kargo

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

## Default values for kargo.

## A human-readable version can be found in the chart README.

## This is a YAML-formatted file.

## Declare variables to be passed into your templates.

## @section Image Parameters

image:

## @param image.repository Image repository of Kargo

repository: cgr.dev/scratch-images/test-tmp/kargo

## @param image.tag Overrides the image tag. The default tag is the value of `.Chart.AppVersion`

tag: 1.11.4-r1@sha256:27100040caa9e03508143e10515e02fe121a0fb8f9ce383a8a695f7ff1fb9aec

## @param image.pullPolicy Image pull policy

pullPolicy: IfNotPresent

## @param image.pullSecrets List of imagePullSecrets.

pullSecrets: []

# - name: regcred

## @section Global Parameters

global:

## @param global.clusterSecretsNamespace **Deprecated in favor of `systemResources.namespace`.** Designates a namespace to contain Secrets associated with cluster-scoped resources. For example, ClusterConfig is a cluster-scoped resource. Cluster-scoped webhook receivers, defined as part of that resource, each must reference a Secret, however, no such thing as a cluster-scoped Secret exists within Kubernetes. To work around that, all Secrets referenced by a ClusterConfig resource must be located in a designated namespace. NOTE: The namespace designated for this purpose is NOT the place to put Secrets that you want to share across all Projects. This namespace is strictly for Secrets that must be referenced by cluster-scoped resources. **Again, this is deprecated in favor of `systemResources.namespace`.** The name of the setting _and_ its default value are both changing to better reflect the intent to use the namespace not only for Secrets, but for _all_ types of namespaced resources that lack a cluster-scoped analog. Kargo versions >= v1.9.0 and < v1.12.0 will automatically sync Secrets from the namespace specified by `clusterSecretsNamespace` to the namespace specified by `clusterSecretsNamespace` (if they are different). That migration utility will be removed from v1.12.0, by which time operators who GitOps their ClusterConfig will need to have updated their manifests accordingly. Upgrades to v1.12.0 will FAIL if `clusterSecretsNamespace` remains defined.

clusterSecretsNamespace: kargo-cluster-secrets

## @param global.createClusterSecretsNamespace **Deprecated, as it is directly related to `clusterSecretsNamespace`, which also is deprecated. See docs for `clusterSecretsNamespace` for more details.** Indicates whether the namespace specified by `clusterSecretsNamespace` should be created when installing the chart.

createClusterSecretsNamespace: true

## @param global.createClusterSecretsRBAC **Deprecated, as it is directly related to `clusterSecretsNamespace`, which also is deprecated. See docs for `clusterSecretsNamespace` for more details.** Indicates whether the Roles/RoleBindings in the namespace specified by `clusterSecretsNamespace` should be created when installing the chart.

createClusterSecretsRBAC: true

systemResources:

## @param global.systemResources.namespace Designates a namespace to contain resources associated with cluster-scoped resources and for which no cluster-scoped analog exists. For example, ClusterConfig is a cluster-scoped resource. Cluster-scoped webhook receivers, defined as part of that resource, each must reference a Secret, however, no such thing as a cluster-scoped Secret exists within Kubernetes. To work around that, all Secrets referenced by a ClusterConfig resource must be located in a designated namespace. NOTE: The namespace designated for this purpose is NOT the place to put resources that you want to share across all Projects. This namespace is strictly for namespaced resources that must be referenced by other, cluster-scoped resources.

namespace: kargo-system-resources

## @param global.systemResources.createNamespace Indicates whether the namespace specified by `global.systemResources.namespace` should be created when installing the chart.

createNamespace: true

## @param global.systemResources.createRBAC Indicates whether the Roles/RoleBindings in the namespace specified by `global.systemResources.namespace` should be created when installing the chart.

createRBAC: true

## @param global.systemResources.extraNamespaceAnnotations Additional annotations to be added to the namespace specified by `global.systemResources.namespace`.

extraNamespaceAnnotations: {}

## @param global.systemResources.extraNamespaceLabels Additional labels to be added to the namespace specified by `global.systemResources.namespace`.

extraNamespaceLabels: {}

sharedResources:

## @param global.sharedResources.namespace designates a namespace where shared resources can be located.

namespace: kargo-shared-resources

## @param global.sharedResources.createNamespace Indicates whether the namespace specified by `global.sharedResources.namespace` should be created when installing the chart.

createNamespace: true

## @param global.sharedResources.createRBAC Indicates whether the Roles/RoleBindings in the namespace specified by `global.sharedResources.namespace` should be created when installing the chart.

createRBAC: true

## @param global.sharedResources.extraNamespaceAnnotations Additional annotations to be added to the namespace specified by `global.sharedResources.namespace`.

extraNamespaceAnnotations: {}

## @param global.sharedResources.extraNamespaceLabels Additional labels to be added to the namespace specified by `global.sharedResources.namespace`.

extraNamespaceLabels: {}

## @param global.labels Labels to add to all resources.

labels: {}

## @param global.annotations Annotations to add to all resources.

annotations: {}

## @param global.podLabels Labels to add to all pods.

podLabels: {}

## @param global.podAnnotations Annotations to add to pods.

podAnnotations: {}

## ServiceAccount global settings

serviceAccount:

## @param global.serviceAccount.labels Global ServiceAccount labels.

labels: {}

## @param global.serviceAccount.annotations Global ServiceAccount annotations.

annotations: {}

# foo: bar

# another: value

## @param global.env Environment variables to add to all Kargo pods.

env: []

# - name: ENV_NAME

# value: value

## @param global.envFrom Environment variables to add to all Kargo pods from ConfigMaps or Secrets.

envFrom: []

# - configMapRef:

# name: config-map-name

# - secretRef:

# name: secret-name

## @param global.nodeSelector Default node selector for all Kargo pods.

nodeSelector: {}

## @param global.tolerations Default tolerations for all Kargo pods.

tolerations: []

## @param global.affinity Default affinity for all Kargo pods.

affinity: {}

## @param global.priorityClassName [nullable] Default priority class for all Kargo pods.

# priorityClassName:

## @param global.securityContext Default security context for all Kargo pods.

securityContext: {}

## @section Workloads

workloads:

## @param workloads.install Whether to install workload-bearing resources (Deployments, CronJobs, etc.) and their supporting resources.

install: true

## @section Data Plane

dataPlane:

## @param dataPlane.install Coarse switch that, when `false`, suppresses every data-plane resource — even where finer-grained flags (`crds.install`, `rbac.installClusterRoles`, `rbac.installClusterRoleBindings`, `webhooks.register`, `global.createClusterSecretsNamespace`, `global.sharedResources.createNamespace`, `global.systemResources.createNamespace`) would otherwise install them. Note: Argo CD data-plane RBAC is governed separately by `argocd.dataPlane.install`.

install: true

controller:

## @param dataPlane.controller.install Coarse switch governing whether per-controller data-plane resources are rendered.

install: true

## @section Argo CD Data Plane

argocd:

## @param argocd.dataPlane.install Coarse switch governing Argo CD data-plane resources — the RBAC granting the controller access to Argo CD `Application` resources. Separate from `dataPlane.install` because Argo CD may reside in a different cluster than Kargo's own data plane.

dataPlane:

install: true

100

kargoController:

101

## @param argocd.dataPlane.kargoController.install Coarse switch governing whether per-Kargo-controller Argo CD data-plane resources are rendered.

102

install: true

103

## @section CRDs

104

crds:

105

## @param crds.install Indicates if Custom Resource Definitions should be installed and upgraded as part of the release. If set to `false`, the CRDs will only be installed if they do not already exist.

106

install: true

107

## @param crds.keep Indicates if Custom Resource Definitions should be kept when a release is uninstalled.

108

keep: true

109

## @section RBAC

110

rbac:

111

## @param rbac.installClusterRoles Indicates if `ClusterRoles` should be installed.

112

installClusterRoles: true

113

## @param rbac.installClusterRoleBindings Indicates if `ClusterRoleBindings` should be installed.

114

installClusterRoleBindings: true

115

## @section Webhooks

116

webhooks:

117

## @param webhooks.register Whether to create `ValidatingWebhookConfiguration` and `MutatingWebhookConfiguration` resources.

118

119

## @section KubeConfigs

120

## @descriptionStart

121

## Optionally point to Kubernetes Secrets containing kubeconfig for:

122

123

## 1. A remote cluster hosting Kargo resources

124

125

## 2. A remote cluster hosting Argo CD resources

126

127

## This flexibility is useful for various advanced use cases -- especially

128

## topologies where Kargo data may be sharded, with Kargo controllers distributed

129

## across many clusters. Either or both of these configurations may be the same.

130

## In the average case, these should all be left unspecified. All that are

131

## unspecified will default to configuration for the cluster in which the Kargo

132

## controller is running.

133

## @descriptionEnd

134

## @skip kubeconfigSecrets

135

kubeconfigSecrets: {}

136

## @param kubeconfigSecrets.kargo [nullable] Kubernetes `Secret` name containing kubeconfig for a remote Kubernetes cluster hosting Kargo resources. Used by all Kargo components.

137

# kargo: ""

138

## @param kubeconfigSecrets.argocd [nullable] Kubernetes `Secret` name containing kubeconfig for a remote Kubernetes cluster hosting Argo CD resources. Used by Kargo controller(s) only.

139

# argocd: ""

140

141

## @section API

142

api:

143

## @param api.enabled Whether the API server is enabled.

144

enabled: true

145

## @skip api.kubeconfigSecrets

146

kubeconfigSecrets: {}

147

## @param api.kubeconfigSecrets.kargo [nullable] Per-component override for `kubeconfigSecrets.kargo`. Lets the API server mount its own kubeconfig secret rather than the shared one. Falls back to the chart-level value when unset.

148

# kargo: ""

149

150

## @param api.replicas The number of API server pods.

151

replicas: 1

152

## @param api.revisionHistoryLimit Number of old ReplicaSets the API server Deployment retains for rollback.

153

revisionHistoryLimit: 10

154

## @param api.rollingUpdate Values merged into the chart-built `strategy.rollingUpdate` for the API server Deployment. Typically used to tune `maxSurge` and `maxUnavailable` (each an absolute number or a percentage). Default empty map — Kubernetes defaults (25% / 25%) apply.

155

rollingUpdate: {}

156

# maxSurge: 25%

157

# maxUnavailable: 25%

158

159

## @param api.host The domain name where Kargo's API server will be accessible. When applicable, this is used for generation of an Ingress resource, certificates, and the OpenID Connect issuer and callback URLs. Note: The value in this field MAY include a port number and MUST NOT specify the protocol (http vs https), which is automatically inferred from other configuration options.

160

host: localhost

161

## @param api.basePath URL path prefix at which the API server is reachable. When non-empty, MUST begin with a slash and MUST NOT end with one (e.g. `/kargo`). Used as the path on any chart-generated Ingress rule for the API server, and included in chart-generated URLs (`API_SERVER_BASE_URL`, `ADMIN_ACCOUNT_TOKEN_ISSUER`, `OIDC_ISSUER_URL`, etc.). The API server binary itself always serves at the root, so when this is set, the user is responsible for configuring their Ingress controller to strip the prefix before forwarding (e.g. via Traefik's `stripPrefix` middleware, NGINX's `rewrite`, etc.).

162

basePath: ""

163

## @param api.logLevel The log level for the API server. Valid options are ERROR, INFO, DEBUG, and TRACE (case insensitive). Note that INFO level messages are written during startup regardless of the selected level.

164

logLevel: INFO

165

## @param api.logFormat The format of logs from the API server. Valid options are CONSOLE or JSON (case insensitive).

166

logFormat: CONSOLE

167

## @param api.secretManagementEnabled Specifies whether Secret management is enabled. This affects the API server's ability to manage repository credentials and other Project-level Secrets, such as those used by AnalysisRuns for verification purposes. If using GitOps to manage Kargo Projects declaratively, the API's Secret management capabilities are not needed and can be disabled to effectively reduce the API server's attackable surface.

