Compare commits
No commits in common. "main" and "openldap" have entirely different histories.
76
README.md
76
README.md
@ -6,25 +6,19 @@ or to ease opencloud dependencies (dex, mongo, mongo-express, ...) deployment.
|
||||
Kind (https://kind.sigs.k8s.io/) is used here as a lightweight kubernetes deployment. Obviously, any kubenetes compliant
|
||||
environment is a legitimate target.
|
||||
|
||||
# Locally built microservices deployment procedure
|
||||
HOW TO:
|
||||
|
||||
## Clone the repository
|
||||
|
||||
```
|
||||
git clone https://cloud.o-forge.io/plm/oc-k8s.git
|
||||
```
|
||||
|
||||
## Install kind
|
||||
1. Install kind
|
||||
|
||||
Follow instructions here https://kind.sigs.k8s.io/
|
||||
|
||||
## Install helm
|
||||
2. Install helm
|
||||
|
||||
Download suitable helm client here https://helm.sh/docs/intro/install/
|
||||
|
||||
## Fire up a kind cluster
|
||||
3. Fire up a kind cluster
|
||||
|
||||
Execute following script to create a single node development k8s cluster
|
||||
Execute following script
|
||||
|
||||
```
|
||||
create_kind_cluster.sh
|
||||
@ -32,66 +26,8 @@ create_kind_cluster.sh
|
||||
|
||||
It will create a *opencloud* docker container running kubernetes services.
|
||||
|
||||
## Clone all the microservices repositories taking part of the opencloud environment
|
||||
|
||||
Execute following script to clone all the needed parts:
|
||||
|
||||
```
|
||||
clone_opencloud_microservices.sh
|
||||
```
|
||||
|
||||
## Build everything
|
||||
|
||||
You need to build and publish all the opencloud microservices images in the kind cluster before deploying the Helm package.
|
||||
|
||||
Proceed as following:
|
||||
|
||||
```
|
||||
build_opencloud_microservices.sh
|
||||
```
|
||||
|
||||
## Deploy the opencloud chart
|
||||
4. Deploy the opencloud chart
|
||||
|
||||
```
|
||||
install_development.sh
|
||||
```
|
||||
|
||||
Feel free to modify/create a new opencloud/dev-values.yaml. Provided setup should work out of the box, but is not suitable for production usage.
|
||||
|
||||
## Hostname settings
|
||||
|
||||
Edit your /etc/hosts file, and add following line:
|
||||
|
||||
```
|
||||
127.0.0.1 beta.opencloud.com
|
||||
```
|
||||
|
||||
## Done
|
||||
|
||||
Everything should be operational now, go to http://beta.opencloud.com and enjoy the ride
|
||||
|
||||
# Prebuilt microservices deployment procedure
|
||||
|
||||
TODO
|
||||
|
||||
# First steps
|
||||
|
||||
Go to http://beta.opencloud.com/users
|
||||
|
||||
Log in using default user/password combo ldapadmin/ldapadmin
|
||||
|
||||
Create a new user, or change the default one
|
||||
|
||||
Go to http://beta.opencloud.com
|
||||
|
||||
Log in using your fresh credentials
|
||||
|
||||
Do stuff
|
||||
|
||||
You can go to http://beta.opencloud.com/mongoexpress
|
||||
|
||||
... for mongo express web client access (default login/password is test/testme)
|
||||
|
||||
You can go to http://localhost/dashboard/
|
||||
|
||||
... for access to Traefik reverse proxy front-end
|
||||
@ -1,15 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
find . -mindepth 2 -maxdepth 2 -name 'Makefile' | while read -r makefile; do
|
||||
dir=$(dirname "$makefile")
|
||||
echo "Running 'make all' in $dir"
|
||||
(
|
||||
cd "$dir" && make all
|
||||
)
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Error: make all failed in $dir"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
echo "All make processes completed successfully."
|
||||
@ -1,49 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
|
||||
REPOS=(
|
||||
"https://cloud.o-forge.io/core/oc-aggregator.git"
|
||||
"https://cloud.o-forge.io/core/oc-auth.git"
|
||||
"https://cloud.o-forge.io/core/oc-catalog.git"
|
||||
"https://cloud.o-forge.io/core/oc-datacenter.git"
|
||||
"https://cloud.o-forge.io/core/oc-discovery.git"
|
||||
"https://cloud.o-forge.io/core/oc-front.git"
|
||||
"https://cloud.o-forge.io/core/oc-discovery.git"
|
||||
"https://cloud.o-forge.io/core/oc-monitord.git"
|
||||
"https://cloud.o-forge.io/core/oc-peer.git"
|
||||
"https://cloud.o-forge.io/core/oc-shared.git"
|
||||
"https://cloud.o-forge.io/core/oc-scheduler.git"
|
||||
"https://cloud.o-forge.io/core/oc-schedulerd.git"
|
||||
"https://cloud.o-forge.io/core/oc-workflow.git"
|
||||
"https://cloud.o-forge.io/core/oc-workspace.git"
|
||||
)
|
||||
|
||||
# Function to clone repositories
|
||||
clone_repo() {
|
||||
local repo_url="$1"
|
||||
local repo_name=$(basename "$repo_url" .git)
|
||||
|
||||
echo "Processing repository: $repo_name"
|
||||
|
||||
if [ -d "$repo_name" ]; then
|
||||
echo "Repository '$repo_name' already exists. Pulling latest changes..."
|
||||
cd "$repo_name" && git pull && cd ..
|
||||
else
|
||||
echo "Cloning repository: $repo_name"
|
||||
git clone "$repo_url"
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "Error cloning $repo_url"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
# Iterate through each repository in the list
|
||||
for repo in "${REPOS[@]}"; do
|
||||
clone_repo "$repo"
|
||||
done
|
||||
|
||||
echo "All repositories processed successfully."
|
||||
|
||||
|
||||
|
||||
@ -5,7 +5,7 @@ type: application
|
||||
version: 0.0.1
|
||||
appVersion: "0.0.1"
|
||||
|
||||
# TODO: grafana, loki
|
||||
# TODO: ory hydra, keto
|
||||
dependencies:
|
||||
- name: openldap
|
||||
repository: https://jp-gouin.github.io/helm-openldap/
|
||||
@ -28,22 +28,10 @@ dependencies:
|
||||
repository: "https://cowboysysop.github.io/charts/"
|
||||
condition: mongo-express.enabled
|
||||
- name: hydra
|
||||
version: "0.50.6"
|
||||
version: "0.50.2"
|
||||
repository: "https://k8s.ory.sh/helm/charts"
|
||||
condition: hydra.enabled
|
||||
- name: keto
|
||||
version: "0.50.2"
|
||||
repository: "https://k8s.ory.sh/helm/charts"
|
||||
condition: keto.enabled
|
||||
- name: loki
|
||||
version: "6.23.0"
|
||||
repository: "https://grafana.github.io/helm-charts"
|
||||
condition: loki.enabled
|
||||
- name: grafana
|
||||
version: "8.6.4"
|
||||
repository: "https://grafana.github.io/helm-charts"
|
||||
condition: grafana.enabled
|
||||
- name: argo-workflows
|
||||
version: "0.45.4"
|
||||
repository: "https://argoproj.github.io/argo-helm"
|
||||
condition: argo-workflows.enabled
|
||||
condition: keto.enabled
|
||||
@ -1,23 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
ci/
|
||||
*.gotmpl
|
||||
@ -1,20 +0,0 @@
|
||||
annotations:
|
||||
artifacthub.io/changes: |
|
||||
- kind: added
|
||||
description: Support configuring workflow events in the controller
|
||||
artifacthub.io/signKey: |
|
||||
fingerprint: 2B8F22F57260EFA67BE1C5824B11F800CD9D2252
|
||||
url: https://argoproj.github.io/argo-helm/pgp_keys.asc
|
||||
apiVersion: v2
|
||||
appVersion: v3.6.2
|
||||
description: A Helm chart for Argo Workflows
|
||||
home: https://github.com/argoproj/argo-helm
|
||||
icon: https://argo-workflows.readthedocs.io/en/stable/assets/logo.png
|
||||
maintainers:
|
||||
- name: argoproj
|
||||
url: https://argoproj.github.io/
|
||||
name: argo-workflows
|
||||
sources:
|
||||
- https://github.com/argoproj/argo-workflows
|
||||
type: application
|
||||
version: 0.45.4
|
||||
@ -1,410 +0,0 @@
|
||||
# Argo Workflows Chart
|
||||
|
||||
This is a **community maintained** chart. It is used to set up argo and its needed dependencies through one command. This is used in conjunction with [helm](https://github.com/kubernetes/helm).
|
||||
|
||||
If you want your deployment of this helm chart to most closely match the [argo CLI](https://github.com/argoproj/argo-workflows), you should deploy it in the `kube-system` namespace.
|
||||
|
||||
## Pre-Requisites
|
||||
|
||||
### Custom resource definitions
|
||||
|
||||
Some users would prefer to install the CRDs _outside_ of the chart. You can disable the CRD installation of this chart by using `--set crds.install=false` when installing the chart.
|
||||
|
||||
Helm cannot upgrade custom resource definitions in the `<chart>/crds` folder [by design](https://helm.sh/docs/chart_best_practices/custom_resource_definitions/#some-caveats-and-explanations). Starting with 3.4.0 (chart version 0.19.0), the CRDs have been moved to `<chart>/templates` to address this design decision.
|
||||
|
||||
If you are using Argo Workflows chart version prior to 3.4.0 (chart version 0.19.0) or have elected to manage the Argo Workflows CRDs outside of the chart, please use `kubectl` to upgrade CRDs manually from [templates/crds](templates/crds/) folder or via the manifests from the upstream project repo:
|
||||
|
||||
```bash
|
||||
kubectl apply -k "https://github.com/argoproj/argo-workflows/manifests/base/crds/full?ref=<appVersion>"
|
||||
|
||||
# Eg. version v3.3.9
|
||||
kubectl apply -k "https://github.com/argoproj/argo-workflows/manifests/base/crds/full?ref=v3.3.9"
|
||||
```
|
||||
|
||||
### ServiceAccount for Workflow Spec
|
||||
In order for each Workflow run, you create ServiceAccount via `values.yaml` like below.
|
||||
|
||||
```yaml
|
||||
workflow:
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: "argo-workflow"
|
||||
rbac:
|
||||
create: true
|
||||
controller:
|
||||
workflowNamespaces:
|
||||
- default
|
||||
- foo
|
||||
- bar
|
||||
```
|
||||
|
||||
Set ServiceAccount on Workflow.
|
||||
|
||||
```yaml
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Workflow
|
||||
metadata:
|
||||
generateName: hello-world-
|
||||
spec:
|
||||
entrypoint: whalesay
|
||||
serviceAccountName: argo-workflow # Set ServiceAccount
|
||||
templates:
|
||||
- name: whalesay
|
||||
container:
|
||||
image: docker/whalesay
|
||||
command: [ cowsay ]
|
||||
args: [ "hello world" ]
|
||||
```
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
$ helm repo add argo https://argoproj.github.io/argo-helm
|
||||
"argo" has been added to your repositories
|
||||
|
||||
$ helm install my-release argo/argo-workflows
|
||||
NAME: my-release
|
||||
...
|
||||
```
|
||||
|
||||
## Changelog
|
||||
|
||||
For full list of changes, please check ArtifactHub [changelog].
|
||||
|
||||
## Usage Notes
|
||||
|
||||
### High Availability
|
||||
|
||||
This chart installs the non-HA version of Argo Workflows by default. If you want to run in HA mode, you can use [these example values](ci/ha-values.yaml) as a starting point.
|
||||
Please see the upstream [Operator Manual's High Availability page](https://argo-workflows.readthedocs.io/en/stable/high-availability/) to understand how to scale Argo Workflows in depth.
|
||||
|
||||
### Workflow controller
|
||||
|
||||
This chart defaults to setting the `controller.instanceID.enabled` to `false` now, which means the deployed controller will act upon any workflow deployed to the cluster. If you would like to limit the behavior and deploy multiple workflow controllers, please use the `controller.instanceID.enabled` attribute along with one of its configuration options to set the `instanceID` of the workflow controller to be properly scoped for your needs.
|
||||
|
||||
### Argo Workflows server authentication
|
||||
|
||||
Argo Workflows server provides some choices for authentication mechanism and you can configure `.Values.server.authModes`. By default, authentication mode is `[server]`, for local development purposes or cases where your gateway authentication is covered by some other means.
|
||||
Please refer to [Argo Server Auth Mode] for more details.
|
||||
|
||||
Argo Workflows server also supports SSO and you can enable it to configure `.Values.server.sso` and `.Values.server.authModes`. In order to manage access levels, you can optionally add RBAC to SSO. Please refer to [SSO RBAC] for more details.
|
||||
|
||||
## Values
|
||||
|
||||
The `values.yaml` contains items used to tweak a deployment of this chart.
|
||||
Fields to note:
|
||||
|
||||
- `controller.instanceID.enabled`: If set to true, the Argo Controller will **ONLY** monitor Workflow submissions with a `--instanceid` attribute
|
||||
- `controller.instanceID.useReleaseName`: If set to true then chart set controller instance id to release name
|
||||
- `controller.instanceID.explicitID`: Allows customization of an instance id for the workflow controller to monitor
|
||||
- `singleNamespace`: When true, restricts the workflow controller to operate
|
||||
in just the single namespace (that one of the Helm release).
|
||||
- `controller.workflowNamespaces`: This is a list of namespaces where the
|
||||
workflow controller will manage workflows. Only valid when `singleNamespace`
|
||||
is false.
|
||||
|
||||
### General parameters
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| apiVersionOverrides.autoscaling | string | `""` | String to override apiVersion of autoscaling rendered by this helm chart |
|
||||
| apiVersionOverrides.cloudgoogle | string | `""` | String to override apiVersion of GKE resources rendered by this helm chart |
|
||||
| apiVersionOverrides.monitoring | string | `""` | String to override apiVersion of monitoring CRDs (ServiceMonitor) rendered by this helm chart |
|
||||
| commonLabels | object | `{}` | Labels to set on all resources |
|
||||
| crds.annotations | object | `{}` | Annotations to be added to all CRDs |
|
||||
| crds.install | bool | `true` | Install and upgrade CRDs |
|
||||
| crds.keep | bool | `true` | Keep CRDs on chart uninstall |
|
||||
| createAggregateRoles | bool | `true` | Create clusterroles that extend existing clusterroles to interact with argo-cd crds |
|
||||
| emissary.images | list | `[]` | The command/args for each image on workflow, needed when the command is not specified and the emissary executor is used. |
|
||||
| extraObjects | list | `[]` | Array of extra K8s manifests to deploy |
|
||||
| fullnameOverride | string | `nil` | String to fully override "argo-workflows.fullname" template |
|
||||
| images.pullPolicy | string | `"Always"` | imagePullPolicy to apply to all containers |
|
||||
| images.pullSecrets | list | `[]` | Secrets with credentials to pull images from a private registry |
|
||||
| images.tag | string | `""` | Common tag for Argo Workflows images. Defaults to `.Chart.AppVersion`. |
|
||||
| kubeVersionOverride | string | `""` | Override the Kubernetes version, which is used to evaluate certain manifests |
|
||||
| nameOverride | string | `nil` | String to partially override "argo-workflows.fullname" template |
|
||||
| namespaceOverride | string | `.Release.Namespace` | Override the namespace |
|
||||
| singleNamespace | bool | `false` | Restrict Argo to operate only in a single namespace (the namespace of the Helm release) by apply Roles and RoleBindings instead of the Cluster equivalents, and start workflow-controller with the --namespaced flag. Use it in clusters with strict access policy. |
|
||||
|
||||
### Workflow
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| workflow.namespace | string | `nil` | Deprecated; use controller.workflowNamespaces instead. |
|
||||
| workflow.rbac.agentPermissions | bool | `false` | Allows permissions for the Argo Agent. Only required if using http/plugin templates |
|
||||
| workflow.rbac.artifactGC | bool | `false` | Allows permissions for the Argo Artifact GC pod. Only required if using artifact gc |
|
||||
| workflow.rbac.create | bool | `true` | Adds Role and RoleBinding for the above specified service account to be able to run workflows. A Role and Rolebinding pair is also created for each namespace in controller.workflowNamespaces (see below) |
|
||||
| workflow.rbac.serviceAccounts | list | `[]` | Extra service accounts to be added to the RoleBinding |
|
||||
| workflow.serviceAccount.annotations | object | `{}` | Annotations applied to created service account |
|
||||
| workflow.serviceAccount.create | bool | `false` | Specifies whether a service account should be created |
|
||||
| workflow.serviceAccount.labels | object | `{}` | Labels applied to created service account |
|
||||
| workflow.serviceAccount.name | string | `"argo-workflow"` | Service account which is used to run workflows |
|
||||
| workflow.serviceAccount.pullSecrets | list | `[]` | Secrets with credentials to pull images from a private registry. Same format as `.Values.images.pullSecrets` |
|
||||
|
||||
### Workflow Controller
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| controller.affinity | object | `{}` | Assign custom [affinity] rules |
|
||||
| controller.clusterWorkflowTemplates.enabled | bool | `true` | Create a ClusterRole and CRB for the controller to access ClusterWorkflowTemplates. |
|
||||
| controller.clusterWorkflowTemplates.serviceAccounts | list | `[]` | Extra service accounts to be added to the ClusterRoleBinding |
|
||||
| controller.columns | list | `[]` | Configure Argo Server to show custom [columns] |
|
||||
| controller.configMap.annotations | object | `{}` | ConfigMap annotations |
|
||||
| controller.configMap.create | bool | `true` | Create a ConfigMap for the controller |
|
||||
| controller.configMap.name | string | `""` | ConfigMap name |
|
||||
| controller.cronWorkflowWorkers | string | `nil` | Number of cron workflow workers Only valid for 3.5+ |
|
||||
| controller.deploymentAnnotations | object | `{}` | deploymentAnnotations is an optional map of annotations to be applied to the controller Deployment |
|
||||
| controller.extraArgs | list | `[]` | Extra arguments to be added to the controller |
|
||||
| controller.extraContainers | list | `[]` | Extra containers to be added to the controller deployment |
|
||||
| controller.extraEnv | list | `[]` | Extra environment variables to provide to the controller container |
|
||||
| controller.extraInitContainers | list | `[]` | Enables init containers to be added to the controller deployment |
|
||||
| controller.image.registry | string | `"quay.io"` | Registry to use for the controller |
|
||||
| controller.image.repository | string | `"argoproj/workflow-controller"` | Registry to use for the controller |
|
||||
| controller.image.tag | string | `""` | Image tag for the workflow controller. Defaults to `.Values.images.tag`. |
|
||||
| controller.initialDelay | string | `nil` | Resolves ongoing, uncommon AWS EKS bug: https://github.com/argoproj/argo-workflows/pull/4224 |
|
||||
| controller.instanceID.enabled | bool | `false` | Configures the controller to filter workflow submissions to only those which have a matching instanceID attribute. |
|
||||
| controller.instanceID.explicitID | string | `""` | Use a custom instanceID |
|
||||
| controller.instanceID.useReleaseName | bool | `false` | Use ReleaseName as instanceID |
|
||||
| controller.kubeConfig | object | `{}` (See [values.yaml]) | Configure when workflow controller runs in a different k8s cluster with the workflow workloads, or needs to communicate with the k8s apiserver using an out-of-cluster kubeconfig secret. |
|
||||
| controller.links | list | `[]` | Configure Argo Server to show custom [links] |
|
||||
| controller.livenessProbe | object | See [values.yaml] | Configure liveness [probe] for the controller |
|
||||
| controller.loadBalancerClass | string | `""` | The class of the load balancer implementation |
|
||||
| controller.loadBalancerSourceRanges | list | `[]` | Source ranges to allow access to service from. Only applies to service type `LoadBalancer` |
|
||||
| controller.logging.format | string | `"text"` | Set the logging format (one of: `text`, `json`) |
|
||||
| controller.logging.globallevel | string | `"0"` | Set the glog logging level |
|
||||
| controller.logging.level | string | `"info"` | Set the logging level (one of: `debug`, `info`, `warn`, `error`) |
|
||||
| controller.metricsConfig.enabled | bool | `false` | Enables prometheus metrics server |
|
||||
| controller.metricsConfig.headlessService | bool | `false` | Flag to enable headless service |
|
||||
| controller.metricsConfig.honorLabels | bool | `false` | When true, honorLabels preserves the metric’s labels when they collide with the target’s labels. |
|
||||
| controller.metricsConfig.ignoreErrors | bool | `false` | Flag that instructs prometheus to ignore metric emission errors. |
|
||||
| controller.metricsConfig.interval | string | `"30s"` | Frequency at which prometheus scrapes metrics |
|
||||
| controller.metricsConfig.metricRelabelings | list | `[]` | ServiceMonitor metric relabel configs to apply to samples before ingestion |
|
||||
| controller.metricsConfig.metricsTTL | string | `""` | How often custom metrics are cleared from memory |
|
||||
| controller.metricsConfig.path | string | `"/metrics"` | Path is the path where metrics are emitted. Must start with a "/". |
|
||||
| controller.metricsConfig.port | int | `9090` | Port is the port where metrics are emitted |
|
||||
| controller.metricsConfig.portName | string | `"metrics"` | Container metrics port name |
|
||||
| controller.metricsConfig.relabelings | list | `[]` | ServiceMonitor relabel configs to apply to samples before scraping |
|
||||
| controller.metricsConfig.secure | bool | `false` | Flag that use a self-signed cert for TLS |
|
||||
| controller.metricsConfig.servicePort | int | `8080` | Service metrics port |
|
||||
| controller.metricsConfig.servicePortName | string | `"metrics"` | Service metrics port name |
|
||||
| controller.metricsConfig.targetLabels | list | `[]` | ServiceMonitor will add labels from the service to the Prometheus metric |
|
||||
| controller.name | string | `"workflow-controller"` | Workflow controller name string |
|
||||
| controller.namespaceParallelism | string | `nil` | Limits the maximum number of incomplete workflows in a namespace |
|
||||
| controller.navColor | string | `""` | Set ui navigation bar background color |
|
||||
| controller.nodeEvents.enabled | bool | `true` | Enable to emit events on node completion. |
|
||||
| controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | [Node selector] |
|
||||
| controller.parallelism | string | `nil` | parallelism dictates how many workflows can be running at the same time |
|
||||
| controller.pdb.enabled | bool | `false` | Configure [Pod Disruption Budget] for the controller pods |
|
||||
| controller.persistence | object | `{}` | enable Workflow Archive to store the status of workflows. Postgres and MySQL (>= 5.7.8) are available. |
|
||||
| controller.podAnnotations | object | `{}` | podAnnotations is an optional map of annotations to be applied to the controller Pods |
|
||||
| controller.podCleanupWorkers | string | `nil` | Number of pod cleanup workers |
|
||||
| controller.podGCDeleteDelayDuration | string | `5s` (Argo Workflows default) | The duration in seconds before the pods in the GC queue get deleted. A zero value indicates that the pods will be deleted immediately. |
|
||||
| controller.podGCGracePeriodSeconds | string | `30` seconds (Kubernetes default) | Specifies the duration in seconds before a terminating pod is forcefully killed. A zero value indicates that the pod will be forcefully terminated immediately. |
|
||||
| controller.podLabels | object | `{}` | Optional labels to add to the controller pods |
|
||||
| controller.podSecurityContext | object | `{}` | SecurityContext to set on the controller pods |
|
||||
| controller.priorityClassName | string | `""` | Leverage a PriorityClass to ensure your pods survive resource shortages. |
|
||||
| controller.rbac.accessAllSecrets | bool | `false` | Allows controller to get, list and watch all k8s secrets. Can only be used if secretWhitelist is empty. |
|
||||
| controller.rbac.create | bool | `true` | Adds Role and RoleBinding for the controller. |
|
||||
| controller.rbac.secretWhitelist | list | `[]` | Allows controller to get, list, and watch certain k8s secrets |
|
||||
| controller.rbac.writeConfigMaps | bool | `false` | Allows controller to create and update ConfigMaps. Enables memoization feature |
|
||||
| controller.replicas | int | `1` | The number of controller pods to run |
|
||||
| controller.resourceRateLimit | object | `{}` | Globally limits the rate at which pods are created. This is intended to mitigate flooding of the Kubernetes API server by workflows with a large amount of parallel nodes. |
|
||||
| controller.resources | object | `{}` | Resource limits and requests for the controller |
|
||||
| controller.retentionPolicy | object | `{}` | Workflow retention by number of workflows |
|
||||
| controller.revisionHistoryLimit | int | `10` | The number of revisions to keep. |
|
||||
| controller.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | the controller container's securityContext |
|
||||
| controller.serviceAccount.annotations | object | `{}` | Annotations applied to created service account |
|
||||
| controller.serviceAccount.create | bool | `true` | Create a service account for the controller |
|
||||
| controller.serviceAccount.labels | object | `{}` | Labels applied to created service account |
|
||||
| controller.serviceAccount.name | string | `""` | Service account name |
|
||||
| controller.serviceAnnotations | object | `{}` | Annotations to be applied to the controller Service |
|
||||
| controller.serviceLabels | object | `{}` | Optional labels to add to the controller Service |
|
||||
| controller.serviceMonitor.additionalLabels | object | `{}` | Prometheus ServiceMonitor labels |
|
||||
| controller.serviceMonitor.enabled | bool | `false` | Enable a prometheus ServiceMonitor |
|
||||
| controller.serviceMonitor.namespace | string | `""` | Prometheus ServiceMonitor namespace |
|
||||
| controller.serviceType | string | `"ClusterIP"` | Service type of the controller Service |
|
||||
| controller.telemetryConfig.enabled | bool | `false` | Enables prometheus telemetry server |
|
||||
| controller.telemetryConfig.ignoreErrors | bool | `false` | Flag that instructs prometheus to ignore metric emission errors. |
|
||||
| controller.telemetryConfig.interval | string | `"30s"` | Frequency at which prometheus scrapes telemetry data |
|
||||
| controller.telemetryConfig.metricsTTL | string | `""` | How often custom metrics are cleared from memory |
|
||||
| controller.telemetryConfig.path | string | `"/telemetry"` | telemetry path |
|
||||
| controller.telemetryConfig.port | int | `8081` | telemetry container port |
|
||||
| controller.telemetryConfig.secure | bool | `false` | Flag that use a self-signed cert for TLS |
|
||||
| controller.telemetryConfig.servicePort | int | `8081` | telemetry service port |
|
||||
| controller.telemetryConfig.servicePortName | string | `"telemetry"` | telemetry service port name |
|
||||
| controller.tolerations | list | `[]` | [Tolerations] for use with node taints |
|
||||
| controller.topologySpreadConstraints | list | `[]` | Assign custom [TopologySpreadConstraints] rules to the workflow controller |
|
||||
| controller.volumeMounts | list | `[]` | Additional volume mounts to the controller main container |
|
||||
| controller.volumes | list | `[]` | Additional volumes to the controller pod |
|
||||
| controller.workflowDefaults | object | `{}` | Default values that will apply to all Workflows from this controller, unless overridden on the Workflow-level. Only valid for 2.7+ |
|
||||
| controller.workflowEvents.enabled | bool | `true` | Enable to emit events on workflow status changes. |
|
||||
| controller.workflowNamespaces | list | `["default"]` | Specify all namespaces where this workflow controller instance will manage workflows. This controls where the service account and RBAC resources will be created. Only valid when singleNamespace is false. |
|
||||
| controller.workflowRestrictions | object | `{}` | Restricts the Workflows that the controller will process. Only valid for 2.9+ |
|
||||
| controller.workflowTTLWorkers | string | `nil` | Number of workflow TTL workers |
|
||||
| controller.workflowWorkers | string | `nil` | Number of workflow workers |
|
||||
|
||||
### Workflow Main Container
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| mainContainer.env | list | `[]` | Adds environment variables for the Workflow main container |
|
||||
| mainContainer.envFrom | list | `[]` | Adds reference environment variables for the Workflow main container |
|
||||
| mainContainer.imagePullPolicy | string | `""` | imagePullPolicy to apply to Workflow main container. Defaults to `.Values.images.pullPolicy`. |
|
||||
| mainContainer.resources | object | `{}` | Resource limits and requests for the Workflow main container |
|
||||
| mainContainer.securityContext | object | `{}` | sets security context for the Workflow main container |
|
||||
|
||||
### Workflow Executor
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| executor.args | list | `[]` | Passes arguments to the executor processes |
|
||||
| executor.env | list | `[]` | Adds environment variables for the executor. |
|
||||
| executor.image.pullPolicy | string | `""` | Image PullPolicy to use for the Workflow Executors. Defaults to `.Values.images.pullPolicy`. |
|
||||
| executor.image.registry | string | `"quay.io"` | Registry to use for the Workflow Executors |
|
||||
| executor.image.repository | string | `"argoproj/argoexec"` | Repository to use for the Workflow Executors |
|
||||
| executor.image.tag | string | `""` | Image tag for the workflow executor. Defaults to `.Values.images.tag`. |
|
||||
| executor.resources | object | `{}` | Resource limits and requests for the Workflow Executors |
|
||||
| executor.securityContext | object | `{}` | sets security context for the executor container |
|
||||
|
||||
### Workflow Server
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| server.GKEbackendConfig.enabled | bool | `false` | Enable BackendConfig custom resource for Google Kubernetes Engine |
|
||||
| server.GKEbackendConfig.spec | object | `{}` | [BackendConfigSpec] |
|
||||
| server.GKEfrontendConfig.enabled | bool | `false` | Enable FrontConfig custom resource for Google Kubernetes Engine |
|
||||
| server.GKEfrontendConfig.spec | object | `{}` | [FrontendConfigSpec] |
|
||||
| server.GKEmanagedCertificate.domains | list | `["argoworkflows.example.com"]` | Domains for the Google Managed Certificate |
|
||||
| server.GKEmanagedCertificate.enabled | bool | `false` | Enable ManagedCertificate custom resource for Google Kubernetes Engine. |
|
||||
| server.affinity | object | `{}` | Assign custom [affinity] rules |
|
||||
| server.authMode | string | `""` | Deprecated; use server.authModes instead. |
|
||||
| server.authModes | list | `[]` | A list of supported authentication modes. Available values are `server`, `client`, or `sso`. If you provide sso, please configure `.Values.server.sso` as well. |
|
||||
| server.autoscaling.behavior | object | `{}` | Configures the scaling behavior of the target in both Up and Down directions. This is only available on HPA apiVersion `autoscaling/v2beta2` and newer |
|
||||
| server.autoscaling.enabled | bool | `false` | Enable Horizontal Pod Autoscaler ([HPA]) for the Argo Server |
|
||||
| server.autoscaling.maxReplicas | int | `5` | Maximum number of replicas for the Argo Server [HPA] |
|
||||
| server.autoscaling.minReplicas | int | `1` | Minimum number of replicas for the Argo Server [HPA] |
|
||||
| server.autoscaling.targetCPUUtilizationPercentage | int | `50` | Average CPU utilization percentage for the Argo Server [HPA] |
|
||||
| server.autoscaling.targetMemoryUtilizationPercentage | int | `50` | Average memory utilization percentage for the Argo Server [HPA] |
|
||||
| server.baseHref | string | `"/"` | Value for base href in index.html. Used if the server is running behind reverse proxy under subpath different from /. |
|
||||
| server.clusterWorkflowTemplates.enableEditing | bool | `true` | Give the server permissions to edit ClusterWorkflowTemplates. |
|
||||
| server.clusterWorkflowTemplates.enabled | bool | `true` | Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates. |
|
||||
| server.deploymentAnnotations | object | `{}` | optional map of annotations to be applied to the ui Deployment |
|
||||
| server.enabled | bool | `true` | Deploy the Argo Server |
|
||||
| server.extraArgs | list | `[]` | Extra arguments to provide to the Argo server binary. |
|
||||
| server.extraContainers | list | `[]` | Extra containers to be added to the server deployment |
|
||||
| server.extraEnv | list | `[]` | Extra environment variables to provide to the argo-server container |
|
||||
| server.extraInitContainers | list | `[]` | Enables init containers to be added to the server deployment |
|
||||
| server.hostAliases | list | `[]` | Mapping between IP and hostnames that will be injected as entries in the pod's hosts files |
|
||||
| server.image.registry | string | `"quay.io"` | Registry to use for the server |
|
||||
| server.image.repository | string | `"argoproj/argocli"` | Repository to use for the server |
|
||||
| server.image.tag | string | `""` | Image tag for the Argo Workflows server. Defaults to `.Values.images.tag`. |
|
||||
| server.ingress.annotations | object | `{}` | Additional ingress annotations |
|
||||
| server.ingress.enabled | bool | `false` | Enable an ingress resource |
|
||||
| server.ingress.extraPaths | list | `[]` | Additional ingress paths |
|
||||
| server.ingress.hosts | list | `[]` | List of ingress hosts |
|
||||
| server.ingress.ingressClassName | string | `""` | Defines which ingress controller will implement the resource |
|
||||
| server.ingress.labels | object | `{}` | Additional ingress labels |
|
||||
| server.ingress.pathType | string | `"Prefix"` | Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific` |
|
||||
| server.ingress.paths | list | `["/"]` | List of ingress paths |
|
||||
| server.ingress.tls | list | `[]` | Ingress TLS configuration |
|
||||
| server.lifecycle | object | `{}` | Specify postStart and preStop lifecycle hooks for server container |
|
||||
| server.loadBalancerClass | string | `""` | The class of the load balancer implementation |
|
||||
| server.loadBalancerIP | string | `""` | Static IP address to assign to loadBalancer service type `LoadBalancer` |
|
||||
| server.loadBalancerSourceRanges | list | `[]` | Source ranges to allow access to service from. Only applies to service type `LoadBalancer` |
|
||||
| server.logging.format | string | `"text"` | Set the logging format (one of: `text`, `json`) |
|
||||
| server.logging.globallevel | string | `"0"` | Set the glog logging level |
|
||||
| server.logging.level | string | `"info"` | Set the logging level (one of: `debug`, `info`, `warn`, `error`) |
|
||||
| server.name | string | `"server"` | Server name string |
|
||||
| server.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | [Node selector] |
|
||||
| server.pdb.enabled | bool | `false` | Configure [Pod Disruption Budget] for the server pods |
|
||||
| server.podAnnotations | object | `{}` | optional map of annotations to be applied to the ui Pods |
|
||||
| server.podLabels | object | `{}` | Optional labels to add to the UI pods |
|
||||
| server.podSecurityContext | object | `{}` | SecurityContext to set on the server pods |
|
||||
| server.priorityClassName | string | `""` | Leverage a PriorityClass to ensure your pods survive resource shortages |
|
||||
| server.rbac.create | bool | `true` | Adds Role and RoleBinding for the server. |
|
||||
| server.replicas | int | `1` | The number of server pods to run |
|
||||
| server.resources | object | `{}` | Resource limits and requests for the server |
|
||||
| server.revisionHistoryLimit | int | `10` | The number of revisions to keep. |
|
||||
| server.secure | bool | `false` | Run the argo server in "secure" mode. Configure this value instead of `--secure` in extraArgs. |
|
||||
| server.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":false,"runAsNonRoot":true}` | Servers container-level security context |
|
||||
| server.serviceAccount.annotations | object | `{}` | Annotations applied to created service account |
|
||||
| server.serviceAccount.create | bool | `true` | Create a service account for the server |
|
||||
| server.serviceAccount.labels | object | `{}` | Labels applied to created service account |
|
||||
| server.serviceAccount.name | string | `""` | Service account name |
|
||||
| server.serviceAnnotations | object | `{}` | Annotations to be applied to the UI Service |
|
||||
| server.serviceLabels | object | `{}` | Optional labels to add to the UI Service |
|
||||
| server.serviceNodePort | string | `nil` | Service node port |
|
||||
| server.servicePort | int | `2746` | Service port for server |
|
||||
| server.servicePortName | string | `""` | Service port name |
|
||||
| server.serviceType | string | `"ClusterIP"` | Service type for server pods |
|
||||
| server.sso.clientId.key | string | `"client-id"` | Key of secret to retrieve the app OIDC client ID |
|
||||
| server.sso.clientId.name | string | `"argo-server-sso"` | Name of secret to retrieve the app OIDC client ID |
|
||||
| server.sso.clientSecret.key | string | `"client-secret"` | Key of a secret to retrieve the app OIDC client secret |
|
||||
| server.sso.clientSecret.name | string | `"argo-server-sso"` | Name of a secret to retrieve the app OIDC client secret |
|
||||
| server.sso.customGroupClaimName | string | `""` | Override claim name for OIDC groups |
|
||||
| server.sso.enabled | bool | `false` | Create SSO configuration. If you set `true` , please also set `.Values.server.authMode` as `sso`. |
|
||||
| server.sso.filterGroupsRegex | list | `[]` | Filter the groups returned by the OIDC provider |
|
||||
| server.sso.insecureSkipVerify | bool | `false` | Skip TLS verification for the HTTP client |
|
||||
| server.sso.issuer | string | `"https://accounts.google.com"` | The root URL of the OIDC identity provider |
|
||||
| server.sso.issuerAlias | string | `""` | Alternate root URLs that can be included for some OIDC providers |
|
||||
| server.sso.rbac.enabled | bool | `true` | Adds ServiceAccount Policy to server (Cluster)Role. |
|
||||
| server.sso.rbac.secretWhitelist | list | `[]` | Whitelist to allow server to fetch Secrets |
|
||||
| server.sso.redirectUrl | string | `""` | The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback. |
|
||||
| server.sso.scopes | list | `[]` | Scopes requested from the SSO ID provider |
|
||||
| server.sso.sessionExpiry | string | `""` | Define how long your login is valid for (in hours) |
|
||||
| server.sso.userInfoPath | string | `""` | Specify the user info endpoint that contains the groups claim |
|
||||
| server.terminationGracePeriodSeconds | int | `30` | terminationGracePeriodSeconds for container lifecycle hook |
|
||||
| server.tmpVolume | object | `{"emptyDir":{}}` | Volume to be mounted in Pods for temporary files. |
|
||||
| server.tolerations | list | `[]` | [Tolerations] for use with node taints |
|
||||
| server.topologySpreadConstraints | list | `[]` | Assign custom [TopologySpreadConstraints] rules to the argo server |
|
||||
| server.volumeMounts | list | `[]` | Additional volume mounts to the server main container. |
|
||||
| server.volumes | list | `[]` | Additional volumes to the server pod. |
|
||||
|
||||
### Artifact Repository
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| artifactRepository.archiveLogs | bool | `false` | Archive the main container logs as an artifact |
|
||||
| artifactRepository.azure | object | `{}` (See [values.yaml]) | Store artifact in Azure Blob Storage |
|
||||
| artifactRepository.gcs | object | `{}` (See [values.yaml]) | Store artifact in a GCS object store |
|
||||
| artifactRepository.s3 | object | See [values.yaml] | Store artifact in a S3-compliant object store |
|
||||
| artifactRepositoryRef | object | `{}` (See [values.yaml]) | The section of [artifact repository ref](https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/). Each map key is the name of configmap |
|
||||
| customArtifactRepository | object | `{}` | The section of custom artifact repository. Utilize a custom artifact repository that is not one of the current base ones (s3, gcs, azure) |
|
||||
| useStaticCredentials | bool | `true` | Use static credentials for S3 (eg. when not using AWS IRSA) |
|
||||
|
||||
## Breaking changes from the deprecated `argo` chart
|
||||
|
||||
1. the `installCRD` value has been removed. CRDs are now only installed from the conventional crds/ directory
|
||||
1. the CRDs were updated to `apiextensions.k8s.io/v1`
|
||||
1. the container image registry/project/tag format was changed to be more in line with the more common
|
||||
|
||||
```yaml
|
||||
image:
|
||||
registry: quay.io
|
||||
repository: argoproj/argocli
|
||||
tag: v3.0.1
|
||||
```
|
||||
|
||||
this also makes it easier for automatic update tooling (eg. renovate bot) to detect and update images.
