azure-service-operator

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

# Create secret or use an existing secret

createAzureOperatorSecret: true

# azureTenantID is the Entra tenant that the subscription is in

azureTenantID: ""

# azureAdditionalTenants is the list of (comma-separated) additional tenants the operator can authenticate with.

# This is required when performing cross-tenant authentication. See

# https://learn.microsoft.com/entra/external-id/cross-tenant-access-overview for more details.

azureAdditionalTenants: ""

# azureSubscriptionID is the Azure Subscription the operator will act against.

azureSubscriptionID: ""

# azureClientID is the client ID of the Azure Service Principal or Managed Identity to use to authenticate with Azure.

azureClientID: ""

# azureClientSecret is the client secret of the Azure Service Principal used to authenticate with Azure.

# This is required when using Service Principal authentication.

azureClientSecret: ""

# A PEM or PKCS12 certificate string including the private key for Azure Credential Authentication. If certificate is password protected, use 'azureClientCertificatePassword' for password.

azureClientCertificate: ""

# Password used to protect the client certificate (optional).

azureClientCertificatePassword: ""

# [Deprecated] Managed Identity (aad-pod-identity) Authentication

# azureManagedIdentityResourceId is the resource ID (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{managedIdentityName})

# of the Azure Managed Identity used to authenticate with Azure if using aad-pod-identity authorization.

aadPodIdentity:

enable: false

azureManagedIdentityResourceId: ""

# azureSyncPeriod is the frequency at which resources are re-reconciled with Azure

# when there have been no triggering changes in the Kubernetes resources. This sync

# exists to detect and correct changes that happened in Azure that Kubernetes is not

# aware about. BE VERY CAREFUL setting this value low - even a modest number of resources

# can cause subscription level throttling if they are re-synced frequently.

# Durations are specified as "1h", "15m", or "60s". Specify the special value "never" to prevent

# syncing. See https://pkg.go.dev/time#ParseDuration for more details.

azureSyncPeriod: ""

# useWorkloadIdentityAuth can be set to use workload identity authentication

# See https://azure.github.io/azure-workload-identity/docs/introduction.html for more details about Azure Workload Identity.

# See https://azure.github.io/azure-service-operator/guide/authentication/ for details on setting up Workload Identity with ASO

useWorkloadIdentityAuth: false

# azureUserAgentSuffix is appended to the default User-Agent for Azure HTTP clients.

azureUserAgentSuffix: ""

# azureAuthorityHost is the URL of the AAD authority. If not specified, the default

# is the AAD URL for the public cloud: https://login.microsoftonline.com/. See

# https://docs.microsoft.com/azure/active-directory/develop/authentication-national-cloud

azureAuthorityHost: ""

# azureResourceManagerEndpoint is the Azure Resource Manager endpoint.

# If not specified, the default is the Public cloud resource manager endpoint.

# See https://docs.microsoft.com/cli/azure/manage-clouds-azure-cli#list-available-clouds for details

# about how to find available resource manager endpoints for your cloud. Note that the resource manager

# endpoint is referred to as "resourceManager" in the Azure CLI.

azureResourceManagerEndpoint: ""

# azureResourceManagerAudience is the Azure Resource Manager AAD audience.

# If not specified, the default is the Public cloud resource manager audience https://management.core.windows.net/.

# See https://docs.microsoft.com/cli/azure/manage-clouds-azure-cli#list-available-clouds for details

# about how to find available resource manager audiences for your cloud. Note that the resource manager

# audience is referred to as "activeDirectoryResourceId" in the Azure CLI.

azureResourceManagerAudience: ""