168

secretManagementEnabled: true

169

## @param api.permissiveCORSPolicyEnabled Whether to enable a permissive CORS (Cross Origin Resource Sharing) policy. This is sometimes advantageous during local development, but otherwise, should generally be left disabled.

170

permissiveCORSPolicyEnabled: false

171

secret:

172

## @param api.secret.name Specifies the name of an existing Secret which contains the `ADMIN_ACCOUNT_PASSWORD_HASH` and `ADMIN_ACCOUNT_TOKEN_SIGNING_KEY` values. By setting this, the Secret will **not** be generated by Helm.

173

174

adminAccount:

175

## @param api.adminAccount.enabled Whether to enable the admin account.

176

enabled: true

177

## @param api.adminAccount.passwordHash Bcrypt password hash for the admin account. A value **must** be provided for this field unless `api.secret.name` is specified.

178

passwordHash: ""

179

## @param api.adminAccount.tokenSigningKey Key used to sign ID tokens (JWTs) for the admin account. It is suggested that you generate this using a password manager or a command like: `openssl rand -base64 29 \| tr -d "=+/" \| cut`. A value **must** be provided for this field, unless `api.secret.name` is specified.

180

tokenSigningKey: ""

181

## @param api.adminAccount.tokenTTL Specifies how long ID tokens for the admin account are valid. (i.e. The expiry will be the time of issue plus this duration.)

182

tokenTTL: 24h

183

## Optionally provide custom ClusterRole permissions for the various built in roles. This is

184

## useful if you want to grant extra permissions to these roles without creating entirely new

185

## roles. These should be a list of valid `roles` as you would include in a `ClusterRole`

186

## resource.

187

clusterRoles:

188

admin:

189

## @param api.clusterRoles.admin.additionalRules Additional RBAC rules to add to the kargo-admin ClusterRole.

190

additionalRules: null

191

projectCreator:

192

## @param api.clusterRoles.projectCreator.additionalRules Additional RBAC rules to add to the kargo-project-creator ClusterRole.

193

additionalRules: null

194

user:

195

## @param api.clusterRoles.user.additionalRules Additional RBAC rules to add to the kargo-user ClusterRole.

196

additionalRules: null

197

viewer:

198

## @param api.clusterRoles.viewer.additionalRules Additional RBAC rules to add to the kargo-viewer ClusterRole.

199

additionalRules: null

200

## All settings related to enabling OpenID Connect as an authentication

201

## method.

202

oidc:

203

## @param api.oidc.enabled Whether to enable authentication using Open ID Connect.

204

## NOTE: Kargo uses the Authorization Code Flow with Proof Key for Code Exchange (PKCE) and does not require a client secret. Some OIDC identity providers may not support this. If yours does not, enabling the optional Dex server and configuring its connectors can adapt most identity providers to work this way.

205

## Note also: The PKCE code challenge used by Kargo is SHA256 hashed.

206

## For more information about PKCE, please visit: https://oauth.net/2/pkce/

207

enabled: false

208

## @param api.oidc.issuerURL The issuer URL for the identity provider. If Dex is enabled, this value will be ignored and the issuer URL will be automatically configured. If Dex is not enabled, this should be set to the issuer URL provided to you by your identity provider.

209

issuerURL:

210

## @param api.oidc.clientID The client ID for the OIDC client. If Dex is enabled, this value will be ignored and the client ID will be automatically configured. If Dex is not enabled, this should be set to the client ID provided to you by your identity provider.

211

clientID:

212

## @param api.oidc.cliClientID The client ID for the OIDC client used by CLI (optional). Needed by some OIDC providers (such as Dex) that require a separate Client ID for web app login vs. CLI login (`http://localhost`). If Dex is enabled, this value will be ignored and cli client ID will be automatically configured. If Dex is not enabled, and a different client app is configured for localhost CLI login, this should be the client ID configured in the IdP.

213

cliClientID:

214

## @param api.oidc.additionalScopes The additional scopes to send to the OIDC provider. This should be set to the scopes you wish to be provided to your identity provider from clients of Kargo, the scopes openid, profile and email are always requested and don't need to be added, this value is intended for any additional ones you require.

215

additionalScopes:

216

- groups

217

## @param api.oidc.usernameClaim The claim to use as the username for the user.

218

usernameClaim: email

219

admins:

220

## @param api.oidc.admins.claims Subjects having any of these claims will automatically be Kargo admins.

221

claims: {}

222

# sub:

223

# - alice

224

# - bob

225

# email:

226

# - alice@example.com

227

# - bob@examples.com

228

# groups:

229

# - kargo-admin

230

projectCreators:

231

## @param api.oidc.projectCreators.claims Subjects having any of these claims will automatically receive the permissions of the karo-user role (see `api.oidc.users`) **plus** permission to create new `Project`s. When a `Project` is created by such a user via the CLI or UI (i.e. through the API and not through `kubectl`) they will automatically receive admin permissions within that `Project` as well as permission to update and delete the cluster-scoped `Project` resource itself.

232

claims: {}

233

# sub:

234

# - alice

235

# - bob

236

# email:

237

# - alice@example.com

238

# - bob@examples.com

239

# groups:

240

# - kargo-project-creator

241

users:

242

## @param api.oidc.users.claims Subjects having any of these claims will automatically receive read-only access to all cluster-scoped Kargo resources. This is the minimum level of permissions that can be granted to a user to allow them to view the list of Projects and system-level configuration. This does not include any access to `Secrets`.

243

claims: {}

244

# sub:

245

# - alice

246

# - bob

247

# email:

248

# - alice@example.com

249

# - bob@examples.com

250

# groups:

251

# - kargo-user

252

viewers:

253

## @param api.oidc.viewers.claims Subjects having any of these claims will automatically receive read-only access to all Kargo resources. This does not include any access to `Secret`s.

254

claims: {}

255

# sub:

256

# - alice

257

# - bob

258

# email:

259

# - alice@example.com

260

# - bob@examples.com

261

# groups:

262

# - kargo-viewer

263

globalServiceAccounts:

264

## @param api.oidc.globalServiceAccounts.namespaces List of namespaces to look for shared service accounts.

265

namespaces: []

266

dex:

267

## @param api.oidc.dex.enabled Whether to enable Dex as the identity provider. When set to true, the Kargo installation will include a Dex server and the Kargo API server will be configured to make the /dex endpoint a reverse proxy for the Dex server.

268

enabled: false

269

## All settings related to using an externally-managed Dex server (one not installed by this chart). When `byo.enabled` is `true`, the chart will NOT install a Dex server but the Kargo API server will still proxy `/dex` to the externally-managed Dex server. Configure `api.oidc.issuerURL`, `api.oidc.clientID`, etc. just as you would for any other OIDC identity provider. Mutually exclusive with `api.oidc.dex.enabled`.

270

byo:

271

## @param api.oidc.dex.byo.enabled Whether to enable proxying to an externally-managed Dex server.

272

enabled: false

273

## @param api.oidc.dex.byo.serverAddress Address (scheme + host + optional port) at which the Kargo API server should reach the externally-managed Dex server. This is used for in-cluster traffic from the API server pod to Dex, not for what end-user clients see (clients see `api.oidc.issuerURL`). Defaults to `https://kargo-dex-server.<release.namespace>.svc` — matching the chart's convention for a Dex Service named `kargo-dex-server` in the release namespace.

274

serverAddress: ""

275

## @param api.oidc.dex.byo.caCertPath Path inside the Kargo API server container at which a CA certificate trusted by Dex is mounted. Optional. When set, the API server will use this certificate when making outbound TLS connections to the externally-managed Dex server. The cert itself must be made available via `api.containers` / `api.volumes` / `api.volumeMounts` (or another out-of-band mechanism).

276

caCertPath: ""

277

## @param api.oidc.dex.revisionHistoryLimit Number of old ReplicaSets the Dex server Deployment retains for rollback.

278

revisionHistoryLimit: 10

279

## @param api.oidc.dex.rollingUpdate Values merged into the chart-built `strategy.rollingUpdate` for the Dex server Deployment. Typically used to tune `maxSurge` and `maxUnavailable` (each an absolute number or a percentage). Default empty map — Kubernetes defaults (25% / 25%) apply.

280

rollingUpdate: {}

281

# maxSurge: 25%

282

# maxUnavailable: 25%

283

284

image:

285

## @param api.oidc.dex.image.repository Image repository of Dex

286

repository: cgr.dev/scratch-images/test-tmp/dex

287

## @param api.oidc.dex.image.tag Image tag for Dex.

288

tag: 2.45.1-r26@sha256:efde42ded614a6282d5272e9c7975cd789a5d7d5d194cc60ce49677fda425c9b

289

## @param api.oidc.dex.image.pullPolicy Image pull policy for Dex.

290

pullPolicy: IfNotPresent

291

## @param api.oidc.dex.image.pullSecrets List of imagePullSecrets.

292

pullSecrets: []

293

# - name: regcred

294

## @param api.oidc.dex.logLevel The log level for the Dex server. Since Dex server is a third-party software, its log level options differ from the other Kargo components. The valid options are: DEBUG, INFO, WARN, ERROR.

295

logLevel: INFO

296

## @param api.oidc.dex.logFormat The format of logs from the Dex server. Since Dex server is a third-party software, its log format options differ from the other Kargo components. The valid options are TEXT and JSON.

297

logFormat: TEXT

298

## @param api.oidc.dex.skipApprovalScreen Whether to skip Dex's own approval screen. Since upstream identity providers will already request user consent, this second approval screen from Dex can be both superfluous and confusing.

299

skipApprovalScreen: true

300

## @param api.oidc.dex.connectors Configure [Dex connectors](https://dexidp.io/docs/connectors/) to one or more upstream identity providers.

301

connectors: []

302

# - id: mock

303

# name: Example

304

# type: mockCallback

305

## Google Example

306

# - id: google

307

# name: Google

308

# type: google

309

# config:

310

# clientID: <your client ID>

311

# clientSecret: "$CLIENT_SECRET"

312

# redirectURI: <http(s)>://<api.host>/dex/callback

313

## GitHub Example

314

# - id: github

315

# name: GitHub

316

# type: github

317

# config:

318

# clientID: <your client ID>

319

# clientSecret: "$CLIENT_SECRET"

320

# redirectURI: <http(s)>://<api.host>/dex/callback

321

## Azure Example

322

# - id: microsoft

323

# name: microsoft

324

# type: microsoft

325

# config:

326

# clientID: <your client ID>

327

# clientSecret: "$CLIENT_SECRET"

328

# redirectURI: <http(s)>://<api.host>/dex/callback

329

# tenant: <tenant ID>

330

331

## ServiceAccount specific settings

332

serviceAccount:

333

## @param api.oidc.dex.serviceAccount.labels Additional labels to add to the Dex server ServiceAccount.

334

labels: {}

335

## @param api.oidc.dex.serviceAccount.annotations Additional annotations to add to the Dex server ServiceAccount.

336

annotations: {}

337

# foo: bar

338

# another: value

339

## @param api.oidc.dex.env Environment variables to add to Dex server pods. This is convenient for cases where api.oidc.dex.connectors needs to reference environment variables from a Secret that is managed "out of band" with a secret management solution such as Sealed Secrets.

340

env: []

341

# - name: CLIENT_SECRET

342

# valueFrom:

343

# secretKeyRef:

344

# name: github-dex

345

# key: dex.github.clientSecret

346

## @param api.oidc.dex.envFrom Environment variables to add to Dex server pods from ConfigMaps or Secrets. This is especially convenient for cases where api.oidc.dex.connectors needs to reference environment variables from a Secret that is managed "out of band" with a secret management solution such as Sealed Secrets.

347

envFrom: []

348

# - configMapRef:

349

# name: config-map-name

350

# - secretRef:

351

# name: secret-name

352

353

## @param api.oidc.dex.containers Additional sidecar containers to add to Dex pods. Rendered as literal YAML.

354

containers: []

355

## @param api.oidc.dex.initContainers Additional init containers to add to Dex pods. Rendered as literal YAML.

356

initContainers: []

357

## @param api.oidc.dex.volumes Add additional volumes to Dex pods. This is convenient for cases where api.oidc.dex.connectors needs to reference mounted data from a Secret that is managed "out of band" with a secret management solution such as Sealed Secrets.

