailable, set the policy to `Fail` below.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
|
||||
#
|
||||
failurePolicy: Ignore
|
||||
|
||||
# Deprecated: please use 'webhook.namespaceSelector' instead
|
||||
# namespaceSelector is the selector for restricting the webhook to only
|
||||
# specific namespaces.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
|
||||
# for more details.
|
||||
# Example:
|
||||
# namespaceSelector:
|
||||
# matchLabels:
|
||||
# sidecar-injector: enabled
|
||||
namespaceSelector: {}
|
||||
|
||||
# Deprecated: please use 'webhook.objectSelector' instead
|
||||
# objectSelector is the selector for restricting the webhook to only
|
||||
# specific labels.
|
||||
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
|
||||
# for more details.
|
||||
# Example:
|
||||
# objectSelector:
|
||||
# matchLabels:
|
||||
# vault-sidecar-injector: enabled
|
||||
objectSelector: {}
|
||||
|
||||
# Deprecated: please use 'webhook.annotations' instead
|
||||
# Extra annotations to attach to the webhook
|
||||
webhookAnnotations: {}
|
||||
|
||||
certs:
|
||||
# secretName is the name of the secret that has the TLS certificate and
|
||||
# private key to serve the injector webhook. If this is null, then the
|
||||
# injector will default to its automatic management mode that will assign
|
||||
# a service account to the injector to generate its own certificates.
|
||||
secretName: null
|
||||
|
||||
# caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
|
||||
# that signed the TLS certificate that the webhook serves. This must be set
|
||||
# if secretName is non-null unless an external service like cert-manager is
|
||||
# keeping the caBundle updated.
|
||||
caBundle: ""
|
||||
|
||||
# certName and keyName are the names of the files within the secret for
|
||||
# the TLS cert and private key, respectively. These have reasonable
|
||||
# defaults but can be customized if necessary.
|
||||
certName: tls.crt
|
||||
keyName: tls.key
|
||||
|
||||
securityContext:
|
||||
pod: {}
|
||||
container: {}
|
||||
|
||||
resources: {}
|
||||
|
||||
# extraEnvironmentVars is a list of extra environment variables to set in the
|
||||
# injector deployment.
|
||||
extraEnvironmentVars: {}
|
||||
# KUBERNETES_SERVICE_HOST: kubernetes.default.svc
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
tolerations: []
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
priorityClassName: ""
|
||||
|
||||
annotations: {}
|
||||
|
||||
extraLabels: {}
|
||||
|
||||
hostNetwork: false
|
||||
|
||||
|
||||
service:
|
||||
# Extra annotations to attach to the injector service
|
||||
annotations: {}
|
||||
|
||||
# Injector serviceAccount specific config
|
||||
serviceAccount:
|
||||
# Extra annotations to attach to the injector serviceAccount
|
||||
annotations: {}
|
||||
|
||||
# A disruption budget limits the number of pods of a replicated application
|
||||
# that are down simultaneously from voluntary disruptions
|
||||
podDisruptionBudget: {}
|
||||
# podDisruptionBudget:
|
||||
# maxUnavailable: 1
|
||||
|
||||
# strategy for updating the deployment. This can be a multi-line string or a
|
||||
# YAML map.
|
||||
strategy: {}
|
||||
# strategy: |
|
||||
# rollingUpdate:
|
||||
# maxSurge: 25%
|
||||
# maxUnavailable: 25%
|
||||
# type: RollingUpdate
|
||||
|
||||
server:
|
||||
enabled: true
|
||||
enterpriseLicense:
|
||||
# The name of the Kubernetes secret that holds the enterprise license. The
|
||||
# secret must be in the same namespace that Vault is installed into.
|
||||
secretName: ""
|
||||
# The key within the Kubernetes secret that holds the enterprise license.
|
||||
secretKey: "license"
|
||||
|
||||
image:
|
||||
repository: "{{ .Modules.SecretsStorage.Server.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.Server.Tag }}"
|
||||
# Overrides the default Image Pull Policy
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
updateStrategyType: "RollingUpdate"
|
||||
|
||||
# Supported log levels include: trace, debug, info, warn, error
|
||||
logLevel: ""
|
||||
|
||||
# Supported log formats include: standard, json
|
||||
logFormat: ""
|
||||
|
||||
resources: {}
|
||||
|
||||
hostAliases: []
|
||||
# - ip: 127.0.0.1
|
||||
# hostnames:
|
||||
# - chart-example.local
|
||||
|
||||
route:
|
||||
enabled: false
|
||||
|
||||
# When HA mode is enabled and K8s service registration is being used,
|
||||
# configure the route to point to the Vault active service.
|
||||
activeService: true
|
||||
|
||||
labels: {}
|
||||
annotations: {}
|
||||
host: chart-example.local
|
||||
# tls will be passed directly to the route's TLS config, which
|
||||
# can be used to configure other termination methods that terminate
|
||||
# TLS at the router
|
||||
tls:
|
||||
termination: passthrough
|
||||
|
||||
# authDelegator enables a cluster role binding to be attached to the service
|
||||
# account. This cluster role binding can be used to setup Kubernetes auth
|
||||
# method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes
|
||||
authDelegator:
|
||||
enabled: true
|
||||
|
||||
extraInitContainers: null
|
||||
extraContainers: null
|
||||
shareProcessNamespace: false
|
||||
extraArgs: ""
|
||||
|
||||
extraPorts: null
|
||||
# - containerPort: 8300
|
||||
# name: http-monitoring
|
||||
|
||||
readinessProbe:
|
||||
enabled: true
|
||||
# If you need to use a http path instead of the default exec
|
||||
# path: /v1/sys/health?standbyok=true
|
||||
|
||||
# Port number on which readinessProbe will be checked.
|
||||
port: 8200
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 2
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 5
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 5
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 3
|
||||
# Used to enable a livenessProbe for the pods
|
||||
livenessProbe:
|
||||
enabled: false
|
||||
# Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
|
||||
execCommand: []
|
||||
# - /bin/sh
|
||||
# - -c
|
||||
# - /vault/userconfig/mylivenessscript/run.sh
|
||||
# Path for the livenessProbe to use httpGet as the livenessProbe handler
|
||||
path: "/v1/sys/health?standbyok=true"
|
||||
# Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
|
||||
port: 8200
|
||||
# When a probe fails, Kubernetes will try failureThreshold times before giving up
|
||||
failureThreshold: 2
|
||||
# Number of seconds after the container has started before probe initiates
|
||||
initialDelaySeconds: 60
|
||||
# How often (in seconds) to perform the probe
|
||||
periodSeconds: 5
|
||||
# Minimum consecutive successes for the probe to be considered successful after having failed
|
||||
successThreshold: 1
|
||||
# Number of seconds after which the probe times out.
|
||||
timeoutSeconds: 3
|
||||
|
||||
terminationGracePeriodSeconds: 10
|
||||
|
||||
# Used to set the sleep time during the preStop step
|
||||
preStopSleepSeconds: 5
|
||||
|
||||
postStart:
|
||||
# - /bin/sh
|
||||
# - -c
|
||||
# - /vault/userconfig/myscript/run.sh
|
||||
|
||||
extraEnvironmentVars: {}
|
||||
|
||||
extraSecretEnvironmentVars: []
|
||||
|
||||
extraVolumes: []
|
||||
|
||||
volumes: null
|
||||
|
||||
volumeMounts: null
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
tolerations: []
|
||||
nodeSelector: {}
|
||||
|
||||
# Enables network policy for server pods
|
||||
networkPolicy:
|
||||
enabled: false
|
||||
egress: []
|
||||
# egress:
|
||||
# - to:
|
||||
# - ipBlock:
|
||||
# cidr: 10.0.0.0/24
|
||||
# ports:
|
||||
# - protocol: TCP
|
||||
# port: 443
|
||||
ingress:
|
||||
- from:
|
||||
- namespaceSelector: {}
|
||||
ports:
|
||||
- port: 8200
|
||||
protocol: TCP
|
||||
- port: 8201
|
||||
protocol: TCP
|
||||
|
||||
priorityClassName: ""
