argo-cd

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

## Argo CD configuration

## Ref: https://github.com/argoproj/argo-cd

# -- Provide a name in place of `argocd`

nameOverride: argocd

# -- String to fully override `"argo-cd.fullname"`

fullnameOverride: ""

# -- Override the namespace

# @default -- `.Release.Namespace`

namespaceOverride: ""

# -- Override the Kubernetes version, which is used to evaluate certain manifests

kubeVersionOverride: ""

# Override APIVersions

# If you want to template helm charts but cannot access k8s API server

# you can set api versions here

apiVersionOverrides: {}

# -- Create aggregated roles that extend existing cluster roles to interact with argo-cd resources

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

createAggregateRoles: false

# -- Create cluster roles for cluster-wide installation.

## Used when you manage applications in the same cluster where Argo CD runs

createClusterRoles: true

openshift:

# -- enables using arbitrary uid for argo repo server

enabled: false

## Custom resource configuration

crds:

# -- Install and upgrade CRDs

install: true

# -- Keep CRDs on chart uninstall

keep: true

# -- Annotations to be added to all CRDs

annotations:

argocd.argoproj.io/sync-options: ServerSideApply=true

# -- Additional labels to be added to all CRDs

additionalLabels: {}

## Globally shared configuration

global:

# -- Default domain used by all components

## Used for ingresses, certificates, SSO, notifications, etc.

domain: argocd.example.com

# -- Runtime class name for all components

runtimeClassName: ""

# -- Common labels for the all resources

additionalLabels: {}

# app: argo-cd

# -- Number of old deployment ReplicaSets to retain. The rest will be garbage collected.

revisionHistoryLimit: 3

# Default image used by all components

image:

# -- If defined, a repository applied to all Argo CD deployments

repository: cgr.dev/chainguard-private/argocd

# -- Overrides the global Argo CD image tag whose default is the chart appVersion

tag: 3.5.2@sha256:c0b08bd76ed839e91929e7af5afe690fd5670128520a12494a43e439e7f2fdc1

# -- If defined, a imagePullPolicy applied to all Argo CD deployments

imagePullPolicy: IfNotPresent

# -- Secrets with credentials to pull images from a private registry

imagePullSecrets: []

# Default logging options used by all components

logging:

# -- Set the global logging format. Either: `text` or `json`

format: text

# -- Set the global logging level. One of: `debug`, `info`, `warn` or `error`

level: info

# -- Annotations for the all deployed Statefulsets

statefulsetAnnotations: {}

# -- Labels for the all deployed Statefulsets

statefulsetLabels: {}

# -- Annotations for the all deployed Deployments

deploymentAnnotations: {}

# -- Labels for the all deployed Deployments

deploymentLabels: {}

# -- Annotations for the all deployed pods

podAnnotations: {}

# -- Labels for the all deployed pods

podLabels: {}

# -- Add Prometheus scrape annotations to all metrics services. This can be used as an alternative to the ServiceMonitors.

addPrometheusAnnotations: false

# -- Toggle and define pod-level security context.

# @default -- `{}` (See [values.yaml])

securityContext: {}

# runAsUser: 999

# runAsGroup: 999

# fsGroup: 999

# -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files

hostAliases: []

# - ip: 10.20.30.40

# hostnames:

# - git.myhostname

# Configure dual-stack used by all component services

dualStack:

# -- IP family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)

ipFamilyPolicy: ""

# -- IP families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.

ipFamilies: []

100

# Default network policy rules used by all components

101

networkPolicy:

102

# -- Create NetworkPolicy objects for all components

103

create: true

104

# -- Default deny all ingress traffic

105

defaultDenyIngress: false

106

# -- Default priority class for all components

107

priorityClassName: ""

108

# -- Default node selector for all components

109

nodeSelector:

110

kubernetes.io/os: linux

111

# -- Default tolerations for all components

112

tolerations: []

113

# Default affinity preset for all components

114

affinity:

115

# -- Default pod anti-affinity rules. Either: `none`, `soft` or `hard`

116

podAntiAffinity: soft

117

# Node affinity rules

118

nodeAffinity:

119

# -- Default node affinity rules. Either: `none`, `soft` or `hard`

120

type: hard

121

# -- Default match expressions for node affinity

122

matchExpressions: []

123

# - key: topology.kubernetes.io/zone

124

# operator: In

125

# values:

126

# - antarctica-east1

127

# - antarctica-west1

128

# -- Default [TopologySpreadConstraints] rules for all components

129

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

130

## If labelSelector is left out, it will default to the labelSelector of the component

131

topologySpreadConstraints: []

132

# - maxSkew: 1

133

# topologyKey: topology.kubernetes.io/zone

134

# whenUnsatisfiable: DoNotSchedule

135

136

# -- Deployment strategy for the all deployed Deployments

137

deploymentStrategy: {}

138

# type: RollingUpdate

139

# rollingUpdate:

140

# maxSurge: 25%

141

# maxUnavailable: 25%

142

143

# -- Environment variables to pass to all deployed Deployments

144

env: []

145

# -- Extra volumes to add to all deployed Deployments and StatefulSets

146

extraVolumes: []

147

# Example of adding a custom CA bundle from a ConfigMap:

148

# - name: my-root-ca

149

# configMap:

150

# name: my-trustbundle

151

# items:

152

# - key: bundle.pem

153

# path: ca-certificates.crt

154

155

# -- Extra volume mounts to add to all deployed Deployments and StatefulSets

156

extraVolumeMounts: []

157

# Example of adding a custom CA bundle mount:

158

# - name: my-root-ca

159

# mountPath: /etc/ssl/certs

160

161

# -- Annotations for the all deployed Certificates

162

certificateAnnotations: {}

163

## Argo Configs

164

configs:

165

# General Argo CD configuration. Any values you put under `.configs.cm` are passed to argocd-cm ConfigMap.

166

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cm.yaml

167

cm:

168

# -- Create the argocd-cm configmap for [declarative setup]

169

create: true

170

# -- Annotations to be added to argocd-cm configmap

171

annotations: {}

172

# -- The name of tracking label used by Argo CD for resource pruning

173

application.instanceLabelKey: argocd.argoproj.io/instance

174

# -- Enable control of the service account used for the sync operation (alpha)

175

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/app-sync-using-impersonation/

176

application.sync.impersonation.enabled: false

177

# -- Enable exec feature in Argo UI

178

## Ref: https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac/#exec-resource

179

exec.enabled: false

180

# -- Enable local admin user

181

## Ref: https://argo-cd.readthedocs.io/en/latest/faq/#how-to-disable-admin-user

182

admin.enabled: true

183

# -- Timeout to discover if a new manifests version got published to the repository

184

timeout.reconciliation: 120s

185

# -- Maximum jitter added to the reconciliation timeout to spread out refreshes and reduce repo-server load

186

timeout.reconciliation.jitter: 60s

187

# -- Timeout to refresh application data as well as target manifests cache

188

timeout.hard.reconciliation: 0s

189

# -- Enable Status Badge

190

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/status-badge/

191

statusbadge.enabled: false

192

# Dex configuration

193

# dex.config: |

194

# connectors:

195

# # GitHub example

196

# - type: github

197

# id: github

198

# name: GitHub

199

# config:

200

# clientID: aabbccddeeff00112233

201

# clientSecret: $dex.github.clientSecret # Alternatively $<some_K8S_secret>:dex.github.clientSecret

202

# orgs:

203

# - name: your-github-org

204

205

# OIDC configuration as an alternative to dex (optional).

206

# oidc.config: |

207

# name: AzureAD

208

# issuer: https://login.microsoftonline.com/TENANT_ID/v2.0

209

# clientID: aaaabbbbccccddddeee

210

# clientSecret: $oidc.azuread.clientSecret

211

# # Optional: set to true to use Azure Workload Identity instead of clientSecret

212

# azure:

213

# useWorkloadIdentity: false

214

215

# Some OIDC providers require a separate clientID for different callback URLs.

216

# For example, if configuring Argo CD with self-hosted Dex, you will need a separate client ID

217

# for the 'localhost' (CLI) client to Dex. This field is optional. If omitted, the CLI will

218

# use the same clientID as the Argo CD server

219

# cliClientID: vvvvwwwwxxxxyyyyzzzz

220

221

# rootCA: |

222

# -----BEGIN CERTIFICATE-----

223

# ... encoded certificate data here ...

224

# -----END CERTIFICATE-----

225

226

# Optional list of allowed aud claims. If omitted or empty, defaults to the clientID value above (and the

227

# cliClientID, if that is also specified). If you specify a list and want the clientID to be allowed, you must

228

# explicitly include it in the list.

229

# Token verification will pass if any of the token's audiences matches any of the audiences in this list.

230

# allowedAudiences:

231

# - aaaabbbbccccddddeee

232

# - qqqqwwwweeeerrrrttt

233

234

# Optional set of OIDC claims to request on the ID token.

235

# requestedIDTokenClaims:

236

# groups:

237

# essential: true

238

239

# Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"]

240

# requestedScopes:

241

# - openid

242

# - profile

243

# - email

244

245

# PKCE authentication flow processes authorization flow from browser only - default false

246

# uses the clientID

247

# make sure the Identity Provider (IdP) is public and doesn't need clientSecret

248

# make sure the Identity Provider (IdP) has this redirect URI registered: https://argocd.example.com/pkce/verify

249

# enablePKCEAuthentication: true

250

251

# Extension Configuration

252

## Ref: https://argo-cd.readthedocs.io/en/latest/developer-guide/extensions/proxy-extensions/

253

# extension.config: |

254

# extensions:

255

# - name: httpbin

256

# backend:

257

# connectionTimeout: 2s

258

# keepAlive: 15s

259

# idleConnectionTimeout: 60s

260

# maxIdleConnections: 30

261

# services:

262

# - url: http://httpbin.org

263

# headers:

264

# - name: some-header

265

# value: '$some.argocd.secret.key'

266

# cluster:

267

# name: some-cluster

268

# server: https://some-cluster

269

270

## Default configuration for ignoreResourceUpdates.

271

## The ignoreResourceUpdates list contains K8s resource's properties that are known to be frequently updated

272

## by controllers and operators. These resources, when watched by argo, will cause many unnecessary updates.

273

274

# -- Ignoring status for all resources. An update will still be sent if the status update causes the health to change.

275

# @default -- See [values.yaml]

276

resource.customizations.ignoreResourceUpdates.all: |

277

jsonPointers:

278

- /status

279

# -- Some Application fields are generated and not related to the application updates itself

280

## The Application itself is already watched by the controller lister, but this configuration is applied for apps of apps

281

# @default -- See [values.yaml]

282

resource.customizations.ignoreResourceUpdates.argoproj.io_Application: |

283

jqPathExpressions:

284

- '.metadata.annotations."notified.notifications.argoproj.io"'

285

- '.metadata.annotations."argocd.argoproj.io/refresh"'

286

- '.metadata.annotations."argocd.argoproj.io/hydrate"'

287

- '.operation'

288

# -- Ignore Argo Rollouts generated fields

289

# @default -- See [values.yaml]

290

resource.customizations.ignoreResourceUpdates.argoproj.io_Rollout: |

291

jqPathExpressions:

292

- '.metadata.annotations."notified.notifications.argoproj.io"'

293

# -- Legacy annotations used on HPA autoscaling/v1

294

# @default -- See [values.yaml]

295

resource.customizations.ignoreResourceUpdates.autoscaling_HorizontalPodAutoscaler: |

296

jqPathExpressions:

297

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/behavior"'

298

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/conditions"'

299

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/metrics"'

300

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/current-metrics"'

301

# -- Ignore the cluster-autoscaler status

302

# @default -- See [values.yaml]

303

resource.customizations.ignoreResourceUpdates.ConfigMap: |

304

jqPathExpressions:

305

# Ignore the cluster-autoscaler status

306

- '.metadata.annotations."cluster-autoscaler.kubernetes.io/last-updated"'

307

# Ignore the annotation of the legacy Leases election

308

- '.metadata.annotations."control-plane.alpha.kubernetes.io/leader"'

309

# -- Ignore the common scaling annotations

310

# @default -- See [values.yaml]

311

resource.customizations.ignoreResourceUpdates.apps_ReplicaSet: |

312

jqPathExpressions:

313

- '.metadata.annotations."deployment.kubernetes.io/desired-replicas"'

314

- '.metadata.annotations."deployment.kubernetes.io/max-replicas"'

315

- '.metadata.annotations."rollout.argoproj.io/desired-replicas"'

316

# -- Ignores update if EndpointSlice is not excluded globally

317

# @default -- See [values.yaml]

318

resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice: |

319

jsonPointers:

320

- /metadata

321

- /endpoints

322

- /ports

323

# -- Ignores update if Endpoints is not excluded globally

324

# @default -- See [values.yaml]

325

resource.customizations.ignoreResourceUpdates.Endpoints: |

326

jsonPointers:

327

- /metadata

328

- /subsets

329

## Default configuration for exclusions.

330

## The exclusion list are K8s resources that we assume will never be declared in Git,

331

## and are never child objects of managed resources that need to be presented in the resource tree.

332

## This list contains high volume and high churn metadata objects which we exclude for performance

333

## reasons, reducing connections and load to the K8s API servers of managed clusters.

334

335

# -- Resource Exclusion/Inclusion

336

# @default -- See [values.yaml]

337

resource.exclusions: |

338

### Network resources created by the Kubernetes control plane and excluded to reduce the number of watched events and UI clutter

339

- apiGroups:

340

- ''

341

- discovery.k8s.io

342

kinds:

343

- Endpoints

344

- EndpointSlice

345

### Internal Kubernetes resources excluded reduce the number of watched events

346

- apiGroups:

347

- coordination.k8s.io

348

kinds:

349

- Lease

350

### Internal Kubernetes Authz/Authn resources excluded reduce the number of watched events

351

- apiGroups:

352

- authentication.k8s.io

353

- authorization.k8s.io

354

kinds:

355

- SelfSubjectReview

356

- TokenReview

357

- LocalSubjectAccessReview

358

- SelfSubjectAccessReview

359

- SelfSubjectRulesReview

360

- SubjectAccessReview

361

### Intermediate Certificate Request excluded reduce the number of watched events

362

- apiGroups:

363

- certificates.k8s.io

364

kinds:

365

- CertificateSigningRequest

366

- apiGroups:

367

- cert-manager.io

368

kinds:

369

- CertificateRequest

370

### Cilium internal resources excluded reduce the number of watched events and UI Clutter

371

- apiGroups:

372

- cilium.io

373

kinds:

374

- CiliumIdentity

375

- CiliumEndpoint

376

- CiliumEndpointSlice

377

### Kyverno intermediate and reporting resources excluded reduce the number of watched events and improve performance

378

- apiGroups:

379

- kyverno.io

380

- reports.kyverno.io

381

- wgpolicyk8s.io

382

kinds:

383

- PolicyReport

384

- ClusterPolicyReport

385

- EphemeralReport

386

- ClusterEphemeralReport

387

- AdmissionReport

388

- ClusterAdmissionReport

389

- BackgroundScanReport

390

- ClusterBackgroundScanReport

391

- UpdateRequest

392

# -- Additional resource exclusions to append to the default `resource.exclusions` list above,

393

# so that the defaults can be kept up to date without needing to duplicate/override them.

394

# These entries are always appended, never substituted: if you also set `resource.exclusions`

395

# yourself, they are appended to your value rather than to the chart defaults.

396

# @default -- `[]`

397

resourceExclusionsAdditional: []

398

# Argo CD configuration parameters

399

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cmd-params-cm.yaml

400

params:

401

# -- Create the argocd-cmd-params-cm configmap

402

# If false, it is expected the configmap will be created by something else.

403

create: true

404

# -- Annotations to be added to the argocd-cmd-params-cm ConfigMap

405

annotations: {}

406

# You can customize parameters by adding parameters here.

407

# (e.g.)

408

# otlp.address: ''

409

# Argo CD RBAC policy configuration

410

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md

411

rbac:

412

# -- Create the argocd-rbac-cm configmap with ([Argo CD RBAC policy]) definitions.

413

# If false, it is expected the configmap will be created by something else.

414

# Argo CD will not work if there is no configmap created with the name above.

415

create: true

416

# -- Annotations to be added to argocd-rbac-cm configmap

417

annotations: {}

418

# -- The name of the default role which Argo CD will falls back to, when authorizing API requests (optional).

419

# If omitted or empty, users may be still be able to login, but will see no apps, projects, etc...

420

policy.default: ""

421

# -- File containing user-defined policies and role definitions.

422

# @default -- `''` (See [values.yaml])

423

policy.csv: ""

424

# Policy rules are in the form:

425

# p, subject, resource, action, object, effect

426

# Role definitions and bindings are in the form:

427

# g, subject, inherited-subject

428

# policy.csv: |

429

# p, role:org-admin, applications, *, */*, allow

430

# p, role:org-admin, clusters, get, *, allow

431

# p, role:org-admin, repositories, *, *, allow

432

# p, role:org-admin, logs, get, *, allow

433

# p, role:org-admin, exec, create, */*, allow

434

# g, your-github-org:your-team, role:org-admin

435

436

# -- OIDC scopes to examine during rbac enforcement (in addition to `sub` scope).

437

# The scope value can be a string, or a list of strings.

438

scopes: "[groups]"

439

# -- Matcher function for Casbin, `glob` for glob matcher and `regex` for regex matcher.

440

policy.matchMode: "glob"

441

# GnuPG public keys for commit verification

442

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/gpg-verification/

443

gpg:

444

# -- Annotations to be added to argocd-gpg-keys-cm configmap

445

annotations: {}

446

# -- [GnuPG] public keys to add to the keyring

447

# @default -- `{}` (See [values.yaml])

448

## Note: Public keys should be exported with `gpg --export --armor <KEY>`

449

keys: {}

450

# 4AEE18F83AFDEB23: |

451

# -----BEGIN PGP PUBLIC KEY BLOCK-----

452

# ...

453

# -----END PGP PUBLIC KEY BLOCK-----

454

# SSH known hosts for Git repositories

455

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#ssh-known-host-public-keys

456

ssh:

457

# -- Specifies if the argocd-ssh-known-hosts-cm configmap should be created by Helm.

458

create: true

459

# -- Annotations to be added to argocd-ssh-known-hosts-cm configmap

460

annotations: {}

461

# -- Known hosts to be added to the known host list by default.

462

# @default -- See [values.yaml]

463

knownHosts: |

464

[ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

465

[ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl

466

[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

467

bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE=

468

bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO

469

bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M=

470

github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

471

github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl

472

github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

473

gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=

474

gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf

475

gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9

476

ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

477

vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

478

# -- Additional known hosts for private repositories

479

extraHosts: ""

480

# Repository TLS certificates

481

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#repositories-using-self-signed-tls-certificates-or-are-signed-by-custom-ca

482

tls:

483

# -- Annotations to be added to argocd-tls-certs-cm configmap

484

annotations: {}

485

# -- TLS certificates for Git repositories

486

# @default -- `{}` (See [values.yaml])

487

certificates: {}

488

# server.example.com: |

489

# -----BEGIN CERTIFICATE-----

490

# ...

491

# -----END CERTIFICATE-----

492

493

# -- Specifies if the argocd-tls-certs-cm configmap should be created by Helm.

494

create: true

495

# ConfigMap for Config Management Plugins

496

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/config-management-plugins/

497

cmp:

498

# -- Create the argocd-cmp-cm configmap

499

create: false

500

# -- Annotations to be added to argocd-cmp-cm configmap

501

annotations: {}

502

# -- Plugin yaml files to be added to argocd-cmp-cm

503

plugins: {}

504

# --- First plugin

505

# my-plugin:

506

# init:

507

# command: [sh]

508

# args: [-c, 'echo "Initializing..."']

509

# generate:

510

# command: [sh, -c]

511

# args:

512

# - |

513

# echo "{\"kind\": \"ConfigMap\", \"apiVersion\": \"v1\", \"metadata\": { \"name\": \"$ARGOCD_APP_NAME\", \"namespace\": \"$ARGOCD_APP_NAMESPACE\", \"annotations\": {\"Foo\": \"$ARGOCD_ENV_FOO\", \"KubeVersion\": \"$KUBE_VERSION\", \"KubeApiVersion\": \"$KUBE_API_VERSIONS\",\"Bar\": \"baz\"}}}"

514

# discover:

515

# fileName: "./subdir/s*.yaml"

516

# find:

517

# glob: "**/Chart.yaml"

518

# command: [sh, -c, find . -name env.yaml]

519

# --- Second plugin

520

# my-plugin2:

521

# init:

522

# command: [sh]

523

# args: [-c, 'echo "Initializing..."']

524

# generate:

525

# command: [sh, -c]

526

# args:

527

# - |

528

529

# discover:

530

# fileName: "./subdir/s*.yaml"

531

# find:

532

# glob: "**/Chart.yaml"

533

# command: [sh, -c, find . -name env.yaml]

534

535

# -- Provide one or multiple [external cluster credentials]

536

# @default -- `{}` (See [values.yaml])

537

## Ref:

538

## - https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters

539

## - https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#external-cluster-credentials

540

## - https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#project-scoped-repositories-and-clusters

541

clusterCredentials: {}

542

# mycluster:

543

# server: https://mycluster.example.com

544

# labels: {}

545

# annotations: {}

546

# config:

547

# bearerToken: "<authentication token>"

548

# tlsClientConfig:

549

# insecure: false

550

# caData: "<base64 encoded certificate>"

551

# mycluster2:

552

# server: https://mycluster2.example.com

553

# labels: {}

554

# annotations: {}

555

# namespaces: namespace1,namespace2

556

# clusterResources: true

557

# config:

558

# bearerToken: "<authentication token>"

559

# tlsClientConfig:

560

# insecure: false

561

# caData: "<base64 encoded certificate>"

562

# mycluster3-project-scoped:

563

# server: https://mycluster3.example.com

564

# labels: {}

565

# annotations: {}

566

# project: my-project1

567

# config:

568

# bearerToken: "<authentication token>"

569

# tlsClientConfig:

570

# insecure: false

571

# caData: "<base64 encoded certificate>"

572

# mycluster4-sharded:

573

# shard: 1

574

# server: https://mycluster4.example.com

575

# labels: {}

576

# annotations: {}

577

# config:

578

# bearerToken: "<authentication token>"

579

# tlsClientConfig:

580

# insecure: false

581

# caData: "<base64 encoded certificate>"

582

583

# -- Repository credentials to be used as Templates for other repos

584

## Creates a secret for each key/value specified below to create repository credentials

585

credentialTemplates: {}

586

# github-enterprise-creds-1:

587

# url: https://github.com/argoproj

588

# githubAppID: 1

589

# githubAppInstallationID: 2

590

# githubAppEnterpriseBaseUrl: https://ghe.example.com/api/v3

591

# githubAppPrivateKey: |

592

# -----BEGIN OPENSSH PRIVATE KEY-----

593

# ...

594

# -----END OPENSSH PRIVATE KEY-----

595

# https-creds:

596

# url: https://github.com/argoproj

597

# password: my-password

598

# username: my-username

599

# ssh-creds:

600

# url: git@github.com:argoproj-labs

601

# sshPrivateKey: |

602

# -----BEGIN OPENSSH PRIVATE KEY-----

603

# ...

604

# -----END OPENSSH PRIVATE KEY-----

605

606

# -- Annotations to be added to `configs.credentialTemplates` Secret

607

credentialTemplatesAnnotations: {}

608

# -- Repositories list to be used by applications

609

## Creates a secret for each key/value specified below to create repositories

610

## Note: the last example in the list would use a repository credential template, configured under "configs.credentialTemplates".