358

volumes: []

359

# - name: google-json

360

# secret:

361

# defaultMode: 420

362

# secretName: kargo-google-groups-json

363

## @param api.oidc.dex.volumeMounts Add additional volume mounts to Dex pods. This is convenient for cases where api.oidc.dex.connectors needs to reference mounted data from a Secret that is managed "out of band" with a secret management solution such as Sealed Secrets.

364

volumeMounts:

365

# - mountPath: /tmp/oidc

366

# name: google-json

367

# readOnly: true

368

369

## @param api.oidc.dex.resources Resources limits and requests for the Dex server containers.

370

resources: {}

371

# limits:

372

# cpu: 100m

373

# memory: 128Mi

374

# requests:

375

# cpu: 100m

376

# memory: 128Mi

377

378

## @param api.oidc.dex.nodeSelector Node selector for Dex server pods. Defaults to `global.nodeSelector`.

379

nodeSelector: {}

380

## @param api.oidc.dex.tolerations Tolerations for Dex server pods. Defaults to `global.tolerations`.

381

tolerations: []

382

## @param api.oidc.dex.affinity Specifies pod affinity for the Dex server pods. Defaults to `global.affinity`.

383

affinity: {}

384

## @param api.oidc.dex.priorityClassName [nullable] Name of the priority class for the Dex server pods. Defaults to `global.priorityClassName`.

385

# priorityClassName:

386

## @param api.oidc.dex.annotations Annotations to add to the Dex server deployment. Merges with `global.annotations`, allowing you to override or add to the global annotations.

387

annotations: {}

388

## @param api.oidc.dex.podAnnotations Annotations to add to the Dex server pods. Merges with `global.podAnnotations`, allowing you to override or add to the global annotations.

389

podAnnotations: {}

390

## @param api.oidc.dex.securityContext Security context for Dex server pods. Defaults to `global.securityContext`.

391

securityContext: {}

392

probes:

393

## @param api.oidc.dex.probes.enabled Whether startup, liveness, and readiness probes should be included in the Dex server deployment. It is sometimes advantageous to disable these during local development.

394

enabled: true

395

## @param api.oidc.dex.probes.startupProbe [object] Values merged into the chart-built `startupProbe` for the Dex server. Typically used to tune timing fields like `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`, `successThreshold`, and `failureThreshold`.

396

startupProbe:

397

initialDelaySeconds: 10

398

# periodSeconds: 10

399

# timeoutSeconds: 1

400

# successThreshold: 1

401

failureThreshold: 30

402

## @param api.oidc.dex.probes.livenessProbe [object] Values merged into the chart-built `livenessProbe` for the Dex server. Default is an empty map, so the chart's `livenessProbe` renders with Kubernetes-default timings.

403

livenessProbe: {}

404

# initialDelaySeconds: 0

405

# periodSeconds: 10

406

# timeoutSeconds: 1

407

# successThreshold: 1

408

# failureThreshold: 3

409

## @param api.oidc.dex.probes.readinessProbe [object] Values merged into the chart-built `readinessProbe` for the Dex server.

410

readinessProbe:

411

initialDelaySeconds: 5

412

# periodSeconds: 10

413

# timeoutSeconds: 1

414

# successThreshold: 1

415

# failureThreshold: 3

416

tls:

417

## @param api.oidc.dex.tls.selfSignedCert Whether to generate a self-signed certificate for use with Dex. If `true`, `cert-manager` CRDs **must** be present in the cluster. The chart will create and use its own namespaced `Issuer`. If `false`, a cert `Secret` with the name specified by `api.oidc.dex.tls.secretName` **must** be provided in the same namespace as Kargo. There is no provision for running Dex without TLS.

418

selfSignedCert: true

419

## @param api.oidc.dex.tls.secretName Name of the cert `Secret` for use with Dex. When `api.oidc.dex.tls.selfSignedCert` is `true`, this will be the name of the generated cert `Secret`. When `api.oidc.dex.tls.selfSignedCert` is `false`, a cert `Secret` with this name **must** be provided in the same namespace as Kargo. There is no provision for running Dex without TLS.

420

secretName: kargo-dex-server-cert

421

argocd:

422

## @param api.argocd.urls Mapping of Argo CD shards names to URLs to support deep links to Argo CD URLs. If sharding is not used, map the empty string to the single Argo CD URL.

423

urls:

424

# "": https://argocd.example.com

425

# "shard2": https://argocd2.example.com

426

## All settings relating to the use of Argo Rollouts by the API Server.

427

rollouts:

428

## @param api.rollouts.integrationEnabled Specifies whether Argo Rollouts integration is enabled. When not enabled, the API server will not be capable of creating/updating/applying AnalysesTemplate resources in the Kargo control plane. When enabled, the API server will perform a sanity check at startup. If Argo Rollouts CRDs are not found, the API server will proceed as if this integration had been explicitly disabled. Explicitly disabling is still preferable if this integration is not desired, as it will grant fewer permissions to the API server.

429

integrationEnabled: true

430

## All settings related to streaming logs from the pods of AnalysisRuns using JobMetric providers.

431

logs:

432

## @param api.rollouts.logs.enabled Specifies whether support for streaming logs from AnalysisRuns using a JobMetric provider is enabled. This feature requires you to have forwarded and stored the logs yourself in a place where they can be retrieved with an HTTP GET.

433

enabled: false

434

## @param api.rollouts.logs.urlTemplate Instructs Kargo on how to construct a URL for the retrieval of relevant logs via HTTP GET. Expressions offset by ${{ }} are supported with the following variables pre-defined and injected with values: project (name), namespace (always equal to the Project's name), stage (name), analysisRun (name), metricName (name of the JobMetric), jobNamespace (namespace of the Job; may be different that the Project namespace as the Job may actually execute in a different cluster), jobName, container (name; since a Pod associated with a Job could have more than one). Example: "https://logs.kargo.example.com/${{project}}/${{analysisRun}}/${{jobName}}/${{container}}".

435

urlTemplate: ""

436

tokenSecret:

437

## @param api.rollouts.logs.tokenSecret.name specifies the name of a Kubernetes Secret managed "out of band" that contains a token usable for accessing job metric logs.

438

name:

439

## @param api.rollouts.logs.tokenSecret.key specifies the key in a Kubernetes Secret (named by name) that is managed "out of band" and contains a token usable for accessing job metric logs.

440

key:

441

## @param api.rollouts.logs.httpHeaders Specifies HTTP headers to include in the HTTP GET request for log retrieval. These are typically used for authentication. The header values support expressions offset by ${{ }}, with the same variables documented for urlTemplate pre-defined and injected with values.

442

httpHeaders: {}

443

## @param api.labels Labels to add to the api resources. Merges with `global.labels`, allowing you to override or add to the global labels.

444

labels: {}

445

## @param api.annotations Annotations to add to the api resources. Merges with `global.annotations`, allowing you to override or add to the global annotations.

446

annotations: {}

447

## @param api.podLabels Optional labels to add to pods. Merges with `global.podLabels`, allowing you to override or add to the global labels.

448

podLabels: {}

449

## @param api.podAnnotations Optional annotations to add to pods. Merges with `global.podAnnotations`, allowing you to override or add to the global annotations.

450

podAnnotations: {}

451

## ServiceAccount specific settings

452

serviceAccount:

453

## @param api.serviceAccount.labels Additional labels to add to the API server ServiceAccount.

454

labels: {}

455

## @param api.serviceAccount.annotations Additional annotations to add to the API server ServiceAccount.

456

annotations: {}

457

# foo: bar

458

# another: value

459

## @param api.env Environment variables to add to API server pods.

460

env: []

461

# - name: ENV_NAME

462

# value: value

463

## @param api.envFrom Environment variables to add to API server pods from ConfigMaps or Secrets.

464

envFrom: []

465

# - configMapRef:

466

# name: config-map-name

467

# - secretRef:

468

# name: secret-name

469

470

## @param api.containers Additional sidecar containers to add to API server pods. Rendered as literal YAML.

471

containers: []

472

## @param api.initContainers Additional init containers to add to API server pods. Rendered as literal YAML.

473

initContainers: []

474

## @param api.volumes Additional pod-level volumes for API server pods. Rendered as literal YAML.

475

volumes: []

476

## @param api.volumeMounts Additional volume mounts for the API server container. Rendered as literal YAML.

477

volumeMounts: []

478

## @param api.resources Resources limits and requests for the api containers.

479

resources: {}

480

# limits:

481

# cpu: 100m

482

# memory: 128Mi

483

# requests:

484

# cpu: 100m

485

# memory: 128Mi

486

487

## @param api.nodeSelector Node selector for api pods. Defaults to `global.nodeSelector`.

488

nodeSelector: {}

489

## @param api.tolerations Tolerations for api pods. Defaults to `global.tolerations`.

490

tolerations: []

491

## @param api.affinity Specifies pod affinity for api pods. Defaults to `global.affinity`.

492

affinity: {}

493

## @param api.topologySpreadConstraints Topology spread constraints for api pods.

494

## e.g.

495

## topologySpreadConstraints:

496

## - maxSkew: 1

497

## topologyKey: kubernetes.io/hostname

498

## whenUnsatisfiable: DoNotSchedule

499

## labelSelector:

500

## matchLabels:

501

## app.kubernetes.io/component: api

502

topologySpreadConstraints: []

503

## @param api.priorityClassName [nullable] Name of the priority class for api pods. Defaults to `global.priorityClassName`.

504

# priorityClassName:

505

## @param api.securityContext Security context for api pods. Defaults to `global.securityContext`.

506

securityContext: {}

507

podDisruptionBudget:

508

## @param api.podDisruptionBudget.enabled Whether to create a PodDisruptionBudget for the API server.

509

enabled: false

510

## @param api.podDisruptionBudget.minAvailable Minimum number/percentage of pods that must remain available during disruption. Cannot be used with maxUnavailable.

511

minAvailable: 1

512

## @param api.podDisruptionBudget.maxUnavailable Maximum number/percentage of pods that can be unavailable during disruption. Cannot be used with minAvailable.

513

maxUnavailable: ""

514

cabundle:

515

## @param api.cabundle.configMapName Specifies the name of an optional ConfigMap containing CA certs that is managed "out of band." Values in the ConfigMap named here should each contain a single PEM-encoded CA cert. If secretName is also defined, it will take precedence over this field.

516

configMapName: ""

517

## @param api.cabundle.secretName Specifies the name of an optional Secret containing CA certs that is managed "out of band." Values in the Secret named here should each contain a single PEM-encoded CA cert. If defined, the value of this field takes precedence over any in configMapName.

518

secretName: ""

519

probes:

520

## @param api.probes.enabled Whether startup, liveness, and readiness probes should be included in the API server deployment. It is sometimes advantageous to disable these during local development.

521

enabled: true

522

## @param api.probes.startupProbe [object] Values merged into the chart-built `startupProbe` for the API server. Typically used to tune timing fields like `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`, `successThreshold`, and `failureThreshold`.

523

startupProbe:

524

initialDelaySeconds: 10

525

# periodSeconds: 10

526

# timeoutSeconds: 1

527

# successThreshold: 1

528

failureThreshold: 30

529

## @param api.probes.livenessProbe [object] Values merged into the chart-built `livenessProbe` for the API server. Default is an empty map, so the chart's `livenessProbe` renders with Kubernetes-default timings.

