cassandra

# This file has been modified by Chainguard, Inc.

#

# Copyright Chainguard, Inc. All Rights Reserved.

# Chainguard, Inc. modifications are subject to the license

# available at: https://www.chainguard.dev/legal/software-license-agreement

#

# Copyright Broadcom, Inc. All Rights Reserved.

# SPDX-License-Identifier: APACHE-2.0

## @section Global parameters

## Global Docker image parameters

## Please, note that this will override the image parameters, including dependencies, configured to use the global value

## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass

##

## @param global.imageRegistry Global Docker image registry

## @param global.useImageTags Pull every image by tag and ignore all image digests, including digests set in values. Use this when your registry mirror does not have the chart's default image digests.

## @param global.imagePullSecrets Global Docker registry secret names as an array

## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)

##

global:

imageRegistry: ""

useImageTags: false

## E.g.

## imagePullSecrets:

## - myRegistryKeySecretName

##

imagePullSecrets: []

defaultStorageClass: ""

## Security parameters

##

security:

## @param global.security.allowInsecureImages Allows skipping image verification

allowInsecureImages: false

## Compatibility adaptations for Kubernetes platforms

##

compatibility:

## Compatibility adaptations for Openshift

##

openshift:

## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)

##

adaptSecurityContext: auto

org: ""

## @section Common parameters

##

## @param nameOverride String to partially override common.names.fullname

##

nameOverride: ""

## @param fullnameOverride String to fully override common.names.fullname

##

fullnameOverride: ""

## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)

##

kubeVersion: ""

## @param commonLabels Labels to add to all deployed objects (sub-charts are not considered)

##

commonLabels: {}

## @param commonAnnotations Annotations to add to all deployed objects

##

commonAnnotations: {}

## @param clusterDomain Kubernetes cluster domain name

##

clusterDomain: cluster.local

## @param extraDeploy Array of extra objects to deploy with the release

##

extraDeploy: []

## @param usePasswordFiles Mount credentials as files instead of using environment variables

##

usePasswordFiles: true

## Enable diagnostic mode in the deployment

##

diagnosticMode:

## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)

##

enabled: false

## @param diagnosticMode.command Command to override all containers in the deployment

##

command:

- sleep

## @param diagnosticMode.args Args to override all containers in the deployment

##

args:

- infinity

## @section Cassandra parameters

##

## Iamguarded Cassandra image

## @param image.registry [default: REGISTRY_NAME] Cassandra image registry

## @param image.repository [default: REPOSITORY_NAME/cassandra] Cassandra image repository

## @skip image.tag Cassandra image tag (immutable tags are recommended)

## @param image.digest Cassandra image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

## @param image.pullPolicy image pull policy

## @param image.pullSecrets Cassandra image pull secrets

## @param image.debug Enable image debug mode

##

image:

registry: cgr.dev

repository: chainguard-private/cassandra-iamguarded

tag: 5.0.9

digest: ""

## Specify a imagePullPolicy

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

##

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

## Secrets must be manually created in the namespace.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

## e.g:

## pullSecrets:

## - myRegistryKeySecretName

##

pullSecrets: []

## Enable debug mode

##

debug: false

## Secret with keystore, keystore password, truststore, truststore password

## DEPRECATED. Use tls.existingSecret instead

# tlsEncryptionSecretName:

## Database credentials

## @param dbUser.user Cassandra admin user

## @param dbUser.forcePassword Force the user to provide a non

## @param dbUser.password Password for `dbUser.user`. Randomly generated if empty

## @param dbUser.existingSecret Use an existing secret object for `dbUser.user` password (will ignore `dbUser.password`)

##

dbUser:

user: cassandra

forcePassword: false

password: ""

