kates
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# -- Global configuration
2
global:
3
# -- Override the image registry for all images in the chart
4
# Useful for air-gapped clusters that mirror images to an internal registry
5
imageRegistry: ""
6
# -- Override image pull secrets globally
7
imagePullSecrets: []
8
# -- Kubernetes cluster DNS domain
9
clusterDomain: "cluster.local"
10
# -- Enable production guard rails: template rendering fails if insecure
11
# chart defaults (e.g. the default database password) would reach the
12
# cluster. Enabled in values-prod.yaml; leave false for dev/kind.
13
productionMode: false
14
# -- Number of Kates API pods. Must be 1; values.schema.json refuses more.
15
# The Kates API keeps each run's workers, the concurrent-run limit, the
16
# disruption lease and the live event streams in its own memory, and a pod
17
# that starts marks every RUNNING run in the database FAILED. A second pod
18
# fails the runs the first is executing, and the two can each run a
19
# disruption plan against the same cluster.
20
replicaCount: 1
21
# -- Container image configuration
22
image:
23
# -- Image repository
24
repository: cgr.dev/chainguard-private/kates
25
# -- Image tag. Must be the release that carries the non-blocking health
26
# endpoints the probe defaults below depend on (>= 1.22.0).
27
tag: 1.29.0-r0@sha256:44c3abc1bfb61a74bd39b84c737974611c2c4bc10fc87181eac4fec860d65802
28
# -- Image pull policy
29
pullPolicy: IfNotPresent
30
# -- Secrets for pulling images from private registries
31
imagePullSecrets: []
32
# -- Override the chart name
33
nameOverride: ""
34
# -- Override the full release name
35
fullnameOverride: ""
36
# -- DNS policy for pods (ClusterFirst, Default, None, ClusterFirstWithHostNet)
37
dnsPolicy: ""
38
# -- Custom DNS configuration (nameservers, searches, options)
39
dnsConfig: {}
40
# -- Service account configuration
41
serviceAccount:
42
# -- Create a ServiceAccount
43
create: true
44
# -- ServiceAccount name (auto-generated if empty)
45
name: ""
46
# -- Extra annotations for the ServiceAccount
47
annotations: {}
48
# -- Automount the service account token
49
automount: true
50
# -- RBAC configuration
51
rbac:
52
# -- Create ClusterRole and ClusterRoleBinding
53
create: true
54
# -- Grant the writes the direct Kubernetes chaos backend makes itself
55
# (KATES_CHAOS_PROVIDER=kubernetes, or hybrid without Litmus): NetworkPolicies,
56
# StatefulSet scaling, and pod ephemeral containers. Litmus runs its
57
# experiments as litmus-admin and needs none of this.
58
directChaos: false
59
# -- Namespaces where the INTEGRATION_CDC test may read its database's
60
# password: a Role in each grants get on the Secret `postgresql` (key
61
# postgres-password), the only Secret the Kates API reads. The test uses the
62
# PostgreSQL behind the first Service labelled
63
# app.kubernetes.io/name=postgresql in any namespace, or in `database` when
64
# there is none. `kates deploy --with-kafka-connect` installs it there and
65
# sets this to that namespace. Each one must exist before the install.
66
# Empty grants nothing, and an INTEGRATION_CDC run then fails at DB_SETUP.
67
cdcSecretNamespaces: []
68
# -- Extra RBAC rules (e.g. for Litmus Chaos integration)
69
extraRules: []
70
# -- Extra annotations to add to pods
71
podAnnotations: {}
72
# -- Extra labels to add to pods
73
podLabels: {}
74
# -- Kubernetes Service configuration
75
service:
76
# -- Service type
77
type: ClusterIP
78
# -- HTTP service port
79
port: 8080
80
# -- NodePort value (only when type=NodePort)
81
nodePort: ""
82
# -- Application protocol hint for service mesh
83
appProtocol: http
84
# -- Extra annotations for the Service
85
annotations: {}
86
# -- gRPC port configuration
87
grpc:
88
# -- gRPC container/service port
89
port: 9000
90
# -- gRPC NodePort value (only when type=NodePort)
91
nodePort: ""
92
# -- Ingress configuration
93
ingress:
94
# -- Enable Ingress
95
enabled: false
96
# -- Ingress class name (e.g. nginx)
97
className: ""
98
# -- Extra Ingress annotations
99
annotations: {}
100
# -- cert-manager integration
101
certManager:
102
# -- Enable cert-manager annotations
103
enabled: false
104
# -- Issuer or ClusterIssuer name
105
issuerName: ""
106
# -- Issuer kind (ClusterIssuer or Issuer)
107
issuerKind: ClusterIssuer
108
# -- Ingress hosts
109
hosts:
110
- host: kates.local
111
paths:
112
- path: /
113
pathType: Prefix
114
# -- TLS configuration
115
tls: []
116
# -- gRPC Ingress (separate Ingress resource for gRPC traffic)
117
grpc:
118
# -- Enable gRPC Ingress
119
enabled: false
120
# -- gRPC Ingress hostname
121
host: grpc.kates.local
122
# -- Extra gRPC Ingress annotations
123
annotations: {}
124
# -- gRPC TLS configuration
125
tls: []
126
# -- Resource requests and limits for the KATES container
127
resources:
128
requests:
129
memory: "2Gi"
130
cpu: "500m"
131
limits:
132
memory: "4Gi"
133
cpu: "2"
134
# -- Flyway schema migration behaviour
135
flyway:
136
# -- Repair the schema history on startup before migrating.
137
#
138
# DEVELOPMENT ONLY. It fixes "Migration checksum mismatch", which happens when
139
# an unreleased migration is edited after a local database already applied it.
140
# On a real database that mismatch means the file and the schema genuinely
141
# disagree, and silently rewriting the history hides it — so this stays off by
142
# default and is enabled in the local overlays.
143
repairAtStart: false
144
# -- Container args, replacing the image's CMD. Empty means "use the image's
145
# own default". The native image sets its heap percentage through CMD, since a
146
# native binary ignores JAVA_TOOL_OPTIONS; override it here rather than
147
# rebuilding the image.
148
containerArgs: []
149
# -- JVM configuration
150
#
151
# JVM IMAGE ONLY. A GraalVM native image does not read JAVA_TOOL_OPTIONS, so
152
# everything here is silently ignored when running a `-native` tag — see
153
# values-native.yaml, which empties it for that reason.
154
jvm:
155
# -- JVM options passed via JAVA_TOOL_OPTIONS (ignored by the native image)
156
options: "-Xms512m -Xmx2560m -XX:+UseZGC -XX:+ZGenerational"
157
# -- Pod-level security context (PSS restricted compliant)
158
# NOTE: runAsUser and fsGroup are intentionally unset so that platforms
159
# like OpenShift can assign random UIDs via their Security Context Constraints.
160
# Set them explicitly in your environment values file if needed.
161
securityContext:
162
runAsNonRoot: true
163
runAsUser: 100
164
fsGroup: 100
165
seccompProfile:
166
type: RuntimeDefault
167
# -- Container-level security context (PSS restricted compliant)
168
containerSecurityContext:
169
allowPrivilegeEscalation: false
170
readOnlyRootFilesystem: true
171
runAsNonRoot: true
172
capabilities:
173
drop:
174
- ALL
175
# -- Grace period for pod termination (seconds)
176
terminationGracePeriodSeconds: 60
177
# -- Deployment update strategy. Must be Recreate; values.schema.json refuses
178
# RollingUpdate, which starts the new pod while the old one still runs (see
179
# replicaCount). Recreate stops the old pod first, so every upgrade has a gap:
180
# the API is unreachable until the new pod is Ready, a minute or two on the
181
# JVM image, and a run still going when the old pod stops ends FAILED, as on
182
# any restart. Upgrade between runs.
183
strategy:
184
type: Recreate
185
# -- Horizontal Pod Autoscaler configuration. enabled must stay false;
186
# values.schema.json refuses true. Kates runs one replica (see replicaCount),
187
# and the CPU a native benchmark burns is what would make an autoscaler add a
188
# second pod in the middle of a run.
189
autoscaling:
190
# -- Enable HPA (must be false)
191
enabled: false
192
# -- Minimum replicas
193
minReplicas: 1
194
# -- Maximum replicas
195
maxReplicas: 5
196
# -- Target CPU utilization percentage
197
targetCPUUtilizationPercentage: 80
198
# -- Target memory utilization percentage (empty to disable)
199
targetMemoryUtilizationPercentage: ""
200
# -- Custom metrics for HPA
201
customMetrics: []
202
# -- Scale behavior policies
203
behavior:
204
scaleDown:
205
stabilizationWindowSeconds: 300
206
policies:
207
- type: Pods
208
value: 1
209
periodSeconds: 60
210
scaleUp:
211
stabilizationWindowSeconds: 30
212
policies:
213
- type: Pods
214
value: 2
215
periodSeconds: 60
216
# -- Pod Disruption Budget configuration. With one pod, a budget either allows
217
# its eviction or blocks every node drain: set maxUnavailable, and leave
218
# minAvailable empty.
219
podDisruptionBudget:
220
# -- Enable PDB
221
enabled: false
222
# -- Minimum available pods. Must stay empty; values.schema.json refuses a
223
# value: any minimum leaves the one pod unevictable, and a drain never ends
224
minAvailable: ""
225
# -- Maximum unavailable pods
226
maxUnavailable: 1
227
# -- Unhealthy pod eviction policy
228
unhealthyPodEvictionPolicy: IfHealthy
229
# -- Priority class name for pod scheduling
230
priorityClassName: ""
231
# -- Topology spread constraints for pod scheduling
232
topologySpreadConstraints: []
233
# -- Node selector for pod scheduling
234
nodeSelector: {}
235
# -- Tolerations for pod scheduling
236
tolerations: []
237
# -- Affinity rules (includes default pod anti-affinity for HA)
238
affinity:
239
podAntiAffinity:
240
preferredDuringSchedulingIgnoredDuringExecution:
241
- weight: 100
242
podAffinityTerm:
243
labelSelector:
244
matchExpressions:
245
- key: app.kubernetes.io/name
246
operator: In
247
values:
248
- kates
249
topologyKey: kubernetes.io/hostname
250
# -- Extra environment variables for the KATES container
251
extraEnv: []
252
# -- Extra init containers (e.g. for Vault secret fetching, schema migration)
253
extraInitContainers: []
254
# -- Extra volumes
255
extraVolumes: []
256
# -- Extra volume mounts
257
extraVolumeMounts: []
258
# -- API key authentication
259
apiKey:
260
# -- Enable API key authentication
261
enabled: true
262
# -- API key value (auto-generated 32-char key if empty)
263
value: ""
264
# -- Use an existing Secret instead of creating one
265
existingSecret: ""
266
# -- Key in the existing Secret
267
secretKey: "api-key"
268
# -- Health probe configuration
269
#
270
# Every probe points at a MicroProfile health endpoint, never at a business
271
# endpoint. `/api/health` looks like the obvious readiness URL but calls
272
# ClusterHealthService.isReachable() — an uncached AdminClient round-trip with a
273
# 5s blocking get — on every request. Since a probe's timeoutSeconds defaults to
274
# 1s, a cluster whose Kafka is still coming up fails EVERY readiness probe and
275
# the pod never goes Ready, even though the app is fine. `/q/health/ready` reads
276
# the periodically-refreshed KafkaReachabilityCache instead and never blocks on a
277
# broker.
278
probes:
279
# -- Startup probe (gates readiness/liveness probes)
280
startup:
281
path: /q/health/started
282
# 60 x 2s = 120s of JVM boot budget. 30 (60s) is not enough on a
283
# CPU-constrained node: the kubelet kills the container mid-boot and the
284
# restart loop reads as "kates takes forever to start".
285
failureThreshold: 60
286
periodSeconds: 2
287
timeoutSeconds: 3
288
# -- Readiness probe
289
readiness:
290
path: /q/health/ready
291
initialDelaySeconds: 5
292
periodSeconds: 10
293
timeoutSeconds: 5
294
failureThreshold: 3
295
# -- Liveness probe
296
liveness:
297
path: /q/health/live
298
initialDelaySeconds: 15
299
periodSeconds: 30
300
timeoutSeconds: 5
301
failureThreshold: 3
302
# -- Container lifecycle hooks
303
lifecycle:
304
# -- Seconds to sleep in preStop hook (allows LB drain)
305
preStopSleepSeconds: 5
306
# -- Init container configuration
307
initContainers:
308
# -- Busybox image for wait-for-postgres init container
309
waitForPostgres:
310
image: cgr.dev/chainguard-private/netcat:1.239-r0@sha256:6133b957a7ca4ca6603c2da7757cf37c5aa72fb53b4dd001d9610afb5dc5dbb8
311
pullPolicy: IfNotPresent
312
# -- Kafka connection configuration
313
kafka:
314
# -- Kafka bootstrap servers
315
bootstrapServers: "krafter-kafka-bootstrap.kafka.svc:9092"
316
# -- Namespace where CDC integration test KafkaTopic CRs are managed (empty = auto-detect)
317
topicNamespace: ""
318
# -- Client rack ID for rack-aware consumption
319
clientRack: ""
320
# -- Security protocol
321
security:
322
protocol: SASL_PLAINTEXT
323
# -- SASL authentication
324
sasl:
325
# -- Enable SASL
326
enabled: true
327
# -- SASL mechanism
328
mechanism: SCRAM-SHA-512
329
# -- SASL username
330
username: kates-backend
331
# -- K8s Secret name containing the SASL password
332
secretName: kates-backend
333
# -- Key in the Secret containing the SASL password
334
secretKey: password
335
# -- OAuthBearer configuration (when mechanism=OAUTHBEARER)
336
oauthbearer:
337
tokenEndpointUrl: ""
338
clientId: ""
339
clientSecretName: ""
340
clientSecretKey: client-secret
341
# -- SSL/TLS configuration
342
ssl:
343
# -- Enable SSL
344
enabled: false
345
# -- Truststore configuration
346
truststore:
347
secretName: ""
348
key: truststore.jks
349
password: ""
350
# -- Keystore configuration
351
keystore:
352
secretName: ""
353
key: keystore.jks
354
password: ""
355
# -- Trogdor coordinator configuration
356
trogdor:
357
# -- Trogdor coordinator URL
358
coordinatorUrl: "http://trogdor-coordinator.kafka.svc:8889"
359
# -- Trogdor agents that run tasks (KATES_TROGDOR_AGENT_NODES): node names
360
# from the coordinator's platform config, comma-separated; a run's tasks take
361
# them in turn. node0 is the name in the trogdor.conf Kafka ships. A name the
362
# coordinator does not know fails the task with "Unknown node names".
363
agentNodes: "node0"
364
# -- Prometheus the backend queries for a disruption's Kafka metrics
365
prometheus:
366
# -- Prometheus base URL (KATES_PROMETHEUS_URL). The default is the Service
367
# kube-prometheus-stack creates for charts/monitoring installed as release
368
# `monitoring` in namespace `monitoring`, which is what `kates deploy` does
369
# (it sets this for the namespace it uses). `make monitoring` installs that
370
# release in namespace `kafka`: set
371
# http://monitoring-kube-prometheus-prometheus.kafka.svc:9090 there, and
372
# networkPolicy.prometheus.namespace to kafka. Unreachable, a disruption's
373
# Prometheus metrics are missing and its SLA verdict lists them unevaluated.
374
url: "http://monitoring-kube-prometheus-prometheus.monitoring.svc:9090"
375
# -- Benchmark engine configuration
376
engine:
377
# -- Default benchmark backend (native or trogdor)
378
defaultBackend: "native"
379
# -- Maximum planned duration accepted for one run (ms)
380
maxDurationMs: "7200000"
381
# -- Grace after a RUNNING/STOPPING run's planned duration before it is failed (ms)
382
reaperGraceMs: "300000"
383
# -- Maximum time a run may stay PENDING before submission is considered stranded (ms)
384
submissionTimeoutMs: "120000"
385
# -- Fault tolerance timeout configuration (ms)
386
faultTolerance:
387
topicService:
388
# -- Timeout for all TopicService operations
389
timeoutMs: "35000"
390
clusterHealthService:
391
# -- Default timeout for cluster health operations
392
defaultTimeoutMs: "35000"
393
# -- Timeout for reachability check
394
reachableTimeoutMs: "10000"
395
# -- Timeout for full health check
396
healthCheckTimeoutMs: "60000"
397
consumerGroupService:
398
# -- Timeout for consumer group operations
399
timeoutMs: "35000"
400
# -- NetworkPolicy configuration
401
networkPolicy:
402
# -- Enable NetworkPolicy
403
enabled: true
404
# -- Ingress rules
405
ingressRules:
406
- from:
407
- namespaceSelector: {}
408
ports:
409
- port: 8080
410
protocol: TCP
411
- from:
412
- namespaceSelector: {}
413
ports:
414
- port: 8080
415
protocol: TCP
416
# -- Kafka egress configuration
417
kafka:
418
namespace: kafka
419
port: 9092
420
# -- Prometheus egress configuration: the namespace prometheus.url points
421
# into. The policy used to allow `monitoring` whatever this said.
422
prometheus:
423
namespace: monitoring
424
port: 9090
425
# -- CDC integration test database egress. `kates deploy
426
# --with-kafka-connect` sets namespace from --db-ns so the backend can
427
# create/read the test tables in the demo PostgreSQL database.
428
cdcDatabase:
429
enabled: false
430
namespace: database
431
podLabels:
432
app.kubernetes.io/name: postgresql
433
port: 5432
434
# -- Extra egress rules
435
egressRules: []
436
# -- Observability and monitoring
437
metrics:
438
# -- Prometheus ServiceMonitor
439
serviceMonitor:
440
# -- Enable ServiceMonitor
441
enabled: false
442
# -- Target namespace for the ServiceMonitor
443
namespace: ""
444
# -- Scrape interval
445
interval: "30s"
446
# -- Scrape timeout
447
scrapeTimeout: ""
448
# -- Extra labels for ServiceMonitor
449
labels: {}
450
# -- Metric relabeling rules
451
metricRelabelings: []
452
# -- Relabeling rules
453
relabelings: []
454
# -- PrometheusRule for alerting
455
prometheusRule:
456
# -- Enable PrometheusRule
457
enabled: false
458
# -- Target namespace for the PrometheusRule
459
namespace: ""
460
# -- Extra labels
461
labels: {}
462
# -- Alert rules
463
rules:
464
- alert: KatesDown
465
expr: up{job="{{ include \"kates.fullname\" . }}"} == 0
466
for: 5m
467
labels:
468
severity: critical
469
annotations:
470
summary: "KATES instance is down"
471
description: "KATES pod {{ $labels.pod }} has been down for more than 5 minutes."
472
- alert: KatesHighErrorRate
473
expr: rate(http_server_requests_seconds_count{job="{{ include \"kates.fullname\" . }}", status=~"5.."}[5m]) > 0.1
474
for: 5m
475
labels:
476
severity: warning
477
annotations:
478
summary: "KATES high error rate"
479
description: "KATES is returning more than 10% 5xx responses."
480
# -- GONE in 0.9.0: the "KATES — Overview" board (dashboards/kates-overview/)
481
# is delivered by charts/monitoring with every other board in dashboards/
482
# (its `dashboards.enabled`), scoped to a release by its `$job` template
483
# variable. A release that still sets any `metrics.grafanaDashboard.*` key
484
# is REFUSED with the new location named (this chart has no values schema,
485
# so without the refusal the key would be accepted and silently ignored).
486
# -- Bundled PostgreSQL configuration.
487
# A self-contained single-instance StatefulSet on the official `postgres`
488
# image (no Bitnami). For production HA, set enabled=false and point
489
# externalDatabase at a managed cluster (CloudNativePG recommended).
490
postgresql:
491
# -- Deploy bundled PostgreSQL
492
enabled: true
493
# -- PostgreSQL image (official library image; Alpine variants also work)
494
image:
495
repository: cgr.dev/chainguard-private/postgres
496
tag: 16.15-r5@sha256:74cf7262337ca121ffd0e057daafe750062581e74b3d8c4e63bc32d8298d1b02
497
# -- Database authentication
498
auth:
499
# -- Database name
500
database: kates
501
# -- Database username
502
username: kates
503
# -- Database password (ignored if existingSecret is set)
504
password: kates
505
# -- Use an existing Secret for DB credentials
506
existingSecret: ""
507
# -- Key in the existing Secret
508
passwordKey: "password"
509
# -- Node selector for the embedded PostgreSQL pod (dev/test only)
510
nodeSelector: {}
511
# -- Tolerations for the embedded PostgreSQL pod
512
tolerations: []
513
# -- Affinity rules for the embedded PostgreSQL pod
514
affinity: {}
515
# -- PVC storage configuration
516
storage:
517
# -- Storage size
518
size: 1Gi
519
# -- Storage class (empty for default)
520
storageClass: ""
521
# -- PostgreSQL resource requests and limits
522
resources:
523
requests:
524
memory: "128Mi"
525
cpu: "100m"
526
limits:
527
memory: "256Mi"
528
cpu: "250m"
529
# -- PostgreSQL pod security context
530
securityContext:
531
runAsNonRoot: true
532
runAsUser: 999
533
fsGroup: 999
534
# -- PostgreSQL container security context
535
containerSecurityContext:
536
allowPrivilegeEscalation: false
537
capabilities:
538
drop:
539
- ALL
540
# -- JDBC connection pool settings
541
connectionPool:
542
# -- Maximum pool size
543
maxSize: "20"
544
# -- Minimum pool size
545
minSize: "5"
