seaweedfs

Helm chart

iamguarded

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

# This file has been modified by Chainguard, Inc.

# Chainguard, Inc. modifications are subject to the license

# available at: https://www.chainguard.dev/legal/software-license-agreement

# SPDX-License-Identifier: APACHE-2.0

## @section Global parameters

## Global Docker image parameters

## Please, note that this will override the image parameters, including dependencies, configured to use the global value

## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass

## @param global.imageRegistry Global Docker image registry

## @param global.imagePullSecrets Global Docker registry secret names as an array

## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)

global:

imageRegistry: ""

## e.g:

## imagePullSecrets:

## - myRegistryKeySecretName

imagePullSecrets: []

defaultStorageClass: ""

## Security parameters

security:

## @param global.security.allowInsecureImages Allows skipping image verification

allowInsecureImages: false

## Compatibility adaptations for Kubernetes platforms

compatibility:

## Compatibility adaptations for Openshift

openshift:

## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)

adaptSecurityContext: auto

org: ""

## @section Common parameters

## @param kubeVersion Override Kubernetes version

kubeVersion: ""

## @param nameOverride String to partially override common.names.name

nameOverride: ""

## @param fullnameOverride String to fully override common.names.fullname

fullnameOverride: ""

## @param namespaceOverride String to fully override common.names.namespace

namespaceOverride: ""

## @param commonLabels Labels to add to all deployed objects

commonLabels: {}

## @param commonAnnotations Annotations to add to all deployed objects

commonAnnotations: {}

## @param clusterDomain Kubernetes cluster domain name

clusterDomain: cluster.local

## @param extraDeploy Array of extra objects to deploy with the release

extraDeploy: []

## Diagnostic mode

## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)

## @param diagnosticMode.command Command to override all containers in the chart release

## @param diagnosticMode.args Args to override all containers in the chart release

diagnosticMode:

enabled: false

command:

- sleep

args:

- infinity

## Iamguarded SeaweedFS image

## @param image.registry [default: REGISTRY_NAME] SeaweedFS image registry

## @param image.repository [default: REPOSITORY_NAME/seaweedfs] SeaweedFS image repository

## @skip image.tag SeaweedFS image tag (immutable tags are recommended)

## @param image.digest SeaweedFS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag image tag (immutable tags are recommended)

## @param image.pullPolicy SeaweedFS image pull policy

## @param image.pullSecrets SeaweedFS image pull secrets

## @param image.debug Enable SeaweedFS image debug mode

image:

registry: cgr.dev

repository: chainguard-private/seaweedfs-iamguarded

tag: 4.45-r3

digest: ""

## Specify a imagePullPolicy

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

100

## Secrets must be manually created in the namespace.

101

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

102

## e.g:

103

## pullSecrets:

104

## - myRegistryKeySecretName

105

106

pullSecrets: []

107

debug: false

108

## Security parameters

109

110

security:

111

## @param security.enabled Enable Security settings

112

113

enabled: false

114

## @param security.corsAllowedOrigins CORS allowed origins

115

116

corsAllowedOrigins: "*"

117

## JWT authz parameters

118

## ref: https://github.com/seaweedfs/seaweedfs/wiki/Security-Overview#securing-volume-servers

119

## ref: https://github.com/seaweedfs/seaweedfs/wiki/Security-Overview#securing-filer-http-with-jwt

120

## @param security.jwtSigning.volumeWrite Enable JWT signing for volume write operations

121

## @param security.jwtSigning.volumeRead Enable JWT signing for volume read operations

122

## @param security.jwtSigning.filerWrite Enable JWT signing for filer write operations

123

## @param security.jwtSigning.filerRead Enable JWT signing for filer read operations

124

125

jwtSigning:

126

volumeWrite: true

127

volumeRead: false

128

filerWrite: false

129

filerRead: false

130

## Mutual TLS for gRPC communications

131

## ref: https://github.com/seaweedfs/seaweedfs/wiki/Security-Overview#securing-grpc-operations

132

133

mTLS:

134

## @param security.mTLS.enabled Enable mTLS for gRPC communications

135

136

enabled: false

137

## @param security.mTLS.autoGenerated.enabled Enable automatic generation of certificates for mTLS

138

## @param security.mTLS.autoGenerated.engine Mechanism to generate the certificates (allowed values: helm, cert-manager)

139

autoGenerated:

140

enabled: false

141

engine: helm

142

## @param security.mTLS.autoGenerated.certManager.existingIssuer The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine)

143

## @param security.mTLS.autoGenerated.certManager.existingIssuerKind Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine)

144

## @param security.mTLS.autoGenerated.certManager.keyAlgorithm Key algorithm for the certificates (only for `cert-manager` engine)

145

## @param security.mTLS.autoGenerated.certManager.keySize Key size for the certificates (only for `cert-manager` engine)

146

## @param security.mTLS.autoGenerated.certManager.duration Duration for the certificates (only for `cert-manager` engine)

147

## @param security.mTLS.autoGenerated.certManager.renewBefore Renewal period for the certificates (only for `cert-manager` engine)

148

certManager:

149

existingIssuer: ""

150

existingIssuerKind: ""

151

keySize: 2048

152

keyAlgorithm: RSA

153

duration: 2160h

154

renewBefore: 360h

155

## @param security.mTLS.ca CA certificate for mTLS. Ignored if `security.mTLS.existingCASecret` is set

156

## @param security.mTLS.existingCASecret The name of an existing Secret containing the CA certificate for mTLS

157

## @param security.mTLS.master.cert Master Server certificate for mTLS. Ignored if `security.mTLS.master.existingSecret` is set

158

## @param security.mTLS.master.key Master Server key for mTLS. Ignored if `security.mTLS.master.existingSecret` is set

159

## @param security.mTLS.master.existingSecret The name of an existing Secret containing the Master Server certificates for mTLS

160

## @param security.mTLS.volume.cert Volume Server certificate for mTLS. Ignored if `security.mTLS.volume.existingSecret` is set

161

## @param security.mTLS.volume.key Volume Server key for mTLS. Ignored if `security.mTLS.volume.existingSecret` is set

162

## @param security.mTLS.volume.existingSecret The name of an existing Secret containing the Volume Server certificates for mTLS

163

## @param security.mTLS.filer.cert Filer certificate for mTLS. Ignored if `security.mTLS.filer.existingSecret` is set

164

## @param security.mTLS.filer.key Filer key for mTLS. Ignored if `security.mTLS.filer.existingSecret` is set

165

## @param security.mTLS.filer.existingSecret The name of an existing Secret containing the Filer certificates for mTLS

166

## @param security.mTLS.client.cert Client certificate for mTLS. Ignored if `security.mTLS.client.existingSecret` is set

167

## @param security.mTLS.client.key Client key for mTLS. Ignored if `security.mTLS.client.existingSecret` is set

168

## @param security.mTLS.client.existingSecret The name of an existing Secret containing the Client certificates for mTLS

169

ca: ""

170

existingCASecret: ""

171

master:

172

cert: ""

173

key: ""

174

existingSecret: ""

175

volume:

176

cert: ""

177

key: ""

178

existingSecret: ""

179

filer:

180

cert: ""

181

key: ""

182

existingSecret: ""

183

client:

184

cert: ""

185

key: ""

186

existingSecret: ""

187

## @param clusterDefault Default SeaweedFS cluster name

188

189

clusterDefault: sw

190

## @section Master Server Parameters

191

192

master:

193

## @param master.replicaCount Number of Master Server replicas to deploy

194

195

replicaCount: 1

196

## @param master.containerPorts.http Master Server HTTP container port

197

## @param master.containerPorts.grpc Master Server GRPC container port

198

## @param master.containerPorts.metrics Master Server metrics container port

199

200

containerPorts:

201

http: 9333

202

grpc: 19333

203

metrics: 9327

204

## @param master.extraContainerPorts Optionally specify extra list of additional ports for Master Server containers

205

## e.g:

206

## extraContainerPorts:

207

## - name: myservice

208

## containerPort: 9090

209

210

extraContainerPorts: []

211

## Configure extra options for Master Server containers' liveness and readiness probes

212

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

213

## @param master.livenessProbe.enabled Enable livenessProbe on Master Server containers

214

## @param master.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

215

## @param master.livenessProbe.periodSeconds Period seconds for livenessProbe

216

## @param master.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

217

## @param master.livenessProbe.failureThreshold Failure threshold for livenessProbe

218

## @param master.livenessProbe.successThreshold Success threshold for livenessProbe

219

220

livenessProbe:

221

enabled: true

222

initialDelaySeconds: 30

223

timeoutSeconds: 30

224

periodSeconds: 10

225

successThreshold: 1

226

failureThreshold: 6

227

## @param master.readinessProbe.enabled Enable readinessProbe on Master Server containers

228

## @param master.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

229

## @param master.readinessProbe.periodSeconds Period seconds for readinessProbe

230

## @param master.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

231

## @param master.readinessProbe.failureThreshold Failure threshold for readinessProbe

232

## @param master.readinessProbe.successThreshold Success threshold for readinessProbe

233

234

readinessProbe:

235

enabled: true

236

initialDelaySeconds: 30

237

timeoutSeconds: 30

238

periodSeconds: 10

239

successThreshold: 1

240

failureThreshold: 6

241

## @param master.startupProbe.enabled Enable startupProbe on Master Server containers

242

## @param master.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

243

## @param master.startupProbe.periodSeconds Period seconds for startupProbe

244

## @param master.startupProbe.timeoutSeconds Timeout seconds for startupProbe

245

## @param master.startupProbe.failureThreshold Failure threshold for startupProbe

246

## @param master.startupProbe.successThreshold Success threshold for startupProbe

247

248

startupProbe:

249

enabled: false

250

initialDelaySeconds: 5

251

periodSeconds: 5

252

timeoutSeconds: 1

253

failureThreshold: 15

254

successThreshold: 1

255

## @param master.customLivenessProbe Custom livenessProbe that overrides the default one

256

257

customLivenessProbe: {}

258

## @param master.customReadinessProbe Custom readinessProbe that overrides the default one

259

260

customReadinessProbe: {}

261

## @param master.customStartupProbe Custom startupProbe that overrides the default one

262

263

customStartupProbe: {}

264

## Master Server resource requests and limits

265

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

266

## @param master.resourcesPreset Set Master Server container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if master.resources is set (master.resources is recommended for production).

267

268

resourcesPreset: "nano"

269

## @param master.resources Set Master Server container requests and limits for different resources like CPU or memory (essential for production workloads)

270

## Example:

271

## resources:

272

## requests:

273

## cpu: 2

274

## memory: 512Mi

275

## limits:

276

## cpu: 3

277

## memory: 1024Mi

278

279

resources: {}

280

## Configure Pods Security Context

281

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

282

## @param master.podSecurityContext.enabled Enable Master Server pods' Security Context

283

## @param master.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for Master Server pods

284

## @param master.podSecurityContext.sysctls Set kernel settings using the sysctl interface for Master Server pods

285

## @param master.podSecurityContext.supplementalGroups Set filesystem extra groups for Master Server pods

286

## @param master.podSecurityContext.fsGroup Set fsGroup in Master Server pods' Security Context

287

288

podSecurityContext:

289

enabled: true

290

fsGroupChangePolicy: Always

291

sysctls: []

292

supplementalGroups: []

293

fsGroup: 1001

294

## Configure Container Security Context

295

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

296

## @param master.containerSecurityContext.enabled Enabled Master Server container' Security Context

297

## @param master.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in Master Server container

298

## @param master.containerSecurityContext.runAsUser Set runAsUser in Master Server container' Security Context

299

## @param master.containerSecurityContext.runAsGroup Set runAsGroup in Master Server container' Security Context

300

## @param master.containerSecurityContext.runAsNonRoot Set runAsNonRoot in Master Server container' Security Context

301

## @param master.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in Master Server container' Security Context

302

## @param master.containerSecurityContext.privileged Set privileged in Master Server container' Security Context

303

## @param master.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in Master Server container' Security Context

304

## @param master.containerSecurityContext.capabilities.drop List of capabilities to be dropped in Master Server container

305

## @param master.containerSecurityContext.seccompProfile.type Set seccomp profile in Master Server container

306

307

containerSecurityContext:

308

enabled: true

309

seLinuxOptions: {}

310

runAsUser: 1001

311

runAsGroup: 1001

312

runAsNonRoot: true

313

readOnlyRootFilesystem: true

314

privileged: false

315

allowPrivilegeEscalation: false

316

capabilities:

317

drop: ["ALL"]

318

seccompProfile:

319

type: "RuntimeDefault"

320

## @param master.logLevel Master Server log level (0, 1, 2, 3, or 4)

321

322

logLevel: 1

323

## @param master.bindAddress Master Server bind address

324

325

bindAddress: 0.0.0.0

326

## @param master.volumeSizeLimitMB Limit (in MB) to stop directing writes to oversized volumes

327

328

volumeSizeLimitMB: 1000

329

## @param master.config Master Server configuration

330

## Specify content for master.toml

331

332

config: ""

333

## @param master.existingConfigmap The name of an existing ConfigMap with your custom configuration for Master Server

334

335

existingConfigmap: ""

336

## @param master.command Override default Master Server container command (useful when using custom images)

337

338

command: []

339

## @param master.args Override default Master Server container args (useful when using custom images)

340

341

args: []

342

## @param master.automountServiceAccountToken Mount Service Account token in Master Server pods

343

344

automountServiceAccountToken: false

345

## @param master.hostAliases Master Server pods host aliases

346

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

347

348

hostAliases: []

349

## @param master.statefulsetAnnotations Annotations for Master Server StatefulSet

350

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

351

352

statefulsetAnnotations: {}

353

## @param master.podLabels Extra labels for Master Server pods

354

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

355

356

podLabels: {}

357

## @param master.podAnnotations Annotations for Master Server pods

358

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

359

360

podAnnotations: {}

361

## @param master.podAffinityPreset Pod affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard`

362

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

363

364

podAffinityPreset: ""

365

## @param master.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard`

366

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

367

368

podAntiAffinityPreset: soft

369

## Node master.affinity preset

370

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

371

372

nodeAffinityPreset:

373

## @param master.nodeAffinityPreset.type Node affinity preset type. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard`

374

375

type: ""

376

## @param master.nodeAffinityPreset.key Node label key to match. Ignored if `master.affinity` is set

377

378

key: ""

379

## @param master.nodeAffinityPreset.values Node label values to match. Ignored if `master.affinity` is set

380

## E.g.

381

## values:

382

## - e2e-az1

383

## - e2e-az2

384

385

values: []

386

## @param master.affinity Affinity for Master Server pods assignment

387

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

388

## NOTE: `master.podAffinityPreset`, `master.podAntiAffinityPreset`, and `master.nodeAffinityPreset` will be ignored when it's set

389

390

affinity: {}

391

## @param master.nodeSelector Node labels for Master Server pods assignment

392

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

393

394

nodeSelector: {}

395

## @param master.tolerations Tolerations for Master Server pods assignment

396

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

397

398

tolerations: []

399

## @param master.updateStrategy.type Master Server StatefulSet strategy type

400

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

401

402

updateStrategy:

403

## Can be set to RollingUpdate or OnDelete

404

405

type: RollingUpdate

406

## @param master.podManagementPolicy Pod management policy for Master Server StatefulSet

407

## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

408

409

podManagementPolicy: Parallel

410

## @param master.priorityClassName Master Server pods' priorityClassName

411

412

priorityClassName: ""

413

## @param master.topologySpreadConstraints Topology Spread Constraints for Master Server pod assignment spread across your cluster among failure-domains

414

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

415

416

topologySpreadConstraints: []

417

## @param master.schedulerName Name of the k8s scheduler (other than default) for Master Server pods

418

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

419

420

schedulerName: ""

421

## @param master.terminationGracePeriodSeconds Seconds Master Server pods need to terminate gracefully

422

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

423

424

terminationGracePeriodSeconds: ""

425

## @param master.lifecycleHooks for Master Server containers to automate configuration before or after startup

426

427

lifecycleHooks: {}

428

## @param master.extraEnvVars Array with extra environment variables to add to Master Server containers

429

## e.g:

430

## extraEnvVars:

431

## - name: FOO

432

## value: "bar"

433

434

extraEnvVars: []

435

## @param master.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Master Server containers

436

437

extraEnvVarsCM: ""

438

## @param master.extraEnvVarsSecret Name of existing Secret containing extra env vars for Master Server containers

439

440

extraEnvVarsSecret: ""

441

## @param master.extraVolumes Optionally specify extra list of additional volumes for the Master Server pods

442

443

extraVolumes: []

444

## @param master.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Master Server containers

445

446

extraVolumeMounts: []

447

## @param master.sidecars Add additional sidecar containers to the Master Server pods

448

## e.g:

449

## sidecars:

450

## - name: your-image-name

451

## image: your-image

452

## imagePullPolicy: Always

453

## ports:

454

## - name: portname

455

## containerPort: 1234

456

457

sidecars: []

458

## @param master.initContainers Add additional init containers to the Master Server pods

459

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

460

## e.g:

461

## initContainers:

462

## - name: your-image-name

463

## image: your-image

464

## imagePullPolicy: Always

465

## command: ['sh', '-c', 'echo "hello world"']

466

467

initContainers: []

468

## Pod Disruption Budget configuration

469

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

470

## @param master.pdb.create Enable/disable a Pod Disruption Budget creation

471

## @param master.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

472

## @param master.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `master.pdb.minAvailable` and `master.pdb.maxUnavailable` are empty.

