fluent-bit

Helm chart

iamguarded

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

# This file has been modified by Chainguard, Inc.

# Chainguard, Inc. modifications are subject to the license

# available at: https://www.chainguard.dev/legal/software-license-agreement

# SPDX-License-Identifier: APACHE-2.0

## @section Global parameters

## Global Docker image parameters

## Please, note that this will override the image parameters, including dependencies, configured to use the global value

## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass

## @param global.imageRegistry Global Docker image registry

## @param global.imagePullSecrets Global Docker registry secret names as an array

## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)

## @param global.storageClass DEPRECATED: use global.defaultStorageClass instead

global:

imageRegistry: ""

## E.g.

## imagePullSecrets:

## - myRegistryKeySecretName

imagePullSecrets: []

defaultStorageClass: ""

storageClass: ""

## Security parameters

security:

## @param global.security.allowInsecureImages Allows skipping image verification

allowInsecureImages: false

## Compatibility adaptations for Kubernetes platforms

compatibility:

## Compatibility adaptations for Openshift

openshift:

## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)

adaptSecurityContext: auto

org: ""

## @section Common parameters

## @param apiVersions Override Kubernetes API versions reported by .Capabilities

apiVersions: []

## @param nameOverride String to partially override common.names.fullname

nameOverride: ""

## @param fullnameOverride String to fully override common.names.fullname

fullnameOverride: ""

## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)

kubeVersion: ""

## @param commonLabels Labels to add to all deployed objects (sub-charts are not considered)

commonLabels: {}

## @param commonAnnotations Annotations to add to all deployed objects

commonAnnotations: {}

## Enable diagnostic mode in the deployment

diagnosticMode:

## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)

enabled: false

## @param diagnosticMode.command Command to override all containers in the deployment

command:

- sleep

## @param diagnosticMode.args Args to override all containers in the deployment

args:

- infinity

## @section Fluent Bit parameters

## Iamguarded Fluent Bit image

## @param image.registry [default: REGISTRY_NAME] Fluent Bit image registry

## @param image.repository [default: REPOSITORY_NAME/fluent-bit] Fluent Bit image repository

## @skip image.tag Fluent Bit image tag (immutable tags are recommended)

## @param image.digest Fluent Bit image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag

## @param image.pullPolicy image pull policy

## @param image.pullSecrets Fluent Bit image pull secrets

## @param image.debug Enable image debug mode

image:

registry: cgr.dev

repository: chainguard-private/fluent-bit-iamguarded

tag: 5.0.9

digest: ""

## Specify a imagePullPolicy

## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images

100

pullPolicy: IfNotPresent

101

## Optionally specify an array of imagePullSecrets.

102

## Secrets must be manually created in the namespace.

103

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

104

## e.g:

105

## pullSecrets:

106

## - myRegistryKeySecretName

107

108

pullSecrets: []

109

## Enable debug mode

110

111

debug: false

112

## @section Fluent Bit daemonset configuration

113

## Running as daemonset eases kubernetes pod monitoring and ensures its integrity

114

## If daemonset is enabled, Fluent Bit deployment will be disabled

115

116

daemonset:

117

## @param daemonset.enabled Use a daemonset instead of a deployment. `replicaCount` will not take effect.

118

119

enabled: false

120

## Pod security context

121

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

122

## @param daemonset.podSecurityContext.enabled Enable security context for daemonset pods

123

## @param daemonset.podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

124

## @param daemonset.podSecurityContext.sysctls Set kernel settings using the sysctl interface

125

## @param daemonset.podSecurityContext.supplementalGroups Set filesystem extra groups

126

## @param daemonset.podSecurityContext.fsGroup Group ID for daemonset containers filesystem

127

128

podSecurityContext:

129

enabled: true

130

fsGroupChangePolicy: Always

131

sysctls: []

132

supplementalGroups: []

133

fsGroup: 0

134

## Pod host paths

135

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

136

## @param daemonset.hostPaths.logs Path to the node logs dir

137

## @param daemonset.hostPaths.containerLogs Path to the container logs dir

138

## @param daemonset.hostPaths.machineId Path to the machine-id file

139

140

hostPaths:

141

logs: /var/log

142

containerLogs: /var/lib/docker/containers

143

machineId: /etc/machine-id

144

## @param hostNetwork Enable HOST Network

145

## If hostNetwork true -> dnsPolicy is set to ClusterFirstWithHostNet

146

147

hostNetwork: false

148

## @param command Command for running the container (set to default if not set). Use array form

149

150

command: []

