update vault integration
This commit is contained in:
@@ -0,0 +1,34 @@
|
||||
- name: argo-cd-ingress
|
||||
namespace: cicd
|
||||
create_namespace: true
|
||||
chart_ref: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartRef }}
|
||||
chart_version: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion }}
|
||||
{{- if and .Modules.Cicd.Enabled (eq .Modules.Cicd.ArgoCd.Expose.Type "ingress") }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
services:
|
||||
- domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
|
||||
address: argo-cd-argocd-server
|
||||
port: 80
|
||||
secretName: argo-cd-server-tls
|
||||
|
||||
ingress:
|
||||
accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
|
||||
class: {{ .Modules.Additional.Ingress.Type }}
|
||||
annotations:
|
||||
{{- if eq .Modules.Additional.Ingress.Type "nginx" }}
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
|
||||
nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
|
||||
nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
{{- end }}
|
||||
tls:
|
||||
enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
|
||||
useCertManager: true
|
||||
|
||||
# used if "useCertManager" is false
|
||||
crt: ""
|
||||
key: ""
|
||||
@@ -0,0 +1,149 @@
|
||||
- name: argo-cd
|
||||
namespace: cicd
|
||||
create_namespace: true
|
||||
chart_ref: {{ .Modules.Cicd.ArgoCd.ChartRef }}
|
||||
chart_version: {{ .Modules.Cicd.ArgoCd.ChartVersion }}
|
||||
{{- if .Modules.Cicd.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
crds:
|
||||
install: true
|
||||
|
||||
server:
|
||||
certificateSecret:
|
||||
enabled: false
|
||||
{{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
|
||||
service:
|
||||
type: "NodePort"
|
||||
nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
|
||||
nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
|
||||
{{- end }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
{{- else }}
|
||||
replicas: 2
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
redis:
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
controller:
|
||||
replicas: 1
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
applicationSet:
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
replicas: 2
|
||||
{{- end }}
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
dex:
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
## check later
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
|
||||
repoServer:
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
|
||||
autoscaling:
|
||||
enabled: true
|
||||
minReplicas: 2
|
||||
{{- else }}
|
||||
replicas: 2
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
notifications:
|
||||
metrics:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
serviceMonitor:
|
||||
enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
|
||||
configs:
|
||||
params:
|
||||
server.insecure: true
|
||||
|
||||
secret:
|
||||
argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
|
||||
|
||||
repositories:
|
||||
# add default helm-repository from harbor
|
||||
{{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
|
||||
|
||||
cm:
|
||||
create: true
|
||||
url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
|
||||
|
||||
accounts.developer: login
|
||||
accounts.guest: login
|
||||
|
||||
# oidc.config: ""
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
policy.csv: |
|
||||
p, role:admin, applications, create, */*, allow
|
||||
p, role:admin, applications, update, */*, allow
|
||||
p, role:admin, applications, delete, */*, allow
|
||||
p, role:admin, applications, sync, */*, allow
|
||||
p, role:admin, applications, override, */*, allow
|
||||
p, role:admin, applications, action/*, */*, allow
|
||||
