helm-charts-hardened/charts/spire/charts/tornjak-frontend/values.yaml

# Default configuration for Tornjak UI (Frontend)
# SPDX-License-Identifier: APACHE-2.0

## @skip global
global: {}

## @section Chart parameters
##
## @param image.registry The OCI registry to pull the image from
## @param image.repository The repository within the registry
## @param image.pullPolicy The image pull policy
## @param image.tag Overrides the image tag whose default is the chart appVersion
##
image:
  registry: ghcr.io
  repository: spiffe/tornjak-frontend
  pullPolicy: IfNotPresent
  tag: ""

## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: []

## @param nameOverride Name override
nameOverride: ""

## @param namespaceOverride Namespace override
namespaceOverride: ""

## @param fullnameOverride Fullname override
fullnameOverride: ""

## @param serviceAccount.create Specifies whether a service account should be created
## @param serviceAccount.annotations [object] Annotations to add to the service account
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
##
serviceAccount:
  create: true
  annotations: {}
  name: ""

## @param labels [object] Labels for tornjak frontend pods
labels: {}

## @param podSecurityContext [object] Pod security context
podSecurityContext: {}
  # fsGroup: 2000

## @param securityContext [object] Security context
securityContext: {}
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  # runAsNonRoot: true
  # runAsUser: 1000

## @param service.type Service type
## @param service.port Service port
## @param service.annotations Annotations for service resource
##
service:
  type: ClusterIP
  port: 3000
  annotations: {}

## @extra nodeSelector Select specific nodes to run on (currently only amd64 is supported by Tornjak)
nodeSelector:
  ## @skip nodeSelector.kubernetes.io/arch
  kubernetes.io/arch: amd64

## @param affinity [object] Affinity rules
affinity: {}

## @param tolerations [array] List of tolerations
tolerations: []

## @param topologySpreadConstraints [array] List of topology spread constraints for resilience
topologySpreadConstraints: []

## Provide minimal resources to prevent accidental crashes due to resource exhaustion
# resources:
#   requests:
#     cpu: 50m
#     memory: 128Mi
#   limits:
#     cpu: 100m
#     memory: 512Mi

## @param apiServerURL URL of the Tornjak APIs (backend). Since Tornjak Frontend runs in the browser, this URL must be accessible from the machine running a browser. If unset, autodetection is atempted.
apiServerURL: ""

# SPIRE Healthchecker indicator
spireHealthCheck:
  ## @param spireHealthCheck.enabled Enables the SPIRE Healthchecker indicator
  enabled: true

## Configure extra options for Tornjak frontend container's startup probe
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
## @param startupProbe.enabled Enable startupProbe on Tornjak frontend container
## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
## @param startupProbe.periodSeconds Period seconds for startupProbe
## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
## @param startupProbe.failureThreshold Failure threshold count for startupProbe
## @param startupProbe.successThreshold Success threshold count for startupProbe
##
startupProbe:
  enabled: true
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 6
  successThreshold: 1

## @param workingDir Set to override the default path containing the Tornjak frontend within the image
workingDir: ""

## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
## @param ingress.className Ingress class name for Tornjak frontend service
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
## @param ingress.annotations [object] Annotations for Tornjak frontend service
ingress:
  enabled: false
  className: ""
  controllerType: ""
  annotations: {}

  ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
  host: "tornjak-frontend"

  ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
  tlsSecret: ""

  ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
  hosts: []
  #   - host: tornjak-frontend.example.org
  #     paths:
  #       - path: /
  #         pathType: Prefix

  ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - tornjak-frontend.example.org

tests:
  bash:
    ## @param tests.bash.image.registry The OCI registry to pull the image from
    ## @param tests.bash.image.repository The repository within the registry
    ## @param tests.bash.image.pullPolicy The image pull policy
    ## @param tests.bash.image.tag Overrides the image tag whose default is the chart appVersion
    ##
    image:
      registry: cgr.dev
      repository: chainguard/bash
      pullPolicy: IfNotPresent
      tag: latest@sha256:d69268f206bc7914c25f7377309a73406517678458ebccec0e6bfab7b9b7e9d2