kates
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# -- Global configuration
2
global:
3
# -- Override the image registry for all images in the chart
4
# Useful for air-gapped clusters that mirror images to an internal registry
5
imageRegistry: ""
6
# -- Override image pull secrets globally
7
imagePullSecrets: []
8
# -- Kubernetes cluster DNS domain
9
clusterDomain: "cluster.local"
10
# -- Enable production guard rails: template rendering fails if insecure
11
# chart defaults (e.g. the default database password) would reach the
12
# cluster. Enabled in values-prod.yaml; leave false for dev/kind.
13
productionMode: false
14
# -- Number of Kates API pods. Must be 1; values.schema.json refuses more.
15
# The Kates API keeps each run's workers, the concurrent-run limit, the
16
# disruption lease and the live event streams in its own memory, and a pod
17
# that starts marks every RUNNING run in the database FAILED. A second pod
18
# fails the runs the first is executing, and the two can each run a
19
# disruption plan against the same cluster.
20
replicaCount: 1
21
# -- Container image configuration
22
image:
23
# -- Image repository
24
repository: cgr.dev/chainguard-private/kates
25
# -- Image tag. Must be the release that carries the non-blocking health
26
# endpoints the probe defaults below depend on (>= 1.22.0).
27
tag: 1.25.0-r1@sha256:e8f15af9db3f30d2dee1890f0fc4ba2581dca9475507ed19d449fe588113c642
28
# -- Image pull policy
29
pullPolicy: IfNotPresent
30
# -- Secrets for pulling images from private registries
31
imagePullSecrets: []
32
# -- Override the chart name
33
nameOverride: ""
34
# -- Override the full release name
35
fullnameOverride: ""
36
# -- DNS policy for pods (ClusterFirst, Default, None, ClusterFirstWithHostNet)
37
dnsPolicy: ""
38
# -- Custom DNS configuration (nameservers, searches, options)
39
dnsConfig: {}
40
# -- Service account configuration
41
serviceAccount:
42
# -- Create a ServiceAccount
43
create: true
44
# -- ServiceAccount name (auto-generated if empty)
45
name: ""
46
# -- Extra annotations for the ServiceAccount
47
annotations: {}
48
# -- Automount the service account token
49
automount: true
50
# -- RBAC configuration
51
rbac:
52
# -- Create ClusterRole and ClusterRoleBinding
53
create: true
54
# -- Grant the writes the direct Kubernetes chaos backend makes itself
55
# (KATES_CHAOS_PROVIDER=kubernetes, or hybrid without Litmus): NetworkPolicies,
56
# StatefulSet scaling, and pod ephemeral containers. Litmus runs its
57
# experiments as litmus-admin and needs none of this.
58
directChaos: false
59
# -- Namespaces where the INTEGRATION_CDC test may read its database's
60
# password: a Role in each grants get on the Secret `postgresql` (key
61
# postgres-password), the only Secret the Kates API reads. The test uses the
62
# PostgreSQL behind the first Service labelled
63
# app.kubernetes.io/name=postgresql in any namespace, or in `database` when
64
# there is none. `kates deploy --with-kafka-connect` installs it there and
65
# sets this to that namespace. Each one must exist before the install.
66
# Empty grants nothing, and an INTEGRATION_CDC run then fails at DB_SETUP.
67
cdcSecretNamespaces: []
68
# -- Extra RBAC rules (e.g. for Litmus Chaos integration)
69
extraRules: []
70
# -- Extra annotations to add to pods
71
podAnnotations: {}
72
# -- Extra labels to add to pods
73
podLabels: {}
74
# -- Kubernetes Service configuration
75
service:
76
# -- Service type
77
type: ClusterIP
78
# -- HTTP service port
79
port: 8080
80
# -- NodePort value (only when type=NodePort)
81
nodePort: ""
82
# -- Application protocol hint for service mesh
83
appProtocol: http
84
# -- Extra annotations for the Service
85
annotations: {}
86
# -- gRPC port configuration
87
grpc:
88
# -- gRPC container/service port
89
port: 9000
90
# -- gRPC NodePort value (only when type=NodePort)
91
nodePort: ""
92
# -- Ingress configuration
93
ingress:
94
# -- Enable Ingress
95
enabled: false
96
# -- Ingress class name (e.g. nginx)
97
className: ""
98
# -- Extra Ingress annotations
99
annotations: {}
100
# -- cert-manager integration
101
certManager:
102
# -- Enable cert-manager annotations
103
enabled: false
104
# -- Issuer or ClusterIssuer name
105
issuerName: ""
106
# -- Issuer kind (ClusterIssuer or Issuer)
107
issuerKind: ClusterIssuer
108
# -- Ingress hosts
109
hosts:
110
- host: kates.local
111
paths:
112
- path: /
113
pathType: Prefix
114
# -- TLS configuration
115
tls: []
116
# -- gRPC Ingress (separate Ingress resource for gRPC traffic)
117
grpc:
118
# -- Enable gRPC Ingress
119
enabled: false
120
# -- gRPC Ingress hostname
121
host: grpc.kates.local
122
# -- Extra gRPC Ingress annotations
123
annotations: {}
124
# -- gRPC TLS configuration
125
tls: []
126
# -- Resource requests and limits for the KATES container
127
resources:
128
requests:
129
memory: "2Gi"
130
cpu: "500m"
131
limits:
132
memory: "4Gi"
133
cpu: "2"
134
# -- Flyway schema migration behaviour
135
flyway:
136
# -- Repair the schema history on startup before migrating.
137
#
138
# DEVELOPMENT ONLY. It fixes "Migration checksum mismatch", which happens when
139
# an unreleased migration is edited after a local database already applied it.
140
# On a real database that mismatch means the file and the schema genuinely
141
# disagree, and silently rewriting the history hides it — so this stays off by
142
# default and is enabled in the local overlays.
143
repairAtStart: false
144
# -- Container args, replacing the image's CMD. Empty means "use the image's
145
# own default". The native image sets its heap percentage through CMD, since a
146
# native binary ignores JAVA_TOOL_OPTIONS; override it here rather than
147
# rebuilding the image.
148
containerArgs: []
149
# -- JVM configuration
150
#
151
# JVM IMAGE ONLY. A GraalVM native image does not read JAVA_TOOL_OPTIONS, so
152
# everything here is silently ignored when running a `-native` tag — see
153
# values-native.yaml, which empties it for that reason.
154
jvm:
155
# -- JVM options passed via JAVA_TOOL_OPTIONS (ignored by the native image)
156
options: "-Xms512m -Xmx2560m -XX:+UseZGC -XX:+ZGenerational"
157
# -- Pod-level security context (PSS restricted compliant)
158
# NOTE: runAsUser and fsGroup are intentionally unset so that platforms
159
# like OpenShift can assign random UIDs via their Security Context Constraints.
160
# Set them explicitly in your environment values file if needed.
161
securityContext:
162
runAsNonRoot: true
163
runAsUser: 100
164
fsGroup: 100
165
seccompProfile:
166
type: RuntimeDefault
167
# -- Container-level security context (PSS restricted compliant)
168
containerSecurityContext:
169
allowPrivilegeEscalation: false
170
readOnlyRootFilesystem: true
171
runAsNonRoot: true
172
capabilities:
173
drop:
174
- ALL
175
# -- Grace period for pod termination (seconds)
176
terminationGracePeriodSeconds: 60
177
# -- Deployment update strategy. Must be Recreate; values.schema.json refuses
178
# RollingUpdate, which starts the new pod while the old one still runs (see
179
# replicaCount). Recreate stops the old pod first, so every upgrade has a gap:
180
# the API is unreachable until the new pod is Ready, a minute or two on the
181
# JVM image, and a run still going when the old pod stops ends FAILED, as on
182
# any restart. Upgrade between runs.
183
strategy:
184
type: Recreate
185
# -- Horizontal Pod Autoscaler configuration. enabled must stay false;
186
# values.schema.json refuses true. Kates runs one replica (see replicaCount),
187
# and the CPU a native benchmark burns is what would make an autoscaler add a
188
# second pod in the middle of a run.
189
autoscaling:
190
# -- Enable HPA (must be false)
191
enabled: false
192
# -- Minimum replicas
193
minReplicas: 1
194
# -- Maximum replicas
195
maxReplicas: 5
196
# -- Target CPU utilization percentage
197
targetCPUUtilizationPercentage: 80
198
# -- Target memory utilization percentage (empty to disable)
199
targetMemoryUtilizationPercentage: ""
200
# -- Custom metrics for HPA
201
customMetrics: []
202
# -- Scale behavior policies
203
behavior:
204
scaleDown:
205
stabilizationWindowSeconds: 300
206
policies:
207
- type: Pods
208
value: 1
209
periodSeconds: 60
210
scaleUp:
211
stabilizationWindowSeconds: 30
212
policies:
213
- type: Pods
214
value: 2
215
periodSeconds: 60
216
# -- Pod Disruption Budget configuration. With one pod, a budget either allows
217
# its eviction or blocks every node drain: set maxUnavailable, and leave
218
# minAvailable empty.
219
podDisruptionBudget:
220
# -- Enable PDB
221
enabled: false
222
# -- Minimum available pods. Must stay empty; values.schema.json refuses a
223
# value: any minimum leaves the one pod unevictable, and a drain never ends
224
minAvailable: ""
225
# -- Maximum unavailable pods
226
maxUnavailable: 1
227
# -- Unhealthy pod eviction policy
228
unhealthyPodEvictionPolicy: IfHealthy
229
# -- Priority class name for pod scheduling
230
priorityClassName: ""
231
# -- Topology spread constraints for pod scheduling
232
topologySpreadConstraints: []
233
# -- Node selector for pod scheduling
234
nodeSelector: {}
235
# -- Tolerations for pod scheduling
236
tolerations: []
237
# -- Affinity rules (includes default pod anti-affinity for HA)
238
affinity:
239
podAntiAffinity:
240
preferredDuringSchedulingIgnoredDuringExecution:
241
- weight: 100
242
podAffinityTerm:
243
labelSelector:
244
matchExpressions:
245
- key: app.kubernetes.io/name
246
operator: In
247
values:
248
- kates
249
topologyKey: kubernetes.io/hostname
250
# -- Extra environment variables for the KATES container
251
extraEnv: []
252
# -- Extra init containers (e.g. for Vault secret fetching, schema migration)
253
extraInitContainers: []
254
# -- Extra volumes
255
extraVolumes: []
256
# -- Extra volume mounts
257
extraVolumeMounts: []
258
# -- API key authentication
259
apiKey:
260
# -- Enable API key authentication
261
enabled: true
262
# -- API key value (auto-generated 32-char key if empty)
263
value: ""
264
# -- Use an existing Secret instead of creating one
265
existingSecret: ""
266
# -- Key in the existing Secret
267
secretKey: "api-key"
268
# -- Health probe configuration
269
#
270
# Every probe points at a MicroProfile health endpoint, never at a business
271
# endpoint. `/api/health` looks like the obvious readiness URL but calls
272
# ClusterHealthService.isReachable() — an uncached AdminClient round-trip with a
273
# 5s blocking get — on every request. Since a probe's timeoutSeconds defaults to
274
# 1s, a cluster whose Kafka is still coming up fails EVERY readiness probe and
275
# the pod never goes Ready, even though the app is fine. `/q/health/ready` reads
276
# the periodically-refreshed KafkaReachabilityCache instead and never blocks on a
277
# broker.
278
probes:
279
# -- Startup probe (gates readiness/liveness probes)
280
startup:
281
path: /q/health/started
282
# 60 x 2s = 120s of JVM boot budget. 30 (60s) is not enough on a
283
# CPU-constrained node: the kubelet kills the container mid-boot and the
284
# restart loop reads as "kates takes forever to start".
285
failureThreshold: 60
286
periodSeconds: 2
287
timeoutSeconds: 3
288
# -- Readiness probe
289
readiness:
290
path: /q/health/ready
291
initialDelaySeconds: 5
292
periodSeconds: 10
293
timeoutSeconds: 5
294
failureThreshold: 3
295
# -- Liveness probe
296
liveness:
297
path: /q/health/live
298
initialDelaySeconds: 15
299
periodSeconds: 30
300
timeoutSeconds: 5
301
failureThreshold: 3
302
# -- Container lifecycle hooks
303
lifecycle:
304
# -- Seconds to sleep in preStop hook (allows LB drain)
305
preStopSleepSeconds: 5
306
# -- Init container configuration
307
initContainers:
308
# -- Busybox image for wait-for-postgres init container
309
waitForPostgres:
310
image: cgr.dev/chainguard-private/netcat:1.238-r1@sha256:93d88a74ea2dff4aaab591b925fab3ef6583da37ba6aadc99854b8fb024bb5d4
311
pullPolicy: IfNotPresent
312
# -- Kafka connection configuration
313
kafka:
314
# -- Kafka bootstrap servers
315
bootstrapServers: "krafter-kafka-bootstrap.kafka.svc:9092"
316
# -- Namespace where CDC integration test KafkaTopic CRs are managed (empty = auto-detect)
317
topicNamespace: ""
318
# -- Client rack ID for rack-aware consumption
319
clientRack: ""
320
# -- Security protocol
321
security:
322
protocol: SASL_PLAINTEXT
323
# -- SASL authentication
324
sasl:
325
# -- Enable SASL
326
enabled: true
327
# -- SASL mechanism
328
mechanism: SCRAM-SHA-512
329
# -- SASL username
330
username: kates-backend
331
# -- K8s Secret name containing the SASL password
332
secretName: kates-backend
333
# -- Key in the Secret containing the SASL password
334
secretKey: password
335
# -- OAuthBearer configuration (when mechanism=OAUTHBEARER)
336
oauthbearer:
337
tokenEndpointUrl: ""
338
clientId: ""
339
clientSecretName: ""
340
clientSecretKey: client-secret
341
# -- SSL/TLS configuration
342
ssl:
343
# -- Enable SSL
344
enabled: false
345
# -- Truststore configuration
346
truststore:
347
secretName: ""
348
key: truststore.jks
349
password: ""
350
# -- Keystore configuration
351
keystore:
352
secretName: ""
353
key: keystore.jks
354
password: ""
355
# -- Trogdor coordinator configuration
356
trogdor:
357
# -- Trogdor coordinator URL
358
coordinatorUrl: "http://trogdor-coordinator.kafka.svc:8889"
359
# -- Trogdor agents that run tasks (KATES_TROGDOR_AGENT_NODES): node names
360
# from the coordinator's platform config, comma-separated; a run's tasks take
361
# them in turn. node0 is the name in the trogdor.conf Kafka ships. A name the
362
# coordinator does not know fails the task with "Unknown node names".
363
agentNodes: "node0"
364
# -- Prometheus the backend queries for a disruption's Kafka metrics
365
prometheus:
366
# -- Prometheus base URL (KATES_PROMETHEUS_URL). The default is the Service
367
# kube-prometheus-stack creates for charts/monitoring installed as release
368
# `monitoring` in namespace `monitoring`, which is what `kates deploy` does
369
# (it sets this for the namespace it uses). `make monitoring` installs that
370
# release in namespace `kafka`: set
371
# http://monitoring-kube-prometheus-prometheus.kafka.svc:9090 there, and
372
# networkPolicy.prometheus.namespace to kafka. Unreachable, a disruption's
373
# Prometheus metrics are missing and its SLA verdict lists them unevaluated.
374
url: "http://monitoring-kube-prometheus-prometheus.monitoring.svc:9090"
375
# -- Benchmark engine configuration
376
engine:
377
# -- Default benchmark backend (native or trogdor)
378
defaultBackend: "native"
379
# -- Fault tolerance timeout configuration (ms)
380
faultTolerance:
381
topicService:
382
# -- Timeout for all TopicService operations
383
timeoutMs: "35000"
384
clusterHealthService:
385
# -- Default timeout for cluster health operations
386
defaultTimeoutMs: "35000"
387
# -- Timeout for reachability check
388
reachableTimeoutMs: "10000"
389
# -- Timeout for full health check
390
healthCheckTimeoutMs: "60000"
391
consumerGroupService:
392
# -- Timeout for consumer group operations
393
timeoutMs: "35000"
394
# -- NetworkPolicy configuration
395
networkPolicy:
396
# -- Enable NetworkPolicy
397
enabled: true
398
# -- Ingress rules
399
ingressRules:
400
- from:
401
- namespaceSelector: {}
402
ports:
403
- port: 8080
404
protocol: TCP
405
- from:
406
- namespaceSelector: {}
407
ports:
408
- port: 8080
409
protocol: TCP
410
# -- Kafka egress configuration
411
kafka:
412
namespace: kafka
413
port: 9092
414
# -- Prometheus egress configuration: the namespace prometheus.url points
415
# into. The policy used to allow `monitoring` whatever this said.
416
prometheus:
417
namespace: monitoring
418
port: 9090
419
# -- Extra egress rules
420
egressRules: []
421
# -- Observability and monitoring
422
metrics:
423
# -- Prometheus ServiceMonitor
424
serviceMonitor:
425
# -- Enable ServiceMonitor
426
enabled: false
427
# -- Target namespace for the ServiceMonitor
428
namespace: ""
429
# -- Scrape interval
430
interval: "30s"
431
# -- Scrape timeout
432
scrapeTimeout: ""
433
# -- Extra labels for ServiceMonitor
434
labels: {}
435
# -- Metric relabeling rules
436
metricRelabelings: []
437
# -- Relabeling rules
438
relabelings: []
439
# -- PrometheusRule for alerting
440
prometheusRule:
441
# -- Enable PrometheusRule
442
enabled: false
443
# -- Target namespace for the PrometheusRule
444
namespace: ""
445
# -- Extra labels
446
labels: {}
447
# -- Alert rules
448
rules:
449
- alert: KatesDown
450
expr: up{job="{{ include \"kates.fullname\" . }}"} == 0
451
for: 5m
452
labels:
453
severity: critical
454
annotations:
455
summary: "KATES instance is down"
456
description: "KATES pod {{ $labels.pod }} has been down for more than 5 minutes."
457
- alert: KatesHighErrorRate
458
expr: rate(http_server_requests_seconds_count{job="{{ include \"kates.fullname\" . }}", status=~"5.."}[5m]) > 0.1
459
for: 5m
460
labels:
461
severity: warning
462
annotations:
463
summary: "KATES high error rate"
464
description: "KATES is returning more than 10% 5xx responses."
465
# -- GONE in 0.9.0: the "KATES — Overview" board (dashboards/kates-overview/)
466
# is delivered by charts/monitoring with every other board in dashboards/
467
# (its `dashboards.enabled`), scoped to a release by its `$job` template
468
# variable. A release that still sets any `metrics.grafanaDashboard.*` key
469
# is REFUSED with the new location named (this chart has no values schema,
470
# so without the refusal the key would be accepted and silently ignored).
471
# -- Bundled PostgreSQL configuration.
472
# A self-contained single-instance StatefulSet on the official `postgres`
473
# image (no Bitnami). For production HA, set enabled=false and point
474
# externalDatabase at a managed cluster (CloudNativePG recommended).
475
postgresql:
476
# -- Deploy bundled PostgreSQL
477
enabled: true
478
# -- PostgreSQL image (official library image; Alpine variants also work)
479
image:
480
repository: cgr.dev/chainguard-private/postgres
481
tag: 16.15-r5@sha256:ddf4e62be22609f378f65d646789e772bf470899f1d16acb151c14632900a4fb
482
# -- Database authentication
483
auth:
484
# -- Database name
485
database: kates
486
# -- Database username
487
username: kates
488
# -- Database password (ignored if existingSecret is set)
489
password: kates
490
# -- Use an existing Secret for DB credentials
491
existingSecret: ""
492
# -- Key in the existing Secret
493
passwordKey: "password"
494
# -- Node selector for the embedded PostgreSQL pod (dev/test only)
495
nodeSelector: {}
496
# -- Tolerations for the embedded PostgreSQL pod
497
tolerations: []
498
# -- Affinity rules for the embedded PostgreSQL pod
499
affinity: {}
500
# -- PVC storage configuration
501
storage:
502
# -- Storage size
503
size: 1Gi
504
# -- Storage class (empty for default)
505
storageClass: ""
506
# -- PostgreSQL resource requests and limits
507
resources:
508
requests:
509
memory: "128Mi"
510
cpu: "100m"
511
limits:
512
memory: "256Mi"
513
cpu: "250m"
514
# -- PostgreSQL pod security context
515
securityContext:
516
runAsNonRoot: true
517
runAsUser: 999
518
fsGroup: 999
519
# -- PostgreSQL container security context
520
containerSecurityContext:
521
allowPrivilegeEscalation: false
522
capabilities:
523
drop:
524
- ALL
525
# -- JDBC connection pool settings
526
connectionPool:
527
# -- Maximum pool size
528
maxSize: "20"
529
# -- Minimum pool size
530
minSize: "5"
