argo-cd

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

Compare:

## Argo CD configuration

## Ref: https://github.com/argoproj/argo-cd

# -- Provide a name in place of `argocd`

nameOverride: argocd

# -- String to fully override `"argo-cd.fullname"`

fullnameOverride: ""

# -- Override the namespace

# @default -- `.Release.Namespace`

namespaceOverride: ""

# -- Override the Kubernetes version, which is used to evaluate certain manifests

kubeVersionOverride: ""

# Override APIVersions

# If you want to template helm charts but cannot access k8s API server

# you can set api versions here

apiVersionOverrides: {}

# -- Create aggregated roles that extend existing cluster roles to interact with argo-cd resources

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

createAggregateRoles: false

# -- Create cluster roles for cluster-wide installation.

## Used when you manage applications in the same cluster where Argo CD runs

createClusterRoles: true

openshift:

# -- enables using arbitrary uid for argo repo server

enabled: false

## Custom resource configuration

crds:

# -- Install and upgrade CRDs

install: true

# -- Keep CRDs on chart uninstall

keep: true

# -- Annotations to be added to all CRDs

annotations:

argocd.argoproj.io/sync-options: ServerSideApply=true

# -- Additional labels to be added to all CRDs

additionalLabels: {}

## Globally shared configuration

global:

# -- Default domain used by all components

## Used for ingresses, certificates, SSO, notifications, etc.

domain: argocd.example.com

# -- Runtime class name for all components

runtimeClassName: ""

# -- Common labels for the all resources

additionalLabels: {}

# app: argo-cd

# -- Number of old deployment ReplicaSets to retain. The rest will be garbage collected.

revisionHistoryLimit: 3

# Default image used by all components

image:

# -- If defined, a repository applied to all Argo CD deployments

repository: cgr.dev/chainguard-private/argocd

# -- Overrides the global Argo CD image tag whose default is the chart appVersion

tag: 3.5.2@sha256:a65bdf2ce7bc3b0d54fd0e02f6a2e1bc1b16d48be5c5d0b2c369ef9c15c380e8

# -- If defined, a imagePullPolicy applied to all Argo CD deployments

imagePullPolicy: IfNotPresent

# -- Secrets with credentials to pull images from a private registry

imagePullSecrets: []

# Default logging options used by all components

logging:

# -- Set the global logging format. Either: `text` or `json`

format: text

# -- Set the global logging level. One of: `debug`, `info`, `warn` or `error`

level: info

# -- Annotations for the all deployed Statefulsets

statefulsetAnnotations: {}

# -- Labels for the all deployed Statefulsets

statefulsetLabels: {}

# -- Annotations for the all deployed Deployments

deploymentAnnotations: {}

# -- Labels for the all deployed Deployments

deploymentLabels: {}

# -- Annotations for the all deployed pods

podAnnotations: {}

# -- Labels for the all deployed pods

podLabels: {}

# -- Add Prometheus scrape annotations to all metrics services. This can be used as an alternative to the ServiceMonitors.

addPrometheusAnnotations: false

# -- Toggle and define pod-level security context.

# @default -- `{}` (See [values.yaml])

securityContext: {}

# runAsUser: 999

# runAsGroup: 999

# fsGroup: 999

# -- Mapping between IP and hostnames that will be injected as entries in the pod's hosts files

hostAliases: []

# - ip: 10.20.30.40

# hostnames:

# - git.myhostname

# Configure dual-stack used by all component services

dualStack:

# -- IP family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)

ipFamilyPolicy: ""

# -- IP families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.

ipFamilies: []

100

# Default network policy rules used by all components

101

networkPolicy:

102

# -- Create NetworkPolicy objects for all components

103

create: true

104

# -- Default deny all ingress traffic

105

defaultDenyIngress: false

106

# -- Default priority class for all components

107

priorityClassName: ""

108

# -- Default node selector for all components

109

nodeSelector:

110

kubernetes.io/os: linux

111

# -- Default tolerations for all components

112

tolerations: []

113

# Default affinity preset for all components

114

affinity:

115

# -- Default pod anti-affinity rules. Either: `none`, `soft` or `hard`

116

podAntiAffinity: soft

117

# Node affinity rules

118

nodeAffinity:

119

# -- Default node affinity rules. Either: `none`, `soft` or `hard`

120

type: hard

121

# -- Default match expressions for node affinity

122

matchExpressions: []

123

# - key: topology.kubernetes.io/zone

124

# operator: In

125

# values:

126

# - antarctica-east1

127

# - antarctica-west1

128

# -- Default [TopologySpreadConstraints] rules for all components

129

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

130

## If labelSelector is left out, it will default to the labelSelector of the component

131

topologySpreadConstraints: []

132

# - maxSkew: 1

133

# topologyKey: topology.kubernetes.io/zone

134

# whenUnsatisfiable: DoNotSchedule

135

136

# -- Deployment strategy for the all deployed Deployments

137

deploymentStrategy: {}

138

# type: RollingUpdate

139

# rollingUpdate:

140

# maxSurge: 25%

141

# maxUnavailable: 25%

142

143

# -- Environment variables to pass to all deployed Deployments

144

env: []

145

# -- Extra volumes to add to all deployed Deployments and StatefulSets

146

extraVolumes: []

147

# Example of adding a custom CA bundle from a ConfigMap:

148

# - name: my-root-ca

149

# configMap:

150

# name: my-trustbundle

151

# items:

152

# - key: bundle.pem

153

# path: ca-certificates.crt

154

155

# -- Extra volume mounts to add to all deployed Deployments and StatefulSets

156

extraVolumeMounts: []

157

# Example of adding a custom CA bundle mount:

158

# - name: my-root-ca

159

# mountPath: /etc/ssl/certs

160

161

# -- Annotations for the all deployed Certificates

162

certificateAnnotations: {}

163

## Argo Configs

164

configs:

165

# General Argo CD configuration. Any values you put under `.configs.cm` are passed to argocd-cm ConfigMap.

166

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cm.yaml

167

cm:

168

# -- Create the argocd-cm configmap for [declarative setup]

169

create: true

170

# -- Annotations to be added to argocd-cm configmap

171

annotations: {}

172

# -- The name of tracking label used by Argo CD for resource pruning

173

application.instanceLabelKey: argocd.argoproj.io/instance

174

# -- Enable control of the service account used for the sync operation (alpha)

175

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/app-sync-using-impersonation/

176

application.sync.impersonation.enabled: false

177

# -- Enable exec feature in Argo UI

178

## Ref: https://argo-cd.readthedocs.io/en/latest/operator-manual/rbac/#exec-resource

179

exec.enabled: false

180

# -- Enable local admin user

181

## Ref: https://argo-cd.readthedocs.io/en/latest/faq/#how-to-disable-admin-user

182

admin.enabled: true

183

# -- Timeout to discover if a new manifests version got published to the repository

184

timeout.reconciliation: 120s

185

# -- Maximum jitter added to the reconciliation timeout to spread out refreshes and reduce repo-server load

186

timeout.reconciliation.jitter: 60s

187

# -- Timeout to refresh application data as well as target manifests cache

188

timeout.hard.reconciliation: 0s

189

# -- Enable Status Badge

190

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/status-badge/

191

statusbadge.enabled: false

192

# Dex configuration

193

# dex.config: |

194

# connectors:

195

# # GitHub example

196

# - type: github

197

# id: github

198

# name: GitHub

199

# config:

200

# clientID: aabbccddeeff00112233

201

# clientSecret: $dex.github.clientSecret # Alternatively $<some_K8S_secret>:dex.github.clientSecret

202

# orgs:

203

# - name: your-github-org

204

205

# OIDC configuration as an alternative to dex (optional).

206

# oidc.config: |

207

# name: AzureAD

208

# issuer: https://login.microsoftonline.com/TENANT_ID/v2.0

209

# clientID: aaaabbbbccccddddeee

210

# clientSecret: $oidc.azuread.clientSecret

211

# # Optional: set to true to use Azure Workload Identity instead of clientSecret

212

# azure:

213

# useWorkloadIdentity: false

214

215

# Some OIDC providers require a separate clientID for different callback URLs.

216

# For example, if configuring Argo CD with self-hosted Dex, you will need a separate client ID

217

# for the 'localhost' (CLI) client to Dex. This field is optional. If omitted, the CLI will

218

# use the same clientID as the Argo CD server

219

# cliClientID: vvvvwwwwxxxxyyyyzzzz

220

221

# rootCA: |

222

# -----BEGIN CERTIFICATE-----

223

# ... encoded certificate data here ...

224

# -----END CERTIFICATE-----

225

226

# Optional list of allowed aud claims. If omitted or empty, defaults to the clientID value above (and the

227

# cliClientID, if that is also specified). If you specify a list and want the clientID to be allowed, you must

228

# explicitly include it in the list.

229

# Token verification will pass if any of the token's audiences matches any of the audiences in this list.

230

# allowedAudiences:

231

# - aaaabbbbccccddddeee

232

# - qqqqwwwweeeerrrrttt

233

234

# Optional set of OIDC claims to request on the ID token.

235

# requestedIDTokenClaims:

236

# groups:

237

# essential: true

238

239

# Optional set of OIDC scopes to request. If omitted, defaults to: ["openid", "profile", "email", "groups"]

240

# requestedScopes:

241

# - openid

242

# - profile

243

# - email

244

245

# PKCE authentication flow processes authorization flow from browser only - default false

246

# uses the clientID

247

# make sure the Identity Provider (IdP) is public and doesn't need clientSecret

248

# make sure the Identity Provider (IdP) has this redirect URI registered: https://argocd.example.com/pkce/verify

249

# enablePKCEAuthentication: true

250

251

# Extension Configuration

252

## Ref: https://argo-cd.readthedocs.io/en/latest/developer-guide/extensions/proxy-extensions/

253

# extension.config: |

254

# extensions:

255

# - name: httpbin

256

# backend:

257

# connectionTimeout: 2s

258

# keepAlive: 15s

259

# idleConnectionTimeout: 60s

260

# maxIdleConnections: 30

261

# services:

262

# - url: http://httpbin.org

263

# headers:

264

# - name: some-header

265

# value: '$some.argocd.secret.key'

266

# cluster:

267

# name: some-cluster

268

# server: https://some-cluster

269

270

## Default configuration for ignoreResourceUpdates.

271

## The ignoreResourceUpdates list contains K8s resource's properties that are known to be frequently updated

272

## by controllers and operators. These resources, when watched by argo, will cause many unnecessary updates.

273

274

# -- Ignoring status for all resources. An update will still be sent if the status update causes the health to change.

275

# @default -- See [values.yaml]

276

resource.customizations.ignoreResourceUpdates.all: |

277

jsonPointers:

278

- /status

279

# -- Some Application fields are generated and not related to the application updates itself

280

## The Application itself is already watched by the controller lister, but this configuration is applied for apps of apps

281

# @default -- See [values.yaml]

282

resource.customizations.ignoreResourceUpdates.argoproj.io_Application: |

283

jqPathExpressions:

284

- '.metadata.annotations."notified.notifications.argoproj.io"'

285

- '.metadata.annotations."argocd.argoproj.io/refresh"'

286

- '.metadata.annotations."argocd.argoproj.io/hydrate"'

287

- '.operation'

288

# -- Ignore Argo Rollouts generated fields

289

# @default -- See [values.yaml]

290

resource.customizations.ignoreResourceUpdates.argoproj.io_Rollout: |

291

jqPathExpressions:

292

- '.metadata.annotations."notified.notifications.argoproj.io"'

293

# -- Legacy annotations used on HPA autoscaling/v1

294

# @default -- See [values.yaml]

295

resource.customizations.ignoreResourceUpdates.autoscaling_HorizontalPodAutoscaler: |

296

jqPathExpressions:

297

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/behavior"'

298

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/conditions"'

299

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/metrics"'

300

- '.metadata.annotations."autoscaling.alpha.kubernetes.io/current-metrics"'

301

# -- Ignore the cluster-autoscaler status

302

# @default -- See [values.yaml]

303

resource.customizations.ignoreResourceUpdates.ConfigMap: |

304

jqPathExpressions:

305

# Ignore the cluster-autoscaler status

306

- '.metadata.annotations."cluster-autoscaler.kubernetes.io/last-updated"'

307

# Ignore the annotation of the legacy Leases election

308

- '.metadata.annotations."control-plane.alpha.kubernetes.io/leader"'

309

# -- Ignore the common scaling annotations

310

# @default -- See [values.yaml]

311

resource.customizations.ignoreResourceUpdates.apps_ReplicaSet: |

312

jqPathExpressions:

313

- '.metadata.annotations."deployment.kubernetes.io/desired-replicas"'

314

- '.metadata.annotations."deployment.kubernetes.io/max-replicas"'

315

- '.metadata.annotations."rollout.argoproj.io/desired-replicas"'

316

# -- Ignores update if EndpointSlice is not excluded globally

317

# @default -- See [values.yaml]

318

resource.customizations.ignoreResourceUpdates.discovery.k8s.io_EndpointSlice: |

319

jsonPointers:

320

- /metadata

321

- /endpoints

322

- /ports

323

# -- Ignores update if Endpoints is not excluded globally

324

# @default -- See [values.yaml]

325

resource.customizations.ignoreResourceUpdates.Endpoints: |

326

jsonPointers:

327

- /metadata

328

- /subsets

329

## Default configuration for exclusions.

330

## The exclusion list are K8s resources that we assume will never be declared in Git,

331

## and are never child objects of managed resources that need to be presented in the resource tree.

332

## This list contains high volume and high churn metadata objects which we exclude for performance

333

## reasons, reducing connections and load to the K8s API servers of managed clusters.

334

335

# -- Resource Exclusion/Inclusion

336

# @default -- See [values.yaml]

337

resource.exclusions: |

338

### Network resources created by the Kubernetes control plane and excluded to reduce the number of watched events and UI clutter

339

- apiGroups:

340

- ''

341

- discovery.k8s.io

342

kinds:

343

- Endpoints

344

- EndpointSlice

345

### Internal Kubernetes resources excluded reduce the number of watched events

346

- apiGroups:

347

- coordination.k8s.io

348

kinds:

349

- Lease

350

### Internal Kubernetes Authz/Authn resources excluded reduce the number of watched events

351

- apiGroups:

352

- authentication.k8s.io

353

- authorization.k8s.io

354

kinds:

355

- SelfSubjectReview

356

- TokenReview

357

- LocalSubjectAccessReview

358

- SelfSubjectAccessReview

359

- SelfSubjectRulesReview

360

- SubjectAccessReview

361

### Intermediate Certificate Request excluded reduce the number of watched events

362

- apiGroups:

363

- certificates.k8s.io

364

kinds:

365

- CertificateSigningRequest

366

- apiGroups:

367

- cert-manager.io

368

kinds:

369

- CertificateRequest

370

### Cilium internal resources excluded reduce the number of watched events and UI Clutter

371

- apiGroups:

372

- cilium.io

373

kinds:

374

- CiliumIdentity

375

- CiliumEndpoint

376

- CiliumEndpointSlice

377

### Kyverno intermediate and reporting resources excluded reduce the number of watched events and improve performance

378

- apiGroups:

379

- kyverno.io

380

- reports.kyverno.io

381

- wgpolicyk8s.io

382

kinds:

383

- PolicyReport

384

- ClusterPolicyReport

385

- EphemeralReport

386

- ClusterEphemeralReport

387

- AdmissionReport

388

- ClusterAdmissionReport

389

- BackgroundScanReport

390

- ClusterBackgroundScanReport

391

- UpdateRequest

392

# -- Additional resource exclusions to append to the default `resource.exclusions` list above,

393

# so that the defaults can be kept up to date without needing to duplicate/override them.

394

# These entries are always appended, never substituted: if you also set `resource.exclusions`

395

# yourself, they are appended to your value rather than to the chart defaults.

396

# @default -- `[]`

397

resourceExclusionsAdditional: []

398

# Argo CD configuration parameters

399

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/argocd-cmd-params-cm.yaml

400

params:

401

# -- Create the argocd-cmd-params-cm configmap

402

# If false, it is expected the configmap will be created by something else.

403

create: true

404

# -- Annotations to be added to the argocd-cmd-params-cm ConfigMap

405

annotations: {}

406

# You can customize parameters by adding parameters here.

407

# (e.g.)

408

# otlp.address: ''

409

# Argo CD RBAC policy configuration

410

## Ref: https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md

411

rbac:

412

# -- Create the argocd-rbac-cm configmap with ([Argo CD RBAC policy]) definitions.

413

# If false, it is expected the configmap will be created by something else.

414

# Argo CD will not work if there is no configmap created with the name above.

415

create: true

416

# -- Annotations to be added to argocd-rbac-cm configmap

417

annotations: {}

418

# -- The name of the default role which Argo CD will falls back to, when authorizing API requests (optional).

419

# If omitted or empty, users may be still be able to login, but will see no apps, projects, etc...

420

policy.default: ""

421

# -- File containing user-defined policies and role definitions.

422

# @default -- `''` (See [values.yaml])

423

policy.csv: ""

424

# Policy rules are in the form:

425

# p, subject, resource, action, object, effect

426

# Role definitions and bindings are in the form:

427

# g, subject, inherited-subject

428

# policy.csv: |

429

# p, role:org-admin, applications, *, */*, allow

430

# p, role:org-admin, clusters, get, *, allow

431

# p, role:org-admin, repositories, *, *, allow

432

# p, role:org-admin, logs, get, *, allow

433

# p, role:org-admin, exec, create, */*, allow

434

# g, your-github-org:your-team, role:org-admin

435

436

# -- OIDC scopes to examine during rbac enforcement (in addition to `sub` scope).

437

# The scope value can be a string, or a list of strings.

438

scopes: "[groups]"

439

# -- Matcher function for Casbin, `glob` for glob matcher and `regex` for regex matcher.

440

policy.matchMode: "glob"

441

# GnuPG public keys for commit verification

442

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/gpg-verification/

443

gpg:

444

# -- Annotations to be added to argocd-gpg-keys-cm configmap

445

annotations: {}

446

# -- [GnuPG] public keys to add to the keyring

447

# @default -- `{}` (See [values.yaml])

448

## Note: Public keys should be exported with `gpg --export --armor <KEY>`

449

keys: {}

450

# 4AEE18F83AFDEB23: |

451

# -----BEGIN PGP PUBLIC KEY BLOCK-----

452

# ...

453

# -----END PGP PUBLIC KEY BLOCK-----

454

# SSH known hosts for Git repositories

455

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#ssh-known-host-public-keys

456

ssh:

457

# -- Specifies if the argocd-ssh-known-hosts-cm configmap should be created by Helm.

458

create: true

459

# -- Annotations to be added to argocd-ssh-known-hosts-cm configmap

460

annotations: {}

461

# -- Known hosts to be added to the known host list by default.

462

# @default -- See [values.yaml]

463

knownHosts: |

464

[ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

465

[ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl

466

[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

467

bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE=

468

bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO

469

bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M=

470

github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=

471

github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl

472

github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

473

gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=

474

gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf

475

gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9

476

ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

477

vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H

478

# -- Additional known hosts for private repositories

479

extraHosts: ""

480

# Repository TLS certificates

481

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#repositories-using-self-signed-tls-certificates-or-are-signed-by-custom-ca

482

tls:

483

# -- Annotations to be added to argocd-tls-certs-cm configmap

484

annotations: {}

485

# -- TLS certificates for Git repositories

486

# @default -- `{}` (See [values.yaml])

487

certificates: {}

488

# server.example.com: |

489

# -----BEGIN CERTIFICATE-----

490

# ...

491

# -----END CERTIFICATE-----

492

493

# -- Specifies if the argocd-tls-certs-cm configmap should be created by Helm.

494

create: true

495

# ConfigMap for Config Management Plugins

496

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/config-management-plugins/

497

cmp:

498

# -- Create the argocd-cmp-cm configmap

499

create: false

500

# -- Annotations to be added to argocd-cmp-cm configmap

501

annotations: {}

502

# -- Plugin yaml files to be added to argocd-cmp-cm

503

plugins: {}

504

# --- First plugin

505

# my-plugin:

506

# init:

507

# command: [sh]

508

# args: [-c, 'echo "Initializing..."']

509

# generate:

510

# command: [sh, -c]

511

# args:

512

# - |

513

# echo "{\"kind\": \"ConfigMap\", \"apiVersion\": \"v1\", \"metadata\": { \"name\": \"$ARGOCD_APP_NAME\", \"namespace\": \"$ARGOCD_APP_NAMESPACE\", \"annotations\": {\"Foo\": \"$ARGOCD_ENV_FOO\", \"KubeVersion\": \"$KUBE_VERSION\", \"KubeApiVersion\": \"$KUBE_API_VERSIONS\",\"Bar\": \"baz\"}}}"

514

# discover:

515

# fileName: "./subdir/s*.yaml"

516

# find:

517

# glob: "**/Chart.yaml"

518

# command: [sh, -c, find . -name env.yaml]

519

# --- Second plugin

520

# my-plugin2:

521

# init:

522

# command: [sh]

523

# args: [-c, 'echo "Initializing..."']

524

# generate:

525

# command: [sh, -c]

526

# args:

527

# - |

528

529

# discover:

530

# fileName: "./subdir/s*.yaml"

531

# find:

532

# glob: "**/Chart.yaml"

533

# command: [sh, -c, find . -name env.yaml]

534

535

# -- Provide one or multiple [external cluster credentials]

536

# @default -- `{}` (See [values.yaml])

537

## Ref:

538

## - https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#clusters

539

## - https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#external-cluster-credentials

540

## - https://argo-cd.readthedocs.io/en/stable/user-guide/projects/#project-scoped-repositories-and-clusters

541

clusterCredentials: {}

542

# mycluster:

543

# server: https://mycluster.example.com

544

# labels: {}

545

# annotations: {}

546

# config:

547

# bearerToken: "<authentication token>"

548

# tlsClientConfig:

549

# insecure: false

550

# caData: "<base64 encoded certificate>"

551

# mycluster2:

552

# server: https://mycluster2.example.com

553

# labels: {}

554

# annotations: {}

555

# namespaces: namespace1,namespace2

556

# clusterResources: true

557

# config:

558

# bearerToken: "<authentication token>"

559

# tlsClientConfig:

560

# insecure: false

561

# caData: "<base64 encoded certificate>"

562

# mycluster3-project-scoped:

563

# server: https://mycluster3.example.com

564

# labels: {}

565

# annotations: {}

566

# project: my-project1

567

# config:

568

# bearerToken: "<authentication token>"

569

# tlsClientConfig:

570

# insecure: false

571

# caData: "<base64 encoded certificate>"

572

# mycluster4-sharded:

573

# shard: 1

574

# server: https://mycluster4.example.com

575

# labels: {}

576

# annotations: {}

577

# config:

578

# bearerToken: "<authentication token>"

579

# tlsClientConfig:

580

# insecure: false

581

# caData: "<base64 encoded certificate>"

582

583

# -- Repository credentials to be used as Templates for other repos

584

## Creates a secret for each key/value specified below to create repository credentials

585

credentialTemplates: {}

586

# github-enterprise-creds-1:

587

# url: https://github.com/argoproj

588

# githubAppID: 1

589

# githubAppInstallationID: 2

590

# githubAppEnterpriseBaseUrl: https://ghe.example.com/api/v3

591

# githubAppPrivateKey: |

592

# -----BEGIN OPENSSH PRIVATE KEY-----

593

# ...

594

# -----END OPENSSH PRIVATE KEY-----

595

# https-creds:

596

# url: https://github.com/argoproj

597

# password: my-password

598

# username: my-username

599

# ssh-creds:

600

# url: git@github.com:argoproj-labs

601

# sshPrivateKey: |

602

# -----BEGIN OPENSSH PRIVATE KEY-----

603

# ...

604

# -----END OPENSSH PRIVATE KEY-----

605

606

# -- Annotations to be added to `configs.credentialTemplates` Secret

607

credentialTemplatesAnnotations: {}

608

# -- Repositories list to be used by applications

609

## Creates a secret for each key/value specified below to create repositories

610

## Note: the last example in the list would use a repository credential template, configured under "configs.credentialTemplates".

