oauth2-proxy
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# This file has been modified by Chainguard, Inc.
2
#
3
# Copyright Chainguard, Inc. All Rights Reserved.
4
# Chainguard, Inc. modifications are subject to the license
5
# available at: https://www.chainguard.dev/legal/software-license-agreement
6
#
7
# Copyright Broadcom, Inc. All Rights Reserved.
8
# SPDX-License-Identifier: APACHE-2.0
9
10
## @section Global parameters
11
## Global Docker image parameters
12
## Please, note that this will override the image parameters, including dependencies, configured to use the global value
13
## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass
14
##
15
16
## @param global.imageRegistry Global Docker image registry
17
## @param global.imagePullSecrets Global Docker registry secret names as an array
18
## @param global.defaultStorageClass Global default StorageClass for Persistent Volume(s)
19
##
20
global:
21
imageRegistry: ""
22
## E.g.
23
## imagePullSecrets:
24
## - myRegistryKeySecretName
25
##
26
imagePullSecrets: []
27
defaultStorageClass: ""
28
## Security parameters
29
##
30
security:
31
## @param global.security.allowInsecureImages Allows skipping image verification
32
allowInsecureImages: false
33
## Compatibility adaptations for Kubernetes platforms
34
##
35
compatibility:
36
## Compatibility adaptations for Openshift
37
##
38
openshift:
39
## @param global.compatibility.openshift.adaptSecurityContext Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation)
40
##
41
adaptSecurityContext: auto
42
org: ""
43
## @section Common parameters
44
##
45
46
## @param kubeVersion Override Kubernetes version
47
##
48
kubeVersion: ""
49
## @param nameOverride String to partially override common.names.fullname
50
##
51
nameOverride: ""
52
## @param fullnameOverride String to fully override common.names.fullname
53
##
54
fullnameOverride: ""
55
## @param commonLabels Labels to add to all deployed objects
56
##
57
commonLabels: {}
58
## @param commonAnnotations Annotations to add to all deployed objects
59
##
60
commonAnnotations: {}
61
## @param clusterDomain Kubernetes cluster domain name
62
##
63
clusterDomain: cluster.local
64
## @param extraDeploy Array of extra objects to deploy with the release
65
##
66
extraDeploy: []
67
## Enable diagnostic mode in the deployment
68
##
69
diagnosticMode:
70
## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden)
71
##
72
enabled: false
73
## @param diagnosticMode.command Command to override all containers in the deployment
74
##
75
command:
76
- sleep
77
## @param diagnosticMode.args Args to override all containers in the deployment
78
##
79
args:
80
- infinity
81
## @section Traffic Exposure Parameters
82
##
83
84
## OAuth2 Proxy service parameters
85
##
86
service:
87
## @param service.type OAuth2 Proxy service type
88
##
89
type: ClusterIP
90
## @param service.port OAuth2 Proxy service HTTP port
91
##
92
port: 80
93
## Node ports to expose
94
## @param service.nodePorts.http Node port for HTTP
95
## NOTE: choose port between <30000-32767>
96
##
97
nodePorts:
98
http: ""
99
## @param service.clusterIP OAuth2 Proxy service Cluster IP
100
## e.g.:
101
## clusterIP: None
102
##
103
clusterIP: ""
104
## @param service.loadBalancerIP OAuth2 Proxy service Load Balancer IP
105
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-loadbalancer
106
##
107
loadBalancerIP: ""
108
## @param service.loadBalancerSourceRanges OAuth2 Proxy service Load Balancer sources
109
## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
110
## e.g:
111
## loadBalancerSourceRanges:
112
## - 10.10.10.0/24
113
##
114
loadBalancerSourceRanges: []
115
## @param service.externalTrafficPolicy OAuth2 Proxy service external traffic policy
116
## ref https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
117
##
118
externalTrafficPolicy: Cluster
119
## @param service.extraPorts Extra ports to expose (normally used with the `sidecar` value)
120
##
121
extraPorts: []
122
## @param service.annotations Additional custom annotations for OAuth2 Proxy service
123
##
124
annotations: {}
125
## @param service.sessionAffinity Session Affinity for Kubernetes service, can be "None" or "ClientIP"
126
## If "ClientIP", consecutive client requests will be directed to the same Pod
127
## ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies
128
##
129
sessionAffinity: None
130
## @param service.sessionAffinityConfig Additional settings for the sessionAffinity
131
## sessionAffinityConfig:
132
## clientIP:
133
## timeoutSeconds: 300
134
##
135
sessionAffinityConfig: {}
136
## Network Policies
137
## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/
138
##
139
networkPolicy:
140
## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created
141
##
142
enabled: true
143
## @param networkPolicy.allowExternal Don't require server label for connections
144
## The Policy model to apply. When set to false, only pods with the correct
145
## server label will have network access to the ports server is listening
146
## on. When true, server will accept connections from any source
147
## (with the correct destination port).
148
##
149
allowExternal: true
150
## @param networkPolicy.allowExternalEgress Allow the pod to access any range of port and all destinations.
151
##
152
allowExternalEgress: true
153
## @param networkPolicy.extraIngress [array] Add extra ingress rules to the NetworkPolicy
154
## e.g:
155
## extraIngress:
156
## - ports:
157
## - port: 1234
158
## from:
159
## - podSelector:
160
## - matchLabels:
161
## - role: frontend
162
## - podSelector:
163
## - matchExpressions:
164
## - key: role
165
## operator: In
166
## values:
167
## - frontend
168
extraIngress: []
169
## @param networkPolicy.extraEgress [array] Add extra ingress rules to the NetworkPolicy
170
## e.g:
171
## extraEgress:
172
## - ports:
173
## - port: 1234
174
## to:
175
## - podSelector:
176
## - matchLabels:
177
## - role: frontend
178
## - podSelector:
179
## - matchExpressions:
180
## - key: role
181
## operator: In
182
## values:
183
## - frontend
184
##
185
extraEgress: []
186
## @param networkPolicy.ingressNSMatchLabels [object] Labels to match to allow traffic from other namespaces
187
## @param networkPolicy.ingressNSPodMatchLabels [object] Pod labels to match to allow traffic from other namespaces
188
##
189
ingressNSMatchLabels: {}
190
ingressNSPodMatchLabels: {}
191
## Configure the ingress resource that allows you to access the OAuth2 Proxy installation
192
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
193
##
194
ingress:
195
## @param ingress.enabled Enable ingress record generation for OAuth2 Proxy
196
##
197
enabled: false
198
## @param ingress.pathType Ingress path type
199
##
200
pathType: ImplementationSpecific
201
## @param ingress.apiVersion Force Ingress API version (automatically detected if not set)
202
##
203
apiVersion: ""
204
## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress (Kubernetes 1.18+)
205
## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster .
206
## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/
207
##
208
ingressClassName: ""
