eck-operator
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# nameOverride is the short name for the deployment. Leave empty to let Helm generate a name using chart values.
2
nameOverride: "elastic-operator"
3
# fullnameOverride is the full name for the deployment. Leave empty to let Helm generate a name using chart values.
4
fullnameOverride: "elastic-operator"
5
# managedNamespaces is the set of namespaces that the operator manages. Leave empty to manage all namespaces.
6
# Mutually exclusive with managedNamespaceSelector.
7
managedNamespaces: []
8
# managedNamespaceSelector is a Kubernetes label selector that dynamically controls which namespaces the operator manages.
9
# The operator watches all namespaces cluster-wide and filters events by matching each namespace's labels against
10
# this selector at runtime. When a namespace gains or loses the matching labels the operator automatically
11
# starts or stops managing resources in that namespace without a restart.
12
# Mutually exclusive with managedNamespaces. Requires createClusterScopedResources: true.
13
# Examples:
14
# managedNamespaceSelector:
15
# matchLabels:
16
# eck-managed: "true"
17
#
18
# managedNamespaceSelector:
19
# matchExpressions:
20
# - key: environment
21
# operator: In
22
# values: [production, staging]
23
managedNamespaceSelector: {}
24
# installCRDs determines whether Custom Resource Definitions (CRD) are installed by the chart.
25
# Note that CRDs are global resources and require cluster admin privileges to install.
26
# If you are sharing a cluster with other users who may want to install ECK on their own namespaces, setting this to true can have unintended consequences.
27
# 1. Upgrades will overwrite the global CRDs and could disrupt the other users of ECK who may be running a different version.
28
# 2. Uninstalling the chart will delete the CRDs and potentially cause Elastic resources deployed by other users to be removed as well.
29
installCRDs: true
30
# replicaCount is the number of operator pods to run.
31
replicaCount: 1
32
image:
33
# repository is the container image prefixed by the registry name.
34
repository: cgr.dev/chainguard-private/eck-operator-fips
35
# pullPolicy is the container image pull policy.
36
pullPolicy: IfNotPresent
37
# tag is the container image tag. If not defined, defaults to chart appVersion.
38
tag: 3.5.0@sha256:194ccbf49fad8a6d593e9ecd5e7b920338fdbeb267af5df965b434aa912dea2d
39
# digest pins the image to a specific content digest for immutable image references.
40
# When set, the rendered image reference becomes repo:tag@sha256:<hex>.
41
# Must be in the format sha256:<hex> (64 hex characters).
42
# Example:
43
# digest: sha256:8c933444cb78d632d2d15851daf7bcb1fc4ec57689bb4aebf7b3353e6bf395a9
44
digest: null
45
# fips specifies whether the operator will use a FIPS compliant container image for its own StatefulSet image.
46
# This setting does not apply to Elastic Stack applications images.
47
# Can be combined with config.ubiOnly.
48
fips: false
49
# priorityClassName defines the PriorityClass to be used by the operator pods.
50
priorityClassName: ""
51
# imagePullSecrets defines the secrets to use when pulling the operator container image.
52
imagePullSecrets: []
53
# resources define the container resource limits for the operator.
54
resources:
55
limits:
56
cpu: 1
57
memory: 1Gi
58
requests:
59
cpu: 100m
60
memory: 150Mi
61
# statefulsetAnnotations define the annotations that should be added to the operator StatefulSet.
62
statefulsetAnnotations: {}
63
# statefulsetLabels define additional labels that should be added to the operator StatefulSet.
64
statefulsetLabels: {}
65
# podAnnotations define the annotations that should be added to the operator pod.
66
podAnnotations: {}
67
## podLabels define additional labels that should be added to the operator pod.
68
podLabels: {}
69
# podSecurityContext defines the pod security context for the operator pod.
70
podSecurityContext:
71
runAsNonRoot: true
72
# securityContext defines the security context of the operator container.
73
securityContext:
74
allowPrivilegeEscalation: false
75
capabilities:
76
drop:
77
- ALL
78
readOnlyRootFilesystem: true
79
runAsNonRoot: true
80
# nodeSelector defines the node selector for the operator pod.
81
nodeSelector: {}
82
# tolerations defines the node tolerations for the operator pod.
83
tolerations: []
84
# affinity defines the node affinity rules for the operator pod.
85
affinity: {}
86
# podDisruptionBudget configures the minimum or the maxium available pods for voluntary disruptions,
87
# set to either an integer (e.g. 1) or a percentage value (e.g. 25%).
88
podDisruptionBudget:
89
enabled: false
90
minAvailable: 1
91
# maxUnavailable: 3
92
# additional environment variables for the operator container.
93
env: []
94
# additional volume mounts for the operator container.
95
volumeMounts: []
96
# additional volumes to add to the operator pod.
97
volumes: []
98
# createClusterScopedResources determines whether cluster-scoped resources (ClusterRoles, ClusterRoleBindings) should be created.