546
# -- External database configuration (when postgresql.enabled=false).
547
# Recommended for production HA: run a CloudNativePG `Cluster` (official
548
# postgres images, streaming replication, backups) and point host/port at its
549
# `-rw` service, e.g. host: kates-db-rw.database.svc — no Bitnami involved.
550
externalDatabase:
551
# -- Enable external database
552
enabled: false
553
# -- Database host
554
host: ""
555
# -- Database port
556
port: 5432
557
# -- Database name
558
database: kates
559
# -- Database username
560
username: kates
561
# -- Database password (ignored if existingSecret is set)
562
password: ""
563
# -- Use an existing Secret for DB credentials
564
existingSecret: ""
565
# -- Key in the existing Secret
566
passwordKey: "password"
567
# -- Default benchmark parameters (fallback for all test types)
568
defaults:
569
replicationFactor: "3"
570
partitions: "3"
571
minInsyncReplicas: "2"
572
acks: "all"
573
batchSize: "65536"
574
lingerMs: "5"
575
compressionType: "lz4"
576
recordSize: "1024"
577
numRecords: "1000000"
578
throughput: "-1"
579
durationMs: "600000"
580
numProducers: "1"
581
numConsumers: "1"
582
# -- Per-test-type parameter overrides
583
tests:
584
# -- LOAD: baseline throughput test
585
load:
586
partitions: "3"
587
batchSize: "65536"
588
lingerMs: "5"
589
numRecords: "1000000"
590
durationMs: "600000"
591
numProducers: "1"
592
# -- STRESS: high-concurrency, large batches
593
stress:
594
partitions: "6"
595
batchSize: "131072"
596
lingerMs: "10"
597
numRecords: "5000000"
598
durationMs: "900000"
599
numProducers: "3"
600
# -- SPIKE: burst traffic, low-latency
601
spike:
602
acks: "1"
603
batchSize: "131072"
604
lingerMs: "0"
605
compressionType: "none"
606
numRecords: "2000000"
607
durationMs: "300000"
608
# -- ENDURANCE: long-running, rate-limited
609
endurance:
610
numRecords: "10000000"
611
throughput: "5000"
612
durationMs: "3600000"
613
# -- VOLUME: large records, high batch size
614
volume:
615
partitions: "6"
616
batchSize: "262144"
617
lingerMs: "50"
618
recordSize: "10240"
619
numRecords: "2000000"
620
# -- CAPACITY: max parallelism
621
capacity:
622
partitions: "12"
623
batchSize: "131072"
624
lingerMs: "10"
625
numRecords: "10000000"
626
durationMs: "1200000"
627
numProducers: "5"
628
# -- ROUNDTRIP: latency-focused
629
roundtrip:
630
batchSize: "16384"
631
lingerMs: "0"
632
compressionType: "none"
633
numRecords: "500000"
634
throughput: "10000"
635
# -- PostgreSQL backup CronJob
636
backup:
637
# -- Enable backup CronJob
638
enabled: false
639
# -- Cron schedule expression
640
schedule: "0 2 * * *"
641
# -- PostgreSQL image for pg_dump
642
image: cgr.dev/chainguard-private/postgres:16.15-r5@sha256:74cf7262337ca121ffd0e057daafe750062581e74b3d8c4e63bc32d8298d1b02
643
# -- Days to retain backups
644
retention: 7
645
# -- Backup persistence
646
persistence:
647
enabled: false
648
existingClaim: ""
649
storageClass: ""
650
size: 5Gi
651
# -- Backup job resources
652
resources:
653
requests:
654
memory: "64Mi"
655
cpu: "50m"
656
limits:
657
memory: "256Mi"
658
cpu: "250m"
659
# -- Pre-upgrade Flyway migration Job
660
migration:
661
# -- Enable migration Job (runs as pre-upgrade Helm hook)
662
enabled: false
663
# -- Override image (defaults to KATES app image)
664
image: cgr.dev/chainguard-private/kates:1.29.0-r0@sha256:44c3abc1bfb61a74bd39b84c737974611c2c4bc10fc87181eac4fec860d65802
665
# -- Custom command (overrides default Flyway migration)
666
command: []
667
# -- Maximum retry attempts
668
backoffLimit: 3
669
# -- Maximum Job duration (seconds)
670
activeDeadlineSeconds: 600
671
# -- Migration job resources
672
resources:
673
requests:
674
memory: "256Mi"
675
cpu: "100m"
676
limits:
677
memory: "512Mi"
678
cpu: "500m"