p, role:admin, applicationsets, get, */*, allow
|
||||
p, role:admin, applicationsets, create, */*, allow
|
||||
p, role:admin, applicationsets, update, */*, allow
|
||||
p, role:admin, applicationsets, delete, */*, allow
|
||||
p, role:admin, certificates, create, *, allow
|
||||
p, role:admin, certificates, update, *, allow
|
||||
p, role:admin, certificates, delete, *, allow
|
||||
p, role:admin, clusters, create, *, allow
|
||||
p, role:admin, clusters, update, *, allow
|
||||
p, role:admin, clusters, delete, *, allow
|
||||
p, role:admin, repositories, create, *, allow
|
||||
p, role:admin, repositories, update, *, allow
|
||||
p, role:admin, repositories, delete, *, allow
|
||||
p, role:admin, projects, create, *, allow
|
||||
p, role:admin, projects, update, *, allow
|
||||
p, role:admin, projects, delete, *, allow
|
||||
p, role:admin, accounts, update, *, allow
|
||||
p, role:admin, gpgkeys, create, *, allow
|
||||
p, role:admin, gpgkeys, delete, *, allow
|
||||
p, role:admin, exec, create, */*, allow
|
||||
|
||||
{{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
|
||||
|
||||
|
||||
policy.default: role:''
|
||||
# scopes: "[roles,email,groups]"
|
||||
|
||||
{{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
|
||||
redis-ha:
|
||||
enabled: true
|
||||
{{- end }}
|
||||
@@ -0,0 +1,435 @@
|
||||
- name: argo-rollouts
|
||||
namespace: cicd
|
||||
create_namespace: true
|
||||
chart_ref: {{ .Modules.Cicd.Rollouts.ChartRef }}
|
||||
chart_version: {{ .Modules.Cicd.Rollouts.ChartVersion }}
|
||||
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.Rollouts.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
installCRDs: true
|
||||
keepCRDs: false
|
||||
clusterInstall: true
|
||||
createClusterAggregateRoles: true
|
||||
|
||||
apiVersionOverrides:
|
||||
# -- String to override apiVersion of ingresses rendered by this helm chart
|
||||
ingress: "" # networking.k8s.io/v1beta1
|
||||
|
||||
# -- Override the Kubernetes version, which is used to evaluate certain manifests
|
||||
kubeVersionOverride: ""
|
||||
|
||||
# -- Additional manifests to deploy within the chart. A list of objects.
|
||||
## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
|
||||
extraObjects: []
|
||||
# - apiVersion: v1
|
||||
# kind: Secret
|
||||
# metadata:
|
||||
# name: datadog
|
||||
# type: Opaque
|
||||
# data:
|
||||
# address: https://api.datadoghq.com
|
||||
# api-key: <datadog-api-key>
|
||||
# app-key: <datadog-app-key>
|
||||
|
||||
global:
|
||||
# -- Annotations for all deployed Deployments
|
||||
deploymentAnnotations: {}
|
||||
|
||||
controller:
|
||||
# -- Value of label `app.kubernetes.io/component`
|
||||
component: rollouts-controller
|
||||
# -- Annotations to be added to the controller deployment
|
||||
deploymentAnnotations: {}
|
||||
# -- Annotations to be added to application controller pods
|
||||
podAnnotations: {}
|
||||
# -- [Node selector]
|
||||
nodeSelector: {}
|
||||
# -- [Tolerations] for use with node taints
|
||||
tolerations: []
|
||||
# -- Assign custom [affinity] rules to the deployment
|
||||
affinity: {}
|
||||
logging:
|
||||
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
|
||||
level: info
|
||||
# -- Set the klog logging level
|
||||
kloglevel: "0"
|
||||
# -- Set the logging format (one of: `text`, `json`)
|
||||
format: "text"
|
||||
|
||||
# -- Assign custom [TopologySpreadConstraints] rules to the controller
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
|
||||
topologySpreadConstraints: []
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: DoNotSchedule
|
||||
|
||||
# -- [priorityClassName] for the controller
|
||||
priorityClassName: ""
|
||||
# -- The number of controller pods to run
|
||||
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
