migrate from kubespray to library helm client

cmd/main/main.go

@@ -2,13 +2,28 @@ package main
 
 import (
 	"flag"
-	"fmt"
+	"kube-forge/internal/additional"
+	"kube-forge/internal/cicd"
 	"kube-forge/internal/config"
+	"kube-forge/internal/csi"
 	"kube-forge/internal/kubespray"
+	"kube-forge/internal/logging"
+	"kube-forge/internal/observability"
+	"kube-forge/internal/registry"
+	"kube-forge/internal/secrets_storage"
 	"kube-forge/internal/templates"
 	"os"
 )
 
+func installAndConfigureModules() {
+	csi.ApplyCharts()
+	additional.ApplyCharts()
+	registry.ApplyCharts()
+	secrets_storage.ApplyCharts()
+	cicd.ApplyCharts()
+	observability.ApplyCharts()
+}
+
 func main() {
 	var password, configPath, workDir string
 	var verbose bool
@@ -20,9 +35,6 @@ func main() {
 	flag.Parse()
 	config := config.CreateConfig(configPath, workDir, password)
 	config.Verbose = verbose
-	repositories, releases := templates.GetHelmAppsConfigData()
-	config.Repositories = repositories
-	config.Releases = releases
 
 	templates.ApplyK8sTemplates()
 
@@ -30,9 +42,10 @@ func main() {
 		switch cmd {
 		case "apply":
 			kubespray.InstallCluster("")
+			installAndConfigureModules()
 			return
 		case "apply-modules":
-			kubespray.InstallCluster("helm-apps")
+			installAndConfigureModules()
 			return
 		case "upgrade":
 			kubespray.UpgradeCluster("")
@@ -42,5 +55,5 @@ func main() {
 			return
 		}
 	}
-	fmt.Println("No such command\nAvailable commands: apply, apply-modules, upgrade, scale")
+	logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale")
 }

go.mod

@@ -11,7 +11,9 @@ require (
 	github.com/apenella/go-ansible/v2 v2.0.0
 	github.com/ilyakaznacheev/cleanenv v1.5.0
 	github.com/mittwald/go-helm-client v0.12.9
+	github.com/sirupsen/logrus v1.9.3
 	golang.org/x/crypto v0.22.0
+	helm.sh/helm/v3 v3.14.2
 	k8s.io/api v0.30.0
 	k8s.io/apimachinery v0.30.0
 	k8s.io/client-go v0.30.0
@@ -113,7 +115,6 @@ require (
 	github.com/rubenv/sql-migrate v1.6.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/cast v1.6.0 // indirect
 	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
@@ -144,7 +145,6 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	helm.sh/helm/v3 v3.14.2 // indirect
 	k8s.io/apiextensions-apiserver v0.29.0 // indirect
 	k8s.io/apiserver v0.29.0 // indirect
 	k8s.io/cli-runtime v0.29.0 // indirect

internal/additional/helm.go

@@ -0,0 +1,79 @@
+package additional
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = []config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getCertManagerSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "cert-manager",
+		ChartName:       appConfig.Modules.Additional.CertManager.ChartRef,
+		Version:         appConfig.Modules.Additional.CertManager.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.CertManager.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl"),
+	}
+}
+
+func getIngressNginxSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "ingress-nginx",
+		ChartName:       appConfig.Modules.Additional.Ingress.ChartRef,
+		Version:         appConfig.Modules.Additional.Ingress.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.Ingress.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl"),
+	}
+}
+
+func getDockerSecretsGeneratorSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "docker-secrets-generator",
+		ChartName:       appConfig.Modules.Additional.DockerSecrets.ChartRef,
+		Version:         appConfig.Modules.Additional.DockerSecrets.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.DockerSecrets.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl"),
+	}
+}
+
+func ApplyCharts() {
+	appConfig := config.GetConfig()
+	helm_client.AddHelmRepos("kube-system", HELM_REPOS)
+	if appConfig.Modules.Additional.CertManager.Enabled {
+		helm_client.InstallChart(getCertManagerSpec())
+	} else {
+		helm_client.DeleteChart(getCertManagerSpec())
+	}
+	if appConfig.Modules.Additional.Ingress.Enabled && appConfig.Modules.Additional.Ingress.Type == "nginx" {
+		helm_client.InstallChart(getIngressNginxSpec())
+	} else {
+		helm_client.DeleteChart(getIngressNginxSpec())
+	}
+	if appConfig.Modules.Additional.DockerSecrets.Repositories != nil {
+		helm_client.InstallChart(getDockerSecretsGeneratorSpec())
+	} else {
+		helm_client.DeleteChart(getDockerSecretsGeneratorSpec())
+	}
+}

internal/cicd/helm.go

@@ -0,0 +1,108 @@
+package cicd
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = [...]config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getArgoCdSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "argo-cd",
+		ChartName:       appConfig.Modules.Cicd.ArgoCd.ChartRef,
+		Version:         appConfig.Modules.Cicd.ArgoCd.ChartVersion,
+		Namespace:       appConfig.Modules.Cicd.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd.yml.tmpl"),
+	}
+}
+
+func getArgoRolloutsSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "argo-rollouts",
+		ChartName:       appConfig.Modules.Cicd.Rollouts.ChartRef,
+		Version:         appConfig.Modules.Cicd.Rollouts.ChartVersion,
+		Namespace:       appConfig.Modules.Cicd.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl"),
+	}
+}
+
+func getKeelSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "keel",
+		ChartName:       appConfig.Modules.Cicd.UpdatesOperator.ChartRef,
+		Version:         appConfig.Modules.Cicd.UpdatesOperator.ChartVersion,
+		Namespace:       appConfig.Modules.Cicd.UpdatesOperator.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/keel.yml.tmpl"),
+	}
+}
+
+func getArgoCdIngressSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "argo-cd-ingress",
+		ChartName:       appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartRef,
+		Version:         appConfig.Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion,
+		Namespace:       appConfig.Modules.Cicd.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl"),
+	}
+}
+
+func addCicdHelmRepos() {
+	appConfig := config.GetConfig()
+	for _, repoSettings := range HELM_REPOS {
+		helm_client.AddHelmRepo(appConfig.Modules.SecretsStorage.Namespace, repoSettings)
+	}
+}
+
+func ApplyCharts() {
+	addCicdHelmRepos()
+	appConfig := config.GetConfig()
+	if appConfig.Modules.Cicd.Enabled {
+		helm_client.InstallChart(getArgoCdSpec())
+		if appConfig.Modules.Cicd.ArgoCd.Expose.Type == "ingress" {
+			helm_client.InstallChart(getArgoCdIngressSpec())
+		} else {
+			helm_client.DeleteChart(getArgoCdIngressSpec())
+		}
+		if appConfig.Modules.Cicd.Rollouts.Enabled {
+			helm_client.InstallChart(getArgoRolloutsSpec())
+		} else {
+			helm_client.DeleteChart(getArgoRolloutsSpec())
+		}
+		if appConfig.Modules.Cicd.UpdatesOperator.Enabled {
+			helm_client.InstallChart(getKeelSpec())
+		} else {
+			helm_client.DeleteChart(getKeelSpec())
+		}
+	} else {
+		helm_client.DeleteChart(getArgoCdIngressSpec())
+		helm_client.DeleteChart(getArgoCdSpec())
+		helm_client.DeleteChart(getArgoRolloutsSpec())
+		helm_client.DeleteChart(getKeelSpec())
+	}
+}

internal/config/config.go

@@ -38,9 +38,6 @@ type Config struct {
 		Cicd                   Cicd           `yaml:"cicd"`
 		SecretsStorage         SecretsStorage `yaml:"secrets_storage"`
 	} `yaml:"modules"`
-
-	Repositories string
-	Releases     string
 }
 
 var instance *Config

internal/config/helm.go

@@ -5,13 +5,30 @@ import (
 	"log"
 	"os"
 	"path/filepath"
+	"time"
 
 	helm_client "github.com/mittwald/go-helm-client"
 )
 
-var client *helm_client.Client
+type RepoSettings struct {
+	Name     string
+	URL      string
+	Username string
+	Password string
+}
 
-func CreateHelmClient() helm_client.Client {
+type ChartSettings struct {
+	ReleaseName     string
+	ChartRef        string
+	ChartVersion    string
+	Namespace       string
+	CreateNamespace bool
+	Atomic          bool
+	Timeout         time.Duration
+	ValuesYaml      string
+}
+
+func GetHelmClient(namespace string) helm_client.Client {
 	config := GetConfig()
 	file, err := os.Open(filepath.Join(config.WorkDir, config.KubeconfigFile))
 	if err != nil {
@@ -24,7 +41,7 @@ func CreateHelmClient() helm_client.Client {
 	}
 	opts := &helm_client.KubeConfClientOptions{
 		Options: &helm_client.Options{
-			Namespace:        "default", // Change this to the namespace you wish to install the chart in.
+			Namespace:        namespace,
 			RepositoryCache:  "/tmp/.helmcache",
 			RepositoryConfig: "/tmp/.helmrepo",
 			Debug:            true,
@@ -40,9 +57,6 @@ func CreateHelmClient() helm_client.Client {
 	if err != nil {
 		log.Fatalf("error while creating helm client: %s", err)
 	}
-	return client
-}
 
-func GetHelmClient() *helm_client.Client {
 	return client
 }

internal/config/modules_additional.go

@@ -5,6 +5,7 @@ type Additional struct {
 		ChartRef     string   `yaml:"chart_ref" env-default:"kube-forge/cert-manager"`
 		ChartVersion string   `yaml:"chart_version" env-default:"v1.14.5"`
 		Enabled      bool     `yaml:"enabled"`
+		Namespace    string   `yaml:"namespace" env-default:"cert-manager"`
 		HaEnabled    bool     `yaml:"ha_enabled"`
 		DnsServers   []string `yaml:"dns_servers" env-default:"8.8.8.8,1.1.1.1"`
 		AccountEmail string   `yaml:"account_email"`
@@ -19,6 +20,7 @@ type Additional struct {
 		ChartVersion            string `yaml:"chart_version" env-default:"4.10.1"`
 		Type                    string `yaml:"type" env-default:"nginx"`
 		Enabled                 bool   `yaml:"enabled"`
+		Namespace               string `yaml:"namespace" env-default:"ingress-nginx"`
 		IngressClassName        string `yaml:"ingress_class_name" env-default:"nginx"`
 		HostNetwork             bool   `yaml:"host_network"`
 		EnableAdmissionWebhooks bool   `yaml:"enable_admission_webhooks"`
@@ -42,6 +44,7 @@ type Additional struct {
 	DockerSecrets struct {
 		ChartRef     string      `yaml:"chart_ref" env-default:"kube-forge/docker-secrets-generator"`
 		ChartVersion string      `yaml:"chart_version" env-default:"0.1.0"`
+		Namespace    string      `yaml:"namespace" env-default:"kube-system"`
 		Repositories interface{} `yaml:"repositories"`
 	} `yaml:"docker_secrets"`
 
@@ -54,11 +57,13 @@ type Additional struct {
 			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/longhorn"`
 			ChartVersion string `yaml:"chart_version" env-default:"1.6.1"`
 			Enabled      bool   `yaml:"enabled"`
+			Namespace    string `yaml:"namespace" env-default:"longhorn-system"`
 		} `yaml:"longhorn"`
 		SecretsStoreCsiDriver struct {
 			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/secrets-store-csi-driver"`
 			ChartVersion string `yaml:"chart_version" env-default:"1.4.3"`
 			Enabled      bool   `yaml:"enabled"`
+			Namespace    string `yaml:"namespace" env-default:"kube-system"`
 		} `yaml:"secrets_store_csi_driver"`
 	} `yaml:"storage"`
 }

internal/config/modules_cicd.go

@@ -1,8 +1,9 @@
 package config
 
 type Cicd struct {
-	Enabled bool `yaml:"enabled"`
+	Enabled   bool   `yaml:"enabled"`
-	ArgoCd  struct {
+	Namespace string `yaml:"namespace" env-default:"cicd"`
+	ArgoCd    struct {
 		ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
 		ChartVersion  string `yaml:"chart_version" env-default:"6.7.10"`
 		AdminPassword string
@@ -69,6 +70,7 @@ type Cicd struct {
 		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/keel"`
 		ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
 		Enabled      bool   `yaml:"enabled"`
+		Namespace    string `yaml:"namespace" env-default:"kube-system"`
 		Image        string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/keelhq/keel"`
 		Tag          string `yaml:"tag" env-default:"latest"`
 	} `yaml:"updates_operator"`

internal/config/modules_observability.go

@@ -8,6 +8,7 @@ type Observability struct {
 	Tracing       Tracing       `yaml:"tracing"`
 	Monitoring    Monitoring    `yaml:"monitoring"`
 	Visualization Visualization `yaml:"visualization"`
+	Namespace     string        `yaml:"namespace" env-default:"observability"`
 }
 
 type Logging struct {
@@ -17,6 +18,7 @@ type Logging struct {
 		ChartVersion  string `yaml:"chart_version" env-default:"2.7.0"`
 		Image         string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/kubesphere/fluent-operator"`
 		Tag           string `yaml:"tag" env-default:"v2.7.0"`
+		Namespace     string `yaml:"namespace" env-default:"observability"`
 		InitContainer struct {
 			Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/docker"`
 			Tag   string `yaml:"tag" env-default:"20.10"`
@@ -36,6 +38,7 @@ type Logging struct {
 		Registry     string `yaml:"registry" env-default:"harbor.kvazaric.ru"`
 		Image        string `yaml:"image" env-default:"kube-forge/grafana/loki"`
 		Tag          string `yaml:"tag" env-default:"latest"`
+		Namespace    string `yaml:"namespace" env-default:"observability"`
 		Persistence  struct {
 			StorageClass string `yaml:"storage_class" env-default:"local-path"`
 			StorageSize  string `yaml:"storage_size" env-default:"10Gi"`
@@ -65,6 +68,7 @@ type Tracing struct {
 		ChartVersion string `yaml:"chart_version" env-default:"0.55.0"`
 		Image        string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"`
 		Tag          string `yaml:"tag" env-default:""`
+		Namespace    string `yaml:"namespace" env-default:"observability"`
 	} `yaml:"operator"`
 	Collector struct {
 		Image string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/otel/opentelemetry-collector-contrib"`
@@ -75,6 +79,7 @@ type Tracing struct {
 		ChartVersion string `yaml:"chart_version" env-default:"1.7.2"`
 		Image        string `yaml:"image" env-default:"harbor.kvazaric.ru/kube-forge/grafana/tempo"`
 		Tag          string `yaml:"tag" env-default:"2.3.1"`
+		Namespace    string `yaml:"namespace" env-default:"observability"`
 		Retention    string `yaml:"retention" env-default:"24h"`
 		ListenPort   int    `yaml:"listen_port" env-default:"3100"`
 		Persistence  struct {
@@ -142,6 +147,7 @@ type Monitoring struct {
 		ChartVersion string `yaml:"chart_version" env-default:"3.12.1"`
 		Image        string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"`
 		Tag          string `yaml:"tag" env-default:""`
+		Namespace    string `yaml:"namespace" env-default:"kube-system"`
 	}
 }
 

internal/config/modules_secrets_storage.go

@@ -3,6 +3,7 @@ package config
 type SecretsStorage struct {
 	ChartRef     string   `yaml:"chart_ref" env-default:"kube-forge/vault"`
 	ChartVersion string   `yaml:"chart_version" env-default:"0.1.0"`
+	Namespace    string   `yaml:"namespace" env-default:"secrets-storage"`
 	Enabled      bool     `yaml:"enabled"`
 	KeyShares    int      `yaml:"key_shares" env-default:"5"`
 	KeyThreshold int      `yaml:"key_threshold" env-default:"3"`

internal/csi/helm.go

@@ -0,0 +1,60 @@
+package csi
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = []config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getLonghornSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "longhorn",
+		ChartName:       appConfig.Modules.Additional.Storage.Longhorn.ChartRef,
+		Version:         appConfig.Modules.Additional.Storage.Longhorn.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.Storage.Longhorn.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl"),
+	}
+}
+
+func getSecretsStoreSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "csi-secrets-store",
+		ChartName:       appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef,
+		Version:         appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 60,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl"),
+	}
+}
+
+func ApplyCharts() {
+	appConfig := config.GetConfig()
+	helm_client.AddHelmRepos("kube-system", HELM_REPOS)
+	if appConfig.Modules.Additional.Storage.Longhorn.Enabled {
+		helm_client.InstallChart(getLonghornSpec())
+	} else {
+		helm_client.DeleteChart(getLonghornSpec())
+	}
+	if appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled {
+		helm_client.InstallChart(getSecretsStoreSpec())
+	} else {
+		helm_client.DeleteChart(getSecretsStoreSpec())
+	}
+}

internal/helm_client/chart.go

@@ -0,0 +1,32 @@
+package helm_client
+
+import (
+	"context"
+	"kube-forge/internal/config"
+	"kube-forge/internal/logging"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+func InstallChart(chartSpec go_helm_client.ChartSpec) {
+	helmClient := config.GetHelmClient(chartSpec.Namespace)
+	_, error := helmClient.GetRelease(chartSpec.ReleaseName)
+	if error != nil {
+		logging.Log.Infof("Installing %s", chartSpec.ChartName)
+	} else {
+		logging.Log.Infof("Upgrading %s", chartSpec.ChartName)
+	}
+	if _, err := helmClient.InstallOrUpgradeChart(context.Background(), &chartSpec, nil); err != nil {
+		panic(err)
+	}
+}
+
+func DeleteChart(chartSpec go_helm_client.ChartSpec) {
+	helmClient := config.GetHelmClient(chartSpec.Namespace)
+	_, error := helmClient.GetRelease(chartSpec.ReleaseName)
+	if error != nil {
+		return
+	}
+	logging.Log.Warnf("Uninstalling %s", chartSpec.ChartName)
+	helmClient.UninstallRelease(&chartSpec)
+}

internal/helm_client/repo.go

@@ -0,0 +1,27 @@
+package helm_client
+
+import (
+	"kube-forge/internal/config"
+
+	"helm.sh/helm/v3/pkg/repo"
+)
+
+func AddHelmRepo(namespace string, repoSettings config.RepoSettings) {
+	helmClient := config.GetHelmClient(namespace)
+	chartRepo := repo.Entry{
+		Name:     repoSettings.Name,
+		URL:      repoSettings.URL,
+		Username: repoSettings.Username,
+		Password: repoSettings.Password,
+	}
+
+	if err := helmClient.AddOrUpdateChartRepo(chartRepo); err != nil {
+		panic(err)
+	}
+}
+
+func AddHelmRepos(namespace string, helmRepos []config.RepoSettings) {
+	for _, repoSettings := range helmRepos {
+		AddHelmRepo(namespace, repoSettings)
+	}
+}

internal/kubespray/cluster.go

@@ -1,22 +1,13 @@
 package kubespray
 
 import (
-	"fmt"
 	"kube-forge/internal/config"
-	"kube-forge/internal/secrets_storage"
 )
 
 func InstallCluster(tags string) {
 	appConfig := config.GetConfig()
 	runPlaybook("kubespray/project/cluster.yml", tags)
 	CopyK8SAdminConfig(appConfig.KubeconfigFile)
-	config.CreateHelmClient()
-	if appConfig.Modules.SecretsStorage.Enabled {
-		fmt.Println("## Additional Vault Configuration")
-		secrets_storage.InitVault()
-		secrets_storage.UnsealVault()
-		secrets_storage.AddKubernetesLocalIntegration()
-	}
 }
 
 func UpgradeCluster(tags string) {
@@ -26,7 +17,7 @@ func UpgradeCluster(tags string) {
 }
 
 func ScaleCluster() {
-	runPlaybook("kubespray/project/scale.yml", "")
 	appConfig := config.GetConfig()
+	runPlaybook("kubespray/project/scale.yml", "")
 	CopyK8SAdminConfig(appConfig.KubeconfigFile)
 }

internal/logging/log.go

@@ -0,0 +1,12 @@
+package logging
+
+import (
+	"github.com/sirupsen/logrus"
+)
+
+var Log = logrus.New()
+
+func init() {
+	Log.SetLevel(logrus.InfoLevel)
+	Log.SetFormatter(&logrus.TextFormatter{})
+}

internal/observability/helm.go

@@ -0,0 +1,122 @@
+package observability
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = []config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getFluentOperatorSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "fluent-operator",
+		ChartName:       appConfig.Modules.Observability.Logging.Operator.ChartRef,
+		Version:         appConfig.Modules.Observability.Logging.Operator.ChartVersion,
+		Namespace:       appConfig.Modules.Observability.Logging.Operator.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		UpgradeCRDs:     true,
+		Timeout:         time.Second * 60,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/fluent-operator.yml.tmpl"),
+	}
+}
+
+func getOpenTelemetryOperatorSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "opentelemetry-operator",
+		ChartName:       appConfig.Modules.Observability.Tracing.Operator.ChartRef,
+		Version:         appConfig.Modules.Observability.Tracing.Operator.ChartVersion,
+		Namespace:       appConfig.Modules.Observability.Tracing.Operator.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		UpgradeCRDs:     true,
+		Timeout:         time.Second * 60,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl"),
+	}
+}
+
+func getMetricsServerSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "metrics-server",
+		ChartName:       appConfig.Modules.Observability.Monitoring.MetricsServer.ChartRef,
+		Version:         appConfig.Modules.Observability.Monitoring.MetricsServer.ChartVersion,
+		Namespace:       appConfig.Modules.Observability.Monitoring.MetricsServer.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 60,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/metrics-server.yml.tmpl"),
+	}
+}
+
+func getTempoSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "tempo",
+		ChartName:       appConfig.Modules.Observability.Tracing.Tempo.ChartRef,
+		Version:         appConfig.Modules.Observability.Tracing.Tempo.ChartVersion,
+		Namespace:       appConfig.Modules.Observability.Tracing.Tempo.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 60,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/tempo.yml.tmpl"),
+	}
+}
+
+func getLokiSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "loki",
+		ChartName:       appConfig.Modules.Observability.Logging.Loki.ChartRef,
+		Version:         appConfig.Modules.Observability.Logging.Loki.ChartVersion,
+		Namespace:       appConfig.Modules.Observability.Logging.Loki.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 60,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/loki.yml.tmpl"),
+	}
+}
+
+func getObservabilitySpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "observability",
+		ChartName:       appConfig.Modules.Observability.ChartRef,
+		Version:         appConfig.Modules.Observability.ChartVersion,
+		Namespace:       appConfig.Modules.Observability.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/observability/observability.yml.tmpl"),
+	}
+}
+
+func ApplyCharts() {
+	appConfig := config.GetConfig()
+	helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
+	if appConfig.Modules.Observability.Enabled {
+		if appConfig.Modules.Observability.Logging.Enabled {
+			helm_client.InstallChart(getFluentOperatorSpec())
+			helm_client.InstallChart(getLokiSpec())
+		}
+		if appConfig.Modules.Observability.Tracing.Enabled {
+			helm_client.InstallChart(getOpenTelemetryOperatorSpec())
+			helm_client.InstallChart(getTempoSpec())
+		}
+		if appConfig.Modules.Observability.Monitoring.Enabled {
+			helm_client.InstallChart(getMetricsServerSpec())
+		}
+		helm_client.InstallChart(getObservabilitySpec())
+	}
+}

internal/registry/charts.go

@@ -1,5 +0,0 @@
-package registry
-
-func InstallRegistryCharts() {
-
-}

internal/registry/commands.go

@@ -1,9 +0,0 @@
-package registry
-
-func CreateDockerRepositories() {
-
-}
-
-func CreateHelmRepositories() {
-
-}

internal/registry/helm.go

@@ -0,0 +1,61 @@
+package registry
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = []config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getHarborCertificateGeneratorSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "harbor-certificate-generator",
+		ChartName:       appConfig.Modules.Registry.Tls.CertificateGenerator.ChartRef,
+		Version:         appConfig.Modules.Registry.Tls.CertificateGenerator.ChartVersion,
+		Namespace:       appConfig.Modules.Registry.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 60,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl"),
+	}
+}
+
+func getHarborSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "harbor",
+		ChartName:       appConfig.Modules.Registry.ChartRef,
+		Version:         appConfig.Modules.Registry.ChartVersion,
+		Namespace:       appConfig.Modules.Registry.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/registry/harbor.yml.tmpl"),
+	}
+}
+
+func ApplyCharts() {
+	appConfig := config.GetConfig()
+	helm_client.AddHelmRepos(appConfig.Modules.Registry.Namespace, HELM_REPOS)
+	if appConfig.Modules.Registry.Enabled {
+		if appConfig.Modules.Registry.Expose.Type == "ingress" {
+			helm_client.InstallChart(getHarborCertificateGeneratorSpec())
+		} else {
+			helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
+		}
+		helm_client.InstallChart(getHarborSpec())
+	} else {
+		helm_client.DeleteChart(getHarborSpec())
+		helm_client.DeleteChart(getHarborCertificateGeneratorSpec())
+	}
+}

internal/resources/templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl

@@ -1,14 +1,2 @@
-- name: docker-secrets-generator
+repositories:
-  namespace: kube-system
+  {{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}
-  chart_ref: {{ .Modules.Additional.DockerSecrets.ChartRef }}
-  chart_version: {{ .Modules.Additional.DockerSecrets.ChartVersion }}
-  {{- if .Modules.Additional.DockerSecrets.Repositories }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-    {{- if .Modules.Additional.DockerSecrets.Repositories }}
-  values:
-    repositories:
-      {{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}
-    {{- end }}

internal/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl

@@ -1,490 +1,479 @@
-- name: longhorn
+global:
-  namespace: longhorn-system
+  cattle:
-  create_namespace: true
+    # -- Default system registry.
-  chart_ref: {{ .Modules.Additional.Storage.Longhorn.ChartRef }}
+    systemDefaultRegistry: ""
-  chart_version: {{ .Modules.Additional.Storage.Longhorn.ChartVersion }}
+    windowsCluster:
-  {{- if .Modules.Additional.Storage.Longhorn.Enabled }}
+      # -- Setting that allows Longhorn to run on a Rancher Windows cluster.
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    global:
-      cattle:
-        # -- Default system registry.
-        systemDefaultRegistry: ""
-        windowsCluster:
-          # -- Setting that allows Longhorn to run on a Rancher Windows cluster.
-          enabled: false
-          # -- Toleration for Linux nodes that can run user-deployed Longhorn components.
-          tolerations:
-          - key: "cattle.io/os"
-            value: "linux"
-            effect: "NoSchedule"
-            operator: "Equal"
-          # -- Node selector for Linux nodes that can run user-deployed Longhorn components.
-          nodeSelector:
-            kubernetes.io/os: "linux"
-          defaultSetting:
-            # -- Toleration for system-managed Longhorn components.
-            taintToleration: cattle.io/os=linux:NoSchedule
-            # -- Node selector for system-managed Longhorn components.
-            systemManagedComponentsNodeSelector: kubernetes.io/os:linux
-
-    networkPolicies:
-      # -- Setting that allows you to enable network policies that control access to Longhorn pods.
       enabled: false
-      # -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
+      # -- Toleration for Linux nodes that can run user-deployed Longhorn components.
-      type: "k3s"
+      tolerations:
+        - key: "cattle.io/os"
+          value: "linux"
+          effect: "NoSchedule"
+          operator: "Equal"
+      # -- Node selector for Linux nodes that can run user-deployed Longhorn components.
+      nodeSelector:
+        kubernetes.io/os: "linux"
+      defaultSetting:
+        # -- Toleration for system-managed Longhorn components.
+        taintToleration: cattle.io/os=linux:NoSchedule
+        # -- Node selector for system-managed Longhorn components.
+        systemManagedComponentsNodeSelector: kubernetes.io/os:linux
 