|
||||
extraLabels: {}
|
||||
|
||||
annotations: {}
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
# Enable or disable the vault-active service, which selects Vault pods that
|
||||
# have labeled themselves as the cluster leader with `vault-active: "true"`.
|
||||
active:
|
||||
enabled: true
|
||||
# Extra annotations for the service definition. This can either be YAML or a
|
||||
# YAML-formatted multi-line templated string map of the annotations to apply
|
||||
# to the active service.
|
||||
annotations: {}
|
||||
# Enable or disable the vault-standby service, which selects Vault pods that
|
||||
# have labeled themselves as a cluster follower with `vault-active: "false"`.
|
||||
standby:
|
||||
enabled: true
|
||||
# Extra annotations for the service definition. This can either be YAML or a
|
||||
# YAML-formatted multi-line templated string map of the annotations to apply
|
||||
# to the standby service.
|
||||
annotations: {}
|
||||
# When disabled, services may select Vault pods not deployed from the chart.
|
||||
# Does not affect the headless vault-internal service with `ClusterIP: None`
|
||||
instanceSelector:
|
||||
enabled: true
|
||||
# clusterIP controls whether a Cluster IP address is attached to the
|
||||
# Vault service within Kubernetes. By default, the Vault service will
|
||||
# be given a Cluster IP address, set to None to disable. When disabled
|
||||
# Kubernetes will create a "headless" service. Headless services can be
|
||||
# used to communicate with pods directly through DNS instead of a round-robin
|
||||
# load balancer.
|
||||
# clusterIP: None
|
||||
|
||||
# Configures the service type for the main Vault service. Can be ClusterIP
|
||||
# or NodePort.
|
||||
#type: ClusterIP
|
||||
|
||||
# The IP family and IP families options are to set the behaviour in a dual-stack environment.
|
||||
# Omitting these values will let the service fall back to whatever the CNI dictates the defaults
|
||||
# should be.
|
||||
# These are only supported for kubernetes versions >=1.23.0
|
||||
#
|
||||
# Configures the service's supported IP family policy, can be either:
|
||||
# SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
|
||||
# PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
|
||||
# RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
|
||||
ipFamilyPolicy: ""
|
||||
|
||||
# Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
|
||||
# Can be IPv4 and/or IPv6.
|
||||
ipFamilies: []
|
||||
|
||||
# Do not wait for pods to be ready before including them in the services'
|
||||
# targets. Does not apply to the headless service, which is used for
|
||||
# cluster-internal communication.
|
||||
publishNotReadyAddresses: true
|
||||
|
||||
# The externalTrafficPolicy can be set to either Cluster or Local
|
||||
# and is only valid for LoadBalancer and NodePort service types.
|
||||
# The default value is Cluster.
|
||||
# ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
|
||||
externalTrafficPolicy: Cluster
|
||||
|
||||
# If type is set to "NodePort", a specific nodePort value can be configured,
|
||||
# will be random if left blank.
|
||||
#nodePort: 30000
|
||||
|
||||
# When HA mode is enabled
|
||||
# If type is set to "NodePort", a specific nodePort value can be configured,
|
||||
# will be random if left blank.
|
||||
#activeNodePort: 30001
|
||||
|
||||
# When HA mode is enabled
|
||||
# If type is set to "NodePort", a specific nodePort value can be configured,
|
||||
# will be random if left blank.
|
||||
#standbyNodePort: 30002
|
||||
|
||||
# Port on which Vault server is listening
|
||||
port: 8200
|
||||
# Target port to which the service should be mapped to
|
||||
targetPort: 8200
|
||||
# Extra annotations for the service definition. This can either be YAML or a
|
||||
# YAML-formatted multi-line templated string map of the annotations to apply
|
||||
# to the service.
|
||||
annotations: {}
|
||||
|
||||
dataStorage:
|
||||
enabled: true
|
||||
size: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.Size }}
|
||||
mountPath: "/vault/data"
|
||||
storageClass: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.StorageClass }}
|
||||
accessMode: ReadWriteOnce
|
||||
annotations: {}
|
||||
labels: {}
|
||||
|
||||
persistentVolumeClaimRetentionPolicy: {}
|
||||
|
||||
# required for ha installation
|
||||
auditStorage:
|
||||
enabled: false
|
||||
# Size of the PVC created
|
||||
size: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.Size }}
|
||||
# Location where the PVC will be mounted.
|
||||
mountPath: "/vault/audit"
|
||||
# Name of the storage class to use. If null it will use the
|
||||
# configured default Storage Class.
|
||||
storageClass: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.StorageClass }}
|
||||
# Access Mode of the storage device being used for the PVC
|
||||
accessMode: ReadWriteOnce
|
||||
# Annotations to apply to the PVC
|
||||
annotations: {}
|
||||
# Labels to apply to the PVC
|
||||
labels: {}
|
||||
|
||||
dev:
|
||||
enabled: false
|
||||
|
||||
# Set VAULT_DEV_ROOT_TOKEN_ID value
|
||||
devRootToken: "root"
|
||||
|
||||
# Run Vault in "standalone" mode. This is the default mode that will deploy if
|
||||
# no arguments are given to helm. This requires a PVC for data storage to use
|
||||
# the "file" backend. This mode is not highly available and should not be scaled
|
||||
# past a single replica.
|
||||
standalone:
|
||||
enabled: "-"
|
||||
|
||||
# config is a raw string of default configuration when using a Stateful
|
||||
# deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data
|
||||
# and store data there. This is only used when using a Replica count of 1, and
|
||||
# using a stateful set. This should be HCL.
|
||||
|
||||
# Note: Configuration files are stored in ConfigMaps so sensitive data
|
||||
# such as passwords should be either mounted through extraSecretEnvironmentVars
|
||||
# or through a Kube secret. For more information see:
|
||||
# https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
|
||||
config: |
|
||||
ui = true
|
||||
|
||||
listener "tcp" {
|
||||
tls_disable = 1
|
||||
address = "[::]:8200"
|
||||
cluster_address = "[::]:8201"
|
||||
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
unauthenticated_metrics_access = "true"
|
||||
}
|
||||
{{- end }}
|
||||
}
|
||||
storage "file" {
|
||||
path = "/vault/data"
|
||||
}
|
||||
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
prometheus_retention_time = "30s"
|
||||
disable_hostname = true
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
# Run Vault in "HA" mode. There are no storage requirements unless the audit log
|
||||
# persistence is required. In HA mode Vault will configure itself to use Consul
|
||||
# for its storage backend. The default configuration provided will work the Consul
|
||||
# Helm project by default. It is possible to manually configure Vault to use a
|
||||
# different HA backend.
|
||||
ha:
|
||||
enabled: false
|
||||
replicas: 3
|
||||
|
||||
# Set the api_addr configuration for Vault HA
|
||||
# See https://developer.hashicorp.com/vault/docs/configuration#api_addr
|
||||
# If set to null, this will be set to the Pod IP Address
|
||||
apiAddr: null
|
||||
|
||||
# Set the cluster_addr confuguration for Vault HA
|
||||
# See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr
|
||||
clusterAddr: null
|
||||
|
||||
# Enables Vault's integrated Raft storage. Unlike the typical HA modes where
|
||||
# Vault's persistence is external (such as Consul), enabling Raft mode will create
|
||||
# persistent volumes for Vault to store data according to the configuration under server.dataStorage.
|
||||
# The Vault cluster will coordinate leader elections and failovers internally.
|
||||
raft:
|
||||
# Enables Raft integrated storage
|
||||
enabled: false
|
||||
# Set the Node Raft ID to the name of the pod
|
||||
setNodeId: false
|
||||
|
||||
config: |
|
||||
ui = true
|
||||
|
||||
listener "tcp" {
|
||||
tls_disable = 1
|
||||
address = "[::]:8200"
|
||||
cluster_address = "[::]:8201"
|
||||
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
unauthenticated_metrics_access = "true"
|
||||
}
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
storage "raft" {
|
||||
path = "/vault/data"