209
## @param ingress.hostname Default host for the ingress record
210
##
211
hostname: oaut2-proxy.local
212
## @param ingress.path Default path for the ingress record
213
## NOTE: You may need to set this to '/*' in order to use this with ALB ingress controllers
214
##
215
path: /
216
## @param ingress.annotations Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations.
217
## For a full list of possible ingress annotations, please see
218
## ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md
219
## Use this parameter to set the required annotations for cert-manager, see
220
## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations
221
##
222
## e.g:
223
## annotations:
224
## kubernetes.io/ingress.class: nginx
225
## cert-manager.io/cluster-issuer: cluster-issuer-name
226
##
227
annotations: {}
228
## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter
229
## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}`
230
## You can:
231
## - Rely on cert-manager to create it by setting the corresponding annotations
232
## - Rely on Helm to create self-signed certificates by setting `ingress.tls=true` and `ingress.certManager=false`
233
##
234
tls: false
235
## @param ingress.extraHosts An array with additional hostname(s) to be covered with the ingress record
236
## e.g:
237
## extraHosts:
238
## - name: oaut2-proxy.local
239
## path: /
240
##
241
extraHosts: []
242
## @param ingress.extraPaths An array with additional arbitrary paths that may need to be added to the ingress under the main host
243
## e.g:
244
## extraPaths:
245
## - path: /*
246
## backend:
247
## serviceName: ssl-redirect
248
## servicePort: use-annotation
249
##
250
extraPaths: []
251
## @param ingress.extraTls TLS configuration for additional hostname(s) to be covered with this ingress record
252
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls
253
## e.g:
254
## extraTls:
255
## - hosts:
256
## - oaut2-proxy.local
257
## secretName: oaut2-proxy.local-tls
258
##
259
extraTls: []
260
## @param ingress.certManager Add the corresponding annotations for cert-manager integration
261
##
262
certManager: false
263
## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm
264
##
265
selfSigned: false
266
## @param ingress.secrets Custom TLS certificates as secrets
267
## NOTE: 'key' and 'certificate' are expected in PEM format
268
## NOTE: 'name' should line up with a 'secretName' set further up
269
## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates
270
## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days
271
## It is also possible to create and manage the certificates outside of this helm chart
272
## Please see README.md for more information
273
## e.g:
274
## secrets:
275
## - name: %%COMPONENT_NAME%%.local-tls
276
## key: |-
277
## -----BEGIN RSA PRIVATE KEY-----
278
## ...
279
## -----END RSA PRIVATE KEY-----
280
## certificate: |-
281
## -----BEGIN CERTIFICATE-----
282
## ...
283
## -----END CERTIFICATE-----
284
##
285
secrets: []
286
## @param ingress.existingSecretName If you're providing your own certificate and want to manage the secret yourself
287
##
288
existingSecretName: ""
289
## @param ingress.extraRules Additional rules to be covered with this ingress record
290
## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-rules
291
## e.g:
292
## extraRules:
293
## - host: example.local
294
## http:
295
## path: /
296
## backend:
297
## service:
298
## name: example-svc
299
## port:
300
## name: http
301
##
302
extraRules: []
303
## @section OAuth2 Proxy Image parameters
304
##
305
306
## Iamguarded OAuth2 Proxy image
307
## ref: https://hub.docker.com/r/iamguarded/redis/tags/
308
## @param image.registry [default: REGISTRY_NAME] OAuth2 Proxy image registry
309
## @param image.repository [default: REPOSITORY_NAME/oauth2-proxy] OAuth2 Proxy image repository
310
## @skip image.tag OAuth2 Proxy image tag (immutable tags are recommended)
311
## @param image.digest OAuth2 Proxy image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag
312
## @param image.pullPolicy OAuth2 Proxy image pull policy
313
## @param image.pullSecrets OAuth2 Proxy image pull secrets
314
##
315
image:
316
registry: cgr.dev
317
repository: chainguard-private/oauth2-proxy-iamguarded
318
tag: 7.14.3
319
digest: ""
320
## Specify a imagePullPolicy
321
## ref: https://kubernetes.io/docs/concepts/containers/images/#pre-pulled-images
322
##
323
pullPolicy: IfNotPresent
324
## Optionally specify an array of imagePullSecrets
325
## Secrets must be manually created in the namespace
326
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
327
## e.g:
328
## pullSecrets:
329
## - myRegistryKeySecretName
330
##
331
pullSecrets: []
332
## @section OAuth2 Proxy configuration parameters
333
##
334
335
## Configuration section
336