-    image:
+networkPolicies:
-      longhorn:
+  # -- Setting that allows you to enable network policies that control access to Longhorn pods.
-        engine:
+  enabled: false
-          # -- Repository for the Longhorn Engine image.
+  # -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
-          repository: longhornio/longhorn-engine
+  type: "k3s"
-          # -- Specify Longhorn engine image tag
-          tag: v1.6.1
-        manager:
-          # -- Repository for the Longhorn Manager image.
-          repository: longhornio/longhorn-manager
-          # -- Specify Longhorn manager image tag
-          tag: v1.6.1
-        ui:
-          # -- Repository for the Longhorn UI image.
-          repository: longhornio/longhorn-ui
-          # -- Specify Longhorn ui image tag
-          tag: v1.6.1
-        instanceManager:
-          # -- Repository for the Longhorn Instance Manager image.
-          repository: longhornio/longhorn-instance-manager
-          # -- Specify Longhorn instance manager image tag
-          tag: v1.6.1
-        shareManager:
-          # -- Repository for the Longhorn Share Manager image.
-          repository: longhornio/longhorn-share-manager
-          # -- Specify Longhorn share manager image tag
-          tag: v1.6.1
-        backingImageManager:
-          # -- Repository for the Backing Image Manager image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/backing-image-manager
-          # -- Specify Longhorn backing image manager image tag
-          tag: v1.6.1
-        supportBundleKit:
-          # -- Repository for the Longhorn Support Bundle Manager image.
-          repository: longhornio/support-bundle-kit
-          # -- Tag for the Longhorn Support Bundle Manager image.
-          tag: v0.0.36
-      csi:
-        attacher:
-          # -- Repository for the CSI attacher image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-attacher
-          # -- Tag for the CSI attacher image. When unspecified, Longhorn uses the default value.
-          tag: v4.4.2
-        provisioner:
-          # -- Repository for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-provisioner
-          # -- Tag for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
-          tag: v3.6.2
-        nodeDriverRegistrar:
-          # -- Repository for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-node-driver-registrar
-          # -- Tag for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
-          tag: v2.9.2
-        resizer:
-          # -- Repository for the CSI Resizer image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-resizer
-          # -- Tag for the CSI Resizer image. When unspecified, Longhorn uses the default value.
-          tag: v1.9.2
-        snapshotter:
-          # -- Repository for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-snapshotter
-          # -- Tag for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
-          tag: v6.3.2
-        livenessProbe:
-          # -- Repository for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/livenessprobe
-          # -- Tag for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
-          tag: v2.12.0
-      openshift:
-        oauthProxy:
-          # -- Repository for the OAuth Proxy image. This setting applies only to OpenShift users.
-          repository: quay.io/openshift/origin-oauth-proxy
-          # -- Tag for the OAuth Proxy image. This setting applies only to OpenShift users. Specify OCP/OKD version 4.1 or later. The latest stable version is 4.14.
-          tag: 4.14
-      # -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
-      pullPolicy: IfNotPresent
 
-    service:
+image:
-      ui:
+  longhorn:
-        # -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
+    engine:
-        type: ClusterIP
+      # -- Repository for the Longhorn Engine image.
-        # -- NodePort port number for Longhorn UI. When unspecified, Longhorn selects a free port between 30000 and 32767.
+      repository: longhornio/longhorn-engine
-        nodePort: null
+      # -- Specify Longhorn engine image tag
-      manager:
+      tag: v1.6.1
-        # -- Service type for Longhorn Manager.
+    manager:
-        type: ClusterIP
+      # -- Repository for the Longhorn Manager image.
-        # -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
+      repository: longhornio/longhorn-manager
-        nodePort: ""
+      # -- Specify Longhorn manager image tag
+      tag: v1.6.1
+    ui:
+      # -- Repository for the Longhorn UI image.
+      repository: longhornio/longhorn-ui
+      # -- Specify Longhorn ui image tag
+      tag: v1.6.1
+    instanceManager:
+      # -- Repository for the Longhorn Instance Manager image.
+      repository: longhornio/longhorn-instance-manager
+      # -- Specify Longhorn instance manager image tag
+      tag: v1.6.1
+    shareManager:
+      # -- Repository for the Longhorn Share Manager image.
+      repository: longhornio/longhorn-share-manager
+      # -- Specify Longhorn share manager image tag
+      tag: v1.6.1
+    backingImageManager:
+      # -- Repository for the Backing Image Manager image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/backing-image-manager
+      # -- Specify Longhorn backing image manager image tag
+      tag: v1.6.1
+    supportBundleKit:
+      # -- Repository for the Longhorn Support Bundle Manager image.
+      repository: longhornio/support-bundle-kit
+      # -- Tag for the Longhorn Support Bundle Manager image.
+      tag: v0.0.36
+  csi:
+    attacher:
+      # -- Repository for the CSI attacher image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-attacher
+      # -- Tag for the CSI attacher image. When unspecified, Longhorn uses the default value.
+      tag: v4.4.2
+    provisioner:
+      # -- Repository for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-provisioner
+      # -- Tag for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
+      tag: v3.6.2
+    nodeDriverRegistrar:
+      # -- Repository for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-node-driver-registrar
+      # -- Tag for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
+      tag: v2.9.2
+    resizer:
+      # -- Repository for the CSI Resizer image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-resizer
+      # -- Tag for the CSI Resizer image. When unspecified, Longhorn uses the default value.
+      tag: v1.9.2
+    snapshotter:
+      # -- Repository for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-snapshotter
+      # -- Tag for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
+      tag: v6.3.2
+    livenessProbe:
+      # -- Repository for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/livenessprobe
+      # -- Tag for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
+      tag: v2.12.0
+  openshift:
+    oauthProxy:
+      # -- Repository for the OAuth Proxy image. This setting applies only to OpenShift users.
+      repository: quay.io/openshift/origin-oauth-proxy
+      # -- Tag for the OAuth Proxy image. This setting applies only to OpenShift users. Specify OCP/OKD version 4.1 or later. The latest stable version is 4.14.
+      tag: 4.14
+  # -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
+  pullPolicy: IfNotPresent
 
-    persistence:
+service:
-      # -- Setting that allows you to specify the default Longhorn StorageClass.
+  ui:
-      defaultClass: true
+    # -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
-      # -- Filesystem type of the default Longhorn StorageClass.
+    type: ClusterIP
-      defaultFsType: ext4
+    # -- NodePort port number for Longhorn UI. When unspecified, Longhorn selects a free port between 30000 and 32767.
-      # -- mkfs parameters of the default Longhorn StorageClass.
+    nodePort: null
-      defaultMkfsParams: ""
+  manager:
-      # -- Replica count of the default Longhorn StorageClass.
+    # -- Service type for Longhorn Manager.
-      defaultClassReplicaCount: 3
+    type: ClusterIP
-      # -- Data locality of the default Longhorn StorageClass. (Options: "disabled", "best-effort")
+    # -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
-      defaultDataLocality: disabled
+    nodePort: ""
-      # -- Reclaim policy that provides instructions for handling of a volume after its claim is released. (Options: "Retain", "Delete")
-      reclaimPolicy: Delete
-      # -- Setting that allows you to enable live migration of a Longhorn volume from one node to another.
-      migratable: false
-      # -- Set NFS mount options for Longhorn StorageClass for RWX volumes
-      nfsOptions: ""
-      recurringJobSelector:
-        # -- Setting that allows you to enable the recurring job selector for a Longhorn StorageClass.
-        enable: false
-        # -- Recurring job selector for a Longhorn StorageClass. Ensure that quotes are used correctly when specifying job parameters. (Example: `[{"name":"backup", "isGroup":true}]`)
-        jobList: []
-      backingImage:
-        # -- Setting that allows you to use a backing image in a Longhorn StorageClass.
-        enable: false
-        # -- Backing image to be used for creating and restoring volumes in a Longhorn StorageClass. When no backing images are available, specify the data source type and parameters that Longhorn can use to create a backing image.
-        name: ~
-        # -- Data source type of a backing image used in a Longhorn StorageClass.
-        # If the backing image exists in the cluster, Longhorn uses this setting to verify the image.
-        # If the backing image does not exist, Longhorn creates one using the specified data source type.
-        dataSourceType: ~
-        # -- Data source parameters of a backing image used in a Longhorn StorageClass.
-        # You can specify a JSON string of a map. (Example: `'{\"url\":\"https://backing-image-example.s3-region.amazonaws.com/test-backing-image\"}'`)
-        dataSourceParameters: ~
-        # -- Expected SHA-512 checksum of a backing image used in a Longhorn StorageClass.
-        expectedChecksum: ~
-      defaultNodeSelector:
-        # -- Setting that allows you to enable the node selector for the default Longhorn StorageClass.
-        enable: false
-        # -- Node selector for the default Longhorn StorageClass. Longhorn uses only nodes with the specified tags for storing volume data. (Examples: "storage,fast")
-        selector: ""
-      # -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
-      removeSnapshotsDuringFilesystemTrim: ignored
 
-    preUpgradeChecker:
+persistence:
-      # -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
+  # -- Setting that allows you to specify the default Longhorn StorageClass.
-      jobEnabled: true
+  defaultClass: true
-      # -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
+  # -- Filesystem type of the default Longhorn StorageClass.
-      upgradeVersionCheck: true
+  defaultFsType: ext4
+  # -- mkfs parameters of the default Longhorn StorageClass.
+  defaultMkfsParams: ""
+  # -- Replica count of the default Longhorn StorageClass.
+  defaultClassReplicaCount: 3
+  # -- Data locality of the default Longhorn StorageClass. (Options: "disabled", "best-effort")
+  defaultDataLocality: disabled
+  # -- Reclaim policy that provides instructions for handling of a volume after its claim is released. (Options: "Retain", "Delete")
+  reclaimPolicy: Delete
+  # -- Setting that allows you to enable live migration of a Longhorn volume from one node to another.
+  migratable: false
+  # -- Set NFS mount options for Longhorn StorageClass for RWX volumes
+  nfsOptions: ""
+  recurringJobSelector:
+    # -- Setting that allows you to enable the recurring job selector for a Longhorn StorageClass.
+    enable: false
+    # -- Recurring job selector for a Longhorn StorageClass. Ensure that quotes are used correctly when specifying job parameters. (Example: `[{"name":"backup", "isGroup":true}]`)
+    jobList: []
+  backingImage:
+    # -- Setting that allows you to use a backing image in a Longhorn StorageClass.
+    enable: false
+    # -- Backing image to be used for creating and restoring volumes in a Longhorn StorageClass. When no backing images are available, specify the data source type and parameters that Longhorn can use to create a backing image.
+    name: ~
+    # -- Data source type of a backing image used in a Longhorn StorageClass.
+    # If the backing image exists in the cluster, Longhorn uses this setting to verify the image.
+    # If the backing image does not exist, Longhorn creates one using the specified data source type.
+    dataSourceType: ~
+    # -- Data source parameters of a backing image used in a Longhorn StorageClass.
+    # You can specify a JSON string of a map. (Example: `'{\"url\":\"https://backing-image-example.s3-region.amazonaws.com/test-backing-image\"}'`)
+    dataSourceParameters: ~
+    # -- Expected SHA-512 checksum of a backing image used in a Longhorn StorageClass.
+    expectedChecksum: ~
+  defaultNodeSelector:
+    # -- Setting that allows you to enable the node selector for the default Longhorn StorageClass.
+    enable: false
+    # -- Node selector for the default Longhorn StorageClass. Longhorn uses only nodes with the specified tags for storing volume data. (Examples: "storage,fast")
+    selector: ""
+  # -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
+  removeSnapshotsDuringFilesystemTrim: ignored
 
-    csi:
+preUpgradeChecker:
-      # -- kubelet root directory. When unspecified, Longhorn uses the default value.
+  # -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
-      kubeletRootDir: ~
+  jobEnabled: true
-      # -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
+  # -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
-      attacherReplicaCount: ~
+  upgradeVersionCheck: true
-      # -- Replica count of the CSI Provisioner. When unspecified, Longhorn uses the default value ("3").
-      provisionerReplicaCount: ~
-      # -- Replica count of the CSI Resizer. When unspecified, Longhorn uses the default value ("3").
-      resizerReplicaCount: ~
-      # -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
-      snapshotterReplicaCount: ~
 
-    defaultSettings:
+csi:
-      # -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
+  # -- kubelet root directory. When unspecified, Longhorn uses the default value.
-      backupTarget: ~
+  kubeletRootDir: ~
-      # -- Name of the Kubernetes secret associated with the backup target.
+  # -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
-      backupTargetCredentialSecret: ~
+  attacherReplicaCount: ~
-      # -- Setting that allows Longhorn to automatically attach a volume and create snapshots or backups when recurring jobs are run.
+  # -- Replica count of the CSI Provisioner. When unspecified, Longhorn uses the default value ("3").
-      allowRecurringJobWhileVolumeDetached: ~
+  provisionerReplicaCount: ~
-      # -- Setting that allows Longhorn to automatically create a default disk only on nodes with the label "node.longhorn.io/create-default-disk=true" (if no other disks exist). When this setting is disabled, Longhorn creates a default disk on each node that is added to the cluster.
+  # -- Replica count of the CSI Resizer. When unspecified, Longhorn uses the default value ("3").
-      createDefaultDiskLabeledNodes: ~
+  resizerReplicaCount: ~
-      # -- Default path for storing data on a host. The default value is "/var/lib/longhorn/".
+  # -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
-      defaultDataPath: ~
+  snapshotterReplicaCount: ~
-      # -- Default data locality. A Longhorn volume has data locality if a local replica of the volume exists on the same node as the pod that is using the volume.
-      defaultDataLocality: ~
-      # -- Setting that allows scheduling on nodes with healthy replicas of the same volume. This setting is disabled by default.
-      replicaSoftAntiAffinity: ~
-      # -- Setting that automatically rebalances replicas when an available node is discovered.
-      replicaAutoBalance: ~
-      # -- Percentage of storage that can be allocated relative to hard drive capacity. The default value is "100".
-      storageOverProvisioningPercentage: ~
-      # -- Percentage of minimum available disk capacity. When the minimum available capacity exceeds the total available capacity, the disk becomes unschedulable until more space is made available for use. The default value is "25".
-      storageMinimalAvailablePercentage: ~
-      # -- Percentage of disk space that is not allocated to the default disk on each new Longhorn node.
-      storageReservedPercentageForDefaultDisk: ~
-      # -- Upgrade Checker that periodically checks for new Longhorn versions. When a new version is available, a notification appears on the Longhorn UI. This setting is enabled by default
-      upgradeChecker: ~
-      # -- Default number of replicas for volumes created using the Longhorn UI. For Kubernetes configuration, modify the `numberOfReplicas` field in the StorageClass. The default value is "3".
-      defaultReplicaCount: ~
-      # -- Default Longhorn StorageClass. "storageClassName" is assigned to PVs and PVCs that are created for an existing Longhorn volume. "storageClassName" can also be used as a label, so it is possible to use a Longhorn StorageClass to bind a workload to an existing PV without creating a Kubernetes StorageClass object. The default value is "longhorn-static".
-      defaultLonghornStaticStorageClass: ~
-      # -- Number of seconds that Longhorn waits before checking the backupstore for new backups. The default value is "300". When the value is "0", polling is disabled.
-      backupstorePollInterval: ~
-      # -- Number of minutes that Longhorn keeps a failed backup resource. When the value is "0", automatic deletion is disabled.
-      failedBackupTTL: ~
-      # -- Setting that restores recurring jobs from a backup volume on a backup target and creates recurring jobs if none exist during backup restoration.
-      restoreVolumeRecurringJobs: ~
-      # -- Maximum number of successful recurring backup and snapshot jobs to be retained. When the value is "0", a history of successful recurring jobs is not retained.
-      recurringSuccessfulJobsHistoryLimit: ~
-      # -- Maximum number of failed recurring backup and snapshot jobs to be retained. When the value is "0", a history of failed recurring jobs is not retained.
-      recurringFailedJobsHistoryLimit: ~
-      # -- Maximum number of snapshots or backups to be retained.
-      recurringJobMaxRetention: ~
-      # -- Maximum number of failed support bundles that can exist in the cluster. When the value is "0", Longhorn automatically purges all failed support bundles.
-      supportBundleFailedHistoryLimit: ~
-      # -- Taint or toleration for system-managed Longhorn components.
-      taintToleration: ~
-      # -- Node selector for system-managed Longhorn components.
-      systemManagedComponentsNodeSelector: ~
-      # -- PriorityClass for system-managed Longhorn components.
-      # This setting can help prevent Longhorn components from being evicted under Node Pressure.
-      # Notice that this will be applied to Longhorn user-deployed components by default if there are no priority class values set yet, such as `longhornManager.priorityClass`.
-      priorityClass: &defaultPriorityClassNameRef "longhorn-critical"
-      # -- Setting that allows Longhorn to automatically salvage volumes when all replicas become faulty (for example, when the network connection is interrupted). Longhorn determines which replicas are usable and then uses these replicas for the volume. This setting is enabled by default.
-      autoSalvage: ~
-      # -- Setting that allows Longhorn to automatically delete a workload pod that is managed by a controller (for example, daemonset) whenever a Longhorn volume is detached unexpectedly (for example, during Kubernetes upgrades). After deletion, the controller restarts the pod and then Kubernetes handles volume reattachment and remounting.
-      autoDeletePodWhenVolumeDetachedUnexpectedly: ~
-      # -- Setting that prevents Longhorn Manager from scheduling replicas on a cordoned Kubernetes node. This setting is enabled by default.
-      disableSchedulingOnCordonedNode: ~
-      # -- Setting that allows Longhorn to schedule new replicas of a volume to nodes in the same zone as existing healthy replicas. Nodes that do not belong to any zone are treated as existing in the zone that contains healthy replicas. When identifying zones, Longhorn relies on the label "topology.kubernetes.io/zone=<Zone name of the node>" in the Kubernetes node object.
-      replicaZoneSoftAntiAffinity: ~
-      # -- Setting that allows scheduling on disks with existing healthy replicas of the same volume. This setting is enabled by default.
-      replicaDiskSoftAntiAffinity: ~
-      # -- Policy that defines the action Longhorn takes when a volume is stuck with a StatefulSet or Deployment pod on a node that failed.
-      nodeDownPodDeletionPolicy: ~
-      # -- Policy that defines the action Longhorn takes when a node with the last healthy replica of a volume is drained.
-      nodeDrainPolicy: ~
-      # -- Setting that allows automatic detaching of manually-attached volumes when a node is cordoned.
-      detachManuallyAttachedVolumesWhenCordoned: ~
-      # -- Number of seconds that Longhorn waits before reusing existing data on a failed replica instead of creating a new replica of a degraded volume.
-      replicaReplenishmentWaitInterval: ~
-      # -- Maximum number of replicas that can be concurrently rebuilt on each node.
-      concurrentReplicaRebuildPerNodeLimit: ~
-      # -- Maximum number of volumes that can be concurrently restored on each node using a backup. When the value is "0", restoration of volumes using a backup is disabled.
-      concurrentVolumeBackupRestorePerNodeLimit: ~
-      # -- Setting that disables the revision counter and thereby prevents Longhorn from tracking all write operations to a volume. When salvaging a volume, Longhorn uses properties of the "volume-head-xxx.img" file (the last file size and the last time the file was modified) to select the replica to be used for volume recovery. This setting applies only to volumes created using the Longhorn UI.
-      disableRevisionCounter: ~
-      # -- Image pull policy for system-managed pods, such as Instance Manager, engine images, and CSI Driver. Changes to the image pull policy are applied only after the system-managed pods restart.
-      systemManagedPodsImagePullPolicy: ~
-      # -- Setting that allows you to create and attach a volume without having all replicas scheduled at the time of creation.
-      allowVolumeCreationWithDegradedAvailability: ~
-      # -- Setting that allows Longhorn to automatically clean up the system-generated snapshot after replica rebuilding is completed.
-      autoCleanupSystemGeneratedSnapshot: ~
-      # -- Setting that allows Longhorn to automatically clean up the snapshot generated by a recurring backup job.
-      autoCleanupRecurringJobBackupSnapshot: ~
-      # -- Maximum number of engines that are allowed to concurrently upgrade on each node after Longhorn Manager is upgraded. When the value is "0", Longhorn does not automatically upgrade volume engines to the new default engine image version.
-      concurrentAutomaticEngineUpgradePerNodeLimit: ~
-      # -- Number of minutes that Longhorn waits before cleaning up the backing image file when no replicas in the disk are using it.
-      backingImageCleanupWaitInterval: ~
-      # -- Number of seconds that Longhorn waits before downloading a backing image file again when the status of all image disk files changes to "failed" or "unknown".
-      backingImageRecoveryWaitInterval: ~
-      # -- Percentage of the total allocatable CPU resources on each node to be reserved for each instance manager pod when the V1 Data Engine is enabled. The default value is "12".
-      guaranteedInstanceManagerCPU: ~
-      # -- Setting that notifies Longhorn that the cluster is using the Kubernetes Cluster Autoscaler.
-      kubernetesClusterAutoscalerEnabled: ~
-      # -- Setting that allows Longhorn to automatically delete an orphaned resource and the corresponding data (for example, stale replicas). Orphaned resources on failed or unknown nodes are not automatically cleaned up.
-      orphanAutoDeletion: ~
-      # -- Storage network for in-cluster traffic. When unspecified, Longhorn uses the Kubernetes cluster network.
-      storageNetwork: ~
-      # -- Flag that prevents accidental uninstallation of Longhorn.
-      deletingConfirmationFlag: ~
-      # -- Timeout between the Longhorn Engine and replicas. Specify a value between "8" and "30" seconds. The default value is "8".
-      engineReplicaTimeout: ~
-      # -- Setting that allows you to enable and disable snapshot hashing and data integrity checks.
-      snapshotDataIntegrity: ~
-      # -- Setting that allows disabling of snapshot hashing after snapshot creation to minimize impact on system performance.
-      snapshotDataIntegrityImmediateCheckAfterSnapshotCreation: ~
-      # -- Setting that defines when Longhorn checks the integrity of data in snapshot disk files. You must use the Unix cron expression format.
-      snapshotDataIntegrityCronjob: ~
-      # -- Setting that allows Longhorn to automatically mark the latest snapshot and its parent files as removed during a filesystem trim. Longhorn does not remove snapshots containing multiple child files.
-      removeSnapshotsDuringFilesystemTrim: ~
-      # -- Setting that allows fast rebuilding of replicas using the checksum of snapshot disk files. Before enabling this setting, you must set the snapshot-data-integrity value to "enable" or "fast-check".
-      fastReplicaRebuildEnabled: ~
-      # -- Number of seconds that an HTTP client waits for a response from a File Sync server before considering the connection to have failed.
-      replicaFileSyncHttpClientTimeout: ~
-      # -- Log levels that indicate the type and severity of logs in Longhorn Manager. The default value is "Info". (Options: "Panic", "Fatal", "Error", "Warn", "Info", "Debug", "Trace")
-      logLevel: ~
-      # -- Setting that allows you to specify a backup compression method.
-      backupCompressionMethod: ~
-      # -- Maximum number of worker threads that can concurrently run for each backup.
-      backupConcurrentLimit: ~
-      # -- Maximum number of worker threads that can concurrently run for each restore operation.
-      restoreConcurrentLimit: ~
-      # -- Setting that allows you to enable the V1 Data Engine.
-      v1DataEngine: ~
-      # -- Setting that allows you to enable the V2 Data Engine, which is based on the Storage Performance Development Kit (SPDK). The V2 Data Engine is a preview feature and should not be used in production environments.
-      v2DataEngine: ~
-      # -- Setting that allows you to configure maximum huge page size (in MiB) for the V2 Data Engine.
-      v2DataEngineHugepageLimit: ~
-      # -- Setting that allows rebuilding of offline replicas for volumes using the V2 Data Engine.
-      offlineReplicaRebuilding: ~
-      # -- Number of millicpus on each node to be reserved for each Instance Manager pod when the V2 Data Engine is enabled. The default value is "1250".
-      v2DataEngineGuaranteedInstanceManagerCPU: ~
-      # -- Setting that allows scheduling of empty node selector volumes to any node.
-      allowEmptyNodeSelectorVolume: ~
-      # -- Setting that allows scheduling of empty disk selector volumes to any disk.
-      allowEmptyDiskSelectorVolume: ~
-      # -- Setting that allows Longhorn to periodically collect anonymous usage data for product improvement purposes. Longhorn sends collected data to the [Upgrade Responder](https://github.com/longhorn/upgrade-responder) server, which is the data source of the Longhorn Public Metrics Dashboard (https://metrics.longhorn.io). The Upgrade Responder server does not store data that can be used to identify clients, including IP addresses.
-      allowCollectingLonghornUsageMetrics: ~
-      # -- Setting that temporarily prevents all attempts to purge volume snapshots.
-      disableSnapshotPurge: ~
-      # -- Maximum snapshot count for a volume. The value should be between 2 to 250
-      snapshotMaxCount: ~
 