530

livenessProbe: {}

531

# initialDelaySeconds: 0

532

# periodSeconds: 10

533

# timeoutSeconds: 1

534

# successThreshold: 1

535

# failureThreshold: 3

536

## @param api.probes.readinessProbe [object] Values merged into the chart-built `readinessProbe` for the API server.

537

readinessProbe:

538

initialDelaySeconds: 5

539

# periodSeconds: 10

540

# timeoutSeconds: 1

541

# successThreshold: 1

542

# failureThreshold: 3

543

tls:

544

## @param api.tls.enabled Whether to enable TLS directly on the API server. This is helpful if you do not intend to use an ingress controller or if you require TLS end-to-end. All other settings in this section EXCEPT `terminatedUpstream` will be ignored when this is set to `false`.

545

enabled: true

546

## @param api.tls.selfSignedCert Whether to generate a self-signed certificate for use by the API server. If `true`, `cert-manager` CRDs **must** be present in the cluster. The chart will create and use its own namespaced `Issuer`. If `false`, a cert `Secret` with the name specified by `api.tls.secretName` **must** be provided in the same namespace as Kargo. The value in this field has no effect if `api.tls.enabled` is `false`.

547

selfSignedCert: true

548

## @param api.tls.secretName Name of the cert `Secret` to use for the API server. When `api.tls.selfSignedCert` is `true`, this will be the name of the generated cert `Secret`. When `api.tls.selfSignedCert` is `false`, a cert `Secret` with this name **must** be provided in the same namespace as Kargo. The value in this field has no effect if `api.tls.enabled` is `false`.

549

secretName: kargo-api-cert

550

## @param api.tls.terminatedUpstream Whether TLS is terminated upstream, i.e. a load balancer, reverse-proxy, or an `Ingress` controller using a single wildcard cert is terminating it. Setting this to `true` forces all API server URLs to use HTTPS even if the `Ingress` (if applicable) or API server itself are listening for plain HTTP requests.

551

terminatedUpstream: false

552

ingress:

553

## @param api.ingress.enabled Whether to enable ingress by creating an Ingress resource. By default, this is disabled. Enabling ingress is advanced usage.

554

enabled: false

555

## @param api.ingress.annotations Annotations specified by your ingress controller to customize the behavior of the Ingress resource.

556

annotations: {}

557

# kubernetes.io/ingress.class: nginx

558

## @param api.ingress.ingressClassName If implemented by your ingress controller, specifies the ingress class. If your ingress controller does not support this, use the `kubernetes.io/ingress.class` annotation instead.

559

ingressClassName:

560

tls:

561

## @param api.ingress.tls.enabled Whether to associate a certificate with the Ingress resource.

562

enabled: true

563

## @param api.ingress.tls.selfSignedCert Whether to generate a self-signed certificate for use with the API server's `Ingress` resource. If `true`, `cert-manager` CRDs **must** be present in the cluster. The chart will create and use its own namespaced `Issuer`. If `false`, a cert `Secret` with the name specified by `api.ingress.tls.secretName` **must** be provided in the same namespace as Kargo. The value in this field has no effect if `api.ingress.tls.enabled` is `false`.

564

selfSignedCert: true

565

## @param api.ingress.tls.secretName Name of the cert `Secret` for use with the API server's `Ingress` resource. When `api.ingress.tls.selfSignedCert` is `true`, this will be the name of the generated cert `Secret`. When `api.ingress.tls.selfSignedCert` is `false`, a cert `Secret` with this name **must** be provided in the same namespace as Kargo. The value in this field has no effect if `api.ingress.tls.enabled` is `false`.

566

secretName: kargo-api-ingress-cert

567

## @param api.ingress.pathType You may want to use `Prefix` for some controllers (like AWS LoadBalancer Ingress controller), which don't support `/` as wildcard path when pathType is set to `ImplementationSpecific`

568

pathType: ImplementationSpecific

569

service:

570

## @param api.service.type If you're not going to use an ingress controller, you may want to change this value to `LoadBalancer` for production deployments. If running locally, you may want to change it to `NodePort` OR leave it as `ClusterIP` and use `kubectl port-forward` to map a port on the local network interface to the service.

571

type: ClusterIP

572

## @param api.service.nodePort [nullable] Host port the `Service` will be mapped to when `type` is either `NodePort` or `LoadBalancer`. If not specified, Kubernetes chooses.

573

# nodePort:

574

## @param api.service.annotations Annotations to add to the API server's service. Merges with `global.annotations`, allowing you to override or add to the global annotations.

575

annotations: {}

576

## @section Controller

577

## All settings for the controller component

578

controller:

579

## @param controller.enabled Whether the controller is enabled.

580

enabled: true

581

## @param controller.id [nullable] When set per-controller data plane resources will be suffixed with this value. This allows for the installation of multiple controllers into a single cluster or even a single namespace (each as its own, separate Helm release) without name collisions.

582

# id:

583

584

## @param controller.revisionHistoryLimit Number of old ReplicaSets the controller Deployment retains for rollback. The controller uses a `Recreate` rollout strategy (singleton), so `rollingUpdate.*` knobs do not apply.

585

revisionHistoryLimit: 10

586

## @skip controller.kubeconfigSecrets

587

kubeconfigSecrets: {}

588

## @param controller.kubeconfigSecrets.kargo [nullable] Per-component override for `kubeconfigSecrets.kargo`. Lets the controller mount its own kubeconfig secret rather than the shared one. Falls back to the chart-level value when unset.

589

# kargo: ""

590

## @param controller.kubeconfigSecrets.argocd [nullable] Per-component override for `kubeconfigSecrets.argocd`. Falls back to the chart-level value when unset.

591

# argocd: ""

592

593

## @param controller.logLevel The log level for the controller. Valid options are ERROR, INFO, DEBUG, and TRACE (case insensitive). Note that INFO level messages are written during startup regardless of the selected level.

594

logLevel: INFO

595

## @param controller.logFormat The format of logs from the controller. Valid options are CONSOLE or JSON (case insensitive).

596

logFormat: CONSOLE

597

## @param controller.isDefault When running multiple controllers backed by a single underlying control plane, designating this controller as the default will cause it to operate on resources not assigned to a specific shard. If `controller.shardName` is undefined, this controller will be considered the default **regardless** of the value of this field (as that was the behavior prior to the introduction of this field). If `controller.shardName` **is** defined, this controller will not be considered the default **unless, additionally** this field is `true`. i.e. A controller is effectively considered the default if `or (not controller.shardName) controller.isDefault`. If `controller.shardName` is defined **and** this field is `true`, this controller will operate **both** on resources explicitly assigned to it **as well as** those not assigned to a specific shard.

598

isDefault: false

599

## @param controller.shardName [nullable] When running multiple controllers backed by a single underlying control plane, specifying a shard name will cause this controller to operate **only** on resources with a matching shard name. Leaving this field undefined will designate this controller as the default controller that is responsible for resources that are not assigned to a specific shard **regardless** of the value of `controller.isDefault` (as that was the behavior prior to the introduction of `controller.isDefault`). If this field is defined, this controller will not be considered the default **unless, additionally** `controller.isDefault` is `true`. i.e. A controller is effectively considered the default if `or (not controller.shardName) controller.isDefault`. If this field is defined **and** `controller.isDefault` is true, this controller will operate **both** on resources explicitly assigned to it **as well as** those not assigned to a specific shard.

600

# shardName:

601

602

## **Deprecated in favor of `global.sharedResources`.**. All settings relating to shared credentials (used across multiple kargo projects).

603

globalCredentials:

604

## @param controller.globalCredentials.namespaces **Deprecated in favor of `global.sharedResources.namespace`.** List of namespaces to look for shared credentials. Note that as of v1.0.0, the Kargo controller does not have cluster-wide access to Secrets. The controller receives read-only permission for Secrets on a per-Project basis as Projects are created. If you designate some namespaces as homes for "global" credentials, you will need to manually grant the controller permission to read Secrets in those namespaces.

605

namespaces: []

606

## @param controller.allowCredentialsOverHTTP Specifies whether the controller should allow credentials (for Git repositories, etc.) to be retrieved and used for operations over HTTP. This is generally discouraged, as it can expose sensitive information. When set to `false`, the controller will only allow credentials to be used over HTTPS (or other secure protocols).

607

allowCredentialsOverHTTP: false

608

## Reconciler-specific settings

609

reconcilers:

610

## @param controller.reconcilers.maxConcurrentReconciles specifies the maximum number of resources EACH of the controller's reconcilers can reconcile concurrently. This setting may also be overridden on a per-reconciler basis.

611

maxConcurrentReconciles: 4

612

controlFlowStages:

613

## @param controller.reconcilers.controlFlowStages.maxConcurrentReconciles optionally overrides the maximum number of control flow Stage resources the controller can reconcile concurrently.

614

maxConcurrentReconciles:

615

promotions:

616

## @param controller.reconcilers.promotions.maxConcurrentReconciles optionally overrides the maximum number of Promotion resources the controller can reconcile concurrently.

617

maxConcurrentReconciles:

618

stages:

619

## @param controller.reconcilers.stages.maxConcurrentReconciles optionally overrides the maximum number of (non-control flow) Stage resources the controller can reconcile concurrently.

620

maxConcurrentReconciles:

621

warehouses:

622

## @param controller.reconcilers.warehouses.maxConcurrentReconciles optionally overrides the maximum number of Warehouse resources the controller can reconcile concurrently.

623

maxConcurrentReconciles:

624

## @param controller.reconcilers.warehouses.minReconciliationInterval optionally sets the minimum reconciliation interval for Warehouse resources. Accepts duration format (e.g., "5m", "1h", "30s"). If a Warehouse specifies an interval lower than this minimum, the minimum value will be enforced instead. If not set, no minimum is enforced.

625

minReconciliationInterval: "5m0s"

626

gitClient:

627

## @param controller.gitClient.name Specifies the name of the Kargo controller (used when authoring Git commits).

628

629

## @param controller.gitClient.email Specifies the email of the Kargo controller (used when authoring Git commits).

630

email: "no-reply@kargo.io"

631

## @param controller.gitClient.pushIntegrationPolicy Controls how remote changes are integrated before pushing. Options: AlwaysRebase (unconditionally rebase), RebaseOrMerge (rebase when safe, merge otherwise), RebaseOrFail (rebase when safe, fail otherwise), AlwaysMerge (unconditionally merge). The default will change from AlwaysRebase to RebaseOrMerge in v1.12.0.

632

pushIntegrationPolicy: "AlwaysRebase"

633

signingKeySecret:

634

## @param controller.gitClient.signingKeySecret.name Specifies the name of an existing `Secret` which contains the Git user's signing key. The value should be accessible under `.data.signingKey` in the same namespace as Kargo. When the signing key is a GPG key, the GPG key's name and email address identity must match the values defined for `controller.gitClient.name` and `controller.gitClient.email`.

635

636

## @param controller.gitClient.signingKeySecret.type Specifies the type of the signing key. The currently supported and default option is `gpg`.

637

type: ""

638

githubPush:

639

## @param controller.githubPush.maxRevisions The maximum number of commits that the github-push step will replay via the GitHub API in a single push. This is a safety guardrail against accidentally replaying large numbers of commits.

640

maxRevisions: 10

641

## @param controller.githubPush.verifyUntrustedCommits When true, the github-push step will omit author/committer information for ALL commits replayed via the GitHub API, not just those signed by a trusted key. This causes GitHub to sign all commits with its own key, resulting in verified commits regardless of trust. Use with caution -- this manufactures trust where none exists.

642

verifyUntrustedCommits: false

643

images:

644

registries:

645

## @param controller.images.registries.rateLimit defines the rate limit in requests-per-second (on a per registry basis) that will be voluntarily enforced client-side for all interactions with container image registries. The default limit is very low, but tune this setting with great caution. Turning it up is not a guarantee of improved Warehouse performance. When registries begin enforcing rate limits because the client is not, the resulting errors may degrade performance worse than voluntarily observing a more conservative rate limit.

646

rateLimit: 20

647

cache:

648

## @param controller.images.cache.cacheByTagPolicy establishes a policy regarding the caching of container image metadata using tags as keys in order to realize a performance boost. Doing so is safest when it is known that image tags are immutable (never overwritten). Permissible values are: "Forbid" (no caching by tag; silently enforced), "Allow" (subscriptions MAY opt-in to caching by tag), "Require" (subscriptions MUST opt-in to caching by tag; effectively this is developer acknowledgement of the cache by tag behavior), "Force" (caching by tag is silently enforced).

