argo-cd

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

## Argo CD configuration

## Ref: https://github.com/argoproj/argo-cd

# -- Provide a name in place of `argocd`

nameOverride: argocd

# -- String to fully override `"argo-cd.fullname"`

fullnameOverride: ""

# -- Override the namespace

# @default -- `.Release.Namespace`

namespaceOverride: ""

# -- Override the Kubernetes version, which is used to evaluate certain manifests

kubeVersionOverride: ""

# Override APIVersions

# If you want to template helm charts but cannot access k8s API server

# you can set api versions here

apiVersionOverrides: {}

# -- Create aggregated roles that extend existing cluster roles to interact with argo-cd resources

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

createAggregateRoles: false

# -- Create cluster roles for cluster-wide installation.

## Used when you manage applications in the same cluster where Argo CD runs

createClusterRoles: true

openshift:

# -- enables using arbitrary uid for argo repo server

enabled: false

## Custom resource configuration

crds:

# -- Install and upgrade CRDs

install: true

# -- Keep CRDs on chart uninstall

keep: true

# -- Annotations to be added to all CRDs

annotations:

argocd.argoproj.io/sync-options: ServerSideApply=true

# -- Additional labels to be added to all CRDs

additionalLabels: {}

## Globally shared configuration

global:

# -- Default domain used by all components

## Used for ingresses, certificates, SSO, notifications, etc.

domain: argocd.example.com

# -- Runtime class name for all components

runtimeClassName: ""

# -- Common labels for the all resources

additionalLabels: {}

# app: argo-cd

# -- Number of old deployment ReplicaSets to retain. The rest will be garbage collected.

revisionHistoryLimit: 3

# Default image used by all components

image:

# -- If defined, a repository applied to all Argo CD deployments

repository: cgr.dev/chainguard-private/argocd

# -- Overrides the global Argo CD image tag whose default is the chart appVersion

tag: latest@sha256:b4def3ec57cd6e8e903a7aaf79841f8f28ad493571424220989c499cb3e815ef

# -- If defined, a imagePullPolicy applied to all Argo CD deployments

imagePullPolicy: IfNotPresent

# -- Secrets with credentials to pull images from a private registry

imagePullSecrets: []

# Default logging options used by all components

logging:

# -- Set the global logging format. Either: `text` or `json`

format: text

# -- Set the global logging level. One of: `debug`, `info`, `warn` or `error`

level: info

# -- Annotations for the all deployed Statefulsets

statefulsetAnnotations: {}

# -- Labels for the all deployed Statefulsets

statefulsetLabels: {}

# -- Annotations for the all deployed Deployments

deploymentAnnotations: {}

# -- Labels for the all deployed Deployments

deploymentLabels: {}

# -- Annotations for the all deployed pods

podAnnotations: {}

# -- Labels for the all deployed pods

podLabels: {}

# -- Add Prometheus scrape annotations to all metrics services. This can be used as an alternative to the ServiceMonitors.

addPrometheusAnnotations: false

# -- Toggle and define pod-level security context.

# @default -- `{}` (See [values.yaml])

securityContext: {}

# runAsUser: 999

# runAsGroup: 999

# fsGroup: 999

# -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files

hostAliases: []

# - ip: 10.20.30.40

# hostnames:

# - git.myhostname

# Configure dual-stack used by all component services

dualStack:

# -- IP family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)

ipFamilyPolicy: ""

# -- IP families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.

ipFamilies: []

100

# Default network policy rules used by all components

101

networkPolicy:

102

# -- Create NetworkPolicy objects for all components

103

create: true

104

# -- Default deny all ingress traffic

105

defaultDenyIngress: false

106

# -- Default priority class for all components

107

priorityClassName: ""

108

# -- Default node selector for all components

109

nodeSelector:

110

kubernetes.io/os: linux

111

# -- Default tolerations for all components

112

tolerations: []

113

# Default affinity preset for all components

114

affinity:

115

# -- Default pod anti-affinity rules. Either: `none`, `soft` or `hard`

116

podAntiAffinity: soft

117

# Node affinity rules

118

nodeAffinity:

119

# -- Default node affinity rules. Either: `none`, `soft` or `hard`

120

type: hard

121

# -- Default match expressions for node affinity

122

matchExpressions: []

123

# - key: topology.kubernetes.io/zone

124

# operator: In

125

# values:

126

# - antarctica-east1

127

# - antarctica-west1

128

# -- Default [TopologySpreadConstraints] rules for all components

129

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

130

## If labelSelector is left out, it will default to the labelSelector of the component

131

topologySpreadConstraints: []

132

# - maxSkew: 1

133

# topologyKey: topology.kubernetes.io/zone

134

# whenUnsatisfiable: DoNotSchedule

135

136

# -- Deployment strategy for the all deployed Deployments

137

deploymentStrategy: {}

138

# type: RollingUpdate

139

# rollingUpdate:

140

# maxSurge: 25%

141

# maxUnavailable: 25%

142

143

# -- Environment variables to pass to all deployed Deployments

144

env: []

145

# -- Extra volumes to add to all deployed Deployments and StatefulSets

146

extraVolumes: []

147

# Example of adding a custom CA bundle from a ConfigMap:

148

# - name: my-root-ca

149

# configMap:

150

# name: my-trustbundle

151

# items:

152

# - key: bundle.pem

153

# path: ca-certificates.crt

154

155

# -- Extra volume mounts to add to all deployed Deployments and StatefulSets

156

extraVolumeMounts: []

157

# Example of adding a custom CA bundle mount:

158

# - name: my-root-ca

159

# mountPath: /etc/ssl/certs

160

161

# -- Annotations for the all deployed Certificates

162

certificateAnnotations: {}

163

## Argo Configs

164

configs:

165

# General Argo CD configuration. Any values you put under `.configs.cm` are passed to argocd-cm ConfigMap.

166

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cm.yaml

167

cm:

168

# -- Create the argocd-cm configmap for [declarative setup]

169

create: true

170

# -- Annotations to be added to argocd-cm configmap

171

annotations: {}

172

# -- The name of tracking label used by Argo CD for resource pruning

173

application.instanceLabelKey: argocd.argoproj.io/instance

174

# -- Enable control of the service account used for the sync operation (alpha)

175

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/app-sync-using-impersonation/

176

application.sync.impersonation.enabled: false

177

# -- Enable exec feature in Argo UI

178

## Ref: https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac/#exec-resource

179

exec.enabled: false

180

# -- Enable local admin user

181

## Ref: https://argo-cd.readthedocs.io/en/latest/faq/#how-to-disable-admin-user

182

admin.enabled: true

183

# -- Timeout to discover if a new manifests version got published to the repository

184

timeout.reconciliation: 120s

185

# -- Maximum jitter added to the reconciliation timeout to spread out refreshes and reduce repo-server load

186

timeout.reconciliation.jitter: 60s

187

# -- Timeout to refresh application data as well as target manifests cache

188

timeout.hard.reconciliation: 0s

189

# -- Enable Status Badge

190

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/status-badge/

191

statusbadge.enabled: false

192

# Dex configuration

193

# dex.config: |

194

# connectors:

195

# # GitHub example

196

# - type: github

197

# id: github

198

# name: GitHub

199

# config:

200

# clientID: aabbccddeeff00112233

201

# clientSecret: $dex.github.clientSecret # Alternatively $<some_K8S_secret>:dex.github.clientSecret

202

# orgs:

203

# - name: your-github-org

204

205

# OIDC configuration as an alternative to dex (optional).

206

# oidc.config: |

207

# name: AzureAD

208

# issuer: https://login.microsoftonline.com/TENANT_ID/v2.0

209

# clientID: aaaabbbbccccddddeee

210

# clientSecret: $oidc.azuread.clientSecret

211

# # Optional: set to true to use Azure Workload Identity instead of clientSecret

212

# azure:

213

# useWorkloadIdentity: false

214

215

# Some OIDC providers require a separate clientID for different callback URLs.

216

# For example, if configuring Argo CD with self-hosted Dex, you will need a separate client ID

217

# for the 'localhost' (CLI) client to Dex. This field is optional. If omitted, the CLI will

218

# use the same clientID as the Argo CD server

219

# cliClientID: vvvvwwwwxxxxyyyyzzzz

220

221

# rootCA: |

222

# -----BEGIN CERTIFICATE-----

223

# ... encoded certificate data here ...

224

# -----END CERTIFICATE-----

225

226

# Optional list of allowed aud claims. If omitted or empty, defaults to the clientID value above (and the

227

# cliClientID, if that is also specified). If you specify a list and want the clientID to be allowed, you must

228

# explicitly include it in the list.

229

# Token verification will pass if any of the token's audiences matches any of the audiences in this list.

230

# allowedAudiences:

231

# - aaaabbbbccccddddeee

232

# - qqqqwwwweeeerrrrttt

233

234

# Optional set of OIDC claims to request on the ID token.

235

# requestedIDTokenClaims:

236

# groups:

237

# essential: true

238

239

# Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"]

240

# requestedScopes:

241

# - openid

242

# - profile

243

# - email

244

245

# PKCE authentication flow processes authorization flow from browser only - default false

246

# uses the clientID

247

# make sure the Identity Provider (IdP) is public and doesn't need clientSecret

248

# make sure the Identity Provider (IdP) has this redirect URI registered: https://argocd.example.com/pkce/verify

249

# enablePKCEAuthentication: true

250

251

# Extension Configuration

252

## Ref: https://argo-cd.readthedocs.io/en/latest/developer-guide/extensions/proxy-extensions/

253

# extension.config: |

254

# extensions:

255

# - name: httpbin

256

# backend:

257

# connectionTimeout: 2s

258

# keepAlive: 15s

259

# idleConnectionTimeout: 60s

260

# maxIdleConnections: 30

261

# services:

262

# - url: http://httpbin.org

263

# headers:

264

# - name: some-header

265

# value: '$some.argocd.secret.key'

266

# cluster:

267

# name: some-cluster

268

# server: https://some-cluster

269

270

## Default configuration for ignoreResourceUpdates.

271

## The ignoreResourceUpdates list contains K8s resource's properties that are known to be frequently updated

272

## by controllers and operators. These resources, when watched by argo, will cause many unnecessary updates.

273

274

# -- Ignoring status for all resources. An update will still be sent if the status update causes the health to change.

275

# @default -- See [values.yaml]

276

resource.customizations.ignoreResourceUpdates.all: |

277

jsonPointers:

278

- /status

279

# -- Some Application fields are generated and not related to the application updates itself

280

## The Application itself is already watched by the controller lister, but this configuration is applied for apps of apps

281

# @default -- See [values.yaml]

282

resource.customizations.ignoreResourceUpdates.argoproj.io_Application: |

283

jqPathExpressions:

284

- '.metadata.annotations."notified.notifications.argoproj.io"'

285

- '.metadata.annotations."argocd.argoproj.io/refresh"'

286

- '.metadata.annotations."argocd.argoproj.io/hydrate"'

287

- '.operation'

288

# -- Ignore Argo Rollouts generated fields

289

# @default -- See [values.yaml]

290

resource.customizations.ignoreResourceUpdates.argoproj.io_Rollout: |

291

jqPathExpressions:

292

- '.metadata.annotations."notified.notifications.argoproj.io"'

293

# -- Legacy annotations used on HPA autoscaling/v1

294

# @default -- See [values.yaml]

295

resource.customizations.ignoreResourceUpdates.autoscaling_HorizontalPodAutoscaler: |

296

jqPathExpressions:

297

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/behavior"'

298

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/conditions"'

299

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/metrics"'

300

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/current-metrics"'

301

# -- Ignore the cluster-autoscaler status

302

# @default -- See [values.yaml]

303

resource.customizations.ignoreResourceUpdates.ConfigMap: |

304

jqPathExpressions:

305

# Ignore the cluster-autoscaler status

306

- '.metadata.annotations."cluster-autoscaler.kubernetes.io/last-updated"'

307

# Ignore the annotation of the legacy Leases election

308

- '.metadata.annotations."control-plane.alpha.kubernetes.io/leader"'

309

# -- Ignore the common scaling annotations

310

# @default -- See [values.yaml]

311

resource.customizations.ignoreResourceUpdates.apps_ReplicaSet: |

312

jqPathExpressions:

313

- '.metadata.annotations."deployment.kubernetes.io/desired-replicas"'

314

- '.metadata.annotations."deployment.kubernetes.io/max-replicas"'

315

- '.metadata.annotations."rollout.argoproj.io/desired-replicas"'

316

# -- Ignores update if EndpointSlice is not excluded globally

317

# @default -- See [values.yaml]

318

resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice: |

319

jsonPointers:

320

- /metadata

321

- /endpoints

322

- /ports

323

# -- Ignores update if Endpoints is not excluded globally

324

# @default -- See [values.yaml]

325

resource.customizations.ignoreResourceUpdates.Endpoints: |

326

jsonPointers:

327

- /metadata

328

- /subsets

329

## Default configuration for exclusions.

330

## The exclusion list are K8s resources that we assume will never be declared in Git,

331

## and are never child objects of managed resources that need to be presented in the resource tree.

332

## This list contains high volume and high churn metadata objects which we exclude for performance

333

## reasons, reducing connections and load to the K8s API servers of managed clusters.

334

335

# -- Resource Exclusion/Inclusion

336

# @default -- See [values.yaml]

337

resource.exclusions: |

338

### Network resources created by the Kubernetes control plane and excluded to reduce the number of watched events and UI clutter

339

- apiGroups:

340

- ''

341

- discovery.k8s.io

342

kinds:

343

- Endpoints

344

- EndpointSlice

345

### Internal Kubernetes resources excluded reduce the number of watched events

346

- apiGroups:

347

- coordination.k8s.io

348

kinds:

349

- Lease

350

### Internal Kubernetes Authz/Authn resources excluded reduce the number of watched events

351

- apiGroups:

352

- authentication.k8s.io

353

- authorization.k8s.io

354

kinds:

355

- SelfSubjectReview

356

- TokenReview

357

- LocalSubjectAccessReview

358

- SelfSubjectAccessReview

359

- SelfSubjectRulesReview

360

- SubjectAccessReview

361

### Intermediate Certificate Request excluded reduce the number of watched events

362

- apiGroups:

363

- certificates.k8s.io

364

kinds:

365

- CertificateSigningRequest

366

- apiGroups:

367

- cert-manager.io

368

kinds:

369

- CertificateRequest

370

### Cilium internal resources excluded reduce the number of watched events and UI Clutter

371

- apiGroups:

372

- cilium.io

373

kinds:

374

- CiliumIdentity

375

- CiliumEndpoint

376

- CiliumEndpointSlice

377

### Kyverno intermediate and reporting resources excluded reduce the number of watched events and improve performance

378

- apiGroups:

379

- kyverno.io

380

- reports.kyverno.io

381

- wgpolicyk8s.io

382

kinds:

383

- PolicyReport

384

- ClusterPolicyReport

385

- EphemeralReport

386

- ClusterEphemeralReport

387

- AdmissionReport

388

- ClusterAdmissionReport

389

- BackgroundScanReport

390

- ClusterBackgroundScanReport

391

- UpdateRequest

392

# Argo CD configuration parameters

393

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cmd-params-cm.yaml

394

params:

395

# -- Create the argocd-cmd-params-cm configmap

396

# If false, it is expected the configmap will be created by something else.

397

create: true

398

# -- Annotations to be added to the argocd-cmd-params-cm ConfigMap

399

annotations: {}

400

# You can customize parameters by adding parameters here.

401

# (e.g.)

402

# otlp.address: ''

403

# Argo CD RBAC policy configuration

404

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md

405

rbac:

406

# -- Create the argocd-rbac-cm configmap with ([Argo CD RBAC policy]) definitions.

407

# If false, it is expected the configmap will be created by something else.

408

# Argo CD will not work if there is no configmap created with the name above.

409

create: true

410

# -- Annotations to be added to argocd-rbac-cm configmap

411

annotations: {}

412

# -- The name of the default role which Argo CD will falls back to, when authorizing API requests (optional).

413

# If omitted or empty, users may be still be able to login, but will see no apps, projects, etc...

414

policy.default: ""

415

# -- File containing user-defined policies and role definitions.

416

# @default -- `''` (See [values.yaml])

417

policy.csv: ""

418

# Policy rules are in the form:

419

# p, subject, resource, action, object, effect

420

# Role definitions and bindings are in the form:

421

# g, subject, inherited-subject

422

# policy.csv: |

423

# p, role:org-admin, applications, *, */*, allow

424

# p, role:org-admin, clusters, get, *, allow

425

# p, role:org-admin, repositories, *, *, allow

426

# p, role:org-admin, logs, get, *, allow

427

# p, role:org-admin, exec, create, */*, allow

428

# g, your-github-org:your-team, role:org-admin

429

430

# -- OIDC scopes to examine during rbac enforcement (in addition to `sub` scope).

431

# The scope value can be a string, or a list of strings.

432

scopes: "[groups]"

433

# -- Matcher function for Casbin, `glob` for glob matcher and `regex` for regex matcher.

434

policy.matchMode: "glob"

435

# GnuPG public keys for commit verification

436

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/gpg-verification/

437

gpg:

438

# -- Annotations to be added to argocd-gpg-keys-cm configmap

439

annotations: {}

440

# -- [GnuPG] public keys to add to the keyring

441

# @default -- `{}` (See [values.yaml])

442

## Note: Public keys should be exported with `gpg --export --armor <KEY>`

443

keys: {}

444

# 4AEE18F83AFDEB23: |

445

# -----BEGIN PGP PUBLIC KEY BLOCK-----

446

# ...

447

# -----END PGP PUBLIC KEY BLOCK-----

448

# SSH known hosts for Git repositories

449

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#ssh-known-host-public-keys

450

ssh:

451

# -- Specifies if the argocd-ssh-known-hosts-cm configmap should be created by Helm.

452

create: true

453

# -- Annotations to be added to argocd-ssh-known-hosts-cm configmap

454

annotations: {}

455

# -- Known hosts to be added to the known host list by default.

456

# @default -- See [values.yaml]

457

knownHosts: |

458

[ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

459

[ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl

460

[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

461

bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE=

462

bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO

463

bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M=

464

github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

465

github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl

466

github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

467

gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=

468

gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf

469

gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9

470

ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

471

vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

472

# -- Additional known hosts for private repositories

473

extraHosts: ""

474

# Repository TLS certificates

475

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#repositories-using-self-signed-tls-certificates-or-are-signed-by-custom-ca

476

tls:

477

# -- Annotations to be added to argocd-tls-certs-cm configmap

478

annotations: {}

479

# -- TLS certificates for Git repositories

480

# @default -- `{}` (See [values.yaml])

481

certificates: {}

482

# server.example.com: |

483

# -----BEGIN CERTIFICATE-----

484

# ...

485

# -----END CERTIFICATE-----

486

487

# -- Specifies if the argocd-tls-certs-cm configmap should be created by Helm.

488

create: true

489

# ConfigMap for Config Management Plugins

490

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/config-management-plugins/

491

cmp:

492

# -- Create the argocd-cmp-cm configmap

493

create: false

494

# -- Annotations to be added to argocd-cmp-cm configmap

495

annotations: {}

496

# -- Plugin yaml files to be added to argocd-cmp-cm

497

plugins: {}

498

# --- First plugin

499

# my-plugin:

500

# init:

501

# command: [sh]

502

# args: [-c, 'echo "Initializing..."']

503

# generate:

504

# command: [sh, -c]

505

# args:

506

# - |

507

# echo "{\"kind\": \"ConfigMap\", \"apiVersion\": \"v1\", \"metadata\": { \"name\": \"$ARGOCD_APP_NAME\", \"namespace\": \"$ARGOCD_APP_NAMESPACE\", \"annotations\": {\"Foo\": \"$ARGOCD_ENV_FOO\", \"KubeVersion\": \"$KUBE_VERSION\", \"KubeApiVersion\": \"$KUBE_API_VERSIONS\",\"Bar\": \"baz\"}}}"

508

# discover:

509

# fileName: "./subdir/s*.yaml"

510

# find:

511

# glob: "**/Chart.yaml"

512

# command: [sh, -c, find . -name env.yaml]

513

# --- Second plugin

514

# my-plugin2:

515

# init:

516

# command: [sh]

517

# args: [-c, 'echo "Initializing..."']

518

# generate:

519

# command: [sh, -c]

520

# args:

521

# - |

522

523

# discover:

524

# fileName: "./subdir/s*.yaml"

525

# find:

526

# glob: "**/Chart.yaml"

527

# command: [sh, -c, find . -name env.yaml]

528

529

# -- Provide one or multiple [external cluster credentials]

530

# @default -- `{}` (See [values.yaml])

531

## Ref:

532

## - https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters

533

## - https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#external-cluster-credentials

534

## - https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#project-scoped-repositories-and-clusters

535

clusterCredentials: {}

536

# mycluster:

537

# server: https://mycluster.example.com

538

# labels: {}

539

# annotations: {}

540

# config:

541

# bearerToken: "<authentication token>"

542

# tlsClientConfig:

543

# insecure: false

544

# caData: "<base64 encoded certificate>"

545

# mycluster2:

546

# server: https://mycluster2.example.com

547

# labels: {}

548

# annotations: {}

549

# namespaces: namespace1,namespace2

550

# clusterResources: true

551

# config:

552

# bearerToken: "<authentication token>"

553

# tlsClientConfig:

554

# insecure: false

555

# caData: "<base64 encoded certificate>"

556

# mycluster3-project-scoped:

557

# server: https://mycluster3.example.com

558

# labels: {}

559

# annotations: {}

560

# project: my-project1

561

# config:

562

# bearerToken: "<authentication token>"

563

# tlsClientConfig:

564

# insecure: false

565

# caData: "<base64 encoded certificate>"

566

# mycluster4-sharded:

567

# shard: 1

568

# server: https://mycluster4.example.com

569

# labels: {}

570

# annotations: {}

571

# config:

572

# bearerToken: "<authentication token>"

573

# tlsClientConfig:

574

# insecure: false

575

# caData: "<base64 encoded certificate>"

576

577

# -- Repository credentials to be used as Templates for other repos

578

## Creates a secret for each key/value specified below to create repository credentials

579

credentialTemplates: {}

580

# github-enterprise-creds-1:

581

# url: https://github.com/argoproj

582

# githubAppID: 1

583

# githubAppInstallationID: 2

584

# githubAppEnterpriseBaseUrl: https://ghe.example.com/api/v3

585

# githubAppPrivateKey: |

586

# -----BEGIN OPENSSH PRIVATE KEY-----

587

# ...

588

# -----END OPENSSH PRIVATE KEY-----

589

# https-creds:

590

# url: https://github.com/argoproj

591

# password: my-password

592

# username: my-username

593

# ssh-creds:

594

# url: git@github.com:argoproj-labs

595

# sshPrivateKey: |

596

# -----BEGIN OPENSSH PRIVATE KEY-----

597

# ...

598

# -----END OPENSSH PRIVATE KEY-----

599

600

# -- Annotations to be added to `configs.credentialTemplates` Secret

601

credentialTemplatesAnnotations: {}

602

# -- Repositories list to be used by applications

603

## Creates a secret for each key/value specified below to create repositories

604

## Note: the last example in the list would use a repository credential template, configured under "configs.credentialTemplates".