473

474

pdb:

475

create: true

476

minAvailable: ""

477

maxUnavailable: ""

478

## Autoscaling configuration

479

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

480

## @param master.autoscaling.enabled Enable autoscaling for master

481

## @param master.autoscaling.minReplicas Minimum number of master replicas

482

## @param master.autoscaling.maxReplicas Maximum number of master replicas

483

## @param master.autoscaling.targetCPU Target CPU utilization percentage

484

## @param master.autoscaling.targetMemory Target Memory utilization percentage

485

486

autoscaling:

487

enabled: false

488

minReplicas: ""

489

maxReplicas: ""

490

targetCPU: ""

491

targetMemory: ""

492

## @section Master Server Traffic Exposure Parameters

493

494

495

## Master Server service parameters

496

497

service:

498

## @param master.service.type Master Server service type

499

500

type: ClusterIP

501

## @param master.service.ports.http Master Server service HTTP port

502

## @param master.service.ports.grpc Master Server service GRPC port

503

504

ports:

505

http: 9333

506

grpc: 19333

507

## Node ports to expose

508

## @param master.service.nodePorts.http Node port for HTTP

509

## @param master.service.nodePorts.grpc Node port for GRPC

510

## NOTE: choose port between <30000-32767>

511

512

nodePorts:

513

http: ""

514

grpc: ""

515

## @param master.service.clusterIP Master Server service Cluster IP

516

## e.g.:

517

## clusterIP: None

518

519

clusterIP: ""

520

## @param master.service.loadBalancerIP Master Server service Load Balancer IP

521

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

522

523

loadBalancerIP: ""

524

## @param master.service.loadBalancerSourceRanges Master Server service Load Balancer sources

525

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

526

## e.g:

527

## loadBalancerSourceRanges:

528

## - 10.10.10.0/24

529

530

loadBalancerSourceRanges: []

531

## @param master.service.externalTrafficPolicy Master Server service external traffic policy

532

## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

533

534

externalTrafficPolicy: Cluster

535

## @param master.service.annotations Additional custom annotations for Master Server service

536

537

annotations: {}

538

## @param master.service.extraPorts Extra ports to expose in Master Server service (normally used with the `sidecars` value)

539

540

extraPorts: []

541

## @param master.service.sessionAffinity Control where client requests go, to the same pod or round-robin

542

## Values: ClientIP or None

543

## ref: https://kubernetes.io/docs/concepts/services-networking/service/

544

545

sessionAffinity: None

546

## @param master.service.sessionAffinityConfig Additional settings for the sessionAffinity

547

## sessionAffinityConfig:

548

## clientIP:

549

## timeoutSeconds: 300

550

551

sessionAffinityConfig: {}

552

## Headless service properties

553

554

headless:

555

## @param master.service.headless.annotations Annotations for the headless service.

556

557

annotations: {}

558

## Network Policies for Master Server

559

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

560

561

networkPolicy:

562

## @param master.networkPolicy.enabled Specifies whether a NetworkPolicy should be created for Master Server

563

564

enabled: true

565

## @param master.networkPolicy.allowExternal Don't require server label for connections

566

## The Policy model to apply. When set to false, only pods with the correct

567

## server label will have network access to the ports server is listening

568

## on. When true, server will accept connections from any source

569

## (with the correct destination port).

570

571

allowExternal: true

572

## @param master.networkPolicy.allowExternalEgress Allow the Master Server pods to access any range of port and all destinations.

573

574

allowExternalEgress: true

575

## @param master.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

576

## e.g:

577

## extraIngress:

578

## - ports:

579

## - port: 1234

580

## from:

581

## - podSelector:

582

## - matchLabels:

583

## - role: frontend

584

## - podSelector:

585

## - matchExpressions:

586

## - key: role

587

## operator: In

588

## values:

589

## - frontend

590

extraIngress: []

591

## @param master.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)

592

## e.g:

593

## extraEgress:

594

## - ports:

595

## - port: 1234

596

## to:

597

## - podSelector:

598

## - matchLabels:

599

## - role: frontend

600

## - podSelector:

601

## - matchExpressions:

602

## - key: role

603

## operator: In

604

## values:

605

## - frontend

606

607

extraEgress: []

608

## @param master.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

609

## @param master.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

610

611

ingressNSMatchLabels: {}

612

ingressNSPodMatchLabels: {}

613

## Master Server ingress parameters

614

## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/

615

616

ingress:

617

## @param master.ingress.enabled Enable ingress record generation for Master Server

618

619

enabled: false

620

## @param master.ingress.pathType Ingress path type

621

622

pathType: ImplementationSpecific

623

## @param master.ingress.apiVersion Force Ingress API version (automatically detected if not set)

624

625

apiVersion: ""

626

## @param master.ingress.hostname Default host for the ingress record

627

628

hostname: master.seaweedfs.local

629

## @param master.ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)

630

## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .

631

## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/

632

633

ingressClassName: ""

634

## @param master.ingress.path Default path for the ingress record

635

## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers

636

637

path: /

638

## @param master.ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

639

## Use this parameter to set the required annotations for cert-manager, see

640

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

641

## e.g:

642

## annotations:

643

## kubernetes.io/ingress.class: nginx

644

## cert-manager.io/cluster-issuer: cluster-issuer-name

645

646

annotations: {}

647

## @param master.ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter

648

## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`

649

## You can:

650

## - Use the `ingress.secrets` parameter to create this TLS secret

651

## - Rely on cert-manager to create it by setting the corresponding annotations

652

## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`

653

654

tls: false

655

## @param master.ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm

656

657

selfSigned: false

658

## @param master.ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record

659

## e.g:

660

## extraHosts:

661

## - name: master.seaweedfs.local

662

## path: /

663

664

extraHosts: []

665

## @param master.ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host

666

## e.g:

667

## extraPaths:

668

## - path: /*

669

## backend:

670

## serviceName: ssl-redirect

671

## servicePort: use-annotation

672

673

extraPaths: []

674

## @param master.ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record

675

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

676

## e.g:

677

## extraTls:

678

## - hosts:

679

## - master.seaweedfs.local

680

## secretName: master.seaweedfs.local-tls

681

682

extraTls: []

683

## @param master.ingress.secrets Custom TLS certificates as secrets

684

## NOTE: 'key' and 'certificate' are expected in PEM format

685

## NOTE: 'name' should line up with a 'secretName' set further up

686

## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates

687

## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days

688

## It is also possible to create and manage the certificates outside of this helm chart

689

## Please see README.md for more information

690

## e.g:

691

## secrets:

692

## - name: master.seaweedfs.local-tls

693

## key: |-

694

## -----BEGIN RSA PRIVATE KEY-----

695

## ...

696

## -----END RSA PRIVATE KEY-----

697

## certificate: |-

698

## -----BEGIN CERTIFICATE-----

699

## ...

700

## -----END CERTIFICATE-----

701

702

secrets: []

703

## @param master.ingress.extraRules Additional rules to be covered with this ingress record

704

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

705

## e.g:

706

## extraRules:

707

## - host: example.local

708

## http:

709

## path: /

710

## backend:

711

## service:

712

## name: example-svc

713

## port:

714

## name: http

715

716

extraRules: []

717

## @section Master Server Persistence Parameters

718

719

720

## Enable Master data persistence using Persistent Volume Claims

721

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

722

723

persistence:

724

## @param master.persistence.enabled Enable data persistence on Master Server using Persistent Volume Claims

725

726

enabled: true

727

## @param master.persistence.mountPath Path to mount the volume at.

728

729

mountPath: /data

730

## @param master.persistence.subPath The subdirectory of the volume to mount to, useful in dev environments and one PV for multiple services

731

732

subPath: ""

733

## @param master.persistence.storageClass Storage class of backing PVC

734

## If defined, storageClassName: <storageClass>

735

## If set to "-", storageClassName: "", which disables dynamic provisioning

736

## If undefined (the default) or set to null, no storageClassName spec is

737

## set, choosing the default provisioner. (gp2 on AWS, standard on

738

## GKE, AWS & OpenStack)

739

740

storageClass: ""

741

## @param master.persistence.annotations Persistent Volume Claim annotations

742

743

annotations: {}

744

## @param master.persistence.accessModes Persistent Volume Access Modes

745

746

accessModes:

747

- ReadWriteOnce

748

## @param master.persistence.size Size of data volume

749

750

size: 8Gi

751

## @param master.persistence.existingClaim The name of an existing PVC to use for data persistence

752

753

existingClaim: ""

754

## @param master.persistence.selector Selector to match an existing Persistent Volume for data PVC

755

## If set, the PVC can't have a PV dynamically provisioned for it

756

## E.g.

757

## selector:

758

## matchLabels:

759

## app: my-app

760

761

selector: {}

762

## @param master.persistence.dataSource Custom PVC data source

763

764

dataSource: {}

765

## Enable Master logs persistence using Persistent Volume Claims

766

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

767

768

logPersistence:

769

## @param master.logPersistence.enabled Enable logs persistence on Master Server using Persistent Volume Claims

770

771

enabled: false

772

## @param master.logPersistence.mountPath Path to mount the volume at.

773

774

mountPath: /logs

775

## @param master.logPersistence.subPath The subdirectory of the volume to mount to, useful in dev environments and one PV for multiple services

776

777

subPath: ""

778

## @param master.logPersistence.storageClass Storage class of backing PVC

779

## If defined, storageClassName: <storageClass>

780

## If set to "-", storageClassName: "", which disables dynamic provisioning

781

## If undefined (the default) or set to null, no storageClassName spec is

782

## set, choosing the default provisioner. (gp2 on AWS, standard on

783

## GKE, AWS & OpenStack)

784

785

storageClass: ""

786

## @param master.logPersistence.annotations Persistent Volume Claim annotations

787

788

annotations: {}

789

## @param master.logPersistence.accessModes Persistent Volume Access Modes

790

791

accessModes:

792

- ReadWriteOnce

793

## @param master.logPersistence.size Size of logs volume

794

795

size: 8Gi

796

## @param master.logPersistence.existingClaim The name of an existing PVC to use for logs persistence

797

798

existingClaim: ""

799

## @param master.logPersistence.selector Selector to match an existing Persistent Volume for logs PVC

800

## If set, the PVC can't have a PV dynamically provisioned for it

801

## E.g.

802

## selector:

803

## matchLabels:

804

## app: my-app

805

806

selector: {}

807

## @param master.logPersistence.dataSource Custom PVC data source

808

809

dataSource: {}

810

## persistentVolumeClaimRetentionPolicy

811

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

812

## @param master.persistentVolumeClaimRetentionPolicy.enabled Controls if and how PVCs are deleted during the lifecycle of the Master Server StatefulSet

813

## @param master.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced

814

## @param master.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted

815

816

persistentVolumeClaimRetentionPolicy:

817

enabled: false

818

whenScaled: Retain

819

whenDeleted: Retain

820

## @section Master Server Metrics Parameters

821

822

metrics:

823

## @param master.metrics.enabled Enable the export of Prometheus metrics

824

825

enabled: false

826

## Metrics service properties

827

828

service:

829

## @param master.metrics.service.port Metrics service port

830

831

port: 9327

832

## @param master.metrics.service.annotations Annotations for the metrics service.

833

834

annotations: {}

835

## Prometheus Operator ServiceMonitor configuration

836

837

serviceMonitor:

838

## @param master.metrics.serviceMonitor.enabled if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`)

839

840

enabled: false

841

## @param master.metrics.serviceMonitor.namespace Namespace in which Prometheus is running

842

843

namespace: ""

844

## @param master.metrics.serviceMonitor.annotations Additional custom annotations for the ServiceMonitor

845

846

annotations: {}

847

## @param master.metrics.serviceMonitor.labels Extra labels for the ServiceMonitor

848

849

labels: {}

850

## @param master.metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in Prometheus

851

852

jobLabel: ""

853

## @param master.metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels

854

855

honorLabels: false

856

## @param master.metrics.serviceMonitor.interval Interval at which metrics should be scraped.

857

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

858

## e.g:

859

## interval: 10s

860

861

interval: ""

862

## @param master.metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended

863

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

864

## e.g:

865

## scrapeTimeout: 10s

866

867

scrapeTimeout: ""

868

## @param master.metrics.serviceMonitor.metricRelabelings Specify additional relabeling of metrics

869

870

metricRelabelings: []

871

## @param master.metrics.serviceMonitor.relabelings Specify general relabeling

872

873

relabelings: []

874

## @param master.metrics.serviceMonitor.selector Prometheus instance selector labels

875

## selector:

876

## prometheus: my-prometheus

877

878

selector: {}

879

## @section Volume Server Parameters

880

881

volume:

882

## @param volume.replicaCount Number of Volume Server replicas to deploy

883

884

replicaCount: 1

885

## @param volume.containerPorts.http Volume Server HTTP container port

886

## @param volume.containerPorts.grpc Volume Server GRPC container port

887

## @param volume.containerPorts.metrics Volume Server metrics container port

888

889

containerPorts:

890

http: 8080

891

grpc: 18080

892

metrics: 9327

893

## @param volume.extraContainerPorts Optionally specify extra list of additional ports for Volume Server containers

894

## e.g:

895

## extraContainerPorts:

896

## - name: myservice

897

## containerPort: 9090

898

899

extraContainerPorts: []

900

## Configure extra options for Volume Server containers' liveness and readiness probes

901

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

902

## @param volume.livenessProbe.enabled Enable livenessProbe on Volume Server containers

903

## @param volume.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

904

## @param volume.livenessProbe.periodSeconds Period seconds for livenessProbe

905

## @param volume.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

906

## @param volume.livenessProbe.failureThreshold Failure threshold for livenessProbe

907

## @param volume.livenessProbe.successThreshold Success threshold for livenessProbe

908

909

livenessProbe:

910

enabled: true

911

initialDelaySeconds: 30

912

timeoutSeconds: 30

913

periodSeconds: 10

914

successThreshold: 1

915

failureThreshold: 6

916

## @param volume.readinessProbe.enabled Enable readinessProbe on Volume Server containers

917

## @param volume.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

918

## @param volume.readinessProbe.periodSeconds Period seconds for readinessProbe

919

## @param volume.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

920

## @param volume.readinessProbe.failureThreshold Failure threshold for readinessProbe

921

## @param volume.readinessProbe.successThreshold Success threshold for readinessProbe

922

923

readinessProbe:

924

enabled: true

925

initialDelaySeconds: 30

926

timeoutSeconds: 30

927

periodSeconds: 10

928

successThreshold: 1

929

failureThreshold: 6

930

## @param volume.startupProbe.enabled Enable startupProbe on Volume Server containers

931

## @param volume.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

932

## @param volume.startupProbe.periodSeconds Period seconds for startupProbe

933

## @param volume.startupProbe.timeoutSeconds Timeout seconds for startupProbe

934

## @param volume.startupProbe.failureThreshold Failure threshold for startupProbe

935

## @param volume.startupProbe.successThreshold Success threshold for startupProbe

936

937

startupProbe:

938

enabled: false

939

initialDelaySeconds: 5

940

periodSeconds: 5

941

timeoutSeconds: 1

942

failureThreshold: 15

943

successThreshold: 1

944

## @param volume.customLivenessProbe Custom livenessProbe that overrides the default one

945

946

customLivenessProbe: {}

947

## @param volume.customReadinessProbe Custom readinessProbe that overrides the default one

948

949

customReadinessProbe: {}

950

## @param volume.customStartupProbe Custom startupProbe that overrides the default one

951

952

customStartupProbe: {}

953

## Volume Server resource requests and limits

954

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

955

## @param volume.resourcesPreset Set Volume Server container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volume.resources is set (volume.resources is recommended for production).

956

957

resourcesPreset: "nano"

958

## @param volume.resources Set Volume Server container requests and limits for different resources like CPU or memory (essential for production workloads)

959

## Example:

960

## resources:

961

## requests:

962

## cpu: 2

963

## memory: 512Mi

964

## limits:

965

## cpu: 3

966

## memory: 1024Mi

967

968

resources: {}

969

## Configure Pods Security Context

970

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

971

## @param volume.podSecurityContext.enabled Enable Volume Server pods' Security Context

972

## @param volume.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for Volume Server pods

973

## @param volume.podSecurityContext.sysctls Set kernel settings using the sysctl interface for Volume Server pods

974

## @param volume.podSecurityContext.supplementalGroups Set filesystem extra groups for Volume Server pods

975

## @param volume.podSecurityContext.fsGroup Set fsGroup in Volume Server pods' Security Context

976

977

podSecurityContext:

978

enabled: true

979

fsGroupChangePolicy: Always

980

sysctls: []

981

supplementalGroups: []

982

fsGroup: 1001

983

## Configure Container Security Context

984

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

985

## @param volume.containerSecurityContext.enabled Enabled Volume Server container' Security Context

986

## @param volume.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in Volume Server container

987

## @param volume.containerSecurityContext.runAsUser Set runAsUser in Volume Server container' Security Context

988

## @param volume.containerSecurityContext.runAsGroup Set runAsGroup in Volume Server container' Security Context

989

## @param volume.containerSecurityContext.runAsNonRoot Set runAsNonRoot in Volume Server container' Security Context

990

## @param volume.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in Volume Server container' Security Context

991

## @param volume.containerSecurityContext.privileged Set privileged in Volume Server container' Security Context

992

## @param volume.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in Volume Server container' Security Context

993

## @param volume.containerSecurityContext.capabilities.drop List of capabilities to be dropped in Volume Server container

994

## @param volume.containerSecurityContext.seccompProfile.type Set seccomp profile in Volume Server container

995

996

containerSecurityContext:

997

enabled: true

998

seLinuxOptions: {}

999

runAsUser: 1001

1000

runAsGroup: 1001

1001

runAsNonRoot: true

1002

readOnlyRootFilesystem: true

1003

privileged: false

1004

allowPrivilegeEscalation: false

1005

capabilities:

1006

drop: ["ALL"]

1007

seccompProfile:

1008

type: "RuntimeDefault"

1009

## @param volume.logLevel Volume Server log level (0, 1, 2, 3, or 4)

1010

1011

logLevel: 1

1012

## @param volume.bindAddress Volume Server bind address

1013

1014

bindAddress: 0.0.0.0

1015

## @param volume.publicUrl Volume Server public URL

1016

1017

publicUrl: ""

1018

## @param volume.config Volume Server configuration

1019

## Specify content for volume.toml

1020

1021

config: ""

1022

## @param volume.existingConfigmap The name of an existing ConfigMap with your custom configuration for Volume Server

1023

1024

existingConfigmap: ""

1025

## @param volume.command Override default Volume Server container command (useful when using custom images)

1026

1027

command: []

1028

## @param volume.args Override default Volume Server container args (useful when using custom images)

1029

1030

args: []

1031

## @param volume.automountServiceAccountToken Mount Service Account token in Volume Server pods

1032

1033

automountServiceAccountToken: false

1034

## @param volume.hostAliases Volume Server pods host aliases

1035

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

1036

1037

hostAliases: []

1038

## @param volume.statefulsetAnnotations Annotations for Volume Server StatefulSet

1039

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

1040

1041

statefulsetAnnotations: {}

1042

## @param volume.podLabels Extra labels for Volume Server pods

1043

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

1044

1045

podLabels: {}

1046

## @param volume.podAnnotations Annotations for Volume Server pods

1047

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

1048

1049

podAnnotations: {}

1050

## @param volume.podAffinityPreset Pod affinity preset. Ignored if `volume.affinity` is set. Allowed values: `soft` or `hard`

1051

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1052

1053

podAffinityPreset: ""

1054

## @param volume.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `volume.affinity` is set. Allowed values: `soft` or `hard`

1055

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1056

1057

podAntiAffinityPreset: soft

1058

## Node volume.affinity preset

1059

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

1060

1061

nodeAffinityPreset:

1062

## @param volume.nodeAffinityPreset.type Node affinity preset type. Ignored if `volume.affinity` is set. Allowed values: `soft` or `hard`

1063

1064

type: ""

1065

## @param volume.nodeAffinityPreset.key Node label key to match. Ignored if `volume.affinity` is set

1066

1067

key: ""

1068

## @param volume.nodeAffinityPreset.values Node label values to match. Ignored if `volume.affinity` is set

1069

## E.g.

1070

## values:

1071

## - e2e-az1

1072

## - e2e-az2

1073

1074

values: []

1075

## @param volume.affinity Affinity for Volume Server pods assignment

1076

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

1077

## NOTE: `volume.podAffinityPreset`, `volume.podAntiAffinityPreset`, and `volume.nodeAffinityPreset` will be ignored when it's set