|
||||
|
||||
1. switched to quay.io as the default registry for all images
|
||||
1. removed any included usage of Minio
|
||||
1. aligned the configuration of serviceAccounts with the argo-cd chart, ie: what used to be `server.createServiceAccount` is now `server.serviceAccount.create`
|
||||
1. moved the field previously known as `telemetryServicePort` inside the `telemetryConfig` as `telemetryConfig.servicePort` - same for `metricsConfig`
|
||||
|
||||
[affinity]: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
||||
[BackendConfigSpec]: https://cloud.google.com/kubernetes-engine/docs/concepts/backendconfig#backendconfigspec_v1beta1_cloudgooglecom
|
||||
[FrontendConfigSpec]: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters
|
||||
[links]: https://argo-workflows.readthedocs.io/en/stable/links/
|
||||
[columns]: https://github.com/argoproj/argo-workflows/pull/10693
|
||||
[Node selector]: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
[Pod Disruption Budget]: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
|
||||
[probe]: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
|
||||
[Tolerations]: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
[TopologySpreadConstraints]: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
[values.yaml]: values.yaml
|
||||
[changelog]: https://artifacthub.io/packages/helm/argo/argo-workflows?modal=changelog
|
||||
[SSO RBAC]: https://argo-workflows.readthedocs.io/en/stable/argo-server-sso/
|
||||
[Argo Server Auth Mode]: https://argo-workflows.readthedocs.io/en/stable/argo-server-auth-mode/
|
||||
@ -1,11 +0,0 @@
|
||||
{{- if .Values.server.authMode }}
|
||||
DEPRECATED option server.authMode - Use server.authModes
|
||||
{{- end }}
|
||||
|
||||
1. Get Argo Server external IP/domain by running:
|
||||
|
||||
kubectl --namespace {{ .Release.Namespace }} get services -o wide | grep {{ template "argo-workflows.server.fullname" . }}
|
||||
|
||||
2. Submit the hello-world workflow by running:
|
||||
|
||||
argo submit https://raw.githubusercontent.com/argoproj/argo-workflows/master/examples/hello-world.yaml --watch
|
||||
@ -1,211 +0,0 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Create argo workflows server name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "argo-workflows.server.fullname" -}}
|
||||
{{- printf "%s-%s" (include "argo-workflows.fullname" .) .Values.server.name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create controller name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "argo-workflows.controller.fullname" -}}
|
||||
{{- printf "%s-%s" (include "argo-workflows.fullname" .) .Values.controller.name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "argo-workflows.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "argo-workflows.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "argo-workflows.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create kubernetes friendly chart version label for the controller.
|
||||
Examples:
|
||||
image.tag = v3.4.4
|
||||
output = v3.4.4
|
||||
|
||||
image.tag = v3.4.4@sha256:d06860f1394a94ac3ff8401126ef32ba28915aa6c3c982c7e607ea0b4dadb696
|
||||
output = v3.4.4
|
||||
*/}}
|
||||
{{- define "argo-workflows.controller_chart_version_label" -}}
|
||||
{{- regexReplaceAll "[^a-zA-Z0-9-_.]+" (regexReplaceAll "@sha256:[a-f0-9]+" (default (include "argo-workflows.defaultTag" .) .Values.controller.image.tag) "") "" | trunc 63 | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create kubernetes friendly chart version label for the server.
|
||||
Examples:
|
||||
image.tag = v3.4.4
|
||||
output = v3.4.4
|
||||
|
||||
image.tag = v3.4.4@sha256:d06860f1394a94ac3ff8401126ef32ba28915aa6c3c982c7e607ea0b4dadb696
|
||||
output = v3.4.4
|
||||
*/}}
|
||||
{{- define "argo-workflows.server_chart_version_label" -}}
|
||||
{{- regexReplaceAll "[^a-zA-Z0-9-_.]+" (regexReplaceAll "@sha256:[a-f0-9]+" (default (include "argo-workflows.defaultTag" .) .Values.server.image.tag) "") "" | trunc 63 | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "argo-workflows.labels" -}}
|
||||
helm.sh/chart: {{ include "argo-workflows.chart" .context }}
|
||||
{{ include "argo-workflows.selectorLabels" (dict "context" .context "component" .component "name" .name) }}
|
||||
app.kubernetes.io/managed-by: {{ .context.Release.Service }}
|
||||
app.kubernetes.io/part-of: argo-workflows
|
||||
{{- with .context.Values.commonLabels }}
|
||||
{{ toYaml .}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "argo-workflows.selectorLabels" -}}
|
||||
{{- if .name -}}
|
||||
app.kubernetes.io/name: {{ include "argo-workflows.name" .context }}-{{ .name }}
|
||||
{{ end -}}
|
||||
app.kubernetes.io/instance: {{ .context.Release.Name }}
|
||||
{{- if .component }}
|
||||
app.kubernetes.io/component: {{ .component }}
|
||||
app: {{ .component }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the controller configMap
|
||||
*/}}
|
||||
{{- define "argo-workflows.controller.config-map.name" -}}
|
||||
{{- .Values.controller.configMap.name | default (printf "%s-%s" (include "argo-workflows.controller.fullname" .) "configmap") | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the server service account to use
|
||||
*/}}
|
||||
{{- define "argo-workflows.serverServiceAccountName" -}}
|
||||
{{- if .Values.server.serviceAccount.create -}}
|
||||
{{ default (include "argo-workflows.server.fullname" .) .Values.server.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.server.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the controller service account to use
|
||||
*/}}
|
||||
{{- define "argo-workflows.controllerServiceAccountName" -}}
|
||||
{{- if .Values.controller.serviceAccount.create -}}
|
||||
{{ default (include "argo-workflows.controller.fullname" .) .Values.controller.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.controller.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for ingress
|
||||
*/}}
|
||||
{{- define "argo-workflows.ingress.apiVersion" -}}
|
||||
{{- if semverCompare "<1.14-0" (include "argo-workflows.kubeVersion" $) -}}
|
||||
{{- print "extensions/v1beta1" -}}
|
||||
{{- else if semverCompare "<1.19-0" (include "argo-workflows.kubeVersion" $) -}}
|
||||
{{- print "networking.k8s.io/v1beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the target Kubernetes version
|
||||
*/}}
|
||||
{{- define "argo-workflows.kubeVersion" -}}
|
||||
{{- default .Capabilities.KubeVersion.Version .Values.kubeVersionOverride }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the default Argo Workflows app version
|
||||
*/}}
|
||||
{{- define "argo-workflows.defaultTag" -}}
|
||||
{{- default .Chart.AppVersion .Values.images.tag }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return full image name including or excluding registry based on existence
|
||||
*/}}
|
||||
{{- define "argo-workflows.image" -}}
|
||||
{{- if and .image.registry .image.repository -}}
|
||||
{{ .image.registry }}/{{ .image.repository }}
|
||||
{{- else -}}
|
||||
{{ .image.repository }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for autoscaling
|
||||
*/}}
|
||||
{{- define "argo-workflows.apiVersion.autoscaling" -}}
|
||||
{{- if .Values.apiVersionOverrides.autoscaling -}}
|
||||
{{- print .Values.apiVersionOverrides.autoscaling -}}
|
||||
{{- else if semverCompare "<1.23-0" (include "argo-workflows.kubeVersion" .) -}}
|
||||
{{- print "autoscaling/v2beta1" -}}
|
||||
{{- else -}}
|
||||
{{- print "autoscaling/v2" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for GKE resources
|
||||
*/}}
|
||||
{{- define "argo-workflows.apiVersions.cloudgoogle" -}}
|
||||
{{- if .Values.apiVersionOverrides.cloudgoogle -}}
|
||||
{{- print .Values.apiVersionOverrides.cloudgoogle -}}
|
||||
{{- else if .Capabilities.APIVersions.Has "cloud.google.com/v1" -}}
|
||||
{{- print "cloud.google.com/v1" -}}
|
||||
{{- else -}}
|
||||
{{- print "cloud.google.com/v1beta1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for monitoring CRDs
|
||||
*/}}
|
||||
{{- define "argo-workflows.apiVersions.monitoring" -}}
|
||||
{{- if .Values.apiVersionOverrides.monitoring -}}
|
||||
{{- print .Values.apiVersionOverrides.monitoring -}}
|
||||
{{- else -}}
|
||||
{{- print "monitoring.coreos.com/v1" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Expand the namespace of the release.
|
||||
Allows overriding it for multi-namespace deployments in combined charts.
|
||||
*/}}
|
||||
{{- define "argo-workflows.namespace" -}}
|
||||
{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end }}
|
||||
@ -1,29 +0,0 @@
|
||||
{{- if .Values.workflow.rbac.agentPermissions -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace (include "argo-workflows.namespace" .)) | uniq) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" $ }}-workflow-agent
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "argo-workflows.fullname" $ }}-workflow-agent
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $.Values.workflow.serviceAccount.name }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
{{- range $.Values.workflow.rbac.serviceAccounts }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ .name }}
|
||||
namespace: {{ .namespace | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,29 +0,0 @@
|
||||
{{- if .Values.workflow.rbac.agentPermissions -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace (include "argo-workflows.namespace" .)) | uniq) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" $ }}-workflow-agent
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtasksets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtasksets/status
|
||||
verbs:
|
||||
- patch
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@ -1,29 +0,0 @@
|
||||
{{- if .Values.workflow.rbac.artifactGC -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace (include "argo-workflows.namespace" .)) | uniq) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" $ }}-wf-artifactgc
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "argo-workflows.fullname" $ }}-wf-artifactgc
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $.Values.workflow.serviceAccount.name }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
{{- range $.Values.workflow.rbac.serviceAccounts }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ .name }}
|
||||
namespace: {{ .namespace | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,29 +0,0 @@
|
||||
{{- if .Values.workflow.rbac.artifactGC -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace (include "argo-workflows.namespace" .)) | uniq) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" $ }}-wf-artifactgc
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowartifactgctasks
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowartifactgctasks/status
|
||||
verbs:
|
||||
- patch
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@ -1,19 +0,0 @@
|
||||
{{- range $cm_name, $cm_val := .Values.artifactRepositoryRef }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ $cm_name }}
|
||||
namespace: {{ include "argo-workflows.namespace" $ | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $cm_name) | nindent 4 }}
|
||||
{{- with $cm_val.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- range $data_key, $data_val := (omit $cm_val "annotations") }}
|
||||
{{- $data_key | nindent 2 }}: |
|
||||
{{- toYaml $data_val | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,107 +0,0 @@
|
||||
{{- if .Values.createAggregateRoles }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" . }}-view
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
- workflows/finalizers
|
||||
- workfloweventbindings
|
||||
- workfloweventbindings/finalizers
|
||||
- workflowtemplates
|
||||
- workflowtemplates/finalizers
|
||||
- cronworkflows
|
||||
- cronworkflows/finalizers
|
||||
- clusterworkflowtemplates
|
||||
- clusterworkflowtemplates/finalizers
|
||||
- workflowtasksets
|
||||
- workflowtasksets/finalizers
|
||||
- workflowtaskresults
|
||||
- workflowtaskresults/finalizers
|
||||
- workflowartifactgctasks
|
||||
- workflowartifactgctasks/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" . }}-edit
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
- workflows/finalizers
|
||||
- workfloweventbindings
|
||||
- workfloweventbindings/finalizers
|
||||
- workflowtemplates
|
||||
- workflowtemplates/finalizers
|
||||
- cronworkflows
|
||||
- cronworkflows/finalizers
|
||||
- clusterworkflowtemplates
|
||||
- clusterworkflowtemplates/finalizers
|
||||
- workflowtasksets
|
||||
- workflowtasksets/finalizers
|
||||
- workflowtaskresults
|
||||
- workflowtaskresults/finalizers
|
||||
- workflowartifactgctasks
|
||||
- workflowartifactgctasks/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" . }}-admin
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
- workflows/finalizers
|
||||
- workfloweventbindings
|
||||
- workfloweventbindings/finalizers
|
||||
- workflowtemplates
|
||||
- workflowtemplates/finalizers
|
||||
- cronworkflows
|
||||
- cronworkflows/finalizers
|
||||
- clusterworkflowtemplates
|
||||
- clusterworkflowtemplates/finalizers
|
||||
- workflowtasksets
|
||||
- workflowtasksets/finalizers
|
||||
- workflowtaskresults
|
||||
- workflowtaskresults/finalizers
|
||||
- workflowartifactgctasks
|
||||
- workflowartifactgctasks/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- deletecollection
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
{{- end }}
|
||||
@ -1,220 +0,0 @@
|
||||
{{- if .Values.controller.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.singleNamespace }}
|
||||
kind: Role
|
||||
{{- else }}
|
||||
kind: ClusterRole
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
{{- if .Values.singleNamespace }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/exec
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
{{- if .Values.controller.rbac.writeConfigMaps }}
|
||||
- create
|
||||
- update
|
||||
{{- end}}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- persistentvolumeclaims
|
||||
- persistentvolumeclaims/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- get
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
- workflows/finalizers
|
||||
- workflowtasksets
|
||||
- workflowtasksets/finalizers
|
||||
- workflowartifactgctasks
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- create
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtemplates
|
||||
- workflowtemplates/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtaskresults
|
||||
- workflowtaskresults/finalizers
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- deletecollection
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- cronworkflows
|
||||
- cronworkflows/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- "policy"
|
||||
resources:
|
||||
- poddisruptionbudgets
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- delete
|
||||
{{- if .Values.controller.persistence }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
{{- if .Values.controller.persistence.postgresql }}
|
||||
- {{ .Values.controller.persistence.postgresql.userNameSecret.name }}
|
||||
- {{ .Values.controller.persistence.postgresql.passwordSecret.name }}
|
||||
{{- end}}
|
||||
{{- if .Values.controller.persistence.mysql }}
|
||||
- {{ .Values.controller.persistence.mysql.userNameSecret.name }}
|
||||
- {{ .Values.controller.persistence.mysql.passwordSecret.name }}
|
||||
{{- end}}
|
||||
verbs:
|
||||
- get
|
||||
{{- end}}
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
resourceNames:
|
||||
{{- if .Values.controller.instanceID.enabled }}
|
||||
{{- if .Values.controller.instanceID.useReleaseName }}
|
||||
- workflow-controller-{{ .Release.Name }}
|
||||
- workflow-controller-lease-{{ .Release.Name }}
|
||||
{{- else }}
|
||||
- workflow-controller-{{ .Values.controller.instanceID.explicitID }}
|
||||
- workflow-controller-lease-{{ .Values.controller.instanceID.explicitID }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- workflow-controller
|
||||
- workflow-controller-lease
|
||||
{{- end }}
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
resourceNames:
|
||||
{{/* for HTTP templates */}}
|
||||
- argo-workflows-agent-ca-certificates
|
||||
{{- with .Values.controller.rbac.secretWhitelist }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
resourceNames: {{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and (not .Values.controller.rbac.secretWhitelist) (.Values.controller.rbac.accessAllSecrets) }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.controller.clusterWorkflowTemplates.enabled (not .Values.singleNamespace) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}-cluster-template
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- clusterworkflowtemplates
|
||||
- clusterworkflowtemplates/finalizers
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,214 +0,0 @@
|
||||
{{- if .Values.controller.configMap.create }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.config-map.name" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" "cm") | nindent 4 }}
|
||||
{{- with .Values.controller.configMap.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
config: |
|
||||
{{- if .Values.controller.instanceID.enabled }}
|
||||
{{- if .Values.controller.instanceID.useReleaseName }}
|
||||
instanceID: {{ .Release.Name }}
|
||||
{{- else }}
|
||||
instanceID: {{ .Values.controller.instanceID.explicitID }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.parallelism }}
|
||||
parallelism: {{ .Values.controller.parallelism }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.resourceRateLimit }}
|
||||
resourceRateLimit: {{- toYaml .Values.controller.resourceRateLimit | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.namespaceParallelism }}
|
||||
namespaceParallelism: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.initialDelay }}
|
||||
initialDelay: {{ . }}
|
||||
{{- end }}
|
||||
{{- if or .Values.mainContainer.resources .Values.mainContainer.env .Values.mainContainer.envFrom .Values.mainContainer.securityContext}}
|
||||
mainContainer:
|
||||
imagePullPolicy: {{ default (.Values.images.pullPolicy) .Values.mainContainer.imagePullPolicy }}
|
||||
{{- with .Values.mainContainer.resources }}
|
||||
resources: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.mainContainer.env }}
|
||||
env: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.mainContainer.envFrom }}
|
||||
envFrom: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.mainContainer.securityContext }}
|
||||
securityContext: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.executor.resources .Values.executor.env .Values.executor.args .Values.executor.securityContext}}
|
||||
executor:
|
||||
imagePullPolicy: {{ default (.Values.images.pullPolicy) .Values.executor.image.pullPolicy }}
|
||||
{{- with .Values.executor.resources }}
|
||||
resources: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.executor.args }}
|
||||
args: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.executor.env }}
|
||||
env: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.executor.securityContext }}
|
||||
securityContext: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.artifactRepository.s3 .Values.artifactRepository.gcs .Values.artifactRepository.azure .Values.customArtifactRepository }}
|
||||
artifactRepository:
|
||||
{{- if .Values.artifactRepository.archiveLogs }}
|
||||
archiveLogs: {{ .Values.artifactRepository.archiveLogs }}
|
||||
{{- end }}
|
||||
{{- with .Values.artifactRepository.gcs }}
|
||||
gcs: {{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.artifactRepository.azure }}
|
||||
azure: {{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.artifactRepository.s3 }}
|
||||
s3:
|
||||
{{- if .Values.useStaticCredentials }}
|
||||
accessKeySecret:
|
||||
key: {{ tpl .Values.artifactRepository.s3.accessKeySecret.key . }}
|
||||
name: {{ tpl .Values.artifactRepository.s3.accessKeySecret.name . }}
|
||||
secretKeySecret:
|
||||
key: {{ tpl .Values.artifactRepository.s3.secretKeySecret.key . }}
|
||||
name: {{ tpl .Values.artifactRepository.s3.secretKeySecret.name . }}
|
||||
{{- if .Values.artifactRepository.s3.sessionTokenSecret }}
|
||||
sessionTokenSecret:
|
||||
key: {{ tpl .Values.artifactRepository.s3.sessionTokenSecret.key . }}
|
||||
name: {{ tpl .Values.artifactRepository.s3.sessionTokenSecret.name . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
bucket: {{ tpl (.Values.artifactRepository.s3.bucket | default "") . }}
|
||||
endpoint: {{ tpl (.Values.artifactRepository.s3.endpoint | default "") . }}
|
||||
insecure: {{ .Values.artifactRepository.s3.insecure }}
|
||||
{{- if .Values.artifactRepository.s3.caSecret }}
|
||||
caSecret:
|
||||
name: {{ tpl .Values.artifactRepository.s3.caSecret.name . }}
|
||||
key: {{ tpl .Values.artifactRepository.s3.caSecret.key . }}
|
||||
{{- end }}
|
||||
{{- if .Values.artifactRepository.s3.keyFormat }}
|
||||
keyFormat: {{ .Values.artifactRepository.s3.keyFormat | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.artifactRepository.s3.region }}
|
||||
region: {{ tpl .Values.artifactRepository.s3.region $ }}
|
||||
{{- end }}
|
||||
{{- if .Values.artifactRepository.s3.roleARN }}
|
||||
roleARN: {{ .Values.artifactRepository.s3.roleARN }}
|
||||
{{- end }}
|
||||
{{- if .Values.artifactRepository.s3.useSDKCreds }}
|
||||
useSDKCreds: {{ .Values.artifactRepository.s3.useSDKCreds }}
|
||||
{{- end }}
|
||||
{{- with .Values.artifactRepository.s3.encryptionOptions }}
|
||||
encryptionOptions:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.customArtifactRepository }}
|
||||
{{- toYaml .Values.customArtifactRepository | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.metricsConfig.enabled }}
|
||||
metricsConfig:
|
||||
enabled: {{ .Values.controller.metricsConfig.enabled }}
|
||||
path: {{ .Values.controller.metricsConfig.path }}
|
||||
port: {{ .Values.controller.metricsConfig.port }}
|
||||
{{- if .Values.controller.metricsConfig.metricsTTL }}
|
||||
metricsTTL: {{ .Values.controller.metricsConfig.metricsTTL }}
|
||||
{{- end }}
|
||||
ignoreErrors: {{ .Values.controller.metricsConfig.ignoreErrors }}
|
||||
secure: {{ .Values.controller.metricsConfig.secure }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.telemetryConfig.enabled }}
|
||||
telemetryConfig:
|
||||
enabled: {{ .Values.controller.telemetryConfig.enabled }}
|
||||
path: {{ .Values.controller.telemetryConfig.path }}
|
||||
port: {{ .Values.controller.telemetryConfig.port }}
|
||||
{{- if .Values.controller.telemetryConfig.metricsTTL }}
|
||||
metricsTTL: {{ .Values.controller.telemetryConfig.metricsTTL }}
|
||||
{{- end }}
|
||||
ignoreErrors: {{ .Values.controller.telemetryConfig.ignoreErrors }}
|
||||
secure: {{ .Values.controller.telemetryConfig.secure }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.persistence }}
|
||||
persistence:
|
||||
{{ toYaml .Values.controller.persistence | indent 6 }}{{- end }}
|
||||
{{- if .Values.controller.workflowDefaults }}
|
||||
workflowDefaults:
|
||||
{{ toYaml .Values.controller.workflowDefaults | indent 6 }}{{- end }}
|
||||
{{- if .Values.server.sso.enabled }}
|
||||
sso:
|
||||
issuer: {{ .Values.server.sso.issuer }}
|
||||
clientId:
|
||||
name: {{ .Values.server.sso.clientId.name }}
|
||||
key: {{ .Values.server.sso.clientId.key }}
|
||||
clientSecret:
|
||||
name: {{ .Values.server.sso.clientSecret.name }}
|
||||
key: {{ .Values.server.sso.clientSecret.key }}
|
||||
redirectUrl: {{ .Values.server.sso.redirectUrl | quote }}
|
||||
rbac:
|
||||
enabled: {{ .Values.server.sso.rbac.enabled }}
|
||||
{{- with .Values.server.sso.scopes }}
|
||||
scopes: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.issuerAlias }}
|
||||
issuerAlias: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.sessionExpiry }}
|
||||
sessionExpiry: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.customGroupClaimName }}
|
||||
customGroupClaimName: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.userInfoPath }}
|
||||
userInfoPath: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.insecureSkipVerify }}
|
||||
insecureSkipVerify: {{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.sso.filterGroupsRegex }}
|
||||
filterGroupsRegex: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.workflowRestrictions }}
|
||||
workflowRestrictions: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.links }}
|
||||
links: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.columns }}
|
||||
columns: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.navColor }}
|
||||
navColor: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.retentionPolicy }}
|
||||
retentionPolicy: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.emissary.images }}
|
||||
images: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
nodeEvents:
|
||||
enabled: {{ .Values.controller.nodeEvents.enabled }}
|
||||
workflowEvents:
|
||||
enabled: {{ .Values.controller.workflowEvents.enabled }}
|
||||
{{- with .Values.controller.kubeConfig }}
|
||||
kubeConfig: {{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.podGCGracePeriodSeconds }}
|
||||
podGCGracePeriodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.podGCDeleteDelayDuration }}
|
||||
podGCDeleteDelayDuration: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,50 +0,0 @@
|
||||
{{- if .Values.controller.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.singleNamespace }}
|
||||
kind: RoleBinding
|
||||
{{ else }}
|
||||
kind: ClusterRoleBinding
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
{{- if .Values.singleNamespace }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- if .Values.singleNamespace }}
|
||||
kind: Role
|
||||
{{ else }}
|
||||
kind: ClusterRole
|
||||
{{- end }}
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "argo-workflows.controllerServiceAccountName" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
|
||||
{{- if .Values.controller.clusterWorkflowTemplates.enabled }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}-cluster-template
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}-cluster-template
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "argo-workflows.controllerServiceAccountName" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
{{- range .Values.controller.clusterWorkflowTemplates.serviceAccounts }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ .name }}
|
||||
namespace: {{ .namespace | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,20 +0,0 @@
|
||||
{{- if .Values.controller.pdb.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
spec:
|
||||
{{- if .Values.controller.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.controller.pdb.minAvailable }}
|
||||
{{- else if .Values.controller.pdb.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.controller.pdb.maxUnavailable }}
|
||||
{{- else }}
|
||||
minAvailable: 0
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 6 }}
|
||||
{{- end }}
|
||||
@ -1,146 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
app.kubernetes.io/version: {{ include "argo-workflows.controller_chart_version_label" . }}
|
||||
{{- with .Values.controller.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.controller.replicas }}
|
||||
revisionHistoryLimit: {{ .Values.controller.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 8 }}
|
||||
app.kubernetes.io/version: {{ include "argo-workflows.controller_chart_version_label" . }}
|
||||
{{- with.Values.controller.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "argo-workflows.controllerServiceAccountName" . }}
|
||||
{{- with .Values.controller.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.extraInitContainers }}
|
||||
initContainers:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: controller
|
||||
image: "{{- include "argo-workflows.image" (dict "context" . "image" .Values.controller.image) }}:{{ default (include "argo-workflows.defaultTag" .) .Values.controller.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.images.pullPolicy }}
|
||||
command: [ "workflow-controller" ]
|
||||
args:
|
||||
- "--configmap"
|
||||
- "{{ template "argo-workflows.controller.config-map.name" . }}"
|
||||
- "--executor-image"
|
||||
- "{{- include "argo-workflows.image" (dict "context" . "image" .Values.executor.image) }}:{{ default (include "argo-workflows.defaultTag" .) .Values.executor.image.tag }}"
|
||||
- "--loglevel"
|
||||
- "{{ .Values.controller.logging.level }}"
|
||||
- "--gloglevel"
|
||||
- "{{ .Values.controller.logging.globallevel }}"
|
||||
- "--log-format"
|
||||
- "{{ .Values.controller.logging.format }}"
|
||||
{{- if .Values.singleNamespace }}
|
||||
- "--namespaced"
|
||||
{{- end }}
|
||||
{{- with .Values.controller.workflowWorkers }}
|
||||
- "--workflow-workers"
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.workflowTTLWorkers }}
|
||||
- "--workflow-ttl-workers"
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.podCleanupWorkers }}
|
||||
- "--pod-cleanup-workers"
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.cronWorkflowWorkers }}
|
||||
- "--cron-workflow-workers"
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.extraArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.controller.securityContext | nindent 12 }}
|
||||
env:
|
||||
- name: ARGO_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: LEADER_ELECTION_IDENTITY
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
{{- if eq (int .Values.controller.replicas) 1 }}
|
||||
- name: LEADER_ELECTION_DISABLE
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- with .Values.controller.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.controller.resources | nindent 12 }}
|
||||
{{- with .Values.controller.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: {{ .Values.controller.metricsConfig.portName }}
|
||||
containerPort: {{ .Values.controller.metricsConfig.port }}
|
||||
- containerPort: 6060
|
||||
livenessProbe: {{ .Values.controller.livenessProbe | toYaml | nindent 12 }}
|
||||
{{- with .Values.controller.extraContainers }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.images.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- range $constraint := . }}
|
||||
- {{ toYaml $constraint | nindent 8 | trim }}
|
||||
{{- if not $constraint.labelSelector }}
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" $ "name" $.Values.controller.name) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
@ -1,16 +0,0 @@
|
||||
{{- if .Values.controller.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controllerServiceAccountName" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
{{- with .Values.controller.serviceAccount.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{ with .Values.controller.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml .| nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,47 +0,0 @@
|
||||
{{- if or .Values.controller.metricsConfig.enabled .Values.controller.telemetryConfig.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
app.kubernetes.io/version: {{ include "argo-workflows.controller_chart_version_label" . }}
|
||||
{{- with .Values.controller.serviceLabels }}
|
||||
{{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.serviceAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
{{- if .Values.controller.metricsConfig.enabled }}
|
||||
- name: {{ .Values.controller.metricsConfig.servicePortName }}
|
||||
port: {{ .Values.controller.metricsConfig.servicePort }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.controller.metricsConfig.port }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.telemetryConfig.enabled }}
|
||||
- name: {{ .Values.controller.telemetryConfig.servicePortName }}
|
||||
port: {{ .Values.controller.telemetryConfig.servicePort }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.controller.telemetryConfig.port }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 4 }}
|
||||
sessionAffinity: None
|
||||
type: {{ .Values.controller.serviceType }}
|
||||
{{- if and (eq .Values.controller.serviceType "ClusterIP") .Values.controller.metricsConfig.headlessService }}
|
||||
clusterIP: None
|
||||
{{- end }}
|
||||
{{- if eq .Values.controller.serviceType "LoadBalancer" }}
|
||||
{{- with .Values.controller.loadBalancerClass }}
|
||||
loadBalancerClass: {{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- toYaml .Values.controller.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@ -1,53 +0,0 @@
|
||||
{{- $apiVersion := include "argo-workflows.apiVersions.monitoring" . }}
|
||||
{{- if and (.Capabilities.APIVersions.Has $apiVersion) (or .Values.controller.metricsConfig.enabled .Values.controller.telemetryConfig.enabled) .Values.controller.serviceMonitor.enabled }}
|
||||
apiVersion: {{ $apiVersion }}
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.controller.fullname" . }}
|
||||
namespace: {{ default (include "argo-workflows.namespace" .) .Values.controller.serviceMonitor.namespace | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.controller.name "name" .Values.controller.name) | nindent 4 }}
|
||||
{{- with .Values.controller.serviceMonitor.additionalLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
endpoints:
|
||||
{{- if .Values.controller.metricsConfig.enabled }}
|
||||
- port: {{ .Values.controller.metricsConfig.servicePortName }}
|
||||
path: {{ .Values.controller.metricsConfig.path }}
|
||||
interval: {{ .Values.controller.metricsConfig.interval }}
|
||||
{{- with .Values.controller.metricsConfig.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.metricsConfig.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
honorLabels: {{ .Values.controller.metricsConfig.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.telemetryConfig.enabled }}
|
||||
- port: telemetry
|
||||
path: {{ .Values.controller.telemetryConfig.path }}
|
||||
interval: {{ .Values.controller.telemetryConfig.interval }}
|
||||
{{- with .Values.controller.metricsConfig.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.metricsConfig.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
honorLabels: {{ .Values.controller.metricsConfig.honorLabels }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.metricsConfig.targetLabels }}
|
||||
targetLabels:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "argo-workflows.namespace" . | quote }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.controller.name) | nindent 6 }}
