gstykalin/kube-forge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migrate from kubespray to library helm client

Browse Source
This commit is contained in:
George Stykalin
2024-06-20 00:20:50 +03:00
parent 3109816dee
commit 78cf06e314
46 changed files with 6283 additions and 12035 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2385
internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl
View File

File diff suppressed because it is too large Load Diff

16
internal/resources/templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl
View File

@@ -1,14 +1,2 @@
- name: docker-secrets-generator
namespace: kube-system
chart_ref: {{ .Modules.Additional.DockerSecrets.ChartRef }}
chart_version: {{ .Modules.Additional.DockerSecrets.ChartVersion }}
{{- if .Modules.Additional.DockerSecrets.Repositories }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
{{- if .Modules.Additional.DockerSecrets.Repositories }}
values:
repositories:
{{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}
{{- end }}
repositories:
{{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}

1753
internal/resources/templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl
View File

File diff suppressed because it is too large Load Diff

915
internal/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl
View File

@@ -1,490 +1,479 @@
- name: longhorn
namespace: longhorn-system
create_namespace: true
chart_ref: {{ .Modules.Additional.Storage.Longhorn.ChartRef }}
chart_version: {{ .Modules.Additional.Storage.Longhorn.ChartVersion }}
{{- if .Modules.Additional.Storage.Longhorn.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
global:
cattle:
# -- Default system registry.
systemDefaultRegistry: ""
windowsCluster:
# -- Setting that allows Longhorn to run on a Rancher Windows cluster.
enabled: false
# -- Toleration for Linux nodes that can run user-deployed Longhorn components.
tolerations:
- key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
# -- Node selector for Linux nodes that can run user-deployed Longhorn components.
nodeSelector:
kubernetes.io/os: "linux"
defaultSetting:
# -- Toleration for system-managed Longhorn components.
taintToleration: cattle.io/os=linux:NoSchedule
# -- Node selector for system-managed Longhorn components.
systemManagedComponentsNodeSelector: kubernetes.io/os:linux
networkPolicies:
# -- Setting that allows you to enable network policies that control access to Longhorn pods.
global:
cattle:
# -- Default system registry.
systemDefaultRegistry: ""
windowsCluster:
# -- Setting that allows Longhorn to run on a Rancher Windows cluster.
enabled: false
# -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
type: "k3s"
# -- Toleration for Linux nodes that can run user-deployed Longhorn components.
tolerations:
- key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
# -- Node selector for Linux nodes that can run user-deployed Longhorn components.
nodeSelector:
kubernetes.io/os: "linux"
defaultSetting:
# -- Toleration for system-managed Longhorn components.
taintToleration: cattle.io/os=linux:NoSchedule
# -- Node selector for system-managed Longhorn components.
systemManagedComponentsNodeSelector: kubernetes.io/os:linux
image:
longhorn:
engine:
# -- Repository for the Longhorn Engine image.
repository: longhornio/longhorn-engine
# -- Specify Longhorn engine image tag
tag: v1.6.1
manager:
# -- Repository for the Longhorn Manager image.
repository: longhornio/longhorn-manager
# -- Specify Longhorn manager image tag
tag: v1.6.1
ui:
# -- Repository for the Longhorn UI image.
repository: longhornio/longhorn-ui
# -- Specify Longhorn ui image tag
tag: v1.6.1
instanceManager:
# -- Repository for the Longhorn Instance Manager image.
repository: longhornio/longhorn-instance-manager
# -- Specify Longhorn instance manager image tag
tag: v1.6.1
shareManager:
# -- Repository for the Longhorn Share Manager image.
repository: longhornio/longhorn-share-manager
# -- Specify Longhorn share manager image tag
tag: v1.6.1
backingImageManager:
# -- Repository for the Backing Image Manager image. When unspecified, Longhorn uses the default value.
repository: longhornio/backing-image-manager
# -- Specify Longhorn backing image manager image tag
tag: v1.6.1
supportBundleKit:
# -- Repository for the Longhorn Support Bundle Manager image.
repository: longhornio/support-bundle-kit
# -- Tag for the Longhorn Support Bundle Manager image.
tag: v0.0.36
csi:
attacher:
# -- Repository for the CSI attacher image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-attacher
# -- Tag for the CSI attacher image. When unspecified, Longhorn uses the default value.
tag: v4.4.2
provisioner:
# -- Repository for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-provisioner
# -- Tag for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
tag: v3.6.2
nodeDriverRegistrar:
# -- Repository for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-node-driver-registrar
# -- Tag for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
tag: v2.9.2
resizer:
# -- Repository for the CSI Resizer image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-resizer
# -- Tag for the CSI Resizer image. When unspecified, Longhorn uses the default value.
tag: v1.9.2
snapshotter:
# -- Repository for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-snapshotter
# -- Tag for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
tag: v6.3.2
livenessProbe:
# -- Repository for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
repository: longhornio/livenessprobe
# -- Tag for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
tag: v2.12.0
openshift:
oauthProxy:
# -- Repository for the OAuth Proxy image. This setting applies only to OpenShift users.
repository: quay.io/openshift/origin-oauth-proxy
# -- Tag for the OAuth Proxy image. This setting applies only to OpenShift users. Specify OCP/OKD version 4.1 or later. The latest stable version is 4.14.
tag: 4.14
# -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
pullPolicy: IfNotPresent
networkPolicies:
# -- Setting that allows you to enable network policies that control access to Longhorn pods.
enabled: false
# -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
type: "k3s"
service:
ui:
# -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
type: ClusterIP
# -- NodePort port number for Longhorn UI. When unspecified, Longhorn selects a free port between 30000 and 32767.
nodePort: null
manager:
# -- Service type for Longhorn Manager.
type: ClusterIP
# -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
nodePort: ""
image:
longhorn:
engine:
# -- Repository for the Longhorn Engine image.
repository: longhornio/longhorn-engine
# -- Specify Longhorn engine image tag
tag: v1.6.1
manager:
# -- Repository for the Longhorn Manager image.
repository: longhornio/longhorn-manager
# -- Specify Longhorn manager image tag
tag: v1.6.1
ui:
# -- Repository for the Longhorn UI image.
repository: longhornio/longhorn-ui
# -- Specify Longhorn ui image tag
tag: v1.6.1
instanceManager:
# -- Repository for the Longhorn Instance Manager image.
repository: longhornio/longhorn-instance-manager
# -- Specify Longhorn instance manager image tag
tag: v1.6.1
shareManager:
# -- Repository for the Longhorn Share Manager image.
repository: longhornio/longhorn-share-manager
# -- Specify Longhorn share manager image tag
tag: v1.6.1
backingImageManager:
# -- Repository for the Backing Image Manager image. When unspecified, Longhorn uses the default value.
repository: longhornio/backing-image-manager
# -- Specify Longhorn backing image manager image tag
tag: v1.6.1
supportBundleKit:
# -- Repository for the Longhorn Support Bundle Manager image.
repository: longhornio/support-bundle-kit
# -- Tag for the Longhorn Support Bundle Manager image.
tag: v0.0.36
csi:
attacher:
# -- Repository for the CSI attacher image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-attacher
# -- Tag for the CSI attacher image. When unspecified, Longhorn uses the default value.
tag: v4.4.2
provisioner:
# -- Repository for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-provisioner
# -- Tag for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
tag: v3.6.2
nodeDriverRegistrar:
# -- Repository for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-node-driver-registrar
# -- Tag for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
tag: v2.9.2
resizer:
# -- Repository for the CSI Resizer image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-resizer
# -- Tag for the CSI Resizer image. When unspecified, Longhorn uses the default value.
tag: v1.9.2
snapshotter:
# -- Repository for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
repository: longhornio/csi-snapshotter
# -- Tag for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
tag: v6.3.2
livenessProbe:
# -- Repository for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
repository: longhornio/livenessprobe
# -- Tag for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
tag: v2.12.0
openshift:
oauthProxy:
# -- Repository for the OAuth Proxy image. This setting applies only to OpenShift users.
repository: quay.io/openshift/origin-oauth-proxy
# -- Tag for the OAuth Proxy image. This setting applies only to OpenShift users. Specify OCP/OKD version 4.1 or later. The latest stable version is 4.14.
tag: 4.14
# -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
pullPolicy: IfNotPresent
persistence:
# -- Setting that allows you to specify the default Longhorn StorageClass.
defaultClass: true
# -- Filesystem type of the default Longhorn StorageClass.
defaultFsType: ext4
# -- mkfs parameters of the default Longhorn StorageClass.
defaultMkfsParams: ""
# -- Replica count of the default Longhorn StorageClass.
defaultClassReplicaCount: 3
# -- Data locality of the default Longhorn StorageClass. (Options: "disabled", "best-effort")
defaultDataLocality: disabled
# -- Reclaim policy that provides instructions for handling of a volume after its claim is released. (Options: "Retain", "Delete")
reclaimPolicy: Delete
# -- Setting that allows you to enable live migration of a Longhorn volume from one node to another.
migratable: false
# -- Set NFS mount options for Longhorn StorageClass for RWX volumes
nfsOptions: ""
recurringJobSelector:
# -- Setting that allows you to enable the recurring job selector for a Longhorn StorageClass.
enable: false
# -- Recurring job selector for a Longhorn StorageClass. Ensure that quotes are used correctly when specifying job parameters. (Example: `[{"name":"backup", "isGroup":true}]`)
jobList: []
backingImage:
# -- Setting that allows you to use a backing image in a Longhorn StorageClass.
enable: false
# -- Backing image to be used for creating and restoring volumes in a Longhorn StorageClass. When no backing images are available, specify the data source type and parameters that Longhorn can use to create a backing image.
name: ~
# -- Data source type of a backing image used in a Longhorn StorageClass.
# If the backing image exists in the cluster, Longhorn uses this setting to verify the image.
# If the backing image does not exist, Longhorn creates one using the specified data source type.
dataSourceType: ~
# -- Data source parameters of a backing image used in a Longhorn StorageClass.
# You can specify a JSON string of a map. (Example: `'{\"url\":\"https://backing-image-example.s3-region.amazonaws.com/test-backing-image\"}'`)
dataSourceParameters: ~
# -- Expected SHA-512 checksum of a backing image used in a Longhorn StorageClass.
expectedChecksum: ~
defaultNodeSelector:
# -- Setting that allows you to enable the node selector for the default Longhorn StorageClass.
enable: false
# -- Node selector for the default Longhorn StorageClass. Longhorn uses only nodes with the specified tags for storing volume data. (Examples: "storage,fast")
selector: ""
# -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
removeSnapshotsDuringFilesystemTrim: ignored
service:
ui:
# -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
type: ClusterIP
# -- NodePort port number for Longhorn UI. When unspecified, Longhorn selects a free port between 30000 and 32767.
nodePort: null
manager:
# -- Service type for Longhorn Manager.
type: ClusterIP
# -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
nodePort: ""
preUpgradeChecker:
# -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
jobEnabled: true
# -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
upgradeVersionCheck: true
persistence:
# -- Setting that allows you to specify the default Longhorn StorageClass.
defaultClass: true
# -- Filesystem type of the default Longhorn StorageClass.
defaultFsType: ext4
# -- mkfs parameters of the default Longhorn StorageClass.
defaultMkfsParams: ""
# -- Replica count of the default Longhorn StorageClass.
defaultClassReplicaCount: 3
# -- Data locality of the default Longhorn StorageClass. (Options: "disabled", "best-effort")
defaultDataLocality: disabled
# -- Reclaim policy that provides instructions for handling of a volume after its claim is released. (Options: "Retain", "Delete")
reclaimPolicy: Delete
# -- Setting that allows you to enable live migration of a Longhorn volume from one node to another.
migratable: false
# -- Set NFS mount options for Longhorn StorageClass for RWX volumes
nfsOptions: ""
recurringJobSelector:
# -- Setting that allows you to enable the recurring job selector for a Longhorn StorageClass.
enable: false
# -- Recurring job selector for a Longhorn StorageClass. Ensure that quotes are used correctly when specifying job parameters. (Example: `[{"name":"backup", "isGroup":true}]`)
jobList: []
backingImage:
# -- Setting that allows you to use a backing image in a Longhorn StorageClass.
enable: false
# -- Backing image to be used for creating and restoring volumes in a Longhorn StorageClass. When no backing images are available, specify the data source type and parameters that Longhorn can use to create a backing image.
name: ~
# -- Data source type of a backing image used in a Longhorn StorageClass.
# If the backing image exists in the cluster, Longhorn uses this setting to verify the image.
# If the backing image does not exist, Longhorn creates one using the specified data source type.
dataSourceType: ~
# -- Data source parameters of a backing image used in a Longhorn StorageClass.
# You can specify a JSON string of a map. (Example: `'{\"url\":\"https://backing-image-example.s3-region.amazonaws.com/test-backing-image\"}'`)
dataSourceParameters: ~
# -- Expected SHA-512 checksum of a backing image used in a Longhorn StorageClass.
expectedChecksum: ~
defaultNodeSelector:
# -- Setting that allows you to enable the node selector for the default Longhorn StorageClass.
enable: false
# -- Node selector for the default Longhorn StorageClass. Longhorn uses only nodes with the specified tags for storing volume data. (Examples: "storage,fast")
selector: ""
# -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
removeSnapshotsDuringFilesystemTrim: ignored
csi:
# -- kubelet root directory. When unspecified, Longhorn uses the default value.
kubeletRootDir: ~
# -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
attacherReplicaCount: ~
# -- Replica count of the CSI Provisioner. When unspecified, Longhorn uses the default value ("3").
provisionerReplicaCount: ~
# -- Replica count of the CSI Resizer. When unspecified, Longhorn uses the default value ("3").
resizerReplicaCount: ~
# -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
snapshotterReplicaCount: ~
preUpgradeChecker:
# -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
jobEnabled: true
# -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
upgradeVersionCheck: true
defaultSettings:
# -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
backupTarget: ~
# -- Name of the Kubernetes secret associated with the backup target.
backupTargetCredentialSecret: ~
# -- Setting that allows Longhorn to automatically attach a volume and create snapshots or backups when recurring jobs are run.
allowRecurringJobWhileVolumeDetached: ~
# -- Setting that allows Longhorn to automatically create a default disk only on nodes with the label "node.longhorn.io/create-default-disk=true" (if no other disks exist). When this setting is disabled, Longhorn creates a default disk on each node that is added to the cluster.
createDefaultDiskLabeledNodes: ~
# -- Default path for storing data on a host. The default value is "/var/lib/longhorn/".
defaultDataPath: ~
# -- Default data locality. A Longhorn volume has data locality if a local replica of the volume exists on the same node as the pod that is using the volume.
defaultDataLocality: ~
# -- Setting that allows scheduling on nodes with healthy replicas of the same volume. This setting is disabled by default.
replicaSoftAntiAffinity: ~
# -- Setting that automatically rebalances replicas when an available node is discovered.
replicaAutoBalance: ~
# -- Percentage of storage that can be allocated relative to hard drive capacity. The default value is "100".
storageOverProvisioningPercentage: ~
# -- Percentage of minimum available disk capacity. When the minimum available capacity exceeds the total available capacity, the disk becomes unschedulable until more space is made available for use. The default value is "25".
storageMinimalAvailablePercentage: ~
# -- Percentage of disk space that is not allocated to the default disk on each new Longhorn node.
storageReservedPercentageForDefaultDisk: ~
# -- Upgrade Checker that periodically checks for new Longhorn versions. When a new version is available, a notification appears on the Longhorn UI. This setting is enabled by default
upgradeChecker: ~
# -- Default number of replicas for volumes created using the Longhorn UI. For Kubernetes configuration, modify the `numberOfReplicas` field in the StorageClass. The default value is "3".
defaultReplicaCount: ~
# -- Default Longhorn StorageClass. "storageClassName" is assigned to PVs and PVCs that are created for an existing Longhorn volume. "storageClassName" can also be used as a label, so it is possible to use a Longhorn StorageClass to bind a workload to an existing PV without creating a Kubernetes StorageClass object. The default value is "longhorn-static".
defaultLonghornStaticStorageClass: ~
# -- Number of seconds that Longhorn waits before checking the backupstore for new backups. The default value is "300". When the value is "0", polling is disabled.
backupstorePollInterval: ~
# -- Number of minutes that Longhorn keeps a failed backup resource. When the value is "0", automatic deletion is disabled.
failedBackupTTL: ~
# -- Setting that restores recurring jobs from a backup volume on a backup target and creates recurring jobs if none exist during backup restoration.
restoreVolumeRecurringJobs: ~
# -- Maximum number of successful recurring backup and snapshot jobs to be retained. When the value is "0", a history of successful recurring jobs is not retained.
recurringSuccessfulJobsHistoryLimit: ~
# -- Maximum number of failed recurring backup and snapshot jobs to be retained. When the value is "0", a history of failed recurring jobs is not retained.
recurringFailedJobsHistoryLimit: ~
# -- Maximum number of snapshots or backups to be retained.
recurringJobMaxRetention: ~
# -- Maximum number of failed support bundles that can exist in the cluster. When the value is "0", Longhorn automatically purges all failed support bundles.
supportBundleFailedHistoryLimit: ~
# -- Taint or toleration for system-managed Longhorn components.
taintToleration: ~
# -- Node selector for system-managed Longhorn components.
systemManagedComponentsNodeSelector: ~
# -- PriorityClass for system-managed Longhorn components.
# This setting can help prevent Longhorn components from being evicted under Node Pressure.
# Notice that this will be applied to Longhorn user-deployed components by default if there are no priority class values set yet, such as `longhornManager.priorityClass`.
priorityClass: &defaultPriorityClassNameRef "longhorn-critical"
# -- Setting that allows Longhorn to automatically salvage volumes when all replicas become faulty (for example, when the network connection is interrupted). Longhorn determines which replicas are usable and then uses these replicas for the volume. This setting is enabled by default.
autoSalvage: ~
# -- Setting that allows Longhorn to automatically delete a workload pod that is managed by a controller (for example, daemonset) whenever a Longhorn volume is detached unexpectedly (for example, during Kubernetes upgrades). After deletion, the controller restarts the pod and then Kubernetes handles volume reattachment and remounting.
autoDeletePodWhenVolumeDetachedUnexpectedly: ~
# -- Setting that prevents Longhorn Manager from scheduling replicas on a cordoned Kubernetes node. This setting is enabled by default.
disableSchedulingOnCordonedNode: ~
# -- Setting that allows Longhorn to schedule new replicas of a volume to nodes in the same zone as existing healthy replicas. Nodes that do not belong to any zone are treated as existing in the zone that contains healthy replicas. When identifying zones, Longhorn relies on the label "topology.kubernetes.io/zone=<Zone name of the node>" in the Kubernetes node object.
replicaZoneSoftAntiAffinity: ~
# -- Setting that allows scheduling on disks with existing healthy replicas of the same volume. This setting is enabled by default.
replicaDiskSoftAntiAffinity: ~
# -- Policy that defines the action Longhorn takes when a volume is stuck with a StatefulSet or Deployment pod on a node that failed.
nodeDownPodDeletionPolicy: ~
# -- Policy that defines the action Longhorn takes when a node with the last healthy replica of a volume is drained.
nodeDrainPolicy: ~
# -- Setting that allows automatic detaching of manually-attached volumes when a node is cordoned.
detachManuallyAttachedVolumesWhenCordoned: ~
# -- Number of seconds that Longhorn waits before reusing existing data on a failed replica instead of creating a new replica of a degraded volume.
replicaReplenishmentWaitInterval: ~
# -- Maximum number of replicas that can be concurrently rebuilt on each node.
concurrentReplicaRebuildPerNodeLimit: ~
# -- Maximum number of volumes that can be concurrently restored on each node using a backup. When the value is "0", restoration of volumes using a backup is disabled.
concurrentVolumeBackupRestorePerNodeLimit: ~
# -- Setting that disables the revision counter and thereby prevents Longhorn from tracking all write operations to a volume. When salvaging a volume, Longhorn uses properties of the "volume-head-xxx.img" file (the last file size and the last time the file was modified) to select the replica to be used for volume recovery. This setting applies only to volumes created using the Longhorn UI.
disableRevisionCounter: ~
# -- Image pull policy for system-managed pods, such as Instance Manager, engine images, and CSI Driver. Changes to the image pull policy are applied only after the system-managed pods restart.
systemManagedPodsImagePullPolicy: ~
# -- Setting that allows you to create and attach a volume without having all replicas scheduled at the time of creation.
allowVolumeCreationWithDegradedAvailability: ~
# -- Setting that allows Longhorn to automatically clean up the system-generated snapshot after replica rebuilding is completed.
autoCleanupSystemGeneratedSnapshot: ~
# -- Setting that allows Longhorn to automatically clean up the snapshot generated by a recurring backup job.
autoCleanupRecurringJobBackupSnapshot: ~
# -- Maximum number of engines that are allowed to concurrently upgrade on each node after Longhorn Manager is upgraded. When the value is "0", Longhorn does not automatically upgrade volume engines to the new default engine image version.
concurrentAutomaticEngineUpgradePerNodeLimit: ~
# -- Number of minutes that Longhorn waits before cleaning up the backing image file when no replicas in the disk are using it.
backingImageCleanupWaitInterval: ~
# -- Number of seconds that Longhorn waits before downloading a backing image file again when the status of all image disk files changes to "failed" or "unknown".
backingImageRecoveryWaitInterval: ~
# -- Percentage of the total allocatable CPU resources on each node to be reserved for each instance manager pod when the V1 Data Engine is enabled. The default value is "12".
guaranteedInstanceManagerCPU: ~
# -- Setting that notifies Longhorn that the cluster is using the Kubernetes Cluster Autoscaler.
kubernetesClusterAutoscalerEnabled: ~
# -- Setting that allows Longhorn to automatically delete an orphaned resource and the corresponding data (for example, stale replicas). Orphaned resources on failed or unknown nodes are not automatically cleaned up.
orphanAutoDeletion: ~
# -- Storage network for in-cluster traffic. When unspecified, Longhorn uses the Kubernetes cluster network.
storageNetwork: ~
# -- Flag that prevents accidental uninstallation of Longhorn.
deletingConfirmationFlag: ~
# -- Timeout between the Longhorn Engine and replicas. Specify a value between "8" and "30" seconds. The default value is "8".
engineReplicaTimeout: ~
# -- Setting that allows you to enable and disable snapshot hashing and data integrity checks.
snapshotDataIntegrity: ~
# -- Setting that allows disabling of snapshot hashing after snapshot creation to minimize impact on system performance.
snapshotDataIntegrityImmediateCheckAfterSnapshotCreation: ~
# -- Setting that defines when Longhorn checks the integrity of data in snapshot disk files. You must use the Unix cron expression format.
snapshotDataIntegrityCronjob: ~
# -- Setting that allows Longhorn to automatically mark the latest snapshot and its parent files as removed during a filesystem trim. Longhorn does not remove snapshots containing multiple child files.
removeSnapshotsDuringFilesystemTrim: ~
# -- Setting that allows fast rebuilding of replicas using the checksum of snapshot disk files. Before enabling this setting, you must set the snapshot-data-integrity value to "enable" or "fast-check".
fastReplicaRebuildEnabled: ~