|
||||
}
|
||||
|
||||
service_registration "kubernetes" {}
|
||||
|
||||
# config is a raw string of default configuration when using a Stateful
|
||||
# deployment. Default is to use a Consul for its HA storage backend.
|
||||
# This should be HCL.
|
||||
|
||||
# Note: Configuration files are stored in ConfigMaps so sensitive data
|
||||
# such as passwords should be either mounted through extraSecretEnvironmentVars
|
||||
# or through a Kube secret. For more information see:
|
||||
# https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
|
||||
config: |
|
||||
ui = true
|
||||
|
||||
listener "tcp" {
|
||||
tls_disable = 1
|
||||
address = "[::]:8200"
|
||||
cluster_address = "[::]:8201"
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
unauthenticated_metrics_access = "true"
|
||||
}
|
||||
{{- end }}
|
||||
}
|
||||
storage "consul" {
|
||||
path = "vault"
|
||||
address = "HOST_IP:8500"
|
||||
}
|
||||
|
||||
service_registration "kubernetes" {}
|
||||
|
||||
# Example configuration for using auto-unseal, using Google Cloud KMS. The
|
||||
# GKMS keys must already exist, and the cluster must have a service account
|
||||
# that is authorized to access GCP KMS.
|
||||
#seal "gcpckms" {
|
||||
# project = "vault-helm-dev-246514"
|
||||
# region = "global"
|
||||
# key_ring = "vault-helm-unseal-kr"
|
||||
# crypto_key = "vault-helm-unseal-key"
|
||||
#}
|
||||
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
telemetry {
|
||||
prometheus_retention_time = "30s"
|
||||
disable_hostname = true
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
# A disruption budget limits the number of pods of a replicated application
|
||||
# that are down simultaneously from voluntary disruptions
|
||||
disruptionBudget:
|
||||
enabled: true
|
||||
|
||||
# maxUnavailable will default to (n/2)-1 where n is the number of
|
||||
# replicas. If you'd like a custom value, you can specify an override here.
|
||||
maxUnavailable: null
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: ""
|
||||
createSecret: false
|
||||
annotations: {}
|
||||
extraLabels: {}
|
||||
serviceDiscovery:
|
||||
enabled: true
|
||||
|
||||
statefulSet:
|
||||
annotations: {}
|
||||
securityContext:
|
||||
pod: {}
|
||||
container: {}
|
||||
|
||||
hostNetwork: false
|
||||
|
||||
# Vault UI
|
||||
ui:
|
||||
enabled: true
|
||||
domain: {{ .Modules.SecretsStorage.Expose.Domain }}
|
||||
publishNotReadyAddresses: true
|
||||
# The service should only contain selectors for active Vault pod
|
||||
activeVaultPodOnly: false
|
||||
{{- if eq .Modules.SecretsStorage.Expose.Type "NodePort" }}
|
||||
serviceType: "NodePort"
|
||||
serviceNodePort: {{ .Modules.SecretsStorage.Expose.NodePort }}
|
||||
{{- else }}
|
||||
serviceType: "ClusterIP"
|
||||
serviceNodePort: null
|
||||
{{- end }}
|
||||
externalPort: 8200
|
||||
targetPort: 8200
|
||||
|
||||
serviceIPFamilyPolicy: ""
|
||||
|
||||
serviceIPFamilies: []
|
||||
|
||||
externalTrafficPolicy: Cluster
|
||||
|
||||
#loadBalancerSourceRanges:
|
||||
# - 10.0.0.0/16
|
||||
# - 1.78.23.3/32
|
||||
|
||||
# loadBalancerIP:
|
||||
|
||||
annotations: {}
|
||||
|
||||
csi:
|
||||
# True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
|
||||
#
|
||||
# Requires installing the secrets-store-csi-driver separately, see:
|
||||
# https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
|
||||
#
|
||||
# With the driver and provider installed, you can mount Vault secrets into volumes
|
||||
# similar to the Vault Agent injector, and you can also sync those secrets into
|
||||
# Kubernetes secrets.
|
||||
enabled: {{ .Modules.SecretsStorage.CsiIntegration.Enabled }}
|
||||
|
||||
image:
|
||||
repository: "{{ .Modules.SecretsStorage.CsiIntegration.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.CsiIntegration.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
volumes: null
|
||||
|
||||
volumeMounts: null
|
||||
|
||||
resources: {}
|
||||
|
||||
# Override the default secret name for the CSI Provider's HMAC key used for
|
||||
# generating secret versions.
|
||||
hmacSecretName: ""
|
||||
|
||||
daemonSet:
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
maxUnavailable: ""
|
||||
# Extra annotations for the daemonSet. This can either be YAML or a
|
||||
# YAML-formatted multi-line templated string map of the annotations to apply
|
||||
# to the daemonSet.
|
||||
annotations: {}
|
||||
# Provider host path (must match the CSI provider's path)
|
||||
providersDir: "/etc/kubernetes/secrets-store-csi-providers"
|
||||
# Kubelet host path
|
||||
kubeletRootDir: "/var/lib/kubelet"
|
||||
# Extra labels to attach to the vault-csi-provider daemonSet
|
||||
# This should be a YAML map of the labels to apply to the csi provider daemonSet
|
||||
extraLabels: {}
|
||||
# security context for the pod template and container in the csi provider daemonSet
|
||||
securityContext:
|
||||
pod: {}
|
||||
container: {}
|
||||
|
||||
pod:
|
||||
annotations: {}
|
||||
tolerations: []
|
||||
nodeSelector: {}
|
||||
affinity: {}
|
||||
extraLabels: {}
|
||||
|
||||
agent:
|
||||
enabled: true
|
||||
extraArgs: []
|
||||
|
||||
image:
|
||||
repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
|
||||
tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
logFormat: standard
|
||||
logLevel: info
|
||||
|
||||
resources: {}
|
||||
|
||||
priorityClassName: ""
|
||||
|
||||
serviceAccount:
|
||||
annotations: {}
|
||||
extraLabels: {}
|
||||
|
||||
readinessProbe:
|
||||
failureThreshold: 2
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
|
||||
livenessProbe:
|
||||
failureThreshold: 2
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
|
||||
debug: false
|
||||
extraArgs: []
|
||||
|
||||
serverTelemetry:
|
||||
# Enable support for the Prometheus Operator. Currently, this chart does not support
|
||||
# authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included
|
||||
# in the `listener "tcp"{}` stanza
|
||||
# telemetry {
|
||||
# unauthenticated_metrics_access = "true"
|
||||
# }
|
||||
#
|
||||
# See the `standalone.config` for a more complete example of this.
|
||||
#
|
||||
# In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration:
|
||||
#
|
||||
# example:
|
||||
# telemetry {
|
||||
# prometheus_retention_time = "30s"
|
||||
# disable_hostname = true
|
||||
# }
|
||||
#
|
||||
# Configuration for monitoring the Vault server.
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
selectors: {}
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
|
||||
prometheusRules:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
selectors: {}
|
||||
rules: []
|
||||
|
||||
ingress:
|
||||
{{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }}
|
||||
enabled: true
|
||||
{{- end }}
|
||||
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
|
||||
class: {{ .Modules.Additional.Ingress.Type }}
|
||||
annotations:
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
|
||||
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
|
||||
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
|
||||
{{- end }}
|
||||
tls:
|
||||
{{- if .Modules.SecretsStorage.Expose.Tls.Enabled }}
|
||||
enabled: true
|
||||
{{- end }}
|
||||
hosts:
|
||||
- host: {{ .Modules.SecretsStorage.Expose.Domain }}
|
||||
secretName: vault-tls
|
||||
@@ -0,0 +1,5 @@
|
||||
- name: kube-forge
|
||||
url: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable"
|
||||
{{ if .Modules.AdditionalRepositories }}
|
||||
{{ .Modules.AdditionalRepositories | toYaml }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,136 @@
