helm-charts-hardened/charts/spire/charts/spike-nexus/values.yaml

# Default configuration for SPIKE Keeper
# SPDX-License-Identifier: APACHE-2.0

## @skip global
global: {}

## @section Chart parameters
##
## @param image.registry The OCI registry to pull the image from
## @param image.repository The repository within the registry
## @param image.pullPolicy The image pull policy
## @param image.tag Overrides the image tag whose default is the chart appVersion
##
image:
  registry: ghcr.io
  repository: spiffe/spike-nexus
  pullPolicy: IfNotPresent
  tag: ""

## @param backendStore The backend store to use. Must be one of [sqlite, memory, lite]
backendStore: sqlite

## @param replicas The number of keepers to launch
replicas: 1

shamir:
  ## @param shamir.shares How many shares to configure for shamir secrets
  shares: 3
  ## @param shamir.threshold How many shares needed to recover
  threshold: 2

## @param keeperPeers Keeper peer configuration. If blank, it will be autodetected
keeperPeers: []

trustRoot:
  ## @param trustRoot.nexus Override which trustRoot Nexus is in
  nexus: ""
  ## @param trustRoot.keepers Override which trustRoot Keepers are in
  keepers: []
  ## @param trustRoot.pilot Override which trustRoot Pilot is in
  pilot: ""

## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
logLevel: debug

## @param agentSocketName The name of the spire-agent unix socket
agentSocketName: spire-agent.sock
## @param csiDriverName The csi driver to use
csiDriverName: csi.spiffe.io

## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: []

## @param nameOverride Name override
nameOverride: ""

## @param namespaceOverride Namespace override
namespaceOverride: ""

## @param fullnameOverride Fullname override
fullnameOverride: ""

## @param serviceAccount.create Specifies whether a service account should be created
## @param serviceAccount.annotations [object] Annotations to add to the service account
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
##
serviceAccount:
  create: true
  annotations: {}
  name: ""

## @param labels [object] Labels for pods
labels: {}

## @param podSecurityContext [object] Pod security context
podSecurityContext: {}
  # fsGroup: 2000

## @param securityContext [object] Security context
securityContext:
  # capabilities:
  #   drop:
  #   - ALL
  # readOnlyRootFilesystem: true
  runAsNonRoot: true
  runAsUser: 1000

## @param service.type Service type
## @param service.port Service port
## @param service.annotations Annotations for service resource
##
service:
  type: ClusterIP
  port: 443
  annotations: {}

## @param nodeSelector (Optional) Select specific nodes to run on.
nodeSelector: {}

## @param affinity [object] Affinity rules
affinity: {}

## @param tolerations [array] List of tolerations
tolerations: []

## @param topologySpreadConstraints [array] List of topology spread constraints for resilience
topologySpreadConstraints: []

## Provide minimal resources to prevent accidental crashes due to resource exhaustion
# resources:
#   requests:
#     cpu: 50m
#     memory: 128Mi
#   limits:
#     cpu: 100m
#     memory: 512Mi

## Configure extra options for startup probe
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes
## @param startupProbe.enabled Enable startupProbe
## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
## @param startupProbe.periodSeconds Period seconds for startupProbe
## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
## @param startupProbe.failureThreshold Failure threshold count for startupProbe
## @param startupProbe.successThreshold Success threshold count for startupProbe
##
startupProbe:
  enabled: true
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 5
  failureThreshold: 6
  successThreshold: 1

## @param ingress.enabled Flag to enable ingress
## @param ingress.className Ingress class name
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
## @param ingress.annotations [object] Annotations
ingress:
  enabled: false
  className: ""
  controllerType: ""
  annotations: {}

  ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
  host: "nexus"

  ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
  tlsSecret: ""

  ## @param ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
  hosts: []
  #   - host: nexus.example.org
  #     paths:
  #       - path: /
  #         pathType: Prefix

  ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
  tls: []
  #  - secretName: chart-example-tls
  #    hosts:
  #      - nexus.example.org

## @param persistence.type What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only)
## @param persistence.size What size volume to use for persistence
## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)
## @param persistence.storageClass What storage class to use for persistence
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
##
persistence:
  type: pvc
  size: 1Gi
  accessMode: ReadWriteOnce
  storageClass: null
  hostPath: ""