99
createClusterScopedResources: true
100
# Automount API credentials for the Service Account into the pod.
101
automountServiceAccountToken: true
102
serviceAccount:
103
# create specifies whether a service account should be created for the operator.
104
create: true
105
# Specifies whether a service account should automount API credentials.
106
automountServiceAccountToken: true
107
# annotations to add to the service account
108
annotations: {}
109
# name of the service account to use. If not set and create is true, a name is generated using the fullname template.
110
name: ""
111
tracing:
112
# enabled specifies whether APM tracing is enabled for the operator.
113
enabled: false
114
# config is a map of APM Server configuration variables that should be set in the environment.
115
config:
116
ELASTIC_APM_SERVER_URL: http://localhost:8200
117
ELASTIC_APM_SERVER_TIMEOUT: 30s
118
refs:
119
# enforceRBAC specifies whether RBAC should be enforced for cross-namespace associations between resources.
120
enforceRBAC: false
121
webhook:
122
# enabled determines whether the webhook is installed.
123
enabled: true
124
# caBundle is the PEM-encoded CA trust bundle for the webhook certificate. Only required if manageCerts is false and certManagerCert is null.
125
caBundle: Cg==
126
# certManagerCert is the name of the cert-manager certificate to use with the webhook.
127
certManagerCert: null
128
# certsDir is the directory to mount the certificates.
129
certsDir: "/tmp/k8s-webhook-server/serving-certs"
130
# failurePolicy of the webhook.
131
failurePolicy: Ignore
132
# manageCerts determines whether the operator manages the webhook certificates automatically.
133
manageCerts: true
134
# namespaceSelector corresponds to the namespaceSelector property of the webhook.
135
# Setting this restricts the webhook to act only on objects submitted to namespaces that match the selector.
136
namespaceSelector: {}
137
# objectSelector corresponds to the objectSelector property of the webhook.
138
# Setting this restricts the webhook to act only on objects that match the selector.
139
objectSelector: {}
140
# port is the port that the validating webhook binds to.
141
port: 9443
142
# secret specifies the Kubernetes secret to be mounted into the path designated by the certsDir value to be used for webhook certificates.
143
certsSecret: ""
144
# hostNetwork allows a Pod to use the Node network namespace.
145
# This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled.
146
# If hostNetwork is enabled, dnsPolicy defaults to ClusterFirstWithHostNet unless explicitly set.
147
# CAUTION: Proceed at your own risk. This setting has security concerns such as allowing malicious users to access workloads running on the host.
148
hostNetwork: false
149
# dnsPolicy defines the DNS policy for the operator pod.
150
# Check https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy for more details.
151
dnsPolicy: ""
152
# dnsConfig defines the DNS configuration for the operator pod.
153
# Check https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config for more details.
154
# dnsConfig:
155
# nameservers:
156
# - 169.254.20.10
157
# searches:
158
# - svc.cluster.local
159
# options:
160
# - name: ndots
161
# value: "2"
162
dnsConfig: {}
163
softMultiTenancy:
164
# enabled determines whether the operator is installed with soft multi-tenancy extensions.
165
# This requires network policies to be enabled on the Kubernetes cluster.
166
enabled: false
167
# kubeAPIServerIP is required when softMultiTenancy is enabled.
168
kubeAPIServerIP: null
169
# kubeAPIServerPort is the port used by the Kubernetes API server.
170
# Only used when softMultiTenancy is enabled. Defaults to 443.
171
kubeAPIServerPort: 443
172
telemetry:
173
# disabled determines whether the operator periodically updates ECK telemetry data for Kibana to consume.
174
disabled: false
175
# distributionChannel denotes which distribution channel was used to install the operator.
176
distributionChannel: "helm"
177
# config values for the operator.
178
config:
179
# logVerbosity defines the logging level. Valid values are as follows:
180
# -2: Errors only
181
# -1: Errors and warnings
182
# 0: Errors, warnings, and information
183
# number greater than 0: Errors, warnings, information, and debug details.
184
logVerbosity: "0"
185
# (Deprecated: use metrics.port: will be removed in v2.14.0) metricsPort defines the port to expose operator metrics. Set to 0 to disable metrics reporting.
186
metricsPort: 0
187
metrics:
188
# port defines the port to expose operator metrics. Set to 0 to disable metrics reporting.
189
port: "0"
190
# secureMode contains the options for enabling and configuring RBAC and TLS/HTTPs for the metrics endpoint.
191
secureMode:
192
# secureMode.enabled specifies whether to enable RBAC and TLS/HTTPs for the metrics endpoint.
193
# * This option makes most sense when using a ServiceMonitor to scrape the metrics and is therefore mutually exclusive with the podMonitor.enabled option.