## Use an existing secrets which already stores your password data.

## for backwards compatibility, existingSecret can be a simple string,

## referencing the secret by name.

## existingSecret:

## ## Name of the existing secret

## ##

## name: mySecret

## ## Key mapping where <key> is the value which the deployment is expecting and

## ## <value> is the name of the key in the existing secret.

## ##

## keyMapping:

## cassandra-password: myCassandraPasswordKey

##

existingSecret: ""

## @param initDB Object with cql scripts. Useful for creating a keyspace and pre-populating data

##

initDB: {}

## @param initDBConfigMap ConfigMap with cql scripts. Useful for creating a keyspace and pre-populating data

##

initDBConfigMap: ""

## @param initDBSecret Secret with cql script (with sensitive data). Useful for creating a keyspace and pre-populating data

##

initDBSecret: ""

## @param existingConfiguration ConfigMap with custom cassandra configuration files. This overrides any other Cassandra configuration set in the chart

##

existingConfiguration: ""

## Cluster parameters

## @param cluster.name Cassandra cluster name

## @param cluster.seedCount Number of seed nodes

## @param cluster.numTokens Number of tokens for each node

## @param cluster.datacenter Datacenter name

## @param cluster.rack Rack name

## @param cluster.endpointSnitch Endpoint Snitch

## @param cluster.clientEncryption Client Encryption

## @param cluster.extraSeeds For an external/second cassandra ring.

## @param cluster.enableUDF Enable User defined functions

##

dynamicSeedDiscovery:

## @param dynamicSeedDiscovery.enabled Enable dynamic-seed-discovery init container

##

enabled: false

## @param dynamicSeedDiscovery.image.registry [default: REGISTRY_NAME] Init container dynamic-seed-discovery image registry

## @param dynamicSeedDiscovery.image.repository [default: REPOSITORY_NAME/alpine] Init container dynamic-seed-discovery image repository

## @skip dynamicSeedDiscovery.image.tag Init container dynamic-seed-discovery image tag (immutable tags are recommended)

## @param dynamicSeedDiscovery.image.digest Init container dynamic-seed-discovery image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

## @param dynamicSeedDiscovery.image.pullPolicy Init container dynamic-seed-discovery pull policy

## @param dynamicSeedDiscovery.image.pullSecrets Specify docker-registry secret names as an array

##

image:

registry: cgr.dev

repository: chainguard-private/os-shell-cassandra-iamguarded

tag: 1.0.0

digest: ""

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

## Secrets must be manually created in the namespace.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

## e.g:

## pullSecrets:

## - myRegistryKeySecretName

##

pullSecrets: []

cluster:

name: cassandra

seedCount: 1

numTokens: 256

datacenter: dc1

rack: rack1

endpointSnitch: SimpleSnitch

clientEncryption: false

## eg:

## extraSeeds:

## - hostname/IP

## - hostname/IP

##

extraSeeds: []

enableUDF: false

## JVM Settings

## @param jvm.extraOpts Set the value for Java Virtual Machine extra options

## @param jvm.maxHeapSize Set Java Virtual Machine maximum heap size (MAX_HEAP_SIZE). Calculated automatically if `nil`

## @param jvm.newHeapSize Set Java Virtual Machine new heap size (HEAP_NEWSIZE). Calculated automatically if `nil`

##

jvm:

extraOpts: ""

## Memory settings: These are calculated automatically unless specified otherwise

## To run on environments with little resources (<= 8GB), tune your heap settings:

## - calculate 1/2 ram and cap to 1024MB

## - calculate 1/4 ram and cap to 8192MB

## - pick the max

##

maxHeapSize: ""

## newHeapSize:

## A good guideline is 100 MB per CPU core.

## - min(100 * num_cores, 1/4 * heap size)

## ref: https://docs.datastax.com/en/archived/cassandra/2.0/cassandra/operations/ops_tune_jvm_c.html

##

newHeapSize: ""

## @param command Command for running the container (set to default if not set). Use array form

##

command: []

## @param args Args for running the container (set to default if not set). Use array form

##

args: []