-    privateRegistry:
+defaultSettings:
-      # -- Setting that allows you to create a private registry secret.
+  # -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
-      createSecret: ~
+  backupTarget: ~
-      # -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
+  # -- Name of the Kubernetes secret associated with the backup target.
-      registryUrl: ~
+  backupTargetCredentialSecret: ~
-      # -- User account used for authenticating with a private registry.
+  # -- Setting that allows Longhorn to automatically attach a volume and create snapshots or backups when recurring jobs are run.
-      registryUser: ~
+  allowRecurringJobWhileVolumeDetached: ~
-      # -- Password for authenticating with a private registry.
+  # -- Setting that allows Longhorn to automatically create a default disk only on nodes with the label "node.longhorn.io/create-default-disk=true" (if no other disks exist). When this setting is disabled, Longhorn creates a default disk on each node that is added to the cluster.
-      registryPasswd: ~
+  createDefaultDiskLabeledNodes: ~
-      # -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
+  # -- Default path for storing data on a host. The default value is "/var/lib/longhorn/".
-      registrySecret: ~
+  defaultDataPath: ~
+  # -- Default data locality. A Longhorn volume has data locality if a local replica of the volume exists on the same node as the pod that is using the volume.
+  defaultDataLocality: ~
+  # -- Setting that allows scheduling on nodes with healthy replicas of the same volume. This setting is disabled by default.
+  replicaSoftAntiAffinity: ~
+  # -- Setting that automatically rebalances replicas when an available node is discovered.
+  replicaAutoBalance: ~
+  # -- Percentage of storage that can be allocated relative to hard drive capacity. The default value is "100".
+  storageOverProvisioningPercentage: ~
+  # -- Percentage of minimum available disk capacity. When the minimum available capacity exceeds the total available capacity, the disk becomes unschedulable until more space is made available for use. The default value is "25".
+  storageMinimalAvailablePercentage: ~
+  # -- Percentage of disk space that is not allocated to the default disk on each new Longhorn node.
+  storageReservedPercentageForDefaultDisk: ~
+  # -- Upgrade Checker that periodically checks for new Longhorn versions. When a new version is available, a notification appears on the Longhorn UI. This setting is enabled by default
+  upgradeChecker: ~
+  # -- Default number of replicas for volumes created using the Longhorn UI. For Kubernetes configuration, modify the `numberOfReplicas` field in the StorageClass. The default value is "3".
+  defaultReplicaCount: ~
+  # -- Default Longhorn StorageClass. "storageClassName" is assigned to PVs and PVCs that are created for an existing Longhorn volume. "storageClassName" can also be used as a label, so it is possible to use a Longhorn StorageClass to bind a workload to an existing PV without creating a Kubernetes StorageClass object. The default value is "longhorn-static".
+  defaultLonghornStaticStorageClass: ~
+  # -- Number of seconds that Longhorn waits before checking the backupstore for new backups. The default value is "300". When the value is "0", polling is disabled.
+  backupstorePollInterval: ~
+  # -- Number of minutes that Longhorn keeps a failed backup resource. When the value is "0", automatic deletion is disabled.
+  failedBackupTTL: ~
+  # -- Setting that restores recurring jobs from a backup volume on a backup target and creates recurring jobs if none exist during backup restoration.
+  restoreVolumeRecurringJobs: ~
+  # -- Maximum number of successful recurring backup and snapshot jobs to be retained. When the value is "0", a history of successful recurring jobs is not retained.
+  recurringSuccessfulJobsHistoryLimit: ~
+  # -- Maximum number of failed recurring backup and snapshot jobs to be retained. When the value is "0", a history of failed recurring jobs is not retained.
+  recurringFailedJobsHistoryLimit: ~
+  # -- Maximum number of snapshots or backups to be retained.
+  recurringJobMaxRetention: ~
+  # -- Maximum number of failed support bundles that can exist in the cluster. When the value is "0", Longhorn automatically purges all failed support bundles.
+  supportBundleFailedHistoryLimit: ~
+  # -- Taint or toleration for system-managed Longhorn components.
+  taintToleration: ~
+  # -- Node selector for system-managed Longhorn components.
+  systemManagedComponentsNodeSelector: ~
+  # -- PriorityClass for system-managed Longhorn components.
+  # This setting can help prevent Longhorn components from being evicted under Node Pressure.
+  # Notice that this will be applied to Longhorn user-deployed components by default if there are no priority class values set yet, such as `longhornManager.priorityClass`.
+  priorityClass: &defaultPriorityClassNameRef "longhorn-critical"
+  # -- Setting that allows Longhorn to automatically salvage volumes when all replicas become faulty (for example, when the network connection is interrupted). Longhorn determines which replicas are usable and then uses these replicas for the volume. This setting is enabled by default.
+  autoSalvage: ~
+  # -- Setting that allows Longhorn to automatically delete a workload pod that is managed by a controller (for example, daemonset) whenever a Longhorn volume is detached unexpectedly (for example, during Kubernetes upgrades). After deletion, the controller restarts the pod and then Kubernetes handles volume reattachment and remounting.
+  autoDeletePodWhenVolumeDetachedUnexpectedly: ~
+  # -- Setting that prevents Longhorn Manager from scheduling replicas on a cordoned Kubernetes node. This setting is enabled by default.
+  disableSchedulingOnCordonedNode: ~
+  # -- Setting that allows Longhorn to schedule new replicas of a volume to nodes in the same zone as existing healthy replicas. Nodes that do not belong to any zone are treated as existing in the zone that contains healthy replicas. When identifying zones, Longhorn relies on the label "topology.kubernetes.io/zone=<Zone name of the node>" in the Kubernetes node object.
+  replicaZoneSoftAntiAffinity: ~
+  # -- Setting that allows scheduling on disks with existing healthy replicas of the same volume. This setting is enabled by default.
+  replicaDiskSoftAntiAffinity: ~
+  # -- Policy that defines the action Longhorn takes when a volume is stuck with a StatefulSet or Deployment pod on a node that failed.
+  nodeDownPodDeletionPolicy: ~
+  # -- Policy that defines the action Longhorn takes when a node with the last healthy replica of a volume is drained.
+  nodeDrainPolicy: ~
+  # -- Setting that allows automatic detaching of manually-attached volumes when a node is cordoned.
+  detachManuallyAttachedVolumesWhenCordoned: ~
+  # -- Number of seconds that Longhorn waits before reusing existing data on a failed replica instead of creating a new replica of a degraded volume.
+  replicaReplenishmentWaitInterval: ~
+  # -- Maximum number of replicas that can be concurrently rebuilt on each node.
+  concurrentReplicaRebuildPerNodeLimit: ~
+  # -- Maximum number of volumes that can be concurrently restored on each node using a backup. When the value is "0", restoration of volumes using a backup is disabled.
+  concurrentVolumeBackupRestorePerNodeLimit: ~
+  # -- Setting that disables the revision counter and thereby prevents Longhorn from tracking all write operations to a volume. When salvaging a volume, Longhorn uses properties of the "volume-head-xxx.img" file (the last file size and the last time the file was modified) to select the replica to be used for volume recovery. This setting applies only to volumes created using the Longhorn UI.
+  disableRevisionCounter: ~
+  # -- Image pull policy for system-managed pods, such as Instance Manager, engine images, and CSI Driver. Changes to the image pull policy are applied only after the system-managed pods restart.
+  systemManagedPodsImagePullPolicy: ~
+  # -- Setting that allows you to create and attach a volume without having all replicas scheduled at the time of creation.
+  allowVolumeCreationWithDegradedAvailability: ~
+  # -- Setting that allows Longhorn to automatically clean up the system-generated snapshot after replica rebuilding is completed.
+  autoCleanupSystemGeneratedSnapshot: ~
+  # -- Setting that allows Longhorn to automatically clean up the snapshot generated by a recurring backup job.
+  autoCleanupRecurringJobBackupSnapshot: ~
+  # -- Maximum number of engines that are allowed to concurrently upgrade on each node after Longhorn Manager is upgraded. When the value is "0", Longhorn does not automatically upgrade volume engines to the new default engine image version.
+  concurrentAutomaticEngineUpgradePerNodeLimit: ~
+  # -- Number of minutes that Longhorn waits before cleaning up the backing image file when no replicas in the disk are using it.
+  backingImageCleanupWaitInterval: ~
+  # -- Number of seconds that Longhorn waits before downloading a backing image file again when the status of all image disk files changes to "failed" or "unknown".
+  backingImageRecoveryWaitInterval: ~
+  # -- Percentage of the total allocatable CPU resources on each node to be reserved for each instance manager pod when the V1 Data Engine is enabled. The default value is "12".
+  guaranteedInstanceManagerCPU: ~
+  # -- Setting that notifies Longhorn that the cluster is using the Kubernetes Cluster Autoscaler.
+  kubernetesClusterAutoscalerEnabled: ~
+  # -- Setting that allows Longhorn to automatically delete an orphaned resource and the corresponding data (for example, stale replicas). Orphaned resources on failed or unknown nodes are not automatically cleaned up.
+  orphanAutoDeletion: ~
+  # -- Storage network for in-cluster traffic. When unspecified, Longhorn uses the Kubernetes cluster network.
+  storageNetwork: ~
+  # -- Flag that prevents accidental uninstallation of Longhorn.
+  deletingConfirmationFlag: ~
+  # -- Timeout between the Longhorn Engine and replicas. Specify a value between "8" and "30" seconds. The default value is "8".
+  engineReplicaTimeout: ~
+  # -- Setting that allows you to enable and disable snapshot hashing and data integrity checks.
+  snapshotDataIntegrity: ~
+  # -- Setting that allows disabling of snapshot hashing after snapshot creation to minimize impact on system performance.
+  snapshotDataIntegrityImmediateCheckAfterSnapshotCreation: ~
+  # -- Setting that defines when Longhorn checks the integrity of data in snapshot disk files. You must use the Unix cron expression format.
+  snapshotDataIntegrityCronjob: ~
+  # -- Setting that allows Longhorn to automatically mark the latest snapshot and its parent files as removed during a filesystem trim. Longhorn does not remove snapshots containing multiple child files.
+  removeSnapshotsDuringFilesystemTrim: ~
+  # -- Setting that allows fast rebuilding of replicas using the checksum of snapshot disk files. Before enabling this setting, you must set the snapshot-data-integrity value to "enable" or "fast-check".
+  fastReplicaRebuildEnabled: ~
+  # -- Number of seconds that an HTTP client waits for a response from a File Sync server before considering the connection to have failed.
+  replicaFileSyncHttpClientTimeout: ~
+  # -- Log levels that indicate the type and severity of logs in Longhorn Manager. The default value is "Info". (Options: "Panic", "Fatal", "Error", "Warn", "Info", "Debug", "Trace")
+  logLevel: ~
+  # -- Setting that allows you to specify a backup compression method.
+  backupCompressionMethod: ~
+  # -- Maximum number of worker threads that can concurrently run for each backup.
+  backupConcurrentLimit: ~
+  # -- Maximum number of worker threads that can concurrently run for each restore operation.
+  restoreConcurrentLimit: ~
+  # -- Setting that allows you to enable the V1 Data Engine.
+  v1DataEngine: ~
+  # -- Setting that allows you to enable the V2 Data Engine, which is based on the Storage Performance Development Kit (SPDK). The V2 Data Engine is a preview feature and should not be used in production environments.
+  v2DataEngine: ~
+  # -- Setting that allows you to configure maximum huge page size (in MiB) for the V2 Data Engine.
+  v2DataEngineHugepageLimit: ~
+  # -- Setting that allows rebuilding of offline replicas for volumes using the V2 Data Engine.
+  offlineReplicaRebuilding: ~
+  # -- Number of millicpus on each node to be reserved for each Instance Manager pod when the V2 Data Engine is enabled. The default value is "1250".
+  v2DataEngineGuaranteedInstanceManagerCPU: ~
+  # -- Setting that allows scheduling of empty node selector volumes to any node.
+  allowEmptyNodeSelectorVolume: ~
+  # -- Setting that allows scheduling of empty disk selector volumes to any disk.
+  allowEmptyDiskSelectorVolume: ~
+  # -- Setting that allows Longhorn to periodically collect anonymous usage data for product improvement purposes. Longhorn sends collected data to the [Upgrade Responder](https://github.com/longhorn/upgrade-responder) server, which is the data source of the Longhorn Public Metrics Dashboard (https://metrics.longhorn.io). The Upgrade Responder server does not store data that can be used to identify clients, including IP addresses.
+  allowCollectingLonghornUsageMetrics: ~
+  # -- Setting that temporarily prevents all attempts to purge volume snapshots.
+  disableSnapshotPurge: ~
+  # -- Maximum snapshot count for a volume. The value should be between 2 to 250
+  snapshotMaxCount: ~
 
-    longhornManager:
+privateRegistry:
-      log:
+  # -- Setting that allows you to create a private registry secret.
-        # -- Format of Longhorn Manager logs. (Options: "plain", "json")
+  createSecret: ~
-        format: plain
+  # -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
-      # -- PriorityClass for Longhorn Manager.
+  registryUrl: ~
-      priorityClass: *defaultPriorityClassNameRef
+  # -- User account used for authenticating with a private registry.
-      # -- Toleration for Longhorn Manager on nodes allowed to run Longhorn Manager.
+  registryUser: ~
-      tolerations: []
+  # -- Password for authenticating with a private registry.
-      ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
+  registryPasswd: ~
-      ## and uncomment this example block
+  # -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
-      # - key: "key"
+  registrySecret: ~
-      #   operator: "Equal"
-      #   value: "value"
-      #   effect: "NoSchedule"
-      # -- Node selector for Longhorn Manager. Specify the nodes allowed to run Longhorn Manager.
-      nodeSelector: {}
-      ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
-      ## and uncomment this example block
-      #  label-key1: "label-value1"
-      #  label-key2: "label-value2"
-      # -- Annotation for the Longhorn Manager service.
-      serviceAnnotations: {}
-      ## If you want to set annotations for the Longhorn Manager service, delete the `{}` in the line above
-      ## and uncomment this example block
-      #  annotation-key1: "annotation-value1"
-      #  annotation-key2: "annotation-value2"
 
-    longhornDriver:
+longhornManager:
-      # -- PriorityClass for Longhorn Driver.
+  log:
-      priorityClass: *defaultPriorityClassNameRef
+    # -- Format of Longhorn Manager logs. (Options: "plain", "json")
-      # -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
+    format: plain
-      tolerations: []
+  # -- PriorityClass for Longhorn Manager.
-      ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
+  priorityClass: *defaultPriorityClassNameRef
-      ## and uncomment this example block
+  # -- Toleration for Longhorn Manager on nodes allowed to run Longhorn Manager.
-      # - key: "key"
+  tolerations: []
-      #   operator: "Equal"
+  ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
-      #   value: "value"
+  ## and uncomment this example block
-      #   effect: "NoSchedule"
+  # - key: "key"
-      # -- Node selector for Longhorn Driver. Specify the nodes allowed to run Longhorn Driver.
+  #   operator: "Equal"
-      nodeSelector: {}
+  #   value: "value"
-      ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
+  #   effect: "NoSchedule"
-      ## and uncomment this example block
+  # -- Node selector for Longhorn Manager. Specify the nodes allowed to run Longhorn Manager.
-      #  label-key1: "label-value1"
+  nodeSelector: {}
-      #  label-key2: "label-value2"
+  ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
+  ## and uncomment this example block
+  #  label-key1: "label-value1"
+  #  label-key2: "label-value2"
+  # -- Annotation for the Longhorn Manager service.
+  serviceAnnotations: {}
+  ## If you want to set annotations for the Longhorn Manager service, delete the `{}` in the line above
+  ## and uncomment this example block
+  #  annotation-key1: "annotation-value1"
+  #  annotation-key2: "annotation-value2"
 
-    longhornUI:
+longhornDriver:
-      # -- Replica count for Longhorn UI.
+  # -- PriorityClass for Longhorn Driver.
-      replicas: 2
+  priorityClass: *defaultPriorityClassNameRef
-      # -- PriorityClass for Longhorn UI.
+  # -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
-      priorityClass: *defaultPriorityClassNameRef
+  tolerations: []
-      # -- Toleration for Longhorn UI on nodes allowed to run Longhorn components.
+  ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
-      tolerations: []
+  ## and uncomment this example block
-      ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
+  # - key: "key"
-      ## and uncomment this example block
+  #   operator: "Equal"
-      # - key: "key"
+  #   value: "value"
-      #   operator: "Equal"
+  #   effect: "NoSchedule"
-      #   value: "value"
+  # -- Node selector for Longhorn Driver. Specify the nodes allowed to run Longhorn Driver.
-      #   effect: "NoSchedule"
+  nodeSelector: {}
-      # -- Node selector for Longhorn UI. Specify the nodes allowed to run Longhorn UI.
+  ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
-      nodeSelector: {}
+  ## and uncomment this example block
-      ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
+  #  label-key1: "label-value1"
-      ## and uncomment this example block
+  #  label-key2: "label-value2"
-      #  label-key1: "label-value1"
-      #  label-key2: "label-value2"
 
-    ingress:
+longhornUI:
-      # -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
+  # -- Replica count for Longhorn UI.
-      enabled: false
+  replicas: 2
+  # -- PriorityClass for Longhorn UI.
+  priorityClass: *defaultPriorityClassNameRef
+  # -- Toleration for Longhorn UI on nodes allowed to run Longhorn components.
+  tolerations: []
+  ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
+  ## and uncomment this example block
+  # - key: "key"
+  #   operator: "Equal"
+  #   value: "value"
+  #   effect: "NoSchedule"
+  # -- Node selector for Longhorn UI. Specify the nodes allowed to run Longhorn UI.
+  nodeSelector: {}
+  ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
+  ## and uncomment this example block
+  #  label-key1: "label-value1"
+  #  label-key2: "label-value2"
 
-      # -- IngressClass resource that contains ingress configuration, including the name of the Ingress controller.
+ingress:
-      # ingressClassName can replace the kubernetes.io/ingress.class annotation used in earlier Kubernetes releases.
+  # -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
-      ingressClassName: ~
+  enabled: false
 
-      # -- Hostname of the Layer 7 load balancer.
+  # -- IngressClass resource that contains ingress configuration, including the name of the Ingress controller.
-      host: sslip.io
+  # ingressClassName can replace the kubernetes.io/ingress.class annotation used in earlier Kubernetes releases.
+  ingressClassName: ~
 
-      # -- Setting that allows you to enable TLS on ingress records.
+  # -- Hostname of the Layer 7 load balancer.
-      tls: false
+  host: sslip.io
 
-      # -- Setting that allows you to enable secure connections to the Longhorn UI service via port 443.
+  # -- Setting that allows you to enable TLS on ingress records.
-      secureBackends: false
+  tls: false
 
-      # -- TLS secret that contains the private key and certificate to be used for TLS. This setting applies only when TLS is enabled on ingress records.
+  # -- Setting that allows you to enable secure connections to the Longhorn UI service via port 443.
-      tlsSecret: longhorn.local-tls
+  secureBackends: false
 
-      path: /
+  # -- TLS secret that contains the private key and certificate to be used for TLS. This setting applies only when TLS is enabled on ingress records.
+  tlsSecret: longhorn.local-tls
 
-      ## If you're using kube-lego, you will want to add:
+  path: /
-      ## kubernetes.io/tls-acme: true
-      ##
-      ## For a full list of possible ingress annotations, please see
-      ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
-      ##
-      ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
-      # -- Ingress annotations in the form of key-value pairs.
-      annotations:
-      #  kubernetes.io/ingress.class: nginx
-      #  kubernetes.io/tls-acme: true
 
-      # -- Secret that contains a TLS private key and certificate. Use secrets if you want to use your own certificates to secure ingresses.
+  ## If you're using kube-lego, you will want to add:
-      secrets:
+  ## kubernetes.io/tls-acme: true
-      ## If you're providing your own certificates, please use this to add the certificates as secrets
+  ##
-      ## key and certificate should start with -----BEGIN CERTIFICATE----- or
+  ## For a full list of possible ingress annotations, please see
-      ## -----BEGIN RSA PRIVATE KEY-----
+  ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
-      ##
+  ##
-      ## name should line up with a tlsSecret set further up
+  ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
-      ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
+  # -- Ingress annotations in the form of key-value pairs.
-      ##
+  annotations:
-      ## It is also possible to create and manage the certificates outside of this helm chart
+  #  kubernetes.io/ingress.class: nginx
-      ## Please see README.md for more information
+  #  kubernetes.io/tls-acme: true
-      # - name: longhorn.local-tls
-      #   key:
-      #   certificate:
 
-    # -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
+  # -- Secret that contains a TLS private key and certificate. Use secrets if you want to use your own certificates to secure ingresses.
-    enablePSP: false
+  secrets:
+  ## If you're providing your own certificates, please use this to add the certificates as secrets
+  ## key and certificate should start with -----BEGIN CERTIFICATE----- or
+  ## -----BEGIN RSA PRIVATE KEY-----
+  ##
+  ## name should line up with a tlsSecret set further up
+  ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
+  ##
+  ## It is also possible to create and manage the certificates outside of this helm chart
+  ## Please see README.md for more information
+  # - name: longhorn.local-tls
+  #   key:
+  #   certificate:
 
-    # -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
+# -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
-    namespaceOverride: ""
+enablePSP: false
 
-    # -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
+# -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
-    annotations: {}
+namespaceOverride: ""
 
-    serviceAccount:
+# -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
-      # -- Annotations to add to the service account
+annotations: {}
-      annotations: {}
 
-    metrics:
+serviceAccount:
-      serviceMonitor:
+  # -- Annotations to add to the service account
-        # -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
+  annotations: {}
-        enabled: false
 
-    ## openshift settings
+metrics:
-    openshift:
+  serviceMonitor:
-      # -- Setting that allows Longhorn to integrate with OpenShift.
+    # -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
-      enabled: false
+    enabled: false
-      ui:
-        # -- Route for connections between Longhorn and the OpenShift web console.
-        route: "longhorn-ui"
-        # -- Port for accessing the OpenShift web console.
-        port: 443
-        # -- Port for proxy that provides access to the OpenShift web console.
-        proxy: 8443
 
-    # -- Setting that allows Longhorn to generate code coverage profiles.
+## openshift settings
-    enableGoCoverDir: false
+openshift:
+  # -- Setting that allows Longhorn to integrate with OpenShift.
+  enabled: false
+  ui:
+    # -- Route for connections between Longhorn and the OpenShift web console.
+    route: "longhorn-ui"
+    # -- Port for accessing the OpenShift web console.
+    port: 443
+    # -- Port for proxy that provides access to the OpenShift web console.
+    proxy: 8443
+
+# -- Setting that allows Longhorn to generate code coverage profiles.
+enableGoCoverDir: false

internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl

@@ -1,254 +1,244 @@
-- name: csi-secrets-store
+linux:
-  namespace: kube-system
+  enabled: true
-  chart_ref: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef }}
+  image:
-  chart_version: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion }}
+    repository: registry.k8s.io/csi-secrets-store/driver
-  {{- if .Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled }}
+    tag: v1.4.3
-  release_state: "present"
+    #digest: sha256:
-  {{- else }}
+    pullPolicy: IfNotPresent
-  release_state: "absent"
-  {{- end }}
-  values:
-    linux:
-      enabled: true
-      image:
-        repository: registry.k8s.io/csi-secrets-store/driver
-        tag: v1.4.3
-        #digest: sha256:
-        pullPolicy: IfNotPresent
 
-      crds:
+  crds:
-        enabled: true
+    enabled: true
-        image:
+    image:
-          repository: registry.k8s.io/csi-secrets-store/driver-crds
+      repository: registry.k8s.io/csi-secrets-store/driver-crds
-          tag: v1.4.3
+      tag: v1.4.3
-          pullPolicy: IfNotPresent
+      pullPolicy: IfNotPresent
-        ## Optionally override resource limits for crd hooks(jobs)
+    ## Optionally override resource limits for crd hooks(jobs)
-        resources: {}
+    resources: {}
-          # requests:
+      # requests:
-          #   cpu: "100m"
+      #   cpu: "100m"
-          #   memory: "128Mi"
+      #   memory: "128Mi"
-          # limits:
+      # limits:
-          #   cpu: "500m"
+      #   cpu: "500m"
-          #   memory: "512Mi"
+      #   memory: "512Mi"
-        annotations: {}
+    annotations: {}
-        podLabels: {}
+    podLabels: {}
 
-      ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+  ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
-      affinity:
+  affinity:
-        nodeAffinity:
+    nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
+      requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
+        nodeSelectorTerms:
-              - matchExpressions:
+          - matchExpressions:
-                  - key: type
+              - key: type
-                    operator: NotIn
+                operator: NotIn
-                    values:
+                values:
-                      - virtual-kubelet
+                  - virtual-kubelet
 
-      driver:
+  driver:
-        resources:
+    resources:
-          limits:
+      limits:
-            cpu: 200m
+        cpu: 200m
-            memory: 200Mi
+        memory: 200Mi
-          requests:
+      requests:
-            cpu: 50m
+        cpu: 50m
-            memory: 100Mi
+        memory: 100Mi
 
-      registrarImage:
+  registrarImage:
-        repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+    repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
-        tag: v2.10.0
+    tag: v2.10.0
-        #digest: sha256:
+    #digest: sha256:
-        pullPolicy: IfNotPresent
+    pullPolicy: IfNotPresent
 
-      registrar:
+  registrar:
-        resources:
+    resources:
-          limits:
+      limits:
-            cpu: 100m
+        cpu: 100m
-            memory: 100Mi
+        memory: 100Mi
-          requests:
+      requests:
-            cpu: 10m
+        cpu: 10m
-            memory: 20Mi
+        memory: 20Mi
-        logVerbosity: 5
+    logVerbosity: 5
 