1078

1079

affinity: {}

1080

## @param volume.nodeSelector Node labels for Volume Server pods assignment

1081

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

1082

1083

nodeSelector: {}

1084

## @param volume.tolerations Tolerations for Volume Server pods assignment

1085

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

1086

1087

tolerations: []

1088

## @param volume.updateStrategy.type Volume Server StatefulSet strategy type

1089

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

1090

1091

updateStrategy:

1092

## Can be set to RollingUpdate or OnDelete

1093

1094

type: RollingUpdate

1095

## @param volume.podManagementPolicy Pod management policy for Volume Server StatefulSet

1096

## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

1097

1098

podManagementPolicy: Parallel

1099

## @param volume.priorityClassName Volume Server pods' priorityClassName

1100

1101

priorityClassName: ""

1102

## @param volume.topologySpreadConstraints Topology Spread Constraints for Volume Server pod assignment spread across your cluster among failure-domains

1103

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

1104

1105

topologySpreadConstraints: []

1106

## @param volume.schedulerName Name of the k8s scheduler (other than default) for Volume Server pods

1107

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

1108

1109

schedulerName: ""

1110

## @param volume.terminationGracePeriodSeconds Seconds Volume Server pods need to terminate gracefully

1111

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

1112

1113

terminationGracePeriodSeconds: ""

1114

## @param volume.lifecycleHooks for Volume Server containers to automate configuration before or after startup

1115

1116

lifecycleHooks: {}

1117

## @param volume.extraEnvVars Array with extra environment variables to add to Volume Server containers

1118

## e.g:

1119

## extraEnvVars:

1120

## - name: FOO

1121

## value: "bar"

1122

1123

extraEnvVars: []

1124

## @param volume.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Volume Server containers

1125

1126

extraEnvVarsCM: ""

1127

## @param volume.extraEnvVarsSecret Name of existing Secret containing extra env vars for Volume Server containers

1128

1129

extraEnvVarsSecret: ""

1130

## @param volume.extraVolumes Optionally specify extra list of additional volumes for the Volume Server pods

1131

1132

extraVolumes: []

1133

## @param volume.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Volume Server containers

1134

1135

extraVolumeMounts: []

1136

## @param volume.sidecars Add additional sidecar containers to the Volume Server pods

1137

## e.g:

1138

## sidecars:

1139

## - name: your-image-name

1140

## image: your-image

1141

## imagePullPolicy: Always

1142

## ports:

1143

## - name: portname

1144

## containerPort: 1234

1145

1146

sidecars: []

1147

## @param volume.initContainers Add additional init containers to the Volume Server pods

1148

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

1149

## e.g:

1150

## initContainers:

1151

## - name: your-image-name

1152

## image: your-image

1153

## imagePullPolicy: Always

1154

## command: ['sh', '-c', 'echo "hello world"']

1155

1156

initContainers: []

1157

## Pod Disruption Budget configuration

1158

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

1159

## @param volume.pdb.create Enable/disable a Pod Disruption Budget creation

1160

## @param volume.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

1161

## @param volume.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `volume.pdb.minAvailable` and `volume.pdb.maxUnavailable` are empty.

1162

1163

pdb:

1164

create: true

1165

minAvailable: ""

1166

maxUnavailable: ""

1167

## Autoscaling configuration

1168

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

1169

## @param volume.autoscaling.enabled Enable autoscaling for volume

1170

## @param volume.autoscaling.minReplicas Minimum number of volume replicas

1171

## @param volume.autoscaling.maxReplicas Maximum number of volume replicas

1172

## @param volume.autoscaling.targetCPU Target CPU utilization percentage

1173

## @param volume.autoscaling.targetMemory Target Memory utilization percentage

1174

1175

autoscaling:

1176

enabled: false

1177

minReplicas: ""

1178

maxReplicas: ""

1179

targetCPU: ""

1180

targetMemory: ""

1181

## @section Volume Server Traffic Exposure Parameters

1182

1183

1184

## Volume Server service parameters

1185

1186

service:

1187

## @param volume.service.type Volume Server service type

1188

1189

type: ClusterIP

1190

## @param volume.service.ports.http Volume Server service HTTP port

1191

## @param volume.service.ports.grpc Volume Server service GRPC port

1192

1193

ports:

1194

http: 8080

1195

grpc: 18080

1196

## Node ports to expose

1197

## @param volume.service.nodePorts.http Node port for HTTP

1198

## @param volume.service.nodePorts.grpc Node port for GRPC

1199

## NOTE: choose port between <30000-32767>

1200

1201

nodePorts:

1202

http: ""

1203

grpc: ""

1204

## @param volume.service.clusterIP Volume Server service Cluster IP

1205

## e.g.:

1206

## clusterIP: None

1207

1208

clusterIP: ""

1209

## @param volume.service.loadBalancerIP Volume Server service Load Balancer IP

1210

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

1211

1212

loadBalancerIP: ""

1213

## @param volume.service.loadBalancerSourceRanges Volume Server service Load Balancer sources

1214

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

1215

## e.g:

1216

## loadBalancerSourceRanges:

1217

## - 10.10.10.0/24

1218

1219

loadBalancerSourceRanges: []

1220

## @param volume.service.externalTrafficPolicy Volume Server service external traffic policy

1221

## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

1222

1223

externalTrafficPolicy: Cluster

1224

## @param volume.service.annotations Additional custom annotations for Volume Server service

1225

1226

annotations: {}

1227

## @param volume.service.extraPorts Extra ports to expose in Volume Server service (normally used with the `sidecars` value)

1228

1229

extraPorts: []

1230

## @param volume.service.sessionAffinity Control where client requests go, to the same pod or round-robin

1231

## Values: ClientIP or None

1232

## ref: https://kubernetes.io/docs/concepts/services-networking/service/

1233

1234

sessionAffinity: None

1235

## @param volume.service.sessionAffinityConfig Additional settings for the sessionAffinity

1236

## sessionAffinityConfig:

1237

## clientIP:

1238

## timeoutSeconds: 300

1239

1240

sessionAffinityConfig: {}

1241

## Headless service properties

1242

1243

headless:

1244

## @param volume.service.headless.annotations Annotations for the headless service.

1245

1246

annotations: {}

1247

## Network Policies for Volume Server

1248

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

1249

1250

networkPolicy:

1251

## @param volume.networkPolicy.enabled Specifies whether a NetworkPolicy should be created for Volume Server

1252

1253

enabled: true

1254

## @param volume.networkPolicy.allowExternal Don't require server label for connections

1255

## The Policy model to apply. When set to false, only pods with the correct

1256

## server label will have network access to the ports server is listening

1257

## on. When true, server will accept connections from any source

1258

## (with the correct destination port).

1259

1260

allowExternal: true

1261

## @param volume.networkPolicy.allowExternalEgress Allow the Volume Server pods to access any range of port and all destinations.

1262

1263

allowExternalEgress: true

1264

## @param volume.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

1265

## e.g:

1266

## extraIngress:

1267

## - ports:

1268

## - port: 1234

1269

## from:

1270

## - podSelector:

1271

## - matchLabels:

1272

## - role: frontend

1273

## - podSelector:

1274

## - matchExpressions:

1275

## - key: role

1276

## operator: In

1277

## values:

1278

## - frontend

1279

extraIngress: []

1280

## @param volume.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)

1281

## e.g:

1282

## extraEgress:

1283

## - ports:

1284

## - port: 1234

1285

## to:

1286

## - podSelector:

1287

## - matchLabels:

1288

## - role: frontend

1289

## - podSelector:

1290

## - matchExpressions:

1291

## - key: role

1292

## operator: In

1293

## values:

1294

## - frontend

1295

1296

extraEgress: []

1297

## @param volume.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

1298

## @param volume.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

1299

1300

ingressNSMatchLabels: {}

1301

ingressNSPodMatchLabels: {}

1302

## Volume Server ingress parameters

1303

## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/

1304

1305

ingress:

1306

## @param volume.ingress.enabled Enable ingress record generation for Volume Server

1307

1308

enabled: false

1309

## @param volume.ingress.pathType Ingress path type

1310

1311

pathType: ImplementationSpecific

1312

## @param volume.ingress.apiVersion Force Ingress API version (automatically detected if not set)

1313

1314

apiVersion: ""

1315

## @param volume.ingress.hostname Default host for the ingress record

1316

1317

hostname: volume.seaweedfs.local

1318

## @param volume.ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)

1319

## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .

1320

## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/

1321

1322

ingressClassName: ""

1323

## @param volume.ingress.path Default path for the ingress record

1324

## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers

1325

1326

path: /

1327

## @param volume.ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

1328

## Use this parameter to set the required annotations for cert-manager, see

1329

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

1330

## e.g:

1331

## annotations:

1332

## kubernetes.io/ingress.class: nginx

1333

## cert-manager.io/cluster-issuer: cluster-issuer-name

1334

1335

annotations: {}

1336

## @param volume.ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter

1337

## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`

1338

## You can:

1339

## - Use the `ingress.secrets` parameter to create this TLS secret

1340

## - Rely on cert-manager to create it by setting the corresponding annotations

1341

## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`

1342

1343

tls: false

1344

## @param volume.ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm

1345

1346

selfSigned: false

1347

## @param volume.ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record

1348

## e.g:

1349

## extraHosts:

1350

## - name: volume.seaweedfs.local

1351

## path: /

1352

1353

extraHosts: []

1354

## @param volume.ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host

1355

## e.g:

1356

## extraPaths:

1357

## - path: /*

1358

## backend:

1359

## serviceName: ssl-redirect

1360

## servicePort: use-annotation

1361

1362

extraPaths: []

1363

## @param volume.ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record

1364

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

1365

## e.g:

1366

## extraTls:

1367

## - hosts:

1368

## - volume.seaweedfs.local

1369

## secretName: volume.seaweedfs.local-tls

1370

1371

extraTls: []

1372

## @param volume.ingress.secrets Custom TLS certificates as secrets

1373

## NOTE: 'key' and 'certificate' are expected in PEM format

1374

## NOTE: 'name' should line up with a 'secretName' set further up

1375

## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates

1376

## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days

1377

## It is also possible to create and manage the certificates outside of this helm chart

1378

## Please see README.md for more information

1379

## e.g:

1380

## secrets:

1381

## - name: volume.seaweedfs.local-tls

1382

## key: |-

1383

## -----BEGIN RSA PRIVATE KEY-----

1384

## ...

1385

## -----END RSA PRIVATE KEY-----

1386

## certificate: |-

1387

## -----BEGIN CERTIFICATE-----

1388

## ...

1389

## -----END CERTIFICATE-----

1390

1391

secrets: []

1392

## @param volume.ingress.extraRules Additional rules to be covered with this ingress record

1393

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

1394

## e.g:

1395

## extraRules:

1396

## - host: example.local

1397

## http:

1398

## path: /

1399

## backend:

1400

## service:

1401

## name: example-svc

1402

## port:

1403

## name: http

1404

1405

extraRules: []

1406

## @section Volume Server Persistence Parameters

1407

1408

dataVolumes:

1409

- ## @param volume.dataVolumes[0].name Name of the data volume

1410

1411

name: data-0

1412

## @param volume.dataVolumes[0].mountPath Path to mount the volume at.

1413

1414

mountPath: /data-0

1415

## @param volume.dataVolumes[0].subPath The subdirectory of the volume to mount to, useful in dev environments and one PV for multiple services

1416

1417

subPath: ""

1418

## @param volume.dataVolumes[0].maxVolumes Max number of SeaweedFS volumes this data volume can be divided into. If set to 0, the limit will be auto configured as free disk space divided by default volume size (30GB)

1419

## ref: https://github.com/seaweedfs/seaweedfs/wiki/FAQ#how-many-volumes-do-i-need

1420

## ref: https://github.com/seaweedfs/seaweedfs/blob/master/weed/util/constants_4bytes.go#L8

1421

1422

maxVolumes: 8

1423

## Enable persistence using Persistent Volume Claims

1424

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

1425

1426

persistence:

1427

## @param volume.dataVolumes[0].persistence.enabled Enable persistence on Volume Server using Persistent Volume Claims

1428

1429

enabled: true

1430

## @param volume.dataVolumes[0].persistence.storageClass Storage class of backing PVC

1431

## If defined, storageClassName: <storageClass>

1432

## If set to "-", storageClassName: "", which disables dynamic provisioning

1433

## If undefined (the default) or set to null, no storageClassName spec is

1434

## set, choosing the default provisioner. (gp2 on AWS, standard on

1435

## GKE, AWS & OpenStack)

1436

1437

storageClass: ""

1438

## @param volume.dataVolumes[0].persistence.annotations Persistent Volume Claim annotations

1439

1440

annotations: {}

1441

## @param volume.dataVolumes[0].persistence.accessModes Persistent Volume Access Modes

1442

1443

accessModes:

1444

- ReadWriteOnce

1445

## @param volume.dataVolumes[0].persistence.size Size of data volume

1446

1447

size: 8Gi

1448

## @param volume.dataVolumes[0].persistence.existingClaim The name of an existing PVC to use for persistence

1449

1450

existingClaim: ""

1451

## @param volume.dataVolumes[0].persistence.selector Selector to match an existing Persistent Volume for data PVC

1452

## If set, the PVC can't have a PV dynamically provisioned for it

1453

## E.g.

1454

## selector:

1455

## matchLabels:

1456

## app: my-app

1457

1458

selector: {}

1459

## @param volume.dataVolumes[0].persistence.dataSource Custom PVC data source

1460

1461

dataSource: {}

1462

## Enable Volume logs persistence using Persistent Volume Claims

1463

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

1464

1465

logPersistence:

1466

## @param volume.logPersistence.enabled Enable logs persistence on Volume Server using Persistent Volume Claims

1467

1468

enabled: false

1469

## @param volume.logPersistence.mountPath Path to mount the volume at.

1470

1471

mountPath: /logs

1472

## @param volume.logPersistence.subPath The subdirectory of the volume to mount to, useful in dev environments and one PV for multiple services

1473

1474

subPath: ""

1475

## @param volume.logPersistence.storageClass Storage class of backing PVC

1476

## If defined, storageClassName: <storageClass>

1477

## If set to "-", storageClassName: "", which disables dynamic provisioning

1478

## If undefined (the default) or set to null, no storageClassName spec is

1479

## set, choosing the default provisioner. (gp2 on AWS, standard on

1480

## GKE, AWS & OpenStack)

1481

1482

storageClass: ""

1483

## @param volume.logPersistence.annotations Persistent Volume Claim annotations

1484

1485

annotations: {}

1486

## @param volume.logPersistence.accessModes Persistent Volume Access Modes

1487

1488

accessModes:

1489

- ReadWriteOnce

1490

## @param volume.logPersistence.size Size of logs volume

1491

1492

size: 8Gi

1493

## @param volume.logPersistence.existingClaim The name of an existing PVC to use for logs persistence

1494

1495

existingClaim: ""

1496

## @param volume.logPersistence.selector Selector to match an existing Persistent Volume for logs PVC

1497

## If set, the PVC can't have a PV dynamically provisioned for it

1498

## E.g.

1499

## selector:

1500

## matchLabels:

1501

## app: my-app

1502

1503

selector: {}

1504

## @param volume.logPersistence.dataSource Custom PVC data source

1505

1506

dataSource: {}

1507

## persistentVolumeClaimRetentionPolicy

1508

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

1509

## @param volume.persistentVolumeClaimRetentionPolicy.enabled Controls if and how PVCs are deleted during the lifecycle of the Volume Server StatefulSet

1510

## @param volume.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced

1511

## @param volume.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted

1512

1513

persistentVolumeClaimRetentionPolicy:

1514

enabled: false

1515

whenScaled: Retain

1516

whenDeleted: Retain

1517

## @section Volume Server Metrics Parameters

1518

1519

metrics:

1520

## @param volume.metrics.enabled Enable the export of Prometheus metrics

1521

1522

enabled: false

1523

## Metrics service properties

1524

1525

service:

1526

## @param volume.metrics.service.port Metrics service port

1527

1528

port: 9327

1529

## @param volume.metrics.service.annotations Annotations for the metrics service.

1530

1531

annotations: {}

1532

## Prometheus Operator ServiceMonitor configuration

1533

1534

serviceMonitor:

1535

## @param volume.metrics.serviceMonitor.enabled if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`)

1536

1537

enabled: false

1538

## @param volume.metrics.serviceMonitor.namespace Namespace in which Prometheus is running

1539

1540

namespace: ""

1541

## @param volume.metrics.serviceMonitor.annotations Additional custom annotations for the ServiceMonitor

1542

1543

annotations: {}

1544

## @param volume.metrics.serviceMonitor.labels Extra labels for the ServiceMonitor

1545

1546

labels: {}

1547

## @param volume.metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in Prometheus

1548

1549

jobLabel: ""

1550

## @param volume.metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels

1551

1552

honorLabels: false

1553

## @param volume.metrics.serviceMonitor.interval Interval at which metrics should be scraped.

1554

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

1555

## e.g:

1556

## interval: 10s

1557

1558

interval: ""

1559

## @param volume.metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended

1560

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

1561

## e.g:

1562

## scrapeTimeout: 10s

1563

1564

scrapeTimeout: ""

1565

## @param volume.metrics.serviceMonitor.metricRelabelings Specify additional relabeling of metrics

1566

1567

metricRelabelings: []

1568

## @param volume.metrics.serviceMonitor.relabelings Specify general relabeling

1569

1570

relabelings: []

1571

## @param volume.metrics.serviceMonitor.selector Prometheus instance selector labels

1572

## selector:

1573

## prometheus: my-prometheus

1574

1575

selector: {}

1576

## @section Filer Server Parameters

1577

1578

filer:

1579

## @param filer.enabled Enable Filer Server deployment

1580

1581

enabled: true

1582

## @param filer.replicaCount Number of Filer Server replicas to deploy

1583

1584

replicaCount: 1

1585

## @param filer.containerPorts.http Filer Server HTTP container port

1586

## @param filer.containerPorts.grpc Filer Server GRPC container port

1587

## @param filer.containerPorts.metrics Filer Server metrics container port

1588

1589

containerPorts:

1590

http: 8888

1591

grpc: 18888

1592

metrics: 9327

1593

## @param filer.extraContainerPorts Optionally specify extra list of additional ports for Filer Server containers

1594

## e.g:

1595

## extraContainerPorts:

1596

## - name: myservice

1597

## containerPort: 9090

1598

1599

extraContainerPorts: []

1600

## Configure extra options for Filer Server containers' liveness and readiness probes

1601

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

1602

## @param filer.livenessProbe.enabled Enable livenessProbe on Filer Server containers

1603

## @param filer.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

1604

## @param filer.livenessProbe.periodSeconds Period seconds for livenessProbe

1605

## @param filer.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

1606

## @param filer.livenessProbe.failureThreshold Failure threshold for livenessProbe

1607

## @param filer.livenessProbe.successThreshold Success threshold for livenessProbe

1608

1609

livenessProbe:

1610

enabled: true

1611

initialDelaySeconds: 30

1612

timeoutSeconds: 30

1613

periodSeconds: 10

1614

successThreshold: 1

1615

failureThreshold: 6

1616

## @param filer.readinessProbe.enabled Enable readinessProbe on Filer Server containers

1617

## @param filer.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

1618

## @param filer.readinessProbe.periodSeconds Period seconds for readinessProbe

1619

## @param filer.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

1620

## @param filer.readinessProbe.failureThreshold Failure threshold for readinessProbe

1621

## @param filer.readinessProbe.successThreshold Success threshold for readinessProbe

1622

1623

readinessProbe:

1624

enabled: true

1625

initialDelaySeconds: 30

1626

timeoutSeconds: 30

1627

periodSeconds: 10

1628

successThreshold: 1

1629

failureThreshold: 6

1630

## @param filer.startupProbe.enabled Enable startupProbe on Filer Server containers

1631

## @param filer.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

1632

## @param filer.startupProbe.periodSeconds Period seconds for startupProbe

1633

## @param filer.startupProbe.timeoutSeconds Timeout seconds for startupProbe

1634

## @param filer.startupProbe.failureThreshold Failure threshold for startupProbe

1635

## @param filer.startupProbe.successThreshold Success threshold for startupProbe

1636

1637

startupProbe:

1638

enabled: false

1639

initialDelaySeconds: 5

1640

periodSeconds: 5

1641

timeoutSeconds: 1

1642

failureThreshold: 15

1643

successThreshold: 1

1644

## @param filer.customLivenessProbe Custom livenessProbe that overrides the default one

1645

1646

customLivenessProbe: {}

1647

## @param filer.customReadinessProbe Custom readinessProbe that overrides the default one

1648

1649

customReadinessProbe: {}

1650

## @param filer.customStartupProbe Custom startupProbe that overrides the default one

1651

1652

customStartupProbe: {}

1653

## Filer Server resource requests and limits

1654

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

1655

## @param filer.resourcesPreset Set Filer Server container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if filer.resources is set (filer.resources is recommended for production).