# -- Number of seconds that an HTTP client waits for a response from a File Sync server before considering the connection to have failed.
replicaFileSyncHttpClientTimeout: ~
# -- Log levels that indicate the type and severity of logs in Longhorn Manager. The default value is "Info". (Options: "Panic", "Fatal", "Error", "Warn", "Info", "Debug", "Trace")
logLevel: ~
# -- Setting that allows you to specify a backup compression method.
backupCompressionMethod: ~
# -- Maximum number of worker threads that can concurrently run for each backup.
backupConcurrentLimit: ~
# -- Maximum number of worker threads that can concurrently run for each restore operation.
restoreConcurrentLimit: ~
# -- Setting that allows you to enable the V1 Data Engine.
v1DataEngine: ~
# -- Setting that allows you to enable the V2 Data Engine, which is based on the Storage Performance Development Kit (SPDK). The V2 Data Engine is a preview feature and should not be used in production environments.
v2DataEngine: ~
# -- Setting that allows you to configure maximum huge page size (in MiB) for the V2 Data Engine.
v2DataEngineHugepageLimit: ~
# -- Setting that allows rebuilding of offline replicas for volumes using the V2 Data Engine.
offlineReplicaRebuilding: ~
# -- Number of millicpus on each node to be reserved for each Instance Manager pod when the V2 Data Engine is enabled. The default value is "1250".
v2DataEngineGuaranteedInstanceManagerCPU: ~
# -- Setting that allows scheduling of empty node selector volumes to any node.
allowEmptyNodeSelectorVolume: ~
# -- Setting that allows scheduling of empty disk selector volumes to any disk.
allowEmptyDiskSelectorVolume: ~
# -- Setting that allows Longhorn to periodically collect anonymous usage data for product improvement purposes. Longhorn sends collected data to the [Upgrade Responder](https://github.com/longhorn/upgrade-responder) server, which is the data source of the Longhorn Public Metrics Dashboard (https://metrics.longhorn.io). The Upgrade Responder server does not store data that can be used to identify clients, including IP addresses.
allowCollectingLonghornUsageMetrics: ~
# -- Setting that temporarily prevents all attempts to purge volume snapshots.
disableSnapshotPurge: ~
# -- Maximum snapshot count for a volume. The value should be between 2 to 250
snapshotMaxCount: ~
csi:
# -- kubelet root directory. When unspecified, Longhorn uses the default value.
kubeletRootDir: ~
# -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
attacherReplicaCount: ~
# -- Replica count of the CSI Provisioner. When unspecified, Longhorn uses the default value ("3").
provisionerReplicaCount: ~
# -- Replica count of the CSI Resizer. When unspecified, Longhorn uses the default value ("3").
resizerReplicaCount: ~
# -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
snapshotterReplicaCount: ~
privateRegistry:
# -- Setting that allows you to create a private registry secret.
createSecret: ~
# -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
registryUrl: ~
# -- User account used for authenticating with a private registry.
registryUser: ~
# -- Password for authenticating with a private registry.
registryPasswd: ~
# -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
registrySecret: ~
defaultSettings:
# -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
backupTarget: ~
# -- Name of the Kubernetes secret associated with the backup target.
backupTargetCredentialSecret: ~
# -- Setting that allows Longhorn to automatically attach a volume and create snapshots or backups when recurring jobs are run.
allowRecurringJobWhileVolumeDetached: ~
# -- Setting that allows Longhorn to automatically create a default disk only on nodes with the label "node.longhorn.io/create-default-disk=true" (if no other disks exist). When this setting is disabled, Longhorn creates a default disk on each node that is added to the cluster.
createDefaultDiskLabeledNodes: ~
# -- Default path for storing data on a host. The default value is "/var/lib/longhorn/".
defaultDataPath: ~
# -- Default data locality. A Longhorn volume has data locality if a local replica of the volume exists on the same node as the pod that is using the volume.
defaultDataLocality: ~
# -- Setting that allows scheduling on nodes with healthy replicas of the same volume. This setting is disabled by default.
replicaSoftAntiAffinity: ~
# -- Setting that automatically rebalances replicas when an available node is discovered.
replicaAutoBalance: ~
# -- Percentage of storage that can be allocated relative to hard drive capacity. The default value is "100".
storageOverProvisioningPercentage: ~
# -- Percentage of minimum available disk capacity. When the minimum available capacity exceeds the total available capacity, the disk becomes unschedulable until more space is made available for use. The default value is "25".
storageMinimalAvailablePercentage: ~
# -- Percentage of disk space that is not allocated to the default disk on each new Longhorn node.
storageReservedPercentageForDefaultDisk: ~
# -- Upgrade Checker that periodically checks for new Longhorn versions. When a new version is available, a notification appears on the Longhorn UI. This setting is enabled by default
upgradeChecker: ~
# -- Default number of replicas for volumes created using the Longhorn UI. For Kubernetes configuration, modify the `numberOfReplicas` field in the StorageClass. The default value is "3".
defaultReplicaCount: ~
# -- Default Longhorn StorageClass. "storageClassName" is assigned to PVs and PVCs that are created for an existing Longhorn volume. "storageClassName" can also be used as a label, so it is possible to use a Longhorn StorageClass to bind a workload to an existing PV without creating a Kubernetes StorageClass object. The default value is "longhorn-static".
defaultLonghornStaticStorageClass: ~
# -- Number of seconds that Longhorn waits before checking the backupstore for new backups. The default value is "300". When the value is "0", polling is disabled.
backupstorePollInterval: ~
# -- Number of minutes that Longhorn keeps a failed backup resource. When the value is "0", automatic deletion is disabled.
failedBackupTTL: ~
# -- Setting that restores recurring jobs from a backup volume on a backup target and creates recurring jobs if none exist during backup restoration.
restoreVolumeRecurringJobs: ~
# -- Maximum number of successful recurring backup and snapshot jobs to be retained. When the value is "0", a history of successful recurring jobs is not retained.
recurringSuccessfulJobsHistoryLimit: ~
# -- Maximum number of failed recurring backup and snapshot jobs to be retained. When the value is "0", a history of failed recurring jobs is not retained.
recurringFailedJobsHistoryLimit: ~
# -- Maximum number of snapshots or backups to be retained.
recurringJobMaxRetention: ~
# -- Maximum number of failed support bundles that can exist in the cluster. When the value is "0", Longhorn automatically purges all failed support bundles.
supportBundleFailedHistoryLimit: ~
# -- Taint or toleration for system-managed Longhorn components.
taintToleration: ~
# -- Node selector for system-managed Longhorn components.
systemManagedComponentsNodeSelector: ~
# -- PriorityClass for system-managed Longhorn components.
# This setting can help prevent Longhorn components from being evicted under Node Pressure.
# Notice that this will be applied to Longhorn user-deployed components by default if there are no priority class values set yet, such as `longhornManager.priorityClass`.
priorityClass: &defaultPriorityClassNameRef "longhorn-critical"
# -- Setting that allows Longhorn to automatically salvage volumes when all replicas become faulty (for example, when the network connection is interrupted). Longhorn determines which replicas are usable and then uses these replicas for the volume. This setting is enabled by default.
autoSalvage: ~
# -- Setting that allows Longhorn to automatically delete a workload pod that is managed by a controller (for example, daemonset) whenever a Longhorn volume is detached unexpectedly (for example, during Kubernetes upgrades). After deletion, the controller restarts the pod and then Kubernetes handles volume reattachment and remounting.
autoDeletePodWhenVolumeDetachedUnexpectedly: ~
# -- Setting that prevents Longhorn Manager from scheduling replicas on a cordoned Kubernetes node. This setting is enabled by default.
disableSchedulingOnCordonedNode: ~
# -- Setting that allows Longhorn to schedule new replicas of a volume to nodes in the same zone as existing healthy replicas. Nodes that do not belong to any zone are treated as existing in the zone that contains healthy replicas. When identifying zones, Longhorn relies on the label "topology.kubernetes.io/zone=<Zone name of the node>" in the Kubernetes node object.
replicaZoneSoftAntiAffinity: ~
# -- Setting that allows scheduling on disks with existing healthy replicas of the same volume. This setting is enabled by default.
replicaDiskSoftAntiAffinity: ~
# -- Policy that defines the action Longhorn takes when a volume is stuck with a StatefulSet or Deployment pod on a node that failed.
nodeDownPodDeletionPolicy: ~
# -- Policy that defines the action Longhorn takes when a node with the last healthy replica of a volume is drained.
nodeDrainPolicy: ~
# -- Setting that allows automatic detaching of manually-attached volumes when a node is cordoned.
detachManuallyAttachedVolumesWhenCordoned: ~
# -- Number of seconds that Longhorn waits before reusing existing data on a failed replica instead of creating a new replica of a degraded volume.
replicaReplenishmentWaitInterval: ~
# -- Maximum number of replicas that can be concurrently rebuilt on each node.
concurrentReplicaRebuildPerNodeLimit: ~
# -- Maximum number of volumes that can be concurrently restored on each node using a backup. When the value is "0", restoration of volumes using a backup is disabled.
concurrentVolumeBackupRestorePerNodeLimit: ~
# -- Setting that disables the revision counter and thereby prevents Longhorn from tracking all write operations to a volume. When salvaging a volume, Longhorn uses properties of the "volume-head-xxx.img" file (the last file size and the last time the file was modified) to select the replica to be used for volume recovery. This setting applies only to volumes created using the Longhorn UI.
disableRevisionCounter: ~
# -- Image pull policy for system-managed pods, such as Instance Manager, engine images, and CSI Driver. Changes to the image pull policy are applied only after the system-managed pods restart.
systemManagedPodsImagePullPolicy: ~
# -- Setting that allows you to create and attach a volume without having all replicas scheduled at the time of creation.
allowVolumeCreationWithDegradedAvailability: ~
# -- Setting that allows Longhorn to automatically clean up the system-generated snapshot after replica rebuilding is completed.
autoCleanupSystemGeneratedSnapshot: ~
# -- Setting that allows Longhorn to automatically clean up the snapshot generated by a recurring backup job.
autoCleanupRecurringJobBackupSnapshot: ~
# -- Maximum number of engines that are allowed to concurrently upgrade on each node after Longhorn Manager is upgraded. When the value is "0", Longhorn does not automatically upgrade volume engines to the new default engine image version.
concurrentAutomaticEngineUpgradePerNodeLimit: ~
# -- Number of minutes that Longhorn waits before cleaning up the backing image file when no replicas in the disk are using it.
backingImageCleanupWaitInterval: ~
# -- Number of seconds that Longhorn waits before downloading a backing image file again when the status of all image disk files changes to "failed" or "unknown".
backingImageRecoveryWaitInterval: ~
# -- Percentage of the total allocatable CPU resources on each node to be reserved for each instance manager pod when the V1 Data Engine is enabled. The default value is "12".
guaranteedInstanceManagerCPU: ~
# -- Setting that notifies Longhorn that the cluster is using the Kubernetes Cluster Autoscaler.
kubernetesClusterAutoscalerEnabled: ~
# -- Setting that allows Longhorn to automatically delete an orphaned resource and the corresponding data (for example, stale replicas). Orphaned resources on failed or unknown nodes are not automatically cleaned up.
orphanAutoDeletion: ~
# -- Storage network for in-cluster traffic. When unspecified, Longhorn uses the Kubernetes cluster network.
storageNetwork: ~
# -- Flag that prevents accidental uninstallation of Longhorn.
deletingConfirmationFlag: ~
# -- Timeout between the Longhorn Engine and replicas. Specify a value between "8" and "30" seconds. The default value is "8".
engineReplicaTimeout: ~
# -- Setting that allows you to enable and disable snapshot hashing and data integrity checks.
snapshotDataIntegrity: ~
# -- Setting that allows disabling of snapshot hashing after snapshot creation to minimize impact on system performance.
snapshotDataIntegrityImmediateCheckAfterSnapshotCreation: ~
# -- Setting that defines when Longhorn checks the integrity of data in snapshot disk files. You must use the Unix cron expression format.
snapshotDataIntegrityCronjob: ~
# -- Setting that allows Longhorn to automatically mark the latest snapshot and its parent files as removed during a filesystem trim. Longhorn does not remove snapshots containing multiple child files.
removeSnapshotsDuringFilesystemTrim: ~
# -- Setting that allows fast rebuilding of replicas using the checksum of snapshot disk files. Before enabling this setting, you must set the snapshot-data-integrity value to "enable" or "fast-check".
fastReplicaRebuildEnabled: ~
# -- Number of seconds that an HTTP client waits for a response from a File Sync server before considering the connection to have failed.
replicaFileSyncHttpClientTimeout: ~
# -- Log levels that indicate the type and severity of logs in Longhorn Manager. The default value is "Info". (Options: "Panic", "Fatal", "Error", "Warn", "Info", "Debug", "Trace")
logLevel: ~
# -- Setting that allows you to specify a backup compression method.
backupCompressionMethod: ~
# -- Maximum number of worker threads that can concurrently run for each backup.
backupConcurrentLimit: ~
# -- Maximum number of worker threads that can concurrently run for each restore operation.
restoreConcurrentLimit: ~
# -- Setting that allows you to enable the V1 Data Engine.
v1DataEngine: ~
# -- Setting that allows you to enable the V2 Data Engine, which is based on the Storage Performance Development Kit (SPDK). The V2 Data Engine is a preview feature and should not be used in production environments.
v2DataEngine: ~
# -- Setting that allows you to configure maximum huge page size (in MiB) for the V2 Data Engine.
v2DataEngineHugepageLimit: ~
# -- Setting that allows rebuilding of offline replicas for volumes using the V2 Data Engine.
offlineReplicaRebuilding: ~
# -- Number of millicpus on each node to be reserved for each Instance Manager pod when the V2 Data Engine is enabled. The default value is "1250".
v2DataEngineGuaranteedInstanceManagerCPU: ~
# -- Setting that allows scheduling of empty node selector volumes to any node.
allowEmptyNodeSelectorVolume: ~
# -- Setting that allows scheduling of empty disk selector volumes to any disk.
allowEmptyDiskSelectorVolume: ~
# -- Setting that allows Longhorn to periodically collect anonymous usage data for product improvement purposes. Longhorn sends collected data to the [Upgrade Responder](https://github.com/longhorn/upgrade-responder) server, which is the data source of the Longhorn Public Metrics Dashboard (https://metrics.longhorn.io). The Upgrade Responder server does not store data that can be used to identify clients, including IP addresses.
allowCollectingLonghornUsageMetrics: ~
# -- Setting that temporarily prevents all attempts to purge volume snapshots.
disableSnapshotPurge: ~
# -- Maximum snapshot count for a volume. The value should be between 2 to 250
snapshotMaxCount: ~
longhornManager:
log:
# -- Format of Longhorn Manager logs. (Options: "plain", "json")
format: plain
# -- PriorityClass for Longhorn Manager.
priorityClass: *defaultPriorityClassNameRef
# -- Toleration for Longhorn Manager on nodes allowed to run Longhorn Manager.
tolerations: []
## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
## and uncomment this example block
# - key: "key"
# operator: "Equal"
# value: "value"
# effect: "NoSchedule"
# -- Node selector for Longhorn Manager. Specify the nodes allowed to run Longhorn Manager.
nodeSelector: {}
## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
## and uncomment this example block
# label-key1: "label-value1"
# label-key2: "label-value2"
# -- Annotation for the Longhorn Manager service.
serviceAnnotations: {}
## If you want to set annotations for the Longhorn Manager service, delete the `{}` in the line above
## and uncomment this example block
# annotation-key1: "annotation-value1"
# annotation-key2: "annotation-value2"
privateRegistry:
# -- Setting that allows you to create a private registry secret.
createSecret: ~
# -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
registryUrl: ~
# -- User account used for authenticating with a private registry.
registryUser: ~
# -- Password for authenticating with a private registry.
registryPasswd: ~
# -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
registrySecret: ~
longhornDriver:
# -- PriorityClass for Longhorn Driver.
priorityClass: *defaultPriorityClassNameRef
# -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
tolerations: []
## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
## and uncomment this example block
# - key: "key"
# operator: "Equal"
# value: "value"
# effect: "NoSchedule"
# -- Node selector for Longhorn Driver. Specify the nodes allowed to run Longhorn Driver.
nodeSelector: {}
## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
## and uncomment this example block
# label-key1: "label-value1"
# label-key2: "label-value2"
longhornManager:
log:
# -- Format of Longhorn Manager logs. (Options: "plain", "json")
format: plain
# -- PriorityClass for Longhorn Manager.
priorityClass: *defaultPriorityClassNameRef
# -- Toleration for Longhorn Manager on nodes allowed to run Longhorn Manager.
tolerations: []
## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
## and uncomment this example block
# - key: "key"
# operator: "Equal"
# value: "value"
# effect: "NoSchedule"
# -- Node selector for Longhorn Manager. Specify the nodes allowed to run Longhorn Manager.
nodeSelector: {}
## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
## and uncomment this example block
# label-key1: "label-value1"
# label-key2: "label-value2"
# -- Annotation for the Longhorn Manager service.
serviceAnnotations: {}
## If you want to set annotations for the Longhorn Manager service, delete the `{}` in the line above
## and uncomment this example block
# annotation-key1: "annotation-value1"
# annotation-key2: "annotation-value2"
longhornUI:
# -- Replica count for Longhorn UI.
replicas: 2
# -- PriorityClass for Longhorn UI.
priorityClass: *defaultPriorityClassNameRef
# -- Toleration for Longhorn UI on nodes allowed to run Longhorn components.
tolerations: []
## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
## and uncomment this example block
# - key: "key"
# operator: "Equal"
# value: "value"
# effect: "NoSchedule"
# -- Node selector for Longhorn UI. Specify the nodes allowed to run Longhorn UI.
nodeSelector: {}
## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
## and uncomment this example block
# label-key1: "label-value1"
# label-key2: "label-value2"
longhornDriver:
# -- PriorityClass for Longhorn Driver.
priorityClass: *defaultPriorityClassNameRef
# -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
tolerations: []
## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
## and uncomment this example block
# - key: "key"
# operator: "Equal"
# value: "value"
# effect: "NoSchedule"
# -- Node selector for Longhorn Driver. Specify the nodes allowed to run Longhorn Driver.
nodeSelector: {}
## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
## and uncomment this example block
# label-key1: "label-value1"
# label-key2: "label-value2"
ingress:
# -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
enabled: false
longhornUI:
# -- Replica count for Longhorn UI.
replicas: 2
# -- PriorityClass for Longhorn UI.
priorityClass: *defaultPriorityClassNameRef
# -- Toleration for Longhorn UI on nodes allowed to run Longhorn components.
tolerations: []
## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
## and uncomment this example block
# - key: "key"
# operator: "Equal"
# value: "value"
# effect: "NoSchedule"
# -- Node selector for Longhorn UI. Specify the nodes allowed to run Longhorn UI.
nodeSelector: {}
## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
## and uncomment this example block
# label-key1: "label-value1"
# label-key2: "label-value2"
# -- IngressClass resource that contains ingress configuration, including the name of the Ingress controller.
# ingressClassName can replace the kubernetes.io/ingress.class annotation used in earlier Kubernetes releases.
ingressClassName: ~
ingress:
# -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
enabled: false
# -- Hostname of the Layer 7 load balancer.
host: sslip.io
# -- IngressClass resource that contains ingress configuration, including the name of the Ingress controller.
# ingressClassName can replace the kubernetes.io/ingress.class annotation used in earlier Kubernetes releases.
ingressClassName: ~
# -- Setting that allows you to enable TLS on ingress records.
tls: false
# -- Hostname of the Layer 7 load balancer.
host: sslip.io
# -- Setting that allows you to enable secure connections to the Longhorn UI service via port 443.
secureBackends: false
# -- Setting that allows you to enable TLS on ingress records.
tls: false
# -- TLS secret that contains the private key and certificate to be used for TLS. This setting applies only when TLS is enabled on ingress records.
tlsSecret: longhorn.local-tls
# -- Setting that allows you to enable secure connections to the Longhorn UI service via port 443.
secureBackends: false
path: /
# -- TLS secret that contains the private key and certificate to be used for TLS. This setting applies only when TLS is enabled on ingress records.
tlsSecret: longhorn.local-tls
## If you're using kube-lego, you will want to add:
## kubernetes.io/tls-acme: true
##
## For a full list of possible ingress annotations, please see
## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
##
## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
# -- Ingress annotations in the form of key-value pairs.
annotations:
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: true
path: /
# -- Secret that contains a TLS private key and certificate. Use secrets if you want to use your own certificates to secure ingresses.
secrets:
## If you're providing your own certificates, please use this to add the certificates as secrets
## key and certificate should start with -----BEGIN CERTIFICATE----- or
## -----BEGIN RSA PRIVATE KEY-----
##
## name should line up with a tlsSecret set further up
## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
##
## It is also possible to create and manage the certificates outside of this helm chart
## Please see README.md for more information
# - name: longhorn.local-tls
# key:
# certificate:
## If you're using kube-lego, you will want to add:
## kubernetes.io/tls-acme: true
##
## For a full list of possible ingress annotations, please see
## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
##
## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
# -- Ingress annotations in the form of key-value pairs.
annotations:
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: true
# -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
enablePSP: false
# -- Secret that contains a TLS private key and certificate. Use secrets if you want to use your own certificates to secure ingresses.
secrets:
## If you're providing your own certificates, please use this to add the certificates as secrets
## key and certificate should start with -----BEGIN CERTIFICATE----- or
## -----BEGIN RSA PRIVATE KEY-----
##
## name should line up with a tlsSecret set further up
## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
##
## It is also possible to create and manage the certificates outside of this helm chart
## Please see README.md for more information
# - name: longhorn.local-tls
# key:
# certificate:
# -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
namespaceOverride: ""
# -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
enablePSP: false
# -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
annotations: {}
# -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
namespaceOverride: ""
serviceAccount:
# -- Annotations to add to the service account
annotations: {}
# -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
annotations: {}
metrics:
serviceMonitor:
# -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
enabled: false
serviceAccount:
# -- Annotations to add to the service account
annotations: {}
## openshift settings
openshift:
# -- Setting that allows Longhorn to integrate with OpenShift.
enabled: false
ui:
# -- Route for connections between Longhorn and the OpenShift web console.
route: "longhorn-ui"
# -- Port for accessing the OpenShift web console.
port: 443
# -- Port for proxy that provides access to the OpenShift web console.
proxy: 8443
metrics:
serviceMonitor:
# -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
enabled: false
# -- Setting that allows Longhorn to generate code coverage profiles.
enableGoCoverDir: false
## openshift settings
openshift:
# -- Setting that allows Longhorn to integrate with OpenShift.
enabled: false
ui:
# -- Route for connections between Longhorn and the OpenShift web console.
route: "longhorn-ui"
# -- Port for accessing the OpenShift web console.
port: 443
# -- Port for proxy that provides access to the OpenShift web console.
proxy: 8443
# -- Setting that allows Longhorn to generate code coverage profiles.
enableGoCoverDir: false