-      livenessProbeImage:
+  livenessProbeImage:
-        repository: registry.k8s.io/sig-storage/livenessprobe
+    repository: registry.k8s.io/sig-storage/livenessprobe
-        tag: v2.12.0
+    tag: v2.12.0
-        #digest: sha256:
+    #digest: sha256:
-        pullPolicy: IfNotPresent
+    pullPolicy: IfNotPresent
 
-      livenessProbe:
+  livenessProbe:
-        resources:
+    resources:
-          limits:
+      limits:
-            cpu: 100m
+        cpu: 100m
-            memory: 100Mi
+        memory: 100Mi
-          requests:
+      requests:
-            cpu: 10m
+        cpu: 10m
-            memory: 20Mi
+        memory: 20Mi
 
-      updateStrategy:
+  updateStrategy:
-        type: RollingUpdate
+    type: RollingUpdate
-        rollingUpdate:
+    rollingUpdate:
-          maxUnavailable: 1
+      maxUnavailable: 1
 
-      kubeletRootDir: /var/lib/kubelet
+  kubeletRootDir: /var/lib/kubelet
-      providersDir: /var/run/secrets-store-csi-providers
+  providersDir: /var/run/secrets-store-csi-providers
-      additionalProvidersDirs:
+  additionalProvidersDirs:
-        - /etc/kubernetes/secrets-store-csi-providers
+    - /etc/kubernetes/secrets-store-csi-providers
-      nodeSelector: {}
+  nodeSelector: {}
-      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
-      # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+  # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
-      tolerations:
+  tolerations:
-        - operator: "Exists"
+    - operator: "Exists"
-      metricsAddr: ":8095"
+  metricsAddr: ":8095"
-      env: []
+  env: []
-      priorityClassName: ""
+  priorityClassName: ""
-      daemonsetAnnotations: {}
+  daemonsetAnnotations: {}
-      podAnnotations: {}
+  podAnnotations: {}
-      podLabels: {}
+  podLabels: {}
 
-      # volumes is a list of volumes made available to secrets store csi driver.
+  # volumes is a list of volumes made available to secrets store csi driver.
-      volumes: null
+  volumes: null
-      #   - name: foo
+  #   - name: foo
-      #     emptyDir: {}
+  #     emptyDir: {}
 
-      # volumeMounts is a list of volumeMounts for secrets store csi driver.
+  # volumeMounts is a list of volumeMounts for secrets store csi driver.
-      volumeMounts: null
+  volumeMounts: null
-      #   - name: foo
+  #   - name: foo
-      #     mountPath: /bar
+  #     mountPath: /bar
-      #     readOnly: true
+  #     readOnly: true
 
-    windows:
+windows:
-      enabled: false
+  enabled: false
-      image:
+  image:
-        repository: registry.k8s.io/csi-secrets-store/driver
+    repository: registry.k8s.io/csi-secrets-store/driver
-        tag: v1.4.3
+    tag: v1.4.3
-        #digest: sha256:
+    #digest: sha256:
-        pullPolicy: IfNotPresent
+    pullPolicy: IfNotPresent
 
-      ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+  ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
-      affinity:
+  affinity:
-        nodeAffinity:
+    nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
+      requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
+        nodeSelectorTerms:
-              - matchExpressions:
+          - matchExpressions:
-                  - key: type
+              - key: type
-                    operator: NotIn
+                operator: NotIn
-                    values:
+                values:
-                      - virtual-kubelet
+                  - virtual-kubelet
 
-      driver:
+  driver:
-        resources:
+    resources:
-          limits:
+      limits:
-            cpu: 400m
+        cpu: 400m
-            memory: 400Mi
+        memory: 400Mi
-          requests:
+      requests:
-            cpu: 100m
+        cpu: 100m
-            memory: 100Mi
+        memory: 100Mi
 
-      registrarImage:
+  registrarImage:
-        repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+    repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
-        tag: v2.10.0
+    tag: v2.10.0
-        #digest: sha256:
+    #digest: sha256:
-        pullPolicy: IfNotPresent
+    pullPolicy: IfNotPresent
 
-      registrar:
+  registrar:
-        resources:
+    resources:
-          limits:
+      limits:
-            cpu: 200m
+        cpu: 200m
-            memory: 200Mi
+        memory: 200Mi
-          requests:
+      requests:
-            cpu: 100m
+        cpu: 100m
-            memory: 100Mi
+        memory: 100Mi
-        logVerbosity: 5
+    logVerbosity: 5
 
-      livenessProbeImage:
+  livenessProbeImage:
-        repository: registry.k8s.io/sig-storage/livenessprobe
+    repository: registry.k8s.io/sig-storage/livenessprobe
-        tag: v2.12.0
+    tag: v2.12.0
-        #digest: sha256:
+    #digest: sha256:
-        pullPolicy: IfNotPresent
+    pullPolicy: IfNotPresent
 
-      livenessProbe:
+  livenessProbe:
-        resources:
+    resources:
-          limits:
+      limits:
-            cpu: 200m
+        cpu: 200m
-            memory: 200Mi
+        memory: 200Mi
-          requests:
+      requests:
-            cpu: 100m
+        cpu: 100m
-            memory: 100Mi
+        memory: 100Mi
 
-      updateStrategy:
+  updateStrategy:
-        type: RollingUpdate
+    type: RollingUpdate
-        rollingUpdate:
+    rollingUpdate:
-          maxUnavailable: 1
+      maxUnavailable: 1
 
-      kubeletRootDir: C:\var\lib\kubelet
+  kubeletRootDir: C:\var\lib\kubelet
-      providersDir: C:\\k\\secrets-store-csi-providers
+  providersDir: C:\\k\\secrets-store-csi-providers
-      additionalProvidersDirs:
+  additionalProvidersDirs:
-      nodeSelector: {}
+  nodeSelector: {}
-      # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
-      # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+  # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
-      tolerations:
+  tolerations:
-        - operator: "Exists"
+    - operator: "Exists"
-      metricsAddr: ":8095"
+  metricsAddr: ":8095"
-      env: []
+  env: []
-      priorityClassName: ""
+  priorityClassName: ""
-      daemonsetAnnotations: {}
+  daemonsetAnnotations: {}
-      podAnnotations: {}
+  podAnnotations: {}
-      podLabels: {}
+  podLabels: {}
 
-      # volumes is a list of volumes made available to secrets store csi driver.
+  # volumes is a list of volumes made available to secrets store csi driver.
-      volumes: null
+  volumes: null
-      #   - name: foo
+  #   - name: foo
-      #     emptyDir: {}
+  #     emptyDir: {}
 
-      # volumeMounts is a list of volumeMounts for secrets store csi driver.
+  # volumeMounts is a list of volumeMounts for secrets store csi driver.
-      volumeMounts: null
+  volumeMounts: null
-      #   - name: foo
+  #   - name: foo
-      #     mountPath: /bar
+  #     mountPath: /bar
-      #     readOnly: true
+  #     readOnly: true
 
-    # log level. Uses V logs (klog)
+# log level. Uses V logs (klog)
-    logVerbosity: 0
+logVerbosity: 0
 
-    # logging format JSON
+# logging format JSON
-    logFormatJSON: false
+logFormatJSON: false
 
-    livenessProbe:
+livenessProbe:
-      port: 9808
+  port: 9808
-      logLevel: 2
+  logLevel: 2
 
-    ## Maximum size in bytes of gRPC response from plugins
+## Maximum size in bytes of gRPC response from plugins
-    maxCallRecvMsgSize: 4194304
+maxCallRecvMsgSize: 4194304
 
-    ## Install Default RBAC roles and bindings
+## Install Default RBAC roles and bindings
-    rbac:
+rbac:
-      install: true
+  install: true
-      pspEnabled: false
+  pspEnabled: false
 
-    ## Install RBAC roles and bindings required for K8S Secrets syncing if true
+## Install RBAC roles and bindings required for K8S Secrets syncing if true
-    syncSecret:
+syncSecret:
-      enabled: false
+  enabled: false
 
-    ## Enable secret rotation feature [alpha]
+## Enable secret rotation feature [alpha]
-    enableSecretRotation: false
+enableSecretRotation: false
 
-    ## Secret rotation poll interval duration
+## Secret rotation poll interval duration
-    rotationPollInterval:
+rotationPollInterval:
 
-    ## Provider HealthCheck
+## Provider HealthCheck
-    providerHealthCheck: false
+providerHealthCheck: false
 
-    ## Provider HealthCheck interval
+## Provider HealthCheck interval
-    providerHealthCheckInterval: 2m
+providerHealthCheckInterval: 2m
 
-    imagePullSecrets: []
+imagePullSecrets: []
 
-    ## This allows CSI drivers to impersonate the pods that they mount the volumes for.
+## This allows CSI drivers to impersonate the pods that they mount the volumes for.
-    # refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
+# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
-    # Supported only for Kubernetes v1.20+
+# Supported only for Kubernetes v1.20+
-    tokenRequests: []
+tokenRequests: []
-    # - audience: aud1
+# - audience: aud1
-    # - audience: aud2
+# - audience: aud2
 
-    # -- Labels to apply to all resources
+# -- Labels to apply to all resources
-    commonLabels: {}
+commonLabels: {}
-    # team_name: dev
+# team_name: dev

internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl

@@ -1,35 +1,24 @@
-- name: argo-cd-ingress
+services:
-  namespace: cicd
+  - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
-  create_namespace: true
+    path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
-  chart_ref: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartRef }}
+    address: argo-cd-argocd-server
-  chart_version: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion }}
+    port: 80
-  {{- if and .Modules.Cicd.Enabled (eq .Modules.Cicd.ArgoCd.Expose.Type "ingress") }}
+    secretName: argo-cd-server-tls
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    services:
-      - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
-        path: {{ .Modules.Cicd.ArgoCd.Expose.Path }}
-        address: argo-cd-argocd-server
-        port: 80
-        secretName: argo-cd-server-tls
 
-    ingress:
+ingress:
-      accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
+  accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-      class: {{ .Modules.Additional.Ingress.Type }}
+  class: {{ .Modules.Additional.Ingress.Type }}
-      annotations:
+  annotations:
-        {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
+    {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-        nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
+    nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-        nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
+    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-        nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-        {{- end }}
+    {{- end }}
-      tls:
+  tls:
-        enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
+    enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
-        useCertManager: true
+    useCertManager: true
 
-        # used if "useCertManager" is false
+    # used if "useCertManager" is false
-        crt: ""
+    crt: ""
-        key: ""
+    key: ""

internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl

@@ -1,181 +1,170 @@
-- name: argo-cd
+crds:
-  namespace: cicd
+  install: true
-  create_namespace: true
+
-  chart_ref: {{ .Modules.Cicd.ArgoCd.ChartRef }}
+global:
-  chart_version: {{ .Modules.Cicd.ArgoCd.ChartVersion }}
+  repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
-  {{- if .Modules.Cicd.Enabled }}
+  tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
-  release_state: "present"
+
-  {{- else }}
+server:
-  release_state: "absent"
+  image:
+    repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
+    tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
+  certificateSecret:
+    enabled: false
+  {{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
+  service:
+    type: "NodePort"
+    nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
+    nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
+  {{- end }}
+  {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
+  {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
+  autoscaling:
+    enabled: true
+    minReplicas: 2
+  {{- else }}
+  replicas: 2
+  {{- end }}
   {{- end }}
-  values:
-    crds:
-      install: true
 
-    global:
+  metrics:
-      repository: {{ .Modules.Cicd.ArgoCd.Global.Image }}
+    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      tag: {{ .Modules.Cicd.ArgoCd.Global.Tag }}
+    serviceMonitor:
+      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
 
-    server:
+redis:
-      image:
+  image:
-        repository: {{ .Modules.Cicd.ArgoCd.Server.Image }}
+    repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
-        tag: {{ .Modules.Cicd.ArgoCd.Server.Tag }}
+    tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
-      certificateSecret:
+  exporter:
-        enabled: false
+    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      {{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
+    image:
-      service:
+      repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }}
-        type: "NodePort"
+      tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }}
-        nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
+  metrics:
-        nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
+    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      {{- end }}
+    serviceMonitor:
-      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
+      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
-      autoscaling:
-        enabled: true
-        minReplicas: 2
-      {{- else }}
-      replicas: 2
-      {{- end }}
-      {{- end }}
 
-      metrics:
+controller:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+  image:
-        serviceMonitor:
+    repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+    tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
+  replicas: 1
+  metrics:
+    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+    serviceMonitor:
+      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
 
-    redis:
+applicationSet:
-      image:
+  image:
-        repository: {{ .Modules.Cicd.ArgoCd.Redis.Image }}
+    repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
-        tag: {{ .Modules.Cicd.ArgoCd.Redis.Tag }}
+    tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
-      exporter:
+  {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+  replicas: 2
-        image:
+  {{- end }}
-          repository: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Image }}
+  metrics:
-          tag: {{ .Modules.Cicd.ArgoCd.Redis.Exporter.Tag }}
+    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      metrics:
+    serviceMonitor:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
 
-    controller:
+dex:
-      image:
+  image:
-        repository: {{ .Modules.Cicd.ArgoCd.Controller.Image }}
+    repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
-        tag: {{ .Modules.Cicd.ArgoCd.Controller.Tag }}
+    tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
-      replicas: 1
+  metrics:
-      metrics:
+    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+    ## check later
-        serviceMonitor:
+    serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+      enabled: false
 
-    applicationSet:
+repoServer:
-      image:
+  image:
-        repository: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Image }}
+    repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
-        tag: {{ .Modules.Cicd.ArgoCd.ApplicationSet.Tag }}
+    tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
-      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
+  {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-      replicas: 2
+  {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
-      {{- end }}
+  autoscaling:
-      metrics:
+    enabled: true
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+    minReplicas: 2
-        serviceMonitor:
+  {{- else }}
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+  replicas: 2
+  {{- end }}
+  {{- end }}
+  metrics:
+    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+    serviceMonitor:
+      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
 
-    dex:
+notifications:
-      image:
+  image:
-        repository: {{ .Modules.Cicd.ArgoCd.Dex.Image }}
+    repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
-        tag: {{ .Modules.Cicd.ArgoCd.Dex.Tag }}
+    tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
-      metrics:
+  metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        ## check later
+    serviceMonitor:
-        serviceMonitor:
+      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-          enabled: false
 
-    repoServer:
+configs:
-      image:
+  params:
-        repository: {{ .Modules.Cicd.ArgoCd.RepoServer.Image }}
+    server.insecure: true
-        tag: {{ .Modules.Cicd.ArgoCd.RepoServer.Tag }}
+    {{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
-      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
+    server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
-      {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
-      autoscaling:
-        enabled: true
-        minReplicas: 2
-      {{- else }}
-      replicas: 2
-      {{- end }}
-      {{- end }}
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    notifications:
-      image:
-        repository: {{ .Modules.Cicd.ArgoCd.Notifications.Image }}
-        tag: {{ .Modules.Cicd.ArgoCd.Notifications.Tag }}
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    configs:
-      params:
-        server.insecure: true
-        {{- if not (eq .Modules.Cicd.ArgoCd.Expose.Path "/" ) }}
-        server.rootpath: '{{ .Modules.Cicd.ArgoCd.Expose.Path }}'
-        {{- end }}
-
-      secret:
-        argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
-
-      repositories:
-        # add default helm-repository from harbor
-        {{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
-
-      cm:
-        create: true
-        url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
-
-        accounts.developer: login
-        accounts.guest: login
-
-        # oidc.config: ""
-
-      rbac:
-        create: true
-        policy.csv: |
-          p, role:admin, applications, create, */*, allow
-          p, role:admin, applications, update, */*, allow
-          p, role:admin, applications, delete, */*, allow
-          p, role:admin, applications, sync, */*, allow
-          p, role:admin, applications, override, */*, allow
-          p, role:admin, applications, action/*, */*, allow
-          p, role:admin, applicationsets, get, */*, allow
-          p, role:admin, applicationsets, create, */*, allow
-          p, role:admin, applicationsets, update, */*, allow
-          p, role:admin, applicationsets, delete, */*, allow
-          p, role:admin, certificates, create, *, allow
-          p, role:admin, certificates, update, *, allow
-          p, role:admin, certificates, delete, *, allow
-          p, role:admin, clusters, create, *, allow
-          p, role:admin, clusters, update, *, allow
-          p, role:admin, clusters, delete, *, allow
-          p, role:admin, repositories, create, *, allow
-          p, role:admin, repositories, update, *, allow
-          p, role:admin, repositories, delete, *, allow
-          p, role:admin, projects, create, *, allow
-          p, role:admin, projects, update, *, allow
-          p, role:admin, projects, delete, *, allow
-          p, role:admin, accounts, update, *, allow
-          p, role:admin, gpgkeys, create, *, allow
-          p, role:admin, gpgkeys, delete, *, allow
-          p, role:admin, exec, create, */*, allow
-
-          {{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
-
-
-        policy.default: role:''
-        # scopes: "[roles,email,groups]"
-
-    {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-    redis-ha:
-      enabled: true
     {{- end }}
+
+  secret:
+    argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
+
+  repositories:
+    # add default helm-repository from harbor
+    {{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
+
+  cm:
+    create: true
+    url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
+
+    accounts.developer: login
+    accounts.guest: login
+
+    # oidc.config: ""
+
+  rbac:
+    create: true
+    policy.csv: |
+      p, role:admin, applications, create, */*, allow
+      p, role:admin, applications, update, */*, allow
+      p, role:admin, applications, delete, */*, allow
+      p, role:admin, applications, sync, */*, allow
+      p, role:admin, applications, override, */*, allow
+      p, role:admin, applications, action/*, */*, allow
+      p, role:admin, applicationsets, get, */*, allow
+      p, role:admin, applicationsets, create, */*, allow
+      p, role:admin, applicationsets, update, */*, allow
+      p, role:admin, applicationsets, delete, */*, allow
+      p, role:admin, certificates, create, *, allow
+      p, role:admin, certificates, update, *, allow
+      p, role:admin, certificates, delete, *, allow
+      p, role:admin, clusters, create, *, allow
+      p, role:admin, clusters, update, *, allow
+      p, role:admin, clusters, delete, *, allow
+      p, role:admin, repositories, create, *, allow
+      p, role:admin, repositories, update, *, allow
+      p, role:admin, repositories, delete, *, allow
+      p, role:admin, projects, create, *, allow
+      p, role:admin, projects, update, *, allow
+      p, role:admin, projects, delete, *, allow
+      p, role:admin, accounts, update, *, allow
+      p, role:admin, gpgkeys, create, *, allow
+      p, role:admin, gpgkeys, delete, *, allow
+      p, role:admin, exec, create, */*, allow
+
+      {{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
+
+
+    policy.default: role:''
+    # scopes: "[roles,email,groups]"
+
+{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
+redis-ha:
+  enabled: true
+{{- end }}

internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl

@@ -1,435 +1,424 @@
-- name: argo-rollouts
+installCRDs: true
-  namespace: cicd
+keepCRDs: false
-  create_namespace: true
+clusterInstall: true
-  chart_ref: {{ .Modules.Cicd.Rollouts.ChartRef }}
+createClusterAggregateRoles: true
-  chart_version: {{ .Modules.Cicd.Rollouts.ChartVersion }}
+
-  {{- if and .Modules.Cicd.Enabled .Modules.Cicd.Rollouts.Enabled }}
+apiVersionOverrides:
-  release_state: "present"
+  # -- String to override apiVersion of ingresses rendered by this helm chart
+  ingress: "" # networking.k8s.io/v1beta1
+
+# -- Override the Kubernetes version, which is used to evaluate certain manifests
+kubeVersionOverride: ""
+
+# -- Additional manifests to deploy within the chart. A list of objects.
+## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
+extraObjects: []
+  # - apiVersion: v1
+  #   kind: Secret
+  #   metadata:
+  #     name: datadog
+  #   type: Opaque
+  #   data:
+  #     address: https://api.datadoghq.com
+  #     api-key: <datadog-api-key>
+  #     app-key: <datadog-app-key>
+
+global:
+  # -- Annotations for all deployed Deployments
+  deploymentAnnotations: {}
+
+controller:
+  # -- Value of label `app.kubernetes.io/component`
+  component: rollouts-controller
+  # -- Annotations to be added to the controller deployment
+  deploymentAnnotations: {}
+  # -- Annotations to be added to application controller pods
+  podAnnotations: {}
+  # -- [Node selector]
+  nodeSelector: {}
+  # -- [Tolerations] for use with node taints
+  tolerations: []
+  # -- Assign custom [affinity] rules to the deployment
+  affinity: {}
+  logging:
+    # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
+    level: info
+    # -- Set the klog logging level
+    kloglevel: "0"
+    # -- Set the logging format (one of: `text`, `json`)
+    format: "text"
+
+  # -- Assign custom [TopologySpreadConstraints] rules to the controller
+  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+  ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
+  topologySpreadConstraints: []
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   whenUnsatisfiable: DoNotSchedule
+
+  # -- [priorityClassName] for the controller
+  priorityClassName: ""
+  # -- The number of controller pods to run
+  {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
+  replicas: 3
   {{- else }}
-  release_state: "absent"
+  replicas: 1
   {{- end }}
-  values:
+  image:
-    installCRDs: true
+    # -- Registry to use
-    keepCRDs: false
+    registry: {{ .Modules.Cicd.Rollouts.Registry }}
-    clusterInstall: true
+    # -- Repository to use
-    createClusterAggregateRoles: true
+    repository: {{ .Modules.Cicd.Rollouts.Repository }}
+    # -- Overrides the image tag (default is the chart appVersion)
+    tag: {{ .Modules.Cicd.Rollouts.Tag }}
+    # -- Image pull policy
+    pullPolicy: IfNotPresent
 
-    apiVersionOverrides:
+  # -- flag to enable creation of cluster controller role (requires cluster RBAC)
-      # -- String to override apiVersion of ingresses rendered by this helm chart
+  createClusterRole: true
-      ingress: "" # networking.k8s.io/v1beta1
 
-    # -- Override the Kubernetes version, which is used to evaluate certain manifests
+  # Controller container ports
-    kubeVersionOverride: ""
+  containerPorts:
-
+    # -- Metrics container port
-    # -- Additional manifests to deploy within the chart. A list of objects.
+    metrics: 8090
-    ## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
+    # -- Healthz container port
-    extraObjects: []
+    healthz: 8080
-      # - apiVersion: v1
+  {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      #   kind: Secret
+  metrics:
-      #   metadata:
+    # -- Deploy metrics service
-      #     name: datadog
+    enabled: true
-      #   type: Opaque
+    service:
-      #   data:
+      # -- Metrics service port name
-      #     address: https://api.datadoghq.com
+      portName: metrics
-      #     api-key: <datadog-api-key>
+      # -- Metrics service port
-      #     app-key: <datadog-app-key>
+      port: 8090
-
+      # -- Service annotations
-    global:
-      # -- Annotations for all deployed Deployments
-      deploymentAnnotations: {}
-
-    controller:
-      # -- Value of label `app.kubernetes.io/component`
-      component: rollouts-controller
-      # -- Annotations to be added to the controller deployment
-      deploymentAnnotations: {}
-      # -- Annotations to be added to application controller pods
-      podAnnotations: {}
-      # -- [Node selector]
-      nodeSelector: {}
-      # -- [Tolerations] for use with node taints
-      tolerations: []
-      # -- Assign custom [affinity] rules to the deployment
-      affinity: {}
-      logging:
-        # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
-        level: info
-        # -- Set the klog logging level
-        kloglevel: "0"
-        # -- Set the logging format (one of: `text`, `json`)
-        format: "text"
-
-      # -- Assign custom [TopologySpreadConstraints] rules to the controller
-      ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-      ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
-      topologySpreadConstraints: []
-      # - maxSkew: 1
-      #   topologyKey: topology.kubernetes.io/zone
-      #   whenUnsatisfiable: DoNotSchedule
-
-      # -- [priorityClassName] for the controller
-      priorityClassName: ""
-      # -- The number of controller pods to run
-      {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
-      replicas: 3
-      {{- else }}
-      replicas: 1
-      {{- end }}
-      image:
-        # -- Registry to use
-        registry: {{ .Modules.Cicd.Rollouts.Registry }}
-        # -- Repository to use
-        repository: {{ .Modules.Cicd.Rollouts.Repository }}
-        # -- Overrides the image tag (default is the chart appVersion)
-        tag: {{ .Modules.Cicd.Rollouts.Tag }}
-        # -- Image pull policy
-        pullPolicy: IfNotPresent
-
-      # -- flag to enable creation of cluster controller role (requires cluster RBAC)
-      createClusterRole: true
-
-      # Controller container ports
-      containerPorts:
-        # -- Metrics container port
-        metrics: 8090
-        # -- Healthz container port
-        healthz: 8080
-      {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      metrics:
-        # -- Deploy metrics service
-        enabled: true
-        service:
-          # -- Metrics service port name
-          portName: metrics
-          # -- Metrics service port
-          port: 8090
-          # -- Service annotations
-          annotations: {}
-        serviceMonitor:
-          # -- Enable a prometheus ServiceMonitor
-          enabled: true
-          # -- Namespace to be used for the ServiceMonitor
-          namespace: ""
-          # -- Labels to be added to the ServiceMonitor
-          additionalLabels: {}
-          # -- Annotations to be added to the ServiceMonitor
-          additionalAnnotations: {}
-          # -- RelabelConfigs to apply to samples before scraping
-          relabelings: []
-          # -- MetricRelabelConfigs to apply to samples before ingestion
-          metricRelabelings: []
-      {{- end }}
-
-      # -- Configure liveness [probe] for the controller
-      # @default -- See [values.yaml]
-      livenessProbe:
-        httpGet:
-          path: /healthz
-          port: healthz
-        initialDelaySeconds: 30
-        periodSeconds: 20
-        failureThreshold: 3
-        successThreshold: 1
-        timeoutSeconds: 10
-
-      # -- Configure readiness [probe] for the controller
-      # @default -- See [values.yaml]
-      readinessProbe:
-        httpGet:
-          path: /metrics
-          port: metrics
-        initialDelaySeconds: 15
-        periodSeconds: 5
-        failureThreshold: 3
-        successThreshold: 1
-        timeoutSeconds: 4
-
-      ## Configure Pod Disruption Budget for the controller
-      pdb:
-        # -- Labels to be added to controller [Pod Disruption Budget]
-        labels: {}
-        # -- Annotations to be added to controller [Pod Disruption Budget]
-        annotations: {}
-        # -- Deploy a [Pod Disruption Budget] for the controller
-        enabled: false
-        # -- Minimum number / percentage of pods that should remain scheduled
-        minAvailable: # 1
-        # -- Maximum number / percentage of pods that may be made unavailable
-        maxUnavailable: # 0
-
-      # -- Additional volumes to add to the controller pod
-      volumes: []
-        # - configMap:
-        #     name: my-certs-cm
-        #   name: my-certs
-
-      # -- Additional volumeMounts to add to the controller container
-      volumeMounts: []
-        # - mountPath: /etc/ssl/certs
-        #   name: my-certs
-
-      # -- Configures 3rd party metric providers for controller
-      ## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
-      metricProviderPlugins: {}
-        # metricProviderPlugins: |-
-        #   - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
-        #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-
-      # -- Configures 3rd party traffic router plugins for controller
-      ## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
-      trafficRouterPlugins: {}
-        # trafficRouterPlugins: |-
-        #   - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
-        #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-
-    serviceAccount:
-      # -- Specifies whether a service account should be created
-      create: true
-      # -- Annotations to add to the service account
       annotations: {}
-      # -- The name of the service account to use.
+    serviceMonitor:
-      # If not set and create is true, a name is generated using the fullname template
+      # -- Enable a prometheus ServiceMonitor
-      name: ""
-
-    # -- Annotations to be added to all CRDs
-    crdAnnotations: {}
-
-    # -- Annotations for the all deployed pods
-    podAnnotations: {}
-
-    # -- Security Context to set on pod level
-    podSecurityContext:
-      runAsNonRoot: true
-
-    # -- Security Context to set on container level
-    containerSecurityContext: {}
-      # capabilities:
-      #   drop:
-      #   - ALL
-      # readOnlyRootFilesystem: true
-      # runAsNonRoot: true
-      # runAsUser: 1000
-
-    # -- Annotations to be added to the Rollout service
-    serviceAnnotations: {}
-
-    # -- Labels to be added to the Rollout pods
-    podLabels: {}
-
-    # -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
-    imagePullSecrets: []
-    # - name: argo-pull-secret
-
-    providerRBAC:
-      # -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
       enabled: true
-      # providerRBAC.enabled must be true in order to toggle the individual providers
+      # -- Namespace to be used for the ServiceMonitor
-      providers:
+      namespace: ""
-        # -- Adds RBAC rules for the Istio provider
+      # -- Labels to be added to the ServiceMonitor
-        istio: true
+      additionalLabels: {}
-        # -- Adds RBAC rules for the SMI provider
+      # -- Annotations to be added to the ServiceMonitor
-        smi: true
+      additionalAnnotations: {}
-        # -- Adds RBAC rules for the Ambassador provider
+      # -- RelabelConfigs to apply to samples before scraping
-        ambassador: true
+      relabelings: []
-        # -- Adds RBAC rules for the AWS Load Balancer Controller provider
+      # -- MetricRelabelConfigs to apply to samples before ingestion
-        awsLoadBalancerController: true
+      metricRelabelings: []
-        # -- Adds RBAC rules for the AWS App Mesh provider
+  {{- end }}
-        awsAppMesh: true
-        # -- Adds RBAC rules for the Traefik provider
-        traefik: true
-        # -- Adds RBAC rules for the Apisix provider
-        apisix: true
-        # -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
-        contour: true
-        # -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
-        glooPlatform: true
-      # -- Additional RBAC rules for others providers
-      additionalRules: []
 
