update vault integration
This commit is contained in:
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,14 @@
|
||||
- name: docker-secrets-generator
|
||||
namespace: kube-system
|
||||
chart_ref: {{ .Modules.Additional.DockerSecrets.ChartRef }}
|
||||
chart_version: {{ .Modules.Additional.DockerSecrets.ChartVersion }}
|
||||
{{- if .Modules.Additional.DockerSecrets.Repositories }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
{{- if .Modules.Additional.DockerSecrets.Repositories }}
|
||||
values:
|
||||
repositories:
|
||||
{{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,908 @@
|
||||
- name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
create_namespace: true
|
||||
chart_ref: {{ .Modules.Additional.Ingress.ChartRef }}
|
||||
chart_version: {{ .Modules.Additional.Ingress.ChartVersion }}
|
||||
{{- if and .Modules.Additional.Ingress.Enabled (eq .Modules.Additional.Ingress.Type "nginx") }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
commonLabels: {}
|
||||
controller:
|
||||
name: controller
|
||||
enableAnnotationValidations: false
|
||||
image:
|
||||
## Keep false as default for now!
|
||||
chroot: false
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
repository: {{ .Modules.Additional.Ingress.Nginx.Controller.Image }}
|
||||
tag: "{{ .Modules.Additional.Ingress.Nginx.Controller.Tag }}"
|
||||
digest: sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
|
||||
digestChroot: sha256:5976b1067cfbca8a21d0ba53d71f83543a73316a61ea7f7e436d6cf84ddf9b26
|
||||
pullPolicy: IfNotPresent
|
||||
# www-data -> uid 101
|
||||
runAsUser: 101
|
||||
allowPrivilegeEscalation: true
|
||||
# -- Use an existing PSP instead of creating one
|
||||
existingPsp: ""
|
||||
# -- Configures the controller container name
|
||||
containerName: controller
|
||||
# -- Configures the ports that the nginx-controller listens on
|
||||
containerPort:
|
||||
http: 80
|
||||
https: 443
|
||||
# -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
|
||||
config: {}
|
||||
# -- Annotations to be added to the controller config configuration configmap.
|
||||
configAnnotations: {}
|
||||
# -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers
|
||||
proxySetHeaders: {}
|
||||
# -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers
|
||||
addHeaders: {}
|
||||
# -- Optionally customize the pod dnsConfig.
|
||||
dnsConfig: {}
|
||||
# -- Optionally customize the pod hostAliases.
|
||||
hostAliases: []
|
||||
# - ip: 127.0.0.1
|
||||
# hostnames:
|
||||
# - foo.local
|
||||
# - bar.local
|
||||
# - ip: 10.1.2.3
|
||||
# hostnames:
|
||||
# - foo.remote
|
||||
# - bar.remote
|
||||
# -- Optionally customize the pod hostname.
|
||||
hostname: {}
|
||||
# -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.
|
||||
# By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller
|
||||
# to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.
|
||||
dnsPolicy: ClusterFirst
|
||||
# -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
|
||||
# Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
|
||||
reportNodeInternalIp: false
|
||||
# -- Process Ingress objects without ingressClass annotation/ingressClassName field
|
||||
# Overrides value for --watch-ingress-without-class flag of the controller binary
|
||||
# Defaults to false
|
||||
watchIngressWithoutClass: false
|
||||
# -- Process IngressClass per name (additionally as per spec.controller).
|
||||
ingressClassByName: false
|
||||
# -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto"
|
||||
# Defaults to false
|
||||
enableTopologyAwareRouting: false
|
||||
# -- This configuration defines if Ingress Controller should allow users to set
|
||||
# their own *-snippet annotations, otherwise this is forbidden / dropped
|
||||
# when users add those annotations.
|
||||
# Global snippets in ConfigMap are still respected
|
||||
allowSnippetAnnotations: true
|
||||
# -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),
|
||||
# since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920
|
||||
# is merged
|
||||
hostNetwork: {{ .Modules.Additional.Ingress.HostNetwork }}
|
||||
## Use host ports 80 and 443
|
||||
## Disabled by default
|
||||
hostPort:
|
||||
# -- Enable 'hostPort' or not
|
||||
enabled: false
|
||||
ports:
|
||||
# -- 'hostPort' http port
|
||||
http: 80
|
||||
# -- 'hostPort' https port
|
||||
https: 443
|
||||
# NetworkPolicy for controller component.
|
||||
networkPolicy:
|
||||
# -- Enable 'networkPolicy' or not
|
||||
enabled: false
|
||||
# -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'
|
||||
electionID: ""
|
||||
## This section refers to the creation of the IngressClass resource
|
||||
## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19
|
||||
ingressClassResource:
|
||||
# -- Name of the ingressClass
|
||||
name: nginx
|
||||
# -- Is this ingressClass enabled or not
|
||||
enabled: true
|
||||
# -- Is this the default ingressClass for the cluster
|
||||
default: false
|
||||
# -- Controller-value of the controller that is processing this ingressClass
|
||||
controllerValue: "k8s.io/ingress-nginx"
|
||||
# -- Parameters is a link to a custom resource containing additional
|
||||
# configuration for the controller. This is optional if the controller
|
||||
# does not require extra parameters.
|
||||
parameters: {}
|
||||
# -- For backwards compatibility with ingress.class annotation, use ingressClass.
|
||||
# Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation
|
||||
ingressClass: {{ .Modules.Additional.Ingress.IngressClassName }}
|
||||
# -- Labels to add to the pod container metadata
|
||||
podLabels: {}
|
||||
|
||||
# -- Security Context policies for controller pods
|
||||
podSecurityContext: {}
|
||||
# -- See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls
|
||||
sysctls: {}
|
||||
# sysctls:
|
||||
# "net.core.somaxconn": "8192"
|
||||
|
||||
# -- Allows customization of the source of the IP address or FQDN to report
|
||||
# in the ingress status field. By default, it reads the information provided
|
||||
# by the service. If disable, the status field reports the IP address of the
|
||||
# node or nodes where an ingress controller pod is running.
|
||||
publishService:
|
||||
# -- Enable 'publishService' or not
|
||||
enabled: true
|
||||
# -- Allows overriding of the publish service to bind to
|
||||
# Must be <namespace>/<service_name>
|
||||
pathOverride: ""
|
||||
# Limit the scope of the controller to a specific namespace
|
||||
scope:
|
||||
# -- Enable 'scope' or not
|
||||
enabled: false
|
||||
# -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)
|
||||
namespace: ""
|
||||
# -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels
|
||||
# only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.
|
||||
namespaceSelector: ""
|
||||
# -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)
|
||||
configMapNamespace: ""
|
||||
tcp:
|
||||
# -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)
|
||||
configMapNamespace: ""
|
||||
# -- Annotations to be added to the tcp config configmap
|
||||
annotations: {}
|
||||
udp:
|
||||
# -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)
|
||||
configMapNamespace: ""
