argo-cd

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

## Argo CD configuration

## Ref: https://github.com/argoproj/argo-cd

# -- Provide a name in place of `argocd`

nameOverride: argocd

# -- String to fully override `"argo-cd.fullname"`

fullnameOverride: ""

# -- Override the namespace

# @default -- `.Release.Namespace`

namespaceOverride: ""

# -- Override the Kubernetes version, which is used to evaluate certain manifests

kubeVersionOverride: ""

# Override APIVersions

# If you want to template helm charts but cannot access k8s API server

# you can set api versions here

apiVersionOverrides: {}

# -- Create aggregated roles that extend existing cluster roles to interact with argo-cd resources

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

createAggregateRoles: false

# -- Create cluster roles for cluster-wide installation.

## Used when you manage applications in the same cluster where Argo CD runs

createClusterRoles: true

openshift:

# -- enables using arbitrary uid for argo repo server

enabled: false

## Custom resource configuration

crds:

# -- Install and upgrade CRDs

install: true

# -- Keep CRDs on chart uninstall

keep: true

# -- Annotations to be added to all CRDs

annotations:

argocd.argoproj.io/sync-options: ServerSideApply=true

# -- Additional labels to be added to all CRDs

additionalLabels: {}

## Globally shared configuration

global:

# -- Default domain used by all components

## Used for ingresses, certificates, SSO, notifications, etc.

domain: argocd.example.com

# -- Runtime class name for all components

runtimeClassName: ""

# -- Common labels for the all resources

additionalLabels: {}

# app: argo-cd

# -- Number of old deployment ReplicaSets to retain. The rest will be garbage collected.

revisionHistoryLimit: 3

# Default image used by all components

image:

# -- If defined, a repository applied to all Argo CD deployments

repository: cgr.dev/chainguard-private/argocd

# -- Overrides the global Argo CD image tag whose default is the chart appVersion

tag: latest@sha256:91b9c0f61f8fd370da7910ffa283f565ac7493b68b0aed6fcd5cedc9eb59aae8

# -- If defined, a imagePullPolicy applied to all Argo CD deployments

imagePullPolicy: IfNotPresent

# -- Secrets with credentials to pull images from a private registry

imagePullSecrets: []

# Default logging options used by all components

logging:

# -- Set the global logging format. Either: `text` or `json`

format: text

# -- Set the global logging level. One of: `debug`, `info`, `warn` or `error`

level: info

# -- Annotations for the all deployed Statefulsets

statefulsetAnnotations: {}

# -- Labels for the all deployed Statefulsets

statefulsetLabels: {}

# -- Annotations for the all deployed Deployments

deploymentAnnotations: {}

# -- Labels for the all deployed Deployments

deploymentLabels: {}

# -- Annotations for the all deployed pods

podAnnotations: {}

# -- Labels for the all deployed pods

podLabels: {}

# -- Add Prometheus scrape annotations to all metrics services. This can be used as an alternative to the ServiceMonitors.

addPrometheusAnnotations: false

# -- Toggle and define pod-level security context.

# @default -- `{}` (See [values.yaml])

securityContext: {}

# runAsUser: 999

# runAsGroup: 999

# fsGroup: 999

# -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files

hostAliases: []

# - ip: 10.20.30.40

# hostnames:

# - git.myhostname

# Configure dual-stack used by all component services

dualStack:

# -- IP family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)

ipFamilyPolicy: ""

# -- IP families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.

ipFamilies: []

100

# Default network policy rules used by all components

101

networkPolicy:

102

# -- Create NetworkPolicy objects for all components

103

create: true

104

# -- Default deny all ingress traffic

105

defaultDenyIngress: false

106

# -- Default priority class for all components

107

priorityClassName: ""

108

# -- Default node selector for all components

109

nodeSelector:

110

kubernetes.io/os: linux

111

# -- Default tolerations for all components

112

tolerations: []

113

# Default affinity preset for all components

114

affinity:

115

# -- Default pod anti-affinity rules. Either: `none`, `soft` or `hard`

116

podAntiAffinity: soft

117

# Node affinity rules

118

nodeAffinity:

119

# -- Default node affinity rules. Either: `none`, `soft` or `hard`

120

type: hard

121

# -- Default match expressions for node affinity

122

matchExpressions: []

123

# - key: topology.kubernetes.io/zone

124

# operator: In

125

# values:

126

# - antarctica-east1

127

# - antarctica-west1

128

# -- Default [TopologySpreadConstraints] rules for all components

129

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

130

## If labelSelector is left out, it will default to the labelSelector of the component

131

topologySpreadConstraints: []

132

# - maxSkew: 1

133

# topologyKey: topology.kubernetes.io/zone

134

# whenUnsatisfiable: DoNotSchedule

135

136

# -- Deployment strategy for the all deployed Deployments

137

deploymentStrategy: {}

138

# type: RollingUpdate

139

# rollingUpdate:

140

# maxSurge: 25%

141

# maxUnavailable: 25%

142

143

# -- Environment variables to pass to all deployed Deployments

144

env: []

145

# -- Extra volumes to add to all deployed Deployments and StatefulSets

146

extraVolumes: []

147

# Example of adding a custom CA bundle from a ConfigMap:

148

# - name: my-root-ca

149

# configMap:

150

# name: my-trustbundle

151

# items:

152

# - key: bundle.pem

153

# path: ca-certificates.crt

154

155

# -- Extra volume mounts to add to all deployed Deployments and StatefulSets

156

extraVolumeMounts: []

157

# Example of adding a custom CA bundle mount:

158

# - name: my-root-ca

159

# mountPath: /etc/ssl/certs

160

161

# -- Annotations for the all deployed Certificates

162

certificateAnnotations: {}

163

## Argo Configs

164

configs:

165

# General Argo CD configuration. Any values you put under `.configs.cm` are passed to argocd-cm ConfigMap.

166

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cm.yaml

167

cm:

168

# -- Create the argocd-cm configmap for [declarative setup]

169

create: true

170

# -- Annotations to be added to argocd-cm configmap

171

annotations: {}

172

# -- The name of tracking label used by Argo CD for resource pruning

173

application.instanceLabelKey: argocd.argoproj.io/instance

174

# -- Enable control of the service account used for the sync operation (alpha)

175

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/app-sync-using-impersonation/

176

application.sync.impersonation.enabled: false

177

# -- Enable exec feature in Argo UI

178

## Ref: https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac/#exec-resource

179

exec.enabled: false

180

# -- Enable local admin user

181

## Ref: https://argo-cd.readthedocs.io/en/latest/faq/#how-to-disable-admin-user

182

admin.enabled: true

183

# -- Timeout to discover if a new manifests version got published to the repository

184

timeout.reconciliation: 120s

185

# -- Maximum jitter added to the reconciliation timeout to spread out refreshes and reduce repo-server load

186

timeout.reconciliation.jitter: 60s

187

# -- Timeout to refresh application data as well as target manifests cache

188

timeout.hard.reconciliation: 0s

189

# -- Enable Status Badge

190

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/status-badge/

191

statusbadge.enabled: false

192

# Dex configuration

193

# dex.config: |

194

# connectors:

195

# # GitHub example

196

# - type: github

197

# id: github

198

# name: GitHub

199

# config:

200

# clientID: aabbccddeeff00112233

201

# clientSecret: $dex.github.clientSecret # Alternatively $<some_K8S_secret>:dex.github.clientSecret

202

# orgs:

203

# - name: your-github-org

204

205

# OIDC configuration as an alternative to dex (optional).

206

# oidc.config: |

207

# name: AzureAD

208

# issuer: https://login.microsoftonline.com/TENANT_ID/v2.0

209

# clientID: aaaabbbbccccddddeee

210

# clientSecret: $oidc.azuread.clientSecret

211

# # Optional: set to true to use Azure Workload Identity instead of clientSecret

212

# azure:

213

# useWorkloadIdentity: false

214

215

# Some OIDC providers require a separate clientID for different callback URLs.

216

# For example, if configuring Argo CD with self-hosted Dex, you will need a separate client ID

217

# for the 'localhost' (CLI) client to Dex. This field is optional. If omitted, the CLI will

218

# use the same clientID as the Argo CD server

219

# cliClientID: vvvvwwwwxxxxyyyyzzzz

220

221

# rootCA: |

222

# -----BEGIN CERTIFICATE-----

223

# ... encoded certificate data here ...

224

# -----END CERTIFICATE-----

225

226

# Optional list of allowed aud claims. If omitted or empty, defaults to the clientID value above (and the

227

# cliClientID, if that is also specified). If you specify a list and want the clientID to be allowed, you must

228

# explicitly include it in the list.

229

# Token verification will pass if any of the token's audiences matches any of the audiences in this list.

230

# allowedAudiences:

231

# - aaaabbbbccccddddeee

232

# - qqqqwwwweeeerrrrttt

233

234

# Optional set of OIDC claims to request on the ID token.

235

# requestedIDTokenClaims:

236

# groups:

237

# essential: true

238

239

# Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"]

240

# requestedScopes:

241

# - openid

242

# - profile

243

# - email

244

245

# PKCE authentication flow processes authorization flow from browser only - default false

246

# uses the clientID

247

# make sure the Identity Provider (IdP) is public and doesn't need clientSecret

248

# make sure the Identity Provider (IdP) has this redirect URI registered: https://argocd.example.com/pkce/verify

249

# enablePKCEAuthentication: true

250

251

# Extension Configuration

252

## Ref: https://argo-cd.readthedocs.io/en/latest/developer-guide/extensions/proxy-extensions/

253

# extension.config: |

254

# extensions:

255

# - name: httpbin

256

# backend:

257

# connectionTimeout: 2s

258

# keepAlive: 15s

259

# idleConnectionTimeout: 60s

260

# maxIdleConnections: 30

261

# services:

262

# - url: http://httpbin.org

263

# headers:

264

# - name: some-header

265

# value: '$some.argocd.secret.key'

266

# cluster:

267

# name: some-cluster

268

# server: https://some-cluster

269

270

## Default configuration for ignoreResourceUpdates.

271

## The ignoreResourceUpdates list contains K8s resource's properties that are known to be frequently updated

272

## by controllers and operators. These resources, when watched by argo, will cause many unnecessary updates.

273

274

# -- Ignoring status for all resources. An update will still be sent if the status update causes the health to change.

275

# @default -- See [values.yaml]

276

resource.customizations.ignoreResourceUpdates.all: |

277

jsonPointers:

278

- /status

279

# -- Some Application fields are generated and not related to the application updates itself

280

## The Application itself is already watched by the controller lister, but this configuration is applied for apps of apps

281

# @default -- See [values.yaml]

282

resource.customizations.ignoreResourceUpdates.argoproj.io_Application: |

283

jqPathExpressions:

284

- '.metadata.annotations."notified.notifications.argoproj.io"'

285

- '.metadata.annotations."argocd.argoproj.io/refresh"'

286

- '.metadata.annotations."argocd.argoproj.io/hydrate"'

287

- '.operation'

288

# -- Ignore Argo Rollouts generated fields

289

# @default -- See [values.yaml]

290

resource.customizations.ignoreResourceUpdates.argoproj.io_Rollout: |

291

jqPathExpressions:

292

- '.metadata.annotations."notified.notifications.argoproj.io"'

293

# -- Legacy annotations used on HPA autoscaling/v1

294

# @default -- See [values.yaml]

295

resource.customizations.ignoreResourceUpdates.autoscaling_HorizontalPodAutoscaler: |

296

jqPathExpressions:

297

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/behavior"'

298

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/conditions"'

299

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/metrics"'

300

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/current-metrics"'

301

# -- Ignore the cluster-autoscaler status

302

# @default -- See [values.yaml]

303

resource.customizations.ignoreResourceUpdates.ConfigMap: |

304

jqPathExpressions:

305

# Ignore the cluster-autoscaler status

306

- '.metadata.annotations."cluster-autoscaler.kubernetes.io/last-updated"'

307

# Ignore the annotation of the legacy Leases election

308

- '.metadata.annotations."control-plane.alpha.kubernetes.io/leader"'

309

# -- Ignore the common scaling annotations

310

# @default -- See [values.yaml]

311

resource.customizations.ignoreResourceUpdates.apps_ReplicaSet: |

312

jqPathExpressions:

313

- '.metadata.annotations."deployment.kubernetes.io/desired-replicas"'

314

- '.metadata.annotations."deployment.kubernetes.io/max-replicas"'

315

- '.metadata.annotations."rollout.argoproj.io/desired-replicas"'

316

# -- Ignores update if EndpointSlice is not excluded globally

317

# @default -- See [values.yaml]

318

resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice: |

319

jsonPointers:

320

- /metadata

321

- /endpoints

322

- /ports

323

# -- Ignores update if Endpoints is not excluded globally

324

# @default -- See [values.yaml]

325

resource.customizations.ignoreResourceUpdates.Endpoints: |

326

jsonPointers:

327

- /metadata

328

- /subsets

329

## Default configuration for exclusions.

330

## The exclusion list are K8s resources that we assume will never be declared in Git,

331

## and are never child objects of managed resources that need to be presented in the resource tree.

332

## This list contains high volume and high churn metadata objects which we exclude for performance

333

## reasons, reducing connections and load to the K8s API servers of managed clusters.

334

335

# -- Resource Exclusion/Inclusion

336

# @default -- See [values.yaml]

337

resource.exclusions: |

338

### Network resources created by the Kubernetes control plane and excluded to reduce the number of watched events and UI clutter

339

- apiGroups:

340

- ''

341

- discovery.k8s.io

342

kinds:

343

- Endpoints

344

- EndpointSlice

345

### Internal Kubernetes resources excluded reduce the number of watched events

346

- apiGroups:

347

- coordination.k8s.io

348

kinds:

349

- Lease

350

### Internal Kubernetes Authz/Authn resources excluded reduce the number of watched events

351

- apiGroups:

352

- authentication.k8s.io

353

- authorization.k8s.io

354

kinds:

355

- SelfSubjectReview

356

- TokenReview

357

- LocalSubjectAccessReview

358

- SelfSubjectAccessReview

359

- SelfSubjectRulesReview

360

- SubjectAccessReview

361

### Intermediate Certificate Request excluded reduce the number of watched events

362

- apiGroups:

363

- certificates.k8s.io

364

kinds:

365

- CertificateSigningRequest

366

- apiGroups:

367

- cert-manager.io

368

kinds:

369

- CertificateRequest

370

### Cilium internal resources excluded reduce the number of watched events and UI Clutter

371

- apiGroups:

372

- cilium.io

373

kinds:

374

- CiliumIdentity

375

- CiliumEndpoint

376

- CiliumEndpointSlice

377

### Kyverno intermediate and reporting resources excluded reduce the number of watched events and improve performance

378

- apiGroups:

379

- kyverno.io

380

- reports.kyverno.io

381

- wgpolicyk8s.io

382

kinds:

383

- PolicyReport

384

- ClusterPolicyReport

385

- EphemeralReport

386

- ClusterEphemeralReport

387

- AdmissionReport

388

- ClusterAdmissionReport

389

- BackgroundScanReport

390

- ClusterBackgroundScanReport

391

- UpdateRequest

392

# Argo CD configuration parameters

393

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cmd-params-cm.yaml

394

params:

395

# -- Create the argocd-cmd-params-cm configmap

396

# If false, it is expected the configmap will be created by something else.

397

create: true

398

# -- Annotations to be added to the argocd-cmd-params-cm ConfigMap

399

annotations: {}

400

# You can customize parameters by adding parameters here.

401

# (e.g.)

402

# otlp.address: ''

403

# Argo CD RBAC policy configuration

404

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md

405

rbac:

406

# -- Create the argocd-rbac-cm configmap with ([Argo CD RBAC policy]) definitions.

407

# If false, it is expected the configmap will be created by something else.

408

# Argo CD will not work if there is no configmap created with the name above.

409

create: true

410

# -- Annotations to be added to argocd-rbac-cm configmap

411

annotations: {}

412

# -- The name of the default role which Argo CD will falls back to, when authorizing API requests (optional).

413

# If omitted or empty, users may be still be able to login, but will see no apps, projects, etc...

414

policy.default: ""

415

# -- File containing user-defined policies and role definitions.

416

# @default -- `''` (See [values.yaml])

417

policy.csv: ""

418

# Policy rules are in the form:

419

# p, subject, resource, action, object, effect

420

# Role definitions and bindings are in the form:

421

# g, subject, inherited-subject

422

# policy.csv: |

423

# p, role:org-admin, applications, *, */*, allow

424

# p, role:org-admin, clusters, get, *, allow

425

# p, role:org-admin, repositories, *, *, allow

426

# p, role:org-admin, logs, get, *, allow

427

# p, role:org-admin, exec, create, */*, allow

428

# g, your-github-org:your-team, role:org-admin

429

430

# -- OIDC scopes to examine during rbac enforcement (in addition to `sub` scope).

431

# The scope value can be a string, or a list of strings.

432

scopes: "[groups]"

433

# -- Matcher function for Casbin, `glob` for glob matcher and `regex` for regex matcher.

434

policy.matchMode: "glob"

435

# GnuPG public keys for commit verification

436

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/gpg-verification/

437

gpg:

438

# -- Annotations to be added to argocd-gpg-keys-cm configmap

439

annotations: {}

440

# -- [GnuPG] public keys to add to the keyring

441

# @default -- `{}` (See [values.yaml])

442

## Note: Public keys should be exported with `gpg --export --armor <KEY>`

443

keys: {}

444

# 4AEE18F83AFDEB23: |

445

# -----BEGIN PGP PUBLIC KEY BLOCK-----

446

# ...

447

# -----END PGP PUBLIC KEY BLOCK-----

448

# SSH known hosts for Git repositories

449

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#ssh-known-host-public-keys

450

ssh:

451

# -- Specifies if the argocd-ssh-known-hosts-cm configmap should be created by Helm.

452

create: true

453

# -- Annotations to be added to argocd-ssh-known-hosts-cm configmap

454

annotations: {}

455

# -- Known hosts to be added to the known host list by default.

456

# @default -- See [values.yaml]

457

knownHosts: |

458

[ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

459

[ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl

460

[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

461

bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE=

462

bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO

463

bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M=

464

github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

465

github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl

466

github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

467

gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=

468

gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf

469

gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9

470

ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

471

vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

472

# -- Additional known hosts for private repositories

473

extraHosts: ""

474

# Repository TLS certificates

475

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#repositories-using-self-signed-tls-certificates-or-are-signed-by-custom-ca

476

tls:

477

# -- Annotations to be added to argocd-tls-certs-cm configmap

478

annotations: {}

479

# -- TLS certificates for Git repositories

480

# @default -- `{}` (See [values.yaml])

481

certificates: {}

482

# server.example.com: |

483

# -----BEGIN CERTIFICATE-----

484

# ...

485

# -----END CERTIFICATE-----

486

487

# -- Specifies if the argocd-tls-certs-cm configmap should be created by Helm.

488

create: true

489

# ConfigMap for Config Management Plugins

490

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/config-management-plugins/

491

cmp:

492

# -- Create the argocd-cmp-cm configmap

493

create: false

494

# -- Annotations to be added to argocd-cmp-cm configmap

495

annotations: {}

496

# -- Plugin yaml files to be added to argocd-cmp-cm

497

plugins: {}

498

# --- First plugin

499

# my-plugin:

500

# init:

501

# command: [sh]

502

# args: [-c, 'echo "Initializing..."']

503

# generate:

504

# command: [sh, -c]

505

# args:

506

# - |

507

# echo "{\"kind\": \"ConfigMap\", \"apiVersion\": \"v1\", \"metadata\": { \"name\": \"$ARGOCD_APP_NAME\", \"namespace\": \"$ARGOCD_APP_NAMESPACE\", \"annotations\": {\"Foo\": \"$ARGOCD_ENV_FOO\", \"KubeVersion\": \"$KUBE_VERSION\", \"KubeApiVersion\": \"$KUBE_API_VERSIONS\",\"Bar\": \"baz\"}}}"

508

# discover:

509

# fileName: "./subdir/s*.yaml"

510

# find:

511

# glob: "**/Chart.yaml"

512

# command: [sh, -c, find . -name env.yaml]

513

# --- Second plugin

514

# my-plugin2:

515

# init:

516

# command: [sh]

517

# args: [-c, 'echo "Initializing..."']

518

# generate:

519

# command: [sh, -c]

520

# args:

521

# - |

522

523

# discover:

524

# fileName: "./subdir/s*.yaml"

525

# find:

526

# glob: "**/Chart.yaml"

527

# command: [sh, -c, find . -name env.yaml]

528

529

# -- Provide one or multiple [external cluster credentials]

530

# @default -- `{}` (See [values.yaml])

531

## Ref:

532

## - https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters

533

## - https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#external-cluster-credentials

534

## - https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#project-scoped-repositories-and-clusters

535

clusterCredentials: {}

536

# mycluster:

537

# server: https://mycluster.example.com

538

# labels: {}

539

# annotations: {}

540

# config:

541

# bearerToken: "<authentication token>"

542

# tlsClientConfig:

543

# insecure: false

544

# caData: "<base64 encoded certificate>"

545

# mycluster2:

546

# server: https://mycluster2.example.com

547

# labels: {}

548

# annotations: {}

549

# namespaces: namespace1,namespace2

550

# clusterResources: true

551

# config:

552

# bearerToken: "<authentication token>"

553

# tlsClientConfig:

554

# insecure: false

555

# caData: "<base64 encoded certificate>"

556

# mycluster3-project-scoped:

557

# server: https://mycluster3.example.com

558

# labels: {}

559

# annotations: {}

560

# project: my-project1

561

# config:

562

# bearerToken: "<authentication token>"

563

# tlsClientConfig:

564

# insecure: false

565

# caData: "<base64 encoded certificate>"

566

# mycluster4-sharded:

567

# shard: 1

568

# server: https://mycluster4.example.com

569

# labels: {}

570

# annotations: {}

571

# config:

572

# bearerToken: "<authentication token>"

573

# tlsClientConfig:

574

# insecure: false

575

# caData: "<base64 encoded certificate>"

576

577

# -- Repository credentials to be used as Templates for other repos

578

## Creates a secret for each key/value specified below to create repository credentials

579

credentialTemplates: {}

580

# github-enterprise-creds-1:

581

# url: https://github.com/argoproj

582

# githubAppID: 1

583

# githubAppInstallationID: 2

584

# githubAppEnterpriseBaseUrl: https://ghe.example.com/api/v3

585

# githubAppPrivateKey: |

586

# -----BEGIN OPENSSH PRIVATE KEY-----

587

# ...

588

# -----END OPENSSH PRIVATE KEY-----

589

# https-creds:

590

# url: https://github.com/argoproj

591

# password: my-password

592

# username: my-username

593

# ssh-creds:

594

# url: git@github.com:argoproj-labs

595

# sshPrivateKey: |

596

# -----BEGIN OPENSSH PRIVATE KEY-----

597

# ...

598

# -----END OPENSSH PRIVATE KEY-----

599

600

# -- Annotations to be added to `configs.credentialTemplates` Secret

601

credentialTemplatesAnnotations: {}

602

# -- Repositories list to be used by applications

603

## Creates a secret for each key/value specified below to create repositories

604

## Note: the last example in the list would use a repository credential template, configured under "configs.credentialTemplates".