## @param extraEnvVars Extra environment variables to be set on cassandra container

## For example:

## - name: FOO

## value: BAR

##

extraEnvVars: []

## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars

##

extraEnvVarsCM: ""

## @param extraEnvVarsSecret Name of existing Secret containing extra env vars

##

extraEnvVarsSecret: ""

## @section Statefulset parameters

##

## @param replicaCount Number of Cassandra replicas

##

replicaCount: 1

## @param updateStrategy.type updateStrategy for Cassandra statefulset

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies

##

updateStrategy:

type: RollingUpdate

## @param automountServiceAccountToken Mount Service Account token in pod

##

automountServiceAccountToken: false

## @param hostAliases Add deployment host aliases

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

##

hostAliases: []

## @param podManagementPolicy StatefulSet pod management policy

##

podManagementPolicy: OrderedReady

## @param priorityClassName Cassandra pods' priority.

## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

##

priorityClassName: ""

## @param podAnnotations Additional pod annotations

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

##

podAnnotations: {}

## @param podLabels Additional pod labels

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

##

podLabels: {}

## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

##

podAffinityPreset: ""

## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

##

podAntiAffinityPreset: soft

## Node affinity preset

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

##

nodeAffinityPreset:

## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

##

type: ""

## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set

##

key: ""

## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set

## E.g.

## values:

## - e2e-az1

## - e2e-az2

##

values: []

## @param affinity Affinity for pod assignment

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

## NOTE: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set

##

affinity: {}

## @param nodeSelector Node labels for pod assignment

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

##

nodeSelector: {}

## @param tolerations Tolerations for pod assignment

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

##

tolerations: []

## @param topologySpreadConstraints Topology Spread Constraints for pod assignment

## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

## The value is evaluated as a template

##

topologySpreadConstraints: []

## Pod security context

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

## @param podSecurityContext.enabled Enabled Cassandra pods' Security Context

## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface

## @param podSecurityContext.supplementalGroups Set filesystem extra groups

## @param podSecurityContext.fsGroup Set Cassandra pod's Security Context fsGroup

##

podSecurityContext:

enabled: true

fsGroupChangePolicy: Always

sysctls: []

supplementalGroups: []

fsGroup: 1001

## Configure Container Security Context (only main container)

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

## @param containerSecurityContext.enabled Enabled Cassandra containers' Security Context

## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

## @param containerSecurityContext.runAsUser Set Cassandra containers' Security Context runAsUser

## @param containerSecurityContext.runAsGroup Set Cassandra containers' Security Context runAsGroup

## @param containerSecurityContext.allowPrivilegeEscalation Set Cassandra containers' Security Context allowPrivilegeEscalation

## @param containerSecurityContext.capabilities.drop Set Cassandra containers' Security Context capabilities to be dropped

## @param containerSecurityContext.readOnlyRootFilesystem Set Cassandra containers' Security Context readOnlyRootFilesystem

## @param containerSecurityContext.runAsNonRoot Set Cassandra containers' Security Context runAsNonRoot

## @param containerSecurityContext.privileged Set container's Security Context privileged

## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile

##

containerSecurityContext:

enabled: true

seLinuxOptions: {}

runAsUser: 1001

runAsGroup: 1001

runAsNonRoot: true

privileged: false

allowPrivilegeEscalation: false

capabilities:

drop: ["ALL"]

seccompProfile:

type: "RuntimeDefault"

readOnlyRootFilesystem: true

## Cassandra pods' resource requests and limits

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

## Minimum memory for development is 4GB and 2 CPU cores

## Minimum memory for production is 8GB and 4 CPU cores

## ref: http://docs.datastax.com/en/archived/cassandra/2.0/cassandra/architecture/architecturePlanningHardware_c.html

##

## We usually recommend not to specify default resources and to leave this as a conscious

## choice for the user. This also increases chances charts run on environments with little

## resources, such as Minikube. If you do want to specify resources, uncomment the following

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).

