flux-operator

# Default values for flux-operator.

nameOverride: ""

fullnameOverride: ""

# -- Enable [multitenancy lockdown](https://fluxoperator.dev/docs/crd/resourceset/#role-based-access-control) for the ResourceSet APIs.

multitenancy:

enabled: false

enabledForWorkloadIdentity: false

defaultServiceAccount: "flux-operator" # @schema required: true

defaultWorkloadIdentityServiceAccount: "flux-operator" # @schema required: true

# -- Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings.

reporting:

interval: 5m # @schema required: true

web:

# -- Enable the [Flux Status web server](https://fluxoperator.dev/web-ui/) on port 9080.

enabled: true

# -- The spec of the [Web Config API](https://fluxoperator.dev/docs/web-ui/web-config-api/)

config: {} # @schema type: object

# -- Reference to an existing Secret in the same namespace as the deployment containing the Web Config API. Should have the key `config.yaml`.

configSecretName: "" # @schema default: ""

# -- SPIFFE IDs or prefixes of authorized web UI clients. When set, the web server on port 9080 accepts only SPIFFE mTLS connections from these clients, so the Ingress or Gateway in front of it must present an SVID (e.g. Envoy Gateway with a BackendTLSPolicy). Requires `spiffe.workloadAPI.endpoint`.

authorizedClientSPIFFEIDs: [] # @schema item: string ; uniqueItems: true

# -- GitOps actions configuration for the web UI.

userActions:

# -- Access mode for GitOps actions. When set to `FineGrained`, actions are performed using the web server's own privileges instead of impersonating the user, and the web ClusterRole is extended with the native Kubernetes permissions required by the actions (only effective in `web.serverOnly` mode; otherwise the operator already runs as cluster-admin). Either `Impersonated` (default) or `FineGrained`.

access: Impersonated # @schema enum:["Impersonated", "FineGrained"]; default: "Impersonated"

# -- Create a NetworkPolicy to allow access to the Flux Status web interface.

networkPolicy:

create: true

# -- Create standard roles for [user access management](https://fluxoperator.dev/docs/web-ui/user-management/).

rbac:

createRoles: true # @schema default: true

createAggregation: false # @schema default: false

# -- Run the Flux Status web server as a standalone deployment (requires a dedicated Helm release).

serverOnly: false

# -- Number of replicas for the Flux Status web server standalone deployment (only applicable if `web.serverOnly` is `true`).

serverReplicas: 1 # @schema default: 1

# -- Ingress settings for the Flux Status web interface.

ingress: # @schema default: {"enabled":false,"className":"","annotations":{}}

enabled: false # @schema default: false

className: ""

annotations: {} # @schema type: object

hosts: [] # @schema item: object ; uniqueItems: true

# - host: flux-operator.example.com

# paths:

# - path: /

# pathType: ImplementationSpecific

tls: [] # @schema item: object ; uniqueItems: true

# - secretName: flux-operator-tls

# hosts:

# - flux-operator.example.com

# -- Gateway API HTTPRoute settings for the Flux Status web interface.

httpRoute: # @schema default: {"enabled":false,"annotations":{},"parentRefs":[],"hostnames":[]}

enabled: false # @schema default: false

annotations: {} # @schema type: object

parentRefs: [] # @schema item: object ; uniqueItems: true

# - name: my-gateway

# namespace: gateway-system

# sectionName: https

hostnames: [] # @schema item: string ; uniqueItems: true

# - flux.example.com

# -- Install and upgrade the custom resource definitions.

installCRDs: true # @schema default: true

# -- Common annotations to add to all deployed objects including pods.

commonAnnotations: {}

# -- Common labels to add to all deployed objects including pods.

commonLabels: {}

# -- Container image settings.

# The image tag defaults to the chart appVersion.

image:

repository: cgr.dev/chainguard-private/flux-operator

tag: v0.62.1-r0@sha256:5cf82b424a4a9bff74a78f8909b2a85c4f91718ebc4291696ac48161242b810d

pullSecrets: [] # @schema item: object ; uniqueItems: true

imagePullPolicy: IfNotPresent # @schema enum:[IfNotPresent, Always, Never]

# -- Pod priority class name.

# Recommended value is system-cluster-critical.

priorityClassName: "" # @schema default: "system-cluster-critical"

# -- Kubernetes [API priority and fairness](https://kubernetes.io/docs/concepts/cluster-administration/flow-control/) settings.

apiPriority: # @schema default: {"enabled":false,"level":"workload-high","extraServiceAccounts":[]}

enabled: false

level: workload-high

extraServiceAccounts: []