-    dashboard:
+  # -- Configure liveness [probe] for the controller
-      # -- Deploy dashboard server
+  # @default -- See [values.yaml]
-      enabled: true
+  livenessProbe:
-      # -- Set cluster role to readonly
+    httpGet:
-      readonly: false
+      path: /healthz
-      # -- Value of label `app.kubernetes.io/component`
+      port: healthz
-      component: rollouts-dashboard
+    initialDelaySeconds: 30
-      # -- Annotations to be added to the dashboard deployment
+    periodSeconds: 20
-      deploymentAnnotations: {}
+    failureThreshold: 3
-      # -- Annotations to be added to application dashboard pods
+    successThreshold: 1
-      podAnnotations: {}
+    timeoutSeconds: 10
-      # -- [Node selector]
-      nodeSelector: {}
-      # -- [Tolerations] for use with node taints
-      tolerations: []
-      # -- Assign custom [affinity] rules to the deployment
-      affinity: {}
-      logging:
-        # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
-        level: info
-        # -- Set the klog logging level
-        kloglevel: "0"
 
-      # -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
+  # -- Configure readiness [probe] for the controller
-      ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+  # @default -- See [values.yaml]
-      ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
+  readinessProbe:
-      topologySpreadConstraints: []
+    httpGet:
-      # - maxSkew: 1
+      path: /metrics
-      #   topologyKey: topology.kubernetes.io/zone
+      port: metrics
-      #   whenUnsatisfiable: DoNotSchedule
+    initialDelaySeconds: 15
+    periodSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+    timeoutSeconds: 4
 
-      # -- [priorityClassName] for the dashboard server
+  ## Configure Pod Disruption Budget for the controller
-      priorityClassName: ""
+  pdb:
+    # -- Labels to be added to controller [Pod Disruption Budget]
+    labels: {}
+    # -- Annotations to be added to controller [Pod Disruption Budget]
+    annotations: {}
+    # -- Deploy a [Pod Disruption Budget] for the controller
+    enabled: false
+    # -- Minimum number / percentage of pods that should remain scheduled
+    minAvailable: # 1
+    # -- Maximum number / percentage of pods that may be made unavailable
+    maxUnavailable: # 0
 
-      # -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
+  # -- Additional volumes to add to the controller pod
-      createClusterRole: true
+  volumes: []
+    # - configMap:
+    #     name: my-certs-cm
+    #   name: my-certs
 
-      # -- The number of dashboard pods to run
+  # -- Additional volumeMounts to add to the controller container
-      {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
+  volumeMounts: []
-      replicas: 3
+    # - mountPath: /etc/ssl/certs
-      {{- else }}
+    #   name: my-certs
-      replicas: 1
-      {{- end }}
-      image:
-        # -- Registry to use
-        registry: quay.io
-        # --  Repository to use
-        repository: argoproj/kubectl-argo-rollouts
-        # -- Overrides the image tag (default is the chart appVersion)
-        tag: ""
-        # -- Image pull policy
-        pullPolicy: IfNotPresent
-      # -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
-      extraArgs: []
-      # -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
-      extraEnv: []
-        # - name: FOO
-        #   value: bar
-      # -- Resource limits and requests for the dashboard pods.
-      resources: {}
-      # -- Security Context to set on pod level
-      podSecurityContext:
-        runAsNonRoot: true
-      # -- Security Context to set on container level
-      containerSecurityContext: {}
-      service:
-        # -- Sets the type of the Service
-        {{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
-        type: NodePort
-        nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
-        {{- else }}
-        type: ClusterIP
-        nodePort:
-        {{- end }}
-        # -- LoadBalancer will get created with the IP specified in this field
-        loadBalancerIP: ""
-        # -- Source IP ranges to allow access to service from
-        loadBalancerSourceRanges: []
-        # -- Dashboard service external IPs
-        externalIPs: []
-        # -- Service annotations
-        annotations: {}
-        # -- Service labels
-        labels: {}
-        # -- Service port name
-        portName: dashboard
-        # -- Service port
-        port: 3100
-        # -- Service target port
-        targetPort: 3100
-        # -- (int) Service nodePort
 
-      serviceAccount:
+  # -- Configures 3rd party metric providers for controller
-        # -- Specifies whether a dashboard service account should be created
+  ## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
-        create: true
+  metricProviderPlugins: {}
-        # -- Annotations to add to the dashboard service account
+    # metricProviderPlugins: |-
-        annotations: {}
+    #   - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
-        # -- The name of the service account to use.
+    #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-        # If not set and create is true, a name is generated using the fullname template
-        name: ""
 
-      ## Configure Pod Disruption Budget for the dashboard
+  # -- Configures 3rd party traffic router plugins for controller
-      pdb:
+  ## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
-        # -- Labels to be added to dashboard [Pod Disruption Budget]
+  trafficRouterPlugins: {}
-        labels: {}
+    # trafficRouterPlugins: |-
-        # -- Annotations to be added to dashboard [Pod Disruption Budget]
+    #   - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
-        annotations: {}
+    #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-        # -- Deploy a [Pod Disruption Budget] for the dashboard
-        enabled: false
-        # -- Minimum number / percentage of pods that should remain scheduled
-        minAvailable: # 1
-        # -- Maximum number / percentage of pods that may be made unavailable
-        maxUnavailable: # 0
 
-      ## Ingress configuration.
+serviceAccount:
-      ## ref: https://kubernetes.io/docs/user-guide/ingress/
+  # -- Specifies whether a service account should be created
-      ##
+  create: true
-      ingress:
+  # -- Annotations to add to the service account
-        # -- Enable dashboard ingress support
+  annotations: {}
-        enabled: false
+  # -- The name of the service account to use.
-        # -- Dashboard ingress annotations
+  # If not set and create is true, a name is generated using the fullname template
-        annotations: {}
+  name: ""
-        # -- Dashboard ingress labels
-        labels: {}
-        # -- Dashboard ingress class name
-        ingressClassName: ""
 
-        # -- Dashboard ingress hosts
+# -- Annotations to be added to all CRDs
-        ## Argo Rollouts Dashboard Ingress.
+crdAnnotations: {}
-        ## Hostnames must be provided if Ingress is enabled.
-        ## Secrets must be manually created in the namespace
-        hosts: []
-          # - argorollouts.example.com
 
-        # -- Dashboard ingress paths
+# -- Annotations for the all deployed pods
-        paths:
+podAnnotations: {}
-          - /
-        # -- Dashboard ingress path type
-        pathType: Prefix
-        # -- Dashboard ingress extra paths
-        extraPaths: []
-          # - path: /*
-          #   backend:
-          #     serviceName: ssl-redirect
-          #     servicePort: use-annotation
-          ## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
-          # - path: /*
-          #   pathType: Prefix
-          #   backend:
-          #     service
-          #       name: ssl-redirect
-          #       port:
-          #         name: use-annotation
 
-        # -- Dashboard ingress tls
+# -- Security Context to set on pod level
-        tls: []
+podSecurityContext:
-          # - secretName: argorollouts-example-tls
+  runAsNonRoot: true
-          #   hosts:
-          #     - argorollouts.example.com
 
-      # -- Additional volumes to add to the dashboard pod
+# -- Security Context to set on container level
-      volumes: []
+containerSecurityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
 
-      # -- Additional volumeMounts to add to the dashboard container
+# -- Annotations to be added to the Rollout service
-      volumeMounts: []
+serviceAnnotations: {}
 
-    notifications:
+# -- Labels to be added to the Rollout pods
-      secret:
+podLabels: {}
-        # -- Whether to create notifications secret
-        create: false
-        # -- Generic key:value pairs to be inserted into the notifications secret
-        items: {}
-          # slack-token:
 
-      # -- Configures notification services
+# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
-      notifiers: {}
+imagePullSecrets: []
-        # service.slack: |
+# - name: argo-pull-secret
-        #   token: $slack-token
 
-      # -- Notification templates
+providerRBAC:
-      templates: {}
+  # -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
+  enabled: true
+  # providerRBAC.enabled must be true in order to toggle the individual providers
+  providers:
+    # -- Adds RBAC rules for the Istio provider
+    istio: true
+    # -- Adds RBAC rules for the SMI provider
+    smi: true
+    # -- Adds RBAC rules for the Ambassador provider
+    ambassador: true
+    # -- Adds RBAC rules for the AWS Load Balancer Controller provider
+    awsLoadBalancerController: true
+    # -- Adds RBAC rules for the AWS App Mesh provider
+    awsAppMesh: true
+    # -- Adds RBAC rules for the Traefik provider
+    traefik: true
+    # -- Adds RBAC rules for the Apisix provider
+    apisix: true
+    # -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
+    contour: true
+    # -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
+    glooPlatform: true
+  # -- Additional RBAC rules for others providers
+  additionalRules: []
 
-      # -- The trigger defines the condition when the notification should be sent
+dashboard:
-      triggers: {}
+  # -- Deploy dashboard server
-        # trigger.on-purple: |
+  enabled: true
-        #   - send: [my-purple-template]
+  # -- Set cluster role to readonly
-        #     when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'
+  readonly: false
+  # -- Value of label `app.kubernetes.io/component`
+  component: rollouts-dashboard
+  # -- Annotations to be added to the dashboard deployment
+  deploymentAnnotations: {}
+  # -- Annotations to be added to application dashboard pods
+  podAnnotations: {}
+  # -- [Node selector]
+  nodeSelector: {}
+  # -- [Tolerations] for use with node taints
+  tolerations: []
+  # -- Assign custom [affinity] rules to the deployment
+  affinity: {}
+  logging:
+    # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
+    level: info
+    # -- Set the klog logging level
+    kloglevel: "0"
+
+  # -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
+  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+  ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
+  topologySpreadConstraints: []
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   whenUnsatisfiable: DoNotSchedule
+
+  # -- [priorityClassName] for the dashboard server
+  priorityClassName: ""
+
+  # -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
+  createClusterRole: true
+
+  # -- The number of dashboard pods to run
+  {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
+  replicas: 3
+  {{- else }}
+  replicas: 1
+  {{- end }}
+  image:
+    # -- Registry to use
+    registry: quay.io
+    # --  Repository to use
+    repository: argoproj/kubectl-argo-rollouts
+    # -- Overrides the image tag (default is the chart appVersion)
+    tag: ""
+    # -- Image pull policy
+    pullPolicy: IfNotPresent
+  # -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
+  extraArgs: []
+  # -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
+  extraEnv: []
+    # - name: FOO
+    #   value: bar
+  # -- Resource limits and requests for the dashboard pods.
+  resources: {}
+  # -- Security Context to set on pod level
+  podSecurityContext:
+    runAsNonRoot: true
+  # -- Security Context to set on container level
+  containerSecurityContext: {}
+  service:
+    # -- Sets the type of the Service
+    {{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
+    type: NodePort
+    nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
+    {{- else }}
+    type: ClusterIP
+    nodePort:
+    {{- end }}
+    # -- LoadBalancer will get created with the IP specified in this field
+    loadBalancerIP: ""
+    # -- Source IP ranges to allow access to service from
+    loadBalancerSourceRanges: []
+    # -- Dashboard service external IPs
+    externalIPs: []
+    # -- Service annotations
+    annotations: {}
+    # -- Service labels
+    labels: {}
+    # -- Service port name
+    portName: dashboard
+    # -- Service port
+    port: 3100
+    # -- Service target port
+    targetPort: 3100
+    # -- (int) Service nodePort
+
+  serviceAccount:
+    # -- Specifies whether a dashboard service account should be created
+    create: true
+    # -- Annotations to add to the dashboard service account
+    annotations: {}
+    # -- The name of the service account to use.
+    # If not set and create is true, a name is generated using the fullname template
+    name: ""
+
+  ## Configure Pod Disruption Budget for the dashboard
+  pdb:
+    # -- Labels to be added to dashboard [Pod Disruption Budget]
+    labels: {}
+    # -- Annotations to be added to dashboard [Pod Disruption Budget]
+    annotations: {}
+    # -- Deploy a [Pod Disruption Budget] for the dashboard
+    enabled: false
+    # -- Minimum number / percentage of pods that should remain scheduled
+    minAvailable: # 1
+    # -- Maximum number / percentage of pods that may be made unavailable
+    maxUnavailable: # 0
+
+  ## Ingress configuration.
+  ## ref: https://kubernetes.io/docs/user-guide/ingress/
+  ##
+  ingress:
+    # -- Enable dashboard ingress support
+    enabled: false
+    # -- Dashboard ingress annotations
+    annotations: {}
+    # -- Dashboard ingress labels
+    labels: {}
+    # -- Dashboard ingress class name
+    ingressClassName: ""
+
+    # -- Dashboard ingress hosts
+    ## Argo Rollouts Dashboard Ingress.
+    ## Hostnames must be provided if Ingress is enabled.
+    ## Secrets must be manually created in the namespace
+    hosts: []
+      # - argorollouts.example.com
+
+    # -- Dashboard ingress paths
+    paths:
+      - /
+    # -- Dashboard ingress path type
+    pathType: Prefix
+    # -- Dashboard ingress extra paths
+    extraPaths: []
+      # - path: /*
+      #   backend:
+      #     serviceName: ssl-redirect
+      #     servicePort: use-annotation
+      ## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
+      # - path: /*
+      #   pathType: Prefix
+      #   backend:
+      #     service
+      #       name: ssl-redirect
+      #       port:
+      #         name: use-annotation
+
+    # -- Dashboard ingress tls
+    tls: []
+      # - secretName: argorollouts-example-tls
+      #   hosts:
+      #     - argorollouts.example.com
+
+  # -- Additional volumes to add to the dashboard pod
+  volumes: []
+
+  # -- Additional volumeMounts to add to the dashboard container
+  volumeMounts: []
+
+notifications:
+  secret:
+    # -- Whether to create notifications secret
+    create: false
+    # -- Generic key:value pairs to be inserted into the notifications secret
+    items: {}
+      # slack-token:
+
+  # -- Configures notification services
+  notifiers: {}
+    # service.slack: |
+    #   token: $slack-token
+
+  # -- Notification templates
+  templates: {}
+
+  # -- The trigger defines the condition when the notification should be sent
+  triggers: {}
+    # trigger.on-purple: |
+    #   - send: [my-purple-template]
+    #     when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'

internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl

@@ -1,255 +1,245 @@
-- name: keel
+image:
-  namespace: kube-system
+  repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
-  chart_ref: {{ .Modules.Cicd.UpdatesOperator.ChartRef }}
+  tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
-  chart_version: {{ .Modules.Cicd.UpdatesOperator.ChartVersion }}
+  pullPolicy: Always
-  {{- if and .Modules.Cicd.Enabled .Modules.Cicd.UpdatesOperator.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    image:
-      repository: {{ .Modules.Cicd.UpdatesOperator.Image }}
-      tag: {{ .Modules.Cicd.UpdatesOperator.Tag }}
-      pullPolicy: Always
 
-    # Enable insecure registries
+# Enable insecure registries
-    insecureRegistry: false
+insecureRegistry: false
 
-    # Polling is enabled by default,
+# Polling is enabled by default,
-    # you can disable it setting value below to false
+# you can disable it setting value below to false
-    polling:
+polling:
-      enabled: true
+  enabled: true
-      defaultSchedule: "@every 1m"
+  defaultSchedule: "@every 1m"
 
-    # Extra Containers to run alongside Keel
+# Extra Containers to run alongside Keel
-    # extraContainers:
+# extraContainers:
-    #   - name: busybox
+#   - name: busybox
-    #     image: busybox
+#     image: busybox
-    #     imagePullPolicy: IfNotPresent
+#     imagePullPolicy: IfNotPresent
-    #     command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
+#     command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
 
-    # Helm provider support
+# Helm provider support
-    helmProvider:
+helmProvider:
-      enabled: true
+  enabled: true
-      # set to version "v3" for Helm v3
+  # set to version "v3" for Helm v3
-      version: "v2"
+  version: "v2"
-      tillerNamespace: "kube-system"
+  tillerNamespace: "kube-system"
-      # optional Tiller address (if portforwarder tunnel doesn't work),
+  # optional Tiller address (if portforwarder tunnel doesn't work),
-      # if you are using default configuration, setting it to
+  # if you are using default configuration, setting it to
-      # 'tiller-deploy:44134' is usually fine
+  # 'tiller-deploy:44134' is usually fine
-      tillerAddress: 'tiller-deploy:44134'
+  tillerAddress: 'tiller-deploy:44134'
-    #  helmDriver: ''
+#  helmDriver: ''
-    #  helmDriverSqlConnectionString: ''
+#  helmDriverSqlConnectionString: ''
 
-    # Google Container Registry
+# Google Container Registry
-    # GCP Project ID
+# GCP Project ID
-    gcr:
+gcr:
-      enabled: false
+  enabled: false
-      projectId: ""
+  projectId: ""
-      gcpServiceAccount: ""
+  gcpServiceAccount: ""
-      clusterName: ""
+  clusterName: ""
-      pubSub:
+  pubSub:
-        enabled: false
+    enabled: false
 
-    # Notification level (debug, info, success, warn, error, fatal)
+# Notification level (debug, info, success, warn, error, fatal)
-    notificationLevel: info
+notificationLevel: info
 
-    # AWS Elastic Container Registry
+# AWS Elastic Container Registry
-    # https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
+# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
-    ecr:
+ecr:
-      enabled: false
+  enabled: false
-      roleArn: ""
+  roleArn: ""
-      accessKeyId: ""
+  accessKeyId: ""
-      secretAccessKey: ""
+  secretAccessKey: ""
-      region: ""
+  region: ""
 
-    # Webhook Notification
+# Webhook Notification
-    # Remote webhook endpoint for notification delivery
+# Remote webhook endpoint for notification delivery
-    webhook:
+webhook:
-      enabled: false
+  enabled: false
-      endpoint: ""
+  endpoint: ""
 
-    # Slack Notification
+# Slack Notification
-    # bot name (default keel) must exist!
+# bot name (default keel) must exist!
-    slack:
+slack:
-      enabled: false
+  enabled: false
-      botName: ""
+  botName: ""
-      token: ""
+  token: ""
-      channel: ""
+  channel: ""
-      approvalsChannel: ""
+  approvalsChannel: ""
 
-    # Hipchat notification and approvals
+# Hipchat notification and approvals
-    hipchat:
+hipchat:
-      enabled: false
+  enabled: false
-      token: ""
+  token: ""
-      channel: ""
+  channel: ""
-      approvalsChannel: ""
+  approvalsChannel: ""
-      botName: ""
+  botName: ""
-      userName: ""
+  userName: ""
-      password: ""
+  password: ""
 
-    # Mattermost notifications
+# Mattermost notifications
-    mattermost:
+mattermost:
-      enabled: false
+  enabled: false
-      endpoint: ""
+  endpoint: ""
 
-    # MS Teams notifications
+# MS Teams notifications
-    teams:
+teams:
-      enabled: false
+  enabled: false
-      webhookUrl: ""
+  webhookUrl: ""
 
-    # Discord notifications
+# Discord notifications
-    discord:
+discord:
-      enabled: false
+  enabled: false
-      webhookUrl: ""
+  webhookUrl: ""
 
-    # Mail notifications
+# Mail notifications
-    mail:
+mail:
-      enabled: false
+  enabled: false
-      from: ""
+  from: ""
-      to: ""
+  to: ""
-      smtp:
+  smtp:
-        server: ""
+    server: ""
-        port: 25
+    port: 25
-        user: ""
+    user: ""
-        pass: ""
+    pass: ""
 
-    # Basic auth on approvals
+# Basic auth on approvals
-    basicauth:
+basicauth:
-      enabled: true
+  enabled: true
-      user: "admin"
+  user: "admin"
-      password: "{{ .Modules.AdminPassword }}"
+  password: "{{ .Modules.AdminPassword }}"
 
-    # Keel service
+# Keel service
-    # Enable to receive webhooks from Docker registries
+# Enable to receive webhooks from Docker registries
-    service:
+service:
-      enabled: false
+  enabled: false
-      type: LoadBalancer
+  type: LoadBalancer
-      externalPort: 9300
+  externalPort: 9300
-      clusterIP: ""
+  clusterIP: ""
 
-    # Webhook Relay service
+# Webhook Relay service
-    # If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
+# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
-    # which can deliver webhooks to your internal Keel service through Keel sidecar container.
+# which can deliver webhooks to your internal Keel service through Keel sidecar container.
-    webhookRelay:
+webhookRelay:
-      enabled: false
+  enabled: false
-      bucket: ""
+  bucket: ""
-      # webhookrelay.com credentials
+  # webhookrelay.com credentials
-      # Set the key and secret values here to create the keel-webhookrelay secret with this
+  # Set the key and secret values here to create the keel-webhookrelay secret with this
-      # chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
+  # chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
-      key: ""
+  key: ""
-      secret: ""
+  secret: ""
-      # webhookrelay docker image
+  # webhookrelay docker image
-      image:
+  image:
-        repository: webhookrelay/webhookrelayd
+    repository: webhookrelay/webhookrelayd
-        tag: latest
+    tag: latest
-        pullPolicy: IfNotPresent
+    pullPolicy: IfNotPresent
 
-    # Use a secret file to define passwords and tokens of third parties.
+# Use a secret file to define passwords and tokens of third parties.
-    secret:
+secret:
-      # Leave blank to use `keel.fullname`
+  # Leave blank to use `keel.fullname`
-      name: ""
+  name: ""
-      # Set to false to manage your own secret file, with terraform for example.
+  # Set to false to manage your own secret file, with terraform for example.
-      create: true
+  create: true
 
-    # Keel self-update
+# Keel self-update
-    # uncomment lines below if you want Keel to automaticly
+# uncomment lines below if you want Keel to automaticly
-    # self-update to the latest release version
+# self-update to the latest release version
-    # keel:
+# keel:
-    #   # keel policy (all/major/minor/patch/force)
+#   # keel policy (all/major/minor/patch/force)
-    #   policy: patch
+#   policy: patch
-    #   # trigger type, defaults to events such as pubsub, webhooks
+#   # trigger type, defaults to events such as pubsub, webhooks
-    #   trigger: poll
+#   trigger: poll
-    #   # polling schedule
+#   # polling schedule
-    #   pollSchedule: "@every 3m"
+#   pollSchedule: "@every 3m"
-    #   # images to track and update
+#   # images to track and update
-    #   images:
+#   images:
-    #     - repository: image.repository
+#     - repository: image.repository
-    #       tag: image.tag
+#       tag: image.tag
 
-    # RBAC manifests management
+# RBAC manifests management
-    rbac:
+rbac:
-      enabled: true
+  enabled: true
-      serviceAccount:
+  serviceAccount:
-        # Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
+    # Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
-        # name:
+    # name:
-        # Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
+    # Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
-        # If rbac.serviceAccount.name is not set, a new name for the service account is generated
+    # If rbac.serviceAccount.name is not set, a new name for the service account is generated
-        create: true
+    create: true
 