|
||||
{{- end }}
|
||||
@ -1,29 +0,0 @@
|
||||
{{- if .Values.workflow.rbac.create -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace (include "argo-workflows.namespace" .)) | uniq) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" $ }}-workflow
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "argo-workflows.fullname" $ }}-workflow
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ $.Values.workflow.serviceAccount.name }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
{{- range $.Values.workflow.rbac.serviceAccounts }}
|
||||
- kind: ServiceAccount
|
||||
name: {{ .name }}
|
||||
namespace: {{ .namespace | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,23 +0,0 @@
|
||||
{{- if .Values.workflow.rbac.create -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace (include "argo-workflows.namespace" .)) | uniq) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.fullname" $ }}-workflow
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflowtaskresults
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@ -1,25 +0,0 @@
|
||||
{{- if .Values.workflow.serviceAccount.create -}}
|
||||
{{- range $namespace := or .Values.singleNamespace false | ternary (list "") (append .Values.controller.workflowNamespaces (coalesce .Values.workflow.namespace (include "argo-workflows.namespace" .)) | uniq) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ $.Values.workflow.serviceAccount.name }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" $ "component" $.Values.controller.name "name" $.Values.controller.name) | nindent 4 }}
|
||||
{{- with $.Values.workflow.serviceAccount.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $namespace }}
|
||||
namespace: {{ . }}
|
||||
{{- end }}
|
||||
{{- with $.Values.workflow.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $.Values.workflow.serviceAccount.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,47 +0,0 @@
|
||||
{{- if .Values.crds.install }}
|
||||
{{- if or (.Values.server.clusterWorkflowTemplates.enabled) (.Values.controller.clusterWorkflowTemplates.enabled) }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: clusterworkflowtemplates.argoproj.io
|
||||
annotations:
|
||||
{{- if .Values.crds.keep }}
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- end }}
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
group: argoproj.io
|
||||
names:
|
||||
kind: ClusterWorkflowTemplate
|
||||
listKind: ClusterWorkflowTemplateList
|
||||
plural: clusterworkflowtemplates
|
||||
shortNames:
|
||||
- clusterwftmpl
|
||||
- cwft
|
||||
singular: clusterworkflowtemplate
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,49 +0,0 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: cronworkflows.argoproj.io
|
||||
annotations:
|
||||
{{- if .Values.crds.keep }}
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- end }}
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
group: argoproj.io
|
||||
names:
|
||||
kind: CronWorkflow
|
||||
listKind: CronWorkflowList
|
||||
plural: cronworkflows
|
||||
shortNames:
|
||||
- cwf
|
||||
- cronwf
|
||||
singular: cronworkflow
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
status:
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,690 +0,0 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: workfloweventbindings.argoproj.io
|
||||
annotations:
|
||||
{{- if .Values.crds.keep }}
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- end }}
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
group: argoproj.io
|
||||
names:
|
||||
kind: WorkflowEventBinding
|
||||
listKind: WorkflowEventBindingList
|
||||
plural: workfloweventbindings
|
||||
shortNames:
|
||||
- wfeb
|
||||
singular: workfloweventbinding
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
event:
|
||||
properties:
|
||||
selector:
|
||||
type: string
|
||||
required:
|
||||
- selector
|
||||
type: object
|
||||
submit:
|
||||
properties:
|
||||
arguments:
|
||||
properties:
|
||||
artifacts:
|
||||
items:
|
||||
properties:
|
||||
archive:
|
||||
properties:
|
||||
none:
|
||||
type: object
|
||||
tar:
|
||||
properties:
|
||||
compressionLevel:
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
zip:
|
||||
type: object
|
||||
type: object
|
||||
archiveLogs:
|
||||
type: boolean
|
||||
artifactGC:
|
||||
properties:
|
||||
podMetadata:
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
serviceAccountName:
|
||||
type: string
|
||||
strategy:
|
||||
enum:
|
||||
- ""
|
||||
- OnWorkflowCompletion
|
||||
- OnWorkflowDeletion
|
||||
- Never
|
||||
type: string
|
||||
type: object
|
||||
artifactory:
|
||||
properties:
|
||||
passwordSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
url:
|
||||
type: string
|
||||
usernameSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
azure:
|
||||
properties:
|
||||
accountKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
blob:
|
||||
type: string
|
||||
container:
|
||||
type: string
|
||||
endpoint:
|
||||
type: string
|
||||
useSDKCreds:
|
||||
type: boolean
|
||||
required:
|
||||
- blob
|
||||
- container
|
||||
- endpoint
|
||||
type: object
|
||||
deleted:
|
||||
type: boolean
|
||||
from:
|
||||
type: string
|
||||
fromExpression:
|
||||
type: string
|
||||
gcs:
|
||||
properties:
|
||||
bucket:
|
||||
type: string
|
||||
key:
|
||||
type: string
|
||||
serviceAccountKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
git:
|
||||
properties:
|
||||
branch:
|
||||
type: string
|
||||
depth:
|
||||
format: int64
|
||||
type: integer
|
||||
disableSubmodules:
|
||||
type: boolean
|
||||
fetch:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
insecureIgnoreHostKey:
|
||||
type: boolean
|
||||
insecureSkipTLS:
|
||||
type: boolean
|
||||
passwordSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
repo:
|
||||
type: string
|
||||
revision:
|
||||
type: string
|
||||
singleBranch:
|
||||
type: boolean
|
||||
sshPrivateKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
usernameSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
required:
|
||||
- repo
|
||||
type: object
|
||||
globalName:
|
||||
type: string
|
||||
hdfs:
|
||||
properties:
|
||||
addresses:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
dataTransferProtection:
|
||||
type: string
|
||||
force:
|
||||
type: boolean
|
||||
hdfsUser:
|
||||
type: string
|
||||
krbCCacheSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
krbConfigConfigMap:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
krbKeytabSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
krbRealm:
|
||||
type: string
|
||||
krbServicePrincipalName:
|
||||
type: string
|
||||
krbUsername:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
required:
|
||||
- path
|
||||
type: object
|
||||
http:
|
||||
properties:
|
||||
auth:
|
||||
properties:
|
||||
basicAuth:
|
||||
properties:
|
||||
passwordSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
usernameSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
clientCert:
|
||||
properties:
|
||||
clientCertSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
clientKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
oauth2:
|
||||
properties:
|
||||
clientIDSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
clientSecretSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
endpointParams:
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
scopes:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
tokenURLSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
type: object
|
||||
headers:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
url:
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
mode:
|
||||
format: int32
|
||||
type: integer
|
||||
name:
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
oss:
|
||||
properties:
|
||||
accessKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
bucket:
|
||||
type: string
|
||||
createBucketIfNotPresent:
|
||||
type: boolean
|
||||
endpoint:
|
||||
type: string
|
||||
key:
|
||||
type: string
|
||||
lifecycleRule:
|
||||
properties:
|
||||
markDeletionAfterDays:
|
||||
format: int32
|
||||
type: integer
|
||||
markInfrequentAccessAfterDays:
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
secretKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
securityToken:
|
||||
type: string
|
||||
useSDKCreds:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
path:
|
||||
type: string
|
||||
raw:
|
||||
properties:
|
||||
data:
|
||||
type: string
|
||||
required:
|
||||
- data
|
||||
type: object
|
||||
recurseMode:
|
||||
type: boolean
|
||||
s3:
|
||||
properties:
|
||||
accessKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
bucket:
|
||||
type: string
|
||||
caSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
createBucketIfNotPresent:
|
||||
properties:
|
||||
objectLocking:
|
||||
type: boolean
|
||||
type: object
|
||||
encryptionOptions:
|
||||
properties:
|
||||
enableEncryption:
|
||||
type: boolean
|
||||
kmsEncryptionContext:
|
||||
type: string
|
||||
kmsKeyId:
|
||||
type: string
|
||||
serverSideCustomerKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
endpoint:
|
||||
type: string
|
||||
insecure:
|
||||
type: boolean
|
||||
key:
|
||||
type: string
|
||||
region:
|
||||
type: string
|
||||
roleARN:
|
||||
type: string
|
||||
secretKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
sessionTokenSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
useSDKCreds:
|
||||
type: boolean
|
||||
type: object
|
||||
subPath:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
parameters:
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
type: string
|
||||
description:
|
||||
type: string
|
||||
enum:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
globalName:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
valueFrom:
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
default:
|
||||
type: string
|
||||
event:
|
||||
type: string
|
||||
expression:
|
||||
type: string
|
||||
jqFilter:
|
||||
type: string
|
||||
jsonPath:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
supplied:
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
metadata:
|
||||
type: object
|
||||
workflowTemplateRef:
|
||||
properties:
|
||||
clusterScope:
|
||||
type: boolean
|
||||
name:
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- workflowTemplateRef
|
||||
type: object
|
||||
required:
|
||||
- event
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
{{- end }}
|
||||
@ -1,64 +0,0 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: workflows.argoproj.io
|
||||
annotations:
|
||||
{{- if .Values.crds.keep }}
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- end }}
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
group: argoproj.io
|
||||
names:
|
||||
kind: Workflow
|
||||
listKind: WorkflowList
|
||||
plural: workflows
|
||||
shortNames:
|
||||
- wf
|
||||
singular: workflow
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Status of the workflow
|
||||
jsonPath: .status.phase
|
||||
name: Status
|
||||
type: string
|
||||
- description: When the workflow was started
|
||||
format: date-time
|
||||
jsonPath: .status.startedAt
|
||||
name: Age
|
||||
type: date
|
||||
- description: Human readable message indicating details about why the workflow
|
||||
is in this condition.
|
||||
jsonPath: .status.message
|
||||
name: Message
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
status:
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
{{- end }}
|
||||
@ -1,671 +0,0 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: workflowtaskresults.argoproj.io
|
||||
annotations:
|
||||
{{- if .Values.crds.keep }}
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- end }}
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
group: argoproj.io
|
||||
names:
|
||||
kind: WorkflowTaskResult
|
||||
listKind: WorkflowTaskResultList
|
||||
plural: workflowtaskresults
|
||||
singular: workflowtaskresult
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
outputs:
|
||||
properties:
|
||||
artifacts:
|
||||
items:
|
||||
properties:
|
||||
archive:
|
||||
properties:
|
||||
none:
|
||||
type: object
|
||||
tar:
|
||||
properties:
|
||||
compressionLevel:
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
zip:
|
||||
type: object
|
||||
type: object
|
||||
archiveLogs:
|
||||
type: boolean
|
||||
artifactGC:
|
||||
properties:
|
||||
podMetadata:
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
serviceAccountName:
|
||||
type: string
|
||||
strategy:
|
||||
enum:
|
||||
- ""
|
||||
- OnWorkflowCompletion
|
||||
- OnWorkflowDeletion
|
||||
- Never
|
||||
type: string
|
||||
type: object
|
||||
artifactory:
|
||||
properties:
|
||||
passwordSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
url:
|
||||
type: string
|
||||
usernameSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
azure:
|
||||
properties:
|
||||
accountKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
blob:
|
||||
type: string
|
||||
container:
|
||||
type: string
|
||||
endpoint:
|
||||
type: string
|
||||
useSDKCreds:
|
||||
type: boolean
|
||||
required:
|
||||
- blob
|
||||
- container
|
||||
- endpoint
|
||||
type: object
|
||||
deleted:
|
||||
type: boolean
|
||||
from:
|
||||
type: string
|
||||
fromExpression:
|
||||
type: string
|
||||
gcs:
|
||||
properties:
|
||||
bucket:
|
||||
type: string
|
||||
key:
|
||||
type: string
|
||||
serviceAccountKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
git:
|
||||
properties:
|
||||
branch:
|
||||
type: string
|
||||
depth:
|
||||
format: int64
|
||||
type: integer
|
||||
disableSubmodules:
|
||||
type: boolean
|
||||
fetch:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
insecureIgnoreHostKey:
|
||||
type: boolean
|
||||
insecureSkipTLS:
|
||||
type: boolean
|
||||
passwordSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
repo:
|
||||
type: string
|
||||
revision:
|
||||
type: string
|
||||
singleBranch:
|
||||
type: boolean
|
||||
sshPrivateKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
usernameSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
required:
|
||||
- repo
|
||||
type: object
|
||||
globalName:
|
||||
type: string
|
||||
hdfs:
|
||||
properties:
|
||||
addresses:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
dataTransferProtection:
|
||||
type: string
|
||||
force:
|
||||
type: boolean
|
||||
hdfsUser:
|
||||
type: string
|
||||
krbCCacheSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
krbConfigConfigMap:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
krbKeytabSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
krbRealm:
|
||||
type: string
|
||||
krbServicePrincipalName:
|
||||
type: string
|
||||
krbUsername:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
required:
|
||||
- path
|
||||
type: object
|
||||
http:
|
||||
properties:
|
||||
auth:
|
||||
properties:
|
||||
basicAuth:
|
||||
properties:
|
||||
passwordSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
usernameSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
clientCert:
|
||||
properties:
|
||||
clientCertSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
clientKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
oauth2:
|
||||
properties:
|
||||
clientIDSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
clientSecretSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
endpointParams:
|
||||
items:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
scopes:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
tokenURLSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
type: object
|
||||
headers:
|
||||
items:
|
||||
properties:
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
type: array
|
||||
url:
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
mode:
|
||||
format: int32
|
||||
type: integer
|
||||
name:
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
oss:
|
||||
properties:
|
||||
accessKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
bucket:
|
||||
type: string
|
||||
createBucketIfNotPresent:
|
||||
type: boolean
|
||||
endpoint:
|
||||
type: string
|
||||
key:
|
||||
type: string
|
||||
lifecycleRule:
|
||||
properties:
|
||||
markDeletionAfterDays:
|
||||
format: int32
|
||||
type: integer
|
||||
markInfrequentAccessAfterDays:
|
||||
format: int32
|
||||
type: integer
|
||||
type: object
|
||||
secretKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
securityToken:
|
||||
type: string
|
||||
useSDKCreds:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
path:
|
||||
type: string
|
||||
raw:
|
||||
properties:
|
||||
data:
|
||||
type: string
|
||||
required:
|
||||
- data
|
||||
type: object
|
||||
recurseMode:
|
||||
type: boolean
|
||||
s3:
|
||||
properties:
|
||||
accessKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
bucket:
|
||||
type: string
|
||||
caSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
createBucketIfNotPresent:
|
||||
properties:
|
||||
objectLocking:
|
||||
type: boolean
|
||||
type: object
|
||||
encryptionOptions:
|
||||
properties:
|
||||
enableEncryption:
|
||||
type: boolean
|
||||
kmsEncryptionContext:
|
||||
type: string
|
||||
kmsKeyId:
|
||||
type: string
|
||||
serverSideCustomerKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
endpoint:
|
||||
type: string
|
||||
insecure:
|
||||
type: boolean
|
||||
key:
|
||||
type: string
|
||||
region:
|
||||
type: string
|
||||
roleARN:
|
||||
type: string
|
||||
secretKeySecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
sessionTokenSecret:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
useSDKCreds:
|
||||
type: boolean
|
||||
type: object
|
||||
subPath:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
exitCode:
|
||||
type: string
|
||||
parameters:
|
||||
items:
|
||||
properties:
|
||||
default:
|
||||
type: string
|
||||
description:
|
||||
type: string
|
||||
enum:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
globalName:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
value:
|
||||
type: string
|
||||
valueFrom:
|
||||
properties:
|
||||
configMapKeyRef:
|
||||
properties:
|
||||
key:
|
||||
type: string
|
||||
name:
|
||||
default: ""
|
||||
type: string
|
||||
optional:
|
||||
type: boolean
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
default:
|
||||
type: string
|
||||
event:
|
||||
type: string
|
||||
expression:
|
||||
type: string
|
||||
jqFilter:
|
||||
type: string
|
||||
jsonPath:
|
||||
type: string
|
||||
parameter:
|
||||
type: string
|
||||
path:
|
||||
type: string
|
||||
supplied:
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: array
|
||||
result:
|
||||
type: string
|
||||
type: object
|
||||
phase:
|
||||
type: string
|
||||
progress:
|
||||
type: string
|
||||
required:
|
||||
- metadata
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
{{- end }}
|
||||
@ -1,50 +0,0 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: workflowtasksets.argoproj.io
|
||||
annotations:
|
||||
{{- if .Values.crds.keep }}
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- end }}
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
group: argoproj.io
|
||||
names:
|
||||
kind: WorkflowTaskSet
|
||||
listKind: WorkflowTaskSetList
|
||||
plural: workflowtasksets
|
||||
shortNames:
|
||||
- wfts
|
||||
singular: workflowtaskset
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
status:
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
@ -1,44 +0,0 @@
|
||||
{{- if .Values.crds.install }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: workflowtemplates.argoproj.io
|
||||
annotations:
|
||||
{{- if .Values.crds.keep }}
|
||||
"helm.sh/resource-policy": keep
|
||||
{{- end }}
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
group: argoproj.io
|
||||
names:
|
||||
kind: WorkflowTemplate
|
||||
listKind: WorkflowTemplateList
|
||||
plural: workflowtemplates
|
||||
shortNames:
|
||||
- wftmpl
|
||||
singular: workflowtemplate
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
{{- end }}
|
||||
@ -1,8 +0,0 @@
|
||||
{{ range .Values.extraObjects }}
|
||||
---
|
||||
{{ if typeIs "string" . }}
|
||||
{{- tpl . $ }}
|
||||
{{- else }}
|
||||
{{- tpl (toYaml .) $ }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
@ -1,11 +0,0 @@
|
||||
{{- if .Values.server.GKEbackendConfig.enabled }}
|
||||
apiVersion: {{ include "argo-workflows.apiVersions.cloudgoogle" . }}
|
||||
kind: BackendConfig
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
spec:
|
||||
{{- toYaml .Values.server.GKEbackendConfig.spec | nindent 2 }}
|
||||
{{- end }}
|
||||
@ -1,11 +0,0 @@
|
||||
{{- if .Values.server.GKEfrontendConfig.enabled }}
|
||||
apiVersion: networking.gke.io/v1beta1
|
||||
kind: FrontendConfig
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
spec:
|
||||
{{- toYaml .Values.server.GKEfrontendConfig.spec | nindent 2 }}
|
||||
{{- end }}
|
||||
@ -1,12 +0,0 @@
|
||||
{{- if .Values.server.GKEmanagedCertificate.enabled }}
|
||||
apiVersion: networking.gke.io/v1
|
||||
kind: ManagedCertificate
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
spec:
|
||||
domains:
|
||||
{{- with .Values.server.GKEmanagedCertificate.domains }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,145 +0,0 @@
|
||||
{{- if and .Values.server.enabled .Values.server.rbac.create}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.singleNamespace }}
|
||||
kind: Role
|
||||
{{- else }}
|
||||
kind: ClusterRole
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
{{- if .Values.singleNamespace }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- events
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods/log
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
{{- if .Values.server.sso.enabled }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
- sso
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
{{- if .Values.server.sso.rbac.enabled }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- serviceaccounts
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
{{- if and .Values.server.sso.enabled .Values.server.sso.rbac.enabled }}
|
||||
{{- with .Values.server.sso.rbac.secretWhitelist }}
|
||||
resourceNames: {{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- watch
|
||||
- create
|
||||
- patch
|
||||
{{- if .Values.controller.persistence }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
{{- with .Values.controller.persistence.postgresql }}
|
||||
- {{ .userNameSecret.name }}
|
||||
- {{ .passwordSecret.name }}
|
||||
{{- end}}
|
||||
{{- with .Values.controller.persistence.mysql }}
|
||||
- {{ .userNameSecret.name }}
|
||||
- {{ .passwordSecret.name }}
|
||||
{{- end}}
|
||||
verbs:
|
||||
- get
|
||||
{{- end}}
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- eventsources
|
||||
- sensors
|
||||
- workflows
|
||||
- workfloweventbindings
|
||||
- workflowtemplates
|
||||
- cronworkflows
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
|
||||
{{- if and .Values.server.clusterWorkflowTemplates.enabled (not .Values.singleNamespace) }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}-cluster-template
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- clusterworkflowtemplates
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if .Values.server.clusterWorkflowTemplates.enableEditing }}
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,45 +0,0 @@
|
||||
{{- if and .Values.server.enabled .Values.server.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
{{- if .Values.singleNamespace }}
|
||||
kind: RoleBinding
|
||||
{{ else }}
|
||||
kind: ClusterRoleBinding
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
{{- if .Values.singleNamespace }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- if .Values.singleNamespace }}
|
||||
kind: Role
|
||||
{{ else }}
|
||||
kind: ClusterRole
|
||||
{{- end }}
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "argo-workflows.serverServiceAccountName" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
|
||||
{{- if .Values.server.clusterWorkflowTemplates.enabled }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}-cluster-template
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "argo-workflows.server.fullname" . }}-cluster-template
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "argo-workflows.serverServiceAccountName" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@ -1,45 +0,0 @@
|
||||
{{- if and .Values.server.enabled .Values.server.autoscaling.enabled }}
|
||||
apiVersion: {{ include "argo-workflows.apiVersion.autoscaling" . }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
minReplicas: {{ .Values.server.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.server.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- with .Values.server.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
{{- if eq (include "argo-workflows.apiVersion.autoscaling" $) "autoscaling/v2beta1" }}
|
||||
targetAverageUtilization: {{ . }}
|
||||
{{- else }}
|
||||
target:
|
||||
averageUtilization: {{ . }}
|
||||
type: Utilization
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
{{- if eq (include "argo-workflows.apiVersion.autoscaling" $) "autoscaling/v2beta1" }}
|
||||
targetAverageUtilization: {{ . }}
|
||||
{{- else }}
|
||||
target:
|
||||
averageUtilization: {{ . }}
|
||||
type: Utilization
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.autoscaling.behavior }}
|
||||
behavior:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,20 +0,0 @@
|
||||
{{- if and .Values.server.enabled .Values.server.pdb.enabled -}}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
spec:
|
||||
{{- if .Values.server.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.server.pdb.minAvailable }}
|
||||
{{- else if .Values.server.pdb.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.server.pdb.maxUnavailable }}
|
||||
{{- else }}
|
||||
minAvailable: 0
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.server.name) | nindent 6 }}
|
||||
{{- end -}}
|
||||
@ -1,157 +0,0 @@
|
||||
{{- if .Values.server.enabled -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
app.kubernetes.io/version: {{ include "argo-workflows.server_chart_version_label" . }}
|
||||
{{- with .Values.server.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.server.autoscaling.enabled }}
|
||||
replicas: {{ .Values.server.replicas }}
|
||||
{{- end }}
|
||||
revisionHistoryLimit: {{ .Values.server.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.server.name) | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 8 }}
|
||||
app.kubernetes.io/version: {{ include "argo-workflows.server_chart_version_label" . }}
|
||||
{{- with .Values.server.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "argo-workflows.serverServiceAccountName" . }}
|
||||
{{- with .Values.server.podSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.hostAliases }}
|
||||
hostAliases:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.extraInitContainers }}
|
||||
initContainers:
|
||||
{{- tpl (toYaml .) $ | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: argo-server
|
||||
image: "{{- include "argo-workflows.image" (dict "context" . "image" .Values.server.image) }}:{{ default (include "argo-workflows.defaultTag" .) .Values.server.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.images.pullPolicy }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.server.securityContext | nindent 12 }}
|
||||
args:
|
||||
- server
|
||||
- --configmap={{ template "argo-workflows.controller.config-map.name" . }}
|
||||
{{- with .Values.server.extraArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.server.authMode }}
|
||||
- "--auth-mode={{ .Values.server.authMode }}"
|
||||
{{- end }}
|
||||
{{- range .Values.server.authModes }}
|
||||
- "--auth-mode={{ . }}"
|
||||
{{- end }}
|
||||
- "--secure={{ .Values.server.secure }}"
|
||||
{{- if .Values.singleNamespace }}
|
||||
- "--namespaced"
|
||||
{{- end }}
|
||||
- "--loglevel"
|
||||
- "{{ .Values.server.logging.level }}"
|
||||
- "--gloglevel"
|
||||
- "{{ .Values.server.logging.globallevel }}"
|
||||
- "--log-format"
|
||||
- "{{ .Values.server.logging.format }}"
|
||||
ports:
|
||||
- name: web
|
||||
containerPort: 2746
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 2746
|
||||
{{- if .Values.server.secure }}
|
||||
scheme: HTTPS
|
||||
{{- else }}
|
||||
scheme: HTTP
|
||||
{{- end }}
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 20
|
||||
env:
|
||||
- name: IN_CLUSTER
|
||||
value: "true"
|
||||
- name: ARGO_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: ARGO_BASE_HREF
|
||||
value: {{ .Values.server.baseHref | quote }}
|
||||
{{- with .Values.server.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.server.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
{{- with .Values.server.volumeMounts }}
|
||||
{{- toYaml . | nindent 10}}
|
||||
{{- end }}
|
||||
{{- with .Values.server.lifecycle }}
|
||||
lifecycle:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.extraContainers }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.images.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: tmp
|
||||
{{- toYaml .Values.server.tmpVolume | nindent 8 }}
|
||||
{{- with .Values.server.volumes }}
|
||||
{{- toYaml . | nindent 6}}
|
||||
{{- end }}
|
||||
{{- with .Values.server.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- range $constraint := . }}
|
||||
- {{ toYaml $constraint | nindent 8 | trim }}
|
||||
{{- if not $constraint.labelSelector }}
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" $ "name" $.Values.server.name) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@ -1,90 +0,0 @@
|
||||
{{- if .Values.server.ingress.enabled -}}
|
||||
{{- $serviceName := include "argo-workflows.server.fullname" . -}}
|
||||
{{- $servicePort := .Values.server.servicePort -}}
|
||||
{{- $paths := .Values.server.ingress.paths -}}
|
||||
{{- $extraPaths := .Values.server.ingress.extraPaths -}}
|
||||
{{- $pathType := .Values.server.ingress.pathType -}}
|
||||
apiVersion: {{ include "argo-workflows.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
{{- if .Values.server.ingress.annotations }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.server.ingress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
{{- if .Values.server.ingress.labels }}
|
||||
{{- toYaml .Values.server.ingress.labels | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if eq (include "argo-workflows.ingress.apiVersion" $) "networking.k8s.io/v1" }}
|
||||
{{- with .Values.server.ingress.ingressClassName }}
|
||||
ingressClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if .Values.server.ingress.hosts }}
|
||||
{{- range $host := .Values.server.ingress.hosts }}
|
||||
- host: {{ $host }}
|
||||
http:
|
||||
paths:
|
||||
{{- if $extraPaths }}
|
||||
{{- toYaml $extraPaths | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- range $p := $paths }}
|
||||
- path: {{ $p }}
|
||||
{{- if eq (include "argo-workflows.ingress.apiVersion" $) "networking.k8s.io/v1" }}
|
||||
pathType: {{ $pathType }}
|
||||
{{- end }}
|
||||
backend:
|
||||
{{- if eq (include "argo-workflows.ingress.apiVersion" $) "networking.k8s.io/v1" }}
|
||||
service:
|
||||
name: {{ $serviceName }}
|
||||
port:
|
||||
{{- if kindIs "float64" $servicePort }}
|
||||
number: {{ $servicePort }}
|
||||
{{- else }}
|
||||
name: {{ $servicePort }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
serviceName: {{ $serviceName }}
|
||||
servicePort: {{ $servicePort }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- else }}
|
||||
- http:
|
||||
paths:
|
||||
{{- if $extraPaths }}
|
||||
{{- toYaml $extraPaths | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- range $p := $paths }}
|
||||
- path: {{ $p }}
|
||||
{{- if eq (include "argo-workflows.ingress.apiVersion" $) "networking.k8s.io/v1" }}
|
||||
pathType: {{ $pathType }}
|
||||
{{- end }}
|
||||
backend:
|
||||
{{- if eq (include "argo-workflows.ingress.apiVersion" $) "networking.k8s.io/v1" }}
|
||||
service:
|
||||
name: {{ $serviceName }}
|
||||
port:
|
||||
{{- if kindIs "float64" $servicePort }}
|
||||
number: {{ $servicePort }}
|
||||
{{- else }}
|
||||
name: {{ $servicePort }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
serviceName: {{ $serviceName }}
|
||||
servicePort: {{ $servicePort }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if .Values.server.ingress.tls }}
|
||||
tls:
|
||||
{{- toYaml .Values.server.ingress.tls | nindent 4 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@ -1,16 +0,0 @@
|
||||
{{- if and .Values.server.enabled .Values.server.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.serverServiceAccountName" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
{{- with .Values.server.serviceAccount.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@ -1,43 +0,0 @@
|
||||
{{- if .Values.server.enabled -}}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "argo-workflows.server.fullname" . }}
|
||||
namespace: {{ include "argo-workflows.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "argo-workflows.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
|
||||
app.kubernetes.io/version: {{ include "argo-workflows.server_chart_version_label" . }}
|
||||
{{- with .Values.server.serviceLabels }}
|
||||
{{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.serviceAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- port: {{ .Values.server.servicePort }}
|
||||
{{- with .Values.server.servicePortName }}
|
||||
name: {{ . }}
|
||||
{{- end }}
|
||||
targetPort: 2746
|
||||
{{- if and (eq .Values.server.serviceType "NodePort") .Values.server.serviceNodePort }}
|
||||
nodePort: {{ .Values.server.serviceNodePort }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "argo-workflows.selectorLabels" (dict "context" . "name" .Values.server.name) | nindent 4 }}
|
||||
sessionAffinity: None
|
||||
type: {{ .Values.server.serviceType }}
|
||||
{{- if eq .Values.server.serviceType "LoadBalancer" }}
|
||||
{{- with .Values.controller.loadBalancerClass }}
|
||||
loadBalancerClass: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.server.loadBalancerIP }}
|
||||
loadBalancerIP: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.server.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- toYaml .Values.server.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@ -1,943 +0,0 @@
|
||||
images:
|
||||
# -- Common tag for Argo Workflows images. Defaults to `.Chart.AppVersion`.
|
||||
tag: ""
|
||||
# -- imagePullPolicy to apply to all containers
|
||||
pullPolicy: Always
|
||||
# -- Secrets with credentials to pull images from a private registry
|
||||
pullSecrets: []
|
||||
# - name: argo-pull-secret
|
||||
|
||||
## Custom resource configuration
|
||||
crds:
|
||||
# -- Install and upgrade CRDs
|
||||
install: true
|
||||
# -- Keep CRDs on chart uninstall
|
||||
keep: true
|
||||
# -- Annotations to be added to all CRDs
|
||||
annotations: {}
|
||||
|
||||
# -- Create clusterroles that extend existing clusterroles to interact with argo-cd crds
|
||||
## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
|
||||
createAggregateRoles: true
|
||||
|
||||
# -- String to partially override "argo-workflows.fullname" template
|
||||
nameOverride:
|
||||
|
||||
# -- String to fully override "argo-workflows.fullname" template
|
||||
fullnameOverride:
|
||||
|
||||
# -- Override the namespace
|
||||
# @default -- `.Release.Namespace`
|
||||
namespaceOverride: ""
|
||||
|
||||
# -- Labels to set on all resources
|
||||
commonLabels: {}
|
||||
|
||||
# -- Override the Kubernetes version, which is used to evaluate certain manifests
|
||||
kubeVersionOverride: ""
|
||||
|
||||
# Override APIVersions
|
||||
apiVersionOverrides:
|
||||
# -- String to override apiVersion of autoscaling rendered by this helm chart
|
||||
autoscaling: "" # autoscaling/v2
|
||||
# -- String to override apiVersion of GKE resources rendered by this helm chart
|
||||
cloudgoogle: "" # cloud.google.com/v1
|
||||
# -- String to override apiVersion of monitoring CRDs (ServiceMonitor) rendered by this helm chart
|
||||
monitoring: "" # monitoring.coreos.com/v1
|
||||
|
||||
# -- Restrict Argo to operate only in a single namespace (the namespace of the
|
||||
# Helm release) by apply Roles and RoleBindings instead of the Cluster
|
||||
# equivalents, and start workflow-controller with the --namespaced flag. Use it
|
||||
# in clusters with strict access policy.
|
||||
singleNamespace: false
|
||||
|
||||
workflow:
|
||||
# -- Deprecated; use controller.workflowNamespaces instead.
|
||||
namespace:
|
||||
serviceAccount:
|
||||
# -- Specifies whether a service account should be created
|
||||
create: false
|
||||
# -- Labels applied to created service account
|
||||
labels: {}
|
||||
# -- Annotations applied to created service account
|
||||
annotations: {}
|
||||
# -- Service account which is used to run workflows
|
||||
name: "argo-workflow"
|
||||
# -- Secrets with credentials to pull images from a private registry. Same format as `.Values.images.pullSecrets`
|
||||
pullSecrets: []
|
||||
rbac:
|
||||
# -- Adds Role and RoleBinding for the above specified service account to be able to run workflows.
|
||||
# A Role and Rolebinding pair is also created for each namespace in controller.workflowNamespaces (see below)
|
||||
create: true
|
||||
# -- Allows permissions for the Argo Agent. Only required if using http/plugin templates
|
||||
agentPermissions: false
|
||||
# -- Allows permissions for the Argo Artifact GC pod. Only required if using artifact gc
|
||||
artifactGC: false
|
||||
# -- Extra service accounts to be added to the RoleBinding
|
||||
serviceAccounts: []
|
||||
# - name: my-service-account
|
||||
# namespace: my-namespace
|
||||
|
||||
controller:
|
||||
image:
|
||||
# -- Registry to use for the controller
|
||||
registry: quay.io
|
||||
# -- Registry to use for the controller
|
||||
repository: argoproj/workflow-controller
|
||||
# -- Image tag for the workflow controller. Defaults to `.Values.images.tag`.
|
||||
tag: ""
|
||||
# -- parallelism dictates how many workflows can be running at the same time
|
||||
parallelism:
|
||||
# -- Globally limits the rate at which pods are created.
|
||||
# This is intended to mitigate flooding of the Kubernetes API server by workflows with a large amount of
|
||||
# parallel nodes.
|
||||
resourceRateLimit: {}
|
||||
# limit: 10
|
||||
# burst: 1
|
||||
|
||||
rbac:
|
||||
# -- Adds Role and RoleBinding for the controller.
|
||||
create: true
|
||||
# -- Allows controller to get, list, and watch certain k8s secrets
|
||||
secretWhitelist: []
|
||||
# -- Allows controller to get, list and watch all k8s secrets. Can only be used if secretWhitelist is empty.
|
||||
accessAllSecrets: false
|
||||
# -- Allows controller to create and update ConfigMaps. Enables memoization feature
|
||||
writeConfigMaps: false
|
||||
|
||||
configMap:
|
||||
# -- Create a ConfigMap for the controller
|
||||
create: true
|
||||
# -- ConfigMap name
|
||||
name: ""
|
||||
# -- ConfigMap annotations
|
||||
annotations: {}
|
||||
|
||||
# -- Limits the maximum number of incomplete workflows in a namespace
|
||||
namespaceParallelism:
|
||||
# -- Resolves ongoing, uncommon AWS EKS bug: https://github.com/argoproj/argo-workflows/pull/4224
|
||||
initialDelay:
|
||||
# -- deploymentAnnotations is an optional map of annotations to be applied to the controller Deployment
|
||||
deploymentAnnotations: {}
|
||||
# -- podAnnotations is an optional map of annotations to be applied to the controller Pods
|
||||
podAnnotations: {}
|
||||
# -- Optional labels to add to the controller pods
|
||||
podLabels: {}
|
||||
# -- SecurityContext to set on the controller pods
|
||||
podSecurityContext: {}
|
||||
# podPortName: http
|
||||
metricsConfig:
|
||||
# -- Enables prometheus metrics server
|
||||
enabled: false
|
||||
# -- Path is the path where metrics are emitted. Must start with a "/".
|
||||
path: /metrics
|
||||
# -- Frequency at which prometheus scrapes metrics
|
||||
interval: 30s
|
||||
# -- Port is the port where metrics are emitted
|
||||
port: 9090
|
||||
# -- How often custom metrics are cleared from memory
|
||||
metricsTTL: ""
|
||||
# -- Flag that instructs prometheus to ignore metric emission errors.
|
||||
ignoreErrors: false
|
||||
# -- Flag that use a self-signed cert for TLS
|
||||
secure: false
|
||||
# -- Container metrics port name
|
||||
portName: metrics
|
||||
# -- Service metrics port
|
||||
servicePort: 8080
|
||||
# -- Service metrics port name
|
||||
servicePortName: metrics
|
||||
# -- Flag to enable headless service
|
||||
headlessService: false
|
||||
# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.
|
||||
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#honorlabels
|
||||
honorLabels: false
|
||||
# -- ServiceMonitor relabel configs to apply to samples before scraping
|
||||
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#relabelconfig
|
||||
relabelings: []
|
||||
# -- ServiceMonitor metric relabel configs to apply to samples before ingestion
|
||||
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#endpoint
|
||||
metricRelabelings: []
|
||||
# -- ServiceMonitor will add labels from the service to the Prometheus metric
|
||||
## Ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#servicemonitorspec
|
||||
targetLabels: []
|
||||
# -- the controller container's securityContext
|
||||
securityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# -- enable Workflow Archive to store the status of workflows. Postgres and MySQL (>= 5.7.8) are available.
|
||||
## Ref: https://argo-workflows.readthedocs.io/en/stable/workflow-archive/
|
||||
persistence: {}
|
||||
# connectionPool:
|
||||
# maxIdleConns: 100
|
||||
# maxOpenConns: 0
|
||||
# # save the entire workflow into etcd and DB
|
||||
# nodeStatusOffLoad: false
|
||||
# # enable archiving of old workflows
|
||||
# archive: false
|
||||
# postgresql:
|
||||
# host: localhost
|
||||
# port: 5432
|
||||
# database: postgres
|
||||
# tableName: argo_workflows
|
||||
# # the database secrets must be in the same namespace of the controller
|
||||
# userNameSecret:
|
||||
# name: argo-postgres-config
|
||||
# key: username
|
||||
# passwordSecret:
|
||||
# name: argo-postgres-config
|
||||
# key: password
|
||||
# ssl: true
|
||||
# # sslMode must be one of: disable, require, verify-ca, verify-full
|
||||
# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq
|
||||
# sslMode: require
|
||||
# mysql:
|
||||
# host: localhost
|
||||
# port: 3306
|
||||
# database: argo
|
||||
# tableName: argo_workflows
|
||||
# userNameSecret:
|
||||
# name: argo-mysql-config
|
||||
# key: username
|
||||
# passwordSecret:
|
||||
# name: argo-mysql-config
|
||||
# key: password
|
||||
|
||||
# -- Default values that will apply to all Workflows from this controller, unless overridden on the Workflow-level.
|
||||
# Only valid for 2.7+
|
||||
## See more: https://argo-workflows.readthedocs.io/en/stable/default-workflow-specs/
|
||||
workflowDefaults: {}
|
||||
# spec:
|
||||
# ttlStrategy:
|
||||
# secondsAfterCompletion: 86400
|
||||
# # Ref: https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/
|
||||
# artifactRepositoryRef:
|
||||
# configMap: my-artifact-repository # default is "artifact-repositories"
|
||||
# key: v2-s3-artifact-repository # default can be set by the `workflows.argoproj.io/default-artifact-repository` annotation in config map.
|
||||
|
||||
# -- Number of workflow workers
|
||||
workflowWorkers: # 32
|
||||
# -- Number of workflow TTL workers
|
||||
workflowTTLWorkers: # 4
|
||||
# -- Number of pod cleanup workers
|
||||
podCleanupWorkers: # 4
|
||||
# -- Number of cron workflow workers
|
||||
# Only valid for 3.5+
|
||||
cronWorkflowWorkers: # 8
|
||||
# -- Restricts the Workflows that the controller will process.
|
||||
# Only valid for 2.9+
|
||||
workflowRestrictions: {}
|
||||
# templateReferencing: Strict|Secure
|
||||
|
||||
# telemetryConfig controls the path and port for prometheus telemetry. Telemetry is enabled and emitted in the same endpoint
|
||||
# as metrics by default, but can be overridden using this config.
|
||||
telemetryConfig:
|
||||
# -- Enables prometheus telemetry server
|
||||
enabled: false
|
||||
# -- telemetry path
|
||||
path: /telemetry
|
||||
# -- Frequency at which prometheus scrapes telemetry data
|
||||
interval: 30s
|
||||
# -- telemetry container port
|
||||
port: 8081
|
||||
# -- How often custom metrics are cleared from memory
|
||||
metricsTTL: ""
|
||||
# -- Flag that instructs prometheus to ignore metric emission errors.
|
||||
ignoreErrors: false
|
||||
# -- Flag that use a self-signed cert for TLS
|
||||
secure: false
|
||||
# -- telemetry service port
|
||||
servicePort: 8081
|
||||
# -- telemetry service port name
|
||||
servicePortName: telemetry
|
||||
serviceMonitor:
|
||||
# -- Enable a prometheus ServiceMonitor
|
||||
enabled: false
|
||||
# -- Prometheus ServiceMonitor labels
|
||||
additionalLabels: {}
|
||||
# -- Prometheus ServiceMonitor namespace
|
||||
namespace: "" # "monitoring"
|
||||
serviceAccount:
|
||||
# -- Create a service account for the controller
|
||||
create: true
|
||||
# -- Service account name
|
||||
name: ""
|
||||
# -- Labels applied to created service account
|
||||
labels: {}
|
||||
# -- Annotations applied to created service account
|
||||
annotations: {}
|
||||
|
||||
# -- Workflow controller name string
|
||||
name: workflow-controller
|
||||
|
||||
# -- Specify all namespaces where this workflow controller instance will manage
|
||||
# workflows. This controls where the service account and RBAC resources will
|
||||
# be created. Only valid when singleNamespace is false.
|
||||
workflowNamespaces:
|
||||
- default
|
||||
|
||||
instanceID:
|
||||
# -- Configures the controller to filter workflow submissions
|
||||
# to only those which have a matching instanceID attribute.
|
||||
## NOTE: If `instanceID.enabled` is set to `true` then either `instanceID.userReleaseName`
|
||||
## or `instanceID.explicitID` must be defined.
|
||||
enabled: false
|
||||
# -- Use ReleaseName as instanceID
|
||||
useReleaseName: false
|
||||
# useReleaseName: true
|
||||
|
||||
# -- Use a custom instanceID
|
||||
explicitID: ""
|
||||
# explicitID: unique-argo-controller-identifier
|
||||
|
||||
logging:
|
||||
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
|
||||
level: info
|
||||
# -- Set the glog logging level
|
||||
globallevel: "0"
|
||||
# -- Set the logging format (one of: `text`, `json`)
|
||||
format: "text"
|
||||
|
||||
# -- Service type of the controller Service
|
||||
serviceType: ClusterIP
|
||||
# -- Annotations to be applied to the controller Service
|
||||
serviceAnnotations: {}
|
||||
# -- Optional labels to add to the controller Service
|
||||
serviceLabels: {}
|
||||
# -- The class of the load balancer implementation
|
||||
loadBalancerClass: ""
|
||||
# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`
|
||||
loadBalancerSourceRanges: []
|
||||
|
||||
# -- Resource limits and requests for the controller
|
||||
resources: {}
|
||||
|
||||
# -- Configure liveness [probe] for the controller
|
||||
# @default -- See [values.yaml]
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
port: 6060
|
||||
path: /healthz
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 90
|
||||
periodSeconds: 60
|
||||
timeoutSeconds: 30
|
||||
|
||||
# -- Extra environment variables to provide to the controller container
|
||||
extraEnv: []
|
||||
# - name: FOO
|
||||
# value: "bar"
|
||||
|
||||
# -- Extra arguments to be added to the controller
|
||||
extraArgs: []
|
||||
# -- Additional volume mounts to the controller main container
|
||||
volumeMounts: []
|
||||
# -- Additional volumes to the controller pod
|
||||
volumes: []
|
||||
# -- The number of controller pods to run
|
||||
replicas: 1
|
||||
# -- The number of revisions to keep.
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
pdb:
|
||||
# -- Configure [Pod Disruption Budget] for the controller pods
|
||||
enabled: false
|
||||
# minAvailable: 1
|
||||
# maxUnavailable: 1
|
||||
|
||||
# -- [Node selector]
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
# -- [Tolerations] for use with node taints
|
||||
tolerations: []
|
||||
# -- Assign custom [affinity] rules
|
||||
affinity: {}
|
||||
|
||||
# -- Assign custom [TopologySpreadConstraints] rules to the workflow controller
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
|
||||
topologySpreadConstraints: []
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: DoNotSchedule
|
||||
|
||||
# -- Leverage a PriorityClass to ensure your pods survive resource shortages.
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
|
||||
priorityClassName: ""
|
||||
|
||||
# -- Configure Argo Server to show custom [links]
|
||||
## Ref: https://argo-workflows.readthedocs.io/en/stable/links/
|
||||
links: []
|
||||
# -- Configure Argo Server to show custom [columns]
|
||||
## Ref: https://github.com/argoproj/argo-workflows/pull/10693
|
||||
columns: []
|
||||
# -- Set ui navigation bar background color
|
||||
navColor: ""
|
||||
clusterWorkflowTemplates:
|
||||
# -- Create a ClusterRole and CRB for the controller to access ClusterWorkflowTemplates.
|
||||
enabled: true
|
||||
# -- Extra service accounts to be added to the ClusterRoleBinding
|
||||
serviceAccounts: []
|
||||
# - name: my-service-account
|
||||
# namespace: my-namespace
|
||||
# -- Extra containers to be added to the controller deployment
|
||||
extraContainers: []
|
||||
|
||||
# -- Enables init containers to be added to the controller deployment
|
||||
extraInitContainers: []
|
||||
|
||||
# -- Workflow retention by number of workflows
|
||||
retentionPolicy: {}
|
||||
# completed: 10
|
||||
# failed: 3
|
||||
# errored: 3
|
||||
|
||||
nodeEvents:
|
||||
# -- Enable to emit events on node completion.
|
||||
## This can take up a lot of space in k8s (typically etcd) resulting in errors when trying to create new events:
|
||||
## "Unable to create audit event: etcdserver: mvcc: database space exceeded"
|
||||
enabled: true
|
||||
|
||||
workflowEvents:
|
||||
# -- Enable to emit events on workflow status changes.
|
||||
## This can take up a lot of space in k8s (typically etcd), resulting in errors when trying to create new events:
|
||||
## "Unable to create audit event: etcdserver: mvcc: database space exceeded"
|
||||
enabled: true
|
||||
|
||||
# -- Configure when workflow controller runs in a different k8s cluster with the workflow workloads,
|
||||
# or needs to communicate with the k8s apiserver using an out-of-cluster kubeconfig secret.
|
||||
# @default -- `{}` (See [values.yaml])
|
||||
kubeConfig: {}
|
||||
# # name of the kubeconfig secret, may not be empty when kubeConfig specified
|
||||
# secretName: kubeconfig-secret
|
||||
# # key of the kubeconfig secret, may not be empty when kubeConfig specified
|
||||
# secretKey: kubeconfig
|
||||
# # mounting path of the kubeconfig secret, default to /kube/config
|
||||
# mountPath: /kubeconfig/mount/path
|
||||
# # volume name when mounting the secret, default to kubeconfig
|
||||
# volumeName: kube-config-volume
|
||||
|
||||
# -- Specifies the duration in seconds before a terminating pod is forcefully killed. A zero value indicates that the pod will be forcefully terminated immediately.
|
||||
# @default -- `30` seconds (Kubernetes default)
|
||||
podGCGracePeriodSeconds:
|
||||
|
||||
# -- The duration in seconds before the pods in the GC queue get deleted. A zero value indicates that the pods will be deleted immediately.
|
||||
# @default -- `5s` (Argo Workflows default)
|
||||
podGCDeleteDelayDuration: ""
|
||||
|
||||
# mainContainer adds default config for main container that could be overriden in workflows template
|
||||
mainContainer:
|
||||
# -- imagePullPolicy to apply to Workflow main container. Defaults to `.Values.images.pullPolicy`.
|
||||
imagePullPolicy: ""
|
||||
# -- Resource limits and requests for the Workflow main container
|
||||
resources: {}
|
||||
# -- Adds environment variables for the Workflow main container
|
||||
env: []
|
||||
# -- Adds reference environment variables for the Workflow main container
|
||||
envFrom: []
|
||||
# -- sets security context for the Workflow main container
|
||||
securityContext: {}
|
||||
|
||||
# executor controls how the init and wait container should be customized
|
||||
executor:
|
||||
image:
|
||||
# -- Registry to use for the Workflow Executors
|
||||
registry: quay.io
|
||||
# -- Repository to use for the Workflow Executors
|
||||
repository: argoproj/argoexec
|
||||
# -- Image tag for the workflow executor. Defaults to `.Values.images.tag`.
|
||||
tag: ""
|
||||
# -- Image PullPolicy to use for the Workflow Executors. Defaults to `.Values.images.pullPolicy`.
|
||||
pullPolicy: ""
|
||||
# -- Resource limits and requests for the Workflow Executors
|
||||
resources: {}
|
||||
# -- Passes arguments to the executor processes
|
||||
args: []
|
||||
# -- Adds environment variables for the executor.
|
||||
env: []
|
||||
# -- sets security context for the executor container
|
||||
securityContext: {}
|
||||
|
||||
server:
|
||||
# -- Deploy the Argo Server
|
||||
enabled: true
|
||||
# -- Value for base href in index.html. Used if the server is running behind reverse proxy under subpath different from /.
|
||||
## only updates base url of resources on client side,
|
||||
## it's expected that a proxy server rewrites the request URL and gets rid of this prefix
|
||||
## https://github.com/argoproj/argo-workflows/issues/716#issuecomment-433213190
|
||||
baseHref: /
|
||||
image:
|
||||
# -- Registry to use for the server
|
||||
registry: quay.io
|
||||
# -- Repository to use for the server
|
||||
repository: argoproj/argocli
|
||||
# -- Image tag for the Argo Workflows server. Defaults to `.Values.images.tag`.
|
||||
tag: ""
|
||||
# -- optional map of annotations to be applied to the ui Deployment
|
||||
deploymentAnnotations: {}
|
||||
# -- optional map of annotations to be applied to the ui Pods
|
||||
podAnnotations: {}
|
||||
# -- Optional labels to add to the UI pods
|
||||
podLabels: {}
|
||||
# -- SecurityContext to set on the server pods
|
||||
podSecurityContext: {}
|
||||
rbac:
|
||||
# -- Adds Role and RoleBinding for the server.
|
||||
create: true
|
||||
# -- Servers container-level security context
|
||||
securityContext:
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# -- Server name string
|
||||
name: server
|
||||
# -- Service type for server pods
|
||||
serviceType: ClusterIP
|
||||
# -- Service port for server
|
||||
servicePort: 2746
|
||||
# -- Service node port
|
||||
serviceNodePort: # 32746
|
||||
# -- Service port name
|
||||
servicePortName: "" # http
|
||||
|
||||
# -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files
|
||||
hostAliases: []
|
||||
# - ip: 10.20.30.40
|
||||
# hostnames:
|
||||
# - git.myhostname
|
||||
|
||||
serviceAccount:
|
||||
# -- Create a service account for the server
|
||||
create: true
|
||||
# -- Service account name
|
||||
name: ""
|
||||
# -- Labels applied to created service account
|
||||
labels: {}
|
||||
# -- Annotations applied to created service account
|
||||
annotations: {}
|
||||
|
||||
# -- Annotations to be applied to the UI Service
|
||||
serviceAnnotations: {}
|
||||
# -- Optional labels to add to the UI Service
|
||||
serviceLabels: {}
|
||||
# -- The class of the load balancer implementation
|
||||
loadBalancerClass: ""
|
||||
# -- Static IP address to assign to loadBalancer service type `LoadBalancer`
|
||||
loadBalancerIP: ""
|
||||
# -- Source ranges to allow access to service from. Only applies to service type `LoadBalancer`
|
||||
loadBalancerSourceRanges: []
|
||||
# -- Resource limits and requests for the server
|
||||
resources: {}
|
||||
# -- The number of server pods to run
|
||||
replicas: 1
|
||||
# -- The number of revisions to keep.
|
||||
revisionHistoryLimit: 10
|
||||
## Argo Server Horizontal Pod Autoscaler
|
||||
autoscaling:
|
||||
# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo Server
|
||||
enabled: false
|
||||
# -- Minimum number of replicas for the Argo Server [HPA]
|
||||
minReplicas: 1
|
||||
# -- Maximum number of replicas for the Argo Server [HPA]
|
||||
maxReplicas: 5
|
||||
# -- Average CPU utilization percentage for the Argo Server [HPA]
|
||||
targetCPUUtilizationPercentage: 50
|
||||
# -- Average memory utilization percentage for the Argo Server [HPA]
|
||||
targetMemoryUtilizationPercentage: 50
|
||||
# -- Configures the scaling behavior of the target in both Up and Down directions.
|
||||
# This is only available on HPA apiVersion `autoscaling/v2beta2` and newer
|
||||
behavior: {}
|
||||
# scaleDown:
|
||||
# stabilizationWindowSeconds: 300
|
||||
# policies:
|
||||
# - type: Pods
|
||||
# value: 1
|
||||
# periodSeconds: 180
|
||||
# scaleUp:
|
||||
# stabilizationWindowSeconds: 300
|
||||
# policies:
|
||||
# - type: Pods
|
||||
# value: 2
|
||||
pdb:
|
||||
# -- Configure [Pod Disruption Budget] for the server pods
|
||||
enabled: false
|
||||
# minAvailable: 1
|
||||
# maxUnavailable: 1
|
||||
|
||||
# -- [Node selector]
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
|
||||
# -- [Tolerations] for use with node taints
|
||||
tolerations: []
|
||||
|
||||
# -- Assign custom [affinity] rules
|
||||
affinity: {}
|
||||
|
||||
# -- Assign custom [TopologySpreadConstraints] rules to the argo server
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
||||
## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
|
||||
topologySpreadConstraints: []
|
||||
# - maxSkew: 1
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: DoNotSchedule
|
||||
|
||||
# -- Leverage a PriorityClass to ensure your pods survive resource shortages
|
||||
## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
|
||||
priorityClassName: ""
|
||||
|
||||
# -- Run the argo server in "secure" mode. Configure this value instead of `--secure` in extraArgs.
|
||||
## See the following documentation for more details on secure mode:
|
||||
## https://argo-workflows.readthedocs.io/en/stable/tls/
|
||||
secure: false
|
||||
|
||||
# -- Extra environment variables to provide to the argo-server container
|
||||
extraEnv: []
|
||||
# - name: FOO
|
||||
# value: "bar"
|
||||
|
||||
# -- Deprecated; use server.authModes instead.
|
||||
authMode: ""
|
||||
|
||||
# -- A list of supported authentication modes. Available values are `server`, `client`, or `sso`. If you provide sso, please configure `.Values.server.sso` as well.