611

repositories: {}

612

# istio-helm-repo:

613

# url: https://storage.googleapis.com/istio-prerelease/daily-build/master-latest-daily/charts

614

# name: istio.io

615

# type: helm

616

# private-helm-repo:

617

# url: https://my-private-chart-repo.internal

618

# name: private-repo

619

# type: helm

620

# password: my-password

621

# username: my-username

622

# private-repo:

623

# url: https://github.com/argoproj/private-repo

624

625

# -- Annotations to be added to `configs.repositories` Secret

626

repositoriesAnnotations: {}

627

# Argo CD sensitive data

628

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets

629

secret:

630

# -- Create the argocd-secret

631

createSecret: true

632

# -- Labels to be added to argocd-secret

633

labels: {}

634

# -- Annotations to be added to argocd-secret

635

annotations: {}

636

# -- Shared secret for authenticating GitHub webhook events

637

githubSecret: ""

638

# -- Shared secret for authenticating GitLab webhook events

639

gitlabSecret: ""

640

# -- Shared secret for authenticating BitbucketServer webhook events

641

bitbucketServerSecret: ""

642

# -- UUID for authenticating Bitbucket webhook events

643

bitbucketUUID: ""

644

# -- Shared secret for authenticating Gogs webhook events

645

gogsSecret: ""

646

## Azure DevOps

647

azureDevops:

648

# -- Shared secret username for authenticating Azure DevOps webhook events

649

username: ""

650

# -- Shared secret password for authenticating Azure DevOps webhook events

651

password: ""

652

# -- add additional secrets to be added to argocd-secret

653

## Custom secrets. Useful for injecting SSO secrets into environment variables.

654

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets

655

## Note that all values must be non-empty.

656

extra: {}

657

# LDAP_PASSWORD: "mypassword"

658

659

# -- Bcrypt hashed admin password

660

## Argo expects the password in the secret to be bcrypt hashed. You can create this hash with

661

## `htpasswd -nbBC 10 "" $ARGO_PWD | tr -d ':\n' | sed 's/$2y/$2a/'`

662

argocdServerAdminPassword: ""

663

# -- Admin password modification time. Eg. `"2006-01-02T15:04:05Z"`

664

# @default -- `""` (defaults to current time)

665

argocdServerAdminPasswordMtime: ""

666

# -- Define custom [CSS styles] for your argo instance.

667

# This setting will automatically mount the provided CSS and reference it in the argo configuration.

668

# @default -- `""` (See [values.yaml])

669

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/custom-styles/

670

styles: ""

671

# styles: |

672

# .sidebar {

673

# background: linear-gradient(to bottom, #999, #777, #333, #222, #111);

674

# }

675

# -- Array of extra K8s manifests to deploy

676

## Note: Supports use of custom Helm templates

677

extraObjects: []

678

# - apiVersion: secrets-store.csi.x-k8s.io/v1

679

# kind: SecretProviderClass

680

# metadata:

681

# name: argocd-secrets-store

682

# spec:

683

# provider: aws

684

# parameters:

685

# objects: |

686

# - objectName: "argocd"

687

# objectType: "secretsmanager"

688

# jmesPath:

689

# - path: "client_id"

690

# objectAlias: "client_id"

691

# - path: "client_secret"

692

# objectAlias: "client_secret"

693

# secretObjects:

694

# - data:

695

# - key: client_id

696

# objectName: client_id

697

# - key: client_secret

698

# objectName: client_secret

699

# secretName: argocd-secrets-store

700

# type: Opaque

701

# labels:

702

# app.kubernetes.io/part-of: argocd

703

704

## Application controller

705

controller:

706

# -- Application controller name string

707

708

# -- The number of application controller pods to run.

709

# Additional replicas will cause sharding of managed clusters across number of replicas.

710

## With dynamic cluster distribution turned on, sharding of the clusters will gracefully

711

## rebalance if the number of replica's changes or one becomes unhealthy. (alpha)

712

replicas: 1

713

# -- Enable dynamic cluster distribution (alpha)

714

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution

715

## This is done using a deployment instead of a statefulSet

716

## When replicas are added or removed, the sharding algorithm is re-run to ensure that the

717

## clusters are distributed according to the algorithm. If the algorithm is well-balanced,

718

## like round-robin, then the shards will be well-balanced.

719

dynamicClusterDistribution: false

720

# -- Runtime class name for the application controller

721

# @default -- `""` (defaults to global.runtimeClassName)

722

runtimeClassName: ""

723

# -- Application controller heartbeat time

724

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution/#working-of-dynamic-distribution

725

heartbeatTime: 10

726

# -- Maximum number of controller revisions that will be maintained in StatefulSet history

727

revisionHistoryLimit: 5

728

## Application controller Pod Disruption Budget

729

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

730

pdb:

731

# -- Deploy a [PodDisruptionBudget] for the application controller

732

enabled: false

733

# -- Labels to be added to application controller pdb

734

labels: {}

735

# -- Annotations to be added to application controller pdb

736

annotations: {}

737

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

738

# @default -- `""` (defaults to 0 if not specified)

739

minAvailable: ""

740

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

741

## Has higher precedence over `controller.pdb.minAvailable`

742

maxUnavailable: ""

743

## Application controller Vertical Pod Autoscaler

744

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

745

vpa:

746

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the application controller

747

enabled: false

748

# -- Labels to be added to application controller vpa

749

labels: {}

750

# -- Annotations to be added to application controller vpa

751

annotations: {}

752

# -- One of the VPA operation modes

753

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

754

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

755

updateMode: Initial

756

# -- Controls how VPA computes the recommended resources for application controller container

757

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

758

containerPolicy: {}

759

# controlledResources: ["cpu", "memory"]

760

# minAllowed:

761

# cpu: 250m

762

# memory: 256Mi

763

# maxAllowed:

764

# cpu: 1

765

# memory: 1Gi

766

# -- The recommenders that will provide recommendations for vertical scaling. Only relevant if a named VPA recommender (e.g. one started with a custom recommender name) is in use; leave unset to use the cluster's default recommender

767

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

768

## NOTE: specify only zero or one recommender as of VPA 1.7.1

769

recommenders: []

770

# -- Configures a startup resource boost for faster cold-start (application boot) resource allocation. NOTE: startupBoost is currently a GKE-specific extension to the VPA API and is only honored on GKE clusters; it is rendered only when set

771

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

772

startupBoost: {}

773

# cpu:

774

# type: Factor

775

# factor: 2

776

# durationSeconds: 10

777

## Application controller image

778

image:

779

# -- Repository to use for the application controller

780

# @default -- `""` (defaults to global.image.repository)

781

repository: ""

782

# -- Tag to use for the application controller

783

# @default -- `""` (defaults to global.image.tag)

784

tag: ""

785

# -- Image pull policy for the application controller

786

# @default -- `""` (defaults to global.image.imagePullPolicy)

787

imagePullPolicy: ""

788

# -- Secrets with credentials to pull images from a private registry

789

# @default -- `[]` (defaults to global.imagePullSecrets)

790

imagePullSecrets: []

791

# -- Additional command line arguments to pass to application controller

792

extraArgs: []

793

# -- Environment variables to pass to application controller

794

env: []

795

# -- envFrom to pass to application controller

796

# @default -- `[]` (See [values.yaml])

797

envFrom: []

798

# - configMapRef:

799

# name: config-map-name

800

# - secretRef:

801

# name: secret-name

802

803

# -- Additional containers to be added to the application controller pod

804

## Note: Supports use of custom Helm templates

805

extraContainers: []

806

# -- Init containers to add to the application controller pod

807

## If your target Kubernetes cluster(s) require a custom credential (exec) plugin

808

## you could use this (and the same in the server pod) to provide such executable

809

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

810

## Note: Supports use of custom Helm templates

811

initContainers: []

812

# - name: download-tools

813

# image: alpine:3

814

# command: [sh, -c]

815

# args:

816

# - wget -qO /custom-tools/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.7/kubelogin-linux-amd64.zip &&

817

# mkdir /custom-tools/tmp && unzip -d /custom-tools/tmp /custom-tools/kubelogin.zip &&

818

# mv /custom-tools/tmp/bin/linux_amd64/kubelogin /custom-tools/ && rm -rf custom-tools/tmp && rm /custom-tools/kubelogin.zip

819

# volumeMounts:

820

# - mountPath: /custom-tools

821

# name: custom-tools

822

823

# -- Additional volumeMounts to the application controller main container

824

volumeMounts: []

825

# - mountPath: /usr/local/bin/kubelogin

826

# name: custom-tools

827

# subPath: kubelogin

828

829

# -- Additional volumes to the application controller pod

830

volumes: []

831

# - name: custom-tools

832

# emptyDir: {}

833

834

## Application controller emptyDir volumes

835

emptyDir:

836

# -- EmptyDir size limit for application controller

837

# @default -- `""` (defaults not set if not specified i.e. no size limit)

838

sizeLimit: ""

839

# sizeLimit: "1Gi"

840

# -- Annotations for the application controller StatefulSet

841

statefulsetAnnotations: {}

842

# -- Labels for the application controller StatefulSet

843

statefulsetLabels: {}

844

# -- Annotations for the application controller Deployment

845

deploymentAnnotations: {}

846

# -- Labels for the application controller Deployment

847

deploymentLabels: {}

848

# -- Annotations to be added to application controller pods

849

podAnnotations: {}

850

# -- Labels to be added to application controller pods

851

podLabels: {}

852

# -- Resource limits and requests for the application controller pods

853

resources: {}

854

# limits:

855

# cpu: 500m

856

# memory: 512Mi

857

# requests:

858

# cpu: 250m

859

# memory: 256Mi

860

861

# Application controller container ports

862

containerPorts:

863

# -- Metrics container port

864

metrics: 8082

865

# -- Host Network for application controller pods

866

hostNetwork: false

867

# -- [DNS configuration]

868

dnsConfig: {}

869

# -- Alternative DNS policy for application controller pods

870

dnsPolicy: "ClusterFirst"

871

# -- Application controller container-level security context

872

# @default -- See [values.yaml]

873

containerSecurityContext:

874

runAsNonRoot: true

875

readOnlyRootFilesystem: true

876

allowPrivilegeEscalation: false

877

seccompProfile:

878

type: RuntimeDefault

879

capabilities:

880

drop:

881

- ALL

882

# Readiness probe for application controller

883

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

884

readinessProbe:

885

# -- Http path to use for the readiness probe

886

httpPath: /healthz

887

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

888

failureThreshold: 3

889

# -- Number of seconds after the container has started before [probe] is initiated

890

initialDelaySeconds: 10

891

# -- How often (in seconds) to perform the [probe]

892

periodSeconds: 10

893

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

894

successThreshold: 1

895

# -- Number of seconds after which the [probe] times out

896

timeoutSeconds: 1

897

## Liveness probe for the application controller.

898

## Disabled by default, matching upstream: Argo CD removed this probe deliberately

899

## (argoproj/argo-cd#9557) because restarting an overloaded controller usually makes

900

## things worse. Enable only if you have a known failure mode (e.g. deadlock) where

901

## a restart is the correct remediation, and size the thresholds generously.

902

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

903

livenessProbe:

904

# -- Enable Kubernetes liveness probe for Application controller

905

enabled: false

906

# -- Http path to use for the liveness probe

907

httpPath: /healthz

908

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

909

failureThreshold: 5

910

# -- Number of seconds after the container has started before [probe] is initiated

911

initialDelaySeconds: 10

912

# -- How often (in seconds) to perform the [probe]

913

periodSeconds: 30

914

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

915

successThreshold: 1

916

# -- Number of seconds after which the [probe] times out

917

timeoutSeconds: 5

918

## Startup probe for application controller (optional)

919

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

920

startupProbe:

921

# -- Enable Kubernetes startup probe for application controller

922

enabled: false

923

# -- Http path to use for the startup probe

924

httpPath: /healthz

925

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

926

failureThreshold: 20

927

# -- Number of seconds after the container has started before [probe] is initiated

928

initialDelaySeconds: 10

929

# -- How often (in seconds) to perform the [probe]

930

periodSeconds: 10

931

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

932

successThreshold: 1

933

# -- Number of seconds after which the [probe] times out

934

timeoutSeconds: 1

935

# -- terminationGracePeriodSeconds for container lifecycle hook

936

terminationGracePeriodSeconds: 30

937

# -- Priority class for the application controller pods

938

# @default -- `""` (defaults to global.priorityClassName)

939

priorityClassName: ""

940

# -- [Node selector]

941

# @default -- `{}` (defaults to global.nodeSelector)

942

nodeSelector: {}

943

# -- [Tolerations] for use with node taints

944

# @default -- `[]` (defaults to global.tolerations)

945

tolerations: []

946

# -- Assign custom [affinity] rules to the deployment

947

# @default -- `{}` (defaults to global.affinity preset)

948

affinity: {}

949

# -- Assign custom [TopologySpreadConstraints] rules to the application controller

950

# @default -- `[]` (defaults to global.topologySpreadConstraints)

951

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

952

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

953

topologySpreadConstraints: []

954

# - maxSkew: 1

955

# topologyKey: topology.kubernetes.io/zone

956

# whenUnsatisfiable: DoNotSchedule

957

958

# -- Automount API credentials for the Service Account into the pod.

959

automountServiceAccountToken: true

960

serviceAccount:

961

# -- Create a service account for the application controller

962

create: true

963

# -- Service account name

964

965

# -- Annotations applied to created service account

966

annotations: {}

967

# -- Labels applied to created service account

968

labels: {}

969

# -- Automount API credentials for the Service Account

970

automountServiceAccountToken: true

971

## Application controller metrics configuration

972

metrics:

973

# -- Deploy metrics service

974

enabled: false

975

applicationLabels:

976

# -- Enables additional labels in argocd_app_labels metric

977

enabled: false

978

# -- Additional labels

979

labels: []

980

service:

981

# -- Metrics service type

982

type: ClusterIP

983

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

984

clusterIP: ""

985

# -- Metrics service annotations

986

annotations: {}

987

# -- Metrics service labels

988

labels: {}

989

# -- Metrics service port

990

servicePort: 8082

991

# -- Metrics service port name

992

portName: http-metrics

993

serviceMonitor:

994

# -- Enable a prometheus ServiceMonitor

995

enabled: false

996

# -- Prometheus ServiceMonitor interval

997

interval: 30s

998

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

999

scrapeTimeout: ""

1000

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1001

honorLabels: false

1002

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1003

relabelings: []

1004

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1005

metricRelabelings: []

1006

# -- Prometheus ServiceMonitor selector

1007

selector: {}

1008

# prometheus: kube-prometheus

1009

1010

# -- Prometheus ServiceMonitor scheme

1011

scheme: ""

1012

# -- Prometheus ServiceMonitor tlsConfig

1013

tlsConfig: {}

1014

# -- Prometheus ServiceMonitor namespace

1015

namespace: "" # "monitoring"

1016

# -- Prometheus ServiceMonitor labels

1017

additionalLabels: {}

1018

# -- Prometheus ServiceMonitor annotations

1019

annotations: {}

1020

rules:

1021

# -- Deploy a PrometheusRule for the application controller

1022

enabled: false

1023

# -- PrometheusRule namespace

1024

namespace: "" # "monitoring"

1025

# -- PrometheusRule selector

1026

selector: {}

1027

# prometheus: kube-prometheus

1028

1029

# -- PrometheusRule labels

1030

additionalLabels: {}

1031

# -- PrometheusRule annotations

1032

annotations: {}

1033

# -- PrometheusRule.Spec for the application controller

1034

spec: []

1035

# - alert: ArgoAppMissing

1036

# expr: |

1037

# absent(argocd_app_info) == 1

1038

# for: 15m

1039

# labels:

1040

# severity: critical

1041

# annotations:

1042

# summary: "[Argo CD] No reported applications"

1043

# description: >

1044

# Argo CD has not reported any applications data for the past 15 minutes which

1045

# means that it must be down or not functioning properly. This needs to be

1046

# resolved for this cloud to continue to maintain state.

1047

# - alert: ArgoAppNotSynced

1048

# expr: |

1049

# argocd_app_info{sync_status!="Synced"} == 1

1050

# for: 12h

1051

# labels:

1052

# severity: warning

1053

# annotations:

1054

# summary: "[{{ $labels.name }}] Application not synchronized"

1055

# description: >

1056

# The application {{ $labels.name }} has not been synchronized for over

1057

# 12 hours which means that the state of this cloud has drifted away from the

1058

# state inside Git.

1059

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

1060

## Defaults to off

1061

clusterRoleRules:

1062

# -- Enable custom rules for the application controller's ClusterRole resource

1063

enabled: false

1064

# -- List of custom rules for the application controller's ClusterRole resource

1065

rules: []

1066

## Enable this and set the rules: to whatever custom rules you want for the Role resource.

1067

## Defaults to off

1068

# -- List of custom rules for the application controller's Role resource

1069

roleRules: []

1070

# Default application controller's network policy

1071

networkPolicy:

1072

# -- Default network policy rules used by application controller

1073

# @default -- `false` (defaults to global.networkPolicy.create)

1074

create: false

1075

## Dex

1076

dex:

1077

# -- Enable dex

1078

enabled: true

1079

# -- Dex name

1080

1081

# -- Additional command line arguments to pass to the Dex server

1082

extraArgs: []

1083

# -- Runtime class name for Dex

1084

# @default -- `""` (defaults to global.runtimeClassName)

1085

runtimeClassName: ""

1086

metrics:

1087

# -- Deploy metrics service

1088

enabled: false

1089

service:

1090

# -- Metrics service annotations

1091

annotations: {}

1092

# -- Metrics service labels

1093

labels: {}

1094

# -- Metrics service port name

1095

portName: http-metrics

1096

serviceMonitor:

1097

# -- Enable a prometheus ServiceMonitor

1098

enabled: false

1099

# -- Prometheus ServiceMonitor interval

1100

interval: 30s

1101

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1102

honorLabels: false

1103

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1104

relabelings: []

1105

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1106

metricRelabelings: []

1107

# -- Prometheus ServiceMonitor selector

1108

selector: {}

1109

# prometheus: kube-prometheus

1110

1111

# -- Prometheus ServiceMonitor scheme

1112

scheme: ""

1113

# -- Prometheus ServiceMonitor tlsConfig

1114

tlsConfig: {}

1115

# -- Prometheus ServiceMonitor namespace

1116

namespace: "" # "monitoring"

