472 lines
14 KiB
YAML
472 lines
14 KiB
YAML
# Default values for keto.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
# -- Number of replicas in deployment
|
|
replicaCount: 1
|
|
|
|
## -- Image configuration
|
|
image:
|
|
# -- Ory KETO image
|
|
repository: oryd/keto
|
|
# -- Default image pull policy
|
|
pullPolicy: IfNotPresent
|
|
# Overrides the image tag whose default is the chart appVersion.
|
|
# -- Ory KETO version
|
|
tag: "v0.12.0"
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
# -- Pod priority
|
|
# https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
|
|
priorityClassName: ""
|
|
|
|
## -- ServiceAccount
|
|
serviceAccount:
|
|
# -- Specifies whether a service account should be created
|
|
create: true
|
|
# -- Annotations to add to the service account
|
|
annotations: {}
|
|
# -- The name of the service account to use.
|
|
# If not set and create is true, a name is generated using the fullname template
|
|
name: ""
|
|
|
|
## -- pod securityContext for hydra & migration init
|
|
podSecurityContext:
|
|
fsGroupChangePolicy: "OnRootMismatch"
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
fsGroup: 65534
|
|
runAsGroup: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
## -- container securityContext for hydra & migration init
|
|
securityContext:
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
runAsGroup: 65534
|
|
allowPrivilegeEscalation: false
|
|
privileged: false
|
|
seLinuxOptions:
|
|
level: "s0:c123,c456"
|
|
|
|
## -- Values for initialization job
|
|
job:
|
|
# -- If you do want to specify annotations, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'annotations:'.
|
|
annotations:
|
|
helm.sh/hook-weight: "1"
|
|
helm.sh/hook: "pre-install, pre-upgrade"
|
|
helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded"
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
|
|
# -- If you want to add extra sidecar containers.
|
|
extraContainers: ""
|
|
# extraContainers: |
|
|
# - name: ...
|
|
# image: ...
|
|
|
|
# -- If you want to add extra init containers.
|
|
extraInitContainers: ""
|
|
# extraInitContainers: |
|
|
# - name: ...
|
|
# image: ...
|
|
|
|
# -- Array of extra envs to be passed to the job. This takes precedence over deployment variables. Kubernetes format
|
|
# is expected. Value is processed with Helm `tpl`
|
|
# - name: FOO
|
|
# value: BAR
|
|
extraEnv: []
|
|
|
|
# -- Node labels for pod assignment.
|
|
nodeSelector: {}
|
|
# If you do want to specify node labels, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'nodeSelector:'.
|
|
# foo: bar
|
|
|
|
# -- Configure node tolerations.
|
|
tolerations: []
|
|
|
|
# -- Job resources
|
|
resources: {}
|
|
|
|
# -- If you want to add lifecycle hooks.
|
|
lifecycle: ""