-    # Resources
+# Resources
-    resources:
+resources:
-      limits:
+  limits:
-        cpu: 100m
+    cpu: 100m
-        memory: 128Mi
+    memory: 128Mi
-      requests:
+  requests:
-        cpu: 50m
+    cpu: 50m
-        memory: 64Mi
+    memory: 64Mi
 
-    # NodeSelector
+# NodeSelector
-    nodeSelector: {}
+nodeSelector: {}
 
-    affinity: {}
+affinity: {}
 
-    tolerations: {}
+tolerations: {}
 
-    # base64 encoded json of GCP service account
+# base64 encoded json of GCP service account
-    # more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
+# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
-    # e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
+# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
-    googleApplicationCredentials: ""
+googleApplicationCredentials: ""
 
-    # Enable DEBUG logging
+# Enable DEBUG logging
-    debug: false
+debug: false
 
-    # This is used by the static manifest generator in order to create a static
+# This is used by the static manifest generator in order to create a static
-    # namespace manifest for the namespace that keel is being installed
+# namespace manifest for the namespace that keel is being installed
-    # within. It should **not** be used if you are using Helm for deployment.
+# within. It should **not** be used if you are using Helm for deployment.
-    createNamespaceResource: false
+createNamespaceResource: false
 
-    podAnnotations: {}
+podAnnotations: {}
 
-    serviceAnnotations: {}
+serviceAnnotations: {}
-    # Useful for making the load balancer internal
+# Useful for making the load balancer internal
-    # serviceAnnotations:
+# serviceAnnotations:
-    #    cloud.google.com/load-balancer-type: Internal
+#    cloud.google.com/load-balancer-type: Internal
 
-    aws:
+aws:
-      region: null
+  region: null
 
-    podDisruptionBudget:
+podDisruptionBudget:
-      enabled: false
+  enabled: false
-      maxUnavailable: 1
+  maxUnavailable: 1
-      minAvailable: null
+  minAvailable: null
 
-    # Google Cloud Certificates
+# Google Cloud Certificates
-    gcloud:
+gcloud:
-      managedCertificates:
+  managedCertificates:
-        enabled: false
+    enabled: false
-        domains:
+    domains:
-          - ""
+      - ""
 
-    ingress:
+ingress:
-      enabled: false
+  enabled: false
-      labels: {}
+  labels: {}
-      annotations: {}
+  annotations: {}
-    #    kubernetes.io/ingress.class: nginx
+#    kubernetes.io/ingress.class: nginx
-    #    kubernetes.io/tls-acme: "true"
+#    kubernetes.io/tls-acme: "true"
-      hosts: []
+  hosts: []
-    #    - host: chart-example.local
+#    - host: chart-example.local
-    #      paths:
+#      paths:
-    #        - /
+#        - /
-      tls: []
+  tls: []
-    #    - secretName: chart-example-tls
+#    - secretName: chart-example-tls
-    #      hosts:
+#      hosts:
-    #        - chart-example.local
+#        - chart-example.local
 
-    dockerRegistry:
+dockerRegistry:
-      enabled: false
+  enabled: false
-      name: ""
+  name: ""
-      key: ""
+  key: ""
 
-    persistence:
+persistence:
-      enabled: false
+  enabled: false
-      storageClass: "-"
+  storageClass: "-"
-      size: 1Gi
+  size: 1Gi

internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl

@@ -1,66 +1,55 @@
-- name: fluent-operator
+# Set this to containerd or crio if you want to collect CRI format logs
-  namespace: observability
+containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
-  create_namespace: true
+Kubernetes: false
-  chart_ref: {{ .Modules.Observability.Logging.Operator.ChartRef }}
-  chart_version: {{ .Modules.Observability.Logging.Operator.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    # Set this to containerd or crio if you want to collect CRI format logs
-    containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
-    Kubernetes: false
 
-    operator:
+operator:
-      initcontainer:
+  initcontainer:
-        repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
+    repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
-        tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
+    tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
 
-        resources:
+    resources:
-          limits:
+      limits:
-            cpu: 100m
+        cpu: 100m
-            memory: 100Mi
+        memory: 100Mi
 
-          requests:
+      requests:
-            cpu: 50m
+        cpu: 50m
-            memory: 64Mi
+        memory: 64Mi
-      container:
+  container:
-        repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
+    repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
-        tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
+    tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
-      resources:
+  resources:
-        limits:
+    limits:
-          cpu: 100m
+      cpu: 100m
-          memory: 100Mi
+      memory: 100Mi
-        requests:
+    requests:
-          cpu: 100m
+      cpu: 100m
-          memory: 60Mi
+      memory: 60Mi
-      imagePullSecrets: []
+  imagePullSecrets: []
-      labels: {}
+  labels: {}
-      logPath:
+  logPath:
-        # The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
+    # The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
-        # crio: /var/log
+    # crio: /var/log
-        containerd: /var/log
+    containerd: /var/log
-      disableComponentControllers: ""
+  disableComponentControllers: ""
 
-    fluentbit:
+fluentbit:
-      crdsEnable: true
+  crdsEnable: true
-      enable: false
+  enable: false
 
-    fluentd:
+fluentd:
-      crdsEnable: true
+  crdsEnable: true
-      enable: false
+  enable: false
-      name: fluentd
+  name: fluentd
-      # Valid modes include "collector" and "agent".
+  # Valid modes include "collector" and "agent".
-      # The "collector" mode will deploy Fluentd as a StatefulSet as before.
+  # The "collector" mode will deploy Fluentd as a StatefulSet as before.
-      # The new "agent" mode will deploy Fluentd as a DaemonSet.
+  # The new "agent" mode will deploy Fluentd as a DaemonSet.
-      mode: "agent"
+  mode: "agent"
-      port: 24224
+  port: 24224
-      image:
+  image:
-        repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
+    repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
-        tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
+    tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
 
-    nameOverride: ""
+nameOverride: ""
-    fullnameOverride: ""
+fullnameOverride: ""
-    namespaceOverride: ""
+namespaceOverride: ""

internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl

@@ -1,200 +1,188 @@
-- name: loki
+loki:
-  namespace: observability
+  image:
-  create_namespace: true
+    registry: {{ .Modules.Observability.Logging.Loki.Registry }}
-  chart_ref: {{ .Modules.Observability.Logging.Loki.ChartRef }}
+    repository: {{ .Modules.Observability.Logging.Loki.Image }}
-  chart_version: {{ .Modules.Observability.Logging.Loki.ChartVersion }}
+    tag: {{ .Modules.Observability.Logging.Loki.Tag }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
+  podAnnotations:
-  release_state: "present"
+    app.kubernetes.io/component: "loki"
-  {{- else }}
+  auth_enabled: false
-  release_state: "absent"
+  commonConfig:
-  {{- end }}
+    replication_factor: 1
-  values:
+  storage:
-    loki:
+    type: 'filesystem'
-      image:
-        registry: {{ .Modules.Observability.Logging.Loki.Registry }}
-        repository: {{ .Modules.Observability.Logging.Loki.Image }}
-        tag: {{ .Modules.Observability.Logging.Loki.Tag }}
-      podAnnotations:
-        app.kubernetes.io/component: "loki"
-      auth_enabled: false
-      commonConfig:
-        replication_factor: 1
-      storage:
-        type: 'filesystem'
 
-      frontend:
+  frontend:
-        max_outstanding_per_tenant: 10000
+    max_outstanding_per_tenant: 10000
 
-      limits_config:
+  limits_config:
-        reject_old_samples: false
+    reject_old_samples: false
-        split_queries_by_interval: 15m
+    split_queries_by_interval: 15m
-        max_query_parallelism: 32
+    max_query_parallelism: 32
-        max_query_series: 10000
+    max_query_series: 10000
-        retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
+    retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
 
-      compactor:
+  compactor:
-        compaction_interval: 10m
+    compaction_interval: 10m
-        retention_enabled: true
+    retention_enabled: true
-        retention_delete_delay: 2h
+    retention_delete_delay: 2h
 
-      querier:
+  querier:
-        max_concurrent: 2048
+    max_concurrent: 2048
 
-      query_scheduler:
+  query_scheduler:
-        max_outstanding_requests_per_tenant: 10000
+    max_outstanding_requests_per_tenant: 10000
 
-      rulerConfig:
+  rulerConfig:
-        storage:
+    storage:
-          type: local
+      type: local
-          local:
+      local:
-            directory: /var/loki/rules
+        directory: /var/loki/rules
-        rule_path: /tmp/rules
+    rule_path: /tmp/rules
 
-        alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
+    alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
 
 
-    singleBinary:
+singleBinary:
-      replicas: 1
+  replicas: 1
 
-      extraVolumes:
+  extraVolumes:
-        - name: loki-default-rules
+    - name: loki-default-rules
-          configMap:
+      configMap:
-            name: loki-default-alerting-rules
+        name: loki-default-alerting-rules
 
-      extraVolumeMounts:
+  extraVolumeMounts:
-        - name: loki-default-rules
+    - name: loki-default-rules
-          mountPath: /var/loki/rules
+      mountPath: /var/loki/rules
 
 
-    write:
+write:
-      persistence:
+  persistence:
-        volumeClaimsEnabled: true
+    volumeClaimsEnabled: true
-        storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
+    storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
-        size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
+    size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
 
-    test:
+test:
-      enabled: false
+  enabled: false
 
-    gateway:
+gateway:
-      enabled: false
+  enabled: false
 
-    monitoring:
+monitoring:
-      selfMonitoring:
+  selfMonitoring:
-        enabled: false
+    enabled: false
-        grafanaAgent:
+    grafanaAgent:
-          installOperator: false
+      installOperator: false
-      lokiCanary:
+  lokiCanary:
-        enabled: false
+    enabled: false
-      rules:
+  rules:
-        enabled: true
+    enabled: true
-        alerting: true
+    alerting: true
-        additionalGroups: {}
 
-    extraObjects:
+extraObjects:
-      - apiVersion: v1
+  - apiVersion: v1
-        kind: ConfigMap
+    kind: ConfigMap
-        metadata:
+    metadata:
-          name: loki-default-alerting-rules
+      name: loki-default-alerting-rules
-          labels:
+      labels:
-            loki_rule: ""
+        loki_rule: ""
 
-        data:
+    data:
-          loki-default-alerting-rules.yaml: |-
+      loki-default-alerting-rules.yaml: |-
-            groups:
+        groups:
-              {{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
+          {{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
-              - name: kube-events-alerts
+          - name: kube-events-alerts
-                rules:
+            rules:
-                  - alert: FailedEventsOccured
+              - alert: FailedEventsOccured
-                    expr: |
+                expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
+                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
-                    for: 1m
+                for: 1m
-                    labels:
+                labels:
-                      severity: critical
+                  severity: critical
-                    annotations:
+                annotations:
-                      alertname: FailedEventsOccured
+                  alertname: FailedEventsOccured
-                      instance: kube-cluster
+                  instance: kube-cluster
-                      jobName: kube_events
+                  jobName: kube_events
-                      summary: Failed events occured in cluster
+                  summary: Failed events occured in cluster
-                      addDefaultUrl: "true"
+                  addDefaultUrl: "true"
 
-                  - alert: OOMKilledEventsOccured
+              - alert: OOMKilledEventsOccured
-                    expr: |
+                expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
+                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
-                    for: 1m
+                for: 1m
-                    labels:
+                labels:
-                      severity: critical
+                  severity: critical
-                    annotations:
+                annotations:
-                      alertname: OOMKilledEventsOccured
+                  alertname: OOMKilledEventsOccured
-                      instance: kube-cluster
+                  instance: kube-cluster
-                      jobName: kube_events
+                  jobName: kube_events
-                      summary: OOMKilled events occured in cluster
+                  summary: OOMKilled events occured in cluster
-                      addDefaultUrl: "true"
+                  addDefaultUrl: "true"
 
-                  - alert: EvictedEventsOccured
+              - alert: EvictedEventsOccured
-                    expr: |
+                expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
+                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
-                    for: 1m
+                for: 1m
-                    labels:
+                labels:
-                      severity: critical
+                  severity: critical
-                    annotations:
+                annotations:
-                      alertname: EvictedEventsOccured
+                  alertname: EvictedEventsOccured
-                      instance: kube-cluster
+                  instance: kube-cluster
-                      jobName: kube_events
+                  jobName: kube_events
-                      summary: Evicted events occured in cluster
+                  summary: Evicted events occured in cluster
-                      addDefaultUrl: "true"
+                  addDefaultUrl: "true"
 
-                  - alert: ImagePullBackOffEventsOccured
+              - alert: ImagePullBackOffEventsOccured
-                    expr: |
+                expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
+                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
-                    for: 1m
+                for: 1m
-                    labels:
+                labels:
-                      severity: critical
+                  severity: critical
-                    annotations:
+                annotations:
-                      alertname: ImagePullBackOffEventsOccured
+                  alertname: ImagePullBackOffEventsOccured
-                      instance: kube-cluster
+                  instance: kube-cluster
-                      jobName: kube_events
+                  jobName: kube_events
-                      summary: ImagePullBackOff events occured in cluster
+                  summary: ImagePullBackOff events occured in cluster
-                      addDefaultUrl: "true"
+                  addDefaultUrl: "true"
 
-                  - alert: BackOffEventsOccured
+              - alert: BackOffEventsOccured
-                    expr: |
+                expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
+                  count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
-                    for: 1m
+                for: 1m
-                    labels:
+                labels:
-                      severity: critical
+                  severity: critical
-                    annotations:
+                annotations:
-                      alertname: BackOffEventsOccured
+                  alertname: BackOffEventsOccured
-                      instance: kube-cluster
+                  instance: kube-cluster
-                      jobName: kube_events
+                  jobName: kube_events
-                      summary: BackOff events occured in cluster
+                  summary: BackOff events occured in cluster
-                      addDefaultUrl: "true"
+                  addDefaultUrl: "true"
-    sidecar:
+sidecar:
-      rules:
+  rules:
-        enabled: true
+    enabled: true
-        # -- Label that the configmaps/secrets with rules will be marked with.
+    # -- Label that the configmaps/secrets with rules will be marked with.
-        label: loki_rule
+    label: loki_rule
-        # -- Label value that the configmaps/secrets with rules will be set to.
+    # -- Label value that the configmaps/secrets with rules will be set to.
-        labelValue: ""
+    labelValue: ""
-        # -- Folder into which the rules will be placed.
+    # -- Folder into which the rules will be placed.
-        folder: /var/loki/rules
+    folder: /var/loki/rules
-        # -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
+    # -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
-        # Otherwise the namespace in which the sidecar is running will be used.
+    # Otherwise the namespace in which the sidecar is running will be used.
-        # It's also possible to specify 'ALL' to search in all namespaces.
+    # It's also possible to specify 'ALL' to search in all namespaces.
-        searchNamespace: 'ALL'
+    searchNamespace: 'ALL'
-        # -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
+    # -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
-        watchMethod: WATCH
+    watchMethod: WATCH
-        # -- Search in configmap, secret, or both.
+    # -- Search in configmap, secret, or both.
-        resource: both
+    resource: both
-        # -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
+    # -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
-        script: null
+    script: null
-        # -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
+    # -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
-        # defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
+    # defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
-        watchServerTimeout: 60
+    watchServerTimeout: 60
-        #
+    #
-        # -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
+    # -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
-        # If you have a network outage dropping all packets with no RST/FIN,
+    # If you have a network outage dropping all packets with no RST/FIN,
-        # this is how long your client waits before realizing & dropping the connection.
+    # this is how long your client waits before realizing & dropping the connection.
-        # Defaults to 66sec.
+    # Defaults to 66sec.
-        watchClientTimeout: 60
+    watchClientTimeout: 60
-        # -- Log level of the sidecar container.
+    # -- Log level of the sidecar container.
-        logLevel: INFO
+    logLevel: INFO

internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl

@@ -1,203 +1,192 @@
-- name: metrics-server
+image:
-  namespace: kube-system
+  repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
-  create_namespace: true
+  tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
-  chart_ref: {{ .Modules.Observability.Monitoring.MetricsServer.ChartRef }}
+  pullPolicy: IfNotPresent
-  chart_version: {{ .Modules.Observability.Monitoring.MetricsServer.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    image:
-      repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
-      tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
-      pullPolicy: IfNotPresent
 
-    imagePullSecrets: []
+imagePullSecrets: []
-    # - name: registrySecretName
+# - name: registrySecretName
 
-    nameOverride: ""
+nameOverride: ""
-    fullnameOverride: ""
+fullnameOverride: ""
 
-    serviceAccount:
+serviceAccount:
-      # Specifies whether a service account should be created
+  # Specifies whether a service account should be created
-      create: true
+  create: true
-      # Annotations to add to the service account
+  # Annotations to add to the service account
-      annotations: {}
+  annotations: {}
-      # The name of the service account to use.
+  # The name of the service account to use.
-      # If not set and create is true, a name is generated using the fullname template
+  # If not set and create is true, a name is generated using the fullname template
-      name: ""
+  name: ""
-      # The list of secrets mountable by this service account.
+  # The list of secrets mountable by this service account.
-      # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
+  # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
-      secrets: []
+  secrets: []
 
-    rbac:
+rbac:
-      # Specifies whether RBAC resources should be created
+  # Specifies whether RBAC resources should be created
-      create: true
+  create: true
-      pspEnabled: false
+  pspEnabled: false
 
-    apiService:
+apiService:
-      create: true
+  create: true
-      # Annotations to add to the API service
+  # Annotations to add to the API service
-      annotations: {}
+  annotations: {}
-      # Specifies whether to skip TLS verification
+  # Specifies whether to skip TLS verification
-      insecureSkipTLSVerify: true
+  insecureSkipTLSVerify: true
-      # The PEM encoded CA bundle for TLS verification
+  # The PEM encoded CA bundle for TLS verification
-      caBundle: ""
+  caBundle: ""
 
-    commonLabels: {}
+commonLabels: {}
-    podLabels:
+podLabels:
-      "app.kubernetes.io/component": "metrics-server"
+  "app.kubernetes.io/component": "metrics-server"
-    podAnnotations: {}
+podAnnotations: {}
 
-    podSecurityContext: {}
+podSecurityContext: {}
 
-    securityContext:
+securityContext:
-      allowPrivilegeEscalation: false
+  allowPrivilegeEscalation: false
-      readOnlyRootFilesystem: true
+  readOnlyRootFilesystem: true
-      runAsNonRoot: true
+  runAsNonRoot: true
-      runAsUser: 1000
+  runAsUser: 1000
-      seccompProfile:
+  seccompProfile:
-        type: RuntimeDefault
+    type: RuntimeDefault
-      capabilities:
+  capabilities:
-        drop:
+    drop:
-          - ALL
+      - ALL
 
-    priorityClassName: system-cluster-critical
+priorityClassName: system-cluster-critical
 
-    containerPort: 10250
+containerPort: 10250
 
-    hostNetwork:
+hostNetwork:
-      # Specifies if metrics-server should be started in hostNetwork mode.
+  # Specifies if metrics-server should be started in hostNetwork mode.
-      #
+  #
-      # You would require this enabled if you use alternate overlay networking for pods and
+  # You would require this enabled if you use alternate overlay networking for pods and
-      # API server unable to communicate with metrics-server. As an example, this is required
+  # API server unable to communicate with metrics-server. As an example, this is required
-      # if you use Weave network on EKS
+  # if you use Weave network on EKS
-      enabled: false
+  enabled: false
 
-    replicas: 1
+replicas: 1
 
-    revisionHistoryLimit:
+revisionHistoryLimit:
 
-    updateStrategy: {}
+updateStrategy: {}
-    #   type: RollingUpdate
+#   type: RollingUpdate
-    #   rollingUpdate:
+#   rollingUpdate:
-    #     maxSurge: 0
+#     maxSurge: 0
-    #     maxUnavailable: 1
+#     maxUnavailable: 1
 
-    podDisruptionBudget:
+podDisruptionBudget:
-      # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+  # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
-      enabled: false
+  enabled: false
-      minAvailable:
+  minAvailable:
-      maxUnavailable:
+  maxUnavailable:
 
-    defaultArgs:
+defaultArgs:
-      - --cert-dir=/tmp
+  - --cert-dir=/tmp
-      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
+  - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
-      - --kubelet-use-node-status-port
+  - --kubelet-use-node-status-port
-      - --metric-resolution=15s
+  - --metric-resolution=15s
-      - --kubelet-insecure-tls
+  - --kubelet-insecure-tls
 
-    args: []
+args: []
 
-    livenessProbe:
+livenessProbe:
-      httpGet:
+  httpGet:
-        path: /livez
+    path: /livez
-        port: https
+    port: https
-        scheme: HTTPS
+    scheme: HTTPS
-      initialDelaySeconds: 0
+  initialDelaySeconds: 0
-      periodSeconds: 10
+  periodSeconds: 10
-      failureThreshold: 3
+  failureThreshold: 3
 
-    readinessProbe:
+readinessProbe:
-      httpGet:
+  httpGet:
-        path: /readyz
+    path: /readyz
-        port: https
+    port: https
-        scheme: HTTPS
+    scheme: HTTPS
-      initialDelaySeconds: 20
+  initialDelaySeconds: 20
-      periodSeconds: 10
+  periodSeconds: 10
-      failureThreshold: 3
+  failureThreshold: 3
 
-    service:
+service:
-      type: ClusterIP
+  type: ClusterIP
-      port: 443
+  port: 443
-      annotations: {}
+  annotations: {}
-      labels: {}
+  labels: {}
-      #  Add these labels to have metrics-server show up in `kubectl cluster-info`
+  #  Add these labels to have metrics-server show up in `kubectl cluster-info`
-      #  kubernetes.io/cluster-service: "true"
+  #  kubernetes.io/cluster-service: "true"
-      #  kubernetes.io/name: "Metrics-server"
+  #  kubernetes.io/name: "Metrics-server"
 
-    addonResizer:
+addonResizer:
-      enabled: false
+  enabled: false
-      image:
+  image:
-        repository: registry.k8s.io/autoscaling/addon-resizer
+    repository: registry.k8s.io/autoscaling/addon-resizer
-        tag: 1.8.20
+    tag: 1.8.20
-      securityContext:
+  securityContext:
-        allowPrivilegeEscalation: false
+    allowPrivilegeEscalation: false
-        readOnlyRootFilesystem: true
+    readOnlyRootFilesystem: true
-        runAsNonRoot: true
+    runAsNonRoot: true
-        runAsUser: 1000
+    runAsUser: 1000
-        seccompProfile:
+    seccompProfile:
-          type: RuntimeDefault
+      type: RuntimeDefault
-        capabilities:
+    capabilities:
-          drop:
+      drop:
-            - ALL
+        - ALL
-      resources:
+  resources:
-        requests:
+    requests:
-          cpu: 40m
+      cpu: 40m
-          memory: 25Mi
+      memory: 25Mi
-        limits:
+    limits:
-          cpu: 40m
+      cpu: 40m
-          memory: 25Mi
+      memory: 25Mi
-      nanny:
+  nanny:
-        cpu: 0m
+    cpu: 0m
-        extraCpu: 1m
+    extraCpu: 1m
-        memory: 0Mi
+    memory: 0Mi
-        extraMemory: 2Mi
+    extraMemory: 2Mi
-        minClusterSize: 100
+    minClusterSize: 100
-        pollPeriod: 300000
+    pollPeriod: 300000
-        threshold: 5
+    threshold: 5
 
-    metrics:
+metrics:
-      enabled: true
+  enabled: true
 
-    serviceMonitor:
+serviceMonitor:
-      enabled: true
+  enabled: true
-      additionalLabels: {}
+  additionalLabels: {}
-      interval: 1m
+  interval: 1m
-      scrapeTimeout: 10s
+  scrapeTimeout: 10s
-      metricRelabelings: []
+  metricRelabelings: []
-      relabelings: []
+  relabelings: []
 
-    # See https://github.com/kubernetes-sigs/metrics-server#scaling
+# See https://github.com/kubernetes-sigs/metrics-server#scaling
-    resources:
+resources:
-      requests:
+  requests:
-        cpu: 100m
+    cpu: 100m
-        memory: 200Mi
+    memory: 200Mi
-      # limits:
+  # limits:
-      #   cpu:
+  #   cpu:
-      #   memory:
+  #   memory:
 
-    extraVolumeMounts: []
+extraVolumeMounts: []
 
-    extraVolumes: []
+extraVolumes: []
 
-    nodeSelector: {}
+nodeSelector: {}
 
-    tolerations: []
+tolerations: []
 
-    affinity: {}
+affinity: {}
 
-    topologySpreadConstraints: []
+topologySpreadConstraints: []
 
-    dnsConfig: {}
+dnsConfig: {}
 
-    # Annotations to add to the deployment
+# Annotations to add to the deployment
-    deploymentAnnotations: {}
+deploymentAnnotations: {}
 
-    schedulerName: ""
+schedulerName: ""
 