428
internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl
View File

@@ -1,254 +1,244 @@
- name: csi-secrets-store
namespace: kube-system
chart_ref: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef }}
chart_version: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion }}
{{- if .Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
linux:
enabled: true
image:
repository: registry.k8s.io/csi-secrets-store/driver
tag: v1.4.3
#digest: sha256:
pullPolicy: IfNotPresent
linux:
enabled: true
image:
repository: registry.k8s.io/csi-secrets-store/driver
tag: v1.4.3
#digest: sha256:
pullPolicy: IfNotPresent
crds:
enabled: true
image:
repository: registry.k8s.io/csi-secrets-store/driver-crds
tag: v1.4.3
pullPolicy: IfNotPresent
## Optionally override resource limits for crd hooks(jobs)
resources: {}
# requests:
# cpu: "100m"
# memory: "128Mi"
# limits:
# cpu: "500m"
# memory: "512Mi"
annotations: {}
podLabels: {}
crds:
enabled: true
image:
repository: registry.k8s.io/csi-secrets-store/driver-crds
tag: v1.4.3
pullPolicy: IfNotPresent
## Optionally override resource limits for crd hooks(jobs)
resources: {}
# requests:
# cpu: "100m"
# memory: "128Mi"
# limits:
# cpu: "500m"
# memory: "512Mi"
annotations: {}
podLabels: {}
## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: type
operator: NotIn
values:
- virtual-kubelet
## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: type
operator: NotIn
values:
- virtual-kubelet
driver:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 50m
memory: 100Mi
driver:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 50m
memory: 100Mi
registrarImage:
repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
tag: v2.10.0
#digest: sha256:
pullPolicy: IfNotPresent
registrarImage:
repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
tag: v2.10.0
#digest: sha256:
pullPolicy: IfNotPresent
registrar:
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 10m
memory: 20Mi
logVerbosity: 5
registrar:
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 10m
memory: 20Mi
logVerbosity: 5
livenessProbeImage:
repository: registry.k8s.io/sig-storage/livenessprobe
tag: v2.12.0
#digest: sha256:
pullPolicy: IfNotPresent
livenessProbeImage:
repository: registry.k8s.io/sig-storage/livenessprobe
tag: v2.12.0
#digest: sha256:
pullPolicy: IfNotPresent
livenessProbe:
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 10m
memory: 20Mi
livenessProbe:
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 10m
memory: 20Mi
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
kubeletRootDir: /var/lib/kubelet
providersDir: /var/run/secrets-store-csi-providers
additionalProvidersDirs:
- /etc/kubernetes/secrets-store-csi-providers
nodeSelector: {}
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
# An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
tolerations:
- operator: "Exists"
metricsAddr: ":8095"
env: []
priorityClassName: ""
daemonsetAnnotations: {}
podAnnotations: {}
podLabels: {}
kubeletRootDir: /var/lib/kubelet
providersDir: /var/run/secrets-store-csi-providers
additionalProvidersDirs:
- /etc/kubernetes/secrets-store-csi-providers
nodeSelector: {}
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
# An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
tolerations:
- operator: "Exists"
metricsAddr: ":8095"
env: []
priorityClassName: ""
daemonsetAnnotations: {}
podAnnotations: {}
podLabels: {}
# volumes is a list of volumes made available to secrets store csi driver.
volumes: null
# - name: foo
# emptyDir: {}
# volumes is a list of volumes made available to secrets store csi driver.
volumes: null
# - name: foo
# emptyDir: {}
# volumeMounts is a list of volumeMounts for secrets store csi driver.
volumeMounts: null
# - name: foo
# mountPath: /bar
# readOnly: true
# volumeMounts is a list of volumeMounts for secrets store csi driver.
volumeMounts: null
# - name: foo
# mountPath: /bar
# readOnly: true
windows:
enabled: false
image:
repository: registry.k8s.io/csi-secrets-store/driver
tag: v1.4.3
#digest: sha256:
pullPolicy: IfNotPresent
windows:
enabled: false
image:
repository: registry.k8s.io/csi-secrets-store/driver
tag: v1.4.3
#digest: sha256:
pullPolicy: IfNotPresent
## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: type
operator: NotIn
values:
- virtual-kubelet
## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: type
operator: NotIn
values:
- virtual-kubelet
driver:
resources:
limits:
cpu: 400m
memory: 400Mi
requests:
cpu: 100m
memory: 100Mi
driver:
resources:
limits:
cpu: 400m
memory: 400Mi
requests:
cpu: 100m
memory: 100Mi
registrarImage:
repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
tag: v2.10.0
#digest: sha256:
pullPolicy: IfNotPresent
registrarImage:
repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
tag: v2.10.0
#digest: sha256:
pullPolicy: IfNotPresent
registrar:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
logVerbosity: 5
registrar:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
logVerbosity: 5
livenessProbeImage:
repository: registry.k8s.io/sig-storage/livenessprobe
tag: v2.12.0
#digest: sha256:
pullPolicy: IfNotPresent
livenessProbeImage:
repository: registry.k8s.io/sig-storage/livenessprobe
tag: v2.12.0
#digest: sha256:
pullPolicy: IfNotPresent
livenessProbe:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
livenessProbe:
resources:
limits:
cpu: 200m
memory: 200Mi
requests:
cpu: 100m
memory: 100Mi
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
kubeletRootDir: C:\var\lib\kubelet
providersDir: C:\\k\\secrets-store-csi-providers
additionalProvidersDirs:
nodeSelector: {}
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
# An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
tolerations:
- operator: "Exists"
metricsAddr: ":8095"
env: []
priorityClassName: ""
daemonsetAnnotations: {}
podAnnotations: {}
podLabels: {}
kubeletRootDir: C:\var\lib\kubelet
providersDir: C:\\k\\secrets-store-csi-providers
additionalProvidersDirs:
nodeSelector: {}
# ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
# An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
tolerations:
- operator: "Exists"
metricsAddr: ":8095"
env: []
priorityClassName: ""
daemonsetAnnotations: {}
podAnnotations: {}
podLabels: {}
# volumes is a list of volumes made available to secrets store csi driver.
volumes: null
# - name: foo
# emptyDir: {}
# volumes is a list of volumes made available to secrets store csi driver.
volumes: null
# - name: foo
# emptyDir: {}
# volumeMounts is a list of volumeMounts for secrets store csi driver.
volumeMounts: null
# - name: foo
# mountPath: /bar
# readOnly: true
# volumeMounts is a list of volumeMounts for secrets store csi driver.
volumeMounts: null
# - name: foo
# mountPath: /bar
# readOnly: true
# log level. Uses V logs (klog)
logVerbosity: 0
# log level. Uses V logs (klog)
logVerbosity: 0
# logging format JSON
logFormatJSON: false
# logging format JSON
logFormatJSON: false
livenessProbe:
port: 9808
logLevel: 2
livenessProbe:
port: 9808
logLevel: 2
## Maximum size in bytes of gRPC response from plugins
maxCallRecvMsgSize: 4194304
## Maximum size in bytes of gRPC response from plugins
maxCallRecvMsgSize: 4194304
## Install Default RBAC roles and bindings
rbac:
install: true
pspEnabled: false
## Install Default RBAC roles and bindings
rbac:
install: true
pspEnabled: false
## Install RBAC roles and bindings required for K8S Secrets syncing if true
syncSecret:
enabled: false
## Install RBAC roles and bindings required for K8S Secrets syncing if true
syncSecret:
enabled: false
## Enable secret rotation feature [alpha]
enableSecretRotation: false
## Enable secret rotation feature [alpha]
enableSecretRotation: false
## Secret rotation poll interval duration
rotationPollInterval:
## Secret rotation poll interval duration
rotationPollInterval:
## Provider HealthCheck
providerHealthCheck: false
## Provider HealthCheck
providerHealthCheck: false
## Provider HealthCheck interval
providerHealthCheckInterval: 2m
## Provider HealthCheck interval
providerHealthCheckInterval: 2m
imagePullSecrets: []
imagePullSecrets: []
## This allows CSI drivers to impersonate the pods that they mount the volumes for.
# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
# Supported only for Kubernetes v1.20+
tokenRequests: []
# - audience: aud1
# - audience: aud2
## This allows CSI drivers to impersonate the pods that they mount the volumes for.
# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
# Supported only for Kubernetes v1.20+
tokenRequests: []
# - audience: aud1
# - audience: aud2
# -- Labels to apply to all resources
commonLabels: {}
# team_name: dev
# -- Labels to apply to all resources
commonLabels: {}
# team_name: dev