611

repositories: {}

612

# istio-helm-repo:

613

# url: https://storage.googleapis.com/istio-prerelease/daily-build/master-latest-daily/charts

614

# name: istio.io

615

# type: helm

616

# private-helm-repo:

617

# url: https://my-private-chart-repo.internal

618

# name: private-repo

619

# type: helm

620

# password: my-password

621

# username: my-username

622

# private-repo:

623

# url: https://github.com/argoproj/private-repo

624

625

# -- Annotations to be added to `configs.repositories` Secret

626

repositoriesAnnotations: {}

627

# Argo CD sensitive data

628

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets

629

secret:

630

# -- Create the argocd-secret

631

createSecret: true

632

# -- Labels to be added to argocd-secret

633

labels: {}

634

# -- Annotations to be added to argocd-secret

635

annotations: {}

636

# -- Shared secret for authenticating GitHub webhook events

637

githubSecret: ""

638

# -- Shared secret for authenticating GitLab webhook events

639

gitlabSecret: ""

640

# -- Shared secret for authenticating BitbucketServer webhook events

641

bitbucketServerSecret: ""

642

# -- UUID for authenticating Bitbucket webhook events

643

bitbucketUUID: ""

644

# -- Shared secret for authenticating Gogs webhook events

645

gogsSecret: ""

646

## Azure DevOps

647

azureDevops:

648

# -- Shared secret username for authenticating Azure DevOps webhook events

649

username: ""

650

# -- Shared secret password for authenticating Azure DevOps webhook events

651

password: ""

652

# -- add additional secrets to be added to argocd-secret

653

## Custom secrets. Useful for injecting SSO secrets into environment variables.

654

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/user-management/#sensitive-data-and-sso-client-secrets

655

## Note that all values must be non-empty.

656

extra: {}

657

# LDAP_PASSWORD: "mypassword"

658

659

# -- Bcrypt hashed admin password

660

## Argo expects the password in the secret to be bcrypt hashed. You can create this hash with

661

## `htpasswd -nbBC 10 "" $ARGO_PWD | tr -d ':\n' | sed 's/$2y/$2a/'`

662

argocdServerAdminPassword: ""

663

# -- Admin password modification time. Eg. `"2006-01-02T15:04:05Z"`

664

# @default -- `""` (defaults to current time)

665

argocdServerAdminPasswordMtime: ""

666

# -- Define custom [CSS styles] for your argo instance.

667

# This setting will automatically mount the provided CSS and reference it in the argo configuration.

668

# @default -- `""` (See [values.yaml])

669

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/custom-styles/

670

styles: ""

671

# styles: |

672

# .sidebar {

673

# background: linear-gradient(to bottom, #999, #777, #333, #222, #111);

674

# }

675

# -- Array of extra K8s manifests to deploy

676

## Note: Supports use of custom Helm templates

677

extraObjects: []

678

# - apiVersion: secrets-store.csi.x-k8s.io/v1

679

# kind: SecretProviderClass

680

# metadata:

681

# name: argocd-secrets-store

682

# spec:

683

# provider: aws

684

# parameters:

685

# objects: |

686

# - objectName: "argocd"

687

# objectType: "secretsmanager"

688

# jmesPath:

689

# - path: "client_id"

690

# objectAlias: "client_id"

691

# - path: "client_secret"

692

# objectAlias: "client_secret"

693

# secretObjects:

694

# - data:

695

# - key: client_id

696

# objectName: client_id

697

# - key: client_secret

698

# objectName: client_secret

699

# secretName: argocd-secrets-store

700

# type: Opaque

701

# labels:

702

# app.kubernetes.io/part-of: argocd

703

704

## Application controller

705

controller:

706

# -- Application controller name string

707

708

# -- The number of application controller pods to run.

709

# Additional replicas will cause sharding of managed clusters across number of replicas.

710

## With dynamic cluster distribution turned on, sharding of the clusters will gracefully

711

## rebalance if the number of replica's changes or one becomes unhealthy. (alpha)

712

replicas: 1

713

# -- Enable dynamic cluster distribution (alpha)

714

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution

715

## This is done using a deployment instead of a statefulSet

716

## When replicas are added or removed, the sharding algorithm is re-run to ensure that the

717

## clusters are distributed according to the algorithm. If the algorithm is well-balanced,

718

## like round-robin, then the shards will be well-balanced.

719

dynamicClusterDistribution: false

720

# -- Runtime class name for the application controller

721

# @default -- `""` (defaults to global.runtimeClassName)

722

runtimeClassName: ""

723

# -- Application controller heartbeat time

724

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/dynamic-cluster-distribution/#working-of-dynamic-distribution

725

heartbeatTime: 10

726

# -- Maximum number of controller revisions that will be maintained in StatefulSet history

727

revisionHistoryLimit: 5

728

## Application controller Pod Disruption Budget

729

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

730

pdb:

731

# -- Deploy a [PodDisruptionBudget] for the application controller

732

enabled: false

733

# -- Labels to be added to application controller pdb

734

labels: {}

735

# -- Annotations to be added to application controller pdb

736

annotations: {}

737

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

738

# @default -- `""` (defaults to 0 if not specified)

739

minAvailable: ""

740

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

741

## Has higher precedence over `controller.pdb.minAvailable`

742

maxUnavailable: ""

743

# -- Policy for evicting unhealthy (not ready) pods, either `IfHealthyBudget` or `AlwaysAllow`

744

## Defaults to `IfHealthyBudget` if not set

745

unhealthyPodEvictionPolicy: ""

746

## Application controller Vertical Pod Autoscaler

747

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

748

vpa:

749

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the application controller

750

enabled: false

751

# -- Labels to be added to application controller vpa

752

labels: {}

753

# -- Annotations to be added to application controller vpa

754

annotations: {}

755

# -- One of the VPA operation modes

756

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

757

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

758

updateMode: Initial

759

# -- Controls how VPA computes the recommended resources for application controller container

760

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

761

containerPolicy: {}

762

# controlledResources: ["cpu", "memory"]

763

# minAllowed:

764

# cpu: 250m

765

# memory: 256Mi

766

# maxAllowed:

767

# cpu: 1

768

# memory: 1Gi

769

# -- The recommenders that will provide recommendations for vertical scaling. Only relevant if a named VPA recommender (e.g. one started with a custom recommender name) is in use; leave unset to use the cluster's default recommender

770

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

771

## NOTE: specify only zero or one recommender as of VPA 1.7.1

772

recommenders: []

773

# -- Configures a startup resource boost for faster cold-start (application boot) resource allocation. NOTE: startupBoost is currently a GKE-specific extension to the VPA API and is only honored on GKE clusters; it is rendered only when set

774

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

775

startupBoost: {}

776

# cpu:

777

# type: Factor

778

# factor: 2

779

# durationSeconds: 10

780

## Application controller image

781

image:

782

# -- Repository to use for the application controller

783

# @default -- `""` (defaults to global.image.repository)

784

repository: ""

785

# -- Tag to use for the application controller

786

# @default -- `""` (defaults to global.image.tag)

787

tag: ""

788

# -- Image pull policy for the application controller

789

# @default -- `""` (defaults to global.image.imagePullPolicy)

790

imagePullPolicy: ""

791

# -- Secrets with credentials to pull images from a private registry

792

# @default -- `[]` (defaults to global.imagePullSecrets)

793

imagePullSecrets: []

794

# -- Additional command line arguments to pass to application controller

795

extraArgs: []

796

# -- Environment variables to pass to application controller

797

env: []

798

# -- envFrom to pass to application controller

799

# @default -- `[]` (See [values.yaml])

800

envFrom: []

801

# - configMapRef:

802

# name: config-map-name

803

# - secretRef:

804

# name: secret-name

805

806

# -- Additional containers to be added to the application controller pod

807

## Note: Supports use of custom Helm templates

808

extraContainers: []

809

# -- Init containers to add to the application controller pod

810

## If your target Kubernetes cluster(s) require a custom credential (exec) plugin

811

## you could use this (and the same in the server pod) to provide such executable

812

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

813

## Note: Supports use of custom Helm templates

814

initContainers: []

815

# - name: download-tools

816

# image: alpine:3

817

# command: [sh, -c]

818

# args:

819

# - wget -qO /custom-tools/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.7/kubelogin-linux-amd64.zip &&

820

# mkdir /custom-tools/tmp && unzip -d /custom-tools/tmp /custom-tools/kubelogin.zip &&

821

# mv /custom-tools/tmp/bin/linux_amd64/kubelogin /custom-tools/ && rm -rf custom-tools/tmp && rm /custom-tools/kubelogin.zip

822

# volumeMounts:

823

# - mountPath: /custom-tools

824

# name: custom-tools

825

826

# -- Additional volumeMounts to the application controller main container

827

volumeMounts: []

828

# - mountPath: /usr/local/bin/kubelogin

829

# name: custom-tools

830

# subPath: kubelogin

831

832

# -- Additional volumes to the application controller pod

833

volumes: []

834

# - name: custom-tools

835

# emptyDir: {}

836

837

## Application controller emptyDir volumes

838

emptyDir:

839

# -- EmptyDir size limit for application controller

840

# @default -- `""` (defaults not set if not specified i.e. no size limit)

841

sizeLimit: ""

842

# sizeLimit: "1Gi"

843

# -- Annotations for the application controller StatefulSet

844

statefulsetAnnotations: {}

845

# -- Labels for the application controller StatefulSet

846

statefulsetLabels: {}

847

# -- Annotations for the application controller Deployment

848

deploymentAnnotations: {}

849

# -- Labels for the application controller Deployment

850

deploymentLabels: {}

851

# -- Annotations to be added to application controller pods

852

podAnnotations: {}

853

# -- Labels to be added to application controller pods

854

podLabels: {}

855

# -- Resource limits and requests for the application controller pods

856

resources: {}

857

# limits:

858

# cpu: 500m

859

# memory: 512Mi

860

# requests:

861

# cpu: 250m

862

# memory: 256Mi

863

864

# Application controller container ports

865

containerPorts:

866

# -- Metrics container port

867

metrics: 8082

868

# -- Host Network for application controller pods

869

hostNetwork: false

870

# -- [DNS configuration]

871

dnsConfig: {}

872

# -- Alternative DNS policy for application controller pods

873

dnsPolicy: "ClusterFirst"

874

# -- Application controller container-level security context

875

# @default -- See [values.yaml]

876

containerSecurityContext:

877

runAsNonRoot: true

878

readOnlyRootFilesystem: true

879

allowPrivilegeEscalation: false

880

seccompProfile:

881

type: RuntimeDefault

882

capabilities:

883

drop:

884

- ALL

885

# Readiness probe for application controller

886

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

887

readinessProbe:

888

# -- Http path to use for the readiness probe

889

httpPath: /healthz

890

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

891

failureThreshold: 3

892

# -- Number of seconds after the container has started before [probe] is initiated

893

initialDelaySeconds: 10

894

# -- How often (in seconds) to perform the [probe]

895

periodSeconds: 10

896

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

897

successThreshold: 1

898

# -- Number of seconds after which the [probe] times out

899

timeoutSeconds: 1

900

## Liveness probe for the application controller.

901

## Disabled by default, matching upstream: Argo CD removed this probe deliberately

902

## (argoproj/argo-cd#9557) because restarting an overloaded controller usually makes

903

## things worse. Enable only if you have a known failure mode (e.g. deadlock) where

904

## a restart is the correct remediation, and size the thresholds generously.

905

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

906

livenessProbe:

907

# -- Enable Kubernetes liveness probe for Application controller

908

enabled: false

909

# -- Http path to use for the liveness probe

910

httpPath: /healthz

911

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

912

failureThreshold: 5

913

# -- Number of seconds after the container has started before [probe] is initiated

914

initialDelaySeconds: 10

915

# -- How often (in seconds) to perform the [probe]

916

periodSeconds: 30

917

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

918

successThreshold: 1

919

# -- Number of seconds after which the [probe] times out

920

timeoutSeconds: 5

921

## Startup probe for application controller (optional)

922

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

923

startupProbe:

924

# -- Enable Kubernetes startup probe for application controller

925

enabled: false

926

# -- Http path to use for the startup probe

927

httpPath: /healthz

928

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

929

failureThreshold: 20

930

# -- Number of seconds after the container has started before [probe] is initiated

931

initialDelaySeconds: 10

932

# -- How often (in seconds) to perform the [probe]

933

periodSeconds: 10

934

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

935

successThreshold: 1

936

# -- Number of seconds after which the [probe] times out

937

timeoutSeconds: 1

938

# -- terminationGracePeriodSeconds for container lifecycle hook

939

terminationGracePeriodSeconds: 30

940

# -- Priority class for the application controller pods

941

# @default -- `""` (defaults to global.priorityClassName)

942

priorityClassName: ""

943

# -- [Node selector]

944

# @default -- `{}` (defaults to global.nodeSelector)

945

nodeSelector: {}

946

# -- [Tolerations] for use with node taints

947

# @default -- `[]` (defaults to global.tolerations)

948

tolerations: []

949

# -- Assign custom [affinity] rules to the deployment

950

# @default -- `{}` (defaults to global.affinity preset)

951

affinity: {}

952

# -- Assign custom [TopologySpreadConstraints] rules to the application controller

953

# @default -- `[]` (defaults to global.topologySpreadConstraints)

954

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

955

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

956

topologySpreadConstraints: []

957

# - maxSkew: 1

958

# topologyKey: topology.kubernetes.io/zone

959

# whenUnsatisfiable: DoNotSchedule

960

961

# -- Automount API credentials for the Service Account into the pod.

962

automountServiceAccountToken: true

963

serviceAccount:

964

# -- Create a service account for the application controller

965

create: true

966

# -- Service account name

967

968

# -- Annotations applied to created service account

969

annotations: {}

970

# -- Labels applied to created service account

971

labels: {}

972

# -- Automount API credentials for the Service Account

973

automountServiceAccountToken: true

974

## Application controller metrics configuration

975

metrics:

976

# -- Deploy metrics service

977

enabled: false

978

applicationLabels:

979

# -- Enables additional labels in argocd_app_labels metric

980

enabled: false

981

# -- Additional labels

982

labels: []

983

service:

984

# -- Metrics service type

985

type: ClusterIP

986

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

987

clusterIP: ""

988

# -- Metrics service annotations

989

annotations: {}

990

# -- Metrics service labels

991

labels: {}

992

# -- Metrics service port

993

servicePort: 8082

994

# -- Metrics service port name

995

portName: http-metrics

996

serviceMonitor:

997

# -- Enable a prometheus ServiceMonitor

998

enabled: false

999

# -- Prometheus ServiceMonitor interval

1000

interval: 30s

1001

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

1002

scrapeTimeout: ""

1003

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1004

honorLabels: false

1005

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1006

relabelings: []

1007

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1008

metricRelabelings: []

1009

# -- Prometheus ServiceMonitor selector

1010

selector: {}

1011

# prometheus: kube-prometheus

1012

1013

# -- Prometheus ServiceMonitor scheme

1014

scheme: ""

1015

# -- Prometheus ServiceMonitor tlsConfig

1016

tlsConfig: {}

1017

# -- Prometheus ServiceMonitor namespace

1018

namespace: "" # "monitoring"

1019

# -- Prometheus ServiceMonitor labels

1020

additionalLabels: {}

1021

# -- Prometheus ServiceMonitor annotations

1022

annotations: {}

1023

rules:

1024

# -- Deploy a PrometheusRule for the application controller

1025

enabled: false

1026

# -- PrometheusRule namespace

1027

namespace: "" # "monitoring"

1028

# -- PrometheusRule selector

1029

selector: {}

1030

# prometheus: kube-prometheus

1031

1032

# -- PrometheusRule labels

1033

additionalLabels: {}

1034

# -- PrometheusRule annotations

1035

annotations: {}

1036

# -- PrometheusRule.Spec for the application controller

1037

spec: []

1038

# - alert: ArgoAppMissing

1039

# expr: |

1040

# absent(argocd_app_info) == 1

1041

# for: 15m

1042

# labels:

1043

# severity: critical

1044

# annotations:

1045

# summary: "[Argo CD] No reported applications"

1046

# description: >

1047

# Argo CD has not reported any applications data for the past 15 minutes which

1048

# means that it must be down or not functioning properly. This needs to be

1049

# resolved for this cloud to continue to maintain state.

1050

# - alert: ArgoAppNotSynced

1051

# expr: |

1052

# argocd_app_info{sync_status!="Synced"} == 1

1053

# for: 12h

1054

# labels:

1055

# severity: warning

1056

# annotations:

1057

# summary: "[{{ $labels.name }}] Application not synchronized"

1058

# description: >

1059

# The application {{ $labels.name }} has not been synchronized for over

1060

# 12 hours which means that the state of this cloud has drifted away from the

1061

# state inside Git.

1062

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

1063

## Defaults to off

1064

clusterRoleRules:

1065

# -- Enable custom rules for the application controller's ClusterRole resource

1066

enabled: false

1067

# -- List of custom rules for the application controller's ClusterRole resource

1068

rules: []

1069

## Enable this and set the rules: to whatever custom rules you want for the Role resource.

1070

## Defaults to off

1071

# -- List of custom rules for the application controller's Role resource

1072

roleRules: []

1073

# Default application controller's network policy

1074

networkPolicy:

1075

# -- Default network policy rules used by application controller

1076

# @default -- `false` (defaults to global.networkPolicy.create)

1077

create: false

1078

## Dex

1079

dex:

1080

# -- Enable dex

1081

enabled: true

1082

# -- Dex name

1083

1084

# -- Additional command line arguments to pass to the Dex server

1085

extraArgs: []

1086

# -- Runtime class name for Dex

1087

# @default -- `""` (defaults to global.runtimeClassName)

1088

runtimeClassName: ""

1089

metrics:

1090

# -- Deploy metrics service

1091

enabled: false

1092

service:

1093

# -- Metrics service annotations

1094

annotations: {}

1095

# -- Metrics service labels

1096

labels: {}

1097

# -- Metrics service port name

1098

portName: http-metrics

1099

serviceMonitor:

1100

# -- Enable a prometheus ServiceMonitor

1101

enabled: false

1102

# -- Prometheus ServiceMonitor interval

1103

interval: 30s

1104

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1105

honorLabels: false

1106

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1107

relabelings: []

1108

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1109

metricRelabelings: []

1110

# -- Prometheus ServiceMonitor selector

1111

selector: {}

1112

# prometheus: kube-prometheus

1113

1114

# -- Prometheus ServiceMonitor scheme

1115

scheme: ""

1116

# -- Prometheus ServiceMonitor tlsConfig

1117

tlsConfig: {}

1118

# -- Prometheus ServiceMonitor namespace

1119

namespace: "" # "monitoring"

1120

# -- Prometheus ServiceMonitor labels

1121

additionalLabels: {}

1122

# -- Prometheus ServiceMonitor annotations

1123

annotations: {}

1124

## Dex Pod Disruption Budget

1125

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1126

pdb:

1127

# -- Deploy a [PodDisruptionBudget] for the Dex server

1128

enabled: false

1129

# -- Labels to be added to Dex server pdb

1130

labels: {}

1131

# -- Annotations to be added to Dex server pdb

1132

annotations: {}

1133

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1134

# @default -- `""` (defaults to 0 if not specified)

1135

minAvailable: ""

