1# This file has been modified by Chainguard, Inc.
3# Copyright Chainguard, Inc. All Rights Reserved.
4# Chainguard, Inc. modifications are subject to the license
5# available at: https://www.chainguard.dev/legal/software-license-agreement
7# Copyright Broadcom, Inc. All Rights Reserved.
8# SPDX-License-Identifier: APACHE-2.0
10## @section Global parameters
11## Global Docker image parameters
12## Please, note that this will override the image parameters, including dependencies, configured to use the global value
13## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass
15## @param global.imageRegistry Global Docker image registry
16## @param global.imagePullSecrets Global Docker registry secret names as an array
17## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)
18## @param global.storageClass DEPRECATED: use global.defaultStorageClass instead
24 ## - myRegistryKeySecretName
27 defaultStorageClass: ""
29 ## Security parameters
32 ## @param global.security.allowInsecureImages Allows skipping image verification
33 allowInsecureImages: false
34 ## Compatibility adaptations for Kubernetes platforms
37 ## Compatibility adaptations for Openshift
40 ## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
42 adaptSecurityContext: auto
44## @section Common parameters
46## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set)
49## @param nameOverride String to partially override common.names.fullname template (will maintain the release name)
52## @param fullnameOverride String to fully override `common.names.fullname` template with a string
55## @param namespaceOverride String to fully override common.names.namespace
58## @param commonAnnotations Annotations to add to all deployed objects
61## @param commonLabels Labels to add to all deployed objects
64## @param extraDeploy Array of extra objects to deploy with the release
67## @param clusterDomain Kubernetes cluster domain name
69clusterDomain: cluster.local
70## Enable diagnostic mode in the deployment(s)/statefulset(s)
73 ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)
76 ## @param diagnosticMode.command Command to override all containers in the the deployment(s)/statefulset(s)
80 ## @param diagnosticMode.args Args to override all containers in the the deployment(s)/statefulset(s)
84## @section Node Exporter parameters
86## @param resourceType Specify how to deploy Node Exporter (allowed values: `daemonset` and `deployment`)
88resourceType: daemonset
89## @param replicaCount Number of replicas to deploy (when `resourceType` is `deployment`)
92## @param isolatedDeployment Specify whether to deploy the Node Exporter in an isolated deployment without access to host network, host PID and /proc and /sys of the host. (when `resourceType` is `deployment`)
94isolatedDeployment: true
95## @param automountServiceAccountToken Mount Service Account token in pod
97automountServiceAccountToken: false
98## @param hostAliases Deployment pod host aliases
99## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
103## Ref: https://kubernetes.io/docs/admin/authorization/rbac/
106 ## @param rbac.create Whether to create and use RBAC resources or not
109 ## @param rbac.pspEnabled Whether to create a PodSecurityPolicy and bound it with RBAC. WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later
112## Service account for Node Exporter to use.
113## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
114## @param serviceAccount.create Specifies whether a ServiceAccount should be created
115## @param serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template.
116## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account
117## @param serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.
122 automountServiceAccountToken: false
124## Iamguarded Node Exporter image version
125## ref: https://hub.docker.com/r/iamguarded/node-exporter/tags/
126## @param image.registry [default: REGISTRY_NAME] Node Exporter image registry
127## @param image.repository [default: REPOSITORY_NAME/node-exporter] Node Exporter image repository
128## @skip image.tag Node Exporter image tag (immutable tags are recommended)
129## @param image.digest Node Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
130## @param image.pullPolicy Node Exporter image pull policy
131## @param image.pullSecrets Specify docker-registry secret names as an array
135 repository: chainguard-private/prometheus-node-exporter-iamguarded
138 ## Specify a imagePullPolicy
139 ## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
141 pullPolicy: IfNotPresent
142 ## Optionally specify an array of imagePullSecrets.
143 ## Secrets must be manually created in the namespace.
144 ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
147 ## - myRegistryKeySecretName
150## @param containerPorts.metrics Node Exporter container port
154## @param sidecars Add additional sidecar containers to the Node exporter pod(s)
157## - name: your-image-name
159## imagePullPolicy: Always
162## containerPort: 1234
165## @param initContainers Add additional init containers to the Node exporter pod(s)
166## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
169## - name: your-image-name
171## imagePullPolicy: Always
172## command: ['sh', '-c', 'echo "hello world"']
175## Pod Disruption Budget configuration
176## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb
177## @param pdb.create Enable/disable a Pod Disruption Budget creation
178## @param pdb.minAvailable Minimum number/percentage of pods that should remain scheduled
179## @param pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty.