|
||||
replicas: 3
|
||||
{{- else }}
|
||||
replicas: 1
|
||||
{{- end }}
|
||||
image:
|
||||
# -- Registry to use
|
||||
registry: quay.io
|
||||
# -- Repository to use
|
||||
repository: argoproj/argo-rollouts
|
||||
# -- Overrides the image tag (default is the chart appVersion)
|
||||
tag: ""
|
||||
# -- Image pull policy
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# -- flag to enable creation of cluster controller role (requires cluster RBAC)
|
||||
createClusterRole: true
|
||||
|
||||
# Controller container ports
|
||||
containerPorts:
|
||||
# -- Metrics container port
|
||||
metrics: 8090
|
||||
# -- Healthz container port
|
||||
healthz: 8080
|
||||
{{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
|
||||
metrics:
|
||||
# -- Deploy metrics service
|
||||
enabled: true
|
||||
service:
|
||||
# -- Metrics service port name
|
||||
portName: metrics
|
||||
# -- Metrics service port
|
||||
port: 8090
|
||||
# -- Service annotations
|
||||
annotations: {}
|
||||
serviceMonitor:
|
||||
# -- Enable a prometheus ServiceMonitor
|
||||
enabled: true
|
||||
# -- Namespace to be used for the ServiceMonitor
|
||||
namespace: ""
|
||||
# -- Labels to be added to the ServiceMonitor
|
||||
additionalLabels: {}
|
||||
# -- Annotations to be added to the ServiceMonitor
|
||||
additionalAnnotations: {}
|
||||
# -- RelabelConfigs to apply to samples before scraping
|
||||
relabelings: []
|
||||
# -- MetricRelabelConfigs to apply to samples before ingestion
|
||||
metricRelabelings: []
|
||||
{{- end }}
|
||||
|
||||
# -- Configure liveness [probe] for the controller
|
||||
# @default -- See [values.yaml]
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: healthz
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 20
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 10
|
||||
|
||||
# -- Configure readiness [probe] for the controller
|
||||
# @default -- See [values.yaml]
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /metrics
|
||||
port: metrics
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 5
|
||||
failureThreshold: 3
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 4
|
||||
|
||||
## Configure Pod Disruption Budget for the controller
|
||||
pdb:
|
||||
# -- Labels to be added to controller [Pod Disruption Budget]
|
||||
labels: {}
|
||||
# -- Annotations to be added to controller [Pod Disruption Budget]
|
||||
annotations: {}
|
||||
# -- Deploy a [Pod Disruption Budget] for the controller
|
||||
enabled: false
|
||||
# -- Minimum number / percentage of pods that should remain scheduled
|
||||
minAvailable: # 1
|
||||
# -- Maximum number / percentage of pods that may be made unavailable
|
||||
maxUnavailable: # 0
|
||||
|
||||
# -- Additional volumes to add to the controller pod
|
||||
volumes: []
|
||||
# - configMap:
|
||||
# name: my-certs-cm
|
||||
# name: my-certs
|
||||
|
||||
# -- Additional volumeMounts to add to the controller container
|
||||
volumeMounts: []
|
||||
# - mountPath: /etc/ssl/certs
|
||||
# name: my-certs
|
||||
|
||||
# -- Configures 3rd party metric providers for controller
|
||||
## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
|
||||
metricProviderPlugins: {}
|
||||
# metricProviderPlugins: |-
|
||||
# - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
|
||||
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
|
||||
|
||||
# -- Configures 3rd party traffic router plugins for controller
|
||||
## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
|
||||
trafficRouterPlugins: {}
|
||||
# trafficRouterPlugins: |-
|
||||
# - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
|
||||
# location: "file://./my-custom-plugin" # supports http(s):// urls and file://
|
||||