|
||||
---
|
||||
bin_dir: {{ .Orchestrator.BinDir }}
|
||||
|
||||
## The access_ip variable is used to define how other nodes should access
|
||||
## the node. This is used in flannel to allow other flannel nodes to see
|
||||
## this node for example. The access_ip is really useful AWS and Google
|
||||
## environments where the nodes are accessed remotely by the "public" ip,
|
||||
## but don't know about that address themselves.
|
||||
# access_ip: 1.1.1.1
|
||||
|
||||
|
||||
## External LB example config
|
||||
## apiserver_loadbalancer_domain_name: "elb.some.domain"
|
||||
# loadbalancer_apiserver:
|
||||
# address: 1.2.3.4
|
||||
# port: 1234
|
||||
|
||||
## Internal loadbalancers for apiservers
|
||||
# loadbalancer_apiserver_localhost: true
|
||||
# valid options are "nginx" or "haproxy"
|
||||
# loadbalancer_apiserver_type: nginx # valid values "nginx" or "haproxy"
|
||||
|
||||
## Local loadbalancer should use this port
|
||||
## And must be set port 6443
|
||||
loadbalancer_apiserver_port: {{ .Orchestrator.LoadbalancerApiserverPort }}
|
||||
|
||||
## If loadbalancer_apiserver_healthcheck_port variable defined, enables proxy liveness check for nginx.
|
||||
loadbalancer_apiserver_healthcheck_port: 8081
|
||||
|
||||
disable_host_nameservers: {{ .Orchestrator.Dns.DisableHostNameservers }}
|
||||
|
||||
upstream_dns_servers:
|
||||
{{- range .Orchestrator.Dns.Servers }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
|
||||
## There are some changes specific to the cloud providers
|
||||
## for instance we need to encapsulate packets with some network plugins
|
||||
## If set the possible values are either 'gce', 'aws', 'azure', 'openstack', 'vsphere', 'oci', or 'external'
|
||||
## When openstack is used make sure to source in the openstack credentials
|
||||
## like you would do when using openstack-client before starting the playbook.
|
||||
{{- if not (eq .Orchestrator.CloudProvider "") }}
|
||||
cloud_provider: {{ .Orchestrator.CloudProvider }}
|
||||
{{- end }}
|
||||
|
||||
## When cloud_provider is set to 'external', you can set the cloud controller to deploy
|
||||
## Supported cloud controllers are: 'openstack', 'vsphere' and 'hcloud'
|
||||
## When openstack or vsphere are used make sure to source in the required fields
|
||||
{{- if not (eq .Orchestrator.ExgernalCloudProvider "") }}
|
||||
external_cloud_provider: {{ .Orchestrator.ExgernalCloudProvider }}
|
||||
{{- end }}
|
||||
|
||||
## Set these proxy values in order to update package manager and docker daemon to use proxies
|
||||
# http_proxy: ""
|
||||
# https_proxy: ""
|
||||
|
||||
## Refer to roles/kubespray-defaults/defaults/main.yml before modifying no_proxy
|
||||
# no_proxy: ""
|
||||
|
||||
## Some problems may occur when downloading files over https proxy due to ansible bug
|
||||
## https://github.com/ansible/ansible/issues/32750. Set this variable to False to disable
|
||||
## SSL validation of get_url module. Note that kubespray will still be performing checksum validation.
|
||||
# download_validate_certs: False
|
||||
|
||||
## If you need exclude all cluster nodes from proxy and other resources, add other resources here.
|
||||
# additional_no_proxy: ""
|
||||
|
||||
## If you need to disable proxying of os package repositories but are still behind an http_proxy set
|
||||
## skip_http_proxy_on_os_packages to true
|
||||
## This will cause kubespray not to set proxy environment in /etc/yum.conf for centos and in /etc/apt/apt.conf for debian/ubuntu
|
||||
## Special information for debian/ubuntu - you have to set the no_proxy variable, then apt package will install from your source of wish
|
||||
# skip_http_proxy_on_os_packages: false
|
||||
|
||||
## Since workers are included in the no_proxy variable by default, docker engine will be restarted on all nodes (all
|
||||
## pods will restart) when adding or removing workers. To override this behaviour by only including master nodes in the
|
||||
## no_proxy variable, set below to true:
|
||||
no_proxy_exclude_workers: false
|
||||
|
||||
## Certificate Management
|
||||
## This setting determines whether certs are generated via scripts.
|
||||
## Chose 'none' if you provide your own certificates.
|
||||
## Option is "script", "none"
|
||||
# cert_management: script
|
||||
|
||||
## Set to true to allow pre-checks to fail and continue deployment
|
||||
# ignore_assert_errors: false
|
||||
|
||||
## The read-only port for the Kubelet to serve on with no authentication/authorization. Uncomment to enable.
|
||||
# kube_read_only_port: 10255
|
||||
|
||||
## Set true to download and cache container
|
||||
# download_container: true
|
||||
|
||||
## Deploy container engine
|
||||
# Set false if you want to deploy container engine manually.
|
||||
deploy_container_engine: {{ .Orchestrator.ContainerEngine.Install }}
|
||||
|
||||
## Red Hat Enterprise Linux subscription registration
|
||||
## Add either RHEL subscription Username/Password or Organization ID/Activation Key combination
|
||||
## Update RHEL subscription purpose usage, role and SLA if necessary
|
||||
# rh_subscription_username: ""
|
||||
# rh_subscription_password: ""
|
||||
# rh_subscription_org_id: ""
|
||||
# rh_subscription_activation_key: ""
|
||||
# rh_subscription_usage: "Development"
|
||||
# rh_subscription_role: "Red Hat Enterprise Server"
|
||||
# rh_subscription_sla: "Self-Support"
|
||||
|
||||
## Check if access_ip responds to ping. Set false if your firewall blocks ICMP.
|
||||
ping_access_ip: {{ .Orchestrator.PingAccessIp }}
|
||||
|
||||
# sysctl_file_path to add sysctl conf to
|
||||
sysctl_file_path: {{ .Orchestrator.SysctlFilePath }}
|
||||
|
||||
## Variables for webhook token auth https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication
|
||||
kube_webhook_token_auth: false
|
||||
kube_webhook_token_auth_url_skip_tls_verify: false
|
||||
# kube_webhook_token_auth_url: https://...
|
||||
## base64-encoded string of the webhook's CA certificate
|
||||
# kube_webhook_token_auth_ca_data: "LS0t..."
|
||||
|
||||
## NTP Settings
|
||||
# Start the ntpd or chrony service and enable it at system boot.
|
||||
ntp_enabled: false
|
||||
ntp_manage_config: false
|
||||
ntp_servers:
|
||||
- "0.pool.ntp.org iburst"
|
||||
- "1.pool.ntp.org iburst"
|
||||
- "2.pool.ntp.org iburst"
|
||||
- "3.pool.ntp.org iburst"
|
||||
|
||||
## Used to control no_log attribute
|
||||
unsafe_show_logs: false
|
||||
|
||||
## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
|
||||
allow_unsupported_distribution_setup: false
|
||||
@@ -0,0 +1,247 @@
|
||||
---
|
||||
dashboard_enabled: false
|
||||
|
||||
helm_enabled: true
|
||||
|
||||
registry_enabled: false
|
||||
|
||||
metrics_server_enabled: false
|
||||
|
||||
# Rancher Local Path Provisioner
|
||||
local_path_provisioner_enabled: true
|
||||
# local_path_provisioner_namespace: "local-path-storage"
|
||||
local_path_provisioner_storage_class: {{ .Modules.Additional.Storage.LocalPathProvisioner.StorageClassName }}
|
||||
local_path_provisioner_reclaim_policy: {{ .Modules.Additional.Storage.LocalPathProvisioner.ReclaimPolicy }}
|
||||
# local_path_provisioner_claim_root: /opt/local-path-provisioner/
|
||||
# local_path_provisioner_debug: false
|
||||
# local_path_provisioner_image_repo: "rancher/local-path-provisioner"
|
||||
# local_path_provisioner_image_tag: "v0.0.23"
|
||||
# local_path_provisioner_helper_image_repo: "busybox"
|
||||
# local_path_provisioner_helper_image_tag: "latest"
|
||||
|
||||
# Local volume provisioner deployment
|
||||
local_volume_provisioner_enabled: false
|
||||
# local_volume_provisioner_namespace: kube-system
|
||||
# local_volume_provisioner_nodelabels:
|
||||
# - kubernetes.io/hostname
|
||||
# - topology.kubernetes.io/region
|
||||