605

repositories: {}

606

# istio-helm-repo:

607

# url: https://storage.googleapis.com/istio-prerelease/daily-build/master-latest-daily/charts

608

# name: istio.io

609

# type: helm

610

# private-helm-repo:

611

# url: https://my-private-chart-repo.internal

612

# name: private-repo

613

# type: helm

614

# password: my-password

615

# username: my-username

616

# private-repo:

617

# url: https://github.com/argoproj/private-repo

618

619

# -- Annotations to be added to `configs.repositories` Secret

620

repositoriesAnnotations: {}

621

# Argo CD sensitive data

622

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets

623

secret:

624

# -- Create the argocd-secret

625

createSecret: true

626

# -- Labels to be added to argocd-secret

627

labels: {}

628

# -- Annotations to be added to argocd-secret

629

annotations: {}

630

# -- Shared secret for authenticating GitHub webhook events

631

githubSecret: ""

632

# -- Shared secret for authenticating GitLab webhook events

633

gitlabSecret: ""

634

# -- Shared secret for authenticating BitbucketServer webhook events

635

bitbucketServerSecret: ""

636

# -- UUID for authenticating Bitbucket webhook events

637

bitbucketUUID: ""

638

# -- Shared secret for authenticating Gogs webhook events

639

gogsSecret: ""

640

## Azure DevOps

641

azureDevops:

642

# -- Shared secret username for authenticating Azure DevOps webhook events

643

username: ""

644

# -- Shared secret password for authenticating Azure DevOps webhook events

645

password: ""

646

# -- add additional secrets to be added to argocd-secret

647

## Custom secrets. Useful for injecting SSO secrets into environment variables.

648

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets

649

## Note that all values must be non-empty.

650

extra: {}

651

# LDAP_PASSWORD: "mypassword"

652

653

# -- Bcrypt hashed admin password

654

## Argo expects the password in the secret to be bcrypt hashed. You can create this hash with

655

## `htpasswd -nbBC 10 "" $ARGO_PWD | tr -d ':\n' | sed 's/$2y/$2a/'`

656

argocdServerAdminPassword: ""

657

# -- Admin password modification time. Eg. `"2006-01-02T15:04:05Z"`

658

# @default -- `""` (defaults to current time)

659

argocdServerAdminPasswordMtime: ""

660

# -- Define custom [CSS styles] for your argo instance.

661

# This setting will automatically mount the provided CSS and reference it in the argo configuration.

662

# @default -- `""` (See [values.yaml])

663

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/custom-styles/

664

styles: ""

665

# styles: |

666

# .sidebar {

667

# background: linear-gradient(to bottom, #999, #777, #333, #222, #111);

668

# }

669

# -- Array of extra K8s manifests to deploy

670

## Note: Supports use of custom Helm templates

671

extraObjects: []

672

# - apiVersion: secrets-store.csi.x-k8s.io/v1

673

# kind: SecretProviderClass

674

# metadata:

675

# name: argocd-secrets-store

676

# spec:

677

# provider: aws

678

# parameters:

679

# objects: |

680

# - objectName: "argocd"

681

# objectType: "secretsmanager"

682

# jmesPath:

683

# - path: "client_id"

684

# objectAlias: "client_id"

685

# - path: "client_secret"

686

# objectAlias: "client_secret"

687

# secretObjects:

688

# - data:

689

# - key: client_id

690

# objectName: client_id

691

# - key: client_secret

692

# objectName: client_secret

693

# secretName: argocd-secrets-store

694

# type: Opaque

695

# labels:

696

# app.kubernetes.io/part-of: argocd

697

698

## Application controller

699

controller:

700

# -- Application controller name string

701

702

# -- The number of application controller pods to run.

703

# Additional replicas will cause sharding of managed clusters across number of replicas.

704

## With dynamic cluster distribution turned on, sharding of the clusters will gracefully

705

## rebalance if the number of replica's changes or one becomes unhealthy. (alpha)

706

replicas: 1

707

# -- Enable dynamic cluster distribution (alpha)

708

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution

709

## This is done using a deployment instead of a statefulSet

710

## When replicas are added or removed, the sharding algorithm is re-run to ensure that the

711

## clusters are distributed according to the algorithm. If the algorithm is well-balanced,

712

## like round-robin, then the shards will be well-balanced.

713

dynamicClusterDistribution: false

714

# -- Runtime class name for the application controller

715

# @default -- `""` (defaults to global.runtimeClassName)

716

runtimeClassName: ""

717

# -- Application controller heartbeat time

718

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution/#working-of-dynamic-distribution

719

heartbeatTime: 10

720

# -- Maximum number of controller revisions that will be maintained in StatefulSet history

721

revisionHistoryLimit: 5

722

## Application controller Pod Disruption Budget

723

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

724

pdb:

725

# -- Deploy a [PodDisruptionBudget] for the application controller

726

enabled: false

727

# -- Labels to be added to application controller pdb

728

labels: {}

729

# -- Annotations to be added to application controller pdb

730

annotations: {}

731

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

732

# @default -- `""` (defaults to 0 if not specified)

733

minAvailable: ""

734

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

735

## Has higher precedence over `controller.pdb.minAvailable`

736

maxUnavailable: ""

737

## Application controller Vertical Pod Autoscaler

738

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

739

vpa:

740

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the application controller

741

enabled: false

742

# -- Labels to be added to application controller vpa

743

labels: {}

744

# -- Annotations to be added to application controller vpa

745

annotations: {}

746

# -- One of the VPA operation modes

747

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

748

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

749

updateMode: Initial

750

# -- Controls how VPA computes the recommended resources for application controller container

751

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

752

containerPolicy: {}

753

# controlledResources: ["cpu", "memory"]

754

# minAllowed:

755

# cpu: 250m

756

# memory: 256Mi

757

# maxAllowed:

758

# cpu: 1

759

# memory: 1Gi

760

# -- The recommenders that will provide recommendations for vertical scaling. Only relevant if a named VPA recommender (e.g. one started with a custom recommender name) is in use; leave unset to use the cluster's default recommender

761

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

762

## NOTE: specify only zero or one recommender as of VPA 1.7.1

763

recommenders: []

764

## Application controller image

765

image:

766

# -- Repository to use for the application controller

767

# @default -- `""` (defaults to global.image.repository)

768

repository: ""

769

# -- Tag to use for the application controller

770

# @default -- `""` (defaults to global.image.tag)

771

tag: ""

772

# -- Image pull policy for the application controller

773

# @default -- `""` (defaults to global.image.imagePullPolicy)

774

imagePullPolicy: ""

775

# -- Secrets with credentials to pull images from a private registry

776

# @default -- `[]` (defaults to global.imagePullSecrets)

777

imagePullSecrets: []

778

# -- Additional command line arguments to pass to application controller

779

extraArgs: []

780

# -- Environment variables to pass to application controller

781

env: []

782

# -- envFrom to pass to application controller

783

# @default -- `[]` (See [values.yaml])

784

envFrom: []

785

# - configMapRef:

786

# name: config-map-name

787

# - secretRef:

788

# name: secret-name

789

790

# -- Additional containers to be added to the application controller pod

791

## Note: Supports use of custom Helm templates

792

extraContainers: []

793

# -- Init containers to add to the application controller pod

794

## If your target Kubernetes cluster(s) require a custom credential (exec) plugin

795

## you could use this (and the same in the server pod) to provide such executable

796

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

797

## Note: Supports use of custom Helm templates

798

initContainers: []

799

# - name: download-tools

800

# image: alpine:3

801

# command: [sh, -c]

802

# args:

803

# - wget -qO /custom-tools/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.7/kubelogin-linux-amd64.zip &&

804

# mkdir /custom-tools/tmp && unzip -d /custom-tools/tmp /custom-tools/kubelogin.zip &&

805

# mv /custom-tools/tmp/bin/linux_amd64/kubelogin /custom-tools/ && rm -rf custom-tools/tmp && rm /custom-tools/kubelogin.zip

806

# volumeMounts:

807

# - mountPath: /custom-tools

808

# name: custom-tools

809

810

# -- Additional volumeMounts to the application controller main container

811

volumeMounts: []

812

# - mountPath: /usr/local/bin/kubelogin

813

# name: custom-tools

814

# subPath: kubelogin

815

816

# -- Additional volumes to the application controller pod

817

volumes: []

818

# - name: custom-tools

819

# emptyDir: {}

820

821

## Application controller emptyDir volumes

822

emptyDir:

823

# -- EmptyDir size limit for application controller

824

# @default -- `""` (defaults not set if not specified i.e. no size limit)

825

sizeLimit: ""

826

# sizeLimit: "1Gi"

827

# -- Annotations for the application controller StatefulSet

828

statefulsetAnnotations: {}

829

# -- Labels for the application controller StatefulSet

830

statefulsetLabels: {}

831

# -- Annotations for the application controller Deployment

832

deploymentAnnotations: {}

833

# -- Labels for the application controller Deployment

834

deploymentLabels: {}

835

# -- Annotations to be added to application controller pods

836

podAnnotations: {}

837

# -- Labels to be added to application controller pods

838

podLabels: {}

839

# -- Resource limits and requests for the application controller pods

840

resources: {}

841

# limits:

842

# cpu: 500m

843

# memory: 512Mi

844

# requests:

845

# cpu: 250m

846

# memory: 256Mi

847

848

# Application controller container ports

849

containerPorts:

850

# -- Metrics container port

851

metrics: 8082

852

# -- Host Network for application controller pods

853

hostNetwork: false

854

# -- [DNS configuration]

855

dnsConfig: {}

856

# -- Alternative DNS policy for application controller pods

857

dnsPolicy: "ClusterFirst"

858

# -- Application controller container-level security context

859

# @default -- See [values.yaml]

860

containerSecurityContext:

861

runAsNonRoot: true

862

readOnlyRootFilesystem: true

863

allowPrivilegeEscalation: false

864

seccompProfile:

865

type: RuntimeDefault

866

capabilities:

867

drop:

868

- ALL

869

# Readiness probe for application controller

870

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

871

readinessProbe:

872

# -- Http path to use for the readiness probe

873

httpPath: /healthz

874

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

875

failureThreshold: 3

876

# -- Number of seconds after the container has started before [probe] is initiated

877

initialDelaySeconds: 10

878

# -- How often (in seconds) to perform the [probe]

879

periodSeconds: 10

880

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

881

successThreshold: 1

882

# -- Number of seconds after which the [probe] times out

883

timeoutSeconds: 1

884

## Startup probe for application controller (optional)

885

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

886

startupProbe:

887

# -- Enable Kubernetes startup probe for application controller

888

enabled: false

889

# -- Http path to use for the startup probe

890

httpPath: /healthz

891

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

892

failureThreshold: 20

893

# -- Number of seconds after the container has started before [probe] is initiated

894

initialDelaySeconds: 10

895

# -- How often (in seconds) to perform the [probe]

896

periodSeconds: 10

897

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

898

successThreshold: 1

899

# -- Number of seconds after which the [probe] times out

900

timeoutSeconds: 1

901

# -- terminationGracePeriodSeconds for container lifecycle hook

902

terminationGracePeriodSeconds: 30

903

# -- Priority class for the application controller pods

904

# @default -- `""` (defaults to global.priorityClassName)

905

priorityClassName: ""

906

# -- [Node selector]

907

# @default -- `{}` (defaults to global.nodeSelector)

908

nodeSelector: {}

909

# -- [Tolerations] for use with node taints

910

# @default -- `[]` (defaults to global.tolerations)

911

tolerations: []

912

# -- Assign custom [affinity] rules to the deployment

913

# @default -- `{}` (defaults to global.affinity preset)

914

affinity: {}

915

# -- Assign custom [TopologySpreadConstraints] rules to the application controller

916

# @default -- `[]` (defaults to global.topologySpreadConstraints)

917

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

918

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

919

topologySpreadConstraints: []

920

# - maxSkew: 1

921

# topologyKey: topology.kubernetes.io/zone

922

# whenUnsatisfiable: DoNotSchedule

923

924

# -- Automount API credentials for the Service Account into the pod.

925

automountServiceAccountToken: true

926

serviceAccount:

927

# -- Create a service account for the application controller

928

create: true

929

# -- Service account name

930

931

# -- Annotations applied to created service account

932

annotations: {}

933

# -- Labels applied to created service account

934

labels: {}

935

# -- Automount API credentials for the Service Account

936

automountServiceAccountToken: true

937

## Application controller metrics configuration

938

metrics:

939

# -- Deploy metrics service

940

enabled: false

941

applicationLabels:

942

# -- Enables additional labels in argocd_app_labels metric

943

enabled: false

944

# -- Additional labels

945

labels: []

946

service:

947

# -- Metrics service type

948

type: ClusterIP

949

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

950

clusterIP: ""

951

# -- Metrics service annotations

952

annotations: {}

953

# -- Metrics service labels

954

labels: {}

955

# -- Metrics service port

956

servicePort: 8082

957

# -- Metrics service port name

958

portName: http-metrics

959

serviceMonitor:

960

# -- Enable a prometheus ServiceMonitor

961

enabled: false

962

# -- Prometheus ServiceMonitor interval

963

interval: 30s

964

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

965

scrapeTimeout: ""

966

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

967

honorLabels: false

968

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

969

relabelings: []

970

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

971

metricRelabelings: []

972

# -- Prometheus ServiceMonitor selector

973

selector: {}

974

# prometheus: kube-prometheus

975

976

# -- Prometheus ServiceMonitor scheme

977

scheme: ""

978

# -- Prometheus ServiceMonitor tlsConfig

979

tlsConfig: {}

980

# -- Prometheus ServiceMonitor namespace

981

namespace: "" # "monitoring"

982

# -- Prometheus ServiceMonitor labels

983

additionalLabels: {}

984

# -- Prometheus ServiceMonitor annotations

985

annotations: {}

986

rules:

987

# -- Deploy a PrometheusRule for the application controller

988

enabled: false

989

# -- PrometheusRule namespace

990

namespace: "" # "monitoring"

991

# -- PrometheusRule selector

992

selector: {}

993

# prometheus: kube-prometheus

994

995

# -- PrometheusRule labels

996

additionalLabels: {}

997

# -- PrometheusRule annotations

998

annotations: {}

999

# -- PrometheusRule.Spec for the application controller

1000

spec: []

1001

# - alert: ArgoAppMissing

1002

# expr: |

1003

# absent(argocd_app_info) == 1

1004

# for: 15m

1005

# labels:

1006

# severity: critical

1007

# annotations:

1008

# summary: "[Argo CD] No reported applications"

1009

# description: >

1010

# Argo CD has not reported any applications data for the past 15 minutes which

1011

# means that it must be down or not functioning properly. This needs to be

1012

# resolved for this cloud to continue to maintain state.

1013

# - alert: ArgoAppNotSynced

1014

# expr: |

1015

# argocd_app_info{sync_status!="Synced"} == 1

1016

# for: 12h

1017

# labels:

1018

# severity: warning

1019

# annotations:

1020

# summary: "[{{ $labels.name }}] Application not synchronized"

1021

# description: >

1022

# The application {{ $labels.name }} has not been synchronized for over

1023

# 12 hours which means that the state of this cloud has drifted away from the

1024

# state inside Git.

1025

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

1026

## Defaults to off

1027

clusterRoleRules:

1028

# -- Enable custom rules for the application controller's ClusterRole resource

1029

enabled: false

1030

# -- List of custom rules for the application controller's ClusterRole resource

1031

rules: []

1032

## Enable this and set the rules: to whatever custom rules you want for the Role resource.

1033

## Defaults to off

1034

# -- List of custom rules for the application controller's Role resource

1035

roleRules: []

1036

# Default application controller's network policy

1037

networkPolicy:

1038

# -- Default network policy rules used by application controller

1039

# @default -- `false` (defaults to global.networkPolicy.create)

1040

create: false

1041

## Dex

1042

dex:

1043

# -- Enable dex

1044

enabled: true

1045

# -- Dex name

1046

1047

# -- Additional command line arguments to pass to the Dex server

1048

extraArgs: []

1049

# -- Runtime class name for Dex

1050

# @default -- `""` (defaults to global.runtimeClassName)

1051

runtimeClassName: ""

1052

metrics:

1053

# -- Deploy metrics service

1054

enabled: false

1055

service:

1056

# -- Metrics service annotations

1057

annotations: {}

1058

# -- Metrics service labels

1059

labels: {}

1060

# -- Metrics service port name

1061

portName: http-metrics

1062

serviceMonitor:

1063

# -- Enable a prometheus ServiceMonitor

1064

enabled: false

1065

# -- Prometheus ServiceMonitor interval

1066

interval: 30s

1067

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1068

honorLabels: false

1069

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1070

relabelings: []

1071

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1072

metricRelabelings: []

1073

# -- Prometheus ServiceMonitor selector

1074

selector: {}

1075

# prometheus: kube-prometheus

1076

1077

# -- Prometheus ServiceMonitor scheme

1078

scheme: ""

1079

# -- Prometheus ServiceMonitor tlsConfig

1080

tlsConfig: {}

1081

# -- Prometheus ServiceMonitor namespace

1082

namespace: "" # "monitoring"

1083

# -- Prometheus ServiceMonitor labels

1084

additionalLabels: {}

1085

# -- Prometheus ServiceMonitor annotations

1086

annotations: {}

1087

## Dex Pod Disruption Budget

1088

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1089

pdb:

1090

# -- Deploy a [PodDisruptionBudget] for the Dex server

1091

enabled: false

1092

# -- Labels to be added to Dex server pdb

1093

labels: {}

1094

# -- Annotations to be added to Dex server pdb

1095

annotations: {}

1096

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1097

# @default -- `""` (defaults to 0 if not specified)

1098

minAvailable: ""

1099

# -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%).

1100

## Has higher precedence over `dex.pdb.minAvailable`

1101

maxUnavailable: ""

