fleet
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
image:
2
repository: cgr.dev/chainguard-private/rancher-fleet
3
tag: latest@sha256:a1cfb04902f23691987374963893272bb37e1829475e0393fcbfd4c277d6ba0e
4
imagePullPolicy: IfNotPresent
5
agentImage:
6
repository: cgr.dev/chainguard-private/rancher-fleet-agent
7
tag: latest@sha256:af2a273c319394fa7e800d9b90a0b6484fc6b20b964cebb044ebd3088af5b716
8
imagePullPolicy: IfNotPresent
9
# For cluster registration the public URL of the Kubernetes API server must be set here
10
# Example: https://example.com:6443
11
apiServerURL: ""
12
# For cluster registration the pem encoded value of the CA of the Kubernetes API server must be set here
13
# If left empty it is assumed this Kubernetes API TLS is signed by a well known CA.
14
apiServerCA: ""
15
# Determines whether the agent should trust CA bundles from the operating system's trust store when connecting to a
16
# management cluster. True in `system-store` mode, false in `strict` mode.
17
agentTLSMode: "system-store"
18
# A duration string for how often agents should report a heartbeat
19
agentCheckinInterval: "15m"
20
# The amount of time that agents will wait before they clean up old Helm releases.
21
# A non-existent value or 0 will result in an interval of 15 minutes.
22
garbageCollectionInterval: "15m"
23
# Whether you want to allow cluster upon registration to specify their labels.
24
ignoreClusterRegistrationLabels: false
25
# Counts from gitrepo are out of sync with bundleDeployment state.
26
# Just retry in a number of seconds as there is no great way to trigger an event that doesn't cause a loop.
27
# If not set default is 15 seconds.
28
# clusterEnqueueDelay: 120s
29
30
# http[s] proxy server
31
# proxy: http://<username>:<password>@<url>:<port>
32
33
# comma separated list of domains or ip addresses that will not use the proxy
34
noProxy: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local
35
# PEM-encoded CA certificate to trust when connecting to the proxy. Required
36
# when proxy is set to an https:// URL and the proxy uses a self-signed cert.
37
# proxyCACert: |
38
# -----BEGIN CERTIFICATE-----
39
# ...
40
# -----END CERTIFICATE-----
41
42
# The amount of time to wait for a response from the server before canceling the
43
# request. Used to retrieve the latest commit of configured git repositories.
44
# A non-existent value or 0 will result in a timeout of 30 seconds.
45
gitClientTimeout: 30s
46
bootstrap:
47
enabled: true
48
# The namespace that will be autocreated and the local cluster will be registered in
49
namespace: fleet-local
50
# The namespace where the fleet agent for the local cluster will be ran, if empty
51
# this will default to cattle-fleet-system
52
agentNamespace: ""
53
# If true, the local cluster stays registered (Cluster + ClusterGroup) but the
54
# fleet-agent is NOT deployed into it. An already-running local agent will be removed.
55
# The local cluster will not receive deployments.
56
localAgentDisabled: false
57
# Apply extra clusterLabels to the local cluster bootstrapped by fleet-controller
58
clusterLabels: {}
59
# A repo to add at install time that will deploy to the local cluster. This allows
60
# one to fully bootstrap fleet, its configuration and all its downstream clusters
61
# in one shot.
62
repo: ""
63
secret: ""
64
branch: master
65
paths: ""
66
global:
67
cattle:
68
imagePullSecrets: []
69
systemDefaultRegistry: ""
70
## Node labels for pod assignment
71
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
72
##
73
nodeSelector: {}
74
## List of node taints to tolerate (requires Kubernetes >= 1.6)
75
tolerations: []