# - topology.kubernetes.io/zone
|
||||
# local_volume_provisioner_storage_classes:
|
||||
# local-storage:
|
||||
# host_dir: /mnt/disks
|
||||
# mount_dir: /mnt/disks
|
||||
# volume_mode: Filesystem
|
||||
# fs_type: ext4
|
||||
# fast-disks:
|
||||
# host_dir: /mnt/fast-disks
|
||||
# mount_dir: /mnt/fast-disks
|
||||
# block_cleaner_command:
|
||||
# - "/scripts/shred.sh"
|
||||
# - "2"
|
||||
# volume_mode: Filesystem
|
||||
# fs_type: ext4
|
||||
# local_volume_provisioner_tolerations:
|
||||
# - effect: NoSchedule
|
||||
# operator: Exists
|
||||
|
||||
# CSI Volume Snapshot Controller deployment, set this to true if your CSI is able to manage snapshots
|
||||
# currently, setting cinder_csi_enabled=true would automatically enable the snapshot controller
|
||||
# Longhorn is an extenal CSI that would also require setting this to true but it is not included in kubespray
|
||||
# csi_snapshot_controller_enabled: false
|
||||
# csi snapshot namespace
|
||||
# snapshot_controller_namespace: kube-system
|
||||
|
||||
# CephFS provisioner deployment
|
||||
cephfs_provisioner_enabled: false
|
||||
# cephfs_provisioner_namespace: "cephfs-provisioner"
|
||||
# cephfs_provisioner_cluster: ceph
|
||||
# cephfs_provisioner_monitors: "172.24.0.1:6789,172.24.0.2:6789,172.24.0.3:6789"
|
||||
# cephfs_provisioner_admin_id: admin
|
||||
# cephfs_provisioner_secret: secret
|
||||
# cephfs_provisioner_storage_class: cephfs
|
||||
# cephfs_provisioner_reclaim_policy: Delete
|
||||
# cephfs_provisioner_claim_root: /volumes
|
||||
# cephfs_provisioner_deterministic_names: true
|
||||
|
||||
# RBD provisioner deployment
|
||||
rbd_provisioner_enabled: false
|
||||
# rbd_provisioner_namespace: rbd-provisioner
|
||||
# rbd_provisioner_replicas: 2
|
||||
# rbd_provisioner_monitors: "172.24.0.1:6789,172.24.0.2:6789,172.24.0.3:6789"
|
||||
# rbd_provisioner_pool: kube
|
||||
# rbd_provisioner_admin_id: admin
|
||||
# rbd_provisioner_secret_name: ceph-secret-admin
|
||||
# rbd_provisioner_secret: ceph-key-admin
|
||||
# rbd_provisioner_user_id: kube
|
||||
# rbd_provisioner_user_secret_name: ceph-secret-user
|
||||
# rbd_provisioner_user_secret: ceph-key-user
|
||||
# rbd_provisioner_user_secret_namespace: rbd-provisioner
|
||||
# rbd_provisioner_fs_type: ext4
|
||||
# rbd_provisioner_image_format: "2"
|
||||
# rbd_provisioner_image_features: layering
|
||||
# rbd_provisioner_storage_class: rbd
|
||||
# rbd_provisioner_reclaim_policy: Delete
|
||||
|
||||
# Nginx ingress controller deployment
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
ingress_nginx_enabled: {{ .Modules.Additional.Ingress.Install }}
|
||||
ingress_nginx_host_network: {{ .Modules.Additional.Ingress.HostNetwork }}
|
||||
ingress_publish_status_address: ""
|
||||
# ingress_nginx_nodeselector:
|
||||
# kubernetes.io/os: "linux"
|
||||
# ingress_nginx_tolerations:
|
||||
# - key: "node-role.kubernetes.io/master"
|
||||
# operator: "Equal"
|
||||
# value: ""
|
||||
# effect: "NoSchedule"
|
||||
# - key: "node-role.kubernetes.io/control-plane"
|
||||
# operator: "Equal"
|
||||
# value: ""
|
||||
# effect: "NoSchedule"
|
||||
# ingress_nginx_namespace: "ingress-nginx"
|
||||
ingress_nginx_insecure_port: {{ .Modules.Additional.Ingress.InsecurePort }}
|
||||
ingress_nginx_secure_port: {{ .Modules.Additional.Ingress.SecurePort }}
|
||||
# ingress_nginx_configmap:
|
||||
# map-hash-bucket-size: "128"
|
||||
# ssl-protocols: "TLSv1.2 TLSv1.3"
|
||||
# ingress_nginx_configmap_tcp_services:
|
||||
# 9000: "default/example-go:8080"
|
||||
# ingress_nginx_configmap_udp_services:
|
||||
# 53: "kube-system/coredns:53"
|
||||
# ingress_nginx_extra_args:
|
||||
# - --default-ssl-certificate=default/foo-tls
|
||||
# ingress_nginx_termination_grace_period_seconds: 300
|
||||
ingress_nginx_class: {{ .Modules.Additional.Ingress.IngressClassName }}
|
||||
{{- end }}
|
||||
|
||||
# ALB ingress controller deployment
|
||||
ingress_alb_enabled: false
|
||||
# alb_ingress_aws_region: "us-east-1"
|
||||
# alb_ingress_restrict_scheme: "false"
|
||||
# Enables logging on all outbound requests sent to the AWS API.
|
||||
# If logging is desired, set to true.
|
||||
# alb_ingress_aws_debug: "false"
|
||||
|
||||
# Cert manager deployment
|
||||
cert_manager_enabled: {{ .Modules.Additional.CertManager.Install }}
|
||||
# cert_manager_namespace: "cert-manager"
|
||||
# cert_manager_tolerations:
|
||||
# - key: node-role.kubernetes.io/master
|
||||
# effect: NoSchedule
|
||||
# - key: node-role.kubernetes.io/control-plane
|
||||
# effect: NoSchedule
|
||||
# cert_manager_affinity:
|
||||
# nodeAffinity:
|
||||
# preferredDuringSchedulingIgnoredDuringExecution:
|
||||
# - weight: 100
|
||||
# preference:
|
||||
# matchExpressions:
|
||||
# - key: node-role.kubernetes.io/control-plane
|
||||
# operator: In
|
||||
# values:
|
||||
# - ""
|
||||
# cert_manager_nodeselector:
|
||||
# kubernetes.io/os: "linux"
|
||||
|
||||
# cert_manager_trusted_internal_ca: |
|
||||
# -----BEGIN CERTIFICATE-----
|
||||
# [REPLACE with your CA certificate]
|
||||
# -----END CERTIFICATE-----
|
||||
# cert_manager_leader_election_namespace: kube-system
|
||||
|
||||
# cert_manager_dns_policy: "ClusterFirst"
|
||||
cert_manager_dns_config:
|
||||
nameservers:
|
||||
{{- range .Modules.Additional.CertManager.DnsServers }}
|
||||
- "{{ . }}"
|
||||
{{- end }}
|
||||
|
||||
# MetalLB deployment
|
||||
{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
|
||||
metallb_enabled: true
|
||||
{{- else }}
|
||||
metallb_enabled: false
|
||||
{{- end }}
|
||||
metallb_speaker_enabled: {{ `"{{ metallb_enabled }}"` }}
|
||||
# metallb_speaker_nodeselector:
|
||||
# kubernetes.io/os: "linux"
|
||||
# metallb_controller_nodeselector:
|
||||
# kubernetes.io/os: "linux"
|
||||
# metallb_speaker_tolerations:
|
||||
# - key: "node-role.kubernetes.io/master"
|
||||
# operator: "Equal"
|
||||
# value: ""
|
||||
# effect: "NoSchedule"
|
||||
# - key: "node-role.kubernetes.io/control-plane"
|
||||
# operator: "Equal"
|
||||
# value: ""
|
||||
# effect: "NoSchedule"
|
||||
# metallb_controller_tolerations:
|
||||
# - key: "node-role.kubernetes.io/master"
|
||||
# operator: "Equal"
|
||||
# value: ""
|
||||
# effect: "NoSchedule"
|
||||
# - key: "node-role.kubernetes.io/control-plane"
|
||||
# operator: "Equal"
|
||||
# value: ""
|
||||
# effect: "NoSchedule"
|
||||
# metallb_version: v0.13.9
|
||||
# metallb_protocol: "layer2"
|
||||
# metallb_port: "7472"
|
||||
# metallb_memberlist_port: "7946"
|
||||
# metallb_config:
|
||||
# address_pools:
|
||||
# primary:
|
||||
# ip_range:
|
||||
# - 10.5.0.0/16
|
||||
# auto_assign: true
|
||||
# pool1:
|
||||
# ip_range:
|
||||
# - 10.6.0.0/16
|
||||
# auto_assign: true
|
||||
# pool2:
|
||||
# ip_range:
|
||||
# - 10.10.0.0/16
|
||||
# auto_assign: true
|
||||
# layer2:
|
||||
# - primary
|
||||
# layer3:
|
||||
# defaults:
|
||||
# peer_port: 179
|
||||
# hold_time: 120s
|
||||
# communities:
|
||||
# vpn-only: "1234:1"
|
||||
# NO_ADVERTISE: "65535:65282"
|
||||
# metallb_peers:
|
||||
# peer1:
|
||||
# peer_address: 10.6.0.1
|
||||
# peer_asn: 64512
|
||||
# my_asn: 4200000000
|
||||
# communities:
|
||||
# - vpn-only
|
||||
# address_pool:
|
||||
# - pool1
|
||||
# peer2:
|
||||
# peer_address: 10.10.0.1
|
||||
# peer_asn: 64513
|
||||
# my_asn: 4200000000
|
||||
# communities:
|
||||
# - NO_ADVERTISE
|
||||
# address_pool:
|
||||
# - pool2
|
||||
|
||||
argocd_enabled: false
|
||||
|
||||
# The plugin manager for kubectl
|
||||
krew_enabled: false
|
||||
krew_root_dir: "/usr/local/krew"
|
||||
|
||||
|
||||
########################################
|
||||
# Helm apps configuration
|
||||
########################################
|
||||
repositories:
|
||||
{{- .Repositories | nindent 2 }}
|
||||
|
||||
releases:
|
||||
{{- .Releases | nindent 2 }}
|
||||
@@ -0,0 +1,384 @@
|
||||
---
|
||||
# Kubernetes configuration dirs and system namespace.
|
||||
# Those are where all the additional config stuff goes
|
||||
# the kubernetes normally puts in /srv/kubernetes.
|
||||
# This puts them in a sane location and namespace.
|
||||
# Editing those values will almost surely break something.
|
||||
kube_config_dir: /etc/kubernetes
|
||||
kube_script_dir: {{ `"{{ bin_dir }}/kubernetes-scripts"` }}
|
||||
kube_manifest_dir: {{ `"{{ kube_config_dir }}/manifests"` }}
|
||||
|
||||
# This is where all the cert scripts and certs will be located
|
||||
kube_cert_dir: {{ `"{{ kube_config_dir }}/ssl"` }}
|
||||
|
||||
# This is where all of the bearer tokens will be stored
|
||||
kube_token_dir: {{ `"{{ kube_config_dir }}/tokens"` }}
|
||||
|
||||
kube_api_anonymous_auth: true
|
||||
|
||||
## Change this to use another Kubernetes version, e.g. a current beta release
|
||||
kube_version: {{ .Orchestrator.Version }}
|
||||
|
||||
# Where the binaries will be downloaded.
|
||||
# Note: ensure that you've enough disk space (about 1G)
|
||||
local_release_dir: "/tmp/releases"
|
||||
# Random shifts for retrying failed ops like pushing/downloading
|
||||
retry_stagger: 5
|
||||
|
||||
# This is the user that owns tha cluster installation.
|
||||
kube_owner: kube
|
||||
|
||||
# This is the group that the cert creation scripts chgrp the
|
||||
# cert files to. Not really changeable...
|
||||
kube_cert_group: kube-cert
|
||||
|
||||
# Cluster Loglevel configuration
|
||||
kube_log_level: 2
|
||||
|
||||
# Directory where credentials will be stored
|
||||
credentials_dir: {{ `"{{ inventory_dir }}/credentials"` }}
|
||||
|
||||
## It is possible to activate / deactivate selected authentication methods (oidc, static token auth)
|
||||
# kube_oidc_auth: false
|
||||
# kube_token_auth: false
|
||||
|
||||
|
||||
## Variables for OpenID Connect Configuration https://kubernetes.io/docs/admin/authentication/
|
||||
## To use OpenID you have to deploy additional an OpenID Provider (e.g Dex, Keycloak, ...)
|
||||
|
||||
# kube_oidc_url: https:// ...
|
||||
# kube_oidc_client_id: kubernetes
|
||||
## Optional settings for OIDC
|
||||
# kube_oidc_ca_file: {{ `"{{ kube_cert_dir }}/ca.pem"` }}
|
||||
# kube_oidc_username_claim: sub
|
||||
# kube_oidc_username_prefix: 'oidc:'
|
||||
# kube_oidc_groups_claim: groups
|
||||
# kube_oidc_groups_prefix: 'oidc:'
|
||||
|
||||
## Variables to control webhook authn/authz
|
||||
# kube_webhook_token_auth: false
|
||||
# kube_webhook_token_auth_url: https://...
|
||||
# kube_webhook_token_auth_url_skip_tls_verify: false
|
||||
|
||||
## For webhook authorization, authorization_modes must include Webhook
|
||||
# kube_webhook_authorization: false
|
||||
# kube_webhook_authorization_url: https://...
|
||||
# kube_webhook_authorization_url_skip_tls_verify: false
|
||||
|
||||
# Choose network plugin (cilium, calico, kube-ovn, weave or flannel. Use cni for generic cni plugin)
|
||||
# Can also be set to 'cloud', which lets the cloud provider setup appropriate routing
|
||||
kube_network_plugin: {{ .Orchestrator.Network.Plugin }}
|
||||
|
||||
# Setting multi_networking to true will install Multus: https://github.com/k8snetworkplumbingwg/multus-cni
|
||||
kube_network_plugin_multus: false
|
||||
|
||||
# Kubernetes internal network for services, unused block of space.
|
||||
kube_service_addresses: {{ .Orchestrator.Network.ServiceAddresses }}
|
||||
|
||||
# internal network. When used, it will assign IP
|
||||
# addresses from this range to individual pods.
|
||||
# This network must be unused in your network infrastructure!
|
||||
kube_pods_subnet: {{ .Orchestrator.Network.PodsSubnet }}
|
||||
|
||||
# internal network node size allocation (optional). This is the size allocated
|
||||
# to each node for pod IP address allocation. Note that the number of pods per node is
|
||||
# also limited by the kubelet_max_pods variable which defaults to 110.
|
||||
#
|
||||
# Example:
|
||||
# Up to 64 nodes and up to 254 or kubelet_max_pods (the lowest of the two) pods per node:
|
||||
# - kube_pods_subnet: 10.233.64.0/18
|
||||
# - kube_network_node_prefix: 24
|
||||
# - kubelet_max_pods: 110
|
||||
#
|
||||
# Example:
|
||||
# Up to 128 nodes and up to 126 or kubelet_max_pods (the lowest of the two) pods per node:
|
||||
# - kube_pods_subnet: 10.233.64.0/18
|
||||
# - kube_network_node_prefix: 25
|
||||
# - kubelet_max_pods: 110
|
||||
kube_network_node_prefix: 24
|
||||
|
||||
# Configure Dual Stack networking (i.e. both IPv4 and IPv6)
|
||||
enable_dual_stack_networks: false
|
||||
|
||||
# Kubernetes internal network for IPv6 services, unused block of space.
|
||||
# This is only used if enable_dual_stack_networks is set to true
|
||||
# This provides 4096 IPv6 IPs
|
||||
kube_service_addresses_ipv6: fd85:ee78:d8a6:8607::1000/116
|
||||
|
||||
# Internal network. When used, it will assign IPv6 addresses from this range to individual pods.
|
||||
# This network must not already be in your network infrastructure!
|
||||
# This is only used if enable_dual_stack_networks is set to true.
|
||||
# This provides room for 256 nodes with 254 pods per node.
|
||||
kube_pods_subnet_ipv6: fd85:ee78:d8a6:8607::1:0000/112
|
||||
|
||||
# IPv6 subnet size allocated to each for pods.
|
||||
# This is only used if enable_dual_stack_networks is set to true
|
||||
# This provides room for 254 pods per node.
|
||||
kube_network_node_prefix_ipv6: 120
|
||||
|
||||
# The port the API Server will be listening on.
|
||||
kube_apiserver_ip: {{ `"{{ kube_service_addresses|ipaddr('net')|ipaddr(1)|ipaddr('address') }}"` }}
|
||||
kube_apiserver_port: 6443 # (https)