1102

## Dex Vertical Pod Autoscaler

1103

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1104

vpa:

1105

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Dex server

1106

enabled: false

1107

# -- Labels to be added to Dex server vpa

1108

labels: {}

1109

# -- Annotations to be added to Dex server vpa

1110

annotations: {}

1111

# -- One of the VPA operation modes

1112

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1113

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1114

updateMode: Initial

1115

# -- Controls how VPA computes the recommended resources for Dex server container

1116

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1117

containerPolicy: {}

1118

# controlledResources: ["cpu", "memory"]

1119

# minAllowed:

1120

# cpu: 250m

1121

# memory: 256Mi

1122

# maxAllowed:

1123

# cpu: 1

1124

# memory: 1Gi

1125

1126

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

1127

## NOTE: specify only zero or one recommender as of VPA 1.7.1

1128

recommenders: []

1129

## Dex image

1130

image:

1131

# -- Dex image repository

1132

repository: cgr.dev/chainguard-private/dex

1133

# -- Dex image tag

1134

tag: latest@sha256:cb136bfd4f1f065c929f8d0823e375f0a4995916c393fd756d2b5b945ce775ff

1135

# -- Dex imagePullPolicy

1136

# @default -- `""` (defaults to global.image.imagePullPolicy)

1137

imagePullPolicy: ""

1138

# -- Secrets with credentials to pull images from a private registry

1139

# @default -- `[]` (defaults to global.imagePullSecrets)

1140

imagePullSecrets: []

1141

# Argo CD init image that creates Dex config

1142

initImage:

1143

# -- Argo CD init image repository

1144

# @default -- `""` (defaults to global.image.repository)

1145

repository: ""

1146

# -- Argo CD init image tag

1147

# @default -- `""` (defaults to global.image.tag)

1148

tag: ""

1149

# -- Argo CD init image imagePullPolicy

1150

# @default -- `""` (defaults to global.image.imagePullPolicy)

1151

imagePullPolicy: ""

1152

# -- Argo CD init image resources

1153

# @default -- `{}` (defaults to dex.resources)

1154

resources: {}

1155

# requests:

1156

# cpu: 5m

1157

# memory: 96Mi

1158

# limits:

1159

# cpu: 10m

1160

# memory: 144Mi

1161

# -- Environment variables to pass to the Dex server

1162

env: []

1163

# -- envFrom to pass to the Dex server

1164

# @default -- `[]` (See [values.yaml])

1165

envFrom: []

1166

# - configMapRef:

1167

# name: config-map-name

1168

# - secretRef:

1169

# name: secret-name

1170

1171

# -- Additional containers to be added to the dex pod

1172

## Note: Supports use of custom Helm templates

1173

extraContainers: []

1174

# -- Init containers to add to the dex pod

1175

## Note: Supports use of custom Helm templates

1176

initContainers: []

1177

# -- Additional volumeMounts to the dex main container

1178

volumeMounts: []

1179

# -- Additional volumes to the dex pod

1180

volumes: []

1181

## Dex server emptyDir volumes

1182

emptyDir:

1183

# -- EmptyDir size limit for Dex server

1184

# @default -- `""` (defaults not set if not specified i.e. no size limit)

1185

sizeLimit: ""

1186

# sizeLimit: "1Gi"

1187

# TLS certificate configuration via Secret

1188

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-dex-server

1189

## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart Dex automatically without extra controllers.

1190

certificateSecret:

1191

# -- Create argocd-dex-server-tls secret

1192

enabled: false

1193

# -- Labels to be added to argocd-dex-server-tls secret

1194

labels: {}

1195

# -- Annotations to be added to argocd-dex-server-tls secret

1196

annotations: {}

1197

# -- Certificate authority. Required for self-signed certificates.

1198

ca: ""

1199

# -- Certificate private key

1200

key: ""

1201

# -- Certificate data. Must contain SANs of Dex service (ie: argocd-dex-server, argocd-dex-server.argo-cd.svc)

1202

crt: ""

1203

# -- Annotations to be added to the Dex server Deployment

1204

deploymentAnnotations: {}

1205

# -- Labels for the Dex server Deployment

1206

deploymentLabels: {}

1207

# -- Annotations to be added to the Dex server pods

1208

podAnnotations: {}

1209

# -- Labels to be added to the Dex server pods

1210

podLabels: {}

1211

# -- Resource limits and requests for dex

1212

resources: {}

1213

# limits:

1214

# cpu: 50m

1215

# memory: 64Mi

1216

# requests:

1217

# cpu: 10m

1218

# memory: 32Mi

1219

1220

# Dex container ports

1221

# NOTE: These ports are currently hardcoded and cannot be changed

1222

containerPorts:

1223

# -- HTTP container port

1224

http: 5556

1225

# -- gRPC container port

1226

grpc: 5557

1227

# -- Metrics container port

1228

metrics: 5558

1229

# -- [DNS configuration]

1230

dnsConfig: {}

1231

# -- Alternative DNS policy for Dex server pods

1232

dnsPolicy: "ClusterFirst"

1233

# -- Dex container-level security context

1234

# @default -- See [values.yaml]

1235

containerSecurityContext:

1236

runAsNonRoot: true

1237

runAsUser: 1001

1238

readOnlyRootFilesystem: true

1239

allowPrivilegeEscalation: false

1240

seccompProfile:

1241

type: RuntimeDefault

1242

capabilities:

1243

drop:

1244

- ALL

1245

## Probes for Dex server

1246

## Supported from Dex >= 2.28.0

1247

livenessProbe:

1248

# -- Enable Kubernetes liveness probe for Dex >= 2.28.0

1249

enabled: false

1250

# -- Http path to use for the liveness probe

1251

httpPath: /healthz/live

1252

# -- Http port to use for the liveness probe

1253

httpPort: metrics

1254

# -- Scheme to use for for the liveness probe (can be HTTP or HTTPS)

1255

httpScheme: HTTP

1256

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1257

failureThreshold: 3

1258

# -- Number of seconds after the container has started before [probe] is initiated

1259

initialDelaySeconds: 10

1260

# -- How often (in seconds) to perform the [probe]

1261

periodSeconds: 10

1262

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1263

successThreshold: 1

1264

# -- Number of seconds after which the [probe] times out

1265

timeoutSeconds: 1

1266

readinessProbe:

1267

# -- Enable Kubernetes readiness probe for Dex >= 2.28.0

1268

enabled: false

1269

# -- Http path to use for the readiness probe

1270

httpPath: /healthz/ready

1271

# -- Http port to use for the readiness probe

1272

httpPort: metrics

1273

# -- Scheme to use for for the liveness probe (can be HTTP or HTTPS)

1274

httpScheme: HTTP

1275

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1276

failureThreshold: 3

1277

# -- Number of seconds after the container has started before [probe] is initiated

1278

initialDelaySeconds: 10

1279

# -- How often (in seconds) to perform the [probe]

1280

periodSeconds: 10

1281

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1282

successThreshold: 1

1283

# -- Number of seconds after which the [probe] times out

1284

timeoutSeconds: 1

1285

## Startup probe for Dex server (optional)

1286

## Supported from Dex >= 2.28.0

1287

startupProbe:

1288

# -- Enable Kubernetes startup probe for Dex >= 2.28.0

1289

enabled: false

1290

# -- Http path to use for the startup probe

1291

httpPath: /healthz/ready

1292

# -- Http port to use for the startup probe

1293

httpPort: metrics

1294

# -- Scheme to use for the startup probe (can be HTTP or HTTPS)

1295

httpScheme: HTTP

1296

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1297

failureThreshold: 20

1298

# -- Number of seconds after the container has started before [probe] is initiated

1299

initialDelaySeconds: 10

1300

# -- How often (in seconds) to perform the [probe]

1301

periodSeconds: 10

1302

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1303

successThreshold: 1

1304

# -- Number of seconds after which the [probe] times out

1305

timeoutSeconds: 1

1306

# -- terminationGracePeriodSeconds for container lifecycle hook

1307

terminationGracePeriodSeconds: 30

1308

# -- Automount API credentials for the Service Account into the pod.

1309

automountServiceAccountToken: true

1310

serviceAccount:

1311

# -- Create dex service account

1312

create: true

1313

# -- Dex service account name

1314

1315

# -- Annotations applied to created service account

1316

annotations: {}

1317

# -- Automount API credentials for the Service Account

1318

automountServiceAccountToken: true

1319

# -- Service port for HTTP access

1320

servicePortHttp: 5556

1321

# -- Service port name for HTTP access

1322

servicePortHttpName: http

1323

# -- Service port for gRPC access

1324

servicePortGrpc: 5557

1325

# -- Service port name for gRPC access

1326

servicePortGrpcName: grpc

1327

# -- Service port for metrics access

1328

servicePortMetrics: 5558

1329

# -- Priority class for the dex pods

1330

# @default -- `""` (defaults to global.priorityClassName)

1331

priorityClassName: ""

1332

# -- [Node selector]

1333

# @default -- `{}` (defaults to global.nodeSelector)

1334

nodeSelector: {}

1335

# -- [Tolerations] for use with node taints

1336

# @default -- `[]` (defaults to global.tolerations)

1337

tolerations: []

1338

# -- Assign custom [affinity] rules to the deployment

1339

# @default -- `{}` (defaults to global.affinity preset)

1340

affinity: {}

1341

# -- Assign custom [TopologySpreadConstraints] rules to dex

1342

# @default -- `[]` (defaults to global.topologySpreadConstraints)

1343

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1344

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

1345

topologySpreadConstraints: []

1346

# - maxSkew: 1

1347

# topologyKey: topology.kubernetes.io/zone

1348

# whenUnsatisfiable: DoNotSchedule

1349

1350

# -- Deployment strategy to be added to the Dex server Deployment

1351

deploymentStrategy: {}

1352

# type: RollingUpdate

1353

# rollingUpdate:

1354

# maxSurge: 25%

1355

# maxUnavailable: 25%

1356

1357

# Default Dex server's network policy

1358

networkPolicy:

1359

# -- Default network policy rules used by Dex server

1360

# @default -- `false` (defaults to global.networkPolicy.create)

1361

create: false

1362

# DEPRECATED - Use configs.params to override

1363

# -- Dex log format. Either `text` or `json`

1364

# @default -- `""` (defaults to global.logging.format)

1365

# logFormat: ""

1366

# -- Dex log level. One of: `debug`, `info`, `warn`, `error`

1367

# @default -- `""` (defaults to global.logging.level)

1368

# logLevel: ""

1369

## Redis

1370

redis:

1371

# -- Enable redis

1372

enabled: true

1373

# -- Redis name

1374

1375

# -- Runtime class name for redis

1376

# @default -- `""` (defaults to global.runtimeClassName)

1377

runtimeClassName: ""

1378

## Redis Pod Disruption Budget

1379

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1380

pdb:

1381

# -- Deploy a [PodDisruptionBudget] for the Redis

1382

enabled: false

1383

# -- Labels to be added to Redis pdb

1384

labels: {}

1385

# -- Annotations to be added to Redis pdb

1386

annotations: {}

1387

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1388

# @default -- `""` (defaults to 0 if not specified)

1389

minAvailable: ""

1390

# -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%).

1391

## Has higher precedence over `redis.pdb.minAvailable`

1392

maxUnavailable: ""

1393

## Redis Vertical Pod Autoscaler

1394

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1395

vpa:

1396

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Redis

1397

enabled: false

1398

# -- Labels to be added to Redis vpa

1399

labels: {}

1400

# -- Annotations to be added to Redis vpa

1401

annotations: {}

1402

# -- One of the VPA operation modes

1403

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1404

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1405

updateMode: Initial

1406

# -- Controls how VPA computes the recommended resources for Redis container

1407

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1408

containerPolicy: {}

1409

# controlledResources: ["cpu", "memory"]

1410

# minAllowed:

1411

# cpu: 250m

1412

# memory: 256Mi

1413

# maxAllowed:

1414

# cpu: 1

1415

# memory: 1Gi

1416

1417

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

1418

## NOTE: specify only zero or one recommender as of VPA 1.7.1

1419

recommenders: []

1420

## Redis image

1421

image:

1422

# -- Redis repository

1423

repository: cgr.dev/chainguard-private/redis

1424

# -- Redis tag

1425

## Do not use 7.4.0 <= v < 8.0.0, otherwise you are no longer using an open source version of Redis

1426

tag: latest@sha256:2489227e9f6db4f2ef666e3c0aa215865dfe6679df29ff76768d0d0b7ed90b12

1427

# -- Redis image pull policy

1428

# @default -- `""` (defaults to global.image.imagePullPolicy)

1429

imagePullPolicy: ""

1430

## Prometheus redis-exporter sidecar

1431

exporter:

1432

# -- Enable Prometheus redis-exporter sidecar

1433

enabled: false

1434

# -- Environment variables to pass to the Redis exporter

1435

env: []

1436

## Prometheus redis-exporter image

1437

image:

1438

# -- Repository to use for the redis-exporter

1439

repository: cgr.dev/chainguard-private/prometheus-redis-exporter

1440

# -- Tag to use for the redis-exporter

1441

tag: latest@sha256:84685ff9e12dd58e0c71dce22cf808c2efc734468f749d490b718de91a90a92b

1442

# -- Image pull policy for the redis-exporter

1443

# @default -- `""` (defaults to global.image.imagePullPolicy)

1444

imagePullPolicy: ""

1445

# -- Redis exporter security context

1446

# @default -- See [values.yaml]

1447

containerSecurityContext:

1448

runAsNonRoot: true

1449

readOnlyRootFilesystem: true

1450

allowPrivilegeEscalation: false

1451

seccompProfile:

1452

type: RuntimeDefault

1453

capabilities:

1454

drop:

1455

- ALL

1456

## Probes for Redis exporter (optional)

1457

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

1458

readinessProbe:

1459

# -- Enable Kubernetes liveness probe for Redis exporter (optional)

1460

enabled: false

1461

# -- Number of seconds after the container has started before [probe] is initiated

1462

initialDelaySeconds: 30

1463

# -- How often (in seconds) to perform the [probe]

1464

periodSeconds: 15

1465

# -- Number of seconds after which the [probe] times out

1466

timeoutSeconds: 15

1467

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1468

successThreshold: 1

1469

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1470

failureThreshold: 5

1471

livenessProbe:

1472

# -- Enable Kubernetes liveness probe for Redis exporter

1473

enabled: false

1474

# -- Number of seconds after the container has started before [probe] is initiated

1475

initialDelaySeconds: 30

1476

# -- How often (in seconds) to perform the [probe]

1477

periodSeconds: 15

1478

# -- Number of seconds after which the [probe] times out

1479

timeoutSeconds: 15

1480

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1481

successThreshold: 1

1482

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1483

failureThreshold: 5

1484

# -- Resource limits and requests for redis-exporter sidecar

1485

resources: {}

1486

# limits:

1487

# cpu: 50m

1488

# memory: 64Mi

1489

# requests:

1490

# cpu: 10m

1491

# memory: 32Mi

1492

# -- Secrets with credentials to pull images from a private registry

1493

# @default -- `[]` (defaults to global.imagePullSecrets)

1494

imagePullSecrets: []

1495

# -- Additional command line arguments to pass to redis-server

1496

extraArgs: []

1497

# - --bind

1498

# - "0.0.0.0"

1499

1500

# -- Environment variables to pass to the Redis server

1501

env: []

1502

# -- envFrom to pass to the Redis server

1503

# @default -- `[]` (See [values.yaml])

1504

envFrom: []

1505

# - configMapRef:

1506

# name: config-map-name

1507

# - secretRef:

1508

# name: secret-name

1509

1510

## Probes for Redis server (optional)

1511

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

1512

readinessProbe:

1513

# -- Enable Kubernetes liveness probe for Redis server

1514

enabled: false

1515

# -- Number of seconds after the container has started before [probe] is initiated

1516

initialDelaySeconds: 30

1517

# -- How often (in seconds) to perform the [probe]

1518

periodSeconds: 15

1519

# -- Number of seconds after which the [probe] times out

1520

timeoutSeconds: 15

1521

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1522

successThreshold: 1

1523

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1524

failureThreshold: 5

1525

livenessProbe:

1526

# -- Enable Kubernetes liveness probe for Redis server

1527

enabled: false

1528

# -- Number of seconds after the container has started before [probe] is initiated

1529

initialDelaySeconds: 30

1530

# -- How often (in seconds) to perform the [probe]

1531

periodSeconds: 15

1532

# -- Number of seconds after which the [probe] times out

1533

timeoutSeconds: 15

1534

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1535

successThreshold: 1

1536

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1537

failureThreshold: 5

1538

# -- Additional containers to be added to the redis pod

1539

## Note: Supports use of custom Helm templates

1540

extraContainers: []

1541

# -- Init containers to add to the redis pod

1542

## Note: Supports use of custom Helm templates

1543

initContainers: []

1544

# -- Additional volumeMounts to the redis container

1545

volumeMounts: []

1546

# -- Additional volumes to the redis pod

1547

volumes: []

1548

# -- Annotations to be added to the Redis server Deployment

1549

deploymentAnnotations: {}

1550

# -- Labels for the Redis server Deployment

1551

deploymentLabels: {}

1552

# -- Annotations to be added to the Redis server pods

1553

podAnnotations: {}

1554

# -- Labels to be added to the Redis server pods

1555

podLabels: {}

1556

# -- Resource limits and requests for redis

1557

resources: {}

1558

# limits:

1559

# cpu: 200m

1560

# memory: 128Mi

1561

# requests:

1562

# cpu: 100m

1563

# memory: 64Mi

1564

1565

# -- Redis pod-level security context

1566

# @default -- See [values.yaml]

1567

securityContext:

1568

runAsNonRoot: true

1569

runAsUser: 999

1570

seccompProfile:

1571

type: RuntimeDefault

1572

# Redis container ports

1573

containerPorts:

1574

# -- Redis container port

1575

redis: 6379

1576

# -- Metrics container port

1577

metrics: 9121

1578

# -- [DNS configuration]

1579

dnsConfig: {}

1580

# -- Alternative DNS policy for Redis server pods

1581

dnsPolicy: "ClusterFirst"

1582

# -- Redis container-level security context

1583

# @default -- See [values.yaml]

1584

containerSecurityContext:

1585

readOnlyRootFilesystem: true

1586

allowPrivilegeEscalation: false

1587

capabilities:

1588

drop:

1589

- ALL

1590

# -- Redis service port

1591

servicePort: 6379

1592

# -- Priority class for redis pods

1593

# @default -- `""` (defaults to global.priorityClassName)

1594

priorityClassName: ""

1595

# -- [Node selector]

1596

# @default -- `{}` (defaults to global.nodeSelector)

1597

nodeSelector: {}

1598

# -- [Tolerations] for use with node taints

1599

# @default -- `[]` (defaults to global.tolerations)

1600

tolerations: []

1601

# -- Assign custom [affinity] rules to the deployment

1602

# @default -- `{}` (defaults to global.affinity preset)

1603

affinity: {}

1604

# -- Assign custom [TopologySpreadConstraints] rules to redis

1605

# @default -- `[]` (defaults to global.topologySpreadConstraints)

1606

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1607

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

1608

topologySpreadConstraints: []

1609

# - maxSkew: 1

1610

# topologyKey: topology.kubernetes.io/zone

1611

# whenUnsatisfiable: DoNotSchedule

1612

1613

# -- terminationGracePeriodSeconds for container lifecycle hook

1614

terminationGracePeriodSeconds: 30

1615

# -- Automount API credentials for the Service Account into the pod.

1616

automountServiceAccountToken: true

1617

serviceAccount:

1618

# -- Create a service account for the redis pod

1619

create: false

1620

# -- Service account name for redis pod

1621

1622

# -- Annotations applied to created service account

1623

annotations: {}

1624

# -- Automount API credentials for the Service Account

1625

automountServiceAccountToken: false

1626

service:

1627

# -- Redis service annotations

1628

annotations: {}

1629

# -- Additional redis service labels

1630

labels: {}

1631

metrics:

1632

# -- Deploy metrics service

1633

enabled: false

1634

# Redis metrics service configuration

1635

service:

1636

# -- Metrics service type

1637

type: ClusterIP

1638

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

1639

clusterIP: None

1640

# -- Metrics service annotations

1641

annotations: {}

1642

# -- Metrics service labels

1643

labels: {}

1644

# -- Metrics service port

1645

servicePort: 9121

1646

# -- Metrics service port name

1647

portName: http-metrics

1648

serviceMonitor:

1649

# -- Enable a prometheus ServiceMonitor

1650

enabled: false

1651

# -- Interval at which metrics should be scraped

1652

interval: 30s

1653

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1654

honorLabels: false

1655

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1656

relabelings: []