194
# * This option also requires using cluster scoped resources (ClusterRole, ClusterRoleBinding) to
195
# grant access to the /metrics endpoint. (createClusterScopedResources: true is required)
196
#
197
enabled: false
198
tls:
199
# certificateSecret is the name of the tls secret containing the custom TLS certificate and key for the secure metrics endpoint.
200
#
201
# * This is an optional setting and is only required if you are using a custom TLS certificate. A self-signed certificate will be generated by default.
202
# * TLS secret key must be named tls.crt.
203
# * TLS key's secret key must be named tls.key.
204
# * It is assumed to be in the same namespace as the ServiceMonitor.
205
#
206
# example: kubectl create secret tls eck-metrics-tls-certificate -n elastic-system \
207
# --cert=/path/to/tls.crt --key=/path/to/tls.key
208
certificateSecret: ""
209
# containerRegistry to use for pulling Elasticsearch and other application container images.
210
containerRegistry: docker.elastic.co
211
# containerRepository to use for pulling Elasticsearch and other application container images.
212
# containerRepository: ""
213
214
# containerSuffix suffix to be appended to container images by default. Cannot be combined with -ubiOnly flag
215
# containerSuffix: ""
216
217
# maxConcurrentReconciles is the number of concurrent reconciliation operations to perform per controller.
218
maxConcurrentReconciles: "3"
219
# caValidity defines the validity period of the CA certificates generated by the operator.
220
caValidity: 8760h
221
# caRotateBefore defines when to rotate a CA certificate that is due to expire.
222
caRotateBefore: 24h
223
# caDir defines the directory containing a CA certificate (tls.crt) and its associated private key (tls.key) to be used for all managed resources.
224
# Setting this makes caRotateBefore and caValidity values ineffective.
225
caDir: ""
226
# certificatesValidity defines the validity period of certificates generated by the operator.
227
certificatesValidity: 8760h
228
# certificatesRotateBefore defines when to rotate a certificate that is due to expire.
229
certificatesRotateBefore: 24h
230
# disableConfigWatch specifies whether the operator watches the configuration file for changes.
231
disableConfigWatch: false
232
# exposedNodeLabels is an array of regular expressions of node labels which are allowed to be copied as annotations on Elasticsearch Pods.
233
exposedNodeLabels: ["topology.kubernetes.io/.*", "failure-domain.beta.kubernetes.io/.*"]
234
# ipFamily specifies the IP family to use. Possible values: IPv4, IPv6 and "" (auto-detect)
235
ipFamily: ""
236
# setDefaultSecurityContext determines whether a default security context is set on application containers created by the operator.
237
# *note* that the default option now is "auto-detect" to attempt to set this properly automatically when both running
238
# in an openshift cluster, and a standard kubernetes cluster. Valid values are as follows:
239
# "auto-detect" : auto detect
240
# "true" : set pod security context when creating resources.
241
# "false" : do not set pod security context when creating resources.
242
setDefaultSecurityContext: "auto-detect"
243
# kubeClientTimeout sets the request timeout for Kubernetes API calls made by the operator.
244
kubeClientTimeout: 60s
245
# elasticsearchClientTimeout sets the request timeout for Elasticsearch API calls made by the operator.
246
elasticsearchClientTimeout: 180s
247
# policies contains policies for the operator, currently only password generation policies are supported.
248
policies: {}
249
# passwords:
250
# length: 24
251
252
# validateStorageClass specifies whether storage classes volume expansion support should be verified.
253
# Can be disabled if cluster-wide storage class RBAC access is not available.
254
validateStorageClass: true
255
# enableLeaderElection specifies whether leader election should be enabled
256
enableLeaderElection: true
257
# Interval between observations of Elasticsearch health, non-positive values disable asynchronous observation.
258
elasticsearchObservationInterval: 10s
259
# ubiOnly specifies whether the operator will use only UBI container images to deploy Elastic Stack applications as well as for its own StatefulSet image. UBI images are only available from 7.10.0 onward.