151

## @param args Args for running the container (set to default if not set). Use array form

152

153

args: []

154

## @param lifecycleHooks [object] Override default etcd container hooks

155

156

lifecycleHooks: {}

157

## @param extraEnvVars Extra environment variables to be set on fluent-bit container

158

## For example:

159

## - name: FOO

160

## value: BAR

161

162

extraEnvVars: []

163

## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars

164

165

extraEnvVarsCM: ""

166

## @param extraEnvVarsSecret Name of existing Secret containing extra env vars

167

168

extraEnvVarsSecret: ""

169

## @param existingConfigMap Name of an existing ConfigMap with the Fluent Bit config file

170

171

existingConfigMap: ""

172

## @param automountServiceAccountToken Mount Service Account token in pod

173

174

automountServiceAccountToken: true

175

## @param hostAliases Deployment pod host aliases

176

## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/

177

178

hostAliases: []

179

## @param replicaCount Number of Fluent Bit replicas

180

181

replicaCount: 1

182

## Configure extra options for container's liveness, readiness and startup probes

183

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes

184

## @param livenessProbe.enabled Enable livenessProbe on nodes

185

## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe

186

## @param livenessProbe.periodSeconds Period seconds for livenessProbe

187

## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe

188

## @param livenessProbe.failureThreshold Failure threshold for livenessProbe

189

## @param livenessProbe.successThreshold Success threshold for livenessProbe

190

191

livenessProbe:

192

enabled: true

193

failureThreshold: 3

194

initialDelaySeconds: 10

195

periodSeconds: 10

196

successThreshold: 1

197

timeoutSeconds: 1

198

## @param startupProbe.enabled Enable startupProbe on containers

199

## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe

200

## @param startupProbe.periodSeconds Period seconds for startupProbe

201

## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe

202

## @param startupProbe.failureThreshold Failure threshold for startupProbe

203

## @param startupProbe.successThreshold Success threshold for startupProbe

204

205

startupProbe:

206

enabled: true

207

initialDelaySeconds: 10

208

periodSeconds: 10

209

timeoutSeconds: 1

210

failureThreshold: 15

211

successThreshold: 1

212

## @param readinessProbe.enabled Enable readinessProbe

213

## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe

214

## @param readinessProbe.periodSeconds Period seconds for readinessProbe

215

## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe

216

## @param readinessProbe.failureThreshold Failure threshold for readinessProbe

217

## @param readinessProbe.successThreshold Success threshold for readinessProbe

218

219

readinessProbe:

220

enabled: true

221

initialDelaySeconds: 10

222

periodSeconds: 10

223

timeoutSeconds: 1

224

failureThreshold: 15

225

successThreshold: 1

226

## @param customLivenessProbe Custom livenessProbe that overrides the default one

227

228

customLivenessProbe: {}

229

## @param customStartupProbe [object] Override default startup probe

230

231

customStartupProbe: {}

232

## @param customReadinessProbe [object] Override default readiness probe

233

234

customReadinessProbe: {}

235

## Fluent Bit pods' resource requests and limits

236

## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/

237

## Minimum memory for development is 4GB and 2 CPU cores

238

## Minimum memory for production is 8GB and 4 CPU cores

239

## ref: http://docs.datastax.com/en/archived/fluent-bit/2.0/fluent-bit/architecture/architecturePlanningHardware_c.html

240

241

## We usually recommend not to specify default resources and to leave this as a conscious

242

## choice for the user. This also increases chances charts run on environments with little

243

## resources, such as Minikube. If you do want to specify resources, uncomment the following

244

## lines, adjust them as necessary, and remove the curly braces after 'resources:'.

245

## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).