|
||||
# -- Annotations to be added to the udp config configmap
|
||||
annotations: {}
|
||||
# -- Maxmind license key to download GeoLite2 Databases.
|
||||
## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases
|
||||
maxmindLicenseKey: ""
|
||||
# -- Additional command line arguments to pass to Ingress-Nginx Controller
|
||||
# E.g. to specify the default SSL certificate you can use
|
||||
extraArgs: {}
|
||||
## extraArgs:
|
||||
## default-ssl-certificate: "<namespace>/<secret_name>"
|
||||
|
||||
# -- Additional environment variables to set
|
||||
extraEnvs: []
|
||||
# extraEnvs:
|
||||
# - name: FOO
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# key: FOO
|
||||
# name: secret-resource
|
||||
|
||||
# -- Use a `DaemonSet` or `Deployment`
|
||||
kind: DaemonSet
|
||||
# -- Annotations to be added to the controller Deployment or DaemonSet
|
||||
##
|
||||
annotations: {}
|
||||
# keel.sh/pollSchedule: "@every 60m"
|
||||
|
||||
# -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels
|
||||
##
|
||||
labels: {}
|
||||
# keel.sh/policy: patch
|
||||
# keel.sh/trigger: poll
|
||||
|
||||
# -- The update strategy to apply to the Deployment or DaemonSet
|
||||
##
|
||||
updateStrategy: {}
|
||||
# rollingUpdate:
|
||||
# maxUnavailable: 1
|
||||
# type: RollingUpdate
|
||||
|
||||
# -- `minReadySeconds` to avoid killing pods before we are ready
|
||||
##
|
||||
minReadySeconds: 0
|
||||
# -- Node tolerations for server scheduling to nodes with taints
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
||||
##
|
||||
tolerations: []
|
||||
# - key: "key"
|
||||
# operator: "Equal|Exists"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
|
||||
|
||||
# -- Affinity and anti-affinity rules for server scheduling to nodes
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
##
|
||||
affinity: {}
|
||||
# # An example of preferred pod anti-affinity, weight is in the range 1-100
|
||||
# podAntiAffinity:
|
||||
# preferredDuringSchedulingIgnoredDuringExecution:
|
||||
# - weight: 100
|
||||
# podAffinityTerm:
|
||||
# labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app.kubernetes.io/name
|
||||
# operator: In
|
||||
# values:
|
||||
# - ingress-nginx
|
||||
# - key: app.kubernetes.io/instance
|
||||
# operator: In
|
||||
# values:
|
||||
# - ingress-nginx
|
||||
# - key: app.kubernetes.io/component
|
||||
# operator: In
|
||||
# values:
|
||||
# - controller
|
||||
# topologyKey: kubernetes.io/hostname
|
||||
|
||||
# # An example of required pod anti-affinity
|
||||
# podAntiAffinity:
|
||||
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||
# - labelSelector:
|
||||
# matchExpressions:
|
||||
# - key: app.kubernetes.io/name
|
||||
# operator: In
|
||||
# values:
|
||||
# - ingress-nginx
|
||||
# - key: app.kubernetes.io/instance
|
||||
# operator: In
|
||||
# values:
|
||||
# - ingress-nginx
|
||||
# - key: app.kubernetes.io/component
|
||||
# operator: In
|
||||
# values:
|
||||
# - controller
|
||||
# topologyKey: "kubernetes.io/hostname"
|
||||
|
||||
# -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
##
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready
|
||||
## wait up to five minutes for the drain of connections
|
||||
##
|
||||
terminationGracePeriodSeconds: 300
|
||||
# -- Node labels for controller pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||||
##
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
## Liveness and readiness probe values
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
|
||||
##
|
||||
## startupProbe:
|
||||
## httpGet:
|
||||
## # should match container.healthCheckPath
|
||||
## path: "/healthz"
|
||||
## port: 10254
|
||||
## scheme: HTTP
|
||||
## initialDelaySeconds: 5
|
||||
## periodSeconds: 5
|
||||
## timeoutSeconds: 2
|
||||
## successThreshold: 1
|
||||
## failureThreshold: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
# should match container.healthCheckPath
|
||||
path: "/healthz"
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
# should match container.healthCheckPath
|
||||
path: "/healthz"
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
# -- Path of the health check endpoint. All requests received on the port defined by
|
||||
# the healthz-port parameter are forwarded internally to this path.
|
||||
healthCheckPath: "/healthz"
|
||||
# -- Address to bind the health check endpoint.
|
||||
# It is better to set this option to the internal node address
|
||||
# if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.
|
||||
healthCheckHost: ""
|
||||
# -- Annotations to be added to controller pods
|
||||
##
|
||||
podAnnotations: {}
|
||||
replicaCount: 1
|
||||
# -- Minimum available pods set in PodDisruptionBudget.
|
||||
# Define either 'minAvailable' or 'maxUnavailable', never both.
|
||||
minAvailable: 1
|
||||
# -- Maximum unavalaile pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
|
||||
# maxUnavailable: 1
|
||||
|
||||
## Define requests resources to avoid probe issues due to CPU utilization in busy nodes
|
||||
## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903
|
||||
## Ideally, there should be no limits.
|
||||
## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/
|
||||
resources:
|
||||
## limits:
|
||||
## cpu: 100m
|
||||
## memory: 90Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 90Mi
|
||||
# Mutually exclusive with keda autoscaling
|
||||
autoscaling:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
minReplicas: 1
|
||||
maxReplicas: 11
|
||||
targetCPUUtilizationPercentage: 50
|
||||
targetMemoryUtilizationPercentage: 50
|
||||
behavior: {}
|
||||
# scaleDown:
|
||||
# stabilizationWindowSeconds: 300
|
||||
# policies:
|
||||
# - type: Pods
|
||||
# value: 1
|
||||
# periodSeconds: 180
|
||||
# scaleUp:
|
||||
# stabilizationWindowSeconds: 300
|
||||
# policies:
|
||||
# - type: Pods
|
||||
# value: 2
|
||||
# periodSeconds: 60
|
||||
autoscalingTemplate: []
|
||||
# Custom or additional autoscaling metrics
|
||||
# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
|
||||
# - type: Pods
|
||||
# pods:
|
||||
# metric:
|
||||
# name: nginx_ingress_controller_nginx_process_requests_total
|
||||
# target:
|
||||
# type: AverageValue
|
||||
# averageValue: 10000m
|
||||
|
||||
# Mutually exclusive with hpa autoscaling
|
||||
keda:
|
||||
apiVersion: "keda.sh/v1alpha1"
|
||||
## apiVersion changes with keda 1.x vs 2.x
|
||||
## 2.x = keda.sh/v1alpha1
|
||||
## 1.x = keda.k8s.io/v1alpha1
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 11
|
||||
pollingInterval: 30
|
||||
cooldownPeriod: 300
|
||||
# fallback:
|
||||
# failureThreshold: 3
|
||||
# replicas: 11
|
||||
restoreToOriginalReplicaCount: false
|
||||
scaledObject:
|
||||
annotations: {}
|
||||
# Custom annotations for ScaledObject resource
|
||||
# annotations:
|
||||
# key: value
|
||||
triggers: []