-    tmpVolume:
+tmpVolume:
-      emptyDir: {}
+  emptyDir: {}
 

internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl

@@ -1,402 +1,391 @@
-- name: observability
+prometheus:
-  namespace: observability
+  enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-  create_namespace: true
+  serviceMonitor: true
-  chart_ref: {{ .Modules.Observability.ChartRef }}
+  image:
-  chart_version: {{ .Modules.Observability.ChartVersion }}
+    repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
-  {{- if .Modules.Observability.Enabled }}
+    tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
-  release_state: "present"
+    pullPolicy: IfNotPresent
-  {{- else }}
+
-  release_state: "absent"
+  clustering:
+    enabled: false
+    replicas: 3
+    shards: 1
+
+  persistence:
+    enabled: true
+
+    storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
+    storageResources:
+      requests:
+        storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
+
+  scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
+  retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
+  # serviceNodePort: 30008
+
+  additionalConfigs: |
+    - job_name: "kubelet"
+      scheme: https
+      metrics_path: /metrics/cadvisor
+      tls_config:
+        insecure_skip_verify: true
+      authorization:
+        credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      kubernetes_sd_configs:
+        - role: node
+      relabel_configs:
+        - action: labelmap
+          regex: __meta_kubernetes_node_label_(.+)
+
+    - job_name: "kubernetes-apiservers"
+      kubernetes_sd_configs:
+        - role: endpoints
+      scheme: https
+      tls_config:
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      authorization:
+        credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      relabel_configs:
+        - source_labels:
+            [
+              __meta_kubernetes_namespace,
+              __meta_kubernetes_service_name,
+              __meta_kubernetes_endpoint_port_name,
+            ]
+          action: keep
+          regex: default;kubernetes;https
+
+    - job_name: "coredns"
+      kubernetes_sd_configs:
+        - role: endpoints
+      scheme: http
+      relabel_configs:
+        - source_labels:
+            [
+              __meta_kubernetes_namespace,
+              __meta_kubernetes_service_name,
+              __meta_kubernetes_endpoint_port_name,
+            ]
+          action: keep
+          regex: kube-system;.*dns.*;metrics
+
+    {{- if .Modules.Observability.Monitoring.Blackbox.Enabled }}
+    - job_name: 'ingress-endpoints'
+      metrics_path: /probe
+      params:
+        module: [https_ok]
+      kubernetes_sd_configs:
+        - role: ingress
+      relabel_configs:
+        - source_labels: [__address__]
+          target_label: __param_target
+        - source_labels: [__param_target]
+          target_label: instance
+        - source_labels:
+            [
+              __meta_kubernetes_ingress_scheme,
+              __address__,
+              __meta_kubernetes_ingress_path,
+            ]
+          regex: (.+);(.+);(.+)
+          replacement: https://${2}${3}/
+          target_label: __param_target
+        - target_label: __address__
+          replacement: observability-blackbox-exporter:9115
+      {{- end }}
+
+alertManager:
+  enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }}
+  serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
+  enableDefaultRules: true
+  image:
+    repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
+    tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
+    pullPolicy: IfNotPresent
+
+  # serviceNodePort: 30009
+
+  configPath: /etc/alertmanager
+  {{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }}
+  additionalMessageTemplates:
+    {{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }}
+  {{- end }}
+  {{- if .Modules.Observability.Monitoring.AlertManager.Route }}
+  route:
+    {{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
+  {{- end }}
+  {{- if .Modules.Observability.Monitoring.AlertManager.Receivers }}
+  receivers:
+    {{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
   {{- end }}
-  values:
-    prometheus:
-      enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-      serviceMonitor: true
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
-        tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
-        pullPolicy: IfNotPresent
 
-      clustering:
+blackboxExporter:
-        enabled: false
+  enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }}
-        replicas: 3
+  serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-        shards: 1
+  image:
+    repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
+    tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
+    pullPolicy: IfNotPresent
 
-      persistence:
+  # serviceNodePort: 30012
-        enabled: true
 
-        storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
+  configPath: /etc/blackbox_exporter
-        storageResources:
+  additionalModules:
-          requests:
-            storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
 
-      scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
-      retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
-      # serviceNodePort: 30008
 
-      additionalConfigs: |
+kubeStateMetrics:
-        - job_name: "kubelet"
+  enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }}
-          scheme: https
+  image:
-          metrics_path: /metrics/cadvisor
+    repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
-          tls_config:
+    tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
-            insecure_skip_verify: true
+    pullPolicy: IfNotPresent
-          authorization:
+  resources:
-            credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+    requests:
-          kubernetes_sd_configs:
+      cpu: 30m
-            - role: node
+      memory: 120Mi
-          relabel_configs:
+    limits:
-            - action: labelmap
+      memory: 240Mi
-              regex: __meta_kubernetes_node_label_(.+)
+      cpu: 60m
 
-        - job_name: "kubernetes-apiservers"
+prometheusOperator:
-          kubernetes_sd_configs:
+  enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-            - role: endpoints
+  image:
-          scheme: https
+    repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
-          tls_config:
+    tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
-            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+    pullPolicy: IfNotPresent
-          authorization:
-            credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-          relabel_configs:
-            - source_labels:
-                [
-                  __meta_kubernetes_namespace,
-                  __meta_kubernetes_service_name,
-                  __meta_kubernetes_endpoint_port_name,
-                ]
-              action: keep
-              regex: default;kubernetes;https
 
-        - job_name: "coredns"
+  prometheusConfigReloader:
-          kubernetes_sd_configs:
+    image:
-            - role: endpoints
+      repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
-          scheme: http
+      tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
-          relabel_configs:
+      pullPolicy: IfNotPresent
-            - source_labels:
-                [
-                  __meta_kubernetes_namespace,
-                  __meta_kubernetes_service_name,
-                  __meta_kubernetes_endpoint_port_name,
-                ]
-              action: keep
-              regex: kube-system;.*dns.*;metrics
 
-        {{- if .Modules.Observability.Monitoring.Blackbox.Enabled }}
+  kubeRbacProxy:
-        - job_name: 'ingress-endpoints'
+    image:
-          metrics_path: /probe
+      repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
-          params:
+      tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
-            module: [https_ok]
+      pullPolicy: IfNotPresent
-          kubernetes_sd_configs:
-            - role: ingress
-          relabel_configs:
-            - source_labels: [__address__]
-              target_label: __param_target
-            - source_labels: [__param_target]
-              target_label: instance
-            - source_labels:
-                [
-                  __meta_kubernetes_ingress_scheme,
-                  __address__,
-                  __meta_kubernetes_ingress_path,
-                ]
-              regex: (.+);(.+);(.+)
-              replacement: https://${2}${3}/
-              target_label: __param_target
-            - target_label: __address__
-              replacement: observability-blackbox-exporter:9115
-         {{- end }}
 
-    alertManager:
+nodeExporter:
-      enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.AlertManager.Enabled }}
+  enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }}
-      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
+  image:
-      enableDefaultRules: true
+    repository: {{ .Modules.Observability.Monitoring.Node.Image }}
-      image:
+    tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
-        repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
+    pullPolicy: IfNotPresent
-        tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
-        pullPolicy: IfNotPresent
 
-      # serviceNodePort: 30009
+kubeEventsExporter:
+  enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
+  image:
+    repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
+    tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
+    pullPolicy: IfNotPresent
+  lokiAddress: http://loki.observability.svc.cluster.local:3100
+  logLevel: warn
+  logFormat: json
+  kubeQPS: 100
+  kubeBurst: 500
+  maxEventAgeSeconds: 120
+  metricsNamePrefix: event_exporter_
 
-      configPath: /etc/alertmanager
+  cron:
-      {{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }}
+    restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
-      additionalMessageTemplates:
+    image:
-        {{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }}
+      repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
-      {{- end }}
+      tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
-      {{- if .Modules.Observability.Monitoring.AlertManager.Route }}
+      pullPolicy: IfNotPresent
-      route:
+  additionalRoutes:
-        {{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
+  additionalReceivers:
-      {{- end }}
+
-      {{- if .Modules.Observability.Monitoring.AlertManager.Receivers }}
+grafana:
-      receivers:
+  enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
-        {{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
+  serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
+  domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
+  path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
+  {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
+  serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
+  {{- end }}
+  image:
+    repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
+    tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
+    pullPolicy: IfNotPresent
+
+  storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
+  storageResources:
+    requests:
+      storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
+
+  config:
+    server: |
+      enable_gzip = true
+      root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
+      {{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path  "/") }}
+      serve_from_sub_path = true
       {{- end }}
 
-    blackboxExporter:
+    security: |
-      enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Blackbox.Enabled }}
+      admin_user = admin
-      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
+      admin_password = {{ .Modules.AdminPassword }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
-        tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
-        pullPolicy: IfNotPresent
 
-      # serviceNodePort: 30012
+    auth: |
+      {{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
 
-      configPath: /etc/blackbox_exporter
+    authGenericAuth: |
-      additionalModules:
+      {{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
 
-
+    additionalDatasources:
-    kubeStateMetrics:
+      {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-      enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.KubeState.Enabled }}
+      - name: Kube-loki
-      image:
+        type: loki
-        repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
+        uid: P2895588539814C92
-        tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
+        access: proxy
-        pullPolicy: IfNotPresent
+        url: http://loki:3100
-      resources:
+        editable: false
-        requests:
+        basicAuth: false
-          cpu: 30m
+        isDefault: false
-          memory: 120Mi
+        jsonData:
-        limits:
+          maxLines: 1000
-          memory: 240Mi
-          cpu: 60m
-
-    prometheusOperator:
-      enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
-        tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
-        pullPolicy: IfNotPresent
-
-      prometheusConfigReloader:
-        image:
-          repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
-          tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
-          pullPolicy: IfNotPresent
-
-      kubeRbacProxy:
-        image:
-          repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
-          tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
-          pullPolicy: IfNotPresent
-
-    nodeExporter:
-      enabled: {{ and .Modules.Observability.Monitoring.Enabled .Modules.Observability.Monitoring.Node.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Node.Image }}
-        tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
-        pullPolicy: IfNotPresent
-
-    kubeEventsExporter:
-      enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
-        tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
-        pullPolicy: IfNotPresent
-      lokiAddress: http://loki.observability.svc.cluster.local:3100
-      logLevel: warn
-      logFormat: json
-      kubeQPS: 100
-      kubeBurst: 500
-      maxEventAgeSeconds: 120
-      metricsNamePrefix: event_exporter_
-
-      cron:
-        restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
-        image:
-          repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
-          tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
-          pullPolicy: IfNotPresent
-      additionalRoutes:
-      additionalReceivers:
-
-    grafana:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
-      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-      domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-      path: {{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
-      {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
-      serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
       {{- end }}
-      image:
+      {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-        repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
+      - name: Kube-jaeger-query
-        tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
+        type: jaeger
-        pullPolicy: IfNotPresent
+        access: proxy
-
+        url: http://tempo:16686
-      storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
+        editable: false
-      storageResources:
+        basicAuth: false
-        requests:
+        isDefault: false
-          storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
+      {{- end }}
-
+      {{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
-      config:
+      {{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
-        server: |
-          enable_gzip = true
-          root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}{{ .Modules.Observability.Visualization.Grafana.Expose.Path }}
-          {{- if not (eq .Modules.Observability.Visualization.Grafana.Expose.Path  "/") }}
-          serve_from_sub_path = true
-          {{- end }}
-
-        security: |
-          admin_user = admin
-          admin_password = {{ .Modules.AdminPassword }}
-
-        auth: |
-          {{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
-
-        authGenericAuth: |
-          {{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
-
-        additionalDatasources:
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-          - name: Kube-loki
-            type: loki
-            uid: P2895588539814C92
-            access: proxy
-            url: http://loki:3100
-            editable: false
-            basicAuth: false
-            isDefault: false
-            jsonData:
-              maxLines: 1000
-          {{- end }}
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-          - name: Kube-jaeger-query
-            type: jaeger
-            access: proxy
-            url: http://tempo:16686
-            editable: false
-            basicAuth: false
-            isDefault: false
-          {{- end }}
-          {{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
-          {{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
-          {{- end }}
-
-    opentelemetryCollector:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-      serviceMonitor: true
-      config: |
-        receivers:
-          otlp:
-            protocols:
-              grpc:
-              http:
-        exporters:
-          otlphttp:
-            endpoint: http://tempo:4318
-        service:
-          telemetry:
-            logs:
-              level: "debug"
-          pipelines:
-            traces:
-              receivers: [otlp]
-              exporters: [otlphttp]
-
-    ingress:
-      {{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }}
-      enabled: true
-      {{- else }}
-      enabled: false
       {{- end }}
-      accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-      class: {{ .Modules.Additional.Ingress.Type }}
-      annotations:
-        {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-        nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-        nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-        {{- end }}
-      tls:
-        {{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
-        enabled: true
-        {{- end }}
-        hosts:
-          - host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-            secretName: grafana-tls
 
-    containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
+opentelemetryCollector:
+  enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
+  serviceMonitor: true
+  config: |
+    receivers:
+      otlp:
+        protocols:
+          grpc:
+          http:
+    exporters:
+      otlphttp:
+        endpoint: http://tempo:4318
+    service:
+      telemetry:
+        logs:
+          level: "debug"
+      pipelines:
+        traces:
+          receivers: [otlp]
+          exporters: [otlphttp]
 
-    fluentbit:
+ingress:
-      enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
+  {{- if and .Modules.Observability.Visualization.Grafana.Enabled (eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress") }}
-      serviceMonitor: true
+  enabled: true
-      image:
+  {{- else }}
-        repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
+  enabled: false
-        tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
+  {{- end }}
+  accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
+  class: {{ .Modules.Additional.Ingress.Type }}
+  annotations:
+    {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
+    nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
+    nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
+    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
+    {{- end }}
+  tls:
+    {{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
+    enabled: true
+    {{- end }}
+    hosts:
+      - host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
+        secretName: grafana-tls
 
-      affinity:
+containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/edge
-                    operator: DoesNotExist
-      tolerations:
-        - operator: Exists
 
-      input:
+fluentbit:
-        tail:
+  enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-          enable: true
+  serviceMonitor: true
-          refreshIntervalSeconds: 10
+  image:
-          memBufLimit: 100MB
+    repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
-          bufferMaxSize: ""
+    tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
-          path: "/var/log/containers/*.log"
-          skipLongLines: true
-          readFromHead: false
-          storageType: memory
-          pauseOnChunksOverlimit: "off"
-        systemd:
-          enable: true
-          systemdFilter:
-            enable: true
-            filters: []
-          path: "/var/log/journal"
-          includeKubelet: true
-          stripUnderscores: "off"
-          storageType: memory
-          pauseOnChunksOverlimit: "off"
 
-        nodeExporterMetrics: {}
+  affinity:
-        fluentBitMetrics: {}
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+          - matchExpressions:
+              - key: node-role.kubernetes.io/edge
+                operator: DoesNotExist
+  tolerations:
+    - operator: Exists
 
-      output:
+  input:
-        es:
+    tail:
-          enable: false
+      enable: true
-          host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
+      refreshIntervalSeconds: 10
-          port: 9200
+      memBufLimit: 100MB
-          logstashPrefix: ks-logstash-log
+      bufferMaxSize: ""
-          bufferSize: 20MB
+      path: "/var/log/containers/*.log"
-          traceError: true
+      skipLongLines: true
-        kafka:
+      readFromHead: false
-          enable: false
+      storageType: memory
-          brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
+      pauseOnChunksOverlimit: "off"
-          topics: ks-log
+    systemd:
-        opentelemetry: {}
+      enable: true
-        opensearch:
+      systemdFilter:
-          enable: false
+        enable: true
-        stdout:
+        filters: []
-          enable: false
+      path: "/var/log/journal"
-        loki:
+      includeKubelet: true
-          enable: true
+      stripUnderscores: "off"
-          host: loki
+      storageType: memory
-          port: 3100
+      pauseOnChunksOverlimit: "off"
 
-        stackdriver: {}
+    nodeExporterMetrics: {}
+    fluentBitMetrics: {}
 
-      service:
+  output:
-        storage: {}
+    es:
+      enable: false
+      host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
+      port: 9200
+      logstashPrefix: ks-logstash-log
+      bufferSize: 20MB
+      traceError: true
+    kafka:
+      enable: false
+      brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
+      topics: ks-log
+    opentelemetry: {}
+    opensearch:
+      enable: false
+    stdout:
+      enable: false
+    loki:
+      enable: true
+      host: loki
+      port: 3100
 
-      filter:
+    stackdriver: {}
-        kubernetes:
-          enable: true
-          labels: true
-          annotations: true
-        containerd:
-          enable: true
-        systemd:
-          enable: true
 
-      kubeedge:
+  service:
-        enable: false
+    storage: {}
-        prometheusRemoteWrite:
+
-          # Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
+  filter:
-          host: "<cloud-prometheus-service-host>"
+    kubernetes:
-          # Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
+      enable: true
-          port: "<cloud-prometheus-service-port>"
+      labels: true
+      annotations: true
+    containerd:
+      enable: true
+    systemd:
+      enable: true
+
+  kubeedge:
+    enable: false
+    prometheusRemoteWrite:
+      # Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
+      host: "<cloud-prometheus-service-host>"
+      # Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
+      port: "<cloud-prometheus-service-port>"

internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl

@@ -1,145 +1,134 @@
-- name: opentelemetry-operator
+replicaCount: 1
-  namespace: observability
+nameOverride: ""
-  create_namespace: true
+imagePullSecrets: []
-  chart_ref: {{ .Modules.Observability.Tracing.Operator.ChartRef }}
+pdb:
-  chart_version: {{ .Modules.Observability.Tracing.Operator.ChartVersion }}
+  create: false
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
+  minAvailable: 1
-  release_state: "present"
+  maxUnavailable: ""
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    replicaCount: 1
-    nameOverride: ""
-    imagePullSecrets: []
-    pdb:
-      create: false
-      minAvailable: 1
-      maxUnavailable: ""
 
-    manager:
+manager:
-      image:
+  image:
-        repository: {{ .Modules.Observability.Tracing.Operator.Image }}
+    repository: {{ .Modules.Observability.Tracing.Operator.Image }}
-        tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
+    tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
-      collectorImage:
+  collectorImage:
-        repository: {{ .Modules.Observability.Tracing.Collector.Image }}
+    repository: {{ .Modules.Observability.Tracing.Collector.Image }}
-        tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
+    tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
 
-      featureGates: ""
+  featureGates: ""
-      ports:
+  ports:
-        metricsPort: 8080
+    metricsPort: 8080
-        webhookPort: 9443
+    webhookPort: 9443
-        healthzPort: 8081
+    healthzPort: 8081
-      resources:
+  resources:
-        limits:
+    limits:
-          cpu: 100m
+      cpu: 100m
-          memory: 128Mi
+      memory: 128Mi
-        requests:
+    requests:
-          cpu: 100m
+      cpu: 100m
-          memory: 64Mi
+      memory: 64Mi
-      env:
+  env:
-        ENABLE_WEBHOOKS: "true"
+    ENABLE_WEBHOOKS: "true"
 
-      serviceAccount:
+  serviceAccount:
-        create: true
+    create: true
-        annotations: {}
+    annotations: {}
 
-      serviceMonitor:
+  serviceMonitor:
-        enabled: true
+    enabled: true
-        metricsEndpoints:
+    metricsEndpoints:
-          - port: metrics
+      - port: metrics
 
-      prometheusRule:
+  prometheusRule:
-        enabled: true
+    enabled: true
-        groups: []
+    groups: []
-        defaultRules:
+    defaultRules:
-          enabled: true
-
-      extraArgs: []
-
-      leaderElection:
-        enabled: true
-
-      verticalPodAutoscaler:
-        enabled: false
-        controlledResources: []
-        maxAllowed: {}
-        minAllowed: {}
-
-        updatePolicy:
-          updateMode: Auto
-          minReplicas: 2
-      rolling: false
-
-      securityContext: {}
-
-    kubeRBACProxy:
       enabled: true
-      image:
-        repository: quay.io/brancz/kube-rbac-proxy
-        tag: v0.15.0
-      ports:
-        proxyPort: 8443
-      resources:
-        limits:
-          cpu: 500m
-          memory: 128Mi
-        requests:
-          cpu: 5m
-          memory: 64Mi
 
-      extraArgs: []
+  extraArgs: []
 
-      securityContext: {}
+  leaderElection:
+    enabled: true
 
-    admissionWebhooks:
+  verticalPodAutoscaler:
-      create: true
+    enabled: false
-      servicePort: 443
+    controlledResources: []
-      failurePolicy: Fail
+    maxAllowed: {}
-      secretName: ""
+    minAllowed: {}
-      pods:
-        failurePolicy: Ignore
 
-      namePrefix: ""
+    updatePolicy:
+      updateMode: Auto
+      minReplicas: 2
+  rolling: false
 
-      timeoutSeconds: 10
+  securityContext: {}
 
-      namespaceSelector: {}
+kubeRBACProxy:
-      objectSelector: {}
+  enabled: true
-      certManager:
+  image:
-        enabled: true
+    repository: quay.io/brancz/kube-rbac-proxy
-        issuerRef: {}
+    tag: v0.15.0
-        certificateAnnotations: {}
+  ports:
-        issuerAnnotations: {}
+    proxyPort: 8443
+  resources:
+    limits:
+      cpu: 500m
+      memory: 128Mi
+    requests:
+      cpu: 5m
+      memory: 64Mi
 
-      autoGenerateCert:
+  extraArgs: []
-        enabled: true
-        recreate: true
 
-      secretAnnotations: {}
+  securityContext: {}
-      secretLabels: {}
 
-    role:
+admissionWebhooks:
-      create: true
+  create: true
+  servicePort: 443
+  failurePolicy: Fail
+  secretName: ""
+  pods:
+    failurePolicy: Ignore
 
-    clusterRole:
+  namePrefix: ""
-      create: true
 
-    affinity: {}
+  timeoutSeconds: 10
-    tolerations: []
-    nodeSelector: {}
-    topologySpreadConstraints: []
-    hostNetwork: false
 
-    priorityClassName: ""
+  namespaceSelector: {}
+  objectSelector: {}
+  certManager:
+    enabled: true
+    issuerRef: {}
+    certificateAnnotations: {}
+    issuerAnnotations: {}
 
-    securityContext:
+  autoGenerateCert:
-      runAsGroup: 65532
+    enabled: true
-      runAsNonRoot: true
+    recreate: true
-      runAsUser: 65532
-      fsGroup: 65532
 
-    testFramework:
+  secretAnnotations: {}
-      image:
+  secretLabels: {}
-        repository: busybox
+
-        tag: latest
+role:
+  create: true
+
+clusterRole:
+  create: true
+
+affinity: {}
+tolerations: []
+nodeSelector: {}
+topologySpreadConstraints: []
+hostNetwork: false
+
+priorityClassName: ""
+
+securityContext:
+  runAsGroup: 65532
+  runAsNonRoot: true
+  runAsUser: 65532
+  fsGroup: 65532
+
+testFramework:
+  image:
+    repository: busybox
+    tag: latest

internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl

@@ -1,79 +1,68 @@
-- name: tempo
+replicas: 1
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Tracing.Tempo.ChartRef }}
-  chart_version: {{ .Modules.Observability.Tracing.Tempo.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    replicas: 1
 
-    tempo:
+tempo:
-      repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
+  repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
-      tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
+  tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
-      pullPolicy: IfNotPresent
+  pullPolicy: IfNotPresent
 
-      updateStrategy: RollingUpdate
+  updateStrategy: RollingUpdate
 
-      memBallastSizeMbs: 1024
+  memBallastSizeMbs: 1024
-      multitenancyEnabled: false
+  multitenancyEnabled: false
-      reportingEnabled: false
+  reportingEnabled: false
 
-      metricsGenerator:
+  metricsGenerator:
-        enabled: false
+    enabled: false
-        remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
+    remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
-      retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
+  retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
-      global_overrides:
+  global_overrides:
-        per_tenant_override_config: /conf/overrides.yaml
+    per_tenant_override_config: /conf/overrides.yaml
 
-      server:
+  server:
-        http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
+    http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
-      storage:
+  storage:
-        trace:
+    trace:
-          backend: local
+      backend: local
-          local:
+      local:
-            path: /var/tempo/traces
+        path: /var/tempo/traces
-          wal:
+      wal:
-            path: /var/tempo/wal
+        path: /var/tempo/wal
-      receivers:
+  receivers:
-        otlp:
+    otlp:
-          protocols:
+      protocols:
-            grpc:
+        grpc:
-              endpoint: "0.0.0.0:4317"
+          endpoint: "0.0.0.0:4317"
-            http:
+        http:
-              endpoint: "0.0.0.0:4318"
+          endpoint: "0.0.0.0:4318"
 
-    tempoQuery:
+tempoQuery:
-      repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
+  repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
-      tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
+  tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
-      pullPolicy: IfNotPresent
+  pullPolicy: IfNotPresent
 
-      enabled: true
+  enabled: true
 
-      service:
+  service:
-        port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
+    port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
 
-      ingress:
+  ingress:
-        enabled: false
+    enabled: false
 
-    serviceAccount:
+serviceAccount:
-      create: true
+  create: true
-      automountServiceAccountToken: true
+  automountServiceAccountToken: true
 
-    service:
+service:
-      type: ClusterIP
+  type: ClusterIP
 
-    serviceMonitor:
+serviceMonitor:
-      enabled: true
+  enabled: true
 
-    persistence:
+persistence:
-      enabled: true
+  enabled: true
-      storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
+  storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
-      accessModes:
+  accessModes:
-        - ReadWriteOnce
+    - ReadWriteOnce
-      size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
+  size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
 
-    priorityClassName: null
+priorityClassName: null

internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl

@@ -1,17 +1,6 @@
-- name: harbor-certificate-generator
+issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
-  namespace: {{ .Modules.Registry.Namespace }}
+solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
-  create_namespace: true
-  chart_ref: {{ .Modules.Registry.Tls.CertificateGenerator.ChartRef }}
-  chart_version: {{ .Modules.Registry.Tls.CertificateGenerator.ChartVersion }}
-  {{- if and .Modules.Registry.Enabled (eq .Modules.Registry.Expose.Type "ingress") }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
-    solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
 