1136

# -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%).

1137

## Has higher precedence over `dex.pdb.minAvailable`

1138

maxUnavailable: ""

1139

# -- Policy for evicting unhealthy (not ready) pods, either `IfHealthyBudget` or `AlwaysAllow`

1140

## Defaults to `IfHealthyBudget` if not set

1141

unhealthyPodEvictionPolicy: ""

1142

## Dex Vertical Pod Autoscaler

1143

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1144

vpa:

1145

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Dex server

1146

enabled: false

1147

# -- Labels to be added to Dex server vpa

1148

labels: {}

1149

# -- Annotations to be added to Dex server vpa

1150

annotations: {}

1151

# -- One of the VPA operation modes

1152

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1153

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1154

updateMode: Initial

1155

# -- Controls how VPA computes the recommended resources for Dex server container

1156

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1157

containerPolicy: {}

1158

# controlledResources: ["cpu", "memory"]

1159

# minAllowed:

1160

# cpu: 250m

1161

# memory: 256Mi

1162

# maxAllowed:

1163

# cpu: 1

1164

# memory: 1Gi

1165

1166

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

1167

## NOTE: specify only zero or one recommender as of VPA 1.7.1

1168

recommenders: []

1169

1170

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

1171

startupBoost: {}

1172

# cpu:

1173

# type: Factor

1174

# factor: 2

1175

# durationSeconds: 10

1176

## Dex image

1177

image:

1178

# -- Dex image repository

1179

repository: cgr.dev/chainguard-private/dex

1180

# -- Dex image tag

1181

tag: 2.45.1@sha256:efde42ded614a6282d5272e9c7975cd789a5d7d5d194cc60ce49677fda425c9b

1182

# -- Dex imagePullPolicy

1183

# @default -- `""` (defaults to global.image.imagePullPolicy)

1184

imagePullPolicy: ""

1185

# -- Secrets with credentials to pull images from a private registry

1186

# @default -- `[]` (defaults to global.imagePullSecrets)

1187

imagePullSecrets: []

1188

# Argo CD init image that creates Dex config

1189

initImage:

1190

# -- Argo CD init image repository

1191

# @default -- `""` (defaults to global.image.repository)

1192

repository: ""

1193

# -- Argo CD init image tag

1194

# @default -- `""` (defaults to global.image.tag)

1195

tag: ""

1196

# -- Argo CD init image imagePullPolicy

1197

# @default -- `""` (defaults to global.image.imagePullPolicy)

1198

imagePullPolicy: ""

1199

# -- Argo CD init image resources

1200

# @default -- `{}` (defaults to dex.resources)

1201

resources: {}

1202

# requests:

1203

# cpu: 5m

1204

# memory: 96Mi

1205

# limits:

1206

# cpu: 10m

1207

# memory: 144Mi

1208

# -- Environment variables to pass to the Dex server

1209

env: []

1210

# -- envFrom to pass to the Dex server

1211

# @default -- `[]` (See [values.yaml])

1212

envFrom: []

1213

# - configMapRef:

1214

# name: config-map-name

1215

# - secretRef:

1216

# name: secret-name

1217

1218

# -- Additional containers to be added to the dex pod

1219

## Note: Supports use of custom Helm templates

1220

extraContainers: []

1221

# -- Init containers to add to the dex pod

1222

## Note: Supports use of custom Helm templates

1223

initContainers: []

1224

# -- Additional volumeMounts to the dex main container

1225

volumeMounts: []

1226

# -- Additional volumes to the dex pod

1227

volumes: []

1228

## Dex server emptyDir volumes

1229

emptyDir:

1230

# -- EmptyDir size limit for Dex server

1231

# @default -- `""` (defaults not set if not specified i.e. no size limit)

1232

sizeLimit: ""

1233

# sizeLimit: "1Gi"

1234

# TLS certificate configuration via Secret

1235

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-dex-server

1236

## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart Dex automatically without extra controllers.

1237

certificateSecret:

1238

# -- Create argocd-dex-server-tls secret

1239

enabled: false

1240

# -- Labels to be added to argocd-dex-server-tls secret

1241

labels: {}

1242

# -- Annotations to be added to argocd-dex-server-tls secret

1243

annotations: {}

1244

# -- Certificate authority. Required for self-signed certificates.

1245

ca: ""

1246

# -- Certificate private key

1247

key: ""

1248

# -- Certificate data. Must contain SANs of Dex service (ie: argocd-dex-server, argocd-dex-server.argo-cd.svc)

1249

crt: ""

1250

# -- Annotations to be added to the Dex server Deployment

1251

deploymentAnnotations: {}

1252

# -- Labels for the Dex server Deployment

1253

deploymentLabels: {}

1254

# -- Annotations to be added to the Dex server pods

1255

podAnnotations: {}

1256

# -- Labels to be added to the Dex server pods

1257

podLabels: {}

1258

# -- Resource limits and requests for dex

1259

resources: {}

1260

# limits:

1261

# cpu: 50m

1262

# memory: 64Mi

1263

# requests:

1264

# cpu: 10m

1265

# memory: 32Mi

1266

1267

# Dex container ports

1268

# NOTE: These ports are currently hardcoded and cannot be changed

1269

containerPorts:

1270

# -- HTTP container port

1271

http: 5556

1272

# -- gRPC container port

1273

grpc: 5557

1274

# -- Metrics container port

1275

metrics: 5558

1276

# -- [DNS configuration]

1277

dnsConfig: {}

1278

# -- Alternative DNS policy for Dex server pods

1279

dnsPolicy: "ClusterFirst"

1280

# -- Dex container-level security context

1281

# @default -- See [values.yaml]

1282

containerSecurityContext:

1283

runAsNonRoot: true

1284

runAsUser: 1001

1285

readOnlyRootFilesystem: true

1286

allowPrivilegeEscalation: false

1287

seccompProfile:

1288

type: RuntimeDefault

1289

capabilities:

1290

drop:

1291

- ALL

1292

## Probes for Dex server

1293

## Supported from Dex >= 2.28.0

1294

livenessProbe:

1295

# -- Enable Kubernetes liveness probe for Dex >= 2.28.0

1296

enabled: false

1297

# -- Http path to use for the liveness probe

1298

httpPath: /healthz/live

1299

# -- Http port to use for the liveness probe

1300

httpPort: metrics

1301

# -- Scheme to use for for the liveness probe (can be HTTP or HTTPS)

1302

httpScheme: HTTP

1303

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1304

failureThreshold: 3

1305

# -- Number of seconds after the container has started before [probe] is initiated

1306

initialDelaySeconds: 10

1307

# -- How often (in seconds) to perform the [probe]

1308

periodSeconds: 10

1309

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1310

successThreshold: 1

1311

# -- Number of seconds after which the [probe] times out

1312

timeoutSeconds: 1

1313

readinessProbe:

1314

# -- Enable Kubernetes readiness probe for Dex >= 2.28.0

1315

enabled: false

1316

# -- Http path to use for the readiness probe

1317

httpPath: /healthz/ready

1318

# -- Http port to use for the readiness probe

1319

httpPort: metrics

1320

# -- Scheme to use for for the liveness probe (can be HTTP or HTTPS)

1321

httpScheme: HTTP

1322

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1323

failureThreshold: 3

1324

# -- Number of seconds after the container has started before [probe] is initiated

1325

initialDelaySeconds: 10

1326

# -- How often (in seconds) to perform the [probe]

1327

periodSeconds: 10

1328

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1329

successThreshold: 1

1330

# -- Number of seconds after which the [probe] times out

1331

timeoutSeconds: 1

1332

## Startup probe for Dex server (optional)

1333

## Supported from Dex >= 2.28.0

1334

startupProbe:

1335

# -- Enable Kubernetes startup probe for Dex >= 2.28.0

1336

enabled: false

1337

# -- Http path to use for the startup probe

1338

httpPath: /healthz/ready

1339

# -- Http port to use for the startup probe

1340

httpPort: metrics

1341

# -- Scheme to use for the startup probe (can be HTTP or HTTPS)

1342

httpScheme: HTTP

1343

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1344

failureThreshold: 20

1345

# -- Number of seconds after the container has started before [probe] is initiated

1346

initialDelaySeconds: 10

1347

# -- How often (in seconds) to perform the [probe]

1348

periodSeconds: 10

1349

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1350

successThreshold: 1

1351

# -- Number of seconds after which the [probe] times out

1352

timeoutSeconds: 1

1353

# -- terminationGracePeriodSeconds for container lifecycle hook

1354

terminationGracePeriodSeconds: 30

1355

# -- Automount API credentials for the Service Account into the pod.

1356

automountServiceAccountToken: true

1357

serviceAccount:

1358

# -- Create dex service account

1359

create: true

1360

# -- Dex service account name

1361

1362

# -- Annotations applied to created service account

1363

annotations: {}

1364

# -- Automount API credentials for the Service Account

1365

automountServiceAccountToken: true

1366

# -- Service port for HTTP access

1367

servicePortHttp: 5556

1368

# -- Service port name for HTTP access

1369

servicePortHttpName: http

1370

# -- Service port for gRPC access

1371

servicePortGrpc: 5557

1372

# -- Service port name for gRPC access

1373

servicePortGrpcName: grpc

1374

# -- Service port for metrics access

1375

servicePortMetrics: 5558

1376

# -- Priority class for the dex pods

1377

# @default -- `""` (defaults to global.priorityClassName)

1378

priorityClassName: ""

1379

# -- [Node selector]

1380

# @default -- `{}` (defaults to global.nodeSelector)

1381

nodeSelector: {}

1382

# -- [Tolerations] for use with node taints

1383

# @default -- `[]` (defaults to global.tolerations)

1384

tolerations: []

1385

# -- Assign custom [affinity] rules to the deployment

1386

# @default -- `{}` (defaults to global.affinity preset)

1387

affinity: {}

1388

# -- Assign custom [TopologySpreadConstraints] rules to dex

1389

# @default -- `[]` (defaults to global.topologySpreadConstraints)

1390

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1391

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

1392

topologySpreadConstraints: []

1393

# - maxSkew: 1

1394

# topologyKey: topology.kubernetes.io/zone

1395

# whenUnsatisfiable: DoNotSchedule

1396

1397

# -- Deployment strategy to be added to the Dex server Deployment

1398

deploymentStrategy: {}

1399

# type: RollingUpdate

1400

# rollingUpdate:

1401

# maxSurge: 25%

1402

# maxUnavailable: 25%

1403

1404

# Default Dex server's network policy

1405

networkPolicy:

1406

# -- Default network policy rules used by Dex server

1407

# @default -- `false` (defaults to global.networkPolicy.create)

1408

create: false

1409

# DEPRECATED - Use configs.params to override

1410

# -- Dex log format. Either `text` or `json`

1411

# @default -- `""` (defaults to global.logging.format)

1412

# logFormat: ""

1413

# -- Dex log level. One of: `debug`, `info`, `warn`, `error`

1414

# @default -- `""` (defaults to global.logging.level)

1415

# logLevel: ""

1416

## Redis

1417

redis:

1418

# -- Enable redis

1419

enabled: true

1420

# -- Redis name

1421

1422

# -- Runtime class name for redis

1423

# @default -- `""` (defaults to global.runtimeClassName)

1424

runtimeClassName: ""

1425

## Redis Pod Disruption Budget

1426

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1427

pdb:

1428

# -- Deploy a [PodDisruptionBudget] for the Redis

1429

enabled: false

1430

# -- Labels to be added to Redis pdb

1431

labels: {}

1432

# -- Annotations to be added to Redis pdb

1433

annotations: {}

1434

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1435

# @default -- `""` (defaults to 0 if not specified)

1436

minAvailable: ""

1437

# -- Number of pods that are unavailble after eviction as number or percentage (eg.: 50%).

1438

## Has higher precedence over `redis.pdb.minAvailable`

1439

maxUnavailable: ""

1440

# -- Policy for evicting unhealthy (not ready) pods, either `IfHealthyBudget` or `AlwaysAllow`

1441

## Defaults to `IfHealthyBudget` if not set

1442

unhealthyPodEvictionPolicy: ""

1443

## Redis Vertical Pod Autoscaler

1444

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1445

vpa:

1446

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Redis

1447

enabled: false

1448

# -- Labels to be added to Redis vpa

1449

labels: {}

1450

# -- Annotations to be added to Redis vpa

1451

annotations: {}

1452

# -- One of the VPA operation modes

1453

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1454

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

1455

updateMode: Initial

1456

# -- Controls how VPA computes the recommended resources for Redis container

1457

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

1458

containerPolicy: {}

1459

# controlledResources: ["cpu", "memory"]

1460

# minAllowed:

1461

# cpu: 250m

1462

# memory: 256Mi

1463

# maxAllowed:

1464

# cpu: 1

1465

# memory: 1Gi

1466

1467

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

1468

## NOTE: specify only zero or one recommender as of VPA 1.7.1

1469

recommenders: []

1470

1471

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

1472

startupBoost: {}

1473

# cpu:

1474

# type: Factor

1475

# factor: 2

1476

# durationSeconds: 10

1477

## Redis image

1478

image:

1479

# -- Redis repository

1480

repository: cgr.dev/chainguard-private/redis

1481

# -- Redis tag

1482

## Do not use 7.4.0 <= v < 8.0.0, otherwise you are no longer using an open source version of Redis

1483

tag: 8.10.1@sha256:570aa6fefcfdd3d9c1815b42329f739f59def73ea00b30818671eca56a91ead0

1484

# -- Redis image pull policy

1485

# @default -- `""` (defaults to global.image.imagePullPolicy)

1486

imagePullPolicy: ""

1487

## Prometheus redis-exporter sidecar

1488

exporter:

1489

# -- Enable Prometheus redis-exporter sidecar

1490

enabled: false

1491

# -- Environment variables to pass to the Redis exporter

1492

env: []

1493

## Prometheus redis-exporter image

1494

image:

1495

# -- Repository to use for the redis-exporter

1496

repository: cgr.dev/chainguard-private/prometheus-redis-exporter

1497

# -- Tag to use for the redis-exporter

1498

tag: 1.91.1@sha256:91fc89d162c491cc4d04e8a3e1acbfb1df00c438831eabb0df375317eb3306eb

1499

# -- Image pull policy for the redis-exporter

1500

# @default -- `""` (defaults to global.image.imagePullPolicy)

1501

imagePullPolicy: ""

1502

# -- Redis exporter security context

1503

# @default -- See [values.yaml]

1504

containerSecurityContext:

1505

runAsNonRoot: true

1506

readOnlyRootFilesystem: true

1507

allowPrivilegeEscalation: false

1508

seccompProfile:

1509

type: RuntimeDefault

1510

capabilities:

1511

drop:

1512

- ALL

1513

## Probes for Redis exporter (optional)

1514

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

1515

readinessProbe:

1516

# -- Enable Kubernetes liveness probe for Redis exporter (optional)

1517

enabled: false

1518

# -- Number of seconds after the container has started before [probe] is initiated

1519

initialDelaySeconds: 30

1520

# -- How often (in seconds) to perform the [probe]

1521

periodSeconds: 15

1522

# -- Number of seconds after which the [probe] times out

1523

timeoutSeconds: 15

1524

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1525

successThreshold: 1

1526

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1527

failureThreshold: 5

1528

livenessProbe:

1529

# -- Enable Kubernetes liveness probe for Redis exporter

1530

enabled: false

1531

# -- Number of seconds after the container has started before [probe] is initiated

1532

initialDelaySeconds: 30

1533

# -- How often (in seconds) to perform the [probe]

1534

periodSeconds: 15

1535

# -- Number of seconds after which the [probe] times out

1536

timeoutSeconds: 15

1537

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1538

successThreshold: 1

1539

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1540

failureThreshold: 5

1541

# -- Resource limits and requests for redis-exporter sidecar

1542

resources: {}

1543

# limits:

1544

# cpu: 50m

1545

# memory: 64Mi

1546

# requests:

1547

# cpu: 10m

1548

# memory: 32Mi

1549

# -- Secrets with credentials to pull images from a private registry

1550

# @default -- `[]` (defaults to global.imagePullSecrets)

1551

imagePullSecrets: []

1552

# -- Additional command line arguments to pass to redis-server

1553

extraArgs: []

1554

# - --bind

1555

# - "0.0.0.0"

1556

1557

# -- Environment variables to pass to the Redis server

1558

env: []

1559

# -- envFrom to pass to the Redis server

1560

# @default -- `[]` (See [values.yaml])

1561

envFrom: []

1562

# - configMapRef:

1563

# name: config-map-name

1564

# - secretRef:

1565

# name: secret-name

1566

1567

## Probes for Redis server (optional)

1568

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

1569

readinessProbe:

1570

# -- Enable Kubernetes liveness probe for Redis server

1571

enabled: false

1572

# -- Number of seconds after the container has started before [probe] is initiated

1573

initialDelaySeconds: 30

1574

# -- How often (in seconds) to perform the [probe]

1575

periodSeconds: 15

1576

# -- Number of seconds after which the [probe] times out

1577

timeoutSeconds: 15

1578

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1579

successThreshold: 1

1580

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1581

failureThreshold: 5

1582

livenessProbe:

1583

# -- Enable Kubernetes liveness probe for Redis server

1584

enabled: false

1585

# -- Number of seconds after the container has started before [probe] is initiated

1586

initialDelaySeconds: 30

1587

# -- How often (in seconds) to perform the [probe]

1588

periodSeconds: 15

1589

# -- Number of seconds after which the [probe] times out

1590

timeoutSeconds: 15

1591

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

1592

successThreshold: 1

1593

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

1594

failureThreshold: 5

1595

# -- Additional containers to be added to the redis pod

1596

## Note: Supports use of custom Helm templates

1597

extraContainers: []

1598

# -- Init containers to add to the redis pod

1599

## Note: Supports use of custom Helm templates

1600

initContainers: []

1601

# -- Additional volumeMounts to the redis container

1602

volumeMounts: []

1603

# -- Additional volumes to the redis pod

1604

volumes: []

1605

# -- Annotations to be added to the Redis server Deployment

1606

deploymentAnnotations: {}

1607

# -- Labels for the Redis server Deployment

1608

deploymentLabels: {}

1609

# -- Annotations to be added to the Redis server pods

1610

podAnnotations: {}

1611

# -- Labels to be added to the Redis server pods

1612

podLabels: {}

1613

# -- Resource limits and requests for redis

1614

resources: {}

1615

# limits:

1616

# cpu: 200m

1617

# memory: 128Mi

1618

# requests:

1619

# cpu: 100m

1620

# memory: 64Mi

1621

1622

# -- Redis pod-level security context

1623

# @default -- See [values.yaml]

1624

securityContext:

1625

runAsNonRoot: true

1626

runAsUser: 999

1627

seccompProfile:

1628

type: RuntimeDefault

1629

# Redis container ports

1630

containerPorts:

1631

# -- Redis container port

1632

redis: 6379

1633

# -- Metrics container port

1634

metrics: 9121

1635

# -- Host Network for redis pods

1636

hostNetwork: false

1637

# -- [DNS configuration]

1638

dnsConfig: {}

1639

# -- Alternative DNS policy for Redis server pods

1640

dnsPolicy: "ClusterFirst"

1641

# -- Redis container-level security context

1642

# @default -- See [values.yaml]

1643

containerSecurityContext:

1644

readOnlyRootFilesystem: true

1645

allowPrivilegeEscalation: false

1646

capabilities:

1647

drop:

1648

- ALL

1649

# -- Redis service port

1650

servicePort: 6379

1651

# -- Priority class for redis pods

1652

# @default -- `""` (defaults to global.priorityClassName)

1653

priorityClassName: ""

1654

# -- [Node selector]

1655

# @default -- `{}` (defaults to global.nodeSelector)

1656

nodeSelector: {}

1657

# -- [Tolerations] for use with node taints

1658

# @default -- `[]` (defaults to global.tolerations)

1659

tolerations: []

1660

# -- Assign custom [affinity] rules to the deployment

1661

# @default -- `{}` (defaults to global.affinity preset)

1662

affinity: {}

1663

# -- Assign custom [TopologySpreadConstraints] rules to redis

1664

# @default -- `[]` (defaults to global.topologySpreadConstraints)

1665

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1666

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

1667

topologySpreadConstraints: []

1668

# - maxSkew: 1

1669

# topologyKey: topology.kubernetes.io/zone

1670

# whenUnsatisfiable: DoNotSchedule

1671

1672

# -- terminationGracePeriodSeconds for container lifecycle hook

1673

terminationGracePeriodSeconds: 30

1674

# -- Automount API credentials for the Service Account into the pod.

1675

automountServiceAccountToken: true

1676

serviceAccount:

1677

# -- Create a service account for the redis pod

1678

create: false

1679

# -- Service account name for redis pod

1680

1681

# -- Annotations applied to created service account

1682

annotations: {}

1683

# -- Automount API credentials for the Service Account

1684

automountServiceAccountToken: false

1685

service:

1686

# -- Redis service annotations

1687

annotations: {}

1688

# -- Additional redis service labels

1689

labels: {}

1690

metrics:

1691

# -- Deploy metrics service

1692

enabled: false

1693

# Redis metrics service configuration

1694

service:

1695

# -- Metrics service type

1696

type: ClusterIP

1697

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

1698

clusterIP: None

1699

# -- Metrics service annotations

1700

annotations: {}

1701

# -- Metrics service labels

1702

labels: {}

1703

# -- Metrics service port

1704

servicePort: 9121

1705

# -- Metrics service port name

1706

portName: http-metrics

1707

serviceMonitor:

1708

# -- Enable a prometheus ServiceMonitor

1709

enabled: false

1710

# -- Interval at which metrics should be scraped

1711

interval: 30s

1712

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

1713

honorLabels: false

1714

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

1715

relabelings: []

1716

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

1717

metricRelabelings: []

1718

# -- Prometheus ServiceMonitor selector

1719

selector: {}

1720

# prometheus: kube-prometheus

1721

1722

# -- Prometheus ServiceMonitor scheme

1723

scheme: ""

1724

# -- Prometheus ServiceMonitor tlsConfig

1725

tlsConfig: {}

1726

# -- Prometheus ServiceMonitor namespace

1727

namespace: "" # "monitoring"

1728

# -- Prometheus ServiceMonitor labels

1729

additionalLabels: {}

1730

# -- Prometheus ServiceMonitor annotations

1731

annotations: {}

1732

# Default redis's network policy

1733

networkPolicy:

1734

# -- Default network policy rules used by redis

1735

# @default -- `false` (defaults to global.networkPolicy.create)

1736

create: false

1737

## Redis-HA subchart replaces custom redis deployment when `redis-ha.enabled=true`

1738

# Ref: https://github.com/DandyDeveloper/charts/blob/master/charts/redis-ha/values.yaml

1739

redis-ha:

1740

# -- Enables the Redis HA subchart and disables the custom Redis single node deployment

1741

enabled: false

1742

## Redis image

1743

image:

1744

# -- Redis repository

1745

repository: ecr-public.aws.com/docker/library/redis

1746

# -- Redis tag

1747

## Do not use 7.4.0 <= v < 8.0.0, otherwise you are no longer using an open source version of Redis

1748

## Runs ahead of the upstream HA manifests' pin: the redis 8.2.x line is only built on Alpine 3.22,

1749

## whose OpenSSL carries known vulnerabilities (GHSA-5p3w-hgjv-f6q3 report); 8.6.x is the patched base.

1750

tag: 8.6.4-alpine

1751

## Prometheus redis-exporter sidecar

1752

exporter:

1753

# -- Enable Prometheus redis-exporter sidecar

1754

enabled: false

1755

# -- Repository to use for the redis-exporter

1756

image: ghcr.io/oliver006/redis_exporter

1757

# -- Tag to use for the redis-exporter

1758

tag: v1.75.0

1759

persistentVolume:

1760

# -- Configures persistence on Redis nodes

1761

enabled: false

1762

## Redis specific configuration options

1763

redis:

1764

# -- Redis convention for naming the cluster group: must match `^[\\w-\\.]+$` and can be templated

1765

masterGroupName: argocd

1766

# -- Any valid redis config options in this section will be applied to each server (see `redis-ha` chart)

1767

# @default -- See [values.yaml]

1768

config:

1769

# -- Will save the DB if both the given number of seconds and the given number of write operations against the DB occurred. `""` is disabled

1770

# @default -- `'""'`

1771

save: '""'

1772

## Redis sentinel specific configuration options

1773

sentinel:

1774

# -- Sentinel container lifecycle hooks. The default `postStart` hook resets the sentinel state after a rolling update to prevent high CPU usage

1775

# @default -- See [values.yaml]

1776

lifecycle:

1777

postStart:

1778

exec:

1779

## Note: the reset command hardcodes the master group name `argocd`. If you override `redis-ha.redis.masterGroupName`, you must override this hook to match.