605

repositories: {}

606

# istio-helm-repo:

607

# url: https://storage.googleapis.com/istio-prerelease/daily-build/master-latest-daily/charts

608

# name: istio.io

609

# type: helm

610

# private-helm-repo:

611

# url: https://my-private-chart-repo.internal

612

# name: private-repo

613

# type: helm

614

# password: my-password

615

# username: my-username

616

# private-repo:

617

# url: https://github.com/argoproj/private-repo

618

619

# -- Annotations to be added to `configs.repositories` Secret

620

repositoriesAnnotations: {}

621

# Argo CD sensitive data

622

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets

623

secret:

624

# -- Create the argocd-secret

625

createSecret: true

626

# -- Labels to be added to argocd-secret

627

labels: {}

628

# -- Annotations to be added to argocd-secret

629

annotations: {}

630

# -- Shared secret for authenticating GitHub webhook events

631

githubSecret: ""

632

# -- Shared secret for authenticating GitLab webhook events

633

gitlabSecret: ""

634

# -- Shared secret for authenticating BitbucketServer webhook events

635

bitbucketServerSecret: ""

636

# -- UUID for authenticating Bitbucket webhook events

637

bitbucketUUID: ""

638

# -- Shared secret for authenticating Gogs webhook events

639

gogsSecret: ""

640

## Azure DevOps

641

azureDevops:

642

# -- Shared secret username for authenticating Azure DevOps webhook events

643

username: ""

644

# -- Shared secret password for authenticating Azure DevOps webhook events

645

password: ""

646

# -- add additional secrets to be added to argocd-secret

647

## Custom secrets. Useful for injecting SSO secrets into environment variables.

648

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets

649

## Note that all values must be non-empty.

650

extra: {}

651

# LDAP_PASSWORD: "mypassword"

652

653

# -- Bcrypt hashed admin password

654

## Argo expects the password in the secret to be bcrypt hashed. You can create this hash with

655

## `htpasswd -nbBC 10 "" $ARGO_PWD | tr -d ':\n' | sed 's/$2y/$2a/'`

656

argocdServerAdminPassword: ""

657

# -- Admin password modification time. Eg. `"2006-01-02T15:04:05Z"`

658

# @default -- `""` (defaults to current time)

659

argocdServerAdminPasswordMtime: ""

660

# -- Define custom [CSS styles] for your argo instance.

661

# This setting will automatically mount the provided CSS and reference it in the argo configuration.

662

# @default -- `""` (See [values.yaml])

663

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/custom-styles/

664

styles: ""

665

# styles: |

666

# .sidebar {

667

# background: linear-gradient(to bottom, #999, #777, #333, #222, #111);

668

# }

669

# -- Array of extra K8s manifests to deploy

670

## Note: Supports use of custom Helm templates

671

extraObjects: []

672

# - apiVersion: secrets-store.csi.x-k8s.io/v1

673

# kind: SecretProviderClass

674

# metadata:

675

# name: argocd-secrets-store

676

# spec:

677

# provider: aws

678

# parameters:

679

# objects: |

680

# - objectName: "argocd"

681

# objectType: "secretsmanager"

682

# jmesPath:

683

# - path: "client_id"

684

# objectAlias: "client_id"

685

# - path: "client_secret"

686

# objectAlias: "client_secret"

687

# secretObjects:

688

# - data:

689

# - key: client_id

690

# objectName: client_id

691

# - key: client_secret

692

# objectName: client_secret

693

# secretName: argocd-secrets-store

694

# type: Opaque

695

# labels:

696

# app.kubernetes.io/part-of: argocd

697

698

## Application controller

699

controller:

700

# -- Application controller name string

701

702

# -- The number of application controller pods to run.

703

# Additional replicas will cause sharding of managed clusters across number of replicas.

704

## With dynamic cluster distribution turned on, sharding of the clusters will gracefully

705

## rebalance if the number of replica's changes or one becomes unhealthy. (alpha)

706

replicas: 1

707

# -- Enable dynamic cluster distribution (alpha)

708

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution

709

## This is done using a deployment instead of a statefulSet

710

## When replicas are added or removed, the sharding algorithm is re-run to ensure that the

711

## clusters are distributed according to the algorithm. If the algorithm is well-balanced,

712

## like round-robin, then the shards will be well-balanced.

713

dynamicClusterDistribution: false

714

# -- Runtime class name for the application controller

715

# @default -- `""` (defaults to global.runtimeClassName)

716

runtimeClassName: ""

717

# -- Application controller heartbeat time

718

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution/#working-of-dynamic-distribution

719

heartbeatTime: 10

720

# -- Maximum number of controller revisions that will be maintained in StatefulSet history

721

revisionHistoryLimit: 5

722

## Application controller Pod Disruption Budget

723

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

724

pdb:

725

# -- Deploy a [PodDisruptionBudget] for the application controller

726

enabled: false

727

# -- Labels to be added to application controller pdb

728

labels: {}

729

# -- Annotations to be added to application controller pdb

730

annotations: {}

731

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

732

# @default -- `""` (defaults to 0 if not specified)

733

minAvailable: ""

734

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

735

## Has higher precedence over `controller.pdb.minAvailable`

736

maxUnavailable: ""

737

## Application controller Vertical Pod Autoscaler

738

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

739

vpa:

740

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the application controller

741

enabled: false

742

# -- Labels to be added to application controller vpa

743

labels: {}

744

# -- Annotations to be added to application controller vpa

745

annotations: {}

746

# -- One of the VPA operation modes

747

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

748

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

749

updateMode: Initial

750

# -- Controls how VPA computes the recommended resources for application controller container

751

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

752

containerPolicy: {}

753

# controlledResources: ["cpu", "memory"]

754

# minAllowed:

755

# cpu: 250m

756

# memory: 256Mi

757

# maxAllowed:

758

# cpu: 1

759

# memory: 1Gi

760

## Application controller image

761

image:

762

# -- Repository to use for the application controller

763

# @default -- `""` (defaults to global.image.repository)

764

repository: ""

765

# -- Tag to use for the application controller

766

# @default -- `""` (defaults to global.image.tag)

767

tag: ""

768

# -- Image pull policy for the application controller

769

# @default -- `""` (defaults to global.image.imagePullPolicy)

770

imagePullPolicy: ""

771

# -- Secrets with credentials to pull images from a private registry

772

# @default -- `[]` (defaults to global.imagePullSecrets)

773

imagePullSecrets: []

774

# -- Additional command line arguments to pass to application controller

775

extraArgs: []

776

# -- Environment variables to pass to application controller

777

env: []

778

# -- envFrom to pass to application controller

779

# @default -- `[]` (See [values.yaml])

780

envFrom: []

781

# - configMapRef:

782

# name: config-map-name

783

# - secretRef:

784

# name: secret-name

785

786

# -- Additional containers to be added to the application controller pod

787

## Note: Supports use of custom Helm templates

788

extraContainers: []

789

# -- Init containers to add to the application controller pod

790

## If your target Kubernetes cluster(s) require a custom credential (exec) plugin

791

## you could use this (and the same in the server pod) to provide such executable

792

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

793

## Note: Supports use of custom Helm templates

794

initContainers: []

795

# - name: download-tools

796

# image: alpine:3

797

# command: [sh, -c]

798

# args:

799

# - wget -qO /custom-tools/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.7/kubelogin-linux-amd64.zip &&

800

# mkdir /custom-tools/tmp && unzip -d /custom-tools/tmp /custom-tools/kubelogin.zip &&

801

# mv /custom-tools/tmp/bin/linux_amd64/kubelogin /custom-tools/ && rm -rf custom-tools/tmp && rm /custom-tools/kubelogin.zip

802

# volumeMounts:

803

# - mountPath: /custom-tools

804

# name: custom-tools

805

806

# -- Additional volumeMounts to the application controller main container

807

volumeMounts: []

808

# - mountPath: /usr/local/bin/kubelogin

809

# name: custom-tools

810

# subPath: kubelogin

811

812

# -- Additional volumes to the application controller pod

813

volumes: []

814

# - name: custom-tools

815

# emptyDir: {}

816

817

## Application controller emptyDir volumes

818

emptyDir:

819

# -- EmptyDir size limit for application controller

820

# @default -- `""` (defaults not set if not specified i.e. no size limit)

821

sizeLimit: ""

822

# sizeLimit: "1Gi"

823

# -- Annotations for the application controller StatefulSet

824

statefulsetAnnotations: {}

825

# -- Labels for the application controller StatefulSet

826

statefulsetLabels: {}

827

# -- Annotations for the application controller Deployment

828

deploymentAnnotations: {}

829

# -- Labels for the application controller Deployment

830

deploymentLabels: {}

831

# -- Annotations to be added to application controller pods

832

podAnnotations: {}

833

# -- Labels to be added to application controller pods

834

podLabels: {}

835

# -- Resource limits and requests for the application controller pods

836

resources: {}

837

# limits:

838

# cpu: 500m

839

# memory: 512Mi

840

# requests:

841

# cpu: 250m

842

# memory: 256Mi

843

844

# Application controller container ports

845

containerPorts:

846

# -- Metrics container port

847

metrics: 8082

848

# -- Host Network for application controller pods

849

hostNetwork: false

850

# -- [DNS configuration]

851

dnsConfig: {}

852

# -- Alternative DNS policy for application controller pods

853

dnsPolicy: "ClusterFirst"

854

# -- Application controller container-level security context

855

# @default -- See [values.yaml]

856

containerSecurityContext:

857

runAsNonRoot: true

858

readOnlyRootFilesystem: true

859

allowPrivilegeEscalation: false

860

seccompProfile:

861

type: RuntimeDefault

862

capabilities:

863

drop:

864

- ALL

865

# Readiness probe for application controller

866

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

867

readinessProbe:

868

# -- Http path to use for the readiness probe

869

httpPath: /healthz

870

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

871

failureThreshold: 3

872

# -- Number of seconds after the container has started before [probe] is initiated

873

initialDelaySeconds: 10

874

# -- How often (in seconds) to perform the [probe]

875

periodSeconds: 10

876

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

877

successThreshold: 1

878

# -- Number of seconds after which the [probe] times out

879

timeoutSeconds: 1

880

## Startup probe for application controller (optional)

881

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

882

startupProbe:

883

# -- Enable Kubernetes startup probe for application controller

884

enabled: false

885

# -- Http path to use for the startup probe

886

httpPath: /healthz

887

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

888

failureThreshold: 20

889

# -- Number of seconds after the container has started before [probe] is initiated

890

initialDelaySeconds: 10

891

# -- How often (in seconds) to perform the [probe]

892

periodSeconds: 10

893

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

894

successThreshold: 1

895

# -- Number of seconds after which the [probe] times out

896

timeoutSeconds: 1

897

# -- terminationGracePeriodSeconds for container lifecycle hook

898

terminationGracePeriodSeconds: 30

899

# -- Priority class for the application controller pods

900

# @default -- `""` (defaults to global.priorityClassName)

901

priorityClassName: ""

902

# -- [Node selector]

903

# @default -- `{}` (defaults to global.nodeSelector)

904

nodeSelector: {}

905

# -- [Tolerations] for use with node taints

906

# @default -- `[]` (defaults to global.tolerations)

907

tolerations: []

908

# -- Assign custom [affinity] rules to the deployment

909

# @default -- `{}` (defaults to global.affinity preset)

910

affinity: {}

911

# -- Assign custom [TopologySpreadConstraints] rules to the application controller

912

# @default -- `[]` (defaults to global.topologySpreadConstraints)

913

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

914

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

915

topologySpreadConstraints: []

916

# - maxSkew: 1

917

# topologyKey: topology.kubernetes.io/zone

918

# whenUnsatisfiable: DoNotSchedule

919

920

# -- Automount API credentials for the Service Account into the pod.

921

automountServiceAccountToken: true

922

serviceAccount:

923

# -- Create a service account for the application controller

924

create: true

925

# -- Service account name

926

927

# -- Annotations applied to created service account

928

annotations: {}

929

# -- Labels applied to created service account

930

labels: {}

931

# -- Automount API credentials for the Service Account

932

automountServiceAccountToken: true

933

## Application controller metrics configuration

934

metrics:

935

# -- Deploy metrics service

936

enabled: false

937

applicationLabels:

938

# -- Enables additional labels in argocd_app_labels metric

939

enabled: false

940

# -- Additional labels

941

labels: []

942

service:

943

# -- Metrics service type

944

type: ClusterIP

945

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

946

clusterIP: ""

947

# -- Metrics service annotations

948

annotations: {}

949

# -- Metrics service labels

950

labels: {}

951

# -- Metrics service port

952

servicePort: 8082

953

# -- Metrics service port name

954

portName: http-metrics

955

serviceMonitor:

956

# -- Enable a prometheus ServiceMonitor

957

enabled: false

958

# -- Prometheus ServiceMonitor interval

959

interval: 30s

960

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

961

scrapeTimeout: ""

962

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

963

honorLabels: false

964

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

965

relabelings: []

966

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

967

metricRelabelings: []

968

# -- Prometheus ServiceMonitor selector

969

selector: {}

970

# prometheus: kube-prometheus

971

972

# -- Prometheus ServiceMonitor scheme

973

scheme: ""

974

# -- Prometheus ServiceMonitor tlsConfig

975

tlsConfig: {}

976

# -- Prometheus ServiceMonitor namespace

977

namespace: "" # "monitoring"

978

# -- Prometheus ServiceMonitor labels

979

additionalLabels: {}

980

# -- Prometheus ServiceMonitor annotations

981

annotations: {}

982

rules:

983

# -- Deploy a PrometheusRule for the application controller

984

enabled: false

985

# -- PrometheusRule namespace

986

namespace: "" # "monitoring"

987

# -- PrometheusRule selector

988

selector: {}

989

# prometheus: kube-prometheus

990

991

# -- PrometheusRule labels

992

additionalLabels: {}

993

# -- PrometheusRule annotations

994

annotations: {}

995

# -- PrometheusRule.Spec for the application controller

996

spec: []

997

# - alert: ArgoAppMissing

998

# expr: |

999

# absent(argocd_app_info) == 1

1000

# for: 15m

1001

# labels:

1002

# severity: critical

1003

# annotations:

1004

# summary: "[Argo CD] No reported applications"

1005

# description: >

1006

# Argo CD has not reported any applications data for the past 15 minutes which

1007

# means that it must be down or not functioning properly. This needs to be

1008

# resolved for this cloud to continue to maintain state.

1009

# - alert: ArgoAppNotSynced

1010

# expr: |

1011

# argocd_app_info{sync_status!="Synced"} == 1

1012

# for: 12h

1013

# labels:

1014

# severity: warning

1015

# annotations:

1016

# summary: "[{{ $labels.name }}] Application not synchronized"

1017

# description: >

1018

# The application {{ $labels.name }} has not been synchronized for over

1019

# 12 hours which means that the state of this cloud has drifted away from the

1020

# state inside Git.

1021

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

1022

## Defaults to off

1023

clusterRoleRules:

1024

# -- Enable custom rules for the application controller's ClusterRole resource

1025

enabled: false

1026

# -- List of custom rules for the application controller's ClusterRole resource

1027

rules: []

1028

## Enable this and set the rules: to whatever custom rules you want for the Role resource.

1029

## Defaults to off

1030

# -- List of custom rules for the application controller's Role resource

1031

roleRules: []

1032

# Default application controller's network policy

1033

networkPolicy:

1034

# -- Default network policy rules used by application controller

1035

# @default -- `false` (defaults to global.networkPolicy.create)

1036

create: false

1037

## Dex

1038

dex:

1039

# -- Enable dex

1040

enabled: true

1041

# -- Dex name

1042

1043

# -- Additional command line arguments to pass to the Dex server

1044

extraArgs: []

1045

# -- Runtime class name for Dex

1046

# @default -- `""` (defaults to global.runtimeClassName)

1047

runtimeClassName: ""

1048

metrics:

1049

# -- Deploy metrics service

1050

enabled: false

1051

service:

1052

# -- Metrics service annotations

1053

annotations: {}

1054

# -- Metrics service labels

1055

labels: {}

1056

# -- Metrics service port name

1057

portName: http-metrics

1058

serviceMonitor:

1059

# -- Enable a prometheus ServiceMonitor

1060

enabled: false

1061

# -- Prometheus ServiceMonitor interval

1062

interval: 30s

1063

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1064

honorLabels: false

1065

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1066

relabelings: []

1067

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1068

metricRelabelings: []

1069

# -- Prometheus ServiceMonitor selector

1070

selector: {}

1071

# prometheus: kube-prometheus

1072

1073

# -- Prometheus ServiceMonitor scheme

1074

scheme: ""

1075

# -- Prometheus ServiceMonitor tlsConfig

1076

tlsConfig: {}

1077

# -- Prometheus ServiceMonitor namespace

1078

namespace: "" # "monitoring"

1079

# -- Prometheus ServiceMonitor labels

1080

additionalLabels: {}

1081

# -- Prometheus ServiceMonitor annotations

1082

annotations: {}

1083

## Dex Pod Disruption Budget

1084

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1085

pdb:

1086

# -- Deploy a [PodDisruptionBudget] for the Dex server

1087

enabled: false

1088

# -- Labels to be added to Dex server pdb

1089

labels: {}

1090

# -- Annotations to be added to Dex server pdb

1091

annotations: {}

1092

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1093

# @default -- `""` (defaults to 0 if not specified)

1094

minAvailable: ""