260
# Cannot be combined with the containerSuffix value.
261
ubiOnly: false
262
# restrictWatchedResources restricts resource watching (secrets, services and configmaps) to resources carrying the
263
# eck.k8s.elastic.co/watched=true label. When false (default), the operator watches all resources cluster-wide.
264
restrictWatchedResources: false
265
# Prometheus PodMonitor configuration
266
# Reference: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#podmonitor
267
podMonitor:
268
# enabled determines whether a podMonitor should deployed to scrape the eck metrics.
269
# This requires the prometheus operator and the config.metrics.port not to be 0
270
enabled: false
271
# labels adds additional labels to the podMonitor
272
labels: {}
273
# annotations adds additional annotations to the podMonitor
274
annotations: {}
275
# namespace determines in which namespace the podMonitor will be deployed.
276
# If not set the podMonitor will be created in the namespace where the Helm release is installed into
277
# namespace: monitoring
278
279
# interval specifies the interval at which metrics should be scraped
280
interval: 5m
281
# scrapeTimeout specifies the timeout after which the scrape is ended
282
scrapeTimeout: 30s
283
# podTargetLabels transfers labels on the Kubernetes Pod onto the target.
284
podTargetLabels: []
285
# podMetricsEndpointConfig allows to add an extended configuration to the podMonitor
286
podMetricsEndpointConfig: {}
287
# honorTimestamps: true
288
# Prometheus ServiceMonitor configuration
289
# Only used when config.enableSecureMetrics is true
290
# Reference: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#servicemonitor
291
serviceMonitor:
292
# This option requires the following settings within Prometheus to function:
293
# 1. RBAC settings for the Prometheus instance to access the metrics endpoint.
294
#
295
# - nonResourceURLs:
296
# - /metrics
297
# verbs:
298
# - get
299
#
300
# 2. If using the Prometheus Operator and your Prometheus instance is not in the same namespace as the operator you will need
301
# the Prometheus Operator configured with the following Helm values:
302
#
303
# prometheus:
304
# prometheusSpec:
305
# serviceMonitorNamespaceSelector: {}
306
# serviceMonitorSelectorNilUsesHelmValues: false
307
#
308
# allows to disable the serviceMonitor, enabled by default for backwards compatibility
309
enabled: true
310
# namespace determines in which namespace the serviceMonitor will be deployed.
311
# If not set the serviceMonitor will be created in the namespace where the Helm release is installed into
312
# namespace: monitoring
313
# caSecret is the name of the secret containing the custom CA certificate used to generate the custom TLS certificate for the secure metrics endpoint.
314
#
315
# * This *must* be the name of the secret containing the CA certificate used to sign the custom TLS certificate for the metrics endpoint.
316
# * This secret *must* be in the same namespace as the Prometheus instance that will scrape the metrics.
317
# * If using the Prometheus operator this secret must be within the `spec.secrets` field of the `Prometheus` custom resource such that it is mounted into the Prometheus pod at `caMountDirectory`, which defaults to /etc/prometheus/secrets/{secret-name}.
318
# * This is an optional setting and is only required if you are using a custom TLS certificate.
319
# * Key must be named ca.crt.
320
#
321
# example: kubectl create secret generic eck-metrics-tls-ca -n monitoring \
322
# --from-file=ca.crt=/path/to/ca.pem
323
caSecret: ""
324
# caMountDirectory is the directory at which the CA certificate is mounted within the Prometheus pod.
325
#
326
# * You should only need to adjust this if you are *not* using the Prometheus operator.
327
caMountDirectory: "/etc/prometheus/secrets/"
328
# insecureSkipVerify specifies whether to skip verification of the TLS certificate for the secure metrics endpoint.
329
#
330
# * If this setting is set to false, then the following settings are required:
331
# - certificateSecret
332
# - caSecret
333
insecureSkipVerify: true
334
# extraObjects allows injecting additional Kubernetes resources into the chart.
335
# These resources will be created/deleted alongside the chart release.
336
# The value can be a list or a map of strings, each string is a YAML manifest.
337
# Helm templating is supported within each manifest.
338
# Example (list):
339
# extraObjects:
340
# - |
341
# apiVersion: v1
342
# kind: ConfigMap
343
# metadata:
344
# name: {{ include "eck-operator.fullname" . }}-extra-config
345
# namespace: {{ .Release.Namespace }}
346
# data:
347
# key: value
348
# Example (map):
349
# extraObjects:
350
# myConfigMap: |
351
# apiVersion: v1
352
# kind: ConfigMap
353
# metadata:
354
# name: {{ include "eck-operator.fullname" . }}-extra-config
355
# namespace: {{ .Release.Namespace }}
356
# data:
357
# key: value
358
extraObjects: []
359
# Globals meant for internal use only
360
global:
361
# manifestGen specifies whether the chart is running under manifest generator.
362
# This is used for tasks specific to generating the all-in-one.yaml file.
363
manifestGen: false
364
# createOperatorNamespace defines whether the operator namespace manifest should be generated when in manifestGen mode.
365
# Usually we do want that to happen (e.g. all-in-one.yaml) but, sometimes we don't (e.g. E2E tests).
366
createOperatorNamespace: true
367
# kubeVersion is the effective Kubernetes version we target when generating the all-in-one.yaml.
368
kubeVersion: 1.21.0
369
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.