55
internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl
View File

@@ -1,35 +1,24 @@
- name: argo-cd-ingress
namespace: cicd
create_namespace: true
chart_ref: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartRef }}
chart_version: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion }}
{{- if and .Modules.Cicd.Enabled (eq .Modules.Cicd.ArgoCd.Expose.Type "ingress") }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
services:
- domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
address: argo-cd-argocd-server
port: 80
secretName: argo-cd-server-tls
services:
- domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
address: argo-cd-argocd-server
port: 80
secretName: argo-cd-server-tls
ingress:
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
class: {{ .Modules.Additional.Ingress.Type }}
annotations:
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
{{- end }}
tls:
enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
useCertManager: true
ingress:
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
class: {{ .Modules.Additional.Ingress.Type }}
annotations:
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
{{- end }}
tls:
enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
useCertManager: true
# used if "useCertManager" is false
crt: ""
key: ""
# used if "useCertManager" is false
crt: ""
key: ""

331
internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl
View File

@@ -1,181 +1,170 @@
- name: argo-cd
namespace: cicd
create_namespace: true
chart_ref: {{ .Modules.Cicd.ArgoCd.ChartRef }}
chart_version: {{ .Modules.Cicd.ArgoCd.ChartVersion }}
{{- if .Modules.Cicd.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
crds:
install: true
global:
repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
server:
image:
repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
certificateSecret:
enabled: false
{{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
service:
type: "NodePort"
nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
{{- end }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
autoscaling:
enabled: true
minReplicas: 2
{{- else }}
replicas: 2
{{- end }}
{{- end }}
values:
crds:
install: true
global:
repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
server:
image:
repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
certificateSecret:
enabled: false
{{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
service:
type: "NodePort"
nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
{{- end }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
autoscaling:
enabled: true
minReplicas: 2
{{- else }}
replicas: 2
{{- end }}
{{- end }}
redis:
image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
exporter:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
controller:
image:
repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
replicas: 1
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
redis:
image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
exporter:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
applicationSet:
image:
repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
replicas: 2
{{- end }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
controller:
image:
repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
replicas: 1
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
dex:
image:
repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
## check later
serviceMonitor:
enabled: false
applicationSet:
image:
repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
replicas: 2
{{- end }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
repoServer:
image:
repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
autoscaling:
enabled: true
minReplicas: 2
{{- else }}
replicas: 2
{{- end }}
{{- end }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
dex:
image:
repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
## check later
serviceMonitor:
enabled: false
notifications:
image:
repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
repoServer:
image:
repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
autoscaling:
enabled: true
minReplicas: 2
{{- else }}
replicas: 2
{{- end }}
{{- end }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
notifications:
image:
repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
configs:
params:
server.insecure: true
{{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
{{- end }}
secret:
argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
repositories:
# add default helm-repository from harbor
{{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
cm:
create: true
url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
accounts.developer: login
accounts.guest: login
# oidc.config: ""
rbac:
create: true
policy.csv: |
p, role:admin, applications, create, */*, allow
p, role:admin, applications, update, */*, allow
p, role:admin, applications, delete, */*, allow
p, role:admin, applications, sync, */*, allow
p, role:admin, applications, override, */*, allow
p, role:admin, applications, action/*, */*, allow
p, role:admin, applicationsets, get, */*, allow
p, role:admin, applicationsets, create, */*, allow
p, role:admin, applicationsets, update, */*, allow
p, role:admin, applicationsets, delete, */*, allow
p, role:admin, certificates, create, *, allow
p, role:admin, certificates, update, *, allow
p, role:admin, certificates, delete, *, allow
p, role:admin, clusters, create, *, allow
p, role:admin, clusters, update, *, allow
p, role:admin, clusters, delete, *, allow
p, role:admin, repositories, create, *, allow
p, role:admin, repositories, update, *, allow
p, role:admin, repositories, delete, *, allow
p, role:admin, projects, create, *, allow
p, role:admin, projects, update, *, allow
p, role:admin, projects, delete, *, allow
p, role:admin, accounts, update, *, allow
p, role:admin, gpgkeys, create, *, allow
p, role:admin, gpgkeys, delete, *, allow
p, role:admin, exec, create, */*, allow
{{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
policy.default: role:''
# scopes: "[roles,email,groups]"
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
redis-ha:
enabled: true
configs:
params:
server.insecure: true
{{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
{{- end }}
secret:
argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
repositories:
# add default helm-repository from harbor
{{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
cm:
create: true
url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
accounts.developer: login
accounts.guest: login
# oidc.config: ""
rbac:
create: true
policy.csv: |
p, role:admin, applications, create, */*, allow
p, role:admin, applications, update, */*, allow
p, role:admin, applications, delete, */*, allow
p, role:admin, applications, sync, */*, allow
p, role:admin, applications, override, */*, allow
p, role:admin, applications, action/*, */*, allow
p, role:admin, applicationsets, get, */*, allow
p, role:admin, applicationsets, create, */*, allow
p, role:admin, applicationsets, update, */*, allow
p, role:admin, applicationsets, delete, */*, allow
p, role:admin, certificates, create, *, allow
p, role:admin, certificates, update, *, allow
p, role:admin, certificates, delete, *, allow
p, role:admin, clusters, create, *, allow
p, role:admin, clusters, update, *, allow
p, role:admin, clusters, delete, *, allow
p, role:admin, repositories, create, *, allow
p, role:admin, repositories, update, *, allow
p, role:admin, repositories, delete, *, allow
p, role:admin, projects, create, *, allow
p, role:admin, projects, update, *, allow
p, role:admin, projects, delete, *, allow
p, role:admin, accounts, update, *, allow
p, role:admin, gpgkeys, create, *, allow
p, role:admin, gpgkeys, delete, *, allow
p, role:admin, exec, create, */*, allow
{{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
policy.default: role:''
# scopes: "[roles,email,groups]"
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
redis-ha:
enabled: true
{{- end }}