1656

1657

resourcesPreset: "nano"

1658

## @param filer.resources Set Filer Server container requests and limits for different resources like CPU or memory (essential for production workloads)

1659

## Example:

1660

## resources:

1661

## requests:

1662

## cpu: 2

1663

## memory: 512Mi

1664

## limits:

1665

## cpu: 3

1666

## memory: 1024Mi

1667

1668

resources: {}

1669

## Filer Server 'wait-for-db' init container configuration

1670

1671

waitForDatabase:

1672

## 'wait-for-db' init container resource requests and limits

1673

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

1674

## @param filer.waitForDatabase.resourcesPreset Set 'wait-for-db' init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if filer.waitForDatabase.resources is set (filer.waitForDatabase.resources is recommended for production).

1675

1676

resourcesPreset: "nano"

1677

## @param filer.waitForDatabase.resources Set 'wait-for-db' init container requests and limits for different resources like CPU or memory (essential for production workloads)

1678

## Example:

1679

## resources:

1680

## requests:

1681

## cpu: 2

1682

## memory: 512Mi

1683

## limits:

1684

## cpu: 3

1685

## memory: 1024Mi

1686

1687

resources: {}

1688

## Configure Pods Security Context

1689

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

1690

## @param filer.podSecurityContext.enabled Enable Filer Server pods' Security Context

1691

## @param filer.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for Filer Server pods

1692

## @param filer.podSecurityContext.sysctls Set kernel settings using the sysctl interface for Filer Server pods

1693

## @param filer.podSecurityContext.supplementalGroups Set filesystem extra groups for Filer Server pods

1694

## @param filer.podSecurityContext.fsGroup Set fsGroup in Filer Server pods' Security Context

1695

1696

podSecurityContext:

1697

enabled: true

1698

fsGroupChangePolicy: Always

1699

sysctls: []

1700

supplementalGroups: []

1701

fsGroup: 1001

1702

## Configure Container Security Context

1703

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

1704

## @param filer.containerSecurityContext.enabled Enabled Filer Server container' Security Context

1705

## @param filer.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in Filer Server container

1706

## @param filer.containerSecurityContext.runAsUser Set runAsUser in Filer Server container' Security Context

1707

## @param filer.containerSecurityContext.runAsGroup Set runAsGroup in Filer Server container' Security Context

1708

## @param filer.containerSecurityContext.runAsNonRoot Set runAsNonRoot in Filer Server container' Security Context

1709

## @param filer.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in Filer Server container' Security Context

1710

## @param filer.containerSecurityContext.privileged Set privileged in Filer Server container' Security Context

1711

## @param filer.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in Filer Server container' Security Context

1712

## @param filer.containerSecurityContext.capabilities.drop List of capabilities to be dropped in Filer Server container

1713

## @param filer.containerSecurityContext.seccompProfile.type Set seccomp profile in Filer Server container

1714

1715

containerSecurityContext:

1716

enabled: true

1717

seLinuxOptions: {}

1718

runAsUser: 1001

1719

runAsGroup: 1001

1720

runAsNonRoot: true

1721

readOnlyRootFilesystem: true

1722

privileged: false

1723

allowPrivilegeEscalation: false

1724

capabilities:

1725

drop: ["ALL"]

1726

seccompProfile:

1727

type: "RuntimeDefault"

1728

## @param filer.logLevel Filer Server log level (0, 1, 2, 3, or 4)

1729

1730

logLevel: 1

1731

## @param filer.bindAddress Filer Server bind address

1732

1733

bindAddress: 0.0.0.0

1734

## @param filer.config Filer Server configuration

1735

## Specify content for filer.toml

1736

1737

config: |

1738

[leveldb2]

1739

enabled = false

1740

## @param filer.existingConfigmap The name of an existing ConfigMap with your custom configuration for Filer Server

1741

1742

existingConfigmap: ""

1743

## @param filer.notificationConfig Filer Server notification configuration

1744

## Specify content for custom notification.toml

1745

1746

notificationConfig: ""

1747

## @param filer.existingNotificationConfigmap The name of an existing ConfigMap with your custom notification configuration for Filer Server

1748

1749

existingNotificationConfigmap: ""

1750

## @param filer.command Override default Filer Server container command (useful when using custom images)

1751

1752

command: []

1753

## @param filer.args Override default Filer Server container args (useful when using custom images)

1754

1755

args: []

1756

## @param filer.automountServiceAccountToken Mount Service Account token in Filer Server pods

1757

1758

automountServiceAccountToken: false

1759

## @param filer.hostAliases Filer Server pods host aliases

1760

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

1761

1762

hostAliases: []

1763

## @param filer.statefulsetAnnotations Annotations for Filer Server StatefulSet

1764

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

1765

1766

statefulsetAnnotations: {}

1767

## @param filer.podLabels Extra labels for Filer Server pods

1768

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

1769

1770

podLabels: {}

1771

## @param filer.podAnnotations Annotations for Filer Server pods

1772

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

1773

1774

podAnnotations: {}

1775

## @param filer.podAffinityPreset Pod affinity preset. Ignored if `filer.affinity` is set. Allowed values: `soft` or `hard`

1776

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1777

1778

podAffinityPreset: ""

1779

## @param filer.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `filer.affinity` is set. Allowed values: `soft` or `hard`

1780

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

1781

1782

podAntiAffinityPreset: soft

1783

## Node filer.affinity preset

1784

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

1785

1786

nodeAffinityPreset:

1787

## @param filer.nodeAffinityPreset.type Node affinity preset type. Ignored if `filer.affinity` is set. Allowed values: `soft` or `hard`

1788

1789

type: ""

1790

## @param filer.nodeAffinityPreset.key Node label key to match. Ignored if `filer.affinity` is set

1791

1792

key: ""

1793

## @param filer.nodeAffinityPreset.values Node label values to match. Ignored if `filer.affinity` is set

1794

## E.g.

1795

## values:

1796

## - e2e-az1

1797

## - e2e-az2

1798

1799

values: []

1800

## @param filer.affinity Affinity for Filer Server pods assignment

1801

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

1802

## NOTE: `filer.podAffinityPreset`, `filer.podAntiAffinityPreset`, and `filer.nodeAffinityPreset` will be ignored when it's set

1803

1804

affinity: {}

1805

## @param filer.nodeSelector Node labels for Filer Server pods assignment

1806

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

1807

1808

nodeSelector: {}

1809

## @param filer.tolerations Tolerations for Filer Server pods assignment

1810

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

1811

1812

tolerations: []

1813

## @param filer.updateStrategy.type Filer Server StatefulSet strategy type

1814

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

1815

1816

updateStrategy:

1817

## Can be set to RollingUpdate or OnDelete

1818

1819

type: RollingUpdate

1820

## @param filer.podManagementPolicy Pod management policy for Filer Server StatefulSet

1821

## Ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-management-policies

1822

1823

podManagementPolicy: Parallel

1824

## @param filer.priorityClassName Filer Server pods' priorityClassName

1825

1826

priorityClassName: ""

1827

## @param filer.topologySpreadConstraints Topology Spread Constraints for Filer Server pod assignment spread across your cluster among failure-domains

1828

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

1829

1830

topologySpreadConstraints: []

1831

## @param filer.schedulerName Name of the k8s scheduler (other than default) for Filer Server pods

1832

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

1833

1834

schedulerName: ""

1835

## @param filer.terminationGracePeriodSeconds Seconds Filer Server pods need to terminate gracefully

1836

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

1837

1838

terminationGracePeriodSeconds: ""

1839

## @param filer.lifecycleHooks for Filer Server containers to automate configuration before or after startup

1840

1841

lifecycleHooks: {}

1842

## @param filer.extraEnvVars Array with extra environment variables to add to Filer Server containers

1843

## e.g:

1844

## extraEnvVars:

1845

## - name: FOO

1846

## value: "bar"

1847

1848

extraEnvVars: []

1849

## @param filer.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Filer Server containers

1850

1851

extraEnvVarsCM: ""

1852

## @param filer.extraEnvVarsSecret Name of existing Secret containing extra env vars for Filer Server containers

1853

1854

extraEnvVarsSecret: ""

1855

## @param filer.extraVolumes Optionally specify extra list of additional volumes for the Filer Server pods

1856

1857

extraVolumes: []

1858

## @param filer.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Filer Server containers

1859

1860

extraVolumeMounts: []

1861

## @param filer.sidecars Add additional sidecar containers to the Filer Server pods

1862

## e.g:

1863

## sidecars:

1864

## - name: your-image-name

1865

## image: your-image

1866

## imagePullPolicy: Always

1867

## ports:

1868

## - name: portname

1869

## containerPort: 1234

1870

1871

sidecars: []

1872

## @param filer.initContainers Add additional init containers to the Filer Server pods

1873

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

1874

## e.g:

1875

## initContainers:

1876

## - name: your-image-name

1877

## image: your-image

1878

## imagePullPolicy: Always

1879

## command: ['sh', '-c', 'echo "hello world"']

1880

1881

initContainers: []

1882

## Pod Disruption Budget configuration

1883

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

1884

## @param filer.pdb.create Enable/disable a Pod Disruption Budget creation

1885

## @param filer.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

1886

## @param filer.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `filer.pdb.minAvailable` and `filer.pdb.maxUnavailable` are empty.

1887

1888

pdb:

1889

create: true

1890

minAvailable: ""

1891

maxUnavailable: ""

1892

## Autoscaling configuration

1893

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

1894

## @param filer.autoscaling.enabled Enable autoscaling for filer

1895

## @param filer.autoscaling.minReplicas Minimum number of filer replicas

1896

## @param filer.autoscaling.maxReplicas Maximum number of filer replicas

1897

## @param filer.autoscaling.targetCPU Target CPU utilization percentage

1898

## @param filer.autoscaling.targetMemory Target Memory utilization percentage

1899

1900

autoscaling:

1901

enabled: false

1902

minReplicas: ""

1903

maxReplicas: ""

1904

targetCPU: ""

1905

targetMemory: ""

1906

## @section Filer Server Traffic Exposure Parameters

1907

1908

1909

## Filer Server service parameters

1910

1911

service:

1912

## @param filer.service.type Filer Server service type

1913

1914

type: ClusterIP

1915

## @param filer.service.ports.http Filer Server service HTTP port

1916

## @param filer.service.ports.grpc Filer Server service GRPC port

1917

1918

ports:

1919

http: 8888

1920

grpc: 18888

1921

## Node ports to expose

1922

## @param filer.service.nodePorts.http Node port for HTTP

1923

## @param filer.service.nodePorts.grpc Node port for GRPC

1924

## NOTE: choose port between <30000-32767>

1925

1926

nodePorts:

1927

http: ""

1928

grpc: ""

1929

## @param filer.service.clusterIP Filer Server service Cluster IP

1930

## e.g.:

1931

## clusterIP: None

1932

1933

clusterIP: ""

1934

## @param filer.service.loadBalancerIP Filer Server service Load Balancer IP

1935

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

1936

1937

loadBalancerIP: ""

1938

## @param filer.service.loadBalancerSourceRanges Filer Server service Load Balancer sources

1939

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

1940

## e.g:

1941

## loadBalancerSourceRanges:

1942

## - 10.10.10.0/24

1943

1944

loadBalancerSourceRanges: []

1945

## @param filer.service.externalTrafficPolicy Filer Server service external traffic policy

1946

## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

1947

1948

externalTrafficPolicy: Cluster

1949

## @param filer.service.annotations Additional custom annotations for Filer Server service

1950

1951

annotations: {}

1952

## @param filer.service.extraPorts Extra ports to expose in Filer Server service (normally used with the `sidecars` value)

1953

1954

extraPorts: []

1955

## @param filer.service.sessionAffinity Control where client requests go, to the same pod or round-robin

1956

## Values: ClientIP or None

1957

## ref: https://kubernetes.io/docs/concepts/services-networking/service/

1958

1959

sessionAffinity: None

1960

## @param filer.service.sessionAffinityConfig Additional settings for the sessionAffinity

1961

## sessionAffinityConfig:

1962

## clientIP:

1963

## timeoutSeconds: 300

1964

1965

sessionAffinityConfig: {}

1966

## Headless service properties

1967

1968

headless:

1969

## @param filer.service.headless.annotations Annotations for the headless service.

1970

1971

annotations: {}

1972

## Network Policies for Filer Server

1973

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

1974

1975

networkPolicy:

1976

## @param filer.networkPolicy.enabled Specifies whether a NetworkPolicy should be created for Filer Server

1977

1978

enabled: true

1979

## @param filer.networkPolicy.allowExternal Don't require server label for connections

1980

## The Policy model to apply. When set to false, only pods with the correct

1981

## server label will have network access to the ports server is listening

1982

## on. When true, server will accept connections from any source

1983

## (with the correct destination port).

1984

1985

allowExternal: true

1986

## @param filer.networkPolicy.allowExternalEgress Allow the Filer Server pods to access any range of port and all destinations.

1987

1988

allowExternalEgress: true

1989

## @param filer.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

1990

## e.g:

1991

## extraIngress:

1992

## - ports:

1993

## - port: 1234

1994

## from:

1995

## - podSelector:

1996

## - matchLabels:

1997

## - role: frontend

1998

## - podSelector:

1999

## - matchExpressions:

2000

## - key: role

2001

## operator: In

2002

## values:

2003

## - frontend

2004

extraIngress: []

2005

## @param filer.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)

2006

## e.g:

2007

## extraEgress:

2008

## - ports:

2009

## - port: 1234

2010

## to:

2011

## - podSelector:

2012

## - matchLabels:

2013

## - role: frontend

2014

## - podSelector:

2015

## - matchExpressions:

2016

## - key: role

2017

## operator: In

2018

## values:

2019

## - frontend

2020

2021

extraEgress: []

2022

## @param filer.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

2023

## @param filer.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

2024

2025

ingressNSMatchLabels: {}

2026

ingressNSPodMatchLabels: {}

2027

## Filer Server ingress parameters

2028

## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/

2029

2030

ingress:

2031

## @param filer.ingress.enabled Enable ingress record generation for Filer Server

2032

2033

enabled: false

2034

## @param filer.ingress.pathType Ingress path type

2035

2036

pathType: ImplementationSpecific

2037

## @param filer.ingress.apiVersion Force Ingress API version (automatically detected if not set)

2038

2039

apiVersion: ""

2040

## @param filer.ingress.hostname Default host for the ingress record

2041

2042

hostname: filer.seaweedfs.local

2043

## @param filer.ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)

2044

## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .

2045

## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/

2046

2047

ingressClassName: ""

2048

## @param filer.ingress.path Default path for the ingress record

2049

## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers

2050

2051

path: /

2052

## @param filer.ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

2053

## Use this parameter to set the required annotations for cert-manager, see

2054

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

2055

## e.g:

2056

## annotations:

2057

## kubernetes.io/ingress.class: nginx

2058

## cert-manager.io/cluster-issuer: cluster-issuer-name

2059

2060

annotations: {}

2061

## @param filer.ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter

2062

## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`

2063

## You can:

2064

## - Use the `ingress.secrets` parameter to create this TLS secret

2065

## - Rely on cert-manager to create it by setting the corresponding annotations

2066

## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`

2067

2068

tls: false

2069

## @param filer.ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm

2070

2071

selfSigned: false

2072

## @param filer.ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record

2073

## e.g:

2074

## extraHosts:

2075

## - name: filer.seaweedfs.local

2076

## path: /

2077

2078

extraHosts: []

2079

## @param filer.ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host

2080

## e.g:

2081

## extraPaths:

2082

## - path: /*

2083

## backend:

2084

## serviceName: ssl-redirect

2085

## servicePort: use-annotation

2086

2087

extraPaths: []

2088

## @param filer.ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record

2089

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

2090

## e.g:

2091

## extraTls:

2092

## - hosts:

2093

## - filer.seaweedfs.local

2094

## secretName: filer.seaweedfs.local-tls

2095

2096

extraTls: []

2097

## @param filer.ingress.secrets Custom TLS certificates as secrets

2098

## NOTE: 'key' and 'certificate' are expected in PEM format

2099

## NOTE: 'name' should line up with a 'secretName' set further up

2100

## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates

2101

## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days

2102

## It is also possible to create and manage the certificates outside of this helm chart

2103

## Please see README.md for more information

2104

## e.g:

2105

## secrets:

2106

## - name: filer.seaweedfs.local-tls

2107

## key: |-

2108

## -----BEGIN RSA PRIVATE KEY-----

2109

## ...

2110

## -----END RSA PRIVATE KEY-----

2111

## certificate: |-

2112

## -----BEGIN CERTIFICATE-----

2113

## ...

2114

## -----END CERTIFICATE-----

2115

2116

secrets: []

2117

## @param filer.ingress.extraRules Additional rules to be covered with this ingress record

2118

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

2119

## e.g:

2120

## extraRules:

2121

## - host: example.local

2122

## http:

2123

## path: /

2124

## backend:

2125

## service:

2126

## name: example-svc

2127

## port:

2128

## name: http

2129

2130

extraRules: []

2131

## @section Filer Server Persistence Parameters

2132

2133

2134

## Enable Filer logs persistence using Persistent Volume Claims

2135

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

2136

2137

logPersistence:

2138

## @param filer.logPersistence.enabled Enable logs persistence on Filer Server using Persistent Volume Claims

2139

2140

enabled: false

2141

## @param filer.logPersistence.mountPath Path to mount the volume at.

2142

2143

mountPath: /logs

2144

## @param filer.logPersistence.subPath The subdirectory of the volume to mount to, useful in dev environments and one PV for multiple services

2145

2146

subPath: ""

2147

## @param filer.logPersistence.storageClass Storage class of backing PVC

2148

## If defined, storageClassName: <storageClass>

2149

## If set to "-", storageClassName: "", which disables dynamic provisioning

2150

## If undefined (the default) or set to null, no storageClassName spec is

2151

## set, choosing the default provisioner. (gp2 on AWS, standard on

2152

## GKE, AWS & OpenStack)

2153

2154

storageClass: ""

2155

## @param filer.logPersistence.annotations Persistent Volume Claim annotations

2156

2157

annotations: {}

2158

## @param filer.logPersistence.accessModes Persistent Volume Access Modes

2159

2160

accessModes:

2161

- ReadWriteOnce

2162

## @param filer.logPersistence.size Size of logs volume

2163

2164

size: 8Gi

2165

## @param filer.logPersistence.existingClaim The name of an existing PVC to use for logs persistence

2166

2167

existingClaim: ""

2168

## @param filer.logPersistence.selector Selector to match an existing Persistent Volume for logs PVC

2169

## If set, the PVC can't have a PV dynamically provisioned for it

2170

## E.g.

2171

## selector:

2172

## matchLabels:

2173

## app: my-app

2174

2175

selector: {}

2176

## @param filer.logPersistence.dataSource Custom PVC data source

2177

2178

dataSource: {}

2179

## persistentVolumeClaimRetentionPolicy

2180

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention

2181

## @param filer.persistentVolumeClaimRetentionPolicy.enabled Controls if and how PVCs are deleted during the lifecycle of the Master Server StatefulSet

2182

## @param filer.persistentVolumeClaimRetentionPolicy.whenScaled Volume retention behavior when the replica count of the StatefulSet is reduced

2183

## @param filer.persistentVolumeClaimRetentionPolicy.whenDeleted Volume retention behavior that applies when the StatefulSet is deleted

2184

2185

persistentVolumeClaimRetentionPolicy:

2186

enabled: false

2187

whenScaled: Retain

2188

whenDeleted: Retain

2189

## @section Filer Server Metrics Parameters

2190

2191

metrics:

2192

## @param filer.metrics.enabled Enable the export of Prometheus metrics

2193

2194

enabled: false

2195

## Metrics service properties

2196

2197

service:

2198

## @param filer.metrics.service.port Metrics service port

2199

2200

port: 9327

2201

## @param filer.metrics.service.annotations Annotations for the metrics service.

2202

2203

annotations: {}

2204

## Prometheus Operator ServiceMonitor configuration

2205

2206

serviceMonitor:

2207

## @param filer.metrics.serviceMonitor.enabled if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`)

2208

2209

enabled: false

2210

## @param filer.metrics.serviceMonitor.namespace Namespace in which Prometheus is running

2211

2212

namespace: ""

2213

## @param filer.metrics.serviceMonitor.annotations Additional custom annotations for the ServiceMonitor

2214

2215

annotations: {}

2216

## @param filer.metrics.serviceMonitor.labels Extra labels for the ServiceMonitor

2217

2218

labels: {}

2219

## @param filer.metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in Prometheus

2220

2221

jobLabel: ""

2222

## @param filer.metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels

2223

2224

honorLabels: false

2225

## @param filer.metrics.serviceMonitor.interval Interval at which metrics should be scraped.

2226

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

2227

## e.g:

2228

## interval: 10s

2229

2230

interval: ""

2231

## @param filer.metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended

2232

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

2233

## e.g:

2234

## scrapeTimeout: 10s

2235

2236

scrapeTimeout: ""

2237

## @param filer.metrics.serviceMonitor.metricRelabelings Specify additional relabeling of metrics

2238

2239

metricRelabelings: []

2240

## @param filer.metrics.serviceMonitor.relabelings Specify general relabeling

2241

2242

relabelings: []

2243

## @param filer.metrics.serviceMonitor.selector Prometheus instance selector labels

2244

## selector:

2245

## prometheus: my-prometheus

2246

2247

selector: {}

2248

## @section Amazon S3 API Parameters

2249

2250

s3:

2251

## @param s3.enabled Enable Amazon S3 API deployment

2252

2253

enabled: false

2254

## @param s3.replicaCount Number of Amazon S3 API replicas to deploy

2255

2256

replicaCount: 1

2257

## @param s3.containerPorts.http Amazon S3 API HTTP container port

2258

## @param s3.containerPorts.grpc Amazon S3 API GRPC container port

2259

## @param s3.containerPorts.metrics Amazon S3 API metrics container port

2260

2261

containerPorts:

2262

http: 8333

2263

grpc: 18333

2264

metrics: 9327

2265

## @param s3.extraContainerPorts Optionally specify extra list of additional ports for Amazon S3 API containers

2266

## e.g:

2267

## extraContainerPorts:

2268

## - name: myservice

2269

## containerPort: 9090

2270

2271

extraContainerPorts: []

2272

## Configure extra options for Amazon S3 API containers' liveness and readiness probes

2273

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

2274

## @param s3.livenessProbe.enabled Enable livenessProbe on Amazon S3 API containers

2275

## @param s3.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

2276

## @param s3.livenessProbe.periodSeconds Period seconds for livenessProbe

2277

## @param s3.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

2278

## @param s3.livenessProbe.failureThreshold Failure threshold for livenessProbe

2279

## @param s3.livenessProbe.successThreshold Success threshold for livenessProbe

2280

2281

livenessProbe:

2282

enabled: true

2283

initialDelaySeconds: 30

2284

timeoutSeconds: 30

2285

periodSeconds: 10

2286

successThreshold: 1

2287

failureThreshold: 6

2288

## @param s3.readinessProbe.enabled Enable readinessProbe on Amazon S3 API containers

2289

## @param s3.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

2290

## @param s3.readinessProbe.periodSeconds Period seconds for readinessProbe

2291

## @param s3.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

2292

## @param s3.readinessProbe.failureThreshold Failure threshold for readinessProbe

2293

## @param s3.readinessProbe.successThreshold Success threshold for readinessProbe

2294

2295

readinessProbe:

2296

enabled: true

2297

initialDelaySeconds: 30

2298

timeoutSeconds: 30

2299

periodSeconds: 10

2300

successThreshold: 1

2301

failureThreshold: 6

2302

## @param s3.startupProbe.enabled Enable startupProbe on Amazon S3 API containers

2303

## @param s3.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

2304

## @param s3.startupProbe.periodSeconds Period seconds for startupProbe

2305

## @param s3.startupProbe.timeoutSeconds Timeout seconds for startupProbe

2306

## @param s3.startupProbe.failureThreshold Failure threshold for startupProbe

2307

## @param s3.startupProbe.successThreshold Success threshold for startupProbe

2308

2309

startupProbe:

2310

enabled: false

2311

initialDelaySeconds: 5

2312

periodSeconds: 5

2313

timeoutSeconds: 1

2314

failureThreshold: 15

2315

successThreshold: 1

2316

## @param s3.customLivenessProbe Custom livenessProbe that overrides the default one

2317

2318

customLivenessProbe: {}

2319

## @param s3.customReadinessProbe Custom readinessProbe that overrides the default one

2320

2321

customReadinessProbe: {}

2322

## @param s3.customStartupProbe Custom startupProbe that overrides the default one

2323

2324

customStartupProbe: {}

2325

## Amazon S3 API resource requests and limits

2326

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

2327

## @param s3.resourcesPreset Set Amazon S3 API container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if s3.resources is set (s3.resources is recommended for production).

2328

2329

resourcesPreset: "nano"

2330

## @param s3.resources Set Amazon S3 API container requests and limits for different resources like CPU or memory (essential for production workloads)

2331

## Example:

2332

## resources:

2333

## requests:

2334

## cpu: 2

2335

## memory: 512Mi

2336

## limits:

2337

## cpu: 3

2338

## memory: 1024Mi

2339

2340

resources: {}

2341

## Configure Pods Security Context

2342

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

2343

## @param s3.podSecurityContext.enabled Enable Amazon S3 API pods' Security Context

2344

## @param s3.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for Amazon S3 API pods

2345

## @param s3.podSecurityContext.sysctls Set kernel settings using the sysctl interface for Amazon S3 API pods

2346

## @param s3.podSecurityContext.supplementalGroups Set filesystem extra groups for Amazon S3 API pods

2347

## @param s3.podSecurityContext.fsGroup Set fsGroup in Amazon S3 API pods' Security Context

2348

2349

podSecurityContext:

2350

enabled: true

2351

fsGroupChangePolicy: Always

2352

sysctls: []

2353

supplementalGroups: []

2354

fsGroup: 1001

2355

## Configure Container Security Context

2356

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

2357

## @param s3.containerSecurityContext.enabled Enabled Amazon S3 API container' Security Context

2358

## @param s3.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in Amazon S3 API container

2359

## @param s3.containerSecurityContext.runAsUser Set runAsUser in Amazon S3 API container' Security Context

2360

## @param s3.containerSecurityContext.runAsGroup Set runAsGroup in Amazon S3 API container' Security Context

2361

## @param s3.containerSecurityContext.runAsNonRoot Set runAsNonRoot in Amazon S3 API container' Security Context

2362

## @param s3.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in Amazon S3 API container' Security Context

2363

## @param s3.containerSecurityContext.privileged Set privileged in Amazon S3 API container' Security Context

2364

## @param s3.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in Amazon S3 API container' Security Context

2365

## @param s3.containerSecurityContext.capabilities.drop List of capabilities to be dropped in Amazon S3 API container

2366

## @param s3.containerSecurityContext.seccompProfile.type Set seccomp profile in Amazon S3 API container

2367

2368

containerSecurityContext:

2369

enabled: true

2370

seLinuxOptions: {}

2371

runAsUser: 1001

2372

runAsGroup: 1001

2373

runAsNonRoot: true

2374

readOnlyRootFilesystem: true

2375

privileged: false

2376

allowPrivilegeEscalation: false

2377

capabilities:

2378

drop: ["ALL"]

2379

seccompProfile:

2380

type: "RuntimeDefault"

2381

## @param s3.logLevel Amazon S3 API log level (0, 1, 2, 3, or 4)

2382

2383

logLevel: 1

2384

## @param s3.bindAddress Amazon S3 API bind address

2385

2386

bindAddress: 0.0.0.0

2387

## @param s3.allowEmptyFolder Allow empty folders in Amazon S3 API

2388

allowEmptyFolder: true

2389

## S3 Authentication

2390

## ref: https://github.com/seaweedfs/seaweedfs/wiki/Amazon-S3-API#s3-authentication

2391

## @param s3.auth.enabled Enable Amazon S3 API authentication

2392

## @param s3.auth.existingSecret Existing secret with Amazon S3 API authentication configuration

2393

## @param s3.auth.existingSecretConfigKey Key of the above existing secret with S3 API authentication configuration, defaults to `config.json`

2394

## @param s3.auth.adminAccessKeyId Amazon S3 API access key with admin privileges. Ignored if `s3.auth.existingSecret` is set

2395

## @param s3.auth.adminSecretAccessKey Amazon S3 API secret key with admin privileges. Ignored if `s3.auth.existingSecret` is set

2396

## @param s3.auth.readAccessKeyId Amazon S3 API read access key with read-only privileges. Ignored if `s3.auth.existingSecret` is set

2397

## @param s3.auth.readSecretAccessKey Amazon S3 API read secret key with read-only privileges. Ignored if `s3.auth.existingSecret` is set

2398

2399

auth:

2400

enabled: false

2401

existingSecret: ""

2402

existingSecretConfigKey: ""

2403

adminAccessKeyId: ""

2404

adminSecretAccessKey: ""

2405

readAccessKeyId: ""

2406

readSecretAccessKey: ""

2407

## @param s3.command Override default Amazon S3 API container command (useful when using custom images)

2408

2409

command: []

2410

## @param s3.args Override default Amazon S3 API container args (useful when using custom images)

2411

2412

args: []

2413

## @param s3.automountServiceAccountToken Mount Service Account token in Amazon S3 API pods

2414

2415

automountServiceAccountToken: false

2416

## @param s3.hostAliases Amazon S3 API pods host aliases

2417

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

2418

2419

hostAliases: []

2420

## @param s3.statefulsetAnnotations Annotations for Amazon S3 API statefulset

2421

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

2422

2423

statefulsetAnnotations: {}

2424

## @param s3.podLabels Extra labels for Amazon S3 API pods

2425

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

2426

2427

podLabels: {}

2428

## @param s3.podAnnotations Annotations for Amazon S3 API pods

2429

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

2430

2431

podAnnotations: {}

2432

## @param s3.podAffinityPreset Pod affinity preset. Ignored if `s3.affinity` is set. Allowed values: `soft` or `hard`

2433

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

2434

2435

podAffinityPreset: ""

2436

## @param s3.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `s3.affinity` is set. Allowed values: `soft` or `hard`

2437

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

2438

2439

podAntiAffinityPreset: soft

2440

## Node s3.affinity preset

2441

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

2442

2443

nodeAffinityPreset:

2444

## @param s3.nodeAffinityPreset.type Node affinity preset type. Ignored if `s3.affinity` is set. Allowed values: `soft` or `hard`

2445

2446

type: ""

2447

## @param s3.nodeAffinityPreset.key Node label key to match. Ignored if `s3.affinity` is set

2448

2449

key: ""

2450

## @param s3.nodeAffinityPreset.values Node label values to match. Ignored if `s3.affinity` is set

2451

## E.g.

2452

## values:

2453

## - e2e-az1

2454

## - e2e-az2

2455

2456

values: []

2457

## @param s3.affinity Affinity for Amazon S3 API pods assignment

2458

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

2459

## NOTE: `s3.podAffinityPreset`, `s3.podAntiAffinityPreset`, and `s3.nodeAffinityPreset` will be ignored when it's set

2460

2461

affinity: {}

2462

## @param s3.nodeSelector Node labels for Amazon S3 API pods assignment

2463

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

2464

2465

nodeSelector: {}

2466

## @param s3.tolerations Tolerations for Amazon S3 API pods assignment

2467

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

2468

2469

tolerations: []

2470

## @param s3.updateStrategy.type Amazon S3 API deployment strategy type

2471

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

2472

2473

updateStrategy:

2474

## Can be set to RollingUpdate or Recreate

2475

2476

type: RollingUpdate

2477

## @param s3.priorityClassName Amazon S3 API pods' priorityClassName

2478

2479

priorityClassName: ""

2480

## @param s3.topologySpreadConstraints Topology Spread Constraints for Amazon S3 API pod assignment spread across your cluster among failure-domains

2481

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

2482

2483

topologySpreadConstraints: []

2484

## @param s3.schedulerName Name of the k8s scheduler (other than default) for Amazon S3 API pods

2485

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

2486

2487

schedulerName: ""

2488

## @param s3.terminationGracePeriodSeconds Seconds Amazon S3 API pods need to terminate gracefully

2489

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

2490

2491

terminationGracePeriodSeconds: ""

2492

## @param s3.lifecycleHooks for Amazon S3 API containers to automate configuration before or after startup

2493

2494

lifecycleHooks: {}

2495

## @param s3.extraEnvVars Array with extra environment variables to add to Amazon S3 API containers

2496

## e.g:

2497

## extraEnvVars:

2498

## - name: FOO

2499

## value: "bar"

2500

2501

extraEnvVars: []

2502

## @param s3.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Amazon S3 API containers

2503

2504

extraEnvVarsCM: ""

2505

## @param s3.extraEnvVarsSecret Name of existing Secret containing extra env vars for Amazon S3 API containers

2506

2507

extraEnvVarsSecret: ""

2508

## @param s3.extraVolumes Optionally specify extra list of additional volumes for the Amazon S3 API pods

2509

2510

extraVolumes: []

2511

## @param s3.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Amazon S3 API containers

2512

2513

extraVolumeMounts: []

2514

## @param s3.sidecars Add additional sidecar containers to the Amazon S3 API pods

2515

## e.g:

2516

## sidecars:

2517

## - name: your-image-name

2518

## image: your-image

2519

## imagePullPolicy: Always

2520

## ports:

2521

## - name: portname

2522

## containerPort: 1234

2523

2524

sidecars: []

2525

## @param s3.initContainers Add additional init containers to the Amazon S3 API pods

2526

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

2527

## e.g:

2528

## initContainers:

2529

## - name: your-image-name

2530

## image: your-image

2531

## imagePullPolicy: Always

2532

## command: ['sh', '-c', 'echo "hello world"']

2533

2534

initContainers: []

2535

## Pod Disruption Budget configuration

2536

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

2537

## @param s3.pdb.create Enable/disable a Pod Disruption Budget creation

2538

## @param s3.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

2539

## @param s3.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `s3.pdb.minAvailable` and `s3.pdb.maxUnavailable` are empty.

2540

2541

pdb:

2542

create: true

2543

minAvailable: ""

2544

maxUnavailable: ""

2545

## Autoscaling configuration

2546

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

2547

## @param s3.autoscaling.enabled Enable autoscaling for s3

2548

## @param s3.autoscaling.minReplicas Minimum number of s3 replicas

2549

## @param s3.autoscaling.maxReplicas Maximum number of s3 replicas

2550

## @param s3.autoscaling.targetCPU Target CPU utilization percentage

2551

## @param s3.autoscaling.targetMemory Target Memory utilization percentage

2552

2553

autoscaling:

2554

enabled: false

2555

minReplicas: ""

2556

maxReplicas: ""

2557

targetCPU: ""

2558

targetMemory: ""

2559

## @section Amazon S3 API Traffic Exposure Parameters

2560

2561

2562

## Amazon S3 API service parameters

2563

2564

service:

2565

## @param s3.service.type Amazon S3 API service type

2566

2567

type: ClusterIP

2568

## @param s3.service.ports.http Amazon S3 API service HTTP port

2569

## @param s3.service.ports.grpc Amazon S3 API service GRPC port

2570

2571

ports:

2572

http: 8333

2573

grpc: 18333

2574

## Node ports to expose

2575

## @param s3.service.nodePorts.http Node port for HTTP

2576

## @param s3.service.nodePorts.grpc Node port for GRPC

2577

## NOTE: choose port between <30000-32767>

2578

2579

nodePorts:

2580

http: ""

2581

grpc: ""

2582

## @param s3.service.clusterIP Amazon S3 API service Cluster IP

2583

## e.g.:

2584

## clusterIP: None

2585

2586

clusterIP: ""

2587

## @param s3.service.loadBalancerIP Amazon S3 API service Load Balancer IP

2588

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

2589

2590

loadBalancerIP: ""

2591

## @param s3.service.loadBalancerSourceRanges Amazon S3 API service Load Balancer sources

2592

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

2593

## e.g:

2594

## loadBalancerSourceRanges:

2595

## - 10.10.10.0/24

2596

2597

loadBalancerSourceRanges: []

2598

## @param s3.service.externalTrafficPolicy Amazon S3 API service external traffic policy

2599

## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

2600

2601

externalTrafficPolicy: Cluster

2602

## @param s3.service.annotations Additional custom annotations for Amazon S3 API service

2603

2604

annotations: {}

2605

## @param s3.service.extraPorts Extra ports to expose in Amazon S3 API service (normally used with the `sidecars` value)

2606

2607

extraPorts: []

2608

## @param s3.service.sessionAffinity Control where client requests go, to the same pod or round-robin

2609

## Values: ClientIP or None

2610

## ref: https://kubernetes.io/docs/concepts/services-networking/service/

2611

2612

sessionAffinity: None

2613

## @param s3.service.sessionAffinityConfig Additional settings for the sessionAffinity

2614

## sessionAffinityConfig:

2615

## clientIP:

2616

## timeoutSeconds: 300

2617

2618

sessionAffinityConfig: {}

2619

## Headless service properties

2620

2621

headless:

2622

## @param s3.service.headless.annotations Annotations for the headless service.

2623

2624

annotations: {}

2625

## Network Policies for Amazon S3 API

2626

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

2627

2628

networkPolicy:

2629

## @param s3.networkPolicy.enabled Specifies whether a NetworkPolicy should be created for Amazon S3 API

2630

2631

enabled: true

2632

## @param s3.networkPolicy.allowExternal Don't require server label for connections

2633

## The Policy model to apply. When set to false, only pods with the correct

2634

## server label will have network access to the ports server is listening

2635

## on. When true, server will accept connections from any source

2636

## (with the correct destination port).

2637

2638

allowExternal: true

2639

## @param s3.networkPolicy.allowExternalEgress Allow the Amazon S3 API pods to access any range of port and all destinations.