##
337
configuration:
338
## @param configuration.clientID OAuth client ID
339
##
340
clientID: "XXXXXXX"
341
## @param configuration.clientSecret OAuth client secret
342
##
343
clientSecret: "XXXXXXXX"
344
## Create a new secret with the following command openssl rand -base64 32 | head -c 32 | base64
345
## Use an existing secret for OAuth2 credentials (see secret.yaml for required fields)
346
##
347
## @param configuration.cookieSecret OAuth cookie secret
348
##
349
cookieSecret: "XXXXXXXXXXXXXXXX"
350
## @param configuration.existingSecret Secret with the client ID, secret and cookie secret
351
##
352
existingSecret: ""
353
## e.g:
354
## google:
355
## adminEmail: xxxx
356
## serviceAccountJson: xxxx
357
## existingSecret: google-secret
358
## Alternatively, use an existing secret (see secret-google.yaml for required fields)
359
##
360
## @param configuration.google.enabled Enable Google service account
361
## @param configuration.google.useApplicationDefaultCredentials Use the application-default credentials (i.e. Workload Identity on GKE) instead of providing a service account JSON
362
## @param configuration.google.adminEmail Google admin email
363
## @param configuration.google.groups Restrict logins to members of these google groups
364
## @param configuration.google.serviceAccountJson Google Service account JSON
365
## @param configuration.google.existingSecret Existing secret containing Google Service Account
366
##
367
google:
368
enabled: false
369
useApplicationDefaultCredentials: false
370
adminEmail: ""
371
groups: []
372
serviceAccountJson: ""
373
existingSecret: ""
374
## Custom configuration file: oauth2_proxy.cfg
375
## content: |
376
## pass_basic_auth = false
377
## pass_access_token = true
378
##
379
## @param configuration.content [string] Default configuration
380
##
381
content: |
382
email_domains = [ "*" ]
383
upstreams = [ "file:///dev/null" ]
384
## @param configuration.existingConfigmap Configmap with the OAuth2 Proxy configuration
385
##
386
existingConfigmap: ""
387
## Authorize individual email addresses
388
## @param configuration.authenticatedEmailsFile.enabled Enable authenticated emails file
389
## @param configuration.authenticatedEmailsFile.content Restricted access list (one email per line)
390
## @param configuration.authenticatedEmailsFile.existingSecret Secret with the authenticated emails file
391
##
392
authenticatedEmailsFile:
393
enabled: false
394
## One email per line
395
## e.g:
396
## content: |-
397
## name1@domain
398
## name2@domain
399
## If you override the config with restricted_access it will configure a user list within this chart what takes care of the configmap
400
##
401
content: ""
402
existingSecret: ""
403
## Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption
404
## @param configuration.htpasswdFile.enabled Enable htpasswd file
405
## @param configuration.htpasswdFile.existingSecret Existing secret for htpasswd file
406
## @param configuration.htpasswdFile.content htpasswd file entries (one row per user)
407
##
408
htpasswdFile:
409
enabled: false
410
## Alternatively supply an existing secret which contains the required information
411
##
412
existingSecret: ""
413
## One row for each user
414
## e.g:
415
## entries: |
416
## testuser:{SHA}EWhzdhgoYJWy0z2gyzhRYlN9DSiv
417
##
418
content: ""
419
## @param configuration.oidcIssuerUrl OpenID Connect issuer URL
420
oidcIssuerUrl: ""
421
## @param configuration.redirectUrl OAuth Redirect URL
422
redirectUrl: ""
423
## @param configuration.whiteList Allowed domains for redirection after authentication. Prefix domain with a . or a *. to allow subdomains
424
whiteList: ""
425
## @section OAuth2 Proxy deployment parameters
426
##
427
428
## @param containerPort OAuth2 Proxy port number
429
##
430
containerPort: 4180
431
## @param extraContainerPorts Array of additional container ports for the OAuth2 Proxy container
432
## e.g:
433
## extraContainerPorts:
434
## - name: metrics
435
## containerPort: 9100
436
##
437
extraContainerPorts: []
438
## @param replicaCount Number of OAuth2 Proxy replicas to deploy
439
##
440
replicaCount: 1
441
## @param extraArgs add extra args to the default command
442
##
443
extraArgs: []
444
## Configure extra options for OAuth2 Proxy containers' startup, liveness and readiness probes
445
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes
446
## @param startupProbe.enabled Enable startupProbe on OAuth2 Proxy nodes
447
## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe
448
## @param startupProbe.periodSeconds Period seconds for startupProbe
449
## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe
450
## @param startupProbe.failureThreshold Failure threshold for startupProbe
451
## @param startupProbe.successThreshold Success threshold for startupProbe
452