|
||||
# - type: prometheus
|
||||
# metadata:
|
||||
# serverAddress: http://<prometheus-host>:9090
|
||||
# metricName: http_requests_total
|
||||
# threshold: '100'
|
||||
# query: sum(rate(http_requests_total{deployment="my-deployment"}[2m]))
|
||||
|
||||
behavior: {}
|
||||
# scaleDown:
|
||||
# stabilizationWindowSeconds: 300
|
||||
# policies:
|
||||
# - type: Pods
|
||||
# value: 1
|
||||
# periodSeconds: 180
|
||||
# scaleUp:
|
||||
# stabilizationWindowSeconds: 300
|
||||
# policies:
|
||||
# - type: Pods
|
||||
# value: 2
|
||||
# periodSeconds: 60
|
||||
# -- Enable mimalloc as a drop-in replacement for malloc.
|
||||
## ref: https://github.com/microsoft/mimalloc
|
||||
##
|
||||
enableMimalloc: true
|
||||
## Override NGINX template
|
||||
customTemplate:
|
||||
configMapName: ""
|
||||
configMapKey: ""
|
||||
service:
|
||||
enabled: true
|
||||
# -- If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were
|
||||
# using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
|
||||
# It allows choosing the protocol for each backend specified in the Kubernetes service.
|
||||
# See the following GitHub issue for more details about the purpose: https://github.com/kubernetes/kubernetes/issues/40244
|
||||
# Will be ignored for Kubernetes versions older than 1.20
|
||||
##
|
||||
appProtocol: true
|
||||
# -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine.
|
||||
annotations: {}
|
||||
labels: {}
|
||||
# clusterIP: ""
|
||||
|
||||
# -- List of IP addresses at which the controller services are available
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
# -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
|
||||
loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
# -- Used by cloud providers to select a load balancer implementation other than the cloud provider default. https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class
|
||||
loadBalancerClass: ""
|
||||
enableHttp: true
|
||||
enableHttps: true
|
||||
## Set external traffic policy to: "Local" to preserve source IP on providers supporting it.
|
||||
## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer
|
||||
# externalTrafficPolicy: ""
|
||||
|
||||
## Must be either "None" or "ClientIP" if set. Kubernetes will default to "None".
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
|
||||
# sessionAffinity: ""
|
||||
|
||||
## Specifies the health check node port (numeric port number) for the service. If healthCheckNodePort isn’t specified,
|
||||
## the service controller allocates a port from your cluster’s NodePort range.
|
||||
## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
|
||||
# healthCheckNodePort: 0
|
||||
|
||||
# -- Represents the dual-stack-ness requested or required by this Service. Possible values are
|
||||
# SingleStack, PreferDualStack or RequireDualStack.
|
||||
# The ipFamilies and clusterIPs fields depend on the value of this field.
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/
|
||||
ipFamilyPolicy: "SingleStack"
|
||||
# -- List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically
|
||||
# based on cluster configuration and the ipFamilyPolicy field.
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ports:
|
||||
http: 80
|
||||
https: 443
|
||||
targetPorts:
|
||||
http: http
|
||||
https: https
|
||||
type: ""
|
||||
# type: NodePort
|
||||
# nodePorts:
|
||||
# http: 32080
|
||||
# https: 32443
|
||||
# tcp:
|
||||
# 8080: 32808
|
||||
nodePorts:
|
||||
http: ""
|
||||
https: ""
|
||||
tcp: {}
|
||||
udp: {}
|
||||
external:
|
||||
enabled: true
|
||||
internal:
|
||||
# -- Enables an additional internal load balancer (besides the external one).
|
||||
enabled: false
|
||||
# -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine.
|
||||
annotations: {}
|
||||
# -- Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS.
|
||||
loadBalancerIP: ""
|
||||
# -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0.
|
||||
loadBalancerSourceRanges: []
|
||||
## Set external traffic policy to: "Local" to preserve source IP on
|
||||
## providers supporting it
|
||||
## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer
|
||||
# externalTrafficPolicy: ""
|
||||
|
||||
# -- Custom port mapping for internal service
|
||||
ports: {}
|
||||
# http: 80
|
||||
# https: 443
|
||||
|
||||
# -- Custom target port mapping for internal service
|
||||
targetPorts: {}
|
||||
# http: http
|
||||
# https: https
|
||||
# shareProcessNamespace enables process namespace sharing within the pod.
|
||||
# This can be used for example to signal log rotation using `kill -USR1` from a sidecar.
|
||||
shareProcessNamespace: false
|
||||
# -- Additional containers to be added to the controller pod.
|
||||
# See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.
|
||||
extraContainers: []
|
||||
# - name: my-sidecar
|
||||
# image: nginx:latest
|
||||
# - name: lemonldap-ng-controller
|
||||
# image: lemonldapng/lemonldap-ng-controller:0.2.0
|
||||
# args:
|
||||
# - /lemonldap-ng-controller
|
||||
# - --alsologtostderr
|
||||
# - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration
|
||||
# env:
|
||||
# - name: POD_NAME
|
||||
# valueFrom:
|
||||
# fieldRef:
|
||||
# fieldPath: metadata.name
|
||||
# - name: POD_NAMESPACE
|
||||
# valueFrom:
|
||||
# fieldRef:
|
||||
# fieldPath: metadata.namespace
|
||||
# volumeMounts:
|
||||
# - name: copy-portal-skins
|
||||
# mountPath: /srv/var/lib/lemonldap-ng/portal/skins
|
||||
|
||||
# -- Additional volumeMounts to the controller main container.
|
||||
extraVolumeMounts: []
|
||||
# - name: copy-portal-skins
|
||||
# mountPath: /var/lib/lemonldap-ng/portal/skins
|
||||
|
||||
# -- Additional volumes to the controller pod.
|
||||
extraVolumes: []
|
||||
# - name: copy-portal-skins
|
||||
# emptyDir: {}
|
||||
|
||||
# -- Containers, which are run before the app containers are started.
|
||||
extraInitContainers: []
|
||||
# - name: init-myservice
|
||||
# image: busybox
|
||||
# command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;']
|
||||
|
||||
# -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module
|
||||
extraModules: []
|
||||
# - name: mytestmodule
|
||||
# image: registry.k8s.io/ingress-nginx/mytestmodule
|
||||
# containerSecurityContext:
|
||||
# allowPrivilegeEscalation: false
|
||||
#
|
||||
# The image must contain a `/usr/local/bin/init_module.sh` executable, which
|
||||
# will be executed as initContainers, to move its config files within the
|
||||
# mounted volume.
|
||||
|
||||
opentelemetry:
|
||||
enabled: false
|
||||
image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
resources: {}
|
||||
admissionWebhooks:
|
||||
annotations: {}
|
||||
# ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem".
|
||||
|
||||
## Additional annotations to the admission webhooks.
|
||||
## These annotations will be added to the ValidatingWebhookConfiguration and
|
||||
## the Jobs Spec of the admission webhooks.
|
||||
enabled: {{ .Modules.Additional.Ingress.EnableAdmissionWebhooks }}
|
||||
# -- Additional environment variables to set
|
||||
extraEnvs: []
|
||||
# extraEnvs:
|
||||
# - name: FOO
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# key: FOO
|
||||
# name: secret-resource
|
||||
# -- Admission Webhook failure policy to use
|
||||
failurePolicy: Fail
|
||||
# timeoutSeconds: 10
|
||||
port: 8443
|
||||
certificate: "/usr/local/certificates/cert"
|
||||
key: "/usr/local/certificates/key"
|
||||
namespaceSelector: {}
|
||||
objectSelector: {}
|
||||
# -- Labels to be added to admission webhooks
|
||||
labels: {}
|
||||
# -- Use an existing PSP instead of creating one
|
||||
existingPsp: ""
|
||||
service:
|
||||
annotations: {}
|
||||
# clusterIP: ""
|
||||
externalIPs: []
|
||||
# loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
servicePort: 443
|
||||
type: ClusterIP
|
||||
createSecretJob:
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 10m
|
||||
# memory: 20Mi
|
||||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 20Mi
|
||||
patchWebhookJob:
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
resources: {}
|
||||
patch:
|
||||
enabled: true
|
||||
image:
|
||||
registry: registry.k8s.io
|
||||
image: ingress-nginx/kube-webhook-certgen
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: v20231011-8b53cabe0
|
||||
digest: sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Provide a priority class name to the webhook patching job
|
||||
##
|
||||
priorityClassName: ""
|
||||
podAnnotations: {}
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
tolerations: []
|
||||
# -- Labels to be added to patch job resources
|
||||
labels: {}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
fsGroup: 2000
|
||||
# Use certmanager to generate webhook certs
|
||||
certManager:
|
||||
enabled: false
|
||||
# self-signed root certificate
|
||||
rootCert:
|
||||
# default to be 5y
|
||||
duration: ""
|
||||
admissionCert:
|
||||
# default to be 1y
|
||||
duration: ""
|
||||
# issuerRef:
|
||||
# name: "issuer"
|
||||
# kind: "ClusterIssuer"
|
||||
metrics:
|
||||
port: 10254
|
||||
portName: metrics
|
||||
# if this port is changed, change healthz-port: in extraArgs: accordingly
|
||||
enabled: false
|
||||
service:
|
||||
annotations: {}
|
||||
# prometheus.io/scrape: "true"
|
||||
# prometheus.io/port: "10254"
|
||||
# -- Labels to be added to the metrics service resource
|
||||
labels: {}
|
||||
# clusterIP: ""
|
||||
|
||||
# -- List of IP addresses at which the stats-exporter service is available
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
# loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
servicePort: 10254
|
||||
type: ClusterIP
|
||||
# externalTrafficPolicy: ""
|
||||
# nodePort: ""
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
additionalLabels: {}
|
||||
## The label to use to retrieve the job name from.
|
||||
## jobLabel: "app.kubernetes.io/name"
|
||||
namespace: ""
|
||||
namespaceSelector: {}
|
||||
## Default: scrape .Release.Namespace or namespaceOverride only
|
||||
## To scrape all, use the following:
|
||||
## namespaceSelector:
|
||||
## any: true
|
||||
scrapeInterval: 30s
|
||||
# honorLabels: true
|
||||
targetLabels: []
|
||||
relabelings: []
|
||||
metricRelabelings: []
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
additionalLabels: {}
|
||||
# namespace: ""
|
||||
rules: []
|
||||
# # These are just examples rules, please adapt them to your needs
|
||||
# - alert: NGINXConfigFailed
|
||||
# expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0
|
||||
# for: 1s
|
||||
# labels:
|
||||
# severity: critical
|
||||
# annotations:
|
||||
# description: bad ingress config - nginx config test failed
|
||||
# summary: uninstall the latest ingress changes to allow config reloads to resume
|
||||
# - alert: NGINXCertificateExpiry
|
||||
# expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds) by (host) - time()) < 604800
|
||||
# for: 1s
|
||||
# labels:
|
||||
# severity: critical
|
||||
# annotations:
|
||||
# description: ssl certificate(s) will expire in less then a week
|
||||
# summary: renew expiring certificates to avoid downtime
|
||||
# - alert: NGINXTooMany500s
|
||||
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
|
||||
# for: 1m
|
||||
# labels:
|
||||
# severity: warning
|
||||
# annotations:
|
||||
# description: Too many 5XXs
|
||||
# summary: More than 5% of all requests returned 5XX, this requires your attention
|
||||
# - alert: NGINXTooMany400s
|
||||
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
|
||||
# for: 1m
|
||||
# labels:
|
||||
# severity: warning
|
||||
# annotations:
|
||||
# description: Too many 4XXs
|
||||
# summary: More than 5% of all requests returned 4XX, this requires your attention
|
||||
# -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:
|
||||
# With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds
|
||||
# to 300, allowing the draining of connections up to five minutes.
|
||||
# If the active connections end before that, the pod will terminate gracefully at that time.
|
||||
# To effectively take advantage of this feature, the Configmap feature
|
||||
# worker-shutdown-timeout new value is 240s instead of 10s.
|
||||
##
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /wait-shutdown
|
||||
priorityClassName: ""
|
||||
# -- Rollback limit
|
||||
##
|
||||
revisionHistoryLimit: 10
|
||||
## Default 404 backend
|
||||
##
|
||||
defaultBackend:
|
||||
##
|
||||
enabled: false
|
||||
name: defaultbackend
|
||||
image:
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
repository: {{ .Modules.Additional.Ingress.Nginx.DefaultBackend.Image }}
|
||||
tag: "{{ .Modules.Additional.Ingress.Nginx.DefaultBackend.Tag }}"
|
||||
pullPolicy: IfNotPresent
|
||||
# nobody user -> uid 65534
|
||||
runAsUser: 65534
|
||||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
# -- Use an existing PSP instead of creating one
|
||||
existingPsp: ""
|
||||
extraArgs: {}
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: ""
|
||||
automountServiceAccountToken: true
|
||||
# -- Additional environment variables to set for defaultBackend pods
|
||||
extraEnvs: []
|
||||
port: 8080
|
||||
## Readiness and liveness probes for default backend
|
||||
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
|
||||
##
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 0
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
# -- The update strategy to apply to the Deployment or DaemonSet
|
||||
##
|
||||
updateStrategy: {}
|
||||
# rollingUpdate:
|
||||
# maxUnavailable: 1
|
||||
# type: RollingUpdate
|
||||
|
||||
# -- `minReadySeconds` to avoid killing pods before we are ready
|
||||
##
|
||||
minReadySeconds: 0
|
||||
# -- Node tolerations for server scheduling to nodes with taints
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
||||
##
|
||||
tolerations: []
|
||||
# - key: "key"
|
||||
# operator: "Equal|Exists"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
|
||||
|
||||
affinity: {}
|
||||
# -- Security Context policies for controller pods
|
||||
# See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
|
||||
# notes on enabling and using sysctls
|
||||
##
|
||||
podSecurityContext: {}
|
||||
# -- Security Context policies for controller main container.
|
||||
# See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
|
||||
# notes on enabling and using sysctls
|
||||
##
|
||||
containerSecurityContext: {}
|
||||
# -- Labels to add to the pod container metadata
|
||||
podLabels: {}
|
||||
# -- Node labels for default backend pod assignment
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||||
##
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
# -- Annotations to be added to default backend pods
|
||||
##
|
||||
podAnnotations: {}
|
||||
replicaCount: 1
|
||||
minAvailable: 1
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 10m
|
||||
# memory: 20Mi
|
||||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 20Mi
|
||||
|
||||
extraVolumeMounts: []
|
||||
## Additional volumeMounts to the default backend container.
|
||||
# - name: copy-portal-skins
|
||||
# mountPath: /var/lib/lemonldap-ng/portal/skins
|
||||
|
||||
extraVolumes: []
|
||||
## Additional volumes to the default backend pod.
|
||||
# - name: copy-portal-skins
|
||||
# emptyDir: {}
|
||||
|
||||
autoscaling:
|
||||
annotations: {}
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 2
|
||||
targetCPUUtilizationPercentage: 50
|
||||
targetMemoryUtilizationPercentage: 50
|
||||
# NetworkPolicy for default backend component.
|
||||
networkPolicy:
|
||||
# -- Enable 'networkPolicy' or not
|
||||
enabled: false
|
||||
service:
|
||||
annotations: {}
|
||||
# clusterIP: ""
|
||||
|
||||
# -- List of IP addresses at which the default backend service is available
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
# loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
servicePort: 80
|
||||
type: ClusterIP
|
||||
priorityClassName: ""
|
||||
# -- Labels to be added to the default backend resources
|
||||
labels: {}
|
||||
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266
|
||||
rbac:
|
||||
create: true
|
||||
scope: false
|
||||
## If true, create & use Pod Security Policy resources
|
||||
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
|
||||
podSecurityPolicy:
|
||||
enabled: false
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: ""
|
||||
automountServiceAccountToken: true
|
||||
# -- Annotations for the controller service account
|
||||
annotations: {}
|
||||
# -- Optional array of imagePullSecrets containing private registry credentials
|
||||
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
imagePullSecrets: []
|
||||
# - name: secretName
|
||||
|
||||
# -- TCP service key-value pairs
|
||||
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
|
||||
##
|
||||
tcp: {}
|
||||
# 8080: "default/example-tcp-svc:9000"
|
||||
|
||||
# -- UDP service key-value pairs
|
||||
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
|
||||
##
|
||||
udp: {}
|
||||
# 53: "kube-system/kube-dns:53"
|
||||
|
||||
# -- Prefix for TCP and UDP ports names in ingress controller service
|
||||
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration
|
||||
portNamePrefix: ""
|
||||
# -- (string) A base64-encoded Diffie-Hellman parameter.
|
||||
# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`
|
||||
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param
|
||||
dhParam: ""
|
||||
@@ -0,0 +1,490 @@
|
||||
- name: longhorn
|
||||
namespace: longhorn-system
|
||||
create_namespace: true
|
||||
chart_ref: {{ .Modules.Additional.Storage.Longhorn.ChartRef }}
|
||||
chart_version: {{ .Modules.Additional.Storage.Longhorn.ChartVersion }}
|
||||
{{- if .Modules.Additional.Storage.Longhorn.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
global:
|
||||
cattle:
|
||||
# -- Default system registry.
|
||||
systemDefaultRegistry: ""
|
||||
windowsCluster:
|
||||
# -- Setting that allows Longhorn to run on a Rancher Windows cluster.
|
||||
enabled: false
|
||||
# -- Toleration for Linux nodes that can run user-deployed Longhorn components.
|
||||
tolerations:
|
||||
- key: "cattle.io/os"
|
||||
value: "linux"
|
||||
effect: "NoSchedule"
|
||||
operator: "Equal"
|
||||
# -- Node selector for Linux nodes that can run user-deployed Longhorn components.
|
||||
nodeSelector:
|
||||
kubernetes.io/os: "linux"
|
||||
defaultSetting:
|
||||
# -- Toleration for system-managed Longhorn components.
|
||||
taintToleration: cattle.io/os=linux:NoSchedule
|
||||
# -- Node selector for system-managed Longhorn components.
|
||||
systemManagedComponentsNodeSelector: kubernetes.io/os:linux
|
||||
|
||||
networkPolicies:
|
||||
# -- Setting that allows you to enable network policies that control access to Longhorn pods.
|
||||
enabled: false
|
||||
# -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
|
||||
type: "k3s"
|
||||
|
||||
image:
|
||||
longhorn:
|
||||
engine:
|
||||
# -- Repository for the Longhorn Engine image.
|
||||
repository: longhornio/longhorn-engine
|
||||
# -- Specify Longhorn engine image tag
|
||||
tag: v1.6.1
|
||||
manager:
|
||||
# -- Repository for the Longhorn Manager image.
|
||||
repository: longhornio/longhorn-manager
|
||||
# -- Specify Longhorn manager image tag
|
||||
tag: v1.6.1
|
||||
ui:
|
||||
# -- Repository for the Longhorn UI image.
|
||||
repository: longhornio/longhorn-ui
|
||||
# -- Specify Longhorn ui image tag
|
||||
tag: v1.6.1
|
||||
instanceManager:
|
||||
# -- Repository for the Longhorn Instance Manager image.
|
||||
repository: longhornio/longhorn-instance-manager
|
||||
# -- Specify Longhorn instance manager image tag
|
||||
tag: v1.6.1
|
||||
shareManager:
|
||||
# -- Repository for the Longhorn Share Manager image.
|
||||
repository: longhornio/longhorn-share-manager
|
||||
# -- Specify Longhorn share manager image tag
|
||||
tag: v1.6.1
|
||||
backingImageManager:
|
||||
# -- Repository for the Backing Image Manager image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/backing-image-manager
|
||||
# -- Specify Longhorn backing image manager image tag
|
||||
tag: v1.6.1
|
||||
supportBundleKit:
|
||||
# -- Repository for the Longhorn Support Bundle Manager image.
|
||||
repository: longhornio/support-bundle-kit
|
||||
# -- Tag for the Longhorn Support Bundle Manager image.
|
||||
tag: v0.0.36
|
||||
csi:
|
||||
attacher:
|
||||
# -- Repository for the CSI attacher image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-attacher
|
||||
# -- Tag for the CSI attacher image. When unspecified, Longhorn uses the default value.
|
||||
tag: v4.4.2
|
||||
provisioner:
|
||||
# -- Repository for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-provisioner
|
||||
# -- Tag for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
|
||||
tag: v3.6.2
|
||||
nodeDriverRegistrar:
|
||||
# -- Repository for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-node-driver-registrar
|
||||
# -- Tag for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
|
||||
tag: v2.9.2
|
||||
resizer:
|
||||
# -- Repository for the CSI Resizer image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-resizer
|
||||
# -- Tag for the CSI Resizer image. When unspecified, Longhorn uses the default value.
|
||||
tag: v1.9.2
|
||||
snapshotter:
|
||||
# -- Repository for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/csi-snapshotter
|
||||
# -- Tag for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
|
||||
tag: v6.3.2
|
||||
livenessProbe:
|
||||
# -- Repository for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
|
||||
repository: longhornio/livenessprobe
|
||||
# -- Tag for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
|
||||
tag: v2.12.0
|
||||
openshift:
|
||||
oauthProxy:
|
||||
# -- Repository for the OAuth Proxy image. This setting applies only to OpenShift users.
|
||||
repository: quay.io/openshift/origin-oauth-proxy
|
||||
# -- Tag for the OAuth Proxy image. This setting applies only to OpenShift users. Specify OCP/OKD version 4.1 or later. The latest stable version is 4.14.
|
||||
tag: 4.14
|
||||
# -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
service:
|
||||
ui:
|
||||
# -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
|
||||
type: ClusterIP
|
||||
# -- NodePort port number for Longhorn UI. When unspecified, Longhorn selects a free port between 30000 and 32767.
|
||||
nodePort: null
|
||||
manager:
|
||||
# -- Service type for Longhorn Manager.
|
||||
type: ClusterIP
|
||||
# -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
|
||||
nodePort: ""
|
||||
|
||||
persistence:
|
||||
# -- Setting that allows you to specify the default Longhorn StorageClass.
|
||||
defaultClass: true
|
||||
# -- Filesystem type of the default Longhorn StorageClass.
|
||||
defaultFsType: ext4
|
||||
# -- mkfs parameters of the default Longhorn StorageClass.
|
||||
defaultMkfsParams: ""
|
||||
# -- Replica count of the default Longhorn StorageClass.
|
||||
defaultClassReplicaCount: 3
|
||||
# -- Data locality of the default Longhorn StorageClass. (Options: "disabled", "best-effort")
|
||||
defaultDataLocality: disabled
|
||||
# -- Reclaim policy that provides instructions for handling of a volume after its claim is released. (Options: "Retain", "Delete")
|
||||
reclaimPolicy: Delete
|
||||
# -- Setting that allows you to enable live migration of a Longhorn volume from one node to another.
|
||||
migratable: false
|
||||
# -- Set NFS mount options for Longhorn StorageClass for RWX volumes
|
||||
nfsOptions: ""
|
||||
recurringJobSelector:
|
||||
# -- Setting that allows you to enable the recurring job selector for a Longhorn StorageClass.
|
||||
enable: false
|
||||
# -- Recurring job selector for a Longhorn StorageClass. Ensure that quotes are used correctly when specifying job parameters. (Example: `[{"name":"backup", "isGroup":true}]`)
|
||||
jobList: []
|
||||
backingImage:
|
||||
# -- Setting that allows you to use a backing image in a Longhorn StorageClass.
|
||||
enable: false
|
||||
# -- Backing image to be used for creating and restoring volumes in a Longhorn StorageClass. When no backing images are available, specify the data source type and parameters that Longhorn can use to create a backing image.