|
|
# lifecycle: |
|
|
# preStop:
|
|
# exec:
|
|
# command: [...]
|
|
|
|
# -- Set automounting of the SA token
|
|
automountServiceAccountToken: false
|
|
|
|
# -- Set sharing process namespace
|
|
shareProcessNamespace: false
|
|
|
|
# -- Specify the serviceAccountName value.
|
|
# In some situations it is needed to provides specific permissions to Hydra deployments
|
|
# Like for example installing Hydra on a cluster with a PosSecurityPolicy and Istio.
|
|
# Uncoment if it is needed to provide a ServiceAccount for the Hydra deployment.
|
|
serviceAccount:
|
|
# -- Specifies whether a service account should be created
|
|
create: true
|
|
# -- Annotations to add to the service account
|
|
annotations:
|
|
helm.sh/hook-weight: "0"
|
|
helm.sh/hook: "pre-install, pre-upgrade"
|
|
helm.sh/hook-delete-policy: "before-hook-creation"
|
|
# -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template
|
|
name: ""
|
|
|
|
# -- Specify pod metadata, this metadata is added directly to the pod, and not higher objects
|
|
podMetadata:
|
|
# -- Extra pod level labels
|
|
labels: {}
|
|
# -- Extra pod level annotations
|
|
annotations: {}
|
|
|
|
spec:
|
|
# -- Set job back off limit
|
|
backoffLimit: 10
|
|
|
|
## -- Ingress definitions
|
|
ingress:
|
|
read:
|
|
enabled: false
|
|
className: ""
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
hosts:
|
|
- host: chart-example.local
|
|
paths:
|
|
- path: /read
|
|
pathType: Prefix
|
|
tls: []
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - chart-example.local
|
|
write:
|
|
enabled: false
|
|
className: ""
|
|
annotations: {}
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
hosts:
|
|
- host: chart-example.local
|
|
paths:
|
|
- path: /write
|
|
pathType: Prefix
|
|
tls: []
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - chart-example.local
|
|
|
|
## -- Service configurations
|
|
service:
|
|
## -- Read service
|
|
read:
|
|
enabled: true
|
|
type: ClusterIP
|
|
clusterIP: ""
|
|
## -- The load balancer IP
|
|
loadBalancerIP: ""
|
|
name: grpc-read
|
|
port: 80
|
|
appProtocol: grpc
|
|
## -- Enable extra headless service
|
|
headless:
|
|
enabled: true
|
|
## -- Write service
|
|
write:
|
|
enabled: true
|
|
type: ClusterIP
|
|
clusterIP: ""
|
|
## -- The load balancer IP
|
|
loadBalancerIP: ""
|
|
name: grpc-write
|
|
port: 80
|
|
appProtocol: grpc
|
|
## -- Enable extra headless service
|
|
headless:
|
|
enabled: true
|
|
## -- Metrics service
|
|
metrics:
|
|
enabled: false
|
|
type: ClusterIP
|
|
## -- The load balancer IP
|
|
loadBalancerIP: ""
|
|
name: http-metrics
|
|
port: 80
|
|
annotations: {}
|
|
|
|
## -- Extra services to be deployed
|
|
extraServices: {}
|
|
|
|
## -- Secret management
|
|
secret:
|
|
# -- Switch to false to prevent creating the secret
|
|
enabled: true
|
|
# -- Provide custom name of existing secret, or custom name of secret to be created
|
|
nameOverride: ""
|
|
# nameOverride: "myCustomSecret"
|
|
# -- Annotations to be added to secret. Annotations are added only when secret is being created. Existing secret will not be modified.
|
|
secretAnnotations:
|
|
# Create the secret before installation, and only then. This saves the secret from regenerating during an upgrade
|
|
# pre-upgrade is needed to upgrade from 0.7.0 to newer. Can be deleted afterwards.
|
|
helm.sh/hook-weight: "0"
|
|
helm.sh/hook: "pre-install, pre-upgrade"
|
|
helm.sh/hook-delete-policy: "before-hook-creation"
|
|
helm.sh/resource-policy: "keep"
|
|
# -- switch to false to prevent checksum annotations being maintained and propogated to the pods
|
|
hashSumEnabled: true
|
|
|
|
## -- Main application config.
|
|
keto:
|
|
# -- Ability to override the entrypoint of keto container
|
|
# (e.g. to source dynamic secrets or export environment dynamic variables)
|
|
command: ["keto"]
|
|
# -- Ability to override arguments of the entrypoint. Can be used in-depended of customCommand
|
|
customArgs: []
|
|
# -- Enables database migration
|
|
automigration:
|
|
enabled: false
|
|
# -- Configure the way to execute database migration. Possible values: job, initContainer
|
|
# When set to job, the migration will be executed as a job on release or upgrade.
|
|
# When set to initContainer, the migration will be executed when kratos pod is created
|
|
# Defaults to job
|
|
type: job
|
|
# -- Ability to override the entrypoint of the automigration container
|
|
# (e.g. to source dynamic secrets or export environment dynamic variables)
|
|
customCommand: []
|
|
# -- Ability to override arguments of the entrypoint. Can be used in-depended of customCommand
|
|
# eg:
|
|
# - sleep 5;
|
|
# - keto
|
|
customArgs: []
|
|
# -- resource requests and limits for the automigration initcontainer
|
|
resources: {}
|
|
# -- Direct keto config. Full documentation can be found in https://www.ory.sh/keto/docs/reference/configuration
|
|
config:
|
|
serve:
|
|
read:
|
|
port: 4466
|
|
write:
|
|
port: 4467
|
|
metrics:
|
|
port: 4468
|
|
namespaces:
|
|
- id: 0
|
|
name: sample
|
|
dsn: memory
|
|
|
|
## -- Configure the probes for when the deployment is considered ready and ongoing health check
|
|
deployment:
|
|
## -- Specify pod deployment strategy
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: "25%"
|
|
maxUnavailable: "25%"
|
|
|
|
## -- Minimum number of seconds for which a newly created pod should be ready without any of its container crashing, for it to be considered available. Defaults to 0 (pod will be considered available as soon as it is ready)
|
|
minReadySeconds: 0
|
|
|
|
## -- DEPRECATED Set custom pod annotations
|
|
podAnnotations: {}
|
|
|
|
## -- Specify pod metadata, this metadata is added directly to the pod, and not higher objects
|
|
podMetadata:
|
|
## -- Extra pod level labels
|
|
labels: {}
|
|
## -- Extra pod level annotations
|
|
annotations: {}
|
|
|
|
## -- Set custom security context for pods
|
|
podSecurityContext: {}
|
|
# fsGroup: 2000
|
|
|
|
# https://github.com/kubernetes/kubernetes/issues/57601
|
|
automountServiceAccountToken: true
|
|
|
|
lifecycle: {}
|
|
## -- Default probe timers
|
|
readinessProbe:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
failureThreshold: 5
|
|
## -- Default probe timers
|
|
startupProbe:
|
|
failureThreshold: 5
|
|
successThreshold: 1
|
|
periodSeconds: 1
|
|
timeoutSeconds: 1
|
|
initialDelaySeconds: 0
|
|
## -- Configure a custom livenessProbe. This overwrites the default object
|
|
customLivenessProbe: {}
|
|
## -- Configure a custom readinessProbe. This overwrites the default object
|
|
customReadinessProbe: {}
|
|
## -- Configure a custom startupProbe. This overwrites the default object
|
|
customStartupProbe: {}
|
|
|
|
## -- Add custom annotations to the deployment
|
|
annotations: {}
|
|
|
|
resources: {}
|
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
# choice for the user. This also increases chances charts run on environments with little
|
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 128Mi
|
|
|
|
# -- Autoscaling for keto deployment
|
|
autoscaling:
|
|
enabled: false
|
|
minReplicas: 1
|
|
maxReplicas: 100
|
|
targetCPU: {}
|
|
# type: Utilization
|
|
# averageUtilization: 80
|
|
targetMemory: {}
|
|
# type: Utilization
|
|
# averageUtilization: 80
|
|
# -- Set custom behavior
|
|
# https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#configurable-scaling-behavior
|
|
behavior: {}
|
|
|
|
nodeSelector: {}
|
|
|
|
# -- If you want to add extra sidecar containers.
|
|
extraContainers: ""
|
|
# extraContainers: |
|
|
# - name: ...
|
|
# image: ...
|
|
|
|
# -- Array of extra Envs to be added to the deployment. Kubernetes format expected. Value is processed with Helm `tpl`
|
|
# - name: FOO
|
|
# value: BAR
|
|
extraEnv: []
|
|
|
|
# -- Array of extra Volumes to be added to the deployment. K8s format expected
|
|
# - name: my-volume
|
|
# secret:
|
|
# secretName: my-secret
|
|
extraVolumes: []
|
|
|
|
# -- Array of extra VolumeMounts to be added to the deployment. K8s format expected
|
|
# - name: my-volume
|
|
# mountPath: /etc/secrets/my-secret
|
|
# readOnly: true
|
|
extraVolumeMounts: []