246

247

resourcesPreset: "nano"

248

## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)

249

## Example:

250

## resources:

251

## requests:

252

## cpu: 2

253

## memory: 512Mi

254

## limits:

255

## cpu: 3

256

## memory: 1024Mi

257

258

resources: {}

259

## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for fluent-bit container

260

261

extraVolumeMounts: []

262

## Container ports to expose

263

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport

264

containerPorts:

265

## @param containerPorts.http Port for HTTP port

266

267

http: 2020

268

## @param extraContainerPorts Optionally specify extra list of additional ports for fluent-bit containers

269

## e.g:

270

## extraContainerPorts:

271

## - name: forward

272

## containerPort: 24224

273

274

extraContainerPorts: []

275

## Fluent Bit service parameters

276

277

service:

278

## @param service.type Fluent Bit service type

279

280

type: ClusterIP

281

## Ports to expose

282

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport

283

ports:

284

## @param service.ports.http Port for HTTP port

285

286

http: 2020

287

## Node ports to expose

288

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport

289

nodePorts:

290

## @param service.nodePorts.http Node port for HTTP port

291

292

http: ""

293

## @param service.extraPorts Extra ports to expose in the service (normally used with the `sidecar` value)

294

295

extraPorts: []

296

## @param service.loadBalancerIP LoadBalancerIP if service type is `LoadBalancer`

297

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer

298

299

loadBalancerIP: ""

300

## @param service.loadBalancerSourceRanges Service Load Balancer sources

301

## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service

302

## e.g:

303

## loadBalancerSourceRanges:

304

## - 10.10.10.0/24

305

306

loadBalancerSourceRanges: []

307

## @param service.clusterIP Service Cluster IP

308

## e.g.:

309

## clusterIP: None

310

311

clusterIP: ""

312

## @param service.externalTrafficPolicy Service external traffic policy

313

## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

314

315

externalTrafficPolicy: Cluster

316

## @param service.annotations Provide any additional annotations which may be required.

317

## This can be used to set the LoadBalancer service type to internal only.

318

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer

319

320

annotations: {}

321

## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"

322

## If "ClientIP", consecutive client requests will be directed to the same Pod

323

## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

324

325

sessionAffinity: None

326

## @param service.sessionAffinityConfig Additional settings for the sessionAffinity

327

## sessionAffinityConfig:

328

## clientIP:

329

## timeoutSeconds: 300

330

331

sessionAffinityConfig: {}

332

## Network Policies

333

## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/

334

335

networkPolicy:

336

## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created

337

338

enabled: true

339

## @param networkPolicy.allowExternal Don't require server label for connections

340

## The Policy model to apply. When set to false, only pods with the correct

341

## server label will have network access to the ports server is listening

342

## on. When true, server will accept connections from any source

343

## (with the correct destination port).

344

345

allowExternal: true

346

## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.

347

348

allowExternalEgress: true

349

## @param networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)

350

351

kubeAPIServerPorts: [443, 6443, 8443]

352

## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy

353

## e.g:

354

## extraIngress:

355

## - ports:

356

## - port: 1234

357

## from:

358

## - podSelector:

359

## - matchLabels:

360

## - role: frontend

361

## - podSelector:

362

## - matchExpressions:

363

## - key: role

364

## operator: In

365

## values:

366

## - frontend

367

extraIngress: []

368

## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy

369

## e.g:

370

## extraEgress:

371

## - ports:

372

## - port: 1234

373

## to:

374

## - podSelector:

375

## - matchLabels:

376

## - role: frontend

377

## - podSelector:

378

## - matchExpressions:

379

## - key: role

380

## operator: In

381

## values:

382

## - frontend

383

384

extraEgress: []

385

## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces

386

## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces

387

388

ingressNSMatchLabels: {}

389

ingressNSPodMatchLabels: {}

390

## Fluent Bit serviceAccount parameters

391

392

serviceAccount:

393

## @param serviceAccount.create Enables ServiceAccount

394

395

create: true

396

## @param serviceAccount.name ServiceAccount name

397

398

name: ""

399

## @param serviceAccount.annotations Annotations to add to all deployed objects

400

401

annotations: {}

402

## @param serviceAccount.automountServiceAccountToken Automount API credentials for a service account.

403

404

automountServiceAccountToken: false

405

## Pod security context

406

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod

407

## @param podSecurityContext.enabled Enabled Fluent Bit pods' Security Context

408

## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy

409

## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface

410

## @param podSecurityContext.supplementalGroups Set filesystem extra groups

411

## @param podSecurityContext.fsGroup Set Fluent Bit pod's Security Context fsGroup

412

413

podSecurityContext:

414

enabled: true

415

fsGroupChangePolicy: Always

416

sysctls: []

417

supplementalGroups: []