185## @param extraArgs Additional command line arguments to pass to node-exporter
187## collector.filesystem.ignored-mount-points: "^/(dev|proc|sys|var/lib/docker/.+)($|/)"
188## collector.filesystem.ignored-fs-types: "^(autofs|binfmt_misc|cgroup|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|mqueue|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|sysfs|tracefs)$"
191## @param command Override default container command (useful when using custom images)
194## @param args Override default container args (useful when using custom images)
197## @param lifecycleHooks for the Node exporter container(s) to automate configuration before or after startup
200## @param extraEnvVars Array with extra environment variables to add to Node exporter container
207## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Node exporter container
210## @param extraEnvVarsSecret Name of existing Secret containing extra env vars for Node exporter container
212extraEnvVarsSecret: ""
213## @param extraVolumes Additional volumes to the node-exporter pods
215## - name: copy-portal-skins
219## @param extraVolumeMounts Additional volumeMounts to the node-exporter container
221## - name: copy-portal-skins
222## mountPath: /var/lib/lemonldap-ng/portal/skins
225## Configure Pods Security Context
226## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
227## @param podSecurityContext.enabled Enabled Node exporter pods' Security Context
228## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
229## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface
230## @param podSecurityContext.supplementalGroups Set filesystem extra groups
231## @param podSecurityContext.fsGroup Set Node exporter pod's Security Context fsGroup
235 fsGroupChangePolicy: Always
237 supplementalGroups: []
239## Configure Container Security Context
240## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
241## @param containerSecurityContext.enabled Enabled containers' Security Context
242## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
243## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser
244## @param containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
245## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
246## @param containerSecurityContext.privileged Set container's Security Context privileged
247## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
248## @param containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
249## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped
250## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
252containerSecurityContext:
259 readOnlyRootFilesystem: true
260 allowPrivilegeEscalation: false
264 type: "RuntimeDefault"
265## Node Exporter Service
268 ## @param service.type Kubernetes service type
271 ## @param service.ports.metrics Node Exporter metrics service port
275 ## @param service.nodePorts.metrics Specify the nodePort value for the LoadBalancer and NodePort service types
276 ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
282 ## @param service.clusterIP Specific cluster IP when service type is cluster IP. Use `None` for headless service
285 ## @param service.loadBalancerIP `loadBalancerIP` if service type is `LoadBalancer`
286 ## Set the LoadBalancer service type to internal only
287 ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
290 ## @param service.loadBalancerSourceRanges Address that are allowed when service is `LoadBalancer`
291 ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
293 ## loadBalancerSourceRanges:
296 loadBalancerSourceRanges: []
297 ## @param service.externalTrafficPolicy Node exporter service external traffic policy
298 ## ref http://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
300 externalTrafficPolicy: Cluster
301 ## @param service.extraPorts Extra ports to expose (normally used with the `sidecar` value)
304 ## @param service.addPrometheusScrapeAnnotation Add the `prometheus.io/scrape: "true"` annotation to the service
306 addPrometheusScrapeAnnotation: true
307 ## @param service.annotations Additional annotations for Node Exporter service
310 ## @param service.labels Additional labels for Node Exporter service
313 ## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"
314 ## If "ClientIP", consecutive client requests will be directed to the same Pod
315 ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
317 sessionAffinity: None
318 ## @param service.sessionAffinityConfig Additional settings for the sessionAffinity
319 ## sessionAffinityConfig:
321 ## timeoutSeconds: 300
323 sessionAffinityConfig: {}
325## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
328 ## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created
331 ## @param networkPolicy.allowExternal Don't require server label for connections
332 ## The Policy model to apply. When set to false, only pods with the correct
333 ## server label will have network access to the ports server is listening
334 ## on. When true, server will accept connections from any source
335 ## (with the correct destination port).
338 ## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
340 allowExternalEgress: true
341 ## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy
351 ## - matchExpressions:
357 ## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
367 ## - matchExpressions:
374 ## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
375 ## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
377 ingressNSMatchLabels: {}
378 ingressNSPodMatchLabels: {}
379## @param updateStrategy.type The update strategy type to apply to the DaemonSet
380## @param updateStrategy.rollingUpdate.maxUnavailable Maximum number of pods that may be made unavailable
386## @param hostNetwork Expose the service to the host network
388## @param hostPID Allows visibility of processes on the host, potentially leaking information such as environment variables and configuration
390## @param minReadySeconds `minReadySeconds` to avoid killing pods before we are ready
393## @param priorityClassName Priority class assigned to the Pods
396## @param terminationGracePeriodSeconds In seconds, time the given to the Node exporter pod needs to terminate gracefully
397## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods
399terminationGracePeriodSeconds: ""
400## Resource requests and limits
401## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
402## We usually recommend not to specify default resources and to leave this as a conscious
403## choice for the user. This also increases chances charts run on environments with little
404## resources, such as Minikube. If you do want to specify resources, uncomment the following
405## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
406## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).