1780

command:

1781

- '/bin/sh'

1782

- '-c'

1783

- 'sleep 30; redis-cli -p 26379 sentinel reset argocd'

1784

## Enables a HA Proxy for better LoadBalancing / Sentinel Master support. Automatically proxies to Redis master.

1785

haproxy:

1786

# -- Enabled HAProxy LoadBalancing/Proxy

1787

enabled: true

1788

# -- Custom labels for the haproxy pod. This is relevant for Argo CD CLI.

1789

labels:

1790

app.kubernetes.io/name: argocd-redis-ha-haproxy

1791

image:

1792

# -- HAProxy Image Repository

1793

repository: ecr-public.aws.com/docker/library/haproxy

1794

metrics:

1795

# -- HAProxy enable prometheus metric scraping

1796

enabled: true

1797

# -- Whether the haproxy pods should be forced to run on separate nodes.

1798

hardAntiAffinity: true

1799

# -- Additional affinities to add to the haproxy pods.

1800

additionalAffinities: {}

1801

# -- Assign custom [affinity] rules to the haproxy pods.

1802

affinity: ""

1803

# -- [Tolerations] for use with node taints for haproxy pods.

1804

tolerations: []

1805

# -- HAProxy container-level security context

1806

# @default -- See [values.yaml]

1807

containerSecurityContext:

1808

readOnlyRootFilesystem: true

1809

# -- Configures redis-ha with AUTH

1810

auth: true

1811

# -- Existing Secret to use for redis-ha authentication.

1812

# By default the redis-secret-init Job is generating this Secret.

1813

existingSecret: argocd-redis

1814

# -- Whether the Redis server pods should be forced to run on separate nodes.

1815

hardAntiAffinity: true

1816

# -- Additional affinities to add to the Redis server pods.

1817

additionalAffinities: {}

1818

# -- Assign custom [affinity] rules to the Redis pods.

1819

affinity: ""

1820

# -- [Tolerations] for use with node taints for Redis pods.

1821

tolerations: []

1822

# -- Assign custom [TopologySpreadConstraints] rules to the Redis pods.

1823

## https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

1824

topologySpreadConstraints:

1825

# -- Enable Redis HA topology spread constraints

1826

enabled: false

1827

# -- Max skew of pods tolerated

1828

# @default -- `""` (defaults to `1`)

1829

maxSkew: ""

1830

# -- Topology key for spread

1831

# @default -- `""` (defaults to `topology.kubernetes.io/zone`)

1832

topologyKey: ""

1833

# -- Enforcement policy, hard or soft

1834

# @default -- `""` (defaults to `ScheduleAnyway`)

1835

whenUnsatisfiable: ""

1836

# -- Redis HA statefulset container-level security context

1837

# @default -- See [values.yaml]

1838

containerSecurityContext:

1839

readOnlyRootFilesystem: true

1840

# External Redis parameters

1841

externalRedis:

1842

# -- External Redis server host

1843

host: ""

1844

# -- External Redis username

1845

username: ""

1846

# -- External Redis password

1847

password: ""

1848

# -- External Redis server port

1849

port: 6379

1850

# -- The name of an existing secret with Redis (must contain key `redis-password`. And should contain `redis-username` if username is not `default`) and Sentinel credentials.

1851

# When it's set, the `externalRedis.username` and `externalRedis.password` parameters are ignored

1852

existingSecret: ""

1853

# -- External Redis Secret annotations

1854

secretAnnotations: {}

1855

redisSecretInit:

1856

# -- Enable Redis secret initialization. If disabled, secret must be provisioned by alternative methods

1857

enabled: true

1858

# -- Redis secret-init name

1859

1860

image:

1861

# -- Repository to use for the Redis secret-init Job

1862

# @default -- `""` (defaults to global.image.repository)

1863

repository: "" # defaults to global.image.repository

1864

# -- Tag to use for the Redis secret-init Job

1865

# @default -- `""` (defaults to global.image.tag)

1866

tag: "" # defaults to global.image.tag

1867

# -- Image pull policy for the Redis secret-init Job

1868

# @default -- `""` (defaults to global.image.imagePullPolicy)

1869

imagePullPolicy: "" # IfNotPresent

1870

# -- Additional command line arguments for the Redis secret-init Job

1871

extraArgs: []

1872

# -- Secrets with credentials to pull images from a private registry

1873

# @default -- `[]` (defaults to global.imagePullSecrets)

1874

imagePullSecrets: []

1875

# -- Runtime class name for the Redis secret-init Job

1876

# @default -- `""` (defaults to global.runtimeClassName)

1877

runtimeClassName: ""

1878

# -- Annotations to be added to the Redis secret-init Job

1879

jobAnnotations: {}

1880

# -- Annotations to be added to the Redis secret-init Job

1881

podAnnotations: {}

1882

# -- Labels to be added to the Redis secret-init Job

1883

podLabels: {}

1884

# -- Resource limits and requests for Redis secret-init Job

1885

resources: {}

1886

# limits:

1887

# cpu: 200m

1888

# memory: 128Mi

1889

# requests:

1890

# cpu: 100m

1891

# memory: 64Mi

1892

1893

# -- Application controller container-level security context

1894

# @default -- See [values.yaml]

1895

containerSecurityContext:

1896

allowPrivilegeEscalation: false

1897

capabilities:

1898

drop:

1899

- ALL

1900

readOnlyRootFilesystem: true

1901

runAsNonRoot: true

1902

seccompProfile:

1903

type: RuntimeDefault

1904

# -- Redis secret-init Job pod-level security context

1905

securityContext: {}

1906

serviceAccount:

1907

# -- Create a service account for the redis pod

1908

create: true

1909

# -- Service account name for redis pod

1910

1911

# -- Annotations applied to created service account

1912

annotations: {}

1913

# -- Automount API credentials for the Service Account

1914

automountServiceAccountToken: true

1915

# -- Priority class for Redis secret-init Job

1916

# @default -- `""` (defaults to global.priorityClassName)

1917

priorityClassName: ""

1918

# -- Host Network for redis-secret-init pods

1919

hostNetwork: false

1920

# -- [DNS configuration]

1921

dnsConfig: {}

1922

# -- Alternative DNS policy for Redis secret-init Job

1923

dnsPolicy: "ClusterFirst"

1924

# -- Assign custom [affinity] rules to the Redis secret-init Job

1925

affinity: {}

1926

# -- Node selector to be added to the Redis secret-init Job

1927

# @default -- `{}` (defaults to global.nodeSelector)

1928

nodeSelector: {}

1929

# -- Tolerations to be added to the Redis secret-init Job

1930

# @default -- `[]` (defaults to global.tolerations)

1931

tolerations: []

1932

## Server

1933

server:

1934

# -- Argo CD server name

1935

1936

# -- The number of server pods to run

1937

replicas: 1

1938

# -- Runtime class name for the Argo CD server

1939

# @default -- `""` (defaults to global.runtimeClassName)

1940

runtimeClassName: ""

1941

## Argo CD server Horizontal Pod Autoscaler

1942

autoscaling:

1943

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the Argo CD server

1944

enabled: false

1945

# -- Minimum number of replicas for the Argo CD server [HPA]

1946

minReplicas: 1

1947

# -- Maximum number of replicas for the Argo CD server [HPA]

1948

maxReplicas: 5

1949

# -- Average CPU utilization percentage for the Argo CD server [HPA]

1950

targetCPUUtilizationPercentage: 50

1951

# -- Average memory utilization percentage for the Argo CD server [HPA]

1952

targetMemoryUtilizationPercentage: 50

1953

# -- Configures the scaling behavior of the target in both Up and Down directions.

1954

behavior: {}

1955

# scaleDown:

1956

# stabilizationWindowSeconds: 300

1957

# policies:

1958

# - type: Pods

1959

# value: 1

1960

# periodSeconds: 180

1961

# scaleUp:

1962

# stabilizationWindowSeconds: 300

1963

# policies:

1964

# - type: Pods

1965

# value: 2

1966

# periodSeconds: 60

1967

# -- Configures custom HPA metrics for the Argo CD server

1968

# Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

1969

metrics: []

1970

## Argo CD server Pod Disruption Budget

1971

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

1972

pdb:

1973

# -- Deploy a [PodDisruptionBudget] for the Argo CD server

1974

enabled: false

1975

# -- Labels to be added to Argo CD server pdb

1976

labels: {}

1977

# -- Annotations to be added to Argo CD server pdb

1978

annotations: {}

1979

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

1980

# @default -- `""` (defaults to 0 if not specified)

1981

minAvailable: ""

1982

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

1983

## Has higher precedence over `server.pdb.minAvailable`

1984

maxUnavailable: ""

1985

# -- Policy for evicting unhealthy (not ready) pods, either `IfHealthyBudget` or `AlwaysAllow`

1986

## Defaults to `IfHealthyBudget` if not set

1987

unhealthyPodEvictionPolicy: ""

1988

## Argo CD server Vertical Pod Autoscaler

1989

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

1990

vpa:

1991

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the Argo CD server

1992

enabled: false

1993

# -- Labels to be added to Argo CD server vpa

1994

labels: {}

1995

# -- Annotations to be added to Argo CD server vpa

1996

annotations: {}

1997

# -- One of the VPA operation modes

1998

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

1999

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

2000

updateMode: Initial

2001

# -- Controls how VPA computes the recommended resources for Argo CD server container

2002

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

2003

containerPolicy: {}

2004

# controlledResources: ["cpu", "memory"]

2005

# minAllowed:

2006

# cpu: 250m

2007

# memory: 256Mi

2008

# maxAllowed:

2009

# cpu: 1

2010

# memory: 1Gi

2011

2012

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

2013

## NOTE: specify only zero or one recommender as of VPA 1.7.1

2014

recommenders: []

2015

2016

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

2017

startupBoost: {}

2018

# cpu:

2019

# type: Factor

2020

# factor: 2

2021

# durationSeconds: 10

2022

## Argo CD server image

2023

image:

2024

# -- Repository to use for the Argo CD server

2025

# @default -- `""` (defaults to global.image.repository)

2026

repository: "" # defaults to global.image.repository

2027

# -- Tag to use for the Argo CD server

2028

# @default -- `""` (defaults to global.image.tag)

2029

tag: "" # defaults to global.image.tag

2030

# -- Image pull policy for the Argo CD server

2031

# @default -- `""` (defaults to global.image.imagePullPolicy)

2032

imagePullPolicy: "" # IfNotPresent

2033

# -- Secrets with credentials to pull images from a private registry

2034

# @default -- `[]` (defaults to global.imagePullSecrets)

2035

imagePullSecrets: []

2036

# -- Additional command line arguments to pass to Argo CD server

2037

extraArgs: []

2038

# -- Environment variables to pass to Argo CD server

2039

env: []

2040

# -- envFrom to pass to Argo CD server

2041

# @default -- `[]` (See [values.yaml])

2042

envFrom: []

2043

# - configMapRef:

2044

# name: config-map-name

2045

# - secretRef:

2046

# name: secret-name

2047

2048

# -- Specify postStart and preStop lifecycle hooks for your argo-cd-server container

2049

lifecycle: {}

2050

## Argo CD extensions

2051

## This function in tech preview stage, do expect instability or breaking changes in newer versions.

2052

## Ref: https://github.com/argoproj-labs/argocd-extension-installer

2053

## When you enable extensions, you need to configure RBAC of logged in Argo CD user.

2054

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#the-extensions-resource

2055

extensions:

2056

# -- Enable support for Argo CD extensions

2057

enabled: false

2058

## Argo CD extension installer image

2059

image:

2060

# -- Repository to use for extension installer image

2061

repository: cgr.dev/chainguard-private/argocd-extension-installer

2062

# -- Tag to use for extension installer image

2063

tag: 1.1.0@sha256:231d8fbd90f4371f1a1e489687c7610d3144af8e7ffed58bed0e57ee8314804d

2064

# -- Image pull policy for extensions

2065

# @default -- `""` (defaults to global.image.imagePullPolicy)

2066

imagePullPolicy: ""

2067

# -- Extensions for Argo CD

2068

# @default -- `[]` (See [values.yaml])

2069

## Ref: https://github.com/argoproj-labs/argocd-extension-metrics#install-ui-extension

2070

extensionList: []

2071

# - name: extension-metrics

2072

# env:

2073

# - name: EXTENSION_URL

2074

# value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension.tar.gz

2075

# - name: EXTENSION_CHECKSUM_URL

2076

# value: https://github.com/argoproj-labs/argocd-extension-metrics/releases/download/v1.0.0/extension_checksums.txt

2077

2078

# -- Server UI extensions container-level security context

2079

# @default -- See [values.yaml]

2080

containerSecurityContext:

2081

runAsNonRoot: true

2082

readOnlyRootFilesystem: true

2083

allowPrivilegeEscalation: false

2084

runAsUser: 1000

2085

seccompProfile:

2086

type: RuntimeDefault

2087

capabilities:

2088

drop:

2089

- ALL

2090

# -- Resource limits and requests for the argocd-extensions container

2091

resources: {}

2092

# limits:

2093

# cpu: 50m

2094

# memory: 128Mi

2095

# requests:

2096

# cpu: 10m

2097

# memory: 64Mi

2098

# -- Additional containers to be added to the server pod

2099

## Note: Supports use of custom Helm templates

2100

extraContainers: []

2101

# - name: my-sidecar

2102

# image: nginx:latest

2103

# - name: lemonldap-ng-controller

2104

# image: lemonldapng/lemonldap-ng-controller:0.2.0

2105

# args:

2106

# - /lemonldap-ng-controller

2107

# - --alsologtostderr

2108

# - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration

2109

# env:

2110

# - name: POD_NAME

2111

# valueFrom:

2112

# fieldRef:

2113

# fieldPath: metadata.name

2114

# - name: POD_NAMESPACE

2115

# valueFrom:

2116

# fieldRef:

2117

# fieldPath: metadata.namespace

2118

# volumeMounts:

2119

# - name: copy-portal-skins

2120

# mountPath: /srv/var/lib/lemonldap-ng/portal/skins

2121

2122

# -- Init containers to add to the server pod

2123

## If your target Kubernetes cluster(s) require a custom credential (exec) plugin

2124

## you could use this (and the same in the application controller pod) to provide such executable

2125

## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

2126

initContainers: []

2127

# - name: download-tools

2128

# image: alpine:3

2129

# command: [sh, -c]

2130

# args:

2131

# - wget -qO /custom-tools/kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.2.7/kubelogin-linux-amd64.zip &&

2132

# mkdir /custom-tools/tmp && unzip -d /custom-tools/tmp /custom-tools/kubelogin.zip &&

2133

# mv /custom-tools/tmp/bin/linux_amd64/kubelogin /custom-tools/ && rm -rf custom-tools/tmp && rm /custom-tools/kubelogin.zip

2134

# volumeMounts:

2135

# - mountPath: /custom-tools

2136

# name: custom-tools

2137

2138

# -- Additional volumeMounts to the server main container

2139

volumeMounts: []

2140

# - mountPath: /usr/local/bin/kubelogin

2141

# name: custom-tools

2142

# subPath: kubelogin

2143

2144

# -- Additional volumes to the server pod

2145

volumes: []

2146

# - name: custom-tools

2147

# emptyDir: {}

2148

2149

## Argo CD server emptyDir volumes

2150

emptyDir:

2151

# -- EmptyDir size limit for the Argo CD server

2152

# @default -- `""` (defaults not set if not specified i.e. no size limit)

2153

sizeLimit: ""

2154

# sizeLimit: "1Gi"

2155

# -- Annotations to be added to server Deployment

2156

deploymentAnnotations: {}

2157

# -- Labels for the server Deployment

2158

deploymentLabels: {}

2159

# -- Annotations to be added to server pods

2160

podAnnotations: {}

2161

# -- Labels to be added to server pods

2162

podLabels: {}

2163

# -- Resource limits and requests for the Argo CD server

2164

resources: {}

2165

# limits:

2166

# cpu: 100m

2167

# memory: 128Mi

2168

# requests:

2169

# cpu: 50m

2170

# memory: 64Mi

2171

2172

# Server container ports

2173

containerPorts:

2174

# -- Server container port

2175

server: 8080

2176

# -- Metrics container port

2177

metrics: 8083

2178

# -- Host Network for Server pods

2179

hostNetwork: false

2180

# -- [DNS configuration]

2181

dnsConfig: {}

2182

# -- Alternative DNS policy for Server pods

2183

dnsPolicy: "ClusterFirst"

2184

# -- Server container-level security context

2185

# @default -- See [values.yaml]

2186

containerSecurityContext:

2187

runAsNonRoot: true

2188

readOnlyRootFilesystem: true

2189

allowPrivilegeEscalation: false

2190

seccompProfile:

2191

type: RuntimeDefault

2192

capabilities:

2193

drop:

2194

- ALL

2195

## Readiness and liveness probes for default backend

2196

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2197

readinessProbe:

2198

# -- Enable Kubernetes readiness probe for default backend

2199

enabled: true

2200

# -- Http path to use for the readiness probe

2201

httpPath: /healthz

2202

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2203

failureThreshold: 3

2204

# -- Number of seconds after the container has started before [probe] is initiated

2205

initialDelaySeconds: 10

2206

# -- How often (in seconds) to perform the [probe]

2207

periodSeconds: 10

2208

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2209

successThreshold: 1

2210

# -- Number of seconds after which the [probe] times out

2211

timeoutSeconds: 1

2212

livenessProbe:

2213

# -- Enable Kubernetes liveness probe for default backend

2214

enabled: true

2215

# -- Http path to use for the liveness probe

2216

httpPath: /healthz?full=true

2217

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2218

failureThreshold: 3

2219

# -- Number of seconds after the container has started before [probe] is initiated

2220

initialDelaySeconds: 10

2221

# -- How often (in seconds) to perform the [probe]

2222

periodSeconds: 10

2223

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2224

successThreshold: 1

2225

# -- Number of seconds after which the [probe] times out

2226

timeoutSeconds: 1

2227

## Startup probe for Argo CD server (optional)

2228

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

2229

startupProbe:

2230

# -- Enable Kubernetes startup probe for Argo CD server

2231

enabled: false

2232

# -- Http path to use for the startup probe

2233

httpPath: /healthz

2234

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

2235

failureThreshold: 20

2236

# -- Number of seconds after the container has started before [probe] is initiated

2237

initialDelaySeconds: 10

2238

# -- How often (in seconds) to perform the [probe]

2239

periodSeconds: 10

2240

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

2241

successThreshold: 1

2242

# -- Number of seconds after which the [probe] times out

2243

timeoutSeconds: 1

2244

# -- terminationGracePeriodSeconds for container lifecycle hook

2245

terminationGracePeriodSeconds: 30

2246

# -- Priority class for the Argo CD server pods

2247

# @default -- `""` (defaults to global.priorityClassName)

2248

priorityClassName: ""

