victoria-metrics-auth

# Default values for victoria-metrics-auth.

# This is a YAML-formatted file.

# Declare variables to be passed into your templates.

global:

# -- Image pull secrets, that can be shared across multiple helm charts

imagePullSecrets: []

image:

# -- Image registry, that can be shared across multiple helm charts

registry: ""

# -- Openshift security context compatibility configuration

compatibility:

openshift:

adaptSecurityContext: "auto"

cluster:

# -- K8s cluster domain suffix, uses for building storage pods' FQDN. Details are [here](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/)

dnsDomain: cluster.local.

# -- Labels added to all resources

extraLabels: {}

# -- Annotations added to all resources

extraAnnotations: {}

# -- Number of replicas of vmauth

replicaCount: 1

# -- Name of Priority Class

priorityClassName: ""

# -- Name of the [RuntimeClass](https://kubernetes.io/docs/concepts/containers/runtime-class/) used to run the pod, e.g. "gvisor"

runtimeClassName: ""

image:

# -- Image registry

registry: cgr.dev

# -- Victoria Metrics Auth Docker repository and image name

repository: chainguard-private/victoriametrics-vmauth

# -- Tag of Docker image

tag: 1.154.1-r0@sha256:9819d52e74e73ada9515678f982e5fc5b3e8e138ed53c5e2e2e835a09f04acb5

# -- Variant of the image to use.

# e.g. enterprise, scratch

variant: ""

# -- Pull policy of Docker image

pullPolicy: IfNotPresent

# -- Override default container command. Use when the VictoriaMetrics binary is available at a custom path

command: []

# -- Image pull secrets

imagePullSecrets: []

# -- Override chart name

nameOverride: ""

# -- Override resources fullname

fullnameOverride: ""

containerWorkingDir: "/"

# -- Specify pod lifecycle

lifecycle: {}

# -- Init containers for vmauth

initContainers: []

# - name: example

# image: example-image

serviceAccount:

# -- Specifies whether a service account should be created

create: true

# -- Annotations to add to the service account

annotations: {}

# -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template

name:

# -- Mount API token to pod directly

automountToken: true

# -- See `kubectl explain poddisruptionbudget.spec` for more. Official guide is [here](https://kubernetes.io/docs/tasks/run-application/configure-pdb/)

podDisruptionBudget:

enabled: false

# -- min number or percentage of pods that can be unavailable

minAvailable: 0

# -- max number or percentage of pods that can be unavailable

maxUnavailable: 0

# -- Defines criteria when unhealthy pods should be considered for eviction

unhealthyPodEvictionPolicy:

labels: {}

# -- See `kubectl explain networkpolicy.spec` for more. Details are [here](https://kubernetes.io/docs/concepts/services-networking/network-policies/)

networkPolicy:

enabled: false

# -- Ingress rules

ingress: []

# -- Egress rules

egress: []

# -- Extra labels for NetworkPolicy

labels: {}

# -- Extra annotations for NetworkPolicy

annotations: {}

# -- HTTP listen address configuration. See https://docs.victoriametrics.com/helm/victoria-metrics-auth/#http-listen-address for details.

http:

- name: http

value: :8427

primary: true

# -- Extra command line arguments for container of component

extraArgs:

envflag.enable: true

envflag.prefix: VM_

loggerFormat: json

# Enable IPv6 support. Useful for running in IPv6-only Kubernetes clusters

# enableTCP6: true

# -- Additional environment variables (ex.: secret tokens, flags). Check [here](https://docs.victoriametrics.com/victoriametrics/#environment-variables) for details

env: []

# -- Pod topologySpreadConstraints

topologySpreadConstraints: []

# - maxSkew: 1

# topologyKey: topology.kubernetes.io/zone

# whenUnsatisfiable: DoNotSchedule

# -- Specify alternative source for env variables

envFrom: []

#- configMapRef:

# name: special-config

# -- Additional hostPath mounts

extraHostPathMounts: []

# - name: certs-dir

# mountPath: /etc/kubernetes/certs

# subPath: ""

# hostPath: /etc/kubernetes/certs

# readOnly: true

# -- Extra Volumes for the pod

extraVolumes: []

# - name: example

# configMap:

# name: example

# -- Extra Volume Mounts for the container

extraVolumeMounts: []