##

resourcesPreset: "large"

## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

## Example:

## resources:

## requests:

## cpu: 2

## memory: 512Mi

## limits:

## cpu: 3

## memory: 1024Mi

##

resources: {}

## Configure extra options for Cassandra containers' liveness and readiness probes

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes

## @param livenessProbe.enabled Enable livenessProbe

## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

## @param livenessProbe.periodSeconds Period seconds for livenessProbe

## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

## @param livenessProbe.failureThreshold Failure threshold for livenessProbe

## @param livenessProbe.successThreshold Success threshold for livenessProbe

##

livenessProbe:

enabled: true

initialDelaySeconds: 60

periodSeconds: 30

timeoutSeconds: 30

successThreshold: 1

failureThreshold: 5

## @param readinessProbe.enabled Enable readinessProbe

## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

## @param readinessProbe.periodSeconds Period seconds for readinessProbe

## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

## @param readinessProbe.failureThreshold Failure threshold for readinessProbe

## @param readinessProbe.successThreshold Success threshold for readinessProbe

##

readinessProbe:

enabled: true

initialDelaySeconds: 60

periodSeconds: 10

timeoutSeconds: 30

successThreshold: 1

failureThreshold: 5

## Configure extra options for startup probe

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes

## @param startupProbe.enabled Enable startupProbe

## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

## @param startupProbe.periodSeconds Period seconds for startupProbe

## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe

## @param startupProbe.failureThreshold Failure threshold for startupProbe

## @param startupProbe.successThreshold Success threshold for startupProbe

##

startupProbe:

enabled: false

initialDelaySeconds: 0

periodSeconds: 10

timeoutSeconds: 5

successThreshold: 1

failureThreshold: 60

## @param customLivenessProbe Custom livenessProbe that overrides the default one

##

customLivenessProbe: {}

## @param customReadinessProbe Custom readinessProbe that overrides the default one

##

customReadinessProbe: {}

## @param customStartupProbe [object] Override default startup probe

##

customStartupProbe: {}

## @param lifecycleHooks [object] Override default etcd container hooks

##

lifecycleHooks: {}

## @param schedulerName Alternative scheduler

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

##

schedulerName: ""

## @param terminationGracePeriodSeconds In seconds, time the given to the Cassandra pod needs to terminate gracefully

## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods

##

terminationGracePeriodSeconds: ""

## @param extraVolumes Optionally specify extra list of additional volumes for cassandra container

##

extraVolumes: []

## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for cassandra container

##

extraVolumeMounts: []

## @param initContainers Add additional init containers to the cassandra pods

##

initContainers: []

## @param sidecars Add additional sidecar containers to the cassandra pods

##

sidecars: []

## Cassandra Pod Disruption Budget configuration

## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

##

pdb:

## @param pdb.create Enable/disable a Pod Disruption Budget creation

##

create: true

## @param pdb.minAvailable Mininimum number of pods that must still be available after the eviction

##

minAvailable: ""

## @param pdb.maxUnavailable Max number of pods that can be unavailable after the eviction

##

maxUnavailable: ""

## @param hostNetwork Enable HOST Network

## If hostNetwork true -> dnsPolicy is set to ClusterFirstWithHostNet

##

hostNetwork: false

## Cassandra container ports to open

## If hostNetwork true: the hostPort is set identical to the containerPort

## @param containerPorts.intra Intra Port on the Host and Container

## @param containerPorts.tls TLS Port on the Host and Container

## @param containerPorts.jmx JMX Port on the Host and Container

## @param containerPorts.cql CQL Port on the Host and Container

##

containerPorts:

intra: 7000

tls: 7001

jmx: 7199

cql: 9042

## Cassandra ports to be exposed as hostPort

## If hostNetwork is false, only the ports specified here will be exposed (or not if set to an empty string)

## @param hostPorts.intra Intra Port on the Host

## @param hostPorts.tls TLS Port on the Host

## @param hostPorts.jmx JMX Port on the Host

## @param hostPorts.cql CQL Port on the Host

##

hostPorts:

intra: ""

tls: ""

jmx: ""

cql: ""