2249

# -- [Node selector]

2250

# @default -- `{}` (defaults to global.nodeSelector)

2251

nodeSelector: {}

2252

# -- [Tolerations] for use with node taints

2253

# @default -- `[]` (defaults to global.tolerations)

2254

tolerations: []

2255

# -- Assign custom [affinity] rules to the deployment

2256

# @default -- `{}` (defaults to global.affinity preset)

2257

affinity: {}

2258

# -- Assign custom [TopologySpreadConstraints] rules to the Argo CD server

2259

# @default -- `[]` (defaults to global.topologySpreadConstraints)

2260

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

2261

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

2262

topologySpreadConstraints: []

2263

# - maxSkew: 1

2264

# topologyKey: topology.kubernetes.io/zone

2265

# whenUnsatisfiable: DoNotSchedule

2266

2267

# -- Deployment strategy to be added to the server Deployment

2268

deploymentStrategy: {}

2269

# type: RollingUpdate

2270

# rollingUpdate:

2271

# maxSurge: 25%

2272

# maxUnavailable: 25%

2273

2274

# TLS certificate configuration via cert-manager

2275

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server

2276

certificate:

2277

# -- Deploy a Certificate resource (requires cert-manager)

2278

enabled: false

2279

# -- Certificate primary domain (commonName)

2280

# @default -- `""` (defaults to global.domain)

2281

domain: ""

2282

# -- Certificate Subject Alternate Names (SANs)

2283

additionalHosts: []

2284

# -- The requested 'duration' (i.e. lifetime) of the certificate.

2285

# @default -- `""` (defaults to 2160h = 90d if not specified)

2286

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

2287

duration: ""

2288

# -- How long before the expiry a certificate should be renewed.

2289

# @default -- `""` (defaults to 360h = 15d if not specified)

2290

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

2291

renewBefore: ""

2292

# Certificate issuer

2293

## Ref: https://cert-manager.io/docs/concepts/issuer

2294

issuer:

2295

# -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io`

2296

group: ""

2297

# -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer`

2298

kind: ""

2299

# -- Certificate issuer name. Eg. `letsencrypt`

2300

2301

# Private key of the certificate

2302

privateKey:

2303

# -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always`

2304

rotationPolicy: Never

2305

# -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8`

2306

encoding: PKCS1

2307

# -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA`

2308

algorithm: RSA

2309

# -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored.

2310

size: 2048

2311

# -- Annotations to be applied to the Server Certificate

2312

annotations: {}

2313

# -- Usages for the certificate

2314

### Ref: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.KeyUsage

2315

usages: []

2316

# -- Annotations that allow the certificate to be composed from data residing in existing Kubernetes Resources

2317

secretTemplateAnnotations: {}

2318

# TLS certificate configuration via Secret

2319

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-certificates-used-by-argocd-server

2320

certificateSecret:

2321

# -- Create argocd-server-tls secret

2322

enabled: false

2323

# -- Annotations to be added to argocd-server-tls secret

2324

annotations: {}

2325

# -- Labels to be added to argocd-server-tls secret

2326

labels: {}

2327

# -- Private Key of the certificate

2328

key: ""

2329

# -- Certificate data

2330

crt: ""

2331

## Server service configuration

2332

service:

2333

# -- Server service annotations

2334

annotations: {}

2335

# -- Server service labels

2336

labels: {}

2337

# -- Server service type

2338

type: ClusterIP

2339

# -- Server service http port for NodePort service type (only if `server.service.type` is set to "NodePort")

2340

nodePortHttp: 30080

2341

# -- (int) Server service http2 port for NodePort service type (only if `server.service.servicePortHttp2` is set and `server.service.type` is set to "NodePort")

2342

# @default -- `nil` (a random node port is assigned)

2343

nodePortHttp2:

2344

# -- Server service https port for NodePort service type (only if `server.service.type` is set to "NodePort")

2345

nodePortHttps: 30443

2346

# -- Server service http port

2347

servicePortHttp: 80

2348

# -- (int) Server service cleartext http2 (h2c) port, targeting the same container port as `servicePortHttp`

2349

# @default -- `nil` (disabled)

2350

## The Argo CD server serves the web UI (HTTP/1.1) and gRPC (HTTP/2) on a single container port, and

2351

## `appProtocol` is single-valued per service port. Set this to expose a second port advertising the

2352

## h2c backend protocol, for Gateway API implementations that do not infer it from the route type.

2353

## Leave empty to disable. Only rendered when `configs.params."server.insecure"` is `true`, since

2354

## h2c is not applicable to a TLS backend.

2355

servicePortHttp2:

2356

# -- Server service https port

2357

servicePortHttps: 443

2358

# -- Server service http port name, can be used to route traffic via istio

2359

servicePortHttpName: http

2360

# -- Server service http2 port name, can be used to route traffic via istio

2361

servicePortHttp2Name: http2

2362

# -- Server service https port name, can be used to route traffic via istio

2363

servicePortHttpsName: https

2364

# -- Server service http2 port appProtocol, e.g. `kubernetes.io/h2c`. Implementations that select the

2365

# protocol from the port name instead do not need it

2366

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol

2367

servicePortHttp2AppProtocol: ""

2368

# -- Server service https port appProtocol

2369

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol

2370

servicePortHttpsAppProtocol: ""

2371

# -- The class of the load balancer implementation

2372

loadBalancerClass: ""

2373

# -- LoadBalancer will get created with the IP specified in this field

2374

loadBalancerIP: ""

2375

# -- Source IP ranges to allow access to service from

2376

## EKS Ref: https://repost.aws/knowledge-center/eks-cidr-ip-address-loadbalancer

2377

## GKE Ref: https://cloud.google.com/kubernetes-engine/docs/concepts/network-overview#limit-connectivity-ext-lb

2378

loadBalancerSourceRanges: []

2379

# -- Server service external IPs

2380

externalIPs: []

2381

# -- Denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints

2382

## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

2383

externalTrafficPolicy: Cluster

2384

# -- Used to maintain session affinity. Supports `ClientIP` and `None`

2385

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies

2386

sessionAffinity: None

2387

## Server metrics service configuration

2388

metrics:

2389

# -- Deploy metrics service

2390

enabled: false

2391

service:

2392

# -- Metrics service type

2393

type: ClusterIP

2394

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

2395

clusterIP: ""

2396

# -- Metrics service annotations

2397

annotations: {}

2398

# -- Metrics service labels

2399

labels: {}

2400

# -- Metrics service port

2401

servicePort: 8083

2402

# -- Metrics service port name

2403

portName: http-metrics

2404

serviceMonitor:

2405

# -- Enable a prometheus ServiceMonitor

2406

enabled: false

2407

# -- Prometheus ServiceMonitor interval

2408

interval: 30s

2409

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

2410

scrapeTimeout: ""

2411

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

2412

honorLabels: false

2413

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

2414

relabelings: []

2415

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

2416

metricRelabelings: []

2417

# -- Prometheus ServiceMonitor selector

2418

selector: {}

2419

# prometheus: kube-prometheus

2420

2421

# -- Prometheus ServiceMonitor scheme

2422

scheme: ""

2423

# -- Prometheus ServiceMonitor tlsConfig

2424

tlsConfig: {}

2425

# -- Prometheus ServiceMonitor namespace

2426

namespace: "" # monitoring

2427

# -- Prometheus ServiceMonitor labels

2428

additionalLabels: {}

2429

# -- Prometheus ServiceMonitor annotations

2430

annotations: {}

2431

# -- Automount API credentials for the Service Account into the pod.

2432

automountServiceAccountToken: true

2433

serviceAccount:

2434

# -- Create server service account

2435

create: true

2436

# -- Server service account name

2437

2438

# -- Annotations applied to created service account

2439

annotations: {}

2440

# -- Labels applied to created service account

2441

labels: {}

2442

# -- Automount API credentials for the Service Account

2443

automountServiceAccountToken: true

2444

# Argo CD server ingress configuration

2445

ingress:

2446

# -- Enable an ingress resource for the Argo CD server

2447

enabled: false

2448

# -- Specific implementation for ingress controller. One of `generic`, `aws` or `gke`

2449

## Additional configuration might be required in related configuration sections

2450

controller: generic

2451

# -- Additional ingress labels

2452

labels: {}

2453

# -- Additional ingress annotations

2454

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-1-ssl-passthrough

2455

annotations: {}

2456

# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"

2457

# nginx.ingress.kubernetes.io/ssl-passthrough: "true"

2458

2459

# -- Defines which ingress controller will implement the resource

2460

ingressClassName: ""

2461

# -- Argo CD server hostname

2462

# @default -- `""` (defaults to global.domain)

2463

hostname: ""

2464

# -- The path to Argo CD server

2465

path: /

2466

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

2467

pathType: Prefix

2468

# -- Enable TLS configuration for the hostname defined at `server.ingress.hostname`

2469

## TLS certificate will be retrieved from a TLS secret `argocd-server-tls`

2470

## You can create this secret via `certificate` or `certificateSecret` option

2471

tls: false

2472

# -- The list of additional hostnames to be covered by ingress record

2473

# @default -- `[]` (See [values.yaml])

2474

extraHosts: []

2475

# - name: argocd.example.com

2476

# path: /

2477

2478

# -- Additional ingress paths

2479

# @default -- `[]` (See [values.yaml])

2480

## Note: Supports use of custom Helm templates

2481

extraPaths: []

2482

# - path: /*

2483

# pathType: Prefix

2484

# backend:

2485

# service:

2486

# name: ssl-redirect

2487

# port:

2488

# name: use-annotation

2489

2490

# -- Additional ingress rules

2491

# @default -- `[]` (See [values.yaml])

2492

## Note: Supports use of custom Helm templates

2493

extraRules: []

2494

# - http:

2495

# paths:

2496

# - path: /

2497

# pathType: Prefix

2498

# backend:

2499

# service:

2500

# name: '{{ include "argo-cd.server.fullname" . }}'

2501

# port:

2502

# name: '{{ .Values.server.service.servicePortHttpsName }}'

2503

2504

# -- Additional TLS configuration

2505

# @default -- `[]` (See [values.yaml])

2506

extraTls: []

2507

# - hosts:

2508

# - argocd.example.com

2509

# secretName: your-certificate-name

2510

2511

# AWS specific options for Application Load Balancer

2512

# Applies only when `serv.ingress.controller` is set to `aws`

2513

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#aws-application-load-balancers-albs-and-classic-elb-http-mode

2514

aws:

2515

# -- Backend protocol version for the AWS ALB gRPC service

2516

## This tells AWS to send traffic from the ALB using gRPC.

2517

## For more information: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/target-group-health-checks.html#health-check-settings

2518

backendProtocolVersion: GRPC

2519

# -- Service type for the AWS ALB gRPC service

2520

## Can be of type NodePort or ClusterIP depending on which mode you are running.

2521

## Instance mode needs type NodePort, IP mode needs type ClusterIP

2522

## Ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/how-it-works/#ingress-traffic

2523

serviceType: NodePort

2524

# -- Annotations for the AWS ALB gRPC service

2525

## Allows adding custom annotations to the gRPC service for integrations like DataDog, Prometheus, etc.

2526

serviceAnnotations: {}

2527

# Google specific options for Google Application Load Balancer

2528

# Applies only when `server.ingress.controller` is set to `gke`

2529

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#google-cloud-load-balancers-with-kubernetes-ingress

2530

gke:

2531

# -- Google [BackendConfig] resource, for use with the GKE Ingress Controller

2532

# @default -- `{}` (See [values.yaml])

2533

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

2534

backendConfig: {}

2535

# iap:

2536

# enabled: true

2537

# oauthclientCredentials:

2538

# secretName: argocd-secret

2539

2540

# -- Google [FrontendConfig] resource, for use with the GKE Ingress Controller

2541

# @default -- `{}` (See [values.yaml])

2542

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/ingress-features#configuring_ingress_features_through_frontendconfig_parameters

2543

frontendConfig: {}

2544

# redirectToHttps:

2545

# enabled: true

2546

# responseCodeName: RESPONSE_CODE

2547

2548

# Managed GKE certificate for ingress hostname

2549

managedCertificate:

2550

# -- Create ManagedCertificate resource and annotations for Google Load balancer

2551

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs

2552

create: true

2553

# -- Additional domains for ManagedCertificate resource

2554

extraDomains: []

2555

# - argocd.example.com

2556

# Dedicated gRPC ingress for ingress controllers that supports only single backend protocol per Ingress resource

2557

# Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#option-2-multiple-ingress-objects-and-hosts

2558

ingressGrpc:

2559

# -- Enable an ingress resource for the Argo CD server for dedicated [gRPC-ingress]

2560

enabled: false

2561

# -- Additional ingress annotations for dedicated [gRPC-ingress]

2562

annotations: {}

2563

# -- Additional ingress labels for dedicated [gRPC-ingress]

2564

labels: {}

2565

# -- Defines which ingress controller will implement the resource [gRPC-ingress]

2566

ingressClassName: ""

2567

# -- Argo CD server hostname for dedicated [gRPC-ingress]

2568

# @default -- `""` (defaults to grpc.`server.ingress.hostname`)

2569

hostname: ""

2570

# -- Argo CD server ingress path for dedicated [gRPC-ingress]

2571

path: /

2572

# -- Ingress path type for dedicated [gRPC-ingress]. One of `Exact`, `Prefix` or `ImplementationSpecific`

2573

pathType: Prefix

2574

# -- Enable TLS configuration for the hostname defined at `server.ingressGrpc.hostname`

2575

## TLS certificate will be retrieved from a TLS secret with name: `argocd-server-grpc-tls`

2576

tls: false

2577

# -- The list of additional hostnames to be covered by ingress record

2578

# @default -- `[]` (See [values.yaml])

2579

extraHosts: []

2580

# - name: grpc.argocd.example.com

2581

# path: /

2582

2583

# -- Additional ingress paths for dedicated [gRPC-ingress]

2584

# @default -- `[]` (See [values.yaml])

2585

## Note: Supports use of custom Helm templates

2586

extraPaths: []

2587

# - path: /*

2588

# pathType: Prefix

2589

# backend:

2590

# service:

2591

# name: ssl-redirect

2592

# port:

2593

# name: use-annotation

2594

2595

# -- Additional ingress rules

2596

# @default -- `[]` (See [values.yaml])

2597

## Note: Supports use of custom Helm templates

2598

extraRules: []

2599

# - http:

2600

# paths:

2601

# - path: /

2602

# pathType: Prefix

2603

# backend:

2604

# service:

2605

# name: '{{ include "argo-cd.server.fullname" . }}'

2606

# port:

2607

# name: '{{ .Values.server.service.servicePortHttpName }}'

2608

2609

# -- Additional TLS configuration for dedicated [gRPC-ingress]

2610

# @default -- `[]` (See [values.yaml])

2611

extraTls: []

2612

# - secretName: your-certificate-name

2613

# hosts:

2614

# - argocd.example.com

2615

# Create a OpenShift Route with SSL passthrough for UI and CLI

2616

# Consider setting 'hostname' e.g. https://argocd.apps-crc.testing/ using your Default Ingress Controller Domain

2617

# Find your domain with: kubectl describe --namespace=openshift-ingress-operator ingresscontroller/default | grep Domain:

2618

# If 'hostname' is an empty string "" OpenShift will create a hostname for you.

2619

route:

2620

# -- Enable an OpenShift Route for the Argo CD server

2621

enabled: false

2622

# -- Openshift Route annotations

2623

annotations: {}

2624

# -- Hostname of OpenShift Route

2625

hostname: ""

2626

# -- Termination type of Openshift Route

2627

termination_type: passthrough

2628

# -- Termination policy of Openshift Route

2629

termination_policy: None

2630

# Gateway API HTTPRoute configuration

2631

# NOTE: Gateway API support is in EXPERIMENTAL status

2632

# Support depends on your Gateway controller implementation

2633

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

2634

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

2635

httproute:

2636

# -- Enable HTTPRoute resource for Argo CD server (Gateway API)

2637

enabled: false

2638

# -- Additional HTTPRoute labels

2639

labels: {}

2640

# -- Additional HTTPRoute annotations

2641

annotations: {}

2642

# -- Gateway API parentRefs for the HTTPRoute

2643

## Must reference an existing Gateway

2644

# @default -- `[]` (See [values.yaml])

2645

parentRefs: []

2646

# - name: example-gateway

2647

# namespace: example-gateway-namespace

2648

# sectionName: https

2649

# -- List of hostnames for the HTTPRoute

2650

# @default -- `[]` (See [values.yaml])

2651

hostnames: []

2652

# - argocd.example.com

2653

# -- HTTPRoute rules configuration

2654

# @default -- `[]` (See [values.yaml])

2655

rules:

2656

- matches:

2657

- path:

2658

type: PathPrefix

2659

value: /

2660

# filters: []

2661

# - type: RequestHeaderModifier

2662

# requestHeaderModifier:

2663

# add:

2664

# - name: X-Custom-Header

2665

# value: custom-value

2666

# timeouts:

2667

# request: 10s

2668

# backendRequest: 2s

2669

# Gateway API GRPCRoute configuration

2670

# NOTE: Gateway API support is in EXPERIMENTAL status

2671

# Support depends on your Gateway controller implementation

2672

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

2673

grpcroute:

2674

# -- Enable GRPCRoute resource for Argo CD server (Gateway API)

2675

enabled: false

2676

# -- Additional GRPCRoute labels

2677

labels: {}

2678

# -- Additional GRPCRoute annotations

2679

annotations: {}

2680

# -- Gateway API parentRefs for the GRPCRoute

2681

## Must reference an existing Gateway

2682

# @default -- `[]` (See [values.yaml])

2683

parentRefs: []

2684

# - name: example-gateway

2685

# namespace: example-gateway-namespace

2686

# sectionName: grpc

2687

# -- List of hostnames for the GRPCRoute

2688

# @default -- `[]` (See [values.yaml])

2689

hostnames: []

2690

# - grpc.argocd.example.com

2691

# -- GRPCRoute rules configuration

2692

# @default -- `[]` (See [values.yaml])

2693

rules:

2694

- matches:

2695

- method:

2696

type: Exact

2697

# filters: []

2698

# - type: RequestHeaderModifier

2699

# requestHeaderModifier:

2700

# add:

2701

# - name: X-Custom-Header

2702

# value: custom-value

2703

# Gateway API BackendTLSPolicy configuration

2704

# NOTE: BackendTLSPolicy support is in EXPERIMENTAL status

2705

# Required for HTTPS backends when using Gateway API

2706

# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)

2707

backendTLSPolicy:

2708

# -- Enable BackendTLSPolicy resource for Argo CD server (Gateway API)

2709

enabled: false

2710

# -- Additional BackendTLSPolicy labels

2711

labels: {}

2712

# -- Additional BackendTLSPolicy annotations

2713

annotations: {}

2714

# -- Target references for the BackendTLSPolicy

2715

# @default -- `[]` (See [values.yaml])

2716

targetRefs: []

2717

# - group: ""

2718

# kind: Service

2719

# name: argocd-server

2720

# sectionName: https

2721

# -- TLS validation configuration

2722

# @default -- `{}` (See [values.yaml])

2723

validation: {}

2724

# hostname: argocd-server.argocd.svc.cluster.local

2725

# caCertificateRefs:

2726

# - name: example-ca-cert

2727

# group: ""

2728

# kind: ConfigMap

2729

# wellKnownCACertificates: System

2730

# Gateway API ListenerSet configuration

2731

# NOTE: Gateway API support is in EXPERIMENTAL status

2732

# ListenerSet allows attaching additional listeners to an existing Gateway

2733

# Requires Gateway API v1alpha2 and a controller that supports ListenerSet

2734

# Refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.ListenerSet

2735

listenerset:

2736

# -- Enable ListenerSet resource for Argo CD server (Gateway API)

2737

enabled: false

2738

# -- Additional ListenerSet labels

2739

labels: {}

2740

# -- Additional ListenerSet annotations

2741

annotations: {}

2742

# -- Gateway API parentRef for the ListenerSet

2743

## Must reference an existing Gateway. Unlike HTTPRoute, ListenerSet accepts exactly one parentRef.

2744

# @default -- `{}` (See [values.yaml])

2745

parentRef: {}

2746

# name: example-gateway

2747

# namespace: example-gateway-namespace

2748

# -- Hostname for the synthesized listener. Defaults to global.domain when empty.

2749

hostname: ""

2750

# -- Name of the synthesized listener. Also used as sectionName in auto-derived httproute parentRefs.

2751

listenerName: https

2752

# -- Port for the synthesized listener

2753

port: 443

2754

# -- Protocol for the synthesized listener

2755

protocol: HTTPS

2756

# -- TLS configuration for the synthesized listener

2757

tls:

2758

# -- Enable TLS on the synthesized listener

2759

enabled: true

2760

# -- TLS termination mode

2761

mode: Terminate

2762

# -- Secret name for TLS certificate. Defaults to `argocd-server-tls` when empty.

2763

secretName: ""

2764

# -- allowedRoutes for the synthesized listener

2765

allowedRoutes:

2766

namespaces:

2767

from: Same

2768

# -- Listeners to attach to the parent Gateway. When non-empty, used verbatim and all synthesized listener fields above are ignored.