# allowMultiEnvManagement determines whether per-namespace and per-resource credentials can specify

# their own Azure cloud environment settings (AZURE_RESOURCE_MANAGER_ENDPOINT, AZURE_RESOURCE_MANAGER_AUDIENCE,

# and AZURE_AUTHORITY_HOST). When enabled, credentials must specify ALL three of these settings or NONE of them.

# When disabled, any attempt to specify these settings in a credential will cause reconciliation to fail.

# This defaults to false for security reasons.

allowMultiEnvManagement: false

# azureTargetNamespaces lists the namespaces the operator will watch

# for Azure resources (if the mode includes running watchers). If

# it's empty the operator will watch all namespaces.

azureTargetNamespaces: []

# azureOperatorMode determines whether the operator should run

# watchers, webhooks or both.

azureOperatorMode: ""

webhook:

# webhook.port determines the port the webhook endpoint binds to.

port: 9443

# webhook.certDir determines which dir to mount webhook certs.

certDir: "/tmp/k8s-webhook-server/serving-certs"

# image defines the container image the ASO pod should run

# Note: This should use the latest released tag number explicitly. If

# it's ':latest' and someone deploys the chart after a new version has

# been released but before the the chart is updated, they could get

# errors, eg. due to types in the operator binary that have no

# corresponding CRD yaml in the cart (and so no CRD in the k8s

# repository).

image:

tag: 2.21.0-r2

repository: cgr.dev/scratch-images/test-tmp/azure-service-operator

pullSecrets: []

digest: sha256:364cc298242c7882a41ce961a6ad1293ad328b7aabf0f9a0eeb3126c1e2f9048

# 'metrics' define settings for the metrics from controller.

# 'address' field defines the metrics binding address on which metrics

metrics:

enable: true

# secure controls whether metrics should be served via 'http' or 'https'.

# Flagging secure as 'true' would use https

# Refer to https://azure.github.io/azure-service-operator/guide/metrics/ for more information

secure: true

# profiling exposes below endpoints.

# /debug/pprof/

# /debug/pprof/cmdline

# /debug/pprof/profile

# /debug/pprof/symbol

# /debug/pprof/trace

100

101

# pprof endpoints are sensitive and can only be enabled when serving metrics securely

102

profiling: false

103

address: 0.0.0.0:{{ .Values.metrics.port }}

104

port: 8443

105

# installCRDs configures if the operator attempts to install and manage the CRDs associated with ASO.

106

# If the operator does not install and manage the CRDs on its own, you must manually install the appropriate

107

# CRDs for version of the ASO operator you're running. Manually installing a subset of the CRDs is supported;

108

# the operator will only reconcile that subset if those are the only CRDs it finds when the pod starts.

109

installCRDs: true

110

# crdPattern is a semicolon delimited string or a list of strings containing the CRD patterns for the operator to install.

111

# Setting this has no effect if installCRDs is false.

112

# This defines what new CRDs will be installed by ASO. Will always upgrade any existing CRDs even if no

113

# crdPattern is defined. Leaving this field unspecified for a fresh install of ASO will result in the operator pod

114

# exiting with an error saying no CRDs are configured. Leaving this field unspecified during an upgrade of ASO preserves

115

# the existing set of CRDs already in the cluster. The existing CRDs will be upgraded to the latest version but no

116

# new CRDs will be installed.

117

# Values can be globs utilizing * or ?. The pattern is compared against the "{group}/{kind}" string of each CRD.

118

# Patterns are case-insensitive.

119

# Example: "resources.azure.com/*" would match the "resources.azure.com/ResourceGroup" resource.

120

# Example: "compute.azure.com/*" would match all compute CRDs

121

# Example: "resources.azure.com/*;compute.azure.com/*" would match all resources.azure.com resources as well as all

122

# compute resources.

123

# We strongly recommend including entire groups such as "dbformysql.azure.com/*". Individual CRDs such as

124

# "dbformysql.azure.com/FlexibleServer" can be listed, but there are often other resources in the group which pair

125

# together to enable other scenarios, such as dbformysql.azure.com/FlexibleServersFirewallRules, and it's generally

126

# easier to just include the whole group.

127

# See https://azure.github.io/azure-service-operator/guide/crd-management for more details.

128

crdPattern: ""