|
||||
## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server-auth-mode/
|
||||
authModes: []
|
||||
|
||||
# -- Extra arguments to provide to the Argo server binary.
|
||||
## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server/#options
|
||||
extraArgs: []
|
||||
|
||||
logging:
|
||||
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
|
||||
level: info
|
||||
# -- Set the glog logging level
|
||||
globallevel: "0"
|
||||
# -- Set the logging format (one of: `text`, `json`)
|
||||
format: "text"
|
||||
|
||||
# -- Volume to be mounted in Pods for temporary files.
|
||||
tmpVolume:
|
||||
emptyDir: {}
|
||||
# -- Additional volume mounts to the server main container.
|
||||
volumeMounts: []
|
||||
# -- Additional volumes to the server pod.
|
||||
volumes: []
|
||||
|
||||
## Ingress configuration.
|
||||
# ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
|
||||
ingress:
|
||||
# -- Enable an ingress resource
|
||||
enabled: false
|
||||
# -- Additional ingress annotations
|
||||
annotations: {}
|
||||
# -- Additional ingress labels
|
||||
labels: {}
|
||||
# -- Defines which ingress controller will implement the resource
|
||||
ingressClassName: ""
|
||||
|
||||
# -- List of ingress hosts
|
||||
## Hostnames must be provided if Ingress is enabled.
|
||||
## Secrets must be manually created in the namespace
|
||||
hosts: []
|
||||
# - argoworkflows.example.com
|
||||
|
||||
# -- List of ingress paths
|
||||
paths:
|
||||
- /
|
||||
|
||||
# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`
|
||||
pathType: Prefix
|
||||
# -- Additional ingress paths
|
||||
extraPaths: []
|
||||
# - path: /*
|
||||
# backend:
|
||||
# serviceName: ssl-redirect
|
||||
# servicePort: use-annotation
|
||||
## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
|
||||
# - path: /*
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service
|
||||
# name: ssl-redirect
|
||||
# port:
|
||||
# name: use-annotation
|
||||
|
||||
# -- Ingress TLS configuration
|
||||
tls: []
|
||||
# - secretName: argoworkflows-example-tls
|
||||
# hosts:
|
||||
# - argoworkflows.example.com
|
||||
|
||||
## Create a Google Backendconfig for use with the GKE Ingress Controller
|
||||
## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration#configuring_ingress_features_through_backendconfig_parameters
|
||||
GKEbackendConfig:
|
||||
# -- Enable BackendConfig custom resource for Google Kubernetes Engine
|
||||
enabled: false
|
||||
# -- [BackendConfigSpec]
|
||||
spec: {}
|
||||
# spec:
|
||||
# iap:
|
||||
# enabled: true
|
||||
# oauthclientCredentials:
|
||||
# secretName: argoworkflows-secret
|
||||
|
||||
## Create a Google Managed Certificate for use with the GKE Ingress Controller
|
||||
## https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs
|
||||
GKEmanagedCertificate:
|
||||
# -- Enable ManagedCertificate custom resource for Google Kubernetes Engine.
|
||||
enabled: false
|
||||
# -- Domains for the Google Managed Certificate
|
||||
domains:
|
||||
- argoworkflows.example.com
|
||||
|
||||
## Create a Google FrontendConfig Custom Resource, for use with the GKE Ingress Controller
|
||||
## https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters
|
||||
GKEfrontendConfig:
|
||||
# -- Enable FrontConfig custom resource for Google Kubernetes Engine
|
||||
enabled: false
|
||||
# -- [FrontendConfigSpec]
|
||||
spec: {}
|
||||
# spec:
|
||||
# redirectToHttps:
|
||||
# enabled: true
|
||||
# responseCodeName: RESPONSE_CODE
|
||||
|
||||
clusterWorkflowTemplates:
|
||||
# -- Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates.
|
||||
enabled: true
|
||||
# -- Give the server permissions to edit ClusterWorkflowTemplates.
|
||||
enableEditing: true
|
||||
|
||||
# SSO configuration when SSO is specified as a server auth mode.
|
||||
sso:
|
||||
# -- Create SSO configuration. If you set `true` , please also set `.Values.server.authMode` as `sso`.
|
||||
enabled: false
|
||||
# -- The root URL of the OIDC identity provider
|
||||
issuer: https://accounts.google.com
|
||||
clientId:
|
||||
# -- Name of secret to retrieve the app OIDC client ID
|
||||
name: argo-server-sso
|
||||
# -- Key of secret to retrieve the app OIDC client ID
|
||||
key: client-id
|
||||
clientSecret:
|
||||
# -- Name of a secret to retrieve the app OIDC client secret
|
||||
name: argo-server-sso
|
||||
# -- Key of a secret to retrieve the app OIDC client secret
|
||||
key: client-secret
|
||||
# -- The OIDC redirect URL. Should be in the form <argo-root-url>/oauth2/callback.
|
||||
redirectUrl: ""
|
||||
rbac:
|
||||
# -- Adds ServiceAccount Policy to server (Cluster)Role.
|
||||
enabled: true
|
||||
# -- Whitelist to allow server to fetch Secrets
|
||||
## When present, restricts secrets the server can read to a given list.
|
||||
## You can use it to restrict the server to only be able to access the
|
||||
## service account token secrets that are associated with service accounts
|
||||
## used for authorization.
|
||||
secretWhitelist: []
|
||||
# -- Scopes requested from the SSO ID provider
|
||||
## The 'groups' scope requests group membership information, which is usually used for authorization decisions.
|
||||
scopes: []
|
||||
# - groups
|
||||
# -- Define how long your login is valid for (in hours)
|
||||
## If omitted, defaults to 10h.
|
||||
sessionExpiry: ""
|
||||
# -- Alternate root URLs that can be included for some OIDC providers
|
||||
issuerAlias: ""
|
||||
# -- Override claim name for OIDC groups
|
||||
customGroupClaimName: ""
|
||||
# -- Specify the user info endpoint that contains the groups claim
|
||||
## Configure this if your OIDC provider provides groups information only using the user-info endpoint (e.g. Okta)
|
||||
userInfoPath: ""
|
||||
# -- Skip TLS verification for the HTTP client
|
||||
insecureSkipVerify: false
|
||||
# -- Filter the groups returned by the OIDC provider
|
||||
## A logical "OR" is used between each regex in the list
|
||||
filterGroupsRegex: []
|
||||
# - ".*argo-wf.*"
|
||||
# - ".*argo-workflow.*"
|
||||
|
||||
# -- Extra containers to be added to the server deployment
|
||||
extraContainers: []
|
||||
|
||||
# -- Enables init containers to be added to the server deployment
|
||||
extraInitContainers: []
|
||||
|
||||
# -- Specify postStart and preStop lifecycle hooks for server container
|
||||
lifecycle: {}
|
||||
|
||||
# -- terminationGracePeriodSeconds for container lifecycle hook
|
||||
terminationGracePeriodSeconds: 30
|
||||
|
||||
# -- Array of extra K8s manifests to deploy
|
||||
extraObjects: []
|
||||
# - apiVersion: secrets-store.csi.x-k8s.io/v1
|
||||
# kind: SecretProviderClass
|
||||
# metadata:
|
||||
# name: argo-server-sso
|
||||
# spec:
|
||||
# provider: aws
|
||||
# parameters:
|
||||
# objects: |
|
||||
# - objectName: "argo/server/sso"
|
||||
# objectType: "secretsmanager"
|
||||
# jmesPath:
|
||||
# - path: "client_id"
|
||||
# objectAlias: "client_id"
|
||||
# - path: "client_secret"
|
||||
# objectAlias: "client_secret"
|
||||
# secretObjects:
|
||||
# - data:
|
||||
# - key: client_id
|
||||
# objectName: client_id
|
||||
# - key: client_secret
|
||||
# objectName: client_secret
|
||||
# secretName: argo-server-sso-secrets-store
|
||||
# type: Opaque
|
||||
|
||||
# -- Use static credentials for S3 (eg. when not using AWS IRSA)
|
||||
useStaticCredentials: true
|
||||
artifactRepository:
|
||||
# -- Archive the main container logs as an artifact
|
||||
archiveLogs: false
|
||||
# -- Store artifact in a S3-compliant object store
|
||||
# @default -- See [values.yaml]
|
||||
s3: {}
|
||||
# # Note the `key` attribute is not the actual secret, it's the PATH to
|
||||
# # the contents in the associated secret, as defined by the `name` attribute.
|
||||
# accessKeySecret:
|
||||
# name: "{{ .Release.Name }}-minio"
|
||||
# key: accesskey
|
||||
# secretKeySecret:
|
||||
# name: "{{ .Release.Name }}-minio"
|
||||
# key: secretkey
|
||||
# sessionTokenSecret:
|
||||
# name: "{{ .Release.Name }}-minio"
|
||||
# key: sessionToken
|
||||
# # insecure will disable TLS. Primarily used for minio installs not configured with TLS
|
||||
# insecure: false
|
||||
# caSecret:
|
||||
# name: ca-root
|
||||
# key: cert.pem
|
||||
# bucket:
|
||||
# endpoint:
|
||||
# region:
|
||||
# roleARN:
|
||||
# useSDKCreds: true
|
||||
# encryptionOptions:
|
||||
# enableEncryption: true
|
||||
# -- Store artifact in a GCS object store
|
||||
# @default -- `{}` (See [values.yaml])
|
||||
gcs: {}
|
||||
# bucket: <project>-argo
|
||||
# keyFormat: "{{ \"{{workflow.namespace}}/{{workflow.name}}/{{pod.name}}\" }}"
|
||||
# # serviceAccountKeySecret is a secret selector.
|
||||
# # It references the k8s secret named 'my-gcs-credentials'.
|
||||
# # This secret is expected to have have the key 'serviceAccountKey',
|
||||
# # containing the base64 encoded credentials
|
||||
# # to the bucket.
|
||||
# #
|
||||
# # If it's running on GKE and Workload Identity is used,
|
||||
# # serviceAccountKeySecret is not needed.
|
||||
# serviceAccountKeySecret:
|
||||
# name: my-gcs-credentials
|
||||
# key: serviceAccountKey
|
||||
# -- Store artifact in Azure Blob Storage
|
||||
# @default -- `{}` (See [values.yaml])
|
||||
azure: {}
|
||||
# endpoint: https://mystorageaccountname.blob.core.windows.net
|
||||
# container: my-container-name
|
||||
# blobNameFormat: path/in/container
|
||||
# # accountKeySecret is a secret selector.
|
||||
# # It references the k8s secret named 'my-azure-storage-credentials'.
|
||||
# # This secret is expected to have have the key 'account-access-key',
|
||||
# # containing the base64 encoded credentials to the storage account.
|
||||
# # If a managed identity has been assigned to the machines running the
|
||||
# # workflow (e.g., https://docs.microsoft.com/en-us/azure/aks/use-managed-identity)
|
||||
# # then accountKeySecret is not needed, and useSDKCreds should be
|
||||
# # set to true instead:
|
||||
# useSDKCreds: true
|
||||
# accountKeySecret:
|
||||
# name: my-azure-storage-credentials
|
||||
# key: account-access-key
|
||||
|
||||
# -- The section of custom artifact repository.
|
||||
# Utilize a custom artifact repository that is not one of the current base ones (s3, gcs, azure)
|
||||
customArtifactRepository: {}
|
||||
# artifactory:
|
||||
# repoUrl: https://artifactory.example.com/raw
|
||||
# usernameSecret:
|
||||
# name: artifactory-creds
|
||||
# key: username
|
||||
# passwordSecret:
|
||||
# name: artifactory-creds
|
||||
# key: password
|
||||
|
||||
# -- The section of [artifact repository ref](https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/).
|
||||
# Each map key is the name of configmap
|
||||
# @default -- `{}` (See [values.yaml])
|
||||
artifactRepositoryRef: {}
|
||||
# # -- 1st ConfigMap
|
||||
# # If you want to use this config map by default, name it "artifact-repositories".
|
||||
# # Otherwise, you can provide a reference to a
|
||||
# # different config map in `artifactRepositoryRef.configMap`.
|
||||
# artifact-repositories:
|
||||
# # -- v3.0 and after - if you want to use a specific key, put that key into this annotation.
|
||||
# annotations:
|
||||
# workflows.argoproj.io/default-artifact-repository: default-v1-s3-artifact-repository
|
||||
# # 1st data of configmap. See above artifactRepository or customArtifactRepository.
|
||||
# default-v1-s3-artifact-repository:
|
||||
# archiveLogs: false
|
||||
# s3:
|
||||
# bucket: my-bucket
|
||||
# endpoint: minio:9000
|
||||
# insecure: true
|
||||
# accessKeySecret:
|
||||
# name: my-minio-cred
|
||||
# key: accesskey
|
||||
# secretKeySecret:
|
||||
# name: my-minio-cred
|
||||
# key: secretkey
|
||||
# # 2nd data
|
||||
# oss-artifact-repository:
|
||||
# archiveLogs: false
|
||||
# oss:
|
||||
# endpoint: http://oss-cn-zhangjiakou-internal.aliyuncs.com
|
||||
# bucket: $mybucket
|
||||
# # accessKeySecret and secretKeySecret are secret selectors.
|
||||
# # It references the k8s secret named 'bucket-workflow-artifect-credentials'.
|
||||
# # This secret is expected to have have the keys 'accessKey'
|
||||
# # and 'secretKey', containing the base64 encoded credentials
|
||||
# # to the bucket.
|
||||
# accessKeySecret:
|
||||
# name: $mybucket-credentials
|
||||
# key: accessKey
|
||||
# secretKeySecret:
|
||||
# name: $mybucket-credentials
|
||||
# key: secretKey
|
||||
# # 2nd ConfigMap
|
||||
# another-artifact-repositories:
|
||||
# annotations:
|
||||
# workflows.argoproj.io/default-artifact-repository: gcs
|
||||
# gcs:
|
||||
# bucket: my-bucket
|
||||
# keyFormat: prefix/in/bucket/{{workflow.name}}/{{pod.name}}
|
||||
# serviceAccountKeySecret:
|
||||
# name: my-gcs-credentials
|
||||
# key: serviceAccountKey
|
||||
|
||||
emissary:
|
||||
# -- The command/args for each image on workflow, needed when the command is not specified and the emissary executor is used.
|
||||
## See more: https://argo-workflows.readthedocs.io/en/stable/workflow-executors/#emissary-emissary
|
||||
images: []
|
||||
# argoproj/argosay:v2:
|
||||
# cmd: [/argosay]
|
||||
# docker/whalesay:latest:
|
||||
# cmd: [/bin/bash]
|
||||
@ -1,23 +0,0 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.vscode
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
OWNERS
|
||||
@ -1,35 +0,0 @@
|
||||
annotations:
|
||||
artifacthub.io/license: Apache-2.0
|
||||
artifacthub.io/links: |
|
||||
- name: Chart Source
|
||||
url: https://github.com/grafana/helm-charts
|
||||
- name: Upstream Project
|
||||
url: https://github.com/grafana/grafana
|
||||
apiVersion: v2
|
||||
appVersion: 11.3.1
|
||||
description: The leading tool for querying and visualizing time series and metrics.
|
||||
home: https://grafana.com
|
||||
icon: https://artifacthub.io/image/b4fed1a7-6c8f-4945-b99d-096efa3e4116
|
||||
keywords:
|
||||
- monitoring
|
||||
- metric
|
||||
kubeVersion: ^1.8.0-0
|
||||
maintainers:
|
||||
- email: zanhsieh@gmail.com
|
||||
name: zanhsieh
|
||||
- email: rluckie@cisco.com
|
||||
name: rtluckie
|
||||
- email: maor.friedman@redhat.com
|
||||
name: maorfr
|
||||
- email: miroslav.hadzhiev@gmail.com
|
||||
name: Xtigyro
|
||||
- email: mail@torstenwalter.de
|
||||
name: torstenwalter
|
||||
- email: github@jkroepke.de
|
||||
name: jkroepke
|
||||
name: grafana
|
||||
sources:
|
||||
- https://github.com/grafana/grafana
|
||||
- https://github.com/grafana/helm-charts
|
||||
type: application
|
||||
version: 8.6.4
|
||||
@ -1,783 +0,0 @@
|
||||
# Grafana Helm Chart
|
||||
|
||||
* Installs the web dashboarding system [Grafana](http://grafana.org/)
|
||||
|
||||
## Get Repo Info
|
||||
|
||||
```console
|
||||
helm repo add grafana https://grafana.github.io/helm-charts
|
||||
helm repo update
|
||||
```
|
||||
|
||||
_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
helm install my-release grafana/grafana
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the my-release deployment:
|
||||
|
||||
```console
|
||||
helm delete my-release
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
## Upgrading an existing Release to a new major version
|
||||
|
||||
A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an
|
||||
incompatible breaking change needing manual actions.
|
||||
|
||||
### To 4.0.0 (And 3.12.1)
|
||||
|
||||
This version requires Helm >= 2.12.0.
|
||||
|
||||
### To 5.0.0
|
||||
|
||||
You have to add --force to your helm upgrade command as the labels of the chart have changed.
|
||||
|
||||
### To 6.0.0
|
||||
|
||||
This version requires Helm >= 3.1.0.
|
||||
|
||||
### To 7.0.0
|
||||
|
||||
For consistency with other Helm charts, the `global.image.registry` parameter was renamed
|
||||
to `global.imageRegistry`. If you were not previously setting `global.image.registry`, no action
|
||||
is required on upgrade. If you were previously setting `global.image.registry`, you will
|
||||
need to instead set `global.imageRegistry`.
|
||||
|
||||
## Configuration
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-------------------------------------------|-----------------------------------------------|---------------------------------------------------------|
|
||||
| `replicas` | Number of nodes | `1` |
|
||||
| `podDisruptionBudget.minAvailable` | Pod disruption minimum available | `nil` |
|
||||
| `podDisruptionBudget.maxUnavailable` | Pod disruption maximum unavailable | `nil` |
|
||||
| `podDisruptionBudget.apiVersion` | Pod disruption apiVersion | `nil` |
|
||||
| `deploymentStrategy` | Deployment strategy | `{ "type": "RollingUpdate" }` |
|
||||
| `livenessProbe` | Liveness Probe settings | `{ "httpGet": { "path": "/api/health", "port": 3000 } "initialDelaySeconds": 60, "timeoutSeconds": 30, "failureThreshold": 10 }` |
|
||||
| `readinessProbe` | Readiness Probe settings | `{ "httpGet": { "path": "/api/health", "port": 3000 } }`|
|
||||
| `securityContext` | Deployment securityContext | `{"runAsUser": 472, "runAsGroup": 472, "fsGroup": 472}` |
|
||||
| `priorityClassName` | Name of Priority Class to assign pods | `nil` |
|
||||
| `image.registry` | Image registry | `docker.io` |
|
||||
| `image.repository` | Image repository | `grafana/grafana` |
|
||||
| `image.tag` | Overrides the Grafana image tag whose default is the chart appVersion (`Must be >= 5.0.0`) | `` |
|
||||
| `image.sha` | Image sha (optional) | `` |
|
||||
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | Image pull secrets (can be templated) | `[]` |
|
||||
| `service.enabled` | Enable grafana service | `true` |
|
||||
| `service.ipFamilies` | Kubernetes service IP families | `[]` |
|
||||
| `service.ipFamilyPolicy` | Kubernetes service IP family policy | `""` |
|
||||
| `service.type` | Kubernetes service type | `ClusterIP` |
|
||||
| `service.port` | Kubernetes port where service is exposed | `80` |
|
||||
| `service.portName` | Name of the port on the service | `service` |
|
||||
| `service.appProtocol` | Adds the appProtocol field to the service | `` |
|
||||
| `service.targetPort` | Internal service is port | `3000` |
|
||||
| `service.nodePort` | Kubernetes service nodePort | `nil` |
|
||||
| `service.annotations` | Service annotations (can be templated) | `{}` |
|
||||
| `service.labels` | Custom labels | `{}` |
|
||||
| `service.clusterIP` | internal cluster service IP | `nil` |
|
||||
| `service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `nil` |
|
||||
| `service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to lb (if supported) | `[]` |
|
||||
| `service.externalIPs` | service external IP addresses | `[]` |
|
||||
| `service.externalTrafficPolicy` | change the default externalTrafficPolicy | `nil` |
|
||||
| `headlessService` | Create a headless service | `false` |
|
||||
| `extraExposePorts` | Additional service ports for sidecar containers| `[]` |
|
||||
| `hostAliases` | adds rules to the pod's /etc/hosts | `[]` |
|
||||
| `ingress.enabled` | Enables Ingress | `false` |
|
||||
| `ingress.annotations` | Ingress annotations (values are templated) | `{}` |
|
||||
| `ingress.labels` | Custom labels | `{}` |
|
||||
| `ingress.path` | Ingress accepted path | `/` |
|
||||
| `ingress.pathType` | Ingress type of path | `Prefix` |
|
||||
| `ingress.hosts` | Ingress accepted hostnames | `["chart-example.local"]` |
|
||||
| `ingress.extraPaths` | Ingress extra paths to prepend to every host configuration. Useful when configuring [custom actions with AWS ALB Ingress Controller](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.6/guide/ingress/annotations/#actions). Requires `ingress.hosts` to have one or more host entries. | `[]` |
|
||||
| `ingress.tls` | Ingress TLS configuration | `[]` |
|
||||
| `ingress.ingressClassName` | Ingress Class Name. MAY be required for Kubernetes versions >= 1.18 | `""` |
|
||||
| `resources` | CPU/Memory resource requests/limits | `{}` |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | Toleration labels for pod assignment | `[]` |
|
||||
| `affinity` | Affinity settings for pod assignment | `{}` |
|
||||
| `extraInitContainers` | Init containers to add to the grafana pod | `{}` |
|
||||
| `extraContainers` | Sidecar containers to add to the grafana pod | `""` |
|
||||
| `extraContainerVolumes` | Volumes that can be mounted in sidecar containers | `[]` |
|
||||
| `extraLabels` | Custom labels for all manifests | `{}` |
|
||||
| `schedulerName` | Name of the k8s scheduler (other than default) | `nil` |
|
||||
| `persistence.enabled` | Use persistent volume to store data | `false` |
|
||||
| `persistence.type` | Type of persistence (`pvc` or `statefulset`) | `pvc` |
|
||||
| `persistence.size` | Size of persistent volume claim | `10Gi` |
|
||||
| `persistence.existingClaim` | Use an existing PVC to persist data (can be templated) | `nil` |
|
||||
| `persistence.storageClassName` | Type of persistent volume claim | `nil` |
|
||||
| `persistence.accessModes` | Persistence access modes | `[ReadWriteOnce]` |
|
||||
| `persistence.annotations` | PersistentVolumeClaim annotations | `{}` |
|
||||
| `persistence.finalizers` | PersistentVolumeClaim finalizers | `[ "kubernetes.io/pvc-protection" ]` |
|
||||
| `persistence.extraPvcLabels` | Extra labels to apply to a PVC. | `{}` |
|
||||
| `persistence.subPath` | Mount a sub dir of the persistent volume (can be templated) | `nil` |
|
||||
| `persistence.inMemory.enabled` | If persistence is not enabled, whether to mount the local storage in-memory to improve performance | `false` |
|
||||
| `persistence.inMemory.sizeLimit` | SizeLimit for the in-memory local storage | `nil` |
|
||||
| `persistence.disableWarning` | Hide NOTES warning, useful when persisting to a database | `false` |
|
||||
| `initChownData.enabled` | If false, don't reset data ownership at startup | true |
|
||||
| `initChownData.image.registry` | init-chown-data container image registry | `docker.io` |
|
||||
| `initChownData.image.repository` | init-chown-data container image repository | `busybox` |
|
||||
| `initChownData.image.tag` | init-chown-data container image tag | `1.31.1` |
|
||||
| `initChownData.image.sha` | init-chown-data container image sha (optional)| `""` |
|
||||
| `initChownData.image.pullPolicy` | init-chown-data container image pull policy | `IfNotPresent` |
|
||||
| `initChownData.resources` | init-chown-data pod resource requests & limits | `{}` |
|
||||
| `schedulerName` | Alternate scheduler name | `nil` |
|
||||
| `env` | Extra environment variables passed to pods | `{}` |
|
||||
| `envValueFrom` | Environment variables from alternate sources. See the API docs on [EnvVarSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#envvarsource-v1-core) for format details. Can be templated | `{}` |
|
||||
| `envFromSecret` | Name of a Kubernetes secret (must be manually created in the same namespace) containing values to be added to the environment. Can be templated | `""` |
|
||||
| `envFromSecrets` | List of Kubernetes secrets (must be manually created in the same namespace) containing values to be added to the environment. Can be templated | `[]` |
|
||||
| `envFromConfigMaps` | List of Kubernetes ConfigMaps (must be manually created in the same namespace) containing values to be added to the environment. Can be templated | `[]` |
|
||||
| `envRenderSecret` | Sensible environment variables passed to pods and stored as secret. (passed through [tpl](https://helm.sh/docs/howto/charts_tips_and_tricks/#using-the-tpl-function)) | `{}` |
|
||||
| `enableServiceLinks` | Inject Kubernetes services as environment variables. | `true` |
|
||||
| `extraSecretMounts` | Additional grafana server secret mounts | `[]` |
|
||||
| `extraVolumeMounts` | Additional grafana server volume mounts | `[]` |
|
||||
| `extraVolumes` | Additional Grafana server volumes | `[]` |
|
||||
| `automountServiceAccountToken` | Mounted the service account token on the grafana pod. Mandatory, if sidecars are enabled | `true` |
|
||||
| `createConfigmap` | Enable creating the grafana configmap | `true` |
|
||||
| `extraConfigmapMounts` | Additional grafana server configMap volume mounts (values are templated) | `[]` |
|
||||
| `extraEmptyDirMounts` | Additional grafana server emptyDir volume mounts | `[]` |
|
||||
| `plugins` | Plugins to be loaded along with Grafana | `[]` |
|
||||
| `datasources` | Configure grafana datasources (passed through tpl) | `{}` |
|
||||
| `alerting` | Configure grafana alerting (passed through tpl) | `{}` |
|
||||
| `notifiers` | Configure grafana notifiers | `{}` |
|
||||
| `dashboardProviders` | Configure grafana dashboard providers | `{}` |
|
||||
| `dashboards` | Dashboards to import | `{}` |
|
||||
| `dashboardsConfigMaps` | ConfigMaps reference that contains dashboards | `{}` |
|
||||
| `grafana.ini` | Grafana's primary configuration | `{}` |
|
||||
| `global.imageRegistry` | Global image pull registry for all images. | `null` |
|
||||
| `global.imagePullSecrets` | Global image pull secrets (can be templated). Allows either an array of {name: pullSecret} maps (k8s-style), or an array of strings (more common helm-style). | `[]` |
|
||||
| `ldap.enabled` | Enable LDAP authentication | `false` |
|
||||
| `ldap.existingSecret` | The name of an existing secret containing the `ldap.toml` file, this must have the key `ldap-toml`. | `""` |
|
||||
| `ldap.config` | Grafana's LDAP configuration | `""` |
|
||||
| `annotations` | Deployment annotations | `{}` |
|
||||
| `labels` | Deployment labels | `{}` |
|
||||
| `podAnnotations` | Pod annotations | `{}` |
|
||||
| `podLabels` | Pod labels | `{}` |
|
||||
| `podPortName` | Name of the grafana port on the pod | `grafana` |
|
||||
| `lifecycleHooks` | Lifecycle hooks for podStart and preStop [Example](https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/#define-poststart-and-prestop-handlers) | `{}` |
|
||||
| `sidecar.image.registry` | Sidecar image registry | `quay.io` |
|
||||
| `sidecar.image.repository` | Sidecar image repository | `kiwigrid/k8s-sidecar` |
|
||||
| `sidecar.image.tag` | Sidecar image tag | `1.28.0` |
|
||||
| `sidecar.image.sha` | Sidecar image sha (optional) | `""` |
|
||||
| `sidecar.imagePullPolicy` | Sidecar image pull policy | `IfNotPresent` |
|
||||
| `sidecar.resources` | Sidecar resources | `{}` |
|
||||
| `sidecar.securityContext` | Sidecar securityContext | `{}` |
|
||||
| `sidecar.enableUniqueFilenames` | Sets the kiwigrid/k8s-sidecar UNIQUE_FILENAMES environment variable. If set to `true` the sidecar will create unique filenames where duplicate data keys exist between ConfigMaps and/or Secrets within the same or multiple Namespaces. | `false` |
|
||||
| `sidecar.alerts.enabled` | Enables the cluster wide search for alerts and adds/updates/deletes them in grafana |`false` |
|
||||
| `sidecar.alerts.label` | Label that config maps with alerts should have to be added | `grafana_alert` |
|
||||
| `sidecar.alerts.labelValue` | Label value that config maps with alerts should have to be added | `""` |
|
||||
| `sidecar.alerts.searchNamespace` | Namespaces list. If specified, the sidecar will search for alerts config-maps inside these namespaces. Otherwise the namespace in which the sidecar is running will be used. It's also possible to specify ALL to search in all namespaces. | `nil` |
|
||||
| `sidecar.alerts.watchMethod` | Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds. | `WATCH` |
|
||||
| `sidecar.alerts.resource` | Should the sidecar looks into secrets, configmaps or both. | `both` |
|
||||
| `sidecar.alerts.reloadURL` | Full url of datasource configuration reload API endpoint, to invoke after a config-map change | `"http://localhost:3000/api/admin/provisioning/alerting/reload"` |
|
||||
| `sidecar.alerts.skipReload` | Enabling this omits defining the REQ_URL and REQ_METHOD environment variables | `false` |
|
||||
| `sidecar.alerts.initAlerts` | Set to true to deploy the alerts sidecar as an initContainer. This is needed if skipReload is true, to load any alerts defined at startup time. | `false` |
|
||||
| `sidecar.alerts.extraMounts` | Additional alerts sidecar volume mounts. | `[]` |
|
||||
| `sidecar.dashboards.enabled` | Enables the cluster wide search for dashboards and adds/updates/deletes them in grafana | `false` |
|
||||
| `sidecar.dashboards.SCProvider` | Enables creation of sidecar provider | `true` |
|
||||
| `sidecar.dashboards.provider.name` | Unique name of the grafana provider | `sidecarProvider` |
|
||||
| `sidecar.dashboards.provider.orgid` | Id of the organisation, to which the dashboards should be added | `1` |
|
||||
| `sidecar.dashboards.provider.folder` | Logical folder in which grafana groups dashboards | `""` |
|
||||
| `sidecar.dashboards.provider.folderUid` | Allows you to specify the static UID for the logical folder above | `""` |
|
||||
| `sidecar.dashboards.provider.disableDelete` | Activate to avoid the deletion of imported dashboards | `false` |
|
||||
| `sidecar.dashboards.provider.allowUiUpdates` | Allow updating provisioned dashboards from the UI | `false` |
|
||||
| `sidecar.dashboards.provider.type` | Provider type | `file` |
|
||||
| `sidecar.dashboards.provider.foldersFromFilesStructure` | Allow Grafana to replicate dashboard structure from filesystem. | `false` |
|
||||
| `sidecar.dashboards.watchMethod` | Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds. | `WATCH` |
|
||||
| `sidecar.skipTlsVerify` | Set to true to skip tls verification for kube api calls | `nil` |
|
||||
| `sidecar.dashboards.label` | Label that config maps with dashboards should have to be added | `grafana_dashboard` |
|
||||
| `sidecar.dashboards.labelValue` | Label value that config maps with dashboards should have to be added | `""` |
|
||||
| `sidecar.dashboards.folder` | Folder in the pod that should hold the collected dashboards (unless `sidecar.dashboards.defaultFolderName` is set). This path will be mounted. | `/tmp/dashboards` |
|
||||
| `sidecar.dashboards.folderAnnotation` | The annotation the sidecar will look for in configmaps to override the destination folder for files | `nil` |
|
||||
| `sidecar.dashboards.defaultFolderName` | The default folder name, it will create a subfolder under the `sidecar.dashboards.folder` and put dashboards in there instead | `nil` |
|
||||
| `sidecar.dashboards.searchNamespace` | Namespaces list. If specified, the sidecar will search for dashboards config-maps inside these namespaces. Otherwise the namespace in which the sidecar is running will be used. It's also possible to specify ALL to search in all namespaces. | `nil` |