649

cacheByTagPolicy: Allow

650

## @param controller.images.cache.maxEntries specifies the maximum number of entries in the internal image metadata cache.

651

maxEntries: 100000

652

push:

653

## @param controller.images.push.maxArtifactSize The maximum size (in bytes) for cross-repository OCI artifact pushes. Defaults to 1 GiB (1073741824). Set to 0 to block all cross-repo pushes, or -1 to disable the limit.

654

maxArtifactSize: 1073741824

655

## All settings relating to the Argo CD control plane this controller might

656

## integrate with.

657

argocd:

658

## @param controller.argocd.integrationEnabled Specifies whether Argo CD integration is enabled. When not enabled, the controller will not watch Argo CD Application resources or factor Application health and sync state into determinations of Stage health. Argo CD-based promotion mechanisms will also fail. When enabled, the controller will perform a sanity check at startup. If Argo CD CRDs are not found, the controller will proceed as if this integration had been explicitly disabled. Explicitly disabling is still preferable if this integration is not desired, as it will grant fewer permissions to the controller.

659

integrationEnabled: true

660

## @param controller.argocd.namespace The namespace into which Argo CD is installed.

661

namespace: argocd

662

## @param controller.argocd.watchArgocdNamespaceOnly Specifies whether the reconciler that watches Argo CD Applications for the sake of forcing related Stages to reconcile should only watch Argo CD Application resources residing in Argo CD's own namespace. Note: Older versions of Argo CD only supported Argo CD Application resources in Argo CD's own namespace, but newer versions support Argo CD Application resources in any namespace. This should usually be left as `false`.

663

watchArgocdNamespaceOnly: false

664

## All settings relating to the use of Argo Rollouts AnalysisTemplates and

665

## AnalysisRuns as a means of verifying Stages after a Promotion.

666

rollouts:

667

## @param controller.rollouts.integrationEnabled Specifies whether Argo Rollouts integration is enabled. When not enabled, the controller will not reconcile Argo Rollouts AnalysisRun resources and attempts to verify Stages via Analysis will fail. When enabled, the controller will perform a sanity check at startup. If Argo Rollouts CRDs are not found, the controller will proceed as if this integration had been explicitly disabled. Explicitly disabling is still preferable if this integration is not desired, as it will grant fewer permissions to the controller.

668

integrationEnabled: true

669

## @param controller.rollouts.controllerInstanceID Specifies a cluster on which Jobs corresponding to an AnalysisRun (used for Freight/Stage verification purposes) will be executed. This is useful in cases where the cluster hosting the Kargo control plane is not a suitable environment for executing user-defined logic. Kargo will use this as the value of the rgo-rollouts.argoproj.io/controller-instance-id label when creating AnalysisRuns. When this is left empty/undefined, no such label will be added to AnalysisRuns.

670

controllerInstanceID: ""

671

## @param controller.labels Labels to add to the api resources. Merges with `global.labels`, allowing you to override or add to the global labels.

672

labels: {}

673

## @param controller.annotations Annotations to add to the api resources. Merges with `global.annotations`, allowing you to override or add to the global annotations.

674

annotations: {}

675

## @param controller.podLabels Optional labels to add to pods. Merges with `global.podLabels`, allowing you to override or add to the global labels.

676

podLabels: {}

677

## @param controller.podAnnotations Optional annotations to add to pods. Merges with `global.podAnnotations`, allowing you to override or add to the global annotations.

678

podAnnotations: {}

679

## All settings relating to the service account for the controller

680

serviceAccount:

681

## @param controller.serviceAccount.iamRole Specifies the ARN of an AWS IAM role to be used by the controller in an IRSA-enabled EKS cluster.

682

iamRole: ""

683

## @param controller.serviceAccount.labels Additional labels to add to the controller ServiceAccount.

684

labels: {}

685

## @param controller.serviceAccount.annotations Additional annotations to add to the controller ServiceAccount.

686

annotations: {}

687

# foo: bar

688

# another: value

689

## @param controller.serviceAccount.clusterWideSecretReadingEnabled Specifies whether the controller's ServiceAccount should be granted read permissions to Secrets CLUSTER-WIDE in the Kargo control plane's cluster. Enabling this is highly discouraged and you do so at your own peril. When this is NOT enabled, the Kargo management controller will dynamically expand and contract the controller's permissions to read Secrets on a Project-by-Project basis.

690

clusterWideSecretReadingEnabled: false

691

## @param controller.initContainers Optional init containers to add to the controller pods. This is rendered as the literal YAML.

692

initContainers: []

693

# - name: download-tools

694

# image: alpine:3.8

695

# command: [ sh, -c ]

696

# args:

697

# - ls

698

699

## @param controller.env Environment variables to add to controller pods.

700

env: []

701

# - name: ENV_NAME

702

# value: value

703

## @param controller.envFrom Environment variables to add to controller pods from ConfigMaps or Secrets.

704

envFrom: []

705

# - configMapRef:

706

# name: config-map-name

707

# - secretRef:

708

# name: secret-name

709

710

## @param controller.containers Additional sidecar containers to add to controller pods. Rendered as literal YAML.

711

containers: []

712

## @param controller.volumes Volumes for the controller pods.

713

volumes: []

714

## @param controller.volumeMounts Volume mounts for the controller pods.

715

volumeMounts: []

716

## @param controller.resources Resources limits and requests for the controller containers.

717

resources: {}

718

# limits:

719

# cpu: 100m

720

# memory: 128Mi

721

# requests:

722

# cpu: 100m

723

# memory: 128Mi

724

725

## @param controller.nodeSelector Node selector for controller pods. Defaults to `global.nodeSelector`.

726

nodeSelector: {}

727

## @param controller.tolerations Tolerations for controller pods. Defaults to `global.tolerations`.

728

tolerations: []

729

## @param controller.affinity Specifies pod affinity for controller pods. Defaults to `global.affinity`.

730

affinity: {}

731

## @param controller.priorityClassName [nullable] Name of the priority class for controller pods. Defaults to `global.priorityClassName`.

732

# priorityClassName:

733

## @param controller.securityContext Security context for controller pods. Defaults to `global.securityContext`.

734

securityContext: {}

735

cabundle:

736

## @param controller.cabundle.configMapName Specifies the name of an optional ConfigMap containing CA certs that is managed "out of band." Values in the ConfigMap named here should each contain a single PEM-encoded CA cert. If secretName is also defined, it will take precedence over this field.

737

configMapName: ""

738

## @param controller.cabundle.secretName Specifies the name of an optional Secret containing CA certs that is managed "out of band." Values in the Secret named here should each contain a single PEM-encoded CA cert. If defined, the value of this field takes precedence over any in configMapName.

739

secretName: ""

740

## All settings relating to exposing the controller's Prometheus metrics.

741

metrics:

742

## @param controller.metrics.enabled Whether to expose the controller's Prometheus metrics. When enabled, the controller binds its metrics server (via `METRICS_BIND_ADDRESS`), declares a metrics container port, and a metrics `Service` is created. Metrics are served over plain HTTP.

743

enabled: false

744

service:

745

## @param controller.metrics.service.type The type of the metrics `Service`.

746

type: ClusterIP

747

## @param controller.metrics.service.clusterIP The cluster IP of the metrics `Service`. Set to `None` for a headless `Service`, which resolves directly to individual pod IPs -- useful for scrapers that perform their own endpoint discovery.

748

clusterIP: ""

749

## @param controller.metrics.service.annotations Annotations to add to the metrics `Service`.

750

annotations: {}

751

## @param controller.metrics.service.labels Additional labels to add to the metrics `Service`.

752

labels: {}

753

## @param controller.metrics.service.servicePort The port exposed by the metrics `Service`. Also used as the container port and the address the metrics server binds to.

754

servicePort: 9090

755

## @param controller.metrics.service.portName The name of the metrics port. Referenced by the `ServiceMonitor` endpoint.

756

portName: http-metrics

757

serviceMonitor:

758

## @param controller.metrics.serviceMonitor.enabled Whether to create a Prometheus Operator `ServiceMonitor` for the controller's metrics. Requires `controller.metrics.enabled` to be `true` and the Prometheus Operator CRDs (`monitoring.coreos.com/v1`) to be present in the cluster; otherwise it is silently skipped.

759

enabled: false

760

## @param controller.metrics.serviceMonitor.interval The scrape interval for the `ServiceMonitor`.

761

interval: 30s

762

## @param controller.metrics.serviceMonitor.scheme The scheme to use when scraping. Defaults to `http` (metrics are served over plain HTTP).

763

scheme: ""

764

## @param controller.metrics.serviceMonitor.tlsConfig TLS configuration for the `ServiceMonitor` endpoint. Rendered as literal YAML.

765

tlsConfig: {}

766

## @param controller.metrics.serviceMonitor.relabelings Relabeling rules applied to samples before scraping. Rendered as literal YAML.

767

relabelings: []

768

## @param controller.metrics.serviceMonitor.metricRelabelings Relabeling rules applied to samples before ingestion. Rendered as literal YAML.

769

metricRelabelings: []

770

## @param controller.metrics.serviceMonitor.additionalLabels Additional labels to add to the `ServiceMonitor`. Often required to match the label selector of your Prometheus Operator instance.

771

additionalLabels: {}

772

## @param controller.metrics.serviceMonitor.namespace The namespace in which to create the `ServiceMonitor`. Defaults to the release namespace.

773

namespace: ""

774

## @section Garbage Collector

775

garbageCollector:

776

## @param garbageCollector.enabled Whether the garbage collector is enabled.

777

enabled: true

778

## @skip garbageCollector.kubeconfigSecrets

779

kubeconfigSecrets: {}

780

## @param garbageCollector.kubeconfigSecrets.kargo [nullable] Per-component override for `kubeconfigSecrets.kargo`. Lets the garbage collector mount its own kubeconfig secret rather than the shared one. Falls back to the chart-level value when unset.

781

# kargo: ""

782

783

## @param garbageCollector.logLevel The log level for the garbage collector. Valid options are ERROR, INFO, DEBUG, and TRACE (case insensitive). Note that INFO level messages are written during startup regardless of the selected level.

784

logLevel: INFO

785

## @param garbageCollector.logFormat The format of logs from the garbage collector. Valid options are CONSOLE or JSON (case insensitive).

786

logFormat: CONSOLE

787

## @param garbageCollector.schedule When to run the garbage collector.

788

schedule: "0 * * * *"

789

## @param garbageCollector.suspend Whether to suspend the garbage collector CronJob. When `true`, the CronJob remains in place but stops launching new Jobs.

790

suspend: false

791

## @param garbageCollector.successfulJobsHistoryLimit Number of successful Job records to retain. Defaults to the Kubernetes CronJob default of `3`.

792

successfulJobsHistoryLimit: 3

793

## @param garbageCollector.failedJobsHistoryLimit Number of failed Job records to retain. Defaults to the Kubernetes CronJob default of `1`.

794

failedJobsHistoryLimit: 1

795

## @param garbageCollector.ttlSecondsAfterFinished Optional automatic cleanup delay (in seconds) for completed garbage collector Jobs. Each Job will be eligible for deletion this many seconds after it finishes. Leave empty/unset to retain Jobs indefinitely (subject to the `*JobsHistoryLimit` knobs).

796

ttlSecondsAfterFinished:

797

## @param garbageCollector.workers The number of concurrent workers to run. Tuning this too low will result in slow garbage collection. Tuning this too high will result in too many API calls and may result in throttling.

798

workers: 3

799

## @param garbageCollector.maxRetainedPromotions The ideal maximum number of Promotions OLDER than the oldest Promotion in a non-terminal phase (for each Stage) that may be spared by the garbage collector. The ACTUAL number of older Promotions spared may exceed this ideal if some Promotions that would otherwise be deleted do not meet the minimum age criterion.