129

# crdLabels is a comma-delimited (or semicolon-delimited) string, or a list of key=value strings, containing

130

# additional labels to apply to all CRDs managed by ASO.

131

# Setting this has no effect if installCRDs is false.

132

# Existing labels not managed by ASO are preserved when CRDs are upgraded. Note that removing a label from this

133

# list does not remove it from CRDs already in the cluster.

134

# Labels reserved by ASO itself (app.kubernetes.io/name, app.kubernetes.io/version and any label prefixed with

135

# serviceoperator.azure.com/) cannot be set here and will be rejected at startup.

136

# Example: "cluster.x-k8s.io/provider=infrastructure-azure"

137

# Example: "cluster.x-k8s.io/provider=infrastructure-azure,environment=production" would apply both labels.

138

# Example: "cluster.x-k8s.io/provider=infrastructure-azure;environment=production" is equivalent, using the

139

# semicolon delimiter also accepted by crdPattern.

140

# Example as a list:

141

# crdLabels:

142

# - cluster.x-k8s.io/provider=infrastructure-azure

143

# - environment=production

144

crdLabels: ""

145

useJSONLogging: false

146

# deploymentAnnotations contain the deployment annotations for Azure Service Operator

147

deploymentAnnotations: {}

148

# multitenant contains the value to enable multi-tenant mode for ASOv2. If multitenant.enable is true + azureOperatorMode set to "webhooks", chart will

149

# install a cluster and if multitenant.enable is true + azureOperatorMode set to "watchers", chart will install a tenant.

150

# NOTE: 'installCRDs' should be set to false while installing a tenant.

151

multitenant:

152

enable: false

153

# networkPolicies allows you to configure the NetworkPolicies deployed as part of the Chart

154

networkPolicies:

155

enable: true

156

# TCP port to be configured for talking to the Kubernetes API

157

kubernetesApiPort: 6443

158

# Destination CIDR for talking to the Kubernetes API

159

kubernetesApiCIDR: 0.0.0.0/0

160

# Destination CIDR for talking to MySQL servers

161

mysqlCIDR: 0.0.0.0/0

162

# Destination CIDR for talking to PostgreSQL servers

163

postgresqlCIDR: 0.0.0.0/0

164

# Destination CIDR for talking to Sql servers

165

sqlCIDR: 0.0.0.0/0

166

# Node labels for pod assignment

167

# Ref: https://kubernetes.io/docs/user-guide/node-selection/

168

nodeSelector:

169

kubernetes.io/os: linux

170

# podAnnotations contain the pod annotations for Azure Service Operator

171

podAnnotations: {}

172

# Enable the pod disruption budget

173

# Specifies the minimum number of pods that must be available at any given time during the disruption.

174

# Ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/

175

podDisruptionBudget:

176

enabled: true

177

minAvailable: 50%

178

# Labels to be added to the pod

179

podLabels: {}

180

# The securityContext of the pod

181

# See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

182

podSecurityContext: {}

183

# Assign a PriorityClassName to pods if set

184

priorityClassName: ""

185

# Number of pod replicas to create for the deployment

186

replicaCount: 2

187

# Recommended initial values for resources

188

# adjust them as necessary

189

resources:

190

limits:

191

cpu: 500m

192

memory: 512Mi

193

requests:

194

cpu: 200m

195

memory: 256Mi

196

go:

197

memLimit: 400MiB # This should be set to ~80-90% of the hard memory limit set above in resources

198

# Number of old history to retain to allow rollback

199

# Default Kubernetes value is set to 10

200

revisionHistoryLimit: 10

201

# Specify security settings for a Container

202

# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

203

# It is not recommended to reduce the restrictions in this list, but additional restrictions outside the default set

204

# can be applied. If you believe additional securityContext configuration should be specified by default

205

# please raise an issue.

206

securityContext:

207

runAsUser: 65532 # nonroot user from gcr.io/distroless/static:nonroot image

208

runAsGroup: 65532 # nonroot group from gcr.io/distroless/static:nonroot image

209

runAsNonRoot: true

210

allowPrivilegeEscalation: false

211

readOnlyRootFilesystem: true

212

capabilities:

213

drop:

214

- ALL

215

# Tolerations are applied to pods. Tolerations allow the scheduler to schedule pods with matching taints. Tolerations allow scheduling but don't guarantee scheduling

216

# For more information, see https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration.

217

tolerations: []

218

# Affinity and anti-affinity expands the types of constraints you can define.

219

# The affinity feature consists of two types of affinity:

220

# Node affinity functions like the nodeSelector field but is more expressive and allows you to specify soft rules.

221

# Inter-pod affinity/anti-affinity allows you to constrain Pods against labels on other Pods.

222

# For more information, see https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity

223

# For specific affinity best practices on AKS clusters, see https://azure.github.io/azure-service-operator/guide/best-practices/#affinity

224

affinity: {}

225

# MaxConcurrentReconciles is the number of threads/goroutines dedicated to reconciling each resource type.

226

# If not specified, the default is 4.

227

# IMPORTANT: Having MaxConcurrentReconciles set to N does not mean that ASO is limited to N interactions with

228

# Azure at any given time, because the control loop yields to another resource while it is not actively issuing HTTP

229

# calls to Azure. Any single resource only blocks the control-loop for its resource-type for as long as it takes to issue

230

# an HTTP call to Azure, view the result, and make a decision. In most cases the time taken to perform these actions

231

# (and thus how long the loop is blocked and preventing other resources from being acted upon) is a few hundred

232

# milliseconds to at most a second or two. In a typical 60s period, hundreds of resources

233

# for a given resource type can be managed with this set to 1.

234

# MaxConcurrentReconciles applies to every registered resource type being watched/managed by ASO.

235

maxConcurrentReconciles: 4

236

rateLimit:

237

# mode configures the internal rate-limiting mode.

238

# Valid values are [disabled, bucket]

239

# * disabled: No ASO-controlled rate-limiting occurs. ASO will attempt to communicate with Azure and

240

# kube-apiserver as much as needed based on load. It will back off based on throttling from

241

# either kube-apiserver or Azure, but will not artificially limit its throughput.

242

# * bucket: Uses a token-bucket algorithm to rate-limit reconciliations. Note that this limits how often

243

# the operator performs a reconciliation, but not every reconciliation triggers a call to kube-apiserver

244

# or Azure (though many do). Since this controls reconciles it can be used to coarsely control throughput

245

# and CPU usage of the operator, as well as the number of requests that the operator issues to Azure.

246

# Keep in mind that the Azure throttling limits (defined at

247

# https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/request-limits-and-throttling)

248

# differentiate between request types. Since a given reconcile for a resource may result in polling (a GET) or

249

# modification (a PUT) it's not possible to entirely avoid Azure throttling by tuning these bucket limits.

250

# We don't recommend enabling this mode by default.

251

# If enabling this mode, we strongly recommend doing some experimentation to tune these values to something to

252

# works for your specific need.

253

mode: disabled

254

# The rate (per second) that the bucket is refilled. This value only has an effect if mode is 'bucket'.

255

qps: 5

256

# The size of the bucket. This value only has an effect if mode is 'bucket'.

257

bucketSize: 100

258

serviceAccount:

259

# Specifies whether a ServiceAccount should be created

260

create: true

261

# The name of the ServiceAccount to use.

262

# If not set and create is true, `azureserviceoperator-default` would be used as a name

263

name: ""

264

annotations: {}

265

# List of extra environment variables to inject into the manager container

266

# Example:

267

# extraEnv:

268

# - name: ENV

269

# value: "prod"

270

# - name: SERVICE

271

# value: "azure-service-operator"

272

extraEnv: []

273

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

azure-service-operator

The trusted source for open source

Product

Solutions

Customers

Resources

Company