|
||||
| `sidecar.dashboards.script` | Absolute path to shell script to execute after a configmap got reloaded. | `nil` |
|
||||
| `sidecar.dashboards.reloadURL` | Full url of dashboards configuration reload API endpoint, to invoke after a config-map change | `"http://localhost:3000/api/admin/provisioning/dashboards/reload"` |
|
||||
| `sidecar.dashboards.skipReload` | Enabling this omits defining the REQ_USERNAME, REQ_PASSWORD, REQ_URL and REQ_METHOD environment variables | `false` |
|
||||
| `sidecar.dashboards.resource` | Should the sidecar looks into secrets, configmaps or both. | `both` |
|
||||
| `sidecar.dashboards.extraMounts` | Additional dashboard sidecar volume mounts. | `[]` |
|
||||
| `sidecar.datasources.enabled` | Enables the cluster wide search for datasources and adds/updates/deletes them in grafana |`false` |
|
||||
| `sidecar.datasources.label` | Label that config maps with datasources should have to be added | `grafana_datasource` |
|
||||
| `sidecar.datasources.labelValue` | Label value that config maps with datasources should have to be added | `""` |
|
||||
| `sidecar.datasources.searchNamespace` | Namespaces list. If specified, the sidecar will search for datasources config-maps inside these namespaces. Otherwise the namespace in which the sidecar is running will be used. It's also possible to specify ALL to search in all namespaces. | `nil` |
|
||||
| `sidecar.datasources.watchMethod` | Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds. | `WATCH` |
|
||||
| `sidecar.datasources.resource` | Should the sidecar looks into secrets, configmaps or both. | `both` |
|
||||
| `sidecar.datasources.reloadURL` | Full url of datasource configuration reload API endpoint, to invoke after a config-map change | `"http://localhost:3000/api/admin/provisioning/datasources/reload"` |
|
||||
| `sidecar.datasources.skipReload` | Enabling this omits defining the REQ_URL and REQ_METHOD environment variables | `false` |
|
||||
| `sidecar.datasources.initDatasources` | Set to true to deploy the datasource sidecar as an initContainer in addition to a container. This is needed if skipReload is true, to load any datasources defined at startup time. | `false` |
|
||||
| `sidecar.notifiers.enabled` | Enables the cluster wide search for notifiers and adds/updates/deletes them in grafana | `false` |
|
||||
| `sidecar.notifiers.label` | Label that config maps with notifiers should have to be added | `grafana_notifier` |
|
||||
| `sidecar.notifiers.labelValue` | Label value that config maps with notifiers should have to be added | `""` |
|
||||
| `sidecar.notifiers.searchNamespace` | Namespaces list. If specified, the sidecar will search for notifiers config-maps (or secrets) inside these namespaces. Otherwise the namespace in which the sidecar is running will be used. It's also possible to specify ALL to search in all namespaces. | `nil` |
|
||||
| `sidecar.notifiers.watchMethod` | Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH requests, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds. | `WATCH` |
|
||||
| `sidecar.notifiers.resource` | Should the sidecar looks into secrets, configmaps or both. | `both` |
|
||||
| `sidecar.notifiers.reloadURL` | Full url of notifier configuration reload API endpoint, to invoke after a config-map change | `"http://localhost:3000/api/admin/provisioning/notifications/reload"` |
|
||||
| `sidecar.notifiers.skipReload` | Enabling this omits defining the REQ_URL and REQ_METHOD environment variables | `false` |
|
||||
| `sidecar.notifiers.initNotifiers` | Set to true to deploy the notifier sidecar as an initContainer in addition to a container. This is needed if skipReload is true, to load any notifiers defined at startup time. | `false` |
|
||||
| `smtp.existingSecret` | The name of an existing secret containing the SMTP credentials. | `""` |
|
||||
| `smtp.userKey` | The key in the existing SMTP secret containing the username. | `"user"` |
|
||||
| `smtp.passwordKey` | The key in the existing SMTP secret containing the password. | `"password"` |
|
||||
| `admin.existingSecret` | The name of an existing secret containing the admin credentials (can be templated). | `""` |
|
||||
| `admin.userKey` | The key in the existing admin secret containing the username. | `"admin-user"` |
|
||||
| `admin.passwordKey` | The key in the existing admin secret containing the password. | `"admin-password"` |
|
||||
| `serviceAccount.automountServiceAccountToken` | Automount the service account token on all pods where is service account is used | `false` |
|
||||
| `serviceAccount.annotations` | ServiceAccount annotations | |
|
||||
| `serviceAccount.create` | Create service account | `true` |
|
||||
| `serviceAccount.labels` | ServiceAccount labels | `{}` |
|
||||
| `serviceAccount.name` | Service account name to use, when empty will be set to created account if `serviceAccount.create` is set else to `default` | `` |
|
||||
| `serviceAccount.nameTest` | Service account name to use for test, when empty will be set to created account if `serviceAccount.create` is set else to `default` | `nil` |
|
||||
| `rbac.create` | Create and use RBAC resources | `true` |
|
||||
| `rbac.namespaced` | Creates Role and Rolebinding instead of the default ClusterRole and ClusteRoleBindings for the grafana instance | `false` |
|
||||
| `rbac.useExistingRole` | Set to a rolename to use existing role - skipping role creating - but still doing serviceaccount and rolebinding to the rolename set here. | `nil` |
|
||||
| `rbac.pspEnabled` | Create PodSecurityPolicy (with `rbac.create`, grant roles permissions as well) | `false` |
|
||||
| `rbac.pspUseAppArmor` | Enforce AppArmor in created PodSecurityPolicy (requires `rbac.pspEnabled`) | `false` |
|
||||
| `rbac.extraRoleRules` | Additional rules to add to the Role | [] |
|
||||
| `rbac.extraClusterRoleRules` | Additional rules to add to the ClusterRole | [] |
|
||||
| `command` | Define command to be executed by grafana container at startup | `nil` |
|
||||
| `args` | Define additional args if command is used | `nil` |
|
||||
| `testFramework.enabled` | Whether to create test-related resources | `true` |
|
||||
| `testFramework.image.registry` | `test-framework` image registry. | `docker.io` |
|
||||
| `testFramework.image.repository` | `test-framework` image repository. | `bats/bats` |
|
||||
| `testFramework.image.tag` | `test-framework` image tag. | `v1.4.1` |
|
||||
| `testFramework.imagePullPolicy` | `test-framework` image pull policy. | `IfNotPresent` |
|
||||
| `testFramework.securityContext` | `test-framework` securityContext | `{}` |
|
||||
| `downloadDashboards.env` | Environment variables to be passed to the `download-dashboards` container | `{}` |
|
||||
| `downloadDashboards.envFromSecret` | Name of a Kubernetes secret (must be manually created in the same namespace) containing values to be added to the environment. Can be templated | `""` |
|
||||
| `downloadDashboards.resources` | Resources of `download-dashboards` container | `{}` |
|
||||
| `downloadDashboardsImage.registry` | Curl docker image registry | `docker.io` |
|
||||
| `downloadDashboardsImage.repository` | Curl docker image repository | `curlimages/curl` |
|
||||
| `downloadDashboardsImage.tag` | Curl docker image tag | `7.73.0` |
|
||||
| `downloadDashboardsImage.sha` | Curl docker image sha (optional) | `""` |
|
||||
| `downloadDashboardsImage.pullPolicy` | Curl docker image pull policy | `IfNotPresent` |
|
||||
| `namespaceOverride` | Override the deployment namespace | `""` (`Release.Namespace`) |
|
||||
| `serviceMonitor.enabled` | Use servicemonitor from prometheus operator | `false` |
|
||||
| `serviceMonitor.namespace` | Namespace this servicemonitor is installed in | |
|
||||
| `serviceMonitor.interval` | How frequently Prometheus should scrape | `1m` |
|
||||
| `serviceMonitor.path` | Path to scrape | `/metrics` |
|
||||
| `serviceMonitor.scheme` | Scheme to use for metrics scraping | `http` |
|
||||
| `serviceMonitor.tlsConfig` | TLS configuration block for the endpoint | `{}` |
|
||||
| `serviceMonitor.labels` | Labels for the servicemonitor passed to Prometheus Operator | `{}` |
|
||||
| `serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `30s` |
|
||||
| `serviceMonitor.relabelings` | RelabelConfigs to apply to samples before scraping. | `[]` |
|
||||
| `serviceMonitor.metricRelabelings` | MetricRelabelConfigs to apply to samples before ingestion. | `[]` |
|
||||
| `revisionHistoryLimit` | Number of old ReplicaSets to retain | `10` |
|
||||
| `imageRenderer.enabled` | Enable the image-renderer deployment & service | `false` |
|
||||
| `imageRenderer.image.registry` | image-renderer Image registry | `docker.io` |
|
||||
| `imageRenderer.image.repository` | image-renderer Image repository | `grafana/grafana-image-renderer` |
|
||||
| `imageRenderer.image.tag` | image-renderer Image tag | `latest` |
|
||||
| `imageRenderer.image.sha` | image-renderer Image sha (optional) | `""` |
|
||||
| `imageRenderer.image.pullPolicy` | image-renderer ImagePullPolicy | `Always` |
|
||||
| `imageRenderer.env` | extra env-vars for image-renderer | `{}` |
|
||||
| `imageRenderer.envValueFrom` | Environment variables for image-renderer from alternate sources. See the API docs on [EnvVarSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#envvarsource-v1-core) for format details. Can be templated | `{}` |
|
||||
| `imageRenderer.extraConfigmapMounts` | Additional image-renderer configMap volume mounts (values are templated) | `[]` |
|
||||
| `imageRenderer.extraSecretMounts` | Additional image-renderer secret volume mounts | `[]` |
|
||||
| `imageRenderer.extraVolumeMounts` | Additional image-renderer volume mounts | `[]` |
|
||||
| `imageRenderer.extraVolumes` | Additional image-renderer volumes | `[]` |
|
||||
| `imageRenderer.serviceAccountName` | image-renderer deployment serviceAccountName | `""` |
|
||||
| `imageRenderer.securityContext` | image-renderer deployment securityContext | `{}` |
|
||||
| `imageRenderer.podAnnotations` | image-renderer image-renderer pod annotation | `{}` |
|
||||
| `imageRenderer.hostAliases` | image-renderer deployment Host Aliases | `[]` |
|
||||
| `imageRenderer.priorityClassName` | image-renderer deployment priority class | `''` |
|
||||
| `imageRenderer.service.enabled` | Enable the image-renderer service | `true` |
|
||||
| `imageRenderer.service.portName` | image-renderer service port name | `http` |
|
||||
| `imageRenderer.service.port` | image-renderer port used by deployment | `8081` |
|
||||
| `imageRenderer.service.targetPort` | image-renderer service port used by service | `8081` |
|
||||
| `imageRenderer.appProtocol` | Adds the appProtocol field to the service | `` |
|
||||
| `imageRenderer.grafanaSubPath` | Grafana sub path to use for image renderer callback url | `''` |
|
||||
| `imageRenderer.serverURL` | Remote image renderer url | `''` |
|
||||
| `imageRenderer.renderingCallbackURL` | Callback url for the Grafana image renderer | `''` |
|
||||
| `imageRenderer.podPortName` | name of the image-renderer port on the pod | `http` |
|
||||
| `imageRenderer.revisionHistoryLimit` | number of image-renderer replica sets to keep | `10` |
|
||||
| `imageRenderer.networkPolicy.limitIngress` | Enable a NetworkPolicy to limit inbound traffic from only the created grafana pods | `true` |
|
||||
| `imageRenderer.networkPolicy.limitEgress` | Enable a NetworkPolicy to limit outbound traffic to only the created grafana pods | `false` |
|
||||
| `imageRenderer.resources` | Set resource limits for image-renderer pods | `{}` |
|
||||
| `imageRenderer.nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `imageRenderer.tolerations` | Toleration labels for pod assignment | `[]` |
|
||||
| `imageRenderer.affinity` | Affinity settings for pod assignment | `{}` |
|
||||
| `networkPolicy.enabled` | Enable creation of NetworkPolicy resources. | `false` |
|
||||
| `networkPolicy.allowExternal` | Don't require client label for connections | `true` |
|
||||
| `networkPolicy.explicitNamespacesSelector` | A Kubernetes LabelSelector to explicitly select namespaces from which traffic could be allowed | `{}` |
|
||||
| `networkPolicy.ingress` | Enable the creation of an ingress network policy | `true` |
|
||||
| `networkPolicy.egress.enabled` | Enable the creation of an egress network policy | `false` |
|
||||
| `networkPolicy.egress.ports` | An array of ports to allow for the egress | `[]` |
|
||||
| `enableKubeBackwardCompatibility` | Enable backward compatibility of kubernetes where pod's defintion version below 1.13 doesn't have the enableServiceLinks option | `false` |
|
||||
|
||||
### Example ingress with path
|
||||
|
||||
With grafana 6.3 and above
|
||||
|
||||
```yaml
|
||||
grafana.ini:
|
||||
server:
|
||||
domain: monitoring.example.com
|
||||
root_url: "%(protocol)s://%(domain)s/grafana"
|
||||
serve_from_sub_path: true
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- "monitoring.example.com"
|
||||
path: "/grafana"
|
||||
```
|
||||
|
||||
### Example of extraVolumeMounts and extraVolumes
|
||||
|
||||
Configure additional volumes with `extraVolumes` and volume mounts with `extraVolumeMounts`.
|
||||
|
||||
Example for `extraVolumeMounts` and corresponding `extraVolumes`:
|
||||
|
||||
```yaml
|
||||
extraVolumeMounts:
|
||||
- name: plugins
|
||||
mountPath: /var/lib/grafana/plugins
|
||||
subPath: configs/grafana/plugins
|
||||
readOnly: false
|
||||
- name: dashboards
|
||||
mountPath: /var/lib/grafana/dashboards
|
||||
hostPath: /usr/shared/grafana/dashboards
|
||||
readOnly: false
|
||||
|
||||
extraVolumes:
|
||||
- name: plugins
|
||||
existingClaim: existing-grafana-claim
|
||||
- name: dashboards
|
||||
hostPath: /usr/shared/grafana/dashboards
|
||||
```
|
||||
|
||||
Volumes default to `emptyDir`. Set to `persistentVolumeClaim`,
|
||||
`hostPath`, `csi`, or `configMap` for other types. For a
|
||||
`persistentVolumeClaim`, specify an existing claim name with
|
||||
`existingClaim`.
|
||||
|
||||
## Import dashboards
|
||||
|
||||
There are a few methods to import dashboards to Grafana. Below are some examples and explanations as to how to use each method:
|
||||
|
||||
```yaml
|
||||
dashboards:
|
||||
default:
|
||||
some-dashboard:
|
||||
json: |
|
||||
{
|
||||
"annotations":
|
||||
|
||||
...
|
||||
# Complete json file here
|
||||
...
|
||||
|
||||
"title": "Some Dashboard",
|
||||
"uid": "abcd1234",
|
||||
"version": 1
|
||||
}
|
||||
custom-dashboard:
|
||||
# This is a path to a file inside the dashboards directory inside the chart directory
|
||||
file: dashboards/custom-dashboard.json
|
||||
prometheus-stats:
|
||||
# Ref: https://grafana.com/dashboards/2
|
||||
gnetId: 2
|
||||
revision: 2
|
||||
datasource: Prometheus
|
||||
loki-dashboard-quick-search:
|
||||
gnetId: 12019
|
||||
revision: 2
|
||||
datasource:
|
||||
- name: DS_PROMETHEUS
|
||||
value: Prometheus
|
||||
- name: DS_LOKI
|
||||
value: Loki
|
||||
local-dashboard:
|
||||
url: https://raw.githubusercontent.com/user/repository/master/dashboards/dashboard.json
|
||||
```
|
||||
|
||||
## BASE64 dashboards
|
||||
|
||||
Dashboards could be stored on a server that does not return JSON directly and instead of it returns a Base64 encoded file (e.g. Gerrit)
|
||||
A new parameter has been added to the url use case so if you specify a b64content value equals to true after the url entry a Base64 decoding is applied before save the file to disk.
|
||||
If this entry is not set or is equals to false not decoding is applied to the file before saving it to disk.
|
||||
|
||||
### Gerrit use case
|
||||
|
||||
Gerrit API for download files has the following schema: <https://yourgerritserver/a/{project-name}/branches/{branch-id}/files/{file-id}/content> where {project-name} and
|
||||
{file-id} usually has '/' in their values and so they MUST be replaced by %2F so if project-name is user/repo, branch-id is master and file-id is equals to dir1/dir2/dashboard
|
||||
the url value is <https://yourgerritserver/a/user%2Frepo/branches/master/files/dir1%2Fdir2%2Fdashboard/content>
|
||||
|
||||
## Sidecar for dashboards
|
||||
|
||||
If the parameter `sidecar.dashboards.enabled` is set, a sidecar container is deployed in the grafana
|
||||
pod. This container watches all configmaps (or secrets) in the cluster and filters out the ones with
|
||||
a label as defined in `sidecar.dashboards.label`. The files defined in those configmaps are written
|
||||
to a folder and accessed by grafana. Changes to the configmaps are monitored and the imported
|
||||
dashboards are deleted/updated.
|
||||
|
||||
A recommendation is to use one configmap per dashboard, as a reduction of multiple dashboards inside
|
||||
one configmap is currently not properly mirrored in grafana.
|
||||
|
||||
Example dashboard config:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: sample-grafana-dashboard
|
||||
labels:
|
||||
grafana_dashboard: "1"
|
||||
data:
|
||||
k8s-dashboard.json: |-
|
||||
[...]
|
||||
```
|
||||
|
||||
## Sidecar for datasources
|
||||
|
||||
If the parameter `sidecar.datasources.enabled` is set, an init container is deployed in the grafana
|
||||
pod. This container lists all secrets (or configmaps, though not recommended) in the cluster and
|
||||
filters out the ones with a label as defined in `sidecar.datasources.label`. The files defined in
|
||||
those secrets are written to a folder and accessed by grafana on startup. Using these yaml files,
|
||||
the data sources in grafana can be imported.
|
||||
|
||||
Should you aim for reloading datasources in Grafana each time the config is changed, set `sidecar.datasources.skipReload: false` and adjust `sidecar.datasources.reloadURL` to `http://<svc-name>.<namespace>.svc.cluster.local/api/admin/provisioning/datasources/reload`.
|
||||
|
||||
Secrets are recommended over configmaps for this usecase because datasources usually contain private
|
||||
data like usernames and passwords. Secrets are the more appropriate cluster resource to manage those.
|
||||
|
||||
Example values to add a postgres datasource as a kubernetes secret:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: grafana-datasources
|
||||
labels:
|
||||
grafana_datasource: 'true' # default value for: sidecar.datasources.label
|
||||
stringData:
|
||||
pg-db.yaml: |-
|
||||
apiVersion: 1
|
||||
datasources:
|
||||
- name: My pg db datasource
|
||||
type: postgres
|
||||
url: my-postgresql-db:5432
|
||||
user: db-readonly-user
|
||||
secureJsonData:
|
||||
password: 'SUperSEcretPa$$word'
|
||||
jsonData:
|
||||
database: my_datase
|
||||
sslmode: 'disable' # disable/require/verify-ca/verify-full
|
||||
maxOpenConns: 0 # Grafana v5.4+
|
||||
maxIdleConns: 2 # Grafana v5.4+
|
||||
connMaxLifetime: 14400 # Grafana v5.4+
|
||||
postgresVersion: 1000 # 903=9.3, 904=9.4, 905=9.5, 906=9.6, 1000=10
|
||||
timescaledb: false
|
||||
# <bool> allow users to edit datasources from the UI.
|
||||
editable: false
|
||||
```
|
||||
|
||||
Example values to add a datasource adapted from [Grafana](http://docs.grafana.org/administration/provisioning/#example-datasource-config-file):
|
||||
|
||||
```yaml
|
||||
datasources:
|
||||
datasources.yaml:
|
||||
apiVersion: 1
|
||||
datasources:
|
||||
# <string, required> name of the datasource. Required
|
||||
- name: Graphite
|
||||
# <string, required> datasource type. Required
|
||||
type: graphite
|
||||
# <string, required> access mode. proxy or direct (Server or Browser in the UI). Required
|
||||
access: proxy
|
||||
# <int> org id. will default to orgId 1 if not specified
|
||||
orgId: 1
|
||||
# <string> url
|
||||
url: http://localhost:8080
|
||||
# <string> database password, if used
|
||||
password:
|
||||
# <string> database user, if used
|
||||
user:
|
||||
# <string> database name, if used
|
||||
database:
|
||||
# <bool> enable/disable basic auth
|
||||
basicAuth:
|
||||
# <string> basic auth username
|
||||
basicAuthUser:
|
||||
# <string> basic auth password
|
||||
basicAuthPassword:
|
||||
# <bool> enable/disable with credentials headers
|
||||
withCredentials:
|
||||
# <bool> mark as default datasource. Max one per org
|
||||
isDefault:
|
||||
# <map> fields that will be converted to json and stored in json_data
|
||||
jsonData:
|
||||
graphiteVersion: "1.1"
|
||||
tlsAuth: true
|
||||
tlsAuthWithCACert: true
|
||||
# <string> json object of data that will be encrypted.
|
||||
secureJsonData:
|
||||
tlsCACert: "..."
|
||||
tlsClientCert: "..."
|
||||
tlsClientKey: "..."
|
||||
version: 1
|
||||
# <bool> allow users to edit datasources from the UI.
|
||||
editable: false
|
||||
```
|
||||
|
||||
## Sidecar for notifiers
|
||||
|
||||
If the parameter `sidecar.notifiers.enabled` is set, an init container is deployed in the grafana
|
||||
pod. This container lists all secrets (or configmaps, though not recommended) in the cluster and
|
||||
filters out the ones with a label as defined in `sidecar.notifiers.label`. The files defined in
|
||||
those secrets are written to a folder and accessed by grafana on startup. Using these yaml files,
|
||||
the notification channels in grafana can be imported. The secrets must be created before
|
||||
`helm install` so that the notifiers init container can list the secrets.
|
||||
|
||||
Secrets are recommended over configmaps for this usecase because alert notification channels usually contain
|
||||
private data like SMTP usernames and passwords. Secrets are the more appropriate cluster resource to manage those.
|
||||
|
||||
Example datasource config adapted from [Grafana](https://grafana.com/docs/grafana/latest/administration/provisioning/#alert-notification-channels):
|
||||
|
||||
```yaml
|
||||
notifiers:
|
||||
- name: notification-channel-1
|
||||
type: slack
|
||||
uid: notifier1
|
||||
# either
|
||||
org_id: 2
|
||||
# or
|
||||
org_name: Main Org.
|
||||
is_default: true
|
||||
send_reminder: true
|
||||
frequency: 1h
|
||||
disable_resolve_message: false
|
||||
# See `Supported Settings` section for settings supporter for each
|
||||
# alert notification type.
|
||||
settings:
|
||||
recipient: 'XXX'
|
||||
token: 'xoxb'
|
||||
uploadImage: true
|
||||
url: https://slack.com
|
||||
|
||||
delete_notifiers:
|
||||
- name: notification-channel-1
|
||||
uid: notifier1
|
||||
org_id: 2
|
||||
- name: notification-channel-2
|
||||
# default org_id: 1
|
||||
```
|
||||
|
||||
## Sidecar for alerting resources
|
||||
|
||||
If the parameter `sidecar.alerts.enabled` is set, a sidecar container is deployed in the grafana
|
||||
pod. This container watches all configmaps (or secrets) in the cluster (namespace defined by `sidecar.alerts.searchNamespace`) and filters out the ones with
|
||||
a label as defined in `sidecar.alerts.label` (default is `grafana_alert`). The files defined in those configmaps are written
|
||||
to a folder and accessed by grafana. Changes to the configmaps are monitored and the imported alerting resources are updated, however, deletions are a little more complicated (see below).
|
||||
|
||||
This sidecar can be used to provision alert rules, contact points, notification policies, notification templates and mute timings as shown in [Grafana Documentation](https://grafana.com/docs/grafana/next/alerting/set-up/provision-alerting-resources/file-provisioning/).
|
||||
|
||||
To fetch the alert config which will be provisioned, use the alert provisioning API ([Grafana Documentation](https://grafana.com/docs/grafana/next/developers/http_api/alerting_provisioning/)).
|
||||
You can use either JSON or YAML format.
|
||||
|
||||
Example config for an alert rule:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: sample-grafana-alert
|
||||
labels:
|
||||
grafana_alert: "1"
|
||||
data:
|
||||
k8s-alert.yml: |-
|
||||
apiVersion: 1
|
||||
groups:
|
||||
- orgId: 1
|
||||
name: k8s-alert
|
||||
[...]
|
||||
```
|
||||
|
||||
To delete provisioned alert rules is a two step process, you need to delete the configmap which defined the alert rule
|
||||
and then create a configuration which deletes the alert rule.
|
||||
|
||||
Example deletion configuration:
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: delete-sample-grafana-alert
|
||||
namespace: monitoring
|
||||
labels:
|
||||
grafana_alert: "1"
|
||||
data:
|
||||
delete-k8s-alert.yml: |-
|
||||
apiVersion: 1
|
||||
deleteRules:
|
||||
- orgId: 1
|
||||
uid: 16624780-6564-45dc-825c-8bded4ad92d3
|
||||
```
|
||||
|
||||
## Statically provision alerting resources
|
||||
|
||||
If you don't need to change alerting resources (alert rules, contact points, notification policies and notification templates) regularly you could use the `alerting` config option instead of the sidecar option above.
|
||||
This will grab the alerting config and apply it statically at build time for the helm file.
|
||||
|
||||
There are two methods to statically provision alerting configuration in Grafana. Below are some examples and explanations as to how to use each method:
|
||||
|
||||
```yaml
|
||||
alerting:
|
||||
team1-alert-rules.yaml:
|
||||
file: alerting/team1/rules.yaml
|
||||
team2-alert-rules.yaml:
|
||||
file: alerting/team2/rules.yaml
|
||||
team3-alert-rules.yaml:
|
||||
file: alerting/team3/rules.yaml
|
||||
notification-policies.yaml:
|
||||
file: alerting/shared/notification-policies.yaml
|
||||
notification-templates.yaml:
|
||||
file: alerting/shared/notification-templates.yaml
|
||||
contactpoints.yaml:
|
||||
apiVersion: 1
|
||||
contactPoints:
|
||||
- orgId: 1
|
||||
name: Slack channel
|
||||
receivers:
|
||||
- uid: default-receiver
|
||||
type: slack
|
||||
settings:
|
||||
# Webhook URL to be filled in
|
||||
url: ""
|
||||
# We need to escape double curly braces for the tpl function.
|
||||
text: '{{ `{{ template "default.message" . }}` }}'
|
||||
title: '{{ `{{ template "default.title" . }}` }}'
|
||||
```
|
||||
|
||||
The two possibilities for static alerting resource provisioning are:
|
||||
|
||||
* Inlining the file contents as shown for contact points in the above example.
|
||||
* Importing a file using a relative path starting from the chart root directory as shown for the alert rules in the above example.
|
||||
|
||||
### Important notes on file provisioning
|
||||
|
||||
* The format of the files is defined in the [Grafana documentation](https://grafana.com/docs/grafana/next/alerting/set-up/provision-alerting-resources/file-provisioning/) on file provisioning.
|
||||
* The chart supports importing YAML and JSON files.
|
||||
* The filename must be unique, otherwise one volume mount will overwrite the other.
|
||||
* In case of inlining, double curly braces that arise from the Grafana configuration format and are not intended as templates for the chart must be escaped.
|
||||
* The number of total files under `alerting:` is not limited. Each file will end up as a volume mount in the corresponding provisioning folder of the deployed Grafana instance.
|
||||
* The file size for each import is limited by what the function `.Files.Get` can handle, which suffices for most cases.
|
||||
|
||||
## How to serve Grafana with a path prefix (/grafana)
|
||||
|
||||
In order to serve Grafana with a prefix (e.g., <http://example.com/grafana>), add the following to your values.yaml.
|
||||
|
||||
```yaml
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: "nginx"
|
||||
nginx.ingress.kubernetes.io/rewrite-target: /$1
|
||||
nginx.ingress.kubernetes.io/use-regex: "true"
|
||||
|
||||
path: /grafana/?(.*)
|
||||
hosts:
|
||||
- k8s.example.dev
|
||||
|
||||
grafana.ini:
|
||||
server:
|
||||
root_url: http://localhost:3000/grafana # this host can be localhost
|
||||
```
|
||||
|
||||
## How to securely reference secrets in grafana.ini
|
||||
|
||||
This example uses Grafana [file providers](https://grafana.com/docs/grafana/latest/administration/configuration/#file-provider) for secret values and the `extraSecretMounts` configuration flag (Additional grafana server secret mounts) to mount the secrets.
|
||||
|
||||
In grafana.ini:
|
||||
|
||||
```yaml
|
||||
grafana.ini:
|
||||
[auth.generic_oauth]
|
||||
enabled = true
|
||||
client_id = $__file{/etc/secrets/auth_generic_oauth/client_id}
|
||||
client_secret = $__file{/etc/secrets/auth_generic_oauth/client_secret}
|
||||
```
|
||||
|
||||
Existing secret, or created along with helm:
|
||||
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: auth-generic-oauth-secret
|
||||
type: Opaque
|
||||
stringData:
|
||||
client_id: <value>
|
||||
client_secret: <value>
|
||||
```
|
||||
|
||||
Include in the `extraSecretMounts` configuration flag:
|
||||
|
||||
```yaml
|
||||
extraSecretMounts:
|
||||
- name: auth-generic-oauth-secret-mount
|
||||
secretName: auth-generic-oauth-secret
|
||||
defaultMode: 0440
|
||||
mountPath: /etc/secrets/auth_generic_oauth
|
||||
readOnly: true
|
||||
```
|
||||
|
||||
### extraSecretMounts using a Container Storage Interface (CSI) provider
|
||||
|
||||
This example uses a CSI driver e.g. retrieving secrets using [Azure Key Vault Provider](https://github.com/Azure/secrets-store-csi-driver-provider-azure)
|
||||
|
||||
```yaml
|
||||
extraSecretMounts:
|
||||
- name: secrets-store-inline
|
||||
mountPath: /run/secrets
|
||||
readOnly: true
|
||||
csi:
|
||||
driver: secrets-store.csi.k8s.io
|
||||
readOnly: true
|
||||
volumeAttributes:
|
||||
secretProviderClass: "my-provider"
|
||||
nodePublishSecretRef:
|
||||
name: akv-creds
|
||||
```
|
||||
|
||||
## Image Renderer Plug-In
|
||||
|
||||
This chart supports enabling [remote image rendering](https://github.com/grafana/grafana-image-renderer/blob/master/README.md#run-in-docker)
|
||||
|
||||
```yaml
|
||||
imageRenderer:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
### Image Renderer NetworkPolicy
|
||||
|
||||
By default the image-renderer pods will have a network policy which only allows ingress traffic from the created grafana instance
|
||||
|
||||
### High Availability for unified alerting
|
||||
|
||||
If you want to run Grafana in a high availability cluster you need to enable
|
||||
the headless service by setting `headlessService: true` in your `values.yaml`
|
||||
file.