679
# -- Stale test run cleanup CronJob. It deletes finished runs through the
680
# API's DELETE /api/tests, sending the key from apiKey's Secret. That
681
# endpoint takes an image newer than 1.25.0: on 1.25.0 every job fails with
682
# HTTP 405 and deletes nothing.
683
cleanup:
684
# -- Enable cleanup CronJob
685
enabled: false
686
# -- Cron schedule expression
687
schedule: "0 4 * * 0"
688
# -- Delete finished test runs created more than N days ago
689
retentionDays: 30
690
# -- Which finished runs to delete: DONE, FAILED or both. A cancelled run
691
# is stored FAILED. A run still PENDING, RUNNING or STOPPING is never
692
# deleted, however old it is.
693
statuses:
694
- DONE
695
- FAILED
696
# -- Curl image for API calls
697
image: cgr.dev/chainguard-private/min-toolkit-debug:latest@sha256:c38f30c67937b88d461d1caec40f118d582339df0bcd7cc6a8e26b0ac8c1b759
698
# -- Kyverno pod security policies (requires Kyverno controller in cluster)
699
kyvernoPolicy:
700
# -- Enable Kyverno ClusterPolicy for the kates namespace
701
enabled: false
702
# -- Policy action: Audit (observe only) or Enforce (block non-compliant)
703
action: Audit
704
# -- Enable mutation rules to auto-inject security contexts
705
mutate: true
706
# -- Enable image registry restriction
707
restrictRegistries: false
708
# -- Allowed image registries (when restrictRegistries is true)
709
allowedRegistries:
710
- ghcr.io/bmscomp/
711
- docker.io/bitnami/
712
- registry.k8s.io/
713
- quay.io/strimzi/
714
- curlimages/
715
# -- GONE in 0.9.0: the Kyverno board (dashboards/kyverno-security/) is
716
# delivered by charts/monitoring with every other board in dashboards/ (its
717
# `dashboards.enabled`) — one Kyverno per cluster, one board, and it belongs
718
# where the rest of the cluster's boards live. `grafanaDashboard` (both the
719
# bool and the map shape) and `grafanaDashboardNamespace` are REFUSED if
720
# set, with the new location named.
721
# -- Cosign image signature verification
722
cosign:
723
# -- Enable image signature verification via Cosign
724
enabled: false
725
# -- Image patterns requiring valid signatures
726
imagePatterns:
727
- "ghcr.io/bmscomp/*"
728
# -- Cosign public key (PEM format) — set via --set-file or Secrets
729
publicKey: ""
730
# -- Auto-generate default-deny NetworkPolicies for new namespaces
731
networkPolicyGeneration:
732
enabled: false
733
# -- Namespaces to exclude from default-deny generation
734
excludeNamespaces:
735
- kube-system
736
- kube-public
737
- kube-node-lease
738
- kyverno
739
- strimzi-operator
740
- monitoring
741
- kafka
742
- cert-manager
743
- litmus
744
- "kates-detect-*"
745
# -- PolicyExceptions for dev/test namespaces
746
policyExceptions:
747
# -- Enable PolicyException resources
748
enabled: false
749
# -- Dev namespaces where policies are relaxed
750
namespaces:
751
- kates-dev
752
- kates-staging
753
# -- Policies to create exceptions for
754
exemptPolicies:
755
- kates-pod-security-standards
756
# -- Rules to exempt in dev namespaces
757
exemptRules:
758
- validate-readonly-rootfs
759
- require-resource-limits
760
- disallow-latest-tag
761
# -- Monitoring integration
762
monitoring:
763
# -- Enable telemetry export (Jaeger)
764
enabled: true
765
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.