|
||||
name: ~
|
||||
# -- Data source type of a backing image used in a Longhorn StorageClass.
|
||||
# If the backing image exists in the cluster, Longhorn uses this setting to verify the image.
|
||||
# If the backing image does not exist, Longhorn creates one using the specified data source type.
|
||||
dataSourceType: ~
|
||||
# -- Data source parameters of a backing image used in a Longhorn StorageClass.
|
||||
# You can specify a JSON string of a map. (Example: `'{\"url\":\"https://backing-image-example.s3-region.amazonaws.com/test-backing-image\"}'`)
|
||||
dataSourceParameters: ~
|
||||
# -- Expected SHA-512 checksum of a backing image used in a Longhorn StorageClass.
|
||||
expectedChecksum: ~
|
||||
defaultNodeSelector:
|
||||
# -- Setting that allows you to enable the node selector for the default Longhorn StorageClass.
|
||||
enable: false
|
||||
# -- Node selector for the default Longhorn StorageClass. Longhorn uses only nodes with the specified tags for storing volume data. (Examples: "storage,fast")
|
||||
selector: ""
|
||||
# -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
|
||||
removeSnapshotsDuringFilesystemTrim: ignored
|
||||
|
||||
preUpgradeChecker:
|
||||
# -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
|
||||
jobEnabled: true
|
||||
# -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
|
||||
upgradeVersionCheck: true
|
||||
|
||||
csi:
|
||||
# -- kubelet root directory. When unspecified, Longhorn uses the default value.
|
||||
kubeletRootDir: ~
|
||||
# -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
|
||||
attacherReplicaCount: ~
|
||||
# -- Replica count of the CSI Provisioner. When unspecified, Longhorn uses the default value ("3").
|
||||
provisionerReplicaCount: ~
|
||||
# -- Replica count of the CSI Resizer. When unspecified, Longhorn uses the default value ("3").
|
||||
resizerReplicaCount: ~
|
||||
# -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
|
||||
snapshotterReplicaCount: ~
|
||||
|
||||
defaultSettings:
|
||||
# -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
|
||||
backupTarget: ~
|
||||
# -- Name of the Kubernetes secret associated with the backup target.
|
||||
backupTargetCredentialSecret: ~
|
||||
# -- Setting that allows Longhorn to automatically attach a volume and create snapshots or backups when recurring jobs are run.
|
||||
allowRecurringJobWhileVolumeDetached: ~
|
||||
# -- Setting that allows Longhorn to automatically create a default disk only on nodes with the label "node.longhorn.io/create-default-disk=true" (if no other disks exist). When this setting is disabled, Longhorn creates a default disk on each node that is added to the cluster.
|
||||
createDefaultDiskLabeledNodes: ~
|
||||
# -- Default path for storing data on a host. The default value is "/var/lib/longhorn/".
|
||||
defaultDataPath: ~
|
||||
# -- Default data locality. A Longhorn volume has data locality if a local replica of the volume exists on the same node as the pod that is using the volume.
|
||||
defaultDataLocality: ~
|
||||
# -- Setting that allows scheduling on nodes with healthy replicas of the same volume. This setting is disabled by default.
|
||||
replicaSoftAntiAffinity: ~
|
||||
# -- Setting that automatically rebalances replicas when an available node is discovered.
|
||||
replicaAutoBalance: ~
|
||||
# -- Percentage of storage that can be allocated relative to hard drive capacity. The default value is "100".
|
||||
storageOverProvisioningPercentage: ~
|
||||
# -- Percentage of minimum available disk capacity. When the minimum available capacity exceeds the total available capacity, the disk becomes unschedulable until more space is made available for use. The default value is "25".
|
||||
storageMinimalAvailablePercentage: ~
|
||||
# -- Percentage of disk space that is not allocated to the default disk on each new Longhorn node.
|
||||
storageReservedPercentageForDefaultDisk: ~
|
||||
# -- Upgrade Checker that periodically checks for new Longhorn versions. When a new version is available, a notification appears on the Longhorn UI. This setting is enabled by default
|
||||
upgradeChecker: ~
|
||||
# -- Default number of replicas for volumes created using the Longhorn UI. For Kubernetes configuration, modify the `numberOfReplicas` field in the StorageClass. The default value is "3".
|
||||
defaultReplicaCount: ~
|
||||
# -- Default Longhorn StorageClass. "storageClassName" is assigned to PVs and PVCs that are created for an existing Longhorn volume. "storageClassName" can also be used as a label, so it is possible to use a Longhorn StorageClass to bind a workload to an existing PV without creating a Kubernetes StorageClass object. The default value is "longhorn-static".
|
||||
defaultLonghornStaticStorageClass: ~
|
||||
# -- Number of seconds that Longhorn waits before checking the backupstore for new backups. The default value is "300". When the value is "0", polling is disabled.
|
||||
backupstorePollInterval: ~
|
||||
# -- Number of minutes that Longhorn keeps a failed backup resource. When the value is "0", automatic deletion is disabled.
|
||||
failedBackupTTL: ~
|
||||
# -- Setting that restores recurring jobs from a backup volume on a backup target and creates recurring jobs if none exist during backup restoration.
|
||||
restoreVolumeRecurringJobs: ~
|
||||
# -- Maximum number of successful recurring backup and snapshot jobs to be retained. When the value is "0", a history of successful recurring jobs is not retained.
|
||||
recurringSuccessfulJobsHistoryLimit: ~
|
||||
# -- Maximum number of failed recurring backup and snapshot jobs to be retained. When the value is "0", a history of failed recurring jobs is not retained.
|
||||
recurringFailedJobsHistoryLimit: ~
|
||||
# -- Maximum number of snapshots or backups to be retained.
|
||||
recurringJobMaxRetention: ~
|
||||
# -- Maximum number of failed support bundles that can exist in the cluster. When the value is "0", Longhorn automatically purges all failed support bundles.
|
||||
supportBundleFailedHistoryLimit: ~
|
||||
# -- Taint or toleration for system-managed Longhorn components.
|
||||
taintToleration: ~
|
||||
# -- Node selector for system-managed Longhorn components.
|
||||
systemManagedComponentsNodeSelector: ~
|
||||
# -- PriorityClass for system-managed Longhorn components.
|
||||
# This setting can help prevent Longhorn components from being evicted under Node Pressure.
|
||||
# Notice that this will be applied to Longhorn user-deployed components by default if there are no priority class values set yet, such as `longhornManager.priorityClass`.
|
||||
priorityClass: &defaultPriorityClassNameRef "longhorn-critical"
|
||||
# -- Setting that allows Longhorn to automatically salvage volumes when all replicas become faulty (for example, when the network connection is interrupted). Longhorn determines which replicas are usable and then uses these replicas for the volume. This setting is enabled by default.
|
||||
autoSalvage: ~
|
||||
# -- Setting that allows Longhorn to automatically delete a workload pod that is managed by a controller (for example, daemonset) whenever a Longhorn volume is detached unexpectedly (for example, during Kubernetes upgrades). After deletion, the controller restarts the pod and then Kubernetes handles volume reattachment and remounting.