##
453
startupProbe:
454
enabled: false
455
initialDelaySeconds: 0
456
periodSeconds: 10
457
timeoutSeconds: 1
458
failureThreshold: 5
459
successThreshold: 1
460
## @param livenessProbe.enabled Enable livenessProbe on OAuth2 Proxy nodes
461
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
462
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
463
## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe
464
## @param livenessProbe.failureThreshold Failure threshold for livenessProbe
465
## @param livenessProbe.successThreshold Success threshold for livenessProbe
466
##
467
livenessProbe:
468
enabled: true
469
initialDelaySeconds: 0
470
periodSeconds: 10
471
timeoutSeconds: 1
472
failureThreshold: 5
473
successThreshold: 1
474
## @param readinessProbe.enabled Enable readinessProbe on OAuth2 Proxy nodes
475
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
476
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
477
## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe
478
## @param readinessProbe.failureThreshold Failure threshold for readinessProbe
479
## @param readinessProbe.successThreshold Success threshold for readinessProbe
480
##
481
readinessProbe:
482
enabled: true
483
initialDelaySeconds: 0
484
periodSeconds: 10
485
timeoutSeconds: 1
486
failureThreshold: 5
487
successThreshold: 1
488
## @param customStartupProbe Custom startupProbe that overrides the default one
489
##
490
customStartupProbe: {}
491
## @param customLivenessProbe Custom livenessProbe that overrides the default one
492
##
493
customLivenessProbe: {}
494
## @param customReadinessProbe Custom readinessProbe that overrides the default one
495
##
496
customReadinessProbe: {}
497
## OAuth2 Proxy resource requests and limits
498
## ref: https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/
499
## @param resourcesPreset Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if resources is set (resources is recommended for production).
500
## More information: https://github.com/iamguarded/charts/blob/main/iamguarded/common/templates/_resources.tpl#L15
501
##
502
resourcesPreset: "nano"
503
## @param resources Set container requests and limits for different resources like CPU or memory (essential for production workloads)
504
## Example:
505
## resources:
506
## requests:
507
## cpu: 2
508
## memory: 512Mi
509
## limits:
510
## cpu: 3
511
## memory: 1024Mi
512
##
513
resources: {}
514
## Limits the number of pods of the replicated application that are down simultaneously from voluntary disruptions
515
## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions
516
## e.g:
517
## podDisruptionBudget:
518
## minAvailable: 1
519
## maxUnavailable: 1
520
## @param pdb.create Enable a Pod Disruption Budget creation
521
## @param pdb.minAvailable Minimum number/percentage of pods that should remain scheduled
522
## @param pdb.maxUnavailable Maximum number/percentage of pods that may be made unavailable. Defaults to `1` if both `pdb.minAvailable` and `pdb.maxUnavailable` are empty.
523
##
524
pdb:
525
create: true
526
minAvailable: ""
527
maxUnavailable: ""
528
## Configure Pods Security Context
529
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
530
## @param podSecurityContext.enabled Enabled OAuth2 Proxy pods' Security Context
531
## @param podSecurityContext.fsGroupChangePolicy Set filesystem group change policy
532
## @param podSecurityContext.sysctls Set kernel settings using the sysctl interface
533
## @param podSecurityContext.supplementalGroups Set filesystem extra groups
534
## @param podSecurityContext.fsGroup Set OAuth2 Proxy pod's Security Context fsGroup
535
##
536
podSecurityContext:
537
enabled: true
538
fsGroupChangePolicy: Always
539
sysctls: []
540
supplementalGroups: []
541
fsGroup: 1001
542
## Configure Container Security Context
543
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
544
## @param containerSecurityContext.enabled Enabled containers' Security Context
545
## @param containerSecurityContext.seLinuxOptions [object,nullable] Set SELinux options in container
546
## @param containerSecurityContext.runAsUser Set containers' Security Context runAsUser
547
## @param containerSecurityContext.runAsGroup Set containers' Security Context runAsGroup
548
## @param containerSecurityContext.runAsNonRoot Set container's Security Context runAsNonRoot
549
## @param containerSecurityContext.privileged Set container's Security Context privileged
550
## @param containerSecurityContext.readOnlyRootFilesystem Set container's Security Context readOnlyRootFilesystem
551
## @param containerSecurityContext.allowPrivilegeEscalation Set container's Security Context allowPrivilegeEscalation
552
## @param containerSecurityContext.capabilities.drop List of capabilities to be dropped
553