|
||||
serviceAccount:
|
||||
# -- Specifies whether a service account should be created
|
||||
create: true
|
||||
# -- Annotations to add to the service account
|
||||
annotations: {}
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
# -- Annotations to be added to all CRDs
|
||||
crdAnnotations: {}
|
||||
|
||||
# -- Annotations for the all deployed pods
|
||||
podAnnotations: {}
|
||||
|
||||
# -- Security Context to set on pod level
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
|
||||
# -- Security Context to set on container level
|
||||
containerSecurityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
# -- Annotations to be added to the Rollout service
|
||||
serviceAnnotations: {}
|
||||
|
||||
# -- Labels to be added to the Rollout pods
|
||||
podLabels: {}
|
||||
|
||||
# -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
|
||||
imagePullSecrets: []
|
||||
# - name: argo-pull-secret
|
||||
|
||||
providerRBAC:
|
||||
# -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
|
||||
enabled: true
|
||||
# providerRBAC.enabled must be true in order to toggle the individual providers
|
||||
providers:
|
||||
# -- Adds RBAC rules for the Istio provider
|
||||
istio: true
|
||||
# -- Adds RBAC rules for the SMI provider
|
||||
smi: true
|
||||
# -- Adds RBAC rules for the Ambassador provider
|
||||
ambassador: true
|
||||
# -- Adds RBAC rules for the AWS Load Balancer Controller provider
|
||||
awsLoadBalancerController: true
|
||||
# -- Adds RBAC rules for the AWS App Mesh provider
|
||||
awsAppMesh: true
|
||||
# -- Adds RBAC rules for the Traefik provider
|
||||
traefik: true
|
||||
# -- Adds RBAC rules for the Apisix provider
|
||||
apisix: true
|
||||
# -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
|
||||
contour: true
|
||||
# -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
|
||||
glooPlatform: true
|
||||
# -- Additional RBAC rules for others providers
|
||||
additionalRules: []
|
||||
|
||||
dashboard:
|
||||
# -- Deploy dashboard server
|
||||
enabled: true
|
||||
# -- Set cluster role to readonly
|
||||
readonly: false
|
||||
# -- Value of label `app.kubernetes.io/component`
|
||||
component: rollouts-dashboard
|
||||
# -- Annotations to be added to the dashboard deployment
|
||||
deploymentAnnotations: {}
|
||||
# -- Annotations to be added to application dashboard pods
|
||||
podAnnotations: {}
|
||||
# -- [Node selector]
|
||||
nodeSelector: {}
|
||||
# -- [Tolerations] for use with node taints
|
||||
tolerations: []
|
||||
# -- Assign custom [affinity] rules to the deployment
|
||||
affinity: {}
|
||||
logging:
|
||||
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
|
||||
level: info
|
||||
# -- Set the klog logging level
|
||||
kloglevel: "0"
|
||||
|
||||
# -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
|
||||
topologySpreadConstraints: []
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: DoNotSchedule
|
||||
|
||||
# -- [priorityClassName] for the dashboard server
|
||||
priorityClassName: ""
|
||||
|
||||
# -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
|
||||
createClusterRole: true
|
||||
|
||||
# -- The number of dashboard pods to run
|
||||
{{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
|
||||
replicas: 3
|
||||
{{- else }}
|
||||
replicas: 1
|
||||
{{- end }}
|
||||
image:
|
||||
# -- Registry to use
|
||||
registry: quay.io
|
||||
# -- Repository to use
|
||||
repository: argoproj/kubectl-argo-rollouts
|
||||
# -- Overrides the image tag (default is the chart appVersion)
|
||||
tag: ""
|
||||
# -- Image pull policy
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
|
||||
extraArgs: []
|
||||
# -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
|
||||
extraEnv: []