531
# -- External database configuration (when postgresql.enabled=false).
532
# Recommended for production HA: run a CloudNativePG `Cluster` (official
533
# postgres images, streaming replication, backups) and point host/port at its
534
# `-rw` service, e.g. host: kates-db-rw.database.svc — no Bitnami involved.
535
externalDatabase:
536
# -- Enable external database
537
enabled: false
538
# -- Database host
539
host: ""
540
# -- Database port
541
port: 5432
542
# -- Database name
543
database: kates
544
# -- Database username
545
username: kates
546
# -- Database password (ignored if existingSecret is set)
547
password: ""
548
# -- Use an existing Secret for DB credentials
549
existingSecret: ""
550
# -- Key in the existing Secret
551
passwordKey: "password"
552
# -- Default benchmark parameters (fallback for all test types)
553
defaults:
554
replicationFactor: "3"
555
partitions: "3"
556
minInsyncReplicas: "2"
557
acks: "all"
558
batchSize: "65536"
559
lingerMs: "5"
560
compressionType: "lz4"
561
recordSize: "1024"
562
numRecords: "1000000"
563
throughput: "-1"
564
durationMs: "600000"
565
numProducers: "1"
566
numConsumers: "1"
567
# -- Per-test-type parameter overrides
568
tests:
569
# -- LOAD: baseline throughput test
570
load:
571
partitions: "3"
572
batchSize: "65536"
573
lingerMs: "5"
574
numRecords: "1000000"
575
durationMs: "600000"
576
numProducers: "1"
577
# -- STRESS: high-concurrency, large batches
578
stress:
579
partitions: "6"
580
batchSize: "131072"
581
lingerMs: "10"
582
numRecords: "5000000"
583
durationMs: "900000"
584
numProducers: "3"
585
# -- SPIKE: burst traffic, low-latency
586
spike:
587
acks: "1"
588
batchSize: "131072"
589
lingerMs: "0"
590
compressionType: "none"
591
numRecords: "2000000"
592
durationMs: "300000"
593
# -- ENDURANCE: long-running, rate-limited
594
endurance:
595
numRecords: "10000000"
596
throughput: "5000"
597
durationMs: "3600000"
598
# -- VOLUME: large records, high batch size
599
volume:
600
partitions: "6"
601
batchSize: "262144"
602
lingerMs: "50"
603
recordSize: "10240"
604
numRecords: "2000000"
605
# -- CAPACITY: max parallelism
606
capacity:
607
partitions: "12"
608
batchSize: "131072"
609
lingerMs: "10"
610
numRecords: "10000000"
611
durationMs: "1200000"
612
numProducers: "5"
613
# -- ROUNDTRIP: latency-focused
614
roundtrip:
615
batchSize: "16384"
616
lingerMs: "0"
617
compressionType: "none"
618
numRecords: "500000"
619
throughput: "10000"
620
# -- PostgreSQL backup CronJob
621
backup:
622
# -- Enable backup CronJob
623
enabled: false
624
# -- Cron schedule expression
625
schedule: "0 2 * * *"
626
# -- PostgreSQL image for pg_dump
627
image: cgr.dev/chainguard-private/postgres:16.15-r5@sha256:ddf4e62be22609f378f65d646789e772bf470899f1d16acb151c14632900a4fb
628
# -- Days to retain backups
629
retention: 7
630
# -- Backup persistence
631
persistence:
632
enabled: false
633
existingClaim: ""
634
storageClass: ""
635
size: 5Gi
636
# -- Backup job resources
637
resources:
638
requests:
639
memory: "64Mi"
640
cpu: "50m"
641
limits:
642
memory: "256Mi"
643
cpu: "250m"
644
# -- Pre-upgrade Flyway migration Job
645
migration:
646
# -- Enable migration Job (runs as pre-upgrade Helm hook)
647
enabled: false
648
# -- Override image (defaults to KATES app image)
649