1095

# -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%).

1096

## Has higher precedence over `dex.pdb.minAvailable`

1097

maxUnavailable: ""

1098

## Dex Vertical Pod Autoscaler

1099

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1100

vpa:

1101

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Dex server

1102

enabled: false

1103

# -- Labels to be added to Dex server vpa

1104

labels: {}

1105

# -- Annotations to be added to Dex server vpa

1106

annotations: {}

1107

# -- One of the VPA operation modes

1108

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1109

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1110

updateMode: Initial

1111

# -- Controls how VPA computes the recommended resources for Dex server container

1112

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1113

containerPolicy: {}

1114

# controlledResources: ["cpu", "memory"]

1115

# minAllowed:

1116

# cpu: 250m

1117

# memory: 256Mi

1118

# maxAllowed:

1119

# cpu: 1

1120

# memory: 1Gi

1121

## Dex image

1122

image:

1123

# -- Dex image repository

1124

repository: cgr.dev/chainguard-private/dex

1125

# -- Dex image tag

1126

tag: latest@sha256:38b0ba7b4e31ba04a8705cd0fe448079c711bfe17217ae1fc153060d3b9f31d3

1127

# -- Dex imagePullPolicy

1128

# @default -- `""` (defaults to global.image.imagePullPolicy)

1129

imagePullPolicy: ""

1130

# -- Secrets with credentials to pull images from a private registry

1131

# @default -- `[]` (defaults to global.imagePullSecrets)

1132

imagePullSecrets: []

1133

# Argo CD init image that creates Dex config

1134

initImage:

1135

# -- Argo CD init image repository

1136

# @default -- `""` (defaults to global.image.repository)

1137

repository: ""

1138

# -- Argo CD init image tag

1139

# @default -- `""` (defaults to global.image.tag)

1140

tag: ""

1141

# -- Argo CD init image imagePullPolicy

1142

# @default -- `""` (defaults to global.image.imagePullPolicy)

1143

imagePullPolicy: ""

1144

# -- Argo CD init image resources

1145

# @default -- `{}` (defaults to dex.resources)

1146

resources: {}

1147

# requests:

1148

# cpu: 5m

1149

# memory: 96Mi

1150

# limits:

1151

# cpu: 10m

1152

# memory: 144Mi

1153

# -- Environment variables to pass to the Dex server

1154

env: []

1155

# -- envFrom to pass to the Dex server

1156

# @default -- `[]` (See [values.yaml])

1157

envFrom: []

1158

# - configMapRef:

1159

# name: config-map-name

1160

# - secretRef:

1161

# name: secret-name

1162

1163

# -- Additional containers to be added to the dex pod

1164

## Note: Supports use of custom Helm templates

1165

extraContainers: []

1166

# -- Init containers to add to the dex pod

1167

## Note: Supports use of custom Helm templates

1168

initContainers: []

1169

# -- Additional volumeMounts to the dex main container

1170

volumeMounts: []

1171

# -- Additional volumes to the dex pod

1172

volumes: []

1173

## Dex server emptyDir volumes

1174

emptyDir:

1175

# -- EmptyDir size limit for Dex server

1176

# @default -- `""` (defaults not set if not specified i.e. no size limit)

1177

sizeLimit: ""

1178

# sizeLimit: "1Gi"

1179

# TLS certificate configuration via Secret

1180

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-dex-server

1181

## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart Dex automatically without extra controllers.

1182

certificateSecret:

1183

# -- Create argocd-dex-server-tls secret

1184

enabled: false

1185

# -- Labels to be added to argocd-dex-server-tls secret

1186

labels: {}

1187

# -- Annotations to be added to argocd-dex-server-tls secret

1188

annotations: {}

1189

# -- Certificate authority. Required for self-signed certificates.

1190

ca: ""

1191

# -- Certificate private key

1192

key: ""

1193

# -- Certificate data. Must contain SANs of Dex service (ie: argocd-dex-server, argocd-dex-server.argo-cd.svc)

1194

crt: ""

1195

# -- Annotations to be added to the Dex server Deployment

1196

deploymentAnnotations: {}

1197

# -- Labels for the Dex server Deployment

1198

deploymentLabels: {}

1199

# -- Annotations to be added to the Dex server pods

1200

podAnnotations: {}

1201

# -- Labels to be added to the Dex server pods

1202

podLabels: {}

1203

# -- Resource limits and requests for dex

1204

resources: {}

1205

# limits:

1206

# cpu: 50m

1207

# memory: 64Mi

1208

# requests:

1209

# cpu: 10m

1210

# memory: 32Mi

1211

1212

# Dex container ports

1213

# NOTE: These ports are currently hardcoded and cannot be changed

1214

containerPorts:

1215

# -- HTTP container port

1216

http: 5556

1217

# -- gRPC container port

1218

grpc: 5557

1219

# -- Metrics container port

1220

metrics: 5558

1221

# -- [DNS configuration]

1222

dnsConfig: {}

1223

# -- Alternative DNS policy for Dex server pods

1224

dnsPolicy: "ClusterFirst"

1225

# -- Dex container-level security context

1226

# @default -- See [values.yaml]

1227

containerSecurityContext:

1228

runAsNonRoot: true

1229

runAsUser: 1001

1230

readOnlyRootFilesystem: true

1231

allowPrivilegeEscalation: false

1232

seccompProfile:

1233

type: RuntimeDefault

1234

capabilities:

1235

drop:

1236

- ALL

1237

## Probes for Dex server

1238

## Supported from Dex >= 2.28.0

1239

livenessProbe:

1240

# -- Enable Kubernetes liveness probe for Dex >= 2.28.0

1241

enabled: false

1242

# -- Http path to use for the liveness probe

1243

httpPath: /healthz/live

1244

# -- Http port to use for the liveness probe

1245

httpPort: metrics

1246

# -- Scheme to use for for the liveness probe (can be HTTP or HTTPS)

1247

httpScheme: HTTP

1248

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1249

failureThreshold: 3

1250

# -- Number of seconds after the container has started before [probe] is initiated

1251

initialDelaySeconds: 10

1252

# -- How often (in seconds) to perform the [probe]

1253

periodSeconds: 10

1254

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1255

successThreshold: 1

1256

# -- Number of seconds after which the [probe] times out

1257

timeoutSeconds: 1

1258

readinessProbe:

1259

# -- Enable Kubernetes readiness probe for Dex >= 2.28.0

1260

enabled: false

1261

# -- Http path to use for the readiness probe

1262

httpPath: /healthz/ready

1263

# -- Http port to use for the readiness probe

1264

httpPort: metrics

1265

# -- Scheme to use for for the liveness probe (can be HTTP or HTTPS)

1266

httpScheme: HTTP

1267

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1268

failureThreshold: 3

1269

# -- Number of seconds after the container has started before [probe] is initiated

1270

initialDelaySeconds: 10

1271

# -- How often (in seconds) to perform the [probe]

1272

periodSeconds: 10

1273

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1274

successThreshold: 1

1275

# -- Number of seconds after which the [probe] times out

1276

timeoutSeconds: 1

1277

## Startup probe for Dex server (optional)

1278

## Supported from Dex >= 2.28.0

1279

startupProbe:

1280

# -- Enable Kubernetes startup probe for Dex >= 2.28.0

1281

enabled: false

1282

# -- Http path to use for the startup probe

1283

httpPath: /healthz/ready

1284

# -- Http port to use for the startup probe

1285

httpPort: metrics

1286

# -- Scheme to use for the startup probe (can be HTTP or HTTPS)

1287

httpScheme: HTTP

1288

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1289

failureThreshold: 20

1290

# -- Number of seconds after the container has started before [probe] is initiated

1291

initialDelaySeconds: 10

1292

# -- How often (in seconds) to perform the [probe]

1293

periodSeconds: 10

1294

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1295

successThreshold: 1

1296

# -- Number of seconds after which the [probe] times out

1297

timeoutSeconds: 1

1298

# -- terminationGracePeriodSeconds for container lifecycle hook

1299

terminationGracePeriodSeconds: 30

1300

# -- Automount API credentials for the Service Account into the pod.

1301

automountServiceAccountToken: true

1302

serviceAccount:

1303

# -- Create dex service account

1304

create: true

1305

# -- Dex service account name

1306

1307

# -- Annotations applied to created service account

1308

annotations: {}

1309

# -- Automount API credentials for the Service Account

1310

automountServiceAccountToken: true

1311

# -- Service port for HTTP access

1312

servicePortHttp: 5556

1313

# -- Service port name for HTTP access

1314

servicePortHttpName: http

1315

# -- Service port for gRPC access

1316

servicePortGrpc: 5557

1317

# -- Service port name for gRPC access

1318

servicePortGrpcName: grpc

1319

# -- Service port for metrics access

1320

servicePortMetrics: 5558

1321

# -- Priority class for the dex pods

1322

# @default -- `""` (defaults to global.priorityClassName)

1323

priorityClassName: ""

1324

# -- [Node selector]

1325

# @default -- `{}` (defaults to global.nodeSelector)

1326

nodeSelector: {}

1327

# -- [Tolerations] for use with node taints

1328

# @default -- `[]` (defaults to global.tolerations)

1329

tolerations: []

1330

# -- Assign custom [affinity] rules to the deployment

1331

# @default -- `{}` (defaults to global.affinity preset)

1332

affinity: {}

1333

# -- Assign custom [TopologySpreadConstraints] rules to dex

1334

# @default -- `[]` (defaults to global.topologySpreadConstraints)

1335

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1336

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

1337

topologySpreadConstraints: []

1338

# - maxSkew: 1

1339

# topologyKey: topology.kubernetes.io/zone

1340

# whenUnsatisfiable: DoNotSchedule

1341

1342

# -- Deployment strategy to be added to the Dex server Deployment

1343

deploymentStrategy: {}

1344

# type: RollingUpdate

1345

# rollingUpdate:

1346

# maxSurge: 25%

1347

# maxUnavailable: 25%

1348

1349

# Default Dex server's network policy

1350

networkPolicy:

1351

# -- Default network policy rules used by Dex server

1352

# @default -- `false` (defaults to global.networkPolicy.create)

1353

create: false

1354

# DEPRECATED - Use configs.params to override

1355

# -- Dex log format. Either `text` or `json`

1356

# @default -- `""` (defaults to global.logging.format)

1357

# logFormat: ""

1358

# -- Dex log level. One of: `debug`, `info`, `warn`, `error`

1359

# @default -- `""` (defaults to global.logging.level)

1360

# logLevel: ""

1361

## Redis

1362

redis:

1363

# -- Enable redis

1364

enabled: true

1365

# -- Redis name

1366

1367

# -- Runtime class name for redis

1368

# @default -- `""` (defaults to global.runtimeClassName)

1369

runtimeClassName: ""

1370

## Redis Pod Disruption Budget

1371

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1372

pdb:

1373

# -- Deploy a [PodDisruptionBudget] for the Redis

1374

enabled: false

1375

# -- Labels to be added to Redis pdb

1376

labels: {}

1377

# -- Annotations to be added to Redis pdb

1378

annotations: {}

1379

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1380

# @default -- `""` (defaults to 0 if not specified)

1381

minAvailable: ""

1382

# -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%).

1383

## Has higher precedence over `redis.pdb.minAvailable`

1384

maxUnavailable: ""

1385

## Redis Vertical Pod Autoscaler

1386

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1387

vpa:

1388

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Redis

1389

enabled: false

1390

# -- Labels to be added to Redis vpa

1391

labels: {}

1392

# -- Annotations to be added to Redis vpa

1393

annotations: {}

1394

# -- One of the VPA operation modes

1395

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1396

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1397

updateMode: Initial

1398

# -- Controls how VPA computes the recommended resources for Redis container

1399

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1400

containerPolicy: {}

1401

# controlledResources: ["cpu", "memory"]

1402

# minAllowed:

1403

# cpu: 250m

1404

# memory: 256Mi

1405

# maxAllowed:

1406

# cpu: 1

1407

# memory: 1Gi

1408

## Redis image

1409

image:

1410

# -- Redis repository

1411

repository: cgr.dev/chainguard-private/redis

1412

# -- Redis tag

1413

## Do not use 7.4.0 <= v < 8.0.0, otherwise you are no longer using an open source version of Redis

1414

tag: latest@sha256:a16616c759f9b177f7b21908969d2b64c1fc2a1b2ad243e3145de8814d8a787f

1415

# -- Redis image pull policy

1416

# @default -- `""` (defaults to global.image.imagePullPolicy)

1417

imagePullPolicy: ""

1418

## Prometheus redis-exporter sidecar

1419

exporter:

1420

# -- Enable Prometheus redis-exporter sidecar

1421

enabled: false

1422

# -- Environment variables to pass to the Redis exporter

1423

env: []

1424

## Prometheus redis-exporter image

1425

image:

1426

# -- Repository to use for the redis-exporter

1427

repository: cgr.dev/chainguard-private/prometheus-redis-exporter

1428

# -- Tag to use for the redis-exporter

1429

tag: latest@sha256:7241d0bbff3a7d3cee7db908d0b733e965692d1012c906919cf2a0bdf31c5e33

1430

# -- Image pull policy for the redis-exporter

1431

# @default -- `""` (defaults to global.image.imagePullPolicy)

1432

imagePullPolicy: ""

1433

# -- Redis exporter security context

1434

# @default -- See [values.yaml]

1435

containerSecurityContext:

1436

runAsNonRoot: true

1437

readOnlyRootFilesystem: true

1438

allowPrivilegeEscalation: false

1439

seccompProfile:

1440

type: RuntimeDefault

1441

capabilities:

1442

drop:

1443

- ALL

1444

## Probes for Redis exporter (optional)

1445

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

1446

readinessProbe:

1447

# -- Enable Kubernetes liveness probe for Redis exporter (optional)

1448

enabled: false

1449

# -- Number of seconds after the container has started before [probe] is initiated

1450

initialDelaySeconds: 30

1451

# -- How often (in seconds) to perform the [probe]

1452

periodSeconds: 15

1453

# -- Number of seconds after which the [probe] times out

1454

timeoutSeconds: 15

1455

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1456

successThreshold: 1

1457

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1458

failureThreshold: 5

1459

livenessProbe:

1460

# -- Enable Kubernetes liveness probe for Redis exporter

1461

enabled: false

1462

# -- Number of seconds after the container has started before [probe] is initiated

1463

initialDelaySeconds: 30

1464

# -- How often (in seconds) to perform the [probe]

1465

periodSeconds: 15

1466

# -- Number of seconds after which the [probe] times out

1467

timeoutSeconds: 15

1468

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1469

successThreshold: 1

1470

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1471

failureThreshold: 5

1472

# -- Resource limits and requests for redis-exporter sidecar

1473

resources: {}

1474

# limits:

1475

# cpu: 50m

1476

# memory: 64Mi

1477

# requests:

1478

# cpu: 10m

1479

# memory: 32Mi

1480

# -- Secrets with credentials to pull images from a private registry

1481

# @default -- `[]` (defaults to global.imagePullSecrets)

1482

imagePullSecrets: []

1483

# -- Additional command line arguments to pass to redis-server

1484

extraArgs: []

1485

# - --bind

1486

# - "0.0.0.0"

1487

1488

# -- Environment variables to pass to the Redis server

1489

env: []

1490

# -- envFrom to pass to the Redis server

1491

# @default -- `[]` (See [values.yaml])

1492

envFrom: []

1493

# - configMapRef:

1494

# name: config-map-name

1495

# - secretRef:

1496

# name: secret-name

1497

1498

## Probes for Redis server (optional)

1499

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

1500

readinessProbe:

1501

# -- Enable Kubernetes liveness probe for Redis server

1502

enabled: false

1503

# -- Number of seconds after the container has started before [probe] is initiated

1504

initialDelaySeconds: 30

1505

# -- How often (in seconds) to perform the [probe]

1506

periodSeconds: 15

1507

# -- Number of seconds after which the [probe] times out

1508

timeoutSeconds: 15

1509

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1510

successThreshold: 1

1511

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1512

failureThreshold: 5

1513

livenessProbe:

1514

# -- Enable Kubernetes liveness probe for Redis server

1515

enabled: false

1516

# -- Number of seconds after the container has started before [probe] is initiated

1517

initialDelaySeconds: 30

1518

# -- How often (in seconds) to perform the [probe]

1519

periodSeconds: 15

1520

# -- Number of seconds after which the [probe] times out

1521

timeoutSeconds: 15

1522

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1523

successThreshold: 1

1524

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1525

failureThreshold: 5

1526

# -- Additional containers to be added to the redis pod

1527

## Note: Supports use of custom Helm templates

1528

extraContainers: []

1529

# -- Init containers to add to the redis pod

1530

## Note: Supports use of custom Helm templates

1531

initContainers: []

1532

# -- Additional volumeMounts to the redis container

1533

volumeMounts: []

1534

# -- Additional volumes to the redis pod

1535

volumes: []

1536

# -- Annotations to be added to the Redis server Deployment

1537

deploymentAnnotations: {}

1538

# -- Labels for the Redis server Deployment

1539

deploymentLabels: {}

1540

# -- Annotations to be added to the Redis server pods

1541

podAnnotations: {}

1542

# -- Labels to be added to the Redis server pods

1543

podLabels: {}

1544

# -- Resource limits and requests for redis

1545

resources: {}

1546

# limits:

1547

# cpu: 200m

1548

# memory: 128Mi

1549

# requests:

1550

# cpu: 100m

1551

# memory: 64Mi

1552

1553

# -- Redis pod-level security context

1554

# @default -- See [values.yaml]

1555

securityContext:

1556

runAsNonRoot: true

1557

runAsUser: 999

1558

seccompProfile:

1559

type: RuntimeDefault

1560

# Redis container ports

1561

containerPorts:

1562

# -- Redis container port

1563

redis: 6379

1564

# -- Metrics container port

1565

metrics: 9121

1566

# -- [DNS configuration]

1567

dnsConfig: {}

1568

# -- Alternative DNS policy for Redis server pods

1569

dnsPolicy: "ClusterFirst"

1570

# -- Redis container-level security context

1571

# @default -- See [values.yaml]

1572

containerSecurityContext:

1573

readOnlyRootFilesystem: true

1574

allowPrivilegeEscalation: false

1575

capabilities:

1576

drop:

1577

- ALL

1578

# -- Redis service port

1579

servicePort: 6379

1580

# -- Priority class for redis pods

1581

# @default -- `""` (defaults to global.priorityClassName)

1582

priorityClassName: ""

1583

# -- [Node selector]

1584

# @default -- `{}` (defaults to global.nodeSelector)

1585

nodeSelector: {}

1586

# -- [Tolerations] for use with node taints

1587

# @default -- `[]` (defaults to global.tolerations)

1588

tolerations: []

1589

# -- Assign custom [affinity] rules to the deployment

1590

# @default -- `{}` (defaults to global.affinity preset)

1591

affinity: {}

1592

# -- Assign custom [TopologySpreadConstraints] rules to redis

1593

# @default -- `[]` (defaults to global.topologySpreadConstraints)

1594

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1595

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

1596

topologySpreadConstraints: []

1597

# - maxSkew: 1

1598

# topologyKey: topology.kubernetes.io/zone

1599

# whenUnsatisfiable: DoNotSchedule

1600

1601

# -- terminationGracePeriodSeconds for container lifecycle hook

1602

terminationGracePeriodSeconds: 30

1603

# -- Automount API credentials for the Service Account into the pod.

1604

automountServiceAccountToken: true

1605

serviceAccount:

1606

# -- Create a service account for the redis pod

1607

create: false

1608

# -- Service account name for redis pod

1609

1610

# -- Annotations applied to created service account

1611

annotations: {}

1612

# -- Automount API credentials for the Service Account

1613

automountServiceAccountToken: false

1614

service:

1615

# -- Redis service annotations

1616

annotations: {}

1617

# -- Additional redis service labels

1618

labels: {}

1619

metrics:

1620

# -- Deploy metrics service

1621

enabled: false

1622

# Redis metrics service configuration

1623

service:

1624

# -- Metrics service type

1625

type: ClusterIP

1626

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

1627

clusterIP: None

1628

# -- Metrics service annotations

1629

annotations: {}

1630

# -- Metrics service labels

1631

labels: {}

1632

# -- Metrics service port

1633

servicePort: 9121

1634

# -- Metrics service port name

1635

portName: http-metrics

1636

serviceMonitor:

1637

# -- Enable a prometheus ServiceMonitor

1638

enabled: false

1639

# -- Interval at which metrics should be scraped

1640

interval: 30s

1641

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1642

honorLabels: false

1643

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1644

relabelings: []

1645

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1646

metricRelabelings: []

1647

# -- Prometheus ServiceMonitor selector

1648

selector: {}

1649

# prometheus: kube-prometheus

1650

1651

# -- Prometheus ServiceMonitor scheme

1652

scheme: ""

1653

# -- Prometheus ServiceMonitor tlsConfig

1654

tlsConfig: {}

1655

# -- Prometheus ServiceMonitor namespace

1656

namespace: "" # "monitoring"

1657

# -- Prometheus ServiceMonitor labels

1658

additionalLabels: {}

1659

# -- Prometheus ServiceMonitor annotations

1660

annotations: {}

1661

# Default redis's network policy

1662

networkPolicy:

1663

# -- Default network policy rules used by redis

1664

# @default -- `false` (defaults to global.networkPolicy.create)

1665

create: false

1666

## Redis-HA subchart replaces custom redis deployment when `redis-ha.enabled=true`

1667

# Ref: https://github.com/DandyDeveloper/charts/blob/master/charts/redis-ha/values.yaml

1668

redis-ha:

1669

# -- Enables the Redis HA subchart and disables the custom Redis single node deployment

1670

enabled: false

1671

## Redis image

1672

image:

1673

# -- Redis repository

1674

repository: ecr-public.aws.com/docker/library/redis

1675

# -- Redis tag

1676

## Do not upgrade to >= 7.4.0, otherwise you are no longer using an open source version of Redis

1677

tag: 8.2.3-alpine

1678

## Prometheus redis-exporter sidecar

1679

exporter:

1680

# -- Enable Prometheus redis-exporter sidecar

1681

enabled: false

1682

# -- Repository to use for the redis-exporter

1683

image: ghcr.io/oliver006/redis_exporter

1684

# -- Tag to use for the redis-exporter

1685

tag: v1.75.0

1686

persistentVolume:

1687

# -- Configures persistence on Redis nodes

1688

enabled: false

1689

## Redis specific configuration options

1690

redis:

1691

# -- Redis convention for naming the cluster group: must match `^[\\w-\\.]+$` and can be templated

1692

masterGroupName: argocd

1693

# -- Any valid redis config options in this section will be applied to each server (see `redis-ha` chart)

1694

# @default -- See [values.yaml]

1695

config:

1696

# -- Will save the DB if both the given number of seconds and the given number of write operations against the DB occurred. `""` is disabled

1697

# @default -- `'""'`

1698

save: '""'

1699

## Enables a HA Proxy for better LoadBalancing / Sentinel Master support. Automatically proxies to Redis master.

1700

haproxy:

1701

# -- Enabled HAProxy LoadBalancing/Proxy

1702

enabled: true

1703

# -- Custom labels for the haproxy pod. This is relevant for Argo CD CLI.

1704

labels:

1705

app.kubernetes.io/name: argocd-redis-ha-haproxy

1706

image:

1707

# -- HAProxy Image Repository

1708

repository: ecr-public.aws.com/docker/library/haproxy

1709

metrics:

1710

# -- HAProxy enable prometheus metric scraping

1711

enabled: true

1712

# -- Whether the haproxy pods should be forced to run on separate nodes.

1713

hardAntiAffinity: true

1714

# -- Additional affinities to add to the haproxy pods.

1715

additionalAffinities: {}

1716

# -- Assign custom [affinity] rules to the haproxy pods.

1717

affinity: ""

1718

# -- [Tolerations] for use with node taints for haproxy pods.

1719

tolerations: []

1720

# -- HAProxy container-level security context

1721

# @default -- See [values.yaml]

1722

containerSecurityContext:

1723

readOnlyRootFilesystem: true

1724

# -- Configures redis-ha with AUTH

1725

auth: true

1726

# -- Existing Secret to use for redis-ha authentication.

1727

# By default the redis-secret-init Job is generating this Secret.

1728

existingSecret: argocd-redis

1729

# -- Whether the Redis server pods should be forced to run on separate nodes.

1730

hardAntiAffinity: true

1731

# -- Additional affinities to add to the Redis server pods.

1732

additionalAffinities: {}

1733

# -- Assign custom [affinity] rules to the Redis pods.

1734

affinity: ""

1735

# -- [Tolerations] for use with node taints for Redis pods.

1736

tolerations: []

1737

# -- Assign custom [TopologySpreadConstraints] rules to the Redis pods.

1738

## https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1739

topologySpreadConstraints:

1740

# -- Enable Redis HA topology spread constraints

1741

enabled: false

1742

# -- Max skew of pods tolerated

1743

# @default -- `""` (defaults to `1`)

1744

maxSkew: ""

1745

# -- Topology key for spread

1746

# @default -- `""` (defaults to `topology.kubernetes.io/zone`)

1747

topologyKey: ""

1748

# -- Enforcement policy, hard or soft

1749

# @default -- `""` (defaults to `ScheduleAnyway`)

1750

whenUnsatisfiable: ""

1751

# -- Redis HA statefulset container-level security context

1752

# @default -- See [values.yaml]

1753

containerSecurityContext:

1754

readOnlyRootFilesystem: true

1755

# External Redis parameters

1756

externalRedis:

1757

# -- External Redis server host

1758

host: ""

1759

# -- External Redis username

1760

username: ""

1761

# -- External Redis password

1762

password: ""

1763

# -- External Redis server port

1764

port: 6379

1765

# -- The name of an existing secret with Redis (must contain key `redis-password`. And should contain `redis-username` if username is not `default`) and Sentinel credentials.

1766

# When it's set, the `externalRedis.username` and `externalRedis.password` parameters are ignored

1767

existingSecret: ""

1768

# -- External Redis Secret annotations

1769

secretAnnotations: {}

1770

redisSecretInit:

1771

# -- Enable Redis secret initialization. If disabled, secret must be provisioned by alternative methods

1772

enabled: true

1773

# -- Redis secret-init name

1774

1775

image:

1776

# -- Repository to use for the Redis secret-init Job

1777

# @default -- `""` (defaults to global.image.repository)

1778

repository: "" # defaults to global.image.repository

1779

# -- Tag to use for the Redis secret-init Job

1780

# @default -- `""` (defaults to global.image.tag)

1781

tag: "" # defaults to global.image.tag

1782

# -- Image pull policy for the Redis secret-init Job

1783

# @default -- `""` (defaults to global.image.imagePullPolicy)

1784

imagePullPolicy: "" # IfNotPresent

1785

# -- Additional command line arguments for the Redis secret-init Job

1786

extraArgs: []

1787

# -- Secrets with credentials to pull images from a private registry

1788

# @default -- `[]` (defaults to global.imagePullSecrets)

1789

imagePullSecrets: []

1790

# -- Runtime class name for the Redis secret-init Job

1791

# @default -- `""` (defaults to global.runtimeClassName)

1792

runtimeClassName: ""

1793

# -- Annotations to be added to the Redis secret-init Job

1794

jobAnnotations: {}

1795

# -- Annotations to be added to the Redis secret-init Job

1796

podAnnotations: {}

1797

# -- Labels to be added to the Redis secret-init Job

1798

podLabels: {}

1799

# -- Resource limits and requests for Redis secret-init Job

1800

resources: {}

1801

# limits:

1802

# cpu: 200m

1803

# memory: 128Mi

1804

# requests:

1805

# cpu: 100m

1806

# memory: 64Mi

1807

1808

# -- Application controller container-level security context

1809

# @default -- See [values.yaml]

1810

containerSecurityContext:

1811

allowPrivilegeEscalation: false

1812

capabilities:

1813

drop:

1814

- ALL

1815

readOnlyRootFilesystem: true

1816

runAsNonRoot: true

1817

seccompProfile:

1818

type: RuntimeDefault

1819

# -- Redis secret-init Job pod-level security context

1820

securityContext: {}

1821

serviceAccount:

1822

# -- Create a service account for the redis pod

1823

create: true

1824

# -- Service account name for redis pod

1825

1826

# -- Annotations applied to created service account

1827

annotations: {}

1828

# -- Automount API credentials for the Service Account

1829

automountServiceAccountToken: true

1830

# -- Priority class for Redis secret-init Job

1831

# @default -- `""` (defaults to global.priorityClassName)

1832

priorityClassName: ""

1833

# -- Assign custom [affinity] rules to the Redis secret-init Job

1834

affinity: {}

1835

# -- Node selector to be added to the Redis secret-init Job

1836

# @default -- `{}` (defaults to global.nodeSelector)

1837

nodeSelector: {}

1838

# -- Tolerations to be added to the Redis secret-init Job

1839

# @default -- `[]` (defaults to global.tolerations)

1840

tolerations: []

1841

## Server

1842

server:

1843

# -- Argo CD server name

1844

1845

# -- The number of server pods to run

1846

replicas: 1

1847

# -- Runtime class name for the Argo CD server

1848

# @default -- `""` (defaults to global.runtimeClassName)

1849

runtimeClassName: ""

1850

## Argo CD server Horizontal Pod Autoscaler

1851

autoscaling:

1852

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo CD server

1853

enabled: false

1854

# -- Minimum number of replicas for the Argo CD server [HPA]

1855

minReplicas: 1

1856

# -- Maximum number of replicas for the Argo CD server [HPA]

1857

maxReplicas: 5

1858

# -- Average CPU utilization percentage for the Argo CD server [HPA]

1859

targetCPUUtilizationPercentage: 50

1860

# -- Average memory utilization percentage for the Argo CD server [HPA]

1861

targetMemoryUtilizationPercentage: 50

1862

# -- Configures the scaling behavior of the target in both Up and Down directions.

1863

behavior: {}

1864

# scaleDown:

1865

# stabilizationWindowSeconds: 300

1866

# policies:

1867

# - type: Pods

1868

# value: 1

1869

# periodSeconds: 180

1870

# scaleUp:

1871

# stabilizationWindowSeconds: 300

1872

# policies:

1873

# - type: Pods

1874

# value: 2

1875

# periodSeconds: 60

1876

# -- Configures custom HPA metrics for the Argo CD server

1877

# Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

1878

metrics: []

1879

## Argo CD server Pod Disruption Budget

1880

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1881

pdb:

1882

# -- Deploy a [PodDisruptionBudget] for the Argo CD server

1883

enabled: false

1884

# -- Labels to be added to Argo CD server pdb

1885

labels: {}

1886

# -- Annotations to be added to Argo CD server pdb

1887

annotations: {}

1888

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1889

# @default -- `""` (defaults to 0 if not specified)

1890

minAvailable: ""

1891

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

1892

## Has higher precedence over `server.pdb.minAvailable`

1893

maxUnavailable: ""

1894

## Argo CD server Vertical Pod Autoscaler

1895

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1896

vpa:

1897

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Argo CD server

1898

enabled: false

1899

# -- Labels to be added to Argo CD server vpa

1900

labels: {}

1901

# -- Annotations to be added to Argo CD server vpa

1902

annotations: {}

1903

# -- One of the VPA operation modes

1904

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1905

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1906

updateMode: Initial

1907

# -- Controls how VPA computes the recommended resources for Argo CD server container

1908

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1909

containerPolicy: {}

1910

# controlledResources: ["cpu", "memory"]

1911

# minAllowed:

1912

# cpu: 250m

1913

# memory: 256Mi

1914

# maxAllowed:

1915

# cpu: 1

1916

# memory: 1Gi

1917

## Argo CD server image

1918

image:

1919

# -- Repository to use for the Argo CD server

1920

# @default -- `""` (defaults to global.image.repository)

1921

repository: "" # defaults to global.image.repository

1922

# -- Tag to use for the Argo CD server

1923

# @default -- `""` (defaults to global.image.tag)

1924

tag: "" # defaults to global.image.tag

1925

# -- Image pull policy for the Argo CD server

1926

# @default -- `""` (defaults to global.image.imagePullPolicy)

1927

imagePullPolicy: "" # IfNotPresent

1928

# -- Secrets with credentials to pull images from a private registry

1929

# @default -- `[]` (defaults to global.imagePullSecrets)

1930

imagePullSecrets: []

1931

# -- Additional command line arguments to pass to Argo CD server

1932

extraArgs: []

1933

# -- Environment variables to pass to Argo CD server

1934

env: []

1935

# -- envFrom to pass to Argo CD server

1936

# @default -- `[]` (See [values.yaml])

1937

envFrom: []

1938

# - configMapRef:

1939

# name: config-map-name

1940

# - secretRef:

1941

# name: secret-name

1942

1943

# -- Specify postStart and preStop lifecycle hooks for your argo-cd-server container

1944

lifecycle: {}

1945

## Argo CD extensions

1946

## This function in tech preview stage, do expect instability or breaking changes in newer versions.

1947

## Ref: https://github.com/argoproj-labs/argocd-extension-installer

1948

## When you enable extensions, you need to configure RBAC of logged in Argo CD user.

1949

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#the-extensions-resource

1950

extensions:

1951

# -- Enable support for Argo CD extensions

1952

enabled: false

1953

## Argo CD extension installer image

1954

image:

1955

# -- Repository to use for extension installer image

1956

repository: cgr.dev/chainguard-private/argocd-extension-installer

1957

# -- Tag to use for extension installer image

1958

tag: latest@sha256:e691c397b9b121d2abce27a4fe89f0a2b879247c46aa391ce3c44dcc94fc5e6c

1959

# -- Image pull policy for extensions

1960

# @default -- `""` (defaults to global.image.imagePullPolicy)

1961

imagePullPolicy: ""

1962

# -- Extensions for Argo CD

1963

# @default -- `[]` (See [values.yaml])

1964

## Ref: https://github.com/argoproj-labs/argocd-extension-metrics#install-ui-extension

1965

extensionList: []

1966

# - name: extension-metrics

1967

# env:

1968

# - name: EXTENSION_URL

1969

# value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension.tar.gz

1970

# - name: EXTENSION_CHECKSUM_URL

1971

# value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension_checksums.txt

1972

1973

# -- Server UI extensions container-level security context

1974

# @default -- See [values.yaml]

1975

containerSecurityContext:

1976

runAsNonRoot: true

1977

readOnlyRootFilesystem: true

1978

allowPrivilegeEscalation: false

1979

runAsUser: 1000

1980

seccompProfile:

1981

type: RuntimeDefault

1982

capabilities:

1983

drop:

1984

- ALL

1985

# -- Resource limits and requests for the argocd-extensions container

1986

resources: {}

1987

# limits:

1988

# cpu: 50m

1989

# memory: 128Mi

1990

# requests:

1991

# cpu: 10m

1992

# memory: 64Mi

1993

# -- Additional containers to be added to the server pod

1994

## Note: Supports use of custom Helm templates

1995

extraContainers: []

1996

# - name: my-sidecar

1997

# image: nginx:latest

1998

# - name: lemonldap-ng-controller

1999

# image: lemonldapng/lemonldap-ng-controller:0.2.0

2000

# args:

2001

# - /lemonldap-ng-controller

2002

# - --alsologtostderr

2003

# - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration

2004

# env:

2005

# - name: POD_NAME

2006

# valueFrom:

2007

# fieldRef:

2008

# fieldPath: metadata.name

2009

# - name: POD_NAMESPACE

2010

# valueFrom:

2011

# fieldRef:

2012

# fieldPath: metadata.namespace

2013

# volumeMounts:

2014

# - name: copy-portal-skins

2015

# mountPath: /srv/var/lib/lemonldap-ng/portal/skins

2016

2017

# -- Init containers to add to the server pod

2018

## If your target Kubernetes cluster(s) require a custom credential (exec) plugin

2019

## you could use this (and the same in the application controller pod) to provide such executable

2020

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

2021

initContainers: []

2022

# - name: download-tools

2023

# image: alpine:3

2024

# command: [sh, -c]

2025

# args:

2026

# - wget -qO /custom-tools/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.7/kubelogin-linux-amd64.zip &&

2027

# mkdir /custom-tools/tmp && unzip -d /custom-tools/tmp /custom-tools/kubelogin.zip &&

2028

# mv /custom-tools/tmp/bin/linux_amd64/kubelogin /custom-tools/ && rm -rf custom-tools/tmp && rm /custom-tools/kubelogin.zip

2029

# volumeMounts:

2030

# - mountPath: /custom-tools

2031

# name: custom-tools

2032

2033

# -- Additional volumeMounts to the server main container

2034

volumeMounts: []

2035

# - mountPath: /usr/local/bin/kubelogin

2036

# name: custom-tools

2037

# subPath: kubelogin

2038

2039

# -- Additional volumes to the server pod

2040

volumes: []

2041

# - name: custom-tools

2042

# emptyDir: {}

2043

2044

## Argo CD server emptyDir volumes

2045

emptyDir:

2046

# -- EmptyDir size limit for the Argo CD server

2047

# @default -- `""` (defaults not set if not specified i.e. no size limit)

2048

sizeLimit: ""

2049

# sizeLimit: "1Gi"

2050

# -- Annotations to be added to server Deployment

2051

deploymentAnnotations: {}

2052

# -- Labels for the server Deployment

2053

deploymentLabels: {}

2054

# -- Annotations to be added to server pods

2055

podAnnotations: {}

2056

# -- Labels to be added to server pods

2057

podLabels: {}

2058

# -- Resource limits and requests for the Argo CD server

2059

resources: {}

2060

# limits:

2061

# cpu: 100m

2062

# memory: 128Mi

2063

# requests:

2064

# cpu: 50m

2065

# memory: 64Mi

2066

2067

# Server container ports

2068

containerPorts:

2069

# -- Server container port

2070

server: 8080

2071

# -- Metrics container port

2072

metrics: 8083

2073

# -- Host Network for Server pods

2074

hostNetwork: false

2075

# -- [DNS configuration]

2076

dnsConfig: {}

2077

# -- Alternative DNS policy for Server pods

2078

dnsPolicy: "ClusterFirst"

2079

# -- Server container-level security context

2080

# @default -- See [values.yaml]

2081

containerSecurityContext:

2082

runAsNonRoot: true

2083

readOnlyRootFilesystem: true

2084

allowPrivilegeEscalation: false

2085

seccompProfile:

2086

type: RuntimeDefault

2087

capabilities:

2088

drop:

2089

- ALL

2090

## Readiness and liveness probes for default backend

2091

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2092

readinessProbe:

2093

# -- Enable Kubernetes readiness probe for default backend

2094

enabled: true

2095

# -- Http path to use for the readiness probe

2096

httpPath: /healthz

2097

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2098

failureThreshold: 3

2099

# -- Number of seconds after the container has started before [probe] is initiated

2100

initialDelaySeconds: 10

2101

# -- How often (in seconds) to perform the [probe]

2102

periodSeconds: 10

2103

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2104

successThreshold: 1

2105

# -- Number of seconds after which the [probe] times out

2106

timeoutSeconds: 1

2107

livenessProbe:

2108

# -- Enable Kubernetes liveness probe for default backend

2109

enabled: true

2110

# -- Http path to use for the liveness probe

2111

httpPath: /healthz?full=true

2112

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2113

failureThreshold: 3

2114

# -- Number of seconds after the container has started before [probe] is initiated

2115

initialDelaySeconds: 10

2116

# -- How often (in seconds) to perform the [probe]

2117

periodSeconds: 10

2118

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2119

successThreshold: 1

2120

# -- Number of seconds after which the [probe] times out

2121

timeoutSeconds: 1

2122

## Startup probe for Argo CD server (optional)

2123

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2124

startupProbe:

2125

# -- Enable Kubernetes startup probe for Argo CD server

2126

enabled: false

2127

# -- Http path to use for the startup probe

2128

httpPath: /healthz

2129

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2130

failureThreshold: 20

2131

# -- Number of seconds after the container has started before [probe] is initiated

2132

initialDelaySeconds: 10

2133

# -- How often (in seconds) to perform the [probe]

2134

periodSeconds: 10

2135

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2136

successThreshold: 1

2137

# -- Number of seconds after which the [probe] times out

2138

timeoutSeconds: 1

2139

# -- terminationGracePeriodSeconds for container lifecycle hook

2140

terminationGracePeriodSeconds: 30

2141

# -- Priority class for the Argo CD server pods

2142

# @default -- `""` (defaults to global.priorityClassName)

2143

priorityClassName: ""