800

maxRetainedPromotions: 20

801

## @param garbageCollector.minPromotionDeletionAge The minimum age a Promotion must be before considered eligible for garbage collection.

802

minPromotionDeletionAge: 336h # Two weeks

803

## @param garbageCollector.maxRetainedFreight The ideal maximum number of Freight OLDER than the oldest still in use (from each Warehouse) that may be spared by the garbage collector. The ACTUAL number of older Freight spared may exceed this ideal if some Freight that would otherwise be deleted do not meet the minimum age criterion.

804

maxRetainedFreight: 20

805

## @param garbageCollector.minFreightDeletionAge The minimum age Freight must be before considered eligible for garbage collection.

806

minFreightDeletionAge: 336h # Two weeks

807

## @param garbageCollector.labels Labels to add to the api resources. Merges with `global.labels`, allowing you to override or add to the global labels.

808

labels: {}

809

## @param garbageCollector.annotations Annotations to add to the api resources. Merges with `global.annotations`, allowing you to override or add to the global annotations.

810

annotations: {}

811

## @param garbageCollector.podLabels Optional labels to add to pods. Merges with `global.podLabels`, allowing you to override or add to the global labels.

812

podLabels: {}

813

## @param garbageCollector.podAnnotations Optional annotations to add to pods. Merges with `global.podAnnotations`, allowing you to override or add to the global annotations.

814

podAnnotations: {}

815

## ServiceAccount specific settings

816

serviceAccount:

817

## @param garbageCollector.serviceAccount.labels Additional labels to add to the managementController ServiceAccount.

818

labels: {}

819

## @param garbageCollector.serviceAccount.annotations Additional annotations to add to the managementController ServiceAccount.

820

annotations: {}

821

# foo: bar

822

# another: value

823

## @param garbageCollector.env Environment variables to add to garbage collector pods.

824

env: []

825

# - name: ENV_NAME

826

# value: value

827

## @param garbageCollector.envFrom Environment variables to add to garbage collector pods from ConfigMaps or Secrets.

828

envFrom: []

829

# - configMapRef:

830

# name: config-map-name

831

# - secretRef:

832

# name: secret-name

833

834

## @param garbageCollector.containers Additional sidecar containers to add to garbage collector pods. Rendered as literal YAML.

835

containers: []

836

## @param garbageCollector.initContainers Additional init containers to add to garbage collector pods. Rendered as literal YAML.

837

initContainers: []

838

## @param garbageCollector.volumes Additional pod-level volumes for garbage collector pods. Rendered as literal YAML.

839

volumes: []

840

## @param garbageCollector.volumeMounts Additional volume mounts for the garbage collector container. Rendered as literal YAML.

841

volumeMounts: []

842

## @param garbageCollector.resources Resources limits and requests for the garbage collector containers.

843

resources: {}

844

# limits:

845

# cpu: 100m

846

# memory: 128Mi

847

# requests:

848

# cpu: 100m

849

# memory: 128Mi

850

851

## @param garbageCollector.nodeSelector Node selector for the garbage collector pods. Defaults to `global.nodeSelector`.

852

nodeSelector: {}

853

## @param garbageCollector.tolerations Tolerations for the garbage collector pods. Defaults to `global.tolerations`.

854

tolerations: []

855

## @param garbageCollector.affinity Specifies pod affinity for the garbage collector pods. Defaults to `global.affinity`.

856

affinity: {}

857

## @param garbageCollector.priorityClassName [nullable] Name of the priority class for the garbage collector pods. Defaults to `global.priorityClassName`.

858

# priorityClassName:

859

## @param garbageCollector.securityContext Security context for garbage collector pods. Defaults to `global.securityContext`.

860

securityContext: {}

861

## @section External Webhooks Server

862

externalWebhooksServer:

863

## @param externalWebhooksServer.enabled Whether the external webhooks server is enabled.

864

enabled: true

865

## @skip externalWebhooksServer.kubeconfigSecrets

866

kubeconfigSecrets: {}

867

## @param externalWebhooksServer.kubeconfigSecrets.kargo [nullable] Per-component override for `kubeconfigSecrets.kargo`. Lets the external webhooks server mount its own kubeconfig secret rather than the shared one. Falls back to the chart-level value when unset.

868

# kargo: ""

869

870

## @param externalWebhooksServer.replicas The number of external webhooks server pods.

871

replicas: 1

872

## @param externalWebhooksServer.revisionHistoryLimit Number of old ReplicaSets the external webhooks server Deployment retains for rollback.

873

revisionHistoryLimit: 10

874

## @param externalWebhooksServer.rollingUpdate Values merged into the chart-built `strategy.rollingUpdate` for the external webhook server Deployment. Typically used to tune `maxSurge` and `maxUnavailable` (each an absolute number or a percentage). Default empty map — Kubernetes defaults (25% / 25%) apply.

875

rollingUpdate: {}

876

# maxSurge: 25%

877

# maxUnavailable: 25%

878

879

## @param externalWebhooksServer.host The domain name where Kargo's external webhooks server will be accessible. When applicable, this is used for generation of an Ingress resource and certificates. Note: The value in this field MAY include a port number and MUST NOT specify the protocol (http vs https), which is automatically inferred from other configuration options.

880

host: localhost

881

## @param externalWebhooksServer.basePath URL path prefix at which the external webhooks server is reachable. When non-empty, MUST begin with a slash and MUST NOT end with one (e.g. `/webhook`). Used as the path on any chart-generated Ingress rule for the external webhooks server, and included in `EXTERNAL_WEBHOOK_SERVER_BASE_URL`. When the external webhooks server has no Ingress of its own and instead piggybacks on the API server's Ingress, this defaults to `<api.basePath>/webhooks`. The external webhooks server binary itself always serves at the root, so when this is set, the user is responsible for configuring their Ingress controller to strip the prefix before forwarding (e.g. via Traefik's `stripPrefix` middleware, NGINX's `rewrite`, etc.).

882

basePath: ""

883

## @param externalWebhooksServer.logLevel The log level for the external webhooks server. Valid options are ERROR, INFO, DEBUG, and TRACE (case insensitive). Note that INFO level messages are written during startup regardless of the selected level.

884

logLevel: INFO

885

## @param externalWebhooksServer.logFormat The format of logs from the external webhooks server. Valid options are CONSOLE or JSON (case insensitive).

886

logFormat: CONSOLE

887

## @param externalWebhooksServer.labels Labels to add to the external webhook server resources. Merges with `global.labels`, allowing you to override or add to the global labels.

888

labels: {}

889

## @param externalWebhooksServer.annotations Annotations to add to the external webhook server resources. Merges with `global.annotations`, allowing you to override or add to the global annotations.

890

annotations: {}

891

## @param externalWebhooksServer.podLabels Optional labels to add to the external webhook server pods. Merges with `global.podLabels`, allowing you to override or add to the global labels.

892

podLabels: {}

893

## @param externalWebhooksServer.podAnnotations Optional annotations to add to the external webhook server pods. Merges with `global.podAnnotations`, allowing you to override or add to the global annotations.

894

podAnnotations: {}

895

## ServiceAccount specific settings

896

serviceAccount:

897

## @param externalWebhooksServer.serviceAccount.labels Additional labels to add to the externalWebHooksServer ServiceAccount.

898

labels: {}

899

## @param externalWebhooksServer.serviceAccount.annotations Additional annotations to add to the externalWebHooksServer ServiceAccount.

900

annotations: {}

901

# foo: bar

902

# another: value

903

## @param externalWebhooksServer.env Environment variables to add to external webhook server pods.

904

env: []

905

# - name: ENV_NAME

906

# value: value

907

## @param externalWebhooksServer.envFrom Environment variables to add to external webhook server pods from ConfigMaps or Secrets.

908

envFrom: []

909

# - configMapRef:

910

# name: config-map-name

911

# - secretRef:

912

# name: secret-name

913

914

## @param externalWebhooksServer.containers Additional sidecar containers to add to external webhook server pods. Rendered as literal YAML.

915

containers: []

916

## @param externalWebhooksServer.initContainers Additional init containers to add to external webhook server pods. Rendered as literal YAML.

917

initContainers: []

918

## @param externalWebhooksServer.volumes Additional pod-level volumes for external webhook server pods. Rendered as literal YAML.

919

volumes: []

920

## @param externalWebhooksServer.volumeMounts Additional volume mounts for the external webhook server container. Rendered as literal YAML.

921

volumeMounts: []

922

## @param externalWebhooksServer.resources Resources limits and requests for the external webhook server containers.

923

resources: {}

924

# limits:

925

# cpu: 100m

926

# memory: 128Mi

927

# requests:

928

# cpu: 100m

929

# memory: 128Mi

930

931

## @param externalWebhooksServer.nodeSelector Node selector for external webhook server pods. Defaults to `global.nodeSelector`.

932

nodeSelector: {}

933

## @param externalWebhooksServer.tolerations Tolerations for external webhook server pods. Defaults to `global.tolerations`.

934

tolerations: []

935

## @param externalWebhooksServer.affinity Specifies pod affinity for external webhook server pods. Defaults to `global.affinity`.

936

affinity: {}

937

## @param externalWebhooksServer.topologySpreadConstraints Topology spread constraints for external webhook server pods.

938

## e.g.

939

## topologySpreadConstraints:

940

## - maxSkew: 1

941

## topologyKey: kubernetes.io/hostname

942

## whenUnsatisfiable: DoNotSchedule

943

## labelSelector:

944

## matchLabels:

945

## app.kubernetes.io/component: external-webhooks-server

946

topologySpreadConstraints: []

947

## @param externalWebhooksServer.priorityClassName [nullable] Name of the priority class for external webhook server pods. Defaults to `global.priorityClassName`.

948

# priorityClassName:

949

## @param externalWebhooksServer.securityContext Security context for external webhook server pods. Defaults to `global.securityContext`.

950

securityContext: {}

951

podDisruptionBudget:

952

## @param externalWebhooksServer.podDisruptionBudget.enabled Whether to create a PodDisruptionBudget for the external webhook server.

953

enabled: false

954

## @param externalWebhooksServer.podDisruptionBudget.minAvailable Minimum number/percentage of pods that must remain available during disruption. Cannot be used with maxUnavailable.

955

minAvailable: 1

956

## @param externalWebhooksServer.podDisruptionBudget.maxUnavailable Maximum number/percentage of pods that can be unavailable during disruption. Cannot be used with minAvailable.

957

maxUnavailable: ""

958

probes:

959

## @param externalWebhooksServer.probes.enabled Whether startup, liveness, and readiness probes should be included in the external webhook server deployment. It is sometimes advantageous to disable these during local development.

960

enabled: true

961

## @param externalWebhooksServer.probes.startupProbe [object] Values merged into the chart-built `startupProbe` for the external webhook server. Typically used to tune timing fields like `initialDelaySeconds`, `periodSeconds`, `timeoutSeconds`, `successThreshold`, and `failureThreshold`.

962

startupProbe:

963

initialDelaySeconds: 10

964

# periodSeconds: 10

965

# timeoutSeconds: 1

966

# successThreshold: 1

967

failureThreshold: 30

968

## @param externalWebhooksServer.probes.livenessProbe [object] Values merged into the chart-built `livenessProbe` for the external webhook server. Default is an empty map, so the chart's `livenessProbe` renders with Kubernetes-default timings.

969

livenessProbe: {}

970

# initialDelaySeconds: 0

971

# periodSeconds: 10

972

# timeoutSeconds: 1

973

# successThreshold: 1

974

# failureThreshold: 3

975

## @param externalWebhooksServer.probes.readinessProbe [object] Values merged into the chart-built `readinessProbe` for the external webhook server.

976

readinessProbe:

977

initialDelaySeconds: 5

978

# periodSeconds: 10

979

# timeoutSeconds: 1

980

# successThreshold: 1

981

# failureThreshold: 3

982

tls:

983

## @param externalWebhooksServer.tls.enabled Whether to enable TLS directly on the external webhook server. This is helpful if you do not intend to use an ingress controller or if you require TLS end-to-end. All other settings in this section EXCEPT `terminatedUpstream` will be ignored when this is set to `false`.