2769

# @default -- `[]` (See [values.yaml])

2770

listeners: []

2771

# - name: https

2772

# port: 443

2773

# protocol: HTTPS

2774

# hostname: argocd.example.com

2775

# tls:

2776

# mode: Terminate

2777

# certificateRefs:

2778

# - group: ""

2779

# kind: Secret

2780

# name: argocd-server-tls

2781

# allowedRoutes:

2782

# namespaces:

2783

# from: Same

2784

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

2785

## Defaults to off

2786

clusterRoleRules:

2787

# -- Enable custom rules for the server's ClusterRole resource

2788

enabled: false

2789

# -- List of custom rules for the server's ClusterRole resource

2790

rules: []

2791

# Default ArgoCD Server's network policy

2792

networkPolicy:

2793

# -- Default network policy rules used by ArgoCD Server

2794

# @default -- `false` (defaults to global.networkPolicy.create)

2795

create: false

2796

## Repo Server

2797

repoServer:

2798

# -- Repo server name

2799

2800

# -- The number of repo server pods to run

2801

replicas: 1

2802

# -- Runtime class name for the repo server

2803

# @default -- `""` (defaults to global.runtimeClassName)

2804

runtimeClassName: ""

2805

## Repo server Horizontal Pod Autoscaler

2806

autoscaling:

2807

# -- Enable Horizontal Pod Autoscaler ([HPA]) for the repo server

2808

enabled: false

2809

# -- Minimum number of replicas for the repo server [HPA]

2810

minReplicas: 1

2811

# -- Maximum number of replicas for the repo server [HPA]

2812

maxReplicas: 5

2813

# -- Average CPU utilization percentage for the repo server [HPA]

2814

targetCPUUtilizationPercentage: 50

2815

# -- Average memory utilization percentage for the repo server [HPA]

2816

targetMemoryUtilizationPercentage: 50

2817

# -- Configures the scaling behavior of the target in both Up and Down directions.

2818

behavior: {}

2819

# scaleDown:

2820

# stabilizationWindowSeconds: 300

2821

# policies:

2822

# - type: Pods

2823

# value: 1

2824

# periodSeconds: 180

2825

# scaleUp:

2826

# stabilizationWindowSeconds: 300

2827

# policies:

2828

# - type: Pods

2829

# value: 2

2830

# periodSeconds: 60

2831

# -- Configures custom HPA metrics for the Argo CD repo server

2832

# Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

2833

metrics: []

2834

## Repo server Pod Disruption Budget

2835

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

2836

pdb:

2837

# -- Deploy a [PodDisruptionBudget] for the repo server

2838

enabled: false

2839

# -- Labels to be added to repo server pdb

2840

labels: {}

2841

# -- Annotations to be added to repo server pdb

2842

annotations: {}

2843

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

2844

# @default -- `""` (defaults to 0 if not specified)

2845

minAvailable: ""

2846

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

2847

## Has higher precedence over `repoServer.pdb.minAvailable`

2848

maxUnavailable: ""

2849

# -- Policy for evicting unhealthy (not ready) pods, either `IfHealthyBudget` or `AlwaysAllow`

2850

## Defaults to `IfHealthyBudget` if not set

2851

unhealthyPodEvictionPolicy: ""

2852

## Repo server Vertical Pod Autoscaler

2853

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

2854

vpa:

2855

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the repo server

2856

enabled: false

2857

# -- Labels to be added to repo server vpa

2858

labels: {}

2859

# -- Annotations to be added to repo server vpa

2860

annotations: {}

2861

# -- One of the VPA operation modes

2862

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

2863

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

2864

updateMode: Initial

2865

# -- Controls how VPA computes the recommended resources for repo server container

2866

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

2867

containerPolicy: {}

2868

# controlledResources: ["cpu", "memory"]

2869

# minAllowed:

2870

# cpu: 250m

2871

# memory: 256Mi

2872

# maxAllowed:

2873

# cpu: 1

2874

# memory: 1Gi

2875

2876

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

2877

## NOTE: specify only zero or one recommender as of VPA 1.7.1

2878

recommenders: []

2879

2880

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

2881

startupBoost: {}

2882

# cpu:

2883

# type: Factor

2884

# factor: 2

2885

# durationSeconds: 10

2886

## Repo server image

2887

image:

2888

# -- Repository to use for the repo server

2889

# @default -- `""` (defaults to global.image.repository)

2890

repository: ""

2891

# -- Tag to use for the repo server

2892

# @default -- `""` (defaults to global.image.tag)

2893

tag: ""

2894

# -- Image pull policy for the repo server

2895

# @default -- `""` (defaults to global.image.imagePullPolicy)

2896

imagePullPolicy: ""

2897

# -- Secrets with credentials to pull images from a private registry

2898

# @default -- `[]` (defaults to global.imagePullSecrets)

2899

imagePullSecrets: []

2900

# -- Additional command line arguments to pass to repo server

2901

extraArgs: []

2902

# -- Environment variables to pass to repo server

2903

env: []

2904

# -- envFrom to pass to repo server

2905

# @default -- `[]` (See [values.yaml])

2906

envFrom: []

2907

# - configMapRef:

2908

# name: config-map-name

2909

# - secretRef:

2910

# name: secret-name

2911

2912

# -- Specify postStart and preStop lifecycle hooks for your argo-repo-server container

2913

lifecycle: {}

2914

# -- Additional containers to be added to the repo server pod

2915

## Ref: https://argo-cd.readthedocs.io/en/stable/user-guide/config-management-plugins/

2916

## Note: Supports use of custom Helm templates

2917

extraContainers: []

2918

# - name: cmp-my-plugin

2919

# command:

2920

# - "/var/run/argocd/argocd-cmp-server"

2921

# image: busybox

2922

# securityContext:

2923

# runAsNonRoot: true

2924

# runAsUser: 999

2925

# volumeMounts:

2926

# - mountPath: /var/run/argocd

2927

# name: var-files

2928

# - mountPath: /home/argocd/cmp-server/plugins

2929

# name: plugins

2930

# # Remove this volumeMount if you've chosen to bake the config file into the sidecar image.

2931

# - mountPath: /home/argocd/cmp-server/config/plugin.yaml

2932

# subPath: my-plugin.yaml

2933

# name: argocd-cmp-cm

2934

# # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps

2935

# # mitigate path traversal attacks.

2936

# - mountPath: /tmp

2937

# name: cmp-tmp

2938

# - name: cmp-my-plugin2

2939

# command:

2940

# - "/var/run/argocd/argocd-cmp-server"

2941

# image: busybox

2942

# securityContext:

2943

# runAsNonRoot: true

2944

# runAsUser: 999

2945

# volumeMounts:

2946

# - mountPath: /var/run/argocd

2947

# name: var-files

2948

# # Remove this volumeMount if you've chosen to bake the config file into the sidecar image.

2949

# - mountPath: /home/argocd/cmp-server/plugins

2950

# name: plugins

2951

# - mountPath: /home/argocd/cmp-server/config/plugin.yaml

2952

# subPath: my-plugin2.yaml

2953

# name: argocd-cmp-cm

2954

# # Starting with v2.4, do NOT mount the same tmp volume as the repo-server container. The filesystem separation helps

2955

# # mitigate path traversal attacks.

2956

# - mountPath: /tmp

2957

# name: cmp-tmp

2958

2959

# -- Init containers to add to the repo server pods

2960

initContainers: []

2961

copyutil:

2962

# -- Extra arguments for the cp command in the repo server copyutil initContainer

2963

# @default -- `"--update=none"`

2964

extraArgs: "--update=none"

2965

# -- Resource limits and requests for the repo server copyutil initContainer

2966

resources: {}

2967

# limits:

2968

# cpu: 100m

2969

# memory: 128Mi

2970

# requests:

2971

# cpu: 50m

2972

# memory: 64Mi

2973

# -- Additional volumeMounts to the repo server main container

2974

volumeMounts: []

2975

# -- Additional volumes to the repo server pod

2976

volumes: []

2977

# - name: argocd-cmp-cm

2978

# configMap:

2979

# name: argocd-cmp-cm

2980

# - name: cmp-tmp

2981

# emptyDir: {}

2982

2983

# -- Volumes to be used in replacement of emptydir on default volumes

2984

existingVolumes: {}

2985

# gpgKeyring:

2986

# persistentVolumeClaim:

2987

# claimName: pvc-argocd-repo-server-keyring

2988

# helmWorkingDir:

2989

# persistentVolumeClaim:

2990

# claimName: pvc-argocd-repo-server-workdir

2991

# tmp:

2992

# persistentVolumeClaim:

2993

# claimName: pvc-argocd-repo-server-tmp

2994

# varFiles:

2995

# persistentVolumeClaim:

2996

# claimName: pvc-argocd-repo-server-varfiles

2997

# plugins:

2998

# persistentVolumeClaim:

2999

# claimName: pvc-argocd-repo-server-plugins

3000

3001

## RepoServer emptyDir volumes

3002

emptyDir:

3003

# -- EmptyDir size limit for repo server

3004

# @default -- `""` (defaults not set if not specified i.e. no size limit)

3005

sizeLimit: ""

3006

# sizeLimit: "1Gi"

3007

# -- Toggle the usage of a ephemeral Helm working directory

3008

useEphemeralHelmWorkingDir: true

3009

# -- Annotations to be added to repo server Deployment

3010

deploymentAnnotations: {}

3011

# -- Labels for the repo server Deployment

3012

deploymentLabels: {}

3013

# -- Annotations to be added to repo server pods

3014

podAnnotations: {}

3015

# -- Labels to be added to repo server pods

3016

podLabels: {}

3017

# -- Resource limits and requests for the repo server pods

3018

resources: {}

3019

# limits:

3020

# cpu: 50m

3021

# memory: 128Mi

3022

# requests:

3023

# cpu: 10m

3024

# memory: 64Mi

3025

3026

# Repo server container ports

3027

containerPorts:

3028

# -- Repo server container port

3029

server: 8081

3030

# -- Metrics container port

3031

metrics: 8084

3032

# -- Host Network for Repo server pods

3033

hostNetwork: false

3034

# -- [DNS configuration]

3035

dnsConfig: {}

3036

# -- Alternative DNS policy for Repo server pods

3037

dnsPolicy: "ClusterFirst"

3038

# -- Repo server container-level security context

3039

# @default -- See [values.yaml]

3040

containerSecurityContext:

3041

runAsNonRoot: true

3042

readOnlyRootFilesystem: true

3043

allowPrivilegeEscalation: false

3044

seccompProfile:

3045

type: RuntimeDefault

3046

capabilities:

3047

drop:

3048

- ALL

3049

## Readiness and liveness probes for Repo Server

3050

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3051

readinessProbe:

3052

# -- Enable Kubernetes readiness probe for Repo Server

3053

enabled: true

3054

# -- Http path to use for the readiness probe

3055

httpPath: /healthz

3056

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3057

failureThreshold: 3

3058

# -- Number of seconds after the container has started before [probe] is initiated

3059

initialDelaySeconds: 10

3060

# -- How often (in seconds) to perform the [probe]

3061

periodSeconds: 10

3062

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3063

successThreshold: 1

3064

# -- Number of seconds after which the [probe] times out

3065

timeoutSeconds: 1

3066

livenessProbe:

3067

# -- Enable Kubernetes liveness probe for Repo Server

3068

enabled: true

3069

# -- Http path to use for the liveness probe

3070

httpPath: /healthz?full=true

3071

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3072

failureThreshold: 3

3073

# -- Number of seconds after the container has started before [probe] is initiated

3074

initialDelaySeconds: 10

3075

# -- How often (in seconds) to perform the [probe]

3076

periodSeconds: 10

3077

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3078

successThreshold: 1

3079

# -- Number of seconds after which the [probe] times out

3080

timeoutSeconds: 1

3081

## Startup probe for Repo Server (optional)

3082

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3083

startupProbe:

3084

# -- Enable Kubernetes startup probe for Repo Server

3085

enabled: false

3086

# -- Http path to use for the startup probe

3087

httpPath: /healthz

3088

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3089

failureThreshold: 20

3090

# -- Number of seconds after the container has started before [probe] is initiated

3091

initialDelaySeconds: 10

3092

# -- How often (in seconds) to perform the [probe]

3093

periodSeconds: 10

3094

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3095

successThreshold: 1

3096

# -- Number of seconds after which the [probe] times out

3097

timeoutSeconds: 1

3098

# -- terminationGracePeriodSeconds for container lifecycle hook

3099

terminationGracePeriodSeconds: 30

3100

# -- [Node selector]

3101

# @default -- `{}` (defaults to global.nodeSelector)

3102

nodeSelector: {}

3103

# -- [Tolerations] for use with node taints

3104

# @default -- `[]` (defaults to global.tolerations)

3105

tolerations: []

3106

# -- Assign custom [affinity] rules to the deployment

3107

# @default -- `{}` (defaults to global.affinity preset)

3108

affinity: {}

3109

# -- Assign custom [TopologySpreadConstraints] rules to the repo server

3110

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3111

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

3112

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3113

topologySpreadConstraints: []

3114

# - maxSkew: 1

3115

# topologyKey: topology.kubernetes.io/zone

3116

# whenUnsatisfiable: DoNotSchedule

3117

3118

# -- Deployment strategy to be added to the repo server Deployment

3119

deploymentStrategy: {}

3120

# type: RollingUpdate

3121

# rollingUpdate:

3122

# maxSurge: 25%

3123

# maxUnavailable: 25%

3124

3125

# -- Priority class for the repo server pods

3126

# @default -- `""` (defaults to global.priorityClassName)

3127

priorityClassName: ""

3128

# TLS certificate configuration via Secret

3129

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#configuring-tls-to-argocd-repo-server

3130

## Note: Issuing certificates via cert-manager in not supported right now because it's not possible to restart repo server automatically without extra controllers.

3131

certificateSecret:

3132

# -- Create argocd-repo-server-tls secret

3133

enabled: false

3134

# -- Annotations to be added to argocd-repo-server-tls secret

3135

annotations: {}

3136

# -- Labels to be added to argocd-repo-server-tls secret

3137

labels: {}

3138

# -- Certificate authority. Required for self-signed certificates.

3139

ca: ""

3140

# -- Certificate private key

3141

key: ""

3142

# -- Certificate data. Must contain SANs of Repo service (ie: argocd-repo-server, argocd-repo-server.argo-cd.svc)

3143

crt: ""

3144

## Repo server service configuration

3145

service:

3146

# -- Repo server service annotations

3147

annotations: {}

3148

# -- Repo server service labels

3149

labels: {}

3150

# -- Repo server service port

3151

port: 8081

3152

# -- Repo server service port name

3153

portName: tcp-repo-server

3154

# -- Traffic distribution preference for the repo server service. If the field is not set, the implementation will apply its default routing strategy.

3155

trafficDistribution: ""

3156

## Repo server metrics service configuration

3157

metrics:

3158

# -- Deploy metrics service

3159

enabled: false

3160

service:

3161

# -- Metrics service type

3162

type: ClusterIP

3163

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3164

clusterIP: ""

3165

# -- Metrics service annotations

3166

annotations: {}

3167

# -- Metrics service labels

3168

labels: {}

3169

# -- Metrics service port

3170

servicePort: 8084

3171

# -- Metrics service port name

3172

portName: http-metrics

3173

serviceMonitor:

3174

# -- Enable a prometheus ServiceMonitor

3175

enabled: false

3176

# -- Prometheus ServiceMonitor interval

3177

interval: 30s

3178

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

3179

scrapeTimeout: ""

3180

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3181

honorLabels: false

3182

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3183

relabelings: []

3184

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3185

metricRelabelings: []

3186

# -- Prometheus ServiceMonitor selector

3187

selector: {}

3188

# prometheus: kube-prometheus

3189

3190

# -- Prometheus ServiceMonitor scheme

3191

scheme: ""

3192

# -- Prometheus ServiceMonitor tlsConfig

3193

tlsConfig: {}

3194

# -- Prometheus ServiceMonitor namespace

3195

namespace: "" # "monitoring"

3196

# -- Prometheus ServiceMonitor labels

3197

additionalLabels: {}

3198

# -- Prometheus ServiceMonitor annotations

3199

annotations: {}

3200

## Enable Custom Rules for the Repo server's Cluster Role resource

3201

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

3202

## Defaults to off

3203

clusterRoleRules:

3204

# -- Enable custom rules for the Repo server's Cluster Role resource

3205

enabled: false

3206

# -- List of custom rules for the Repo server's Cluster Role resource

3207

rules: []

3208

# -- Automount API credentials for the Service Account into the pod.

3209

automountServiceAccountToken: true

3210

## Repo server service account

3211

## If create is set to true, make sure to uncomment the name and update the rbac section below

3212

serviceAccount:

3213

# -- Create repo server service account

3214

create: true

3215

# -- Repo server service account name

3216

3217

# -- Annotations applied to created service account

3218

annotations: {}

3219

# -- Labels applied to created service account

3220

labels: {}

3221

# -- Automount API credentials for the Service Account

3222

automountServiceAccountToken: true

3223

# -- Repo server rbac rules

3224

rbac: []

3225

# - apiGroups:

3226

# - argoproj.io

3227

# resources:

3228

# - applications

3229

# verbs:

3230

# - get

3231

# - list

3232

# - watch

3233

3234

# Default repo server's network policy

3235

networkPolicy:

3236

# -- Default network policy rules used by repo server

3237

# @default -- `false` (defaults to global.networkPolicy.create)

3238

create: false

3239

## ApplicationSet controller

3240

applicationSet:

3241

# -- ApplicationSet controller name string

3242

3243

# -- The number of ApplicationSet controller pods to run

3244

replicas: 1

3245

# -- Runtime class name for the ApplicationSet controller

3246

# @default -- `""` (defaults to global.runtimeClassName)

3247

runtimeClassName: ""

3248

## ApplicationSet controller Pod Disruption Budget

3249

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

3250

pdb:

3251

# -- Deploy a [PodDisruptionBudget] for the ApplicationSet controller

3252

enabled: false

3253

# -- Labels to be added to ApplicationSet controller pdb

3254

labels: {}

3255

# -- Annotations to be added to ApplicationSet controller pdb

3256

annotations: {}

3257

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

3258

# @default -- `""` (defaults to 0 if not specified)

3259

minAvailable: ""

3260

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

3261

## Has higher precedence over `applicationSet.pdb.minAvailable`

3262

maxUnavailable: ""

3263

# -- Policy for evicting unhealthy (not ready) pods, either `IfHealthyBudget` or `AlwaysAllow`

3264

## Defaults to `IfHealthyBudget` if not set

3265

unhealthyPodEvictionPolicy: ""

3266

## ApplicationSet controller Vertical Pod Autoscaler

3267

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

3268

vpa:

3269

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the ApplicationSet controller

3270

enabled: false

3271

# -- Labels to be added to ApplicationSet controller vpa

3272

labels: {}

3273

# -- Annotations to be added to ApplicationSet controller vpa

3274

annotations: {}

3275

# -- One of the VPA operation modes

3276

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

3277

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

3278

updateMode: Initial

3279

# -- Controls how VPA computes the recommended resources for ApplicationSet controller container

3280

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

3281

containerPolicy: {}

3282

# controlledResources: ["cpu", "memory"]

3283

# minAllowed:

3284

# cpu: 250m

3285

# memory: 256Mi

3286

# maxAllowed:

3287

# cpu: 1

3288

# memory: 1Gi

3289

3290

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

3291

## NOTE: specify only zero or one recommender as of VPA 1.7.1

3292

recommenders: []

3293

3294

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

3295

startupBoost: {}

3296

# cpu:

3297

# type: Factor

3298

# factor: 2

3299

# durationSeconds: 10

3300

## ApplicationSet controller image

3301

image:

3302

# -- Repository to use for the ApplicationSet controller

3303

# @default -- `""` (defaults to global.image.repository)

3304

repository: ""

3305

# -- Tag to use for the ApplicationSet controller

3306

# @default -- `""` (defaults to global.image.tag)

3307

tag: ""

3308

# -- Image pull policy for the ApplicationSet controller

3309

# @default -- `""` (defaults to global.image.imagePullPolicy)

3310

imagePullPolicy: ""

3311

# -- If defined, uses a Secret to pull an image from a private Docker registry or repository.

3312

# @default -- `[]` (defaults to global.imagePullSecrets)

3313

imagePullSecrets: []

3314

# -- ApplicationSet controller command line flags

3315

extraArgs: []

3316

# -- Environment variables to pass to the ApplicationSet controller

3317

extraEnv: []

3318

# - name: "MY_VAR"

3319

# value: "value"

3320

3321

# -- envFrom to pass to the ApplicationSet controller

3322

# @default -- `[]` (See [values.yaml])

3323

extraEnvFrom: []

3324

# - configMapRef:

3325

# name: config-map-name

3326

# - secretRef:

3327

# name: secret-name

3328

3329

# -- Additional containers to be added to the ApplicationSet controller pod

3330

## Note: Supports use of custom Helm templates

3331

extraContainers: []

3332

# -- Init containers to add to the ApplicationSet controller pod

3333

## Note: Supports use of custom Helm templates

3334

initContainers: []

3335

# -- List of extra mounts to add (normally used with extraVolumes)

3336

extraVolumeMounts: []

3337

# -- List of extra volumes to add

3338

extraVolumes: []

3339

## ApplicationSet controller emptyDir volumes

3340

emptyDir:

3341

# -- EmptyDir size limit for applicationSet controller

3342

# @default -- `""` (defaults not set if not specified i.e. no size limit)

3343

sizeLimit: ""

3344

# sizeLimit: "1Gi"

3345

## Metrics service configuration

3346

metrics:

3347

# -- Deploy metrics service

3348

enabled: false

3349

service:

3350

# -- Metrics service type

3351

type: ClusterIP

3352

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3353

clusterIP: ""