813
internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl
View File

@@ -1,435 +1,424 @@
- name: argo-rollouts
namespace: cicd
create_namespace: true
chart_ref: {{ .Modules.Cicd.Rollouts.ChartRef }}
chart_version: {{ .Modules.Cicd.Rollouts.ChartVersion }}
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.Rollouts.Enabled }}
release_state: "present"
installCRDs: true
keepCRDs: false
clusterInstall: true
createClusterAggregateRoles: true
apiVersionOverrides:
# -- String to override apiVersion of ingresses rendered by this helm chart
ingress: "" # networking.k8s.io/v1beta1
# -- Override the Kubernetes version, which is used to evaluate certain manifests
kubeVersionOverride: ""
# -- Additional manifests to deploy within the chart. A list of objects.
## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
extraObjects: []
# - apiVersion: v1
# kind: Secret
# metadata:
# name: datadog
# type: Opaque
# data:
# address: https://api.datadoghq.com
# api-key: <datadog-api-key>
# app-key: <datadog-app-key>
global:
# -- Annotations for all deployed Deployments
deploymentAnnotations: {}
controller:
# -- Value of label `app.kubernetes.io/component`
component: rollouts-controller
# -- Annotations to be added to the controller deployment
deploymentAnnotations: {}
# -- Annotations to be added to application controller pods
podAnnotations: {}
# -- [Node selector]
nodeSelector: {}
# -- [Tolerations] for use with node taints
tolerations: []
# -- Assign custom [affinity] rules to the deployment
affinity: {}
logging:
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
level: info
# -- Set the klog logging level
kloglevel: "0"
# -- Set the logging format (one of: `text`, `json`)
format: "text"
# -- Assign custom [TopologySpreadConstraints] rules to the controller
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
topologySpreadConstraints: []
# - maxSkew: 1
# topologyKey: topology.kubernetes.io/zone
# whenUnsatisfiable: DoNotSchedule
# -- [priorityClassName] for the controller
priorityClassName: ""
# -- The number of controller pods to run
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
replicas: 3
{{- else }}
release_state: "absent"
replicas: 1
{{- end }}
values:
installCRDs: true
keepCRDs: false
clusterInstall: true
createClusterAggregateRoles: true
image:
# -- Registry to use
registry: {{ .Modules.Cicd.Rollouts.Registry }}
# -- Repository to use
repository: {{ .Modules.Cicd.Rollouts.Repository }}
# -- Overrides the image tag (default is the chart appVersion)
tag: {{ .Modules.Cicd.Rollouts.Tag }}
# -- Image pull policy
pullPolicy: IfNotPresent
apiVersionOverrides:
# -- String to override apiVersion of ingresses rendered by this helm chart
ingress: "" # networking.k8s.io/v1beta1
# -- flag to enable creation of cluster controller role (requires cluster RBAC)
createClusterRole: true
# -- Override the Kubernetes version, which is used to evaluate certain manifests
kubeVersionOverride: ""
# -- Additional manifests to deploy within the chart. A list of objects.
## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
extraObjects: []
# - apiVersion: v1
# kind: Secret
# metadata:
# name: datadog
# type: Opaque
# data:
# address: https://api.datadoghq.com
# api-key: <datadog-api-key>
# app-key: <datadog-app-key>
global:
# -- Annotations for all deployed Deployments
deploymentAnnotations: {}
controller:
# -- Value of label `app.kubernetes.io/component`
component: rollouts-controller
# -- Annotations to be added to the controller deployment
deploymentAnnotations: {}
# -- Annotations to be added to application controller pods
podAnnotations: {}
# -- [Node selector]
nodeSelector: {}
# -- [Tolerations] for use with node taints
tolerations: []
# -- Assign custom [affinity] rules to the deployment
affinity: {}
logging:
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
level: info
# -- Set the klog logging level
kloglevel: "0"
# -- Set the logging format (one of: `text`, `json`)
format: "text"
# -- Assign custom [TopologySpreadConstraints] rules to the controller
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
topologySpreadConstraints: []
# - maxSkew: 1
# topologyKey: topology.kubernetes.io/zone
# whenUnsatisfiable: DoNotSchedule
# -- [priorityClassName] for the controller
priorityClassName: ""
# -- The number of controller pods to run
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
replicas: 3
{{- else }}
replicas: 1
{{- end }}
image:
# -- Registry to use
registry: {{ .Modules.Cicd.Rollouts.Registry }}
# -- Repository to use
repository: {{ .Modules.Cicd.Rollouts.Repository }}
# -- Overrides the image tag (default is the chart appVersion)
tag: {{ .Modules.Cicd.Rollouts.Tag }}
# -- Image pull policy
pullPolicy: IfNotPresent
# -- flag to enable creation of cluster controller role (requires cluster RBAC)
createClusterRole: true
# Controller container ports
containerPorts:
# -- Metrics container port
metrics: 8090
# -- Healthz container port
healthz: 8080
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
metrics:
# -- Deploy metrics service
enabled: true
service:
# -- Metrics service port name
portName: metrics
# -- Metrics service port
port: 8090
# -- Service annotations
annotations: {}
serviceMonitor:
# -- Enable a prometheus ServiceMonitor
enabled: true
# -- Namespace to be used for the ServiceMonitor
namespace: ""
# -- Labels to be added to the ServiceMonitor
additionalLabels: {}
# -- Annotations to be added to the ServiceMonitor
additionalAnnotations: {}
# -- RelabelConfigs to apply to samples before scraping
relabelings: []
# -- MetricRelabelConfigs to apply to samples before ingestion
metricRelabelings: []
{{- end }}
# -- Configure liveness [probe] for the controller
# @default -- See [values.yaml]
livenessProbe:
httpGet:
path: /healthz
port: healthz
initialDelaySeconds: 30
periodSeconds: 20
failureThreshold: 3
successThreshold: 1
timeoutSeconds: 10
# -- Configure readiness [probe] for the controller
# @default -- See [values.yaml]
readinessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 15
periodSeconds: 5
failureThreshold: 3
successThreshold: 1
timeoutSeconds: 4
## Configure Pod Disruption Budget for the controller
pdb:
# -- Labels to be added to controller [Pod Disruption Budget]
labels: {}
# -- Annotations to be added to controller [Pod Disruption Budget]
annotations: {}
# -- Deploy a [Pod Disruption Budget] for the controller
enabled: false
# -- Minimum number / percentage of pods that should remain scheduled
minAvailable: # 1
# -- Maximum number / percentage of pods that may be made unavailable
maxUnavailable: # 0
# -- Additional volumes to add to the controller pod
volumes: []
# - configMap:
# name: my-certs-cm
# name: my-certs
# -- Additional volumeMounts to add to the controller container
volumeMounts: []
# - mountPath: /etc/ssl/certs
# name: my-certs
# -- Configures 3rd party metric providers for controller
## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
metricProviderPlugins: {}
# metricProviderPlugins: |-
# - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
# -- Configures 3rd party traffic router plugins for controller
## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
trafficRouterPlugins: {}
# trafficRouterPlugins: |-
# - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
serviceAccount:
# -- Specifies whether a service account should be created
create: true
# -- Annotations to add to the service account
# Controller container ports
containerPorts:
# -- Metrics container port
metrics: 8090
# -- Healthz container port
healthz: 8080
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
metrics:
# -- Deploy metrics service
enabled: true
service:
# -- Metrics service port name
portName: metrics
# -- Metrics service port
port: 8090
# -- Service annotations
annotations: {}
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
# -- Annotations to be added to all CRDs
crdAnnotations: {}
# -- Annotations for the all deployed pods
podAnnotations: {}
# -- Security Context to set on pod level
podSecurityContext:
runAsNonRoot: true
# -- Security Context to set on container level
containerSecurityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
# -- Annotations to be added to the Rollout service
serviceAnnotations: {}
# -- Labels to be added to the Rollout pods
podLabels: {}
# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
imagePullSecrets: []
# - name: argo-pull-secret
providerRBAC:
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
serviceMonitor:
# -- Enable a prometheus ServiceMonitor
enabled: true
# providerRBAC.enabled must be true in order to toggle the individual providers
providers:
# -- Adds RBAC rules for the Istio provider
istio: true
# -- Adds RBAC rules for the SMI provider
smi: true
# -- Adds RBAC rules for the Ambassador provider
ambassador: true
# -- Adds RBAC rules for the AWS Load Balancer Controller provider
awsLoadBalancerController: true
# -- Adds RBAC rules for the AWS App Mesh provider
awsAppMesh: true
# -- Adds RBAC rules for the Traefik provider
traefik: true
# -- Adds RBAC rules for the Apisix provider
apisix: true
# -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
contour: true
# -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
glooPlatform: true
# -- Additional RBAC rules for others providers
additionalRules: []
# -- Namespace to be used for the ServiceMonitor
namespace: ""
# -- Labels to be added to the ServiceMonitor
additionalLabels: {}
# -- Annotations to be added to the ServiceMonitor
additionalAnnotations: {}
# -- RelabelConfigs to apply to samples before scraping
relabelings: []
# -- MetricRelabelConfigs to apply to samples before ingestion
metricRelabelings: []
{{- end }}
dashboard:
# -- Deploy dashboard server
enabled: true
# -- Set cluster role to readonly
readonly: false
# -- Value of label `app.kubernetes.io/component`
component: rollouts-dashboard
# -- Annotations to be added to the dashboard deployment
deploymentAnnotations: {}
# -- Annotations to be added to application dashboard pods
podAnnotations: {}
# -- [Node selector]
nodeSelector: {}
# -- [Tolerations] for use with node taints
tolerations: []
# -- Assign custom [affinity] rules to the deployment
affinity: {}
logging:
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
level: info
# -- Set the klog logging level
kloglevel: "0"
# -- Configure liveness [probe] for the controller
# @default -- See [values.yaml]
livenessProbe:
httpGet:
path: /healthz
port: healthz
initialDelaySeconds: 30
periodSeconds: 20
failureThreshold: 3
successThreshold: 1
timeoutSeconds: 10
# -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
topologySpreadConstraints: []
# - maxSkew: 1
# topologyKey: topology.kubernetes.io/zone
# whenUnsatisfiable: DoNotSchedule
# -- Configure readiness [probe] for the controller
# @default -- See [values.yaml]
readinessProbe:
httpGet:
path: /metrics
port: metrics
initialDelaySeconds: 15
periodSeconds: 5
failureThreshold: 3
successThreshold: 1
timeoutSeconds: 4
# -- [priorityClassName] for the dashboard server
priorityClassName: ""
## Configure Pod Disruption Budget for the controller
pdb:
# -- Labels to be added to controller [Pod Disruption Budget]
labels: {}
# -- Annotations to be added to controller [Pod Disruption Budget]
annotations: {}
# -- Deploy a [Pod Disruption Budget] for the controller
enabled: false
# -- Minimum number / percentage of pods that should remain scheduled
minAvailable: # 1
# -- Maximum number / percentage of pods that may be made unavailable
maxUnavailable: # 0
# -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
createClusterRole: true
# -- Additional volumes to add to the controller pod
volumes: []
# - configMap:
# name: my-certs-cm
# name: my-certs
# -- The number of dashboard pods to run
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
replicas: 3
{{- else }}
replicas: 1
{{- end }}
image:
# -- Registry to use
registry: quay.io
# -- Repository to use
repository: argoproj/kubectl-argo-rollouts
# -- Overrides the image tag (default is the chart appVersion)
tag: ""
# -- Image pull policy
pullPolicy: IfNotPresent
# -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
extraArgs: []
# -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
extraEnv: []
# - name: FOO
# value: bar
# -- Resource limits and requests for the dashboard pods.
resources: {}
# -- Security Context to set on pod level
podSecurityContext:
runAsNonRoot: true
# -- Security Context to set on container level
containerSecurityContext: {}
service:
# -- Sets the type of the Service
{{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
type: NodePort
nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
{{- else }}
type: ClusterIP
nodePort:
{{- end }}
# -- LoadBalancer will get created with the IP specified in this field
loadBalancerIP: ""
# -- Source IP ranges to allow access to service from
loadBalancerSourceRanges: []
# -- Dashboard service external IPs
externalIPs: []
# -- Service annotations
annotations: {}
# -- Service labels
labels: {}
# -- Service port name
portName: dashboard
# -- Service port
port: 3100
# -- Service target port
targetPort: 3100
# -- (int) Service nodePort
# -- Additional volumeMounts to add to the controller container
volumeMounts: []
# - mountPath: /etc/ssl/certs
# name: my-certs
serviceAccount:
# -- Specifies whether a dashboard service account should be created
create: true
# -- Annotations to add to the dashboard service account
annotations: {}
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
# -- Configures 3rd party metric providers for controller
## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
metricProviderPlugins: {}
# metricProviderPlugins: |-
# - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
## Configure Pod Disruption Budget for the dashboard
pdb:
# -- Labels to be added to dashboard [Pod Disruption Budget]
labels: {}
# -- Annotations to be added to dashboard [Pod Disruption Budget]
annotations: {}
# -- Deploy a [Pod Disruption Budget] for the dashboard
enabled: false
# -- Minimum number / percentage of pods that should remain scheduled
minAvailable: # 1
# -- Maximum number / percentage of pods that may be made unavailable
maxUnavailable: # 0
# -- Configures 3rd party traffic router plugins for controller
## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
trafficRouterPlugins: {}
# trafficRouterPlugins: |-
# - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
## Ingress configuration.
## ref: https://kubernetes.io/docs/user-guide/ingress/
##
ingress:
# -- Enable dashboard ingress support
enabled: false
# -- Dashboard ingress annotations
annotations: {}
# -- Dashboard ingress labels
labels: {}
# -- Dashboard ingress class name
ingressClassName: ""
serviceAccount:
# -- Specifies whether a service account should be created
create: true
# -- Annotations to add to the service account
annotations: {}
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
# -- Dashboard ingress hosts
## Argo Rollouts Dashboard Ingress.
## Hostnames must be provided if Ingress is enabled.
## Secrets must be manually created in the namespace
hosts: []
# - argorollouts.example.com
# -- Annotations to be added to all CRDs
crdAnnotations: {}
# -- Dashboard ingress paths
paths:
- /
# -- Dashboard ingress path type
pathType: Prefix
# -- Dashboard ingress extra paths
extraPaths: []
# - path: /*
# backend:
# serviceName: ssl-redirect
# servicePort: use-annotation
## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
# - path: /*
# pathType: Prefix
# backend:
# service
# name: ssl-redirect
# port:
# name: use-annotation
# -- Annotations for the all deployed pods
podAnnotations: {}
# -- Dashboard ingress tls
tls: []
# - secretName: argorollouts-example-tls
# hosts:
# - argorollouts.example.com
# -- Security Context to set on pod level
podSecurityContext:
runAsNonRoot: true
# -- Additional volumes to add to the dashboard pod
volumes: []
# -- Security Context to set on container level
containerSecurityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
# -- Additional volumeMounts to add to the dashboard container
volumeMounts: []
# -- Annotations to be added to the Rollout service
serviceAnnotations: {}
notifications:
secret:
# -- Whether to create notifications secret
create: false
# -- Generic key:value pairs to be inserted into the notifications secret
items: {}
# slack-token:
# -- Labels to be added to the Rollout pods
podLabels: {}
# -- Configures notification services
notifiers: {}
# service.slack: |
# token: $slack-token
# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
imagePullSecrets: []
# - name: argo-pull-secret
# -- Notification templates
templates: {}
providerRBAC:
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
enabled: true
# providerRBAC.enabled must be true in order to toggle the individual providers
providers:
# -- Adds RBAC rules for the Istio provider
istio: true
# -- Adds RBAC rules for the SMI provider
smi: true
# -- Adds RBAC rules for the Ambassador provider
ambassador: true
# -- Adds RBAC rules for the AWS Load Balancer Controller provider
awsLoadBalancerController: true
# -- Adds RBAC rules for the AWS App Mesh provider
awsAppMesh: true
# -- Adds RBAC rules for the Traefik provider
traefik: true
# -- Adds RBAC rules for the Apisix provider
apisix: true
# -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
contour: true
# -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
glooPlatform: true
# -- Additional RBAC rules for others providers
additionalRules: []
# -- The trigger defines the condition when the notification should be sent
triggers: {}
# trigger.on-purple: |
# - send: [my-purple-template]
# when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'
dashboard:
# -- Deploy dashboard server
enabled: true
# -- Set cluster role to readonly
readonly: false
# -- Value of label `app.kubernetes.io/component`
component: rollouts-dashboard
# -- Annotations to be added to the dashboard deployment
deploymentAnnotations: {}
# -- Annotations to be added to application dashboard pods
podAnnotations: {}
# -- [Node selector]
nodeSelector: {}
# -- [Tolerations] for use with node taints
tolerations: []
# -- Assign custom [affinity] rules to the deployment
affinity: {}
logging:
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
level: info
# -- Set the klog logging level
kloglevel: "0"
# -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
topologySpreadConstraints: []
# - maxSkew: 1
# topologyKey: topology.kubernetes.io/zone
# whenUnsatisfiable: DoNotSchedule
# -- [priorityClassName] for the dashboard server
priorityClassName: ""
# -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
createClusterRole: true
# -- The number of dashboard pods to run
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
replicas: 3
{{- else }}
replicas: 1
{{- end }}
image:
# -- Registry to use
registry: quay.io
# -- Repository to use
repository: argoproj/kubectl-argo-rollouts
# -- Overrides the image tag (default is the chart appVersion)
tag: ""
# -- Image pull policy
pullPolicy: IfNotPresent
# -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
extraArgs: []
# -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
extraEnv: []
# - name: FOO
# value: bar
# -- Resource limits and requests for the dashboard pods.
resources: {}
# -- Security Context to set on pod level
podSecurityContext:
runAsNonRoot: true
# -- Security Context to set on container level
containerSecurityContext: {}
service:
# -- Sets the type of the Service
{{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
type: NodePort
nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
{{- else }}
type: ClusterIP
nodePort:
{{- end }}
# -- LoadBalancer will get created with the IP specified in this field
loadBalancerIP: ""
# -- Source IP ranges to allow access to service from
loadBalancerSourceRanges: []
# -- Dashboard service external IPs
externalIPs: []
# -- Service annotations
annotations: {}
# -- Service labels
labels: {}
# -- Service port name
portName: dashboard
# -- Service port
port: 3100
# -- Service target port
targetPort: 3100
# -- (int) Service nodePort
serviceAccount:
# -- Specifies whether a dashboard service account should be created
create: true
# -- Annotations to add to the dashboard service account
annotations: {}
# -- The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
## Configure Pod Disruption Budget for the dashboard
pdb:
# -- Labels to be added to dashboard [Pod Disruption Budget]
labels: {}
# -- Annotations to be added to dashboard [Pod Disruption Budget]
annotations: {}
# -- Deploy a [Pod Disruption Budget] for the dashboard
enabled: false
# -- Minimum number / percentage of pods that should remain scheduled
minAvailable: # 1
# -- Maximum number / percentage of pods that may be made unavailable
maxUnavailable: # 0
## Ingress configuration.
## ref: https://kubernetes.io/docs/user-guide/ingress/
##
ingress:
# -- Enable dashboard ingress support
enabled: false
# -- Dashboard ingress annotations
annotations: {}
# -- Dashboard ingress labels
labels: {}
# -- Dashboard ingress class name
ingressClassName: ""
# -- Dashboard ingress hosts
## Argo Rollouts Dashboard Ingress.
## Hostnames must be provided if Ingress is enabled.
## Secrets must be manually created in the namespace
hosts: []
# - argorollouts.example.com
# -- Dashboard ingress paths
paths:
- /
# -- Dashboard ingress path type
pathType: Prefix
# -- Dashboard ingress extra paths
extraPaths: []
# - path: /*
# backend:
# serviceName: ssl-redirect
# servicePort: use-annotation
## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
# - path: /*
# pathType: Prefix
# backend:
# service
# name: ssl-redirect
# port:
# name: use-annotation
# -- Dashboard ingress tls
tls: []
# - secretName: argorollouts-example-tls
# hosts:
# - argorollouts.example.com
# -- Additional volumes to add to the dashboard pod
volumes: []
# -- Additional volumeMounts to add to the dashboard container
volumeMounts: []
notifications:
secret:
# -- Whether to create notifications secret
create: false
# -- Generic key:value pairs to be inserted into the notifications secret
items: {}
# slack-token:
# -- Configures notification services
notifiers: {}
# service.slack: |
# token: $slack-token
# -- Notification templates
templates: {}
# -- The trigger defines the condition when the notification should be sent
triggers: {}
# trigger.on-purple: |
# - send: [my-purple-template]
# when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'

430
internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl
View File

@@ -1,255 +1,245 @@
- name: keel
namespace: kube-system
chart_ref: {{ .Modules.Cicd.UpdatesOperator.ChartRef }}
chart_version: {{ .Modules.Cicd.UpdatesOperator.ChartVersion }}
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.UpdatesOperator.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
image:
repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
pullPolicy: Always
image:
repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
pullPolicy: Always
# Enable insecure registries
insecureRegistry: false
# Enable insecure registries
insecureRegistry: false
# Polling is enabled by default,
# you can disable it setting value below to false
polling:
enabled: true
defaultSchedule: "@every 1m"
# Polling is enabled by default,
# you can disable it setting value below to false
polling:
enabled: true
defaultSchedule: "@every 1m"
# Extra Containers to run alongside Keel
# extraContainers:
# - name: busybox
# image: busybox
# imagePullPolicy: IfNotPresent
# command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
# Extra Containers to run alongside Keel
# extraContainers:
# - name: busybox
# image: busybox
# imagePullPolicy: IfNotPresent
# command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
# Helm provider support
helmProvider:
enabled: true
# set to version "v3" for Helm v3
version: "v2"
tillerNamespace: "kube-system"
# optional Tiller address (if portforwarder tunnel doesn't work),
# if you are using default configuration, setting it to
# 'tiller-deploy:44134' is usually fine
tillerAddress: 'tiller-deploy:44134'
# helmDriver: ''
# helmDriverSqlConnectionString: ''
# Helm provider support
helmProvider:
enabled: true
# set to version "v3" for Helm v3
version: "v2"
tillerNamespace: "kube-system"
# optional Tiller address (if portforwarder tunnel doesn't work),
# if you are using default configuration, setting it to
# 'tiller-deploy:44134' is usually fine
tillerAddress: 'tiller-deploy:44134'
# helmDriver: ''
# helmDriverSqlConnectionString: ''
# Google Container Registry
# GCP Project ID
gcr:
enabled: false
projectId: ""
gcpServiceAccount: ""
clusterName: ""
pubSub:
enabled: false
# Google Container Registry
# GCP Project ID
gcr:
enabled: false
projectId: ""
gcpServiceAccount: ""
clusterName: ""
pubSub:
enabled: false
# Notification level (debug, info, success, warn, error, fatal)
notificationLevel: info
# Notification level (debug, info, success, warn, error, fatal)
notificationLevel: info
# AWS Elastic Container Registry
# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
ecr:
enabled: false
roleArn: ""
accessKeyId: ""
secretAccessKey: ""
region: ""
# AWS Elastic Container Registry
# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
ecr:
enabled: false
roleArn: ""
accessKeyId: ""
secretAccessKey: ""
region: ""
# Webhook Notification
# Remote webhook endpoint for notification delivery
webhook:
enabled: false
endpoint: ""
# Webhook Notification
# Remote webhook endpoint for notification delivery
webhook:
enabled: false
endpoint: ""
# Slack Notification
# bot name (default keel) must exist!
slack:
enabled: false
botName: ""
token: ""
channel: ""
approvalsChannel: ""
# Slack Notification
# bot name (default keel) must exist!
slack:
enabled: false
botName: ""
token: ""
channel: ""
approvalsChannel: ""
# Hipchat notification and approvals
hipchat:
enabled: false
token: ""
channel: ""
approvalsChannel: ""
botName: ""
userName: ""
password: ""
# Hipchat notification and approvals
hipchat:
enabled: false
token: ""
channel: ""
approvalsChannel: ""
botName: ""
userName: ""
password: ""
# Mattermost notifications
mattermost:
enabled: false
endpoint: ""
# Mattermost notifications
mattermost:
enabled: false
endpoint: ""
# MS Teams notifications
teams:
enabled: false
webhookUrl: ""
# MS Teams notifications
teams:
enabled: false
webhookUrl: ""
# Discord notifications
discord:
enabled: false
webhookUrl: ""
# Discord notifications
discord:
enabled: false
webhookUrl: ""
# Mail notifications
mail:
enabled: false
from: ""
to: ""
smtp:
server: ""
port: 25
user: ""
pass: ""
# Mail notifications
mail:
enabled: false
from: ""
to: ""
smtp:
server: ""
port: 25
user: ""
pass: ""
# Basic auth on approvals
basicauth:
enabled: true
user: "admin"
password: "{{ .Modules.AdminPassword }}"
# Basic auth on approvals
basicauth:
enabled: true
user: "admin"
password: "{{ .Modules.AdminPassword }}"
# Keel service
# Enable to receive webhooks from Docker registries
service:
enabled: false
type: LoadBalancer
externalPort: 9300
clusterIP: ""
# Keel service
# Enable to receive webhooks from Docker registries
service:
enabled: false
type: LoadBalancer
externalPort: 9300
clusterIP: ""
# Webhook Relay service
# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
# which can deliver webhooks to your internal Keel service through Keel sidecar container.
webhookRelay:
enabled: false
bucket: ""
# webhookrelay.com credentials
# Set the key and secret values here to create the keel-webhookrelay secret with this
# chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
key: ""
secret: ""
# webhookrelay docker image
image:
repository: webhookrelay/webhookrelayd
tag: latest
pullPolicy: IfNotPresent
# Webhook Relay service
# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
# which can deliver webhooks to your internal Keel service through Keel sidecar container.
webhookRelay:
enabled: false
bucket: ""
# webhookrelay.com credentials
# Set the key and secret values here to create the keel-webhookrelay secret with this
# chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
key: ""
secret: ""
# webhookrelay docker image
image:
repository: webhookrelay/webhookrelayd
tag: latest
pullPolicy: IfNotPresent
# Use a secret file to define passwords and tokens of third parties.
secret:
# Leave blank to use `keel.fullname`
name: ""
# Set to false to manage your own secret file, with terraform for example.
create: true
# Use a secret file to define passwords and tokens of third parties.
secret:
# Leave blank to use `keel.fullname`
name: ""
# Set to false to manage your own secret file, with terraform for example.
create: true
# Keel self-update
# uncomment lines below if you want Keel to automaticly
# self-update to the latest release version
# keel:
# # keel policy (all/major/minor/patch/force)
# policy: patch
# # trigger type, defaults to events such as pubsub, webhooks
# trigger: poll
# # polling schedule
# pollSchedule: "@every 3m"
# # images to track and update
# images:
# - repository: image.repository
# tag: image.tag
# Keel self-update
# uncomment lines below if you want Keel to automaticly
# self-update to the latest release version
# keel:
# # keel policy (all/major/minor/patch/force)
# policy: patch
# # trigger type, defaults to events such as pubsub, webhooks
# trigger: poll
# # polling schedule
# pollSchedule: "@every 3m"
# # images to track and update
# images:
# - repository: image.repository
# tag: image.tag
# RBAC manifests management
rbac:
enabled: true
serviceAccount:
# Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
# name:
# Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
# If rbac.serviceAccount.name is not set, a new name for the service account is generated
create: true
# RBAC manifests management
rbac:
enabled: true
serviceAccount:
# Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
# name:
# Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
# If rbac.serviceAccount.name is not set, a new name for the service account is generated
create: true
# Resources
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 50m
memory: 64Mi
# Resources
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 50m
memory: 64Mi
# NodeSelector
nodeSelector: {}
# NodeSelector
nodeSelector: {}
affinity: {}
affinity: {}
tolerations: {}
tolerations: {}
# base64 encoded json of GCP service account
# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
googleApplicationCredentials: ""
# base64 encoded json of GCP service account
# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
googleApplicationCredentials: ""
# Enable DEBUG logging
debug: false
# Enable DEBUG logging
debug: false
# This is used by the static manifest generator in order to create a static
# namespace manifest for the namespace that keel is being installed
# within. It should **not** be used if you are using Helm for deployment.
createNamespaceResource: false
# This is used by the static manifest generator in order to create a static
# namespace manifest for the namespace that keel is being installed
# within. It should **not** be used if you are using Helm for deployment.
createNamespaceResource: false
podAnnotations: {}
podAnnotations: {}
serviceAnnotations: {}
# Useful for making the load balancer internal
# serviceAnnotations:
# cloud.google.com/load-balancer-type: Internal
serviceAnnotations: {}
# Useful for making the load balancer internal
# serviceAnnotations:
# cloud.google.com/load-balancer-type: Internal
aws:
region: null
aws:
region: null
podDisruptionBudget:
enabled: false
maxUnavailable: 1
minAvailable: null
podDisruptionBudget:
enabled: false
maxUnavailable: 1
minAvailable: null
# Google Cloud Certificates
gcloud:
managedCertificates:
enabled: false
domains:
- ""
# Google Cloud Certificates
gcloud:
managedCertificates:
enabled: false
domains:
- ""
ingress:
enabled: false
labels: {}
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
hosts: []
# - host: chart-example.local
# paths:
# - /
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
ingress:
enabled: false
labels: {}
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
hosts: []
# - host: chart-example.local
# paths:
# - /
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
dockerRegistry:
enabled: false
name: ""
key: ""
dockerRegistry:
enabled: false
name: ""
key: ""
persistence:
enabled: false
storageClass: "-"
size: 1Gi
persistence:
enabled: false
storageClass: "-"
size: 1Gi