1117

# -- Prometheus ServiceMonitor labels

1118

additionalLabels: {}

1119

# -- Prometheus ServiceMonitor annotations

1120

annotations: {}

1121

## Dex Pod Disruption Budget

1122

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1123

pdb:

1124

# -- Deploy a [PodDisruptionBudget] for the Dex server

1125

enabled: false

1126

# -- Labels to be added to Dex server pdb

1127

labels: {}

1128

# -- Annotations to be added to Dex server pdb

1129

annotations: {}

1130

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1131

# @default -- `""` (defaults to 0 if not specified)

1132

minAvailable: ""

1133

# -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%).

1134

## Has higher precedence over `dex.pdb.minAvailable`

1135

maxUnavailable: ""

1136

## Dex Vertical Pod Autoscaler

1137

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1138

vpa:

1139

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Dex server

1140

enabled: false

1141

# -- Labels to be added to Dex server vpa

1142

labels: {}

1143

# -- Annotations to be added to Dex server vpa

1144

annotations: {}

1145

# -- One of the VPA operation modes

1146

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1147

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1148

updateMode: Initial

1149

# -- Controls how VPA computes the recommended resources for Dex server container

1150

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1151

containerPolicy: {}

1152

# controlledResources: ["cpu", "memory"]

1153

# minAllowed:

1154

# cpu: 250m

1155

# memory: 256Mi

1156

# maxAllowed:

1157

# cpu: 1

1158

# memory: 1Gi

1159

1160

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

1161

## NOTE: specify only zero or one recommender as of VPA 1.7.1

1162

recommenders: []

1163

1164

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

1165

startupBoost: {}

1166

# cpu:

1167

# type: Factor

1168

# factor: 2

1169

# durationSeconds: 10

1170

## Dex image

1171

image:

1172

# -- Dex image repository

1173

repository: cgr.dev/chainguard-private/dex

1174

# -- Dex image tag

1175

tag: 2.45.1@sha256:2fb614e66bec9ccb59b9a634d2f6bcb8cb98901149969c04fc87652192a45c96

1176

# -- Dex imagePullPolicy

1177

# @default -- `""` (defaults to global.image.imagePullPolicy)

1178

imagePullPolicy: ""

1179

# -- Secrets with credentials to pull images from a private registry

1180

# @default -- `[]` (defaults to global.imagePullSecrets)

1181

imagePullSecrets: []

1182

# Argo CD init image that creates Dex config

1183

initImage:

1184

# -- Argo CD init image repository

1185

# @default -- `""` (defaults to global.image.repository)

1186

repository: ""

1187

# -- Argo CD init image tag

1188

# @default -- `""` (defaults to global.image.tag)

1189

tag: ""

1190

# -- Argo CD init image imagePullPolicy

1191

# @default -- `""` (defaults to global.image.imagePullPolicy)

1192

imagePullPolicy: ""

1193

# -- Argo CD init image resources

1194

# @default -- `{}` (defaults to dex.resources)

1195

resources: {}

1196

# requests:

1197

# cpu: 5m

1198

# memory: 96Mi

1199

# limits:

1200

# cpu: 10m

1201

# memory: 144Mi

1202

# -- Environment variables to pass to the Dex server

1203

env: []

1204

# -- envFrom to pass to the Dex server

1205

# @default -- `[]` (See [values.yaml])

1206

envFrom: []

1207

# - configMapRef:

1208

# name: config-map-name

1209

# - secretRef:

1210

# name: secret-name

1211

1212

# -- Additional containers to be added to the dex pod

1213

## Note: Supports use of custom Helm templates

1214

extraContainers: []

1215

# -- Init containers to add to the dex pod

1216

## Note: Supports use of custom Helm templates

1217

initContainers: []

1218

# -- Additional volumeMounts to the dex main container

1219

volumeMounts: []

1220

# -- Additional volumes to the dex pod

1221

volumes: []

1222

## Dex server emptyDir volumes

1223

emptyDir:

1224

# -- EmptyDir size limit for Dex server

1225

# @default -- `""` (defaults not set if not specified i.e. no size limit)

1226

sizeLimit: ""

1227

# sizeLimit: "1Gi"

1228

# TLS certificate configuration via Secret

1229

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-dex-server

1230

## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart Dex automatically without extra controllers.

1231

certificateSecret:

1232

# -- Create argocd-dex-server-tls secret

1233

enabled: false

1234

# -- Labels to be added to argocd-dex-server-tls secret

1235

labels: {}

1236

# -- Annotations to be added to argocd-dex-server-tls secret

1237

annotations: {}

1238

# -- Certificate authority. Required for self-signed certificates.

1239

ca: ""

1240

# -- Certificate private key

1241

key: ""

1242

# -- Certificate data. Must contain SANs of Dex service (ie: argocd-dex-server, argocd-dex-server.argo-cd.svc)

1243

crt: ""

1244

# -- Annotations to be added to the Dex server Deployment

1245

deploymentAnnotations: {}

1246

# -- Labels for the Dex server Deployment

1247

deploymentLabels: {}

1248

# -- Annotations to be added to the Dex server pods

1249

podAnnotations: {}

1250

# -- Labels to be added to the Dex server pods

1251

podLabels: {}

1252

# -- Resource limits and requests for dex

1253

resources: {}

1254

# limits:

1255

# cpu: 50m

1256

# memory: 64Mi

1257

# requests:

1258

# cpu: 10m

1259

# memory: 32Mi

1260

1261

# Dex container ports

1262

# NOTE: These ports are currently hardcoded and cannot be changed

1263

containerPorts:

1264

# -- HTTP container port

1265

http: 5556

1266

# -- gRPC container port

1267

grpc: 5557

1268

# -- Metrics container port

1269

metrics: 5558

1270

# -- [DNS configuration]

1271

dnsConfig: {}

1272

# -- Alternative DNS policy for Dex server pods

1273

dnsPolicy: "ClusterFirst"

1274

# -- Dex container-level security context

1275

# @default -- See [values.yaml]

1276

containerSecurityContext:

1277

runAsNonRoot: true

1278

runAsUser: 1001

1279

readOnlyRootFilesystem: true

1280

allowPrivilegeEscalation: false

1281

seccompProfile:

1282

type: RuntimeDefault

1283

capabilities:

1284

drop:

1285

- ALL

1286

## Probes for Dex server

1287

## Supported from Dex >= 2.28.0

1288

livenessProbe:

1289

# -- Enable Kubernetes liveness probe for Dex >= 2.28.0

1290

enabled: false

1291

# -- Http path to use for the liveness probe

1292

httpPath: /healthz/live

1293

# -- Http port to use for the liveness probe

1294

httpPort: metrics

1295

# -- Scheme to use for for the liveness probe (can be HTTP or HTTPS)

1296

httpScheme: HTTP

1297

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1298

failureThreshold: 3

1299

# -- Number of seconds after the container has started before [probe] is initiated

1300

initialDelaySeconds: 10

1301

# -- How often (in seconds) to perform the [probe]

1302

periodSeconds: 10

1303

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1304

successThreshold: 1

1305

# -- Number of seconds after which the [probe] times out

1306

timeoutSeconds: 1

1307

readinessProbe:

1308

# -- Enable Kubernetes readiness probe for Dex >= 2.28.0

1309

enabled: false

1310

# -- Http path to use for the readiness probe

1311

httpPath: /healthz/ready

1312

# -- Http port to use for the readiness probe

1313

httpPort: metrics

1314

# -- Scheme to use for for the liveness probe (can be HTTP or HTTPS)

1315

httpScheme: HTTP

1316

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1317

failureThreshold: 3

1318

# -- Number of seconds after the container has started before [probe] is initiated

1319

initialDelaySeconds: 10

1320

# -- How often (in seconds) to perform the [probe]

1321

periodSeconds: 10

1322

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1323

successThreshold: 1

1324

# -- Number of seconds after which the [probe] times out

1325

timeoutSeconds: 1

1326

## Startup probe for Dex server (optional)

1327

## Supported from Dex >= 2.28.0

1328

startupProbe:

1329

# -- Enable Kubernetes startup probe for Dex >= 2.28.0

1330

enabled: false

1331

# -- Http path to use for the startup probe

1332

httpPath: /healthz/ready

1333

# -- Http port to use for the startup probe

1334

httpPort: metrics

1335

# -- Scheme to use for the startup probe (can be HTTP or HTTPS)

1336

httpScheme: HTTP

1337

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1338

failureThreshold: 20

1339

# -- Number of seconds after the container has started before [probe] is initiated

1340

initialDelaySeconds: 10

1341

# -- How often (in seconds) to perform the [probe]

1342

periodSeconds: 10

1343

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1344

successThreshold: 1

1345

# -- Number of seconds after which the [probe] times out

1346

timeoutSeconds: 1

1347

# -- terminationGracePeriodSeconds for container lifecycle hook

1348

terminationGracePeriodSeconds: 30

1349

# -- Automount API credentials for the Service Account into the pod.

1350

automountServiceAccountToken: true

1351

serviceAccount:

1352

# -- Create dex service account

1353

create: true

1354

# -- Dex service account name

1355

1356

# -- Annotations applied to created service account

1357

annotations: {}

1358

# -- Automount API credentials for the Service Account

1359

automountServiceAccountToken: true

1360

# -- Service port for HTTP access

1361

servicePortHttp: 5556

1362

# -- Service port name for HTTP access

1363

servicePortHttpName: http

1364

# -- Service port for gRPC access

1365

servicePortGrpc: 5557

1366

# -- Service port name for gRPC access

1367

servicePortGrpcName: grpc

1368

# -- Service port for metrics access

1369

servicePortMetrics: 5558

1370

# -- Priority class for the dex pods

1371

# @default -- `""` (defaults to global.priorityClassName)

1372

priorityClassName: ""

1373

# -- [Node selector]

1374

# @default -- `{}` (defaults to global.nodeSelector)

1375

nodeSelector: {}

1376

# -- [Tolerations] for use with node taints

1377

# @default -- `[]` (defaults to global.tolerations)

1378

tolerations: []

1379

# -- Assign custom [affinity] rules to the deployment

1380

# @default -- `{}` (defaults to global.affinity preset)

1381

affinity: {}

1382

# -- Assign custom [TopologySpreadConstraints] rules to dex

1383

# @default -- `[]` (defaults to global.topologySpreadConstraints)

1384

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1385

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

1386

topologySpreadConstraints: []

1387

# - maxSkew: 1

1388

# topologyKey: topology.kubernetes.io/zone

1389

# whenUnsatisfiable: DoNotSchedule

1390

1391

# -- Deployment strategy to be added to the Dex server Deployment

1392

deploymentStrategy: {}

1393

# type: RollingUpdate

1394

# rollingUpdate:

1395

# maxSurge: 25%

1396

# maxUnavailable: 25%

1397

1398

# Default Dex server's network policy

1399

networkPolicy:

1400

# -- Default network policy rules used by Dex server

1401

# @default -- `false` (defaults to global.networkPolicy.create)

1402

create: false

1403

# DEPRECATED - Use configs.params to override

1404

# -- Dex log format. Either `text` or `json`

1405

# @default -- `""` (defaults to global.logging.format)

1406

# logFormat: ""

1407

# -- Dex log level. One of: `debug`, `info`, `warn`, `error`

1408

# @default -- `""` (defaults to global.logging.level)

1409

# logLevel: ""

1410

## Redis

1411

redis:

1412

# -- Enable redis

1413

enabled: true

1414

# -- Redis name

1415

1416

# -- Runtime class name for redis

1417

# @default -- `""` (defaults to global.runtimeClassName)

1418

runtimeClassName: ""

1419

## Redis Pod Disruption Budget

1420

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1421

pdb:

1422

# -- Deploy a [PodDisruptionBudget] for the Redis

1423

enabled: false

1424

# -- Labels to be added to Redis pdb

1425

labels: {}

1426

# -- Annotations to be added to Redis pdb

1427

annotations: {}

1428

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1429

# @default -- `""` (defaults to 0 if not specified)

1430

minAvailable: ""

1431

# -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%).

1432

## Has higher precedence over `redis.pdb.minAvailable`

1433

maxUnavailable: ""

1434

## Redis Vertical Pod Autoscaler

1435

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1436

vpa:

1437

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Redis

1438

enabled: false

1439

# -- Labels to be added to Redis vpa

1440

labels: {}

1441

# -- Annotations to be added to Redis vpa

1442

annotations: {}

1443

# -- One of the VPA operation modes

1444

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1445

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1446

updateMode: Initial

1447

# -- Controls how VPA computes the recommended resources for Redis container

1448

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1449

containerPolicy: {}

1450

# controlledResources: ["cpu", "memory"]

1451

# minAllowed:

1452

# cpu: 250m

1453

# memory: 256Mi

1454

# maxAllowed:

1455

# cpu: 1

1456

# memory: 1Gi

1457

1458

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

1459

## NOTE: specify only zero or one recommender as of VPA 1.7.1

1460

recommenders: []

1461

1462

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

1463

startupBoost: {}

1464

# cpu:

1465

# type: Factor

1466

# factor: 2

1467

# durationSeconds: 10

1468

## Redis image

1469

image:

1470

# -- Redis repository

1471

repository: cgr.dev/chainguard-private/redis

1472

# -- Redis tag

1473

## Do not use 7.4.0 <= v < 8.0.0, otherwise you are no longer using an open source version of Redis

1474

tag: 8.8.2@sha256:ac41dc9c416d7e8d7fd6add45d1449c0836743ed1ffa9238df7dd2a4da5943c9

1475

# -- Redis image pull policy

1476

# @default -- `""` (defaults to global.image.imagePullPolicy)

1477

imagePullPolicy: ""

1478

## Prometheus redis-exporter sidecar

1479

exporter:

1480

# -- Enable Prometheus redis-exporter sidecar

1481

enabled: false

1482

# -- Environment variables to pass to the Redis exporter

1483

env: []

1484

## Prometheus redis-exporter image

1485

image:

1486

# -- Repository to use for the redis-exporter

1487

repository: cgr.dev/chainguard-private/prometheus-redis-exporter

1488

# -- Tag to use for the redis-exporter

1489

tag: 1.90.0@sha256:3a54a4528698682a8ad842d6ac5e13947ef15f89ede7cf78dd9084ed6ae697d7

1490

# -- Image pull policy for the redis-exporter

1491

# @default -- `""` (defaults to global.image.imagePullPolicy)

1492

imagePullPolicy: ""

1493

# -- Redis exporter security context

1494

# @default -- See [values.yaml]

1495

containerSecurityContext:

1496

runAsNonRoot: true

1497

readOnlyRootFilesystem: true

1498

allowPrivilegeEscalation: false

1499

seccompProfile:

1500

type: RuntimeDefault

1501

capabilities:

1502

drop:

1503

- ALL

1504

## Probes for Redis exporter (optional)

1505

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

1506

readinessProbe:

1507

# -- Enable Kubernetes liveness probe for Redis exporter (optional)

1508

enabled: false

1509

# -- Number of seconds after the container has started before [probe] is initiated

1510

initialDelaySeconds: 30

1511

# -- How often (in seconds) to perform the [probe]

1512

periodSeconds: 15

1513

# -- Number of seconds after which the [probe] times out

1514

timeoutSeconds: 15

1515

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1516

successThreshold: 1

1517

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1518

failureThreshold: 5

1519

livenessProbe:

1520

# -- Enable Kubernetes liveness probe for Redis exporter

1521

enabled: false

1522

# -- Number of seconds after the container has started before [probe] is initiated

1523

initialDelaySeconds: 30

1524

# -- How often (in seconds) to perform the [probe]

1525

periodSeconds: 15

1526

# -- Number of seconds after which the [probe] times out

1527

timeoutSeconds: 15

1528

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1529

successThreshold: 1

1530

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1531

failureThreshold: 5

1532

# -- Resource limits and requests for redis-exporter sidecar

1533

resources: {}

1534

# limits:

1535

# cpu: 50m

1536

# memory: 64Mi

1537

# requests:

1538

# cpu: 10m

1539

# memory: 32Mi

1540

# -- Secrets with credentials to pull images from a private registry

1541

# @default -- `[]` (defaults to global.imagePullSecrets)

1542

imagePullSecrets: []

1543

# -- Additional command line arguments to pass to redis-server

1544

extraArgs: []

1545

# - --bind

1546

# - "0.0.0.0"

1547

1548

# -- Environment variables to pass to the Redis server

1549

env: []

1550

# -- envFrom to pass to the Redis server

1551

# @default -- `[]` (See [values.yaml])

1552

envFrom: []

1553

# - configMapRef:

1554

# name: config-map-name

1555

# - secretRef:

1556

# name: secret-name

1557

1558

## Probes for Redis server (optional)

1559

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

1560

readinessProbe:

1561

# -- Enable Kubernetes liveness probe for Redis server

1562

enabled: false

1563

# -- Number of seconds after the container has started before [probe] is initiated

1564

initialDelaySeconds: 30

1565

# -- How often (in seconds) to perform the [probe]

1566

periodSeconds: 15

1567

# -- Number of seconds after which the [probe] times out

1568

timeoutSeconds: 15

1569

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1570

successThreshold: 1

1571

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1572

failureThreshold: 5

1573

livenessProbe:

1574

# -- Enable Kubernetes liveness probe for Redis server

1575

enabled: false

1576

# -- Number of seconds after the container has started before [probe] is initiated

1577

initialDelaySeconds: 30

1578

# -- How often (in seconds) to perform the [probe]

1579

periodSeconds: 15

1580

# -- Number of seconds after which the [probe] times out

1581

timeoutSeconds: 15

1582

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1583

successThreshold: 1

1584

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1585

failureThreshold: 5

1586

# -- Additional containers to be added to the redis pod

1587

## Note: Supports use of custom Helm templates

1588

extraContainers: []

1589

# -- Init containers to add to the redis pod

1590

## Note: Supports use of custom Helm templates

1591

initContainers: []

1592

# -- Additional volumeMounts to the redis container

1593

volumeMounts: []

1594

# -- Additional volumes to the redis pod

1595

volumes: []

1596

# -- Annotations to be added to the Redis server Deployment

1597

deploymentAnnotations: {}

1598

# -- Labels for the Redis server Deployment

1599

deploymentLabels: {}

1600

# -- Annotations to be added to the Redis server pods

1601

podAnnotations: {}

1602

# -- Labels to be added to the Redis server pods

1603

podLabels: {}

1604

# -- Resource limits and requests for redis

1605

resources: {}

1606

# limits:

1607

# cpu: 200m

1608

# memory: 128Mi

1609

# requests:

1610

# cpu: 100m

1611

# memory: 64Mi

1612

1613

# -- Redis pod-level security context

1614

# @default -- See [values.yaml]

1615

securityContext:

1616

runAsNonRoot: true

1617

runAsUser: 999

1618

seccompProfile:

1619

type: RuntimeDefault

1620

# Redis container ports

1621

containerPorts:

1622

# -- Redis container port

1623

redis: 6379

1624

# -- Metrics container port

1625

metrics: 9121

1626

# -- Host Network for redis pods

1627

hostNetwork: false

1628

# -- [DNS configuration]

1629

dnsConfig: {}

1630

# -- Alternative DNS policy for Redis server pods

1631

dnsPolicy: "ClusterFirst"

1632

# -- Redis container-level security context

1633

# @default -- See [values.yaml]

1634

containerSecurityContext:

1635

readOnlyRootFilesystem: true

1636

allowPrivilegeEscalation: false

1637

capabilities:

1638

drop:

1639

- ALL

1640

# -- Redis service port

1641

servicePort: 6379

1642

# -- Priority class for redis pods

1643

# @default -- `""` (defaults to global.priorityClassName)

1644

priorityClassName: ""

1645

# -- [Node selector]

1646

# @default -- `{}` (defaults to global.nodeSelector)

1647

nodeSelector: {}

1648

# -- [Tolerations] for use with node taints

1649

# @default -- `[]` (defaults to global.tolerations)

1650

tolerations: []

1651

# -- Assign custom [affinity] rules to the deployment

1652

# @default -- `{}` (defaults to global.affinity preset)

1653

affinity: {}

1654

# -- Assign custom [TopologySpreadConstraints] rules to redis

1655

# @default -- `[]` (defaults to global.topologySpreadConstraints)

1656

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1657

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

1658

topologySpreadConstraints: []

1659

# - maxSkew: 1

1660

# topologyKey: topology.kubernetes.io/zone

1661

# whenUnsatisfiable: DoNotSchedule

1662

1663

# -- terminationGracePeriodSeconds for container lifecycle hook

1664

terminationGracePeriodSeconds: 30

1665

# -- Automount API credentials for the Service Account into the pod.

1666

automountServiceAccountToken: true

1667

serviceAccount:

1668

# -- Create a service account for the redis pod

1669

create: false

1670

# -- Service account name for redis pod

1671

1672

# -- Annotations applied to created service account

1673

annotations: {}

1674

# -- Automount API credentials for the Service Account

1675

automountServiceAccountToken: false

1676

service:

1677

# -- Redis service annotations

1678

annotations: {}

1679

# -- Additional redis service labels

1680

labels: {}

1681

metrics:

1682

# -- Deploy metrics service

1683

enabled: false

1684

# Redis metrics service configuration

1685

service:

1686

# -- Metrics service type

1687

type: ClusterIP

1688

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

1689

clusterIP: None

1690

# -- Metrics service annotations

1691

annotations: {}

1692

# -- Metrics service labels

1693

labels: {}

1694

# -- Metrics service port

1695

servicePort: 9121

1696

# -- Metrics service port name

1697

portName: http-metrics

1698

serviceMonitor:

1699

# -- Enable a prometheus ServiceMonitor

1700

enabled: false

1701

# -- Interval at which metrics should be scraped

1702

interval: 30s

1703

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1704

honorLabels: false

1705

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1706

relabelings: []

1707

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1708

metricRelabelings: []

1709

# -- Prometheus ServiceMonitor selector

1710

selector: {}

1711

# prometheus: kube-prometheus

1712

1713

# -- Prometheus ServiceMonitor scheme

1714

scheme: ""

1715

# -- Prometheus ServiceMonitor tlsConfig

1716

tlsConfig: {}

1717

# -- Prometheus ServiceMonitor namespace

1718

namespace: "" # "monitoring"

1719

# -- Prometheus ServiceMonitor labels

1720

additionalLabels: {}

1721

# -- Prometheus ServiceMonitor annotations

1722

annotations: {}

1723

# Default redis's network policy

1724

networkPolicy:

1725

# -- Default network policy rules used by redis

1726

# @default -- `false` (defaults to global.networkPolicy.create)

1727

create: false

1728

## Redis-HA subchart replaces custom redis deployment when `redis-ha.enabled=true`

1729

# Ref: https://github.com/DandyDeveloper/charts/blob/master/charts/redis-ha/values.yaml

1730

redis-ha:

1731

# -- Enables the Redis HA subchart and disables the custom Redis single node deployment

1732

enabled: false

1733

## Redis image

1734

image:

1735

# -- Redis repository

1736

repository: ecr-public.aws.com/docker/library/redis

1737

# -- Redis tag

1738

## Do not use 7.4.0 <= v < 8.0.0, otherwise you are no longer using an open source version of Redis

1739

## Runs ahead of the upstream HA manifests' pin: the redis 8.2.x line is only built on Alpine 3.22,

1740

## whose OpenSSL carries known vulnerabilities (GHSA-5p3w-hgjv-f6q3 report); 8.6.x is the patched base.

1741

tag: 8.6.4-alpine

1742

## Prometheus redis-exporter sidecar

1743

exporter:

1744

# -- Enable Prometheus redis-exporter sidecar

1745

enabled: false

1746

# -- Repository to use for the redis-exporter

1747

image: ghcr.io/oliver006/redis_exporter

1748

# -- Tag to use for the redis-exporter

1749

tag: v1.75.0

1750

persistentVolume:

1751

# -- Configures persistence on Redis nodes

1752

enabled: false

1753

## Redis specific configuration options

1754

redis:

1755

# -- Redis convention for naming the cluster group: must match `^[\\w-\\.]+$` and can be templated

1756

masterGroupName: argocd

1757

# -- Any valid redis config options in this section will be applied to each server (see `redis-ha` chart)

1758

# @default -- See [values.yaml]

1759

config:

1760

# -- Will save the DB if both the given number of seconds and the given number of write operations against the DB occurred. `""` is disabled

1761

# @default -- `'""'`

1762

save: '""'

1763

## Redis sentinel specific configuration options

1764

sentinel:

1765

# -- Sentinel container lifecycle hooks. The default `postStart` hook resets the sentinel state after a rolling update to prevent high CPU usage

1766

# @default -- See [values.yaml]

1767

lifecycle:

1768

postStart:

1769

exec:

1770

## Note: the reset command hardcodes the master group name `argocd`. If you override `redis-ha.redis.masterGroupName`, you must override this hook to match.

1771

command:

1772

- '/bin/sh'

1773

- '-c'

1774

- 'sleep 30; redis-cli -p 26379 sentinel reset argocd'

1775

## Enables a HA Proxy for better LoadBalancing / Sentinel Master support. Automatically proxies to Redis master.

1776

haproxy:

1777

# -- Enabled HAProxy LoadBalancing/Proxy

1778

enabled: true

1779

# -- Custom labels for the haproxy pod. This is relevant for Argo CD CLI.

1780

labels:

1781

app.kubernetes.io/name: argocd-redis-ha-haproxy

1782

image:

1783

# -- HAProxy Image Repository

1784

repository: ecr-public.aws.com/docker/library/haproxy

1785

metrics:

1786

# -- HAProxy enable prometheus metric scraping

1787

enabled: true

1788

# -- Whether the haproxy pods should be forced to run on separate nodes.

1789

hardAntiAffinity: true

1790

# -- Additional affinities to add to the haproxy pods.

1791

additionalAffinities: {}

1792

# -- Assign custom [affinity] rules to the haproxy pods.

1793

affinity: ""

1794

# -- [Tolerations] for use with node taints for haproxy pods.

1795

tolerations: []

1796

# -- HAProxy container-level security context

1797

# @default -- See [values.yaml]

1798

containerSecurityContext:

1799

readOnlyRootFilesystem: true

1800

# -- Configures redis-ha with AUTH

1801

auth: true

1802

# -- Existing Secret to use for redis-ha authentication.

1803

# By default the redis-secret-init Job is generating this Secret.

1804

existingSecret: argocd-redis

1805

# -- Whether the Redis server pods should be forced to run on separate nodes.

1806

hardAntiAffinity: true

1807

# -- Additional affinities to add to the Redis server pods.

1808

additionalAffinities: {}

1809

# -- Assign custom [affinity] rules to the Redis pods.

1810

affinity: ""

1811

# -- [Tolerations] for use with node taints for Redis pods.

1812

tolerations: []

1813

# -- Assign custom [TopologySpreadConstraints] rules to the Redis pods.

1814

## https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1815

topologySpreadConstraints:

1816

# -- Enable Redis HA topology spread constraints

1817

enabled: false

1818

# -- Max skew of pods tolerated

1819

# @default -- `""` (defaults to `1`)

1820

maxSkew: ""

1821

# -- Topology key for spread

1822

# @default -- `""` (defaults to `topology.kubernetes.io/zone`)

1823

topologyKey: ""

1824

# -- Enforcement policy, hard or soft

1825

# @default -- `""` (defaults to `ScheduleAnyway`)

1826

whenUnsatisfiable: ""

1827

# -- Redis HA statefulset container-level security context

1828

# @default -- See [values.yaml]

1829

containerSecurityContext:

1830

readOnlyRootFilesystem: true

1831

# External Redis parameters

1832

externalRedis:

1833

# -- External Redis server host

1834

host: ""

1835

# -- External Redis username

1836

username: ""

1837

# -- External Redis password

1838

password: ""

1839

# -- External Redis server port

1840

port: 6379

1841

# -- The name of an existing secret with Redis (must contain key `redis-password`. And should contain `redis-username` if username is not `default`) and Sentinel credentials.

1842

# When it's set, the `externalRedis.username` and `externalRedis.password` parameters are ignored

1843

existingSecret: ""

1844

# -- External Redis Secret annotations

1845

secretAnnotations: {}

1846

redisSecretInit:

1847

# -- Enable Redis secret initialization. If disabled, secret must be provisioned by alternative methods

1848

enabled: true

1849

# -- Redis secret-init name

1850

1851

image:

1852

# -- Repository to use for the Redis secret-init Job

1853

# @default -- `""` (defaults to global.image.repository)

1854

repository: "" # defaults to global.image.repository

1855

# -- Tag to use for the Redis secret-init Job

1856

# @default -- `""` (defaults to global.image.tag)

1857

tag: "" # defaults to global.image.tag

1858

# -- Image pull policy for the Redis secret-init Job

1859

# @default -- `""` (defaults to global.image.imagePullPolicy)

1860

imagePullPolicy: "" # IfNotPresent

1861

# -- Additional command line arguments for the Redis secret-init Job

1862

extraArgs: []

1863

# -- Secrets with credentials to pull images from a private registry

1864

# @default -- `[]` (defaults to global.imagePullSecrets)

1865

imagePullSecrets: []

1866

# -- Runtime class name for the Redis secret-init Job

1867

# @default -- `""` (defaults to global.runtimeClassName)

1868

runtimeClassName: ""

1869

# -- Annotations to be added to the Redis secret-init Job

1870

jobAnnotations: {}

1871

# -- Annotations to be added to the Redis secret-init Job

1872

podAnnotations: {}

1873

# -- Labels to be added to the Redis secret-init Job

1874

podLabels: {}

1875

# -- Resource limits and requests for Redis secret-init Job

1876

resources: {}

1877

# limits:

1878

# cpu: 200m

1879

# memory: 128Mi

1880

# requests:

1881

# cpu: 100m

1882

# memory: 64Mi

1883

1884

# -- Application controller container-level security context

1885

# @default -- See [values.yaml]

1886

containerSecurityContext:

1887

allowPrivilegeEscalation: false

1888

capabilities:

1889

drop:

1890

- ALL

1891

readOnlyRootFilesystem: true

1892

runAsNonRoot: true

1893

seccompProfile:

1894

type: RuntimeDefault

1895

# -- Redis secret-init Job pod-level security context

1896

securityContext: {}

1897

serviceAccount:

1898

# -- Create a service account for the redis pod

1899

create: true

1900

# -- Service account name for redis pod

1901

1902

# -- Annotations applied to created service account

1903

annotations: {}

1904

# -- Automount API credentials for the Service Account

1905

automountServiceAccountToken: true

1906

# -- Priority class for Redis secret-init Job

1907

# @default -- `""` (defaults to global.priorityClassName)

1908

priorityClassName: ""

1909

# -- Host Network for redis-secret-init pods

1910

hostNetwork: false

1911

# -- [DNS configuration]

1912

dnsConfig: {}

1913

# -- Alternative DNS policy for Redis secret-init Job

1914

dnsPolicy: "ClusterFirst"

1915

# -- Assign custom [affinity] rules to the Redis secret-init Job

1916

affinity: {}

1917

# -- Node selector to be added to the Redis secret-init Job

1918

# @default -- `{}` (defaults to global.nodeSelector)

1919

nodeSelector: {}

1920

# -- Tolerations to be added to the Redis secret-init Job

1921

# @default -- `[]` (defaults to global.tolerations)

1922

tolerations: []

1923

## Server

1924

server:

1925

# -- Argo CD server name

1926

1927

# -- The number of server pods to run

1928

replicas: 1

1929

# -- Runtime class name for the Argo CD server

1930

# @default -- `""` (defaults to global.runtimeClassName)

1931

runtimeClassName: ""

1932

## Argo CD server Horizontal Pod Autoscaler

1933

autoscaling:

1934

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo CD server

1935

enabled: false

1936

# -- Minimum number of replicas for the Argo CD server [HPA]

1937

minReplicas: 1

1938

# -- Maximum number of replicas for the Argo CD server [HPA]

1939

maxReplicas: 5

1940

# -- Average CPU utilization percentage for the Argo CD server [HPA]

1941

targetCPUUtilizationPercentage: 50

1942

# -- Average memory utilization percentage for the Argo CD server [HPA]

1943

targetMemoryUtilizationPercentage: 50

1944

# -- Configures the scaling behavior of the target in both Up and Down directions.

1945

behavior: {}

1946

# scaleDown:

1947

# stabilizationWindowSeconds: 300

1948

# policies:

1949

# - type: Pods

1950

# value: 1

1951

# periodSeconds: 180

1952

# scaleUp:

1953

# stabilizationWindowSeconds: 300

1954

# policies:

1955

# - type: Pods

1956

# value: 2

1957

# periodSeconds: 60

1958

# -- Configures custom HPA metrics for the Argo CD server

1959

# Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

1960

metrics: []

1961

## Argo CD server Pod Disruption Budget

1962

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1963

pdb:

1964

# -- Deploy a [PodDisruptionBudget] for the Argo CD server

1965

enabled: false

1966

# -- Labels to be added to Argo CD server pdb

1967

labels: {}

1968

# -- Annotations to be added to Argo CD server pdb

1969

annotations: {}

1970

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1971

# @default -- `""` (defaults to 0 if not specified)

1972

minAvailable: ""

1973

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

1974

## Has higher precedence over `server.pdb.minAvailable`

1975

maxUnavailable: ""

1976

## Argo CD server Vertical Pod Autoscaler

1977

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1978

vpa:

1979

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Argo CD server

1980

enabled: false

1981

# -- Labels to be added to Argo CD server vpa

1982

labels: {}

1983

# -- Annotations to be added to Argo CD server vpa

1984

annotations: {}

1985

# -- One of the VPA operation modes

1986

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1987

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1988

updateMode: Initial

1989

# -- Controls how VPA computes the recommended resources for Argo CD server container

1990

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1991

containerPolicy: {}

1992

# controlledResources: ["cpu", "memory"]

1993

# minAllowed:

1994

# cpu: 250m

1995

# memory: 256Mi

1996

# maxAllowed:

1997

# cpu: 1

1998

# memory: 1Gi

1999

2000

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

2001

## NOTE: specify only zero or one recommender as of VPA 1.7.1

2002

recommenders: []

2003

2004

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

2005

startupBoost: {}

2006

# cpu:

2007

# type: Factor

2008

# factor: 2

2009

# durationSeconds: 10

2010

## Argo CD server image

2011

image:

2012

# -- Repository to use for the Argo CD server

2013

# @default -- `""` (defaults to global.image.repository)

2014

repository: "" # defaults to global.image.repository

2015

# -- Tag to use for the Argo CD server

2016

# @default -- `""` (defaults to global.image.tag)

2017

tag: "" # defaults to global.image.tag

2018

# -- Image pull policy for the Argo CD server

2019

# @default -- `""` (defaults to global.image.imagePullPolicy)

2020

imagePullPolicy: "" # IfNotPresent

2021

# -- Secrets with credentials to pull images from a private registry

2022

# @default -- `[]` (defaults to global.imagePullSecrets)

2023

imagePullSecrets: []

2024

# -- Additional command line arguments to pass to Argo CD server

2025

extraArgs: []

2026

# -- Environment variables to pass to Argo CD server

2027

env: []

2028

# -- envFrom to pass to Argo CD server

2029

# @default -- `[]` (See [values.yaml])

2030

envFrom: []

2031

# - configMapRef:

2032

# name: config-map-name

2033

# - secretRef:

2034

# name: secret-name

2035

2036

# -- Specify postStart and preStop lifecycle hooks for your argo-cd-server container

2037

lifecycle: {}

2038

## Argo CD extensions

2039

## This function in tech preview stage, do expect instability or breaking changes in newer versions.

2040

## Ref: https://github.com/argoproj-labs/argocd-extension-installer

2041

## When you enable extensions, you need to configure RBAC of logged in Argo CD user.

2042

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#the-extensions-resource

2043

extensions:

2044

# -- Enable support for Argo CD extensions

2045

enabled: false

2046

## Argo CD extension installer image

2047

image:

2048

# -- Repository to use for extension installer image

2049

repository: cgr.dev/chainguard-private/argocd-extension-installer

2050

# -- Tag to use for extension installer image

2051

tag: 1.1.0@sha256:34e0032e97d278011c77a93a95d17585dd1ed0924d5363aead7a50b57652dcde

2052

# -- Image pull policy for extensions

2053

# @default -- `""` (defaults to global.image.imagePullPolicy)

2054

imagePullPolicy: ""

2055

# -- Extensions for Argo CD

2056

# @default -- `[]` (See [values.yaml])

2057

## Ref: https://github.com/argoproj-labs/argocd-extension-metrics#install-ui-extension

2058

extensionList: []

2059

# - name: extension-metrics

2060

# env:

2061

# - name: EXTENSION_URL

2062

# value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension.tar.gz

2063

# - name: EXTENSION_CHECKSUM_URL

2064

# value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension_checksums.txt

2065

2066

# -- Server UI extensions container-level security context

2067

# @default -- See [values.yaml]

2068

containerSecurityContext:

2069

runAsNonRoot: true

2070

readOnlyRootFilesystem: true

2071

allowPrivilegeEscalation: false

2072

runAsUser: 1000

2073

seccompProfile:

2074

type: RuntimeDefault

2075

capabilities:

2076

drop:

2077

- ALL

2078

# -- Resource limits and requests for the argocd-extensions container

2079

resources: {}

2080

# limits:

2081

# cpu: 50m

2082

# memory: 128Mi

2083

# requests:

2084

# cpu: 10m

2085

# memory: 64Mi

2086

# -- Additional containers to be added to the server pod

2087

## Note: Supports use of custom Helm templates

2088

extraContainers: []

2089

# - name: my-sidecar

2090

# image: nginx:latest

2091

# - name: lemonldap-ng-controller

2092

# image: lemonldapng/lemonldap-ng-controller:0.2.0

2093

# args:

2094

# - /lemonldap-ng-controller

2095

# - --alsologtostderr

2096

# - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration

2097

# env:

2098

# - name: POD_NAME

2099

# valueFrom:

2100

# fieldRef:

2101

# fieldPath: metadata.name

2102

# - name: POD_NAMESPACE

2103

# valueFrom:

2104

# fieldRef:

2105

# fieldPath: metadata.namespace

2106

# volumeMounts:

2107

# - name: copy-portal-skins

2108

# mountPath: /srv/var/lib/lemonldap-ng/portal/skins

2109

2110

# -- Init containers to add to the server pod

2111

## If your target Kubernetes cluster(s) require a custom credential (exec) plugin

2112

## you could use this (and the same in the application controller pod) to provide such executable

2113

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

2114

initContainers: []

2115

# - name: download-tools

2116

# image: alpine:3

2117

# command: [sh, -c]

2118

# args:

2119

# - wget -qO /custom-tools/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.7/kubelogin-linux-amd64.zip &&

2120

# mkdir /custom-tools/tmp && unzip -d /custom-tools/tmp /custom-tools/kubelogin.zip &&

2121

# mv /custom-tools/tmp/bin/linux_amd64/kubelogin /custom-tools/ && rm -rf custom-tools/tmp && rm /custom-tools/kubelogin.zip

2122

# volumeMounts:

2123

# - mountPath: /custom-tools

2124

# name: custom-tools

2125

2126

# -- Additional volumeMounts to the server main container

2127

volumeMounts: []

2128

# - mountPath: /usr/local/bin/kubelogin

2129

# name: custom-tools

2130

# subPath: kubelogin

2131

2132

# -- Additional volumes to the server pod

2133

volumes: []

2134

# - name: custom-tools

2135

# emptyDir: {}

2136

2137

## Argo CD server emptyDir volumes

2138

emptyDir:

2139

# -- EmptyDir size limit for the Argo CD server

2140

# @default -- `""` (defaults not set if not specified i.e. no size limit)

2141

sizeLimit: ""

2142

# sizeLimit: "1Gi"

2143

# -- Annotations to be added to server Deployment

2144

deploymentAnnotations: {}

2145

# -- Labels for the server Deployment

2146

deploymentLabels: {}

2147

# -- Annotations to be added to server pods

2148

podAnnotations: {}

2149

# -- Labels to be added to server pods

2150

podLabels: {}

2151

# -- Resource limits and requests for the Argo CD server

2152

resources: {}

2153

# limits:

2154

# cpu: 100m

2155

# memory: 128Mi

2156

# requests:

2157

# cpu: 50m

2158

# memory: 64Mi

2159

2160

# Server container ports

2161

containerPorts:

2162

# -- Server container port

2163

server: 8080

2164

# -- Metrics container port

2165

metrics: 8083

2166

# -- Host Network for Server pods

2167

hostNetwork: false

2168

# -- [DNS configuration]

2169

dnsConfig: {}

2170

# -- Alternative DNS policy for Server pods

2171

dnsPolicy: "ClusterFirst"

2172

# -- Server container-level security context

2173

# @default -- See [values.yaml]

2174

containerSecurityContext:

2175

runAsNonRoot: true

2176

readOnlyRootFilesystem: true

2177

allowPrivilegeEscalation: false

2178

seccompProfile:

2179

type: RuntimeDefault

2180

capabilities:

2181

drop:

2182

- ALL

2183

## Readiness and liveness probes for default backend

2184

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2185

readinessProbe:

2186

# -- Enable Kubernetes readiness probe for default backend

2187

enabled: true

2188

# -- Http path to use for the readiness probe

2189

httpPath: /healthz

2190

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2191

failureThreshold: 3

2192

# -- Number of seconds after the container has started before [probe] is initiated

2193

initialDelaySeconds: 10

2194

# -- How often (in seconds) to perform the [probe]

2195

periodSeconds: 10

2196

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2197

successThreshold: 1

2198

# -- Number of seconds after which the [probe] times out

2199

timeoutSeconds: 1

2200

livenessProbe:

2201

# -- Enable Kubernetes liveness probe for default backend

2202

enabled: true

2203

# -- Http path to use for the liveness probe

2204

httpPath: /healthz?full=true

2205

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2206

failureThreshold: 3

2207

# -- Number of seconds after the container has started before [probe] is initiated

2208

initialDelaySeconds: 10

2209

# -- How often (in seconds) to perform the [probe]

2210

periodSeconds: 10

2211

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2212

successThreshold: 1

2213

# -- Number of seconds after which the [probe] times out

2214

timeoutSeconds: 1

2215

## Startup probe for Argo CD server (optional)

2216

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2217

startupProbe:

2218

# -- Enable Kubernetes startup probe for Argo CD server

2219

enabled: false

2220

# -- Http path to use for the startup probe

2221

httpPath: /healthz

2222

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2223

failureThreshold: 20

2224

# -- Number of seconds after the container has started before [probe] is initiated

2225

initialDelaySeconds: 10

2226

# -- How often (in seconds) to perform the [probe]

2227

periodSeconds: 10

2228

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2229

successThreshold: 1

2230

# -- Number of seconds after which the [probe] times out

2231

timeoutSeconds: 1

2232

# -- terminationGracePeriodSeconds for container lifecycle hook

2233

terminationGracePeriodSeconds: 30

2234

# -- Priority class for the Argo CD server pods

2235

# @default -- `""` (defaults to global.priorityClassName)

2236

priorityClassName: ""

2237

# -- [Node selector]

2238

# @default -- `{}` (defaults to global.nodeSelector)

2239

nodeSelector: {}

2240

# -- [Tolerations] for use with node taints

2241

# @default -- `[]` (defaults to global.tolerations)

2242

tolerations: []

2243

# -- Assign custom [affinity] rules to the deployment

2244

# @default -- `{}` (defaults to global.affinity preset)

2245

affinity: {}

2246

# -- Assign custom [TopologySpreadConstraints] rules to the Argo CD server

2247

# @default -- `[]` (defaults to global.topologySpreadConstraints)

2248

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

2249

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

2250

topologySpreadConstraints: []

2251

# - maxSkew: 1

2252

# topologyKey: topology.kubernetes.io/zone

2253

# whenUnsatisfiable: DoNotSchedule

2254

2255

# -- Deployment strategy to be added to the server Deployment

2256

deploymentStrategy: {}

2257

# type: RollingUpdate

2258

# rollingUpdate:

2259

# maxSurge: 25%

2260

# maxUnavailable: 25%

2261

2262

# TLS certificate configuration via cert-manager

2263

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server

2264

certificate:

2265

# -- Deploy a Certificate resource (requires cert-manager)

2266

enabled: false

2267

# -- Certificate primary domain (commonName)

2268

# @default -- `""` (defaults to global.domain)

2269

domain: ""

2270

# -- Certificate Subject Alternate Names (SANs)

2271

additionalHosts: []

2272

# -- The requested 'duration' (i.e. lifetime) of the certificate.

2273

# @default -- `""` (defaults to 2160h = 90d if not specified)

2274

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

2275

duration: ""

2276

# -- How long before the expiry a certificate should be renewed.

2277

# @default -- `""` (defaults to 360h = 15d if not specified)

2278

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

2279

renewBefore: ""

2280

# Certificate issuer

2281

## Ref: https://cert-manager.io/docs/concepts/issuer

2282

issuer:

2283

# -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io`

2284

group: ""

2285

# -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer`

2286

kind: ""

2287

# -- Certificate issuer name. Eg. `letsencrypt`

2288

2289

# Private key of the certificate

2290

privateKey:

2291

# -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always`

2292

rotationPolicy: Never

2293

# -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8`

2294

encoding: PKCS1

2295

# -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA`

2296

algorithm: RSA

2297

# -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored.

2298

size: 2048

2299

# -- Annotations to be applied to the Server Certificate

2300

annotations: {}

2301

# -- Usages for the certificate

2302

### Ref: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage

2303

usages: []

2304

# -- Annotations that allow the certificate to be composed from data residing in existing Kubernetes Resources

2305

secretTemplateAnnotations: {}

2306

# TLS certificate configuration via Secret

2307

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server

2308

certificateSecret:

2309

# -- Create argocd-server-tls secret

2310

enabled: false

2311

# -- Annotations to be added to argocd-server-tls secret

2312

annotations: {}

2313

# -- Labels to be added to argocd-server-tls secret

2314

labels: {}

2315

# -- Private Key of the certificate

2316

key: ""

2317

# -- Certificate data

2318

crt: ""

2319

## Server service configuration

2320

service:

2321

# -- Server service annotations

2322

annotations: {}

2323

# -- Server service labels

2324

labels: {}

2325

# -- Server service type

2326

type: ClusterIP

2327

# -- Server service http port for NodePort service type (only if `server.service.type` is set to "NodePort")

2328

nodePortHttp: 30080

2329

# -- (int) Server service http2 port for NodePort service type (only if `server.service.servicePortHttp2` is set and `server.service.type` is set to "NodePort")

2330

# @default -- `nil` (a random node port is assigned)

2331

nodePortHttp2:

2332

# -- Server service https port for NodePort service type (only if `server.service.type` is set to "NodePort")

2333

nodePortHttps: 30443

2334

# -- Server service http port

2335

servicePortHttp: 80

2336

# -- (int) Server service cleartext http2 (h2c) port, targeting the same container port as `servicePortHttp`

2337

# @default -- `nil` (disabled)

2338

## The Argo CD server serves the web UI (HTTP/1.1) and gRPC (HTTP/2) on a single container port, and

2339

## `appProtocol` is single-valued per service port. Set this to expose a second port advertising the

2340

## h2c backend protocol, for Gateway API implementations that do not infer it from the route type.

2341

## Leave empty to disable. Only rendered when `configs.params."server.insecure"` is `true`, since

2342

## h2c is not applicable to a TLS backend.

2343

servicePortHttp2:

2344

# -- Server service https port

2345

servicePortHttps: 443

2346

# -- Server service http port name, can be used to route traffic via istio

2347

servicePortHttpName: http

2348

# -- Server service http2 port name, can be used to route traffic via istio

2349

servicePortHttp2Name: http2

2350

# -- Server service https port name, can be used to route traffic via istio

2351

servicePortHttpsName: https

2352

# -- Server service http2 port appProtocol, e.g. `kubernetes.io/h2c`. Implementations that select the

2353

# protocol from the port name instead do not need it

2354

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol

2355

servicePortHttp2AppProtocol: ""

2356

# -- Server service https port appProtocol

2357

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol

2358

servicePortHttpsAppProtocol: ""

2359

# -- The class of the load balancer implementation

2360

loadBalancerClass: ""

2361

# -- LoadBalancer will get created with the IP specified in this field

2362

loadBalancerIP: ""

2363

# -- Source IP ranges to allow access to service from

2364

## EKS Ref: https://repost.aws/knowledge-center/eks-cidr-ip-address-loadbalancer

2365

## GKE Ref: https://cloud.google.com/kubernetes-engine/docs/concepts/network-overview#limit-connectivity-ext-lb

2366

loadBalancerSourceRanges: []

2367

# -- Server service external IPs

2368

externalIPs: []

2369

# -- Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

2370

## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

2371

externalTrafficPolicy: Cluster

2372

# -- Used to maintain session affinity. Supports `ClientIP` and `None`

2373

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

2374

sessionAffinity: None

2375

## Server metrics service configuration

2376

metrics:

2377

# -- Deploy metrics service

2378

enabled: false

2379

service:

2380

# -- Metrics service type

2381

type: ClusterIP

2382

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

2383

clusterIP: ""

2384

# -- Metrics service annotations

2385

annotations: {}

2386

# -- Metrics service labels

2387

labels: {}

2388

# -- Metrics service port

2389

servicePort: 8083

2390

# -- Metrics service port name

2391

portName: http-metrics

2392

serviceMonitor:

2393

# -- Enable a prometheus ServiceMonitor

2394

enabled: false

2395

# -- Prometheus ServiceMonitor interval

2396

interval: 30s

2397

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

2398

scrapeTimeout: ""

2399

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

2400

honorLabels: false

2401

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

2402

relabelings: []

2403

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

2404

metricRelabelings: []

2405

# -- Prometheus ServiceMonitor selector

2406

selector: {}

2407

# prometheus: kube-prometheus

2408

2409

# -- Prometheus ServiceMonitor scheme

2410

scheme: ""

2411

# -- Prometheus ServiceMonitor tlsConfig

2412

tlsConfig: {}

2413

# -- Prometheus ServiceMonitor namespace

2414

namespace: "" # monitoring

2415

# -- Prometheus ServiceMonitor labels

2416

additionalLabels: {}

2417

# -- Prometheus ServiceMonitor annotations

2418

annotations: {}

2419

# -- Automount API credentials for the Service Account into the pod.

2420

automountServiceAccountToken: true

2421

serviceAccount:

2422

# -- Create server service account

2423

create: true

2424

# -- Server service account name

2425

2426

# -- Annotations applied to created service account

2427

annotations: {}

2428

# -- Labels applied to created service account

2429

labels: {}

2430

# -- Automount API credentials for the Service Account

2431

automountServiceAccountToken: true

2432

# Argo CD server ingress configuration

2433

ingress:

2434

# -- Enable an ingress resource for the Argo CD server

2435

enabled: false

2436

# -- Specific implementation for ingress controller. One of `generic`, `aws` or `gke`

2437

## Additional configuration might be required in related configuration sections

2438

controller: generic

2439

# -- Additional ingress labels

2440

labels: {}

2441

# -- Additional ingress annotations

2442

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough

2443

annotations: {}

2444

# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

2445

# nginx.ingress.kubernetes.io/ssl-passthrough: "true"

2446

2447

# -- Defines which ingress controller will implement the resource

2448

ingressClassName: ""

2449

# -- Argo CD server hostname

2450

# @default -- `""` (defaults to global.domain)

2451

hostname: ""

2452

# -- The path to Argo CD server

2453

path: /

2454

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

2455

pathType: Prefix

2456

# -- Enable TLS configuration for the hostname defined at `server.ingress.hostname`

2457

## TLS certificate will be retrieved from a TLS secret `argocd-server-tls`

2458

## You can create this secret via `certificate` or `certificateSecret` option

2459

tls: false

2460

# -- The list of additional hostnames to be covered by ingress record

2461

# @default -- `[]` (See [values.yaml])

2462

extraHosts: []

2463

# - name: argocd.example.com

2464

# path: /

2465

2466

# -- Additional ingress paths

2467

# @default -- `[]` (See [values.yaml])

2468

## Note: Supports use of custom Helm templates

2469

extraPaths: []

2470

# - path: /*

2471

# pathType: Prefix

2472

# backend:

2473

# service:

2474

# name: ssl-redirect

2475

# port:

2476

# name: use-annotation

2477

2478

# -- Additional ingress rules

2479

# @default -- `[]` (See [values.yaml])

2480

## Note: Supports use of custom Helm templates

2481

extraRules: []

2482

# - http:

2483

# paths:

2484

# - path: /

2485

# pathType: Prefix

2486

# backend:

2487

# service:

2488

# name: '{{ include "argo-cd.server.fullname" . }}'

2489

# port:

2490

# name: '{{ .Values.server.service.servicePortHttpsName }}'

2491

2492

# -- Additional TLS configuration

2493

# @default -- `[]` (See [values.yaml])

2494

extraTls: []

2495

# - hosts:

2496

# - argocd.example.com

2497

# secretName: your-certificate-name

2498

2499

# AWS specific options for Application Load Balancer

2500

# Applies only when `serv.ingress.controller` is set to `aws`

2501

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#aws-application-load-balancers-albs-and-classic-elb-http-mode

2502

aws:

2503

# -- Backend protocol version for the AWS ALB gRPC service

2504

## This tells AWS to send traffic from the ALB using gRPC.

2505

## For more information: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html#health-check-settings

2506

backendProtocolVersion: GRPC

2507

# -- Service type for the AWS ALB gRPC service

2508

## Can be of type NodePort or ClusterIP depending on which mode you are running.

2509

## Instance mode needs type NodePort, IP mode needs type ClusterIP

2510

## Ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/how-it-works/#ingress-traffic

2511

serviceType: NodePort

2512

# -- Annotations for the AWS ALB gRPC service

2513

## Allows adding custom annotations to the gRPC service for integrations like DataDog, Prometheus, etc.

2514

serviceAnnotations: {}

2515

# Google specific options for Google Application Load Balancer

2516

# Applies only when `server.ingress.controller` is set to `gke`

2517

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#google-cloud-load-balancers-with-kubernetes-ingress

2518

gke:

2519

# -- Google [BackendConfig] resource, for use with the GKE Ingress Controller

2520

# @default -- `{}` (See [values.yaml])

2521

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

2522

backendConfig: {}

2523

# iap:

2524

# enabled: true

2525

# oauthclientCredentials:

2526

# secretName: argocd-secret

2527

2528

# -- Google [FrontendConfig] resource, for use with the GKE Ingress Controller

2529

# @default -- `{}` (See [values.yaml])

2530

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

2531

frontendConfig: {}

2532

# redirectToHttps:

2533

# enabled: true

2534

# responseCodeName: RESPONSE_CODE

2535

2536

# Managed GKE certificate for ingress hostname

2537

managedCertificate:

2538

# -- Create ManagedCertificate resource and annotations for Google Load balancer

2539

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs

2540

create: true

2541

# -- Additional domains for ManagedCertificate resource

2542

extraDomains: []

2543

# - argocd.example.com

2544

# Dedicated gRPC ingress for ingress controllers that supports only single backend protocol per Ingress resource

2545

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-2-multiple-ingress-objects-and-hosts

2546

ingressGrpc:

2547

# -- Enable an ingress resource for the Argo CD server for dedicated [gRPC-ingress]

2548

enabled: false

2549

# -- Additional ingress annotations for dedicated [gRPC-ingress]

2550

annotations: {}

2551

# -- Additional ingress labels for dedicated [gRPC-ingress]

2552

labels: {}

2553

# -- Defines which ingress controller will implement the resource [gRPC-ingress]

2554

ingressClassName: ""

2555

# -- Argo CD server hostname for dedicated [gRPC-ingress]

2556

# @default -- `""` (defaults to grpc.`server.ingress.hostname`)

2557

hostname: ""

2558

# -- Argo CD server ingress path for dedicated [gRPC-ingress]

2559

path: /

2560

# -- Ingress path type for dedicated [gRPC-ingress]. One of `Exact`, `Prefix` or `ImplementationSpecific`

2561

pathType: Prefix

2562

# -- Enable TLS configuration for the hostname defined at `server.ingressGrpc.hostname`

2563

## TLS certificate will be retrieved from a TLS secret with name: `argocd-server-grpc-tls`

2564

tls: false

2565

# -- The list of additional hostnames to be covered by ingress record

2566

# @default -- `[]` (See [values.yaml])

2567

extraHosts: []

2568

# - name: grpc.argocd.example.com

2569

# path: /

2570

2571

# -- Additional ingress paths for dedicated [gRPC-ingress]

2572

# @default -- `[]` (See [values.yaml])

2573

## Note: Supports use of custom Helm templates

2574

extraPaths: []

2575

# - path: /*

2576

# pathType: Prefix

2577

# backend:

2578

# service:

2579

# name: ssl-redirect

2580

# port:

2581

# name: use-annotation

2582

2583

# -- Additional ingress rules

2584

# @default -- `[]` (See [values.yaml])

2585

## Note: Supports use of custom Helm templates

2586

extraRules: []

2587

# - http:

2588

# paths:

2589

# - path: /

2590

# pathType: Prefix

2591

# backend:

2592

# service:

2593

# name: '{{ include "argo-cd.server.fullname" . }}'

2594

# port:

2595

# name: '{{ .Values.server.service.servicePortHttpName }}'

2596

2597

# -- Additional TLS configuration for dedicated [gRPC-ingress]

2598

# @default -- `[]` (See [values.yaml])

2599

extraTls: []

2600

# - secretName: your-certificate-name

2601

# hosts:

2602

# - argocd.example.com

2603

# Create a OpenShift Route with SSL passthrough for UI and CLI

2604

# Consider setting 'hostname' e.g. https://argocd.apps-crc.testing/ using your Default Ingress Controller Domain

2605

# Find your domain with: kubectl describe --namespace=openshift-ingress-operator ingresscontroller/default | grep Domain:

2606

# If 'hostname' is an empty string "" OpenShift will create a hostname for you.

2607

route:

2608

# -- Enable an OpenShift Route for the Argo CD server

2609

enabled: false

2610

# -- Openshift Route annotations

2611

annotations: {}

2612

# -- Hostname of OpenShift Route

2613

hostname: ""

2614

# -- Termination type of Openshift Route

2615

termination_type: passthrough

2616

# -- Termination policy of Openshift Route

2617

termination_policy: None

2618

# Gateway API HTTPRoute configuration

2619

# NOTE: Gateway API support is in EXPERIMENTAL status

2620

# Support depends on your Gateway controller implementation

2621

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

2622

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

2623

httproute:

2624

# -- Enable HTTPRoute resource for Argo CD server (Gateway API)

2625

enabled: false

2626

# -- Additional HTTPRoute labels

2627

labels: {}

2628

# -- Additional HTTPRoute annotations

2629

annotations: {}

2630

# -- Gateway API parentRefs for the HTTPRoute

2631

## Must reference an existing Gateway

2632

# @default -- `[]` (See [values.yaml])

2633

parentRefs: []

2634

# - name: example-gateway

2635

# namespace: example-gateway-namespace

2636

# sectionName: https

2637

# -- List of hostnames for the HTTPRoute

2638

# @default -- `[]` (See [values.yaml])

2639

hostnames: []

2640

# - argocd.example.com

2641

# -- HTTPRoute rules configuration

2642

# @default -- `[]` (See [values.yaml])

2643

rules:

2644

- matches:

2645

- path:

2646

type: PathPrefix

2647

value: /

2648

# filters: []

2649

# - type: RequestHeaderModifier

2650

# requestHeaderModifier:

2651

# add:

2652

# - name: X-Custom-Header

2653

# value: custom-value

2654

# timeouts:

2655

# request: 10s

2656

# backendRequest: 2s

2657

# Gateway API GRPCRoute configuration

2658

# NOTE: Gateway API support is in EXPERIMENTAL status

2659

# Support depends on your Gateway controller implementation

2660

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

2661

grpcroute:

2662

# -- Enable GRPCRoute resource for Argo CD server (Gateway API)

2663

enabled: false

2664

# -- Additional GRPCRoute labels

2665

labels: {}

2666

# -- Additional GRPCRoute annotations

2667

annotations: {}

2668

# -- Gateway API parentRefs for the GRPCRoute

2669

## Must reference an existing Gateway

2670

# @default -- `[]` (See [values.yaml])

2671

parentRefs: []

2672

# - name: example-gateway

2673

# namespace: example-gateway-namespace

2674

# sectionName: grpc

2675

# -- List of hostnames for the GRPCRoute

2676

# @default -- `[]` (See [values.yaml])

2677

hostnames: []

2678

# - grpc.argocd.example.com

2679

# -- GRPCRoute rules configuration

2680

# @default -- `[]` (See [values.yaml])

2681

rules:

2682

- matches:

2683

- method:

2684

type: Exact

2685

# filters: []

2686

# - type: RequestHeaderModifier

2687

# requestHeaderModifier:

2688

# add:

2689

# - name: X-Custom-Header

2690

# value: custom-value

2691

# Gateway API BackendTLSPolicy configuration

2692

# NOTE: BackendTLSPolicy support is in EXPERIMENTAL status

2693

# Required for HTTPS backends when using Gateway API

2694

# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)

2695

backendTLSPolicy:

2696

# -- Enable BackendTLSPolicy resource for Argo CD server (Gateway API)

2697

enabled: false

2698

# -- Additional BackendTLSPolicy labels

2699

labels: {}

2700

# -- Additional BackendTLSPolicy annotations

2701

annotations: {}

2702

# -- Target references for the BackendTLSPolicy

2703

# @default -- `[]` (See [values.yaml])

2704

targetRefs: []

2705

# - group: ""

2706

# kind: Service

2707

# name: argocd-server

2708

# sectionName: https

2709

# -- TLS validation configuration

2710

# @default -- `{}` (See [values.yaml])

2711

validation: {}

2712

# hostname: argocd-server.argocd.svc.cluster.local

2713

# caCertificateRefs:

2714

# - name: example-ca-cert

2715

# group: ""

2716

# kind: ConfigMap

2717

# wellKnownCACertificates: System

2718

# Gateway API ListenerSet configuration

2719

# NOTE: Gateway API support is in EXPERIMENTAL status

2720

# ListenerSet allows attaching additional listeners to an existing Gateway

2721

# Requires Gateway API v1alpha2 and a controller that supports ListenerSet

2722

# Refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.ListenerSet

2723

listenerset:

2724

# -- Enable ListenerSet resource for Argo CD server (Gateway API)

2725

enabled: false

2726

# -- Additional ListenerSet labels

2727

labels: {}

2728

# -- Additional ListenerSet annotations

2729

annotations: {}

2730

# -- Gateway API parentRef for the ListenerSet

2731

## Must reference an existing Gateway. Unlike HTTPRoute, ListenerSet accepts exactly one parentRef.

2732

# @default -- `{}` (See [values.yaml])

2733

parentRef: {}

2734

# name: example-gateway

2735

# namespace: example-gateway-namespace

2736

# -- Hostname for the synthesized listener. Defaults to global.domain when empty.

2737

hostname: ""

2738

# -- Name of the synthesized listener. Also used as sectionName in auto-derived httproute parentRefs.

2739

listenerName: https

2740

# -- Port for the synthesized listener

2741

port: 443

2742

# -- Protocol for the synthesized listener

2743

protocol: HTTPS

2744

# -- TLS configuration for the synthesized listener

2745

tls:

2746

# -- Enable TLS on the synthesized listener

2747

enabled: true

2748

# -- TLS termination mode

2749

mode: Terminate

2750

# -- Secret name for TLS certificate. Defaults to `argocd-server-tls` when empty.

2751

secretName: ""

2752

# -- allowedRoutes for the synthesized listener

2753

allowedRoutes:

2754

namespaces:

2755

from: Same

2756

# -- Listeners to attach to the parent Gateway. When non-empty, used verbatim and all synthesized listener fields above are ignored.