2640

2641

allowExternalEgress: true

2642

## @param s3.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

2643

## e.g:

2644

## extraIngress:

2645

## - ports:

2646

## - port: 1234

2647

## from:

2648

## - podSelector:

2649

## - matchLabels:

2650

## - role: frontend

2651

## - podSelector:

2652

## - matchExpressions:

2653

## - key: role

2654

## operator: In

2655

## values:

2656

## - frontend

2657

extraIngress: []

2658

## @param s3.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)

2659

## e.g:

2660

## extraEgress:

2661

## - ports:

2662

## - port: 1234

2663

## to:

2664

## - podSelector:

2665

## - matchLabels:

2666

## - role: frontend

2667

## - podSelector:

2668

## - matchExpressions:

2669

## - key: role

2670

## operator: In

2671

## values:

2672

## - frontend

2673

2674

extraEgress: []

2675

## @param s3.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

2676

## @param s3.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

2677

2678

ingressNSMatchLabels: {}

2679

ingressNSPodMatchLabels: {}

2680

## Amazon S3 API ingress parameters

2681

## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/

2682

2683

ingress:

2684

## @param s3.ingress.enabled Enable ingress record generation for Amazon S3 API

2685

2686

enabled: false

2687

## @param s3.ingress.pathType Ingress path type

2688

2689

pathType: ImplementationSpecific

2690

## @param s3.ingress.apiVersion Force Ingress API version (automatically detected if not set)

2691

2692

apiVersion: ""

2693

## @param s3.ingress.hostname Default host for the ingress record

2694

2695

hostname: s3.seaweedfs.local

2696

## @param s3.ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)

2697

## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .

2698

## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/

2699

2700

ingressClassName: ""

2701

## @param s3.ingress.path Default path for the ingress record

2702

## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers

2703

2704

path: /

2705

## @param s3.ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

2706

## Use this parameter to set the required annotations for cert-manager, see

2707

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

2708

## e.g:

2709

## annotations:

2710

## kubernetes.io/ingress.class: nginx

2711

## cert-manager.io/cluster-issuer: cluster-issuer-name

2712

2713

annotations: {}

2714

## @param s3.ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter

2715

## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`

2716

## You can:

2717

## - Use the `ingress.secrets` parameter to create this TLS secret

2718

## - Rely on cert-manager to create it by setting the corresponding annotations

2719

## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`

2720

2721

tls: false

2722

## @param s3.ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm

2723

2724

selfSigned: false

2725

## @param s3.ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record

2726

## e.g:

2727

## extraHosts:

2728

## - name: s3.seaweedfs.local

2729

## path: /

2730

2731

extraHosts: []

2732

## @param s3.ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host

2733

## e.g:

2734

## extraPaths:

2735

## - path: /*

2736

## backend:

2737

## serviceName: ssl-redirect

2738

## servicePort: use-annotation

2739

2740

extraPaths: []

2741

## @param s3.ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record

2742

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

2743

## e.g:

2744

## extraTls:

2745

## - hosts:

2746

## - s3.seaweedfs.local

2747

## secretName: s3.seaweedfs.local-tls

2748

2749

extraTls: []

2750

## @param s3.ingress.secrets Custom TLS certificates as secrets

2751

## NOTE: 'key' and 'certificate' are expected in PEM format

2752

## NOTE: 'name' should line up with a 'secretName' set further up

2753

## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates

2754

## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days

2755

## It is also possible to create and manage the certificates outside of this helm chart

2756

## Please see README.md for more information

2757

## e.g:

2758

## secrets:

2759

## - name: s3.seaweedfs.local-tls

2760

## key: |-

2761

## -----BEGIN RSA PRIVATE KEY-----

2762

## ...

2763

## -----END RSA PRIVATE KEY-----

2764

## certificate: |-

2765

## -----BEGIN CERTIFICATE-----

2766

## ...

2767

## -----END CERTIFICATE-----

2768

2769

secrets: []

2770

## @param s3.ingress.extraRules Additional rules to be covered with this ingress record

2771

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

2772

## e.g:

2773

## extraRules:

2774

## - host: example.local

2775

## http:

2776

## path: /

2777

## backend:

2778

## service:

2779

## name: example-svc

2780

## port:

2781

## name: http

2782

2783

extraRules: []

2784

## @section Amazon S3 API Metrics Parameters

2785

2786

metrics:

2787

## @param s3.metrics.enabled Enable the export of Prometheus metrics

2788

2789

enabled: false

2790

## Metrics service properties

2791

2792

service:

2793

## @param s3.metrics.service.port Metrics service port

2794

2795

port: 9327

2796

## @param s3.metrics.service.annotations Annotations for the metrics service.

2797

2798

annotations: {}

2799

## Prometheus Operator ServiceMonitor configuration

2800

2801

serviceMonitor:

2802

## @param s3.metrics.serviceMonitor.enabled if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`)

2803

2804

enabled: false

2805

## @param s3.metrics.serviceMonitor.namespace Namespace in which Prometheus is running

2806

2807

namespace: ""

2808

## @param s3.metrics.serviceMonitor.annotations Additional custom annotations for the ServiceMonitor

2809

2810

annotations: {}

2811

## @param s3.metrics.serviceMonitor.labels Extra labels for the ServiceMonitor

2812

2813

labels: {}

2814

## @param s3.metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in Prometheus

2815

2816

jobLabel: ""

2817

## @param s3.metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels

2818

2819

honorLabels: false

2820

## @param s3.metrics.serviceMonitor.interval Interval at which metrics should be scraped.

2821

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

2822

## e.g:

2823

## interval: 10s

2824

2825

interval: ""

2826

## @param s3.metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended

2827

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

2828

## e.g:

2829

## scrapeTimeout: 10s

2830

2831

scrapeTimeout: ""

2832

## @param s3.metrics.serviceMonitor.metricRelabelings Specify additional relabeling of metrics

2833

2834

metricRelabelings: []

2835

## @param s3.metrics.serviceMonitor.relabelings Specify general relabeling

2836

2837

relabelings: []

2838

## @param s3.metrics.serviceMonitor.selector Prometheus instance selector labels

2839

## selector:

2840

## prometheus: my-prometheus

2841

2842

selector: {}

2843

## @section WebDAV Parameters

2844

2845

webdav:

2846

## @param webdav.enabled Enable WebDAV deployment

2847

2848

enabled: false

2849

## @param webdav.replicaCount Number of WebDAV replicas to deploy

2850

2851

replicaCount: 1

2852

## @param webdav.containerPorts.http WebDAV HTTP container port (HTTPS if `webdav.tls.enabled` is `true`)

2853

2854

containerPorts:

2855

http: 7333

2856

## @param webdav.extraContainerPorts Optionally specify extra list of additional ports for WebDAV containers

2857

## e.g:

2858

## extraContainerPorts:

2859

## - name: myservice

2860

## containerPort: 9090

2861

2862

extraContainerPorts: []

2863

## Configure extra options for WebDAV containers' liveness and readiness probes

2864

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

2865

## @param webdav.livenessProbe.enabled Enable livenessProbe on WebDAV containers

2866

## @param webdav.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

2867

## @param webdav.livenessProbe.periodSeconds Period seconds for livenessProbe

2868

## @param webdav.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

2869

## @param webdav.livenessProbe.failureThreshold Failure threshold for livenessProbe

2870

## @param webdav.livenessProbe.successThreshold Success threshold for livenessProbe

2871

2872

livenessProbe:

2873

enabled: true

2874

initialDelaySeconds: 30

2875

timeoutSeconds: 30

2876

periodSeconds: 10

2877

successThreshold: 1

2878

failureThreshold: 6

2879

## @param webdav.readinessProbe.enabled Enable readinessProbe on WebDAV containers

2880

## @param webdav.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

2881

## @param webdav.readinessProbe.periodSeconds Period seconds for readinessProbe

2882

## @param webdav.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

2883

## @param webdav.readinessProbe.failureThreshold Failure threshold for readinessProbe

2884

## @param webdav.readinessProbe.successThreshold Success threshold for readinessProbe

2885

2886

readinessProbe:

2887

enabled: true

2888

initialDelaySeconds: 30

2889

timeoutSeconds: 30

2890

periodSeconds: 10

2891

successThreshold: 1

2892

failureThreshold: 6

2893

## @param webdav.startupProbe.enabled Enable startupProbe on WebDAV containers

2894

## @param webdav.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

2895

## @param webdav.startupProbe.periodSeconds Period seconds for startupProbe

2896

## @param webdav.startupProbe.timeoutSeconds Timeout seconds for startupProbe

2897

## @param webdav.startupProbe.failureThreshold Failure threshold for startupProbe

2898

## @param webdav.startupProbe.successThreshold Success threshold for startupProbe

2899

2900

startupProbe:

2901

enabled: false

2902

initialDelaySeconds: 5

2903

periodSeconds: 5

2904

timeoutSeconds: 1

2905

failureThreshold: 15

2906

successThreshold: 1

2907

## @param webdav.customLivenessProbe Custom livenessProbe that overrides the default one

2908

2909

customLivenessProbe: {}

2910

## @param webdav.customReadinessProbe Custom readinessProbe that overrides the default one

2911

2912

customReadinessProbe: {}

2913

## @param webdav.customStartupProbe Custom startupProbe that overrides the default one

2914

2915

customStartupProbe: {}

2916

## WebDAV resource requests and limits

2917

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

2918

## @param webdav.resourcesPreset Set WebDAV container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if webdav.resources is set (webdav.resources is recommended for production).

2919

2920

resourcesPreset: "nano"

2921

## @param webdav.resources Set WebDAV container requests and limits for different resources like CPU or memory (essential for production workloads)

2922

## Example:

2923

## resources:

2924

## requests:

2925

## cpu: 2

2926

## memory: 512Mi

2927

## limits:

2928

## cpu: 3

2929

## memory: 1024Mi

2930

2931

resources: {}

2932

## Configure Pods Security Context

2933

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

2934

## @param webdav.podSecurityContext.enabled Enable WebDAV pods' Security Context

2935

## @param webdav.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for WebDAV pods

2936

## @param webdav.podSecurityContext.sysctls Set kernel settings using the sysctl interface for WebDAV pods

2937

## @param webdav.podSecurityContext.supplementalGroups Set filesystem extra groups for WebDAV pods

2938

## @param webdav.podSecurityContext.fsGroup Set fsGroup in WebDAV pods' Security Context

2939

2940

podSecurityContext:

2941

enabled: true

2942

fsGroupChangePolicy: Always

2943

sysctls: []

2944

supplementalGroups: []

2945

fsGroup: 1001

2946

## Configure Container Security Context

2947

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

2948

## @param webdav.containerSecurityContext.enabled Enabled WebDAV container' Security Context

2949

## @param webdav.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in WebDAV container

2950

## @param webdav.containerSecurityContext.runAsUser Set runAsUser in WebDAV container' Security Context

2951

## @param webdav.containerSecurityContext.runAsGroup Set runAsGroup in WebDAV container' Security Context

2952

## @param webdav.containerSecurityContext.runAsNonRoot Set runAsNonRoot in WebDAV container' Security Context

2953

## @param webdav.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in WebDAV container' Security Context

2954

## @param webdav.containerSecurityContext.privileged Set privileged in WebDAV container' Security Context

2955

## @param webdav.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in WebDAV container' Security Context

2956

## @param webdav.containerSecurityContext.capabilities.drop List of capabilities to be dropped in WebDAV container

2957

## @param webdav.containerSecurityContext.seccompProfile.type Set seccomp profile in WebDAV container

2958

2959

containerSecurityContext:

2960

enabled: true

2961

seLinuxOptions: {}

2962

runAsUser: 1001

2963

runAsGroup: 1001

2964

runAsNonRoot: true

2965

readOnlyRootFilesystem: true

2966

privileged: false

2967

allowPrivilegeEscalation: false

2968

capabilities:

2969

drop: ["ALL"]

2970

seccompProfile:

2971

type: "RuntimeDefault"

2972

## @param webdav.logLevel WebDAV log level (0, 1, 2, 3, or 4)

2973

2974

logLevel: 1

2975

## TLS configuration for WebDAV

2976

2977

tls:

2978

## @param webdav.tls.enabled Enable TLS transport for WebDAV

2979

2980

enabled: false

2981

## @param webdav.tls.autoGenerated.enabled Enable automatic generation of certificates for TLS

2982

## @param webdav.tls.autoGenerated.engine Mechanism to generate the certificates (allowed values: helm, cert-manager)

2983

autoGenerated:

2984

enabled: false

2985

engine: helm

2986

## @param webdav.tls.autoGenerated.certManager.existingIssuer The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine)

2987

## @param webdav.tls.autoGenerated.certManager.existingIssuerKind Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine)

2988

## @param webdav.tls.autoGenerated.certManager.keyAlgorithm Key algorithm for the certificates (only for `cert-manager` engine)

2989

## @param webdav.tls.autoGenerated.certManager.keySize Key size for the certificates (only for `cert-manager` engine)

2990

## @param webdav.tls.autoGenerated.certManager.duration Duration for the certificates (only for `cert-manager` engine)

2991

## @param webdav.tls.autoGenerated.certManager.renewBefore Renewal period for the certificates (only for `cert-manager` engine)

2992

certManager:

2993

existingIssuer: ""

2994

existingIssuerKind: ""

2995

keySize: 2048

2996

keyAlgorithm: RSA

2997

duration: 2160h

2998

renewBefore: 360h

2999

## @param webdav.tls.existingSecret The name of an existing Secret containing the certificates for TLS

3000

## @param webdav.tls.cert Volume Server certificate for TLS. Ignored if `webdav.tls.existingSecret` is set

3001

## @param webdav.tls.key Volume Server key for TLS. Ignored if `webdav.tls.existingSecret` is set

3002

3003

existingSecret: ""

3004

cert: ""

3005

key: ""

3006

## @param webdav.command Override default WebDAV container command (useful when using custom images)

3007

3008

command: []

3009

## @param webdav.args Override default WebDAV container args (useful when using custom images)

3010

3011

args: []

3012

## @param webdav.automountServiceAccountToken Mount Service Account token in WebDAV pods

3013

3014

automountServiceAccountToken: false

3015

## @param webdav.hostAliases WebDAV pods host aliases

3016

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

3017

3018

hostAliases: []

3019

## @param webdav.statefulsetAnnotations Annotations for WebDAV statefulset

3020

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

3021

3022

statefulsetAnnotations: {}

3023

## @param webdav.podLabels Extra labels for WebDAV pods

3024

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

3025

3026

podLabels: {}

3027

## @param webdav.podAnnotations Annotations for WebDAV pods

3028

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

3029

3030

podAnnotations: {}

3031

## @param webdav.podAffinityPreset Pod affinity preset. Ignored if `webdav.affinity` is set. Allowed values: `soft` or `hard`

3032

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

3033

3034

podAffinityPreset: ""

3035

## @param webdav.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `webdav.affinity` is set. Allowed values: `soft` or `hard`

3036

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

3037

3038

podAntiAffinityPreset: soft

3039

## Node webdav.affinity preset

3040

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

3041

3042

nodeAffinityPreset:

3043

## @param webdav.nodeAffinityPreset.type Node affinity preset type. Ignored if `webdav.affinity` is set. Allowed values: `soft` or `hard`

3044

3045

type: ""

3046

## @param webdav.nodeAffinityPreset.key Node label key to match. Ignored if `webdav.affinity` is set

3047

3048

key: ""

3049

## @param webdav.nodeAffinityPreset.values Node label values to match. Ignored if `webdav.affinity` is set

3050

## E.g.

3051

## values:

3052

## - e2e-az1

3053

## - e2e-az2

3054

3055

values: []

3056

## @param webdav.affinity Affinity for WebDAV pods assignment

3057

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

3058

## NOTE: `webdav.podAffinityPreset`, `webdav.podAntiAffinityPreset`, and `webdav.nodeAffinityPreset` will be ignored when it's set

3059

3060

affinity: {}

3061

## @param webdav.nodeSelector Node labels for WebDAV pods assignment

3062

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

3063

3064

nodeSelector: {}

3065

## @param webdav.tolerations Tolerations for WebDAV pods assignment

3066

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

3067

3068

tolerations: []

3069

## @param webdav.updateStrategy.type WebDAV deployment strategy type

3070

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

3071

3072

updateStrategy:

3073

## Can be set to RollingUpdate or Recreate

3074

3075

type: RollingUpdate

3076

## @param webdav.priorityClassName WebDAV pods' priorityClassName

3077

3078

priorityClassName: ""

3079

## @param webdav.topologySpreadConstraints Topology Spread Constraints for WebDAV pod assignment spread across your cluster among failure-domains

3080

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

3081

3082

topologySpreadConstraints: []

3083

## @param webdav.schedulerName Name of the k8s scheduler (other than default) for WebDAV pods

3084

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

3085

3086

schedulerName: ""

3087

## @param webdav.terminationGracePeriodSeconds Seconds WebDAV pods need to terminate gracefully

3088

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

3089

3090

terminationGracePeriodSeconds: ""

3091

## @param webdav.lifecycleHooks for WebDAV containers to automate configuration before or after startup

3092

3093

lifecycleHooks: {}

3094

## @param webdav.extraEnvVars Array with extra environment variables to add to WebDAV containers

3095

## e.g:

3096

## extraEnvVars:

3097

## - name: FOO

3098

## value: "bar"

3099

3100

extraEnvVars: []

3101

## @param webdav.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for WebDAV containers

3102

3103

extraEnvVarsCM: ""

3104

## @param webdav.extraEnvVarsSecret Name of existing Secret containing extra env vars for WebDAV containers

3105

3106

extraEnvVarsSecret: ""

3107

## @param webdav.extraVolumes Optionally specify extra list of additional volumes for the WebDAV pods

3108

3109

extraVolumes: []

3110

## @param webdav.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the WebDAV containers

3111

3112

extraVolumeMounts: []

3113

## @param webdav.sidecars Add additional sidecar containers to the WebDAV pods

3114

## e.g:

3115

## sidecars:

3116

## - name: your-image-name

3117

## image: your-image

3118

## imagePullPolicy: Always

3119

## ports:

3120

## - name: portname

3121

## containerPort: 1234

3122

3123

sidecars: []

3124

## @param webdav.initContainers Add additional init containers to the WebDAV pods

3125

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

3126

## e.g:

3127

## initContainers:

3128

## - name: your-image-name

3129

## image: your-image

3130

## imagePullPolicy: Always

3131

## command: ['sh', '-c', 'echo "hello world"']

3132

3133

initContainers: []

3134

## Pod Disruption Budget configuration

3135

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

3136

## @param webdav.pdb.create Enable/disable a Pod Disruption Budget creation

3137

## @param webdav.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

3138

## @param webdav.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `webdav.pdb.minAvailable` and `webdav.pdb.maxUnavailable` are empty.