407## More information: https://github.com/iamguarded/charts/blob/main/iamguarded/common/templates/_resources.tpl#L15
409resourcesPreset: "nano"
410## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
421## @param podLabels Pod labels
422## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
425## @param podAnnotations Pod annotations
426## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
429## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
430## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
433## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
434## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
436podAntiAffinityPreset: soft
437## Node affinity preset
438## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
441 ## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
444 ## @param nodeAffinityPreset.key Node label key to match Ignored if `affinity` is set.
446 ## key: "kubernetes.io/e2e-az-name"
449 ## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set.
456## @param affinity Affinity for pod assignment. Evaluated as a template.
457## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
458## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set
461## @param nodeSelector Node labels for pod assignment. Evaluated as a template.
462## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
465## @param tolerations Tolerations for pod assignment. Evaluated as a template.
466## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
469## Configure extra options for liveness probe
470## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
471## @param livenessProbe.enabled Enable livenessProbe
472## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
473## @param livenessProbe.periodSeconds Period seconds for livenessProbe
474## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
475## @param livenessProbe.failureThreshold Failure threshold for livenessProbe
476## @param livenessProbe.successThreshold Success threshold for livenessProbe
480 initialDelaySeconds: 120
485## Configure extra options for readiness probe
486## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
487## @param readinessProbe.enabled Enable readinessProbe
488## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
489## @param readinessProbe.periodSeconds Period seconds for readinessProbe
490## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
491## @param readinessProbe.failureThreshold Failure threshold for readinessProbe
492## @param readinessProbe.successThreshold Success threshold for readinessProbe
496 initialDelaySeconds: 30
501## Configure extra options for startup probe
502## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
503## @param startupProbe.enabled Enable startupProbe
504## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
505## @param startupProbe.periodSeconds Period seconds for startupProbe
506## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
507## @param startupProbe.failureThreshold Failure threshold for startupProbe
508## @param startupProbe.successThreshold Success threshold for startupProbe
512 initialDelaySeconds: 30
517## @param customStartupProbe Custom liveness probe for the Node exporter container
519customStartupProbe: {}
520## @param customLivenessProbe Custom liveness probe for the Node exporter container
522customLivenessProbe: {}
523## @param customReadinessProbe Custom readiness probe for the Node exporter container
525customReadinessProbe: {}
526## ServiceMonitor configuration
529 ## @param serviceMonitor.enabled Creates a ServiceMonitor to monitor Node Exporter
532 ## @param serviceMonitor.namespace Namespace in which Prometheus is running
535 ## @param serviceMonitor.jobLabel The name of the label on the target service to use as the job name in prometheus.
538 ## @param serviceMonitor.interval Scrape interval (use by default, falling back to Prometheus' default)
539 ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint
544 ## @param serviceMonitor.scrapeTimeout Timeout after which the scrape is ended
545 ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint
547 ## scrapeTimeout: 10s
550 ## @param serviceMonitor.basicAuth Use basic auth for scraping
551 ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#BasicAuth
562 ## @param serviceMonitor.selector ServiceMonitor selector labels
563 ## ref: https://github.com/iamguarded/charts/tree/main/iamguarded/prometheus-operator#prometheus-configuration
566 ## prometheus: my-prometheus
569 ## @param serviceMonitor.relabelings RelabelConfigs to apply to samples before scraping
570 ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig
573 ## @param serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion
574 ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig
576 metricRelabelings: []
577 ## @param serviceMonitor.labels Extra labels for the ServiceMonitor
580 ## @param serviceMonitor.honorLabels honorLabels chooses the metric's labels on collisions with target labels
583 ## @param serviceMonitor.attachMetadata Attaches node metadata to discovered targets
584 ## ref: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#attachmetadata
590 ## @param serviceMonitor.sampleLimit Per-scrape limit on number of scraped samples that will be accepted.
593## Pod Security Policy for Node Exporter to use.
594## WARNING: PodSecurityPolicy is deprecated in Kubernetes v1.21 or later, unavailable in v1.25 or later
595## @param podSecurityPolicy.annotations Annotations for Pod Security Policy. Evaluated as a template.
598## seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
599## seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default