## @param containerSecurityContext.seccompProfile.type Set container's Security Context seccomp profile
554
##
555
containerSecurityContext:
556
enabled: true
557
seLinuxOptions: {}
558
runAsUser: 1001
559
runAsGroup: 1001
560
runAsNonRoot: true
561
privileged: false
562
readOnlyRootFilesystem: true
563
allowPrivilegeEscalation: false
564
capabilities:
565
drop: ["ALL"]
566
seccompProfile:
567
type: "RuntimeDefault"
568
## @param command Override default container command (useful when using custom images)
569
##
570
command: []
571
## @param args Override default container args (useful when using custom images)
572
##
573
args: []
574
## @param automountServiceAccountToken Mount Service Account token in pod
575
##
576
automountServiceAccountToken: false
577
## @param hostAliases OAuth2 Proxy pods host aliases
578
## ref: https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
579
##
580
hostAliases: []
581
## @param podLabels Extra labels for OAuth2 Proxy pods
582
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
583
##
584
podLabels: {}
585
## @param podAnnotations Annotations for OAuth2 Proxy pods
586
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
587
##
588
podAnnotations: {}
589
## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
590
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
591
##
592
podAffinityPreset: ""
593
## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
594
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity
595
##
596
podAntiAffinityPreset: soft
597
## Node affinity preset
598
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity
599
##
600
nodeAffinityPreset:
601
## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard`
602
##
603
type: ""
604
## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set
605
##
606
key: ""
607
## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set
608
## E.g.
609
## values:
610
## - e2e-az1
611
## - e2e-az2
612
##
613
values: []
614
## @param affinity Affinity for OAuth2 Proxy pods assignment
615
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
616
## NOTE: `podAffinityPreset`, `podAntiAffinityPreset`, and `nodeAffinityPreset` will be ignored when it's set
617
##
618
affinity: {}
619
## @param nodeSelector Node labels for OAuth2 Proxy pods assignment
620
## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
621
##
622
nodeSelector: {}
623
## @param tolerations Tolerations for OAuth2 Proxy pods assignment
624
## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
625
##
626
tolerations: []
627
## @param updateStrategy.type OAuth2 Proxy statefulset strategy type
628
## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
629
##
630
updateStrategy:
631
## StrategyType
632
## Can be set to RollingUpdate or OnDelete
633
##
634
type: RollingUpdate
635
## @param priorityClassName OAuth2 Proxy pods' priorityClassName
636
##
637
priorityClassName: ""
638
## @param schedulerName Name of the k8s scheduler (other than default)
639
## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
640
##
641
schedulerName: ""
642
## @param topologySpreadConstraints Topology Spread Constraints for pod assignment
643
## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
644
## The value is evaluated as a template
645
##
646
topologySpreadConstraints: []
647
## @param lifecycleHooks for the OAuth2 Proxy container(s) to automate configuration before or after startup
648
##
649
lifecycleHooks: {}
650
## @param extraEnvVars Array with extra environment variables to add to OAuth2 Proxy nodes
651
## e.g:
652
## extraEnvVars:
653
## - name: FOO
654
## value: "bar"
655
##
656
extraEnvVars: []
657
## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars for OAuth2 Proxy nodes
658
##
659
extraEnvVarsCM: ""
660
## @param extraEnvVarsSecret Name of existing Secret containing extra env vars for OAuth2 Proxy nodes
661
##
662
extraEnvVarsSecret: ""
663
## @param extraVolumes Optionally specify extra list of additional volumes for the OAuth2 Proxy pod(s)
664
##
665
extraVolumes: []
666
## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for the OAuth2 Proxy container(s)
667
##
668
extraVolumeMounts: []
669
## @param sidecars Add additional sidecar containers to the OAuth2 Proxy pod(s)
670
## e.g:
671
## sidecars:
672
## - name: your-image-name
673
## image: your-image
674
## imagePullPolicy: Always
675
## ports:
676
## - name: portname
677
## containerPort: 1234
678
##
679
sidecars: []
680
## @param initContainers Add additional init containers to the OAuth2 Proxy pod(s)
681
## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
682
## e.g:
683
## initContainers:
684
## - name: your-image-name
685
## image: your-image
686
## imagePullPolicy: Always
687
## command: ['sh', '-c', 'echo "hello world"']
688
##
689
initContainers: []