418

fsGroup: 1001

419

## Configure Container Security Context (only main container)

420

## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

421

## @param containerSecurityContext.enabled Enabled Fluent Bit containers' Security Context

422

## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container

423

## @param containerSecurityContext.runAsUser Set Fluent Bit containers' Security Context runAsUser

424

## @param containerSecurityContext.runAsGroup Set Fluent Bit containers' Security Context runAsGroup

425

## @param containerSecurityContext.runAsNonRoot Set Fluent Bit container's Security Context runAsNonRoot

426

## @param containerSecurityContext.readOnlyRootFilesystem Set Fluent Bit container's Security Context runAsNonRoot

427

## @param containerSecurityContext.privileged Set primary container's Security Context privileged

428

## @param containerSecurityContext.allowPrivilegeEscalation Set primary container's Security Context allowPrivilegeEscalation

429

## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped

430

## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile

431

432

containerSecurityContext:

433

enabled: true

434

seLinuxOptions: {}

435

runAsUser: 1001

436

runAsGroup: 1001

437

runAsNonRoot: true

438

privileged: false

439

allowPrivilegeEscalation: false

440

readOnlyRootFilesystem: true

441

capabilities:

442

drop: ["ALL"]

443

seccompProfile:

444

type: "RuntimeDefault"

445

## @param podAnnotations Additional pod annotations

446

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/

447

448

podAnnotations: {}

449

## @param podLabels Additional pod labels

450

## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

451

452

podLabels: {}

453

## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

454

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

455

456

podAffinityPreset: ""

457

## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

458

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity

459

460

podAntiAffinityPreset: soft

461

## Node affinity preset

462

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity

463

464

nodeAffinityPreset:

465

## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`

466

467

type: ""

468

## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set

469

470

key: ""

471

## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set

472

## E.g.

473

## values:

474

## - e2e-az1

475

## - e2e-az2

476

477

values: []

478

## @param priorityClassName Server priorityClassName

479

## Ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/

480

481

priorityClassName: ""

482

## @param affinity Affinity for pod assignment

483

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

484

## NOTE: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set

485

486

affinity: {}

487

## @param nodeSelector Node labels for pod assignment

488

## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

489

490

nodeSelector: {}

491

## @param tolerations Tolerations for pod assignment

492

## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

493

494

tolerations: []

495

## @param topologySpreadConstraints Topology Spread Constraints for pod assignment

496

## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

497

## The value is evaluated as a template

498

499

topologySpreadConstraints: []

500

## @param schedulerName Alternative scheduler

501

## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/

502

503

schedulerName: ""

504

## @param updateStrategy.type Fluent Bit deployment strategy type

505

## @param updateStrategy.rollingUpdate Fluent Bit deployment rolling update configuration parameters

506

## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy

507

508

updateStrategy:

509

type: RollingUpdate

510

rollingUpdate: {}

511

## @param extraVolumes Optionally specify extra list of additional volumes for fluent-bit container

512

513

extraVolumes: []

514

## @param initContainers Add additional init containers to the fluent-bit pods

515

516

initContainers: []

517

## @param sidecars Add additional sidecar containers to the fluent-bit pods

518

519

sidecars: []

520

## @section Fluent Bit configuration

521

522

config:

523

## @param config.flush Interval to flush output (seconds)

524

525

flush: 1

526

## @param config.logLevel Diagnostic level (error/warning/info/debug/trace)

527

528

logLevel: info

529

## @param config.service [string] Defines the global behaviour of the Fluent Bit engine.

530

531

service: |

532

[SERVICE]

533

Flush {{ .Values.config.flush }}

534

Daemon Off

535

Log_Level {{ .Values.config.logLevel }}

536

Config_Watch On

537

HTTP_Server On

538

HTTP_Listen 0.0.0.0

539

HTTP_Port {{ .Values.containerPorts.http }}

540

Parsers_File /opt/iamguarded/fluent-bit/conf/parsers.conf

541

Parsers_File /opt/iamguarded/fluent-bit/conf/custom_parsers.conf

542

## @param config.inputs [string] Defines the source from where Fluent Bit can collect data

543

## https://docs.fluentbit.io/manual/pipeline/inputs

544

545

inputs: |

546

[INPUT]

547

Name cpu

548

## @param config.filters [string] Set of plugins that can be used to filter, modify, or enrich log data that is processed by Fluent Bit.