3139

3140

pdb:

3141

create: true

3142

minAvailable: ""

3143

maxUnavailable: ""

3144

## Autoscaling configuration

3145

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

3146

## @param webdav.autoscaling.enabled Enable autoscaling for webdav

3147

## @param webdav.autoscaling.minReplicas Minimum number of webdav replicas

3148

## @param webdav.autoscaling.maxReplicas Maximum number of webdav replicas

3149

## @param webdav.autoscaling.targetCPU Target CPU utilization percentage

3150

## @param webdav.autoscaling.targetMemory Target Memory utilization percentage

3151

3152

autoscaling:

3153

enabled: false

3154

minReplicas: ""

3155

maxReplicas: ""

3156

targetCPU: ""

3157

targetMemory: ""

3158

## @section WebDAV Traffic Exposure Parameters

3159

3160

3161

## WebDAV service parameters

3162

3163

service:

3164

## @param webdav.service.type WebDAV service type

3165

3166

type: ClusterIP

3167

## @param webdav.service.ports.http WebDAV service HTTP port (HTTPS if `webdav.tls.enabled` is `true`)

3168

3169

ports:

3170

http: 7333

3171

## Node ports to expose

3172

## @param webdav.service.nodePorts.http Node port for HTTP (HTTPS if `webdav.tls.enabled` is `true`)

3173

## NOTE: choose port between <30000-32767>

3174

3175

nodePorts:

3176

http: ""

3177

## @param webdav.service.clusterIP WebDAV service Cluster IP

3178

## e.g.:

3179

## clusterIP: None

3180

3181

clusterIP: ""

3182

## @param webdav.service.loadBalancerIP WebDAV service Load Balancer IP

3183

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

3184

3185

loadBalancerIP: ""

3186

## @param webdav.service.loadBalancerSourceRanges WebDAV service Load Balancer sources

3187

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

3188

## e.g:

3189

## loadBalancerSourceRanges:

3190

## - 10.10.10.0/24

3191

3192

loadBalancerSourceRanges: []

3193

## @param webdav.service.externalTrafficPolicy WebDAV service external traffic policy

3194

## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

3195

3196

externalTrafficPolicy: Cluster

3197

## @param webdav.service.annotations Additional custom annotations for WebDAV service

3198

3199

annotations: {}

3200

## @param webdav.service.extraPorts Extra ports to expose in WebDAV service (normally used with the `sidecars` value)

3201

3202

extraPorts: []

3203

## @param webdav.service.sessionAffinity Control where client requests go, to the same pod or round-robin

3204

## Values: ClientIP or None

3205

## ref: https://kubernetes.io/docs/concepts/services-networking/service/

3206

3207

sessionAffinity: None

3208

## @param webdav.service.sessionAffinityConfig Additional settings for the sessionAffinity

3209

## sessionAffinityConfig:

3210

## clientIP:

3211

## timeoutSeconds: 300

3212

3213

sessionAffinityConfig: {}

3214

## Headless service properties

3215

3216

headless:

3217

## @param webdav.service.headless.annotations Annotations for the headless service.

3218

3219

annotations: {}

3220

## Network Policies for WebDAV

3221

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

3222

3223

networkPolicy:

3224

## @param webdav.networkPolicy.enabled Specifies whether a NetworkPolicy should be created for WebDAV

3225

3226

enabled: true

3227

## @param webdav.networkPolicy.allowExternal Don't require server label for connections

3228

## The Policy model to apply. When set to false, only pods with the correct

3229

## server label will have network access to the ports server is listening

3230

## on. When true, server will accept connections from any source

3231

## (with the correct destination port).

3232

3233

allowExternal: true

3234

## @param webdav.networkPolicy.allowExternalEgress Allow the WebDAV pods to access any range of port and all destinations.

3235

3236

allowExternalEgress: true

3237

## @param webdav.networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

3238

## e.g:

3239

## extraIngress:

3240

## - ports:

3241

## - port: 1234

3242

## from:

3243

## - podSelector:

3244

## - matchLabels:

3245

## - role: frontend

3246

## - podSelector:

3247

## - matchExpressions:

3248

## - key: role

3249

## operator: In

3250

## values:

3251

## - frontend

3252

extraIngress: []

3253

## @param webdav.networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)

3254

## e.g:

3255

## extraEgress:

3256

## - ports:

3257

## - port: 1234

3258

## to:

3259

## - podSelector:

3260

## - matchLabels:

3261

## - role: frontend

3262

## - podSelector:

3263

## - matchExpressions:

3264

## - key: role

3265

## operator: In

3266

## values:

3267

## - frontend

3268

3269

extraEgress: []

3270

## @param webdav.networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

3271

## @param webdav.networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

3272

3273

ingressNSMatchLabels: {}

3274

ingressNSPodMatchLabels: {}

3275

## WebDAV ingress parameters

3276

## ref: http://kubernetes.io/docs/concepts/services-networking/ingress/

3277

3278

ingress:

3279

## @param webdav.ingress.enabled Enable ingress record generation for WebDAV

3280

3281

enabled: false

3282

## @param webdav.ingress.pathType Ingress path type

3283

3284

pathType: ImplementationSpecific

3285

## @param webdav.ingress.apiVersion Force Ingress API version (automatically detected if not set)

3286

3287

apiVersion: ""

3288

## @param webdav.ingress.hostname Default host for the ingress record

3289

3290

hostname: webdav.seaweedfs.local

3291

## @param webdav.ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)

3292

## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .

3293

## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/

3294

3295

ingressClassName: ""

3296

## @param webdav.ingress.path Default path for the ingress record

3297

## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers

3298

3299

path: /

3300

## @param webdav.ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

3301

## Use this parameter to set the required annotations for cert-manager, see

3302

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

3303

## e.g:

3304

## annotations:

3305

## kubernetes.io/ingress.class: nginx

3306

## cert-manager.io/cluster-issuer: cluster-issuer-name

3307

3308

annotations: {}

3309

## @param webdav.ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter

3310

## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`

3311

## You can:

3312

## - Use the `ingress.secrets` parameter to create this TLS secret

3313

## - Rely on cert-manager to create it by setting the corresponding annotations

3314

## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`

3315

3316

tls: false

3317

## @param webdav.ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm

3318

3319

selfSigned: false

3320

## @param webdav.ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record

3321

## e.g:

3322

## extraHosts:

3323

## - name: webdav.seaweedfs.local

3324

## path: /

3325

3326

extraHosts: []

3327

## @param webdav.ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host

3328

## e.g:

3329

## extraPaths:

3330

## - path: /*

3331

## backend:

3332

## serviceName: ssl-redirect

3333

## servicePort: use-annotation

3334

3335

extraPaths: []

3336

## @param webdav.ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record

3337

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

3338

## e.g:

3339

## extraTls:

3340

## - hosts:

3341

## - webdav.seaweedfs.local

3342

## secretName: webdav.seaweedfs.local-tls

3343

3344

extraTls: []

3345

## @param webdav.ingress.secrets Custom TLS certificates as secrets

3346

## NOTE: 'key' and 'certificate' are expected in PEM format

3347

## NOTE: 'name' should line up with a 'secretName' set further up

3348

## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates

3349

## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days

3350

## It is also possible to create and manage the certificates outside of this helm chart

3351

## Please see README.md for more information

3352

## e.g:

3353

## secrets:

3354

## - name: webdav.seaweedfs.local-tls

3355

## key: |-

3356

## -----BEGIN RSA PRIVATE KEY-----

3357

## ...

3358

## -----END RSA PRIVATE KEY-----

3359

## certificate: |-

3360

## -----BEGIN CERTIFICATE-----

3361

## ...

3362

## -----END CERTIFICATE-----

3363

3364

secrets: []

3365

## @param webdav.ingress.extraRules Additional rules to be covered with this ingress record

3366

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

3367

## e.g:

3368

## extraRules:

3369

## - host: example.local

3370

## http:

3371

## path: /

3372

## backend:

3373

## service:

3374

## name: example-svc

3375

## port:

3376

## name: http

3377

3378

extraRules: []

3379

## @section IAM Parameters

3380

3381

iam:

3382

## @param iam.enabled Enable IAM deployment (DEPRECATED in SeaweedFS 4.x - IAM is now embedded in filer/s3)

3383

3384

enabled: false

3385

## @param iam.replicaCount Number of IAM replicas to deploy

3386

3387

replicaCount: 1

3388

## @param iam.containerPorts.http IAM HTTP container port

3389

3390

containerPorts:

3391

http: 8111

3392

## Configure extra options for IAM containers' liveness and readiness probes

3393

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

3394

## @param iam.livenessProbe.enabled Enable livenessProbe on IAM containers

3395

## @param iam.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

3396

## @param iam.livenessProbe.periodSeconds Period seconds for livenessProbe

3397

## @param iam.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

3398

## @param iam.livenessProbe.failureThreshold Failure threshold for livenessProbe

3399

## @param iam.livenessProbe.successThreshold Success threshold for livenessProbe

3400

3401

livenessProbe:

3402

enabled: true

3403

initialDelaySeconds: 30

3404

timeoutSeconds: 30

3405

periodSeconds: 10

3406

successThreshold: 1

3407

failureThreshold: 6

3408

## @param iam.readinessProbe.enabled Enable readinessProbe on IAM containers

3409

## @param iam.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

3410

## @param iam.readinessProbe.periodSeconds Period seconds for readinessProbe

3411

## @param iam.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

3412

## @param iam.readinessProbe.failureThreshold Failure threshold for readinessProbe

3413

## @param iam.readinessProbe.successThreshold Success threshold for readinessProbe

3414

3415

readinessProbe:

3416

enabled: true

3417

initialDelaySeconds: 30

3418

timeoutSeconds: 30

3419

periodSeconds: 10

3420

successThreshold: 1

3421

failureThreshold: 6

3422

## @param iam.startupProbe.enabled Enable startupProbe on IAM containers

3423

## @param iam.startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

3424

## @param iam.startupProbe.periodSeconds Period seconds for startupProbe

3425

## @param iam.startupProbe.timeoutSeconds Timeout seconds for startupProbe

3426

## @param iam.startupProbe.failureThreshold Failure threshold for startupProbe

3427

## @param iam.startupProbe.successThreshold Success threshold for startupProbe

3428

3429

startupProbe:

3430

enabled: false

3431

initialDelaySeconds: 5

3432

periodSeconds: 5

3433

timeoutSeconds: 1

3434

failureThreshold: 15

3435

successThreshold: 1

3436

## IAM resource requests and limits

3437

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

3438

## @param iam.resourcesPreset Set IAM container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if webdav.resources is set (webdav.resources is recommended for production).

3439

3440

resourcesPreset: "nano"

3441

## @param iam.resources Set IAM container requests and limits for different resources like CPU or memory (essential for production workloads)

3442

## Example:

3443

## resources:

3444

## requests:

3445

## cpu: 2

3446

## memory: 512Mi

3447

## limits:

3448

## cpu: 3

3449

## memory: 1024Mi

3450

3451

resources: {}

3452

## Configure Pods Security Context

3453

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

3454

## @param iam.podSecurityContext.enabled Enable IAM pods' Security Context

3455

## @param iam.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy for IAM pods

3456

## @param iam.podSecurityContext.sysctls Set kernel settings using the sysctl interface for IAM pods

3457

## @param iam.podSecurityContext.supplementalGroups Set filesystem extra groups for IAM pods

3458

## @param iam.podSecurityContext.fsGroup Set fsGroup in IAM pods' Security Context

3459

3460

podSecurityContext:

3461

enabled: true

3462

fsGroupChangePolicy: Always

3463

sysctls: []

3464

supplementalGroups: []

3465

fsGroup: 1001

3466

## Configure Container Security Context

3467

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

3468

## @param iam.containerSecurityContext.enabled Enabled IAM container' Security Context

3469

## @param iam.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in IAM container

3470

## @param iam.containerSecurityContext.runAsUser Set runAsUser in IAM container' Security Context

3471

## @param iam.containerSecurityContext.runAsGroup Set runAsGroup in IAM container' Security Context

3472

## @param iam.containerSecurityContext.runAsNonRoot Set runAsNonRoot in IAM container' Security Context

3473

## @param iam.containerSecurityContext.readOnlyRootFilesystem Set readOnlyRootFilesystem in IAM container' Security Context

3474

## @param iam.containerSecurityContext.privileged Set privileged in IAM container' Security Context

3475

## @param iam.containerSecurityContext.allowPrivilegeEscalation Set allowPrivilegeEscalation in IAM container' Security Context

3476

## @param iam.containerSecurityContext.capabilities.drop List of capabilities to be dropped in IAM container

3477

## @param iam.containerSecurityContext.seccompProfile.type Set seccomp profile in IAM container

3478

3479

containerSecurityContext:

3480

enabled: true

3481

seLinuxOptions: {}

3482

runAsUser: 1001

3483

runAsGroup: 1001

3484

runAsNonRoot: true

3485

readOnlyRootFilesystem: true

3486

privileged: false

3487

allowPrivilegeEscalation: false

3488

capabilities:

3489

drop: ["ALL"]

3490

seccompProfile:

3491

type: "RuntimeDefault"

3492

## @param iam.logLevel IAM log level (0, 1, 2, 3, or 4)

3493

3494

logLevel: 1

3495

## @param iam.command Override default IAM container command (useful when using custom images)

3496

3497

command: []

3498

## @param iam.args Override default IAM container args (useful when using custom images)

3499

3500

args: []

3501

## @param iam.automountServiceAccountToken Mount Service Account token in IAM pods

3502

3503

automountServiceAccountToken: false

3504

## @param iam.hostAliases IAM pods host aliases

3505

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

3506

3507

hostAliases: []

3508

## @param iam.statefulsetAnnotations Annotations for IAM statefulset

3509

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

3510

3511

statefulsetAnnotations: {}

3512

## @param iam.podLabels Extra labels for IAM pods

3513

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

3514

3515

podLabels: {}

3516

## @param iam.podAnnotations Annotations for IAM pods

3517

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

3518

3519

podAnnotations: {}

3520

## @param iam.podAffinityPreset Pod affinity preset. Ignored if `iam.affinity` is set. Allowed values: `soft` or `hard`

3521

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

3522

3523

podAffinityPreset: ""

3524

## @param iam.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `iam.affinity` is set. Allowed values: `soft` or `hard`

3525

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

3526

3527

podAntiAffinityPreset: soft

3528

## Node iam.affinity preset

3529

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

3530

3531

nodeAffinityPreset:

3532

## @param iam.nodeAffinityPreset.type Node affinity preset type. Ignored if `iam.affinity` is set. Allowed values: `soft` or `hard`

3533

3534

type: ""

3535

## @param iam.nodeAffinityPreset.key Node label key to match. Ignored if `iam.affinity` is set

3536

3537

key: ""

3538

## @param iam.nodeAffinityPreset.values Node label values to match. Ignored if `iam.affinity` is set

3539

## E.g.

3540

## values:

3541

## - e2e-az1

3542

## - e2e-az2

3543

3544

values: []

3545

## @param iam.affinity Affinity for IAM pods assignment

3546

## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

3547

## NOTE: `iam.podAffinityPreset`, `iam.podAntiAffinityPreset`, and `iam.nodeAffinityPreset` will be ignored when it's set

3548

3549

affinity: {}

3550

## @param iam.nodeSelector Node labels for IAM pods assignment

3551

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

3552

3553

nodeSelector: {}

3554

## @param iam.tolerations Tolerations for IAM pods assignment

3555

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

3556

3557

tolerations: []

3558

## @param iam.updateStrategy.type IAM deployment strategy type

3559

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

3560

3561

updateStrategy:

3562

## Can be set to RollingUpdate or Recreate

3563

3564

type: RollingUpdate

3565

## @param iam.priorityClassName IAM pods' priorityClassName

3566

3567

priorityClassName: ""

3568

## @param iam.topologySpreadConstraints Topology Spread Constraints for IAM pod assignment spread across your cluster among failure-domains

3569

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

3570

3571

topologySpreadConstraints: []

3572

## @param iam.schedulerName Name of the k8s scheduler (other than default) for IAM pods

3573

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

3574

3575

schedulerName: ""

3576

## @param iam.terminationGracePeriodSeconds Seconds IAM pods need to terminate gracefully

3577

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

3578

3579

terminationGracePeriodSeconds: ""

3580

## @param iam.lifecycleHooks for IAM containers to automate configuration before or after startup

3581

3582

lifecycleHooks: {}

3583

## @param iam.extraEnvVars Array with extra environment variables to add to IAM containers

3584

## e.g:

3585

## extraEnvVars:

3586

## - name: FOO

3587

## value: "bar"

3588

3589

extraEnvVars: []

3590

## @param iam.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for IAM containers

3591

3592

extraEnvVarsCM: ""

3593

## @param iam.extraEnvVarsSecret Name of existing Secret containing extra env vars for IAM containers

3594

3595

extraEnvVarsSecret: ""

3596

## @param iam.extraVolumes Optionally specify extra list of additional volumes for the IAM pods

3597

3598

extraVolumes: []

3599

## @param iam.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the IAM containers

3600

3601

extraVolumeMounts: []

3602

## @param iam.sidecars Add additional sidecar containers to the IAM pods

3603

## e.g:

3604

## sidecars:

3605

## - name: your-image-name

3606

## image: your-image

3607

## imagePullPolicy: Always

3608

## ports:

3609

## - name: portname

3610

## containerPort: 1234

3611

3612

sidecars: []

3613

## @param iam.initContainers Add additional init containers to the IAM pods

3614

## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/

3615

## e.g:

3616

## initContainers:

3617

## - name: your-image-name

3618

## image: your-image

3619

## imagePullPolicy: Always

3620

## command: ['sh', '-c', 'echo "hello world"']

3621

3622

initContainers: []

3623

## Pod Disruption Budget configuration

3624

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb

3625

## @param iam.pdb.create Enable/disable a Pod Disruption Budget creation

3626

## @param iam.pdb.minAvailable Minimum number/percentage of pods that should remain scheduled

3627

## @param iam.pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `iam.pdb.minAvailable` and `iam.pdb.maxUnavailable` are empty.