76
## Pod affinity for the controllers.
77
affinity: {}
78
# Container resource limits and requests for the controllers
79
resources: {}
80
## Limits and requests for all fleet containers.
81
# limits:
82
# cpu: 8000m
83
# memory: 8Gi
84
# requests:
85
# cpu: 250m
86
# memory: 768Mi
87
#
88
## Set per-component overrides here.
89
## Set to empty object {} to use none rather than the default from above.
90
# fleetController:
91
# limits:
92
# cpu: 8000m
93
# memory: 8Gi
94
# requests:
95
# cpu: 250m
96
# memory: 768Mi
97
# fleetCleanup: {} # none rather than default
98
# fleetAgentmanagement: {} # none rather than default
99
# gitjob: {} # none rather than default
100
# helmops: {} # none rather than default
101
102
## PriorityClassName assigned to deployment.
103
priorityClassName: ""
104
## Determines whether SSH operations (eg. cloning git repos, downloading Helm charts) could succeed if
105
## host verification fails. Insecure when set to true. Default: false.
106
insecureSkipHostKeyChecks: false
107
## Adds hosts to the known_hosts configmap if using a custom git provider for gitrepos
108
additionalKnownHosts: []
109
# Custom entries to be added in SSH known_hosts format (see charts/fleet/templates/configmap_known_hosts.yaml for examples):
110
# - <host>[:port] <key-algorithm> <fingerprint>
111
112
gitops:
113
enabled: true
114
# syncPeriod is used to pick up polling for lost gitrepo events.
115
# It should be larger than the largest gitrepo pollinginterval.
116
syncPeriod: 2h
117
metrics:
118
enabled: true
119
debug: false
120
debugLevel: 0
121
propagateDebugSettingsToAgents: true
122
disableSecurityContext: false
123
migrations:
124
clusterRegistrationCleanup: true
125
gitrepoJobsCleanup: true
126
gitrepoHelmURLRegexMigration: true
127
## Leader election configuration
128
leaderElection:
129
leaseDuration: 30s
130
retryPeriod: 10s
131
renewDeadline: 25s
132
## Fleet controller configuration
133
controller:
134
replicas: 1
135
registrationTokenTTL:
136
required: false
137
reconciler:
138
# The number of workers that are allowed to each type of reconciler
139
workers:
140
gitrepo: "50"
141
bundle: "50"
142
bundledeployment: "50"
143
cluster: "50"
144
clustergroup: "50"
145
imagescan: "50"
146
schedule: "50"
147
content: "50"
148
gitjob:
149
replicas: 1
150
helmops:
151
enabled: true
152
replicas: 1
153
# When enabled, the imagescan controller will run to monitor image repositories.
154
# If disabled, config files (e.g. fleet.yaml) containing non-empty imageScan fields will result in errors.
155
# This option may be deprecated in a future release, and imagescan removed.
156
imagescan:
157
enabled: false
158
## Fleet agent configuration
159
agent:
160
replicas: 1
161
reconciler:
162
# The number of workers that are allowed for each type of reconciler
163
workers:
164
bundledeployment: "50"
165
drift: "50"
166
## Leader election configuration
167
leaderElection:
168
leaseDuration: 30s
169
retryPeriod: 10s
170
renewDeadline: 25s
171
172
# Extra environment variables passed to the fleet pods.
173
# extraEnv:
174
# - name: OCI_STORAGE
175
# value: "false"
176
177
# shards:
178
# - id: shard0
179
# nodeSelector:
180
# kubernetes.io/hostname: k3d-upstream-server-0
181
# - id: shard1
182
# nodeSelector:
183
# kubernetes.io/hostname: k3d-upstream-server-1
184
# - id: shard2
185
# nodeSelector:
186
# kubernetes.io/hostname: k3d-upstream-server-2
187
188
# Extra labels passed to the fleet pods.
189
# extraLabels:
190
# fleetController:
191
# new-label: "new-label-value"
192
# new-label-2: "new-label-value-2"
193
# gitjob:
194
# new-label: "new-label-value"
195
# new-label-2: "new-label-value-2"
196
# helmops:
197
# new-label: "new-label-value"
198
# new-label-2: "new-label-value-2"
199
200
# Extra annotations passed to the fleet pods.
201
# extraAnnotations:
202
# fleetController:
203
# new-annotation: "new-annotation-value"
204
# new-annotation-2: "new-annotation-value-2"
205
# gitjob:
206
# new-annotation: "new-annotation-value"
207
# new-annotation-2: "new-annotation-value-2"
208
# helmops:
209
# new-annotation: "new-annotation-value"
210
# new-annotation-2: "new-annotation-value-2"
211
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.