image: cgr.dev/chainguard-private/kates:1.25.0-r1@sha256:e8f15af9db3f30d2dee1890f0fc4ba2581dca9475507ed19d449fe588113c642
650
# -- Custom command (overrides default Flyway migration)
651
command: []
652
# -- Maximum retry attempts
653
backoffLimit: 3
654
# -- Maximum Job duration (seconds)
655
activeDeadlineSeconds: 600
656
# -- Migration job resources
657
resources:
658
requests:
659
memory: "256Mi"
660
cpu: "100m"
661
limits:
662
memory: "512Mi"
663
cpu: "500m"
664
# -- Stale test run cleanup CronJob
665
cleanup:
666
# -- Enable cleanup CronJob
667
enabled: false
668
# -- Cron schedule expression
669
schedule: "0 4 * * 0"
670
# -- Delete completed test runs older than N days
671
retentionDays: 30
672
# -- Curl image for API calls
673
image: cgr.dev/chainguard-private/min-toolkit-debug:latest@sha256:07e451e70f5ebb1f4c19d423fb6c5e3168ffeda21df578aceb4f2b93145f274d
674
# -- Kyverno pod security policies (requires Kyverno controller in cluster)
675
kyvernoPolicy:
676
# -- Enable Kyverno ClusterPolicy for the kates namespace
677
enabled: false
678
# -- Policy action: Audit (observe only) or Enforce (block non-compliant)
679
action: Audit
680
# -- Enable mutation rules to auto-inject security contexts
681
mutate: true
682
# -- Enable image registry restriction
683
restrictRegistries: false
684
# -- Allowed image registries (when restrictRegistries is true)
685
allowedRegistries:
686
- ghcr.io/bmscomp/
687
- docker.io/bitnami/
688
- registry.k8s.io/
689
- quay.io/strimzi/
690
- curlimages/
691
# -- GONE in 0.9.0: the Kyverno board (dashboards/kyverno-security/) is
692
# delivered by charts/monitoring with every other board in dashboards/ (its
693
# `dashboards.enabled`) — one Kyverno per cluster, one board, and it belongs
694
# where the rest of the cluster's boards live. `grafanaDashboard` (both the
695
# bool and the map shape) and `grafanaDashboardNamespace` are REFUSED if
696
# set, with the new location named.
697
# -- Cosign image signature verification
698
cosign:
699
# -- Enable image signature verification via Cosign
700
enabled: false
701
# -- Image patterns requiring valid signatures
702
imagePatterns:
703
- "ghcr.io/bmscomp/*"
704
# -- Cosign public key (PEM format) — set via --set-file or Secrets
705
publicKey: ""
706
# -- Auto-generate default-deny NetworkPolicies for new namespaces
707
networkPolicyGeneration:
708
enabled: false
709
# -- Namespaces to exclude from default-deny generation
710
excludeNamespaces:
711
- kube-system
712
- kube-public
713
- kube-node-lease
714
- kyverno
715
- strimzi-operator
716
- monitoring
717
- kafka
718
- cert-manager
719
- litmus
720
- "kates-detect-*"
721
# -- PolicyExceptions for dev/test namespaces
722
policyExceptions:
723
# -- Enable PolicyException resources
724
enabled: false
725
# -- Dev namespaces where policies are relaxed
726
namespaces:
727
- kates-dev
728
- kates-staging
729
# -- Policies to create exceptions for
730
exemptPolicies:
731
- kates-pod-security-standards
732
# -- Rules to exempt in dev namespaces
733
exemptRules:
734
- validate-readonly-rootfs
735
- require-resource-limits
736
- disallow-latest-tag
737
# -- Monitoring integration
738
monitoring:
739
# -- Enable telemetry export (Jaeger)
740
enabled: true
741
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.