109
internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl
View File

@@ -1,66 +1,55 @@
- name: fluent-operator
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Logging.Operator.ChartRef }}
chart_version: {{ .Modules.Observability.Logging.Operator.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
# Set this to containerd or crio if you want to collect CRI format logs
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
Kubernetes: false
# Set this to containerd or crio if you want to collect CRI format logs
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
Kubernetes: false
operator:
initcontainer:
repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
operator:
initcontainer:
repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
resources:
limits:
cpu: 100m
memory: 100Mi
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 50m
memory: 64Mi
container:
repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 100m
memory: 60Mi
imagePullSecrets: []
labels: {}
logPath:
# The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
# crio: /var/log
containerd: /var/log
disableComponentControllers: ""
requests:
cpu: 50m
memory: 64Mi
container:
repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
resources:
limits:
cpu: 100m
memory: 100Mi
requests:
cpu: 100m
memory: 60Mi
imagePullSecrets: []
labels: {}
logPath:
# The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
# crio: /var/log
containerd: /var/log
disableComponentControllers: ""
fluentbit:
crdsEnable: true
enable: false
fluentbit:
crdsEnable: true
enable: false
fluentd:
crdsEnable: true
enable: false
name: fluentd
# Valid modes include "collector" and "agent".
# The "collector" mode will deploy Fluentd as a StatefulSet as before.
# The new "agent" mode will deploy Fluentd as a DaemonSet.
mode: "agent"
port: 24224
image:
repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
fluentd:
crdsEnable: true
enable: false
name: fluentd
# Valid modes include "collector" and "agent".
# The "collector" mode will deploy Fluentd as a StatefulSet as before.
# The new "agent" mode will deploy Fluentd as a DaemonSet.
mode: "agent"
port: 24224
image:
repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
nameOverride: ""
fullnameOverride: ""
namespaceOverride: ""
nameOverride: ""
fullnameOverride: ""
namespaceOverride: ""

344
internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl
View File

@@ -1,200 +1,188 @@
- name: loki
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Logging.Loki.ChartRef }}
chart_version: {{ .Modules.Observability.Logging.Loki.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
loki:
image:
registry: {{ .Modules.Observability.Logging.Loki.Registry }}
repository: {{ .Modules.Observability.Logging.Loki.Image }}
tag: {{ .Modules.Observability.Logging.Loki.Tag }}
podAnnotations:
app.kubernetes.io/component: "loki"
auth_enabled: false
commonConfig:
replication_factor: 1
storage:
type: 'filesystem'
loki:
image:
registry: {{ .Modules.Observability.Logging.Loki.Registry }}
repository: {{ .Modules.Observability.Logging.Loki.Image }}
tag: {{ .Modules.Observability.Logging.Loki.Tag }}
podAnnotations:
app.kubernetes.io/component: "loki"
auth_enabled: false
commonConfig:
replication_factor: 1
storage:
type: 'filesystem'
frontend:
max_outstanding_per_tenant: 10000
frontend:
max_outstanding_per_tenant: 10000
limits_config:
reject_old_samples: false
split_queries_by_interval: 15m
max_query_parallelism: 32
max_query_series: 10000
retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
limits_config:
reject_old_samples: false
split_queries_by_interval: 15m
max_query_parallelism: 32
max_query_series: 10000
retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
compactor:
compaction_interval: 10m
retention_enabled: true
retention_delete_delay: 2h
compactor:
compaction_interval: 10m
retention_enabled: true
retention_delete_delay: 2h
querier:
max_concurrent: 2048
querier:
max_concurrent: 2048
query_scheduler:
max_outstanding_requests_per_tenant: 10000
query_scheduler:
max_outstanding_requests_per_tenant: 10000
rulerConfig:
storage:
type: local
local:
directory: /var/loki/rules
rule_path: /tmp/rules
rulerConfig:
storage:
type: local
local:
directory: /var/loki/rules
rule_path: /tmp/rules
alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
singleBinary:
replicas: 1
singleBinary:
replicas: 1
extraVolumes:
- name: loki-default-rules
configMap:
name: loki-default-alerting-rules
extraVolumes:
- name: loki-default-rules
configMap:
name: loki-default-alerting-rules
extraVolumeMounts:
- name: loki-default-rules
mountPath: /var/loki/rules
extraVolumeMounts:
- name: loki-default-rules
mountPath: /var/loki/rules
write:
persistence:
volumeClaimsEnabled: true
storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
write:
persistence:
volumeClaimsEnabled: true
storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
test:
enabled: false
test:
enabled: false
gateway:
enabled: false
gateway:
enabled: false
monitoring:
selfMonitoring:
enabled: false
grafanaAgent:
installOperator: false
lokiCanary:
enabled: false
rules:
enabled: true
alerting: true
additionalGroups: {}
monitoring:
selfMonitoring:
enabled: false
grafanaAgent:
installOperator: false
lokiCanary:
enabled: false
rules:
enabled: true
alerting: true
extraObjects:
- apiVersion: v1
kind: ConfigMap
metadata:
name: loki-default-alerting-rules
labels:
loki_rule: ""
extraObjects:
- apiVersion: v1
kind: ConfigMap
metadata:
name: loki-default-alerting-rules
labels:
loki_rule: ""
data:
loki-default-alerting-rules.yaml: |-
groups:
{{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
- name: kube-events-alerts
rules:
- alert: FailedEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: FailedEventsOccured
instance: kube-cluster
jobName: kube_events
summary: Failed events occured in cluster
addDefaultUrl: "true"
data:
loki-default-alerting-rules.yaml: |-
groups:
{{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
- name: kube-events-alerts
rules:
- alert: FailedEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: FailedEventsOccured
instance: kube-cluster
jobName: kube_events
summary: Failed events occured in cluster
addDefaultUrl: "true"
- alert: OOMKilledEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: OOMKilledEventsOccured
instance: kube-cluster
jobName: kube_events
summary: OOMKilled events occured in cluster
addDefaultUrl: "true"
- alert: OOMKilledEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: OOMKilledEventsOccured
instance: kube-cluster
jobName: kube_events
summary: OOMKilled events occured in cluster
addDefaultUrl: "true"
- alert: EvictedEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: EvictedEventsOccured
instance: kube-cluster
jobName: kube_events
summary: Evicted events occured in cluster
addDefaultUrl: "true"
- alert: EvictedEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: EvictedEventsOccured
instance: kube-cluster
jobName: kube_events
summary: Evicted events occured in cluster
addDefaultUrl: "true"
- alert: ImagePullBackOffEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: ImagePullBackOffEventsOccured
instance: kube-cluster
jobName: kube_events
summary: ImagePullBackOff events occured in cluster
addDefaultUrl: "true"
- alert: ImagePullBackOffEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: ImagePullBackOffEventsOccured
instance: kube-cluster
jobName: kube_events
summary: ImagePullBackOff events occured in cluster
addDefaultUrl: "true"
- alert: BackOffEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: BackOffEventsOccured
instance: kube-cluster
jobName: kube_events
summary: BackOff events occured in cluster
addDefaultUrl: "true"
sidecar:
rules:
enabled: true
# -- Label that the configmaps/secrets with rules will be marked with.
label: loki_rule
# -- Label value that the configmaps/secrets with rules will be set to.
labelValue: ""
# -- Folder into which the rules will be placed.
folder: /var/loki/rules
# -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
# Otherwise the namespace in which the sidecar is running will be used.
# It's also possible to specify 'ALL' to search in all namespaces.
searchNamespace: 'ALL'
# -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
watchMethod: WATCH
# -- Search in configmap, secret, or both.
resource: both
# -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
script: null
# -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
watchServerTimeout: 60
#
# -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
# If you have a network outage dropping all packets with no RST/FIN,
# this is how long your client waits before realizing & dropping the connection.
# Defaults to 66sec.
watchClientTimeout: 60
# -- Log level of the sidecar container.
logLevel: INFO
- alert: BackOffEventsOccured
expr: |
count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
for: 1m
labels:
severity: critical
annotations:
alertname: BackOffEventsOccured
instance: kube-cluster
jobName: kube_events
summary: BackOff events occured in cluster
addDefaultUrl: "true"
sidecar:
rules:
enabled: true
# -- Label that the configmaps/secrets with rules will be marked with.
label: loki_rule
# -- Label value that the configmaps/secrets with rules will be set to.
labelValue: ""
# -- Folder into which the rules will be placed.
folder: /var/loki/rules
# -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
# Otherwise the namespace in which the sidecar is running will be used.
# It's also possible to specify 'ALL' to search in all namespaces.
searchNamespace: 'ALL'
# -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
watchMethod: WATCH
# -- Search in configmap, secret, or both.
resource: both
# -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
script: null
# -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
# defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
watchServerTimeout: 60
#
# -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
# If you have a network outage dropping all packets with no RST/FIN,
# this is how long your client waits before realizing & dropping the connection.
# Defaults to 66sec.
watchClientTimeout: 60
# -- Log level of the sidecar container.
logLevel: INFO

325
internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl
View File

@@ -1,203 +1,192 @@
- name: metrics-server
namespace: kube-system
create_namespace: true
chart_ref: {{ .Modules.Observability.Monitoring.MetricsServer.ChartRef }}
chart_version: {{ .Modules.Observability.Monitoring.MetricsServer.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
image:
repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
pullPolicy: IfNotPresent
image:
repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
pullPolicy: IfNotPresent
imagePullSecrets: []
# - name: registrySecretName
imagePullSecrets: []
# - name: registrySecretName
nameOverride: ""
fullnameOverride: ""
nameOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
create: true
# Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
# The list of secrets mountable by this service account.
# See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
secrets: []
serviceAccount:
# Specifies whether a service account should be created
create: true
# Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
# The list of secrets mountable by this service account.
# See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
secrets: []
rbac:
# Specifies whether RBAC resources should be created
create: true
pspEnabled: false
rbac:
# Specifies whether RBAC resources should be created
create: true
pspEnabled: false
apiService:
create: true
# Annotations to add to the API service
annotations: {}
# Specifies whether to skip TLS verification
insecureSkipTLSVerify: true
# The PEM encoded CA bundle for TLS verification
caBundle: ""
apiService:
create: true
# Annotations to add to the API service
annotations: {}
# Specifies whether to skip TLS verification
insecureSkipTLSVerify: true
# The PEM encoded CA bundle for TLS verification
caBundle: ""
commonLabels: {}
podLabels:
"app.kubernetes.io/component": "metrics-server"
podAnnotations: {}
commonLabels: {}
podLabels:
"app.kubernetes.io/component": "metrics-server"
podAnnotations: {}
podSecurityContext: {}
podSecurityContext: {}
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
priorityClassName: system-cluster-critical
priorityClassName: system-cluster-critical
containerPort: 10250
containerPort: 10250
hostNetwork:
# Specifies if metrics-server should be started in hostNetwork mode.
#
# You would require this enabled if you use alternate overlay networking for pods and
# API server unable to communicate with metrics-server. As an example, this is required
# if you use Weave network on EKS
enabled: false
hostNetwork:
# Specifies if metrics-server should be started in hostNetwork mode.
#
# You would require this enabled if you use alternate overlay networking for pods and
# API server unable to communicate with metrics-server. As an example, this is required
# if you use Weave network on EKS
enabled: false
replicas: 1
replicas: 1
revisionHistoryLimit:
revisionHistoryLimit:
updateStrategy: {}
# type: RollingUpdate
# rollingUpdate:
# maxSurge: 0
# maxUnavailable: 1
updateStrategy: {}
# type: RollingUpdate
# rollingUpdate:
# maxSurge: 0
# maxUnavailable: 1
podDisruptionBudget:
# https://kubernetes.io/docs/tasks/run-application/configure-pdb/
enabled: false
minAvailable:
maxUnavailable:
podDisruptionBudget:
# https://kubernetes.io/docs/tasks/run-application/configure-pdb/
enabled: false
minAvailable:
maxUnavailable:
defaultArgs:
- --cert-dir=/tmp
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=15s
- --kubelet-insecure-tls
defaultArgs:
- --cert-dir=/tmp
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=15s
- --kubelet-insecure-tls
args: []
args: []
livenessProbe:
httpGet:
path: /livez
port: https
scheme: HTTPS
initialDelaySeconds: 0
periodSeconds: 10
failureThreshold: 3
livenessProbe:
httpGet:
path: /livez
port: https
scheme: HTTPS
initialDelaySeconds: 0
periodSeconds: 10
failureThreshold: 3
readinessProbe:
httpGet:
path: /readyz
port: https
scheme: HTTPS
initialDelaySeconds: 20
periodSeconds: 10
failureThreshold: 3
readinessProbe:
httpGet:
path: /readyz
port: https
scheme: HTTPS
initialDelaySeconds: 20
periodSeconds: 10
failureThreshold: 3
service:
type: ClusterIP
port: 443
annotations: {}
labels: {}
# Add these labels to have metrics-server show up in `kubectl cluster-info`
# kubernetes.io/cluster-service: "true"
# kubernetes.io/name: "Metrics-server"
service:
type: ClusterIP
port: 443
annotations: {}
labels: {}
# Add these labels to have metrics-server show up in `kubectl cluster-info`
# kubernetes.io/cluster-service: "true"
# kubernetes.io/name: "Metrics-server"
addonResizer:
enabled: false
image:
repository: registry.k8s.io/autoscaling/addon-resizer
tag: 1.8.20
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
resources:
requests:
cpu: 40m
memory: 25Mi
limits:
cpu: 40m
memory: 25Mi
nanny:
cpu: 0m
extraCpu: 1m
memory: 0Mi
extraMemory: 2Mi
minClusterSize: 100
pollPeriod: 300000
threshold: 5
addonResizer:
enabled: false
image:
repository: registry.k8s.io/autoscaling/addon-resizer
tag: 1.8.20
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
resources:
requests:
cpu: 40m
memory: 25Mi
limits:
cpu: 40m
memory: 25Mi
nanny:
cpu: 0m
extraCpu: 1m
memory: 0Mi
extraMemory: 2Mi
minClusterSize: 100
pollPeriod: 300000
threshold: 5
metrics:
enabled: true
metrics:
enabled: true
serviceMonitor:
enabled: true
additionalLabels: {}
interval: 1m
scrapeTimeout: 10s
metricRelabelings: []
relabelings: []
serviceMonitor:
enabled: true
additionalLabels: {}
interval: 1m
scrapeTimeout: 10s
metricRelabelings: []
relabelings: []
# See https://github.com/kubernetes-sigs/metrics-server#scaling
resources:
requests:
cpu: 100m
memory: 200Mi
# limits:
# cpu:
# memory:
# See https://github.com/kubernetes-sigs/metrics-server#scaling
resources:
requests:
cpu: 100m
memory: 200Mi
# limits:
# cpu:
# memory:
extraVolumeMounts: []
extraVolumeMounts: []
extraVolumes: []
extraVolumes: []
nodeSelector: {}
nodeSelector: {}
tolerations: []
tolerations: []
affinity: {}
affinity: {}
topologySpreadConstraints: []
topologySpreadConstraints: []
dnsConfig: {}
dnsConfig: {}
# Annotations to add to the deployment
deploymentAnnotations: {}
# Annotations to add to the deployment
deploymentAnnotations: {}
schedulerName: ""
schedulerName: ""
tmpVolume:
emptyDir: {}
tmpVolume:
emptyDir: {}