2144

# -- [Node selector]

2145

# @default -- `{}` (defaults to global.nodeSelector)

2146

nodeSelector: {}

2147

# -- [Tolerations] for use with node taints

2148

# @default -- `[]` (defaults to global.tolerations)

2149

tolerations: []

2150

# -- Assign custom [affinity] rules to the deployment

2151

# @default -- `{}` (defaults to global.affinity preset)

2152

affinity: {}

2153

# -- Assign custom [TopologySpreadConstraints] rules to the Argo CD server

2154

# @default -- `[]` (defaults to global.topologySpreadConstraints)

2155

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

2156

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

2157

topologySpreadConstraints: []

2158

# - maxSkew: 1

2159

# topologyKey: topology.kubernetes.io/zone

2160

# whenUnsatisfiable: DoNotSchedule

2161

2162

# -- Deployment strategy to be added to the server Deployment

2163

deploymentStrategy: {}

2164

# type: RollingUpdate

2165

# rollingUpdate:

2166

# maxSurge: 25%

2167

# maxUnavailable: 25%

2168

2169

# TLS certificate configuration via cert-manager

2170

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server

2171

certificate:

2172

# -- Deploy a Certificate resource (requires cert-manager)

2173

enabled: false

2174

# -- Certificate primary domain (commonName)

2175

# @default -- `""` (defaults to global.domain)

2176

domain: ""

2177

# -- Certificate Subject Alternate Names (SANs)

2178

additionalHosts: []

2179

# -- The requested 'duration' (i.e. lifetime) of the certificate.

2180

# @default -- `""` (defaults to 2160h = 90d if not specified)

2181

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

2182

duration: ""

2183

# -- How long before the expiry a certificate should be renewed.

2184

# @default -- `""` (defaults to 360h = 15d if not specified)

2185

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

2186

renewBefore: ""

2187

# Certificate issuer

2188

## Ref: https://cert-manager.io/docs/concepts/issuer

2189

issuer:

2190

# -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io`

2191

group: ""

2192

# -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer`

2193

kind: ""

2194

# -- Certificate issuer name. Eg. `letsencrypt`

2195

2196

# Private key of the certificate

2197

privateKey:

2198

# -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always`

2199

rotationPolicy: Never

2200

# -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8`

2201

encoding: PKCS1

2202

# -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA`

2203

algorithm: RSA

2204

# -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored.

2205

size: 2048

2206

# -- Annotations to be applied to the Server Certificate

2207

annotations: {}

2208

# -- Usages for the certificate

2209

### Ref: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage

2210

usages: []

2211

# -- Annotations that allow the certificate to be composed from data residing in existing Kubernetes Resources

2212

secretTemplateAnnotations: {}

2213

# TLS certificate configuration via Secret

2214

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server

2215

certificateSecret:

2216

# -- Create argocd-server-tls secret

2217

enabled: false

2218

# -- Annotations to be added to argocd-server-tls secret

2219

annotations: {}

2220

# -- Labels to be added to argocd-server-tls secret

2221

labels: {}

2222

# -- Private Key of the certificate

2223

key: ""

2224

# -- Certificate data

2225

crt: ""

2226

## Server service configuration

2227

service:

2228

# -- Server service annotations

2229

annotations: {}

2230

# -- Server service labels

2231

labels: {}

2232

# -- Server service type

2233

type: ClusterIP

2234

# -- Server service http port for NodePort service type (only if `server.service.type` is set to "NodePort")

2235

nodePortHttp: 30080

2236

# -- Server service https port for NodePort service type (only if `server.service.type` is set to "NodePort")

2237

nodePortHttps: 30443

2238

# -- Server service http port

2239

servicePortHttp: 80

2240

# -- Server service https port

2241

servicePortHttps: 443

2242

# -- Server service http port name, can be used to route traffic via istio

2243

servicePortHttpName: http

2244

# -- Server service https port name, can be used to route traffic via istio

2245

servicePortHttpsName: https

2246

# -- Server service https port appProtocol

2247

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol

2248

servicePortHttpsAppProtocol: ""

2249

# -- The class of the load balancer implementation

2250

loadBalancerClass: ""

2251

# -- LoadBalancer will get created with the IP specified in this field

2252

loadBalancerIP: ""

2253

# -- Source IP ranges to allow access to service from

2254

## EKS Ref: https://repost.aws/knowledge-center/eks-cidr-ip-address-loadbalancer

2255

## GKE Ref: https://cloud.google.com/kubernetes-engine/docs/concepts/network-overview#limit-connectivity-ext-lb

2256

loadBalancerSourceRanges: []

2257

# -- Server service external IPs

2258

externalIPs: []

2259

# -- Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

2260

## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

2261

externalTrafficPolicy: Cluster

2262

# -- Used to maintain session affinity. Supports `ClientIP` and `None`

2263

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

2264

sessionAffinity: None

2265

## Server metrics service configuration

2266

metrics:

2267

# -- Deploy metrics service

2268

enabled: false

2269

service:

2270

# -- Metrics service type

2271

type: ClusterIP

2272

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

2273

clusterIP: ""

2274

# -- Metrics service annotations

2275

annotations: {}

2276

# -- Metrics service labels

2277

labels: {}

2278

# -- Metrics service port

2279

servicePort: 8083

2280

# -- Metrics service port name

2281

portName: http-metrics

2282

serviceMonitor:

2283

# -- Enable a prometheus ServiceMonitor

2284

enabled: false

2285

# -- Prometheus ServiceMonitor interval

2286

interval: 30s

2287

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

2288

scrapeTimeout: ""

2289

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

2290

honorLabels: false

2291

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

2292

relabelings: []

2293

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

2294

metricRelabelings: []

2295

# -- Prometheus ServiceMonitor selector

2296

selector: {}

2297

# prometheus: kube-prometheus

2298

2299

# -- Prometheus ServiceMonitor scheme

2300

scheme: ""

2301

# -- Prometheus ServiceMonitor tlsConfig

2302

tlsConfig: {}

2303

# -- Prometheus ServiceMonitor namespace

2304

namespace: "" # monitoring

2305

# -- Prometheus ServiceMonitor labels

2306

additionalLabels: {}

2307

# -- Prometheus ServiceMonitor annotations

2308

annotations: {}

2309

# -- Automount API credentials for the Service Account into the pod.

2310

automountServiceAccountToken: true

2311

serviceAccount:

2312

# -- Create server service account

2313

create: true

2314

# -- Server service account name

2315

2316

# -- Annotations applied to created service account

2317

annotations: {}

2318

# -- Labels applied to created service account

2319

labels: {}

2320

# -- Automount API credentials for the Service Account

2321

automountServiceAccountToken: true

2322

# Argo CD server ingress configuration

2323

ingress:

2324

# -- Enable an ingress resource for the Argo CD server

2325

enabled: false

2326

# -- Specific implementation for ingress controller. One of `generic`, `aws` or `gke`

2327

## Additional configuration might be required in related configuration sections

2328

controller: generic

2329

# -- Additional ingress labels

2330

labels: {}

2331

# -- Additional ingress annotations

2332

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough

2333

annotations: {}

2334

# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

2335

# nginx.ingress.kubernetes.io/ssl-passthrough: "true"

2336

2337

# -- Defines which ingress controller will implement the resource

2338

ingressClassName: ""

2339

# -- Argo CD server hostname

2340

# @default -- `""` (defaults to global.domain)

2341

hostname: ""

2342

# -- The path to Argo CD server

2343

path: /

2344

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

2345

pathType: Prefix

2346

# -- Enable TLS configuration for the hostname defined at `server.ingress.hostname`

2347

## TLS certificate will be retrieved from a TLS secret `argocd-server-tls`

2348

## You can create this secret via `certificate` or `certificateSecret` option

2349

tls: false

2350

# -- The list of additional hostnames to be covered by ingress record

2351

# @default -- `[]` (See [values.yaml])

2352

extraHosts: []

2353

# - name: argocd.example.com

2354

# path: /

2355

2356

# -- Additional ingress paths

2357

# @default -- `[]` (See [values.yaml])

2358

## Note: Supports use of custom Helm templates

2359

extraPaths: []

2360

# - path: /*

2361

# pathType: Prefix

2362

# backend:

2363

# service:

2364

# name: ssl-redirect

2365

# port:

2366

# name: use-annotation

2367

2368

# -- Additional ingress rules

2369

# @default -- `[]` (See [values.yaml])

2370

## Note: Supports use of custom Helm templates

2371

extraRules: []

2372

# - http:

2373

# paths:

2374

# - path: /

2375

# pathType: Prefix

2376

# backend:

2377

# service:

2378

# name: '{{ include "argo-cd.server.fullname" . }}'

2379

# port:

2380

# name: '{{ .Values.server.service.servicePortHttpsName }}'

2381

2382

# -- Additional TLS configuration

2383

# @default -- `[]` (See [values.yaml])

2384

extraTls: []

2385

# - hosts:

2386

# - argocd.example.com

2387

# secretName: your-certificate-name

2388

2389

# AWS specific options for Application Load Balancer

2390

# Applies only when `serv.ingress.controller` is set to `aws`

2391

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#aws-application-load-balancers-albs-and-classic-elb-http-mode

2392

aws:

2393

# -- Backend protocol version for the AWS ALB gRPC service

2394

## This tells AWS to send traffic from the ALB using gRPC.

2395

## For more information: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html#health-check-settings

2396

backendProtocolVersion: GRPC

2397

# -- Service type for the AWS ALB gRPC service

2398

## Can be of type NodePort or ClusterIP depending on which mode you are running.

2399

## Instance mode needs type NodePort, IP mode needs type ClusterIP

2400

## Ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/how-it-works/#ingress-traffic

2401

serviceType: NodePort

2402

# -- Annotations for the AWS ALB gRPC service

2403

## Allows adding custom annotations to the gRPC service for integrations like DataDog, Prometheus, etc.

2404

serviceAnnotations: {}

2405

# Google specific options for Google Application Load Balancer

2406

# Applies only when `server.ingress.controller` is set to `gke`

2407

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#google-cloud-load-balancers-with-kubernetes-ingress

2408

gke:

2409

# -- Google [BackendConfig] resource, for use with the GKE Ingress Controller

2410

# @default -- `{}` (See [values.yaml])

2411

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

2412

backendConfig: {}

2413

# iap:

2414

# enabled: true

2415

# oauthclientCredentials:

2416

# secretName: argocd-secret

2417

2418

# -- Google [FrontendConfig] resource, for use with the GKE Ingress Controller

2419

# @default -- `{}` (See [values.yaml])

2420

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

2421

frontendConfig: {}

2422

# redirectToHttps:

2423

# enabled: true

2424

# responseCodeName: RESPONSE_CODE

2425

2426

# Managed GKE certificate for ingress hostname

2427

managedCertificate:

2428

# -- Create ManagedCertificate resource and annotations for Google Load balancer

2429

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs

2430

create: true

2431

# -- Additional domains for ManagedCertificate resource

2432

extraDomains: []

2433

# - argocd.example.com

2434

# Dedicated gRPC ingress for ingress controllers that supports only single backend protocol per Ingress resource

2435

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-2-multiple-ingress-objects-and-hosts

2436

ingressGrpc:

2437

# -- Enable an ingress resource for the Argo CD server for dedicated [gRPC-ingress]

2438

enabled: false

2439

# -- Additional ingress annotations for dedicated [gRPC-ingress]

2440

annotations: {}

2441

# -- Additional ingress labels for dedicated [gRPC-ingress]

2442

labels: {}

2443

# -- Defines which ingress controller will implement the resource [gRPC-ingress]

2444

ingressClassName: ""

2445

# -- Argo CD server hostname for dedicated [gRPC-ingress]

2446

# @default -- `""` (defaults to grpc.`server.ingress.hostname`)

2447

hostname: ""

2448

# -- Argo CD server ingress path for dedicated [gRPC-ingress]

2449

path: /

2450

# -- Ingress path type for dedicated [gRPC-ingress]. One of `Exact`, `Prefix` or `ImplementationSpecific`

2451

pathType: Prefix

2452

# -- Enable TLS configuration for the hostname defined at `server.ingressGrpc.hostname`

2453

## TLS certificate will be retrieved from a TLS secret with name: `argocd-server-grpc-tls`

2454

tls: false

2455

# -- The list of additional hostnames to be covered by ingress record

2456

# @default -- `[]` (See [values.yaml])

2457

extraHosts: []

2458

# - name: grpc.argocd.example.com

2459

# path: /

2460

2461

# -- Additional ingress paths for dedicated [gRPC-ingress]

2462

# @default -- `[]` (See [values.yaml])

2463

## Note: Supports use of custom Helm templates

2464

extraPaths: []

2465

# - path: /*

2466

# pathType: Prefix

2467

# backend:

2468

# service:

2469

# name: ssl-redirect

2470

# port:

2471

# name: use-annotation

2472

2473

# -- Additional ingress rules

2474

# @default -- `[]` (See [values.yaml])

2475

## Note: Supports use of custom Helm templates

2476

extraRules: []

2477

# - http:

2478

# paths:

2479

# - path: /

2480

# pathType: Prefix

2481

# backend:

2482

# service:

2483

# name: '{{ include "argo-cd.server.fullname" . }}'

2484

# port:

2485

# name: '{{ .Values.server.service.servicePortHttpName }}'

2486

2487

# -- Additional TLS configuration for dedicated [gRPC-ingress]

2488

# @default -- `[]` (See [values.yaml])

2489

extraTls: []

2490

# - secretName: your-certificate-name

2491

# hosts:

2492

# - argocd.example.com

2493

# Create a OpenShift Route with SSL passthrough for UI and CLI

2494

# Consider setting 'hostname' e.g. https://argocd.apps-crc.testing/ using your Default Ingress Controller Domain

2495

# Find your domain with: kubectl describe --namespace=openshift-ingress-operator ingresscontroller/default | grep Domain:

2496

# If 'hostname' is an empty string "" OpenShift will create a hostname for you.

2497

route:

2498

# -- Enable an OpenShift Route for the Argo CD server

2499

enabled: false

2500

# -- Openshift Route annotations

2501

annotations: {}

2502

# -- Hostname of OpenShift Route

2503

hostname: ""

2504

# -- Termination type of Openshift Route

2505

termination_type: passthrough

2506

# -- Termination policy of Openshift Route

2507

termination_policy: None

2508

# Gateway API HTTPRoute configuration

2509

# NOTE: Gateway API support is in EXPERIMENTAL status

2510

# Support depends on your Gateway controller implementation

2511

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

2512

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

2513

httproute:

2514

# -- Enable HTTPRoute resource for Argo CD server (Gateway API)

2515

enabled: false

2516

# -- Additional HTTPRoute labels

2517

labels: {}

2518

# -- Additional HTTPRoute annotations

2519

annotations: {}

2520

# -- Gateway API parentRefs for the HTTPRoute

2521

## Must reference an existing Gateway

2522

# @default -- `[]` (See [values.yaml])

2523

parentRefs: []

2524

# - name: example-gateway

2525

# namespace: example-gateway-namespace

2526

# sectionName: https

2527

# -- List of hostnames for the HTTPRoute

2528

# @default -- `[]` (See [values.yaml])

2529

hostnames: []

2530

# - argocd.example.com

2531

# -- HTTPRoute rules configuration

2532

# @default -- `[]` (See [values.yaml])

2533

rules:

2534

- matches:

2535

- path:

2536

type: PathPrefix

2537

value: /

2538

# filters: []

2539

# - type: RequestHeaderModifier

2540

# requestHeaderModifier:

2541

# add:

2542

# - name: X-Custom-Header

2543

# value: custom-value

2544

# timeouts:

2545

# request: 10s

2546

# backendRequest: 2s

2547

# Gateway API GRPCRoute configuration

2548

# NOTE: Gateway API support is in EXPERIMENTAL status

2549

# Support depends on your Gateway controller implementation

2550

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

2551

grpcroute:

2552

# -- Enable GRPCRoute resource for Argo CD server (Gateway API)

2553

enabled: false

2554

# -- Additional GRPCRoute labels

2555

labels: {}

2556

# -- Additional GRPCRoute annotations

2557

annotations: {}

2558

# -- Gateway API parentRefs for the GRPCRoute

2559

## Must reference an existing Gateway

2560

# @default -- `[]` (See [values.yaml])

2561

parentRefs: []

2562

# - name: example-gateway

2563

# namespace: example-gateway-namespace

2564

# sectionName: grpc

2565

# -- List of hostnames for the GRPCRoute

2566

# @default -- `[]` (See [values.yaml])

2567

hostnames: []

2568

# - grpc.argocd.example.com

2569

# -- GRPCRoute rules configuration

2570

# @default -- `[]` (See [values.yaml])

2571

rules:

2572

- matches:

2573

- method:

2574

type: Exact

2575

# filters: []

2576

# - type: RequestHeaderModifier

2577

# requestHeaderModifier:

2578

# add:

2579

# - name: X-Custom-Header

2580

# value: custom-value

2581

# Gateway API BackendTLSPolicy configuration

2582

# NOTE: BackendTLSPolicy support is in EXPERIMENTAL status

2583

# Required for HTTPS backends when using Gateway API

2584

# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)

2585

backendTLSPolicy:

2586

# -- Enable BackendTLSPolicy resource for Argo CD server (Gateway API)

2587

enabled: false

2588

# -- Additional BackendTLSPolicy labels

2589

labels: {}

2590

# -- Additional BackendTLSPolicy annotations

2591

annotations: {}

2592

# -- Target references for the BackendTLSPolicy

2593

# @default -- `[]` (See [values.yaml])

2594

targetRefs: []

2595

# - group: ""

2596

# kind: Service

2597

# name: argocd-server

2598

# sectionName: https

2599

# -- TLS validation configuration

2600

# @default -- `{}` (See [values.yaml])

2601

validation: {}

2602

# hostname: argocd-server.argocd.svc.cluster.local

2603

# caCertificateRefs:

2604

# - name: example-ca-cert

2605

# group: ""

2606

# kind: ConfigMap

2607

# wellKnownCACertificates: System

2608

# Gateway API ListenerSet configuration

2609

# NOTE: Gateway API support is in EXPERIMENTAL status

2610

# ListenerSet allows attaching additional listeners to an existing Gateway

2611

# Requires Gateway API v1alpha2 and a controller that supports ListenerSet

2612

# Refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.ListenerSet

2613

listenerset:

2614

# -- Enable ListenerSet resource for Argo CD server (Gateway API)

2615

enabled: false

2616

# -- Additional ListenerSet labels

2617

labels: {}

2618

# -- Additional ListenerSet annotations

2619

annotations: {}

2620

# -- Gateway API parentRef for the ListenerSet

2621

## Must reference an existing Gateway. Unlike HTTPRoute, ListenerSet accepts exactly one parentRef.

2622

# @default -- `{}` (See [values.yaml])

2623

parentRef: {}

2624

# name: example-gateway

2625

# namespace: example-gateway-namespace

2626

# -- Hostname for the synthesized listener. Defaults to global.domain when empty.

2627

hostname: ""

2628

# -- Name of the synthesized listener. Also used as sectionName in auto-derived httproute parentRefs.

2629

listenerName: https

2630

# -- Port for the synthesized listener

2631

port: 443

2632

# -- Protocol for the synthesized listener

2633

protocol: HTTPS

2634

# -- TLS configuration for the synthesized listener

2635

tls:

2636

# -- Enable TLS on the synthesized listener

2637

enabled: true

2638

# -- TLS termination mode

2639

mode: Terminate

2640

# -- Secret name for TLS certificate. Defaults to `argocd-server-tls` when empty.

2641

secretName: ""

2642

# -- allowedRoutes for the synthesized listener

2643

allowedRoutes:

2644

namespaces:

2645

from: Same

2646

# -- Listeners to attach to the parent Gateway. When non-empty, used verbatim and all synthesized listener fields above are ignored.