## @section RBAC parameters

##

## Cassandra pods ServiceAccount

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

##

serviceAccount:

## @param serviceAccount.create Enable the creation of a ServiceAccount for Cassandra pods

##

create: true

## @param serviceAccount.name The name of the ServiceAccount to use.

## If not set and create is true, a name is generated using the cassandra.fullname template

##

name: ""

## @param serviceAccount.annotations Annotations for Cassandra Service Account

##

annotations: {}

## @param serviceAccount.automountServiceAccountToken Automount API credentials for a service account.

##

automountServiceAccountToken: false

## @section Traffic Exposure Parameters

##

## Cassandra service parameters

##

service:

## @param service.type Cassandra service type

##

type: ClusterIP

## @param service.ports.cql Cassandra service CQL Port

## @param service.ports.metrics Cassandra service metrics port

##

ports:

cql: 9042

metrics: 8080

## Node ports to expose

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport

## @param service.nodePorts.cql Node port for CQL

## @param service.nodePorts.metrics Node port for metrics

##

nodePorts:

cql: ""

metrics: ""

## @param service.extraPorts Extra ports to expose in the service (normally used with the `sidecar` value)

##

extraPorts: []

## @param service.loadBalancerIP LoadBalancerIP if service type is `LoadBalancer`

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer

##

loadBalancerIP: ""

## @param service.loadBalancerSourceRanges Service Load Balancer sources

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

## e.g:

## loadBalancerSourceRanges:

## - 10.10.10.0/24

##

loadBalancerSourceRanges: []

## @param service.clusterIP Service Cluster IP

## e.g.:

## clusterIP: None

##

clusterIP: ""

## @param service.externalTrafficPolicy Service external traffic policy

## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

##

externalTrafficPolicy: Cluster

## @param service.annotations Provide any additional annotations which may be required.

## This can be used to set the LoadBalancer service type to internal only.

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer

##

annotations: {}

## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"

## If "ClientIP", consecutive client requests will be directed to the same Pod

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

##

sessionAffinity: None

## @param service.sessionAffinityConfig Additional settings for the sessionAffinity

## sessionAffinityConfig:

## clientIP:

## timeoutSeconds: 300

##

sessionAffinityConfig: {}

## Headless service properties

##

headless:

## @param service.headless.annotations Annotations for the headless service.

##

annotations: {}

## Network Policies

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

##

networkPolicy:

## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created

##

enabled: true

## @param networkPolicy.allowExternal Don't require server label for connections

## The Policy model to apply. When set to false, only pods with the correct

## server label will have network access to the ports server is listening

## on. When true, server will accept connections from any source

## (with the correct destination port).

##

allowExternal: true

## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.

##

allowExternalEgress: true

## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

## e.g:

## extraIngress:

## - ports:

## - port: 1234

## from:

## - podSelector:

## - matchLabels:

## - role: frontend

## - podSelector:

## - matchExpressions:

## - key: role

## operator: In

## values:

## - frontend

extraIngress: []

## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy (ignored if allowExternalEgress=true)

## e.g:

## extraEgress:

## - ports:

## - port: 1234

## to:

## - podSelector:

## - matchLabels:

## - role: frontend

## - podSelector:

## - matchExpressions:

## - key: role

## operator: In

## values:

## - frontend

##

extraEgress: []

## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

##

ingressNSMatchLabels: {}

ingressNSPodMatchLabels: {}

## @section Persistence parameters

##

## Enable persistence using Persistent Volume Claims

## ref: https://kubernetes.io/docs/concepts/storage/persistent-volumes/

##

persistence:

## @param persistence.enabled Enable Cassandra data persistence using PVC, use a Persistent Volume Claim, If false, use emptyDir