690
## @param dnsPolicy Pod DNS policy. Valid values are 'ClusterFirstWithHostNet', 'ClusterFirst', 'Default' or 'None'.
691
## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
692
##
693
dnsPolicy: ""
694
## @param dnsConfig Pod DNS configuration.
695
## ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config
696
## e.g:
697
## dnsConfig:
698
## nameservers:
699
## - 8.8.8.8
700
## - 8.8.4.4
701
## options:
702
## - name: ndots
703
## value: "2"
704
## searches:
705
## - example.com
706
##
707
dnsConfig: {}
708
## ServiceAccount configuration
709
##
710
serviceAccount:
711
## @param serviceAccount.create Specifies whether a ServiceAccount should be created
712
##
713
create: true
714
## @param serviceAccount.name The name of the ServiceAccount to use
715
## If not set and create is true, a name is generated using the common.names.fullname template
716
##
717
name: ""
718
## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account
719
##
720
automountServiceAccountToken: false
721
## @param serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.
722
##
723
annotations: {}
724
## @section External Redis® parameters
725
##
726
externalRedis:
727
## @param externalRedis.host External Redis® server host
728
##
729
host: ""
730
## @param externalRedis.password External Redis® user password
731
##
732
password: ""
733
## @param externalRedis.port External Redis® server port
734
##
735
port: 6379
736
## @param externalRedis.databaseIndex External Redis® database index
737
##
738
databaseIndex: 0
739
## @param externalRedis.existingSecret The name of an existing secret with Redis® credentials
740
## NOTE: Must contain key `redis-password`
741
## NOTE: When it's set, the `externalRedis.password` parameter is ignored
742
##
743
existingSecret: ""
744
## @param externalRedis.existingSecretPasswordKey Key inside the existing secret with Redis® credentials
745
##
746
existingSecretPasswordKey: ""
747
## @section Redis® sub-chart parameters
748
##
749
redis:
750
## @param redis.enabled Deploy Redis® sub-chart
751
##
752
enabled: true
753
## @param redis.architecture Redis® architecture
754
##
755
architecture: "standalone"
756
master:
757
## @param redis.master.service.port Redis® (without Sentinel) service port
758
##
759
service:
760
port: 6379
761
replica:
762
## @param redis.replica.replicaCount Number of Redis® replicas
763
##
764
replicaCount: 3
765
auth:
766
## @param redis.auth.enabled Enable Redis® authentication
767
##
768
enabled: true
769
## @param redis.auth.existingSecret Secret with Redis® credentials
770
##
771
existingSecret: ""
772
## @param redis.auth.existingSecretPasswordKey Key inside the existing secret with Redis® credentials
773
##
774
existingSecretPasswordKey: ""
775
## @param redis.auth.sentinel Enable authentication in the Sentinel nodes
776
##
777
sentinel: true
778
sentinel:
779
## @param redis.sentinel.enabled Enable Redis® sentinel in the deployment
780
##
781
enabled: false
782
## @param redis.sentinel.masterSet Name of the Redis® Sentinel master set
783
##
784
masterSet: mymaster
785
service:
786
## @param redis.sentinel.service.port Redis® (with Sentinel) service port
787
##
788
port: 6379
789
## @param redis.sentinel.service.sentinelPort Redis® (with Sentinel) sentinel service port
790
##
791
sentinelPort: 26379
792