2647

# @default -- `[]` (See [values.yaml])

2648

listeners: []

2649

# - name: https

2650

# port: 443

2651

# protocol: HTTPS

2652

# hostname: argocd.example.com

2653

# tls:

2654

# mode: Terminate

2655

# certificateRefs:

2656

# - group: ""

2657

# kind: Secret

2658

# name: argocd-server-tls

2659

# allowedRoutes:

2660

# namespaces:

2661

# from: Same

2662

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

2663

## Defaults to off

2664

clusterRoleRules:

2665

# -- Enable custom rules for the server's ClusterRole resource

2666

enabled: false

2667

# -- List of custom rules for the server's ClusterRole resource

2668

rules: []

2669

# Default ArgoCD Server's network policy

2670

networkPolicy:

2671

# -- Default network policy rules used by ArgoCD Server

2672

# @default -- `false` (defaults to global.networkPolicy.create)

2673

create: false

2674

## Repo Server

2675

repoServer:

2676

# -- Repo server name

2677

2678

# -- The number of repo server pods to run

2679

replicas: 1

2680

# -- Runtime class name for the repo server

2681

# @default -- `""` (defaults to global.runtimeClassName)

2682

runtimeClassName: ""

2683

## Repo server Horizontal Pod Autoscaler

2684

autoscaling:

2685

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the repo server

2686

enabled: false

2687

# -- Minimum number of replicas for the repo server [HPA]

2688

minReplicas: 1

2689

# -- Maximum number of replicas for the repo server [HPA]

2690

maxReplicas: 5

2691

# -- Average CPU utilization percentage for the repo server [HPA]

2692

targetCPUUtilizationPercentage: 50

2693

# -- Average memory utilization percentage for the repo server [HPA]

2694

targetMemoryUtilizationPercentage: 50

2695

# -- Configures the scaling behavior of the target in both Up and Down directions.

2696

behavior: {}

2697

# scaleDown:

2698

# stabilizationWindowSeconds: 300

2699

# policies:

2700

# - type: Pods

2701

# value: 1

2702

# periodSeconds: 180

2703

# scaleUp:

2704

# stabilizationWindowSeconds: 300

2705

# policies:

2706

# - type: Pods

2707

# value: 2

2708

# periodSeconds: 60

2709

# -- Configures custom HPA metrics for the Argo CD repo server

2710

# Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

2711

metrics: []

2712

## Repo server Pod Disruption Budget

2713

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

2714

pdb:

2715

# -- Deploy a [PodDisruptionBudget] for the repo server

2716

enabled: false

2717

# -- Labels to be added to repo server pdb

2718

labels: {}

2719

# -- Annotations to be added to repo server pdb

2720

annotations: {}

2721

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

2722

# @default -- `""` (defaults to 0 if not specified)

2723

minAvailable: ""

2724

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

2725

## Has higher precedence over `repoServer.pdb.minAvailable`

2726

maxUnavailable: ""

2727

## Repo server Vertical Pod Autoscaler

2728

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

2729

vpa:

2730

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the repo server

2731

enabled: false

2732

# -- Labels to be added to repo server vpa

2733

labels: {}

2734

# -- Annotations to be added to repo server vpa

2735

annotations: {}

2736

# -- One of the VPA operation modes

2737

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

2738

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

2739

updateMode: Initial

2740

# -- Controls how VPA computes the recommended resources for repo server container

2741

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

2742

containerPolicy: {}

2743

# controlledResources: ["cpu", "memory"]

2744

# minAllowed:

2745

# cpu: 250m

2746

# memory: 256Mi

2747

# maxAllowed:

2748

# cpu: 1

2749

# memory: 1Gi

2750

## Repo server image

2751

image:

2752

# -- Repository to use for the repo server

2753

# @default -- `""` (defaults to global.image.repository)

2754

repository: ""

2755

# -- Tag to use for the repo server

2756

# @default -- `""` (defaults to global.image.tag)

2757

tag: ""

2758

# -- Image pull policy for the repo server

2759

# @default -- `""` (defaults to global.image.imagePullPolicy)

2760

imagePullPolicy: ""

2761

# -- Secrets with credentials to pull images from a private registry

2762

# @default -- `[]` (defaults to global.imagePullSecrets)

2763

imagePullSecrets: []

2764

# -- Additional command line arguments to pass to repo server

2765

extraArgs: []

2766

# -- Environment variables to pass to repo server

2767

env: []

2768

# -- envFrom to pass to repo server

2769

# @default -- `[]` (See [values.yaml])

2770

envFrom: []

2771

# - configMapRef:

2772

# name: config-map-name

2773

# - secretRef:

2774

# name: secret-name

2775

2776

# -- Specify postStart and preStop lifecycle hooks for your argo-repo-server container

2777

lifecycle: {}

2778

# -- Additional containers to be added to the repo server pod

2779

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/

2780

## Note: Supports use of custom Helm templates

2781

extraContainers: []

2782

# - name: cmp-my-plugin

2783

# command:

2784

# - "/var/run/argocd/argocd-cmp-server"

2785

# image: busybox

2786

# securityContext:

2787

# runAsNonRoot: true

2788

# runAsUser: 999

2789

# volumeMounts:

2790

# - mountPath: /var/run/argocd

2791

# name: var-files

2792

# - mountPath: /home/argocd/cmp-server/plugins

2793

# name: plugins

2794

# # Remove this volumeMount if you've chosen to bake the config file into the sidecar image.

2795

# - mountPath: /home/argocd/cmp-server/config/plugin.yaml

2796

# subPath: my-plugin.yaml

2797

# name: argocd-cmp-cm

2798

# # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps

2799

# # mitigate path traversal attacks.

2800

# - mountPath: /tmp

2801

# name: cmp-tmp

2802

# - name: cmp-my-plugin2

2803

# command:

2804

# - "/var/run/argocd/argocd-cmp-server"

2805

# image: busybox

2806

# securityContext:

2807

# runAsNonRoot: true

2808

# runAsUser: 999

2809

# volumeMounts:

2810

# - mountPath: /var/run/argocd

2811

# name: var-files

2812

# # Remove this volumeMount if you've chosen to bake the config file into the sidecar image.

2813

# - mountPath: /home/argocd/cmp-server/plugins

2814

# name: plugins

2815

# - mountPath: /home/argocd/cmp-server/config/plugin.yaml

2816

# subPath: my-plugin2.yaml

2817

# name: argocd-cmp-cm

2818

# # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps

2819

# # mitigate path traversal attacks.

2820

# - mountPath: /tmp

2821

# name: cmp-tmp

2822

2823

# -- Init containers to add to the repo server pods

2824

initContainers: []

2825

copyutil:

2826

# -- Extra arguments for the cp command in the repo server copyutil initContainer

2827

# @default -- `"--update=none"`

2828

extraArgs: "--update=none"

2829

# -- Resource limits and requests for the repo server copyutil initContainer

2830

resources: {}

2831

# limits:

2832

# cpu: 100m

2833

# memory: 128Mi

2834

# requests:

2835

# cpu: 50m

2836

# memory: 64Mi

2837

# -- Additional volumeMounts to the repo server main container

2838

volumeMounts: []

2839

# -- Additional volumes to the repo server pod

2840

volumes: []

2841

# - name: argocd-cmp-cm

2842

# configMap:

2843

# name: argocd-cmp-cm

2844

# - name: cmp-tmp

2845

# emptyDir: {}

2846

2847

# -- Volumes to be used in replacement of emptydir on default volumes

2848

existingVolumes: {}

2849

# gpgKeyring:

2850

# persistentVolumeClaim:

2851

# claimName: pvc-argocd-repo-server-keyring

2852

# helmWorkingDir:

2853

# persistentVolumeClaim:

2854

# claimName: pvc-argocd-repo-server-workdir

2855

# tmp:

2856

# persistentVolumeClaim:

2857

# claimName: pvc-argocd-repo-server-tmp

2858

# varFiles:

2859

# persistentVolumeClaim:

2860

# claimName: pvc-argocd-repo-server-varfiles

2861

# plugins:

2862

# persistentVolumeClaim:

2863

# claimName: pvc-argocd-repo-server-plugins

2864

2865

## RepoServer emptyDir volumes

2866

emptyDir:

2867

# -- EmptyDir size limit for repo server

2868

# @default -- `""` (defaults not set if not specified i.e. no size limit)

2869

sizeLimit: ""

2870

# sizeLimit: "1Gi"

2871

# -- Toggle the usage of a ephemeral Helm working directory

2872

useEphemeralHelmWorkingDir: true

2873

# -- Annotations to be added to repo server Deployment

2874

deploymentAnnotations: {}

2875

# -- Labels for the repo server Deployment

2876

deploymentLabels: {}

2877

# -- Annotations to be added to repo server pods

2878

podAnnotations: {}

2879

# -- Labels to be added to repo server pods

2880

podLabels: {}

2881

# -- Resource limits and requests for the repo server pods

2882

resources: {}

2883

# limits:

2884

# cpu: 50m

2885

# memory: 128Mi

2886

# requests:

2887

# cpu: 10m

2888

# memory: 64Mi

2889

2890

# Repo server container ports

2891

containerPorts:

2892

# -- Repo server container port

2893

server: 8081

2894

# -- Metrics container port

2895

metrics: 8084

2896

# -- Host Network for Repo server pods

2897

hostNetwork: false

2898

# -- [DNS configuration]

2899

dnsConfig: {}

2900

# -- Alternative DNS policy for Repo server pods

2901

dnsPolicy: "ClusterFirst"

2902

# -- Repo server container-level security context

2903

# @default -- See [values.yaml]

2904

containerSecurityContext:

2905

runAsNonRoot: true

2906

readOnlyRootFilesystem: true

2907

allowPrivilegeEscalation: false

2908

seccompProfile:

2909

type: RuntimeDefault

2910

capabilities:

2911

drop:

2912

- ALL

2913

## Readiness and liveness probes for Repo Server

2914

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2915

readinessProbe:

2916

# -- Enable Kubernetes readiness probe for Repo Server

2917

enabled: true

2918

# -- Http path to use for the readiness probe

2919

httpPath: /healthz

2920

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2921

failureThreshold: 3

2922

# -- Number of seconds after the container has started before [probe] is initiated

2923

initialDelaySeconds: 10

2924

# -- How often (in seconds) to perform the [probe]

2925

periodSeconds: 10

2926

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2927

successThreshold: 1

2928

# -- Number of seconds after which the [probe] times out

2929

timeoutSeconds: 1

2930

livenessProbe:

2931

# -- Enable Kubernetes liveness probe for Repo Server

2932

enabled: true

2933

# -- Http path to use for the liveness probe

2934

httpPath: /healthz?full=true

2935

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2936

failureThreshold: 3

2937

# -- Number of seconds after the container has started before [probe] is initiated

2938

initialDelaySeconds: 10

2939

# -- How often (in seconds) to perform the [probe]

2940

periodSeconds: 10

2941

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2942

successThreshold: 1

2943

# -- Number of seconds after which the [probe] times out

2944

timeoutSeconds: 1

2945

## Startup probe for Repo Server (optional)

2946

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2947

startupProbe:

2948

# -- Enable Kubernetes startup probe for Repo Server

2949

enabled: false

2950

# -- Http path to use for the startup probe

2951

httpPath: /healthz

2952

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2953

failureThreshold: 20

2954

# -- Number of seconds after the container has started before [probe] is initiated

2955

initialDelaySeconds: 10

2956

# -- How often (in seconds) to perform the [probe]

2957

periodSeconds: 10

2958

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2959

successThreshold: 1

2960

# -- Number of seconds after which the [probe] times out

2961

timeoutSeconds: 1

2962

# -- terminationGracePeriodSeconds for container lifecycle hook

2963

terminationGracePeriodSeconds: 30

2964

# -- [Node selector]

2965

# @default -- `{}` (defaults to global.nodeSelector)

2966

nodeSelector: {}

2967

# -- [Tolerations] for use with node taints

2968

# @default -- `[]` (defaults to global.tolerations)

2969

tolerations: []

2970

# -- Assign custom [affinity] rules to the deployment

2971

# @default -- `{}` (defaults to global.affinity preset)

2972

affinity: {}

2973

# -- Assign custom [TopologySpreadConstraints] rules to the repo server

2974

# @default -- `[]` (defaults to global.topologySpreadConstraints)

2975

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

2976

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

2977

topologySpreadConstraints: []

2978

# - maxSkew: 1

2979

# topologyKey: topology.kubernetes.io/zone

2980

# whenUnsatisfiable: DoNotSchedule

2981

2982

# -- Deployment strategy to be added to the repo server Deployment

2983

deploymentStrategy: {}

2984

# type: RollingUpdate

2985

# rollingUpdate:

2986

# maxSurge: 25%

2987

# maxUnavailable: 25%

2988

2989

# -- Priority class for the repo server pods

2990

# @default -- `""` (defaults to global.priorityClassName)

2991

priorityClassName: ""

2992

# TLS certificate configuration via Secret

2993

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-repo-server

2994

## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart repo server automatically without extra controllers.

2995

certificateSecret:

2996

# -- Create argocd-repo-server-tls secret

2997

enabled: false

2998

# -- Annotations to be added to argocd-repo-server-tls secret

2999

annotations: {}

3000

# -- Labels to be added to argocd-repo-server-tls secret

3001

labels: {}

3002

# -- Certificate authority. Required for self-signed certificates.

3003

ca: ""

3004

# -- Certificate private key

3005

key: ""

3006

# -- Certificate data. Must contain SANs of Repo service (ie: argocd-repo-server, argocd-repo-server.argo-cd.svc)

3007

crt: ""

3008

## Repo server service configuration

3009

service:

3010

# -- Repo server service annotations

3011

annotations: {}

3012

# -- Repo server service labels

3013

labels: {}

3014

# -- Repo server service port

3015

port: 8081

3016

# -- Repo server service port name

3017

portName: tcp-repo-server

3018

# -- Traffic distribution preference for the repo server service. If the field is not set, the implementation will apply its default routing strategy.

3019

trafficDistribution: ""

3020

## Repo server metrics service configuration

3021

metrics:

3022

# -- Deploy metrics service

3023

enabled: false

3024

service:

3025

# -- Metrics service type

3026

type: ClusterIP

3027

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3028

clusterIP: ""

3029

# -- Metrics service annotations

3030

annotations: {}

3031

# -- Metrics service labels

3032

labels: {}

3033

# -- Metrics service port

3034

servicePort: 8084

3035

# -- Metrics service port name

3036

portName: http-metrics

3037

serviceMonitor:

3038

# -- Enable a prometheus ServiceMonitor

3039

enabled: false

3040

# -- Prometheus ServiceMonitor interval

3041

interval: 30s

3042

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

3043

scrapeTimeout: ""

3044

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3045

honorLabels: false

3046

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3047

relabelings: []

3048

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3049

metricRelabelings: []

3050

# -- Prometheus ServiceMonitor selector

3051

selector: {}

3052

# prometheus: kube-prometheus

3053

3054

# -- Prometheus ServiceMonitor scheme

3055

scheme: ""

3056

# -- Prometheus ServiceMonitor tlsConfig

3057

tlsConfig: {}

3058

# -- Prometheus ServiceMonitor namespace

3059

namespace: "" # "monitoring"

3060

# -- Prometheus ServiceMonitor labels

3061

additionalLabels: {}

3062

# -- Prometheus ServiceMonitor annotations

3063

annotations: {}

3064

## Enable Custom Rules for the Repo server's Cluster Role resource

3065

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

3066

## Defaults to off

3067

clusterRoleRules:

3068

# -- Enable custom rules for the Repo server's Cluster Role resource

3069

enabled: false

3070

# -- List of custom rules for the Repo server's Cluster Role resource

3071

rules: []

3072

# -- Automount API credentials for the Service Account into the pod.

3073

automountServiceAccountToken: true

3074

## Repo server service account

3075

## If create is set to true, make sure to uncomment the name and update the rbac section below

3076

serviceAccount:

3077

# -- Create repo server service account

3078

create: true

3079

# -- Repo server service account name

3080

3081

# -- Annotations applied to created service account

3082

annotations: {}

3083

# -- Labels applied to created service account

3084

labels: {}

3085

# -- Automount API credentials for the Service Account

3086

automountServiceAccountToken: true

3087

# -- Repo server rbac rules

3088

rbac: []

3089

# - apiGroups:

3090

# - argoproj.io

3091

# resources:

3092

# - applications

3093

# verbs:

3094

# - get

3095

# - list

3096

# - watch

3097

3098

# Default repo server's network policy

3099

networkPolicy:

3100

# -- Default network policy rules used by repo server

3101

# @default -- `false` (defaults to global.networkPolicy.create)

3102

create: false

3103

## ApplicationSet controller

3104

applicationSet:

3105

# -- ApplicationSet controller name string

3106

3107

# -- The number of ApplicationSet controller pods to run

3108

replicas: 1

3109

# -- Runtime class name for the ApplicationSet controller

3110

# @default -- `""` (defaults to global.runtimeClassName)

3111

runtimeClassName: ""

3112

## ApplicationSet controller Pod Disruption Budget

3113

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

3114

pdb:

3115

# -- Deploy a [PodDisruptionBudget] for the ApplicationSet controller

3116

enabled: false

3117

# -- Labels to be added to ApplicationSet controller pdb

3118

labels: {}

3119

# -- Annotations to be added to ApplicationSet controller pdb

3120

annotations: {}

3121

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

3122

# @default -- `""` (defaults to 0 if not specified)

3123

minAvailable: ""

3124

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

3125

## Has higher precedence over `applicationSet.pdb.minAvailable`

3126

maxUnavailable: ""

3127

## ApplicationSet controller Vertical Pod Autoscaler

3128

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

3129

vpa:

3130

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the ApplicationSet controller

3131

enabled: false

3132

# -- Labels to be added to ApplicationSet controller vpa

3133

labels: {}

3134

# -- Annotations to be added to ApplicationSet controller vpa

3135

annotations: {}

3136

# -- One of the VPA operation modes

3137

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

3138

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

3139

updateMode: Initial

3140

# -- Controls how VPA computes the recommended resources for ApplicationSet controller container

3141

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

3142

containerPolicy: {}

3143

# controlledResources: ["cpu", "memory"]

3144

# minAllowed:

3145

# cpu: 250m

3146

# memory: 256Mi

3147

# maxAllowed:

3148

# cpu: 1

3149

# memory: 1Gi

3150

## ApplicationSet controller image

3151

image:

3152

# -- Repository to use for the ApplicationSet controller

3153

# @default -- `""` (defaults to global.image.repository)

3154

repository: ""

3155

# -- Tag to use for the ApplicationSet controller

3156

# @default -- `""` (defaults to global.image.tag)

3157

tag: ""

3158

# -- Image pull policy for the ApplicationSet controller

3159

# @default -- `""` (defaults to global.image.imagePullPolicy)

3160

imagePullPolicy: ""

3161

# -- If defined, uses a Secret to pull an image from a private Docker registry or repository.

3162

# @default -- `[]` (defaults to global.imagePullSecrets)

3163

imagePullSecrets: []

3164

# -- ApplicationSet controller command line flags

3165

extraArgs: []

3166

# -- Environment variables to pass to the ApplicationSet controller

3167

extraEnv: []

3168

# - name: "MY_VAR"

3169

# value: "value"

3170

3171

# -- envFrom to pass to the ApplicationSet controller

3172

# @default -- `[]` (See [values.yaml])

3173

extraEnvFrom: []

3174

# - configMapRef:

3175

# name: config-map-name

3176

# - secretRef:

3177

# name: secret-name

3178

3179

# -- Additional containers to be added to the ApplicationSet controller pod

3180

## Note: Supports use of custom Helm templates

3181

extraContainers: []

3182

# -- Init containers to add to the ApplicationSet controller pod

3183

## Note: Supports use of custom Helm templates

3184

initContainers: []

3185

# -- List of extra mounts to add (normally used with extraVolumes)

3186

extraVolumeMounts: []

3187

# -- List of extra volumes to add

3188

extraVolumes: []

3189

## ApplicationSet controller emptyDir volumes

3190

emptyDir:

3191

# -- EmptyDir size limit for applicationSet controller

3192

# @default -- `""` (defaults not set if not specified i.e. no size limit)

3193

sizeLimit: ""

3194

# sizeLimit: "1Gi"

3195

## Metrics service configuration

3196

metrics:

3197

# -- Deploy metrics service

3198

enabled: false

3199

service:

3200

# -- Metrics service type

3201

type: ClusterIP

3202

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3203

clusterIP: ""

3204

# -- Metrics service annotations

3205

annotations: {}

3206

# -- Metrics service labels

3207

labels: {}

3208

# -- Metrics service port

3209

servicePort: 8080

3210

# -- Metrics service port name

3211

portName: http-metrics

3212

serviceMonitor:

3213

# -- Enable a prometheus ServiceMonitor

3214

enabled: false

3215

# -- Prometheus ServiceMonitor interval

3216

interval: 30s

3217

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

3218

scrapeTimeout: ""

3219

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3220

honorLabels: false

3221

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3222

relabelings: []

3223

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3224

metricRelabelings: []

3225

# -- Prometheus ServiceMonitor selector

3226

selector: {}

3227

# prometheus: kube-prometheus

3228

3229

# -- Prometheus ServiceMonitor scheme

3230

scheme: ""

3231

# -- Prometheus ServiceMonitor tlsConfig

3232

tlsConfig: {}

3233

# -- Prometheus ServiceMonitor namespace

3234

namespace: "" # monitoring

3235

# -- Prometheus ServiceMonitor labels

3236

additionalLabels: {}

3237

# -- Prometheus ServiceMonitor annotations

3238

annotations: {}

3239

## ApplicationSet service configuration

3240

service:

3241

# -- ApplicationSet service annotations

3242

annotations: {}

3243

# -- ApplicationSet service labels

3244

labels: {}

3245

# -- ApplicationSet service type

3246

type: ClusterIP

3247

# -- ApplicationSet service port

3248

port: 7000

3249

# -- ApplicationSet service port name

3250

portName: http-webhook

3251

# -- Automount API credentials for the Service Account into the pod.

3252

automountServiceAccountToken: true

3253

serviceAccount:

3254

# -- Create ApplicationSet controller service account

3255

create: true

3256

# -- ApplicationSet controller service account name

3257

3258

# -- Annotations applied to created service account

3259

annotations: {}

3260

# -- Labels applied to created service account

3261

labels: {}

3262

# -- Automount API credentials for the Service Account

3263

automountServiceAccountToken: true

3264

# -- Annotations to be added to ApplicationSet controller Deployment

3265

deploymentAnnotations: {}

3266

# -- Labels for the ApplicationSet controller Deployment

3267

deploymentLabels: {}

3268

# -- Annotations for the ApplicationSet controller pods

3269

podAnnotations: {}

3270

# -- Labels for the ApplicationSet controller pods

3271

podLabels: {}

3272

# -- Resource limits and requests for the ApplicationSet controller pods.

3273

resources: {}

3274

# limits:

3275

# cpu: 100m

3276

# memory: 128Mi

3277

# requests:

3278

# cpu: 100m

3279

# memory: 128Mi

3280

3281

# ApplicationSet controller container ports

3282

containerPorts:

3283

# -- Metrics container port

3284

metrics: 8080

3285

# -- Probe container port

3286

probe: 8081

3287

# -- Webhook container port

3288

webhook: 7000

3289

# -- [DNS configuration]

3290

dnsConfig: {}

3291

# -- Alternative DNS policy for ApplicationSet controller pods

3292

dnsPolicy: "ClusterFirst"

3293

# -- ApplicationSet controller container-level security context

3294

# @default -- See [values.yaml]

3295

containerSecurityContext:

3296

runAsNonRoot: true

3297

readOnlyRootFilesystem: true

3298

allowPrivilegeEscalation: false

3299

seccompProfile:

3300

type: RuntimeDefault

3301

capabilities:

3302

drop:

3303

- ALL

3304

## Probes for ApplicationSet controller (optional)

3305

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3306

readinessProbe:

3307

# -- Enable Kubernetes liveness probe for ApplicationSet controller

3308

enabled: false

3309

# -- Number of seconds after the container has started before [probe] is initiated

3310

initialDelaySeconds: 10

3311

# -- How often (in seconds) to perform the [probe]

3312

periodSeconds: 10

3313

# -- Number of seconds after which the [probe] times out

3314

timeoutSeconds: 1

3315

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3316

successThreshold: 1

3317

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3318

failureThreshold: 3

3319

livenessProbe:

3320

# -- Enable Kubernetes liveness probe for ApplicationSet controller

3321

enabled: false

3322

# -- Number of seconds after the container has started before [probe] is initiated

3323

initialDelaySeconds: 10

3324

# -- How often (in seconds) to perform the [probe]

3325

periodSeconds: 10

3326

# -- Number of seconds after which the [probe] times out

3327

timeoutSeconds: 1

3328

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3329

successThreshold: 1

3330

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3331

failureThreshold: 3

3332

## Startup probe for ApplicationSet controller (optional)

3333

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3334

startupProbe:

3335

# -- Enable Kubernetes startup probe for ApplicationSet controller

3336

enabled: false

3337

# -- Number of seconds after the container has started before [probe] is initiated

3338

initialDelaySeconds: 10

3339

# -- How often (in seconds) to perform the [probe]

3340

periodSeconds: 10

3341

# -- Number of seconds after which the [probe] times out

3342

timeoutSeconds: 1

3343

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3344

successThreshold: 1

3345

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3346

failureThreshold: 20

3347

# -- terminationGracePeriodSeconds for container lifecycle hook

3348

terminationGracePeriodSeconds: 30

3349

# -- [Node selector]

3350

# @default -- `{}` (defaults to global.nodeSelector)

3351

nodeSelector: {}

3352

# -- [Tolerations] for use with node taints

3353

# @default -- `[]` (defaults to global.tolerations)

3354

tolerations: []

3355

# -- Assign custom [affinity] rules

3356

# @default -- `{}` (defaults to global.affinity preset)

3357

affinity: {}

3358

# -- Assign custom [TopologySpreadConstraints] rules to the ApplicationSet controller

3359

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3360

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

3361

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3362

topologySpreadConstraints: []

3363

# - maxSkew: 1

3364

# topologyKey: topology.kubernetes.io/zone

3365

# whenUnsatisfiable: DoNotSchedule

3366

3367

# -- Deployment strategy to be added to the ApplicationSet controller Deployment

3368

deploymentStrategy: {}

3369

# type: RollingUpdate

3370

# rollingUpdate:

3371

# maxSurge: 25%

3372

# maxUnavailable: 25%

3373

3374

# -- Priority class for the ApplicationSet controller pods

3375

# @default -- `""` (defaults to global.priorityClassName)

3376

priorityClassName: ""

3377

# TLS certificate configuration via cert-manager

3378

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-configuration

3379

certificate:

3380

# -- Deploy a Certificate resource (requires cert-manager)

3381

enabled: false

3382

# -- Certificate primary domain (commonName)

3383

# @default -- `""` (defaults to global.domain)

3384

domain: ""

3385

# -- Certificate Subject Alternate Names (SANs)

3386

additionalHosts: []

3387

# -- The requested 'duration' (i.e. lifetime) of the certificate.

3388

# @default -- `""` (defaults to 2160h = 90d if not specified)

3389

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

3390

duration: ""

3391

# -- How long before the expiry a certificate should be renewed.

3392

# @default -- `""` (defaults to 360h = 15d if not specified)

3393

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

3394

renewBefore: ""

3395

# Certificate issuer

3396

## Ref: https://cert-manager.io/docs/concepts/issuer

3397

issuer:

3398

# -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io`

3399

group: ""

3400

# -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer`

3401

kind: ""

3402

# -- Certificate issuer name. Eg. `letsencrypt`

3403

3404

# Private key of the certificate

3405

privateKey:

3406

# -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always`

3407

rotationPolicy: Never

3408

# -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8`

3409

encoding: PKCS1

3410

# -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA`

3411

algorithm: RSA

3412

# -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored.

3413

size: 2048

3414

# -- Annotations to be applied to the ApplicationSet Certificate

3415

annotations: {}

3416

## Ingress for the Git Generator webhook

3417

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration)

3418

ingress:

3419

# -- Enable an ingress resource for ApplicationSet webhook

3420

enabled: false

3421

# -- Additional ingress labels

3422

labels: {}

3423

# -- Additional ingress annotations

3424

annotations: {}

3425

# -- Defines which ingress ApplicationSet controller will implement the resource

3426

ingressClassName: ""

3427

# -- Argo CD ApplicationSet hostname

3428

# @default -- `""` (defaults to global.domain)

3429

hostname: ""

3430

# -- List of ingress paths

3431

path: /api/webhook

3432

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

3433

pathType: Prefix

3434

# -- Enable TLS configuration for the hostname defined at `applicationSet.webhook.ingress.hostname`

3435

## TLS certificate will be retrieved from a TLS secret with name:`argocd-applicationset-controller-tls`

3436

tls: false

3437

# -- The list of additional hostnames to be covered by ingress record

3438

# @default -- `[]` (See [values.yaml])

3439

extraHosts: []

3440

# - name: argocd.example.com

3441

# path: /

3442

3443

# -- Additional ingress paths

3444

# @default -- `[]` (See [values.yaml])

3445

extraPaths: []

3446

# - path: /*

3447

# pathType: Prefix

3448

# backend:

3449

# service:

3450

# name: ssl-redirect

3451

# port:

3452

# name: use-annotation

3453

3454

# -- Additional ingress rules

3455

# @default -- `[]` (See [values.yaml])

3456

## Note: Supports use of custom Helm templates

3457

extraRules: []

3458

# - http:

3459

# paths:

3460

# - path: /api/webhook

3461

# pathType: Prefix

3462

# backend:

3463

# service:

3464

# name: '{{ include "argo-cd.applicationSet.fullname" . }}'

3465

# port:

3466

# name: '{{ .Values.applicationSet.service.portName }}'

3467

3468

# -- Additional ingress TLS configuration

3469

# @default -- `[]` (See [values.yaml])

3470

extraTls: []

3471

# - secretName: argocd-applicationset-tls

3472

# hosts:

3473

# - argocd-applicationset.example.com

3474

## Gateway API HTTPRoute for the Git Generator webhook

3475

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration)

3476

# NOTE: Gateway API support is in EXPERIMENTAL status

3477

# Support depends on your Gateway controller implementation

3478

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

3479

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

3480

httproute:

3481

# -- Enable HTTPRoute resource for Argo CD Applicationset Webhook (Gateway API)

3482

enabled: false

3483

# -- Additional HTTPRoute labels

3484

labels: {}

3485

# -- Additional HTTPRoute annotations

3486

annotations: {}

3487

# -- Gateway API parentRefs for the HTTPRoute

3488

## Must reference an existing Gateway

3489

# @default -- `[]` (See [values.yaml])

3490

parentRefs: []

3491

# - name: example-gateway

3492

# namespace: example-gateway-namespace

3493

# sectionName: https

3494

# -- List of hostnames for the HTTPRoute

3495

# @default -- `[]` (See [values.yaml])

3496

hostnames: []

3497

# - argocd.example.com

3498

# -- HTTPRoute rules configuration

3499

# @default -- `[]` (See [values.yaml])

3500

rules:

3501

- matches:

3502

- path:

3503

type: PathPrefix

3504

value: /api/webhook

3505

# filters: []

3506

# - type: RequestHeaderModifier

3507

# requestHeaderModifier:

3508

# add:

3509

# - name: X-Custom-Header

3510

# value: custom-value

3511

# Gateway API ListenerSet configuration for the Git Generator webhook

3512

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration

3513

# NOTE: Gateway API support is in EXPERIMENTAL status

3514

# ListenerSet allows attaching additional listeners to an existing Gateway

3515

# Requires Gateway API v1alpha2 and a controller that supports ListenerSet

3516

# Refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.ListenerSet

3517

listenerset:

3518

# -- Enable ListenerSet resource for Argo CD ApplicationSet webhook (Gateway API)

3519

enabled: false

3520

# -- Additional ListenerSet labels

3521

labels: {}

3522

# -- Additional ListenerSet annotations

3523

annotations: {}

3524

# -- Gateway API parentRef for the ListenerSet

3525

## Must reference an existing Gateway. Unlike HTTPRoute, ListenerSet accepts exactly one parentRef.

3526

# @default -- `{}` (See [values.yaml])

3527

parentRef: {}

3528

# name: example-gateway

3529

# namespace: example-gateway-namespace

3530

# -- Hostname for the synthesized listener. Defaults to global.domain when empty.

3531

hostname: ""

3532

# -- Name of the synthesized listener. Also used as sectionName in auto-derived httproute parentRefs.

3533

listenerName: https

3534

# -- Port for the synthesized listener

3535

port: 443

3536

# -- Protocol for the synthesized listener

3537

protocol: HTTPS

3538

# -- TLS configuration for the synthesized listener

3539

tls:

3540

# -- Enable TLS on the synthesized listener

3541

enabled: true

3542

# -- TLS termination mode

3543

mode: Terminate

3544

# -- Secret name for TLS certificate. Defaults to `argocd-applicationset-controller-tls` when empty.

3545

secretName: ""

3546

# -- allowedRoutes for the synthesized listener

3547

allowedRoutes:

3548

namespaces:

3549

from: Same

3550

# -- Listeners to attach to the parent Gateway. When non-empty, used verbatim and all synthesized listener fields above are ignored.

3551

# @default -- `[]` (See [values.yaml])

3552

listeners: []

3553

# - name: https

3554

# port: 443

3555

# protocol: HTTPS

3556

# hostname: argocd.example.com

3557

# tls:

3558

# mode: Terminate

3559

# certificateRefs:

3560

# - group: ""

3561

# kind: Secret

3562

# name: argocd-applicationset-controller-tls

3563

# allowedRoutes:

3564

# namespaces:

3565

# from: Same

3566

# -- Enable ApplicationSet in any namespace feature

3567

allowAnyNamespace: false

3568

# Default ApplicationSet controller's network policy

3569

networkPolicy:

3570

# -- Default network policy rules used by ApplicationSet controller

3571

# @default -- `false` (defaults to global.networkPolicy.create)

3572

create: false

3573

## Notifications controller

3574

notifications:

3575

# -- Enable notifications controller

3576

enabled: true

3577

# -- Notifications controller name string

3578

3579

# -- Argo CD dashboard url; used in place of {{.context.argocdUrl}} in templates

3580

# @default -- `""` (defaults to https://`global.domain`)

3581

argocdUrl: ""

3582

# -- Runtime class name for the notifications controller

3583

# @default -- `""` (defaults to global.runtimeClassName)

3584

runtimeClassName: ""

3585

## Notifications controller Pod Disruption Budget

3586

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

3587

pdb:

3588

# -- Deploy a [PodDisruptionBudget] for the notifications controller

3589

enabled: false

3590

# -- Labels to be added to notifications controller pdb

3591

labels: {}

3592

# -- Annotations to be added to notifications controller pdb

3593

annotations: {}

3594

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

3595

# @default -- `""` (defaults to 0 if not specified)

3596

minAvailable: ""

3597

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

3598

## Has higher precedence over `notifications.pdb.minAvailable`

3599

maxUnavailable: ""

3600

## Notifications controller Vertical Pod Autoscaler

3601

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

3602

vpa:

3603

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the notifications controller

3604

enabled: false

3605

# -- Labels to be added to notifications controller vpa

3606

labels: {}

3607

# -- Annotations to be added to notifications controller vpa

3608

annotations: {}

3609

# -- One of the VPA operation modes

3610

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

3611

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

3612

updateMode: Initial

3613

# -- Controls how VPA computes the recommended resources for notifications controller container

3614

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

3615

containerPolicy: {}

3616

# controlledResources: ["cpu", "memory"]

3617

# minAllowed:

3618

# cpu: 250m

3619

# memory: 256Mi

3620

# maxAllowed:

3621

# cpu: 1

3622

# memory: 1Gi

3623

## Notifications controller image

3624

image:

3625

# -- Repository to use for the notifications controller

3626

# @default -- `""` (defaults to global.image.repository)

3627

repository: ""

3628

# -- Tag to use for the notifications controller

3629

# @default -- `""` (defaults to global.image.tag)

3630

tag: ""

3631

# -- Image pull policy for the notifications controller

3632

# @default -- `""` (defaults to global.image.imagePullPolicy)

3633

imagePullPolicy: ""

3634

# -- Secrets with credentials to pull images from a private registry

3635

# @default -- `[]` (defaults to global.imagePullSecrets)

3636

imagePullSecrets: []

3637

# DEPRECATED - Use configs.params to override

3638

# -- Notifications controller log format. Either `text` or `json`

3639

# @default -- `""` (defaults to global.logging.format)

3640

# logFormat: ""

3641

# -- Notifications controller log level. One of: `debug`, `info`, `warn`, `error`

3642

# @default -- `""` (defaults to global.logging.level)

3643

# logLevel: ""

3644

3645

# -- Extra arguments to provide to the notifications controller

3646

extraArgs: []

3647

# -- Additional container environment variables

3648

extraEnv: []

3649

# -- envFrom to pass to the notifications controller

3650

# @default -- `[]` (See [values.yaml])

3651

extraEnvFrom: []

3652

# - configMapRef:

3653

# name: config-map-name

3654

# - secretRef:

3655

# name: secret-name

3656

3657

# -- Additional containers to be added to the notifications controller pod

3658

## Note: Supports use of custom Helm templates

3659

extraContainers: []

3660

# -- Init containers to add to the notifications controller pod

3661

## Note: Supports use of custom Helm templates

3662

initContainers: []

3663

# -- List of extra mounts to add (normally used with extraVolumes)

3664

extraVolumeMounts: []

3665

# -- List of extra volumes to add

3666

extraVolumes: []

3667

# -- Define user-defined context

3668

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/#defining-user-defined-context

3669

context: {}

3670

# region: east

3671

# environmentName: staging

3672

3673

secret:

3674

# -- Whether helm chart creates notifications controller secret

3675

## If true, will create a secret with the name below. Otherwise, will assume existence of a secret with that name.

3676

create: true

3677

# -- notifications controller Secret name

3678

3679

# -- key:value pairs of annotations to be added to the secret

3680

annotations: {}

3681

# -- key:value pairs of labels to be added to the secret

3682

labels: {}

3683

# -- Generic key:value pairs to be inserted into the secret

3684

## Can be used for templates, notification services etc. Some examples given below.

3685

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/

3686

items: {}

3687

# slack-token:

3688

# # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/slack/

3689

# grafana-apiKey:

3690

# # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/grafana/

3691

3692

# webhooks-github-token:

3693

3694

# email-username:

3695

# email-password:

3696

# For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/email/

3697

3698

metrics:

3699

# -- Enables prometheus metrics server

3700

enabled: false

3701

# -- Metrics port

3702

port: 9001

3703

service:

3704

# -- Metrics service type

3705

type: ClusterIP

3706

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3707

clusterIP: ""

3708

# -- Metrics service annotations

3709

annotations: {}

3710

# -- Metrics service labels

3711

labels: {}

3712

# -- Metrics service port name

3713

portName: http-metrics

3714

serviceMonitor:

3715

# -- Enable a prometheus ServiceMonitor

3716

enabled: false

3717

# -- Prometheus ServiceMonitor selector

3718

selector: {}

3719

# prometheus: kube-prometheus

3720

# -- Prometheus ServiceMonitor labels

3721

additionalLabels: {}

3722

# -- Prometheus ServiceMonitor annotations

3723

annotations: {}

3724

# namespace: monitoring

3725

# interval: 30s

3726

# scrapeTimeout: 10s

3727

# -- Prometheus ServiceMonitor scheme

3728

scheme: ""

3729

# -- Prometheus ServiceMonitor tlsConfig

3730

tlsConfig: {}

3731

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3732

honorLabels: false

3733

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3734

relabelings: []

3735

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3736

metricRelabelings: []

3737

# -- Configures notification services such as slack, email or custom webhook

3738

# @default -- See [values.yaml]

3739

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/

3740

notifiers: {}

3741

# service.slack: |

3742

# token: $slack-token

3743

3744

# -- Annotations to be applied to the notifications controller Deployment

3745

deploymentAnnotations: {}

3746

# -- Labels for the notifications controller Deployment

3747

deploymentLabels: {}

3748

# -- Annotations to be applied to the notifications controller Pods

3749

podAnnotations: {}

3750

# -- Labels to be applied to the notifications controller Pods

3751

podLabels: {}

3752

# -- Resource limits and requests for the notifications controller

3753

resources: {}

3754

# limits:

3755

# cpu: 100m

3756

# memory: 128Mi

3757

# requests:

3758

# cpu: 100m

3759

# memory: 128Mi

3760

3761

# Notification controller container ports

3762

containerPorts:

3763

# -- Metrics container port

3764

metrics: 9001

3765

# -- [DNS configuration]

3766

dnsConfig: {}

3767

# -- Alternative DNS policy for notifications controller Pods

3768

dnsPolicy: "ClusterFirst"

3769

# -- Notification controller container-level security Context

3770

# @default -- See [values.yaml]

3771

containerSecurityContext:

3772

runAsNonRoot: true

3773

readOnlyRootFilesystem: true

3774

allowPrivilegeEscalation: false

3775

seccompProfile:

3776

type: RuntimeDefault

3777

capabilities:

3778

drop:

3779

- ALL

3780

## Probes for notifications controller Pods (optional)

3781

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3782

readinessProbe:

3783

# -- Enable Kubernetes liveness probe for notifications controller Pods

3784

enabled: false

3785

# -- Number of seconds after the container has started before [probe] is initiated

3786

initialDelaySeconds: 10

3787

# -- How often (in seconds) to perform the [probe]

3788

periodSeconds: 10

3789

# -- Number of seconds after which the [probe] times out

3790

timeoutSeconds: 1

3791

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3792

successThreshold: 1

3793

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3794

failureThreshold: 3

3795

livenessProbe:

3796

# -- Enable Kubernetes liveness probe for notifications controller Pods

3797

enabled: false

3798

# -- Number of seconds after the container has started before [probe] is initiated

3799

initialDelaySeconds: 10

3800

# -- How often (in seconds) to perform the [probe]

3801

periodSeconds: 10

3802

# -- Number of seconds after which the [probe] times out

3803

timeoutSeconds: 1

3804

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3805

successThreshold: 1

3806

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3807

failureThreshold: 3

3808

## Startup probe for notifications controller Pods (optional)

3809

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3810

startupProbe:

3811

# -- Enable Kubernetes startup probe for notifications controller Pods

3812

enabled: false

3813

# -- Number of seconds after the container has started before [probe] is initiated

3814

initialDelaySeconds: 10

3815

# -- How often (in seconds) to perform the [probe]

3816

periodSeconds: 10

3817

# -- Number of seconds after which the [probe] times out

3818

timeoutSeconds: 1

3819

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3820

successThreshold: 1

3821

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3822

failureThreshold: 20

3823

# -- terminationGracePeriodSeconds for container lifecycle hook

3824

terminationGracePeriodSeconds: 30

3825

# -- [Node selector]

3826

# @default -- `{}` (defaults to global.nodeSelector)

3827

nodeSelector: {}

3828

# -- [Tolerations] for use with node taints

3829

# @default -- `[]` (defaults to global.tolerations)

3830

tolerations: []

3831

# -- Assign custom [affinity] rules

3832

# @default -- `{}` (defaults to global.affinity preset)

3833

affinity: {}

3834

# -- Assign custom [TopologySpreadConstraints] rules to the application controller

3835

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3836

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

3837

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3838

topologySpreadConstraints: []

3839

# - maxSkew: 1

3840

# topologyKey: topology.kubernetes.io/zone

3841

# whenUnsatisfiable: DoNotSchedule

3842

3843

# -- Deployment strategy to be added to the notifications controller Deployment

3844

deploymentStrategy:

3845

type: Recreate

3846

# -- Priority class for the notifications controller pods

3847

# @default -- `""` (defaults to global.priorityClassName)

3848

priorityClassName: ""

3849

# -- Automount API credentials for the Service Account into the pod.

3850

automountServiceAccountToken: true

3851

serviceAccount:

3852

# -- Create notifications controller service account

3853

create: true

3854

# -- Notification controller service account name

3855

3856

# -- Annotations applied to created service account

3857

annotations: {}

3858

# -- Labels applied to created service account

3859

labels: {}

3860

# -- Automount API credentials for the Service Account

3861

automountServiceAccountToken: true

3862

cm:

3863

# -- Whether helm chart creates notifications controller config map

3864

create: true

3865

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

3866

## Defaults to off

3867

clusterRoleRules:

3868

# -- List of custom rules for the notifications controller's ClusterRole resource

3869

rules: []

3870

# -- Contains centrally managed global application subscriptions

3871

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/subscriptions/

3872

subscriptions: []

3873

# # subscription for on-sync-status-unknown trigger notifications

3874

# - recipients:

3875

# - slack:test2

3876

# - email:test@gmail.com

3877

# triggers:

3878

# - on-sync-status-unknown

3879

# # subscription restricted to applications with matching labels only

3880

# - recipients:

3881

# - slack:test3

3882

# selector: test=true

3883

# triggers:

3884

# - on-sync-status-unknown

3885

3886

# -- The notification template is used to generate the notification content

3887

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/

3888

templates: {}

3889

# template.app-deployed: |

3890

# email:

3891

# subject: New version of an application {{.app.metadata.name}} is up and running.

3892

# message: |

3893

# {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests.

3894

# slack:

3895

# attachments: |

3896

# [{

3897

# "title": "{{ .app.metadata.name}}",

3898

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

3899

# "color": "#18be52",

3900

# "fields": [

3901

# {

3902

# "title": "Sync Status",

3903

# "value": "{{.app.status.sync.status}}",

3904

# "short": true

3905

# },

3906

# {

3907

# "title": "Repository",

3908

# "value": "{{.app.spec.source.repoURL}}",

3909

# "short": true

3910

# },

3911

# {

3912

# "title": "Revision",

3913

# "value": "{{.app.status.sync.revision}}",

3914

# "short": true

3915

# }

3916

# {{range $index, $c := .app.status.conditions}}

3917

# {{if not $index}},{{end}}

3918

# {{if $index}},{{end}}

3919

# {

3920

# "title": "{{$c.type}}",

3921

# "value": "{{$c.message}}",

3922

# "short": true

3923

# }

3924

# {{end}}

3925

# ]

3926

# }]

3927

# template.app-health-degraded: |

3928

# email:

3929

# subject: Application {{.app.metadata.name}} has degraded.

3930

# message: |

3931

# {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded.

3932

# Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.

3933

# slack:

3934

# attachments: |-

3935

# [{

3936

# "title": "{{ .app.metadata.name}}",

3937

# "title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

3938

# "color": "#f4c030",

3939

# "fields": [

3940

# {

3941

# "title": "Sync Status",

3942

# "value": "{{.app.status.sync.status}}",

3943

# "short": true

3944

# },

3945

# {

3946

# "title": "Repository",

3947

# "value": "{{.app.spec.source.repoURL}}",

3948

# "short": true

3949

# }

3950

# {{range $index, $c := .app.status.conditions}}

3951

# {{if not $index}},{{end}}

3952

# {{if $index}},{{end}}

3953

# {

3954

# "title": "{{$c.type}}",

3955

# "value": "{{$c.message}}",

3956

# "short": true

3957

# }

3958

# {{end}}

3959

# ]

3960

# }]

3961

# template.app-sync-failed: |

3962

# email:

3963

# subject: Failed to sync application {{.app.metadata.name}}.

3964

# message: |

3965

# {{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}}

3966

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

3967

# slack:

3968

# attachments: |-

3969

# [{

3970

# "title": "{{ .app.metadata.name}}",

3971

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

3972

# "color": "#E96D76",

3973

# "fields": [

3974

# {

3975

# "title": "Sync Status",

3976

# "value": "{{.app.status.sync.status}}",

3977

# "short": true

3978

# },

3979

# {

3980

# "title": "Repository",

3981

# "value": "{{.app.spec.source.repoURL}}",

3982

# "short": true

3983

# }

3984

# {{range $index, $c := .app.status.conditions}}

3985

# {{if not $index}},{{end}}

3986

# {{if $index}},{{end}}

3987

# {

3988

# "title": "{{$c.type}}",

3989

# "value": "{{$c.message}}",

3990

# "short": true

3991

# }

3992

# {{end}}

3993

# ]

3994

# }]

3995

# template.app-sync-running: |

3996

# email:

3997

# subject: Start syncing application {{.app.metadata.name}}.

3998

# message: |

3999

# The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}.

4000

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4001

# slack:

4002

# attachments: |-

4003

# [{

4004

# "title": "{{ .app.metadata.name}}",

4005

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4006

# "color": "#0DADEA",

4007

# "fields": [

4008

# {

4009

# "title": "Sync Status",

4010

# "value": "{{.app.status.sync.status}}",

4011

# "short": true

4012

# },

4013

# {

4014

# "title": "Repository",

4015

# "value": "{{.app.spec.source.repoURL}}",

4016

# "short": true

4017

# }

4018

# {{range $index, $c := .app.status.conditions}}

4019

# {{if not $index}},{{end}}

4020

# {{if $index}},{{end}}

4021

# {

4022

# "title": "{{$c.type}}",

4023

# "value": "{{$c.message}}",

4024

# "short": true

4025

# }

4026

# {{end}}

4027

# ]

4028

# }]

4029

# template.app-sync-status-unknown: |

4030

# email:

4031

# subject: Application {{.app.metadata.name}} sync status is 'Unknown'

4032

# message: |

4033

# {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'.

4034

# Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.

4035

# {{if ne .serviceType "slack"}}

4036

# {{range $c := .app.status.conditions}}

4037

# * {{$c.message}}

4038

# {{end}}

4039

# {{end}}

4040

# slack:

4041

# attachments: |-

4042

# [{

4043

# "title": "{{ .app.metadata.name}}",

4044

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4045

# "color": "#E96D76",

4046

# "fields": [

4047

# {

4048

# "title": "Sync Status",

4049

# "value": "{{.app.status.sync.status}}",

4050

# "short": true

4051

# },

4052

# {

4053

# "title": "Repository",

4054

# "value": "{{.app.spec.source.repoURL}}",

4055

# "short": true

4056

# }

4057

# {{range $index, $c := .app.status.conditions}}

4058

# {{if not $index}},{{end}}

4059

# {{if $index}},{{end}}

4060

# {

4061

# "title": "{{$c.type}}",

4062

# "value": "{{$c.message}}",

4063

# "short": true

4064

# }

4065

# {{end}}

4066

# ]

4067

# }]

4068

# template.app-sync-succeeded: |

4069

# email:

4070

# subject: Application {{.app.metadata.name}} has been successfully synced.

4071

# message: |

4072

# {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}.

4073

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4074

# slack:

4075

# attachments: |-

4076

# [{

4077

# "title": "{{ .app.metadata.name}}",

4078

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4079

# "color": "#18be52",

4080

# "fields": [

4081

# {

4082

# "title": "Sync Status",

4083

# "value": "{{.app.status.sync.status}}",

4084

# "short": true

4085

# },

4086

# {

4087

# "title": "Repository",

4088

# "value": "{{.app.spec.source.repoURL}}",

4089

# "short": true

4090

# }

4091

# {{range $index, $c := .app.status.conditions}}

4092

# {{if not $index}},{{end}}

4093

# {{if $index}},{{end}}

4094

# {

4095

# "title": "{{$c.type}}",

4096

# "value": "{{$c.message}}",

4097

# "short": true

4098

# }

4099

# {{end}}

4100

# ]

4101

# }]

4102

4103

# -- The trigger defines the condition when the notification should be sent

4104

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/

4105

triggers: {}

4106

# trigger.on-deployed: |

4107

# - description: Application is synced and healthy. Triggered once per commit.

4108

# oncePer: app.status.sync.revision

4109

# send:

4110

# - app-deployed

4111

# when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status == 'Healthy'

4112

# trigger.on-health-degraded: |

4113

# - description: Application has degraded

4114

# send:

4115

# - app-health-degraded

4116

# when: app.status.health.status == 'Degraded'

4117

# trigger.on-sync-failed: |

4118

# - description: Application syncing has failed

4119

# send:

4120

# - app-sync-failed

4121

# when: app.status.operationState.phase in ['Error', 'Failed']

4122

# trigger.on-sync-running: |

4123

# - description: Application is being synced

4124

# send:

4125

# - app-sync-running

4126

# when: app.status.operationState.phase in ['Running']

4127

# trigger.on-sync-status-unknown: |

4128

# - description: Application status is 'Unknown'

4129

# send:

4130

# - app-sync-status-unknown

4131

# when: app.status.sync.status == 'Unknown'

4132

# trigger.on-sync-succeeded: |

4133

# - description: Application syncing has succeeded

4134

# send:

4135

# - app-sync-succeeded

4136

# when: app.status.operationState.phase in ['Succeeded']

4137

4138

# For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/#default-triggers

4139

# defaultTriggers: |

4140

# - on-sync-status-unknown

4141

4142

# Default notifications controller's network policy

4143

networkPolicy:

4144

# -- Default network policy rules used by notifications controller

4145

# @default -- `false` (defaults to global.networkPolicy.create)

4146

create: false

4147

commitServer:

4148

# -- Enable commit server

4149

enabled: false

4150

# -- Commit server name

4151

4152

# -- Runtime class name for the commit server

4153

# @default -- `""` (defaults to global.runtimeClassName)

4154

runtimeClassName: ""

4155

## commit server controller image

4156

image:

4157

# -- Repository to use for the commit server

4158

# @default -- `""` (defaults to global.image.repository)

4159

repository: ""

4160

# -- Tag to use for the commit server

4161

# @default -- `""` (defaults to global.image.tag)

4162

tag: ""

4163

# -- Image pull policy for the commit server

4164

# @default -- `""` (defaults to global.image.imagePullPolicy)

4165

imagePullPolicy: ""

4166

# -- commit server command line flags

4167

extraArgs: []

4168

# -- Environment variables to pass to the commit server

4169

extraEnv: []

4170

# - name: "MY_VAR"

4171

# value: "value"

4172

4173

# -- envFrom to pass to the commit server

4174

# @default -- `[]` (See [values.yaml])

4175

extraEnvFrom: []

4176

# - configMapRef:

4177

# name: config-map-name

4178

# - secretRef:

4179

# name: secret-name

4180

4181

# -- List of extra mounts to add (normally used with extraVolumes)

4182

extraVolumeMounts: []

4183

# -- List of extra volumes to add

4184

extraVolumes: []

4185

metrics:

4186

# -- Enables prometheus metrics server

4187

enabled: false

4188

service:

4189

# -- Metrics service type

4190

type: ClusterIP

4191

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

4192

clusterIP: ""

4193

# -- Metrics service annotations

4194

annotations: {}

4195

# -- Metrics service labels

4196

labels: {}

4197

# -- Metrics service port

4198

servicePort: 8087

4199

# -- Metrics service port name

4200

portName: metrics

4201

## commit server service configuration

4202

service:

4203

# -- commit server service annotations

4204

annotations: {}

4205

# -- commit server service labels

4206

labels: {}

4207

# -- commit server service port

4208

port: 8086

4209

# -- commit server service port name

4210

portName: server

4211

# -- Automount API credentials for the Service Account into the pod.

4212

automountServiceAccountToken: false

4213

serviceAccount:

4214

# -- Create commit server service account

4215

create: true

4216

# -- commit server service account name

4217

4218

# -- Annotations applied to created service account

4219

annotations: {}

4220

# -- Labels applied to created service account

4221

labels: {}

4222

# -- Automount API credentials for the Service Account

4223

automountServiceAccountToken: true

4224

# -- Annotations to be added to commit server Deployment

4225

deploymentAnnotations: {}

4226

# -- Labels for the commit server Deployment

4227

deploymentLabels: {}

4228

# -- Annotations for the commit server pods

4229

podAnnotations: {}

4230

# -- Labels for the commit server pods

4231

podLabels: {}

4232

# -- Resource limits and requests for the commit server pods.

4233

resources: {}

4234

# limits:

4235

# cpu: 100m

4236

# memory: 128Mi

4237

# requests:

4238

# cpu: 100m

4239

# memory: 128Mi

4240

4241

# -- [DNS configuration]

4242

dnsConfig: {}

4243

# -- Alternative DNS policy for commit server pods

4244

dnsPolicy: "ClusterFirst"

4245

# -- commit server container-level security context

4246

# @default -- See [values.yaml]

4247

containerSecurityContext:

4248

runAsNonRoot: true

4249

readOnlyRootFilesystem: true

4250

allowPrivilegeEscalation: false

4251

capabilities:

4252

drop:

4253

- ALL

4254

seccompProfile:

4255

type: RuntimeDefault

4256

## Probes for commit server (optional)

4257

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

4258

readinessProbe:

4259

# -- Enable Kubernetes liveness probe for commit server

4260

enabled: true

4261

# -- Http path to use for the readiness probe

4262

httpPath: /healthz

4263

# -- Number of seconds after the container has started before [probe] is initiated

4264

initialDelaySeconds: 5

4265

# -- How often (in seconds) to perform the [probe]

4266

periodSeconds: 10

4267

# -- Number of seconds after which the [probe] times out

4268

timeoutSeconds: 1

4269

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4270

failureThreshold: 3

4271

livenessProbe:

4272

# -- Enable Kubernetes liveness probe for commit server

4273

enabled: true

4274

# -- Http path to use for the liveness probe

4275

httpPath: /healthz?full=true

4276

# -- Number of seconds after the container has started before [probe] is initiated

4277

initialDelaySeconds: 30

4278

# -- How often (in seconds) to perform the [probe]

4279

periodSeconds: 30

4280

# -- Number of seconds after which the [probe] times out

4281

timeoutSeconds: 5

4282

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4283

failureThreshold: 3

4284

## Startup probe for commit server (optional)

4285

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

4286

startupProbe:

4287

# -- Enable Kubernetes startup probe for commit server

4288

enabled: false

4289

# -- Http path to use for the startup probe

4290

httpPath: /healthz

4291

# -- Number of seconds after the container has started before [probe] is initiated

4292

initialDelaySeconds: 10

4293

# -- How often (in seconds) to perform the [probe]

4294

periodSeconds: 10

4295

# -- Number of seconds after which the [probe] times out

4296

timeoutSeconds: 1

4297

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4298

failureThreshold: 20

4299

# -- terminationGracePeriodSeconds for container lifecycle hook

4300

terminationGracePeriodSeconds: 30

4301

# -- [Node selector]

4302

# @default -- `{}` (defaults to global.nodeSelector)

4303

nodeSelector: {}

4304

# -- [Tolerations] for use with node taints

4305

# @default -- `[]` (defaults to global.tolerations)

4306

tolerations: []

4307

# -- Assign custom [affinity] rules

4308

# @default -- `{}` (defaults to global.affinity preset)

4309

affinity: {}

4310

# -- Assign custom [TopologySpreadConstraints] rules to the commit server

4311

# @default -- `[]` (defaults to global.topologySpreadConstraints)

4312

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

4313

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

4314

topologySpreadConstraints: []

4315

# - maxSkew: 1

4316

# topologyKey: topology.kubernetes.io/zone

4317

# whenUnsatisfiable: DoNotSchedule

4318

4319

# -- Deployment strategy to be added to the commit server Deployment

4320

deploymentStrategy: {}

4321

# type: RollingUpdate

4322

# rollingUpdate:

4323

# maxSurge: 25%

4324

# maxUnavailable: 25%

4325

4326

# -- Priority class for the commit server pods

4327

# @default -- `""` (defaults to global.priorityClassName)

4328

priorityClassName: ""

4329

# Default commit server's network policy

4330

networkPolicy:

4331

# -- Default network policy rules used by commit server

4332

# @default -- `false` (defaults to global.networkPolicy.create)

4333

create: false

4334

## Commit server Vertical Pod Autoscaler

4335

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

4336

vpa:

4337

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the commit server

4338

enabled: false

4339

# -- Labels to be added to commit server vpa

4340

labels: {}

4341

# -- Annotations to be added to commit server vpa

4342

annotations: {}

4343

# -- One of the VPA operation modes

4344

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

4345

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

4346

updateMode: Initial

4347

# -- Controls how VPA computes the recommended resources for commit server container

4348

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

4349

containerPolicy: {}

4350

# controlledResources: ["cpu", "memory"]

4351

# minAllowed:

4352

# cpu: 250m

4353

# memory: 256Mi

4354

# maxAllowed:

4355

# cpu: 1

4356

# memory: 1Gi

4357

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

argo-cd

The trusted source for open source

Product

Solutions

Customers

Resources

Company