2757

# @default -- `[]` (See [values.yaml])

2758

listeners: []

2759

# - name: https

2760

# port: 443

2761

# protocol: HTTPS

2762

# hostname: argocd.example.com

2763

# tls:

2764

# mode: Terminate

2765

# certificateRefs:

2766

# - group: ""

2767

# kind: Secret

2768

# name: argocd-server-tls

2769

# allowedRoutes:

2770

# namespaces:

2771

# from: Same

2772

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

2773

## Defaults to off

2774

clusterRoleRules:

2775

# -- Enable custom rules for the server's ClusterRole resource

2776

enabled: false

2777

# -- List of custom rules for the server's ClusterRole resource

2778

rules: []

2779

# Default ArgoCD Server's network policy

2780

networkPolicy:

2781

# -- Default network policy rules used by ArgoCD Server

2782

# @default -- `false` (defaults to global.networkPolicy.create)

2783

create: false

2784

## Repo Server

2785

repoServer:

2786

# -- Repo server name

2787

2788

# -- The number of repo server pods to run

2789

replicas: 1

2790

# -- Runtime class name for the repo server

2791

# @default -- `""` (defaults to global.runtimeClassName)

2792

runtimeClassName: ""

2793

## Repo server Horizontal Pod Autoscaler

2794

autoscaling:

2795

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the repo server

2796

enabled: false

2797

# -- Minimum number of replicas for the repo server [HPA]

2798

minReplicas: 1

2799

# -- Maximum number of replicas for the repo server [HPA]

2800

maxReplicas: 5

2801

# -- Average CPU utilization percentage for the repo server [HPA]

2802

targetCPUUtilizationPercentage: 50

2803

# -- Average memory utilization percentage for the repo server [HPA]

2804

targetMemoryUtilizationPercentage: 50

2805

# -- Configures the scaling behavior of the target in both Up and Down directions.

2806

behavior: {}

2807

# scaleDown:

2808

# stabilizationWindowSeconds: 300

2809

# policies:

2810

# - type: Pods

2811

# value: 1

2812

# periodSeconds: 180

2813

# scaleUp:

2814

# stabilizationWindowSeconds: 300

2815

# policies:

2816

# - type: Pods

2817

# value: 2

2818

# periodSeconds: 60

2819

# -- Configures custom HPA metrics for the Argo CD repo server

2820

# Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

2821

metrics: []

2822

## Repo server Pod Disruption Budget

2823

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

2824

pdb:

2825

# -- Deploy a [PodDisruptionBudget] for the repo server

2826

enabled: false

2827

# -- Labels to be added to repo server pdb

2828

labels: {}

2829

# -- Annotations to be added to repo server pdb

2830

annotations: {}

2831

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

2832

# @default -- `""` (defaults to 0 if not specified)

2833

minAvailable: ""

2834

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

2835

## Has higher precedence over `repoServer.pdb.minAvailable`

2836

maxUnavailable: ""

2837

## Repo server Vertical Pod Autoscaler

2838

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

2839

vpa:

2840

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the repo server

2841

enabled: false

2842

# -- Labels to be added to repo server vpa

2843

labels: {}

2844

# -- Annotations to be added to repo server vpa

2845

annotations: {}

2846

# -- One of the VPA operation modes

2847

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

2848

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

2849

updateMode: Initial

2850

# -- Controls how VPA computes the recommended resources for repo server container

2851

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

2852

containerPolicy: {}

2853

# controlledResources: ["cpu", "memory"]

2854

# minAllowed:

2855

# cpu: 250m

2856

# memory: 256Mi

2857

# maxAllowed:

2858

# cpu: 1

2859

# memory: 1Gi

2860

2861

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

2862

## NOTE: specify only zero or one recommender as of VPA 1.7.1

2863

recommenders: []

2864

2865

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

2866

startupBoost: {}

2867

# cpu:

2868

# type: Factor

2869

# factor: 2

2870

# durationSeconds: 10

2871

## Repo server image

2872

image:

2873

# -- Repository to use for the repo server

2874

# @default -- `""` (defaults to global.image.repository)

2875

repository: ""

2876

# -- Tag to use for the repo server

2877

# @default -- `""` (defaults to global.image.tag)

2878

tag: ""

2879

# -- Image pull policy for the repo server

2880

# @default -- `""` (defaults to global.image.imagePullPolicy)

2881

imagePullPolicy: ""

2882

# -- Secrets with credentials to pull images from a private registry

2883

# @default -- `[]` (defaults to global.imagePullSecrets)

2884

imagePullSecrets: []

2885

# -- Additional command line arguments to pass to repo server

2886

extraArgs: []

2887

# -- Environment variables to pass to repo server

2888

env: []

2889

# -- envFrom to pass to repo server

2890

# @default -- `[]` (See [values.yaml])

2891

envFrom: []

2892

# - configMapRef:

2893

# name: config-map-name

2894

# - secretRef:

2895

# name: secret-name

2896

2897

# -- Specify postStart and preStop lifecycle hooks for your argo-repo-server container

2898

lifecycle: {}

2899

# -- Additional containers to be added to the repo server pod

2900

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/

2901

## Note: Supports use of custom Helm templates

2902

extraContainers: []

2903

# - name: cmp-my-plugin

2904

# command:

2905

# - "/var/run/argocd/argocd-cmp-server"

2906

# image: busybox

2907

# securityContext:

2908

# runAsNonRoot: true

2909

# runAsUser: 999

2910

# volumeMounts:

2911

# - mountPath: /var/run/argocd

2912

# name: var-files

2913

# - mountPath: /home/argocd/cmp-server/plugins

2914

# name: plugins

2915

# # Remove this volumeMount if you've chosen to bake the config file into the sidecar image.

2916

# - mountPath: /home/argocd/cmp-server/config/plugin.yaml

2917

# subPath: my-plugin.yaml

2918

# name: argocd-cmp-cm

2919

# # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps

2920

# # mitigate path traversal attacks.

2921

# - mountPath: /tmp

2922

# name: cmp-tmp

2923

# - name: cmp-my-plugin2

2924

# command:

2925

# - "/var/run/argocd/argocd-cmp-server"

2926

# image: busybox

2927

# securityContext:

2928

# runAsNonRoot: true

2929

# runAsUser: 999

2930

# volumeMounts:

2931

# - mountPath: /var/run/argocd

2932

# name: var-files

2933

# # Remove this volumeMount if you've chosen to bake the config file into the sidecar image.

2934

# - mountPath: /home/argocd/cmp-server/plugins

2935

# name: plugins

2936

# - mountPath: /home/argocd/cmp-server/config/plugin.yaml

2937

# subPath: my-plugin2.yaml

2938

# name: argocd-cmp-cm

2939

# # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps

2940

# # mitigate path traversal attacks.

2941

# - mountPath: /tmp

2942

# name: cmp-tmp

2943

2944

# -- Init containers to add to the repo server pods

2945

initContainers: []

2946

copyutil:

2947

# -- Extra arguments for the cp command in the repo server copyutil initContainer

2948

# @default -- `"--update=none"`

2949

extraArgs: "--update=none"

2950

# -- Resource limits and requests for the repo server copyutil initContainer

2951

resources: {}

2952

# limits:

2953

# cpu: 100m

2954

# memory: 128Mi

2955

# requests:

2956

# cpu: 50m

2957

# memory: 64Mi

2958

# -- Additional volumeMounts to the repo server main container

2959

volumeMounts: []

2960

# -- Additional volumes to the repo server pod

2961

volumes: []

2962

# - name: argocd-cmp-cm

2963

# configMap:

2964

# name: argocd-cmp-cm

2965

# - name: cmp-tmp

2966

# emptyDir: {}

2967

2968

# -- Volumes to be used in replacement of emptydir on default volumes

2969

existingVolumes: {}

2970

# gpgKeyring:

2971

# persistentVolumeClaim:

2972

# claimName: pvc-argocd-repo-server-keyring

2973

# helmWorkingDir:

2974

# persistentVolumeClaim:

2975

# claimName: pvc-argocd-repo-server-workdir

2976

# tmp:

2977

# persistentVolumeClaim:

2978

# claimName: pvc-argocd-repo-server-tmp

2979

# varFiles:

2980

# persistentVolumeClaim:

2981

# claimName: pvc-argocd-repo-server-varfiles

2982

# plugins:

2983

# persistentVolumeClaim:

2984

# claimName: pvc-argocd-repo-server-plugins

2985

2986

## RepoServer emptyDir volumes

2987

emptyDir:

2988

# -- EmptyDir size limit for repo server

2989

# @default -- `""` (defaults not set if not specified i.e. no size limit)

2990

sizeLimit: ""

2991

# sizeLimit: "1Gi"

2992

# -- Toggle the usage of a ephemeral Helm working directory

2993

useEphemeralHelmWorkingDir: true

2994

# -- Annotations to be added to repo server Deployment

2995

deploymentAnnotations: {}

2996

# -- Labels for the repo server Deployment

2997

deploymentLabels: {}

2998

# -- Annotations to be added to repo server pods

2999

podAnnotations: {}

3000

# -- Labels to be added to repo server pods

3001

podLabels: {}

3002

# -- Resource limits and requests for the repo server pods

3003

resources: {}

3004

# limits:

3005

# cpu: 50m

3006

# memory: 128Mi

3007

# requests:

3008

# cpu: 10m

3009

# memory: 64Mi

3010

3011

# Repo server container ports

3012

containerPorts:

3013

# -- Repo server container port

3014

server: 8081

3015

# -- Metrics container port

3016

metrics: 8084

3017

# -- Host Network for Repo server pods

3018

hostNetwork: false

3019

# -- [DNS configuration]

3020

dnsConfig: {}

3021

# -- Alternative DNS policy for Repo server pods

3022

dnsPolicy: "ClusterFirst"

3023

# -- Repo server container-level security context

3024

# @default -- See [values.yaml]

3025

containerSecurityContext:

3026

runAsNonRoot: true

3027

readOnlyRootFilesystem: true

3028

allowPrivilegeEscalation: false

3029

seccompProfile:

3030

type: RuntimeDefault

3031

capabilities:

3032

drop:

3033

- ALL

3034

## Readiness and liveness probes for Repo Server

3035

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3036

readinessProbe:

3037

# -- Enable Kubernetes readiness probe for Repo Server

3038

enabled: true

3039

# -- Http path to use for the readiness probe

3040

httpPath: /healthz

3041

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3042

failureThreshold: 3

3043

# -- Number of seconds after the container has started before [probe] is initiated

3044

initialDelaySeconds: 10

3045

# -- How often (in seconds) to perform the [probe]

3046

periodSeconds: 10

3047

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3048

successThreshold: 1

3049

# -- Number of seconds after which the [probe] times out

3050

timeoutSeconds: 1

3051

livenessProbe:

3052

# -- Enable Kubernetes liveness probe for Repo Server

3053

enabled: true

3054

# -- Http path to use for the liveness probe

3055

httpPath: /healthz?full=true

3056

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3057

failureThreshold: 3

3058

# -- Number of seconds after the container has started before [probe] is initiated

3059

initialDelaySeconds: 10

3060

# -- How often (in seconds) to perform the [probe]

3061

periodSeconds: 10

3062

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3063

successThreshold: 1

3064

# -- Number of seconds after which the [probe] times out

3065

timeoutSeconds: 1

3066

## Startup probe for Repo Server (optional)

3067

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3068

startupProbe:

3069

# -- Enable Kubernetes startup probe for Repo Server

3070

enabled: false

3071

# -- Http path to use for the startup probe

3072

httpPath: /healthz

3073

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3074

failureThreshold: 20

3075

# -- Number of seconds after the container has started before [probe] is initiated

3076

initialDelaySeconds: 10

3077

# -- How often (in seconds) to perform the [probe]

3078

periodSeconds: 10

3079

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3080

successThreshold: 1

3081

# -- Number of seconds after which the [probe] times out

3082

timeoutSeconds: 1

3083

# -- terminationGracePeriodSeconds for container lifecycle hook

3084

terminationGracePeriodSeconds: 30

3085

# -- [Node selector]

3086

# @default -- `{}` (defaults to global.nodeSelector)

3087

nodeSelector: {}

3088

# -- [Tolerations] for use with node taints

3089

# @default -- `[]` (defaults to global.tolerations)

3090

tolerations: []

3091

# -- Assign custom [affinity] rules to the deployment

3092

# @default -- `{}` (defaults to global.affinity preset)

3093

affinity: {}

3094

# -- Assign custom [TopologySpreadConstraints] rules to the repo server

3095

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3096

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

3097

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3098

topologySpreadConstraints: []

3099

# - maxSkew: 1

3100

# topologyKey: topology.kubernetes.io/zone

3101

# whenUnsatisfiable: DoNotSchedule

3102

3103

# -- Deployment strategy to be added to the repo server Deployment

3104

deploymentStrategy: {}

3105

# type: RollingUpdate

3106

# rollingUpdate:

3107

# maxSurge: 25%

3108

# maxUnavailable: 25%

3109

3110

# -- Priority class for the repo server pods

3111

# @default -- `""` (defaults to global.priorityClassName)

3112

priorityClassName: ""

3113

# TLS certificate configuration via Secret

3114

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-repo-server

3115

## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart repo server automatically without extra controllers.

3116

certificateSecret:

3117

# -- Create argocd-repo-server-tls secret

3118

enabled: false

3119

# -- Annotations to be added to argocd-repo-server-tls secret

3120

annotations: {}

3121

# -- Labels to be added to argocd-repo-server-tls secret

3122

labels: {}

3123

# -- Certificate authority. Required for self-signed certificates.

3124

ca: ""

3125

# -- Certificate private key

3126

key: ""

3127

# -- Certificate data. Must contain SANs of Repo service (ie: argocd-repo-server, argocd-repo-server.argo-cd.svc)

3128

crt: ""

3129

## Repo server service configuration

3130

service:

3131

# -- Repo server service annotations

3132

annotations: {}

3133

# -- Repo server service labels

3134

labels: {}

3135

# -- Repo server service port

3136

port: 8081

3137

# -- Repo server service port name

3138

portName: tcp-repo-server

3139

# -- Traffic distribution preference for the repo server service. If the field is not set, the implementation will apply its default routing strategy.

3140

trafficDistribution: ""

3141

## Repo server metrics service configuration

3142

metrics:

3143

# -- Deploy metrics service

3144

enabled: false

3145

service:

3146

# -- Metrics service type

3147

type: ClusterIP

3148

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3149

clusterIP: ""

3150

# -- Metrics service annotations

3151

annotations: {}

3152

# -- Metrics service labels

3153

labels: {}

3154

# -- Metrics service port

3155

servicePort: 8084

3156

# -- Metrics service port name

3157

portName: http-metrics

3158

serviceMonitor:

3159

# -- Enable a prometheus ServiceMonitor

3160

enabled: false

3161

# -- Prometheus ServiceMonitor interval

3162

interval: 30s

3163

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

3164

scrapeTimeout: ""

3165

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3166

honorLabels: false

3167

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3168

relabelings: []

3169

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3170

metricRelabelings: []

3171

# -- Prometheus ServiceMonitor selector

3172

selector: {}

3173

# prometheus: kube-prometheus

3174

3175

# -- Prometheus ServiceMonitor scheme

3176

scheme: ""

3177

# -- Prometheus ServiceMonitor tlsConfig

3178

tlsConfig: {}

3179

# -- Prometheus ServiceMonitor namespace

3180

namespace: "" # "monitoring"

3181

# -- Prometheus ServiceMonitor labels

3182

additionalLabels: {}

3183

# -- Prometheus ServiceMonitor annotations

3184

annotations: {}

3185

## Enable Custom Rules for the Repo server's Cluster Role resource

3186

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

3187

## Defaults to off

3188

clusterRoleRules:

3189

# -- Enable custom rules for the Repo server's Cluster Role resource

3190

enabled: false

3191

# -- List of custom rules for the Repo server's Cluster Role resource

3192

rules: []

3193

# -- Automount API credentials for the Service Account into the pod.

3194

automountServiceAccountToken: true

3195

## Repo server service account

3196

## If create is set to true, make sure to uncomment the name and update the rbac section below

3197

serviceAccount:

3198

# -- Create repo server service account

3199

create: true

3200

# -- Repo server service account name

3201

3202

# -- Annotations applied to created service account

3203

annotations: {}

3204

# -- Labels applied to created service account

3205

labels: {}

3206

# -- Automount API credentials for the Service Account

3207

automountServiceAccountToken: true

3208

# -- Repo server rbac rules

3209

rbac: []

3210

# - apiGroups:

3211

# - argoproj.io

3212

# resources:

3213

# - applications

3214

# verbs:

3215

# - get

3216

# - list

3217

# - watch

3218

3219

# Default repo server's network policy

3220

networkPolicy:

3221

# -- Default network policy rules used by repo server

3222

# @default -- `false` (defaults to global.networkPolicy.create)

3223

create: false

3224

## ApplicationSet controller

3225

applicationSet:

3226

# -- ApplicationSet controller name string

3227

3228

# -- The number of ApplicationSet controller pods to run

3229

replicas: 1

3230

# -- Runtime class name for the ApplicationSet controller

3231

# @default -- `""` (defaults to global.runtimeClassName)

3232

runtimeClassName: ""

3233

## ApplicationSet controller Pod Disruption Budget

3234

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

3235

pdb:

3236

# -- Deploy a [PodDisruptionBudget] for the ApplicationSet controller

3237

enabled: false

3238

# -- Labels to be added to ApplicationSet controller pdb

3239

labels: {}

3240

# -- Annotations to be added to ApplicationSet controller pdb

3241

annotations: {}

3242

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

3243

# @default -- `""` (defaults to 0 if not specified)

3244

minAvailable: ""

3245

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

3246

## Has higher precedence over `applicationSet.pdb.minAvailable`

3247

maxUnavailable: ""

3248

## ApplicationSet controller Vertical Pod Autoscaler

3249

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

3250

vpa:

3251

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the ApplicationSet controller

3252

enabled: false

3253

# -- Labels to be added to ApplicationSet controller vpa

3254

labels: {}

3255

# -- Annotations to be added to ApplicationSet controller vpa

3256

annotations: {}

3257

# -- One of the VPA operation modes

3258

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

3259

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

3260

updateMode: Initial

3261

# -- Controls how VPA computes the recommended resources for ApplicationSet controller container

3262

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

3263

containerPolicy: {}

3264

# controlledResources: ["cpu", "memory"]

3265

# minAllowed:

3266

# cpu: 250m

3267

# memory: 256Mi

3268

# maxAllowed:

3269

# cpu: 1

3270

# memory: 1Gi

3271

3272

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

3273

## NOTE: specify only zero or one recommender as of VPA 1.7.1

3274

recommenders: []

3275

3276

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

3277

startupBoost: {}

3278

# cpu:

3279

# type: Factor

3280

# factor: 2

3281

# durationSeconds: 10

3282

## ApplicationSet controller image

3283

image:

3284

# -- Repository to use for the ApplicationSet controller

3285

# @default -- `""` (defaults to global.image.repository)

3286

repository: ""

3287

# -- Tag to use for the ApplicationSet controller

3288

# @default -- `""` (defaults to global.image.tag)

3289

tag: ""

3290

# -- Image pull policy for the ApplicationSet controller

3291

# @default -- `""` (defaults to global.image.imagePullPolicy)

3292

imagePullPolicy: ""

3293

# -- If defined, uses a Secret to pull an image from a private Docker registry or repository.

3294

# @default -- `[]` (defaults to global.imagePullSecrets)

3295

imagePullSecrets: []

3296

# -- ApplicationSet controller command line flags

3297

extraArgs: []

3298

# -- Environment variables to pass to the ApplicationSet controller

3299

extraEnv: []

3300

# - name: "MY_VAR"

3301

# value: "value"

3302

3303

# -- envFrom to pass to the ApplicationSet controller

3304

# @default -- `[]` (See [values.yaml])

3305

extraEnvFrom: []