549

## https://docs.fluentbit.io/manual/pipeline/filters

550

## Example:

551

## filters: |

552

## [FILTER]

553

## Name kubernetes

554

## Match kube.*

555

## Merge_Log On

556

## Keep_Log Off

557

## K8S-Logging.Parser On

558

## K8S-Logging.Exclude On

559

560

filters: ""

561

## @param config.outputs [string] Outputs to send the collected data to different destinations

562

## https://docs.fluentbit.io/manual/pipeline/outputs

563

564

outputs: |

565

[OUTPUT]

566

Name stdout

567

Match *

568

## @param config.upstream This configuration is deprecated, please use `extraFiles` instead.

569

## https://docs.fluentbit.io/manual/administration/configuring-fluent-bit/classic-mode/upstream-servers

570

571

upstream: {}

572

## @param config.customParsers [string] Custom parsers

573

## https://docs.fluentbit.io/manual/pipeline/parsers

574

575

customParsers: |

576

[PARSER]

577

Name docker_no_time

578

Format json

579

Time_Keep Off

580

Time_Key time

581

Time_Format %Y-%m-%dT%H:%M:%S.%L

582

## @param config.extraFiles Extra config files

583

## This allows adding more files with arbitary filenames to /fluent-bit/etc by providing key/value pairs.

584

## The key becomes the filename, the value becomes the file content.

585

586

extraFiles: {}

587

## Role Based Access

588

## Ref: https://kubernetes.io/docs/admin/authorization/rbac/

589

## @param rbac.create Create Role and RoleBinding

590

## @param rbac.nodeAccess RBAC node access

591

592

rbac:

593

create: false

594

nodeAccess: false

595

## @param rbac.rules Custom RBAC rules to set

596

## e.g:

597

## rules:

598

## - apiGroups:

599

## - ""

600

## resources:

601

## - pods

602

## verbs:

603

## - get

604

## - list

605

606

rules: []

607

## @section Autoscaling

608

609

autoscaling:

610

vpa:

611

## @param autoscaling.vpa.enabled Enable VPA

612

613

enabled: false

614

## @param autoscaling.vpa.annotations Annotations for VPA resource

615

616

annotations: {}

617

## @param autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory

618

619

controlledResources: []

620

## @param autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod

621

## cpu: 200m

622

## memory: 100Mi

623

maxAllowed: {}

624

## @param autoscaling.vpa.minAllowed VPA Min allowed resources for the pod

625

## cpu: 200m

626

## memory: 100Mi

627

minAllowed: {}

628

## @section VPA update policy

629

630

updatePolicy:

631

## @param autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod

632

## Possible values are "Off", "Initial", "Recreate", and "Auto".

633

634

updateMode: Auto

635

hpa:

636

## @param autoscaling.hpa.annotations Annotations for HPA resource

637

638

annotations: {}

639

## @param autoscaling.hpa.enabled Enable HPA

640

641

enabled: false

642

## @param autoscaling.hpa.minReplicas Min replicas

643

644

minReplicas: 1

645

## @param autoscaling.hpa.maxReplicas Max replicas

646

647

maxReplicas: 3

648

## @param autoscaling.hpa.targetCPUUtilizationPercentage Target CPU utilization percentage

649

650

targetCPUUtilizationPercentage: 75

651

## @param autoscaling.hpa.targetMemoryUtilizationPercentage Target Memory utilization percentage

652

653

targetMemoryUtilizationPercentage: ""

654

## @param autoscaling.hpa.customRules Custom rules

655

656

customRules: []

657

## @param autoscaling.hpa.behavior HPA Behavior

658

659

behavior: {}

660

## Configure the ingress resource that allows you to access the

661

## fluent-bit Console. Set up the URL

662

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/

663

664

ingress:

665

## @param ingress.enabled Enable ingress controller resource for fluentBit Console

666

667

enabled: false

668

## @param ingress.apiVersion Force Ingress API version (automatically detected if not set)

669

670

apiVersion: ""

671

## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)

672

## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster.

673

## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/

674

675

ingressClassName: ""

676

## @param ingress.hostname Default host for the ingress resource

677

678

hostname: fluent-bit.local

679

## @param ingress.path The Path to fluentBit®. You may need to set this to '/*' in order to use this with ALB ingress controllers.