##

enabled: true

## @param persistence.existingClaim Name of an existing PVC to use

##

existingClaim: ""

## @param persistence.storageClass PVC Storage Class for Cassandra data volume

## If defined, storageClassName: <storageClass>

## If set to "-", storageClassName: "", which disables dynamic provisioning

## If undefined (the default) or set to null, no storageClassName spec is

## set, choosing the default provisioner. (gp2 on AWS, standard on

## GKE, AWS & OpenStack)

##

storageClass: ""

## @param persistence.commitStorageClass PVC Storage Class for Cassandra Commit Log volume

## Storage class to use with CASSANDRA_COMMITLOG_DIR to reduce the concurrence for writing data and commit logs

## If set to "-", commitStorageClass: "", which disables dynamic provisioning

## If undefined (the default) or set to null, no storageClassName spec is

## set, choosing the default provisioner. (gp2 on AWS, standard on

## GKE, AWS & OpenStack)

##

commitStorageClass: ""

## @param persistence.annotations Persistent Volume Claim annotations

##

annotations: {}

## @param persistence.accessModes Persistent Volume Access Mode

##

accessModes:

- ReadWriteOnce

## @param persistence.size PVC Storage Request for Cassandra data volume

##

size: 8Gi

## @param persistence.commitLogsize PVC Storage Request for Cassandra commit log volume. Unset by default

##

commitLogsize: 2Gi

## @param persistence.mountPath The path the data volume will be mounted at

##

mountPath: /iamguarded/cassandra

## @param persistence.commitLogMountPath The path the commit log volume will be mounted at. Unset by default. Set it to '/iamguarded/cassandra/commitlog' to enable a separate commit log volume

##

# commitLogMountPath: /iamguarded/cassandra/commitlog

commitLogMountPath: ""

## @section Volume Permissions parameters

##

## Init containers parameters:

## volumePermissions: Change the owner and group of the persistent volume mountpoint to runAsUser:fsGroup values from the securityContext section.

##

volumePermissions:

## @param volumePermissions.enabled Enable init container that changes the owner and group of the persistent volume

##

enabled: false

## @param volumePermissions.image.registry [default: REGISTRY_NAME] Init container volume image registry

## @param volumePermissions.image.repository [default: REPOSITORY_NAME/os-shell] Init container volume image repository

## @skip volumePermissions.image.tag Init container volume image tag (immutable tags are recommended)

## @param volumePermissions.image.digest Init container volume image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

## @param volumePermissions.image.pullPolicy Init container volume pull policy

## @param volumePermissions.image.pullSecrets Specify docker-registry secret names as an array

##

image:

registry: cgr.dev

repository: chainguard-private/os-shell-iamguarded

tag: 1.0.0

digest: ""

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

## Secrets must be manually created in the namespace.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

## e.g:

## pullSecrets:

## - myRegistryKeySecretName

##

pullSecrets: []

## Init container' resource requests and limits

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

## We usually recommend not to specify default resources and to leave this as a conscious

## choice for the user. This also increases chances charts run on environments with little

## resources, such as Minikube. If you do want to specify resources, uncomment the following

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

## @param volumePermissions.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if volumePermissions.resources is set (volumePermissions.resources is recommended for production).

##

resourcesPreset: "nano"

## @param volumePermissions.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

## Example:

## resources:

## requests:

## cpu: 2

## memory: 512Mi

## limits:

## cpu: 3

## memory: 1024Mi

##

resources: {}

## Init container Security Context

## Note: the chown of the data folder is done to securityContext.runAsUser

## and not the below volumePermissions.securityContext.runAsUser

## @param volumePermissions.securityContext.seLinuxOptions [object,nullable] Set SELinux options in container

## @param volumePermissions.securityContext.runAsUser User ID for the init container

##

## When runAsUser is set to special value "auto", init container will try to chwon the

## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2`

## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed).

## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with

## pod securityContext.enabled=false and shmVolume.chmod.enabled=false

##

securityContext:

seLinuxOptions: {}

runAsUser: 0

## @section Metrics parameters

##

## Cassandra Prometheus exporter configuration

##

metrics:

## @param metrics.enabled Start a side-car prometheus exporter

##

enabled: false

## Iamguarded Cassandra Exporter image

## @param metrics.image.registry [default: REGISTRY_NAME] Cassandra exporter image registry

## @param metrics.image.repository [default: REPOSITORY_NAME/cassandra-exporter] Cassandra exporter image name

## @skip metrics.image.tag Cassandra exporter image tag

## @param metrics.image.digest Cassandra exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

## @param metrics.image.pullPolicy image pull policy

## @param metrics.image.pullSecrets Specify docker-registry secret names as an array

##

image:

registry: cgr.dev

repository: chainguard-private/jmx-exporter-iamguarded

tag: 1.7.0

digest: ""

pullPolicy: IfNotPresent

## Optionally specify an array of imagePullSecrets.

## Secrets must be manually created in the namespace.

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

## e.g:

## pullSecrets:

## - myRegistryKeySecretName

##

pullSecrets: []

## Cassandra Prometheus exporter resource requests and limits

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

## We usually recommend not to specify default resources and to leave this as a conscious

## choice for the user. This also increases chances charts run on environments with little

## resources, such as Minikube. If you do want to specify resources, uncomment the following

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

## @param metrics.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production).

##

resourcesPreset: "nano"

## @param metrics.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

## Example:

## resources:

## requests:

## cpu: 2

## memory: 512Mi

## limits:

## cpu: 3

## memory: 1024Mi

##

resources: {}

## @param metrics.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

## @param metrics.readinessProbe.periodSeconds Period seconds for readinessProbe

## @param metrics.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

## @param metrics.readinessProbe.failureThreshold Failure threshold for readinessProbe

## @param metrics.readinessProbe.successThreshold Success threshold for readinessProbe

##

readinessProbe:

initialDelaySeconds: 20

periodSeconds: 10

timeoutSeconds: 45

failureThreshold: 3

successThreshold: 1

## @param metrics.extraVolumeMounts Optionally specify extra list of additional volumeMounts for cassandra-exporter container

##

extraVolumeMounts: []

## @param metrics.podAnnotations [object] Metrics exporter pod Annotation and Labels

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

##

podAnnotations:

prometheus.io/scrape: "true"

prometheus.io/port: "8080"

## Prometheus Operator ServiceMonitor configuration

##

serviceMonitor:

## @param metrics.serviceMonitor.enabled If `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`)

##

enabled: false

## @param metrics.serviceMonitor.namespace Namespace in which Prometheus is running

##

namespace: monitoring

## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped.

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

## e.g:

## interval: 10s

##

interval: ""

## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

## e.g:

## scrapeTimeout: 10s

##

scrapeTimeout: ""

## @param metrics.serviceMonitor.selector Prometheus instance selector labels

## e.g:

## selector:

## prometheus: my-prometheus

##

selector: {}

## @param metrics.serviceMonitor.metricRelabelings Specify Metric Relabelings to add to the scrape endpoint

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig

##

metricRelabelings: []

## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig

##

relabelings: []

## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint

##

honorLabels: false

## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus.

##

jobLabel: ""

## @param metrics.serviceMonitor.labels Used to pass Labels that are required by the installed Prometheus Operator

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec

##

labels: {}

## Metrics container ports to open

## If hostNetwork true: the hostPort is set identical to the containerPort

## @param metrics.containerPorts.http HTTP Port on the Host and Container

## @param metrics.containerPorts.jmx JMX Port on the Host and Container

##

containerPorts:

http: 8080

jmx: 5555

## Metrics ports to be exposed as hostPort

## If hostNetwork is false, only the ports specified here will be exposed (or not if set to an empty string)

## @param metrics.hostPorts.http HTTP Port on the Host

## @param metrics.hostPorts.jmx JMX Port on the Host

##

hostPorts:

http: ""

jmx: ""