|
||||
# - name: FOO
|
||||
# value: bar
|
||||
# -- Resource limits and requests for the dashboard pods.
|
||||
resources: {}
|
||||
# -- Security Context to set on pod level
|
||||
podSecurityContext:
|
||||
runAsNonRoot: true
|
||||
# -- Security Context to set on container level
|
||||
containerSecurityContext: {}
|
||||
service:
|
||||
# -- Sets the type of the Service
|
||||
{{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
|
||||
type: NodePort
|
||||
nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
|
||||
{{- else }}
|
||||
type: ClusterIP
|
||||
nodePort:
|
||||
{{- end }}
|
||||
# -- LoadBalancer will get created with the IP specified in this field
|
||||
loadBalancerIP: ""
|
||||
# -- Source IP ranges to allow access to service from
|
||||
loadBalancerSourceRanges: []
|
||||
# -- Dashboard service external IPs
|
||||
externalIPs: []
|
||||
# -- Service annotations
|
||||
annotations: {}
|
||||
# -- Service labels
|
||||
labels: {}
|
||||
# -- Service port name
|
||||
portName: dashboard
|
||||
# -- Service port
|
||||
port: 3100
|
||||
# -- Service target port
|
||||
targetPort: 3100
|
||||
# -- (int) Service nodePort
|
||||
|
||||
serviceAccount:
|
||||
# -- Specifies whether a dashboard service account should be created
|
||||
create: true
|
||||
# -- Annotations to add to the dashboard service account
|
||||
annotations: {}
|
||||
# -- The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
## Configure Pod Disruption Budget for the dashboard
|
||||
pdb:
|
||||
# -- Labels to be added to dashboard [Pod Disruption Budget]
|
||||
labels: {}
|
||||
# -- Annotations to be added to dashboard [Pod Disruption Budget]
|
||||
annotations: {}
|
||||
# -- Deploy a [Pod Disruption Budget] for the dashboard
|
||||
enabled: false
|
||||
# -- Minimum number / percentage of pods that should remain scheduled
|
||||
minAvailable: # 1
|
||||
# -- Maximum number / percentage of pods that may be made unavailable
|
||||
maxUnavailable: # 0
|
||||
|
||||
## Ingress configuration.
|
||||
## ref: https://kubernetes.io/docs/user-guide/ingress/
|
||||
##
|
||||
ingress:
|
||||
# -- Enable dashboard ingress support
|
||||
enabled: false
|
||||
# -- Dashboard ingress annotations
|
||||
annotations: {}
|
||||
# -- Dashboard ingress labels
|
||||
labels: {}
|
||||
# -- Dashboard ingress class name
|
||||
ingressClassName: ""
|
||||
|
||||
# -- Dashboard ingress hosts
|
||||
## Argo Rollouts Dashboard Ingress.
|
||||
## Hostnames must be provided if Ingress is enabled.
|
||||
## Secrets must be manually created in the namespace
|
||||
hosts: []
|
||||
# - argorollouts.example.com
|
||||
|
||||
# -- Dashboard ingress paths
|
||||
paths:
|
||||
- /
|
||||
# -- Dashboard ingress path type
|
||||
pathType: Prefix
|
||||
# -- Dashboard ingress extra paths
|
||||
extraPaths: []
|
||||
# - path: /*
|
||||
# backend:
|
||||
# serviceName: ssl-redirect
|
||||
# servicePort: use-annotation
|
||||
## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
|
||||
# - path: /*
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service
|
||||
# name: ssl-redirect
|
||||
# port:
|
||||
# name: use-annotation
|
||||
|
||||
# -- Dashboard ingress tls
|
||||
tls: []
|
||||
# - secretName: argorollouts-example-tls
|
||||
# hosts:
|
||||
# - argorollouts.example.com
|
||||
|
||||
# -- Additional volumes to add to the dashboard pod
|
||||
volumes: []
|
||||
|
||||
# -- Additional volumeMounts to add to the dashboard container
|
||||
volumeMounts: []
|
||||
|
||||
notifications:
|
||||
secret:
|
||||
# -- Whether to create notifications secret
|
||||
create: false
|
||||
# -- Generic key:value pairs to be inserted into the notifications secret
|
||||
items: {}
|
||||
# slack-token:
|
||||
|
||||
# -- Configures notification services
|
||||