1657

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1658

metricRelabelings: []

1659

# -- Prometheus ServiceMonitor selector

1660

selector: {}

1661

# prometheus: kube-prometheus

1662

1663

# -- Prometheus ServiceMonitor scheme

1664

scheme: ""

1665

# -- Prometheus ServiceMonitor tlsConfig

1666

tlsConfig: {}

1667

# -- Prometheus ServiceMonitor namespace

1668

namespace: "" # "monitoring"

1669

# -- Prometheus ServiceMonitor labels

1670

additionalLabels: {}

1671

# -- Prometheus ServiceMonitor annotations

1672

annotations: {}

1673

# Default redis's network policy

1674

networkPolicy:

1675

# -- Default network policy rules used by redis

1676

# @default -- `false` (defaults to global.networkPolicy.create)

1677

create: false

1678

## Redis-HA subchart replaces custom redis deployment when `redis-ha.enabled=true`

1679

# Ref: https://github.com/DandyDeveloper/charts/blob/master/charts/redis-ha/values.yaml

1680

redis-ha:

1681

# -- Enables the Redis HA subchart and disables the custom Redis single node deployment

1682

enabled: false

1683

## Redis image

1684

image:

1685

# -- Redis repository

1686

repository: ecr-public.aws.com/docker/library/redis

1687

# -- Redis tag

1688

## Do not upgrade to >= 7.4.0, otherwise you are no longer using an open source version of Redis

1689

tag: 8.2.3-alpine

1690

## Prometheus redis-exporter sidecar

1691

exporter:

1692

# -- Enable Prometheus redis-exporter sidecar

1693

enabled: false

1694

# -- Repository to use for the redis-exporter

1695

image: ghcr.io/oliver006/redis_exporter

1696

# -- Tag to use for the redis-exporter

1697

tag: v1.75.0

1698

persistentVolume:

1699

# -- Configures persistence on Redis nodes

1700

enabled: false

1701

## Redis specific configuration options

1702

redis:

1703

# -- Redis convention for naming the cluster group: must match `^[\\w-\\.]+$` and can be templated

1704

masterGroupName: argocd

1705

# -- Any valid redis config options in this section will be applied to each server (see `redis-ha` chart)

1706

# @default -- See [values.yaml]

1707

config:

1708

# -- Will save the DB if both the given number of seconds and the given number of write operations against the DB occurred. `""` is disabled

1709

# @default -- `'""'`

1710

save: '""'

1711

## Enables a HA Proxy for better LoadBalancing / Sentinel Master support. Automatically proxies to Redis master.

1712

haproxy:

1713

# -- Enabled HAProxy LoadBalancing/Proxy

1714

enabled: true

1715

# -- Custom labels for the haproxy pod. This is relevant for Argo CD CLI.

1716

labels:

1717

app.kubernetes.io/name: argocd-redis-ha-haproxy

1718

image:

1719

# -- HAProxy Image Repository

1720

repository: ecr-public.aws.com/docker/library/haproxy

1721

metrics:

1722

# -- HAProxy enable prometheus metric scraping

1723

enabled: true

1724

# -- Whether the haproxy pods should be forced to run on separate nodes.

1725

hardAntiAffinity: true

1726

# -- Additional affinities to add to the haproxy pods.

1727

additionalAffinities: {}

1728

# -- Assign custom [affinity] rules to the haproxy pods.

1729

affinity: ""

1730

# -- [Tolerations] for use with node taints for haproxy pods.

1731

tolerations: []

1732

# -- HAProxy container-level security context

1733

# @default -- See [values.yaml]

1734

containerSecurityContext:

1735

readOnlyRootFilesystem: true

1736

# -- Configures redis-ha with AUTH

1737

auth: true

1738

# -- Existing Secret to use for redis-ha authentication.

1739

# By default the redis-secret-init Job is generating this Secret.

1740

existingSecret: argocd-redis

1741

# -- Whether the Redis server pods should be forced to run on separate nodes.

1742

hardAntiAffinity: true

1743

# -- Additional affinities to add to the Redis server pods.

1744

additionalAffinities: {}

1745

# -- Assign custom [affinity] rules to the Redis pods.

1746

affinity: ""

1747

# -- [Tolerations] for use with node taints for Redis pods.

1748

tolerations: []

1749

# -- Assign custom [TopologySpreadConstraints] rules to the Redis pods.

1750

## https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1751

topologySpreadConstraints:

1752

# -- Enable Redis HA topology spread constraints

1753

enabled: false

1754

# -- Max skew of pods tolerated

1755

# @default -- `""` (defaults to `1`)

1756

maxSkew: ""

1757

# -- Topology key for spread

1758

# @default -- `""` (defaults to `topology.kubernetes.io/zone`)

1759

topologyKey: ""

1760

# -- Enforcement policy, hard or soft

1761

# @default -- `""` (defaults to `ScheduleAnyway`)

1762

whenUnsatisfiable: ""

1763

# -- Redis HA statefulset container-level security context

1764

# @default -- See [values.yaml]

1765

containerSecurityContext:

1766

readOnlyRootFilesystem: true

1767

# External Redis parameters

1768

externalRedis:

1769

# -- External Redis server host

1770

host: ""

1771

# -- External Redis username

1772

username: ""

1773

# -- External Redis password

1774

password: ""

1775

# -- External Redis server port

1776

port: 6379

1777

# -- The name of an existing secret with Redis (must contain key `redis-password`. And should contain `redis-username` if username is not `default`) and Sentinel credentials.

1778

# When it's set, the `externalRedis.username` and `externalRedis.password` parameters are ignored

1779

existingSecret: ""

1780

# -- External Redis Secret annotations

1781

secretAnnotations: {}

1782

redisSecretInit:

1783

# -- Enable Redis secret initialization. If disabled, secret must be provisioned by alternative methods

1784

enabled: true

1785

# -- Redis secret-init name

1786

1787

image:

1788

# -- Repository to use for the Redis secret-init Job

1789

# @default -- `""` (defaults to global.image.repository)

1790

repository: "" # defaults to global.image.repository

1791

# -- Tag to use for the Redis secret-init Job

1792

# @default -- `""` (defaults to global.image.tag)

1793

tag: "" # defaults to global.image.tag

1794

# -- Image pull policy for the Redis secret-init Job

1795

# @default -- `""` (defaults to global.image.imagePullPolicy)

1796

imagePullPolicy: "" # IfNotPresent

1797

# -- Additional command line arguments for the Redis secret-init Job

1798

extraArgs: []

1799

# -- Secrets with credentials to pull images from a private registry

1800

# @default -- `[]` (defaults to global.imagePullSecrets)

1801

imagePullSecrets: []

1802

# -- Runtime class name for the Redis secret-init Job

1803

# @default -- `""` (defaults to global.runtimeClassName)

1804

runtimeClassName: ""

1805

# -- Annotations to be added to the Redis secret-init Job

1806

jobAnnotations: {}

1807

# -- Annotations to be added to the Redis secret-init Job

1808

podAnnotations: {}

1809

# -- Labels to be added to the Redis secret-init Job

1810

podLabels: {}

1811

# -- Resource limits and requests for Redis secret-init Job

1812

resources: {}

1813

# limits:

1814

# cpu: 200m

1815

# memory: 128Mi

1816

# requests:

1817

# cpu: 100m

1818

# memory: 64Mi

1819

1820

# -- Application controller container-level security context

1821

# @default -- See [values.yaml]

1822

containerSecurityContext:

1823

allowPrivilegeEscalation: false

1824

capabilities:

1825

drop:

1826

- ALL

1827

readOnlyRootFilesystem: true

1828

runAsNonRoot: true

1829

seccompProfile:

1830

type: RuntimeDefault

1831

# -- Redis secret-init Job pod-level security context

1832

securityContext: {}

1833

serviceAccount:

1834

# -- Create a service account for the redis pod

1835

create: true

1836

# -- Service account name for redis pod

1837

1838

# -- Annotations applied to created service account

1839

annotations: {}

1840

# -- Automount API credentials for the Service Account

1841

automountServiceAccountToken: true

1842

# -- Priority class for Redis secret-init Job

1843

# @default -- `""` (defaults to global.priorityClassName)

1844

priorityClassName: ""

1845

# -- Assign custom [affinity] rules to the Redis secret-init Job

1846

affinity: {}

1847

# -- Node selector to be added to the Redis secret-init Job

1848

# @default -- `{}` (defaults to global.nodeSelector)

1849

nodeSelector: {}

1850

# -- Tolerations to be added to the Redis secret-init Job

1851

# @default -- `[]` (defaults to global.tolerations)

1852

tolerations: []

1853

## Server

1854

server:

1855

# -- Argo CD server name

1856

1857

# -- The number of server pods to run

1858

replicas: 1

1859

# -- Runtime class name for the Argo CD server

1860

# @default -- `""` (defaults to global.runtimeClassName)

1861

runtimeClassName: ""

1862

## Argo CD server Horizontal Pod Autoscaler

1863

autoscaling:

1864

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo CD server

1865

enabled: false

1866

# -- Minimum number of replicas for the Argo CD server [HPA]

1867

minReplicas: 1

1868

# -- Maximum number of replicas for the Argo CD server [HPA]

1869

maxReplicas: 5

1870

# -- Average CPU utilization percentage for the Argo CD server [HPA]

1871

targetCPUUtilizationPercentage: 50

1872

# -- Average memory utilization percentage for the Argo CD server [HPA]

1873

targetMemoryUtilizationPercentage: 50

1874

# -- Configures the scaling behavior of the target in both Up and Down directions.

1875

behavior: {}

1876

# scaleDown:

1877

# stabilizationWindowSeconds: 300

1878

# policies:

1879

# - type: Pods

1880

# value: 1

1881

# periodSeconds: 180

1882

# scaleUp:

1883

# stabilizationWindowSeconds: 300

1884

# policies:

1885

# - type: Pods

1886

# value: 2

1887

# periodSeconds: 60

1888

# -- Configures custom HPA metrics for the Argo CD server

1889

# Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

1890

metrics: []

1891

## Argo CD server Pod Disruption Budget

1892

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1893

pdb:

1894

# -- Deploy a [PodDisruptionBudget] for the Argo CD server

1895

enabled: false

1896

# -- Labels to be added to Argo CD server pdb

1897

labels: {}

1898

# -- Annotations to be added to Argo CD server pdb

1899

annotations: {}

1900

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1901

# @default -- `""` (defaults to 0 if not specified)

1902

minAvailable: ""

1903

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

1904

## Has higher precedence over `server.pdb.minAvailable`

1905

maxUnavailable: ""

1906

## Argo CD server Vertical Pod Autoscaler

1907

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1908

vpa:

1909

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Argo CD server

1910

enabled: false

1911

# -- Labels to be added to Argo CD server vpa

1912

labels: {}

1913

# -- Annotations to be added to Argo CD server vpa

1914

annotations: {}

1915

# -- One of the VPA operation modes

1916

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1917

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1918

updateMode: Initial

1919

# -- Controls how VPA computes the recommended resources for Argo CD server container

1920

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1921

containerPolicy: {}

1922

# controlledResources: ["cpu", "memory"]

1923

# minAllowed:

1924

# cpu: 250m

1925

# memory: 256Mi

1926

# maxAllowed:

1927

# cpu: 1

1928

# memory: 1Gi

1929

1930

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

1931

## NOTE: specify only zero or one recommender as of VPA 1.7.1

1932

recommenders: []

1933

## Argo CD server image

1934

image:

1935

# -- Repository to use for the Argo CD server

1936

# @default -- `""` (defaults to global.image.repository)

1937

repository: "" # defaults to global.image.repository

1938

# -- Tag to use for the Argo CD server

1939

# @default -- `""` (defaults to global.image.tag)

1940

tag: "" # defaults to global.image.tag

1941

# -- Image pull policy for the Argo CD server

1942

# @default -- `""` (defaults to global.image.imagePullPolicy)

1943

imagePullPolicy: "" # IfNotPresent

1944

# -- Secrets with credentials to pull images from a private registry

1945

# @default -- `[]` (defaults to global.imagePullSecrets)

1946

imagePullSecrets: []

1947

# -- Additional command line arguments to pass to Argo CD server

1948

extraArgs: []

1949

# -- Environment variables to pass to Argo CD server

1950

env: []

1951

# -- envFrom to pass to Argo CD server

1952

# @default -- `[]` (See [values.yaml])

1953

envFrom: []

1954

# - configMapRef:

1955

# name: config-map-name

1956

# - secretRef:

1957

# name: secret-name

1958

1959

# -- Specify postStart and preStop lifecycle hooks for your argo-cd-server container

1960

lifecycle: {}

1961

## Argo CD extensions

1962

## This function in tech preview stage, do expect instability or breaking changes in newer versions.

1963

## Ref: https://github.com/argoproj-labs/argocd-extension-installer

1964

## When you enable extensions, you need to configure RBAC of logged in Argo CD user.

1965

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#the-extensions-resource

1966

extensions:

1967

# -- Enable support for Argo CD extensions

1968

enabled: false

1969

## Argo CD extension installer image

1970

image:

1971

# -- Repository to use for extension installer image

1972

repository: cgr.dev/chainguard-private/argocd-extension-installer

1973

# -- Tag to use for extension installer image

1974

tag: latest@sha256:75f77e5bf7b7b7ce788b4bd0e8898b4f5e17b287d5379f0284c118d920a8d842

1975

# -- Image pull policy for extensions

1976

# @default -- `""` (defaults to global.image.imagePullPolicy)

1977

imagePullPolicy: ""

1978

# -- Extensions for Argo CD

1979

# @default -- `[]` (See [values.yaml])

1980

## Ref: https://github.com/argoproj-labs/argocd-extension-metrics#install-ui-extension

1981

extensionList: []

1982

# - name: extension-metrics

1983

# env:

1984

# - name: EXTENSION_URL

1985

# value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension.tar.gz

1986

# - name: EXTENSION_CHECKSUM_URL

1987

# value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension_checksums.txt

1988

1989

# -- Server UI extensions container-level security context

1990

# @default -- See [values.yaml]

1991

containerSecurityContext:

1992

runAsNonRoot: true

1993

readOnlyRootFilesystem: true

1994

allowPrivilegeEscalation: false

1995

runAsUser: 1000

1996

seccompProfile:

1997

type: RuntimeDefault

1998

capabilities:

1999

drop:

2000

- ALL

2001

# -- Resource limits and requests for the argocd-extensions container

2002

resources: {}

2003

# limits:

2004

# cpu: 50m

2005

# memory: 128Mi

2006

# requests:

2007

# cpu: 10m

2008

# memory: 64Mi

2009

# -- Additional containers to be added to the server pod

2010

## Note: Supports use of custom Helm templates

2011

extraContainers: []

2012

# - name: my-sidecar

2013

# image: nginx:latest

2014

# - name: lemonldap-ng-controller

2015

# image: lemonldapng/lemonldap-ng-controller:0.2.0

2016

# args:

2017

# - /lemonldap-ng-controller

2018

# - --alsologtostderr

2019

# - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration

2020

# env:

2021

# - name: POD_NAME

2022

# valueFrom:

2023

# fieldRef:

2024

# fieldPath: metadata.name

2025

# - name: POD_NAMESPACE

2026

# valueFrom:

2027

# fieldRef:

2028

# fieldPath: metadata.namespace

2029

# volumeMounts:

2030

# - name: copy-portal-skins

2031

# mountPath: /srv/var/lib/lemonldap-ng/portal/skins

2032

2033

# -- Init containers to add to the server pod

2034

## If your target Kubernetes cluster(s) require a custom credential (exec) plugin

2035

## you could use this (and the same in the application controller pod) to provide such executable

2036

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

2037

initContainers: []

2038

# - name: download-tools

2039

# image: alpine:3

2040

# command: [sh, -c]

2041

# args:

2042

# - wget -qO /custom-tools/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.7/kubelogin-linux-amd64.zip &&

2043

# mkdir /custom-tools/tmp && unzip -d /custom-tools/tmp /custom-tools/kubelogin.zip &&

2044

# mv /custom-tools/tmp/bin/linux_amd64/kubelogin /custom-tools/ && rm -rf custom-tools/tmp && rm /custom-tools/kubelogin.zip

2045

# volumeMounts:

2046

# - mountPath: /custom-tools

2047

# name: custom-tools

2048

2049

# -- Additional volumeMounts to the server main container

2050

volumeMounts: []

2051

# - mountPath: /usr/local/bin/kubelogin

2052

# name: custom-tools

2053

# subPath: kubelogin

2054

2055

# -- Additional volumes to the server pod

2056

volumes: []

2057

# - name: custom-tools

2058

# emptyDir: {}

2059

2060

## Argo CD server emptyDir volumes

2061

emptyDir:

2062

# -- EmptyDir size limit for the Argo CD server

2063

# @default -- `""` (defaults not set if not specified i.e. no size limit)

2064

sizeLimit: ""

2065

# sizeLimit: "1Gi"

2066

# -- Annotations to be added to server Deployment

2067

deploymentAnnotations: {}

2068

# -- Labels for the server Deployment

2069

deploymentLabels: {}

2070

# -- Annotations to be added to server pods

2071

podAnnotations: {}

2072

# -- Labels to be added to server pods

2073

podLabels: {}

2074

# -- Resource limits and requests for the Argo CD server

2075

resources: {}

2076

# limits:

2077

# cpu: 100m

2078

# memory: 128Mi

2079

# requests:

2080

# cpu: 50m

2081

# memory: 64Mi

2082

2083

# Server container ports

2084

containerPorts:

2085

# -- Server container port

2086

server: 8080

2087

# -- Metrics container port

2088

metrics: 8083

2089

# -- Host Network for Server pods

2090

hostNetwork: false

2091

# -- [DNS configuration]

2092

dnsConfig: {}

2093

# -- Alternative DNS policy for Server pods

2094

dnsPolicy: "ClusterFirst"

2095

# -- Server container-level security context

2096

# @default -- See [values.yaml]

2097

containerSecurityContext:

2098

runAsNonRoot: true

2099

readOnlyRootFilesystem: true

2100

allowPrivilegeEscalation: false

2101

seccompProfile:

2102

type: RuntimeDefault

2103

capabilities:

2104

drop:

2105

- ALL

2106

## Readiness and liveness probes for default backend

2107

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2108

readinessProbe:

2109

# -- Enable Kubernetes readiness probe for default backend

2110

enabled: true

2111

# -- Http path to use for the readiness probe

2112

httpPath: /healthz

2113

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2114

failureThreshold: 3

2115

# -- Number of seconds after the container has started before [probe] is initiated

2116

initialDelaySeconds: 10

2117

# -- How often (in seconds) to perform the [probe]

2118

periodSeconds: 10

2119

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2120

successThreshold: 1

2121

# -- Number of seconds after which the [probe] times out

2122

timeoutSeconds: 1

2123

livenessProbe:

2124

# -- Enable Kubernetes liveness probe for default backend

2125

enabled: true

2126

# -- Http path to use for the liveness probe

2127

httpPath: /healthz?full=true

2128

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2129

failureThreshold: 3

2130

# -- Number of seconds after the container has started before [probe] is initiated

2131

initialDelaySeconds: 10

2132

# -- How often (in seconds) to perform the [probe]

2133

periodSeconds: 10

2134

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2135

successThreshold: 1

2136

# -- Number of seconds after which the [probe] times out

2137

timeoutSeconds: 1

2138

## Startup probe for Argo CD server (optional)

2139

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2140

startupProbe:

2141

# -- Enable Kubernetes startup probe for Argo CD server

2142

enabled: false

2143

# -- Http path to use for the startup probe

2144

httpPath: /healthz

2145

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2146

failureThreshold: 20

2147

# -- Number of seconds after the container has started before [probe] is initiated

2148

initialDelaySeconds: 10

2149

# -- How often (in seconds) to perform the [probe]

2150

periodSeconds: 10

2151

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2152

successThreshold: 1

2153

# -- Number of seconds after which the [probe] times out

2154

timeoutSeconds: 1

2155

# -- terminationGracePeriodSeconds for container lifecycle hook

2156

terminationGracePeriodSeconds: 30

2157

# -- Priority class for the Argo CD server pods

2158

# @default -- `""` (defaults to global.priorityClassName)

2159

priorityClassName: ""

2160

# -- [Node selector]

2161

# @default -- `{}` (defaults to global.nodeSelector)

2162

nodeSelector: {}

2163

# -- [Tolerations] for use with node taints

2164

# @default -- `[]` (defaults to global.tolerations)

2165

tolerations: []

