Initial spike support (#591)
* Initial spike support Signed-off-by: Kevin Fox <[email protected]> * Fix lint and docs Signed-off-by: Kevin Fox <[email protected]> * Update spike to 0.4.1 Signed-off-by: Kevin Fox <[email protected]> * Update for multiarch Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Fix values and docs Signed-off-by: Kevin Fox <[email protected]> * Pull in changes from Volkan Signed-off-by: Kevin Fox <[email protected]> * Fix service Signed-off-by: Kevin Fox <[email protected]> * Typo fix Signed-off-by: Volkan Özçelik <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: Volkan Özçelik <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Volkan Özçelik <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Faisal Memon
Volkan Özçelik
Faisal Memon
Volkan Özçelik
parent
38314ed6de
commit
e78400ebcd
@@ -0,0 +1,13 @@
|
||||
apiVersion: v2
|
||||
name: spike-keeper
|
||||
description: A Helm chart to deploy SPIKE Keeper
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.4.1"
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/spiffe/spike
|
||||
icon: https://spike.ist/assets/spike-banner.png
|
||||
maintainers:
|
||||
- name: kfox1111
|
||||
email: [email protected]
|
||||
@@ -0,0 +1,72 @@
|
||||
# spike-keeper
|
||||
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart to deploy spike keepers
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
|
||||
|
||||
## Version support
|
||||
|
||||
> [!Note]
|
||||
> This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||
> we do aim for as much stability as possible.
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| Helm | `3.x` |
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/spiffe/spike>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spike-keeper` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `replicas` | The number of keepers to launch | `3` |
|
||||
| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||
| `labels` | Labels for pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `service.type` | Service type | `ClusterIP` |
|
||||
| `service.port` | Service port | `443` |
|
||||
| `service.annotations` | Annotations for service resource | `{}` |
|
||||
| `nodeSelector` | (Optional) Select specific nodes to run on. | `{}` |
|
||||
| `affinity` | Affinity rules | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
||||
| `startupProbe.enabled` | Enable startupProbe | `true` |
|
||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
||||
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `ingress.className` | Ingress class name | `""` |
|
||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `ingress.annotations` | Annotations | `{}` |
|
||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `keeper` |
|
||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
@@ -0,0 +1 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
@@ -0,0 +1,83 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spike-keeper.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spike-keeper.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||
*/}}
|
||||
{{- define "spike-keeper.namespace" -}}
|
||||
{{- if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.server.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-server" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spike-keeper.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spike-keeper.labels" -}}
|
||||
helm.sh/chart: {{ include "spike-keeper.chart" . }}
|
||||
{{ include "spike-keeper.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spike-keeper.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spike-keeper.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spike-keeper.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spike-keeper.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spike-keeper.workload-api-socket-path" -}}
|
||||
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,44 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{ $root := . }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||
{{- $fullName := include "spike-keeper.fullname" . -}}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $path = "" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
{{ $last := sub (.Values.replicas | int) 1 | int }}
|
||||
{{ range (seq 0 ($last) | toString | split " ") }}
|
||||
{{ $i := . }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}-{{ $i }}
|
||||
namespace: {{ include "spike-keeper.namespace" $root }}
|
||||
labels:
|
||||
{{ include "spike-keeper.labels" $root | nindent 4}}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $host := $root.Values.ingress.host }}
|
||||
{{- if contains "." $host }}
|
||||
{{- $hostParts := regexSplit "[.]" $host 2 }}
|
||||
{{- $host = printf "%s-%s.%s" (index $hostParts 0) $i (index $hostParts 1) }}
|
||||
{{- else }}
|
||||
{{- $host = printf "%s-%s" $host $i }}
|
||||
{{- end }}
|
||||
{{ $ingress := deepCopy $root.Values.ingress }}
|
||||
{{ $_ := set $ingress "host" $host }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" $ingress "svcName" (printf "%s-%s" $fullName $i) "port" $root.Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" $root.Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,48 @@
|
||||
{{ $root := . }}
|
||||
{{ $last := sub (.Values.replicas | int) 1 | int }}
|
||||
{{ range (seq 0 ($last) | toString | split " ") }}
|
||||
{{ $i := . }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
namespace: {{ include "spike-keeper.namespace" $root }}
|
||||
name: {{ include "spike-keeper.fullname" $root }}-{{ $i }}
|
||||
{{- with $root.Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
apps.kubernetes.io/pod-index: {{ $i | quote }}
|
||||
{{- include "spike-keeper.labels" $root | nindent 4 }}
|
||||
spec:
|
||||
type: {{ $root.Values.service.type }}
|
||||
selector:
|
||||
apps.kubernetes.io/pod-index: {{ $i | quote }}
|
||||
{{- include "spike-keeper.selectorLabels" $root | nindent 4 }}
|
||||
ports:
|
||||
- name: {{ include "spike-keeper.fullname" $root }}
|
||||
port: {{ $root.Values.service.port }}
|
||||
targetPort: http
|
||||
{{ end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
namespace: {{ include "spike-keeper.namespace" $root }}
|
||||
name: {{ include "spike-keeper.fullname" $root }}-headless
|
||||
{{- with $root.Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spike-keeper.labels" $root | nindent 4 }}
|
||||
spec:
|
||||
type: {{ $root.Values.service.type }}
|
||||
clusterIP: None