|
||||
|
||||
As next step you have to setup the `grafana.ini` in your `values.yaml` in a way
|
||||
that it will make use of the headless service to obtain all the IPs of the
|
||||
cluster. You should replace ``{{ Name }}`` with the name of your helm deployment.
|
||||
|
||||
```yaml
|
||||
grafana.ini:
|
||||
...
|
||||
unified_alerting:
|
||||
enabled: true
|
||||
ha_peers: {{ Name }}-headless:9094
|
||||
ha_listen_address: ${POD_IP}:9094
|
||||
ha_advertise_address: ${POD_IP}:9094
|
||||
|
||||
alerting:
|
||||
enabled: false
|
||||
```
|
||||
@ -1 +0,0 @@
|
||||
# Leave this file empty to ensure that CI runs builds against the default configuration in values.yaml.
|
||||
@ -1,16 +0,0 @@
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: grafana-test
|
||||
app.kubernetes.io/name: grafana
|
||||
topologyKey: failure-domain.beta.kubernetes.io/zone
|
||||
weight: 100
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: grafana-test
|
||||
app.kubernetes.io/name: grafana
|
||||
topologyKey: kubernetes.io/hostname
|
||||
@ -1,53 +0,0 @@
|
||||
dashboards:
|
||||
my-provider:
|
||||
my-awesome-dashboard:
|
||||
# An empty but valid dashboard
|
||||
json: |
|
||||
{
|
||||
"__inputs": [],
|
||||
"__requires": [
|
||||
{
|
||||
"type": "grafana",
|
||||
"id": "grafana",
|
||||
"name": "Grafana",
|
||||
"version": "6.3.5"
|
||||
}
|
||||
],
|
||||
"annotations": {
|
||||
"list": [
|
||||
{
|
||||
"builtIn": 1,
|
||||
"datasource": "-- Grafana --",
|
||||
"enable": true,
|
||||
"hide": true,
|
||||
"iconColor": "rgba(0, 211, 255, 1)",
|
||||
"name": "Annotations & Alerts",
|
||||
"type": "dashboard"
|
||||
}
|
||||
]
|
||||
},
|
||||
"editable": true,
|
||||
"gnetId": null,
|
||||
"graphTooltip": 0,
|
||||
"id": null,
|
||||
"links": [],
|
||||
"panels": [],
|
||||
"schemaVersion": 19,
|
||||
"style": "dark",
|
||||
"tags": [],
|
||||
"templating": {
|
||||
"list": []
|
||||
},
|
||||
"time": {
|
||||
"from": "now-6h",
|
||||
"to": "now"
|
||||
},
|
||||
"timepicker": {
|
||||
"refresh_intervals": ["5s"]
|
||||
},
|
||||
"timezone": "",
|
||||
"title": "Dummy Dashboard",
|
||||
"uid": "IdcYQooWk",
|
||||
"version": 1
|
||||
}
|
||||
datasource: Prometheus
|
||||
@ -1,19 +0,0 @@
|
||||
dashboards:
|
||||
my-provider:
|
||||
my-awesome-dashboard:
|
||||
gnetId: 10000
|
||||
revision: 1
|
||||
datasource: Prometheus
|
||||
dashboardProviders:
|
||||
dashboardproviders.yaml:
|
||||
apiVersion: 1
|
||||
providers:
|
||||
- name: 'my-provider'
|
||||
orgId: 1
|
||||
folder: ''
|
||||
type: file
|
||||
updateIntervalSeconds: 10
|
||||
disableDeletion: true
|
||||
editable: true
|
||||
options:
|
||||
path: /var/lib/grafana/dashboards/my-provider
|
||||
@ -1,7 +0,0 @@
|
||||
extraConfigmapMounts:
|
||||
- name: '{{ include "grafana.fullname" . }}'
|
||||
configMap: '{{ include "grafana.fullname" . }}'
|
||||
mountPath: /var/lib/grafana/dashboards/test-dashboard.json
|
||||
# This is not a realistic test, but for this we only care about extraConfigmapMounts not being empty and pointing to an existing ConfigMap
|
||||
subPath: grafana.ini
|
||||
readOnly: true
|
||||
@ -1,107 +0,0 @@
|
||||
podLabels:
|
||||
customLableA: Aaaaa
|
||||
imageRenderer:
|
||||
enabled: true
|
||||
env:
|
||||
RENDERING_ARGS: --disable-gpu,--window-size=1280x758
|
||||
RENDERING_MODE: clustered
|
||||
podLabels:
|
||||
customLableB: Bbbbb
|
||||
networkPolicy:
|
||||
limitIngress: true
|
||||
limitEgress: true
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1000m
|
||||
memory: 1000Mi
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 50Mi
|
||||
extraVolumes:
|
||||
- name: empty-renderer-volume
|
||||
emtpyDir: {}
|
||||
extraVolumeMounts:
|
||||
- mountPath: /tmp/renderer
|
||||
name: empty-renderer-volume
|
||||
extraConfigmapMounts:
|
||||
- name: renderer-config
|
||||
mountPath: /usr/src/app/config.json
|
||||
subPath: renderer-config.json
|
||||
configMap: image-renderer-config
|
||||
extraSecretMounts:
|
||||
- name: renderer-certificate
|
||||
mountPath: /usr/src/app/certs/
|
||||
secretName: image-renderer-certificate
|
||||
readOnly: true
|
||||
|
||||
extraObjects:
|
||||
- apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: image-renderer-config
|
||||
data:
|
||||
renderer-config.json: |
|
||||
{
|
||||
"service": {
|
||||
"host": null,
|
||||
"port": 8081,
|
||||
"protocol": "http",
|
||||
"certFile": "",
|
||||
"certKey": "",
|
||||
|
||||
"metrics": {
|
||||
"enabled": true,
|
||||
"collectDefaultMetrics": true,
|
||||
"requestDurationBuckets": [1, 5, 7, 9, 11, 13, 15, 20, 30]
|
||||
},
|
||||
|
||||
"logging": {
|
||||
"level": "info",
|
||||
"console": {
|
||||
"json": true,
|
||||
"colorize": false
|
||||
}
|
||||
},
|
||||
|
||||
"security": {
|
||||
"authToken": "-"
|
||||
}
|
||||
},
|
||||
"rendering": {
|
||||
"chromeBin": null,
|
||||
"args": ["--no-sandbox", "--disable-gpu"],
|
||||
"ignoresHttpsErrors": false,
|
||||
|
||||
"timezone": null,
|
||||
"acceptLanguage": null,
|
||||
"width": 1000,
|
||||
"height": 500,
|
||||
"deviceScaleFactor": 1,
|
||||
"maxWidth": 3080,
|
||||
"maxHeight": 3000,
|
||||
"maxDeviceScaleFactor": 4,
|
||||
"pageZoomLevel": 1,
|
||||
"headed": false,
|
||||
|
||||
"mode": "default",
|
||||
"emulateNetworkConditions": false,
|
||||
"clustering": {
|
||||
"monitor": false,
|
||||
"mode": "browser",
|
||||
"maxConcurrency": 5,
|
||||
"timeout": 30
|
||||
},
|
||||
|
||||
"verboseLogging": false,
|
||||
"dumpio": false,
|
||||
"timingMetrics": false
|
||||
}
|
||||
}
|
||||
- apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: image-renderer-certificate
|
||||
type: Opaque
|
||||
data:
|
||||
# Decodes to 'PLACEHOLDER CERTIFICATE'
|
||||
not-a-real-certificate: UExBQ0VIT0xERVIgQ0VSVElGSUNBVEU=
|
||||
@ -1,32 +0,0 @@
|
||||
global:
|
||||
environment: prod
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts:
|
||||
- monitoring-{{ .Values.global.environment }}.example.com
|
||||
|
||||
route:
|
||||
main:
|
||||
enabled: true
|
||||
labels:
|
||||
app: monitoring-prometheus
|
||||
hostnames:
|
||||
- "*.example.com"
|
||||
- "{{ .Values.global.environment }}.example.com"
|
||||
filters:
|
||||
- type: RequestHeaderModifier
|
||||
requestHeaderModifier:
|
||||
set:
|
||||
- name: my-header-name
|
||||
value: my-new-header-value
|
||||
additionalRules:
|
||||
- filters:
|
||||
- type: RequestHeaderModifier
|
||||
requestHeaderModifier:
|
||||
set:
|
||||
- name: my-header-name
|
||||
value: my-new-header-value
|
||||
matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /foo/
|
||||
@ -1,3 +0,0 @@
|
||||
persistence:
|
||||
type: pvc
|
||||
enabled: true
|
||||
@ -1,38 +0,0 @@
|
||||
extraObjects:
|
||||
- apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: '{{ include "grafana.fullname" . }}-test'
|
||||
data:
|
||||
var1: "value1"
|
||||
- apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: '{{ include "grafana.fullname" . }}-test'
|
||||
type: Opaque
|
||||
data:
|
||||
var2: "dmFsdWUy"
|
||||
|
||||
sidecar:
|
||||
dashboards:
|
||||
enabled: true
|
||||
envValueFrom:
|
||||
VAR1:
|
||||
configMapKeyRef:
|
||||
name: '{{ include "grafana.fullname" . }}-test'
|
||||
key: var1
|
||||
VAR2:
|
||||
secretKeyRef:
|
||||
name: '{{ include "grafana.fullname" . }}-test'
|
||||
key: var2
|
||||
datasources:
|
||||
enabled: true
|
||||
envValueFrom:
|
||||
VAR1:
|
||||
configMapKeyRef:
|
||||
name: '{{ include "grafana.fullname" . }}-test'
|
||||
key: var1
|
||||
VAR2:
|
||||
secretKeyRef:
|
||||
name: '{{ include "grafana.fullname" . }}-test'
|
||||
key: var2
|
||||
@ -1 +0,0 @@
|
||||
{}
|
||||
@ -1,55 +0,0 @@
|
||||
1. Get your '{{ .Values.adminUser }}' user password by running:
|
||||
|
||||
kubectl get secret --namespace {{ include "grafana.namespace" . }} {{ .Values.admin.existingSecret | default (include "grafana.fullname" .) }} -o jsonpath="{.data.{{ .Values.admin.passwordKey | default "admin-password" }}}" | base64 --decode ; echo
|
||||
|
||||
|
||||
2. The Grafana server can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster:
|
||||
|
||||
{{ include "grafana.fullname" . }}.{{ include "grafana.namespace" . }}.svc.cluster.local
|
||||
{{ if .Values.ingress.enabled }}
|
||||
If you bind grafana to 80, please update values in values.yaml and reinstall:
|
||||
```
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
fsGroup: 0
|
||||
|
||||
command:
|
||||
- "setcap"
|
||||
- "'cap_net_bind_service=+ep'"
|
||||
- "/usr/sbin/grafana-server &&"
|
||||
- "sh"
|
||||
- "/run.sh"
|
||||
```
|
||||
Details refer to https://grafana.com/docs/installation/configuration/#http-port.
|
||||
Or grafana would always crash.
|
||||
|
||||
From outside the cluster, the server URL(s) are:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
http://{{ . }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
Get the Grafana URL to visit by running these commands in the same shell:
|
||||
{{- if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ include "grafana.namespace" . }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "grafana.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ include "grafana.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo http://$NODE_IP:$NODE_PORT
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get svc --namespace {{ include "grafana.namespace" . }} -w {{ include "grafana.fullname" . }}'
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ include "grafana.namespace" . }} {{ include "grafana.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
|
||||
http://$SERVICE_IP:{{ .Values.service.port -}}
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
export POD_NAME=$(kubectl get pods --namespace {{ include "grafana.namespace" . }} -l "app.kubernetes.io/name={{ include "grafana.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
|
||||
kubectl --namespace {{ include "grafana.namespace" . }} port-forward $POD_NAME 3000
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
3. Login with the password from step 1 and the username: {{ .Values.adminUser }}
|
||||
|
||||
{{- if and (not .Values.persistence.enabled) (not .Values.persistence.disableWarning) }}
|
||||
#################################################################################
|
||||
###### WARNING: Persistence is disabled!!! You will lose your data when #####
|
||||
###### the Grafana pod is terminated. #####
|
||||
#################################################################################
|
||||
{{- end }}
|
||||
@ -1,176 +0,0 @@
|
||||
{{/*
|
||||
Generate config map data
|
||||
*/}}
|
||||
{{- define "grafana.configData" -}}
|
||||
{{ include "grafana.assertNoLeakedSecrets" . }}
|
||||
{{- $files := .Files }}
|
||||
{{- $root := . -}}
|
||||
{{- with .Values.plugins }}
|
||||
plugins: {{ join "," . }}
|
||||
{{- end }}
|
||||
grafana.ini: |
|
||||
{{- range $elem, $elemVal := index .Values "grafana.ini" }}
|
||||
{{- if not (kindIs "map" $elemVal) }}
|
||||
{{- if kindIs "invalid" $elemVal }}
|
||||
{{ $elem }} =
|
||||
{{- else if kindIs "slice" $elemVal }}
|
||||
{{ $elem }} = {{ toJson $elemVal }}
|
||||
{{- else if kindIs "string" $elemVal }}
|
||||
{{ $elem }} = {{ tpl $elemVal $ }}
|
||||
{{- else }}
|
||||
{{ $elem }} = {{ $elemVal }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := index .Values "grafana.ini" }}
|
||||
{{- if kindIs "map" $value }}
|
||||
[{{ $key }}]
|
||||
{{- range $elem, $elemVal := $value }}
|
||||
{{- if kindIs "invalid" $elemVal }}
|
||||
{{ $elem }} =
|
||||
{{- else if kindIs "slice" $elemVal }}
|
||||
{{ $elem }} = {{ toJson $elemVal }}
|
||||
{{- else if kindIs "string" $elemVal }}
|
||||
{{ $elem }} = {{ tpl $elemVal $ }}
|
||||
{{- else }}
|
||||
{{ $elem }} = {{ $elemVal }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- range $key, $value := .Values.datasources }}
|
||||
{{- if not (hasKey $value "secret") }}
|
||||
{{ $key }}: |
|
||||
{{- tpl (toYaml $value | nindent 2) $root }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- range $key, $value := .Values.notifiers }}
|
||||
{{- if not (hasKey $value "secret") }}
|
||||
{{ $key }}: |
|
||||
{{- toYaml $value | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- range $key, $value := .Values.alerting }}
|
||||
{{- if (hasKey $value "file") }}
|
||||
{{ $key }}:
|
||||
{{- toYaml ( $files.Get $value.file ) | nindent 2 }}
|
||||
{{- else if (or (hasKey $value "secret") (hasKey $value "secretFile"))}}
|
||||
{{/* will be stored inside secret generated by "configSecret.yaml"*/}}
|
||||
{{- else }}
|
||||
{{ $key }}: |
|
||||
{{- tpl (toYaml $value | nindent 2) $root }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- range $key, $value := .Values.dashboardProviders }}
|
||||
{{ $key }}: |
|
||||
{{- toYaml $value | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.dashboards }}
|
||||
download_dashboards.sh: |
|
||||
#!/usr/bin/env sh
|
||||
set -euf
|
||||
{{- if .Values.dashboardProviders }}
|
||||
{{- range $key, $value := .Values.dashboardProviders }}
|
||||
{{- range $value.providers }}
|
||||
mkdir -p {{ .options.path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{ $dashboardProviders := .Values.dashboardProviders }}
|
||||
{{- range $provider, $dashboards := .Values.dashboards }}
|
||||
{{- range $key, $value := $dashboards }}
|
||||
{{- if (or (hasKey $value "gnetId") (hasKey $value "url")) }}
|
||||
curl -skf \
|
||||
--connect-timeout 60 \
|
||||
--max-time 60 \
|
||||
{{- if not $value.b64content }}
|
||||
{{- if not $value.acceptHeader }}
|
||||
-H "Accept: application/json" \
|
||||
{{- else }}
|
||||
-H "Accept: {{ $value.acceptHeader }}" \
|
||||
{{- end }}
|
||||
{{- if $value.token }}
|
||||
-H "Authorization: token {{ $value.token }}" \
|
||||
{{- end }}
|
||||
{{- if $value.bearerToken }}
|
||||
-H "Authorization: Bearer {{ $value.bearerToken }}" \
|
||||
{{- end }}
|
||||
{{- if $value.basic }}
|
||||
-H "Authorization: Basic {{ $value.basic }}" \
|
||||
{{- end }}
|
||||
{{- if $value.gitlabToken }}
|
||||
-H "PRIVATE-TOKEN: {{ $value.gitlabToken }}" \
|
||||
{{- end }}
|
||||
-H "Content-Type: application/json;charset=UTF-8" \
|
||||
{{- end }}
|
||||
{{- $dpPath := "" -}}
|
||||
{{- range $kd := (index $dashboardProviders "dashboardproviders.yaml").providers }}
|
||||
{{- if eq $kd.name $provider }}
|
||||
{{- $dpPath = $kd.options.path }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $value.url }}
|
||||
"{{ $value.url }}" \
|
||||
{{- else }}
|
||||
"https://grafana.com/api/dashboards/{{ $value.gnetId }}/revisions/{{- if $value.revision -}}{{ $value.revision }}{{- else -}}1{{- end -}}/download" \
|
||||
{{- end }}
|
||||
{{- if $value.datasource }}
|
||||
{{- if kindIs "string" $value.datasource }}
|
||||
| sed '/-- .* --/! s/"datasource":.*,/"datasource": "{{ $value.datasource }}",/g' \
|
||||
{{- end }}
|
||||
{{- if kindIs "slice" $value.datasource }}
|
||||
{{- range $value.datasource }}
|
||||
| sed '/-- .* --/! s/${{"{"}}{{ .name }}}/{{ .value }}/g' \
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $value.b64content }}
|
||||
| base64 -d \
|
||||
{{- end }}
|
||||
> "{{- if $dpPath -}}{{ $dpPath }}{{- else -}}/var/lib/grafana/dashboards/{{ $provider }}{{- end -}}/{{ $key }}.json"
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Generate dashboard json config map data
|
||||
*/}}
|
||||
{{- define "grafana.configDashboardProviderData" -}}
|
||||
provider.yaml: |-
|
||||
apiVersion: 1
|
||||
providers:
|
||||
- name: '{{ .Values.sidecar.dashboards.provider.name }}'
|
||||
orgId: {{ .Values.sidecar.dashboards.provider.orgid }}
|
||||
{{- if not .Values.sidecar.dashboards.provider.foldersFromFilesStructure }}
|
||||
folder: '{{ .Values.sidecar.dashboards.provider.folder }}'
|
||||
folderUid: '{{ .Values.sidecar.dashboards.provider.folderUid }}'
|
||||
{{- end }}
|
||||
type: {{ .Values.sidecar.dashboards.provider.type }}
|
||||
disableDeletion: {{ .Values.sidecar.dashboards.provider.disableDelete }}
|
||||
allowUiUpdates: {{ .Values.sidecar.dashboards.provider.allowUiUpdates }}
|
||||
updateIntervalSeconds: {{ .Values.sidecar.dashboards.provider.updateIntervalSeconds | default 30 }}
|
||||
options:
|
||||
foldersFromFilesStructure: {{ .Values.sidecar.dashboards.provider.foldersFromFilesStructure }}
|
||||
path: {{ .Values.sidecar.dashboards.folder }}{{- with .Values.sidecar.dashboards.defaultFolderName }}/{{ . }}{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "grafana.secretsData" -}}
|
||||
{{- if and (not .Values.env.GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION) (not .Values.admin.existingSecret) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD__FILE) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD) }}
|
||||
admin-user: {{ .Values.adminUser | b64enc | quote }}
|
||||
{{- if .Values.adminPassword }}
|
||||
admin-password: {{ .Values.adminPassword | b64enc | quote }}
|
||||
{{- else }}
|
||||
admin-password: {{ include "grafana.password" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not .Values.ldap.existingSecret }}
|
||||
ldap-toml: {{ tpl .Values.ldap.config $ | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@ -1,274 +0,0 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "grafana.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "grafana.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "grafana.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account
|
||||
*/}}
|
||||
{{- define "grafana.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "grafana.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "grafana.serviceAccountNameTest" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (print (include "grafana.fullname" .) "-test") .Values.serviceAccount.nameTest }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.nameTest }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||
*/}}
|
||||
{{- define "grafana.namespace" -}}
|
||||
{{- if .Values.namespaceOverride }}
|
||||
{{- .Values.namespaceOverride }}
|
||||
{{- else }}
|
||||
{{- .Release.Namespace }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "grafana.labels" -}}
|
||||
helm.sh/chart: {{ include "grafana.chart" . }}
|
||||
{{ include "grafana.selectorLabels" . }}
|
||||
{{- if or .Chart.AppVersion .Values.image.tag }}
|
||||
app.kubernetes.io/version: {{ mustRegexReplaceAllLiteral "@sha.*" .Values.image.tag "" | default .Chart.AppVersion | trunc 63 | trimSuffix "-" | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraLabels }}
|
||||
{{ toYaml . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "grafana.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "grafana.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "grafana.imageRenderer.labels" -}}
|
||||
helm.sh/chart: {{ include "grafana.chart" . }}
|
||||
{{ include "grafana.imageRenderer.selectorLabels" . }}
|
||||
{{- if or .Chart.AppVersion .Values.image.tag }}
|
||||
app.kubernetes.io/version: {{ mustRegexReplaceAllLiteral "@sha.*" .Values.image.tag "" | default .Chart.AppVersion | trunc 63 | trimSuffix "-" | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels ImageRenderer
|
||||
*/}}
|
||||
{{- define "grafana.imageRenderer.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "grafana.name" . }}-image-renderer
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Looks if there's an existing secret and reuse its password. If not it generates
|
||||
new password and use it.
|
||||
*/}}
|
||||
{{- define "grafana.password" -}}
|
||||
{{- $secret := (lookup "v1" "Secret" (include "grafana.namespace" .) (include "grafana.fullname" .) ) }}
|
||||
{{- if $secret }}
|
||||
{{- index $secret "data" "admin-password" }}
|
||||
{{- else }}
|
||||
{{- (randAlphaNum 40) | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for rbac.
|
||||
*/}}
|
||||
{{- define "grafana.rbac.apiVersion" -}}
|
||||
{{- if $.Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" }}
|
||||
{{- print "rbac.authorization.k8s.io/v1" }}
|
||||
{{- else }}
|
||||
{{- print "rbac.authorization.k8s.io/v1beta1" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for ingress.
|
||||
*/}}
|
||||
{{- define "grafana.ingress.apiVersion" -}}
|
||||
{{- if and ($.Capabilities.APIVersions.Has "networking.k8s.io/v1") (semverCompare ">= 1.19-0" .Capabilities.KubeVersion.Version) }}
|
||||
{{- print "networking.k8s.io/v1" }}
|
||||
{{- else if $.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
|
||||
{{- print "networking.k8s.io/v1beta1" }}
|
||||
{{- else }}
|
||||
{{- print "extensions/v1beta1" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for Horizontal Pod Autoscaler.
|
||||
*/}}
|
||||
{{- define "grafana.hpa.apiVersion" -}}
|
||||
{{- if .Capabilities.APIVersions.Has "autoscaling/v2" }}
|
||||
{{- print "autoscaling/v2" }}
|
||||
{{- else }}
|
||||
{{- print "autoscaling/v2beta2" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for podDisruptionBudget.
|
||||
*/}}
|
||||
{{- define "grafana.podDisruptionBudget.apiVersion" -}}
|
||||
{{- if $.Values.podDisruptionBudget.apiVersion }}
|
||||
{{- print $.Values.podDisruptionBudget.apiVersion }}
|
||||
{{- else if $.Capabilities.APIVersions.Has "policy/v1/PodDisruptionBudget" }}
|
||||
{{- print "policy/v1" }}
|
||||
{{- else }}
|
||||
{{- print "policy/v1beta1" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Return if ingress is stable.
|
||||
*/}}
|
||||
{{- define "grafana.ingress.isStable" -}}
|
||||
{{- eq (include "grafana.ingress.apiVersion" .) "networking.k8s.io/v1" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Return if ingress supports ingressClassName.
|
||||
*/}}
|
||||
{{- define "grafana.ingress.supportsIngressClassName" -}}
|
||||
{{- or (eq (include "grafana.ingress.isStable" .) "true") (and (eq (include "grafana.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Return if ingress supports pathType.