2166

# -- Assign custom [affinity] rules to the deployment

2167

# @default -- `{}` (defaults to global.affinity preset)

2168

affinity: {}

2169

# -- Assign custom [TopologySpreadConstraints] rules to the Argo CD server

2170

# @default -- `[]` (defaults to global.topologySpreadConstraints)

2171

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

2172

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

2173

topologySpreadConstraints: []

2174

# - maxSkew: 1

2175

# topologyKey: topology.kubernetes.io/zone

2176

# whenUnsatisfiable: DoNotSchedule

2177

2178

# -- Deployment strategy to be added to the server Deployment

2179

deploymentStrategy: {}

2180

# type: RollingUpdate

2181

# rollingUpdate:

2182

# maxSurge: 25%

2183

# maxUnavailable: 25%

2184

2185

# TLS certificate configuration via cert-manager

2186

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server

2187

certificate:

2188

# -- Deploy a Certificate resource (requires cert-manager)

2189

enabled: false

2190

# -- Certificate primary domain (commonName)

2191

# @default -- `""` (defaults to global.domain)

2192

domain: ""

2193

# -- Certificate Subject Alternate Names (SANs)

2194

additionalHosts: []

2195

# -- The requested 'duration' (i.e. lifetime) of the certificate.

2196

# @default -- `""` (defaults to 2160h = 90d if not specified)

2197

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

2198

duration: ""

2199

# -- How long before the expiry a certificate should be renewed.

2200

# @default -- `""` (defaults to 360h = 15d if not specified)

2201

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

2202

renewBefore: ""

2203

# Certificate issuer

2204

## Ref: https://cert-manager.io/docs/concepts/issuer

2205

issuer:

2206

# -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io`

2207

group: ""

2208

# -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer`

2209

kind: ""

2210

# -- Certificate issuer name. Eg. `letsencrypt`

2211

2212

# Private key of the certificate

2213

privateKey:

2214

# -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always`

2215

rotationPolicy: Never

2216

# -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8`

2217

encoding: PKCS1

2218

# -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA`

2219

algorithm: RSA

2220

# -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored.

2221

size: 2048

2222

# -- Annotations to be applied to the Server Certificate

2223

annotations: {}

2224

# -- Usages for the certificate

2225

### Ref: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage

2226

usages: []

2227

# -- Annotations that allow the certificate to be composed from data residing in existing Kubernetes Resources

2228

secretTemplateAnnotations: {}

2229

# TLS certificate configuration via Secret

2230

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server

2231

certificateSecret:

2232

# -- Create argocd-server-tls secret

2233

enabled: false

2234

# -- Annotations to be added to argocd-server-tls secret

2235

annotations: {}

2236

# -- Labels to be added to argocd-server-tls secret

2237

labels: {}

2238

# -- Private Key of the certificate

2239

key: ""

2240

# -- Certificate data

2241

crt: ""

2242

## Server service configuration

2243

service:

2244

# -- Server service annotations

2245

annotations: {}

2246

# -- Server service labels

2247

labels: {}

2248

# -- Server service type

2249

type: ClusterIP

2250

# -- Server service http port for NodePort service type (only if `server.service.type` is set to "NodePort")

2251

nodePortHttp: 30080

2252

# -- (int) Server service http2 port for NodePort service type (only if `server.service.servicePortHttp2` is set and `server.service.type` is set to "NodePort")

2253

# @default -- `nil` (a random node port is assigned)

2254

nodePortHttp2:

2255

# -- Server service https port for NodePort service type (only if `server.service.type` is set to "NodePort")

2256

nodePortHttps: 30443

2257

# -- Server service http port

2258

servicePortHttp: 80

2259

# -- (int) Server service cleartext http2 (h2c) port, targeting the same container port as `servicePortHttp`

2260

# @default -- `nil` (disabled)

2261

## The Argo CD server serves the web UI (HTTP/1.1) and gRPC (HTTP/2) on a single container port, and

2262

## `appProtocol` is single-valued per service port. Set this to expose a second port advertising the

2263

## h2c backend protocol, for Gateway API implementations that do not infer it from the route type.

2264

## Leave empty to disable. Only rendered when `configs.params."server.insecure"` is `true`, since

2265

## h2c is not applicable to a TLS backend.

2266

servicePortHttp2:

2267

# -- Server service https port

2268

servicePortHttps: 443

2269

# -- Server service http port name, can be used to route traffic via istio

2270

servicePortHttpName: http

2271

# -- Server service http2 port name, can be used to route traffic via istio

2272

servicePortHttp2Name: http2

2273

# -- Server service https port name, can be used to route traffic via istio

2274

servicePortHttpsName: https

2275

# -- Server service http2 port appProtocol, e.g. `kubernetes.io/h2c`. Implementations that select the

2276

# protocol from the port name instead do not need it

2277

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol

2278

servicePortHttp2AppProtocol: ""

2279

# -- Server service https port appProtocol

2280

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol

2281

servicePortHttpsAppProtocol: ""

2282

# -- The class of the load balancer implementation

2283

loadBalancerClass: ""

2284

# -- LoadBalancer will get created with the IP specified in this field

2285

loadBalancerIP: ""

2286

# -- Source IP ranges to allow access to service from

2287

## EKS Ref: https://repost.aws/knowledge-center/eks-cidr-ip-address-loadbalancer

2288

## GKE Ref: https://cloud.google.com/kubernetes-engine/docs/concepts/network-overview#limit-connectivity-ext-lb

2289

loadBalancerSourceRanges: []

2290

# -- Server service external IPs

2291

externalIPs: []

2292

# -- Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

2293

## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

2294

externalTrafficPolicy: Cluster

2295

# -- Used to maintain session affinity. Supports `ClientIP` and `None`

2296

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

2297

sessionAffinity: None

2298

## Server metrics service configuration

2299

metrics:

2300

# -- Deploy metrics service

2301

enabled: false

2302

service:

2303

# -- Metrics service type

2304

type: ClusterIP

2305

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

2306

clusterIP: ""

2307

# -- Metrics service annotations

2308

annotations: {}

2309

# -- Metrics service labels

2310

labels: {}

2311

# -- Metrics service port

2312

servicePort: 8083

2313

# -- Metrics service port name

2314

portName: http-metrics

2315

serviceMonitor:

2316

# -- Enable a prometheus ServiceMonitor

2317

enabled: false

2318

# -- Prometheus ServiceMonitor interval

2319

interval: 30s

2320

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

2321

scrapeTimeout: ""

2322

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

2323

honorLabels: false

2324

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

2325

relabelings: []

2326

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

2327

metricRelabelings: []

2328

# -- Prometheus ServiceMonitor selector

2329

selector: {}

2330

# prometheus: kube-prometheus

2331

2332

# -- Prometheus ServiceMonitor scheme

2333

scheme: ""

2334

# -- Prometheus ServiceMonitor tlsConfig

2335

tlsConfig: {}

2336

# -- Prometheus ServiceMonitor namespace

2337

namespace: "" # monitoring

2338

# -- Prometheus ServiceMonitor labels

2339

additionalLabels: {}

2340

# -- Prometheus ServiceMonitor annotations

2341

annotations: {}

2342

# -- Automount API credentials for the Service Account into the pod.

2343

automountServiceAccountToken: true

2344

serviceAccount:

2345

# -- Create server service account

2346

create: true

2347

# -- Server service account name

2348

2349

# -- Annotations applied to created service account

2350

annotations: {}

2351

# -- Labels applied to created service account

2352

labels: {}

2353

# -- Automount API credentials for the Service Account

2354

automountServiceAccountToken: true

2355

# Argo CD server ingress configuration

2356

ingress:

2357

# -- Enable an ingress resource for the Argo CD server

2358

enabled: false

2359

# -- Specific implementation for ingress controller. One of `generic`, `aws` or `gke`

2360

## Additional configuration might be required in related configuration sections

2361

controller: generic

2362

# -- Additional ingress labels

2363

labels: {}

2364

# -- Additional ingress annotations

2365

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough

2366

annotations: {}

2367

# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

2368

# nginx.ingress.kubernetes.io/ssl-passthrough: "true"

2369

2370

# -- Defines which ingress controller will implement the resource

2371

ingressClassName: ""

2372

# -- Argo CD server hostname

2373

# @default -- `""` (defaults to global.domain)

2374

hostname: ""

2375

# -- The path to Argo CD server

2376

path: /

2377

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

2378

pathType: Prefix

2379

# -- Enable TLS configuration for the hostname defined at `server.ingress.hostname`

2380

## TLS certificate will be retrieved from a TLS secret `argocd-server-tls`

2381

## You can create this secret via `certificate` or `certificateSecret` option

2382

tls: false

2383

# -- The list of additional hostnames to be covered by ingress record

2384

# @default -- `[]` (See [values.yaml])

2385

extraHosts: []

2386

# - name: argocd.example.com

2387

# path: /

2388

2389

# -- Additional ingress paths

2390

# @default -- `[]` (See [values.yaml])

2391

## Note: Supports use of custom Helm templates

2392

extraPaths: []

2393

# - path: /*

2394

# pathType: Prefix

2395

# backend:

2396

# service:

2397

# name: ssl-redirect

2398

# port:

2399

# name: use-annotation

2400

2401

# -- Additional ingress rules

2402

# @default -- `[]` (See [values.yaml])

2403

## Note: Supports use of custom Helm templates

2404

extraRules: []

2405

# - http:

2406

# paths:

2407

# - path: /

2408

# pathType: Prefix

2409

# backend:

2410

# service:

2411

# name: '{{ include "argo-cd.server.fullname" . }}'

2412

# port:

2413

# name: '{{ .Values.server.service.servicePortHttpsName }}'

2414

2415

# -- Additional TLS configuration

2416

# @default -- `[]` (See [values.yaml])

2417

extraTls: []

2418

# - hosts:

2419

# - argocd.example.com

2420

# secretName: your-certificate-name

2421

2422

# AWS specific options for Application Load Balancer

2423

# Applies only when `serv.ingress.controller` is set to `aws`

2424

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#aws-application-load-balancers-albs-and-classic-elb-http-mode

2425

aws:

2426

# -- Backend protocol version for the AWS ALB gRPC service

2427

## This tells AWS to send traffic from the ALB using gRPC.

2428

## For more information: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html#health-check-settings

2429

backendProtocolVersion: GRPC

2430

# -- Service type for the AWS ALB gRPC service

2431

## Can be of type NodePort or ClusterIP depending on which mode you are running.

2432

## Instance mode needs type NodePort, IP mode needs type ClusterIP

2433

## Ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/how-it-works/#ingress-traffic

2434

serviceType: NodePort

2435

# -- Annotations for the AWS ALB gRPC service

2436

## Allows adding custom annotations to the gRPC service for integrations like DataDog, Prometheus, etc.

2437

serviceAnnotations: {}

2438

# Google specific options for Google Application Load Balancer

2439

# Applies only when `server.ingress.controller` is set to `gke`

2440

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#google-cloud-load-balancers-with-kubernetes-ingress

2441

gke:

2442

# -- Google [BackendConfig] resource, for use with the GKE Ingress Controller

2443

# @default -- `{}` (See [values.yaml])

2444

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

2445

backendConfig: {}

2446

# iap:

2447

# enabled: true

2448

# oauthclientCredentials:

2449

# secretName: argocd-secret

2450

2451

# -- Google [FrontendConfig] resource, for use with the GKE Ingress Controller

2452

# @default -- `{}` (See [values.yaml])

2453

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

2454

frontendConfig: {}

2455

# redirectToHttps:

2456

# enabled: true

2457

# responseCodeName: RESPONSE_CODE

2458

2459

# Managed GKE certificate for ingress hostname

2460

managedCertificate:

2461

# -- Create ManagedCertificate resource and annotations for Google Load balancer

2462

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs

2463

create: true

2464

# -- Additional domains for ManagedCertificate resource

2465

extraDomains: []

2466

# - argocd.example.com

2467

# Dedicated gRPC ingress for ingress controllers that supports only single backend protocol per Ingress resource

2468

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-2-multiple-ingress-objects-and-hosts

2469

ingressGrpc:

2470

# -- Enable an ingress resource for the Argo CD server for dedicated [gRPC-ingress]

2471

enabled: false

2472

# -- Additional ingress annotations for dedicated [gRPC-ingress]

2473

annotations: {}

2474

# -- Additional ingress labels for dedicated [gRPC-ingress]

2475

labels: {}

2476

# -- Defines which ingress controller will implement the resource [gRPC-ingress]

2477

ingressClassName: ""

2478

# -- Argo CD server hostname for dedicated [gRPC-ingress]

2479

# @default -- `""` (defaults to grpc.`server.ingress.hostname`)

2480

hostname: ""

2481

# -- Argo CD server ingress path for dedicated [gRPC-ingress]

2482

path: /

2483

# -- Ingress path type for dedicated [gRPC-ingress]. One of `Exact`, `Prefix` or `ImplementationSpecific`

2484

pathType: Prefix

2485

# -- Enable TLS configuration for the hostname defined at `server.ingressGrpc.hostname`

2486

## TLS certificate will be retrieved from a TLS secret with name: `argocd-server-grpc-tls`

2487

tls: false

2488

# -- The list of additional hostnames to be covered by ingress record

2489

# @default -- `[]` (See [values.yaml])

2490

extraHosts: []

2491

# - name: grpc.argocd.example.com

2492

# path: /

2493

2494

# -- Additional ingress paths for dedicated [gRPC-ingress]

2495

# @default -- `[]` (See [values.yaml])

2496

## Note: Supports use of custom Helm templates

2497

extraPaths: []

2498

# - path: /*

2499

# pathType: Prefix

2500

# backend:

2501

# service:

2502

# name: ssl-redirect

2503

# port:

2504

# name: use-annotation

2505

2506

# -- Additional ingress rules

2507

# @default -- `[]` (See [values.yaml])

2508

## Note: Supports use of custom Helm templates

2509

extraRules: []

2510

# - http:

2511

# paths:

2512

# - path: /

2513

# pathType: Prefix

2514

# backend:

2515

# service:

2516

# name: '{{ include "argo-cd.server.fullname" . }}'

2517

# port:

2518

# name: '{{ .Values.server.service.servicePortHttpName }}'

2519

2520

# -- Additional TLS configuration for dedicated [gRPC-ingress]

2521

# @default -- `[]` (See [values.yaml])

2522

extraTls: []

2523

# - secretName: your-certificate-name

2524

# hosts:

2525

# - argocd.example.com

2526

# Create a OpenShift Route with SSL passthrough for UI and CLI

2527

# Consider setting 'hostname' e.g. https://argocd.apps-crc.testing/ using your Default Ingress Controller Domain

2528

# Find your domain with: kubectl describe --namespace=openshift-ingress-operator ingresscontroller/default | grep Domain:

2529

# If 'hostname' is an empty string "" OpenShift will create a hostname for you.

2530

route:

2531

# -- Enable an OpenShift Route for the Argo CD server

2532

enabled: false

2533

# -- Openshift Route annotations

2534

annotations: {}

2535

# -- Hostname of OpenShift Route

2536

hostname: ""

2537

# -- Termination type of Openshift Route

2538

termination_type: passthrough

2539

# -- Termination policy of Openshift Route

2540

termination_policy: None

2541

# Gateway API HTTPRoute configuration

2542

# NOTE: Gateway API support is in EXPERIMENTAL status

2543

# Support depends on your Gateway controller implementation

2544

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

2545

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

2546

httproute:

2547

# -- Enable HTTPRoute resource for Argo CD server (Gateway API)

2548

enabled: false

2549

# -- Additional HTTPRoute labels

2550

labels: {}

2551

# -- Additional HTTPRoute annotations

2552

annotations: {}

2553

# -- Gateway API parentRefs for the HTTPRoute

2554

## Must reference an existing Gateway

2555

# @default -- `[]` (See [values.yaml])

2556

parentRefs: []

2557

# - name: example-gateway

2558

# namespace: example-gateway-namespace

2559

# sectionName: https

2560

# -- List of hostnames for the HTTPRoute

2561

# @default -- `[]` (See [values.yaml])

2562

hostnames: []

2563

# - argocd.example.com

2564

# -- HTTPRoute rules configuration

2565

# @default -- `[]` (See [values.yaml])

2566

rules:

2567

- matches:

2568

- path:

2569

type: PathPrefix

2570

value: /

2571

# filters: []

2572

# - type: RequestHeaderModifier

2573

# requestHeaderModifier:

2574

# add:

2575

# - name: X-Custom-Header

2576

# value: custom-value

2577

# timeouts:

2578

# request: 10s

2579

# backendRequest: 2s

2580

# Gateway API GRPCRoute configuration

2581

# NOTE: Gateway API support is in EXPERIMENTAL status

2582

# Support depends on your Gateway controller implementation

2583

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

2584

grpcroute:

2585

# -- Enable GRPCRoute resource for Argo CD server (Gateway API)

2586

enabled: false

2587

# -- Additional GRPCRoute labels

2588

labels: {}

2589

# -- Additional GRPCRoute annotations

2590

annotations: {}

2591

# -- Gateway API parentRefs for the GRPCRoute

2592

## Must reference an existing Gateway

2593

# @default -- `[]` (See [values.yaml])

2594

parentRefs: []

2595

# - name: example-gateway

2596

# namespace: example-gateway-namespace

2597

# sectionName: grpc

2598

# -- List of hostnames for the GRPCRoute

2599

# @default -- `[]` (See [values.yaml])

2600

hostnames: []

2601

# - grpc.argocd.example.com

2602

# -- GRPCRoute rules configuration

2603

# @default -- `[]` (See [values.yaml])

2604

rules:

2605

- matches:

2606

- method:

2607

type: Exact

2608

# filters: []

2609

# - type: RequestHeaderModifier

2610

# requestHeaderModifier:

2611

# add:

2612

# - name: X-Custom-Header

2613

# value: custom-value

2614

# Gateway API BackendTLSPolicy configuration

2615

# NOTE: BackendTLSPolicy support is in EXPERIMENTAL status

2616

# Required for HTTPS backends when using Gateway API

2617

# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)

2618

backendTLSPolicy:

2619

# -- Enable BackendTLSPolicy resource for Argo CD server (Gateway API)

2620

enabled: false

2621

# -- Additional BackendTLSPolicy labels

2622

labels: {}

2623

# -- Additional BackendTLSPolicy annotations

2624

annotations: {}

2625

# -- Target references for the BackendTLSPolicy

2626

# @default -- `[]` (See [values.yaml])

2627

targetRefs: []

2628

# - group: ""

2629

# kind: Service

2630

# name: argocd-server

2631

# sectionName: https

2632

# -- TLS validation configuration

2633

# @default -- `{}` (See [values.yaml])

2634

validation: {}

2635

# hostname: argocd-server.argocd.svc.cluster.local

2636

# caCertificateRefs:

2637

# - name: example-ca-cert

2638

# group: ""

2639

# kind: ConfigMap

2640

# wellKnownCACertificates: System

2641

# Gateway API ListenerSet configuration

2642

# NOTE: Gateway API support is in EXPERIMENTAL status

2643

# ListenerSet allows attaching additional listeners to an existing Gateway

2644

# Requires Gateway API v1alpha2 and a controller that supports ListenerSet

2645

# Refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.ListenerSet

2646

listenerset:

2647

# -- Enable ListenerSet resource for Argo CD server (Gateway API)

2648

enabled: false

2649

# -- Additional ListenerSet labels

2650

labels: {}

2651

# -- Additional ListenerSet annotations

2652

annotations: {}

2653

# -- Gateway API parentRef for the ListenerSet

2654

## Must reference an existing Gateway. Unlike HTTPRoute, ListenerSet accepts exactly one parentRef.

2655

# @default -- `{}` (See [values.yaml])

2656

parentRef: {}

2657

# name: example-gateway

2658

# namespace: example-gateway-namespace

2659

# -- Hostname for the synthesized listener. Defaults to global.domain when empty.

2660

hostname: ""

2661

# -- Name of the synthesized listener. Also used as sectionName in auto-derived httproute parentRefs.

2662

listenerName: https

2663

# -- Port for the synthesized listener

2664

port: 443

2665

# -- Protocol for the synthesized listener

2666

protocol: HTTPS

2667

# -- TLS configuration for the synthesized listener

2668

tls:

2669

# -- Enable TLS on the synthesized listener

2670

enabled: true

2671

# -- TLS termination mode

2672

mode: Terminate

2673

# -- Secret name for TLS certificate. Defaults to `argocd-server-tls` when empty.

2674

secretName: ""

2675

# -- allowedRoutes for the synthesized listener

2676

allowedRoutes:

2677

namespaces:

2678

from: Same

2679

# -- Listeners to attach to the parent Gateway. When non-empty, used verbatim and all synthesized listener fields above are ignored.