735
internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl
View File

@@ -1,402 +1,391 @@
- name: observability
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.ChartRef }}
chart_version: {{ .Modules.Observability.ChartVersion }}
{{- if .Modules.Observability.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
prometheus:
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
serviceMonitor: true
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
pullPolicy: IfNotPresent
clustering:
enabled: false
replicas: 3
shards: 1
persistence:
enabled: true
storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
storageResources:
requests:
storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
# serviceNodePort: 30008
additionalConfigs: |
- job_name: "kubelet"
scheme: https
metrics_path: /metrics/cadvisor
tls_config:
insecure_skip_verify: true
authorization:
credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
kubernetes_sd_configs:
- role: node
relabel_configs:
- action: labelmap
regex: __meta_kubernetes_node_label_(.+)
- job_name: "kubernetes-apiservers"
kubernetes_sd_configs:
- role: endpoints
scheme: https
tls_config:
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
authorization:
credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
relabel_configs:
- source_labels:
[
__meta_kubernetes_namespace,
__meta_kubernetes_service_name,
__meta_kubernetes_endpoint_port_name,
]
action: keep
regex: default;kubernetes;https
- job_name: "coredns"
kubernetes_sd_configs:
- role: endpoints
scheme: http
relabel_configs:
- source_labels:
[
__meta_kubernetes_namespace,
__meta_kubernetes_service_name,
__meta_kubernetes_endpoint_port_name,
]
action: keep
regex: kube-system;.*dns.*;metrics
{{- if .Modules.Observability.Monitoring.Blackbox.Enabled }}
- job_name: 'ingress-endpoints'
metrics_path: /probe
params:
module: [https_ok]
kubernetes_sd_configs:
- role: ingress
relabel_configs:
- source_labels: [__address__]
target_label: __param_target
- source_labels: [__param_target]
target_label: instance
- source_labels:
[
__meta_kubernetes_ingress_scheme,
__address__,
__meta_kubernetes_ingress_path,
]
regex: (.+);(.+);(.+)
replacement: https://${2}${3}/
target_label: __param_target
- target_label: __address__
replacement: observability-blackbox-exporter:9115
{{- end }}
alertManager:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
enableDefaultRules: true
image:
repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
pullPolicy: IfNotPresent
# serviceNodePort: 30009
configPath: /etc/alertmanager
{{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }}
additionalMessageTemplates:
{{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }}
{{- end }}
{{- if .Modules.Observability.Monitoring.AlertManager.Route }}
route:
{{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
{{- end }}
{{- if .Modules.Observability.Monitoring.AlertManager.Receivers }}
receivers:
{{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
{{- end }}
values:
prometheus:
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
serviceMonitor: true
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
pullPolicy: IfNotPresent
clustering:
enabled: false
replicas: 3
shards: 1
blackboxExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
pullPolicy: IfNotPresent
persistence:
enabled: true
# serviceNodePort: 30012
storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
storageResources:
requests:
storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
configPath: /etc/blackbox_exporter
additionalModules:
scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
# serviceNodePort: 30008
additionalConfigs: |
- job_name: "kubelet"
scheme: https
metrics_path: /metrics/cadvisor
tls_config:
insecure_skip_verify: true
authorization:
credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
kubernetes_sd_configs:
- role: node
relabel_configs:
- action: labelmap
regex: __meta_kubernetes_node_label_(.+)
kubeStateMetrics:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
pullPolicy: IfNotPresent
resources:
requests:
cpu: 30m
memory: 120Mi
limits:
memory: 240Mi
cpu: 60m
- job_name: "kubernetes-apiservers"
kubernetes_sd_configs:
- role: endpoints
scheme: https
tls_config:
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
authorization:
credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
relabel_configs:
- source_labels:
[
__meta_kubernetes_namespace,
__meta_kubernetes_service_name,
__meta_kubernetes_endpoint_port_name,
]
action: keep
regex: default;kubernetes;https
prometheusOperator:
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
pullPolicy: IfNotPresent
- job_name: "coredns"
kubernetes_sd_configs:
- role: endpoints
scheme: http
relabel_configs:
- source_labels:
[
__meta_kubernetes_namespace,
__meta_kubernetes_service_name,
__meta_kubernetes_endpoint_port_name,
]
action: keep
regex: kube-system;.*dns.*;metrics
prometheusConfigReloader:
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
pullPolicy: IfNotPresent
{{- if .Modules.Observability.Monitoring.Blackbox.Enabled }}
- job_name: 'ingress-endpoints'
metrics_path: /probe
params:
module: [https_ok]
kubernetes_sd_configs:
- role: ingress
relabel_configs:
- source_labels: [__address__]
target_label: __param_target
- source_labels: [__param_target]
target_label: instance
- source_labels:
[
__meta_kubernetes_ingress_scheme,
__address__,
__meta_kubernetes_ingress_path,
]
regex: (.+);(.+);(.+)
replacement: https://${2}${3}/
target_label: __param_target
- target_label: __address__
replacement: observability-blackbox-exporter:9115
{{- end }}
kubeRbacProxy:
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
pullPolicy: IfNotPresent
alertManager:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
enableDefaultRules: true
image:
repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
pullPolicy: IfNotPresent
nodeExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Node.Image }}
tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
pullPolicy: IfNotPresent
# serviceNodePort: 30009
kubeEventsExporter:
enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
image:
repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
pullPolicy: IfNotPresent
lokiAddress: http://loki.observability.svc.cluster.local:3100
logLevel: warn
logFormat: json
kubeQPS: 100
kubeBurst: 500
maxEventAgeSeconds: 120
metricsNamePrefix: event_exporter_
configPath: /etc/alertmanager
{{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }}
additionalMessageTemplates:
{{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }}
{{- end }}
{{- if .Modules.Observability.Monitoring.AlertManager.Route }}
route:
{{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
{{- end }}
{{- if .Modules.Observability.Monitoring.AlertManager.Receivers }}
receivers:
{{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
cron:
restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
image:
repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
pullPolicy: IfNotPresent
additionalRoutes:
additionalReceivers:
grafana:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
{{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
{{- end }}
image:
repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
pullPolicy: IfNotPresent
storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
storageResources:
requests:
storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
config:
server: |
enable_gzip = true
root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
{{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path "/") }}
serve_from_sub_path = true
{{- end }}
blackboxExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
pullPolicy: IfNotPresent
security: |
admin_user = admin
admin_password = {{ .Modules.AdminPassword }}
# serviceNodePort: 30012
auth: |
{{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
configPath: /etc/blackbox_exporter
additionalModules:
authGenericAuth: |
{{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
kubeStateMetrics:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
pullPolicy: IfNotPresent
resources:
requests:
cpu: 30m
memory: 120Mi
limits:
memory: 240Mi
cpu: 60m
prometheusOperator:
enabled: {{ .Modules.Observability.Monitoring.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
pullPolicy: IfNotPresent
prometheusConfigReloader:
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
pullPolicy: IfNotPresent
kubeRbacProxy:
image:
repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
pullPolicy: IfNotPresent
nodeExporter:
enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }}
image:
repository: {{ .Modules.Observability.Monitoring.Node.Image }}
tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
pullPolicy: IfNotPresent
kubeEventsExporter:
enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
image:
repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
pullPolicy: IfNotPresent
lokiAddress: http://loki.observability.svc.cluster.local:3100
logLevel: warn
logFormat: json
kubeQPS: 100
kubeBurst: 500
maxEventAgeSeconds: 120
metricsNamePrefix: event_exporter_
cron:
restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
image:
repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
pullPolicy: IfNotPresent
additionalRoutes:
additionalReceivers:
grafana:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
{{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
additionalDatasources:
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
- name: Kube-loki
type: loki
uid: P2895588539814C92
access: proxy
url: http://loki:3100
editable: false
basicAuth: false
isDefault: false
jsonData:
maxLines: 1000
{{- end }}
image:
repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
pullPolicy: IfNotPresent
storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
storageResources:
requests:
storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
config:
server: |
enable_gzip = true
root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
{{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path "/") }}
serve_from_sub_path = true
{{- end }}
security: |
admin_user = admin
admin_password = {{ .Modules.AdminPassword }}
auth: |
{{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
authGenericAuth: |
{{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
additionalDatasources:
{{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
- name: Kube-loki
type: loki
uid: P2895588539814C92
access: proxy
url: http://loki:3100
editable: false
basicAuth: false
isDefault: false
jsonData:
maxLines: 1000
{{- end }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
- name: Kube-jaeger-query
type: jaeger
access: proxy
url: http://tempo:16686
editable: false
basicAuth: false
isDefault: false
{{- end }}
{{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
{{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
{{- end }}
opentelemetryCollector:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
serviceMonitor: true
config: |
receivers:
otlp:
protocols:
grpc:
http:
exporters:
otlphttp:
endpoint: http://tempo:4318
service:
telemetry:
logs:
level: "debug"
pipelines:
traces:
receivers: [otlp]
exporters: [otlphttp]
ingress:
{{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }}
enabled: true
{{- else }}
enabled: false
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
- name: Kube-jaeger-query
type: jaeger
access: proxy
url: http://tempo:16686
editable: false
basicAuth: false
isDefault: false
{{- end }}
{{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
{{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
{{- end }}
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
class: {{ .Modules.Additional.Ingress.Type }}
annotations:
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
{{- end }}
tls:
{{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
enabled: true
{{- end }}
hosts:
- host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
secretName: grafana-tls
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
opentelemetryCollector:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
serviceMonitor: true
config: |
receivers:
otlp:
protocols:
grpc:
http:
exporters:
otlphttp:
endpoint: http://tempo:4318
service:
telemetry:
logs:
level: "debug"
pipelines:
traces:
receivers: [otlp]
exporters: [otlphttp]
fluentbit:
enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
serviceMonitor: true
image:
repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
ingress:
{{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }}
enabled: true
{{- else }}
enabled: false
{{- end }}
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
class: {{ .Modules.Additional.Ingress.Type }}
annotations:
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
{{- end }}
tls:
{{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
enabled: true
{{- end }}
hosts:
- host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
secretName: grafana-tls
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/edge
operator: DoesNotExist
tolerations:
- operator: Exists
containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
input:
tail:
enable: true
refreshIntervalSeconds: 10
memBufLimit: 100MB
bufferMaxSize: ""
path: "/var/log/containers/*.log"
skipLongLines: true
readFromHead: false
storageType: memory
pauseOnChunksOverlimit: "off"
systemd:
enable: true
systemdFilter:
enable: true
filters: []
path: "/var/log/journal"
includeKubelet: true
stripUnderscores: "off"
storageType: memory
pauseOnChunksOverlimit: "off"
fluentbit:
enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
serviceMonitor: true
image:
repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
nodeExporterMetrics: {}
fluentBitMetrics: {}
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/edge
operator: DoesNotExist
tolerations:
- operator: Exists
output:
es:
enable: false
host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
port: 9200
logstashPrefix: ks-logstash-log
bufferSize: 20MB
traceError: true
kafka:
enable: false
brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
topics: ks-log
opentelemetry: {}
opensearch:
enable: false
stdout:
enable: false
loki:
enable: true
host: loki
port: 3100
input:
tail:
enable: true
refreshIntervalSeconds: 10
memBufLimit: 100MB
bufferMaxSize: ""
path: "/var/log/containers/*.log"
skipLongLines: true
readFromHead: false
storageType: memory
pauseOnChunksOverlimit: "off"
systemd:
enable: true
systemdFilter:
enable: true
filters: []
path: "/var/log/journal"
includeKubelet: true
stripUnderscores: "off"
storageType: memory
pauseOnChunksOverlimit: "off"
stackdriver: {}
nodeExporterMetrics: {}
fluentBitMetrics: {}
service:
storage: {}
output:
es:
enable: false
host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
port: 9200
logstashPrefix: ks-logstash-log
bufferSize: 20MB
traceError: true
kafka:
enable: false
brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
topics: ks-log
opentelemetry: {}
opensearch:
enable: false
stdout:
enable: false
loki:
enable: true
host: loki
port: 3100
filter:
kubernetes:
enable: true
labels: true
annotations: true
containerd:
enable: true
systemd:
enable: true
stackdriver: {}
kubeedge:
enable: false
prometheusRemoteWrite:
# Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
host: "<cloud-prometheus-service-host>"
# Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
port: "<cloud-prometheus-service-port>"
service:
storage: {}
filter:
kubernetes:
enable: true
labels: true
annotations: true
containerd:
enable: true
systemd:
enable: true
kubeedge:
enable: false
prometheusRemoteWrite:
# Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
host: "<cloud-prometheus-service-host>"
# Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
port: "<cloud-prometheus-service-port>"

239
internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl
View File

@@ -1,145 +1,134 @@
- name: opentelemetry-operator
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Tracing.Operator.ChartRef }}
chart_version: {{ .Modules.Observability.Tracing.Operator.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
replicaCount: 1
nameOverride: ""
imagePullSecrets: []
pdb:
create: false
minAvailable: 1
maxUnavailable: ""
replicaCount: 1
nameOverride: ""
imagePullSecrets: []
pdb:
create: false
minAvailable: 1
maxUnavailable: ""
manager:
image:
repository: {{ .Modules.Observability.Tracing.Operator.Image }}
tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
collectorImage:
repository: {{ .Modules.Observability.Tracing.Collector.Image }}
tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
manager:
image:
repository: {{ .Modules.Observability.Tracing.Operator.Image }}
tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
collectorImage:
repository: {{ .Modules.Observability.Tracing.Collector.Image }}
tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
featureGates: ""
ports:
metricsPort: 8080
webhookPort: 9443
healthzPort: 8081
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
env:
ENABLE_WEBHOOKS: "true"
featureGates: ""
ports:
metricsPort: 8080
webhookPort: 9443
healthzPort: 8081
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 100m
memory: 64Mi
env:
ENABLE_WEBHOOKS: "true"
serviceAccount:
create: true
annotations: {}
serviceAccount:
create: true
annotations: {}
serviceMonitor:
enabled: true
metricsEndpoints:
- port: metrics
serviceMonitor:
enabled: true
metricsEndpoints:
- port: metrics
prometheusRule:
enabled: true
groups: []
defaultRules:
enabled: true
extraArgs: []
leaderElection:
enabled: true
verticalPodAutoscaler:
enabled: false
controlledResources: []
maxAllowed: {}
minAllowed: {}
updatePolicy:
updateMode: Auto
minReplicas: 2
rolling: false
securityContext: {}
kubeRBACProxy:
prometheusRule:
enabled: true
groups: []
defaultRules:
enabled: true
image:
repository: quay.io/brancz/kube-rbac-proxy
tag: v0.15.0
ports:
proxyPort: 8443
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 5m
memory: 64Mi
extraArgs: []
extraArgs: []
securityContext: {}
leaderElection:
enabled: true
admissionWebhooks:
create: true
servicePort: 443
failurePolicy: Fail
secretName: ""
pods:
failurePolicy: Ignore
verticalPodAutoscaler:
enabled: false
controlledResources: []
maxAllowed: {}
minAllowed: {}
namePrefix: ""
updatePolicy:
updateMode: Auto
minReplicas: 2
rolling: false
timeoutSeconds: 10
securityContext: {}
namespaceSelector: {}
objectSelector: {}
certManager:
enabled: true
issuerRef: {}
certificateAnnotations: {}
issuerAnnotations: {}
kubeRBACProxy:
enabled: true
image:
repository: quay.io/brancz/kube-rbac-proxy
tag: v0.15.0
ports:
proxyPort: 8443
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 5m
memory: 64Mi
autoGenerateCert:
enabled: true
recreate: true
extraArgs: []
secretAnnotations: {}
secretLabels: {}
securityContext: {}
role:
create: true
admissionWebhooks:
create: true
servicePort: 443
failurePolicy: Fail
secretName: ""
pods:
failurePolicy: Ignore
clusterRole:
create: true
namePrefix: ""
affinity: {}
tolerations: []
nodeSelector: {}
topologySpreadConstraints: []
hostNetwork: false
timeoutSeconds: 10
priorityClassName: ""
namespaceSelector: {}
objectSelector: {}
certManager:
enabled: true
issuerRef: {}
certificateAnnotations: {}
issuerAnnotations: {}
securityContext:
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
fsGroup: 65532
autoGenerateCert:
enabled: true
recreate: true
testFramework:
image:
repository: busybox
tag: latest
secretAnnotations: {}
secretLabels: {}
role:
create: true
clusterRole:
create: true
affinity: {}
tolerations: []
nodeSelector: {}
topologySpreadConstraints: []
hostNetwork: false
priorityClassName: ""
securityContext:
runAsGroup: 65532
runAsNonRoot: true
runAsUser: 65532
fsGroup: 65532
testFramework:
image:
repository: busybox
tag: latest

119
internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl
View File

@@ -1,79 +1,68 @@
- name: tempo
namespace: observability
create_namespace: true
chart_ref: {{ .Modules.Observability.Tracing.Tempo.ChartRef }}
chart_version: {{ .Modules.Observability.Tracing.Tempo.ChartVersion }}
{{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
replicas: 1
replicas: 1
tempo:
repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
pullPolicy: IfNotPresent
tempo:
repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
pullPolicy: IfNotPresent
updateStrategy: RollingUpdate
updateStrategy: RollingUpdate
memBallastSizeMbs: 1024
multitenancyEnabled: false
reportingEnabled: false
memBallastSizeMbs: 1024
multitenancyEnabled: false
reportingEnabled: false
metricsGenerator:
enabled: false
remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
global_overrides:
per_tenant_override_config: /conf/overrides.yaml
metricsGenerator:
enabled: false
remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
global_overrides:
per_tenant_override_config: /conf/overrides.yaml
server:
http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
storage:
trace:
backend: local
local:
path: /var/tempo/traces
wal:
path: /var/tempo/wal
receivers:
otlp:
protocols:
grpc:
endpoint: "0.0.0.0:4317"
http:
endpoint: "0.0.0.0:4318"
server:
http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
storage:
trace:
backend: local
local:
path: /var/tempo/traces
wal:
path: /var/tempo/wal
receivers:
otlp:
protocols:
grpc:
endpoint: "0.0.0.0:4317"
http:
endpoint: "0.0.0.0:4318"
tempoQuery:
repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
pullPolicy: IfNotPresent
tempoQuery:
repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
pullPolicy: IfNotPresent
enabled: true
enabled: true
service:
port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
service:
port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
ingress:
enabled: false
ingress:
enabled: false
serviceAccount:
create: true
automountServiceAccountToken: true
serviceAccount:
create: true
automountServiceAccountToken: true
service:
type: ClusterIP
service:
type: ClusterIP
serviceMonitor:
enabled: true
serviceMonitor:
enabled: true
persistence:
enabled: true
storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
accessModes:
- ReadWriteOnce
size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
persistence:
enabled: true
storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
accessModes:
- ReadWriteOnce
size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
priorityClassName: null
priorityClassName: null