984

enabled: true

985

## @param externalWebhooksServer.tls.selfSignedCert Whether to generate a self-signed certificate for use by the external webhooks server. If `true`, `cert-manager` CRDs **must** be present in the cluster. The chart will create and use its own namespaced `Issuer`. If `false`, a cert `Secret` with the name specified by `externalWebhooksServer.tls.secretName` **must** be provided in the same namespace as Kargo. The value in this field has no effect if `externalWebhooksServer.tls.enabled` is `false`.

986

selfSignedCert: true

987

## @param externalWebhooksServer.tls.secretName Name of the cert `Secret` to use for the external webhooks server. When `externalWebhooksServer.tls.selfSignedCert` is `true`, this will be the name of the generated cert `Secret`. When `externalWebhooksServer.tls.selfSignedCert` is `false`, a cert `Secret` with this name **must** be provided in the same namespace as Kargo. The value in this field has no effect if `externalWebhooksServer.tls.enabled` is `false`.

988

secretName: kargo-external-webhooks-server-cert

989

## @param externalWebhooksServer.tls.terminatedUpstream Whether TLS is terminated upstream, i.e. a load balancer, reverse-proxy, or an `Ingress` controller using a single wildcard cert is terminating it. Setting this to `true` forces all external webhook server URLs to use HTTPS even if the `Ingress` (if applicable) or external webhook server itself are listening for plain HTTP requests.

990

terminatedUpstream: false

991

ingress:

992

## @param externalWebhooksServer.ingress.enabled Whether to enable separate ingress for webhook by creating an Ingress resource. By default, this is disabled and webhook is exposed as part of kargo-api ingress. Enabling ingress is advanced usage.

993

enabled: false

994

## @param externalWebhooksServer.ingress.annotations Annotations specified by your ingress controller to customize the behavior of the Ingress resource.

995

annotations: {}

996

# kubernetes.io/ingress.class: nginx

997

## @param externalWebhooksServer.ingress.ingressClassName If implemented by your ingress controller, specifies the ingress class. If your ingress controller does not support this, use the `kubernetes.io/ingress.class` annotation instead.

998

ingressClassName:

999

tls:

1000

## @param externalWebhooksServer.ingress.tls.enabled Whether to associate a certificate with the Ingress resource.

1001

enabled: true

1002

## @param externalWebhooksServer.ingress.tls.selfSignedCert Whether to generate a self-signed certificate for use with the external webhook server's `Ingress` resource. If `true`, `cert-manager` CRDs **must** be present in the cluster. The chart will create and use its own namespaced `Issuer`. If `false`, a cert `Secret` with the name specified by `externalWebhooksServer.ingress.tls.secretName` **must** be provided in the same namespace as Kargo. The value in this field has no effect if `externalWebhooksServer.ingress.tls.enabled` is `false`.

1003

selfSignedCert: true

1004

## @param externalWebhooksServer.ingress.tls.secretName Name of the cert `Secret` for the external webhooks server's `Ingress` resource. When `externalWebhooksServer.ingress.tls.selfSignedCert` is `true`, this will be the name of the generated cert `Secret`. When `externalWebhooksServer.ingress.tls.selfSignedCert` is `false`, a cert `Secret` with this name **must** be provided in the same namespace as Kargo. The value in this field has no effect if `externalWebhooksServer.ingress.tls.enabled` is `false`.

1005

secretName: kargo-external-webhooks-server-ingress-cert

1006

## @param externalWebhooksServer.ingress.pathType You may want to use `Prefix` for some controllers (like AWS LoadBalancer Ingress controller), which don't support `/` as wildcard path when pathType is set to `ImplementationSpecific`

1007

pathType: ImplementationSpecific

1008

service:

1009

## @param externalWebhooksServer.service.type If you're not going to use an ingress controller, you may want to change this value to `LoadBalancer` for production deployments. If running locally, you may want to change it to `NodePort` OR leave it as `ClusterIP` and use `kubectl port-forward` to map a port on the local network interface to the service.

1010

type: ClusterIP

1011

## @param externalWebhooksServer.service.nodePort [nullable] Host port the `Service` will be mapped to when `type` is either `NodePort` or `LoadBalancer`. If not specified, Kubernetes chooses.

1012

# nodePort:

1013

## @param externalWebhooksServer.service.annotations Annotations to add to the external webhook server's service. Merges with `global.annotations`, allowing you to override or add to the global annotations.

1014

annotations: {}

1015

## @section Management Controller

1016

## All settings for the management controller component

1017

managementController:

1018

## @param managementController.enabled Whether the management controller is enabled.

1019

enabled: true

1020

## @param managementController.revisionHistoryLimit Number of old ReplicaSets the management controller Deployment retains for rollback. The management controller uses a `Recreate` rollout strategy (singleton), so `rollingUpdate.*` knobs do not apply.

1021

revisionHistoryLimit: 10

1022

## @skip managementController.kubeconfigSecrets

1023

kubeconfigSecrets: {}

1024

## @param managementController.kubeconfigSecrets.kargo [nullable] Per-component override for `kubeconfigSecrets.kargo`. Lets the management controller mount its own kubeconfig secret rather than the shared one. Falls back to the chart-level value when unset.

1025

# kargo: ""

1026

1027

## @param managementController.logLevel The log level for the management controller. Valid options are ERROR, INFO, DEBUG, and TRACE (case insensitive). Note that INFO level messages are written during startup regardless of the selected level.

1028

logLevel: INFO

1029

## @param managementController.logFormat The format of logs from the management controller. Valid options are CONSOLE or JSON (case insensitive).

1030

logFormat: CONSOLE

1031

## Reconciler-specific settings

1032

reconcilers:

1033

## @param managementController.reconcilers.maxConcurrentReconciles specifies the maximum number of resources EACH of the management controller's reconcilers can reconcile concurrently. This setting may also be overridden on a per-reconciler basis.

1034

maxConcurrentReconciles: 4

1035

namespaces:

1036

## @param managementController.reconcilers.namespaces.maxConcurrentReconciles optionally overrides the maximum number of Namespace resources the management controller can reconcile concurrently.

1037

maxConcurrentReconciles:

1038

projectConfigs:

1039

## @param managementController.reconcilers.projectConfigs.maxConcurrentReconciles optionally overrides the maximum number of ProjectConfig resources the management controller can reconcile concurrently.

1040

maxConcurrentReconciles:

1041

projects:

1042

## @param managementController.reconcilers.projects.maxConcurrentReconciles optionally overrides the maximum number of Project resources the management controller can reconcile concurrently.

1043

maxConcurrentReconciles:

1044

serviceAccounts:

1045

## @param managementController.reconcilers.serviceAccounts.maxConcurrentReconciles optionally overrides the maximum number of ServiceAccount resources the management controller can reconcile concurrently.

1046

maxConcurrentReconciles:

1047

## @param managementController.labels Labels to add to the api resources. Merges with `global.labels`, allowing you to override or add to the global labels.

1048

labels: {}

1049

## @param managementController.annotations Annotations to add to the api resources. Merges with `global.annotations`, allowing you to override or add to the global annotations.

1050

annotations: {}

1051

## @param managementController.podLabels Optional labels to add to pods. Merges with `global.podLabels`, allowing you to override or add to the global labels.

1052

podLabels: {}

1053

## @param managementController.podAnnotations Optional annotations to add to pods. Merges with `global.podAnnotations`, allowing you to override or add to the global annotations.

1054

podAnnotations: {}

1055

## ServiceAccount specific settings

1056

serviceAccount:

1057

## @param managementController.serviceAccount.labels Additional labels to add to the managementController ServiceAccount.

1058

labels: {}

1059

## @param managementController.serviceAccount.annotations Additional annotations to add to the managementController ServiceAccount.

1060

annotations: {}

1061

# foo: bar

1062

# another: value

1063

## @param managementController.env Environment variables to add to management controller pods.

1064

env: []

1065

# - name: ENV_NAME

1066

# value: value

1067

## @param managementController.envFrom Environment variables to add to management controller pods from ConfigMaps or Secrets.

1068

envFrom: []

1069

# - configMapRef:

1070

# name: config-map-name

1071

# - secretRef:

1072

# name: secret-name

1073

1074

## @param managementController.containers Additional sidecar containers to add to management controller pods. Rendered as literal YAML.

1075

containers: []

1076

## @param managementController.initContainers Additional init containers to add to management controller pods. Rendered as literal YAML.

1077

initContainers: []

1078

## @param managementController.volumes Additional pod-level volumes for management controller pods. Rendered as literal YAML.

1079

volumes: []

1080

## @param managementController.volumeMounts Additional volume mounts for the management controller container. Rendered as literal YAML.

1081

volumeMounts: []

1082

## @param managementController.resources Resources limits and requests for the management controller containers.

1083

resources: {}

1084

# limits:

1085

# cpu: 100m

1086

# memory: 128Mi

1087

# requests:

1088

# cpu: 100m

1089

# memory: 128Mi

1090

1091

## @param managementController.nodeSelector Node selector for management controller pods. Defaults to `global.nodeSelector`.

1092

nodeSelector: {}

1093

## @param managementController.tolerations Tolerations for management controller pods. Defaults to `global.tolerations`.

1094

tolerations: []

1095

## @param managementController.affinity Specifies pod affinity for management controller pods. Defaults to `global.affinity`.

1096

affinity: {}

1097

## @param managementController.priorityClassName [nullable] Name of the priority class for management controller pods. Defaults to `global.priorityClassName`.

1098

# priorityClassName:

1099

## @param managementController.securityContext Security context for management controller pods. Defaults to `global.securityContext`.

1100

securityContext: {}

1101

## All settings relating to exposing the management controller's Prometheus metrics.

1102

metrics:

1103

## @param managementController.metrics.enabled Whether to expose the management controller's Prometheus metrics. When enabled, the management controller binds its metrics server (via `METRICS_BIND_ADDRESS`), declares a metrics container port, and a metrics `Service` is created. Metrics are served over plain HTTP.

1104

enabled: false

1105

service:

1106

## @param managementController.metrics.service.type The type of the metrics `Service`.

1107

type: ClusterIP

1108

## @param managementController.metrics.service.clusterIP The cluster IP of the metrics `Service`. Set to `None` for a headless `Service`, which resolves directly to individual pod IPs -- useful for scrapers that perform their own endpoint discovery.

1109

clusterIP: ""

1110

## @param managementController.metrics.service.annotations Annotations to add to the metrics `Service`.

1111

annotations: {}

1112

## @param managementController.metrics.service.labels Additional labels to add to the metrics `Service`.

1113

labels: {}

1114

## @param managementController.metrics.service.servicePort The port exposed by the metrics `Service`. Also used as the container port and the address the metrics server binds to.

1115

servicePort: 9090

1116

## @param managementController.metrics.service.portName The name of the metrics port. Referenced by the `ServiceMonitor` endpoint.

1117

portName: http-metrics

1118

serviceMonitor:

1119

## @param managementController.metrics.serviceMonitor.enabled Whether to create a Prometheus Operator `ServiceMonitor` for the management controller's metrics. Requires `managementController.metrics.enabled` to be `true` and the Prometheus Operator CRDs (`monitoring.coreos.com/v1`) to be present in the cluster; otherwise it is silently skipped.

1120

enabled: false

1121

## @param managementController.metrics.serviceMonitor.interval The scrape interval for the `ServiceMonitor`.

1122

interval: 30s

1123

## @param managementController.metrics.serviceMonitor.scheme The scheme to use when scraping. Defaults to `http` (metrics are served over plain HTTP).

1124

scheme: ""

1125

## @param managementController.metrics.serviceMonitor.tlsConfig TLS configuration for the `ServiceMonitor` endpoint. Rendered as literal YAML.

1126

tlsConfig: {}

1127

## @param managementController.metrics.serviceMonitor.relabelings Relabeling rules applied to samples before scraping. Rendered as literal YAML.