|
||||
selector:
|
||||
{{- include "spike-keeper.selectorLabels" $root | nindent 4 }}
|
||||
ports:
|
||||
- name: {{ include "spike-keeper.fullname" $root }}
|
||||
port: {{ $root.Values.service.port }}
|
||||
targetPort: http
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spike-keeper.serviceAccountName" . }}
|
||||
namespace: {{ include "spike-keeper.namespace" . }}
|
||||
labels:
|
||||
{{- include "spike-keeper.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,84 @@
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ include "spike-keeper.fullname" . }}
|
||||
namespace: {{ include "spike-keeper.namespace" . }}
|
||||
labels:
|
||||
{{- include "spike-keeper.labels" . | nindent 4 }}
|
||||
spec:
|
||||
serviceName: {{ include "spike-keeper.fullname" . }}-headless
|
||||
replicas: {{ .Values.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spike-keeper.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "spike-keeper.selectorLabels" . | nindent 8 }}
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: spike-keeper
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spike-keeper.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ include "spike-keeper.fullname" . }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global "ubi" true) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: SPIFFE_ENDPOINT_SOCKET
|
||||
value: unix://{{ include "spike-keeper.workload-api-socket-path" . }}
|
||||
- name: SPIKE_SYSTEM_LOG_LEVEL
|
||||
value: {{ .Values.logLevel | upper }}
|
||||
- name: SPIKE_TRUST_ROOT
|
||||
value: {{ include "spire-lib.trust-domain" . }}
|
||||
- name: SPIKE_TRUST_ROOT_NEXUS
|
||||
value: {{if eq .Values.trustRoot.nexus "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.nexus }}{{ end }}
|
||||
- name: SPIKE_KEEPER_TLS_PORT
|
||||
value: ":8443"
|
||||
{{- if .Values.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
tcpSocket:
|
||||
port: 8443
|
||||
failureThreshold: {{ .Values.startupProbe.failureThreshold }}
|
||||
initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.startupProbe.periodSeconds }}
|
||||
successThreshold: {{ .Values.startupProbe.successThreshold }}
|
||||
timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: {{ include "spike-keeper.workload-api-socket-path" . | dir }}
|
||||
readOnly: true
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: "{{ .Values.csiDriverName }}"
|
||||
readOnly: true
|
||||
@@ -0,0 +1,139 @@
|
||||
# Default configuration for SPIKE Keeper
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
## @skip global
|
||||
global: {}
|
||||
|
||||
## @section Chart parameters
|
||||
##
|
||||
## @param image.registry The OCI registry to pull the image from
|
||||
## @param image.repository The repository within the registry
|
||||
## @param image.pullPolicy The image pull policy
|
||||
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spike-keeper
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
## @param replicas The number of keepers to launch
|
||||
replicas: 3
|
||||
|
||||
trustRoot:
|
||||
## @param trustRoot.nexus Override which trustRoot Nexus is in
|
||||
nexus: ""
|
||||
|
||||
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||
logLevel: debug
|
||||
|
||||
## @param agentSocketName The name of the spire-agent unix socket
|
||||
agentSocketName: spire-agent.sock
|
||||
## @param csiDriverName The csi driver to use
|
||||
csiDriverName: csi.spiffe.io
|
||||
|
||||
## @param imagePullSecrets [array] Pull secrets for images
|
||||
imagePullSecrets: []
|
||||
|
||||
## @param nameOverride Name override
|
||||
nameOverride: ""
|
||||
|
||||
## @param namespaceOverride Namespace override
|
||||
namespaceOverride: ""
|
||||
|
||||
## @param fullnameOverride Fullname override
|
||||
fullnameOverride: ""
|
||||
|
||||
## @param serviceAccount.create Specifies whether a service account should be created
|
||||
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
||||
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||
##
|
||||
serviceAccount:
|
||||
create: true
|
||||
annotations: {}
|
||||
name: ""
|
||||
|
||||
## @param labels [object] Labels for pods
|
||||
labels: {}
|
||||
|
||||
## @param podSecurityContext [object] Pod security context
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
## @param securityContext [object] Security context
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param service.type Service type
|
||||
## @param service.port Service port
|
||||
## @param service.annotations Annotations for service resource
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
|
||||
## @param nodeSelector (Optional) Select specific nodes to run on.
|
||||
nodeSelector: {}
|
||||
|
||||
## @param affinity [object] Affinity rules
|
||||
affinity: {}
|
||||
|
||||
## @param tolerations [array] List of tolerations
|
||||
tolerations: []
|
||||
|
||||
## @param topologySpreadConstraints [array] List of topology spread constraints for resilience
|
||||
topologySpreadConstraints: []
|
||||
|
||||
## Provide minimal resources to prevent accidental crashes due to resource exhaustion
|
||||
# resources:
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 128Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 512Mi
|
||||
|
||||
## Configure extra options for startup probe
|
||||
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
|
||||
## @param startupProbe.enabled Enable startupProbe
|
||||
## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
|
||||
## @param startupProbe.periodSeconds Period seconds for startupProbe
|
||||
## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
|
||||
## @param startupProbe.failureThreshold Failure threshold count for startupProbe
|
||||
## @param startupProbe.successThreshold Success threshold count for startupProbe
|
||||
##
|
||||
startupProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
successThreshold: 1
|
||||
|
||||
## @param ingress.enabled Flag to enable ingress
|
||||
## @param ingress.className Ingress class name
|
||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
## @param ingress.annotations [object] Annotations
|
||||
ingress:
|
||||
enabled: false
|
||||
className: ""
|
||||
controllerType: ""
|
||||
annotations: {}
|
||||
|
||||
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "keeper"
|
||||
|
||||
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||
hosts: []
|
||||
|
||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
Reference in New Issue
Block a user