1# This file has been modified by Chainguard, Inc.
3# Copyright Chainguard, Inc. All Rights Reserved.
4# Chainguard, Inc. modifications are subject to the license
5# available at: https://www.chainguard.dev/legal/software-license-agreement
7# Copyright Broadcom, Inc. All Rights Reserved.
8# SPDX-License-Identifier: APACHE-2.0
10## @section Global parameters
11## Global Docker image parameters
12## Please, note that this will override the image parameters, including dependencies, configured to use the global value
13## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass
15## @param global.imageRegistry Global Docker image registry
16## @param global.imagePullSecrets Global Docker registry secret names as an array
22 ## - myRegistryKeySecretName
25 ## Security parameters
28 ## @param global.security.allowInsecureImages Allows skipping image verification
29 allowInsecureImages: false
30 ## Compatibility adaptations for Kubernetes platforms
33 ## Compatibility adaptations for Openshift
36 ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
38 adaptSecurityContext: auto
40## @section Common parameters
42## @param kubeVersion Override Kubernetes version
45## @param apiVersions Override Kubernetes API versions reported by .Capabilities
48## @param nameOverride String to partially override kubernetes-event-exporter.fullname include (will maintain the release name)
51## @param fullnameOverride String to fully override kubernetes-event-exporter.fullname template
54## @param commonAnnotations Annotations to add to all deployed objects
57## @param commonLabels Labels to add to all deployed objects
60## Enable diagnostic mode in the deployment
63 ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)
66 ## @param diagnosticMode.command Command to override all containers in the deployment
70 ## @param diagnosticMode.args Args to override all containers in the deployment
74## @param extraDeploy Array of extra objects to deploy with the release (evaluated as a template)
77## @section Kubernetes Event Exporter parameters
79## @param replicaCount Desired number of pod replicas
82## @param revisionHistoryLimit Desired number of old ReplicaSets to retain
83## Defaults to 10, if set to 0 old ReplicaSets will be garbage-collected
84revisionHistoryLimit: 10
86## @param containerPorts.http HTTP container port
90## @param extraContainerPorts Optionally specify extra list of additional port-mappings for the container
92extraContainerPorts: []
94 ## @param image.registry [default: REGISTRY_NAME] Container image registry
95 ## @param image.repository [default: REPOSITORY_NAME/kubernetes-event-exporter] Container image name
96 ## @skip image.tag Container image tag
97 ## @param image.digest Container image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
98 ## @param image.pullPolicy Container image pull policy
99 ## @param image.pullSecrets Specify docker-registry secret names as an array
102 repository: chainguard-private/kubernetes-event-exporter-iamguarded
105 ## Specify a imagePullPolicy
106 ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
108 pullPolicy: IfNotPresent
109 ## Optionally specify an array of imagePullSecrets.
110 ## Secrets must be manually created in the namespace.
111 ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
114 ## - myRegistryKeySecretName
117## @param automountServiceAccountToken Mount Service Account token in pod
119automountServiceAccountToken: true
120## @param hostAliases Add deployment host aliases
121## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
124## Kubernetes event exporter configuration, rendered as a template
125## ref: https://github.com/resmoio/kubernetes-event-exporter#configuration
126## @param config.logLevel Verbosity of the logs (options: `fatal`, `error`, `warn`, `info` or `debug`)
127## @param config.logFormat How the logs are formatted. Allowed values: `pretty` or `json`
128## @param config.clusterName The name of the kubernetes cluster that the events are originating from
129## @param config.receivers [array] Array containing event receivers
130## @param config.route.routes [array] Array containing event route configuration
142 ## message: "{{ .Message }}"
143 ## reason: "{{ .Reason }}"
144 ## type: "{{ .Type }}"
145 ## count: "{{ .Count }}"
146 ## kind: "{{ .InvolvedObject.Kind }}"
147 ## name: "{{ .InvolvedObject.Name }}"
148 ## namespace: "{{ .Namespace }}"
149 ## component: "{{ .Source.Component }}"
150 ## host: "{{ .Source.Host }}"
158 ## @param rbac.create Create the RBAC roles for API accessibility
161 ## @param rbac.rules [array] List of rules for the cluster role
166 verbs: ["get", "watch", "list"]
167## Pods Service Account
168## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
169## @param serviceAccount.create Specifies whether a ServiceAccount should be created
170## @param serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template.
171## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account
172## @param serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.
177 automountServiceAccountToken: false
179## @param podAnnotations Pod annotations
180## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
183## @param podLabels Pod labels
184## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
187## SecurityContext holds pod-level security attributes and common container settings.