3354

# -- Metrics service annotations

3355

annotations: {}

3356

# -- Metrics service labels

3357

labels: {}

3358

# -- Metrics service port

3359

servicePort: 8080

3360

# -- Metrics service port name

3361

portName: http-metrics

3362

serviceMonitor:

3363

# -- Enable a prometheus ServiceMonitor

3364

enabled: false

3365

# -- Prometheus ServiceMonitor interval

3366

interval: 30s

3367

# -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

3368

scrapeTimeout: ""

3369

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3370

honorLabels: false

3371

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3372

relabelings: []

3373

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3374

metricRelabelings: []

3375

# -- Prometheus ServiceMonitor selector

3376

selector: {}

3377

# prometheus: kube-prometheus

3378

3379

# -- Prometheus ServiceMonitor scheme

3380

scheme: ""

3381

# -- Prometheus ServiceMonitor tlsConfig

3382

tlsConfig: {}

3383

# -- Prometheus ServiceMonitor namespace

3384

namespace: "" # monitoring

3385

# -- Prometheus ServiceMonitor labels

3386

additionalLabels: {}

3387

# -- Prometheus ServiceMonitor annotations

3388

annotations: {}

3389

## ApplicationSet service configuration

3390

service:

3391

# -- ApplicationSet service annotations

3392

annotations: {}

3393

# -- ApplicationSet service labels

3394

labels: {}

3395

# -- ApplicationSet service type

3396

type: ClusterIP

3397

# -- ApplicationSet service port

3398

port: 7000

3399

# -- ApplicationSet service port name

3400

portName: http-webhook

3401

# -- Automount API credentials for the Service Account into the pod.

3402

automountServiceAccountToken: true

3403

serviceAccount:

3404

# -- Create ApplicationSet controller service account

3405

create: true

3406

# -- ApplicationSet controller service account name

3407

3408

# -- Annotations applied to created service account

3409

annotations: {}

3410

# -- Labels applied to created service account

3411

labels: {}

3412

# -- Automount API credentials for the Service Account

3413

automountServiceAccountToken: true

3414

# -- Annotations to be added to ApplicationSet controller Deployment

3415

deploymentAnnotations: {}

3416

# -- Labels for the ApplicationSet controller Deployment

3417

deploymentLabels: {}

3418

# -- Annotations for the ApplicationSet controller pods

3419

podAnnotations: {}

3420

# -- Labels for the ApplicationSet controller pods

3421

podLabels: {}

3422

# -- Resource limits and requests for the ApplicationSet controller pods.

3423

resources: {}

3424

# limits:

3425

# cpu: 100m

3426

# memory: 128Mi

3427

# requests:

3428

# cpu: 100m

3429

# memory: 128Mi

3430

3431

# ApplicationSet controller container ports

3432

containerPorts:

3433

# -- Metrics container port

3434

metrics: 8080

3435

# -- Probe container port

3436

probe: 8081

3437

# -- Webhook container port

3438

webhook: 7000

3439

# -- [DNS configuration]

3440

dnsConfig: {}

3441

# -- Alternative DNS policy for ApplicationSet controller pods

3442

dnsPolicy: "ClusterFirst"

3443

# -- ApplicationSet controller container-level security context

3444

# @default -- See [values.yaml]

3445

containerSecurityContext:

3446

runAsNonRoot: true

3447

readOnlyRootFilesystem: true

3448

allowPrivilegeEscalation: false

3449

seccompProfile:

3450

type: RuntimeDefault

3451

capabilities:

3452

drop:

3453

- ALL

3454

## Probes for ApplicationSet controller (optional)

3455

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3456

readinessProbe:

3457

# -- Enable Kubernetes liveness probe for ApplicationSet controller

3458

enabled: false

3459

# -- Number of seconds after the container has started before [probe] is initiated

3460

initialDelaySeconds: 10

3461

# -- How often (in seconds) to perform the [probe]

3462

periodSeconds: 10

3463

# -- Number of seconds after which the [probe] times out

3464

timeoutSeconds: 1

3465

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3466

successThreshold: 1

3467

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3468

failureThreshold: 3

3469

livenessProbe:

3470

# -- Enable Kubernetes liveness probe for ApplicationSet controller

3471

enabled: false

3472

# -- Number of seconds after the container has started before [probe] is initiated

3473

initialDelaySeconds: 10

3474

# -- How often (in seconds) to perform the [probe]

3475

periodSeconds: 10

3476

# -- Number of seconds after which the [probe] times out

3477

timeoutSeconds: 1

3478

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3479

successThreshold: 1

3480

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3481

failureThreshold: 3

3482

## Startup probe for ApplicationSet controller (optional)

3483

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3484

startupProbe:

3485

# -- Enable Kubernetes startup probe for ApplicationSet controller

3486

enabled: false

3487

# -- Number of seconds after the container has started before [probe] is initiated

3488

initialDelaySeconds: 10

3489

# -- How often (in seconds) to perform the [probe]

3490

periodSeconds: 10

3491

# -- Number of seconds after which the [probe] times out

3492

timeoutSeconds: 1

3493

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3494

successThreshold: 1

3495

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3496

failureThreshold: 20

3497

# -- terminationGracePeriodSeconds for container lifecycle hook

3498

terminationGracePeriodSeconds: 30

3499

# -- [Node selector]

3500

# @default -- `{}` (defaults to global.nodeSelector)

3501

nodeSelector: {}

3502

# -- [Tolerations] for use with node taints

3503

# @default -- `[]` (defaults to global.tolerations)

3504

tolerations: []

3505

# -- Assign custom [affinity] rules

3506

# @default -- `{}` (defaults to global.affinity preset)

3507

affinity: {}

3508

# -- Assign custom [TopologySpreadConstraints] rules to the ApplicationSet controller

3509

# @default -- `[]` (defaults to global.topologySpreadConstraints)

3510

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

3511

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

3512

topologySpreadConstraints: []

3513

# - maxSkew: 1

3514

# topologyKey: topology.kubernetes.io/zone

3515

# whenUnsatisfiable: DoNotSchedule

3516

3517

# -- Deployment strategy to be added to the ApplicationSet controller Deployment

3518

deploymentStrategy: {}

3519

# type: RollingUpdate

3520

# rollingUpdate:

3521

# maxSurge: 25%

3522

# maxUnavailable: 25%

3523

3524

# -- Priority class for the ApplicationSet controller pods

3525

# @default -- `""` (defaults to global.priorityClassName)

3526

priorityClassName: ""

3527

# TLS certificate configuration via cert-manager

3528

## Ref: https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/#tls-configuration

3529

certificate:

3530

# -- Deploy a Certificate resource (requires cert-manager)

3531

enabled: false

3532

# -- Certificate primary domain (commonName)

3533

# @default -- `""` (defaults to global.domain)

3534

domain: ""

3535

# -- Certificate Subject Alternate Names (SANs)

3536

additionalHosts: []

3537

# -- The requested 'duration' (i.e. lifetime) of the certificate.

3538

# @default -- `""` (defaults to 2160h = 90d if not specified)

3539

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

3540

duration: ""

3541

# -- How long before the expiry a certificate should be renewed.

3542

# @default -- `""` (defaults to 360h = 15d if not specified)

3543

## Ref: https://cert-manager.io/docs/usage/certificate/#renewal

3544

renewBefore: ""

3545

# Certificate issuer

3546

## Ref: https://cert-manager.io/docs/concepts/issuer

3547

issuer:

3548

# -- Certificate issuer group. Set if using an external issuer. Eg. `cert-manager.io`

3549

group: ""

3550

# -- Certificate issuer kind. Either `Issuer` or `ClusterIssuer`

3551

kind: ""

3552

# -- Certificate issuer name. Eg. `letsencrypt`

3553

3554

# Private key of the certificate

3555

privateKey:

3556

# -- Rotation policy of private key when certificate is re-issued. Either: `Never` or `Always`

3557

rotationPolicy: Never

3558

# -- The private key cryptography standards (PKCS) encoding for private key. Either: `PCKS1` or `PKCS8`

3559

encoding: PKCS1

3560

# -- Algorithm used to generate certificate private key. One of: `RSA`, `Ed25519` or `ECDSA`

3561

algorithm: RSA

3562

# -- Key bit size of the private key. If algorithm is set to `Ed25519`, size is ignored.

3563

size: 2048

3564

# -- Annotations to be applied to the ApplicationSet Certificate

3565

annotations: {}

3566

## Ingress for the Git Generator webhook

3567

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration)

3568

ingress:

3569

# -- Enable an ingress resource for ApplicationSet webhook

3570

enabled: false

3571

# -- Additional ingress labels

3572

labels: {}

3573

# -- Additional ingress annotations

3574

annotations: {}

3575

# -- Defines which ingress ApplicationSet controller will implement the resource

3576

ingressClassName: ""

3577

# -- Argo CD ApplicationSet hostname

3578

# @default -- `""` (defaults to global.domain)

3579

hostname: ""

3580

# -- List of ingress paths

3581

path: /api/webhook

3582

# -- Ingress path type. One of `Exact`, `Prefix` or `ImplementationSpecific`

3583

pathType: Prefix

3584

# -- Enable TLS configuration for the hostname defined at `applicationSet.webhook.ingress.hostname`

3585

## TLS certificate will be retrieved from a TLS secret with name:`argocd-applicationset-controller-tls`

3586

tls: false

3587

# -- The list of additional hostnames to be covered by ingress record

3588

# @default -- `[]` (See [values.yaml])

3589

extraHosts: []

3590

# - name: argocd.example.com

3591

# path: /

3592

3593

# -- Additional ingress paths

3594

# @default -- `[]` (See [values.yaml])

3595

extraPaths: []

3596

# - path: /*

3597

# pathType: Prefix

3598

# backend:

3599

# service:

3600

# name: ssl-redirect

3601

# port:

3602

# name: use-annotation

3603

3604

# -- Additional ingress rules

3605

# @default -- `[]` (See [values.yaml])

3606

## Note: Supports use of custom Helm templates

3607

extraRules: []

3608

# - http:

3609

# paths:

3610

# - path: /api/webhook

3611

# pathType: Prefix

3612

# backend:

3613

# service:

3614

# name: '{{ include "argo-cd.applicationSet.fullname" . }}'

3615

# port:

3616

# name: '{{ .Values.applicationSet.service.portName }}'

3617

3618

# -- Additional ingress TLS configuration

3619

# @default -- `[]` (See [values.yaml])

3620

extraTls: []

3621

# - secretName: argocd-applicationset-tls

3622

# hosts:

3623

# - argocd-applicationset.example.com

3624

## Gateway API HTTPRoute for the Git Generator webhook

3625

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration)

3626

# NOTE: Gateway API support is in EXPERIMENTAL status

3627

# Support depends on your Gateway controller implementation

3628

# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)

3629

# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details

3630

httproute:

3631

# -- Enable HTTPRoute resource for Argo CD Applicationset Webhook (Gateway API)

3632

enabled: false

3633

# -- Additional HTTPRoute labels

3634

labels: {}

3635

# -- Additional HTTPRoute annotations

3636

annotations: {}

3637

# -- Gateway API parentRefs for the HTTPRoute

3638

## Must reference an existing Gateway

3639

# @default -- `[]` (See [values.yaml])

3640

parentRefs: []

3641

# - name: example-gateway

3642

# namespace: example-gateway-namespace

3643

# sectionName: https

3644

# -- List of hostnames for the HTTPRoute

3645

# @default -- `[]` (See [values.yaml])

3646

hostnames: []

3647

# - argocd.example.com

3648

# -- HTTPRoute rules configuration

3649

# @default -- `[]` (See [values.yaml])

3650

rules:

3651

- matches:

3652

- path:

3653

type: PathPrefix

3654

value: /api/webhook

3655

# filters: []

3656

# - type: RequestHeaderModifier

3657

# requestHeaderModifier:

3658

# add:

3659

# - name: X-Custom-Header

3660

# value: custom-value

3661

# Gateway API ListenerSet configuration for the Git Generator webhook

3662

## Ref: https://argocd-applicationset.readthedocs.io/en/master/Generators-Git/#webhook-configuration

3663

# NOTE: Gateway API support is in EXPERIMENTAL status

3664

# ListenerSet allows attaching additional listeners to an existing Gateway

3665

# Requires Gateway API v1alpha2 and a controller that supports ListenerSet

3666

# Refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1alpha2.ListenerSet

3667

listenerset:

3668

# -- Enable ListenerSet resource for Argo CD ApplicationSet webhook (Gateway API)

3669

enabled: false

3670

# -- Additional ListenerSet labels

3671

labels: {}

3672

# -- Additional ListenerSet annotations

3673

annotations: {}

3674

# -- Gateway API parentRef for the ListenerSet

3675

## Must reference an existing Gateway. Unlike HTTPRoute, ListenerSet accepts exactly one parentRef.

3676

# @default -- `{}` (See [values.yaml])

3677

parentRef: {}

3678

# name: example-gateway

3679

# namespace: example-gateway-namespace

3680

# -- Hostname for the synthesized listener. Defaults to global.domain when empty.

3681

hostname: ""

3682

# -- Name of the synthesized listener. Also used as sectionName in auto-derived httproute parentRefs.

3683

listenerName: https

3684

# -- Port for the synthesized listener

3685

port: 443

3686

# -- Protocol for the synthesized listener

3687

protocol: HTTPS

3688

# -- TLS configuration for the synthesized listener

3689

tls:

3690

# -- Enable TLS on the synthesized listener

3691

enabled: true

3692

# -- TLS termination mode

3693

mode: Terminate

3694

# -- Secret name for TLS certificate. Defaults to `argocd-applicationset-controller-tls` when empty.

3695

secretName: ""

3696

# -- allowedRoutes for the synthesized listener

3697

allowedRoutes:

3698

namespaces:

3699

from: Same

3700

# -- Listeners to attach to the parent Gateway. When non-empty, used verbatim and all synthesized listener fields above are ignored.

3701

# @default -- `[]` (See [values.yaml])

3702

listeners: []

3703

# - name: https

3704

# port: 443

3705

# protocol: HTTPS

3706

# hostname: argocd.example.com

3707

# tls:

3708

# mode: Terminate

3709

# certificateRefs:

3710

# - group: ""

3711

# kind: Secret

3712

# name: argocd-applicationset-controller-tls

3713

# allowedRoutes:

3714

# namespaces:

3715

# from: Same

3716

# -- Enable ApplicationSet in any namespace feature

3717

allowAnyNamespace: false

3718

# Default ApplicationSet controller's network policy

3719

networkPolicy:

3720

# -- Default network policy rules used by ApplicationSet controller

3721

# @default -- `false` (defaults to global.networkPolicy.create)

3722

create: false

3723

## Notifications controller

3724

notifications:

3725

# -- Enable notifications controller

3726

enabled: true

3727

# -- Notifications controller name string

3728

3729

# -- Argo CD dashboard url; used in place of {{.context.argocdUrl}} in templates

3730

# @default -- `""` (defaults to https://`global.domain`)

3731

argocdUrl: ""

3732

# -- Runtime class name for the notifications controller

3733

# @default -- `""` (defaults to global.runtimeClassName)

3734

runtimeClassName: ""

3735

## Notifications controller Pod Disruption Budget

3736

## Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/

3737

pdb:

3738

# -- Deploy a [PodDisruptionBudget] for the notifications controller

3739

enabled: false

3740

# -- Labels to be added to notifications controller pdb

3741

labels: {}

3742

# -- Annotations to be added to notifications controller pdb

3743

annotations: {}

3744

# -- Number of pods that are available after eviction as number or percentage (eg.: 50%)

3745

# @default -- `""` (defaults to 0 if not specified)

3746

minAvailable: ""

3747

# -- Number of pods that are unavailable after eviction as number or percentage (eg.: 50%).

3748

## Has higher precedence over `notifications.pdb.minAvailable`

3749

maxUnavailable: ""

3750

# -- Policy for evicting unhealthy (not ready) pods, either `IfHealthyBudget` or `AlwaysAllow`

3751

## Defaults to `IfHealthyBudget` if not set

3752

unhealthyPodEvictionPolicy: ""

3753

## Notifications controller Vertical Pod Autoscaler

3754

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

3755

vpa:

3756

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the notifications controller

3757

enabled: false

3758

# -- Labels to be added to notifications controller vpa

3759

labels: {}

3760

# -- Annotations to be added to notifications controller vpa

3761

annotations: {}

3762

# -- One of the VPA operation modes

3763

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

3764

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

3765

updateMode: Initial

3766

# -- Controls how VPA computes the recommended resources for notifications controller container

3767

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

3768

containerPolicy: {}

3769

# controlledResources: ["cpu", "memory"]

3770

# minAllowed:

3771

# cpu: 250m

3772

# memory: 256Mi

3773

# maxAllowed:

3774

# cpu: 1

3775

# memory: 1Gi

3776

3777

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

3778

## NOTE: specify only zero or one recommender as of VPA 1.7.1

3779

recommenders: []

3780

3781

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

3782

startupBoost: {}

3783

# cpu:

3784

# type: Factor

3785

# factor: 2

3786

# durationSeconds: 10

3787

## Notifications controller image

3788

image:

3789

# -- Repository to use for the notifications controller

3790

# @default -- `""` (defaults to global.image.repository)

3791

repository: ""

3792

# -- Tag to use for the notifications controller

3793

# @default -- `""` (defaults to global.image.tag)

3794

tag: ""

3795

# -- Image pull policy for the notifications controller

3796

# @default -- `""` (defaults to global.image.imagePullPolicy)

3797

imagePullPolicy: ""

3798

# -- Secrets with credentials to pull images from a private registry

3799

# @default -- `[]` (defaults to global.imagePullSecrets)

3800

imagePullSecrets: []

3801

# DEPRECATED - Use configs.params to override

3802

# -- Notifications controller log format. Either `text` or `json`

3803

# @default -- `""` (defaults to global.logging.format)

3804

# logFormat: ""

3805

# -- Notifications controller log level. One of: `debug`, `info`, `warn`, `error`

3806

# @default -- `""` (defaults to global.logging.level)

3807

# logLevel: ""

3808

3809

# -- Extra arguments to provide to the notifications controller

3810

extraArgs: []

3811

# -- Additional container environment variables

3812

extraEnv: []

3813

# -- envFrom to pass to the notifications controller

3814

# @default -- `[]` (See [values.yaml])

3815

extraEnvFrom: []

3816

# - configMapRef:

3817

# name: config-map-name

3818

# - secretRef:

3819

# name: secret-name

3820

3821

# -- Additional containers to be added to the notifications controller pod

3822

## Note: Supports use of custom Helm templates

3823

extraContainers: []

3824

# -- Init containers to add to the notifications controller pod

3825

## Note: Supports use of custom Helm templates

3826

initContainers: []

3827

# -- List of extra mounts to add (normally used with extraVolumes)

3828

extraVolumeMounts: []

3829

# -- List of extra volumes to add

3830

extraVolumes: []

3831

# -- Define user-defined context

3832

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/#defining-user-defined-context

3833

context: {}

3834

# region: east

3835

# environmentName: staging

3836

3837

secret:

3838

# -- Whether helm chart creates notifications controller secret

3839

## If true, will create a secret with the name below. Otherwise, will assume existence of a secret with that name.

3840

create: true

3841

# -- notifications controller Secret name

3842

3843

# -- key:value pairs of annotations to be added to the secret

3844

annotations: {}

3845

# -- key:value pairs of labels to be added to the secret

3846

labels: {}

3847

# -- Generic key:value pairs to be inserted into the secret

3848

## Can be used for templates, notification services etc. Some examples given below.

3849

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/

3850

items: {}

3851

# slack-token:

3852

# # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/slack/

3853

# grafana-apiKey:

3854

# # For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/grafana/

3855

3856

# webhooks-github-token:

3857

3858

# email-username:

3859

# email-password:

3860

# For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/email/

3861

3862

metrics:

3863

# -- Enables prometheus metrics server

3864

enabled: false

3865

# -- Metrics port

3866

port: 9001

3867

service:

3868

# -- Metrics service type

3869

type: ClusterIP

3870

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

3871

clusterIP: ""

3872

# -- Metrics service annotations

3873

annotations: {}

3874

# -- Metrics service labels

3875

labels: {}

3876

# -- Metrics service port name

3877

portName: http-metrics

3878

serviceMonitor:

3879

# -- Enable a prometheus ServiceMonitor

3880

enabled: false

3881

# -- Prometheus ServiceMonitor selector

3882

selector: {}

3883

# prometheus: kube-prometheus

3884

# -- Prometheus ServiceMonitor labels

3885

additionalLabels: {}

3886

# -- Prometheus ServiceMonitor annotations

3887

annotations: {}

3888

# namespace: monitoring

3889

# interval: 30s

3890

# scrapeTimeout: 10s

3891

# -- Prometheus ServiceMonitor scheme

3892

scheme: ""

3893

# -- Prometheus ServiceMonitor tlsConfig

3894

tlsConfig: {}

3895

# -- When true, honorLabels preserves the metric’s labels when they collide with the target’s labels.

3896

honorLabels: false

3897

# -- Prometheus [RelabelConfigs] to apply to samples before scraping

3898

relabelings: []

3899

# -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestion

3900

metricRelabelings: []