|
||||
autoDeletePodWhenVolumeDetachedUnexpectedly: ~
|
||||
# -- Setting that prevents Longhorn Manager from scheduling replicas on a cordoned Kubernetes node. This setting is enabled by default.
|
||||
disableSchedulingOnCordonedNode: ~
|
||||
# -- Setting that allows Longhorn to schedule new replicas of a volume to nodes in the same zone as existing healthy replicas. Nodes that do not belong to any zone are treated as existing in the zone that contains healthy replicas. When identifying zones, Longhorn relies on the label "topology.kubernetes.io/zone=<Zone name of the node>" in the Kubernetes node object.
|
||||
replicaZoneSoftAntiAffinity: ~
|
||||
# -- Setting that allows scheduling on disks with existing healthy replicas of the same volume. This setting is enabled by default.
|
||||
replicaDiskSoftAntiAffinity: ~
|
||||
# -- Policy that defines the action Longhorn takes when a volume is stuck with a StatefulSet or Deployment pod on a node that failed.
|
||||
nodeDownPodDeletionPolicy: ~
|
||||
# -- Policy that defines the action Longhorn takes when a node with the last healthy replica of a volume is drained.
|
||||
nodeDrainPolicy: ~
|
||||
# -- Setting that allows automatic detaching of manually-attached volumes when a node is cordoned.
|
||||
detachManuallyAttachedVolumesWhenCordoned: ~
|
||||
# -- Number of seconds that Longhorn waits before reusing existing data on a failed replica instead of creating a new replica of a degraded volume.
|
||||
replicaReplenishmentWaitInterval: ~
|
||||
# -- Maximum number of replicas that can be concurrently rebuilt on each node.
|
||||
concurrentReplicaRebuildPerNodeLimit: ~
|
||||
# -- Maximum number of volumes that can be concurrently restored on each node using a backup. When the value is "0", restoration of volumes using a backup is disabled.
|
||||
concurrentVolumeBackupRestorePerNodeLimit: ~
|
||||
# -- Setting that disables the revision counter and thereby prevents Longhorn from tracking all write operations to a volume. When salvaging a volume, Longhorn uses properties of the "volume-head-xxx.img" file (the last file size and the last time the file was modified) to select the replica to be used for volume recovery. This setting applies only to volumes created using the Longhorn UI.
|
||||
disableRevisionCounter: ~
|
||||
# -- Image pull policy for system-managed pods, such as Instance Manager, engine images, and CSI Driver. Changes to the image pull policy are applied only after the system-managed pods restart.
|
||||
systemManagedPodsImagePullPolicy: ~
|
||||
# -- Setting that allows you to create and attach a volume without having all replicas scheduled at the time of creation.
|
||||
allowVolumeCreationWithDegradedAvailability: ~
|
||||
# -- Setting that allows Longhorn to automatically clean up the system-generated snapshot after replica rebuilding is completed.
|
||||
autoCleanupSystemGeneratedSnapshot: ~
|
||||
# -- Setting that allows Longhorn to automatically clean up the snapshot generated by a recurring backup job.
|
||||
autoCleanupRecurringJobBackupSnapshot: ~
|
||||
# -- Maximum number of engines that are allowed to concurrently upgrade on each node after Longhorn Manager is upgraded. When the value is "0", Longhorn does not automatically upgrade volume engines to the new default engine image version.
|
||||
concurrentAutomaticEngineUpgradePerNodeLimit: ~
|
||||
# -- Number of minutes that Longhorn waits before cleaning up the backing image file when no replicas in the disk are using it.
|
||||
backingImageCleanupWaitInterval: ~
|
||||
# -- Number of seconds that Longhorn waits before downloading a backing image file again when the status of all image disk files changes to "failed" or "unknown".
|
||||
backingImageRecoveryWaitInterval: ~
|
||||
# -- Percentage of the total allocatable CPU resources on each node to be reserved for each instance manager pod when the V1 Data Engine is enabled. The default value is "12".
|
||||
guaranteedInstanceManagerCPU: ~
|
||||
# -- Setting that notifies Longhorn that the cluster is using the Kubernetes Cluster Autoscaler.
|
||||
kubernetesClusterAutoscalerEnabled: ~
|
||||
# -- Setting that allows Longhorn to automatically delete an orphaned resource and the corresponding data (for example, stale replicas). Orphaned resources on failed or unknown nodes are not automatically cleaned up.
|
||||
orphanAutoDeletion: ~
|
||||
# -- Storage network for in-cluster traffic. When unspecified, Longhorn uses the Kubernetes cluster network.
|
||||
storageNetwork: ~
|
||||
# -- Flag that prevents accidental uninstallation of Longhorn.
|
||||
deletingConfirmationFlag: ~
|
||||
# -- Timeout between the Longhorn Engine and replicas. Specify a value between "8" and "30" seconds. The default value is "8".
|
||||
engineReplicaTimeout: ~
|
||||
# -- Setting that allows you to enable and disable snapshot hashing and data integrity checks.
|
||||
snapshotDataIntegrity: ~
|
||||
# -- Setting that allows disabling of snapshot hashing after snapshot creation to minimize impact on system performance.
|
||||
snapshotDataIntegrityImmediateCheckAfterSnapshotCreation: ~
|
||||
# -- Setting that defines when Longhorn checks the integrity of data in snapshot disk files. You must use the Unix cron expression format.
|
||||
snapshotDataIntegrityCronjob: ~
|
||||
# -- Setting that allows Longhorn to automatically mark the latest snapshot and its parent files as removed during a filesystem trim. Longhorn does not remove snapshots containing multiple child files.
|
||||
removeSnapshotsDuringFilesystemTrim: ~
|
||||
# -- Setting that allows fast rebuilding of replicas using the checksum of snapshot disk files. Before enabling this setting, you must set the snapshot-data-integrity value to "enable" or "fast-check".
|
||||
fastReplicaRebuildEnabled: ~
|
||||
# -- Number of seconds that an HTTP client waits for a response from a File Sync server before considering the connection to have failed.
|
||||
replicaFileSyncHttpClientTimeout: ~
|
||||
# -- Log levels that indicate the type and severity of logs in Longhorn Manager. The default value is "Info". (Options: "Panic", "Fatal", "Error", "Warn", "Info", "Debug", "Trace")
|
||||
logLevel: ~
|
||||
# -- Setting that allows you to specify a backup compression method.
|
||||
backupCompressionMethod: ~
|
||||
# -- Maximum number of worker threads that can concurrently run for each backup.
|
||||
backupConcurrentLimit: ~
|
||||
# -- Maximum number of worker threads that can concurrently run for each restore operation.
|
||||
restoreConcurrentLimit: ~
|
||||
# -- Setting that allows you to enable the V1 Data Engine.
|
||||
v1DataEngine: ~
|
||||
# -- Setting that allows you to enable the V2 Data Engine, which is based on the Storage Performance Development Kit (SPDK). The V2 Data Engine is a preview feature and should not be used in production environments.
|
||||
v2DataEngine: ~
|
||||
# -- Setting that allows you to configure maximum huge page size (in MiB) for the V2 Data Engine.
|
||||
v2DataEngineHugepageLimit: ~
|
||||
# -- Setting that allows rebuilding of offline replicas for volumes using the V2 Data Engine.
|
||||
offlineReplicaRebuilding: ~
|
||||
# -- Number of millicpus on each node to be reserved for each Instance Manager pod when the V2 Data Engine is enabled. The default value is "1250".