2680

# @default -- `[]` (See [values.yaml])

2681

listeners: []

2682

# - name: https

2683

# port: 443

2684

# protocol: HTTPS

2685

# hostname: argocd.example.com

2686

# tls:

2687

# mode: Terminate

2688

# certificateRefs:

2689

# - group: ""

2690

# kind: Secret

2691

# name: argocd-server-tls

2692

# allowedRoutes:

2693

# namespaces:

2694

# from: Same

2695

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

2696

## Defaults to off

2697

clusterRoleRules:

2698

# -- Enable custom rules for the server's ClusterRole resource

2699

enabled: false

2700

# -- List of custom rules for the server's ClusterRole resource

2701

rules: []

2702

# Default ArgoCD Server's network policy

2703

networkPolicy:

2704

# -- Default network policy rules used by ArgoCD Server

2705

# @default -- `false` (defaults to global.networkPolicy.create)

2706

create: false

2707

## Repo Server

2708

repoServer:

2709

# -- Repo server name

2710

2711

# -- The number of repo server pods to run

2712

replicas: 1

2713

# -- Runtime class name for the repo server

2714

# @default -- `""` (defaults to global.runtimeClassName)

2715

runtimeClassName: ""

2716

## Repo server Horizontal Pod Autoscaler

2717

autoscaling:

2718

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the repo server

2719

enabled: false

2720

# -- Minimum number of replicas for the repo server [HPA]

2721

minReplicas: 1

2722

# -- Maximum number of replicas for the repo server [HPA]

2723

maxReplicas: 5

2724

# -- Average CPU utilization percentage for the repo server [HPA]

2725

targetCPUUtilizationPercentage: 50

2726

# -- Average memory utilization percentage for the repo server [HPA]

2727

targetMemoryUtilizationPercentage: 50

2728

# -- Configures the scaling behavior of the target in both Up and Down directions.

2729

behavior: {}

2730

# scaleDown:

2731

# stabilizationWindowSeconds: 300

2732

# policies:

2733

# - type: Pods

2734

# value: 1

2735

# periodSeconds: 180

2736

# scaleUp:

2737

# stabilizationWindowSeconds: 300

2738

# policies:

2739

# - type: Pods

2740

# value: 2

2741

# periodSeconds: 60

2742

# -- Configures custom HPA metrics for the Argo CD repo server

2743

# Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

2744

metrics: []

2745

## Repo server Pod Disruption Budget

2746

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

2747

pdb:

2748

# -- Deploy a [PodDisruptionBudget] for the repo server

2749

enabled: false

2750

# -- Labels to be added to repo server pdb

2751

labels: {}

2752

# -- Annotations to be added to repo server pdb

2753

annotations: {}

2754

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

2755

# @default -- `""` (defaults to 0 if not specified)

2756

minAvailable: ""

2757

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

2758

## Has higher precedence over `repoServer.pdb.minAvailable`

2759

maxUnavailable: ""

2760

## Repo server Vertical Pod Autoscaler

2761

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

2762

vpa:

2763

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the repo server

2764

enabled: false

2765

# -- Labels to be added to repo server vpa

2766

labels: {}

2767

# -- Annotations to be added to repo server vpa

2768

annotations: {}

2769

# -- One of the VPA operation modes

2770

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

2771

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

2772

updateMode: Initial

2773

# -- Controls how VPA computes the recommended resources for repo server container

2774

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

2775

containerPolicy: {}

2776

# controlledResources: ["cpu", "memory"]

2777

# minAllowed:

2778

# cpu: 250m

2779

# memory: 256Mi

2780

# maxAllowed:

2781

# cpu: 1

2782

# memory: 1Gi

2783

2784

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

2785

## NOTE: specify only zero or one recommender as of VPA 1.7.1

2786

recommenders: []

2787

## Repo server image

2788

image:

2789

# -- Repository to use for the repo server

2790

# @default -- `""` (defaults to global.image.repository)

2791

repository: ""

2792

# -- Tag to use for the repo server

2793

# @default -- `""` (defaults to global.image.tag)

2794

tag: ""

2795

# -- Image pull policy for the repo server

2796

# @default -- `""` (defaults to global.image.imagePullPolicy)

2797

imagePullPolicy: ""

2798

# -- Secrets with credentials to pull images from a private registry

2799

# @default -- `[]` (defaults to global.imagePullSecrets)

2800

imagePullSecrets: []

2801

# -- Additional command line arguments to pass to repo server

2802

extraArgs: []

2803

# -- Environment variables to pass to repo server

2804

env: []

2805

# -- envFrom to pass to repo server

2806

# @default -- `[]` (See [values.yaml])

2807

envFrom: []

2808

# - configMapRef:

2809

# name: config-map-name

2810

# - secretRef:

2811

# name: secret-name

2812

2813

# -- Specify postStart and preStop lifecycle hooks for your argo-repo-server container

2814

lifecycle: {}

2815

# -- Additional containers to be added to the repo server pod

2816

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/

2817

## Note: Supports use of custom Helm templates

2818

extraContainers: []

2819

# - name: cmp-my-plugin

2820

# command:

2821

# - "/var/run/argocd/argocd-cmp-server"

2822

# image: busybox

2823

# securityContext:

2824

# runAsNonRoot: true

2825

# runAsUser: 999

2826

# volumeMounts:

2827

# - mountPath: /var/run/argocd

2828

# name: var-files

2829

# - mountPath: /home/argocd/cmp-server/plugins

2830

# name: plugins

2831

# # Remove this volumeMount if you've chosen to bake the config file into the sidecar image.

2832

# - mountPath: /home/argocd/cmp-server/config/plugin.yaml

2833

# subPath: my-plugin.yaml

2834

# name: argocd-cmp-cm

2835

# # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps

2836

# # mitigate path traversal attacks.

2837

# - mountPath: /tmp

2838

# name: cmp-tmp

2839

# - name: cmp-my-plugin2

2840

# command:

2841

# - "/var/run/argocd/argocd-cmp-server"

2842

# image: busybox

2843

# securityContext:

2844

# runAsNonRoot: true

2845

# runAsUser: 999

2846

# volumeMounts:

2847

# - mountPath: /var/run/argocd

2848

# name: var-files

2849

# # Remove this volumeMount if you've chosen to bake the config file into the sidecar image.

2850

# - mountPath: /home/argocd/cmp-server/plugins

2851

# name: plugins

2852

# - mountPath: /home/argocd/cmp-server/config/plugin.yaml

2853

# subPath: my-plugin2.yaml

2854

# name: argocd-cmp-cm

2855

# # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps

2856

# # mitigate path traversal attacks.

2857

# - mountPath: /tmp

2858

# name: cmp-tmp

2859

2860

# -- Init containers to add to the repo server pods

2861

initContainers: []

2862

copyutil:

2863

# -- Extra arguments for the cp command in the repo server copyutil initContainer

2864

# @default -- `"--update=none"`

2865

extraArgs: "--update=none"

2866

# -- Resource limits and requests for the repo server copyutil initContainer

2867

resources: {}

2868

# limits:

2869

# cpu: 100m

2870

# memory: 128Mi

2871

# requests:

2872

# cpu: 50m

2873

# memory: 64Mi

2874

# -- Additional volumeMounts to the repo server main container

2875

volumeMounts: []

2876

# -- Additional volumes to the repo server pod

2877

volumes: []

2878

# - name: argocd-cmp-cm

2879

# configMap:

2880

# name: argocd-cmp-cm

2881

# - name: cmp-tmp

2882

# emptyDir: {}

2883

2884

# -- Volumes to be used in replacement of emptydir on default volumes

2885

existingVolumes: {}

2886

# gpgKeyring:

2887

# persistentVolumeClaim:

2888

# claimName: pvc-argocd-repo-server-keyring

2889

# helmWorkingDir:

2890

# persistentVolumeClaim:

2891

# claimName: pvc-argocd-repo-server-workdir

2892

# tmp:

2893

# persistentVolumeClaim:

2894

# claimName: pvc-argocd-repo-server-tmp

2895

# varFiles:

2896

# persistentVolumeClaim:

2897

# claimName: pvc-argocd-repo-server-varfiles

2898

# plugins:

2899

# persistentVolumeClaim:

2900

# claimName: pvc-argocd-repo-server-plugins

2901

2902

## RepoServer emptyDir volumes

2903

emptyDir:

2904

# -- EmptyDir size limit for repo server

2905

# @default -- `""` (defaults not set if not specified i.e. no size limit)

2906

sizeLimit: ""

2907

# sizeLimit: "1Gi"

2908

# -- Toggle the usage of a ephemeral Helm working directory

2909

useEphemeralHelmWorkingDir: true

2910

# -- Annotations to be added to repo server Deployment

2911

deploymentAnnotations: {}

2912

# -- Labels for the repo server Deployment

2913

deploymentLabels: {}

2914

# -- Annotations to be added to repo server pods

2915

podAnnotations: {}

2916

# -- Labels to be added to repo server pods

2917

podLabels: {}

2918

# -- Resource limits and requests for the repo server pods

2919

resources: {}

2920

# limits:

2921

# cpu: 50m

2922

# memory: 128Mi

2923

# requests:

2924

# cpu: 10m

2925

# memory: 64Mi

2926

2927

# Repo server container ports

2928

containerPorts:

2929

# -- Repo server container port

2930

server: 8081

2931

# -- Metrics container port

2932

metrics: 8084

2933

# -- Host Network for Repo server pods

2934

hostNetwork: false

2935

# -- [DNS configuration]

2936

dnsConfig: {}

2937

# -- Alternative DNS policy for Repo server pods

2938

dnsPolicy: "ClusterFirst"

2939

# -- Repo server container-level security context

2940

# @default -- See [values.yaml]

2941

containerSecurityContext:

2942

runAsNonRoot: true

2943

readOnlyRootFilesystem: true

2944

allowPrivilegeEscalation: false

2945

seccompProfile:

2946

type: RuntimeDefault

2947

capabilities:

2948

drop:

2949

- ALL

2950

## Readiness and liveness probes for Repo Server

2951

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2952

readinessProbe:

2953

# -- Enable Kubernetes readiness probe for Repo Server

2954

enabled: true

2955

# -- Http path to use for the readiness probe

2956

httpPath: /healthz

2957

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2958

failureThreshold: 3

2959

# -- Number of seconds after the container has started before [probe] is initiated

2960

initialDelaySeconds: 10

2961

# -- How often (in seconds) to perform the [probe]

2962

periodSeconds: 10

2963

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2964

successThreshold: 1

2965

# -- Number of seconds after which the [probe] times out

2966

timeoutSeconds: 1

2967

livenessProbe:

2968

# -- Enable Kubernetes liveness probe for Repo Server

2969

enabled: true

2970

# -- Http path to use for the liveness probe

2971

httpPath: /healthz?full=true

2972

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2973

failureThreshold: 3

2974

# -- Number of seconds after the container has started before [probe] is initiated

2975

initialDelaySeconds: 10

2976

# -- How often (in seconds) to perform the [probe]

2977

periodSeconds: 10

2978

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2979

successThreshold: 1

2980

# -- Number of seconds after which the [probe] times out

2981

timeoutSeconds: 1

2982

## Startup probe for Repo Server (optional)

2983

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2984

startupProbe:

2985

# -- Enable Kubernetes startup probe for Repo Server

2986

enabled: false

2987

# -- Http path to use for the startup probe

2988

httpPath: /healthz

2989

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2990

failureThreshold: 20

2991

# -- Number of seconds after the container has started before [probe] is initiated

2992

initialDelaySeconds: 10

2993

# -- How often (in seconds) to perform the [probe]

2994

periodSeconds: 10

2995

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2996

successThreshold: 1

2997

# -- Number of seconds after which the [probe] times out

2998

timeoutSeconds: 1

2999

# -- terminationGracePeriodSeconds for container lifecycle hook

3000

terminationGracePeriodSeconds: 30

3001

# -- [Node selector]

3002

# @default -- `{}` (defaults to global.nodeSelector)

3003

nodeSelector: {}

3004

# -- [Tolerations] for use with node taints

3005

# @default -- `[]` (defaults to global.tolerations)

3006

tolerations: []

3007

# -- Assign custom [affinity] rules to the deployment

3008

# @default -- `{}` (defaults to global.affinity preset)

3009

affinity: {}

3010

# -- Assign custom [TopologySpreadConstraints] rules to the repo server

3011

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3012

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

3013

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3014

topologySpreadConstraints: []

3015

# - maxSkew: 1

3016

# topologyKey: topology.kubernetes.io/zone

3017

# whenUnsatisfiable: DoNotSchedule

3018

3019

# -- Deployment strategy to be added to the repo server Deployment

3020

deploymentStrategy: {}

3021

# type: RollingUpdate

3022

# rollingUpdate:

3023

# maxSurge: 25%

3024

# maxUnavailable: 25%

3025

3026

# -- Priority class for the repo server pods

3027

# @default -- `""` (defaults to global.priorityClassName)

3028

priorityClassName: ""

3029

# TLS certificate configuration via Secret

3030

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-repo-server

3031

## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart repo server automatically without extra controllers.

3032

certificateSecret:

3033

# -- Create argocd-repo-server-tls secret

3034

enabled: false

3035

# -- Annotations to be added to argocd-repo-server-tls secret

3036

annotations: {}

3037

# -- Labels to be added to argocd-repo-server-tls secret

3038

labels: {}

3039

# -- Certificate authority. Required for self-signed certificates.

3040

ca: ""

3041

# -- Certificate private key

3042

key: ""

3043

# -- Certificate data. Must contain SANs of Repo service (ie: argocd-repo-server, argocd-repo-server.argo-cd.svc)

3044

crt: ""

3045

## Repo server service configuration

3046

service:

3047

# -- Repo server service annotations

3048

annotations: {}

3049

# -- Repo server service labels

3050

labels: {}

3051

# -- Repo server service port

3052

port: 8081

3053

# -- Repo server service port name

3054

portName: tcp-repo-server

3055

# -- Traffic distribution preference for the repo server service. If the field is not set, the implementation will apply its default routing strategy.

3056

trafficDistribution: ""

3057

## Repo server metrics service configuration

3058

metrics:

3059

# -- Deploy metrics service

3060

enabled: false

3061

service:

3062

# -- Metrics service type

3063

type: ClusterIP

3064

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3065

clusterIP: ""

3066

# -- Metrics service annotations

3067

annotations: {}

3068

# -- Metrics service labels

3069

labels: {}

3070

# -- Metrics service port

3071

servicePort: 8084

3072

# -- Metrics service port name

3073

portName: http-metrics

3074

serviceMonitor:

3075

# -- Enable a prometheus ServiceMonitor

3076

enabled: false

3077

# -- Prometheus ServiceMonitor interval

3078

interval: 30s

3079

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

3080

scrapeTimeout: ""

3081

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3082

honorLabels: false

3083

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3084

relabelings: []

3085

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3086

metricRelabelings: []

3087

# -- Prometheus ServiceMonitor selector

3088

selector: {}

3089

# prometheus: kube-prometheus

3090

3091

# -- Prometheus ServiceMonitor scheme

3092

scheme: ""

3093

# -- Prometheus ServiceMonitor tlsConfig

3094

tlsConfig: {}

3095

# -- Prometheus ServiceMonitor namespace

3096

namespace: "" # "monitoring"

3097

# -- Prometheus ServiceMonitor labels

3098

additionalLabels: {}

3099

# -- Prometheus ServiceMonitor annotations

3100

annotations: {}

3101

## Enable Custom Rules for the Repo server's Cluster Role resource

3102

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

3103

## Defaults to off

3104

clusterRoleRules:

3105

# -- Enable custom rules for the Repo server's Cluster Role resource

3106

enabled: false

3107

# -- List of custom rules for the Repo server's Cluster Role resource

3108

rules: []

3109

# -- Automount API credentials for the Service Account into the pod.

3110

automountServiceAccountToken: true

3111

## Repo server service account

3112

## If create is set to true, make sure to uncomment the name and update the rbac section below

3113

serviceAccount:

3114

# -- Create repo server service account

3115

create: true

3116

# -- Repo server service account name

3117

3118

# -- Annotations applied to created service account

3119

annotations: {}

3120

# -- Labels applied to created service account

3121

labels: {}

3122

# -- Automount API credentials for the Service Account

3123

automountServiceAccountToken: true

3124

# -- Repo server rbac rules

3125

rbac: []

3126

# - apiGroups:

3127

# - argoproj.io

3128

# resources:

3129

# - applications

3130

# verbs:

3131

# - get

3132

# - list

3133

# - watch

3134

3135

# Default repo server's network policy

3136

networkPolicy:

3137

# -- Default network policy rules used by repo server

3138

# @default -- `false` (defaults to global.networkPolicy.create)

3139

create: false

3140

## ApplicationSet controller

3141

applicationSet:

3142

# -- ApplicationSet controller name string

3143

3144

# -- The number of ApplicationSet controller pods to run

3145

replicas: 1

3146

# -- Runtime class name for the ApplicationSet controller

3147

# @default -- `""` (defaults to global.runtimeClassName)

3148

runtimeClassName: ""

3149

## ApplicationSet controller Pod Disruption Budget

3150

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

3151

pdb:

3152

# -- Deploy a [PodDisruptionBudget] for the ApplicationSet controller

3153

enabled: false

3154

# -- Labels to be added to ApplicationSet controller pdb

3155

labels: {}

3156

# -- Annotations to be added to ApplicationSet controller pdb

3157

annotations: {}

3158

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

3159

# @default -- `""` (defaults to 0 if not specified)

3160

minAvailable: ""

3161

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

3162

## Has higher precedence over `applicationSet.pdb.minAvailable`

3163

maxUnavailable: ""

3164

## ApplicationSet controller Vertical Pod Autoscaler

3165

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

3166

vpa:

3167

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the ApplicationSet controller

3168

enabled: false

3169

# -- Labels to be added to ApplicationSet controller vpa

3170

labels: {}

3171

# -- Annotations to be added to ApplicationSet controller vpa

3172

annotations: {}

3173

# -- One of the VPA operation modes

3174

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

3175

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

3176

updateMode: Initial

3177

# -- Controls how VPA computes the recommended resources for ApplicationSet controller container

3178

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

3179

containerPolicy: {}

3180

# controlledResources: ["cpu", "memory"]

3181

# minAllowed:

3182

# cpu: 250m

3183

# memory: 256Mi

3184

# maxAllowed:

3185

# cpu: 1

3186

# memory: 1Gi

3187

3188

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

3189

## NOTE: specify only zero or one recommender as of VPA 1.7.1

3190

recommenders: []

3191

## ApplicationSet controller image

3192

image:

3193

# -- Repository to use for the ApplicationSet controller

3194

# @default -- `""` (defaults to global.image.repository)

3195

repository: ""

3196

# -- Tag to use for the ApplicationSet controller

3197

# @default -- `""` (defaults to global.image.tag)

3198

tag: ""

3199

# -- Image pull policy for the ApplicationSet controller

3200

# @default -- `""` (defaults to global.image.imagePullPolicy)

3201

imagePullPolicy: ""

3202

# -- If defined, uses a Secret to pull an image from a private Docker registry or repository.

3203

# @default -- `[]` (defaults to global.imagePullSecrets)

3204

imagePullSecrets: []

3205

# -- ApplicationSet controller command line flags

3206

extraArgs: []

3207

# -- Environment variables to pass to the ApplicationSet controller

3208

extraEnv: []

3209

# - name: "MY_VAR"

3210

# value: "value"

3211

3212

# -- envFrom to pass to the ApplicationSet controller

3213

# @default -- `[]` (See [values.yaml])

3214

extraEnvFrom: []

3215

# - configMapRef:

3216

# name: config-map-name

3217

# - secretRef:

3218

# name: secret-name

3219

3220

# -- Additional containers to be added to the ApplicationSet controller pod

3221

## Note: Supports use of custom Helm templates

3222

extraContainers: []

3223

# -- Init containers to add to the ApplicationSet controller pod

3224

## Note: Supports use of custom Helm templates

3225

initContainers: []

3226

# -- List of extra mounts to add (normally used with extraVolumes)

3227

extraVolumeMounts: []

3228

# -- List of extra volumes to add

3229

extraVolumes: []

3230

## ApplicationSet controller emptyDir volumes

3231

emptyDir:

3232

# -- EmptyDir size limit for applicationSet controller

3233

# @default -- `""` (defaults not set if not specified i.e. no size limit)

3234

sizeLimit: ""

3235

# sizeLimit: "1Gi"

3236

## Metrics service configuration

3237

metrics:

3238

# -- Deploy metrics service

3239

enabled: false

3240

service:

3241

# -- Metrics service type

3242

type: ClusterIP

3243

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3244

clusterIP: ""

3245

# -- Metrics service annotations

3246

annotations: {}

3247

# -- Metrics service labels

3248

labels: {}

3249

# -- Metrics service port

3250

servicePort: 8080

3251

# -- Metrics service port name

3252

portName: http-metrics

3253

serviceMonitor:

3254

# -- Enable a prometheus ServiceMonitor

3255

enabled: false

3256

# -- Prometheus ServiceMonitor interval

3257

interval: 30s

3258

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

3259

scrapeTimeout: ""

3260

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3261

honorLabels: false

3262

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3263

relabelings: []

3264

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3265

metricRelabelings: []

3266

# -- Prometheus ServiceMonitor selector

3267

selector: {}

3268

# prometheus: kube-prometheus

3269

3270

# -- Prometheus ServiceMonitor scheme

3271

scheme: ""

3272

# -- Prometheus ServiceMonitor tlsConfig

3273

tlsConfig: {}

3274

# -- Prometheus ServiceMonitor namespace

3275

namespace: "" # monitoring

3276

# -- Prometheus ServiceMonitor labels

3277

additionalLabels: {}

3278

# -- Prometheus ServiceMonitor annotations

3279

annotations: {}

3280

## ApplicationSet service configuration

3281

service:

3282

# -- ApplicationSet service annotations

3283

annotations: {}

3284

# -- ApplicationSet service labels

3285

labels: {}

3286

# -- ApplicationSet service type

3287

type: ClusterIP

3288

# -- ApplicationSet service port

3289

port: 7000

3290

# -- ApplicationSet service port name

3291

portName: http-webhook

3292

# -- Automount API credentials for the Service Account into the pod.

3293

automountServiceAccountToken: true

3294

serviceAccount:

3295

# -- Create ApplicationSet controller service account

3296

create: true

3297

# -- ApplicationSet controller service account name

3298

3299

# -- Annotations applied to created service account

3300

annotations: {}

3301

# -- Labels applied to created service account

3302

labels: {}

3303

# -- Automount API credentials for the Service Account

3304

automountServiceAccountToken: true

3305

# -- Annotations to be added to ApplicationSet controller Deployment

3306

deploymentAnnotations: {}

3307

# -- Labels for the ApplicationSet controller Deployment

3308

deploymentLabels: {}

3309

# -- Annotations for the ApplicationSet controller pods

3310

podAnnotations: {}

3311

# -- Labels for the ApplicationSet controller pods

3312

podLabels: {}

3313

# -- Resource limits and requests for the ApplicationSet controller pods.

3314

resources: {}

3315

# limits:

3316

# cpu: 100m

3317

# memory: 128Mi

3318

# requests:

3319

# cpu: 100m

3320

# memory: 128Mi

3321

3322

# ApplicationSet controller container ports

3323

containerPorts:

3324

# -- Metrics container port

3325

metrics: 8080

3326

# -- Probe container port

3327

probe: 8081

3328

# -- Webhook container port

3329

webhook: 7000

3330

# -- [DNS configuration]

3331

dnsConfig: {}

3332

# -- Alternative DNS policy for ApplicationSet controller pods

3333

dnsPolicy: "ClusterFirst"

3334

# -- ApplicationSet controller container-level security context

3335

# @default -- See [values.yaml]

3336

containerSecurityContext:

3337

runAsNonRoot: true

3338

readOnlyRootFilesystem: true

3339

allowPrivilegeEscalation: false

3340

seccompProfile:

3341

type: RuntimeDefault

3342

capabilities:

3343

drop:

3344

- ALL

3345

## Probes for ApplicationSet controller (optional)

3346

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3347

readinessProbe:

3348

# -- Enable Kubernetes liveness probe for ApplicationSet controller

3349

enabled: false

3350

# -- Number of seconds after the container has started before [probe] is initiated

3351

initialDelaySeconds: 10

3352

# -- How often (in seconds) to perform the [probe]

3353

periodSeconds: 10

3354

# -- Number of seconds after which the [probe] times out

3355

timeoutSeconds: 1

3356

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3357

successThreshold: 1

3358

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3359

failureThreshold: 3

3360

livenessProbe:

3361

# -- Enable Kubernetes liveness probe for ApplicationSet controller

3362

enabled: false

3363

# -- Number of seconds after the container has started before [probe] is initiated

3364

initialDelaySeconds: 10

3365

# -- How often (in seconds) to perform the [probe]

3366

periodSeconds: 10

3367

# -- Number of seconds after which the [probe] times out

3368

timeoutSeconds: 1

3369

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3370

successThreshold: 1

3371

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3372

failureThreshold: 3

3373

## Startup probe for ApplicationSet controller (optional)

3374

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3375

startupProbe:

3376

# -- Enable Kubernetes startup probe for ApplicationSet controller

3377

enabled: false

3378

# -- Number of seconds after the container has started before [probe] is initiated

3379

initialDelaySeconds: 10

3380

# -- How often (in seconds) to perform the [probe]

3381

periodSeconds: 10

3382

# -- Number of seconds after which the [probe] times out

3383

timeoutSeconds: 1

3384

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3385

successThreshold: 1

3386

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3387

failureThreshold: 20

3388

# -- terminationGracePeriodSeconds for container lifecycle hook

3389

terminationGracePeriodSeconds: 30

3390

# -- [Node selector]

3391

# @default -- `{}` (defaults to global.nodeSelector)

3392

nodeSelector: {}

3393

# -- [Tolerations] for use with node taints

3394

# @default -- `[]` (defaults to global.tolerations)

3395

tolerations: []

3396

# -- Assign custom [affinity] rules

3397

# @default -- `{}` (defaults to global.affinity preset)

3398

affinity: {}

3399

# -- Assign custom [TopologySpreadConstraints] rules to the ApplicationSet controller

3400

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3401

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

3402

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3403

topologySpreadConstraints: []

3404

# - maxSkew: 1

3405

# topologyKey: topology.kubernetes.io/zone

3406

# whenUnsatisfiable: DoNotSchedule

3407

3408

# -- Deployment strategy to be added to the ApplicationSet controller Deployment

3409

deploymentStrategy: {}

3410

# type: RollingUpdate

3411

# rollingUpdate:

3412

# maxSurge: 25%

3413

# maxUnavailable: 25%

3414

3415

# -- Priority class for the ApplicationSet controller pods

3416

# @default -- `""` (defaults to global.priorityClassName)

3417

priorityClassName: ""

3418

# TLS certificate configuration via cert-manager

3419

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-configuration

3420

certificate:

3421

# -- Deploy a Certificate resource (requires cert-manager)

3422

enabled: false

3423

# -- Certificate primary domain (commonName)

3424

# @default -- `""` (defaults to global.domain)

3425

domain: ""

3426

# -- Certificate Subject Alternate Names (SANs)

3427

additionalHosts: []

3428

# -- The requested 'duration' (i.e. lifetime) of the certificate.

3429

# @default -- `""` (defaults to 2160h = 90d if not specified)

3430

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

3431

duration: ""

3432

# -- How long before the expiry a certificate should be renewed.

3433

# @default -- `""` (defaults to 360h = 15d if not specified)

3434

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

3435

renewBefore: ""

3436

# Certificate issuer

3437

## Ref: https://cert-manager.io/docs/concepts/issuer

3438

issuer:

3439

# -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io`

3440

group: ""

3441

# -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer`

3442

kind: ""

3443

# -- Certificate issuer name. Eg. `letsencrypt`

3444

3445

# Private key of the certificate

3446

privateKey:

3447

# -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always`

3448

rotationPolicy: Never

3449

# -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8`

3450

encoding: PKCS1

3451

# -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA`

3452

algorithm: RSA

3453

# -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored.

3454

size: 2048

3455

# -- Annotations to be applied to the ApplicationSet Certificate

3456

annotations: {}

3457

## Ingress for the Git Generator webhook

3458

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration)

3459

ingress:

3460

# -- Enable an ingress resource for ApplicationSet webhook

3461

enabled: false

3462

# -- Additional ingress labels

3463

labels: {}

3464

# -- Additional ingress annotations

3465

annotations: {}

3466

# -- Defines which ingress ApplicationSet controller will implement the resource

3467

ingressClassName: ""

3468

# -- Argo CD ApplicationSet hostname

3469

# @default -- `""` (defaults to global.domain)

3470

hostname: ""

3471

# -- List of ingress paths

3472

path: /api/webhook

3473

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

3474

pathType: Prefix

3475

# -- Enable TLS configuration for the hostname defined at `applicationSet.webhook.ingress.hostname`

3476

## TLS certificate will be retrieved from a TLS secret with name:`argocd-applicationset-controller-tls`

3477

tls: false

3478

# -- The list of additional hostnames to be covered by ingress record

3479

# @default -- `[]` (See [values.yaml])

3480

extraHosts: []

3481

# - name: argocd.example.com

3482

# path: /

3483

3484

# -- Additional ingress paths

3485

# @default -- `[]` (See [values.yaml])

3486

extraPaths: []

3487

# - path: /*

3488

# pathType: Prefix

3489

# backend:

3490

# service:

3491

# name: ssl-redirect

3492

# port:

3493

# name: use-annotation

3494

3495

# -- Additional ingress rules

3496

# @default -- `[]` (See [values.yaml])

3497

## Note: Supports use of custom Helm templates

3498

extraRules: []

3499

# - http:

3500

# paths:

3501

# - path: /api/webhook

3502

# pathType: Prefix

3503

# backend:

3504

# service:

3505

# name: '{{ include "argo-cd.applicationSet.fullname" . }}'

3506

# port:

3507

# name: '{{ .Values.applicationSet.service.portName }}'

3508

3509

# -- Additional ingress TLS configuration

3510

# @default -- `[]` (See [values.yaml])

3511

extraTls: []

3512

# - secretName: argocd-applicationset-tls

3513

# hosts:

3514

# - argocd-applicationset.example.com

3515

## Gateway API HTTPRoute for the Git Generator webhook

3516

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration)

3517

# NOTE: Gateway API support is in EXPERIMENTAL status

3518

# Support depends on your Gateway controller implementation

3519

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

3520

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

3521

httproute:

3522

# -- Enable HTTPRoute resource for Argo CD Applicationset Webhook (Gateway API)

3523

enabled: false

3524

# -- Additional HTTPRoute labels

3525

labels: {}

3526

# -- Additional HTTPRoute annotations

3527

annotations: {}

3528

# -- Gateway API parentRefs for the HTTPRoute

3529

## Must reference an existing Gateway

3530

# @default -- `[]` (See [values.yaml])

3531

parentRefs: []

3532

# - name: example-gateway

3533

# namespace: example-gateway-namespace

3534

# sectionName: https

3535

# -- List of hostnames for the HTTPRoute

3536

# @default -- `[]` (See [values.yaml])

3537

hostnames: []

3538

# - argocd.example.com

3539

# -- HTTPRoute rules configuration

3540

# @default -- `[]` (See [values.yaml])

3541

rules:

3542

- matches:

3543

- path:

3544

type: PathPrefix

3545

value: /api/webhook

3546

# filters: []

3547

# - type: RequestHeaderModifier

3548

# requestHeaderModifier:

3549

# add:

3550

# - name: X-Custom-Header

3551

# value: custom-value

3552

# Gateway API ListenerSet configuration for the Git Generator webhook

3553

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration

3554

# NOTE: Gateway API support is in EXPERIMENTAL status

3555

# ListenerSet allows attaching additional listeners to an existing Gateway

3556

# Requires Gateway API v1alpha2 and a controller that supports ListenerSet

3557

# Refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.ListenerSet

3558

listenerset:

3559

# -- Enable ListenerSet resource for Argo CD ApplicationSet webhook (Gateway API)

3560

enabled: false

3561

# -- Additional ListenerSet labels

3562

labels: {}

3563

# -- Additional ListenerSet annotations

3564

annotations: {}

3565

# -- Gateway API parentRef for the ListenerSet

3566

## Must reference an existing Gateway. Unlike HTTPRoute, ListenerSet accepts exactly one parentRef.

3567

# @default -- `{}` (See [values.yaml])

3568

parentRef: {}

3569

# name: example-gateway

3570

# namespace: example-gateway-namespace

3571

# -- Hostname for the synthesized listener. Defaults to global.domain when empty.

3572

hostname: ""

3573

# -- Name of the synthesized listener. Also used as sectionName in auto-derived httproute parentRefs.

3574

listenerName: https

3575

# -- Port for the synthesized listener

3576

port: 443

3577

# -- Protocol for the synthesized listener

3578

protocol: HTTPS

3579

# -- TLS configuration for the synthesized listener

3580

tls:

3581

# -- Enable TLS on the synthesized listener

3582

enabled: true

3583

# -- TLS termination mode

3584

mode: Terminate

3585

# -- Secret name for TLS certificate. Defaults to `argocd-applicationset-controller-tls` when empty.

3586

secretName: ""

3587

# -- allowedRoutes for the synthesized listener

3588

allowedRoutes:

3589

namespaces:

3590

from: Same

3591

# -- Listeners to attach to the parent Gateway. When non-empty, used verbatim and all synthesized listener fields above are ignored.

3592

# @default -- `[]` (See [values.yaml])

3593

listeners: []

3594

# - name: https

3595

# port: 443

3596

# protocol: HTTPS

3597

# hostname: argocd.example.com

3598

# tls:

3599

# mode: Terminate

3600

# certificateRefs:

3601

# - group: ""

3602

# kind: Secret

3603

# name: argocd-applicationset-controller-tls

3604

# allowedRoutes:

3605

# namespaces:

3606

# from: Same

3607

# -- Enable ApplicationSet in any namespace feature

3608

allowAnyNamespace: false

3609

# Default ApplicationSet controller's network policy

3610

networkPolicy:

3611

# -- Default network policy rules used by ApplicationSet controller

3612

# @default -- `false` (defaults to global.networkPolicy.create)

3613

create: false

3614

## Notifications controller

3615

notifications:

3616

# -- Enable notifications controller

3617

enabled: true

3618

# -- Notifications controller name string

3619

3620

# -- Argo CD dashboard url; used in place of {{.context.argocdUrl}} in templates

3621

# @default -- `""` (defaults to https://`global.domain`)

3622

argocdUrl: ""

3623

# -- Runtime class name for the notifications controller

3624

# @default -- `""` (defaults to global.runtimeClassName)

3625

runtimeClassName: ""

3626

## Notifications controller Pod Disruption Budget

3627

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

3628

pdb:

3629

# -- Deploy a [PodDisruptionBudget] for the notifications controller

3630

enabled: false

3631

# -- Labels to be added to notifications controller pdb

3632

labels: {}

3633

# -- Annotations to be added to notifications controller pdb

3634

annotations: {}

3635

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

3636

# @default -- `""` (defaults to 0 if not specified)

3637

minAvailable: ""

3638

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

3639

## Has higher precedence over `notifications.pdb.minAvailable`

3640

maxUnavailable: ""

3641

## Notifications controller Vertical Pod Autoscaler

3642

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

3643

vpa:

3644

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the notifications controller

3645

enabled: false

3646

# -- Labels to be added to notifications controller vpa

3647

labels: {}

3648

# -- Annotations to be added to notifications controller vpa

3649

annotations: {}

3650

# -- One of the VPA operation modes

3651

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

3652

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

3653

updateMode: Initial

3654

# -- Controls how VPA computes the recommended resources for notifications controller container

3655

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

3656

containerPolicy: {}

3657

# controlledResources: ["cpu", "memory"]

3658

# minAllowed:

3659

# cpu: 250m

3660

# memory: 256Mi

3661

# maxAllowed:

3662

# cpu: 1

3663

# memory: 1Gi

3664

3665

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

3666

## NOTE: specify only zero or one recommender as of VPA 1.7.1

3667

recommenders: []

3668

## Notifications controller image

3669

image:

3670

# -- Repository to use for the notifications controller

3671

# @default -- `""` (defaults to global.image.repository)

3672

repository: ""

3673

# -- Tag to use for the notifications controller

3674

# @default -- `""` (defaults to global.image.tag)

3675

tag: ""

3676

# -- Image pull policy for the notifications controller

3677

# @default -- `""` (defaults to global.image.imagePullPolicy)

3678

imagePullPolicy: ""

3679

# -- Secrets with credentials to pull images from a private registry

3680

# @default -- `[]` (defaults to global.imagePullSecrets)

3681

imagePullSecrets: []

3682

# DEPRECATED - Use configs.params to override

3683

# -- Notifications controller log format. Either `text` or `json`

3684

# @default -- `""` (defaults to global.logging.format)

3685

# logFormat: ""

3686

# -- Notifications controller log level. One of: `debug`, `info`, `warn`, `error`

3687

# @default -- `""` (defaults to global.logging.level)

3688

# logLevel: ""

3689

3690

# -- Extra arguments to provide to the notifications controller

3691

extraArgs: []

3692

# -- Additional container environment variables

3693

extraEnv: []

3694

# -- envFrom to pass to the notifications controller

3695

# @default -- `[]` (See [values.yaml])

3696

extraEnvFrom: []

3697

# - configMapRef:

3698

# name: config-map-name

3699

# - secretRef:

3700

# name: secret-name

3701

3702

# -- Additional containers to be added to the notifications controller pod

3703

## Note: Supports use of custom Helm templates

3704

extraContainers: []

3705

# -- Init containers to add to the notifications controller pod

3706

## Note: Supports use of custom Helm templates

3707

initContainers: []

3708

# -- List of extra mounts to add (normally used with extraVolumes)

3709

extraVolumeMounts: []

3710

# -- List of extra volumes to add

3711

extraVolumes: []

3712

# -- Define user-defined context

3713

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/#defining-user-defined-context

3714

context: {}

3715

# region: east

3716

# environmentName: staging

3717

3718

secret:

3719

# -- Whether helm chart creates notifications controller secret

3720

## If true, will create a secret with the name below. Otherwise, will assume existence of a secret with that name.

3721

create: true

3722

# -- notifications controller Secret name

3723

3724

# -- key:value pairs of annotations to be added to the secret

3725

annotations: {}

3726

# -- key:value pairs of labels to be added to the secret

3727

labels: {}

3728

# -- Generic key:value pairs to be inserted into the secret

3729

## Can be used for templates, notification services etc. Some examples given below.

3730

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/

3731

items: {}

3732

# slack-token:

3733

# # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/slack/

3734

# grafana-apiKey:

3735

# # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/grafana/

3736

3737

# webhooks-github-token:

3738

3739

# email-username:

3740

# email-password:

3741

# For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/email/

3742

3743

metrics:

3744

# -- Enables prometheus metrics server

3745

enabled: false

3746

# -- Metrics port

3747

port: 9001

3748

service:

3749

# -- Metrics service type

3750

type: ClusterIP

3751

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3752

clusterIP: ""

3753

# -- Metrics service annotations

3754

annotations: {}

3755

# -- Metrics service labels

3756

labels: {}

3757

# -- Metrics service port name

3758

portName: http-metrics

3759

serviceMonitor:

3760

# -- Enable a prometheus ServiceMonitor

3761

enabled: false

3762

# -- Prometheus ServiceMonitor selector

3763

selector: {}

3764

# prometheus: kube-prometheus

3765

# -- Prometheus ServiceMonitor labels

3766

additionalLabels: {}

3767

# -- Prometheus ServiceMonitor annotations

3768

annotations: {}

3769

# namespace: monitoring

3770

# interval: 30s

3771

# scrapeTimeout: 10s

3772

# -- Prometheus ServiceMonitor scheme

3773

scheme: ""

3774

# -- Prometheus ServiceMonitor tlsConfig

3775

tlsConfig: {}

3776

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3777

honorLabels: false

3778

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3779

relabelings: []

3780

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3781

metricRelabelings: []

3782

# -- Configures notification services such as slack, email or custom webhook

3783

# @default -- See [values.yaml]

3784

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/

3785

notifiers: {}

3786

# service.slack: |

3787

# token: $slack-token

3788

3789

# -- Annotations to be applied to the notifications controller Deployment

3790

deploymentAnnotations: {}

3791

# -- Labels for the notifications controller Deployment

3792

deploymentLabels: {}

3793

# -- Annotations to be applied to the notifications controller Pods

3794

podAnnotations: {}

3795

# -- Labels to be applied to the notifications controller Pods

3796

podLabels: {}

3797

# -- Resource limits and requests for the notifications controller

3798

resources: {}

3799

# limits:

3800

# cpu: 100m

3801

# memory: 128Mi

3802

# requests:

3803

# cpu: 100m

3804

# memory: 128Mi

3805

3806

# Notification controller container ports

3807

containerPorts:

3808

# -- Metrics container port

3809

metrics: 9001

3810

# -- [DNS configuration]

3811

dnsConfig: {}

3812

# -- Alternative DNS policy for notifications controller Pods

3813

dnsPolicy: "ClusterFirst"

3814

# -- Notification controller container-level security Context

3815

# @default -- See [values.yaml]

3816

containerSecurityContext:

3817

runAsNonRoot: true

3818

readOnlyRootFilesystem: true

3819

allowPrivilegeEscalation: false

3820

seccompProfile:

3821

type: RuntimeDefault

3822

capabilities:

3823

drop:

3824

- ALL

3825

## Probes for notifications controller Pods (optional)

3826

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3827

readinessProbe:

3828

# -- Enable Kubernetes liveness probe for notifications controller Pods

3829

enabled: false

3830

# -- Number of seconds after the container has started before [probe] is initiated

3831

initialDelaySeconds: 10

3832

# -- How often (in seconds) to perform the [probe]

3833

periodSeconds: 10

3834

# -- Number of seconds after which the [probe] times out

3835

timeoutSeconds: 1

3836

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3837

successThreshold: 1

3838

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3839

failureThreshold: 3

3840

livenessProbe:

3841

# -- Enable Kubernetes liveness probe for notifications controller Pods

3842

enabled: false

3843

# -- Number of seconds after the container has started before [probe] is initiated

3844

initialDelaySeconds: 10

3845

# -- How often (in seconds) to perform the [probe]

3846

periodSeconds: 10

3847

# -- Number of seconds after which the [probe] times out

3848

timeoutSeconds: 1

3849

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3850

successThreshold: 1

3851

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3852

failureThreshold: 3

3853

## Startup probe for notifications controller Pods (optional)

3854

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3855

startupProbe:

3856

# -- Enable Kubernetes startup probe for notifications controller Pods

3857

enabled: false

3858

# -- Number of seconds after the container has started before [probe] is initiated

3859

initialDelaySeconds: 10

3860

# -- How often (in seconds) to perform the [probe]

3861

periodSeconds: 10

3862

# -- Number of seconds after which the [probe] times out

3863

timeoutSeconds: 1

3864

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3865

successThreshold: 1

3866

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3867

failureThreshold: 20

3868

# -- terminationGracePeriodSeconds for container lifecycle hook

3869

terminationGracePeriodSeconds: 30

3870

# -- [Node selector]

3871

# @default -- `{}` (defaults to global.nodeSelector)

3872

nodeSelector: {}

3873

# -- [Tolerations] for use with node taints

3874

# @default -- `[]` (defaults to global.tolerations)

3875

tolerations: []

3876

# -- Assign custom [affinity] rules

3877

# @default -- `{}` (defaults to global.affinity preset)

3878

affinity: {}

3879

# -- Assign custom [TopologySpreadConstraints] rules to the application controller

3880

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3881

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

3882

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3883

topologySpreadConstraints: []

3884

# - maxSkew: 1

3885

# topologyKey: topology.kubernetes.io/zone

3886

# whenUnsatisfiable: DoNotSchedule

3887

3888

# -- Deployment strategy to be added to the notifications controller Deployment

3889

deploymentStrategy:

3890

type: Recreate

3891

# -- Priority class for the notifications controller pods

3892

# @default -- `""` (defaults to global.priorityClassName)

3893

priorityClassName: ""

3894

# -- Automount API credentials for the Service Account into the pod.

3895

automountServiceAccountToken: true

3896

serviceAccount:

3897

# -- Create notifications controller service account

3898

create: true

3899

# -- Notification controller service account name

3900

3901

# -- Annotations applied to created service account

3902

annotations: {}

3903

# -- Labels applied to created service account

3904

labels: {}

3905

# -- Automount API credentials for the Service Account

3906

automountServiceAccountToken: true

3907

cm:

3908

# -- Whether helm chart creates notifications controller config map

3909

create: true

3910

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

3911

## Defaults to off

3912

clusterRoleRules:

3913

# -- List of custom rules for the notifications controller's ClusterRole resource

3914

rules: []

3915

# -- Contains centrally managed global application subscriptions

3916

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/subscriptions/

3917

subscriptions: []

3918

# # subscription for on-sync-status-unknown trigger notifications

3919

# - recipients:

3920

# - slack:test2

3921

# - email:test@gmail.com

3922

# triggers:

3923

# - on-sync-status-unknown

3924

# # subscription restricted to applications with matching labels only

3925

# - recipients:

3926

# - slack:test3

3927

# selector: test=true

3928

# triggers:

3929

# - on-sync-status-unknown

3930

3931

# -- The notification template is used to generate the notification content

3932

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/

3933

templates: {}

3934

# template.app-deployed: |

3935

# email:

3936

# subject: New version of an application {{.app.metadata.name}} is up and running.

3937

# message: |

3938

# {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests.

3939

# slack:

3940

# attachments: |

3941

# [{

3942

# "title": "{{ .app.metadata.name}}",

3943

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

3944

# "color": "#18be52",

3945

# "fields": [

3946

# {

3947

# "title": "Sync Status",

3948

# "value": "{{.app.status.sync.status}}",

3949

# "short": true

3950

# },

3951

# {

3952

# "title": "Repository",

3953

# "value": "{{.app.spec.source.repoURL}}",

3954

# "short": true

3955

# },

3956

# {

3957

# "title": "Revision",

3958

# "value": "{{.app.status.sync.revision}}",

3959

# "short": true

3960

# }

3961

# {{range $index, $c := .app.status.conditions}}

3962

# {{if not $index}},{{end}}

3963

# {{if $index}},{{end}}

3964

# {

3965

# "title": "{{$c.type}}",

3966

# "value": "{{$c.message}}",

3967

# "short": true

3968

# }

3969

# {{end}}

3970

# ]

3971

# }]

3972

# template.app-health-degraded: |

3973

# email:

3974

# subject: Application {{.app.metadata.name}} has degraded.

3975

# message: |

3976

# {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded.

3977

# Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.

3978

# slack:

3979

# attachments: |-

3980

# [{

3981

# "title": "{{ .app.metadata.name}}",

3982

# "title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

3983

# "color": "#f4c030",

3984

# "fields": [

3985

# {

3986

# "title": "Sync Status",

3987

# "value": "{{.app.status.sync.status}}",

3988

# "short": true

3989

# },

3990

# {

3991

# "title": "Repository",

3992

# "value": "{{.app.spec.source.repoURL}}",

3993

# "short": true

3994

# }

3995

# {{range $index, $c := .app.status.conditions}}

3996

# {{if not $index}},{{end}}

3997

# {{if $index}},{{end}}

3998

# {

3999

# "title": "{{$c.type}}",

4000

# "value": "{{$c.message}}",

4001

# "short": true

4002

# }

4003

# {{end}}

4004

# ]

4005

# }]

4006

# template.app-sync-failed: |

4007

# email:

4008

# subject: Failed to sync application {{.app.metadata.name}}.

4009

# message: |

4010

# {{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}}

4011

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4012

# slack:

4013

# attachments: |-

4014

# [{

4015

# "title": "{{ .app.metadata.name}}",

4016

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4017

# "color": "#E96D76",

4018

# "fields": [

4019

# {

4020

# "title": "Sync Status",

4021

# "value": "{{.app.status.sync.status}}",

4022

# "short": true

4023

# },

4024

# {

4025

# "title": "Repository",

4026

# "value": "{{.app.spec.source.repoURL}}",

4027

# "short": true

4028

# }

4029

# {{range $index, $c := .app.status.conditions}}

4030

# {{if not $index}},{{end}}

4031

# {{if $index}},{{end}}

4032

# {

4033

# "title": "{{$c.type}}",

4034

# "value": "{{$c.message}}",

4035

# "short": true

4036

# }

4037

# {{end}}

4038

# ]

4039

# }]

4040

# template.app-sync-running: |

4041

# email:

4042

# subject: Start syncing application {{.app.metadata.name}}.

4043

# message: |

4044

# The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}.

4045

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4046

# slack:

4047

# attachments: |-

4048

# [{

4049

# "title": "{{ .app.metadata.name}}",

4050

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4051

# "color": "#0DADEA",

4052

# "fields": [

4053

# {

4054

# "title": "Sync Status",

4055

# "value": "{{.app.status.sync.status}}",

4056

# "short": true

4057

# },

4058

# {

4059

# "title": "Repository",

4060

# "value": "{{.app.spec.source.repoURL}}",

4061

# "short": true

4062

# }

4063

# {{range $index, $c := .app.status.conditions}}

4064

# {{if not $index}},{{end}}

4065

# {{if $index}},{{end}}

4066

# {

4067

# "title": "{{$c.type}}",

4068

# "value": "{{$c.message}}",

4069

# "short": true

4070

# }

4071

# {{end}}

4072

# ]

4073

# }]

4074

# template.app-sync-status-unknown: |

4075

# email:

4076

# subject: Application {{.app.metadata.name}} sync status is 'Unknown'

4077

# message: |

4078

# {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'.

4079

# Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.

4080

# {{if ne .serviceType "slack"}}

4081

# {{range $c := .app.status.conditions}}

4082

# * {{$c.message}}

4083

# {{end}}

4084

# {{end}}

4085

# slack:

4086

# attachments: |-

4087

# [{

4088

# "title": "{{ .app.metadata.name}}",

4089

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4090

# "color": "#E96D76",

4091

# "fields": [

4092

# {

4093

# "title": "Sync Status",

4094

# "value": "{{.app.status.sync.status}}",

4095

# "short": true

4096

# },

4097

# {

4098

# "title": "Repository",

4099

# "value": "{{.app.spec.source.repoURL}}",

4100

# "short": true

4101

# }

4102

# {{range $index, $c := .app.status.conditions}}

4103

# {{if not $index}},{{end}}

4104

# {{if $index}},{{end}}

4105

# {

4106

# "title": "{{$c.type}}",

4107

# "value": "{{$c.message}}",

4108

# "short": true

4109

# }

4110

# {{end}}

4111

# ]

4112

# }]

4113

# template.app-sync-succeeded: |

4114

# email:

4115

# subject: Application {{.app.metadata.name}} has been successfully synced.

4116

# message: |

4117

# {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}.

4118

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4119

# slack:

4120

# attachments: |-

4121

# [{

4122

# "title": "{{ .app.metadata.name}}",

4123

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4124

# "color": "#18be52",

4125

# "fields": [

4126

# {

4127

# "title": "Sync Status",

4128

# "value": "{{.app.status.sync.status}}",

4129

# "short": true

4130

# },

4131

# {

4132

# "title": "Repository",

4133

# "value": "{{.app.spec.source.repoURL}}",

4134

# "short": true

4135

# }

4136

# {{range $index, $c := .app.status.conditions}}

4137

# {{if not $index}},{{end}}

4138

# {{if $index}},{{end}}

4139

# {

4140

# "title": "{{$c.type}}",

4141

# "value": "{{$c.message}}",

4142

# "short": true

4143

# }

4144

# {{end}}

4145

# ]

4146

# }]

4147

4148

# -- The trigger defines the condition when the notification should be sent

4149

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/

4150

triggers: {}

4151

# trigger.on-deployed: |

4152

# - description: Application is synced and healthy. Triggered once per commit.

4153

# oncePer: app.status.sync.revision

4154

# send:

4155

# - app-deployed

4156

# when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status == 'Healthy'

4157

# trigger.on-health-degraded: |

4158

# - description: Application has degraded

4159

# send:

4160

# - app-health-degraded

4161

# when: app.status.health.status == 'Degraded'

4162

# trigger.on-sync-failed: |

4163

# - description: Application syncing has failed

4164

# send:

4165

# - app-sync-failed

4166

# when: app.status.operationState.phase in ['Error', 'Failed']

4167

# trigger.on-sync-running: |

4168

# - description: Application is being synced

4169

# send:

4170

# - app-sync-running

4171

# when: app.status.operationState.phase in ['Running']

4172

# trigger.on-sync-status-unknown: |

4173

# - description: Application status is 'Unknown'

4174

# send:

4175

# - app-sync-status-unknown

4176

# when: app.status.sync.status == 'Unknown'

4177

# trigger.on-sync-succeeded: |

4178

# - description: Application syncing has succeeded

4179

# send:

4180

# - app-sync-succeeded

4181

# when: app.status.operationState.phase in ['Succeeded']

4182

4183

# For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/#default-triggers

4184

# defaultTriggers: |

4185

# - on-sync-status-unknown

4186

4187

# Default notifications controller's network policy

4188

networkPolicy:

4189

# -- Default network policy rules used by notifications controller

4190

# @default -- `false` (defaults to global.networkPolicy.create)

4191

create: false

4192

commitServer:

4193

# -- Enable commit server

4194

enabled: false

4195

# -- Commit server name

4196

4197

# -- Runtime class name for the commit server

4198

# @default -- `""` (defaults to global.runtimeClassName)

4199

runtimeClassName: ""

4200

## commit server controller image

4201

image:

4202

# -- Repository to use for the commit server

4203

# @default -- `""` (defaults to global.image.repository)

4204

repository: ""

4205

# -- Tag to use for the commit server

4206

# @default -- `""` (defaults to global.image.tag)

4207

tag: ""

4208

# -- Image pull policy for the commit server

4209

# @default -- `""` (defaults to global.image.imagePullPolicy)

4210

imagePullPolicy: ""

4211

# -- commit server command line flags

4212

extraArgs: []

4213

# -- Environment variables to pass to the commit server

4214

extraEnv: []

4215

# - name: "MY_VAR"

4216

# value: "value"

4217

4218

# -- envFrom to pass to the commit server

4219

# @default -- `[]` (See [values.yaml])

4220

extraEnvFrom: []

4221

# - configMapRef:

4222

# name: config-map-name

4223

# - secretRef:

4224

# name: secret-name

4225

4226

# -- List of extra mounts to add (normally used with extraVolumes)

4227

extraVolumeMounts: []

4228

# -- List of extra volumes to add

4229

extraVolumes: []

4230

metrics:

4231

# -- Enables prometheus metrics server

4232

enabled: false

4233

service:

4234

# -- Metrics service type

4235

type: ClusterIP

4236

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

4237

clusterIP: ""

4238

# -- Metrics service annotations

4239

annotations: {}

4240

# -- Metrics service labels

4241

labels: {}

4242

# -- Metrics service port

4243

servicePort: 8087

4244

# -- Metrics service port name

4245

portName: metrics

4246

## commit server service configuration

4247

service:

4248

# -- commit server service annotations

4249

annotations: {}

4250

# -- commit server service labels

4251

labels: {}

4252

# -- commit server service port

4253

port: 8086

4254

# -- commit server service port name

4255

portName: server

4256

# -- Automount API credentials for the Service Account into the pod.

4257

automountServiceAccountToken: false

4258

serviceAccount:

4259

# -- Create commit server service account

4260

create: true

4261

# -- commit server service account name

4262

4263

# -- Annotations applied to created service account

4264

annotations: {}

4265

# -- Labels applied to created service account

4266

labels: {}

4267

# -- Automount API credentials for the Service Account

4268

automountServiceAccountToken: true

4269

# -- Annotations to be added to commit server Deployment

4270

deploymentAnnotations: {}

4271

# -- Labels for the commit server Deployment

4272

deploymentLabels: {}

4273

# -- Annotations for the commit server pods

4274

podAnnotations: {}

4275

# -- Labels for the commit server pods

4276

podLabels: {}

4277

# -- Resource limits and requests for the commit server pods.

4278

resources: {}

4279

# limits:

4280

# cpu: 100m

4281

# memory: 128Mi

4282

# requests:

4283

# cpu: 100m

4284

# memory: 128Mi

4285

4286

# -- [DNS configuration]

4287

dnsConfig: {}

4288

# -- Alternative DNS policy for commit server pods

4289

dnsPolicy: "ClusterFirst"

4290

# -- commit server container-level security context

4291

# @default -- See [values.yaml]

4292

containerSecurityContext:

4293

runAsNonRoot: true

4294

readOnlyRootFilesystem: true

4295

allowPrivilegeEscalation: false

4296

capabilities:

4297

drop:

4298

- ALL

4299

seccompProfile:

4300

type: RuntimeDefault

4301

## Probes for commit server (optional)

4302

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

4303

readinessProbe:

4304

# -- Enable Kubernetes liveness probe for commit server

4305

enabled: true

4306

# -- Http path to use for the readiness probe

4307

httpPath: /healthz

4308

# -- Number of seconds after the container has started before [probe] is initiated

4309

initialDelaySeconds: 5

4310

# -- How often (in seconds) to perform the [probe]

4311

periodSeconds: 10

4312

# -- Number of seconds after which the [probe] times out

4313

timeoutSeconds: 1

4314

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4315

failureThreshold: 3

4316

livenessProbe:

4317

# -- Enable Kubernetes liveness probe for commit server

4318

enabled: true

4319

# -- Http path to use for the liveness probe

4320

httpPath: /healthz?full=true

4321

# -- Number of seconds after the container has started before [probe] is initiated

4322

initialDelaySeconds: 30

4323

# -- How often (in seconds) to perform the [probe]

4324

periodSeconds: 30

4325

# -- Number of seconds after which the [probe] times out

4326

timeoutSeconds: 5

4327

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4328

failureThreshold: 3

4329

## Startup probe for commit server (optional)

4330

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

4331

startupProbe:

4332

# -- Enable Kubernetes startup probe for commit server

4333

enabled: false

4334

# -- Http path to use for the startup probe

4335

httpPath: /healthz

4336

# -- Number of seconds after the container has started before [probe] is initiated

4337

initialDelaySeconds: 10

4338

# -- How often (in seconds) to perform the [probe]

4339

periodSeconds: 10

4340

# -- Number of seconds after which the [probe] times out

4341

timeoutSeconds: 1

4342

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4343

failureThreshold: 20

4344

# -- terminationGracePeriodSeconds for container lifecycle hook

4345

terminationGracePeriodSeconds: 30

4346

# -- [Node selector]

4347

# @default -- `{}` (defaults to global.nodeSelector)

4348

nodeSelector: {}

4349

# -- [Tolerations] for use with node taints

4350

# @default -- `[]` (defaults to global.tolerations)

4351

tolerations: []

4352

# -- Assign custom [affinity] rules

4353

# @default -- `{}` (defaults to global.affinity preset)

4354

affinity: {}

4355

# -- Assign custom [TopologySpreadConstraints] rules to the commit server

4356

# @default -- `[]` (defaults to global.topologySpreadConstraints)

4357

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

4358

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

4359

topologySpreadConstraints: []

4360

# - maxSkew: 1

4361

# topologyKey: topology.kubernetes.io/zone

4362

# whenUnsatisfiable: DoNotSchedule

4363

4364

# -- Deployment strategy to be added to the commit server Deployment

4365

deploymentStrategy: {}

4366

# type: RollingUpdate

4367

# rollingUpdate:

4368

# maxSurge: 25%

4369

# maxUnavailable: 25%

4370

4371

# -- Priority class for the commit server pods

4372

# @default -- `""` (defaults to global.priorityClassName)

4373

priorityClassName: ""

4374

# Default commit server's network policy

4375

networkPolicy:

4376

# -- Default network policy rules used by commit server

4377

# @default -- `false` (defaults to global.networkPolicy.create)

4378

create: false

4379

## Commit server Vertical Pod Autoscaler

4380

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

4381

vpa:

4382

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the commit server

4383

enabled: false

4384

# -- Labels to be added to commit server vpa

4385

labels: {}

4386

# -- Annotations to be added to commit server vpa

4387

annotations: {}

4388

# -- One of the VPA operation modes

4389

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

4390

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

4391

updateMode: Initial

4392

# -- Controls how VPA computes the recommended resources for commit server container

4393

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

4394

containerPolicy: {}

4395

# controlledResources: ["cpu", "memory"]

4396

# minAllowed:

4397

# cpu: 250m

4398

# memory: 256Mi

4399

# maxAllowed:

4400

# cpu: 1

4401

# memory: 1Gi

4402

4403

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

4404

## NOTE: specify only zero or one recommender as of VPA 1.7.1

4405

recommenders: []

4406

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

argo-cd

The trusted source for open source

Product

Solutions

Customers

Resources

Company