|
||||
*/}}
|
||||
{{- define "grafana.ingress.supportsPathType" -}}
|
||||
{{- or (eq (include "grafana.ingress.isStable" .) "true") (and (eq (include "grafana.ingress.apiVersion" .) "networking.k8s.io/v1beta1") (semverCompare ">= 1.18-0" .Capabilities.KubeVersion.Version)) }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Formats imagePullSecrets. Input is (dict "root" . "imagePullSecrets" .{specific imagePullSecrets})
|
||||
*/}}
|
||||
{{- define "grafana.imagePullSecrets" -}}
|
||||
{{- $root := .root }}
|
||||
{{- range (concat .root.Values.global.imagePullSecrets .imagePullSecrets) }}
|
||||
{{- if eq (typeOf .) "map[string]interface {}" }}
|
||||
- {{ toYaml (dict "name" (tpl .name $root)) | trim }}
|
||||
{{- else }}
|
||||
- name: {{ tpl . $root }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{/*
|
||||
Checks whether or not the configSecret secret has to be created
|
||||
*/}}
|
||||
{{- define "grafana.shouldCreateConfigSecret" -}}
|
||||
{{- $secretFound := false -}}
|
||||
{{- range $key, $value := .Values.datasources }}
|
||||
{{- if hasKey $value "secret" }}
|
||||
{{- $secretFound = true}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.notifiers }}
|
||||
{{- if hasKey $value "secret" }}
|
||||
{{- $secretFound = true}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.alerting }}
|
||||
{{- if (or (hasKey $value "secret") (hasKey $value "secretFile")) }}
|
||||
{{- $secretFound = true}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $secretFound}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Checks whether the user is attempting to store secrets in plaintext
|
||||
in the grafana.ini configmap
|
||||
*/}}
|
||||
{{/* grafana.assertNoLeakedSecrets checks for sensitive keys in values */}}
|
||||
{{- define "grafana.assertNoLeakedSecrets" -}}
|
||||
{{- $sensitiveKeysYaml := `
|
||||
sensitiveKeys:
|
||||
- path: ["database", "password"]
|
||||
- path: ["smtp", "password"]
|
||||
- path: ["security", "secret_key"]
|
||||
- path: ["security", "admin_password"]
|
||||
- path: ["auth.basic", "password"]
|
||||
- path: ["auth.ldap", "bind_password"]
|
||||
- path: ["auth.google", "client_secret"]
|
||||
- path: ["auth.github", "client_secret"]
|
||||
- path: ["auth.gitlab", "client_secret"]
|
||||
- path: ["auth.generic_oauth", "client_secret"]
|
||||
- path: ["auth.okta", "client_secret"]
|
||||
- path: ["auth.azuread", "client_secret"]
|
||||
- path: ["auth.grafana_com", "client_secret"]
|
||||
- path: ["auth.grafananet", "client_secret"]
|
||||
- path: ["azure", "user_identity_client_secret"]
|
||||
- path: ["unified_alerting", "ha_redis_password"]
|
||||
- path: ["metrics", "basic_auth_password"]
|
||||
- path: ["external_image_storage.s3", "secret_key"]
|
||||
- path: ["external_image_storage.webdav", "password"]
|
||||
- path: ["external_image_storage.azure_blob", "account_key"]
|
||||
` | fromYaml -}}
|
||||
{{- if $.Values.assertNoLeakedSecrets -}}
|
||||
{{- $grafanaIni := index .Values "grafana.ini" -}}
|
||||
{{- range $_, $secret := $sensitiveKeysYaml.sensitiveKeys -}}
|
||||
{{- $currentMap := $grafanaIni -}}
|
||||
{{- $shouldContinue := true -}}
|
||||
{{- range $index, $elem := $secret.path -}}
|
||||
{{- if and $shouldContinue (hasKey $currentMap $elem) -}}
|
||||
{{- if eq (len $secret.path) (add1 $index) -}}
|
||||
{{- if not (regexMatch "\\$(?:__(?:env|file|vault))?{[^}]+}" (index $currentMap $elem)) -}}
|
||||
{{- fail (printf "Sensitive key '%s' should not be defined explicitly in values. Use variable expansion instead. You can disable this client-side validation by changing the value of assertNoLeakedSecrets." (join "." $secret.path)) -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- $currentMap = index $currentMap $elem -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- $shouldContinue = false -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
File diff suppressed because it is too large
Load Diff
@ -1,25 +0,0 @@
|
||||
{{- if and .Values.rbac.create (or (not .Values.rbac.namespaced) .Values.rbac.extraClusterRoleRules) (not .Values.rbac.useExistingClusterRole) }}
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ include "grafana.fullname" . }}-clusterrole
|
||||
{{- if or .Values.sidecar.dashboards.enabled .Values.rbac.extraClusterRoleRules .Values.sidecar.datasources.enabled .Values.sidecar.plugins.enabled .Values.sidecar.alerts.enabled }}
|
||||
rules:
|
||||
{{- if or .Values.sidecar.dashboards.enabled .Values.sidecar.datasources.enabled .Values.sidecar.plugins.enabled .Values.sidecar.alerts.enabled }}
|
||||
- apiGroups: [""] # "" indicates the core API group
|
||||
resources: ["configmaps", "secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
{{- end}}
|
||||
{{- with .Values.rbac.extraClusterRoleRules }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end}}
|
||||
{{- else }}
|
||||
rules: []
|
||||
{{- end}}
|
||||
{{- end}}
|
||||
@ -1,24 +0,0 @@
|
||||
{{- if and .Values.rbac.create (or (not .Values.rbac.namespaced) .Values.rbac.extraClusterRoleRules) }}
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-clusterrolebinding
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "grafana.serviceAccountName" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
{{- if .Values.rbac.useExistingClusterRole }}
|
||||
name: {{ .Values.rbac.useExistingClusterRole }}
|
||||
{{- else }}
|
||||
name: {{ include "grafana.fullname" . }}-clusterrole
|
||||
{{- end }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- end }}
|
||||
@ -1,43 +0,0 @@
|
||||
{{- $createConfigSecret := eq (include "grafana.shouldCreateConfigSecret" .) "true" -}}
|
||||
{{- if and .Values.createConfigmap $createConfigSecret }}
|
||||
{{- $files := .Files }}
|
||||
{{- $root := . -}}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "{{ include "grafana.fullname" . }}-config-secret"
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- range $key, $value := .Values.alerting }}
|
||||
{{- if (hasKey $value "secretFile") }}
|
||||
{{- $key | nindent 2 }}:
|
||||
{{- toYaml ( $files.Get $value.secretFile ) | b64enc | nindent 4}}
|
||||
{{/* as of https://helm.sh/docs/chart_template_guide/accessing_files/ this will only work if you fork this chart and add files to it*/}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
stringData:
|
||||
{{- range $key, $value := .Values.datasources }}
|
||||
{{- if (hasKey $value "secret") }}
|
||||
{{- $key | nindent 2 }}: |
|
||||
{{- tpl (toYaml $value.secret | nindent 4) $root }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.notifiers }}
|
||||
{{- if (hasKey $value "secret") }}
|
||||
{{- $key | nindent 2 }}: |
|
||||
{{- tpl (toYaml $value.secret | nindent 4) $root }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.alerting }}
|
||||
{{ if (hasKey $value "secret") }}
|
||||
{{- $key | nindent 2 }}: |
|
||||
{{- tpl (toYaml $value.secret | nindent 4) $root }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,15 +0,0 @@
|
||||
{{- if and .Values.sidecar.dashboards.enabled .Values.sidecar.dashboards.SCProvider }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ include "grafana.fullname" . }}-config-dashboards
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
data:
|
||||
{{- include "grafana.configDashboardProviderData" . | nindent 2 }}
|
||||
{{- end }}
|
||||
@ -1,20 +0,0 @@
|
||||
{{- if .Values.createConfigmap }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- if or .Values.configMapAnnotations .Values.annotations }}
|
||||
annotations:
|
||||
{{- with .Values.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.configMapAnnotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
data:
|
||||
{{- include "grafana.configData" . | nindent 2 }}
|
||||
{{- end }}
|
||||
@ -1,35 +0,0 @@
|
||||
{{- if .Values.dashboards }}
|
||||
{{ $files := .Files }}
|
||||
{{- range $provider, $dashboards := .Values.dashboards }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" $ }}-dashboards-{{ $provider }}
|
||||
namespace: {{ include "grafana.namespace" $ }}
|
||||
labels:
|
||||
{{- include "grafana.labels" $ | nindent 4 }}
|
||||
dashboard-provider: {{ $provider }}
|
||||
{{- if $dashboards }}
|
||||
data:
|
||||
{{- $dashboardFound := false }}
|
||||
{{- range $key, $value := $dashboards }}
|
||||
{{- if (or (hasKey $value "json") (hasKey $value "file")) }}
|
||||
{{- $dashboardFound = true }}
|
||||
{{- print $key | nindent 2 }}.json:
|
||||
{{- if hasKey $value "json" }}
|
||||
|-
|
||||
{{- $value.json | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if hasKey $value "file" }}
|
||||
{{- toYaml ( $files.Get $value.file ) | nindent 4}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not $dashboardFound }}
|
||||
{}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@ -1,53 +0,0 @@
|
||||
{{- if (and (not .Values.useStatefulSet) (or (not .Values.persistence.enabled) (eq .Values.persistence.type "pvc"))) }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if (not .Values.autoscaling.enabled) }}
|
||||
replicas: {{ .Values.replicas }}
|
||||
{{- end }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "grafana.selectorLabels" . | nindent 6 }}
|
||||
{{- with .Values.deploymentStrategy }}
|
||||
strategy:
|
||||
{{- toYaml . | trim | nindent 4 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
checksum/config: {{ include "grafana.configData" . | sha256sum }}
|
||||
{{- if .Values.dashboards }}
|
||||
checksum/dashboards-json-config: {{ include (print $.Template.BasePath "/dashboards-json-configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
checksum/sc-dashboard-provider-config: {{ include "grafana.configDashboardProviderData" . | sha256sum }}
|
||||
{{- if and (or (and (not .Values.admin.existingSecret) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD__FILE) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD)) (and .Values.ldap.enabled (not .Values.ldap.existingSecret))) (not .Values.env.GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION) }}
|
||||
checksum/secret: {{ include "grafana.secretsData" . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.envRenderSecret }}
|
||||
checksum/secret-env: {{ tpl (toYaml .Values.envRenderSecret) . | sha256sum }}
|
||||
{{- end }}
|
||||
kubectl.kubernetes.io/default-container: {{ .Chart.Name }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "grafana.pod" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@ -1,4 +0,0 @@
|
||||
{{ range .Values.extraObjects }}
|
||||
---
|
||||
{{ tpl (toYaml .) $ }}
|
||||
{{ end }}
|
||||
@ -1,22 +0,0 @@
|
||||
{{- $sts := list "sts" "StatefulSet" "statefulset" -}}
|
||||
{{- if or .Values.headlessService (and .Values.persistence.enabled (not .Values.persistence.existingClaim) (has .Values.persistence.type $sts)) }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-headless
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
clusterIP: None
|
||||
selector:
|
||||
{{- include "grafana.selectorLabels" . | nindent 4 }}
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: {{ .Values.gossipPortName }}-tcp
|
||||
port: 9094
|
||||
{{- end }}
|
||||
@ -1,51 +0,0 @@
|
||||
{{- $sts := list "sts" "StatefulSet" "statefulset" -}}
|
||||
{{- if .Values.autoscaling.enabled }}
|
||||
apiVersion: {{ include "grafana.hpa.apiVersion" . }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ include "grafana.name" . }}
|
||||
helm.sh/chart: {{ include "grafana.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
{{- if has .Values.persistence.type $sts }}
|
||||
kind: StatefulSet
|
||||
{{- else }}
|
||||
kind: Deployment
|
||||
{{- end }}
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
{{- if eq (include "grafana.hpa.apiVersion" .) "autoscaling/v2beta1" }}
|
||||
targetAverageUtilization: {{ .Values.autoscaling.targetMemory }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetMemory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
{{- if eq (include "grafana.hpa.apiVersion" .) "autoscaling/v2beta1" }}
|
||||
targetAverageUtilization: {{ .Values.autoscaling.targetCPU }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetCPU }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.behavior }}
|
||||
behavior: {{ toYaml .Values.autoscaling.behavior | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,199 +0,0 @@
|
||||
{{ if .Values.imageRenderer.enabled }}
|
||||
{{- $root := . -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-image-renderer
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.imageRenderer.labels" . | nindent 4 }}
|
||||
{{- with .Values.imageRenderer.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and (not .Values.imageRenderer.autoscaling.enabled) (.Values.imageRenderer.replicas) }}
|
||||
replicas: {{ .Values.imageRenderer.replicas }}
|
||||
{{- end }}
|
||||
revisionHistoryLimit: {{ .Values.imageRenderer.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "grafana.imageRenderer.selectorLabels" . | nindent 6 }}
|
||||
|
||||
{{- with .Values.imageRenderer.deploymentStrategy }}
|
||||
strategy:
|
||||
{{- toYaml . | trim | nindent 4 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "grafana.imageRenderer.selectorLabels" . | nindent 8 }}
|
||||
{{- with .Values.imageRenderer.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- with .Values.imageRenderer.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imageRenderer.schedulerName }}
|
||||
schedulerName: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.serviceAccountName }}
|
||||
serviceAccountName: "{{ . }}"
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.hostAliases }}
|
||||
hostAliases:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.priorityClassName }}
|
||||
priorityClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ tpl . $root }}
|
||||
{{- end}}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}-image-renderer
|
||||
{{- $registry := .Values.global.imageRegistry | default .Values.imageRenderer.image.registry -}}
|
||||
{{- if .Values.imageRenderer.image.sha }}
|
||||
image: "{{ $registry }}/{{ .Values.imageRenderer.image.repository }}:{{ .Values.imageRenderer.image.tag }}@sha256:{{ .Values.imageRenderer.image.sha }}"
|
||||
{{- else }}
|
||||
image: "{{ $registry }}/{{ .Values.imageRenderer.image.repository }}:{{ .Values.imageRenderer.image.tag }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.imageRenderer.image.pullPolicy }}
|
||||
{{- if .Values.imageRenderer.command }}
|
||||
command:
|
||||
{{- range .Values.imageRenderer.command }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
ports:
|
||||
- name: {{ .Values.imageRenderer.service.portName }}
|
||||
containerPort: {{ .Values.imageRenderer.service.targetPort }}
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: {{ .Values.imageRenderer.service.portName }}
|
||||
env:
|
||||
- name: HTTP_PORT
|
||||
value: {{ .Values.imageRenderer.service.targetPort | quote }}
|
||||
{{- if .Values.imageRenderer.serviceMonitor.enabled }}
|
||||
- name: ENABLE_METRICS
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.imageRenderer.envValueFrom }}
|
||||
- name: {{ $key | quote }}
|
||||
valueFrom:
|
||||
{{- tpl (toYaml $value) $ | nindent 16 }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.imageRenderer.env }}
|
||||
- name: {{ $key | quote }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /tmp
|
||||
name: image-renderer-tmpfs
|
||||
{{- range .Values.imageRenderer.extraConfigmapMounts }}
|
||||
- name: {{ tpl .name $root }}
|
||||
mountPath: {{ tpl .mountPath $root }}
|
||||
subPath: {{ tpl (.subPath | default "") $root }}
|
||||
readOnly: {{ .readOnly }}
|
||||
{{- end }}
|
||||
{{- range .Values.imageRenderer.extraSecretMounts }}
|
||||
- name: {{ .name }}
|
||||
mountPath: {{ .mountPath }}
|
||||
readOnly: {{ .readOnly }}
|
||||
subPath: {{ .subPath | default "" }}
|
||||
{{- end }}
|
||||
{{- range .Values.imageRenderer.extraVolumeMounts }}
|
||||
- name: {{ .name }}
|
||||
mountPath: {{ .mountPath }}
|
||||
subPath: {{ .subPath | default "" }}
|
||||
readOnly: {{ .readOnly }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.affinity }}
|
||||
affinity:
|
||||
{{- tpl (toYaml .) $root | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: image-renderer-tmpfs
|
||||
emptyDir: {}
|
||||
{{- range .Values.imageRenderer.extraConfigmapMounts }}
|
||||
- name: {{ tpl .name $root }}
|
||||
configMap:
|
||||
name: {{ tpl .configMap $root }}
|
||||
{{- with .items }}
|
||||
items:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range .Values.imageRenderer.extraSecretMounts }}
|
||||
{{- if .secretName }}
|
||||
- name: {{ .name }}
|
||||
secret:
|
||||
secretName: {{ .secretName }}
|
||||
defaultMode: {{ .defaultMode }}
|
||||
{{- with .items }}
|
||||
items:
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- else if .projected }}
|
||||
- name: {{ .name }}
|
||||
projected:
|
||||
{{- toYaml .projected | nindent 12 }}
|
||||
{{- else if .csi }}
|
||||
- name: {{ .name }}
|
||||
csi:
|
||||
{{- toYaml .csi | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range .Values.imageRenderer.extraVolumes }}
|
||||
- name: {{ .name }}
|
||||
{{- if .existingClaim }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .existingClaim }}
|
||||
{{- else if .hostPath }}
|
||||
hostPath:
|
||||
{{ toYaml .hostPath | nindent 12 }}
|
||||
{{- else if .csi }}
|
||||
csi:
|
||||
{{- toYaml .csi | nindent 12 }}
|
||||
{{- else if .configMap }}
|
||||
configMap:
|
||||
{{- toYaml .configMap | nindent 12 }}
|
||||
{{- else if .emptyDir }}
|
||||
emptyDir:
|
||||
{{- toYaml .emptyDir | nindent 12 }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,46 +0,0 @@
|
||||
{{- if and .Values.imageRenderer.enabled .Values.imageRenderer.autoscaling.enabled }}
|
||||
apiVersion: {{ include "grafana.hpa.apiVersion" . }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-image-renderer
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ include "grafana.name" . }}-image-renderer
|
||||
helm.sh/chart: {{ include "grafana.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "grafana.fullname" . }}-image-renderer
|
||||
minReplicas: {{ .Values.imageRenderer.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.imageRenderer.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.imageRenderer.autoscaling.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
{{- if eq (include "grafana.hpa.apiVersion" .) "autoscaling/v2beta1" }}
|
||||
targetAverageUtilization: {{ .Values.imageRenderer.autoscaling.targetMemory }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.imageRenderer.autoscaling.targetMemory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.imageRenderer.autoscaling.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
{{- if eq (include "grafana.hpa.apiVersion" .) "autoscaling/v2beta1" }}
|
||||
targetAverageUtilization: {{ .Values.imageRenderer.autoscaling.targetCPU }}
|
||||
{{- else }}
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.imageRenderer.autoscaling.targetCPU }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.imageRenderer.autoscaling.behavior }}
|
||||
behavior: {{ toYaml .Values.imageRenderer.autoscaling.behavior | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,79 +0,0 @@
|
||||
{{- if and .Values.imageRenderer.enabled .Values.imageRenderer.networkPolicy.limitIngress }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-image-renderer-ingress
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
annotations:
|
||||
comment: Limit image-renderer ingress traffic from grafana
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "grafana.imageRenderer.selectorLabels" . | nindent 6 }}
|
||||
{{- with .Values.imageRenderer.podLabels }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.imageRenderer.service.targetPort }}
|
||||
protocol: TCP
|
||||
from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ include "grafana.namespace" . }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "grafana.selectorLabels" . | nindent 14 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.networkPolicy.extraIngressSelectors -}}
|
||||
{{ toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.imageRenderer.enabled .Values.imageRenderer.networkPolicy.limitEgress }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-image-renderer-egress
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
annotations:
|
||||
comment: Limit image-renderer egress traffic to grafana
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "grafana.imageRenderer.selectorLabels" . | nindent 6 }}
|
||||
{{- with .Values.imageRenderer.podLabels }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
# allow dns resolution
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# talk only to grafana
|
||||
- ports:
|
||||
- port: {{ .Values.service.targetPort }}
|
||||
protocol: TCP
|
||||
to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: {{ include "grafana.namespace" . }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "grafana.selectorLabels" . | nindent 14 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,31 +0,0 @@
|
||||
{{- if and .Values.imageRenderer.enabled .Values.imageRenderer.service.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-image-renderer
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.imageRenderer.labels" . | nindent 4 }}
|
||||
{{- with .Values.imageRenderer.service.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
{{- with .Values.imageRenderer.service.clusterIP }}
|
||||
clusterIP: {{ . }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: {{ .Values.imageRenderer.service.portName }}
|
||||
port: {{ .Values.imageRenderer.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.imageRenderer.service.targetPort }}
|
||||
{{- with .Values.imageRenderer.appProtocol }}
|
||||
appProtocol: {{ . }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "grafana.imageRenderer.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@ -1,48 +0,0 @@
|
||||
{{- if .Values.imageRenderer.serviceMonitor.enabled }}
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-image-renderer
|
||||
{{- if .Values.imageRenderer.serviceMonitor.namespace }}
|
||||
namespace: {{ tpl .Values.imageRenderer.serviceMonitor.namespace . }}
|
||||
{{- else }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "grafana.imageRenderer.labels" . | nindent 4 }}
|
||||
{{- with .Values.imageRenderer.serviceMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
endpoints:
|
||||
- port: {{ .Values.imageRenderer.service.portName }}
|
||||
{{- with .Values.imageRenderer.serviceMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
honorLabels: true
|
||||
path: {{ .Values.imageRenderer.serviceMonitor.path }}
|
||||
scheme: {{ .Values.imageRenderer.serviceMonitor.scheme }}
|
||||
{{- with .Values.imageRenderer.serviceMonitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.imageRenderer.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
jobLabel: "{{ .Release.Name }}-image-renderer"
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "grafana.imageRenderer.selectorLabels" . | nindent 6 }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "grafana.namespace" . }}
|
||||
{{- with .Values.imageRenderer.serviceMonitor.targetLabels }}
|
||||
targetLabels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,78 +0,0 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $ingressApiIsStable := eq (include "grafana.ingress.isStable" .) "true" -}}
|
||||
{{- $ingressSupportsIngressClassName := eq (include "grafana.ingress.supportsIngressClassName" .) "true" -}}
|
||||
{{- $ingressSupportsPathType := eq (include "grafana.ingress.supportsPathType" .) "true" -}}
|
||||
{{- $fullName := include "grafana.fullname" . -}}
|
||||
{{- $servicePort := .Values.service.port -}}
|
||||
{{- $ingressPath := .Values.ingress.path -}}
|
||||
{{- $ingressPathType := .Values.ingress.pathType -}}
|
||||
{{- $extraPaths := .Values.ingress.extraPaths -}}
|
||||
apiVersion: {{ include "grafana.ingress.apiVersion" . }}
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ tpl $value $ | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and $ingressSupportsIngressClassName .Values.ingress.ingressClassName }}
|
||||
ingressClassName: {{ .Values.ingress.ingressClassName }}
|
||||
{{- end -}}
|
||||
{{- with .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if .Values.ingress.hosts }}
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ tpl . $ | quote }}
|
||||
http:
|
||||
paths:
|
||||
{{- with $extraPaths }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
- path: {{ $ingressPath }}
|
||||
{{- if $ingressSupportsPathType }}
|
||||
pathType: {{ $ingressPathType }}
|
||||
{{- end }}
|
||||
backend:
|
||||
{{- if $ingressApiIsStable }}
|
||||
service:
|
||||
name: {{ $fullName }}
|
||||
port:
|
||||
number: {{ $servicePort }}
|
||||
{{- else }}
|
||||
serviceName: {{ $fullName }}
|
||||
servicePort: {{ $servicePort }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- http:
|
||||
paths:
|
||||
- backend:
|
||||
{{- if $ingressApiIsStable }}
|
||||
service:
|
||||
name: {{ $fullName }}
|
||||
port:
|
||||
number: {{ $servicePort }}
|
||||
{{- else }}
|
||||
serviceName: {{ $fullName }}
|
||||
servicePort: {{ $servicePort }}
|
||||
{{- end }}
|
||||
{{- with $ingressPath }}
|
||||
path: {{ . }}
|
||||
{{- end }}
|
||||
{{- if $ingressSupportsPathType }}
|
||||
pathType: {{ $ingressPathType }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
@ -1,61 +0,0 @@
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
policyTypes:
|
||||
{{- if .Values.networkPolicy.ingress }}
|
||||
- Ingress
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.egress.enabled }}
|
||||
- Egress
|
||||
{{- end }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "grafana.selectorLabels" . | nindent 6 }}
|
||||
|
||||
{{- if .Values.networkPolicy.egress.enabled }}
|
||||
egress:
|
||||
{{- if not .Values.networkPolicy.egress.blockDNSResolution }}
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
- ports:
|
||||
{{ .Values.networkPolicy.egress.ports | toJson }}
|
||||
{{- with .Values.networkPolicy.egress.to }}
|
||||
to:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.networkPolicy.ingress }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.service.targetPort }}
|
||||
{{- if not .Values.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ include "grafana.fullname" . }}-client: "true"
|
||||
{{- with .Values.networkPolicy.explicitNamespacesSelector }}
|
||||
- namespaceSelector:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{- include "grafana.labels" . | nindent 14 }}
|
||||
role: read
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,22 +0,0 @@
|
||||
{{- if .Values.podDisruptionBudget }}
|
||||
apiVersion: {{ include "grafana.podDisruptionBudget.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.podDisruptionBudget.minAvailable }}
|
||||
minAvailable: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podDisruptionBudget.maxUnavailable }}
|
||||
maxUnavailable: {{ . }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "grafana.selectorLabels" . | nindent 6 }}
|
||||
{{- end }}
|
||||
@ -1,49 +0,0 @@
|
||||
{{- if and .Values.rbac.pspEnabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
{{- if .Values.rbac.pspUseAppArmor }}
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
{{- end }}
|
||||
spec:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
requiredDropCapabilities:
|
||||
# Default set from Docker, with DAC_OVERRIDE and CHOWN
|
||||
- ALL
|
||||
volumes:
|
||||
- 'configMap'
|
||||
- 'emptyDir'
|
||||
- 'projected'
|
||||
- 'csi'
|
||||
- 'secret'
|
||||
- 'downwardAPI'
|
||||
- 'persistentVolumeClaim'
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'RunAsAny'
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
# Forbid adding the root group.
|
||||
- min: 1
|
||||
max: 65535
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
# Forbid adding the root group.
|
||||
- min: 1
|
||||
max: 65535
|
||||
readOnlyRootFilesystem: false
|
||||
{{- end }}
|
||||
@ -1,39 +0,0 @@
|
||||
{{- if and (not .Values.useStatefulSet) .Values.persistence.enabled (not .Values.persistence.existingClaim) (eq .Values.persistence.type "pvc")}}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.persistence.extraPvcLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.persistence.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.persistence.finalizers }}
|
||||
finalizers:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{- range .Values.persistence.accessModes }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size | quote }}
|
||||
{{- if and (.Values.persistence.lookupVolumeName) (lookup "v1" "PersistentVolumeClaim" (include "grafana.namespace" .) (include "grafana.fullname" .)) }}
|
||||
volumeName: {{ (lookup "v1" "PersistentVolumeClaim" (include "grafana.namespace" .) (include "grafana.fullname" .)).spec.volumeName }}
|
||||
{{- end }}
|
||||
{{- with .Values.persistence.storageClassName }}
|
||||
storageClassName: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.persistence.selectorLabels }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,32 +0,0 @@
|
||||
{{- if and .Values.rbac.create (not .Values.rbac.useExistingRole) -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.rbac.pspEnabled (and .Values.rbac.namespaced (or .Values.sidecar.dashboards.enabled .Values.sidecar.datasources.enabled .Values.sidecar.plugins.enabled .Values.rbac.extraRoleRules)) }}
|
||||
rules:
|
||||
{{- if and .Values.rbac.pspEnabled (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }}
|
||||
- apiGroups: ['extensions']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames: [{{ include "grafana.fullname" . }}]
|
||||
{{- end }}
|
||||
{{- if and .Values.rbac.namespaced (or .Values.sidecar.dashboards.enabled .Values.sidecar.datasources.enabled .Values.sidecar.plugins.enabled) }}
|
||||
- apiGroups: [""] # "" indicates the core API group
|
||||
resources: ["configmaps", "secrets"]
|
||||
verbs: ["get", "watch", "list"]
|
||||
{{- end }}
|
||||
{{- with .Values.rbac.extraRoleRules }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end}}
|
||||
{{- else }}
|
||||
rules: []
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,25 +0,0 @@
|
||||
{{- if .Values.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
{{- if .Values.rbac.useExistingRole }}
|
||||
name: {{ .Values.rbac.useExistingRole }}
|
||||
{{- else }}
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
{{- end }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "grafana.serviceAccountName" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
{{- end }}
|
||||
@ -1,44 +0,0 @@
|
||||
{{- range $name, $route := .Values.route }}
|
||||
{{- if $route.enabled -}}
|
||||
---
|
||||
apiVersion: {{ $route.apiVersion | default "gateway.networking.k8s.io/v1" }}
|
||||
kind: {{ $route.kind | default "HTTPRoute" }}
|
||||
metadata:
|
||||
{{- with $route.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ template "grafana.fullname" $ }}{{ if ne $name "main" }}-{{ $name }}{{ end }}
|
||||
namespace: {{ template "grafana.namespace" $ }}
|
||||
labels:
|
||||
app: {{ template "grafana.name" $ }}-prometheus
|
||||
{{- include "grafana.labels" $ | nindent 4 }}
|
||||
{{- with $route.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with $route.parentRefs }}
|
||||
parentRefs:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $route.hostnames }}
|
||||
hostnames:
|
||||
{{- tpl (toYaml .) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- if $route.additionalRules }}
|
||||
{{- tpl (toYaml $route.additionalRules) $ | nindent 4 }}
|
||||
{{- end }}
|
||||
- backendRefs:
|
||||
- name: {{ include "grafana.fullname" $ }}
|
||||
port: {{ $.Values.service.port }}
|
||||
{{- with $route.filters }}
|
||||
filters:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with $route.matches }}
|
||||
matches:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,14 +0,0 @@
|
||||
{{- if .Values.envRenderSecret }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-env
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- range $key, $val := .Values.envRenderSecret }}
|
||||
{{ $key }}: {{ tpl ($val | toString) $ | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,16 +0,0 @@
|
||||
{{- if or (and (not .Values.admin.existingSecret) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD__FILE) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD) (not .Values.env.GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION)) (and .Values.ldap.enabled (not .Values.ldap.existingSecret)) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- include "grafana.secretsData" . | nindent 2 }}
|
||||
{{- end }}
|
||||
@ -1,67 +0,0 @@
|
||||
{{- if .Values.service.enabled }}
|
||||
{{- $root := . }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.service.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- tpl (toYaml . | nindent 4) $root }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if (or (eq .Values.service.type "ClusterIP") (empty .Values.service.type)) }}
|
||||
type: ClusterIP
|
||||
{{- with .Values.service.clusterIP }}
|
||||
clusterIP: {{ . }}
|
||||
{{- end }}
|
||||
{{- else if eq .Values.service.type "LoadBalancer" }}
|
||||
type: LoadBalancer
|
||||
{{- with .Values.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.loadBalancerClass }}
|
||||
loadBalancerClass: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
type: {{ .Values.service.type }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.ipFamilies }}
|
||||
ipFamilies: {{ .Values.service.ipFamilies | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.externalIPs }}
|
||||
externalIPs:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ . }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: {{ .Values.service.portName }}
|
||||
port: {{ .Values.service.port }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.service.targetPort }}
|
||||
{{- with .Values.service.appProtocol }}
|
||||
appProtocol: {{ . }}
|
||||
{{- end }}
|
||||
{{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }}
|
||||
nodePort: {{ .Values.service.nodePort }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraExposePorts }}
|
||||
{{- tpl (toYaml . | nindent 4) $root }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "grafana.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@ -1,17 +0,0 @@
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.autoMount | default .Values.serviceAccount.automountServiceAccountToken }}
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- tpl (toYaml . | nindent 4) $ }}
|
||||
{{- end }}
|
||||
name: {{ include "grafana.serviceAccountName" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
{{- end }}
|
||||
@ -1,52 +0,0 @@
|
||||
{{- if .Values.serviceMonitor.enabled }}
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
{{- if .Values.serviceMonitor.namespace }}
|
||||
namespace: {{ tpl .Values.serviceMonitor.namespace . }}
|
||||
{{- else }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceMonitor.labels }}
|
||||
{{- tpl (toYaml . | nindent 4) $ }}
|
||||
{{- end }}
|
||||
spec:
|
||||
endpoints:
|
||||
- port: {{ .Values.service.portName }}
|
||||
{{- with .Values.serviceMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
honorLabels: true
|
||||
path: {{ .Values.serviceMonitor.path }}
|
||||
scheme: {{ .Values.serviceMonitor.scheme }}
|
||||
{{- with .Values.serviceMonitor.tlsConfig }}
|
||||
tlsConfig:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.relabelings }}
|
||||
relabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
jobLabel: "{{ .Release.Name }}"
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "grafana.selectorLabels" . | nindent 6 }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "grafana.namespace" . }}
|
||||
{{- with .Values.serviceMonitor.targetLabels }}
|
||||
targetLabels:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,58 +0,0 @@
|
||||
{{- $sts := list "sts" "StatefulSet" "statefulset" -}}
|
||||
{{- if (or (.Values.useStatefulSet) (and .Values.persistence.enabled (not .Values.persistence.existingClaim) (has .Values.persistence.type $sts)))}}
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "grafana.selectorLabels" . | nindent 6 }}
|
||||
serviceName: {{ include "grafana.fullname" . }}-headless
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
checksum/dashboards-json-config: {{ include (print $.Template.BasePath "/dashboards-json-configmap.yaml") . | sha256sum }}
|
||||
checksum/sc-dashboard-provider-config: {{ include (print $.Template.BasePath "/configmap-dashboard-provider.yaml") . | sha256sum }}
|
||||
{{- if and (or (and (not .Values.admin.existingSecret) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD__FILE) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD)) (and .Values.ldap.enabled (not .Values.ldap.existingSecret))) (not .Values.env.GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION) }}
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
kubectl.kubernetes.io/default-container: {{ .Chart.Name }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "grafana.pod" . | nindent 6 }}
|
||||
{{- if .Values.persistence.enabled}}
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: storage
|
||||
spec:
|
||||
accessModes: {{ .Values.persistence.accessModes }}
|
||||
storageClassName: {{ .Values.persistence.storageClassName }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.persistence.size }}
|
||||
{{- with .Values.persistence.selectorLabels }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,20 +0,0 @@
|
||||
{{- if .Values.testFramework.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-test
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": {{ .Values.testFramework.hookType | default "test" }}
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
data:
|
||||
run.sh: |-
|
||||
@test "Test Health" {
|
||||
url="http://{{ include "grafana.fullname" . }}/api/health"
|
||||
|
||||
code=$(wget --server-response --spider --timeout 90 --tries 10 ${url} 2>&1 | awk '/^ HTTP/{print $2}')
|
||||
[ "$code" == "200" ]
|
||||
}
|
||||
{{- end }}
|
||||
@ -1,32 +0,0 @@
|
||||
{{- if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.testFramework.enabled .Values.rbac.pspEnabled }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-test
|
||||
annotations:
|
||||
"helm.sh/hook": {{ .Values.testFramework.hookType | default "test" }}
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
spec:
|
||||
allowPrivilegeEscalation: true
|
||||
privileged: false
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
fsGroup:
|
||||
rule: RunAsAny
|
||||
seLinux:
|
||||
rule: RunAsAny
|
||||
supplementalGroups:
|
||||
rule: RunAsAny
|
||||
runAsUser:
|
||||
rule: RunAsAny
|
||||
volumes:
|
||||
- configMap
|
||||
- downwardAPI
|
||||
- emptyDir
|
||||
- projected
|
||||
- csi
|
||||
- secret
|
||||
{{- end }}
|
||||
@ -1,17 +0,0 @@
|
||||
{{- if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.testFramework.enabled .Values.rbac.pspEnabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-test
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": {{ .Values.testFramework.hookType | default "test" }}
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ['policy']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames: [{{ include "grafana.fullname" . }}-test]
|
||||
{{- end }}
|
||||
@ -1,20 +0,0 @@
|
||||
{{- if and (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") .Values.testFramework.enabled .Values.rbac.pspEnabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-test
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": {{ .Values.testFramework.hookType | default "test" }}
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "grafana.fullname" . }}-test
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "grafana.serviceAccountNameTest" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
{{- end }}
|
||||
@ -1,12 +0,0 @@
|
||||
{{- if and .Values.testFramework.enabled .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
name: {{ include "grafana.serviceAccountNameTest" . }}
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": {{ .Values.testFramework.hookType | default "test" }}
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
|
||||
{{- end }}
|
||||
@ -1,53 +0,0 @@
|
||||
{{- if .Values.testFramework.enabled }}
|
||||
{{- $root := . }}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: {{ include "grafana.fullname" . }}-test
|
||||
labels:
|
||||
{{- include "grafana.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": {{ .Values.testFramework.hookType | default "test" }}
|
||||
"helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded"
|
||||
namespace: {{ include "grafana.namespace" . }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "grafana.serviceAccountNameTest" . }}
|
||||
{{- with .Values.testFramework.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.image.pullSecrets .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- include "grafana.imagePullSecrets" (dict "root" $root "imagePullSecrets" .Values.image.pullSecrets) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- tpl (toYaml .) $root | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Release.Name }}-test
|
||||
image: "{{ .Values.global.imageRegistry | default .Values.testFramework.image.registry }}/{{ .Values.testFramework.image.repository }}:{{ .Values.testFramework.image.tag }}"
|
||||
imagePullPolicy: "{{ .Values.testFramework.imagePullPolicy}}"
|
||||
command: ["/opt/bats/bin/bats", "-t", "/tests/run.sh"]
|
||||
volumeMounts:
|
||||
- mountPath: /tests
|
||||
name: tests
|
||||
readOnly: true
|
||||
{{- with .Values.testFramework.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: tests
|
||||
configMap:
|
||||
name: {{ include "grafana.fullname" . }}-test
|
||||
restartPolicy: Never
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user