680

681

path: /

682

## @param ingress.pathType Ingress path type

683

684

pathType: ImplementationSpecific

685

## @param ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.

686

## For a full list of possible ingress annotations, please see

687

## ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md

688

## Use this parameter to set the required annotations for cert-manager, see

689

## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations

690

691

## e.g:

692

## annotations:

693

## kubernetes.io/ingress.class: nginx

694

## cert-manager.io/cluster-issuer: cluster-issuer-name

695

696

annotations: {}

697

## @param ingress.tls Enable TLS configuration for the hostname defined at `ingress.hostname` parameter

698

## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`

699

## You can:

700

## - Use the `ingress.secrets` parameter to create this TLS secret

701

## - Rely on cert-manager to create it by setting the corresponding annotations

702

## - Rely on Helm to create self-signed certificates by setting `ingress.selfSigned=true`

703

704

tls: false

705

## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm

706

707

selfSigned: false

708

## @param ingress.extraHosts The list of additional hostnames to be covered with this ingress record.

709

## Most likely the hostname above will be enough, but in the event more hosts are needed, this is an array

710

## e.g:

711

## extraHosts:

712

## - name: fluent-bit.local

713

## path: /

714

715

extraHosts: []

716

## @param ingress.extraPaths Any additional paths that may need to be added to the ingress under the main host

717

## For example: The ALB ingress controller requires a special rule for handling SSL redirection.

718

## extraPaths:

719

## - path: /*

720

## backend:

721

## serviceName: ssl-redirect

722

## servicePort: use-annotation

723

724

extraPaths: []

725

## @param ingress.extraTls The tls configuration for additional hostnames to be covered with this ingress record.

726

## see: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls

727

## e.g:

728

## extraTls:

729

## - hosts:

730

## - fluent-bit.local

731

## secretName: fluent-bit.local-tls

732

733

extraTls: []

734

## @param ingress.secrets If you're providing your own certificates, please use this to add the certificates as secrets

735

## key and certificate are expected in PEM format

736

## name should line up with a secretName set further up

737

738

## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates

739

## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days

740

## It is also possible to create and manage the certificates outside of this helm chart

741

## Please see README.md for more information

742

743

## Example

744

## secrets:

745

## - name: fluent-bit.local-tls

746

## key: ""

747

## certificate: ""

748

749

secrets: []

750

## @param ingress.extraRules Additional rules to be covered with this ingress record

751

## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules

752

## e.g:

753

## extraRules:

754

## - host: example.local

755

## http:

756

## path: /

757

## backend:

758

## service:

759

## name: example-svc

760

## port:

761

## name: http

762

763

extraRules: []

764

## Fluent Bit Pod Disruption Budget

765

## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/

766

## @param pdb.create Deploy a PodDisruptionBudget object for Fluent Bit deployment

767

## @param pdb.minAvailable Minimum available Fluent Bit replicas (expressed in percentage)

768

## @param pdb.maxUnavailable Maximum unavailable Fluent Bit replicas (expressed in percentage)

769

770

pdb:

771

create: true

772

minAvailable: ""

773

maxUnavailable: "50%"

774

## Prometheus metrics

775

776

metrics:

777

## @param metrics.enabled Enable the export of Prometheus metrics

778

779

enabled: false

780

## Prometheus Operator ServiceMonitor configuration

781

782

serviceMonitor:

783

## @param metrics.serviceMonitor.enabled if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`)

784

785

enabled: false

786

## @param metrics.serviceMonitor.namespace Namespace in which Prometheus is running

787

788

namespace: ""

789

## @param metrics.serviceMonitor.annotations [object] Additional custom annotations for the ServiceMonitor

790

791

annotations:

792

prometheus.io/scrape: "true"

793

prometheus.io/port: "{{ .Values.service.ports.http }}"

794

prometheus.io/path: "/metrics"

795

## @param metrics.serviceMonitor.labels Extra labels for the ServiceMonitor

796

797

labels: {}

798

## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in Prometheus

799

800

jobLabel: ""

801

## @param metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels

802

803

honorLabels: false

804

## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped.

805

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

806

## e.g:

807

## interval: 10s

808

809

interval: ""

810

## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended

811

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint

812

## e.g:

813

## scrapeTimeout: 10s

814

815

scrapeTimeout: ""

816

## @param metrics.serviceMonitor.metricRelabelings Specify additional relabeling of metrics

817

818

metricRelabelings: []

819

## @param metrics.serviceMonitor.relabelings Specify general relabeling

820

821

relabelings: []

822

## @param metrics.serviceMonitor.selector Prometheus instance selector labels

823

## selector:

824

## prometheus: my-prometheus

825

826

selector: {}

827

## @param extraDeploy Array of extra objects to deploy with the release

828

829

extraDeploy: []

830

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

fluent-bit

The trusted source for open source

Product

Solutions

Customers

Resources

Company