3306

# - configMapRef:

3307

# name: config-map-name

3308

# - secretRef:

3309

# name: secret-name

3310

3311

# -- Additional containers to be added to the ApplicationSet controller pod

3312

## Note: Supports use of custom Helm templates

3313

extraContainers: []

3314

# -- Init containers to add to the ApplicationSet controller pod

3315

## Note: Supports use of custom Helm templates

3316

initContainers: []

3317

# -- List of extra mounts to add (normally used with extraVolumes)

3318

extraVolumeMounts: []

3319

# -- List of extra volumes to add

3320

extraVolumes: []

3321

## ApplicationSet controller emptyDir volumes

3322

emptyDir:

3323

# -- EmptyDir size limit for applicationSet controller

3324

# @default -- `""` (defaults not set if not specified i.e. no size limit)

3325

sizeLimit: ""

3326

# sizeLimit: "1Gi"

3327

## Metrics service configuration

3328

metrics:

3329

# -- Deploy metrics service

3330

enabled: false

3331

service:

3332

# -- Metrics service type

3333

type: ClusterIP

3334

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3335

clusterIP: ""

3336

# -- Metrics service annotations

3337

annotations: {}

3338

# -- Metrics service labels

3339

labels: {}

3340

# -- Metrics service port

3341

servicePort: 8080

3342

# -- Metrics service port name

3343

portName: http-metrics

3344

serviceMonitor:

3345

# -- Enable a prometheus ServiceMonitor

3346

enabled: false

3347

# -- Prometheus ServiceMonitor interval

3348

interval: 30s

3349

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

3350

scrapeTimeout: ""

3351

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3352

honorLabels: false

3353

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3354

relabelings: []

3355

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3356

metricRelabelings: []

3357

# -- Prometheus ServiceMonitor selector

3358

selector: {}

3359

# prometheus: kube-prometheus

3360

3361

# -- Prometheus ServiceMonitor scheme

3362

scheme: ""

3363

# -- Prometheus ServiceMonitor tlsConfig

3364

tlsConfig: {}

3365

# -- Prometheus ServiceMonitor namespace

3366

namespace: "" # monitoring

3367

# -- Prometheus ServiceMonitor labels

3368

additionalLabels: {}

3369

# -- Prometheus ServiceMonitor annotations

3370

annotations: {}

3371

## ApplicationSet service configuration

3372

service:

3373

# -- ApplicationSet service annotations

3374

annotations: {}

3375

# -- ApplicationSet service labels

3376

labels: {}

3377

# -- ApplicationSet service type

3378

type: ClusterIP

3379

# -- ApplicationSet service port

3380

port: 7000

3381

# -- ApplicationSet service port name

3382

portName: http-webhook

3383

# -- Automount API credentials for the Service Account into the pod.

3384

automountServiceAccountToken: true

3385

serviceAccount:

3386

# -- Create ApplicationSet controller service account

3387

create: true

3388

# -- ApplicationSet controller service account name

3389

3390

# -- Annotations applied to created service account

3391

annotations: {}

3392

# -- Labels applied to created service account

3393

labels: {}

3394

# -- Automount API credentials for the Service Account

3395

automountServiceAccountToken: true

3396

# -- Annotations to be added to ApplicationSet controller Deployment

3397

deploymentAnnotations: {}

3398

# -- Labels for the ApplicationSet controller Deployment

3399

deploymentLabels: {}

3400

# -- Annotations for the ApplicationSet controller pods

3401

podAnnotations: {}

3402

# -- Labels for the ApplicationSet controller pods

3403

podLabels: {}

3404

# -- Resource limits and requests for the ApplicationSet controller pods.

3405

resources: {}

3406

# limits:

3407

# cpu: 100m

3408

# memory: 128Mi

3409

# requests:

3410

# cpu: 100m

3411

# memory: 128Mi

3412

3413

# ApplicationSet controller container ports

3414

containerPorts:

3415

# -- Metrics container port

3416

metrics: 8080

3417

# -- Probe container port

3418

probe: 8081

3419

# -- Webhook container port

3420

webhook: 7000

3421

# -- [DNS configuration]

3422

dnsConfig: {}

3423

# -- Alternative DNS policy for ApplicationSet controller pods

3424

dnsPolicy: "ClusterFirst"

3425

# -- ApplicationSet controller container-level security context

3426

# @default -- See [values.yaml]

3427

containerSecurityContext:

3428

runAsNonRoot: true

3429

readOnlyRootFilesystem: true

3430

allowPrivilegeEscalation: false

3431

seccompProfile:

3432

type: RuntimeDefault

3433

capabilities:

3434

drop:

3435

- ALL

3436

## Probes for ApplicationSet controller (optional)

3437

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3438

readinessProbe:

3439

# -- Enable Kubernetes liveness probe for ApplicationSet controller

3440

enabled: false

3441

# -- Number of seconds after the container has started before [probe] is initiated

3442

initialDelaySeconds: 10

3443

# -- How often (in seconds) to perform the [probe]

3444

periodSeconds: 10

3445

# -- Number of seconds after which the [probe] times out

3446

timeoutSeconds: 1

3447

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3448

successThreshold: 1

3449

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3450

failureThreshold: 3

3451

livenessProbe:

3452

# -- Enable Kubernetes liveness probe for ApplicationSet controller

3453

enabled: false

3454

# -- Number of seconds after the container has started before [probe] is initiated

3455

initialDelaySeconds: 10

3456

# -- How often (in seconds) to perform the [probe]

3457

periodSeconds: 10

3458

# -- Number of seconds after which the [probe] times out

3459

timeoutSeconds: 1

3460

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3461

successThreshold: 1

3462

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3463

failureThreshold: 3

3464

## Startup probe for ApplicationSet controller (optional)

3465

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3466

startupProbe:

3467

# -- Enable Kubernetes startup probe for ApplicationSet controller

3468

enabled: false

3469

# -- Number of seconds after the container has started before [probe] is initiated

3470

initialDelaySeconds: 10

3471

# -- How often (in seconds) to perform the [probe]

3472

periodSeconds: 10

3473

# -- Number of seconds after which the [probe] times out

3474

timeoutSeconds: 1

3475

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3476

successThreshold: 1

3477

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3478

failureThreshold: 20

3479

# -- terminationGracePeriodSeconds for container lifecycle hook

3480

terminationGracePeriodSeconds: 30

3481

# -- [Node selector]

3482

# @default -- `{}` (defaults to global.nodeSelector)

3483

nodeSelector: {}

3484

# -- [Tolerations] for use with node taints

3485

# @default -- `[]` (defaults to global.tolerations)

3486

tolerations: []

3487

# -- Assign custom [affinity] rules

3488

# @default -- `{}` (defaults to global.affinity preset)

3489

affinity: {}

3490

# -- Assign custom [TopologySpreadConstraints] rules to the ApplicationSet controller

3491

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3492

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

3493

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3494

topologySpreadConstraints: []

3495

# - maxSkew: 1

3496

# topologyKey: topology.kubernetes.io/zone

3497

# whenUnsatisfiable: DoNotSchedule

3498

3499

# -- Deployment strategy to be added to the ApplicationSet controller Deployment

3500

deploymentStrategy: {}

3501

# type: RollingUpdate

3502

# rollingUpdate:

3503

# maxSurge: 25%

3504

# maxUnavailable: 25%

3505

3506

# -- Priority class for the ApplicationSet controller pods

3507

# @default -- `""` (defaults to global.priorityClassName)

3508

priorityClassName: ""

3509

# TLS certificate configuration via cert-manager

3510

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-configuration

3511

certificate:

3512

# -- Deploy a Certificate resource (requires cert-manager)

3513

enabled: false

3514

# -- Certificate primary domain (commonName)

3515

# @default -- `""` (defaults to global.domain)

3516

domain: ""

3517

# -- Certificate Subject Alternate Names (SANs)

3518

additionalHosts: []

3519

# -- The requested 'duration' (i.e. lifetime) of the certificate.

3520

# @default -- `""` (defaults to 2160h = 90d if not specified)

3521

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

3522

duration: ""

3523

# -- How long before the expiry a certificate should be renewed.

3524

# @default -- `""` (defaults to 360h = 15d if not specified)

3525

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

3526

renewBefore: ""

3527

# Certificate issuer

3528

## Ref: https://cert-manager.io/docs/concepts/issuer

3529

issuer:

3530

# -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io`

3531

group: ""

3532

# -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer`

3533

kind: ""

3534

# -- Certificate issuer name. Eg. `letsencrypt`

3535

3536

# Private key of the certificate

3537

privateKey:

3538

# -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always`

3539

rotationPolicy: Never

3540

# -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8`

3541

encoding: PKCS1

3542

# -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA`

3543

algorithm: RSA

3544

# -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored.

3545

size: 2048

3546

# -- Annotations to be applied to the ApplicationSet Certificate

3547

annotations: {}

3548

## Ingress for the Git Generator webhook

3549

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration)

3550

ingress:

3551

# -- Enable an ingress resource for ApplicationSet webhook

3552

enabled: false

3553

# -- Additional ingress labels

3554

labels: {}

3555

# -- Additional ingress annotations

3556

annotations: {}

3557

# -- Defines which ingress ApplicationSet controller will implement the resource

3558

ingressClassName: ""

3559

# -- Argo CD ApplicationSet hostname

3560

# @default -- `""` (defaults to global.domain)

3561

hostname: ""

3562

# -- List of ingress paths

3563

path: /api/webhook

3564

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

3565

pathType: Prefix

3566

# -- Enable TLS configuration for the hostname defined at `applicationSet.webhook.ingress.hostname`

3567

## TLS certificate will be retrieved from a TLS secret with name:`argocd-applicationset-controller-tls`

3568

tls: false

3569

# -- The list of additional hostnames to be covered by ingress record

3570

# @default -- `[]` (See [values.yaml])

3571

extraHosts: []

3572

# - name: argocd.example.com

3573

# path: /

3574

3575

# -- Additional ingress paths

3576

# @default -- `[]` (See [values.yaml])

3577

extraPaths: []

3578

# - path: /*

3579

# pathType: Prefix

3580

# backend:

3581

# service:

3582

# name: ssl-redirect

3583

# port:

3584

# name: use-annotation

3585

3586

# -- Additional ingress rules

3587

# @default -- `[]` (See [values.yaml])

3588

## Note: Supports use of custom Helm templates

3589

extraRules: []

3590

# - http:

3591

# paths:

3592

# - path: /api/webhook

3593

# pathType: Prefix

3594

# backend:

3595

# service:

3596

# name: '{{ include "argo-cd.applicationSet.fullname" . }}'

3597

# port:

3598

# name: '{{ .Values.applicationSet.service.portName }}'

3599

3600

# -- Additional ingress TLS configuration

3601

# @default -- `[]` (See [values.yaml])

3602

extraTls: []

3603

# - secretName: argocd-applicationset-tls

3604

# hosts:

3605

# - argocd-applicationset.example.com

3606

## Gateway API HTTPRoute for the Git Generator webhook

3607

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration)

3608

# NOTE: Gateway API support is in EXPERIMENTAL status

3609

# Support depends on your Gateway controller implementation

3610

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

3611

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

3612

httproute:

3613

# -- Enable HTTPRoute resource for Argo CD Applicationset Webhook (Gateway API)

3614

enabled: false

3615

# -- Additional HTTPRoute labels

3616

labels: {}

3617

# -- Additional HTTPRoute annotations

3618

annotations: {}

3619

# -- Gateway API parentRefs for the HTTPRoute

3620

## Must reference an existing Gateway

3621

# @default -- `[]` (See [values.yaml])

3622

parentRefs: []

3623

# - name: example-gateway

3624

# namespace: example-gateway-namespace

3625

# sectionName: https

3626

# -- List of hostnames for the HTTPRoute

3627

# @default -- `[]` (See [values.yaml])

3628

hostnames: []

3629

# - argocd.example.com

3630

# -- HTTPRoute rules configuration

3631

# @default -- `[]` (See [values.yaml])

3632

rules:

3633

- matches:

3634

- path:

3635

type: PathPrefix

3636

value: /api/webhook

3637

# filters: []

3638

# - type: RequestHeaderModifier

3639

# requestHeaderModifier:

3640

# add:

3641

# - name: X-Custom-Header

3642

# value: custom-value

3643

# Gateway API ListenerSet configuration for the Git Generator webhook

3644

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration

3645

# NOTE: Gateway API support is in EXPERIMENTAL status

3646

# ListenerSet allows attaching additional listeners to an existing Gateway

3647

# Requires Gateway API v1alpha2 and a controller that supports ListenerSet

3648

# Refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.ListenerSet

3649

listenerset:

3650

# -- Enable ListenerSet resource for Argo CD ApplicationSet webhook (Gateway API)

3651

enabled: false

3652

# -- Additional ListenerSet labels

3653

labels: {}

3654

# -- Additional ListenerSet annotations

3655

annotations: {}

3656

# -- Gateway API parentRef for the ListenerSet

3657

## Must reference an existing Gateway. Unlike HTTPRoute, ListenerSet accepts exactly one parentRef.

3658

# @default -- `{}` (See [values.yaml])

3659

parentRef: {}

3660

# name: example-gateway

3661

# namespace: example-gateway-namespace

3662

# -- Hostname for the synthesized listener. Defaults to global.domain when empty.

3663

hostname: ""

3664

# -- Name of the synthesized listener. Also used as sectionName in auto-derived httproute parentRefs.

3665

listenerName: https

3666

# -- Port for the synthesized listener

3667

port: 443

3668

# -- Protocol for the synthesized listener

3669

protocol: HTTPS

3670

# -- TLS configuration for the synthesized listener

3671

tls:

3672

# -- Enable TLS on the synthesized listener

3673

enabled: true

3674

# -- TLS termination mode

3675

mode: Terminate

3676

# -- Secret name for TLS certificate. Defaults to `argocd-applicationset-controller-tls` when empty.

3677

secretName: ""

3678

# -- allowedRoutes for the synthesized listener

3679

allowedRoutes:

3680

namespaces:

3681

from: Same

3682

# -- Listeners to attach to the parent Gateway. When non-empty, used verbatim and all synthesized listener fields above are ignored.

3683

# @default -- `[]` (See [values.yaml])

3684

listeners: []

3685

# - name: https

3686

# port: 443

3687

# protocol: HTTPS

3688

# hostname: argocd.example.com

3689

# tls:

3690

# mode: Terminate

3691

# certificateRefs:

3692

# - group: ""

3693

# kind: Secret

3694

# name: argocd-applicationset-controller-tls

3695

# allowedRoutes:

3696

# namespaces:

3697

# from: Same

3698

# -- Enable ApplicationSet in any namespace feature

3699

allowAnyNamespace: false

3700

# Default ApplicationSet controller's network policy

3701

networkPolicy:

3702

# -- Default network policy rules used by ApplicationSet controller

3703

# @default -- `false` (defaults to global.networkPolicy.create)

3704

create: false

3705

## Notifications controller

3706

notifications:

3707

# -- Enable notifications controller

3708

enabled: true

3709

# -- Notifications controller name string

3710

3711

# -- Argo CD dashboard url; used in place of {{.context.argocdUrl}} in templates

3712

# @default -- `""` (defaults to https://`global.domain`)

3713

argocdUrl: ""

3714

# -- Runtime class name for the notifications controller

3715

# @default -- `""` (defaults to global.runtimeClassName)

3716

runtimeClassName: ""

3717

## Notifications controller Pod Disruption Budget

3718

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

3719

pdb:

3720

# -- Deploy a [PodDisruptionBudget] for the notifications controller

3721

enabled: false

3722

# -- Labels to be added to notifications controller pdb

3723

labels: {}

3724

# -- Annotations to be added to notifications controller pdb

3725

annotations: {}

3726

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

3727

# @default -- `""` (defaults to 0 if not specified)

3728

minAvailable: ""

3729

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

3730

## Has higher precedence over `notifications.pdb.minAvailable`

3731

maxUnavailable: ""

3732

## Notifications controller Vertical Pod Autoscaler

3733

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

3734

vpa:

3735

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the notifications controller

3736

enabled: false

3737

# -- Labels to be added to notifications controller vpa

3738

labels: {}

3739

# -- Annotations to be added to notifications controller vpa

3740

annotations: {}

3741

# -- One of the VPA operation modes

3742

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

3743

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

3744

updateMode: Initial

3745

# -- Controls how VPA computes the recommended resources for notifications controller container

3746

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

3747

containerPolicy: {}

3748

# controlledResources: ["cpu", "memory"]

3749

# minAllowed:

3750

# cpu: 250m

3751

# memory: 256Mi

3752

# maxAllowed:

3753

# cpu: 1

3754

# memory: 1Gi

3755

3756

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

3757

## NOTE: specify only zero or one recommender as of VPA 1.7.1

3758

recommenders: []

3759

3760

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

3761

startupBoost: {}

3762

# cpu:

3763

# type: Factor

3764

# factor: 2

3765

# durationSeconds: 10

3766

## Notifications controller image

3767

image:

3768

# -- Repository to use for the notifications controller

3769

# @default -- `""` (defaults to global.image.repository)

3770

repository: ""

3771

# -- Tag to use for the notifications controller

3772

# @default -- `""` (defaults to global.image.tag)

3773

tag: ""

3774

# -- Image pull policy for the notifications controller

3775

# @default -- `""` (defaults to global.image.imagePullPolicy)

3776

imagePullPolicy: ""

3777

# -- Secrets with credentials to pull images from a private registry

3778

# @default -- `[]` (defaults to global.imagePullSecrets)

3779

imagePullSecrets: []

3780

# DEPRECATED - Use configs.params to override

3781

# -- Notifications controller log format. Either `text` or `json`

3782

# @default -- `""` (defaults to global.logging.format)

3783

# logFormat: ""

3784

# -- Notifications controller log level. One of: `debug`, `info`, `warn`, `error`

3785

# @default -- `""` (defaults to global.logging.level)

3786

# logLevel: ""

3787

3788

# -- Extra arguments to provide to the notifications controller

3789

extraArgs: []

3790

# -- Additional container environment variables

3791

extraEnv: []

3792

# -- envFrom to pass to the notifications controller

3793

# @default -- `[]` (See [values.yaml])

3794

extraEnvFrom: []

3795

# - configMapRef:

3796

# name: config-map-name

3797

# - secretRef:

3798

# name: secret-name

3799

3800

# -- Additional containers to be added to the notifications controller pod

3801

## Note: Supports use of custom Helm templates

3802

extraContainers: []

3803

# -- Init containers to add to the notifications controller pod

3804

## Note: Supports use of custom Helm templates

3805

initContainers: []

3806

# -- List of extra mounts to add (normally used with extraVolumes)

3807

extraVolumeMounts: []

3808

# -- List of extra volumes to add

3809

extraVolumes: []

3810

# -- Define user-defined context

3811

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/#defining-user-defined-context

3812

context: {}

3813

# region: east

3814

# environmentName: staging

3815

3816

secret:

3817

# -- Whether helm chart creates notifications controller secret

3818

## If true, will create a secret with the name below. Otherwise, will assume existence of a secret with that name.

3819

create: true

3820

# -- notifications controller Secret name

3821

3822

# -- key:value pairs of annotations to be added to the secret

3823

annotations: {}

3824

# -- key:value pairs of labels to be added to the secret

3825

labels: {}

3826

# -- Generic key:value pairs to be inserted into the secret

3827

## Can be used for templates, notification services etc. Some examples given below.

3828

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/

3829

items: {}

3830

# slack-token:

3831

# # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/slack/

3832

# grafana-apiKey:

3833

# # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/grafana/

3834

3835

# webhooks-github-token:

3836

3837

# email-username:

3838

# email-password:

3839

# For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/email/

3840

3841

metrics:

3842

# -- Enables prometheus metrics server

3843

enabled: false

3844

# -- Metrics port

3845

port: 9001

3846

service:

3847

# -- Metrics service type

3848

type: ClusterIP

3849

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3850

clusterIP: ""

3851

# -- Metrics service annotations

3852

annotations: {}

3853

# -- Metrics service labels

3854

labels: {}

3855

# -- Metrics service port name

3856

portName: http-metrics

3857

serviceMonitor:

3858

# -- Enable a prometheus ServiceMonitor

3859

enabled: false

3860

# -- Prometheus ServiceMonitor selector

3861

selector: {}

3862

# prometheus: kube-prometheus

3863

# -- Prometheus ServiceMonitor labels

3864

additionalLabels: {}

3865

# -- Prometheus ServiceMonitor annotations

3866

annotations: {}

3867

# namespace: monitoring

3868

# interval: 30s

3869

# scrapeTimeout: 10s

3870

# -- Prometheus ServiceMonitor scheme

3871

scheme: ""

3872

# -- Prometheus ServiceMonitor tlsConfig

3873

tlsConfig: {}

3874

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3875

honorLabels: false

3876

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3877

relabelings: []

3878

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3879

metricRelabelings: []