|
||||
|
||||
# Kube-proxy proxyMode configuration.
|
||||
# Can be ipvs, iptables
|
||||
kube_proxy_mode: ipvs
|
||||
|
||||
# configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
|
||||
# must be set to true for MetalLB, kube-vip(ARP enabled) to work
|
||||
{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
|
||||
kube_proxy_strict_arp: true
|
||||
{{- else }}
|
||||
kube_proxy_strict_arp: false
|
||||
{{- end }}
|
||||
|
||||
# A string slice of values which specify the addresses to use for NodePorts.
|
||||
# Values may be valid IP blocks (e.g. 1.2.3.0/24, 1.2.3.4/32).
|
||||
# The default empty string slice ([]) means to use all local addresses.
|
||||
# kube_proxy_nodeport_addresses_cidr is retained for legacy config
|
||||
kube_proxy_nodeport_addresses: >- {{ `
|
||||
{%- if kube_proxy_nodeport_addresses_cidr is defined -%}
|
||||
[{{ kube_proxy_nodeport_addresses_cidr }}]
|
||||
{%- else -%}
|
||||
[]
|
||||
{%- endif -%} ` }}
|
||||
|
||||
# If non-empty, will use this string as identification instead of the actual hostname
|
||||
# kube_override_hostname: >- {{ `
|
||||
# {%- if cloud_provider is defined and cloud_provider in [ 'aws' ] -%}
|
||||
# {%- else -%}
|
||||
# {{ inventory_hostname }}
|
||||
# {%- endif -%}` }}
|
||||
|
||||
## Encrypting Secret Data at Rest
|
||||
kube_encrypt_secret_data: false
|
||||
|
||||
# Graceful Node Shutdown (Kubernetes >= 1.21.0), see https://kubernetes.io/blog/2021/04/21/graceful-node-shutdown-beta/
|
||||
# kubelet_shutdown_grace_period had to be greater than kubelet_shutdown_grace_period_critical_pods to allow
|
||||
# non-critical podsa to also terminate gracefully
|
||||
# kubelet_shutdown_grace_period: 60s
|
||||
# kubelet_shutdown_grace_period_critical_pods: 20s
|
||||
|
||||
# DNS configuration.
|
||||
# Kubernetes cluster name, also will be used as DNS domain
|
||||
cluster_name: {{ .Orchestrator.ClusterName }}
|
||||
# Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods
|
||||
ndots: 2
|
||||
# dns_timeout: 2
|
||||
# dns_attempts: 2
|
||||
# Custom search domains to be added in addition to the default cluster search domains
|
||||
# searchdomains:
|
||||
# - {{ `"svc.{{ cluster_name }}"` }}
|
||||
# - {{ `"default.svc.{{ cluster_name }}"` }}
|
||||
# remove_default_searchdomains: false
|
||||
# Can be coredns, coredns_dual, manual or none
|
||||
dns_mode: coredns
|
||||
# Set manual server if using a custom cluster DNS server
|
||||
# manual_dns_server: 10.x.x.x
|
||||
# Enable nodelocal dns cache
|
||||
enable_nodelocaldns: true
|
||||
enable_nodelocaldns_secondary: false
|
||||
nodelocaldns_ip: 169.254.25.10
|
||||
nodelocaldns_health_port: 9254
|
||||
nodelocaldns_second_health_port: 9256
|
||||
nodelocaldns_bind_metrics_host_ip: false
|
||||
nodelocaldns_secondary_skew_seconds: 5
|
||||
# nodelocaldns_external_zones:
|
||||
# - zones:
|
||||
# - example.com
|
||||
# - example.io:1053
|
||||
# nameservers:
|
||||
# - 1.1.1.1
|
||||
# - 2.2.2.2
|
||||
# cache: 5
|
||||
# - zones:
|
||||
# - https://mycompany.local:4453
|
||||
# nameservers:
|
||||
# - 192.168.0.53
|
||||
# cache: 0
|
||||
# - zones:
|
||||
# - mydomain.tld
|
||||
# nameservers:
|
||||
# - 10.233.0.3
|
||||
# cache: 5
|
||||
# rewrite:
|
||||
# - name website.tld website.namespace.svc.cluster.local
|
||||
# Enable k8s_external plugin for CoreDNS
|
||||
enable_coredns_k8s_external: false
|
||||
coredns_k8s_external_zone: k8s_external.local
|
||||
# Enable endpoint_pod_names option for kubernetes plugin
|
||||
enable_coredns_k8s_endpoint_pod_names: false
|
||||
# Set forward options for upstream DNS servers in coredns (and nodelocaldns) config
|
||||
# dns_upstream_forward_extra_opts:
|
||||
# policy: sequential
|
||||
# Apply extra options to coredns kubernetes plugin
|
||||
# coredns_kubernetes_extra_opts:
|
||||
# - 'fallthrough example.local'
|
||||
# Forward extra domains to the coredns kubernetes plugin
|
||||
# coredns_kubernetes_extra_domains: ''
|
||||
|
||||
# Can be docker_dns, host_resolvconf or none
|
||||
resolvconf_mode: host_resolvconf
|
||||
# Deploy netchecker app to verify DNS resolve as an HTTP service
|
||||
deploy_netchecker: false
|
||||
# Ip address of the kubernetes skydns service
|
||||
skydns_server: {{ `"{{ kube_service_addresses|ipaddr('net')|ipaddr(3)|ipaddr('address') }}"` }}
|
||||
skydns_server_secondary: {{ `"{{ kube_service_addresses|ipaddr('net')|ipaddr(4)|ipaddr('address') }}"` }}
|
||||
dns_domain: {{ `"{{ cluster_name }}"` }}
|
||||
|
||||
## Container runtime
|
||||
## docker for docker, crio for cri-o and containerd for containerd.
|
||||
## Default: containerd
|
||||
container_manager: {{ .Orchestrator.ContainerEngine.Type }}
|
||||
|
||||
# Additional container runtimes
|
||||
kata_containers_enabled: false
|
||||
|
||||
kubeadm_certificate_key: {{ `"{{ lookup('password', credentials_dir + '/kubeadm_certificate_key.creds length=64 chars=hexdigits') | lower }}"` }}