# - name: kustomize-controller

# namespace: flux-system

# - name: helm-controller

# namespace: flux-system

# -- Container resources requests and limits settings.

resources: # @schema required: true

limits:

cpu: 2000m

memory: 1Gi

requests: # @schema default: {"cpu":"100m","memory":"64Mi"}

cpu: 100m

memory: 64Mi

# -- Container liveness probe settings.

livenessProbe: # @schema default: {"httpGet":{"path":"/healthz","port":8081},"initialDelaySeconds":15,"periodSeconds":20}

httpGet:

path: /healthz

port: 8081

initialDelaySeconds: 15

periodSeconds: 20

# -- Container readiness probe settings.

readinessProbe: # @schema default: {"httpGet":{"path":"/readyz","port":8081},"initialDelaySeconds":5,"periodSeconds":10}

httpGet:

path: /readyz

port: 8081

initialDelaySeconds: 5

periodSeconds: 10

# -- Pod service account settings.

# The name of the service account defaults to the release name.

serviceAccount: # @schema default: {"create":true,"automount":true,"name":""}

create: true

automount: true

name: ""

rbac:

# -- Grant the cluster-admin role to the flux-operator service account (required for the Flux Instance deployment).

create: true

# -- Grant the Kubernetes view, edit and admin roles access to ResourceSet APIs.

createAggregation: true

# -- Pod security context settings.

podSecurityContext: {} # @schema default: {"fsGroup":1337}

# -- Container security context settings.

# The default is compliant with the pod security restricted profile.

securityContext: # @schema required: true

runAsNonRoot: true # @schema default: true

readOnlyRootFilesystem: true # @schema default: true

allowPrivilegeEscalation: false # @schema default: false

capabilities: # @schema default: {"drop":["ALL"]}

drop: # @schema item: string ; uniqueItems: true

- "ALL"

seccompProfile: # @schema default: {"type":"RuntimeDefault"}

type: "RuntimeDefault"

# -- Pod affinity and anti-affinity settings.

affinity: # @schema default: {"nodeAffinity":{"requiredDuringSchedulingIgnoredDuringExecution":{"nodeSelectorTerms":[{"matchExpressions":[{"key":"kubernetes.io/os","operator":"In","values":["linux"]}]}]}}}

nodeAffinity:

requiredDuringSchedulingIgnoredDuringExecution:

nodeSelectorTerms:

- matchExpressions:

- key: kubernetes.io/os

operator: In

values:

- linux

# -- Pod tolerations settings.

tolerations: [] # @schema item: object ; uniqueItems: true

# -- Pod Node Selector settings.

nodeSelector: {} # @schema type: object

# -- Deployment update strategy. Set `{"type":"Recreate"}` for single-replica installs whose web UI is fronted by a load balancer health check, where a rolling update would otherwise deadlock.

strategy: {} # @schema type: object

# -- If `true`, the container ports (`8080` and `8081`) are exposed on the host network.

hostNetwork: false # @schema default: false

# -- Pod extra volumes.

extraVolumes: [] # @schema item: object ; uniqueItems: true

# -- Container extra environment variables.

extraEnvs: [] # @schema item: object ; uniqueItems: true

# -- Container extra arguments.

extraArgs: [] # @schema item: string ; uniqueItems: true

# -- Container extra volume mounts.

extraVolumeMounts: [] # @schema item: object ; uniqueItems: true

# -- Container logging level flag.

logLevel: "info" # @schema enum:[debug,info,error]

# -- Prometheus Operator scraping settings.

serviceMonitor: # @schema default: {"create":false,"interval":"60s","scrapeTimeout":"30s"}

create: false

interval: 60s

scrapeTimeout: 30s

labels: {}

service:

# -- Sets the IP family policy on all Service resources. Uses Kubernetes defaults if unset

ipFamilyPolicy: '' # @schema type: string; enum:['', SingleStack, PreferDualStack, RequireDualStack]

# -- SPIFFE settings for the flux-operator pod.

spiffe:

workloadAPI:

# -- The SPIFFE Workload API endpoint. Sets the `SPIFFE_ENDPOINT_SOCKET` environment variable.

endpoint: ""

# -- The SPIFFE CSI driver name used to mount the Workload API socket at `/spiffe-workload-api`. When set, the endpoint must be a socket under that path, e.g. `unix:///spiffe-workload-api/spire-agent.sock`.

csiDriver: ""

brokerAPI:

# -- The SPIFFE Broker API endpoint. Sets the `--spiffe-broker-endpoint` flag. Requires `spiffe.workloadAPI.endpoint` and `spiffe.brokerAPI.ids`.

endpoint: ""

# -- SPIFFE IDs or prefixes of the Broker API endpoint. Sets the repeatable `--spiffe-broker-id` flag.

ids: [] # @schema item: string ; uniqueItems: true

# -- Marketplace settings.

marketplace:

type: ""

license: ""

account: ""