notifiers: {}
|
||||
# service.slack: |
|
||||
# token: $slack-token
|
||||
|
||||
# -- Notification templates
|
||||
templates: {}
|
||||
|
||||
# -- The trigger defines the condition when the notification should be sent
|
||||
triggers: {}
|
||||
# trigger.on-purple: |
|
||||
# - send: [my-purple-template]
|
||||
# when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'
|
||||
@@ -0,0 +1,255 @@
|
||||
- name: keel
|
||||
namespace: kube-system
|
||||
chart_ref: {{ .Modules.Cicd.UpdatesOperator.ChartRef }}
|
||||
chart_version: {{ .Modules.Cicd.UpdatesOperator.ChartVersion }}
|
||||
{{- if and .Modules.Cicd.Enabled .Modules.Cicd.UpdatesOperator.Enabled }}
|
||||
release_state: "present"
|
||||
{{- else }}
|
||||
release_state: "absent"
|
||||
{{- end }}
|
||||
values:
|
||||
image:
|
||||
repository: keelhq/keel
|
||||
tag: null
|
||||
pullPolicy: Always
|
||||
|
||||
# Enable insecure registries
|
||||
insecureRegistry: false
|
||||
|
||||
# Polling is enabled by default,
|
||||
# you can disable it setting value below to false
|
||||
polling:
|
||||
enabled: true
|
||||
defaultSchedule: "@every 1m"
|
||||
|
||||
# Extra Containers to run alongside Keel
|
||||
# extraContainers:
|
||||
# - name: busybox
|
||||
# image: busybox
|
||||
# imagePullPolicy: IfNotPresent
|
||||
# command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
|
||||
|
||||
# Helm provider support
|
||||
helmProvider:
|
||||
enabled: true
|
||||
# set to version "v3" for Helm v3
|
||||
version: "v2"
|
||||
tillerNamespace: "kube-system"
|
||||
# optional Tiller address (if portforwarder tunnel doesn't work),
|
||||
# if you are using default configuration, setting it to
|
||||
# 'tiller-deploy:44134' is usually fine
|
||||
tillerAddress: 'tiller-deploy:44134'
|
||||
# helmDriver: ''
|
||||
# helmDriverSqlConnectionString: ''
|
||||
|
||||
# Google Container Registry
|
||||
# GCP Project ID
|
||||
gcr:
|
||||
enabled: false
|
||||
projectId: ""
|
||||
gcpServiceAccount: ""
|
||||
clusterName: ""
|
||||
pubSub:
|
||||
enabled: false
|
||||
|
||||
# Notification level (debug, info, success, warn, error, fatal)
|
||||
notificationLevel: info
|
||||
|
||||
# AWS Elastic Container Registry
|
||||
# https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
|
||||
ecr:
|
||||
enabled: false
|
||||
roleArn: ""
|
||||
accessKeyId: ""
|
||||
secretAccessKey: ""
|
||||
region: ""
|
||||
|
||||
# Webhook Notification
|
||||
# Remote webhook endpoint for notification delivery
|
||||
webhook:
|
||||
enabled: false
|
||||
endpoint: ""
|
||||
|
||||
# Slack Notification
|
||||
# bot name (default keel) must exist!
|
||||
slack:
|
||||
enabled: false
|
||||
botName: ""
|
||||
token: ""
|
||||
channel: ""
|
||||
approvalsChannel: ""
|
||||
|
||||
# Hipchat notification and approvals
|
||||
hipchat:
|
||||
enabled: false
|
||||
token: ""
|
||||
channel: ""
|
||||
approvalsChannel: ""
|
||||
botName: ""
|
||||
userName: ""
|
||||
password: ""
|
||||
|
||||
# Mattermost notifications
|
||||
mattermost:
|
||||
enabled: false
|
||||
endpoint: ""
|
||||
|
||||
# MS Teams notifications
|
||||
teams:
|
||||
enabled: false
|
||||
webhookUrl: ""
|
||||
|
||||
# Discord notifications
|
||||
discord:
|
||||
enabled: false
|
||||
webhookUrl: ""
|
||||
|
||||
# Mail notifications
|
||||
mail:
|
||||
enabled: false
|
||||
from: ""
|
||||
to: ""
|
||||
smtp:
|
||||
server: ""
|
||||
port: 25
|
||||
user: ""
|
||||
pass: ""
|
||||
|
||||
# Basic auth on approvals
|
||||
basicauth:
|
||||
enabled: true
|
||||
user: "admin"
|
||||
password: "{{ .Modules.AdminPassword }}"
|
||||
|
||||
# Keel service
|
||||
# Enable to receive webhooks from Docker registries
|
||||
service:
|
||||
enabled: false
|
||||
type: LoadBalancer
|
||||
externalPort: 9300
|
||||
clusterIP: ""