-    certificates:
+certificates:
-      - name: harbor-tls
+  - name: harbor-tls
-        domain: {{ .Modules.Registry.Expose.Domain }}
+    domain: {{ .Modules.Registry.Expose.Domain }}

internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl

@@ -1,382 +1,371 @@
-- name: harbor
+expose:
-  namespace: {{ .Modules.Registry.Namespace }}
+  type: {{ .Modules.Registry.Expose.Type }}
-  create_namespace: true
+  tls:
-  chart_ref: {{ .Modules.Registry.ChartRef }}
+    enabled: {{ .Modules.Registry.Tls.Enabled }}
-  chart_version: {{ .Modules.Registry.ChartVersion }}
+    certSource: secret
-  {{- if .Modules.Registry.Enabled  }}
+    secret:
-  release_state: "present"
+      secretName: harbor-tls
-  {{- else }}
+  ingress:
-  release_state: "absent"
+    hosts:
-  {{- end }}
+      core: {{ .Modules.Registry.Expose.Domain }}
-  values:
+    controller: default
-    expose:
+    kubeVersionOverride: ""
-      type: {{ .Modules.Registry.Expose.Type }}
+    className: "{{ .Modules.Additional.Ingress.Type }}"
-      tls:
+    annotations:
-        enabled: {{ .Modules.Registry.Tls.Enabled }}
+      ingress.kubernetes.io/ssl-redirect: "true"
-        certSource: secret
+      ingress.kubernetes.io/proxy-body-size: "0"
-        secret:
+      {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-          secretName: harbor-tls
+      nginx.ingress.kubernetes.io/ssl-redirect: "true"
-      ingress:
+      nginx.ingress.kubernetes.io/proxy-body-size: "0"
-        hosts:
+      {{- end }}
-          core: {{ .Modules.Registry.Expose.Domain }}
+    labels: {}
-        controller: default
-        kubeVersionOverride: ""
-        className: "{{ .Modules.Additional.Ingress.Type }}"
-        annotations:
-          ingress.kubernetes.io/ssl-redirect: "true"
-          ingress.kubernetes.io/proxy-body-size: "0"
-          {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-          nginx.ingress.kubernetes.io/ssl-redirect: "true"
-          nginx.ingress.kubernetes.io/proxy-body-size: "0"
-          {{- end }}
-        labels: {}
 
-      nodePort:
+  nodePort:
-        name: harbor
+    name: harbor
-        ports:
+    ports:
-          http:
+      http:
-            port: 80
+        port: 80
-            nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
+        nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
-          https:
+      https:
-            port: 443
+        port: 443
-            nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
+        nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
-
-    externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}{{ if not (eq  .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
-    persistence:
-      resourcePolicy: "keep"
-      persistentVolumeClaim:
-        registry:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.RegistrySize  }}
-          annotations: {}
-        jobservice:
-          jobLog:
-            existingClaim: ""
-            storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-            subPath: ""
-            accessMode: ReadWriteOnce
-            size: {{ .Modules.Registry.Persistence.JobserviceSize  }}
-            annotations: {}
-        database:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.DatabaseSize  }}
-          annotations: {}
-        redis:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.RedisSize }}
-          annotations: {}
-        trivy:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.TrivySize }}
-          annotations: {}
-
-      imageChartStorage:
-        disableredirect: false
-
-        type: filesystem
-        filesystem:
-          rootdirectory: /storage
-          #maxthreads: 100
-
-    imagePullPolicy: IfNotPresent
-
-    updateStrategy:
-      type: RollingUpdate
-
-    harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
-
-    logLevel: info
-
-    metrics:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      core:
-        path: /metrics
-        port: 8001
-      registry:
-        path: /metrics
-        port: 8001
-      jobservice:
-        path: /metrics
-        port: 8001
-      exporter:
-        path: /metrics
-        port: 8001
-
-      serviceMonitor:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    trace:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-      provider: otel
-      sample_rate: 1
-      attributes:
-        application: harbor
-      jaeger:
-        endpoint: http://hostname:14268/api/traces
-      otel:
-        endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
-        url_path: /v1/traces
-        compression: false
-        insecure: true
-        timeout: 10
-
-    portal:
-      image:
-        repository: {{ .Modules.Registry.Portal.Image }}
-        tag: {{ .Modules.Registry.Portal.Tag }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-
-      topologySpreadConstraints: []
-
-      podLabels:
-        "app.kubernetes.io/component": "harbor-portal"
-      priorityClassName:
-
-    core:
-      image:
-        repository: {{ .Modules.Registry.Core.Image }}
-        tag: {{ .Modules.Registry.Portal.Tag }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-      startupProbe:
-        enabled: true
-        initialDelaySeconds: 10
-      extraEnvVars: []
-      nodeSelector: {}
-      tolerations: []
-      affinity: {}
-      topologySpreadConstraints: []
-      podLabels:
-        "app.kubernetes.io/component": "harbor-core"
-      serviceAnnotations: {}
-      priorityClassName:
-      configureUserSettings:
-      quotaUpdateProvider: db # Or redis
-      secret: ""
-      existingSecret: ""
-      secretName: ""
-      tokenKey: ""
-
-      tokenCert: ""
-
-      xsrfKey: ""
-      existingXsrfSecret: ""
-      existingXsrfSecretKey: CSRF_KEY
-      artifactPullAsyncFlushDuration:
-      gdpr:
-        deleteUser: false
-        auditLogsCompliant: false
-
-
-    jobservice:
-      image:
-        repository: {{ .Modules.Registry.Jobservice.Image }}
-        tag: {{ .Modules.Registry.Jobservice.Tag }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-      topologySpreadConstraints:
-      podLabels:
-        "app.kubernetes.io/component": "harbor-jobservice"
-      priorityClassName:
-      maxJobWorkers: 10
-      jobLoggers:
-        - file
-        # - database
-        # - stdout
-      loggerSweeperDuration: 14 #days
-      notification:
-        webhook_job_max_retry: 3
-        webhook_job_http_client_timeout: 3 # in seconds
-      reaper:
-        max_update_hours: 24
-        max_dangling_hours: 168
-      secret: ""
-      existingSecret: ""
-      existingSecretKey: JOBSERVICE_SECRET
 
+externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}{{ if not (eq  .Modules.Registry.Expose.Path "/") }}{{ .Modules.Registry.Expose.Path }}{{ end }}
+persistence:
+  resourcePolicy: "keep"
+  persistentVolumeClaim:
     registry:
-      registry:
+      existingClaim: ""
-        image:
+      storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          repository: {{ .Modules.Registry.Registry.Registry.Image }}
+      subPath: ""
-          tag: {{ .Modules.Registry.Registry.Registry.Tag }}
+      accessMode: ReadWriteOnce
-        extraEnvVars: []
+      size: {{ .Modules.Registry.Persistence.RegistrySize  }}
-      controller:
+      annotations: {}
-        image:
+    jobservice:
-          repository: {{ .Modules.Registry.Registry.Controller.Image }}
+      jobLog:
-          tag: {{ .Modules.Registry.Registry.Controller.Tag }}
+        existingClaim: ""
-        extraEnvVars: []
+        storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-      serviceAccountName: ""
+        subPath: ""
-      automountServiceAccountToken: false
+        accessMode: ReadWriteOnce
-      replicas: 1
+        size: {{ .Modules.Registry.Persistence.JobserviceSize  }}
-      revisionHistoryLimit: 10
+        annotations: {}
-      topologySpreadConstraints: []
-      podLabels:
-        "app.kubernetes.io/component": "harbor-registry"
-      priorityClassName:
-      secret: ""
-      existingSecret: ""
-      existingSecretKey: REGISTRY_HTTP_SECRET
-      relativeurls: false
-      credentials:
-        # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
-        existingSecret: ""
-        # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
-        # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
-        # htpasswdString: ""
-      middleware:
-        enabled: false
-        type: cloudFront
-        cloudFront:
-          baseurl: example.cloudfront.net
-          keypairid: KEYPAIRID
-          duration: 3000s
-          ipfilteredby: none
-          # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
-          # that allows access to CloudFront
-          privateKeySecret: "my-secret"
-      # enable purge _upload directories
-      upload_purging:
-        enabled: true
-        # remove files in _upload directories which exist for a period of time, default is one week.
-        age: 168h
-        # the interval of the purge operations
-        interval: 24h
-        dryrun: false
-
-    trivy:
-      enabled: {{ .Modules.Registry.EnabledScanner }}
-      image:
-        repository: {{ .Modules.Registry.Trivy.Image }}
-        tag: {{ .Modules.Registry.Trivy.Tag }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      resources:
-        requests:
-          cpu: 200m
-          memory: 512Mi
-        limits:
-          cpu: 1
-          memory: 1Gi
-
-
     database:
-      # if external database is used, set "type" to "external"
+      existingClaim: ""
-      # and fill the connection information in "external" section
+      storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-      type: internal
+      subPath: ""
-      internal:
+      accessMode: ReadWriteOnce
-        image:
+      size: {{ .Modules.Registry.Persistence.DatabaseSize  }}
-          repository: {{ .Modules.Registry.Database.Image }}
+      annotations: {}
-          tag: {{ .Modules.Registry.Database.Tag }}
-        serviceAccountName: ""
-        automountServiceAccountToken: false
-        livenessProbe:
-          timeoutSeconds: 1
-        readinessProbe:
-          timeoutSeconds: 1
-        priorityClassName:
-        # The initial superuser password for internal database
-        # password: "changeit"
-        # The size limit for Shared memory, pgSQL use it for shared_buffer
-        # More details see:
-        # https://github.com/goharbor/harbor/issues/15034
-        shmSizeLimit: 512Mi
-        initContainer:
-          migrator: {}
-          # resources:
-          #  requests:
-          #    memory: 128Mi
-          #    cpu: 100m
-          permissions: {}
-          # resources:
-          #  requests:
-          #    memory: 128Mi
-          #    cpu: 100m
-      external:
-        host: "192.168.0.1"
-        port: "5432"
-        username: "user"
-        password: "password"
-        coreDatabase: "registry"
-        # if using existing secret, the key must be "password"
-        existingSecret: ""
-        # "disable" - No SSL
-        # "require" - Always SSL (skip verification)
-        # "verify-ca" - Always SSL (verify that the certificate presented by the
-        # server was signed by a trusted CA)
-        # "verify-full" - Always SSL (verify that the certification presented by the
-        # server was signed by a trusted CA and the server host name matches the one
-        # in the certificate)
-        sslmode: "disable"
-      # The maximum number of connections in the idle connection pool per pod (core+exporter).
-      # If it <=0, no idle connections are retained.
-      maxIdleConns: 100
-      # The maximum number of open connections to the database per pod (core+exporter).
-      # If it <= 0, then there is no limit on the number of open connections.
-      # Note: the default number of connections is 1024 for postgre of harbor.
-      maxOpenConns: 900
-      ## Additional deployment annotations
-      podAnnotations: {}
-      ## Additional deployment labels
-      podLabels: {}
-
-
     redis:
-      type: internal
+      existingClaim: ""
-      internal:
+      storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-        image:
+      subPath: ""
-          repository: {{ .Modules.Registry.Redis.Image }}
+      accessMode: ReadWriteOnce
-          tag: {{ .Modules.Registry.Redis.Tag }}
+      size: {{ .Modules.Registry.Persistence.RedisSize }}
-        serviceAccountName: ""
+      annotations: {}
-        automountServiceAccountToken: false
+    trivy:
-        extraEnvVars: []
+      existingClaim: ""
-        nodeSelector: {}
+      storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-        tolerations: []
+      subPath: ""
-        affinity: {}
+      accessMode: ReadWriteOnce
-        priorityClassName:
+      size: {{ .Modules.Registry.Persistence.TrivySize }}
-        jobserviceDatabaseIndex: "1"
+      annotations: {}
-        registryDatabaseIndex: "2"
+
-        trivyAdapterIndex: "5"
+  imageChartStorage:
-        # harborDatabaseIndex: "6"
+    disableredirect: false
-        # cacheLayerDatabaseIndex: "7"
+
-      external:
+    type: filesystem
-        # support redis, redis+sentinel
+    filesystem:
-        # addr for redis: <host_redis>:<port_redis>
+      rootdirectory: /storage
-        # addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
+      #maxthreads: 100
-        addr: "192.168.0.2:6379"
+
-        # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
+imagePullPolicy: IfNotPresent
-        sentinelMasterSet: ""
+
-        # The "coreDatabaseIndex" must be "0" as the library Harbor
+updateStrategy:
-        # used doesn't support configuring it
+  type: RollingUpdate
-        # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
+
-        # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
+harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
-        coreDatabaseIndex: "0"
+
-        jobserviceDatabaseIndex: "1"
+logLevel: info
-        registryDatabaseIndex: "2"
+
-        trivyAdapterIndex: "5"
+metrics:
-        # harborDatabaseIndex: "6"
+  enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        # cacheLayerDatabaseIndex: "7"
+  core:
-        # username field can be an empty string, and it will be authenticated against the default user
+    path: /metrics
-        username: ""
+    port: 8001
-        password: ""
+  registry:
-        existingSecret: ""
+    path: /metrics
-      podAnnotations: {}
+    port: 8001
-      podLabels: {}
+  jobservice:
+    path: /metrics
+    port: 8001
+  exporter:
+    path: /metrics
+    port: 8001
+
+  serviceMonitor:
+    enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
+
+trace:
+  enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
+  provider: otel
+  sample_rate: 1
+  attributes:
+    application: harbor
+  jaeger:
+    endpoint: http://hostname:14268/api/traces
+  otel:
+    endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
+    url_path: /v1/traces
+    compression: false
+    insecure: true
+    timeout: 10
+
+portal:
+  image:
+    repository: {{ .Modules.Registry.Portal.Image }}
+    tag: {{ .Modules.Registry.Portal.Tag }}
+  serviceAccountName: ""
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+
+  topologySpreadConstraints: []
+
+  podLabels:
+    "app.kubernetes.io/component": "harbor-portal"
+  priorityClassName:
+
+core:
+  image:
+    repository: {{ .Modules.Registry.Core.Image }}
+    tag: {{ .Modules.Registry.Portal.Tag }}
+  serviceAccountName: ""
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+  startupProbe:
+    enabled: true
+    initialDelaySeconds: 10
+  extraEnvVars: []
+  nodeSelector: {}
+  tolerations: []
+  affinity: {}
+  topologySpreadConstraints: []
+  podLabels:
+    "app.kubernetes.io/component": "harbor-core"
+  serviceAnnotations: {}
+  priorityClassName:
+  configureUserSettings:
+  quotaUpdateProvider: db # Or redis
+  secret: ""
+  existingSecret: ""
+  secretName: ""
+  tokenKey: ""
+
+  tokenCert: ""
+
+  xsrfKey: ""
+  existingXsrfSecret: ""
+  existingXsrfSecretKey: CSRF_KEY
+  artifactPullAsyncFlushDuration:
+  gdpr:
+    deleteUser: false
+    auditLogsCompliant: false
+
+
+jobservice:
+  image:
+    repository: {{ .Modules.Registry.Jobservice.Image }}
+    tag: {{ .Modules.Registry.Jobservice.Tag }}
+  serviceAccountName: ""
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+  topologySpreadConstraints:
+  podLabels:
+    "app.kubernetes.io/component": "harbor-jobservice"
+  priorityClassName:
+  maxJobWorkers: 10
+  jobLoggers:
+    - file
+    # - database
+    # - stdout
+  loggerSweeperDuration: 14 #days
+  notification:
+    webhook_job_max_retry: 3
+    webhook_job_http_client_timeout: 3 # in seconds
+  reaper:
+    max_update_hours: 24
+    max_dangling_hours: 168
+  secret: ""
+  existingSecret: ""
+  existingSecretKey: JOBSERVICE_SECRET
+
+registry:
+  registry:
+    image:
+      repository: {{ .Modules.Registry.Registry.Registry.Image }}
+      tag: {{ .Modules.Registry.Registry.Registry.Tag }}
+    extraEnvVars: []
+  controller:
+    image:
+      repository: {{ .Modules.Registry.Registry.Controller.Image }}
+      tag: {{ .Modules.Registry.Registry.Controller.Tag }}
+    extraEnvVars: []
+  serviceAccountName: ""
+  automountServiceAccountToken: false
+  replicas: 1
+  revisionHistoryLimit: 10
+  topologySpreadConstraints: []
+  podLabels:
+    "app.kubernetes.io/component": "harbor-registry"
+  priorityClassName:
+  secret: ""
+  existingSecret: ""
+  existingSecretKey: REGISTRY_HTTP_SECRET
+  relativeurls: false
+  credentials:
+    # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
+    existingSecret: ""
+    # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
+    # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
+    # htpasswdString: ""
+  middleware:
+    enabled: false
+    type: cloudFront
+    cloudFront:
+      baseurl: example.cloudfront.net
+      keypairid: KEYPAIRID
+      duration: 3000s
+      ipfilteredby: none
+      # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
+      # that allows access to CloudFront
+      privateKeySecret: "my-secret"
+  # enable purge _upload directories
+  upload_purging:
+    enabled: true
+    # remove files in _upload directories which exist for a period of time, default is one week.
+    age: 168h
+    # the interval of the purge operations
+    interval: 24h
+    dryrun: false
+
+trivy:
+  enabled: {{ .Modules.Registry.EnabledScanner }}
+  image:
+    repository: {{ .Modules.Registry.Trivy.Image }}
+    tag: {{ .Modules.Registry.Trivy.Tag }}
+  serviceAccountName: ""
+  automountServiceAccountToken: false
+  resources:
+    requests:
+      cpu: 200m
+      memory: 512Mi
+    limits:
+      cpu: 1
+      memory: 1Gi
+
+
+database:
+  # if external database is used, set "type" to "external"
+  # and fill the connection information in "external" section
+  type: internal
+  internal:
+    image:
+      repository: {{ .Modules.Registry.Database.Image }}
+      tag: {{ .Modules.Registry.Database.Tag }}
+    serviceAccountName: ""
+    automountServiceAccountToken: false
+    livenessProbe:
+      timeoutSeconds: 1
+    readinessProbe:
+      timeoutSeconds: 1
+    priorityClassName:
+    # The initial superuser password for internal database
+    # password: "changeit"
+    # The size limit for Shared memory, pgSQL use it for shared_buffer
+    # More details see:
+    # https://github.com/goharbor/harbor/issues/15034
+    shmSizeLimit: 512Mi
+    initContainer:
+      migrator: {}
+      # resources:
+      #  requests:
+      #    memory: 128Mi
+      #    cpu: 100m
+      permissions: {}
+      # resources:
+      #  requests:
+      #    memory: 128Mi
+      #    cpu: 100m
+  external:
+    host: "192.168.0.1"
+    port: "5432"
+    username: "user"
+    password: "password"
+    coreDatabase: "registry"
+    # if using existing secret, the key must be "password"
+    existingSecret: ""
+    # "disable" - No SSL
+    # "require" - Always SSL (skip verification)
+    # "verify-ca" - Always SSL (verify that the certificate presented by the
+    # server was signed by a trusted CA)
+    # "verify-full" - Always SSL (verify that the certification presented by the
+    # server was signed by a trusted CA and the server host name matches the one
+    # in the certificate)
+    sslmode: "disable"
+  # The maximum number of connections in the idle connection pool per pod (core+exporter).
+  # If it <=0, no idle connections are retained.
+  maxIdleConns: 100
+  # The maximum number of open connections to the database per pod (core+exporter).
+  # If it <= 0, then there is no limit on the number of open connections.
+  # Note: the default number of connections is 1024 for postgre of harbor.
+  maxOpenConns: 900
+  ## Additional deployment annotations
+  podAnnotations: {}
+  ## Additional deployment labels
+  podLabels: {}
+
+
+redis:
+  type: internal
+  internal:
+    image:
+      repository: {{ .Modules.Registry.Redis.Image }}
+      tag: {{ .Modules.Registry.Redis.Tag }}
+    serviceAccountName: ""
+    automountServiceAccountToken: false
+    extraEnvVars: []
+    nodeSelector: {}
+    tolerations: []
+    affinity: {}
+    priorityClassName:
+    jobserviceDatabaseIndex: "1"
+    registryDatabaseIndex: "2"
+    trivyAdapterIndex: "5"
+    # harborDatabaseIndex: "6"
+    # cacheLayerDatabaseIndex: "7"
+  external:
+    # support redis, redis+sentinel
+    # addr for redis: <host_redis>:<port_redis>
+    # addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
+    addr: "192.168.0.2:6379"
+    # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
+    sentinelMasterSet: ""
+    # The "coreDatabaseIndex" must be "0" as the library Harbor
+    # used doesn't support configuring it
+    # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
+    # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
+    coreDatabaseIndex: "0"
+    jobserviceDatabaseIndex: "1"
+    registryDatabaseIndex: "2"
+    trivyAdapterIndex: "5"
+    # harborDatabaseIndex: "6"
+    # cacheLayerDatabaseIndex: "7"
+    # username field can be an empty string, and it will be authenticated against the default user
+    username: ""
+    password: ""
+    existingSecret: ""
+  podAnnotations: {}
+  podLabels: {}

internal/resources/templates/helm-apps/repositories/repositories.yml.tmpl

@@ -1,5 +0,0 @@
-- name: kube-forge
-  url: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable"
-{{ if .Modules.AdditionalRepositories }}
-{{ .Modules.AdditionalRepositories | toYaml }}
-{{- end }}

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl

@@ -232,13 +232,3 @@ argocd_enabled: false
 # The plugin manager for kubectl
 krew_enabled: false
 krew_root_dir: "/usr/local/krew"
-
-
-########################################
-# Helm apps configuration
-########################################
-repositories:
-  {{- .Repositories | nindent 2 }}
-
-releases:
-  {{- .Releases | nindent 2 }}

internal/secrets_storage/commands.go

@@ -4,44 +4,45 @@ import (
 	"fmt"
 	"kube-forge/internal/config"
 	"kube-forge/internal/kubernetes_client"
+	"kube-forge/internal/logging"
 	"kube-forge/internal/templates"
 	"regexp"
 	"strings"
 )
 
-func InitVault() {
+func initVault() {
 	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
 	if err != nil {
-		fmt.Println(err.Error())
+		logging.Log.Error(err.Error())
 		return
 	}
 	err = commandToInitVault()
 	if err != nil {
-		fmt.Println(err.Error())
+		logging.Log.Warn(err.Error())
 		return
 	}
-	fmt.Println("Vault initialized")
+	logging.Log.Info("Vault initialized")
 	templates.ApplyVaultInitKeysTemplate()
 }
 
-func AddKubernetesLocalIntegration() {
+func addKubernetesLocalIntegration() {
 	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
 	if err != nil {
-		fmt.Println(err.Error())
+		logging.Log.Error(err.Error())
 		return
 	}
 	err = commandToAddKubernetesLocalIntegration()
 	if err != nil {
-		fmt.Println(err.Error())
+		logging.Log.Error(err.Error())
 		return
 	}
-	fmt.Println("Vault local Kubernetes integration added")
+	logging.Log.Info("Vault local Kubernetes integration added")
 }
 
-func UnsealVault() {
+func unsealVault() {
 	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
 	if err != nil {
-		fmt.Println(err.Error())
+		logging.Log.Error(err.Error())
 		return
 	}
 	commandToUnsealVault()
@@ -92,7 +93,7 @@ func commandToUnsealVault() {
 			commandArray, "secrets-storage", "vault-0", "vault",
 		)
 	}
-	fmt.Println("Vault unsealed")
+	logging.Log.Info("Vault unsealed")
 }
 
 func commandToAddKubernetesLocalIntegration() error {

internal/secrets_storage/helm.go

@@ -0,0 +1,44 @@
+package secrets_storage
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = []config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getVaultSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "vault",
+		ChartName:       appConfig.Modules.SecretsStorage.ChartRef,
+		Version:         appConfig.Modules.SecretsStorage.ChartVersion,
+		Namespace:       appConfig.Modules.SecretsStorage.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/secrets-storage/vault.yml.tmpl"),
+	}
+}
+
+func ApplyCharts() {
+	appConfig := config.GetConfig()
+	helm_client.AddHelmRepos(appConfig.Modules.SecretsStorage.Namespace, HELM_REPOS)
+	if appConfig.Modules.SecretsStorage.Enabled {
+		helm_client.InstallChart(getVaultSpec())
+		initVault()
+		unsealVault()
+		addKubernetesLocalIntegration()
+	} else {
+		helm_client.DeleteChart(getVaultSpec())
+	}
+}

internal/templates/helm.go

@@ -0,0 +1,12 @@
+package templates
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/resources"
+)
+
+func GetHelmValuesByTemplate(templateFile string) string {
+	cfg := config.GetConfig()
+	template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
+	return executeTemplateToString(template, cfg)
+}

internal/templates/helm_apps.go

@@ -1,46 +0,0 @@
-package templates
-
-import (
-	"kube-forge/internal/config"
-	"kube-forge/internal/resources"
-	"strings"
-)
-
-var HELM_APPS_TEMPLATES = [...]string{
-	"templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl",
-	"templates/helm-apps/releases/observability/fluent-operator.yml.tmpl",
-	"templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl",
-	"templates/helm-apps/releases/observability/metrics-server.yml.tmpl",
-	"templates/helm-apps/releases/observability/tempo.yml.tmpl",
-	"templates/helm-apps/releases/observability/loki.yml.tmpl",
-	"templates/helm-apps/releases/observability/observability.yml.tmpl",
-	"templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl",
-	"templates/helm-apps/releases/registry/harbor.yml.tmpl",
-	"templates/helm-apps/releases/cicd/argo-cd.yml.tmpl",
-	"templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl",
-	"templates/helm-apps/releases/cicd/keel.yml.tmpl",
-	"templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl",
-	"templates/helm-apps/releases/secrets-storage/vault.yml.tmpl",
-}
-var HELM_REPOSITORIES_TEMPLATES = [...]string{
-	"templates/helm-apps/repositories/repositories.yml.tmpl",
-}
-
-func GetHelmAppsConfigData() (string, string) {
-	cfg := config.GetConfig()
-	helmAppsTemplateResults := []string{}
-	for _, templateFile := range HELM_APPS_TEMPLATES {
-		template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
-		helmAppsTemplateResults = append(helmAppsTemplateResults, executeTemplateToString(template, cfg))
-	}
-	repositoriesTemplateResults := []string{}
-	for _, templateFile := range HELM_REPOSITORIES_TEMPLATES {
-		template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
-		repositoriesTemplateResults = append(repositoriesTemplateResults, executeTemplateToString(template, cfg))
-	}
-	return strings.Join(repositoriesTemplateResults, "\n"), strings.Join(helmAppsTemplateResults, "\n")
-}

kubespray/project/cluster.yml

@@ -90,7 +90,7 @@
     - { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
     - { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
     - { role: kubernetes-apps, tags: apps }
-    - { role: helm-apps, tags: helm-apps }
+    # - { role: helm-apps, tags: helm-apps }
 
 - name: Apply resolv.conf changes now that cluster DNS is up
   hosts: k8s_cluster