1128

relabelings: []

1129

## @param managementController.metrics.serviceMonitor.metricRelabelings Relabeling rules applied to samples before ingestion. Rendered as literal YAML.

1130

metricRelabelings: []

1131

## @param managementController.metrics.serviceMonitor.additionalLabels Additional labels to add to the `ServiceMonitor`. Often required to match the label selector of your Prometheus Operator instance.

1132

additionalLabels: {}

1133

## @param managementController.metrics.serviceMonitor.namespace The namespace in which to create the `ServiceMonitor`. Defaults to the release namespace.

1134

namespace: ""

1135

## @section Webhooks Server

1136

webhooksServer:

1137

## @param webhooksServer.enabled Whether the webhooks server is enabled.

1138

enabled: true

1139

## @skip webhooksServer.kubeconfigSecrets

1140

kubeconfigSecrets: {}

1141

## @param webhooksServer.kubeconfigSecrets.kargo [nullable] Per-component override for `kubeconfigSecrets.kargo`. Lets the webhooks server mount its own kubeconfig secret rather than the shared one. Falls back to the chart-level value when unset.

1142

# kargo: ""

1143

1144

## @param webhooksServer.replicas The number of webhooks server pods.

1145

replicas: 1

1146

## @param webhooksServer.revisionHistoryLimit Number of old ReplicaSets the webhooks server Deployment retains for rollback.

1147

revisionHistoryLimit: 10

1148

## @param webhooksServer.rollingUpdate Values merged into the chart-built `strategy.rollingUpdate` for the webhooks server Deployment. Typically used to tune `maxSurge` and `maxUnavailable` (each an absolute number or a percentage). Default empty map — Kubernetes defaults (25% / 25%) apply.

1149

rollingUpdate: {}

1150

# maxSurge: 25%

1151

# maxUnavailable: 25%

1152

1153

## @param webhooksServer.logLevel The log level for the webhooks server. Valid options are ERROR, INFO, DEBUG, and TRACE (case insensitive). Note that INFO level messages are written during startup regardless of the selected level.

1154

logLevel: INFO

1155

## @param webhooksServer.logFormat The format of logs from the webhooks server. Valid options are CONSOLE or JSON (case insensitive).

1156

logFormat: CONSOLE

1157

## @param webhooksServer.controlplaneUserRegex Regular expression for matching controlplane users.

1158

controlplaneUserRegex: "" # ^system:serviceaccount:kargo:[a-z0-9]([-a-z0-9]*[a-z0-9])?$

1159

## @param webhooksServer.labels Labels to add to the webhook server resources. Merges with `global.labels`, allowing you to override or add to the global labels.

1160

labels: {}

1161

## @param webhooksServer.annotations Annotations to add to the webhook server resources. Merges with `global.annotations`, allowing you to override or add to the global annotations.

1162

annotations: {}

1163

## @param webhooksServer.podLabels Optional labels to add to the webhook server pods. Merges with `global.podLabels`, allowing you to override or add to the global labels.

1164

podLabels: {}

1165

## @param webhooksServer.podAnnotations Optional annotations to add to the webhook server pods. Merges with `global.podAnnotations`, allowing you to override or add to the global annotations.

1166

podAnnotations: {}

1167

## ServiceAccount specific settings

1168

serviceAccount:

1169

## @param webhooksServer.serviceAccount.labels Additional labels to add to the webhooks server ServiceAccount.

1170

labels: {}

1171

## @param webhooksServer.serviceAccount.annotations Additional annotations to add to the webhooks server ServiceAccount.

1172

annotations: {}

1173

# foo: bar

1174

# another: value

1175

## @param webhooksServer.env Environment variables to add to webhook server pods.

1176

env: []

1177

# - name: ENV_NAME

1178

# value: value

1179

## @param webhooksServer.envFrom Environment variables to add to webhook server pods from ConfigMaps or Secrets.

1180

envFrom: []

1181

# - configMapRef:

1182

# name: config-map-name

1183

# - secretRef:

1184

# name: secret-name

1185

1186

## @param webhooksServer.containers Additional sidecar containers to add to webhooks server pods. Rendered as literal YAML.

1187

containers: []

1188

## @param webhooksServer.initContainers Additional init containers to add to webhooks server pods. Rendered as literal YAML.

1189

initContainers: []

1190

## @param webhooksServer.volumes Additional pod-level volumes for webhooks server pods. Rendered as literal YAML.

1191

volumes: []

1192

## @param webhooksServer.volumeMounts Additional volume mounts for the webhooks server container. Rendered as literal YAML.

1193

volumeMounts: []

1194

## @param webhooksServer.resources Resources limits and requests for the webhooks server containers.

1195

resources: {}

1196

# limits:

1197

# cpu: 100m

1198

# memory: 128Mi

1199

# requests:

1200

# cpu: 100m

1201

# memory: 128Mi

1202

1203

## @param webhooksServer.nodeSelector Node selector for the webhooks server pods. Defaults to `global.nodeSelector`.

1204

nodeSelector: {}

1205

## @param webhooksServer.tolerations Tolerations for the webhooks server pods. Defaults to `global.tolerations`.

1206

tolerations: []

1207

## @param webhooksServer.affinity Specifies pod affinity for the webhooks server pods. Defaults to `global.affinity`.

1208

affinity: {}

1209

## @param webhooksServer.topologySpreadConstraints Topology spread constraints for webhooks server pods.

1210

## e.g.

1211

## topologySpreadConstraints:

1212

## - maxSkew: 1

1213

## topologyKey: kubernetes.io/hostname

1214

## whenUnsatisfiable: DoNotSchedule

1215

## labelSelector:

1216

## matchLabels:

1217

## app.kubernetes.io/component: webhooks-server

1218

topologySpreadConstraints: []

1219

## @param webhooksServer.priorityClassName [nullable] Name of the priority class for the webhooks server pods. Defaults to `global.priorityClassName`.

1220

# priorityClassName:

1221

## @param webhooksServer.securityContext Security context for webhooks server pods. Defaults to `global.securityContext`.

1222

securityContext: {}

1223

## All settings relating to exposing the webhooks server's Prometheus metrics.

1224

metrics:

1225

## @param webhooksServer.metrics.enabled Whether to expose the webhooks server's Prometheus metrics. When enabled, the webhooks server binds its metrics server (via `METRICS_BIND_ADDRESS`), declares a metrics container port, and a metrics `Service` is created. Metrics are served over plain HTTP.

1226

enabled: false

1227

service:

1228

## @param webhooksServer.metrics.service.type The type of the metrics `Service`.

1229

type: ClusterIP

1230

## @param webhooksServer.metrics.service.clusterIP The cluster IP of the metrics `Service`. Set to `None` for a headless `Service`, which resolves directly to individual pod IPs -- useful for scrapers that perform their own endpoint discovery.

1231

clusterIP: ""

1232

## @param webhooksServer.metrics.service.annotations Annotations to add to the metrics `Service`.

1233

annotations: {}

1234

## @param webhooksServer.metrics.service.labels Additional labels to add to the metrics `Service`.

1235

labels: {}

1236

## @param webhooksServer.metrics.service.servicePort The port exposed by the metrics `Service`. Also used as the container port and the address the metrics server binds to.

1237

servicePort: 9090

1238

## @param webhooksServer.metrics.service.portName The name of the metrics port. Referenced by the `ServiceMonitor` endpoint.

1239

portName: http-metrics

1240

serviceMonitor:

1241

## @param webhooksServer.metrics.serviceMonitor.enabled Whether to create a Prometheus Operator `ServiceMonitor` for the webhooks server's metrics. Requires `webhooksServer.metrics.enabled` to be `true` and the Prometheus Operator CRDs (`monitoring.coreos.com/v1`) to be present in the cluster; otherwise it is silently skipped.

1242

enabled: false

1243

## @param webhooksServer.metrics.serviceMonitor.interval The scrape interval for the `ServiceMonitor`.

1244

interval: 30s

1245

## @param webhooksServer.metrics.serviceMonitor.scheme The scheme to use when scraping. Defaults to `http` (metrics are served over plain HTTP).

1246

scheme: ""

1247

## @param webhooksServer.metrics.serviceMonitor.tlsConfig TLS configuration for the `ServiceMonitor` endpoint. Rendered as literal YAML.

1248

tlsConfig: {}

1249

## @param webhooksServer.metrics.serviceMonitor.relabelings Relabeling rules applied to samples before scraping. Rendered as literal YAML.

1250

relabelings: []

1251

## @param webhooksServer.metrics.serviceMonitor.metricRelabelings Relabeling rules applied to samples before ingestion. Rendered as literal YAML.

1252

metricRelabelings: []

1253

## @param webhooksServer.metrics.serviceMonitor.additionalLabels Additional labels to add to the `ServiceMonitor`. Often required to match the label selector of your Prometheus Operator instance.

1254

additionalLabels: {}

1255

## @param webhooksServer.metrics.serviceMonitor.namespace The namespace in which to create the `ServiceMonitor`. Defaults to the release namespace.

1256

namespace: ""

1257

podDisruptionBudget:

1258

## @param webhooksServer.podDisruptionBudget.enabled Whether to create a PodDisruptionBudget for the webhooks server.

1259

enabled: false

1260

## @param webhooksServer.podDisruptionBudget.minAvailable Minimum number/percentage of pods that must remain available during disruption. Cannot be used with maxUnavailable.

1261

minAvailable: 1

1262

## @param webhooksServer.podDisruptionBudget.maxUnavailable Maximum number/percentage of pods that can be unavailable during disruption. Cannot be used with minAvailable.

1263

maxUnavailable: ""

1264

tls:

1265

## @param webhooksServer.tls.selfSignedCert Whether to generate a self-signed certificate for the (internal) webhooks server. If `true`, `cert-manager` CRDs **must** be present in the cluster. The chart will create and use its own namespaced `Issuer`. If `false`, a cert `Secret` with the name specified by `webhooksServer.tls.secretName` **must** be provided in the same namespace as Kargo. If that cert is not already trusted by the Kubernetes API server, you must specify a value for `webhooksServer.tls.caBundle`. This is why it is strongly recommended to leave this setting as `true`. There is no provision for running the webhooks server without TLS because the Kubernetes API server will not communicate with non-TLS endpoints.

1266

selfSignedCert: true

1267

## @param webhooksServer.tls.secretName Name of the cert `Secret` for use with the (internal) webhooks server. When `webhooksServer.tls.selfSignedCert` is `true`, this will be the name of the generated cert `Secret`. When `webhooksServer.tls.selfSignedCert` is `false`, a cert `Secret` with this name **must** be provided in the same namespace as Kargo. There is no provision for running the webhooks server without TLS because the Kubernetes API server will not communicate with non TLS-endpoints.

1268

secretName: kargo-webhooks-server-cert

1269

## @param webhooksServer.tls.caBundle PEM-encoded TLS certificates for certificate authorities to trust when `webhooksServer.tls.selfSignedCert` is `false`. If the cert has been signed by an authority already trusted by the Kubernetes API server, this setting can be ignored.

1270

caBundle: ""

1271

# caBundle: |

1272

# -----BEGIN CERTIFICATE-----

1273

# ...

1274

# -----END CERTIFICATE-----

1275

## @param extraObjects An array describing additional, arbitrary Kubernetes resources to include when rendering this chart. Items in the array may be YAML objects or strings. Either may be templated. Templates will be evaluated against the same set of values as the rest of the chart.

1276

extraObjects: []

1277

# - apiVersion: v1

1278

# kind: ConfigMap

1279

# metadata:

1280

# name: custom-cm-1

1281

# data:

1282

# host: '{{ .Values.api.host }}'

1283

# - |

1284

# apiVersion: v1

1285

# kind: ConfigMap

1286

# metadata:

1287

# name: custom-cm-2

1288

# data:

1289

# host: {{ .Values.api.host }}

1290

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

kargo

The trusted source for open source

Product

Solutions

Customers

Resources

Company