|
||||
v2DataEngineGuaranteedInstanceManagerCPU: ~
|
||||
# -- Setting that allows scheduling of empty node selector volumes to any node.
|
||||
allowEmptyNodeSelectorVolume: ~
|
||||
# -- Setting that allows scheduling of empty disk selector volumes to any disk.
|
||||
allowEmptyDiskSelectorVolume: ~
|
||||
# -- Setting that allows Longhorn to periodically collect anonymous usage data for product improvement purposes. Longhorn sends collected data to the [Upgrade Responder](https://github.com/longhorn/upgrade-responder) server, which is the data source of the Longhorn Public Metrics Dashboard (https://metrics.longhorn.io). The Upgrade Responder server does not store data that can be used to identify clients, including IP addresses.
|
||||
allowCollectingLonghornUsageMetrics: ~
|
||||
# -- Setting that temporarily prevents all attempts to purge volume snapshots.
|
||||
disableSnapshotPurge: ~
|
||||
# -- Maximum snapshot count for a volume. The value should be between 2 to 250
|
||||
snapshotMaxCount: ~
|
||||
|
||||
privateRegistry:
|
||||
# -- Setting that allows you to create a private registry secret.
|
||||
createSecret: ~
|
||||
# -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
|
||||
registryUrl: ~
|
||||
# -- User account used for authenticating with a private registry.
|
||||
registryUser: ~
|
||||
# -- Password for authenticating with a private registry.
|
||||
registryPasswd: ~
|
||||
# -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
|
||||
registrySecret: ~
|
||||
|
||||
longhornManager:
|
||||
log:
|
||||
# -- Format of Longhorn Manager logs. (Options: "plain", "json")
|
||||
format: plain
|
||||
# -- PriorityClass for Longhorn Manager.
|
||||
priorityClass: *defaultPriorityClassNameRef
|
||||
# -- Toleration for Longhorn Manager on nodes allowed to run Longhorn Manager.
|
||||
tolerations: []
|
||||
## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
|
||||
## and uncomment this example block
|
||||
# - key: "key"
|
||||
# operator: "Equal"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule"
|
||||
# -- Node selector for Longhorn Manager. Specify the nodes allowed to run Longhorn Manager.
|
||||
nodeSelector: {}
|
||||
## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
|
||||
## and uncomment this example block
|
||||
# label-key1: "label-value1"
|
||||
# label-key2: "label-value2"
|
||||
# -- Annotation for the Longhorn Manager service.
|
||||
serviceAnnotations: {}
|
||||
## If you want to set annotations for the Longhorn Manager service, delete the `{}` in the line above
|
||||
## and uncomment this example block
|
||||
# annotation-key1: "annotation-value1"
|
||||
# annotation-key2: "annotation-value2"
|
||||
|
||||
longhornDriver:
|
||||
# -- PriorityClass for Longhorn Driver.
|
||||
priorityClass: *defaultPriorityClassNameRef
|
||||
# -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
|
||||
tolerations: []
|
||||
## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
|
||||
## and uncomment this example block
|
||||
# - key: "key"
|
||||
# operator: "Equal"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule"
|
||||
# -- Node selector for Longhorn Driver. Specify the nodes allowed to run Longhorn Driver.
|
||||
nodeSelector: {}
|
||||
## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
|
||||
## and uncomment this example block
|
||||
# label-key1: "label-value1"
|
||||
# label-key2: "label-value2"
|
||||
|
||||
longhornUI:
|
||||
# -- Replica count for Longhorn UI.
|
||||
replicas: 2
|
||||
# -- PriorityClass for Longhorn UI.
|
||||
priorityClass: *defaultPriorityClassNameRef
|
||||
# -- Toleration for Longhorn UI on nodes allowed to run Longhorn components.
|
||||
tolerations: []
|
||||
## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
|
||||
## and uncomment this example block
|
||||
# - key: "key"
|
||||
# operator: "Equal"
|
||||
# value: "value"
|
||||
# effect: "NoSchedule"
|
||||
# -- Node selector for Longhorn UI. Specify the nodes allowed to run Longhorn UI.
|
||||
nodeSelector: {}
|
||||
## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
|
||||
## and uncomment this example block
|
||||
# label-key1: "label-value1"
|
||||
# label-key2: "label-value2"
|
||||
|
||||
ingress:
|
||||
# -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
|
||||
enabled: false
|
||||
|
||||
# -- IngressClass resource that contains ingress configuration, including the name of the Ingress controller.
|
||||
# ingressClassName can replace the kubernetes.io/ingress.class annotation used in earlier Kubernetes releases.
|
||||
ingressClassName: ~
|
||||
|
||||
# -- Hostname of the Layer 7 load balancer.
|
||||
host: sslip.io
|
||||
|
||||
# -- Setting that allows you to enable TLS on ingress records.
|
||||
tls: false
|
||||
|
||||
# -- Setting that allows you to enable secure connections to the Longhorn UI service via port 443.
|
||||
secureBackends: false
|
||||
|
||||
# -- TLS secret that contains the private key and certificate to be used for TLS. This setting applies only when TLS is enabled on ingress records.
|
||||
tlsSecret: longhorn.local-tls
|
||||
|
||||
path: /
|
||||
|
||||
## If you're using kube-lego, you will want to add:
|
||||
## kubernetes.io/tls-acme: true
|
||||
##
|
||||
## For a full list of possible ingress annotations, please see
|
||||
## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
|
||||
##
|
||||
## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
|
||||
# -- Ingress annotations in the form of key-value pairs.
|
||||
annotations:
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: true
|
||||
|
||||
# -- Secret that contains a TLS private key and certificate. Use secrets if you want to use your own certificates to secure ingresses.
|
||||
secrets:
|
||||
## If you're providing your own certificates, please use this to add the certificates as secrets
|
||||
## key and certificate should start with -----BEGIN CERTIFICATE----- or
|
||||
## -----BEGIN RSA PRIVATE KEY-----
|
||||
##
|
||||
## name should line up with a tlsSecret set further up
|
||||
## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
|
||||
##
|
||||
## It is also possible to create and manage the certificates outside of this helm chart
|
||||
## Please see README.md for more information
|
||||
# - name: longhorn.local-tls
|
||||
# key:
|
||||
# certificate:
|
||||
|
||||
# -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
|
||||
enablePSP: false
|
||||
|
||||
# -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
|
||||
namespaceOverride: ""
|
||||
|
||||
# -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
|
||||
annotations: {}
|
||||
|
||||
serviceAccount:
|
||||
# -- Annotations to add to the service account
|
||||
annotations: {}
|
||||
|
||||
metrics:
|
||||
serviceMonitor:
|
||||
# -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
|
||||
enabled: false
|
||||
|
||||
## openshift settings
|
||||
openshift:
|
||||
# -- Setting that allows Longhorn to integrate with OpenShift.
|
||||
enabled: false
|
||||
ui:
|
||||
# -- Route for connections between Longhorn and the OpenShift web console.
|
||||
route: "longhorn-ui"
|
||||
# -- Port for accessing the OpenShift web console.
|
||||
port: 443
|
||||
# -- Port for proxy that provides access to the OpenShift web console.
|
||||
proxy: 8443
|
||||
|
||||
# -- Setting that allows Longhorn to generate code coverage profiles.
|
||||
enableGoCoverDir: false
|
||||
@@ -0,0 +1,9 @@
|
||||
- name: csi-secrets-store
|
||||
namespace: kube-system
|
||||
chart_ref: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef }}
|
||||
chart_version: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion }}
|
||||
{{- if .Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user