188## @param podSecurityContext.enabled Enable security context
189## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
190## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface
191## @param podSecurityContext.supplementalGroups Set filesystem extra groups
192## @param podSecurityContext.fsGroup Group ID for the container
196 fsGroupChangePolicy: Always
198 supplementalGroups: []
200## Pod disruption budget
201## @param pdb.create Create a pdb
202## @param pdb.minAvailable Minimum number / percentage of pods that should remain scheduled
203## @param pdb.maxUnavailable Maximum number / percentage of pods that may be made unavailable
209## @param containerSecurityContext.enabled Enabled containers' Security Context
210## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
211## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser
212## @param containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
213## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
214## @param containerSecurityContext.privileged Set container's Security Context privileged
215## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
216## @param containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
217## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped
218## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
220containerSecurityContext:
227 readOnlyRootFilesystem: true
228 allowPrivilegeEscalation: false
232 type: "RuntimeDefault"
233## @param command Override default container command (useful when using custom images)
236## @param args Override default container args (useful when using custom images)
239## @param lifecycleHooks Lifecycle for the container to automate configuration before or after startup
242## Container resource requests and limits
243## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
244## We usually recommend not to specify default resources and to leave this as a conscious
245## choice for the user. This also increases chances charts run on environments with little
246## resources, such as Minikube. If you do want to specify resources, uncomment the following
247## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
248## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).
250resourcesPreset: "nano"
251## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
263## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
266 ## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created
269 ## @param networkPolicy.kubeAPIServerPorts [array] List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security)
271 kubeAPIServerPorts: [443, 6443, 8443]
272 ## @param networkPolicy.allowExternal Don't require server label for connections
273 ## The Policy model to apply. When set to false, only pods with the correct
274 ## server label will have network access to the ports server is listening
275 ## on. When true, server will accept connections from any source
276 ## (with the correct destination port).
279 ## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
281 allowExternalEgress: true
282 ## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy
292 ## - matchExpressions:
298 ## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
308 ## - matchExpressions:
315 ## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
316 ## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
318 ingressNSMatchLabels: {}
319 ingressNSPodMatchLabels: {}
320## Configure extra options for Kubernetes event exporter container's liveness, readiness and startup probes
321## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes
322## @param livenessProbe.enabled Enable livenessProbe on Kubernetes event exporter container
323## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
324## @param livenessProbe.periodSeconds Period seconds for livenessProbe
325## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
326## @param livenessProbe.failureThreshold Failure threshold for livenessProbe
327## @param livenessProbe.successThreshold Success threshold for livenessProbe
331 initialDelaySeconds: 5
336## @param readinessProbe.enabled Enable readinessProbe on Kubernetes event exporter container
337## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
338## @param readinessProbe.periodSeconds Period seconds for readinessProbe
339## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
340## @param readinessProbe.failureThreshold Failure threshold for readinessProbe
341## @param readinessProbe.successThreshold Success threshold for readinessProbe
345 initialDelaySeconds: 5
350## @param startupProbe.enabled Enable startupProbe on Kubernetes event exporter container
351## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
352## @param startupProbe.periodSeconds Period seconds for startupProbe
353## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
354## @param startupProbe.failureThreshold Failure threshold for startupProbe
355## @param startupProbe.successThreshold Success threshold for startupProbe
359 initialDelaySeconds: 40
364## Configure extra custom startup, liveness and readiness probes
365## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
366## @param customStartupProbe Configure startup probe for Kubernetes event exporter pod
368customStartupProbe: {}
369## @param customLivenessProbe Configure liveness probe for Kubernetes event exporter pod
371customLivenessProbe: {}
372## @param customReadinessProbe Configure readiness probe for Kubernetes event exporter pod
374customReadinessProbe: {}
375## @param nodeSelector Node labels for pod assignment
376## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
379## @param priorityClassName Set Priority Class Name to allow priority control over other pods
380## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
383## @param schedulerName Name of the k8s scheduler (other than default)
384## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
387## @param topologySpreadConstraints Topology Spread Constraints for pod assignment
388## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
389## The value is evaluated as a template
391topologySpreadConstraints: []
392## @param tolerations Tolerations for pod assignment
393## Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
396## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
397## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
400## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
401## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
403podAntiAffinityPreset: soft
404## Node affinity preset
405## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
408 ## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
411 ## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set.
413 ## key: "kubernetes.io/e2e-az-name"
416 ## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set.
423## @param affinity Affinity for pod assignment
424## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
425## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set
428## @param updateStrategy.type Deployment strategy type.
429## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
432## type: RollingUpdate
435## maxUnavailable: 25%
439## @param extraEnvVars Array containing extra env vars to be added to all containers
443## value: env_var_value
446## @param extraEnvVarsCM ConfigMap containing extra env vars to be added to all containers
449## @param extraEnvVarsSecret Secret containing extra env vars to be added to all containers
451extraEnvVarsSecret: ""
452## @param extraVolumeMounts Array to add extra mounts (normally used with extraVolumes)
455## @param extraVolumes Array to add extra volumes
458## @param initContainers Attach additional init containers to pods
461## - name: your-image-name
463## imagePullPolicy: Always
466## @param sidecars Add additional sidecar containers to pods
469## - name: your-image-name
471## imagePullPolicy: Always
474## containerPort: 1234
477## Metrics configuration
480 ## @param metrics.enabled Enable exposing statistics
481 ## ref: https://github.com/resmoio/kubernetes-event-exporter/blob/858089f2dc42243c0939a7f13a76fdd22e70be0f/main.go#L25
484 ## metrics service parameters
487 ## @param metrics.service.ports.http Metrics service HTTP port
491 ## @param metrics.service.annotations [object] Annotations for enabling prometheus to access the metrics endpoints
494 prometheus.io/scrape: "true"
495 prometheus.io/port: "{{ .Values.metrics.service.ports.http }}"
496 ## Prometheus Operator ServiceMonitor configuration
499 ## @param metrics.serviceMonitor.enabled Create ServiceMonitor Resource for scraping metrics using PrometheusOperator
502 ## @param metrics.serviceMonitor.port Metrics service HTTP port
505 ## @param metrics.serviceMonitor.endpoints [array] The endpoint configuration of the ServiceMonitor. Path is mandatory. Interval, timeout and labellings can be overwritten.
509 ## @param metrics.serviceMonitor.path Metrics service HTTP path. Deprecated: Use @param metrics.serviceMonitor.endpoints instead
512 ## @param metrics.serviceMonitor.namespace Namespace which Prometheus is running in
515 ## @param metrics.serviceMonitor.interval Interval at which metrics should be scraped
518 ## @param metrics.serviceMonitor.scrapeTimeout Specify the timeout after which the scrape is ended
520 ## scrapeTimeout: 30s
523 ## @param metrics.serviceMonitor.labels Additional labels that can be used so ServiceMonitor will be discovered by Prometheus
526 ## @param metrics.serviceMonitor.selector Prometheus instance selector labels
529 ## @param metrics.serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping
532 ## @param metrics.serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion
534 metricRelabelings: []
535 ## @param metrics.serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels
538 ## @param metrics.serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus.
541 ## Prometheus Operator alert rules configuration
544 ## @param metrics.prometheusRule.enabled Create PrometheusRule Resource for scraping metrics using PrometheusOperator
547 ## @param metrics.prometheusRule.namespace Namespace which Prometheus is running in
550 ## @param metrics.prometheusRule.labels Additional labels that can be used so PrometheusRule will be discovered by Prometheus
553 ## @param metrics.prometheusRule.groups Groups, containing the alert rules.
556 ## - name: KubernetesEventExporter
558 ## - alert: KubernetesEventExporterTooManyWatchErrors
560 ## message: "Kubernetes Event Exporter instance in namespace {{ `{{` }} $labels.namespace {{ `}}` }} has reported too many watch errors in 5 minutes."
562 ## sum(watch_errors{namespace="{{ include "common.names.namespace" . }}"})
565 ## severity: critical
567## @section Autoscaling
571 ## @param autoscaling.vpa.enabled Enable VPA
574 ## @param autoscaling.vpa.annotations Annotations for VPA resource
577 ## @param autoscaling.vpa.recommenders Recommender responsible for generating recommendation for the object.
578 ## List should be empty (then the default recommender will generate the recommendation) or contain exactly one recommender.
581 ## - name: custom-recommender-performance
583 ## @param autoscaling.vpa.controlledResources VPA List of resources that the vertical pod autoscaler can control. Defaults to cpu and memory
585 controlledResources: []
586 ## @param autoscaling.vpa.maxAllowed VPA Max allowed resources for the pod
590 ## @param autoscaling.vpa.minAllowed VPA Min allowed resources for the pod
594 ## @section VPA update policy
597 ## @param autoscaling.vpa.updatePolicy.minReplicas Specifies minimal number of replicas which need to be alive for VPA Updater to attempt pod eviction
599 ## @param autoscaling.vpa.updatePolicy.updateMode Autoscaling update policy Specifies whether recommended updates are applied when a Pod is started and whether recommended updates are applied during the life of a Pod
600 ## Possible values are "Off", "Initial", "Recreate", and "Auto".