3901

# -- Configures notification services such as slack, email or custom webhook

3902

# @default -- See [values.yaml]

3903

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/services/overview/

3904

notifiers: {}

3905

# service.slack: |

3906

# token: $slack-token

3907

3908

# -- Annotations to be applied to the notifications controller Deployment

3909

deploymentAnnotations: {}

3910

# -- Labels for the notifications controller Deployment

3911

deploymentLabels: {}

3912

# -- Annotations to be applied to the notifications controller Pods

3913

podAnnotations: {}

3914

# -- Labels to be applied to the notifications controller Pods

3915

podLabels: {}

3916

# -- Resource limits and requests for the notifications controller

3917

resources: {}

3918

# limits:

3919

# cpu: 100m

3920

# memory: 128Mi

3921

# requests:

3922

# cpu: 100m

3923

# memory: 128Mi

3924

3925

# Notification controller container ports

3926

containerPorts:

3927

# -- Metrics container port

3928

metrics: 9001

3929

# -- [DNS configuration]

3930

dnsConfig: {}

3931

# -- Alternative DNS policy for notifications controller Pods

3932

dnsPolicy: "ClusterFirst"

3933

# -- Notification controller container-level security Context

3934

# @default -- See [values.yaml]

3935

containerSecurityContext:

3936

runAsNonRoot: true

3937

readOnlyRootFilesystem: true

3938

allowPrivilegeEscalation: false

3939

seccompProfile:

3940

type: RuntimeDefault

3941

capabilities:

3942

drop:

3943

- ALL

3944

## Probes for notifications controller Pods (optional)

3945

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3946

readinessProbe:

3947

# -- Enable Kubernetes liveness probe for notifications controller Pods

3948

enabled: false

3949

# -- Number of seconds after the container has started before [probe] is initiated

3950

initialDelaySeconds: 10

3951

# -- How often (in seconds) to perform the [probe]

3952

periodSeconds: 10

3953

# -- Number of seconds after which the [probe] times out

3954

timeoutSeconds: 1

3955

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3956

successThreshold: 1

3957

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3958

failureThreshold: 3

3959

livenessProbe:

3960

# -- Enable Kubernetes liveness probe for notifications controller Pods

3961

enabled: false

3962

# -- Number of seconds after the container has started before [probe] is initiated

3963

initialDelaySeconds: 10

3964

# -- How often (in seconds) to perform the [probe]

3965

periodSeconds: 10

3966

# -- Number of seconds after which the [probe] times out

3967

timeoutSeconds: 1

3968

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3969

successThreshold: 1

3970

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3971

failureThreshold: 3

3972

## Startup probe for notifications controller Pods (optional)

3973

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

3974

startupProbe:

3975

# -- Enable Kubernetes startup probe for notifications controller Pods

3976

enabled: false

3977

# -- Number of seconds after the container has started before [probe] is initiated

3978

initialDelaySeconds: 10

3979

# -- How often (in seconds) to perform the [probe]

3980

periodSeconds: 10

3981

# -- Number of seconds after which the [probe] times out

3982

timeoutSeconds: 1

3983

# -- Minimum consecutive successes for the [probe] to be considered successful after having failed

3984

successThreshold: 1

3985

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

3986

failureThreshold: 20

3987

# -- terminationGracePeriodSeconds for container lifecycle hook

3988

terminationGracePeriodSeconds: 30

3989

# -- [Node selector]

3990

# @default -- `{}` (defaults to global.nodeSelector)

3991

nodeSelector: {}

3992

# -- [Tolerations] for use with node taints

3993

# @default -- `[]` (defaults to global.tolerations)

3994

tolerations: []

3995

# -- Assign custom [affinity] rules

3996

# @default -- `{}` (defaults to global.affinity preset)

3997

affinity: {}

3998

# -- Assign custom [TopologySpreadConstraints] rules to the application controller

3999

# @default -- `[]` (defaults to global.topologySpreadConstraints)

4000

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/

4001

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

4002

topologySpreadConstraints: []

4003

# - maxSkew: 1

4004

# topologyKey: topology.kubernetes.io/zone

4005

# whenUnsatisfiable: DoNotSchedule

4006

4007

# -- Deployment strategy to be added to the notifications controller Deployment

4008

deploymentStrategy:

4009

type: Recreate

4010

# -- Priority class for the notifications controller pods

4011

# @default -- `""` (defaults to global.priorityClassName)

4012

priorityClassName: ""

4013

# -- Automount API credentials for the Service Account into the pod.

4014

automountServiceAccountToken: true

4015

serviceAccount:

4016

# -- Create notifications controller service account

4017

create: true

4018

# -- Notification controller service account name

4019

4020

# -- Annotations applied to created service account

4021

annotations: {}

4022

# -- Labels applied to created service account

4023

labels: {}

4024

# -- Automount API credentials for the Service Account

4025

automountServiceAccountToken: true

4026

cm:

4027

# -- Whether helm chart creates notifications controller config map

4028

create: true

4029

## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.

4030

## Defaults to off

4031

clusterRoleRules:

4032

# -- List of custom rules for the notifications controller's ClusterRole resource

4033

rules: []

4034

# -- Contains centrally managed global application subscriptions

4035

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/subscriptions/

4036

subscriptions: []

4037

# # subscription for on-sync-status-unknown trigger notifications

4038

# - recipients:

4039

# - slack:test2

4040

# - email:test@gmail.com

4041

# triggers:

4042

# - on-sync-status-unknown

4043

# # subscription restricted to applications with matching labels only

4044

# - recipients:

4045

# - slack:test3

4046

# selector: test=true

4047

# triggers:

4048

# - on-sync-status-unknown

4049

4050

# -- The notification template is used to generate the notification content

4051

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/templates/

4052

templates: {}

4053

# template.app-deployed: |

4054

# email:

4055

# subject: New version of an application {{.app.metadata.name}} is up and running.

4056

# message: |

4057

# {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests.

4058

# slack:

4059

# attachments: |

4060

# [{

4061

# "title": "{{ .app.metadata.name}}",

4062

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4063

# "color": "#18be52",

4064

# "fields": [

4065

# {

4066

# "title": "Sync Status",

4067

# "value": "{{.app.status.sync.status}}",

4068

# "short": true

4069

# },

4070

# {

4071

# "title": "Repository",

4072

# "value": "{{.app.spec.source.repoURL}}",

4073

# "short": true

4074

# },

4075

# {

4076

# "title": "Revision",

4077

# "value": "{{.app.status.sync.revision}}",

4078

# "short": true

4079

# }

4080

# {{range $index, $c := .app.status.conditions}}

4081

# {{if not $index}},{{end}}

4082

# {{if $index}},{{end}}

4083

# {

4084

# "title": "{{$c.type}}",

4085

# "value": "{{$c.message}}",

4086

# "short": true

4087

# }

4088

# {{end}}

4089

# ]

4090

# }]

4091

# template.app-health-degraded: |

4092

# email:

4093

# subject: Application {{.app.metadata.name}} has degraded.

4094

# message: |

4095

# {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded.

4096

# Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.

4097

# slack:

4098

# attachments: |-

4099

# [{

4100

# "title": "{{ .app.metadata.name}}",

4101

# "title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4102

# "color": "#f4c030",

4103

# "fields": [

4104

# {

4105

# "title": "Sync Status",

4106

# "value": "{{.app.status.sync.status}}",

4107

# "short": true

4108

# },

4109

# {

4110

# "title": "Repository",

4111

# "value": "{{.app.spec.source.repoURL}}",

4112

# "short": true

4113

# }

4114

# {{range $index, $c := .app.status.conditions}}

4115

# {{if not $index}},{{end}}

4116

# {{if $index}},{{end}}

4117

# {

4118

# "title": "{{$c.type}}",

4119

# "value": "{{$c.message}}",

4120

# "short": true

4121

# }

4122

# {{end}}

4123

# ]

4124

# }]

4125

# template.app-sync-failed: |

4126

# email:

4127

# subject: Failed to sync application {{.app.metadata.name}}.

4128

# message: |

4129

# {{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}}

4130

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4131

# slack:

4132

# attachments: |-

4133

# [{

4134

# "title": "{{ .app.metadata.name}}",

4135

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4136

# "color": "#E96D76",

4137

# "fields": [

4138

# {

4139

# "title": "Sync Status",

4140

# "value": "{{.app.status.sync.status}}",

4141

# "short": true

4142

# },

4143

# {

4144

# "title": "Repository",

4145

# "value": "{{.app.spec.source.repoURL}}",

4146

# "short": true

4147

# }

4148

# {{range $index, $c := .app.status.conditions}}

4149

# {{if not $index}},{{end}}

4150

# {{if $index}},{{end}}

4151

# {

4152

# "title": "{{$c.type}}",

4153

# "value": "{{$c.message}}",

4154

# "short": true

4155

# }

4156

# {{end}}

4157

# ]

4158

# }]

4159

# template.app-sync-running: |

4160

# email:

4161

# subject: Start syncing application {{.app.metadata.name}}.

4162

# message: |

4163

# The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}.

4164

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4165

# slack:

4166

# attachments: |-

4167

# [{

4168

# "title": "{{ .app.metadata.name}}",

4169

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4170

# "color": "#0DADEA",

4171

# "fields": [

4172

# {

4173

# "title": "Sync Status",

4174

# "value": "{{.app.status.sync.status}}",

4175

# "short": true

4176

# },

4177

# {

4178

# "title": "Repository",

4179

# "value": "{{.app.spec.source.repoURL}}",

4180

# "short": true

4181

# }

4182

# {{range $index, $c := .app.status.conditions}}

4183

# {{if not $index}},{{end}}

4184

# {{if $index}},{{end}}

4185

# {

4186

# "title": "{{$c.type}}",

4187

# "value": "{{$c.message}}",

4188

# "short": true

4189

# }

4190

# {{end}}

4191

# ]

4192

# }]

4193

# template.app-sync-status-unknown: |

4194

# email:

4195

# subject: Application {{.app.metadata.name}} sync status is 'Unknown'

4196

# message: |

4197

# {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'.

4198

# Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}.

4199

# {{if ne .serviceType "slack"}}

4200

# {{range $c := .app.status.conditions}}

4201

# * {{$c.message}}

4202

# {{end}}

4203

# {{end}}

4204

# slack:

4205

# attachments: |-

4206

# [{

4207

# "title": "{{ .app.metadata.name}}",

4208

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4209

# "color": "#E96D76",

4210

# "fields": [

4211

# {

4212

# "title": "Sync Status",

4213

# "value": "{{.app.status.sync.status}}",

4214

# "short": true

4215

# },

4216

# {

4217

# "title": "Repository",

4218

# "value": "{{.app.spec.source.repoURL}}",

4219

# "short": true

4220

# }

4221

# {{range $index, $c := .app.status.conditions}}

4222

# {{if not $index}},{{end}}

4223

# {{if $index}},{{end}}

4224

# {

4225

# "title": "{{$c.type}}",

4226

# "value": "{{$c.message}}",

4227

# "short": true

4228

# }

4229

# {{end}}

4230

# ]

4231

# }]

4232

# template.app-sync-succeeded: |

4233

# email:

4234

# subject: Application {{.app.metadata.name}} has been successfully synced.

4235

# message: |

4236

# {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}.

4237

# Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true .

4238

# slack:

4239

# attachments: |-

4240

# [{

4241

# "title": "{{ .app.metadata.name}}",

4242

# "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}",

4243

# "color": "#18be52",

4244

# "fields": [

4245

# {

4246

# "title": "Sync Status",

4247

# "value": "{{.app.status.sync.status}}",

4248

# "short": true

4249

# },

4250

# {

4251

# "title": "Repository",

4252

# "value": "{{.app.spec.source.repoURL}}",

4253

# "short": true

4254

# }

4255

# {{range $index, $c := .app.status.conditions}}

4256

# {{if not $index}},{{end}}

4257

# {{if $index}},{{end}}

4258

# {

4259

# "title": "{{$c.type}}",

4260

# "value": "{{$c.message}}",

4261

# "short": true

4262

# }

4263

# {{end}}

4264

# ]

4265

# }]

4266

4267

# -- The trigger defines the condition when the notification should be sent

4268

## For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/

4269

triggers: {}

4270

# trigger.on-deployed: |

4271

# - description: Application is synced and healthy. Triggered once per commit.

4272

# oncePer: app.status.sync.revision

4273

# send:

4274

# - app-deployed

4275

# when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status == 'Healthy'

4276

# trigger.on-health-degraded: |

4277

# - description: Application has degraded

4278

# send:

4279

# - app-health-degraded

4280

# when: app.status.health.status == 'Degraded'

4281

# trigger.on-sync-failed: |

4282

# - description: Application syncing has failed

4283

# send:

4284

# - app-sync-failed

4285

# when: app.status.operationState.phase in ['Error', 'Failed']

4286

# trigger.on-sync-running: |

4287

# - description: Application is being synced

4288

# send:

4289

# - app-sync-running

4290

# when: app.status.operationState.phase in ['Running']

4291

# trigger.on-sync-status-unknown: |

4292

# - description: Application status is 'Unknown'

4293

# send:

4294

# - app-sync-status-unknown

4295

# when: app.status.sync.status == 'Unknown'

4296

# trigger.on-sync-succeeded: |

4297

# - description: Application syncing has succeeded

4298

# send:

4299

# - app-sync-succeeded

4300

# when: app.status.operationState.phase in ['Succeeded']

4301

4302

# For more information: https://argo-cd.readthedocs.io/en/stable/operator-manual/notifications/triggers/#default-triggers

4303

# defaultTriggers: |

4304

# - on-sync-status-unknown

4305

4306

# Default notifications controller's network policy

4307

networkPolicy:

4308

# -- Default network policy rules used by notifications controller

4309

# @default -- `false` (defaults to global.networkPolicy.create)

4310

create: false

4311

commitServer:

4312

# -- Enable commit server

4313

enabled: false

4314

# -- Commit server name

4315

4316

# -- Runtime class name for the commit server

4317

# @default -- `""` (defaults to global.runtimeClassName)

4318

runtimeClassName: ""

4319

## commit server controller image

4320

image:

4321

# -- Repository to use for the commit server

4322

# @default -- `""` (defaults to global.image.repository)

4323

repository: ""

4324

# -- Tag to use for the commit server

4325

# @default -- `""` (defaults to global.image.tag)

4326

tag: ""

4327

# -- Image pull policy for the commit server

4328

# @default -- `""` (defaults to global.image.imagePullPolicy)

4329

imagePullPolicy: ""

4330

# -- commit server command line flags

4331

extraArgs: []

4332

# -- Environment variables to pass to the commit server

4333

extraEnv: []

4334

# - name: "MY_VAR"

4335

# value: "value"

4336

4337

# -- envFrom to pass to the commit server

4338

# @default -- `[]` (See [values.yaml])

4339

extraEnvFrom: []

4340

# - configMapRef:

4341

# name: config-map-name

4342

# - secretRef:

4343

# name: secret-name

4344

4345

# -- List of extra mounts to add (normally used with extraVolumes)

4346

extraVolumeMounts: []

4347

# -- List of extra volumes to add

4348

extraVolumes: []

4349

metrics:

4350

# -- Enables prometheus metrics server

4351

enabled: false

4352

service:

4353

# -- Metrics service type

4354

type: ClusterIP

4355

# -- Metrics service clusterIP. `None` makes a "headless service" (no virtual IP)

4356

clusterIP: ""

4357

# -- Metrics service annotations

4358

annotations: {}

4359

# -- Metrics service labels

4360

labels: {}

4361

# -- Metrics service port

4362

servicePort: 8087

4363

# -- Metrics service port name

4364

portName: metrics

4365

## commit server service configuration

4366

service:

4367

# -- commit server service annotations

4368

annotations: {}

4369

# -- commit server service labels

4370

labels: {}

4371

# -- commit server service port

4372

port: 8086

4373

# -- commit server service port name

4374

portName: server

4375

# -- Automount API credentials for the Service Account into the pod.

4376

automountServiceAccountToken: false

4377

serviceAccount:

4378

# -- Create commit server service account

4379

create: true

4380

# -- commit server service account name

4381

4382

# -- Annotations applied to created service account

4383

annotations: {}

4384

# -- Labels applied to created service account

4385

labels: {}

4386

# -- Automount API credentials for the Service Account

4387

automountServiceAccountToken: true

4388

# -- Annotations to be added to commit server Deployment

4389

deploymentAnnotations: {}

4390

# -- Labels for the commit server Deployment

4391

deploymentLabels: {}

4392

# -- Annotations for the commit server pods

4393

podAnnotations: {}

4394

# -- Labels for the commit server pods

4395

podLabels: {}

4396

# -- Resource limits and requests for the commit server pods.

4397

resources: {}

4398

# limits:

4399

# cpu: 100m

4400

# memory: 128Mi

4401

# requests:

4402

# cpu: 100m

4403

# memory: 128Mi

4404

4405

# -- [DNS configuration]

4406

dnsConfig: {}

4407

# -- Alternative DNS policy for commit server pods

4408

dnsPolicy: "ClusterFirst"

4409

# -- commit server container-level security context

4410

# @default -- See [values.yaml]

4411

containerSecurityContext:

4412

runAsNonRoot: true

4413

readOnlyRootFilesystem: true

4414

allowPrivilegeEscalation: false

4415

capabilities:

4416

drop:

4417

- ALL

4418

seccompProfile:

4419

type: RuntimeDefault

4420

## Probes for commit server (optional)

4421

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

4422

readinessProbe:

4423

# -- Enable Kubernetes liveness probe for commit server

4424

enabled: true

4425

# -- Http path to use for the readiness probe

4426

httpPath: /healthz

4427

# -- Number of seconds after the container has started before [probe] is initiated

4428

initialDelaySeconds: 5

4429

# -- How often (in seconds) to perform the [probe]

4430

periodSeconds: 10

4431

# -- Number of seconds after which the [probe] times out

4432

timeoutSeconds: 1

4433

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4434

failureThreshold: 3

4435

livenessProbe:

4436

# -- Enable Kubernetes liveness probe for commit server

4437

enabled: true

4438

# -- Http path to use for the liveness probe

4439

httpPath: /healthz?full=true

4440

# -- Number of seconds after the container has started before [probe] is initiated

4441

initialDelaySeconds: 30

4442

# -- How often (in seconds) to perform the [probe]

4443

periodSeconds: 30

4444

# -- Number of seconds after which the [probe] times out

4445

timeoutSeconds: 5

4446

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4447

failureThreshold: 3

4448

## Startup probe for commit server (optional)

4449

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/

4450

startupProbe:

4451

# -- Enable Kubernetes startup probe for commit server

4452

enabled: false

4453

# -- Http path to use for the startup probe

4454

httpPath: /healthz

4455

# -- Number of seconds after the container has started before [probe] is initiated

4456

initialDelaySeconds: 10

4457

# -- How often (in seconds) to perform the [probe]

4458

periodSeconds: 10

4459

# -- Number of seconds after which the [probe] times out

4460

timeoutSeconds: 1

4461

# -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded

4462

failureThreshold: 20

4463

# -- terminationGracePeriodSeconds for container lifecycle hook

4464

terminationGracePeriodSeconds: 30

4465

# -- [Node selector]

4466

# @default -- `{}` (defaults to global.nodeSelector)

4467

nodeSelector: {}

4468

# -- [Tolerations] for use with node taints

4469

# @default -- `[]` (defaults to global.tolerations)

4470

tolerations: []

4471

# -- Assign custom [affinity] rules

4472

# @default -- `{}` (defaults to global.affinity preset)

4473

affinity: {}

4474

# -- Assign custom [TopologySpreadConstraints] rules to the commit server

4475

# @default -- `[]` (defaults to global.topologySpreadConstraints)

4476

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

4477

## If labelSelector is left out, it will default to the labelSelector configuration of the deployment

4478

topologySpreadConstraints: []

4479

# - maxSkew: 1

4480

# topologyKey: topology.kubernetes.io/zone

4481

# whenUnsatisfiable: DoNotSchedule

4482

4483

# -- Deployment strategy to be added to the commit server Deployment

4484

deploymentStrategy: {}

4485

# type: RollingUpdate

4486

# rollingUpdate:

4487

# maxSurge: 25%

4488

# maxUnavailable: 25%

4489

4490

# -- Priority class for the commit server pods

4491

# @default -- `""` (defaults to global.priorityClassName)

4492

priorityClassName: ""

4493

# Default commit server's network policy

4494

networkPolicy:

4495

# -- Default network policy rules used by commit server

4496

# @default -- `false` (defaults to global.networkPolicy.create)

4497

create: false

4498

## Commit server Vertical Pod Autoscaler

4499

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/

4500

vpa:

4501

# -- Deploy a [VerticalPodAutoscaler](https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically/) for the commit server

4502

enabled: false

4503

# -- Labels to be added to commit server vpa

4504

labels: {}

4505

# -- Annotations to be added to commit server vpa

4506

annotations: {}

4507

# -- One of the VPA operation modes

4508

## Ref: https://kubernetes.io/docs/concepts/workloads/autoscaling/#scaling-workloads-vertically

4509

## Note: Recreate update mode requires more than one replica unless the min-replicas VPA controller flag is overridden

4510

updateMode: Initial

4511

# -- Controls how VPA computes the recommended resources for commit server container

4512

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/examples/hamster.yaml

4513

containerPolicy: {}

4514

# controlledResources: ["cpu", "memory"]

4515

# minAllowed:

4516

# cpu: 250m

4517

# memory: 256Mi

4518

# maxAllowed:

4519

# cpu: 1

4520

# memory: 1Gi

4521

4522

## Ref: https://github.com/kubernetes/autoscaler/blob/master/vertical-pod-autoscaler/docs/api.md#verticalpodautoscalerspec

4523

## NOTE: specify only zero or one recommender as of VPA 1.7.1

4524

recommenders: []

4525

4526

## Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/boost-application-startup

4527

startupBoost: {}

4528

# cpu:

4529

# type: Factor

4530

# factor: 2

4531

# durationSeconds: 10

4532

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

argo-cd

The trusted source for open source

Product

Solutions

Customers

Resources

Company