|
|
|
|
# -- If you want to add extra init containers. These are processed before the migration init container.
|
|
extraInitContainers: {}
|
|
# extraInitContainers: |
|
|
# - name: ...
|
|
# image: ...
|
|
|
|
# -- Extra labels to be added to the deployment, and pods. K8s object format expected
|
|
# foo: bar
|
|
# my.special.label/type: value
|
|
extraLabels: {}
|
|
|
|
# -- Extra ports to be exposed by the main deployment
|
|
extraPorts: []
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|
|
|
|
# -- Configure pod topologySpreadConstraints.
|
|
topologySpreadConstraints: []
|
|
# - maxSkew: 1
|
|
# topologyKey: topology.kubernetes.io/zone
|
|
# whenUnsatisfiable: DoNotSchedule
|
|
# labelSelector:
|
|
# matchLabels:
|
|
# app.kubernetes.io/name: keto
|
|
# app.kubernetes.io/instance: keto
|
|
|
|
# -- Configure pod dnsConfig.
|
|
dnsConfig: {}
|
|
# options:
|
|
# - name: "ndots"
|
|
# value: "1"
|
|
|
|
# -- Parameters for the automigration initContainer
|
|
automigration:
|
|
# -- Array of extra envs to be passed to the initContainer. Kubernetes format is expected. Value is processed with
|
|
# Helm `tpl`
|
|
# - name: FOO
|
|
# value: BAR
|
|
extraEnv: []
|
|
# -- Number of revisions kept in history
|
|
revisionHistoryLimit: 5
|
|
terminationGracePeriodSeconds: 60
|
|
|
|
## -- Watcher sidecar configuration
|
|
watcher:
|
|
enabled: false
|
|
image: oryd/k8s-toolbox:v0.0.7
|
|
# -- Path to mounted file, which wil be monitored for changes. eg: /etc/secrets/my-secret/foo
|
|
mountFile: ""
|
|
# -- Specify pod metadata, this metadata is added directly to the pod, and not higher objects
|
|
podMetadata:
|
|
# -- Extra pod level labels
|
|
labels: {}
|
|
# -- Extra pod level annotations
|
|
annotations: {}
|
|
# -- Label key used for managing applications
|
|
watchLabelKey: "ory.sh/watcher"
|
|
# -- Number of revisions kept in history
|
|
revisionHistoryLimit: 5
|
|
automountServiceAccountToken: true
|
|
resources: {}
|
|
|
|
## -- PodDistributionBudget configuration
|
|
pdb:
|
|
enabled: false
|
|
spec:
|
|
minAvailable: ""
|
|
maxUnavailable: ""
|
|
|
|
## -- Parameters for the Prometheus ServiceMonitor objects.
|
|
# Reference: https://docs.openshift.com/container-platform/4.6/rest_api/monitoring_apis/servicemonitor-monitoring-coreos-com-v1.html
|
|
serviceMonitor:
|
|
# -- HTTP scheme to use for scraping.
|
|
scheme: http
|
|
# -- Interval at which metrics should be scraped
|
|
scrapeInterval: 60s
|
|
# -- Timeout after which the scrape is ended
|
|
scrapeTimeout: 30s
|
|
# -- Provide additionnal labels to the ServiceMonitor ressource metadata
|
|
labels: {}
|
|
# -- TLS configuration to use when scraping the endpoint
|
|
tlsConfig: {}
|
|
|
|
configmap:
|
|
# -- switch to false to prevent checksum annotations being maintained and propogated to the pods
|
|
hashSumEnabled: true
|
|
|
|
test:
|
|
# -- Provide additional labels to the test pod
|
|
labels: {}
|
|
# -- use a busybox image from another repository
|
|
busybox:
|
|
repository: busybox
|
|
tag: 1
|