# - name: example

# mountPath: /example

# -- Extra containers to run in a pod with vmauth

extraContainers: []

# - name: config-reloader

# image: reloader-image

# -- Pod's security context. Details are [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)

podSecurityContext:

enabled: true

# fsGroup: 2000

# -- Container security context. Check [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) for details.

securityContext:

enabled: true

# capabilities:

# drop:

# - ALL

# readOnlyRootFilesystem: true

# runAsNonRoot: true

# runAsUser: 1000

service:

# -- Service traffic distribution. Details are [here](https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution)

trafficDistribution: ""

# -- Enable vmauth service

enabled: true

# -- Service annotations

annotations: {}

# -- Service labels

extraLabels: {}

# -- Service ClusterIP

clusterIP: ""

# -- Service external IPs. Check [here](https://kubernetes.io/docs/concepts/services-networking/service/#external-ips) for details

externalIPs: []

# -- Service load balancer IP

loadBalancerIP: ""

# -- Load balancer source range

loadBalancerSourceRanges: []

# -- Service port

servicePort: ""

# nodePort: 30000

# -- Service type

type: ClusterIP

# -- Service external traffic policy. Check [here](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip) for details

externalTrafficPolicy: ""

# -- Health check node port for a service. Check [here](https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip) for details

healthCheckNodePort: ""

# -- Service IP family policy. Check [here](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services) for details.

ipFamilyPolicy: ""

# -- List of service IP families. Check [here](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services) for details.

ipFamilies: []

route:

# -- Enable deployment of HTTPRoute for VMAuth

enabled: false

# -- HTTPRoute annotations

annotations: {}

# -- HTTPRoute extra labels

extraLabels: {}

# -- HTTPGateway objects refs

parentRefs: []

# -- Array of hostnames

hostnames: []

# -- Extra rules to prepend to route. This is useful when working with annotation based services.

extraRules: []

# -- Filters for a default rule in HTTPRoute

filters: []

# -- Matches for a default rule in HTTPRoute

matches:

- path:

type: PathPrefix

value: /

ingress:

# -- Enable deployment of ingress for vmauth component

enabled: false

# -- Ingress annotations

annotations: {}

# kubernetes.io/ingress.class: nginx

# kubernetes.io/tls-acme: 'true'

# -- Ingress extra labels

extraLabels: {}

# -- Array of host objects

hosts:

- name: vmauth.local

path:

- /

port: http

# -- Array of TLS objects

tls: []

# - secretName: vmauth-ingress-tls

# hosts:

# - vmauth.local

# -- Ingress controller class name

ingressClassName: ""

# -- Ingress path type

pathType: Prefix

ingressInternal:

# -- Enable deployment of internal ingress for vmauth component

enabled: false

# -- Ingress annotations

annotations: {}

# kubernetes.io/ingress.class: nginx

# kubernetes.io/tls-acme: 'true'

# -- Ingress extra labels

extraLabels: {}

# -- Array of host objects

hosts:

- name: vmauth.local

path:

- /

port: http

# -- Array of TLS objects

tls: []

# - secretName: vmauth-ingress-tls

# hosts:

# - vmauth.local

# -- Ingress controller class name

ingressClassName: ""

# -- Ingress path type

pathType: Prefix

# -- We usually recommend not to specify default resources and to leave this as a conscious choice for the user. This also increases chances charts run on environments with little resources, such as Minikube. If you do want to specify resources, uncomment the following lines, adjust them as necessary, and remove the curly braces after `resources:`.

resources: {}

# limits:

# cpu: 100m

# memory: 128Mi

# requests:

# cpu: 100m

# memory: 128Mi

# -- Annotations to be added to the deployment

annotations: {}

# -- Annotations to be added to pod

podAnnotations: {}

# -- Labels to be added to pod

podLabels: {}

# -- Labels to be added to the deployment

extraLabels: {}

# -- Custom DNS config for pod. Details are [here](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-config)

dnsConfig: {}

# -- NodeSelector configurations. Check [here](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector) for details

nodeSelector: {}

# -- Tolerations configurations. Check [here](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/) for details

tolerations: []