3880

# -- Configures notification services such as slack, email or custom webhook

3881

# @default -- See [values.yaml]

3882

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/

3883

notifiers: {}

3884

# service.slack: |

3885

# token: $slack-token

3886

3887

# -- Annotations to be applied to the notifications controller Deployment

3888

deploymentAnnotations: {}

3889

# -- Labels for the notifications controller Deployment

3890

deploymentLabels: {}

3891

# -- Annotations to be applied to the notifications controller Pods

3892

podAnnotations: {}

3893

# -- Labels to be applied to the notifications controller Pods

3894

podLabels: {}

3895

# -- Resource limits and requests for the notifications controller

3896

resources: {}

3897

# limits:

3898

# cpu: 100m

3899

# memory: 128Mi

3900

# requests:

3901

# cpu: 100m

3902

# memory: 128Mi

3903

3904

# Notification controller container ports

3905

containerPorts:

3906

# -- Metrics container port

3907

metrics: 9001

3908

# -- [DNS configuration]

3909

dnsConfig: {}

3910

# -- Alternative DNS policy for notifications controller Pods

3911

dnsPolicy: "ClusterFirst"

3912

# -- Notification controller container-level security Context

3913

# @default -- See [values.yaml]

3914

containerSecurityContext:

3915

runAsNonRoot: true

3916

readOnlyRootFilesystem: true

3917

allowPrivilegeEscalation: false

3918

seccompProfile:

3919

type: RuntimeDefault

3920

capabilities:

3921

drop:

3922

- ALL

3923

## Probes for notifications controller Pods (optional)

3924

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3925

readinessProbe:

3926

# -- Enable Kubernetes liveness probe for notifications controller Pods

3927

enabled: false

3928

# -- Number of seconds after the container has started before [probe] is initiated

3929

initialDelaySeconds: 10

3930

# -- How often (in seconds) to perform the [probe]

3931

periodSeconds: 10

3932

# -- Number of seconds after which the [probe] times out

3933

timeoutSeconds: 1

3934

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3935

successThreshold: 1

3936

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3937

failureThreshold: 3

3938

livenessProbe:

3939

# -- Enable Kubernetes liveness probe for notifications controller Pods

3940

enabled: false

3941

# -- Number of seconds after the container has started before [probe] is initiated

3942

initialDelaySeconds: 10

3943

# -- How often (in seconds) to perform the [probe]

3944

periodSeconds: 10

3945

# -- Number of seconds after which the [probe] times out

3946

timeoutSeconds: 1

3947

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3948

successThreshold: 1

3949

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3950

failureThreshold: 3

3951

## Startup probe for notifications controller Pods (optional)

3952

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3953

startupProbe:

3954

# -- Enable Kubernetes startup probe for notifications controller Pods

3955

enabled: false

3956

# -- Number of seconds after the container has started before [probe] is initiated

3957

initialDelaySeconds: 10

3958

# -- How often (in seconds) to perform the [probe]

3959

periodSeconds: 10

3960

# -- Number of seconds after which the [probe] times out

3961

timeoutSeconds: 1

3962

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3963

successThreshold: 1

3964

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3965

failureThreshold: 20

3966

# -- terminationGracePeriodSeconds for container lifecycle hook

3967

terminationGracePeriodSeconds: 30

3968

# -- [Node selector]

3969

# @default -- `{}` (defaults to global.nodeSelector)

3970

nodeSelector: {}

3971

# -- [Tolerations] for use with node taints

3972

# @default -- `[]` (defaults to global.tolerations)

3973

tolerations: []

3974

# -- Assign custom [affinity] rules

3975

# @default -- `{}` (defaults to global.affinity preset)

3976

affinity: {}

3977

# -- Assign custom [TopologySpreadConstraints] rules to the application controller

3978

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3979

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

3980

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3981

topologySpreadConstraints: []

3982

# - maxSkew: 1

3983

# topologyKey: topology.kubernetes.io/zone

3984

# whenUnsatisfiable: DoNotSchedule

3985

3986

# -- Deployment strategy to be added to the notifications controller Deployment

3987

deploymentStrategy:

3988

type: Recreate

3989

# -- Priority class for the notifications controller pods

3990

# @default -- `""` (defaults to global.priorityClassName)

3991

priorityClassName: ""

3992

# -- Automount API credentials for the Service Account into the pod.

3993

automountServiceAccountToken: true

3994

serviceAccount:

3995

# -- Create notifications controller service account

3996

create: true

3997

# -- Notification controller service account name

3998

3999

# -- Annotations applied to created service account

4000

annotations: {}

4001

# -- Labels applied to created service account

4002

labels: {}

4003

# -- Automount API credentials for the Service Account

4004

automountServiceAccountToken: true

4005

cm:

4006

# -- Whether helm chart creates notifications controller config map

4007

create: true

4008

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

4009

## Defaults to off

4010

clusterRoleRules:

4011

# -- List of custom rules for the notifications controller's ClusterRole resource

4012

rules: []

4013

# -- Contains centrally managed global application subscriptions

4014

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/subscriptions/

4015

subscriptions: []

4016

# # subscription for on-sync-status-unknown trigger notifications

4017

# - recipients:

4018

# - slack:test2

4019

# - email:test@gmail.com

4020

# triggers:

4021

# - on-sync-status-unknown

4022

# # subscription restricted to applications with matching labels only

4023

# - recipients:

4024

# - slack:test3

4025

# selector: test=true

4026

# triggers:

4027

# - on-sync-status-unknown

4028

4029

# -- The notification template is used to generate the notification content

4030

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/

4031

templates: {}

4032

# template.app-deployed: |

4033

# email:

4034

# subject: New version of an application {{.app.metadata.name}} is up and running.

4035

# message: |

4036

# {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests.

4037

# slack:

4038

# attachments: |

4039

# [{

4040

# "title": "{{ .app.metadata.name}}",

4041

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4042

# "color": "#18be52",

4043

# "fields": [

4044

# {

4045

# "title": "Sync Status",

4046

# "value": "{{.app.status.sync.status}}",

4047

# "short": true

4048

# },

4049

# {

4050

# "title": "Repository",

4051

# "value": "{{.app.spec.source.repoURL}}",

4052

# "short": true

4053

# },

4054

# {

4055

# "title": "Revision",

4056

# "value": "{{.app.status.sync.revision}}",

4057

# "short": true

4058

# }

4059

# {{range $index, $c := .app.status.conditions}}

4060

# {{if not $index}},{{end}}

4061

# {{if $index}},{{end}}

4062

# {

4063

# "title": "{{$c.type}}",

4064

# "value": "{{$c.message}}",

4065

# "short": true

4066

# }

4067

# {{end}}

4068

# ]

4069

# }]

4070

# template.app-health-degraded: |

4071

# email:

4072

# subject: Application {{.app.metadata.name}} has degraded.

4073

# message: |

4074

# {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded.

4075

# Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.

4076

# slack:

4077

# attachments: |-

4078

# [{

4079

# "title": "{{ .app.metadata.name}}",

4080

# "title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4081

# "color": "#f4c030",

4082

# "fields": [

4083

# {

4084

# "title": "Sync Status",

4085

# "value": "{{.app.status.sync.status}}",

4086

# "short": true

4087

# },

4088

# {

4089

# "title": "Repository",

4090

# "value": "{{.app.spec.source.repoURL}}",

4091

# "short": true

4092

# }

4093

# {{range $index, $c := .app.status.conditions}}

4094

# {{if not $index}},{{end}}

4095

# {{if $index}},{{end}}

4096

# {

4097

# "title": "{{$c.type}}",

4098

# "value": "{{$c.message}}",

4099

# "short": true

4100

# }

4101

# {{end}}

4102

# ]

4103

# }]

4104

# template.app-sync-failed: |

4105

# email:

4106

# subject: Failed to sync application {{.app.metadata.name}}.

4107

# message: |

4108

# {{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}}

4109

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4110

# slack:

4111

# attachments: |-

4112

# [{

4113

# "title": "{{ .app.metadata.name}}",

4114

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4115

# "color": "#E96D76",

4116

# "fields": [

4117

# {

4118

# "title": "Sync Status",

4119

# "value": "{{.app.status.sync.status}}",

4120

# "short": true

4121

# },

4122

# {

4123

# "title": "Repository",

4124

# "value": "{{.app.spec.source.repoURL}}",

4125

# "short": true

4126

# }

4127

# {{range $index, $c := .app.status.conditions}}

4128

# {{if not $index}},{{end}}

4129

# {{if $index}},{{end}}

4130

# {

4131

# "title": "{{$c.type}}",

4132

# "value": "{{$c.message}}",

4133

# "short": true

4134

# }

4135

# {{end}}

4136

# ]

4137

# }]

4138

# template.app-sync-running: |

4139

# email:

4140

# subject: Start syncing application {{.app.metadata.name}}.

4141

# message: |

4142

# The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}.

4143

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4144

# slack:

4145

# attachments: |-

4146

# [{

4147

# "title": "{{ .app.metadata.name}}",

4148

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4149

# "color": "#0DADEA",

4150

# "fields": [

4151

# {

4152

# "title": "Sync Status",

4153

# "value": "{{.app.status.sync.status}}",

4154

# "short": true

4155

# },

4156

# {

4157

# "title": "Repository",

4158

# "value": "{{.app.spec.source.repoURL}}",

4159

# "short": true

4160

# }

4161

# {{range $index, $c := .app.status.conditions}}

4162

# {{if not $index}},{{end}}

4163

# {{if $index}},{{end}}

4164

# {

4165

# "title": "{{$c.type}}",

4166

# "value": "{{$c.message}}",

4167

# "short": true

4168

# }

4169

# {{end}}

4170

# ]

4171

# }]

4172

# template.app-sync-status-unknown: |

4173

# email:

4174

# subject: Application {{.app.metadata.name}} sync status is 'Unknown'

4175

# message: |

4176

# {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'.

4177

# Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.

4178

# {{if ne .serviceType "slack"}}

4179

# {{range $c := .app.status.conditions}}

4180

# * {{$c.message}}

4181

# {{end}}

4182

# {{end}}

4183

# slack:

4184

# attachments: |-

4185

# [{

4186

# "title": "{{ .app.metadata.name}}",

4187

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4188

# "color": "#E96D76",

4189

# "fields": [

4190

# {

4191

# "title": "Sync Status",

4192

# "value": "{{.app.status.sync.status}}",

4193

# "short": true

4194

# },

4195

# {

4196

# "title": "Repository",

4197

# "value": "{{.app.spec.source.repoURL}}",

4198

# "short": true

4199

# }

4200

# {{range $index, $c := .app.status.conditions}}

4201

# {{if not $index}},{{end}}

4202

# {{if $index}},{{end}}

4203

# {

4204

# "title": "{{$c.type}}",

4205

# "value": "{{$c.message}}",

4206

# "short": true

4207

# }

4208

# {{end}}

4209

# ]

4210

# }]

4211

# template.app-sync-succeeded: |

4212

# email:

4213

# subject: Application {{.app.metadata.name}} has been successfully synced.

4214

# message: |

4215

# {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}.

4216

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4217

# slack:

4218

# attachments: |-

4219

# [{

4220

# "title": "{{ .app.metadata.name}}",

4221

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4222

# "color": "#18be52",

4223

# "fields": [

4224

# {

4225

# "title": "Sync Status",

4226

# "value": "{{.app.status.sync.status}}",

4227

# "short": true

4228

# },

4229

# {

4230

# "title": "Repository",

4231

# "value": "{{.app.spec.source.repoURL}}",

4232

# "short": true

4233

# }

4234

# {{range $index, $c := .app.status.conditions}}

4235

# {{if not $index}},{{end}}

4236

# {{if $index}},{{end}}

4237

# {

4238

# "title": "{{$c.type}}",

4239

# "value": "{{$c.message}}",

4240

# "short": true

4241

# }

4242

# {{end}}

4243

# ]

4244

# }]

4245

4246

# -- The trigger defines the condition when the notification should be sent

4247

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/

4248

triggers: {}

4249

# trigger.on-deployed: |

4250

# - description: Application is synced and healthy. Triggered once per commit.

4251

# oncePer: app.status.sync.revision

4252

# send:

4253

# - app-deployed

4254

# when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status == 'Healthy'

4255

# trigger.on-health-degraded: |

4256

# - description: Application has degraded

4257

# send:

4258

# - app-health-degraded

4259

# when: app.status.health.status == 'Degraded'

4260

# trigger.on-sync-failed: |

4261

# - description: Application syncing has failed

4262

# send:

4263

# - app-sync-failed

4264

# when: app.status.operationState.phase in ['Error', 'Failed']

4265

# trigger.on-sync-running: |

4266

# - description: Application is being synced

4267

# send:

4268

# - app-sync-running

4269

# when: app.status.operationState.phase in ['Running']

4270

# trigger.on-sync-status-unknown: |

4271

# - description: Application status is 'Unknown'

4272

# send:

4273

# - app-sync-status-unknown

4274

# when: app.status.sync.status == 'Unknown'

4275

# trigger.on-sync-succeeded: |

4276

# - description: Application syncing has succeeded

4277

# send:

4278

# - app-sync-succeeded

4279

# when: app.status.operationState.phase in ['Succeeded']

4280

4281

# For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/#default-triggers

4282

# defaultTriggers: |

4283

# - on-sync-status-unknown

4284

4285

# Default notifications controller's network policy

4286

networkPolicy:

4287

# -- Default network policy rules used by notifications controller

4288

# @default -- `false` (defaults to global.networkPolicy.create)

4289

create: false

4290

commitServer:

4291

# -- Enable commit server

4292

enabled: false

4293

# -- Commit server name

4294

4295

# -- Runtime class name for the commit server

4296

# @default -- `""` (defaults to global.runtimeClassName)

4297

runtimeClassName: ""

4298

## commit server controller image

4299

image:

4300

# -- Repository to use for the commit server

4301

# @default -- `""` (defaults to global.image.repository)

4302

repository: ""

4303

# -- Tag to use for the commit server

4304

# @default -- `""` (defaults to global.image.tag)

4305

tag: ""

4306

# -- Image pull policy for the commit server

4307

# @default -- `""` (defaults to global.image.imagePullPolicy)

4308

imagePullPolicy: ""

4309

# -- commit server command line flags

4310

extraArgs: []

4311

# -- Environment variables to pass to the commit server

4312

extraEnv: []

4313

# - name: "MY_VAR"

4314

# value: "value"

4315

4316

# -- envFrom to pass to the commit server

4317

# @default -- `[]` (See [values.yaml])

4318

extraEnvFrom: []

4319

# - configMapRef:

4320

# name: config-map-name

4321

# - secretRef:

4322

# name: secret-name

4323

4324

# -- List of extra mounts to add (normally used with extraVolumes)

4325

extraVolumeMounts: []

4326

# -- List of extra volumes to add

4327

extraVolumes: []

4328

metrics:

4329

# -- Enables prometheus metrics server

4330

enabled: false

4331

service:

4332

# -- Metrics service type

4333

type: ClusterIP

4334

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

4335

clusterIP: ""

4336

# -- Metrics service annotations

4337

annotations: {}

4338

# -- Metrics service labels

4339

labels: {}

4340

# -- Metrics service port

4341

servicePort: 8087

4342

# -- Metrics service port name

4343

portName: metrics

4344

## commit server service configuration

4345

service:

4346

# -- commit server service annotations

4347

annotations: {}

4348

# -- commit server service labels

4349

labels: {}

4350

# -- commit server service port

4351

port: 8086

4352

# -- commit server service port name

4353

portName: server

4354

# -- Automount API credentials for the Service Account into the pod.

4355

automountServiceAccountToken: false

4356

serviceAccount:

4357

# -- Create commit server service account

4358

create: true

4359

# -- commit server service account name

4360

4361

# -- Annotations applied to created service account

4362

annotations: {}

4363

# -- Labels applied to created service account

4364

labels: {}

4365

# -- Automount API credentials for the Service Account

4366

automountServiceAccountToken: true

4367

# -- Annotations to be added to commit server Deployment

4368

deploymentAnnotations: {}

4369

# -- Labels for the commit server Deployment

4370

deploymentLabels: {}

4371

# -- Annotations for the commit server pods

4372

podAnnotations: {}

4373

# -- Labels for the commit server pods

4374

podLabels: {}

4375

# -- Resource limits and requests for the commit server pods.

4376

resources: {}

4377

# limits:

4378

# cpu: 100m

4379

# memory: 128Mi

4380

# requests:

4381

# cpu: 100m

4382

# memory: 128Mi

4383

4384

# -- [DNS configuration]

4385

dnsConfig: {}

4386

# -- Alternative DNS policy for commit server pods

4387

dnsPolicy: "ClusterFirst"

4388

# -- commit server container-level security context

4389

# @default -- See [values.yaml]

4390

containerSecurityContext:

4391

runAsNonRoot: true

4392

readOnlyRootFilesystem: true

4393

allowPrivilegeEscalation: false

4394

capabilities:

4395

drop:

4396

- ALL

4397

seccompProfile:

4398

type: RuntimeDefault

4399

## Probes for commit server (optional)

4400

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

4401

readinessProbe:

4402

# -- Enable Kubernetes liveness probe for commit server

4403

enabled: true

4404

# -- Http path to use for the readiness probe

4405

httpPath: /healthz

4406

# -- Number of seconds after the container has started before [probe] is initiated

4407

initialDelaySeconds: 5

4408

# -- How often (in seconds) to perform the [probe]

4409

periodSeconds: 10

4410

# -- Number of seconds after which the [probe] times out

4411

timeoutSeconds: 1

4412

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4413

failureThreshold: 3

4414

livenessProbe:

4415

# -- Enable Kubernetes liveness probe for commit server

4416

enabled: true

4417

# -- Http path to use for the liveness probe

4418

httpPath: /healthz?full=true

4419

# -- Number of seconds after the container has started before [probe] is initiated

4420

initialDelaySeconds: 30

4421

# -- How often (in seconds) to perform the [probe]

4422

periodSeconds: 30

4423

# -- Number of seconds after which the [probe] times out

4424

timeoutSeconds: 5

4425

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4426

failureThreshold: 3

4427

## Startup probe for commit server (optional)

4428

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

4429

startupProbe:

4430

# -- Enable Kubernetes startup probe for commit server

4431

enabled: false

4432

# -- Http path to use for the startup probe

4433

httpPath: /healthz

4434

# -- Number of seconds after the container has started before [probe] is initiated

4435

initialDelaySeconds: 10

4436

# -- How often (in seconds) to perform the [probe]

4437

periodSeconds: 10

4438

# -- Number of seconds after which the [probe] times out

4439

timeoutSeconds: 1

4440

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4441

failureThreshold: 20

4442

# -- terminationGracePeriodSeconds for container lifecycle hook

4443

terminationGracePeriodSeconds: 30

4444

# -- [Node selector]

4445

# @default -- `{}` (defaults to global.nodeSelector)

4446

nodeSelector: {}

4447

# -- [Tolerations] for use with node taints

4448

# @default -- `[]` (defaults to global.tolerations)

4449

tolerations: []

4450

# -- Assign custom [affinity] rules

4451

# @default -- `{}` (defaults to global.affinity preset)

4452

affinity: {}

4453

# -- Assign custom [TopologySpreadConstraints] rules to the commit server

4454

# @default -- `[]` (defaults to global.topologySpreadConstraints)

4455

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

4456

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

4457

topologySpreadConstraints: []

4458

# - maxSkew: 1

4459

# topologyKey: topology.kubernetes.io/zone

4460

# whenUnsatisfiable: DoNotSchedule

4461

4462

# -- Deployment strategy to be added to the commit server Deployment

4463

deploymentStrategy: {}

4464

# type: RollingUpdate

4465

# rollingUpdate:

4466

# maxSurge: 25%

4467

# maxUnavailable: 25%

4468

4469

# -- Priority class for the commit server pods

4470

# @default -- `""` (defaults to global.priorityClassName)

4471

priorityClassName: ""

4472

# Default commit server's network policy

4473

networkPolicy:

4474

# -- Default network policy rules used by commit server

4475

# @default -- `false` (defaults to global.networkPolicy.create)

4476

create: false

4477

## Commit server Vertical Pod Autoscaler

4478

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

4479

vpa:

4480

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the commit server

4481

enabled: false

4482

# -- Labels to be added to commit server vpa

4483

labels: {}

4484

# -- Annotations to be added to commit server vpa

4485

annotations: {}

4486

# -- One of the VPA operation modes

4487

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

4488

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

4489

updateMode: Initial

4490

# -- Controls how VPA computes the recommended resources for commit server container

4491

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

4492

containerPolicy: {}

4493

# controlledResources: ["cpu", "memory"]

4494

# minAllowed:

4495

# cpu: 250m

4496

# memory: 256Mi

4497

# maxAllowed:

4498

# cpu: 1

4499

# memory: 1Gi

4500

4501

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

4502

## NOTE: specify only zero or one recommender as of VPA 1.7.1

4503

recommenders: []

4504

4505

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

4506

startupBoost: {}

4507

# cpu:

4508

# type: Factor

4509

# factor: 2

4510

# durationSeconds: 10

4511

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

argo-cd

The trusted source for open source

Product

Solutions

Customers

Resources

Company