3628

3629

pdb:

3630

create: true

3631

minAvailable: ""

3632

maxUnavailable: ""

3633

## @section IAM Traffic Exposure Parameters

3634

3635

3636

## IAM service parameters

3637

3638

service:

3639

## @param iam.service.type IAM service type

3640

3641

type: ClusterIP

3642

## @param iam.service.ports.http IAM service HTTP port (HTTPS if `iam.tls.enabled` is `true`)

3643

3644

ports:

3645

http: 8111

3646

## Node ports to expose

3647

## @param iam.service.nodePorts.http Node port for HTTP (HTTPS if `iam.tls.enabled` is `true`)

3648

## NOTE: choose port between <30000-32767>

3649

3650

nodePorts:

3651

http: ""

3652

## @param iam.service.clusterIP IAM service Cluster IP

3653

## e.g.:

3654

## clusterIP: None

3655

3656

clusterIP: ""

3657

## @param iam.service.loadBalancerIP IAM service Load Balancer IP

3658

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer

3659

3660

loadBalancerIP: ""

3661

## @param iam.service.loadBalancerSourceRanges IAM service Load Balancer sources

3662

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

3663

## e.g:

3664

## loadBalancerSourceRanges:

3665

## - 10.10.10.0/24

3666

3667

loadBalancerSourceRanges: []

3668

## @param iam.service.externalTrafficPolicy IAM service external traffic policy

3669

## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

3670

3671

externalTrafficPolicy: Cluster

3672

## @param iam.service.annotations Additional custom annotations for IAM service

3673

3674

annotations: {}

3675

## @param iam.service.extraPorts Extra ports to expose in IAM service (normally used with the `sidecars` value)

3676

3677

extraPorts: []

3678

## @param iam.service.sessionAffinity Control where client requests go, to the same pod or round-robin

3679

## Values: ClientIP or None

3680

## ref: https://kubernetes.io/docs/concepts/services-networking/service/

3681

3682

sessionAffinity: None

3683

## @param iam.service.sessionAffinityConfig Additional settings for the sessionAffinity

3684

## sessionAffinityConfig:

3685

## clientIP:

3686

## timeoutSeconds: 300

3687

3688

sessionAffinityConfig: {}

3689

## Headless service properties

3690

3691

## Network Policies for IAM

3692

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

3693

3694

## @section Init Container Parameters

3695

3696

3697

## 'volumePermissions' init container parameters

3698

## Changes the owner and group of the persistent volume mount point to runAsUser:fsGroup values

3699

## based on the *podSecurityContext/*containerSecurityContext parameters

3700

3701

volumePermissions:

3702

## @param volumePermissions.enabled Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup`

3703

3704

enabled: false

3705

## OS Shell + Utility image

3706

## @param volumePermissions.image.registry [default: REGISTRY_NAME] OS Shell + Utility image registry

3707

## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] OS Shell + Utility image repository

3708

## @skip volumePermissions.image.tag OS Shell + Utility image tag (immutable tags are recommended)

3709

## @param volumePermissions.image.pullPolicy OS Shell + Utility image pull policy

3710

## @param volumePermissions.image.pullSecrets OS Shell + Utility image pull secrets

3711

3712

image:

3713

registry: cgr.dev

3714

repository: chainguard-private/os-shell-iamguarded

3715

tag: 1.0.0

3716

pullPolicy: IfNotPresent

3717

## Optionally specify an array of imagePullSecrets.

3718

## Secrets must be manually created in the namespace.

3719

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

3720

## e.g:

3721

## pullSecrets:

3722

## - myRegistryKeySecretName

3723

3724

pullSecrets: []

3725

## Init container's resource requests and limits

3726

## ref: http://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

3727

## @param volumePermissions.resourcesPreset Set init container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production).

3728

3729

resourcesPreset: "nano"

3730

## @param volumePermissions.resources Set init container requests and limits for different resources like CPU or memory (essential for production workloads)

3731

## Example:

3732

## resources:

3733

## requests:

3734

## cpu: 2

3735

## memory: 512Mi

3736

## limits:

3737

## cpu: 3

3738

## memory: 1024Mi

3739

3740

resources: {}

3741

## Init container Container Security Context

3742

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

3743

## @param volumePermissions.containerSecurityContext.enabled Enabled init container' Security Context

3744

## @param volumePermissions.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in init container

3745

## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser

3746

## NOTE: when runAsUser is set to special value "auto", init container will try to chown the

3747

## data folder to auto-determined user&group, using commands: `id -u`:`id -G | cut -d" " -f2`

3748

## "auto" is especially useful for OpenShift which has scc with dynamic user ids (and 0 is not allowed)

3749

3750

containerSecurityContext:

3751

enabled: true

3752

seLinuxOptions: {}

3753

runAsUser: 0

3754

## @section Other Parameters

3755

3756

3757

## ServiceAccount configuration

3758

3759

serviceAccount:

3760

## @param serviceAccount.create Specifies whether a ServiceAccount should be created

3761

3762

create: true

3763

## @param serviceAccount.name The name of the ServiceAccount to use.

3764

## If not set and create is true, a name is generated using the common.names.fullname template

3765

3766

name: ""

3767

## @param serviceAccount.annotations Additional Service Account annotations (evaluated as a template)

3768

3769

annotations: {}

3770

## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account

3771

3772

automountServiceAccountToken: false

3773

## @section Database Parameters

3774

3775

3776

## MariaDB chart configuration

3777

3778

mariadb:

3779

## @param mariadb.enabled Deploy a MariaDB server to satisfy the Filer server database requirements

3780

## To use an external database set this to false and configure the `externalDatabase.*` parameters

3781

3782

enabled: true

3783

## Iamguarded MariaDB image

3784

## @param mariadb.image.registry [default: REGISTRY_NAME] MariaDB image registry

3785

## @param mariadb.image.repository [default: REPOSITORY_NAME/mariadb] MariaDB image repository

3786

## @skip mariadb.image.tag MariaDB image tag (immutable tags are recommended)

3787

## @param mariadb.image.digest MariaDB image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

3788

## @param mariadb.image.pullPolicy MariaDB image pull policy

3789

## @param mariadb.image.pullSecrets Specify docker-registry secret names as an array

3790

3791

image:

3792

registry: cgr.dev

3793

repository: chainguard-private/mariadb-iamguarded

3794

tag: 12.0.2-debian-12-r0

3795

digest: ""

3796

## Specify a imagePullPolicy

3797

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

3798

3799

pullPolicy: IfNotPresent

3800

## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)

3801

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

3802

## Example:

3803

## pullSecrets:

3804

## - myRegistryKeySecretName

3805

3806

pullSecrets: []

3807

## @param mariadb.architecture MariaDB architecture. Allowed values: `standalone` or `replication`

3808

3809

architecture: standalone

3810

## MariaDB Authentication parameters

3811

## @param mariadb.auth.rootPassword MariaDB root password

3812

## @param mariadb.auth.database MariaDB custom database

3813

## @param mariadb.auth.username MariaDB custom user name

3814

## @param mariadb.auth.password MariaDB custom user password

3815

3816

auth:

3817

rootPassword: ""

3818

database: iamguarded_seaweedfs

3819

username: bn_seaweedfs

3820

password: ""

3821

## @param mariadb.initdbScripts [object] Specify dictionary of scripts to be run at first boot

3822

3823

initdbScripts:

3824

create_table.sql: |

3825

USE iamguarded_seaweedfs;

3826

CREATE TABLE IF NOT EXISTS filemeta (

3827

`dirhash` BIGINT NOT NULL COMMENT 'first 64 bits of MD5 hash value of directory field',

3828

`name` VARCHAR(766) NOT NULL COMMENT 'directory or file name',

3829

`directory` TEXT NOT NULL COMMENT 'full path to parent directory',

3830

`meta` LONGBLOB,

3831

PRIMARY KEY (`dirhash`, `name`)

3832

) DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin;

3833

## MariaDB Primary configuration

3834

3835

primary:

3836

## MariaDB Primary Persistence parameters

3837

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

3838

## @param mariadb.primary.persistence.enabled Enable persistence on MariaDB using PVC(s)

3839

## @param mariadb.primary.persistence.storageClass Persistent Volume storage class

3840

## @param mariadb.primary.persistence.accessModes [array] Persistent Volume access modes

3841

## @param mariadb.primary.persistence.size Persistent Volume size

3842

3843

persistence:

3844

enabled: true

3845

storageClass: ""

3846

accessModes:

3847

- ReadWriteOnce

3848

size: 8Gi

3849

## MariaDB primary container's resource requests and limits

3850

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

3851

## We usually recommend not to specify default resources and to leave this as a conscious

3852

## choice for the user. This also increases chances charts run on environments with little

3853

## resources, such as Minikube. If you do want to specify resources, uncomment the following

3854

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

3855

## @param mariadb.primary.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, small, medium, large, xlarge, 2xlarge). This is ignored if primary.resources is set (primary.resources is recommended for production).

3856

3857

resourcesPreset: "micro"

3858

## @param mariadb.primary.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

3859

## Example:

3860

## resources:

3861

## requests:

3862

## cpu: 2

3863

## memory: 512Mi

3864

## limits:

3865

## cpu: 3

3866

## memory: 1024Mi

3867

3868

resources: {}

3869

## PostgresSQL chart configuration

3870

3871

postgresql:

3872

## @param postgresql.enabled Deploy a PostgresSQL server to satisfy the Filer server database requirements

3873

## To use an external database set this to false and configure the `externalDatabase.*` parameters

3874

3875

enabled: false

3876

## Iamguarded PostgreSQL image version

3877

## @param postgresql.image.registry [default: REGISTRY_NAME] PostgreSQL image registry

3878

## @param postgresql.image.repository [default: REPOSITORY_NAME/postgresql] PostgreSQL image repository

3879

## @skip postgresql.image.tag PostgreSQL image tag (immutable tags are recommended)

3880

## @param postgresql.image.digest PostgreSQL image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

3881

## @param postgresql.image.pullPolicy PostgreSQL image pull policy

3882

## @param postgresql.image.pullSecrets Specify image pull secrets

3883

3884

image:

3885

registry: cgr.dev

3886

repository: chainguard-private/postgres-iamguarded

3887

tag: 18.6-r2

3888

digest: ""

3889

## Specify a imagePullPolicy

3890

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

3891

3892

pullPolicy: IfNotPresent

3893

## Optionally specify an array of imagePullSecrets.

3894

## Secrets must be manually created in the namespace.

3895

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

3896

## Example:

3897

## pullSecrets:

3898

## - myRegistryKeySecretName

3899

3900

pullSecrets: []

3901

## @param postgresql.architecture PostgreSQL architecture (`standalone` or `replication`)

3902

3903

architecture: standalone

3904

## @param postgresql.auth.postgresPassword Password for the "postgres" admin user. Ignored if `auth.existingSecret` with key `postgres-password` is provided

3905

## @param postgresql.auth.database Name for a custom database to create

3906

## @param postgresql.auth.username Name for a custom user to create

3907

## @param postgresql.auth.password Password for the custom user to create

3908

## @param postgresql.auth.existingSecret Name of existing secret to use for PostgreSQL credentials

3909

## @param postgresql.auth.secretKeys.userPasswordKey Name of key in existing secret to use for PostgreSQL credentials. Only used when `auth.existingSecret` is set.

3910

auth:

3911

postgresPassword: ""

3912

database: iamguarded_seaweedfs

3913

username: bn_seaweedfs

3914

password: some-password

3915

existingSecret: ""

3916

secretKeys:

3917

userPasswordKey: password

3918

## PostgreSQL Primary configuration

3919

3920

primary:

3921

## PostgreSQL Primary resource requests and limits

3922

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

3923

## @param postgresql.primary.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if postgresql.primary.resources is set (postgresql.primary.resources is recommended for production).

3924

3925

resourcesPreset: "nano"

3926

## @param postgresql.primary.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

3927

## Example:

3928

## resources:

3929

## requests:

3930

## cpu: 2

3931

## memory: 512Mi

3932

## limits:

3933

## cpu: 3

3934

## memory: 1024Mi

3935

3936

resources: {}

3937

## @param postgresql.primary.initdb.scripts [object] Dictionary of initdb scripts

3938

3939

initdb:

3940

scripts:

3941

create_table.sql: |

3942

\c iamguarded_seaweedfs;

3943

CREATE TABLE IF NOT EXISTS filemeta (

3944

dirhash BIGINT,

3945

name VARCHAR(65535),

3946

directory VARCHAR(65535),

3947

meta bytea,

3948

PRIMARY KEY (dirhash, name)

3949

);

3950

## PostgreSQL Primary Persistence parameters

3951

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

3952

## @param postgresql.primary.persistence.enabled Enable PostgreSQL Primary data persistence using PVC(s)

3953

## @param postgresql.primary.persistence.storageClass Persistent Volume storage class

3954

## @param postgresql.primary.persistence.accessModes [array] Persistent Volume access modes

3955

## @param postgresql.primary.persistence.size Persistent Volume size

3956

3957

persistence:

3958

enabled: true

3959

storageClass: ""

3960

accessModes:

3961

- ReadWriteOnce

3962

size: 8Gi

3963

## External Database Configuration

3964

## All of these values are only used if `mariadb.enabled=false` and `externalDatabase.enabled=true`.

3965

3966

externalDatabase:

3967

## @param externalDatabase.enabled Enable external database support

3968

3969

enabled: false

3970

## @param externalDatabase.store Database store (mariadb, postgresql)

3971

3972

store: mariadb

3973

## @param externalDatabase.host External Database server host

3974

3975

host: localhost

3976

## @param externalDatabase.port External Database server port

3977

3978

port: 3306

3979

## @param externalDatabase.user External Database username

3980

3981

user: bn_seaweedfs

3982

## @param externalDatabase.password External Database user password

3983

3984

password: ""

3985

## @param externalDatabase.database External Database database name

3986

3987

database: iamguarded_seaweedfs

3988

## @param externalDatabase.existingSecret The name of an existing secret with database credentials. Evaluated as a template

3989

## NOTE: Must contain key `mariadb-password` for mariadb or 'postgres-password' for postgres

3990

## NOTE: When it's set, the `externalDatabase.password` parameter is ignored

3991

3992

existingSecret: ""

3993

## @param externalDatabase.waitForDatabaseEnabled Whether to check for external database before starting seaweedfs containers

3994

3995

waitForDatabaseEnabled: true

3996

3997

## Init external database job

3998

3999

initDatabaseJob:

4000

## @param externalDatabase.initDatabaseJob.enabled Enable the init external database job

4001

4002

enabled: false

4003

## @param externalDatabase.initDatabaseJob.labels Extra labels for the init external database job

4004

4005

labels: {}

4006

## @param externalDatabase.initDatabaseJob.annotations [object] Extra annotations for the init external database job

4007

4008

annotations:

4009

helm.sh/hook: post-install

4010

helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded

4011

## @param externalDatabase.initDatabaseJob.backoffLimit Set backoff limit of the init external database job

4012

4013

backoffLimit: 10

4014

## Configure Container Security Context

4015

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

4016

## @param externalDatabase.initDatabaseJob.containerSecurityContext.enabled Enabled init external database job containers' Security Context

4017

## @param externalDatabase.initDatabaseJob.containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

4018

## @param externalDatabase.initDatabaseJob.containerSecurityContext.runAsUser Set init external database job containers' Security Context runAsUser

4019

## @param externalDatabase.initDatabaseJob.containerSecurityContext.runAsGroup Set init external database job containers' Security Context runAsGroup

4020

## @param externalDatabase.initDatabaseJob.containerSecurityContext.runAsNonRoot Set init external database job containers' Security Context runAsNonRoot

4021

## @param externalDatabase.initDatabaseJob.containerSecurityContext.privileged Set init external database job containers' Security Context privileged

4022

## @param externalDatabase.initDatabaseJob.containerSecurityContext.readOnlyRootFilesystem Set init external database job containers' Security Context readOnlyRootFilesystem

4023

## @param externalDatabase.initDatabaseJob.containerSecurityContext.allowPrivilegeEscalation Set init external database job containers' Security Context allowPrivilegeEscalation

4024

## @param externalDatabase.initDatabaseJob.containerSecurityContext.capabilities.drop List of capabilities to be dropped

4025

## @param externalDatabase.initDatabaseJob.containerSecurityContext.seccompProfile.type Set init external database job containers' Security Context seccomp profile

4026

4027

containerSecurityContext:

4028

enabled: true

4029

seLinuxOptions: {}

4030

runAsUser: 1001

4031

runAsGroup: 1001

4032

runAsNonRoot: true

4033

privileged: false

4034

readOnlyRootFilesystem: true

4035

allowPrivilegeEscalation: false

4036

capabilities:

4037

drop: ["ALL"]

4038

seccompProfile:

4039

type: "RuntimeDefault"

4040

## Configure Pods Security Context

4041

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

4042

## @param externalDatabase.initDatabaseJob.podSecurityContext.enabled Enabled init external database job pods' Security Context

4043

## @param externalDatabase.initDatabaseJob.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

4044

## @param externalDatabase.initDatabaseJob.podSecurityContext.sysctls Set kernel settings using the sysctl interface

4045

## @param externalDatabase.initDatabaseJob.podSecurityContext.supplementalGroups Set filesystem extra groups

4046

## @param externalDatabase.initDatabaseJob.podSecurityContext.fsGroup Set init external database job pod's Security Context fsGroup

4047

4048

podSecurityContext:

4049

enabled: true

4050

fsGroupChangePolicy: Always

4051

sysctls: []

4052

supplementalGroups: []

4053

fsGroup: 1001

4054

## Container resource requests and limits

4055

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

4056

## @param externalDatabase.initDatabaseJob.resourcesPreset Set init external database job container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if externalDatabase.initDatabaseJob.resources is set (externalDatabase.initDatabaseJob.resources is recommended for production).

4057

4058

resourcesPreset: "micro"

4059

## @param externalDatabase.initDatabaseJob.resources Set init external database job container requests and limits for different resources like CPU or memory (essential for production workloads)

4060

## Example:

4061

## resources:

4062

## requests:

4063

## cpu: 2

4064

## memory: 512Mi

4065

## limits:

4066

## cpu: 3

4067

## memory: 1024Mi

4068

4069

resources: {}

4070

## @param externalDatabase.initDatabaseJob.automountServiceAccountToken Mount Service Account token in external database job pod

4071

4072

automountServiceAccountToken: false

4073

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

seaweedfs

The trusted source for open source

Product

Solutions

Customers

Resources

Company