|
||||
|
||||
# K8s image pull policy (imagePullPolicy)
|
||||
k8s_image_pull_policy: IfNotPresent
|
||||
|
||||
# audit log for kubernetes
|
||||
kubernetes_audit: false
|
||||
|
||||
# define kubelet config dir for dynamic kubelet
|
||||
# kubelet_config_dir:
|
||||
default_kubelet_config_dir: {{ `"{{ kube_config_dir }}/dynamic_kubelet_dir"` }}
|
||||
|
||||
# pod security policy (RBAC must be enabled either by having 'RBAC' in authorization_modes or kubeadm enabled)
|
||||
podsecuritypolicy_enabled: {{ .Orchestrator.PodSecurotyPolicyEnabled }}
|
||||
|
||||
# Custom PodSecurityPolicySpec for restricted policy
|
||||
# podsecuritypolicy_restricted_spec: {}
|
||||
|
||||
# Custom PodSecurityPolicySpec for privileged policy
|
||||
# podsecuritypolicy_privileged_spec: {}
|
||||
|
||||
# Make a copy of kubeconfig on the host that runs Ansible in {{ `{{ inventory_dir }}/artifacts`}}
|
||||
kubeconfig_localhost: true
|
||||
# Use ansible_host as external api ip when copying over kubeconfig.
|
||||
kubeconfig_localhost_ansible_host: true
|
||||
# kubectl_localhost: false
|
||||
|
||||
# A comma separated list of levels of node allocatable enforcement to be enforced by kubelet.
|
||||
# Acceptable options are 'pods', 'system-reserved', 'kube-reserved' and ''. Default is "".
|
||||
# kubelet_enforce_node_allocatable: pods
|
||||
|
||||
## Set runtime and kubelet cgroups when using systemd as cgroup driver (default)
|
||||
# kubelet_runtime_cgroups: {{ `"/{{ kube_service_cgroups }}/{{ container_manager }}.service"` }}
|
||||
# kubelet_kubelet_cgroups: {{ `"/{{ kube_service_cgroups }}/kubelet.service"` }}
|
||||
|
||||
## Set runtime and kubelet cgroups when using cgroupfs as cgroup driver
|
||||
# kubelet_runtime_cgroups_cgroupfs: {{ `"/system.slice/{{ container_manager }}.service"` }}
|
||||
# kubelet_kubelet_cgroups_cgroupfs: "/system.slice/kubelet.service"
|
||||
|
||||
# Optionally reserve this space for kube daemons.
|
||||
# kube_reserved: false
|
||||
## Uncomment to override default values
|
||||
## The following two items need to be set when kube_reserved is true
|
||||
# kube_reserved_cgroups_for_service_slice: kube.slice
|
||||
# kube_reserved_cgroups: {{ `"/{{ kube_reserved_cgroups_for_service_slice }}"` }}
|
||||
# kube_memory_reserved: 256Mi
|
||||
# kube_cpu_reserved: 100m
|
||||
# kube_ephemeral_storage_reserved: 2Gi
|
||||
# kube_pid_reserved: "1000"
|
||||
# Reservation for master hosts
|
||||
# kube_master_memory_reserved: 512Mi
|
||||
# kube_master_cpu_reserved: 200m
|
||||
# kube_master_ephemeral_storage_reserved: 2Gi
|
||||
# kube_master_pid_reserved: "1000"
|
||||
|
||||
## Optionally reserve resources for OS system daemons.
|
||||
# system_reserved: true
|
||||
## Uncomment to override default values
|
||||
## The following two items need to be set when system_reserved is true
|
||||
# system_reserved_cgroups_for_service_slice: system.slice
|
||||
# system_reserved_cgroups: {{ `"/{{ system_reserved_cgroups_for_service_slice }}"` }}
|
||||
# system_memory_reserved: 512Mi
|
||||
# system_cpu_reserved: 500m
|
||||
# system_ephemeral_storage_reserved: 2Gi
|
||||
## Reservation for master hosts
|
||||
# system_master_memory_reserved: 256Mi
|
||||
# system_master_cpu_reserved: 250m
|
||||
# system_master_ephemeral_storage_reserved: 2Gi
|
||||
|
||||
## Eviction Thresholds to avoid system OOMs
|
||||
# https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/#eviction-thresholds
|
||||
# eviction_hard: {}
|
||||
# eviction_hard_control_plane: {}
|
||||
|
||||
# An alternative flexvolume plugin directory
|
||||
# kubelet_flexvolumes_plugins_dir: /usr/libexec/kubernetes/kubelet-plugins/volume/exec
|
||||
|
||||
## Supplementary addresses that can be added in kubernetes ssl keys.
|
||||
## That can be useful for example to setup a keepalived virtual IP
|
||||
# supplementary_addresses_in_ssl_keys: [10.0.0.1, 10.0.0.2, 10.0.0.3]
|
||||
|
||||
## Running on top of openstack vms with cinder enabled may lead to unschedulable pods due to NoVolumeZoneConflict restriction in kube-scheduler.
|
||||
## See https://github.com/kubernetes-sigs/kubespray/issues/2141
|
||||
## Set this variable to true to get rid of this issue
|
||||
volume_cross_zone_attachment: false
|
||||
## Add Persistent Volumes Storage Class for corresponding cloud provider (supported: in-tree OpenStack, Cinder CSI,
|
||||
## AWS EBS CSI, Azure Disk CSI, GCP Persistent Disk CSI)
|
||||
persistent_volumes_enabled: false
|
||||
|
||||
## Container Engine Acceleration
|
||||
## Enable container acceleration feature, for example use gpu acceleration in containers
|
||||
# nvidia_accelerator_enabled: true
|
||||
## Nvidia GPU driver install. Install will by done by a (init) pod running as a daemonset.
|
||||
## Important: if you use Ubuntu then you should set in all.yml 'docker_storage_options: -s overlay2'
|
||||
## Array with nvida_gpu_nodes, leave empty or comment if you don't want to install drivers.
|
||||
## Labels and taints won't be set to nodes if they are not in the array.
|
||||
# nvidia_gpu_nodes:
|
||||
# - kube-gpu-001
|
||||
# nvidia_driver_version: "384.111"
|
||||
## flavor can be tesla or gtx
|
||||
# nvidia_gpu_flavor: gtx
|
||||
## NVIDIA driver installer images. Change them if you have trouble accessing gcr.io.
|
||||
# nvidia_driver_install_centos_container: atzedevries/nvidia-centos-driver-installer:2
|
||||
# nvidia_driver_install_ubuntu_container: gcr.io/google-containers/ubuntu-nvidia-driver-installer@sha256:7df76a0f0a17294e86f691c81de6bbb7c04a1b4b3d4ea4e7e2cccdc42e1f6d63
|
||||
## NVIDIA GPU device plugin image.
|
||||
# nvidia_gpu_device_plugin_container: "registry.k8s.io/nvidia-gpu-device-plugin@sha256:0842734032018be107fa2490c98156992911e3e1f2a21e059ff0105b07dd8e9e"
|
||||
|
||||
## Support tls min version, Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.
|
||||
# tls_min_version: ""
|
||||
|
||||
## Support tls cipher suites.
|
||||
# tls_cipher_suites: {}
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|
||||
# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||||
# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
|
||||
# - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
|
||||
# - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
|
||||
# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
||||
# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
||||
# - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||||
# - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
||||
# - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||||
# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||||
# - TLS_ECDHE_RSA_WITH_RC4_128_SHA
|
||||
# - TLS_RSA_WITH_3DES_EDE_CBC_SHA
|
||||
# - TLS_RSA_WITH_AES_128_CBC_SHA
|
||||
# - TLS_RSA_WITH_AES_128_CBC_SHA256
|
||||
# - TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
# - TLS_RSA_WITH_AES_256_CBC_SHA
|
||||
# - TLS_RSA_WITH_AES_256_GCM_SHA384
|
||||
# - TLS_RSA_WITH_RC4_128_SHA
|
||||
|
||||
## Amount of time to retain events. (default 1h0m0s)
|
||||
event_ttl_duration: "{{ .Orchestrator.EventTtl }}"
|
||||
|
||||
## Automatically renew K8S control plane certificates on first Monday of each month
|
||||
auto_renew_certificates: {{ .Orchestrator.AutoRenewCertificates }}
|
||||
# First Monday of each month
|
||||
# auto_renew_certificates_systemd_calendar: {{ `"Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"` }}
|
||||
|
||||
# kubeadm patches path
|
||||
kubeadm_patches:
|
||||
enabled: false
|
||||
source_dir: {{ `"{{ inventory_dir }}/patches"` }}
|
||||
dest_dir: {{ `"{{ kube_config_dir }}/patches"` }}
|
||||
61
pkg/resources/templates/kubespray/inventory/hosts.tmpl
Normal file
61
pkg/resources/templates/kubespray/inventory/hosts.tmpl
Normal file
@@ -0,0 +1,61 @@
|
||||
{{- range .Hosts }}
|
||||
{{ .Hostname }} ansible_host={{ .Ip }} ip={{ .Ip }} {{ if .User }}ansible_user={{ .User }}{{- end }} {{ if .Password }}ansible_ssh_password={{ .Password }}{{- end }}
|
||||
{{- end }}
|
||||
|
||||
[kube_control_plane]
|
||||
{{- range .Hosts }}
|
||||
{{- $search := "control_plane" -}}
|
||||
{{- $found := false -}}
|
||||
{{- range .Roles }}
|
||||
{{- if eq . $search }}
|
||||
{{- $found = true }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $found }}
|
||||
{{ .Hostname }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
[etcd]
|
||||
{{- range .Hosts }}
|
||||
{{- $search := "etcd" -}}
|
||||
{{- $found := false -}}
|
||||
{{- range .Roles }}
|
||||
{{- if eq . $search }}
|
||||
{{- $found = true }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $found }}
|
||||
{{ .Hostname }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
[kube_node]
|
||||
{{- range .Hosts }}
|
||||
{{- $search := "node" -}}
|
||||
{{- $found := false -}}
|
||||
{{- range .Roles }}
|
||||
{{- if eq . $search }}
|
||||
{{- $found = true }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $found }}
|
||||
{{ .Hostname }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
[k8s_cluster:children]
|
||||
kube_control_plane
|
||||
kube_node
|
||||
|
||||
[all:vars]
|
||||
ansible_connection=ssh
|
||||
{{- if not (eq .Credentials.User "") }}
|
||||
ansible_user={{ .Credentials.User }}
|
||||
{{- end }}
|
||||
{{- if not (eq .Credentials.Password "") }}
|
||||
ansible_ssh_password={{ .Credentials.Password }}
|
||||
{{- end }}
|
||||
{{- if not (eq .Credentials.PrivateKeyFile "") }}
|
||||
ansible_ssh_private_key_file={{ .Credentials.PrivateKeyFile }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user