|
||||
|
||||
# Webhook Relay service
|
||||
# If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
|
||||
# which can deliver webhooks to your internal Keel service through Keel sidecar container.
|
||||
webhookRelay:
|
||||
enabled: false
|
||||
bucket: ""
|
||||
# webhookrelay.com credentials
|
||||
# Set the key and secret values here to create the keel-webhookrelay secret with this
|
||||
# chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
|
||||
key: ""
|
||||
secret: ""
|
||||
# webhookrelay docker image
|
||||
image:
|
||||
repository: webhookrelay/webhookrelayd
|
||||
tag: latest
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# Use a secret file to define passwords and tokens of third parties.
|
||||
secret:
|
||||
# Leave blank to use `keel.fullname`
|
||||
name: ""
|
||||
# Set to false to manage your own secret file, with terraform for example.
|
||||
create: true
|
||||
|
||||
# Keel self-update
|
||||
# uncomment lines below if you want Keel to automaticly
|
||||
# self-update to the latest release version
|
||||
# keel:
|
||||
# # keel policy (all/major/minor/patch/force)
|
||||
# policy: patch
|
||||
# # trigger type, defaults to events such as pubsub, webhooks
|
||||
# trigger: poll
|
||||
# # polling schedule
|
||||
# pollSchedule: "@every 3m"
|
||||
# # images to track and update
|
||||
# images:
|
||||
# - repository: image.repository
|
||||
# tag: image.tag
|
||||
|
||||
# RBAC manifests management
|
||||
rbac:
|
||||
enabled: true
|
||||
serviceAccount:
|
||||
# Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
|
||||
# name:
|
||||
# Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
|
||||
# If rbac.serviceAccount.name is not set, a new name for the service account is generated
|
||||
create: true
|
||||
|
||||
# Resources
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
|
||||
# NodeSelector
|
||||
nodeSelector: {}
|
||||
|
||||
affinity: {}
|
||||
|
||||
tolerations: {}
|
||||
|
||||
# base64 encoded json of GCP service account
|
||||
# more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
|
||||
# e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
|
||||
googleApplicationCredentials: ""
|
||||
|
||||
# Enable DEBUG logging
|
||||
debug: false
|
||||
|
||||
# This is used by the static manifest generator in order to create a static
|
||||
# namespace manifest for the namespace that keel is being installed
|
||||
# within. It should **not** be used if you are using Helm for deployment.
|
||||
createNamespaceResource: false
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
serviceAnnotations: {}
|
||||
# Useful for making the load balancer internal
|
||||
# serviceAnnotations:
|
||||
# cloud.google.com/load-balancer-type: Internal
|
||||
|
||||
aws:
|
||||
region: null
|
||||
|
||||
podDisruptionBudget:
|
||||
enabled: false
|
||||
maxUnavailable: 1
|
||||
minAvailable: null
|
||||
|
||||
# Google Cloud Certificates
|
||||
gcloud:
|
||||
managedCertificates:
|
||||
enabled: false
|
||||
domains:
|
||||
- ""
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
labels: {}
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
hosts: []
|
||||
# - host: chart-example.local
|
||||
# paths:
|
||||
# - /
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
dockerRegistry:
|
||||
enabled: false
|
||||
name: ""
|
||||
key: ""
|
||||
|
||||
persistence:
|
||||
enabled: false
|
||||
storageClass: "-"
|
||||
size: 1Gi
|
||||
Reference in New Issue
Block a user