## @param metrics.configuration [string] Configure Cassandra-exporter with a custom config.yml file

## ref: https://github.com/criteo/cassandra_exporter/blob/master/config.yml

##

configuration: |

host: localhost:{{ .Values.containerPorts.jmx }}

ssl: False

user:

password:

listenPort: {{ .Values.metrics.containerPorts.http }}

blacklist:

# To profile the duration of jmx call you can start the program with the following options

# > java -Dorg.slf4j.simpleLogger.defaultLogLevel=trace -jar cassandra_exporter.jar config.yml --oneshot

#

# To get intuition of what is done by cassandra when something is called you can look in cassandra

# https://github.com/apache/cassandra/tree/trunk/src/java/org/apache/cassandra/metrics

# Please avoid to scrape frequently those calls that are iterating over all sstables

# Unaccessible metrics (not enough privilege)

- java:lang:memorypool:.*usagethreshold.*

# Leaf attributes not interesting for us but that are presents in many path

- .*:999thpercentile

- .*:95thpercentile

- .*:fifteenminuterate

- .*:fiveminuterate

- .*:durationunit

- .*:rateunit

- .*:stddev

- .*:meanrate

- .*:mean

- .*:min

# Path present in many metrics but uninterresting

- .*:viewlockacquiretime:.*

- .*:viewreadtime:.*

- .*:cas[a-z]+latency:.*

- .*:colupdatetimedeltahistogram:.*

# Mostly for RPC, do not scrap them

- org:apache:cassandra:db:.*

# columnfamily is an alias for Table metrics

# https://github.com/apache/cassandra/blob/8b3a60b9a7dbefeecc06bace617279612ec7092d/src/java/org/apache/cassandra/metrics/TableMetrics.java#L162

- org:apache:cassandra:metrics:columnfamily:.*

# Should we export metrics for system keyspaces/tables ?

- org:apache:cassandra:metrics:[^:]+:system[^:]*:.*

# Don't scrap us

- com:criteo:nosql:cassandra:exporter:.*

maxScrapFrequencyInSec:

50:

- .*

# Refresh those metrics only every hour as it is costly for cassandra to retrieve them

3600:

- .*:snapshotssize:.*

- .*:estimated.*

- .*:totaldiskspaceused:.*

## @section TLS/SSL parameters

##

## TLS/SSL parameters

## @param tls.internodeEncryption Set internode encryption

## @param tls.clientEncryption Set client-server encryption

## @param tls.autoGenerated Generate automatically self-signed TLS certificates. Currently only supports PEM certificates

## @param tls.existingSecret Existing secret that contains Cassandra Keystore and truststore

## @param tls.passwordsSecret Secret containing the Keystore and Truststore passwords if needed

## @param tls.keystorePassword Password for the keystore, if needed.

## @param tls.truststorePassword Password for the truststore, if needed.

## @param tls.resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if tls.resources is set (tls.resources is recommended for production).

## @param tls.resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

## @param tls.certificatesSecret Secret with the TLS certificates.

## @param tls.tlsEncryptionSecretName Secret with the encryption of the TLS certificates

##

tls:

internodeEncryption: none

clientEncryption: false

autoGenerated: false

existingSecret: ""

passwordsSecret: ""

keystorePassword: ""

truststorePassword: ""

certificatesSecret: ""

tlsEncryptionSecretName: ""

resourcesPreset: "nano"

## We usually recommend not to specify default resources and to leave this as a conscious

## choice for the user. This also increases chances charts run on environments with little

## resources, such as Minikube. If you do want to specify resources, uncomment the following

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

## Example:

## resources:

## requests:

## cpu: 2

## memory: 512Mi

## limits:

## cpu: 3

## memory: 1024Mi

resources: {}