# - key: "key"

# operator: "Equal|Exists"

# value: "value"

# effect: "NoSchedule|PreferNoSchedule"

# -- Affinity configurations

affinity: {}

# -- vmauth mode: deployment, daemonSet

mode: deployment

# -- [K8s DaemonSet](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) specific variables

daemonSet:

spec: {}

# -- [K8s Deployment](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/) specific variables

deployment:

spec:

strategy:

type: RollingUpdate

serviceMonitor:

# -- Enable deployment of Service Monitor for server component. This is Prometheus operator object

enabled: false

# -- Service Monitor labels

extraLabels: {}

# -- Service Monitor annotations

annotations: {}

# -- Service Monitor relabelings

relabelings: []

# -- Basic auth params for Service Monitor

basicAuth: {}

# -- Service Monitor metricRelabelings

metricRelabelings: []

# -- Service Monitor port. Uses primary http item name by default

port: ""

# -- Service Monitor target port. Overrides port when set

targetPort: ""

# interval: 15s

# scrapeTimeout: 5s

# -- Commented. HTTP scheme to use for scraping.

# scheme: https

# -- Commented. TLS configuration to use when scraping the endpoint

# tlsConfig:

# insecureSkipVerify: true

# -- Use existing secret if specified otherwise .config values will be used. Check [here](https://docs.victoriametrics.com/victoriametrics/vmauth/) for details.

# Configuration in the given secret must be stored under `auth.yml` key.

secretName: ""

# -- Config file content.

config:

# Arbitrary number of usernames may be put here.

# Usernames must be unique.

# users:

# The user for querying local single-node VictoriaMetrics.

# All the requests to http://vmauth:8427 with the given Basic Auth (username:password)

# will be routed to http://localhost:8428 .

# For example, http://vmauth:8427/api/v1/query is routed to http://localhost:8428/api/v1/query

# - username: "local-single-node"

# password: "***"

# url_prefix: "http://localhost:8428"

# The user for querying account 123 in VictoriaMetrics cluster

# See https://github.com/VictoriaMetrics/VictoriaMetrics/blob/cluster/README.md#url-format

# All the requests to http://vmauth:8427 with the given Basic Auth (username:password)

# will be routed to http://vmselect:8481/select/123/prometheus .

# For example, http://vmauth:8427/api/v1/query is routed to http://vmselect:8481/select/123/prometheus/api/v1/select

# - username: "cluster-select-account-123"

# password: "***"

# url_prefix: "http://vmselect:8481/select/123/prometheus"

# The user for inserting Prometheus data into VictoriaMetrics cluster under account 42

# See https://github.com/VictoriaMetrics/VictoriaMetrics/blob/cluster/README.md#url-format

# All the requests to http://vmauth:8427 with the given Basic Auth (username:password)

# will be routed to http://vminsert:8480/insert/42/prometheus .

# For example, http://vmauth:8427/api/v1/write is routed to http://vminsert:8480/insert/42/prometheus/api/v1/write

# - username: "cluster-insert-account-42"

# password: "***"

# url_prefix: "http://vminsert:8480/insert/42/prometheus"

# -- Raw config file content. Overrides `.Values.config` when set. Supports Helm templating,

# YAML anchors, and comments.

configRaw: ""

# -- Annotations for config secret

configAnnotations: {}

# -- Add extra specs dynamically to this chart

extraObjects: []

probe:

# -- Readiness probe

readiness:

tcpSocket: {}

initialDelaySeconds: 5

periodSeconds: 15

# -- Liveness probe

liveness:

tcpSocket: {}

initialDelaySeconds: 5

periodSeconds: 15

timeoutSeconds: 5

# -- Startup probe

startup: {}

# -- Enterprise license key configuration for VictoriaMetrics enterprise.

# Required only for VictoriaMetrics enterprise. Check docs [here](https://docs.victoriametrics.com/victoriametrics/enterprise/),

# for more information, visit [site](https://victoriametrics.com/products/enterprise/).

# Request a trial license [here](https://victoriametrics.com/products/enterprise/trial/)

# Supported starting from VictoriaMetrics v1.94.0

license:

# -- License key

key: ""

# -- Use existing secret with license key

secret:

# -- Existing secret name

name: ""

# -- Key in secret with license key

key: ""