21
internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl
View File

@@ -1,17 +1,6 @@
- name: harbor-certificate-generator
namespace: {{ .Modules.Registry.Namespace }}
create_namespace: true
chart_ref: {{ .Modules.Registry.Tls.CertificateGenerator.ChartRef }}
chart_version: {{ .Modules.Registry.Tls.CertificateGenerator.ChartVersion }}
{{- if and .Modules.Registry.Enabled (eq .Modules.Registry.Expose.Type "ingress") }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
certificates:
- name: harbor-tls
domain: {{ .Modules.Registry.Expose.Domain }}
certificates:
- name: harbor-tls
domain: {{ .Modules.Registry.Expose.Domain }}

743
internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl
View File

@@ -1,382 +1,371 @@
- name: harbor
namespace: {{ .Modules.Registry.Namespace }}
create_namespace: true
chart_ref: {{ .Modules.Registry.ChartRef }}
chart_version: {{ .Modules.Registry.ChartVersion }}
{{- if .Modules.Registry.Enabled }}
release_state: "present"
{{- else }}
release_state: "absent"
{{- end }}
values:
expose:
type: {{ .Modules.Registry.Expose.Type }}
tls:
enabled: {{ .Modules.Registry.Tls.Enabled }}
certSource: secret
secret:
secretName: harbor-tls
ingress:
hosts:
core: {{ .Modules.Registry.Expose.Domain }}
controller: default
kubeVersionOverride: ""
className: "{{ .Modules.Additional.Ingress.Type }}"
annotations:
ingress.kubernetes.io/ssl-redirect: "true"
ingress.kubernetes.io/proxy-body-size: "0"
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
{{- end }}
labels: {}
expose:
type: {{ .Modules.Registry.Expose.Type }}
tls:
enabled: {{ .Modules.Registry.Tls.Enabled }}
certSource: secret
secret:
secretName: harbor-tls
ingress:
hosts:
core: {{ .Modules.Registry.Expose.Domain }}
controller: default
kubeVersionOverride: ""
className: "{{ .Modules.Additional.Ingress.Type }}"
annotations:
ingress.kubernetes.io/ssl-redirect: "true"
ingress.kubernetes.io/proxy-body-size: "0"
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
{{- end }}
labels: {}
nodePort:
name: harbor
ports:
http:
port: 80
nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
https:
port: 443
nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
persistence:
resourcePolicy: "keep"
persistentVolumeClaim:
registry:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.RegistrySize }}
annotations: {}
jobservice:
jobLog:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.JobserviceSize }}
annotations: {}
database:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.DatabaseSize }}
annotations: {}
redis:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.RedisSize }}
annotations: {}
trivy:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.TrivySize }}
annotations: {}
imageChartStorage:
disableredirect: false
type: filesystem
filesystem:
rootdirectory: /storage
#maxthreads: 100
imagePullPolicy: IfNotPresent
updateStrategy:
type: RollingUpdate
harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
logLevel: info
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
core:
path: /metrics
port: 8001
registry:
path: /metrics
port: 8001
jobservice:
path: /metrics
port: 8001
exporter:
path: /metrics
port: 8001
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
trace:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
provider: otel
sample_rate: 1
attributes:
application: harbor
jaeger:
endpoint: http://hostname:14268/api/traces
otel:
endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
url_path: /v1/traces
compression: false
insecure: true
timeout: 10
portal:
image:
repository: {{ .Modules.Registry.Portal.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
topologySpreadConstraints: []
podLabels:
"app.kubernetes.io/component": "harbor-portal"
priorityClassName:
core:
image:
repository: {{ .Modules.Registry.Core.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
startupProbe:
enabled: true
initialDelaySeconds: 10
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
podLabels:
"app.kubernetes.io/component": "harbor-core"
serviceAnnotations: {}
priorityClassName:
configureUserSettings:
quotaUpdateProvider: db # Or redis
secret: ""
existingSecret: ""
secretName: ""
tokenKey: ""
tokenCert: ""
xsrfKey: ""
existingXsrfSecret: ""
existingXsrfSecretKey: CSRF_KEY
artifactPullAsyncFlushDuration:
gdpr:
deleteUser: false
auditLogsCompliant: false
jobservice:
image:
repository: {{ .Modules.Registry.Jobservice.Image }}
tag: {{ .Modules.Registry.Jobservice.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
topologySpreadConstraints:
podLabels:
"app.kubernetes.io/component": "harbor-jobservice"
priorityClassName:
maxJobWorkers: 10
jobLoggers:
- file
# - database
# - stdout
loggerSweeperDuration: 14 #days
notification:
webhook_job_max_retry: 3
webhook_job_http_client_timeout: 3 # in seconds
reaper:
max_update_hours: 24
max_dangling_hours: 168
secret: ""
existingSecret: ""
existingSecretKey: JOBSERVICE_SECRET
nodePort:
name: harbor
ports:
http:
port: 80
nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
https:
port: 443
nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain }}{{ if not (eq .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
persistence:
resourcePolicy: "keep"
persistentVolumeClaim:
registry:
registry:
image:
repository: {{ .Modules.Registry.Registry.Registry.Image }}
tag: {{ .Modules.Registry.Registry.Registry.Tag }}
extraEnvVars: []
controller:
image:
repository: {{ .Modules.Registry.Registry.Controller.Image }}
tag: {{ .Modules.Registry.Registry.Controller.Tag }}
extraEnvVars: []
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
topologySpreadConstraints: []
podLabels:
"app.kubernetes.io/component": "harbor-registry"
priorityClassName:
secret: ""
existingSecret: ""
existingSecretKey: REGISTRY_HTTP_SECRET
relativeurls: false
credentials:
# If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
existingSecret: ""
# Login and password in htpasswd string format. Excludes `registry.credentials.username` and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
# htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
# htpasswdString: ""
middleware:
enabled: false
type: cloudFront
cloudFront:
baseurl: example.cloudfront.net
keypairid: KEYPAIRID
duration: 3000s
ipfilteredby: none
# The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
# that allows access to CloudFront
privateKeySecret: "my-secret"
# enable purge _upload directories
upload_purging:
enabled: true
# remove files in _upload directories which exist for a period of time, default is one week.
age: 168h
# the interval of the purge operations
interval: 24h
dryrun: false
trivy:
enabled: {{ .Modules.Registry.EnabledScanner }}
image:
repository: {{ .Modules.Registry.Trivy.Image }}
tag: {{ .Modules.Registry.Trivy.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
resources:
requests:
cpu: 200m
memory: 512Mi
limits:
cpu: 1
memory: 1Gi
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.RegistrySize }}
annotations: {}
jobservice:
jobLog:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.JobserviceSize }}
annotations: {}
database:
# if external database is used, set "type" to "external"
# and fill the connection information in "external" section
type: internal
internal:
image:
repository: {{ .Modules.Registry.Database.Image }}
tag: {{ .Modules.Registry.Database.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
livenessProbe:
timeoutSeconds: 1
readinessProbe:
timeoutSeconds: 1
priorityClassName:
# The initial superuser password for internal database
# password: "changeit"
# The size limit for Shared memory, pgSQL use it for shared_buffer
# More details see:
# https://github.com/goharbor/harbor/issues/15034
shmSizeLimit: 512Mi
initContainer:
migrator: {}
# resources:
# requests:
# memory: 128Mi
# cpu: 100m
permissions: {}
# resources:
# requests:
# memory: 128Mi
# cpu: 100m
external:
host: "192.168.0.1"
port: "5432"
username: "user"
password: "password"
coreDatabase: "registry"
# if using existing secret, the key must be "password"
existingSecret: ""
# "disable" - No SSL
# "require" - Always SSL (skip verification)
# "verify-ca" - Always SSL (verify that the certificate presented by the
# server was signed by a trusted CA)
# "verify-full" - Always SSL (verify that the certification presented by the
# server was signed by a trusted CA and the server host name matches the one
# in the certificate)
sslmode: "disable"
# The maximum number of connections in the idle connection pool per pod (core+exporter).
# If it <=0, no idle connections are retained.
maxIdleConns: 100
# The maximum number of open connections to the database per pod (core+exporter).
# If it <= 0, then there is no limit on the number of open connections.
# Note: the default number of connections is 1024 for postgre of harbor.
maxOpenConns: 900
## Additional deployment annotations
podAnnotations: {}
## Additional deployment labels
podLabels: {}
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.DatabaseSize }}
annotations: {}
redis:
type: internal
internal:
image:
repository: {{ .Modules.Registry.Redis.Image }}
tag: {{ .Modules.Registry.Redis.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
priorityClassName:
jobserviceDatabaseIndex: "1"
registryDatabaseIndex: "2"
trivyAdapterIndex: "5"
# harborDatabaseIndex: "6"
# cacheLayerDatabaseIndex: "7"
external:
# support redis, redis+sentinel
# addr for redis: <host_redis>:<port_redis>
# addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
addr: "192.168.0.2:6379"
# The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
sentinelMasterSet: ""
# The "coreDatabaseIndex" must be "0" as the library Harbor
# used doesn't support configuring it
# harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
# cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
coreDatabaseIndex: "0"
jobserviceDatabaseIndex: "1"
registryDatabaseIndex: "2"
trivyAdapterIndex: "5"
# harborDatabaseIndex: "6"
# cacheLayerDatabaseIndex: "7"
# username field can be an empty string, and it will be authenticated against the default user
username: ""
password: ""
existingSecret: ""
podAnnotations: {}
podLabels: {}
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.RedisSize }}
annotations: {}
trivy:
existingClaim: ""
storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
subPath: ""
accessMode: ReadWriteOnce
size: {{ .Modules.Registry.Persistence.TrivySize }}
annotations: {}
imageChartStorage:
disableredirect: false
type: filesystem
filesystem:
rootdirectory: /storage
#maxthreads: 100
imagePullPolicy: IfNotPresent
updateStrategy:
type: RollingUpdate
harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
logLevel: info
metrics:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
core:
path: /metrics
port: 8001
registry:
path: /metrics
port: 8001
jobservice:
path: /metrics
port: 8001
exporter:
path: /metrics
port: 8001
serviceMonitor:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
trace:
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
provider: otel
sample_rate: 1
attributes:
application: harbor
jaeger:
endpoint: http://hostname:14268/api/traces
otel:
endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
url_path: /v1/traces
compression: false
insecure: true
timeout: 10
portal:
image:
repository: {{ .Modules.Registry.Portal.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
topologySpreadConstraints: []
podLabels:
"app.kubernetes.io/component": "harbor-portal"
priorityClassName:
core:
image:
repository: {{ .Modules.Registry.Core.Image }}
tag: {{ .Modules.Registry.Portal.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
startupProbe:
enabled: true
initialDelaySeconds: 10
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
topologySpreadConstraints: []
podLabels:
"app.kubernetes.io/component": "harbor-core"
serviceAnnotations: {}
priorityClassName:
configureUserSettings:
quotaUpdateProvider: db # Or redis
secret: ""
existingSecret: ""
secretName: ""
tokenKey: ""
tokenCert: ""
xsrfKey: ""
existingXsrfSecret: ""
existingXsrfSecretKey: CSRF_KEY
artifactPullAsyncFlushDuration:
gdpr:
deleteUser: false
auditLogsCompliant: false
jobservice:
image:
repository: {{ .Modules.Registry.Jobservice.Image }}
tag: {{ .Modules.Registry.Jobservice.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
topologySpreadConstraints:
podLabels:
"app.kubernetes.io/component": "harbor-jobservice"
priorityClassName:
maxJobWorkers: 10
jobLoggers:
- file
# - database
# - stdout
loggerSweeperDuration: 14 #days
notification:
webhook_job_max_retry: 3
webhook_job_http_client_timeout: 3 # in seconds
reaper:
max_update_hours: 24
max_dangling_hours: 168
secret: ""
existingSecret: ""
existingSecretKey: JOBSERVICE_SECRET
registry:
registry:
image:
repository: {{ .Modules.Registry.Registry.Registry.Image }}
tag: {{ .Modules.Registry.Registry.Registry.Tag }}
extraEnvVars: []
controller:
image:
repository: {{ .Modules.Registry.Registry.Controller.Image }}
tag: {{ .Modules.Registry.Registry.Controller.Tag }}
extraEnvVars: []
serviceAccountName: ""
automountServiceAccountToken: false
replicas: 1
revisionHistoryLimit: 10
topologySpreadConstraints: []
podLabels:
"app.kubernetes.io/component": "harbor-registry"
priorityClassName:
secret: ""
existingSecret: ""
existingSecretKey: REGISTRY_HTTP_SECRET
relativeurls: false
credentials:
# If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
existingSecret: ""
# Login and password in htpasswd string format. Excludes `registry.credentials.username` and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
# htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
# htpasswdString: ""
middleware:
enabled: false
type: cloudFront
cloudFront:
baseurl: example.cloudfront.net
keypairid: KEYPAIRID
duration: 3000s
ipfilteredby: none
# The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
# that allows access to CloudFront
privateKeySecret: "my-secret"
# enable purge _upload directories
upload_purging:
enabled: true
# remove files in _upload directories which exist for a period of time, default is one week.
age: 168h
# the interval of the purge operations
interval: 24h
dryrun: false
trivy:
enabled: {{ .Modules.Registry.EnabledScanner }}
image:
repository: {{ .Modules.Registry.Trivy.Image }}
tag: {{ .Modules.Registry.Trivy.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
resources:
requests:
cpu: 200m
memory: 512Mi
limits:
cpu: 1
memory: 1Gi
database:
# if external database is used, set "type" to "external"
# and fill the connection information in "external" section
type: internal
internal:
image:
repository: {{ .Modules.Registry.Database.Image }}
tag: {{ .Modules.Registry.Database.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
livenessProbe:
timeoutSeconds: 1
readinessProbe:
timeoutSeconds: 1
priorityClassName:
# The initial superuser password for internal database
# password: "changeit"
# The size limit for Shared memory, pgSQL use it for shared_buffer
# More details see:
# https://github.com/goharbor/harbor/issues/15034
shmSizeLimit: 512Mi
initContainer:
migrator: {}
# resources:
# requests:
# memory: 128Mi
# cpu: 100m
permissions: {}
# resources:
# requests:
# memory: 128Mi
# cpu: 100m
external:
host: "192.168.0.1"
port: "5432"
username: "user"
password: "password"
coreDatabase: "registry"
# if using existing secret, the key must be "password"
existingSecret: ""
# "disable" - No SSL
# "require" - Always SSL (skip verification)
# "verify-ca" - Always SSL (verify that the certificate presented by the
# server was signed by a trusted CA)
# "verify-full" - Always SSL (verify that the certification presented by the
# server was signed by a trusted CA and the server host name matches the one
# in the certificate)
sslmode: "disable"
# The maximum number of connections in the idle connection pool per pod (core+exporter).
# If it <=0, no idle connections are retained.
maxIdleConns: 100
# The maximum number of open connections to the database per pod (core+exporter).
# If it <= 0, then there is no limit on the number of open connections.
# Note: the default number of connections is 1024 for postgre of harbor.
maxOpenConns: 900
## Additional deployment annotations
podAnnotations: {}
## Additional deployment labels
podLabels: {}
redis:
type: internal
internal:
image:
repository: {{ .Modules.Registry.Redis.Image }}
tag: {{ .Modules.Registry.Redis.Tag }}
serviceAccountName: ""
automountServiceAccountToken: false
extraEnvVars: []
nodeSelector: {}
tolerations: []
affinity: {}
priorityClassName:
jobserviceDatabaseIndex: "1"
registryDatabaseIndex: "2"
trivyAdapterIndex: "5"
# harborDatabaseIndex: "6"
# cacheLayerDatabaseIndex: "7"
external:
# support redis, redis+sentinel
# addr for redis: <host_redis>:<port_redis>
# addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
addr: "192.168.0.2:6379"
# The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
sentinelMasterSet: ""
# The "coreDatabaseIndex" must be "0" as the library Harbor
# used doesn't support configuring it
# harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
# cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
coreDatabaseIndex: "0"
jobserviceDatabaseIndex: "1"
registryDatabaseIndex: "2"
trivyAdapterIndex: "5"
# harborDatabaseIndex: "6"
# cacheLayerDatabaseIndex: "7"
# username field can be an empty string, and it will be authenticated against the default user
username: ""
password: ""
existingSecret: ""
podAnnotations: {}
podLabels: {}

1749
internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl
View File

File diff suppressed because it is too large Load Diff

5
internal/resources/templates/helm-apps/repositories/repositories.yml.tmpl
View File

@@ -1,5 +0,0 @@
- name: kube-forge
url: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable"
{{ if .Modules.AdditionalRepositories }}
{{ .Modules.AdditionalRepositories | toYaml }}
{{- end }}

10
internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl
View File

@@ -232,13 +232,3 @@ argocd_enabled: false
# The plugin manager for kubectl
krew_enabled: false
krew_root_dir: "/usr/local/krew"
########################################
# Helm apps configuration
########################################
repositories:
{{- .Repositories | nindent 2 }}
releases:
{{- .Releases | nindent 2 }}